Upgrade to nixos-24.05

I think this is the only "supported" nixos version now. But in any case scipy
seemed to be broken on the older version, and I couldn't build my code that uses
llm. Also, this allows me to get rid of the bild.os-unstable thing for
Beryllium, which was just a sitting timebomb of breaking stuff.

There are a lot of changes here because ruff updated to the very latest, and it
changed some minor lint things. Also with the new nixos I get a proper cgit
module, and some other breaking changes needed fixing.

20 files changed, 126 insertions, 404 deletions

diff --git a/Biz/Bild.nix b/Biz/Bild.nix
index bc235bf..8e33d93 100644
--- a/Biz/Bild.nix
+++ b/Biz/Bild.nix
@@ -4,14 +4,14 @@ let
   constants = import ./Bild/Constants.nix;
 
   # expose some attrs from stable, keep this minimal and simple
-  stable = {
-    inherit (nixpkgs.nixos-23_11)
-      sources lib makeWrapper ccacheStdenv haskell lispPackages_new python3
-      nixos mkShell dockerTools pkgs;
-    stdenv = nixpkgs.nixos-23_11.ccacheStdenv;
+  stable = let stable = nixpkgs.nixos-24_05;
+  in {
+    inherit (stable)
+      sources lib makeWrapper ccacheStdenv haskell sbcl python3 nixos mkShell
+      dockerTools pkgs;
+    stdenv = stable.ccacheStdenv;
   };
 
-  # just needed for running ollama
   unstable = nixpkgs.nixos-unstable-small;
 
   # this is the main library definitions, recursive references can be made with
@@ -65,7 +65,7 @@ let
         ]);
     };
 
-    lisp = { sbclWith = stable.lispPackages_new.sbclWithPackages; };
+    lisp = { sbclWith = stable.sbcl.withPackages; };
 
     python = {
       packages = stable.python3.pkgs;
@@ -80,14 +80,14 @@ let
     # exposed packages for inclusion in builds
     pkgs = with stable.pkgs; {
       inherit bat bc cmark universal-ctags deadnix fd figlet fzf git
-        git-branchless gitlint guile hlint indent jq lolcat mypy nixfmt ormolu
-        pkg-config ripgrep rustc tree wemux;
-      llama-cpp = nixpkgs.nixos-unstable-small.llama-cpp;
-      llm = nixpkgs.nixos-unstable-small.llm.withPlugins
-        [ nixpkgs.nixos-unstable-small.python3.pkgs.llm-ollama ];
-      ollama = nixpkgs.nixos-unstable-small.ollama;
-      ruff = nixpkgs.nixos-unstable-small.ruff;
-      shellcheck = nixpkgs.nixos-unstable-small.shellcheck;
+        git-branchless gitlint groff guile hlint indent jq lolcat mypy nixfmt
+        ormolu pkg-config ripgrep rustc tree wemux;
+      llama-cpp = unstable.llama-cpp;
+      llm = python3.withPackages
+        (p: with p; [ p.llm-ollama ]);
+      ollama = unstable.ollama;
+      ruff = unstable.ruff;
+      shellcheck = unstable.shellcheck;
     };
 
     # a standard nix build for bild, for bootstrapping. this should be the only
@@ -106,7 +106,7 @@ let
         # lisp deps, remove this when i implement nix builds for lisp
         guile
         (self.lisp.sbclWith
-          (p: with p; [ asdf alexandria ])) # just enough to build Example.lisp
+          (p: with p; [ alexandria ])) # just enough to build Example.lisp
       ];
       strictDeps = true;
       ghcVersion = self.haskell.ghcVersion;
@@ -203,7 +203,6 @@ let
 
     # build an operating system. 'cfg' is the NixOS config
     os = cfg: (stable.nixos (_args: cfg)).toplevel;
-    os-unstable = cfg: (unstable.nixos (_args: cfg)).toplevel;
 
     # build a docker image
     image = stable.dockerTools.buildImage;
diff --git a/Biz/Bild/Deps.hs b/Biz/Bild/Deps.hs
index 2b2a72a..e268a74 100644
--- a/Biz/Bild/Deps.hs
+++ b/Biz/Bild/Deps.hs
@@ -416,10 +416,9 @@ parseCmdUpdate =
         Opts.headerDoc
           <| Just
           <| Opts.nest 2
-          <| "Examples:"
-          Opts.<$$> ""
-          Opts.<$$> Opts.vcat
-            [ Opts.fill 30 "deps update" Opts.<+> "# update all packages",
+          <| Opts.vcat
+            [ "Examples:",
+              Opts.fill 30 "deps update" Opts.<+> "# update all packages",
               Opts.fill 30 "deps update nixpkgs" Opts.<+> "# update nixpkgs",
               Opts.fill 30 "deps update my-package -v beta-0.2" Opts.<+> "# update my-package to version \"beta-0.2\""
             ]
@@ -507,10 +506,12 @@ parseCmdModify =
         Opts.progDesc "Modify dependency attributes without performing an update",
         Opts.headerDoc
           <| Just
-          <| "Examples:"
-          Opts.<$$> ""
-          Opts.<$$> "  niv modify nixpkgs -v beta-0.2"
-          Opts.<$$> "  niv modify nixpkgs -a branch=nixpkgs-unstable"
+          <| Opts.vcat
+            [ "Examples:",
+              "",
+              "  niv modify nixpkgs -v beta-0.2",
+              "  niv modify nixpkgs -a branch=nixpkgs-unstable"
+            ]
       ]
     optName =
       Opts.optional
@@ -556,10 +557,12 @@ parseCmdDrop =
         Opts.progDesc "Drop dependency",
         Opts.headerDoc
           <| Just
-          <| "Examples:"
-          Opts.<$$> ""
-          Opts.<$$> "  niv drop jq"
-          Opts.<$$> "  niv drop my-package version"
+          <| Opts.vcat
+            [ "Examples:",
+              "",
+              "  niv drop jq",
+              "  niv drop my-package version"
+            ]
       ]
     parseDropAttributes :: Opts.Parser [T.Text]
     parseDropAttributes =
diff --git a/Biz/Bild/Deps.nix b/Biz/Bild/Deps.nix
index 46fa00f..23b096d 100644
--- a/Biz/Bild/Deps.nix
+++ b/Biz/Bild/Deps.nix
@@ -1,13 +1,9 @@
 _self: super:
 
 {
-  autogen = super.callPackage ./Deps/autogen.nix { };
+  # Needs upgrading for guile 3
+  # inspekt3d = super.callPackage ./Deps/inspekt3d.nix {};
 
-  guile = super.guile_3_0;
-
-  guile-opengl = super.callPackage ./Deps/guile-opengl.nix { };
-  # The libfive build is broken...
-  #inspekt3d = super.callPackage ./Deps/inspekt3d.nix {};
   guix = super.pkgs.stdenv.mkDerivation rec {
     pname = "guix";
     name = "${pname}-${version}";
@@ -35,4 +31,15 @@ _self: super:
   nostr-rs-relay = super.callPackage ./Deps/nostr-rs-relay.nix { };
 
   ollama = super.callPackage ./Deps/ollama.nix { acceleration = "cuda"; };
+
+  # https://github.com/NixOS/nixpkgs/issues/317147#issuecomment-2147343125
+  radicale = super.radicale.overrideAttrs (_old: rec {
+    version = "3.2.0";
+    src = super.fetchFromGitHub {
+      owner = "Kozea";
+      repo = "Radicale";
+      rev = "v${version}";
+      hash = "sha256-RxC8VOfdTXJZiAroDHTKjJqGWu65Z5uyb4WK1LOqubQ=";
+    };
+  });
 }
diff --git a/Biz/Bild/Deps/autogen.nix b/Biz/Bild/Deps/autogen.nix
deleted file mode 100644
index fc95b14..0000000
--- a/Biz/Bild/Deps/autogen.nix
+++ /dev/null
@@ -1,107 +0,0 @@
-# From: https://github.com/NixOS/nixpkgs/pull/139361
-{ lib, stdenv, buildPackages, fetchurl, fetchpatch, autoreconfHook, which
-, pkg-config, perl, guile, libxml2 }:
-
-stdenv.mkDerivation rec {
-  pname = "autogen";
-  version = "5.18.16";
-
-  src = fetchurl {
-    url = "mirror://gnu/autogen/rel${version}/autogen-${version}.tar.xz";
-    sha256 = "16mlbdys8q4ckxlvxyhwkdnh1ay9f6g0cyp1kylkpalgnik398gq";
-  };
-
-  patches = let
-    dp = { ver ? "1%255.18.16-4", pname, name ? (pname + ".diff"), sha256 }:
-      fetchurl {
-        url = "https://salsa.debian.org/debian/autogen/-/raw/debian/${ver}"
-          + "/debian/patches/${pname}.diff?inline=false";
-        inherit name sha256;
-      };
-  in [
-    (dp {
-      pname = "20_no_Werror";
-      sha256 = "08z4s2ifiqyaacjpd9pzr59w8m4j3548kkaq1bwvp2gjn29m680x";
-    })
-    (dp {
-      pname = "30_ag_macros.m4_syntax_error";
-      sha256 = "1z8vmbwbkz3505wd33i2xx91mlf8rwsa7klndq37nw821skxwyh3";
-    })
-    (dp {
-      pname = "31_allow_overriding_AGexe_for_crossbuild";
-      sha256 = "0h9wkc9bqb509knh8mymi43hg6n6sxg2lixvjlchcx7z0j7p8xkf";
-    })
-    # Next upstream release will contain guile-3 support. We apply non-invasive
-    # patch meanwhile.
-    (fetchpatch {
-      name = "guile-3.patch";
-      url =
-        "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-devel/autogen/files/autogen-5.18.16-guile-3.patch?id=43bcc61c56a5a7de0eaf806efec7d8c0e4c01ae7";
-      sha256 = "18d7y1f6164dm1wlh7rzbacfygiwrmbc35a7qqsbdawpkhydm5lr";
-    })
-  ];
-
-  outputs = [ "bin" "dev" "lib" "out" "man" "info" ];
-
-  nativeBuildInputs = [
-    which
-    pkg-config
-    perl
-    autoreconfHook # patches applied
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    # autogen needs a build autogen when cross-compiling
-    buildPackages.buildPackages.autogen
-    buildPackages.texinfo
-  ];
-  buildInputs = [ guile libxml2 ];
-
-  preConfigure = ''
-    export MAN_PAGE_DATE=$(date '+%Y-%m-%d' -d "@$SOURCE_DATE_EPOCH")
-  '';
-
-  configureFlags = [
-    # Make sure to use a static value for the timeout. If we do not set a value
-    # here autogen will select one based on the execution time of the configure
-    # phase which is not really reproducible.
-    #
-    # If you are curious about the number 78, it has been cargo-culted from
-    # Debian: https://salsa.debian.org/debian/autogen/-/blob/master/debian/rules#L21
-    "--enable-timeout=78"
-  ] ++ (lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "--with-libxml2=${libxml2.dev}"
-    "--with-libxml2-cflags=-I${libxml2.dev}/include/libxml2"
-    # the configure check for regcomp wants to run a host program
-    "libopts_cv_with_libregex=yes"
-    #"MAKEINFO=${buildPackages.texinfo}/bin/makeinfo"
-  ])
-  # See: https://sourceforge.net/p/autogen/bugs/187/
-    ++ lib.optionals stdenv.isDarwin [ "ac_cv_func_utimensat=no" ];
-
-  #doCheck = true; # not reliable
-
-  postInstall = ''
-    mkdir -p $dev/bin
-    mv $bin/bin/autoopts-config $dev/bin
-
-    for f in $lib/lib/autogen/tpl-config.tlib $out/share/autogen/tpl-config.tlib; do
-      sed -e "s|$dev/include|/no-such-autogen-include-path|" -i $f
-      sed -e "s|$bin/bin|/no-such-autogen-bin-path|" -i $f
-      sed -e "s|$lib/lib|/no-such-autogen-lib-path|" -i $f
-    done
-
-  '' + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    # remove /build/** from RPATHs
-    for f in "$bin"/bin/*; do
-      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)/build/[^:]*:@\1@g')"
-      patchelf --set-rpath "$nrp" "$f"
-    done
-  '';
-
-  meta = with lib; {
-    description = "Automated text and program generation tool";
-    license = with licenses; [ gpl3Plus lgpl3Plus ];
-    homepage = "https://www.gnu.org/software/autogen/";
-    platforms = platforms.all;
-    maintainers = [ ];
-  };
-}
diff --git a/Biz/Bild/Deps/guile-opengl.nix b/Biz/Bild/Deps/guile-opengl.nix
index d547042..af01082 100644
--- a/Biz/Bild/Deps/guile-opengl.nix
+++ b/Biz/Bild/Deps/guile-opengl.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, pkgconfig, guile, libGL, libGLU, freeglut }:
+{ stdenv, lib, fetchurl, pkg-config, guile, libGL, libGLU, freeglut }:
 
 let
   name = "guile-opengl-${version}";
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
       --replace '(dynamic-link "libglut")' '(dynamic-link "${freeglut}/lib/libglut.so")'
   '';
 
-  nativeBuildInputs = [ pkgconfig guile libGL libGLU freeglut ];
+  nativeBuildInputs = [ pkg-config guile libGL libGLU freeglut ];
 
   meta = with lib; {
     description = "Guile bindings for the OpenGL graphics API";
diff --git a/Biz/Bild/Deps/inspekt3d.nix b/Biz/Bild/Deps/inspekt3d.nix
index d1cf60e..a9dac3d 100644
--- a/Biz/Bild/Deps/inspekt3d.nix
+++ b/Biz/Bild/Deps/inspekt3d.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, autoreconfHook, pkgconfig, guile, guile-opengl, mesa
+{ stdenv, lib, autoreconfHook, pkg-config, guile, guile-opengl, mesa
 , glibcLocales, libfive, sources }:
 
 stdenv.mkDerivation {
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   src = sources.inspekt3d;
   version = "unstable-2018-10-17";
 
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [ guile glibcLocales mesa ];
   propagatedBuildInputs = [ guile-opengl libfive ];
 
@@ -28,4 +28,3 @@ stdenv.mkDerivation {
     platforms = platforms.all;
   };
 }
-
diff --git a/Biz/Bild/Example.py b/Biz/Bild/Example.py
index dd9a6ef..e5766ba 100644
--- a/Biz/Bild/Example.py
+++ b/Biz/Bild/Example.py
@@ -15,6 +15,9 @@ def cryptic_hello(name: str) -> str:
     Encrypt and decrypt `name`.
 
     Example taken from `cryptography` docs.
+
+    Raises:
+        ValueError: if decryption fails
     """
     key = cryptography.fernet.Fernet.generate_key()
     f = cryptography.fernet.Fernet(key)
diff --git a/Biz/Bild/Nixpkgs.nix b/Biz/Bild/Nixpkgs.nix
index 8bc9cad..d53a125 100644
--- a/Biz/Bild/Nixpkgs.nix
+++ b/Biz/Bild/Nixpkgs.nix
@@ -15,32 +15,22 @@ let
   # package overlays, because of the 'null' from 'overrideSource'
   depsOverlay = _: pkgs: pkgs.overridePinnedDeps pkgs.overrideSource;
 
+  overlays = [
+    (_: _: { inherit sources; })
+    (import ./CcacheWrapper.nix)
+    (import ./Functions.nix)
+    depsOverlay
+    (import ./Deps.nix)
+    (import ./Python.nix)
+    (import ./Haskell.nix)
+  ];
 in {
-  nixos-23_11 = import sources.nixos-23_11 {
-    inherit system config;
-    overlays = [
-      (_: _: { inherit sources; })
-      (import ./CcacheWrapper.nix)
-      (import ./Functions.nix)
-      depsOverlay
-      (import ./Deps.nix)
-      (import ./Python.nix)
-      (import ./Haskell.nix)
-    ];
-  };
+  nixos-24_05 = import sources.nixos-24_05 {
+    inherit system config overlays;
 
-  nixos-unstable-small = import sources.nixos-unstable-small {
-    inherit system config;
-    overlays = [
-      (_: _: { inherit sources; })
-      (import ./CcacheWrapper.nix)
-      (import ./Functions.nix)
-      depsOverlay
-      (import ./Deps.nix)
-      (import ./Python.nix)
-      (import ./Haskell.nix)
-    ];
   };
 
-}
+  nixos-unstable-small =
+    import sources.nixos-unstable-small { inherit system config overlays; };
 
+}
diff --git a/Biz/Bild/Sources.json b/Biz/Bild/Sources.json
index c12b6ce..53ac29f 100644
--- a/Biz/Bild/Sources.json
+++ b/Biz/Bild/Sources.json
@@ -47,11 +47,9 @@
     },
     "inspekt3d": {
         "branch": "master",
-        "sha256": "0lan6930g5a9z4ack9jj0zdd0mb2s6q2xzpiwcjdc3pvl9b1nbw4",
-        "type": "tarball",
-        "url": "https://gitlab.com/kavalogic-inc/inspekt3d/-/archive/703f52ccbfedad2bf5240bf8183d1b573c9d54ef/inspekt3d-703f52ccbfedad2bf5240bf8183d1b573c9d54ef.tar.gz",
-        "url_template": "https://gitlab.com/kavalogic-inc/inspekt3d/-/archive/<version>/inspekt3d-<version>.tar.gz",
-        "version": "703f52ccbfedad2bf5240bf8183d1b573c9d54ef"
+        "repo": "https://git.sr.ht/~morgansmith/inspekt3d",
+        "rev": "703f52ccbfedad2bf5240bf8183d1b573c9d54ef",
+        "type": "git"
     },
     "interegular": {
         "branch": "master",
@@ -84,10 +82,10 @@
         "homepage": "https://github.com/nmattia/niv",
         "owner": "nmattia",
         "repo": "niv",
-        "rev": "82e5cd1ad3c387863f0545d7591512e76ab0fc41",
-        "sha256": "090l219mzc0gi33i3psgph6s2pwsc8qy4lyrqjdj4qzkvmaj65a7",
+        "rev": "e80fc8fae87cc91f449533fca6b9cadf8be69e6c",
+        "sha256": "024hnxvqk8z5n2n54rj05l91q38g9y8nwvrj46xml13kjmg4shb3",
         "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/82e5cd1ad3c387863f0545d7591512e76ab0fc41.tar.gz",
+        "url": "https://github.com/nmattia/niv/archive/e80fc8fae87cc91f449533fca6b9cadf8be69e6c.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixos-23_05": {
@@ -114,6 +112,18 @@
         "url": "https://github.com/nixos/nixpkgs/archive/219951b495fc2eac67b1456824cc1ec1fd2ee659.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
+    "nixos-24_05": {
+        "branch": "nixos-24.05",
+        "description": "Nix Packages collection & NixOS",
+        "homepage": "",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a9b86fc2290b69375c5542b622088eb6eca2a7c3",
+        "sha256": "1mssfzy1nsansjmp5ckyl8vbk32va3abchpg19ljyak0xblxnjs1",
+        "type": "tarball",
+        "url": "https://github.com/nixos/nixpkgs/archive/a9b86fc2290b69375c5542b622088eb6eca2a7c3.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
     "nixos-mailserver": {
         "repo": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver",
         "rev": "f535d8123c4761b2ed8138f3d202ea710a334a1d",
@@ -123,28 +133,16 @@
         "url_template": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/<rev>/nixos-mailserver-<rev>.tar.gz",
         "version": "master"
     },
-    "nixos-unstable": {
-        "branch": "nixos-unstable",
-        "description": "Nix Packages collection & NixOS",
-        "homepage": "",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "fd281bd6b7d3e32ddfa399853946f782553163b5",
-        "sha256": "1hy81yj2dcg6kfsm63xcqf8kvigxglim1rcg1xpmy2rb6a8vqvsj",
-        "type": "tarball",
-        "url": "https://github.com/nixos/nixpkgs/archive/fd281bd6b7d3e32ddfa399853946f782553163b5.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
     "nixos-unstable-small": {
         "branch": "nixos-unstable-small",
         "description": "Nix Packages collection & NixOS",
         "homepage": "",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6cc8dbb00974248cdd1b7ebd05cbc7c0799ce974",
-        "sha256": "09lyljxmzvwc71j5s2k0ya3y04ya3lxy8bgcm36gi8vmrn42dgv0",
+        "rev": "a5e6a9e979367ee14f65d9c38119c30272f8455f",
+        "sha256": "08yfk81kpsizdzlbi8whpaarb0w0rw9aynlrvhn5gr5dfpv9hbsf",
         "type": "tarball",
-        "url": "https://github.com/nixos/nixpkgs/archive/6cc8dbb00974248cdd1b7ebd05cbc7c0799ce974.tar.gz",
+        "url": "https://github.com/nixos/nixpkgs/archive/a5e6a9e979367ee14f65d9c38119c30272f8455f.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "outlines": {
diff --git a/Biz/Cloud.nix b/Biz/Cloud.nix
index b2dbcfc..2254436 100644
--- a/Biz/Cloud.nix
+++ b/Biz/Cloud.nix
@@ -9,7 +9,6 @@ bild.os {
     ./Cloud/Chat.nix
     ./Cloud/Comms.nix
     ./Cloud/Git.nix
-    ./Cloud/Cgit.nix
     ./Cloud/Hardware.nix
     ./Cloud/Hub.nix
     ./Cloud/Mail.nix
diff --git a/Biz/Cloud/Cgit.nix b/Biz/Cloud/Cgit.nix
deleted file mode 100644
index 23fa00f..0000000
--- a/Biz/Cloud/Cgit.nix
+++ /dev/null
@@ -1,136 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  globalConfig = config;
-  settingsFormat = {
-    type = with lib.types;
-      let
-        value = oneOf [ int str ] // {
-          description = "INI-like atom (int or string)";
-        };
-        values = coercedTo value lib.singleton (listOf value) // {
-          description = value.description
-            + " or a list of them for duplicate keys";
-        };
-      in attrsOf (values);
-    generate = name: values:
-      pkgs.writeText name
-      (lib.generators.toKeyValue { listsAsDuplicateKeys = true; } values);
-  };
-in {
-  options.services.nginx.virtualHosts = mkOption {
-    type = types.attrsOf (types.submodule ({ config, ... }:
-      let
-        cfg = config.cgit;
-
-        # These are the global options for this submodule, but for nicer UX they
-        # are inlined into the freeform settings.  Hence they MUST NOT INTERSECT
-        # with any settings from cgitrc!
-        options = {
-          enable = mkEnableOption "cgit";
-
-          location = mkOption {
-            default = "/";
-            type = types.str;
-            description = ''
-              Location to serve cgit on.
-            '';
-          };
-
-          allowCrawlers = mkOption {
-            default = true;
-            type = types.bool;
-            description = ''
-              Allow search engines to crawl and index this site.
-            '';
-          };
-        };
-
-        # Remove the global options for serialization into cgitrc
-        settings = removeAttrs cfg (attrNames options);
-      in {
-        options.cgit = mkOption {
-          type = types.submodule {
-            freeformType = settingsFormat.type;
-            inherit options;
-            config = {
-              css = mkDefault "/cgit.css";
-              logo = mkDefault "/cgit.png";
-              favicon = mkDefault "/favicon.ico";
-            };
-          };
-          default = { };
-          example = literalExample ''
-            {
-              enable = true;
-              virtual-root = "/";
-              source-filter = "''${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
-              about-filter = "''${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
-              cache-size = 1000;
-              scan-path = "/srv/git";
-              include = [
-                (builtins.toFile "cgitrc-extra-1" '''
-                  # Anything that has to be in a particular order
-                ''')
-                (builtins.toFile "cgitrc-extra-2" '''
-                  # Anything that has to be in a particular order
-                ''')
-              ];
-            }
-          '';
-          description = ''
-            Verbatim contents of the cgit runtime configuration file. Documentation
-            (with cgitrc example file) is available in "man cgitrc". Or online:
-            http://git.zx2c4.com/cgit/tree/cgitrc.5.txt
-          '';
-        };
-
-        config = let location = removeSuffix "/" cfg.location;
-        in mkIf cfg.enable {
-
-          locations."${location}/" = {
-            root = "${pkgs.cgit}/cgit/";
-            tryFiles = "$uri @cgit";
-          };
-          locations."~ ^${location}/(cgit.(css|png)|favicon.ico|robots.txt)$" =
-            {
-              alias = "${pkgs.cgit}/cgit/$1";
-            };
-          locations."@cgit" = {
-            extraConfig = ''
-              include ${pkgs.nginx}/conf/fastcgi_params;
-              fastcgi_param   CGIT_CONFIG     ${
-                settingsFormat.generate "cgitrc" settings
-              };
-              fastcgi_param   SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
-              fastcgi_param   QUERY_STRING    $args;
-              fastcgi_param   HTTP_HOST       $server_name;
-              fastcgi_pass    unix:${globalConfig.services.fcgiwrap.socketAddress};
-            '' + (if cfg.location == "/" then ''
-              fastcgi_param   PATH_INFO   $uri;
-            '' else ''
-              fastcgi_split_path_info  ^(${location}/)(/?.+)$;
-              fastcgi_param  PATH_INFO  $fastcgi_path_info;
-            '') + (if !cfg.allowCrawlers then ''
-              add_header X-Robots-Tag "noindex, follow" always;
-            '' else
-              "");
-          };
-        };
-
-      }));
-  };
-
-  config = let vhosts = config.services.nginx.virtualHosts;
-  in mkIf (any (name: vhosts.${name}.cgit.enable) (attrNames vhosts)) {
-    # make the cgitrc manpage available
-    environment.systemPackages = [ pkgs.cgit ];
-
-    services.fcgiwrap.enable = true;
-  };
-
-  meta = {
-    maintainers = with lib.maintainers; [ bsima ]; # afix-space hmenke ];
-  };
-}
diff --git a/Biz/Cloud/Git.nix b/Biz/Cloud/Git.nix
index 3ef4530..bc97d23 100644
--- a/Biz/Cloud/Git.nix
+++ b/Biz/Cloud/Git.nix
@@ -6,6 +6,25 @@ let
   ports = import ./Ports.nix;
 in {
   services = {
+    cgit.cloud = {
+      enable = true;
+      nginx.location = "/git";
+      nginx.virtualHost = "/git";
+      scanPath = "/var/git/repositories";
+      settings = {
+        strict-export = "git-daemon-export-ok";
+        css = "/git/cgit.css";
+        logo = "/git/cgit.png";
+        root-title = "ben's git repos";
+        root-desc = "building";
+        enable-git-config = 1;
+        clone-url = lib.strings.concatStringsSep " " [
+          "https://$HTTP_HOST/git/$CGIT_REPO_URL"
+          "git://$HTTP_HOST/$CGIT_REPO_URL"
+          "git@$HTTP_HOST:$CGIT_REPO_URL"
+        ];
+      };
+    };
     gitolite = {
       enable = true;
       enableGitAnnex = true;
@@ -33,29 +52,6 @@ in {
       user = "gitDaemon";
       group = "gitDaemon";
     };
-    nginx.virtualHosts.${domain}.cgit = {
-      enable = true;
-      location = "/git";
-      allowCrawlers = false;
-      virtual-root = "/git";
-      css = "/git/cgit.css";
-      logo = "/git/cgit.png";
-      root-title = "ben's git repos";
-      root-desc = "building";
-      enable-git-config = 1;
-      clone-url = lib.strings.concatStringsSep " " [
-        "https://$HTTP_HOST/git/$CGIT_REPO_URL"
-        "git://$HTTP_HOST/$CGIT_REPO_URL"
-        "git@$HTTP_HOST:$CGIT_REPO_URL"
-      ];
-      include = [
-        # these depend on order, scan-path must come last
-        (builtins.toFile "cgitrc" ''
-          strict-export=git-daemon-export-ok
-          scan-path=${root}/repositories
-        '')
-      ];
-    };
     gerrit = {
       enable = false;
       builtinPlugins = [
diff --git a/Biz/Dev/Beryllium.nix b/Biz/Dev/Beryllium.nix
index cca0997..82374c3 100644
--- a/Biz/Dev/Beryllium.nix
+++ b/Biz/Dev/Beryllium.nix
@@ -1,5 +1,5 @@
 { bild }:
-bild.os-unstable {
+bild.os {
   imports = [
     ../OsBase.nix
     ../Packages.nix
diff --git a/Biz/Dev/Beryllium/Configuration.nix b/Biz/Dev/Beryllium/Configuration.nix
index e3e4232..b051315 100644
--- a/Biz/Dev/Beryllium/Configuration.nix
+++ b/Biz/Dev/Beryllium/Configuration.nix
@@ -1,7 +1,3 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
 { pkgs, ... }:
 
 {
@@ -54,7 +50,6 @@
   services.printing.enable = true;
 
   # Enable sound with pipewire.
-  sound.enable = true;
   hardware.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {
@@ -70,11 +65,7 @@
     #media-session.enable = true;
   };
 
-  # Enable touchpad support (enabled default in most desktopManager).
-  # services.xserver.libinput.enable = true;
-
   hardware.opengl.enable = true;
-  hardware.opengl.driSupport = true;
   hardware.opengl.driSupport32Bit = true;
   services.xserver.videoDrivers = [ "nvidia" ];
   hardware.nvidia.nvidiaPersistenced = true;
@@ -84,17 +75,7 @@
   hardware.nvidia.open = true;
   hardware.nvidia.nvidiaSettings = true;
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  #users.users.ben = {
-  #  isNormalUser = true;
-  #  description = "Ben Sima";
-  #  extraGroups = [ "networkmanager" "wheel" ];
-  #  packages = with pkgs; [
-  #    firefox
-  #    kate
-  #  #  thunderbird
-  #  ];
-  #};
+  hardware.keyboard.zsa.enable = true;
 
   services.xserver.displayManager.autoLogin.enable = false;
   services.xserver.displayManager.autoLogin.user = "ben";
@@ -109,36 +90,16 @@
 
   services.eternal-terminal.enable = true;
 
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
   environment.systemPackages = with pkgs; [
     v4l-utils
     linuxPackages.v4l2loopback
     nvtop
-    #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
-    #  wget
+    keymapp
   ];
 
   systemd.services.NetworkManager-wait-online.enable = false;
 
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-  # services.openssh.enable = true;
-
-  # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [ 24800 ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
+  networking.firewall.allowedTCPPorts = [ ports.barrier ];
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
diff --git a/Biz/Dev/Lithium/Configuration.nix b/Biz/Dev/Lithium/Configuration.nix
index b4e0660..97b00c8 100644
--- a/Biz/Dev/Lithium/Configuration.nix
+++ b/Biz/Dev/Lithium/Configuration.nix
@@ -52,7 +52,6 @@ in {
   virtualisation.virtualbox.host.headless = false;
   virtualisation.virtualbox.host.addNetworkInterface = false;
   virtualisation.virtualbox.guest.enable = false;
-  virtualisation.virtualbox.guest.x11 = false;
 
   services.my-hoogle.enable = true;
   services.my-hoogle.port = ports.hoogle;
diff --git a/Biz/Dev/Vpn.nix b/Biz/Dev/Vpn.nix
index 47f9c6e..9b791b7 100644
--- a/Biz/Dev/Vpn.nix
+++ b/Biz/Dev/Vpn.nix
@@ -8,7 +8,7 @@ in {
     enable = true;
     address = "0.0.0.0";
     port = ports.headscale;
-    settings = { };
+    settings = { dns.base_domain = "simatime.com"; };
   };
 
   services.nginx.virtualHosts.${domain} = {
diff --git a/Biz/Dragons/main.py b/Biz/Dragons/main.py
index 6e2c995..f85d9e7 100644
--- a/Biz/Dragons/main.py
+++ b/Biz/Dragons/main.py
@@ -47,7 +47,7 @@ def authors_for(
 
 def mailmap_users() -> list[str]:
     """Return users from the .mailmap file."""
-    with pathlib.Path(".mailmap").open() as file:
+    with pathlib.Path(".mailmap").open(encoding="utf8") as file:
         lines = file.readlines()
         return [find_user(line) for line in lines]
 
diff --git a/Biz/Log.py b/Biz/Log.py
index 675a73e..debbf26 100644
--- a/Biz/Log.py
+++ b/Biz/Log.py
@@ -1,6 +1,6 @@
 """Setup logging like Biz/Log.hs."""
 
-# ruff: noqa: builtin-attribute-shadowing
+# noqa: builtin-attribute-shadowing
 import logging
 import typing
 
diff --git a/Biz/Que/Client.py b/Biz/Que/Client.py
index 53f14e4..9620c5e 100644
--- a/Biz/Que/Client.py
+++ b/Biz/Que/Client.py
@@ -112,10 +112,10 @@ def then(args: argparse.Namespace, msg: str) -> None:
     """Perform an action when passed `--then`."""
     if args.then:
         logging.debug("then")
-        subprocess.run(
+        subprocess.run(  # noqa: S602
             args.then.format(msg=msg, que=args.target),
             check=False,
-            shell=True,  # noqa: S602
+            shell=True,
         )
 
 
@@ -124,7 +124,12 @@ def then(args: argparse.Namespace, msg: str) -> None:
 @retry(http.client.IncompleteRead)
 @retry(http.client.RemoteDisconnected)
 def recv(args: argparse.Namespace) -> None:
-    """Receive a message from the que."""
+    """
+    Receive a message from the que.
+
+    Raises:
+        ValueError: if url is malformed
+    """
     logging.debug("recv on: %s", args.target)
     if args.poll:
         req = request.Request(f"{args.host}/{args.target}/stream")
diff --git a/Biz/Repl.py b/Biz/Repl.py
index cd7bad6..6b60d02 100644
--- a/Biz/Repl.py
+++ b/Biz/Repl.py
@@ -43,6 +43,9 @@ def use(ns: str, path: str) -> None:
     Load or reload the module named 'ns' from 'path'.
 
     Like `use` in the Guile Scheme repl.
+
+    Raises:
+        ReplError: if module cannot be loaded
     """
     logging.info("loading %s from %s", ns, path)
     spec = importlib.util.spec_from_file_location(ns, path)
@@ -149,6 +152,9 @@ class CustomRepl:
         This is called on `sys.excepthook`, which runs when the repl doesn't
         know how to handle some input. So, we inspect `value` and provide
         alternate functionality, bottoming out at the default exception.
+
+        Raises:
+            ReplError: if caught exception is empty
         """
         # ruff: noqa: PLR0911
         if not isinstance(value, SyntaxError):