From 2ef87bbdedd7c716df66c7921b7c14707b6856b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Moritz=20B=C3=B6hme?= <mail@moritzboeh.me>
Date: Fri, 1 Aug 2025 20:27:20 +0200
Subject: [PATCH] perf: speed up evaluation and reduce memory

---
 machines/moritz-desktop/configuration.nix |  4 +-
 modules/moritz/nixpkgs.nix                | 63 -----------------------
 modules/moritz/profiles/base.nix          | 19 +------
 modules/moritz/profiles/desktop.nix       |  2 +-
 modules/moritz/programs/chromium.nix      |  3 +-
 modules/moritz/programs/firefox.nix       |  5 +-
 modules/moritz/security/default.nix       |  2 +-
 7 files changed, 12 insertions(+), 86 deletions(-)
 delete mode 100644 modules/moritz/nixpkgs.nix

diff --git a/machines/moritz-desktop/configuration.nix b/machines/moritz-desktop/configuration.nix
index 4bb254d..111cd63 100644
--- a/machines/moritz-desktop/configuration.nix
+++ b/machines/moritz-desktop/configuration.nix
@@ -1,7 +1,7 @@
 # Edit this configuration file to define what should be installed on
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
-{pkgs, ...}: {
+{pkgs, inputs, ...}: {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
@@ -43,7 +43,7 @@
 
   home-manager.users.moritz.home.packages = with pkgs; [
     anki
-    stable.calibre # NOTE: breaks often in unstable
+    (inputs.stable.legacyPackages.${pkgs.system}.calibre) # NOTE: breaks often in unstable
   ];
 
   networking.firewall.allowedTCPPorts = [9090];
diff --git a/modules/moritz/nixpkgs.nix b/modules/moritz/nixpkgs.nix
deleted file mode 100644
index 8eed234..0000000
--- a/modules/moritz/nixpkgs.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.my.nixpkgs;
-
-  overlayType = mkOptionType {
-    name = "nixpkgs-overlay";
-    description = "nixpkgs overlay";
-    check = lib.isFunction;
-    merge = lib.mergeOneOption;
-  };
-in {
-  options.my.nixpkgs = {
-    overlays = mkOption {
-      default = [];
-      type = types.listOf overlayType;
-      example =
-        literalExpression
-        ''
-          [
-            (self: super: {
-              openssh = super.openssh.override {
-                hpnSupport = true;
-                kerberos = self.libkrb5;
-              };
-            })
-          ]
-        '';
-    };
-    channels = mkOption {
-      default = {};
-      example = literalExpression ''
-        {
-          stable = inputs.nixpkgs-stable;
-        }
-      '';
-      type = with types; attrsOf package;
-    };
-    overlaysForAllChannels = mkEnableOption "apply overlays for all channels";
-  };
-
-  config.nixpkgs = {
-    overlays = let
-      channelOverlays = _: prev:
-        mapAttrs
-        (
-          _: value:
-            import value {
-              inherit (prev) system;
-              config.allowUnfree = true;
-              overlays = optional cfg.overlaysForAllChannels cfg.overlays;
-            }
-        )
-        cfg.channels;
-    in
-      cfg.overlays ++ [channelOverlays];
-
-    config.allowUnfree = true;
-  };
-}
diff --git a/modules/moritz/profiles/base.nix b/modules/moritz/profiles/base.nix
index b2c9aa5..13224c5 100644
--- a/modules/moritz/profiles/base.nix
+++ b/modules/moritz/profiles/base.nix
@@ -12,23 +12,6 @@ in {
   ];
 
   my = {
-    nixpkgs = {
-      overlays = [
-        (
-          _: prev: {
-            nur = import inputs.nur {
-              pkgs = prev;
-              nurpkgs = prev;
-            };
-          }
-        )
-      ];
-      channels = {
-        master = inputs.master;
-        stable = inputs.stable;
-      };
-    };
-
     shell = {
       abbreviations = {
         us = "systemctl --user";
@@ -164,6 +147,8 @@ in {
     xdg.userDirs.enable = true;
   };
 
+  nixpkgs.config.allowUnfree = true;
+
   home-manager = {
     useGlobalPkgs = true;
     useUserPackages = true;
diff --git a/modules/moritz/profiles/desktop.nix b/modules/moritz/profiles/desktop.nix
index e6f5cfa..8e7dd8d 100644
--- a/modules/moritz/profiles/desktop.nix
+++ b/modules/moritz/profiles/desktop.nix
@@ -74,7 +74,7 @@ in {
       (inputs.filetags.packages.${pkgs.system}.default)
       keepassxc
       pavucontrol
-      stable.libreoffice # NOTE: breaks often
+      (inputs.stable.legacyPackages.${pkgs.system}.libreoffice) # NOTE: breaks often
       signal-desktop
       vlc
     ];
diff --git a/modules/moritz/programs/chromium.nix b/modules/moritz/programs/chromium.nix
index 5372855..9c05016 100644
--- a/modules/moritz/programs/chromium.nix
+++ b/modules/moritz/programs/chromium.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  inputs,
   ...
 }:
 with lib; let
@@ -11,7 +12,7 @@ in {
     enable = mkEnableOption "chromium";
     package = mkOption {
       type = types.package;
-      default = pkgs.stable.chromium;
+      default = inputs.stable.legacyPackages.${pkgs.system}.chromium;
       defaultText = "pkgs.chromium";
       description = "Chromium package to install.";
     };
diff --git a/modules/moritz/programs/firefox.nix b/modules/moritz/programs/firefox.nix
index b2dee1c..1494811 100644
--- a/modules/moritz/programs/firefox.nix
+++ b/modules/moritz/programs/firefox.nix
@@ -65,7 +65,10 @@ in {
             // Overrides
             ${cfg.arkenfox.overrides}
           '';
-          extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
+          extensions.packages = with (import inputs.nur {
+            pkgs = pkgs;
+            nurpkgs = pkgs;
+          }).repos.rycee.firefox-addons; [
             darkreader
             istilldontcareaboutcookies
             kagi-search
diff --git a/modules/moritz/security/default.nix b/modules/moritz/security/default.nix
index 8f4642c..13a8587 100644
--- a/modules/moritz/security/default.nix
+++ b/modules/moritz/security/default.nix
@@ -70,7 +70,7 @@
 
   # SSH
   services.openssh = {
-    package = pkgs.master.openssh; # HACK: to fix CVE-2024-6387
+    package = pkgs.openssh;
     settings = {
       # Disable ssh password login
       PasswordAuthentication = lib.mkDefault false;