Blacklist "Comodo AAA Services root" and "emSign ECC Root CA - G3"
so they are left out of /etc/ssl/certs/ca-certificates.crt.
Mozilla already distrusted the Comodo root for serverAuth (it was only
trusted for email), so emSign ECC G3 is the only root this removes for
TLS. Apps that ship their own trust store (NSS in browsers, certifi,
Java cacerts) are not affected.
Assisted-by: Claude:opus-5-5
After a cold boot the EM160R-GL often drops off the PCIe link 10-20s
after probe ("Unable to change power state from D3cold to D0", config
space reads all-ones) and never brings up its wwan ports. Until now
only a hibernate/resume cycle brought it back.
An ACPI _RST through the PCI reset attribute does the same at runtime.
The rescan after it catches the firmware mid-boot, under the generic
Qualcomm ID 17cb:0304, which has no FCC unlock script, so ModemManager
fails with "Couldn't set operating mode". A second rescan once the
firmware is up gets 1eac:100d back and the modem enables normally.
The service does nothing if wwan ports show up within 60s of boot.
The recovery sequence was verified by hand on 7.2.11; the service has
not yet run it on a real cold boot.
Assisted-by: Claude:opus-5-5
The in-tree amdxdna driver on LTS 6.18 is too old for FastFlowLM:
flm validate reports kernel_ok=false and the driver loads NPU firmware
1.0.0.63, while FLM needs 1.1.0.0 or newer. The 7.x driver loads
npu_7.sbin (1.1.2.64), and /dev/accel/accel0 is present on 7.2.11.
Assisted-by: Claude:opus-5-5
nixpkgs moves from 2026-08-04 to 2026-10-17. Also updated: anotherim,
lanzaboote, nix-amd-ai, nix-flatpak and sops-nix, plus their
transitive inputs.
Assisted-by: Claude:opus-5-5
With the updated inputs both are checked by the unfree predicate and
evaluation stops on them: discord-ptb now pulls in a separate
-unwrapped package, and nix-amd-ai marked its FastFlowLM NPU runtime
unfree in 2026-10.
Assisted-by: Claude:opus-5-5
nixpkgs dropped openssl_3 as end of life, so evaluating litecoin.nix
fails after the next input update. The default openssl is 3.5, which
the build already works with.
Assisted-by: Claude:opus-5-5
Two local-test variants for mutter!5375: the NULL-check fix with
g_message traces, and Jonas Ådahl's proposal to forget a cancelled
touch sequence. They log which path cancelled the touch, to answer
how a resize reaches touch_can_grab_surface() with no focus surface.
Not applied yet; desktop.nix still uses mutter-touch-cancelled-grab.
Assisted-by: Claude:opus-5-5
A second boot entry with Xfce on Xorg via LightDM, matching the
desktop where another.im's typing jitter shows up (2026-10-19), to
reproduce it here. GDM in GNOME 50 no longer starts Xorg sessions,
hence LightDM. The default entry is untouched.
Assisted-by: Claude:opus-5-5
resume_offset must name the swapfile's first physical extent for
hibernation to resume from it; the old value no longer matched.
Assisted-by: Claude:opus-5-5
It ran git add -A, so a rebuild swept every unrelated change in
/etc/nixos into one "Update: <date>" commit and pushed it. Rebuild
and commit separately instead.
Assisted-by: Claude:opus-5-5
Lets servers on Linode (Akamai) be created and managed from the
console, next to hcloud for Hetzner, e.g. throwaway test hosts spun up
by Claude Code.
Assisted-by: Claude:opus-5-5
GNOME draws no StatusNotifierItem tray without it, so apps that keep
running in the tray could not offer it: another.im's "Stay connected
when closed" stayed greyed out ("Needs a tray icon, which this desktop
cannot show"). The extension's tray also needs gnome-settings-daemon's
udev rules (NixOS wiki, GNOME: "Systray Icons"). It is enabled in the
user's own extension list, beside the TLP switcher.
Assisted-by: Claude:opus-5-5
another.im (and any UnifiedPush app) is woken by its server for each
message only while a distributor runs on the session bus; GNOME has
none, so the app reported "no UnifiedPush distributor" and missed
messages once quit. KUnifiedPush's distributor needs no Plasma and
uses KDE's ntfy server by default.
Its unit ships in share/systemd/user, which systemd.packages does not
read, so the user service is written out here as the package's own
(26.04), started with the graphical session.
Assisted-by: Claude:opus-5-5
Container images and build caches (anotherim-js's build images alone
are several GB each) had filled the root filesystem, and a NDK unzip
in an image build failed with the disk full. Point
rootless_storage_path at the data disk. Existing storage was moved
there with its libpod database paths rewritten.
Assisted-by: Claude:opus-5
thinkpad_acpi ignores writes to /proc/acpi/ibm/fan unless loaded
with fan_control=1. Enable it so the fan can be set to a level (0-7)
or full-speed by hand; the firmware stays in charge while the level
is "auto". Applies from the next boot or a reload of the module.
Assisted-by: Claude:opus-5
Register vsmartcard's vpcd with pcscd as "Virtual PCD", so the
Remote Smart Card Reader app on a phone can serve the ID card over
NFC as a PC/SC reader. Over USB the link is an adb port reverse
(adb reverse tcp:35963 tcp:35963), hence android-tools.
Assisted-by: Claude:opus-5
An AI pair-programming CLI to use beside Claude Code. It talks to
OpenRouter through the ~/.local/bin/aider wrapper, which holds the
model and key settings outside the store.
Assisted-by: Claude:opus-5
The crash is mutter issue #4871, a regression from !5057, and
!5375 ("wayland/touch: Do not crash on empty focus surface") carries
the same NULL check as our patch. Say so in the overlay and the
patch, so it is clear when the patch can go.
Assisted-by: Claude:opus-5
With pinentry-curses the passphrase prompt needs a terminal, so a
signed commit made from an editor or any tool without one fails with
"gpg: signing failed: No such file or directory". pinentry-gnome3
asks in a GNOME dialog instead (and still falls back to curses
without a display).
Assisted-by: Claude:opus-5
meta_wayland_touch_cancel() clears focus_surface on active touches
but keeps their serials until the finger lifts. A client asking for
a move/resize grab with such a serial (anotherim-js's resize edges
by touch) makes touch_can_grab_surface() dereference NULL and takes
down gnome-shell (four crashes on 2026-10-13, same address).
Carry a one-line NULL check until nixpkgs' mutter has a fix; it is
not upstream as of mutter 50.2 / main.
Assisted-by: Claude:opus-5
gnome-shell keeps segfaulting in libmutter, and with the PAM core
limit at 0 systemd-coredump threw every dump away, so there was no
backtrace to work from. Raise the limit to unlimited; dumps land
root-owned in /var/lib/systemd/coredump, readable only by their
owner. Enable nixseparatedebuginfod2 so gdb/coredumpctl can fetch
symbols for store paths on demand.
The user manager inherits the limit at its first login, so it takes
a reboot (or a full logout) to apply.
Assisted-by: Claude:opus-5
Add modules/hostel-wifi.nix: per-SSID MAC randomization (iwd), disable
mDNS/LLMNR/NetBIOS, reject hostile IPv6 RAs, firewall LAN-side probing,
an nftables killswitch target allowing only tunnel egress + captive-portal
endpoints, NTS-secured time via chrony, and a captive-portal helper.
Import left commented out; toggle via 'untrusted on|off'.
acpi.ec_no_wakeup=1 stops EC interrupts from thrashing s2idle, and a
dconf system-db override disables gsd-power's sleep handlers so logind
owns all sleep/idle policy (gsd was re-waking before HibernateDelaySec).
Split lid/suspend policy by power source (s-t-h on battery, plain suspend
on AC), map power key to hibernate, drop HibernateDelaySec to 15min while
re-validating thermals, and disable USB-device wakeup via udev.
