flake: update inputs

Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/573c650e8a14b2faa0041645ab18aed7e60f0c9a' (2025-03-13)
  → 'github:NixOS/nixpkgs/a48741b083d4f36dd79abd9f760c84da6b4dc0e5' (2025-06-29)

.gitea/workflows/build.yml

@@ -16,9 +16,7 @@ jobs:
       - name: Checkout repository
         uses: https://gitea.com/actions/checkout@v3
       - name: Install nix
-        uses: https://github.com/cachix/install-nix-action@v23
+        uses: https://github.com/cachix/install-nix-action@v24
-        with:
-          github_access_token: ${{ secrets.INPUT_GITHUB_ACCESS_TOKEN }}
       - name: Check ${{ matrix.check }}
         # Depends on nixos/nix#7759 to simply `nix flake check`
         run: nix run .#checks.$(nix eval --raw --impure --expr "builtins.currentSystem").${{ matrix.check }}
@@ -48,7 +46,7 @@ jobs:
     - name: Checkout repository
       uses: https://gitea.com/actions/checkout@v3
     - name: Install nix
-      uses: https://github.com/cachix/install-nix-action@v23
+      uses: https://github.com/cachix/install-nix-action@v24
     - name: Show nixpkgs version
       run: nix eval --impure --expr '(import ./flake-compat.nix { src = ./.; }).lib.version'
     - name: Setup cachix

.gitea/workflows/update.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: cachix/install-nix-action@v23
         with:
           extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            access-tokens = github.com=${{ secrets.INPUT_GITHUB_ACCESS_TOKEN }}
       - name: "flake: update inputs"
         uses: DeterminateSystems/update-flake-lock@v20
         with:

flake.lock

@@ -5,11 +5,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1731533236,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1704008649,
+        "lastModified": 1751180975,
-        "narHash": "sha256-rGPSWjXTXTurQN9beuHdyJhB8O761w1Zc5BqSSmHvoM=",
+        "narHash": "sha256-BKk4yDiXr4LdF80OTVqYJ53Q74rOcA/82EClXug8xsY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d44d59d2b5bd694cd9d996fd8c51d03e3e9ba7f7",
+        "rev": "a48741b083d4f36dd79abd9f760c84da6b4dc0e5",
         "type": "github"
       },
       "original": {

modules/default.nix

@@ -4,6 +4,7 @@
   amdgpu-pwm = ./services/hardware/amdgpu-pwm.nix;
   betanin = ./services/web-apps/betanin.nix;
   dunst = ./services/x11/dunst.nix;
+  koillection = ./services/web-apps/koillection.nix;
   porkbun-ddns = ./services/networking/porkbun-ddns.nix;
   radeon-profile-daemon = ./services/hardware/radeon-profile-daemon.nix;
 }

modules/services/web-apps/betanin.nix

@@ -6,15 +6,11 @@ let
 
   cfg = config.services.betanin;
 
-  defaultUser = "betanin";
-  defaultGroup = "betanin";
-
   settingsFormat = pkgs.formats.toml { };
   beetsFormat = pkgs.formats.yaml { };
 in
 {
-  options = {
+  options.services.betanin = {
-    services.betanin = {
     enable = lib.mkEnableOption "betanin";
 
     package = mkOption {
@@ -38,13 +34,13 @@ in
     user = mkOption {
       description = "User that the betanin program should run under.";
       type = types.str;
-        default = defaultUser;
+      default = "betanin";
     };
 
     group = mkOption {
       description = "Group that the betanin program should run under.";
       type = types.str;
-        default = defaultGroup;
+      default = "betanin";
     };
 
     dataDir = mkOption {
@@ -60,7 +56,7 @@ in
         {
           frontend = {
             username = "foo";
-              password { _secret = "/run/secrets/betaninPasswordFile"; };
+            password = { _secret = "/run/secrets/betaninPasswordFile"; };
           };
           clients = {
             api_key = { _secret = "/run/secrets/betaninApiKeyFile"; };
@@ -70,7 +66,7 @@ in
           };
         }
       '';
-        description = lib.mdDoc ''
+      description = ''
         Configuration for betanin.
 
         Options containing secret data should be set to an attribute set
@@ -82,8 +78,7 @@ in
     beets.settings = mkOption {
       type = beetsFormat.type;
       default = { };
-        description = lib.mdDoc "Configuration for beets used by betanin.";
+      description = "Configuration for beets used by betanin.";
-      };
     };
   };
 
@@ -123,17 +118,14 @@ in
       {
         description = "Betanin service";
         wantedBy = [ "multi-user.target" ];
-        after = [ "networking.target" ];
+        after = [ "network.target" ];
+        path = [ pkgs.replace-secret ];
+
         environment = {
           HOME = cfg.dataDir;
         };
-        path = [ pkgs.replace-secret ];
 
         script = ''
-          mkdir -p ${cfg.dataDir}/.config/betanin \
-            ${cfg.dataDir}/.local/share/betanin \
-            ${cfg.dataDir}/.config/beets
-
           ln -sf ${beetsFile} ${cfg.dataDir}/.config/beets/config.yaml
           cat ${settingsFile} > ${cfg.dataDir}/.config/betanin/config.toml
           ${secretReplacements}
@@ -141,28 +133,34 @@ in
           ${cfg.package}/bin/betanin --port ${toString cfg.port}
         '';
 
-        serviceConfig = lib.mkMerge [
+        serviceConfig = {
-          {
           User = cfg.user;
           Group = cfg.group;
           PrivateTmp = true;
           Restart = "always";
           WorkingDirectory = cfg.dataDir;
-          }
+          StateDirectory = mkIf (cfg.dataDir == "/var/lib/betanin") "betanin";
-          (mkIf (cfg.dataDir == "/var/lib/betanin") {
+        };
-            StateDirectory = "betanin";
-          })
-        ];
       };
 
-    users.users = optionalAttrs (cfg.user == defaultUser) {
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/.config                    0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/.config/betanin            0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/.config/beets              0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/.local                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/.local/share               0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/.local/share/betanin       0750 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    users.users = optionalAttrs (cfg.user == "betanin") {
       ${cfg.user} = {
         isSystemUser = true;
         group = cfg.group;
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == defaultGroup) {
+    users.groups = optionalAttrs (cfg.group == "betanin") {
       ${cfg.group} = { };
     };
   };

modules/services/web-apps/koillection.nix

@@ -0,0 +1,318 @@
+{ config, lib, modulesPath, options, pkgs, ... }:
+let
+  inherit (lib) literalExpression mkEnableOption mkIf mkOption optionalString types;
+
+  opt = options.services.koillection;
+  cfg = config.services.koillection;
+  db = cfg.database;
+
+  koillection = (pkgs.koillection or pkgs.callPackage ../../../pkgs/by-name/ko/koillection/package.nix { }).override {
+    dataDir = cfg.dataDir;
+  };
+  inherit (koillection.passthru) phpPackage;
+in
+{
+  options.services.koillection = {
+    enable = mkEnableOption "Koillection, a collection manager";
+
+    user = mkOption {
+      type = types.str;
+      default = "koillection";
+      description = lib.mdDoc "User Koillection runs as.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "koillection";
+      description = lib.mdDoc "Group Koillection runs as.";
+    };
+
+    hostName = lib.mkOption {
+      type = types.str;
+      default = config.networking.fqdnOrHostName;
+      defaultText = "config.networking.fqdnOrHostName";
+      example = "koillection.example.com";
+      description = lib.mdDoc "The hostname to serve Koillection on.";
+    };
+
+    dataDir = mkOption {
+      description = lib.mdDoc "Koillection data directory";
+      default = "/var/lib/koillection";
+      type = types.path;
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = if db.createLocally then "/run/postgresql" else null;
+        defaultText = literalExpression ''
+          if config.${opt.database.createLocally}
+          then "/run/postgresql"
+          else null
+        '';
+        example = "192.168.12.85";
+        description = lib.mdDoc "Database host address or unix socket.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 5432;
+        description = lib.mdDoc "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "koillection";
+        description = lib.mdDoc "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = cfg.user;
+        defaultText = literalExpression "user";
+        description = lib.mdDoc "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/koillection-dbpassword";
+        description = lib.mdDoc ''
+          A file containing the password corresponding to
+          {option}`database.user`.
+        '';
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc "Create the database and database user locally.";
+      };
+    };
+
+    poolConfig = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for the bookstack PHP pool. See the documentation on `php-fpm.conf`
+        for details on configuration directives.
+      '';
+    };
+
+    nginx = mkOption {
+      type = types.submodule (
+        lib.recursiveUpdate
+          (import "${modulesPath}/services/web-servers/nginx/vhost-options.nix" { inherit config lib; })
+          { }
+      );
+      default = { };
+      example = literalExpression ''
+        {
+          serverAliases = [
+            "koillection.''${config.networking.domain}"
+          ];
+          # To enable encryption and let let's encrypt take care of certificate
+          forceSSL = true;
+          enableACME = true;
+        }
+      '';
+      description = lib.mdDoc ''
+        With this option, you can customize the nginx virtualHost settings.
+      '';
+    };
+
+    config = mkOption {
+      type = with types;
+        attrsOf
+          (nullOr
+            (either
+              (oneOf [ bool int port path str ])
+              (submodule {
+                options = {
+                  _secret = mkOption {
+                    type = nullOr str;
+                    description = lib.mdDoc ''
+                      The path to a file containing the value the option should
+                      be set to in the final configuration file.
+                    '';
+                  };
+                };
+              })));
+      default = { };
+      example = literalExpression ''
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.koillection.config = {
+      APP_ENV = "prod";
+      # DB_DRIVER = "pdo_pgsql";
+      DB_USER = db.user;
+      DB_PASSWORD._secret = db.passwordFile;
+      DB_HOST = db.host;
+      DB_PORT = db.port;
+      DB_NAME = db.name;
+      # FIXME
+      # DB_VERSION = lib.versions.major config.services.postgresql.package.version;
+      DB_VERSION = "15";
+      PHP_TZ = config.time.timeZone;
+    };
+
+    services.postgresql = mkIf db.createLocally {
+      enable = true;
+      ensureDatabases = [ db.name ];
+      ensureUsers = [{
+        name = db.user;
+        ensureDBOwnership = true;
+      }];
+    };
+
+    services.phpfpm.pools.koillection = {
+      inherit (cfg) user group;
+      inherit phpPackage;
+      # Copied from docker/php.ini
+      phpOptions = ''
+        max_execution_time = 200
+
+        apc.enabled = 1
+        apc.shm_size = 64M
+        apc.ttl = 7200
+
+        opcache.enable = 1
+        opcache.memory_consumption = 256
+        opcache.max_accelerated_files = 20000
+        opcache.max_wasted_percentage = 10
+        opcache.validate_timestamps = 0
+        opcache.preload = ${koillection}/share/php/koillection/config/preload.php
+        opcache.preload_user = ${cfg.user}
+        expose_php = Off
+
+        session.cookie_httponly = 1
+        realpath_cache_size = 4096K
+        realpath_cache_ttle = 600
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = cfg.user;
+        "listen.group" = cfg.group;
+      } // cfg.poolConfig;
+    };
+
+    services.nginx = {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.hostName}" = lib.mkMerge [
+        cfg.nginx
+        {
+          root = lib.mkForce "${koillection}/share/php/koillection/public";
+          extraConfig = optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;";
+          locations = {
+            "/" = {
+              index = "index.php";
+              extraConfig = ''try_files $uri $uri/ /index.php?query_string;'';
+            };
+            "~ \.php$" = {
+              extraConfig = ''
+                try_files $uri $uri/ /index.php?$query_string;
+                include ${config.services.nginx.package}/conf/fastcgi_params;
+                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+                fastcgi_param REDIRECT_STATUS 200;
+                fastcgi_pass unix:${config.services.phpfpm.pools."koillection".socket};
+                ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"}
+              '';
+            };
+            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+              extraConfig = "expires 365d;";
+            };
+          };
+        }
+      ];
+    };
+
+    systemd.services.koillection-setup = {
+      description = "Preparation tasks for koillection";
+      before = [ "phpfpm-koillection.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        WorkingDirectory = koillection;
+        RuntimeDirectory = "koillection/cache";
+        RuntimeDirectoryMode = "0700";
+      };
+      path = [ pkgs.replace-secret ];
+      script =
+        let
+          isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
+          koillectionEnvVars = lib.generators.toKeyValue {
+            mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+              mkValueString = v: with builtins;
+                if isInt v then toString v
+                else if lib.isString v then v
+                else if true == v then "true"
+                else if false == v then "false"
+                else if isSecret v then hashString "sha256" v._secret
+                else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}";
+            };
+          };
+          secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
+          mkSecretReplacement = file: ''
+            replace-secret ${lib.escapeShellArgs [ ( builtins.hashString "sha256" file ) file "${cfg.dataDir}/.env" ]}
+          '';
+          secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+          filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! builtins.elem v [{ } null])) cfg.config;
+          koillectionEnv = pkgs.writeText "koillection.env" (koillectionEnvVars filteredConfig);
+        in
+        ''
+          # error handling
+          set -euo pipefail
+
+          # set permissions
+          umask 077
+
+          # create .env file
+          install -T -m 0600 -o ${cfg.user} ${koillectionEnv} "${cfg.dataDir}/.env"
+          ${secretReplacements}
+
+          # prepend `base64:` if it does not exist in APP_KEY
+
+          if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+              sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+          fi
+
+          # migrate db
+          ${lib.getExe phpPackage} ${koillection}/share/php/koillection/bin/console doctrine:migrations:migrate --no-interaction --allow-no-migration
+
+          # dump translations
+          # TODO: Might need pointing somewhere else.
+          ${lib.getExe phpPackage} ${koillection}/share/php/koillection/bin/console app:translations:dump
+        '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/var                        0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/var/cache                  0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/var/cache/prod             0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.dataDir}/var/logs                   0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    users = {
+      users = mkIf (cfg.user == "koillection") {
+        koillection = {
+          inherit (cfg) group;
+          isSystemUser = true;
+        };
+        "${config.services.nginx.user}".extraGroups = [ cfg.group ];
+      };
+      groups = mkIf (cfg.group == "koillection") {
+        koillection = { };
+      };
+    };
+  };
+}

pkgs/by-name/at/atlauncher/package.nix

@@ -1,46 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, makeWrapper
-, jdk17
-, udev
-, xorg
-}:
-
-stdenv.mkDerivation rec {
-  pname = "atlauncher";
-  version = "3.4.35.4";
-
-  src = fetchurl {
-    url = "https://github.com/ATLauncher/ATLauncher/releases/download/v${version}/ATLauncher-${version}.jar";
-    hash = "sha256-M8ygN70yizJM6VEffBh/lH/DneKAzQ5UFzc3g51dja0=";
-  };
-
-  dontUnpack = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share/java
-    cp $src $out/share/java/ATLauncher.jar
-    makeWrapper ${jdk17}/bin/java $out/bin/atlauncher \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ xorg.libXxf86vm udev ]}" \
-      --add-flags "-jar $out/share/java/ATLauncher.jar" \
-      --add-flags "--working-dir \''${XDG_DATA_HOME:-\$HOME/.local/share}/ATLauncher" \
-      --add-flags "--no-launcher-update"
-  '';
-
-  meta = {
-    description = "Minecraft launcher";
-    longDescription = ''
-      ATLauncher is a Launcher for Minecraft which integrates multiple different
-      ModPacks to allow you to download and install ModPacks easily and quickly.
-    '';
-    sourceProvenance = [
-      (lib.sourceTypes.binaryBytecode or { shortName = "binaryBytecode"; isSource = false; })
-    ];
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.all;
-    homepage = "https://atlauncher.com/";
-  };
-}

pkgs/by-name/be/betanin/client/composition.nix

@@ -1,17 +0,0 @@
-# This file has been generated by node2nix 1.11.1. Do not edit!
-
-{pkgs ? import <nixpkgs> {
-    inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}:
-
-let
-  nodeEnv = import ./node-env.nix {
-    inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript;
-    inherit pkgs nodejs;
-    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
-  };
-in
-import ./packages.nix {
-  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
-  inherit nodeEnv;
-}

pkgs/by-name/be/betanin/client/default.nix

@@ -1,21 +0,0 @@
-{ pkgs
-, stdenv
-, src
-, version
-}:
-
-let
-  nodeComposition = import ./composition.nix {
-    inherit pkgs;
-    inherit (stdenv.hostPlatform) system;
-  };
-in
-nodeComposition.package.override {
-  pname = "betanin";
-  inherit version;
-  src = "${src}/betanin_client";
-
-  postInstall = ''
-    PRODUCTION=true npm run-script build
-  '';
-}

pkgs/by-name/be/betanin/client/generate.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-# Requires node2nix and jq
-
-cd "$(dirname "$0")" || exit 1
-
-set -euo pipefail
-
-nix build ..#betanin.src 2>/dev/null
-
-tempDir=$(mktemp -d)
-cp result/betanin_client/package.json "$tempDir/"
-cp result/betanin_client/package-lock.json "$tempDir/"
-pushd "$tempDir"
-
-node2nix \
-    --input package.json \
-    --lock package-lock.json \
-    --output packages.nix \
-    --composition composition.nix \
-    --strip-optional-dependencies \
-    --development \
-    --nodejs-18
-
-popd
-cp "$tempDir"/*.nix .
-
-rm result
-rm -rf "$tempDir"

pkgs/by-name/be/betanin/client/node-env.nix

@@ -1,689 +0,0 @@
-# This file originates from node2nix
-
-{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
-
-let
-  # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
-  utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
-
-  python = if nodejs ? python then nodejs.python else python2;
-
-  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
-  tarWrapper = runCommand "tarWrapper" {} ''
-    mkdir -p $out/bin
-
-    cat > $out/bin/tar <<EOF
-    #! ${stdenv.shell} -e
-    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
-    EOF
-
-    chmod +x $out/bin/tar
-  '';
-
-  # Function that generates a TGZ file from a NPM project
-  buildNodeSourceDist =
-    { name, version, src, ... }:
-
-    stdenv.mkDerivation {
-      name = "node-tarball-${name}-${version}";
-      inherit src;
-      buildInputs = [ nodejs ];
-      buildPhase = ''
-        export HOME=$TMPDIR
-        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
-      '';
-      installPhase = ''
-        mkdir -p $out/tarballs
-        mv $tgzFile $out/tarballs
-        mkdir -p $out/nix-support
-        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
-      '';
-    };
-
-  # Common shell logic
-  installPackage = writeShellScript "install-package" ''
-    installPackage() {
-      local packageName=$1 src=$2
-
-      local strippedName
-
-      local DIR=$PWD
-      cd $TMPDIR
-
-      unpackFile $src
-
-      # Make the base dir in which the target dependency resides first
-      mkdir -p "$(dirname "$DIR/$packageName")"
-
-      if [ -f "$src" ]
-      then
-          # Figure out what directory has been unpacked
-          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
-
-          # Restore write permissions to make building work
-          find "$packageDir" -type d -exec chmod u+x {} \;
-          chmod -R u+w "$packageDir"
-
-          # Move the extracted tarball into the output folder
-          mv "$packageDir" "$DIR/$packageName"
-      elif [ -d "$src" ]
-      then
-          # Get a stripped name (without hash) of the source directory.
-          # On old nixpkgs it's already set internally.
-          if [ -z "$strippedName" ]
-          then
-              strippedName="$(stripHash $src)"
-          fi
-
-          # Restore write permissions to make building work
-          chmod -R u+w "$strippedName"
-
-          # Move the extracted directory into the output folder
-          mv "$strippedName" "$DIR/$packageName"
-      fi
-
-      # Change to the package directory to install dependencies
-      cd "$DIR/$packageName"
-    }
-  '';
-
-  # Bundle the dependencies of the package
-  #
-  # Only include dependencies if they don't exist. They may also be bundled in the package.
-  includeDependencies = {dependencies}:
-    lib.optionalString (dependencies != []) (
-      ''
-        mkdir -p node_modules
-        cd node_modules
-      ''
-      + (lib.concatMapStrings (dependency:
-        ''
-          if [ ! -e "${dependency.packageName}" ]; then
-              ${composePackage dependency}
-          fi
-        ''
-      ) dependencies)
-      + ''
-        cd ..
-      ''
-    );
-
-  # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
-    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
-      installPackage "${packageName}" "${src}"
-      ${includeDependencies { inherit dependencies; }}
-      cd ..
-      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-    '';
-
-  pinpointDependencies = {dependencies, production}:
-    let
-      pinpointDependenciesFromPackageJSON = writeTextFile {
-        name = "pinpointDependencies.js";
-        text = ''
-          var fs = require('fs');
-          var path = require('path');
-
-          function resolveDependencyVersion(location, name) {
-              if(location == process.env['NIX_STORE']) {
-                  return null;
-              } else {
-                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
-
-                  if(fs.existsSync(dependencyPackageJSON)) {
-                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
-
-                      if(dependencyPackageObj.name == name) {
-                          return dependencyPackageObj.version;
-                      }
-                  } else {
-                      return resolveDependencyVersion(path.resolve(location, ".."), name);
-                  }
-              }
-          }
-
-          function replaceDependencies(dependencies) {
-              if(typeof dependencies == "object" && dependencies !== null) {
-                  for(var dependency in dependencies) {
-                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
-
-                      if(resolvedVersion === null) {
-                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
-                      } else {
-                          dependencies[dependency] = resolvedVersion;
-                      }
-                  }
-              }
-          }
-
-          /* Read the package.json configuration */
-          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
-
-          /* Pinpoint all dependencies */
-          replaceDependencies(packageObj.dependencies);
-          if(process.argv[2] == "development") {
-              replaceDependencies(packageObj.devDependencies);
-          }
-          else {
-              packageObj.devDependencies = {};
-          }
-          replaceDependencies(packageObj.optionalDependencies);
-          replaceDependencies(packageObj.peerDependencies);
-
-          /* Write the fixed package.json file */
-          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
-        '';
-      };
-    in
-    ''
-      node ${pinpointDependenciesFromPackageJSON} ${if production then "production" else "development"}
-
-      ${lib.optionalString (dependencies != [])
-        ''
-          if [ -d node_modules ]
-          then
-              cd node_modules
-              ${lib.concatMapStrings (dependency: pinpointDependenciesOfPackage dependency) dependencies}
-              cd ..
-          fi
-        ''}
-    '';
-
-  # Recursively traverses all dependencies of a package and pinpoints all
-  # dependencies in the package.json file to the versions that are actually
-  # being used.
-
-  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
-    ''
-      if [ -d "${packageName}" ]
-      then
-          cd "${packageName}"
-          ${pinpointDependencies { inherit dependencies production; }}
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-      fi
-    '';
-
-  # Extract the Node.js source code which is used to compile packages with
-  # native bindings
-  nodeSources = runCommand "node-sources" {} ''
-    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
-    mv node-* $out
-  '';
-
-  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
-  addIntegrityFieldsScript = writeTextFile {
-    name = "addintegrityfields.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      function augmentDependencies(baseDir, dependencies) {
-          for(var dependencyName in dependencies) {
-              var dependency = dependencies[dependencyName];
-
-              // Open package.json and augment metadata fields
-              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
-              var packageJSONPath = path.join(packageJSONDir, "package.json");
-
-              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
-                  console.log("Adding metadata fields to: "+packageJSONPath);
-                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
-
-                  if(dependency.integrity) {
-                      packageObj["_integrity"] = dependency.integrity;
-                  } else {
-                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
-                  }
-
-                  if(dependency.resolved) {
-                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
-                  } else {
-                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
-                  }
-
-                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
-                      packageObj["_from"] = dependency.from;
-                  }
-
-                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
-              }
-
-              // Augment transitive dependencies
-              if(dependency.dependencies !== undefined) {
-                  augmentDependencies(packageJSONDir, dependency.dependencies);
-              }
-          }
-      }
-
-      if(fs.existsSync("./package-lock.json")) {
-          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
-
-          if(![1, 2].includes(packageLock.lockfileVersion)) {
-            process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
-            process.exit(1);
-          }
-
-          if(packageLock.dependencies !== undefined) {
-              augmentDependencies(".", packageLock.dependencies);
-          }
-      }
-    '';
-  };
-
-  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
-  reconstructPackageLock = writeTextFile {
-    name = "reconstructpackagelock.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      var packageObj = JSON.parse(fs.readFileSync("package.json"));
-
-      var lockObj = {
-          name: packageObj.name,
-          version: packageObj.version,
-          lockfileVersion: 2,
-          requires: true,
-          packages: {
-              "": {
-                  name: packageObj.name,
-                  version: packageObj.version,
-                  license: packageObj.license,
-                  bin: packageObj.bin,
-                  dependencies: packageObj.dependencies,
-                  engines: packageObj.engines,
-                  optionalDependencies: packageObj.optionalDependencies
-              }
-          },
-          dependencies: {}
-      };
-
-      function augmentPackageJSON(filePath, packages, dependencies) {
-          var packageJSON = path.join(filePath, "package.json");
-          if(fs.existsSync(packageJSON)) {
-              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
-              packages[filePath] = {
-                  version: packageObj.version,
-                  integrity: "sha1-000000000000000000000000000=",
-                  dependencies: packageObj.dependencies,
-                  engines: packageObj.engines,
-                  optionalDependencies: packageObj.optionalDependencies
-              };
-              dependencies[packageObj.name] = {
-                  version: packageObj.version,
-                  integrity: "sha1-000000000000000000000000000=",
-                  dependencies: {}
-              };
-              processDependencies(path.join(filePath, "node_modules"), packages, dependencies[packageObj.name].dependencies);
-          }
-      }
-
-      function processDependencies(dir, packages, dependencies) {
-          if(fs.existsSync(dir)) {
-              var files = fs.readdirSync(dir);
-
-              files.forEach(function(entry) {
-                  var filePath = path.join(dir, entry);
-                  var stats = fs.statSync(filePath);
-
-                  if(stats.isDirectory()) {
-                      if(entry.substr(0, 1) == "@") {
-                          // When we encounter a namespace folder, augment all packages belonging to the scope
-                          var pkgFiles = fs.readdirSync(filePath);
-
-                          pkgFiles.forEach(function(entry) {
-                              if(stats.isDirectory()) {
-                                  var pkgFilePath = path.join(filePath, entry);
-                                  augmentPackageJSON(pkgFilePath, packages, dependencies);
-                              }
-                          });
-                      } else {
-                          augmentPackageJSON(filePath, packages, dependencies);
-                      }
-                  }
-              });
-          }
-      }
-
-      processDependencies("node_modules", lockObj.packages, lockObj.dependencies);
-
-      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
-    '';
-  };
-
-  # Script that links bins defined in package.json to the node_modules bin directory
-  # NPM does not do this for top-level packages itself anymore as of v7
-  linkBinsScript = writeTextFile {
-    name = "linkbins.js";
-    text = ''
-      var fs = require('fs');
-      var path = require('path');
-
-      var packageObj = JSON.parse(fs.readFileSync("package.json"));
-
-      var nodeModules = Array(packageObj.name.split("/").length).fill("..").join(path.sep);
-
-      if(packageObj.bin !== undefined) {
-          fs.mkdirSync(path.join(nodeModules, ".bin"))
-
-          if(typeof packageObj.bin == "object") {
-              Object.keys(packageObj.bin).forEach(function(exe) {
-                  if(fs.existsSync(packageObj.bin[exe])) {
-                      console.log("linking bin '" + exe + "'");
-                      fs.symlinkSync(
-                          path.join("..", packageObj.name, packageObj.bin[exe]),
-                          path.join(nodeModules, ".bin", exe)
-                      );
-                  }
-                  else {
-                      console.log("skipping non-existent bin '" + exe + "'");
-                  }
-              })
-          }
-          else {
-              if(fs.existsSync(packageObj.bin)) {
-                  console.log("linking bin '" + packageObj.bin + "'");
-                  fs.symlinkSync(
-                      path.join("..", packageObj.name, packageObj.bin),
-                      path.join(nodeModules, ".bin", packageObj.name.split("/").pop())
-                  );
-              }
-              else {
-                  console.log("skipping non-existent bin '" + packageObj.bin + "'");
-              }
-          }
-      }
-      else if(packageObj.directories !== undefined && packageObj.directories.bin !== undefined) {
-          fs.mkdirSync(path.join(nodeModules, ".bin"))
-
-          fs.readdirSync(packageObj.directories.bin).forEach(function(exe) {
-              if(fs.existsSync(path.join(packageObj.directories.bin, exe))) {
-                  console.log("linking bin '" + exe + "'");
-                  fs.symlinkSync(
-                      path.join("..", packageObj.name, packageObj.directories.bin, exe),
-                      path.join(nodeModules, ".bin", exe)
-                  );
-              }
-              else {
-                  console.log("skipping non-existent bin '" + exe + "'");
-              }
-          })
-      }
-    '';
-  };
-
-  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
-    let
-      forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
-    in
-    ''
-        # Pinpoint the versions of all dependencies to the ones that are actually being used
-        echo "pinpointing versions of dependencies..."
-        source $pinpointDependenciesScriptPath
-
-        # Patch the shebangs of the bundled modules to prevent them from
-        # calling executables outside the Nix store as much as possible
-        patchShebangs .
-
-        # Deploy the Node.js package by running npm install. Since the
-        # dependencies have been provided already by ourselves, it should not
-        # attempt to install them again, which is good, because we want to make
-        # it Nix's responsibility. If it needs to install any dependencies
-        # anyway (e.g. because the dependency parameters are
-        # incomplete/incorrect), it fails.
-        #
-        # The other responsibilities of NPM are kept -- version checks, build
-        # steps, postprocessing etc.
-
-        export HOME=$TMPDIR
-        cd "${packageName}"
-        runHook preRebuild
-
-        ${lib.optionalString bypassCache ''
-          ${lib.optionalString reconstructLock ''
-            if [ -f package-lock.json ]
-            then
-                echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
-                echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
-                rm package-lock.json
-            else
-                echo "No package-lock.json file found, reconstructing..."
-            fi
-
-            node ${reconstructPackageLock}
-          ''}
-
-          node ${addIntegrityFieldsScript}
-        ''}
-
-        npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
-
-        runHook postRebuild
-
-        if [ "''${dontNpmInstall-}" != "1" ]
-        then
-            # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
-            rm -f npm-shrinkwrap.json
-
-            npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install
-        fi
-
-        # Link executables defined in package.json
-        node ${linkBinsScript}
-    '';
-
-  # Builds and composes an NPM package including all its dependencies
-  buildNodePackage =
-    { name
-    , packageName
-    , version ? null
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , preRebuild ? ""
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , meta ? {}
-    , ... }@args:
-
-    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
-    in
-    stdenv.mkDerivation ({
-      name = "${name}${if version == null then "" else "-${version}"}";
-      buildInputs = [ tarWrapper python nodejs ]
-        ++ lib.optional (stdenv.isLinux) utillinux
-        ++ lib.optional (stdenv.isDarwin) libtool
-        ++ buildInputs;
-
-      inherit nodejs;
-
-      inherit dontStrip; # Stripping may fail a build for some package deployments
-      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
-
-      compositionScript = composePackage args;
-      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
-
-      installPhase = ''
-        source ${installPackage}
-
-        # Create and enter a root node_modules/ folder
-        mkdir -p $out/lib/node_modules
-        cd $out/lib/node_modules
-
-        # Compose the package and all its dependencies
-        source $compositionScriptPath
-
-        ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
-
-        # Create symlink to the deployed executable folder, if applicable
-        if [ -d "$out/lib/node_modules/.bin" ]
-        then
-            ln -s $out/lib/node_modules/.bin $out/bin
-
-            # Fixup all executables
-            ls $out/bin/* | while read i
-            do
-                file="$(readlink -f "$i")"
-                chmod u+rwx "$file"
-                if isScript "$file"
-                then
-                    sed -i 's/\r$//' "$file"  # convert crlf to lf
-                fi
-            done
-        fi
-
-        # Create symlinks to the deployed manual page folders, if applicable
-        if [ -d "$out/lib/node_modules/${packageName}/man" ]
-        then
-            mkdir -p $out/share
-            for dir in "$out/lib/node_modules/${packageName}/man/"*
-            do
-                mkdir -p $out/share/man/$(basename "$dir")
-                for page in "$dir"/*
-                do
-                    ln -s $page $out/share/man/$(basename "$dir")
-                done
-            done
-        fi
-
-        # Run post install hook, if provided
-        runHook postInstall
-      '';
-
-      meta = {
-        # default to Node.js' platforms
-        platforms = nodejs.meta.platforms;
-      } // meta;
-    } // extraArgs);
-
-  # Builds a node environment (a node_modules folder and a set of binaries)
-  buildNodeDependencies =
-    { name
-    , packageName
-    , version ? null
-    , src
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
-    let
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
-    in
-      stdenv.mkDerivation ({
-        name = "node-dependencies-${name}${if version == null then "" else "-${version}"}";
-
-        buildInputs = [ tarWrapper python nodejs ]
-          ++ lib.optional (stdenv.isLinux) utillinux
-          ++ lib.optional (stdenv.isDarwin) libtool
-          ++ buildInputs;
-
-        inherit dontStrip; # Stripping may fail a build for some package deployments
-        inherit dontNpmInstall unpackPhase buildPhase;
-
-        includeScript = includeDependencies { inherit dependencies; };
-        pinpointDependenciesScript = pinpointDependenciesOfPackage args;
-
-        passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
-
-        installPhase = ''
-          source ${installPackage}
-
-          mkdir -p $out/${packageName}
-          cd $out/${packageName}
-
-          source $includeScriptPath
-
-          # Create fake package.json to make the npm commands work properly
-          cp ${src}/package.json .
-          chmod 644 package.json
-          ${lib.optionalString bypassCache ''
-            if [ -f ${src}/package-lock.json ]
-            then
-                cp ${src}/package-lock.json .
-                chmod 644 package-lock.json
-            fi
-          ''}
-
-          # Go to the parent folder to make sure that all packages are pinpointed
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-
-          ${prepareAndInvokeNPM { inherit packageName bypassCache reconstructLock npmFlags production; }}
-
-          # Expose the executables that were installed
-          cd ..
-          ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
-
-          mv ${packageName} lib
-          ln -s $out/lib/node_modules/.bin $out/bin
-        '';
-      } // extraArgs);
-
-  # Builds a development shell
-  buildNodeShell =
-    { name
-    , packageName
-    , version ? null
-    , src
-    , dependencies ? []
-    , buildInputs ? []
-    , production ? true
-    , npmFlags ? ""
-    , dontNpmInstall ? false
-    , bypassCache ? false
-    , reconstructLock ? false
-    , dontStrip ? true
-    , unpackPhase ? "true"
-    , buildPhase ? "true"
-    , ... }@args:
-
-    let
-      nodeDependencies = buildNodeDependencies args;
-      extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "unpackPhase" "buildPhase" ];
-    in
-    stdenv.mkDerivation ({
-      name = "node-shell-${name}${if version == null then "" else "-${version}"}";
-
-      buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux ++ buildInputs;
-      buildCommand = ''
-        mkdir -p $out/bin
-        cat > $out/bin/shell <<EOF
-        #! ${stdenv.shell} -e
-        $shellHook
-        exec ${stdenv.shell}
-        EOF
-        chmod +x $out/bin/shell
-      '';
-
-      # Provide the dependencies in a development shell through the NODE_PATH environment variable
-      inherit nodeDependencies;
-      shellHook = lib.optionalString (dependencies != []) ''
-        export NODE_PATH=${nodeDependencies}/lib/node_modules
-        export PATH="${nodeDependencies}/bin:$PATH"
-      '';
-    } // extraArgs);
-in
-{
-  buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
-  buildNodePackage = lib.makeOverridable buildNodePackage;
-  buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
-  buildNodeShell = lib.makeOverridable buildNodeShell;
-}

pkgs/by-name/be/betanin/package.nix

@@ -1,43 +1,54 @@
 { lib
-, callPackage
+, buildNpmPackage
 , fetchFromGitHub
 , python3
 , beets
 }:
 
 let
-  py = python3.pkgs;
+  version = "0.5.6";
-
-  version = "0.4.0.ffe45c02";
 
   src = fetchFromGitHub {
-    owner = "xeals";
+    owner = "sentriz";
     repo = "betanin";
-    rev = "ffe45c028037fc1659f62a9cdc9e1413dc2f358d";
+    rev = "v${version}";
-    hash = "sha256-5d8Y7PDlhkdVRVX+KvpiQ2WYNRELwc+ya5s4Qi+YQpI=";
+    hash = "sha256-8JzZfxXzey6vGwsnpXTea/gTMFwmeeavimn5njHIEg0=";
   };
 
-  client = callPackage ./client {
+  client = buildNpmPackage {
-    inherit src version;
+    pname = "betanin_client";
-  };
-in
-py.buildPythonApplication {
-  pname = "betanin";
     inherit version src;
 
-  clientDistDir = "${client}/lib/node_modules/betanin/dist/";
+    sourceRoot = "${src.name}/betanin_client";
 
-  doCheck = false;
+    npmDepsHash = "sha256-VkCQKpkDCTDejv8eRAN2Zfbq8TlWLdtqVJU3fo9hQrI=";
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    npmInstallFlags = [ "--include=dev" ];
+    installPhase = ''
+      cp -r dist $out
+    '';
+  };
+in
+python3.pkgs.buildPythonApplication {
+  pname = "betanin";
+  inherit version src;
+  format = "pyproject";
 
   patches = [ ./paths.patch ];
   postPatch = ''
+    export clientDistDir="${client}"
     export libPrefix="${python3.libPrefix}"
     substituteAllInPlace betanin/paths.py
+
+    # pythonRelaxDepsHook doesn't work
+    sed -i 's/Flask <3.0.0/Flask/' pyproject.toml
   '';
 
-  propagatedBuildInputs =
+  build-system = with python3.pkgs; [ setuptools ];
-    (builtins.attrValues {
+
-      inherit (py)
+  dependencies = (with python3.pkgs; [
     apprise
     alembic
     click
@@ -56,8 +67,8 @@ py.buildPythonApplication {
     python-socketio
     sqlalchemy
     sqlalchemy-utils
-        toml;
+    toml
-    }) ++ [
+  ]) ++ [
     beets
   ];
 
@@ -66,6 +77,6 @@ py.buildPythonApplication {
     description = "beets based mitm of your torrent client and music player";
     license = lib.licenses.gpl3Only;
     maintainers = [ ];
-    platforms = python3.meta.platforms;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/cu/cura5/package.nix

@@ -33,7 +33,7 @@ let
       fi
       args+=("$a")
     done
-    exec "${cura5}/bin/${name}" "''${args[@]}"
+    QT_QPA_PLATFORM=xcb exec "${cura5}/bin/cura5" "''${args[@]}"
   '';
 in
 stdenv.mkDerivation rec {

pkgs/by-name/ge/gersemi/package.nix

@@ -1,35 +0,0 @@
-{ lib
-, python3
-, fetchPypi
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "gersemi";
-  version = "0.10.0";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Gd3wZNbBIYo2i0n1DlyHg3s5c+BBJ0nppMw8IVcfKUM=";
-  };
-
-  # Remove dataclasses backport requirement since it doesn't work on newer
-  # Python.
-  patchPhase = ''
-    sed -i '/dataclasses/d' setup.py
-  '';
-
-  propagatedBuildInputs = with python3.pkgs; [
-    appdirs
-    colorama
-    lark
-    pyyaml
-  ];
-
-  meta = {
-    description = "A formatter to make your CMake code the real treasure";
-    homepage = "https://github.com/BlankSpruce/gersemi";
-    license = lib.licenses.mpl20;
-    platforms = python3.meta.platforms;
-  };
-}

pkgs/by-name/ko/koillection/koillection-dirs.patch

@@ -0,0 +1,25 @@
+*** a/src/Kernel.php
+--- b/src/Kernel.php
+@@ -8,6 +8,21 @@ class Kernel extends BaseKernel
+ use Symfony\Component\HttpKernel\Kernel as BaseKernel;
+ 
+ class Kernel extends BaseKernel
+ {
+     use MicroKernelTrait;
++
++    public function getDataDir(): string
++    {
++        return '@dataDir@';
++    }
++
++    public function getCacheDir(): string
++    {
++        return $this->getDataDir() . '/var/cache/' . $this->getEnvironment();
++    }
++
++    public function getLogDir(): string
++    {
++        return $this->getDataDir() . '/var/logs';
++    }
+ }
+

pkgs/by-name/ko/koillection/package.nix

@@ -0,0 +1,69 @@
+{ lib
+, dataDir ? "/var/lib/koillection"
+  # REVIEW: This supposed to be aliased by the caller, which means it shouldn't
+  # go in by-name, I think.
+, php83
+, fetchFromGitHub
+, mkYarnPackage
+, fetchYarnDeps
+}:
+
+php83.buildComposerProject (finalAttrs: {
+  pname = "koillection";
+  version = "1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "benjaminjonard";
+    repo = "koillection";
+    rev = finalAttrs.version;
+    hash = "sha256-r2rkHhp0F5QfwJuKeu4UdPoluDXxpyhYpie1zUk1h5c=";
+  };
+
+  frontend = mkYarnPackage {
+    inherit (finalAttrs) pname version;
+
+    src = "${finalAttrs.src}/assets";
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${finalAttrs.src}/assets/yarn.lock";
+      hash = "";
+    };
+  };
+
+  patches = [
+    ./koillection-dirs.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace src/Kernel.php \
+      --replace "@dataDir@" "${dataDir}"
+  '';
+
+  # Lock file uses exact constraints, which Composer doesn't like.
+  composerStrictValidation = false;
+  # Actually installs plugins, i.e., Symfony.
+  composerNoPlugins = false;
+  vendorHash = "sha256-LU9ZN4qUNUpSBGH6AChw3qU4RjgsoPJmLL01FS7UKRQ=";
+
+  postInstall = ''
+    local koillection_out=$out/share/php/koillection
+
+    rm -R $koillection_out/public/uploads
+    ln -s ${dataDir}/.env $koillection_out/.env.local
+    ln -s ${dataDir}/public/uploads $koillection_out/public/uploads
+
+    cp -r ${finalAttrs.frontend} assets/
+  '';
+
+  passthru = {
+    phpPackage = php83;
+  };
+
+  meta = {
+    description = "Self-hosted service allowing users to manage any kind of collections";
+    homepage = "https://github.com/benjaminjonard/koillection";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    broken = true; # Blocked on NixOS/nixpkgs#254369
+  };
+})

pkgs/by-name/po/porkbun-ddns/porkbun-ddns.py

@@ -9,7 +9,7 @@ from dataclasses import dataclass, fields as datafields
 from enum import Enum, unique
 from typing import List, Optional
 
-APIBASE = "https://porkbun.com/api/json/v3/dns"
+APIBASE = "https://api.porkbun.com/api/json/v3/dns"
 
 
 def dataclass_from_dict(klass: object, d: dict):

pkgs/by-name/ps/psst/package.nix

@@ -3,7 +3,7 @@
 , rustPlatform
 
 , pkg-config
-, alsaLib
+, alsa-lib
 , dbus
 , openssl
 
@@ -23,6 +23,7 @@ assert withGui -> gtk3.meta.available;
 rustPlatform.buildRustPackage rec {
   pname = "psst";
   version = "20221012.d70ed81";
+
   src = fetchFromGitHub {
     owner = "jpochyla";
     repo = "psst";
@@ -30,12 +31,13 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-ZKhHN0ruLb6ZVKkrKv/YawRsVop6SP1QF/nrtkmA8P8=";
     fetchSubmodules = true;
   };
-  cargoSha256 = "sha256-zH6+EV78FDVOYEFXk0f54pH2Su0QpK1I0bHqzIiMdBo=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-my15AXG9LLmdqZLqXdeZ81VLv+GbSMgNtuFAlYTEUvQ=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ optional withGui copyDesktopItems;
 
-  buildInputs = [ alsaLib dbus openssl ]
+  buildInputs = [ alsa-lib dbus openssl ]
     ++ optional withGui gtk3;
 
   cargoBuildFlags = optionals (!withGui) [

pkgs/by-name/sa/samrewritten/package.nix

@@ -1,48 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, curl
-, gnumake
-, gnutls
-, gtk3
-, gtkmm3
-, pkg-config
-, yajl
-}:
-
-stdenv.mkDerivation rec {
-  pname = "SamRewritten";
-  version = "2.1";
-
-  src = fetchFromGitHub {
-    owner = "PaulCombal";
-    repo = pname;
-    rev = "202008";
-    sha256 = "ab7903b997675b0d4d7eede15430fc5ca2736e6c25c7f95a7c97e1ce25582a1c";
-  };
-
-  nativeBuildInputs = [ gnumake pkg-config ];
-  buildInputs = [
-    curl
-    gnutls
-    gtk3
-    gtkmm3
-    yajl
-  ];
-
-  NIX_CFLAGS_LINK = "-pthread";
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  postFixup = ''
-    substituteInPlace $out/share/applications/samrewritten.desktop \
-      --replace /usr/bin/samrewritten $out/bin/samrewritten
-  '';
-
-  meta = with lib; {
-    description = "Steam Achievement Manager For Linux";
-    homepage = "https://github.com/PaulCombal/SamRewritten";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}

pkgs/by-name/th/thor/nugetDeps.nix

@@ -0,0 +1,16 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "K4os.Compression.LZ4"; version = "1.3.5"; sha256 = "1nv9inhz0n25lhkw9xgp6g5xbqmcdccdhx6mwrli0pdp6hjmlh9k"; })
+  (fetchNuGet { pname = "K4os.Compression.LZ4.Streams"; version = "1.3.5"; sha256 = "09m0jxq6558r1v1l4rsc8c0n6nlacz2d8c03as6kvvvz2gr7h506"; })
+  (fetchNuGet { pname = "K4os.Hash.xxHash"; version = "1.0.8"; sha256 = "0vz1f81z4rh7a576fdzbc6wmj7p4gaca1rch3anvh1s5qd7xdd10"; })
+  (fetchNuGet { pname = "Serilog"; version = "3.0.0-dev-02022"; sha256 = "0c7gqhzkcdzmhycq60mzwqwcycl99ksk4q0pmwz140japasfhcqk"; })
+  (fetchNuGet { pname = "Serilog.Exceptions"; version = "8.4.0"; sha256 = "1v0rnhr616wj85gb6wvafj22kvnphp7m9vsyalcc25hwa1jvlryr"; })
+  (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "4.1.1-dev-00910"; sha256 = "00h3sd0lxnx53jmgqh84pw73zk3d710dvlgkf4x135vfhax9bw7m"; })
+  (fetchNuGet { pname = "SharpCompress"; version = "0.33.0"; sha256 = "1j94hfjvkygpp97svv75jay0rmnx9ygg86d5syyahl9hayns4ig9"; })
+  (fetchNuGet { pname = "Spectre.Console"; version = "0.47.1-preview.0.8"; sha256 = "1r6v16lh7mqxxh3j9lqryif8skx3q9nkgf5gnp5xpc4im3a52wql"; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.3"; sha256 = "1jgdazpmwc21dd9naq3l9n5s8a1jnbwlvgkf1pnm0aji6jd4xqdz"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.7.0"; sha256 = "04qw9km34pmzr2alckb3mqdb4fpqwlvzk59lg8c7jfidghcl4jqq"; })
+]

pkgs/by-name/th/thor/package.nix

@@ -0,0 +1,35 @@
+{ lib
+, fetchFromGitHub
+, buildDotnetModule
+, dotnetCorePackages
+}:
+
+buildDotnetModule rec {
+  pname = "thor";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "Samsung-Loki";
+    repo = "Thor";
+    rev = version;
+    hash = "sha256-tYzPpgbM9rCDdLW0ERZWmmxzMYpe1BNyFwmpaLQXRGQ=";
+  };
+
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;
+  nugetDeps = ./nugetDeps.nix;
+  projectFile = "TheAirBlow.Thor.Shell/TheAirBlow.Thor.Shell.csproj";
+
+  postFixup = ''
+    mv $out/bin/TheAirBlow.Thor.Shell $out/bin/thor
+  '';
+
+  # dotnet7 is unsupported but it still runs fine; just don't build it in CI.
+  # https://github.com/Samsung-Loki/Thor/issues/23
+  preferLocalBuild = true;
+  meta = {
+    homepage = "https://github.com/Samsung-Loki/Thor";
+    description = "An alternative to Heimdall";
+    license = lib.licenses.mpl20;
+  };
+}

pkgs/by-name/wg/wg2nd/package.nix

@@ -0,0 +1,27 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libcap
+}: stdenv.mkDerivation {
+  pname = "wg2nd";
+  version = "20240605.23a3710";
+  src = fetchFromGitHub {
+    owner = "flu0r1ne";
+    repo = "wg2nd";
+    rev = "23a37100f121edd0c1291c4a78901662eae5d58b";
+    hash = "sha256-XY19Vicg8l/2stlWj1QqJt0pJOi/kueQpBufVlLJVxk=";
+  };
+
+  buildInputs = [ libcap ];
+
+  installPhase = ''
+    PREFIX=$out BINDIR=/bin make install
+  '';
+
+  meta = {
+    description = "WireGuard to systemd-networkd Configuration Converter";
+    homepage = "https://git.flu0r1ine.net/wg2nd/about";
+    license = [ lib.licenses.gpl2Only lib.licenses.mit ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/data/fonts/monaspace/default.nix

@@ -1,73 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-}:
-
-let
-  mkMonaspace =
-    { pname
-    , variants ? [ ]
-    }: stdenvNoCC.mkDerivation rec {
-      inherit pname;
-      version = "1.000";
-
-      src = fetchFromGitHub {
-        owner = "githubnext";
-        repo = "monaspace";
-        rev = "v${version}";
-        hash = "sha256-Zo56r0QoLwxwGQtcWP5cDlasx000G9BFeGINvvwEpQs=";
-      };
-
-      _variants = map (builtins.replaceStrings [ " " ] [ "" ]) variants;
-
-      installPhase = ''
-        local out_font=$out/share/fonts/monaspace
-      '' + (if variants == [ ] then ''
-        install -m444 -Dt $out_font fonts/otf/*.otf
-        install -m444 -Dt $out_font fonts/variable/*.ttf
-      '' else ''
-        for variant in $_variants; do
-          install -m444 -Dt $out_font fonts/otf/"$variant"-*.otf
-          install -m444 -Dt $out_font fonts/variable/"$variant"Var*.ttf
-        done
-      '');
-
-      meta = {
-        description = "An innovative superfamily of fonts for code";
-        homepage = "https://monaspace.githubnext.com/";
-        longDescription = ''
-          Since the earliest days of the teletype machine, code has been set in
-          monospaced type — letters, on a grid. Monaspace is a new type system
-          that advances the state of the art for the display of code on screen.
-        '';
-        license = lib.licenses.ofl;
-        platforms = lib.platforms.all;
-      };
-    };
-in
-{
-  monaspace = mkMonaspace {
-    pname = "monaspace";
-  };
-
-  monaspace-argon = mkMonaspace {
-    pname = "monaspace-argon";
-    variants = [ "Monaspace Argon" ];
-  };
-  monaspace-krypton = mkMonaspace {
-    pname = "monaspace-krypton";
-    variants = [ "Monaspace Krypton" ];
-  };
-  monaspace-neon = mkMonaspace {
-    pname = "monaspace-neon";
-    variants = [ "Monaspace Neon" ];
-  };
-  monaspace-radon = mkMonaspace {
-    pname = "monaspace-radon";
-    variants = [ "Monaspace Radon" ];
-  };
-  monaspace-xenon = mkMonaspace {
-    pname = "monaspace-xenon";
-    variants = [ "Monaspace Xenon" ];
-  };
-}

pkgs/top-level/all-packages.nix

@@ -21,15 +21,6 @@ rec {
     ideaUltimateWithPlugins = ideaUltimatePlugins.jetbrainsWithPlugins;
   };
 
-  monaspace-fonts = pkgs.callPackage ../data/fonts/monaspace/default.nix { };
-  inherit (monaspace-fonts)
-    monaspace
-    monaspace-argon
-    monaspace-krypton
-    monaspace-neon
-    monaspace-radon
-    monaspace-xenon;
-
   mopidy-subidy = pkgs.callPackage ../applications/audio/mopidy/subidy.nix {
     python3Packages = pkgs.python3Packages // python3Packages;
   };