nixos-26.05 removed lix_2_93, which the lix-module release-2.93 branch
hard-pins via lixFromNixpkgs (no 2.94 module release exists yet). Drop
the lix-module input and set nix.package = pkgs.lix, which is Lix 2.94.2
on 26.05 — so we stay on Lix, just sourced from nixpkgs.
Also: newer disko dropped the btrfs `label` option; pass -L nixos via
extraArgs instead so the impermanence rollback still finds the "nixos"
label.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
nixos-25.11 reached end-of-life (frozen upstream at b6018f8), so
`nix flake update` no longer pulls system package updates. Move the
default nixpkgs channel to the current stable release, nixos-26.05.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`just update system` re-locks + rebuilds the NixOS system flake,
`just update home` re-locks + switches the Home Manager flake, and
`just update` with no arg does both (system first). Previously update
only touched the system flake, leaving the Home Manager side stale.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Thunar didn't integrate cleanly with the GNOME session. Drop the
XFCE file-manager module (thunar/xfconf/exo/tumbler) and restore
Nautilus as the native file manager: un-exclude nautilus, point the
dash favorite at org.gnome.Nautilus.desktop, remove the Thunar
desktop override, and keep gvfs (moved into gnome.nix) for mounting,
trash, and network shares. Add file-roller for archive-manager
integration in Nautilus.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Strict RPF (NixOS default) drops the encrypted return traffic of an active
exit node: table 52's 'default dev tailscale0' makes the reverse-path lookup
for packets arriving on the physical interface resolve to tailscale0, so they
are dropped before Tailscale decrypts them (rx stays 0). Loose RPF still blocks
spoofed/unroutable sources but removes the interface-match requirement, as
recommended by Tailscale/NixOS for exit nodes and subnet routers.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Eagerly calling __bp_install at source time made bash-preexec install
before starship/atuin/zoxide/ghostty modified PROMPT_COMMAND, so their
hooks landed after __bp_interactive_mode. bash-preexec then never marked
typed commands as interactive and skipped preexec_functions, so atuin's
__atuin_preexec never fired and history stopped recording
(ATUIN_PREEXEC_BACKEND stuck at "<shlvl>:none").
Remove the eager __bp_install and the manual PROMPT_COMMAND/array wiring
for starship, atuin and zoxide; each tool registers with bash-preexec
itself, and deferred install on the first prompt keeps
__bp_interactive_mode last (verified against bash-preexec 0.6.0).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
