Merge branch 'main' of ssh://git.duckland.org:2202/don/NixOS-Configs

hosts/ace/default.nix

@@ -4,10 +4,10 @@
   imports =
     [
       ./hardware-configuration.nix
-      ../../workstation
+      ../workstation
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "ace";
 }

hosts/dragon/default.nix

@@ -8,10 +8,10 @@
       #inputs.nixos-hardware.nixosModules.common-gpu-intel
       #inputs.nixos-hardware.nixosModules.common-pc-laptop
       #inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
-      ../../workstation
+      ../workstation
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "dragon";
 }

hosts/eve/default.nix

@@ -4,10 +4,10 @@
   imports =
     [
       ./hardware-configuration.nix
-      ../../workstation
+      ../workstation
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "eve";
 }

hosts/loki/default.nix

@@ -1,13 +1,14 @@
-{ config, pkgs, ... }:
+{ inputs, outputs, ... }:
 
 {
   imports =
     [
       ./hardware-configuration.nix
-      ../../workstation
+      ../workstation
+      ../workstation/kvm.nix
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "loki";
 }

hosts/pocket2/default.nix

@@ -4,14 +4,14 @@
   imports =
     [
       ./hardware-configuration.nix
-      #inputs.nixos-hardware.nixosModules.common-cpu-intel
-      #inputs.nixos-hardware.nixosModules.common-gpu-intel
-      #inputs.nixos-hardware.nixosModules.common-pc-laptop
-      #inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
-      ../../workstation
+      inputs.nixos-hardware.nixosModules.common-cpu-intel
+      inputs.nixos-hardware.nixosModules.common-gpu-intel
+      inputs.nixos-hardware.nixosModules.common-pc-laptop
+      inputs.nixos-hardware.nixosModules.common-pc-laptop-ssd
+      ../workstation
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "pocket2";
 }

hosts/pocket2/hardware-configuration.nix

@@ -23,10 +23,6 @@
       fsType = "vfat";
     };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/13b6e2c4-b8f1-48c9-b992-bf2d172d9a25"; }
-    ];
-
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction

hosts/server/default.nix

@@ -0,0 +1,194 @@
+{ config, pkgs, ... }:
+
+let
+  my-python-packages = python-packages: with python-packages; [
+    pip
+    pipx
+    python-dateutil
+    setuptools
+    requests
+  ];
+  python-with-my-packages = pkgs.python3Full.withPackages my-python-packages;
+in
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      warn-dirty = false;
+      auto-optimise-store = true;
+      trusted-users = [ "root" "don" ];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+  imports =
+    [
+      ./systemd.nix
+      ./tailscale.nix
+      ./upgrade-diff.nix
+    ];
+
+  networking.networkmanager.enable = true;
+  networking.enableIPv6 = true;
+  networking.useDHCP = false;
+
+  time = {
+    timeZone = "America/Chicago";
+    hardwareClockInLocalTime = false;
+  };
+
+  i18n.defaultLocale = "en_US.utf8";
+
+  boot = {
+    kernelParams = [ "consoleblank=60" ];
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+    };
+    plymouth = {
+      enable = true;
+      theme = "breeze";
+    };
+    kernel = {
+      sysctl = { "vm.swappiness" = 10;};
+    };
+  };
+
+  security = {
+    sudo.enable = false;
+    doas = {
+      enable = true;
+      extraRules = [{
+        users = [ "don" ];
+        keepEnv = true;
+        noPass = true;
+      }];
+    };
+  };
+
+  services = {
+    pcscd = {
+      enable = true;
+    };
+    udisks2 = {
+      enable = true;
+    };
+    nscd = {
+      enableNsncd = true;
+    };
+    tailscale = {
+      enable = true;
+    };
+    locate = {
+      enable = true;
+      package = pkgs.mlocate;
+      localuser = null;
+    };
+    openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "yes";
+      };
+    };
+  };
+
+  security.rtkit.enable = true;
+
+  users.users = {
+    don = {
+      isNormalUser = true;
+      initialPassword = "changeme";
+      description = "Don Harper";
+      extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+      ];
+    };
+    root = {
+      initialPassword = "changeme";
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+      ];
+    };
+  };
+
+  #nixpkgs.config.allowUnfree = true;
+
+  environment.systemPackages = with pkgs; [
+    python-with-my-packages
+    aspell
+    aspellDicts.en
+    bash-completion
+    nix-bash-completions
+    btop
+    git-crypt
+    gitFull
+    home-manager
+    hunspell
+    hunspellDicts.en_US
+    isync
+    lsb-release
+    lsof
+    pkg-config
+    poppler_utils
+    ruby
+    udiskie
+  ];
+
+  programs = {
+    dconf = {
+      enable = true;
+    };
+    mtr = {
+      enable = true;
+    };
+    gnupg = {
+      agent = {
+        enable = true;
+        pinentryPackage = pkgs.pinentry-curses;
+        enableSSHSupport = true;
+      };
+    };
+  };
+
+
+  nixpkgs.overlays = [
+    (final: super:{ khal        = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
+  ];
+
+  # Open ports in the firewall.
+  networking.firewall = {
+    enable = false;
+    trustedInterfaces = [ "tailscale0" ];
+    checkReversePath = "loose";
+    allowedUDPPorts = [ config.services.tailscale.port ];
+    allowedTCPPorts = [ 22 ];
+  };
+
+
+  system.stateVersion = "23.11";
+  programs.msmtp = {
+    enable = true;
+    accounts = {
+      default = {
+        auth = true;
+        tls = true;
+        port = 587;
+        from = "duck@duckland.org";
+        host = "smtp.gmail.com";
+        user = "duckunix@gmail.com";
+        passwordeval = "cat /home/don/.smtp_password.txt";
+      };
+    };
+  };
+}

hosts/server/systemd.nix

@@ -0,0 +1,48 @@
+{ pkgs, ... }:
+
+let
+  readlink = "${pkgs.coreutils}/bin/readlink";
+  notify-send = "${pkgs.libnotify}/bin/notify-send";
+in {
+  systemd = {
+    services = {
+      clean-keychain = {
+        description = "Clean up .keychain on boot";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.coreutils-full}/bin/rm -rf /home/don/.keychain";
+        };
+      };
+    };
+    user = {
+      services = {
+        detect-reboot-for-upgrade = {
+          script = ''
+            set -eu -o pipefail
+            booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
+            built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+            if [[ "''${booted}" != "''${built}" ]];
+            then
+              echo "Looks like we need a reboot!"
+              ${notify-send} --urgency=low --icon=system-reboot "Reboot is needed for a NixOS upgrade."
+            fi
+          '';
+          serviceConfig = {
+            Type = "oneshot";
+          };
+        };
+      };
+      timers = {
+        detect-reboot-for-upgrade = {
+          wantedBy = [ "timers.target" ];
+          partOf = [ "detect-reboot-for-upgrade.service" ];
+          timerConfig = {
+            OnCalendar = "hourly";
+            Unit = "detect-reboot-for-upgrade.service";
+          };
+        };
+      };
+    };
+  };
+}

hosts/server/upgrade-diff.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }: {
+  system.activationScripts.diff = {
+    supportsDryActivation = true;
+    text = ''
+      ${pkgs.nvd}/bin/nvd --nix-bin-dir=${pkgs.nix}/bin diff /run/current-system "$systemConfig"
+    '';
+  };
+}

hosts/smaug/default.nix

@@ -4,10 +4,10 @@
   imports =
     [
       ./hardware-configuration.nix
-      ../../workstation
+      ../workstation
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "smaug";
 }

hosts/t2/default.nix

@@ -4,10 +4,10 @@
   imports =
     [
       ./hardware-configuration.nix
-      ../../workstation
+      ../workstation
       ../../home
       ../../home/gui
-      ../../wm
+      ../wm
     ];
   networking.hostName = "t2";
 }

hosts/wm/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+  {
+    imports = [ ./sway ];
+  }

hosts/wm/kde/default.nix

@@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    alacritty
+    bemenu
+    dracula-theme # gtk theme
+    glib
+    grim
+    kaddressbook
+    kalendar
+    kdeconnect
+    #kmail-account-wizard
+    kmail
+    #kdepim-runtime
+    #kdepim
+    #kdepim-addons
+    kitinerary
+    mako
+    plasma-desktop
+    slurp
+    wl-clipboard
+  ];
+
+
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  services.xserver.enable = true;
+  services.xserver.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+}

hosts/wm/sway/default.nix

@@ -0,0 +1,56 @@
+{ pkgs, ... }:
+let
+  dbus-sway-environment = pkgs.writeTextFile {
+    name = "dbus-sway-environment";
+    destination = "/bin/dbus-sway-environment";
+    executable = true;
+    text = ''
+      dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway
+      systemctl --user stop pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr
+      systemctl --user start pipewire pipewire-media-session xdg-desktop-portal xdg-desktop-portal-wlr
+    '';
+  };
+  configure-gtk = pkgs.writeTextFile {
+    name = "configure-gtk";
+    destination = "/bin/configure-gtk";
+    executable = true;
+    text = let
+      schema = pkgs.gsettings-desktop-schemas;
+      datadir = "${schema}/share/gsettings-schemas/${schema.name}";
+    in ''
+        export XDG_DATA_DIRS=${datadir}:$XDG_DATA_DIRS
+        gnome_schema=org.gnome.desktop.interface
+        gsettings set $gnome_schema gtk-theme 'Dracula'
+    '';
+  };
+in
+  {
+    environment.systemPackages = with pkgs; [
+      alacritty
+      bemenu
+      configure-gtk
+      dbus-sway-environment
+      dracula-theme # gtk theme
+      glib
+      gnome.adwaita-icon-theme
+      grim
+      mako
+      slurp
+      sway
+      swayidle
+      swayimg
+      swaylock-effects
+      swaynotificationcenter
+      waybar
+      wayland
+      wl-clipboard
+    ];
+    services.dbus.enable = true;
+    programs = {
+      sway = {
+        enable = true;
+        wrapperFeatures.gtk = true;
+      };
+    };
+    services.greetd.package = "greetd.wlgreet";
+  }

hosts/workstation/default.nix

@@ -0,0 +1,324 @@
+{ config, pkgs, ... }:
+
+let
+  my-python-packages = python-packages: with python-packages; [
+    pip
+    # pipx
+    python-dateutil
+    setuptools
+    requests
+  ];
+  python-with-my-packages = pkgs.python3Full.withPackages my-python-packages;
+in
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      warn-dirty = false;
+      auto-optimise-store = true;
+      trusted-users = [ "root" "don" ];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+  imports =
+    [
+      ./detect-reboot-needed.nix
+      ./systemd.nix
+      ./tailscale.nix
+      ./upgrade-diff.nix
+    ];
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.enableIPv6 = true;
+  networking.networkmanager.wifi.powersave = true;
+  networking.useDHCP = false;
+
+  # Set your time zone.
+  time = {
+    timeZone = "America/Chicago";
+    hardwareClockInLocalTime = false;
+  };
+
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.utf8";
+  i18n.inputMethod = {
+    enabled = "fcitx5";
+    fcitx5.addons = with pkgs; [
+      fcitx5-mozc
+      fcitx5-gtk
+    ];
+  };
+
+  # Bootloader.
+  boot = {
+    kernelPackages = pkgs.linuxPackages_latest;
+    kernelParams = [ "consoleblank=60" ];
+    binfmt = {
+      emulatedSystems = [ "aarch64-linux" ];
+    };
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+    };
+    plymouth = {
+      enable = true;
+      theme = "breeze";
+    };
+    kernel = {
+      sysctl = { "vm.swappiness" = 10;};
+    };
+  };
+
+  security = {
+    polkit = {
+      enable = true;
+    };
+    sudo.enable = false;
+    doas = {
+      enable = true;
+      extraRules = [{
+        users = [ "don" ];
+        keepEnv = true;
+        noPass = true;
+      }];
+    };
+  };
+
+  services = {
+    #udev = {
+      #extraRules = ''
+        #KERNEL=="card0", SUBSYSTEM=="drm", RUN+=""${pkgs.kanshi-fix}"/bin/kanshi-fix"
+      #'';
+    #};
+    pcscd = {
+      enable = true;
+    };
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+    };
+    printing = {
+      enable = true;
+    };
+    udisks2 = {
+      enable = true;
+    };
+    nscd = {
+      enableNsncd = true;
+    };
+    fwupd = {
+      enable = true;
+    };
+    flatpak = {
+      enable = true;
+    };
+    fstrim = {
+      enable = true;
+    };
+    pipewire = {
+      enable = true;
+      alsa = {
+        enable = true;
+        support32Bit = true;
+      };
+      pulse = {
+        enable = true;
+      };
+    };
+    tailscale = {
+      enable = true;
+    };
+    logind = {
+      lidSwitchExternalPower = "ignore";
+      lidSwitchDocked = "ignore";
+    };
+    locate = {
+      enable = true;
+      package = pkgs.mlocate;
+      localuser = null;
+    };
+    openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        #PermitRootLogin = "yes";
+      };
+    };
+  };
+
+  # Enable sound with pipewire.
+  sound.enable = true;
+  hardware.bluetooth.enable = true;
+  hardware.pulseaudio.enable = false;
+  hardware.sane = {
+    enable = true;
+    extraBackends = [ pkgs.sane-airscan ];
+  };
+  security.rtkit.enable = true;
+
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    #gtkUsePortal = true;
+  };
+
+  users.users.don = {
+    isNormalUser = true;
+    initialPassword = "changeme";
+    description = "Don Harper";
+    extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+    ];
+  };
+
+  zramSwap = {
+    enable = true;
+    memoryPercent = 25;
+    memoryMax = 2147483648;
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" ];
+
+  environment.systemPackages = with pkgs; [
+    #(callPackage ../mypackages/kanshi-fix/default.nix {})
+    python-with-my-packages
+    acpi
+    aspell
+    aspellDicts.en
+    bash-completion
+    nix-bash-completions
+    btop
+    espeak-classic
+    fwup
+    fwupd
+    fwupd-efi
+    git-crypt
+    gitFull
+    headsetcontrol
+    home-manager
+    hunspell
+    hunspellDicts.en_US
+    imagemagick
+    isync
+    libsForQt5.qtkeychain
+    lsb-release
+    pkg-config
+    playerctl
+    poppler_utils
+    pulseaudio
+    ruby
+    steam
+    udiskie
+    wireplumber
+    wlsunset
+    xdg-utils
+    xfce.thunar
+    zathura
+  ];
+
+  programs = {
+    steam = {
+      enable = true;
+      # Open ports in the firewall for Steam Remote Play
+      remotePlay.openFirewall = true;
+      # Open ports in the firewall for Source Dedicated Server
+      dedicatedServer.openFirewall = true;
+    };
+    dconf = {
+      enable = true;
+    };
+    light = {
+      enable = true;
+    };
+    mtr = {
+      enable = true;
+    };
+    kdeconnect = {
+      enable = true;
+    };
+    gnupg = {
+      agent = {
+        enable = true;
+        pinentryPackage = pkgs.pinentry-curses;
+        enableSSHSupport = true;
+      };
+    };
+  };
+
+
+  nixpkgs.overlays = [
+    (final: prev: { qutebrowser = prev.qutebrowser.override     { enableWideVine = true; }; })
+    (final: super:{ khal        = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
+  ];
+
+  # Open ports in the firewall.
+  networking.firewall = {
+    enable = true;
+    # always allow traffic from your Tailscale network
+    trustedInterfaces = [ "tailscale0" ];
+    checkReversePath = "loose";
+
+    # allow the Tailscale UDP port through the firewall
+    allowedUDPPorts = [ config.services.tailscale.port ];
+    allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
+    allowedUDPPortRanges = [ { from = 1714 ; to = 1764; } ];
+
+    # allow you to SSH in over the public internet
+    allowedTCPPorts = [ 22 ];
+    interfaces = {
+      "tailscale0" = {
+        allowedTCPPorts = [ 22 8080 8443 ];
+        allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
+        allowedUDPPortRanges = [ { from = 1714 ; to = 1764; } ];
+      };
+    };
+  };
+
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+  programs.msmtp = {
+    enable = true;
+    accounts = {
+      default = {
+        auth = true;
+        tls = true;
+        port = 587;
+        from = "duck@duckland.org";
+        host = "smtp.gmail.com";
+        user = "duckunix@gmail.com";
+        passwordeval = "cat /home/don/.smtp_password.txt";
+      };
+    };
+  };
+  xdg.mime.enable = true;
+  xdg.mime.defaultApplications = {
+    "text/html" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
+  };
+  environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
+}

hosts/workstation/detect-reboot-needed.nix

@@ -0,0 +1,30 @@
+{ pkgs, ... }:
+
+let
+  readlink = "${pkgs.coreutils}/bin/readlink";
+  notify-send = "${pkgs.libnotify}/bin/notify-send";
+in {
+  systemd.user.services.detect-reboot-for-upgrade = {
+    script = ''
+      set -eu -o pipefail
+      booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
+      built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+      if [[ "''${booted}" != "''${built}" ]];
+      then
+        echo "Looks like we need a reboot!"
+        ${notify-send} --urgency=low --icon=system-reboot "Reboot is needed for a NixOS upgrade."
+      fi
+    '';
+    serviceConfig = {
+      Type = "oneshot";
+    };
+  };
+  systemd.user.timers.detect-reboot-for-upgrade = {
+    wantedBy = [ "timers.target" ];
+    partOf = [ "detect-reboot-for-upgrade.service" ];
+    timerConfig = {
+      OnCalendar = "hourly";
+      Unit = "detect-reboot-for-upgrade.service";
+    };
+  };
+}

hosts/workstation/kvm.nix

@@ -0,0 +1,5 @@
+{ pkgs, inputs, ... }:
+{
+  virtualisation.libvirtd.enable = true;
+  environment.systemPackages = with pkgs; [ gnome.gnome-boxes ];
+}

hosts/workstation/systemd.nix

@@ -0,0 +1,50 @@
+{ pkgs, lib, ... }:
+
+let
+  readlink = "${pkgs.coreutils}/bin/readlink";
+  notify-send = "${pkgs.libnotify}/bin/notify-send";
+in {
+  systemd = {
+    services = {
+      NetworkManager-wait-online.enable = lib.mkForce false;
+      systemd-networkd-wait-online.enable = lib.mkForce false;
+      clean-keychain = {
+        description = "Clean up .keychain on boot";
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.coreutils-full}/bin/rm -rf /home/don/.keychain";
+        };
+      };
+    };
+    user = {
+      services = {
+        detect-reboot-for-upgrade = {
+          script = ''
+            set -eu -o pipefail
+            booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
+            built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+            if [[ "''${booted}" != "''${built}" ]];
+            then
+              echo "Looks like we need a reboot!"
+              ${notify-send} --urgency=low --icon=system-reboot "Reboot is needed for a NixOS upgrade."
+            fi
+          '';
+          serviceConfig = {
+            Type = "oneshot";
+          };
+        };
+      };
+      timers = {
+        detect-reboot-for-upgrade = {
+          wantedBy = [ "timers.target" ];
+          partOf = [ "detect-reboot-for-upgrade.service" ];
+          timerConfig = {
+            OnCalendar = "hourly";
+            Unit = "detect-reboot-for-upgrade.service";
+          };
+        };
+      };
+    };
+  };
+}

hosts/workstation/upgrade-diff.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }: {
+  system.activationScripts.diff = {
+    supportsDryActivation = true;
+    text = ''
+      ${pkgs.nvd}/bin/nvd --nix-bin-dir=${pkgs.nix}/bin diff /run/current-system "$systemConfig"
+    '';
+  };
+}