Reorganize and update nixpkgs upstreams

This patch does a few things:

1. Switches from nixpkgs-unstable to nixos-unstable{,-small}, simply because
   nixpkgs-unstable is not in cache.nixos.org, but nixos-unstable is, and -small
   is the same but requires all tests to pass. So we should prefer
   nixos-unstable-small, whenever possible.

2. Reorganizes the nixpkgs import code such that Nixpkgs.nix returns an attrset
   of all the nixpkgs that I want to use, rather than putting other nixpkgs
   branches into the main one as an overlay. This is much simpler and explicit,
   but it meant I had to change a lot of usages throughtout the nix codebase.

3. As a consequence of 2, moves the overlays into separate files so they can be
   re-used across nixpkgs branches.

14 files changed, 338 insertions, 291 deletions

diff --git a/Biz/Bild.nix b/Biz/Bild.nix
index 7a07f36..329726a 100644
--- a/Biz/Bild.nix
+++ b/Biz/Bild.nix
@@ -2,175 +2,172 @@
 
 let
   constants = import ./Bild/Constants.nix;
-  lib = nixpkgs.lib;
-  # put all of our stuff in the 'bild' namespace
-in nixpkgs // {
-  bild = rec {
-    # provided by .envrc
-    root = builtins.getEnv "CODEROOT";
-
-    inherit (nixpkgs) sources;
-
-    haskell = rec {
-      inherit (constants) ghcCompiler;
-
-      # all available packages
-      deps = import ./Bild/Deps/Haskell.nix;
-      packages = lib.attrsets.getAttrs deps nixpkgs.haskellPackages;
-
-      # make a ghc with dependencies
-      ghcWith = nixpkgs.haskell.packages.${ghcCompiler}.ghcWithHoogle;
-
-      # ghc with all packages, used for generating bild's package database
-      ghcPackageSetFull = ghcWith (p: lib.attrsets.attrVals deps p);
-
-      # bild's dependencies, needs to be hand-written
-      ghcPackageSetBild = ghcWith (hpkgs:
-        with hpkgs; [
-          aeson
-          async
-          base
-          bytestring
-          conduit
-          conduit-extra
-          containers
-          directory
-          docopt
-          filepath
-          process
-          protolude
-          rainbow
-          regex-applicative
-          split
-          tasty
-          tasty-hunit
-          tasty-quickcheck
-          text
-          hostname
-          wai # can remove when removed from Biz.Log
-        ]);
-    };
+  stable = nixpkgs.nixos-23_05;
+in rec {
+  # provided by .envrc
+  root = builtins.getEnv "CODEROOT";
+
+  inherit (stable) sources lib makeWrapper stdenv;
+
+  haskell = rec {
+    inherit (constants) ghcCompiler;
+
+    # all available packages
+    deps = import ./Bild/Deps/Haskell.nix;
+    packages = lib.attrsets.getAttrs deps stable.haskellPackages;
+
+    # make a ghc with dependencies
+    ghcWith = stable.haskell.packages.${ghcCompiler}.ghcWithHoogle;
+
+    # ghc with all packages, used for generating bild's package database
+    ghcPackageSetFull = ghcWith (p: lib.attrsets.attrVals deps p);
+
+    # bild's dependencies, needs to be hand-written
+    ghcPackageSetBild = ghcWith (hpkgs:
+      with hpkgs; [
+        aeson
+        async
+        base
+        bytestring
+        conduit
+        conduit-extra
+        containers
+        directory
+        docopt
+        filepath
+        process
+        protolude
+        rainbow
+        regex-applicative
+        split
+        tasty
+        tasty-hunit
+        tasty-quickcheck
+        text
+        hostname
+        wai # can remove when removed from Biz.Log
+      ]);
+  };
 
-    lisp = { sbclWith = nixpkgs.lispPackages_new.sbclWithPackages; };
+  lisp = { sbclWith = stable.lispPackages_new.sbclWithPackages; };
 
-    python = {
-      packages = nixpkgs.python3Packages;
-      pythonWith = nixpkgs.python3.withPackages;
-      buildPythonApplication = nixpkgs.python3.pkgs.buildPythonApplication;
-    };
+  python = {
+    packages = stable.python3.pkgs;
+    pythonWith = stable.python3.withPackages;
+    buildPythonApplication = stable.python3.pkgs.buildPythonApplication;
+  };
 
-    # c packages are just nixpkgs, filtered to just the list of deps i want
-    c.packages = lib.attrsets.getAttrs (import ./Bild/Deps/C.nix) nixpkgs.pkgs;
+  # c packages are just stable, filtered to just the list of deps i want
+  c.packages = lib.attrsets.getAttrs (import ./Bild/Deps/C.nix) stable.pkgs;
 
-    # expose some packages for inclusion in os/image builds
-    pkgs = with nixpkgs.pkgs; {
-      inherit deadnix git hlint indent ormolu shellcheck nixfmt mypy pkg-config;
-      ruff = unstable.ruff;
-    };
+  # exposed packages for inclusion in builds
+  pkgs = with stable.pkgs; {
+    inherit deadnix git hlint indent ormolu shellcheck nixfmt mypy pkg-config
+      rustc cmark;
+    ruff = nixpkgs.nixos-unstable-small.ruff;
+  };
 
-    # a standard nix build for bild, for bootstrapping. this should be the only
-    # hand-written builder we need
-    bild = nixpkgs.stdenv.mkDerivation {
-      name = "bild";
+  # a standard nix build for bild, for bootstrapping. this should be the only
+  # hand-written builder we need
+  bild = stable.stdenv.mkDerivation {
+    name = "bild";
+    src = ../.;
+    nativeBuildInputs = [ haskell.ghcPackageSetBild ];
+    buildInputs = [ stable.makeWrapper ];
+    propagatedBuildInputs = with stable; [
+      pkg-config
+      git
+      # this is just to get access to ghc-pkg in bild
+      (haskell.ghcWith (_: [ ]))
+
+      # lisp deps, remove this when i implement nix builds for lisp
+      guile
+      (lisp.sbclWith
+        (p: with p; [ asdf alexandria ])) # just enough to build Example.lisp
+    ];
+    strictDeps = true;
+    buildPhase = ''
+      mkdir -p $out/bin $out/lib/ghc-${haskell.ghcPackageSetFull.version}
+      cp -r \
+        ${haskell.ghcPackageSetFull}/lib/ghc-${haskell.ghcPackageSetFull.version}/package.conf.d \
+        $out/lib/ghc-${haskell.ghcPackageSetFull.version}
+      ghc \
+        -threaded \
+        -Werror \
+        -i. \
+        --make Biz/Bild.hs \
+        -main-is Biz.Bild \
+        -o $out/bin/bild
+    '';
+    installPhase = ''
+      wrapProgram $out/bin/bild \
+        --prefix PATH : ${
+          lib.makeBinPath [ haskell.ghcPackageSetBild stable.pkgs.git ]
+        } \
+        --set GHC_PACKAGE_PATH \
+        $out/lib/ghc-${haskell.ghcPackageSetFull.version}/package.conf.d
+    '';
+  };
+
+  # wrapper around bild
+  runBildAnalyze = target:
+    stable.stdenv.mkDerivation rec {
+      name = "bild-analysis";
       src = ../.;
-      nativeBuildInputs = [ haskell.ghcPackageSetBild ];
-      buildInputs = [ nixpkgs.makeWrapper ];
-      propagatedBuildInputs = with nixpkgs; [
-        pkg-config
-        git
-        # this is just to get access to ghc-pkg in bild
-        (haskell.ghcWith (_: [ ]))
-
-        # lisp deps, remove this when i implement nix builds for lisp
-        guile
-        (lisp.sbclWith
-          (p: with p; [ asdf alexandria ])) # just enough to build Example.lisp
-      ];
-      strictDeps = true;
+      USER = "nixbld";
+      HOSTNAME = "nix-sandbox";
+      # we need to remove the $src root because bild expects paths relative to the
+      # working directory:
+      TARGET = "." + lib.strings.removePrefix (toString src) (toString target);
       buildPhase = ''
-        mkdir -p $out/bin $out/lib/ghc-${haskell.ghcPackageSetFull.version}
-        cp -r \
-          ${haskell.ghcPackageSetFull}/lib/ghc-${haskell.ghcPackageSetFull.version}/package.conf.d \
-          $out/lib/ghc-${haskell.ghcPackageSetFull.version}
-        ghc \
-          -threaded \
-          -Werror \
-          -i. \
-          --make Biz/Bild.hs \
-          -main-is Biz.Bild \
-          -o $out/bin/bild
-      '';
-      installPhase = ''
-        wrapProgram $out/bin/bild \
-          --prefix PATH : ${
-            lib.makeBinPath [ haskell.ghcPackageSetBild pkgs.git ]
-          } \
-          --set GHC_PACKAGE_PATH \
-          $out/lib/ghc-${haskell.ghcPackageSetFull.version}/package.conf.d
+        export CODEROOT=$(pwd)
+        mkdir $out
+        ${bild}/bin/bild --plan "$TARGET" 1> $out/analysis.json \
+          2> >(tee -a $out/stderr >&2)
       '';
+      installPhase = "exit 0";
     };
 
-    # wrapper around bild
-    runBildAnalyze = target:
-      nixpkgs.stdenv.mkDerivation rec {
-        name = "bild-analysis";
-        src = ../.;
-        USER = "nixbld";
-        HOSTNAME = "nix-sandbox";
-        # we need to remove the $src root because bild expects paths relative to the
-        # working directory:
-        TARGET = "."
-          + lib.strings.removePrefix (toString src) (toString target);
-        buildPhase = ''
-          export CODEROOT=$(pwd)
-          mkdir $out
-          ${bild}/bin/bild --plan "$TARGET" 1> $out/analysis.json \
-            2> >(tee -a $out/stderr >&2)
-        '';
-        installPhase = "exit 0";
-      };
-
-    # gather data needed for compiling by analyzing the main module. returns the
-    # json object of the build
-    analyze = target:
-      builtins.readFile (runBildAnalyze target + "/analysis.json");
-
-    # this does a bild build for the given target, but entirely in nix. its kinda
-    # like IFD, but not as costly, i think
-    run = target: import ./Bild/Builder.nix { analysisJSON = analyze target; };
-
-    # the main development environment
-    env = nixpkgs.pkgs.mkShell {
-      name = "bizdev";
-      # this should just be dev tools
-      buildInputs = with nixpkgs.pkgs; [
-        bat
-        bc
-        bild
-        ctags
-        fd
-        figlet
-        fzf
-        git
-        git-branchless
-        gitlint
-        jq
-        lolcat
-        nixpkgs.haskell.packages.${constants.ghcCompiler}.fast-tags
-        ormolu
-        ripgrep
-        tree
-        wemux
-      ];
-      shellHook = ''
-        export GHC_PACKAGE_PATH=${bild}/lib/ghc-${haskell.ghcPackageSetFull.version}/package.conf.d
-      '';
-    };
+  # gather data needed for compiling by analyzing the main module. returns the
+  # json object of the build
+  analyze = target:
+    builtins.readFile (runBildAnalyze target + "/analysis.json");
+
+  # this does a bild build for the given target, but entirely in nix. its kinda
+  # like IFD, but not as costly, i think
+  run = target: import ./Bild/Builder.nix { analysisJSON = analyze target; };
+
+  # the main development environment
+  env = stable.pkgs.mkShell {
+    name = "bizdev";
+    # this should just be dev tools
+    buildInputs = with stable.pkgs; [
+      bat
+      bc
+      bild
+      ctags
+      fd
+      figlet
+      fzf
+      git
+      git-branchless
+      gitlint
+      jq
+      lolcat
+      stable.haskell.packages.${constants.ghcCompiler}.fast-tags
+      ormolu
+      ripgrep
+      tree
+      wemux
+    ];
+    shellHook = ''
+      export GHC_PACKAGE_PATH=${bild}/lib/ghc-${haskell.ghcPackageSetFull.version}/package.conf.d
+    '';
+  };
 
-    # build an operating system. 'cfg' is the NixOS config
-    os = cfg: (nixpkgs.nixos (_args: cfg)).toplevel;
+  # build an operating system. 'cfg' is the NixOS config
+  os = cfg: (stable.nixos (_args: cfg)).toplevel;
 
-    # build a docker image
-    image = nixpkgs.pkgs.dockerTools.buildImage;
-  };
+  # build a docker image
+  image = stable.pkgs.dockerTools.buildImage;
 }
diff --git a/Biz/Bild/Builder.nix b/Biz/Bild/Builder.nix
index 4bef830..d1fc48b 100644
--- a/Biz/Bild/Builder.nix
+++ b/Biz/Bild/Builder.nix
@@ -3,9 +3,9 @@
      wouldn't you?
    - Try to reuse as much upstream Nix as possible.
 */
-{ analysisJSON, nixpkgs ? import ../Bild.nix { } }:
-with nixpkgs;
+{ analysisJSON, bild ? import ../Bild.nix { } }:
 let
+  lib = bild.lib;
   analysis = builtins.fromJSON analysisJSON;
   build = _: target:
     let
@@ -53,7 +53,7 @@ let
       sysdeps_ = if isEmpty target.sysdeps then
         [ ]
       else
-        lib.attrsets.attrVals target.sysdeps pkgs;
+        lib.attrsets.attrVals target.sysdeps bild.pkgs;
 
       rundeps_ = if isEmpty target.rundeps then
         [ ]
@@ -63,16 +63,16 @@ let
       CODEROOT = ".";
 
       builders = {
-        base = stdenv.mkDerivation rec {
+        base = bild.stdenv.mkDerivation rec {
           inherit name src CODEROOT preBuild;
           buildInputs = langdeps_ ++ sysdeps_;
           installPhase = "install -D ${name} $out/bin/${name}";
           buildPhase = compileLine;
         };
 
-        haskell = stdenv.mkDerivation rec {
+        haskell = bild.stdenv.mkDerivation rec {
           inherit name src CODEROOT preBuild;
-          nativeBuildInputs = [ makeWrapper ];
+          nativeBuildInputs = [ bild.makeWrapper ];
           buildInputs = sysdeps_ ++ [
             (bild.haskell.ghcWith
               (p: (lib.attrsets.attrVals target.langdeps p)))
@@ -85,7 +85,7 @@ let
           '';
         };
 
-        c = stdenv.mkDerivation rec {
+        c = bild.stdenv.mkDerivation rec {
           inherit name src CODEROOT preBuild;
           buildInputs = langdeps_ ++ sysdeps_;
           installPhase = "install -D ${name} $out/bin/${name}";
@@ -155,4 +155,4 @@ let
   # return a single drv, so just take the first one for now. ideally i would only
   # pass Target, one at a time, (perhaps parallelized in haskell land) and then i
   # wouldn't need all of this let nesting
-in builtins.head (lib.attrsets.mapAttrsToList build analysis)
+in builtins.head (bild.lib.attrsets.mapAttrsToList build analysis)
diff --git a/Biz/Bild/Deps.nix b/Biz/Bild/Deps.nix
index 9a18c90..8f44dde 100644
--- a/Biz/Bild/Deps.nix
+++ b/Biz/Bild/Deps.nix
@@ -1,59 +1,6 @@
 _self: super:
 
-with import ./Constants.nix;
-let
-  buildCabal = sel: name: sel.callCabal2nix name super.sources.${name} { };
-  buildCabalSubdir = sel:
-    { name, src ? super.sources.${name}, subdir ? name }:
-    sel.callCabal2nix name (src + "/${subdir}") { };
-in rec {
-  haskell = super.haskell // {
-    packages = super.haskell.packages // {
-      "${ghcCompiler}" = super.haskell.packages."${ghcCompiler}".override
-        (_old: {
-          overrides = with super.pkgs.haskell.lib;
-            sel: sup:
-            super.overridePinnedDeps (buildCabal sel) // {
-              acid-state =
-                dontCheck sup.acid-state; # mac: "too many open files"
-              clay = doJailbreak sup.clay;
-              envy = doJailbreak sup.envy;
-              fast-tags =
-                sup.fast-tags.overrideAttrs (old: old // { patches = [ ]; });
-              generic-data = dontCheck
-                sup.generic-data; # https://github.com/Lysxia/generic-data/issues/56
-              readable =
-                doJailbreak sup.readable; # why is this even being built?
-              servant-auth = doJailbreak (buildCabalSubdir sel {
-                name = "servant-auth";
-                subdir = "servant-auth/servant-auth";
-              });
-              servant-server = doJailbreak sup.servant-server;
-              stripe-core = doJailbreak sup.stripe-core;
-              stripe-haskell = dontCheck sup.stripe-haskell;
-              stripe-http-client =
-                doJailbreak (dontCheck sup.stripe-http-client);
-              temporary = dontCheck sup.temporary;
-              wai-middleware-metrics = dontCheck sup.wai-middleware-metrics;
-            };
-        });
-    };
-  };
-
-  python3 = super.python3.override {
-    packageOverrides = _: pysuper:
-      with pysuper.pkgs.python3Packages; {
-        exllama = callPackage ./Deps/exllama.nix {
-          cudaPackages = super.pkgs.cudaPackages_11_7;
-        };
-        interegular = callPackage ./Deps/interegular.nix { };
-        outlines = callPackage ./Deps/outlines.nix { };
-        perscache = callPackage ./Deps/perscache.nix { };
-      };
-  };
-
-  python3Packages = python3.pkgs;
-
+{
   autogen = super.callPackage ./Deps/autogen.nix { };
 
   guile = super.guile_3_0;
diff --git a/Biz/Bild/Functions.nix b/Biz/Bild/Functions.nix
new file mode 100644
index 0000000..b725a00
--- /dev/null
+++ b/Biz/Bild/Functions.nix
@@ -0,0 +1,33 @@
+_: super: {
+  # Given a generic `builder`, will generate an attrset for all the packages
+  # pinned by `deps` with `builder` applied to the package. This attrset can
+  # then be merged with the rest of the packages in the set as part of an
+  # overlay or overrides.
+  overridePinnedDeps = builder:
+    super.lib.genAttrs (builtins.attrNames super.sources) builder;
+
+  # Modifies a derivation with our source and version, keeping super build
+  # rules. This will fail if build steps have changed, or if no build
+  # rules are available upstream.
+  overrideSource = depName:
+    if super ? "${depName}" && super.${depName} ? overrideAttrs then
+      super.${depName}.overrideAttrs (attrs:
+        attrs // rec {
+          version =
+            super.sources.${depName}.version or super.sources.${depName}.rev;
+          src = super.sources.${depName};
+        })
+    else
+      null;
+
+  # Simply override the 'src' attr on a drv. This is meant to be a simpler
+  # alternative to 'overrideSource' above. In an overaly, use it like:
+  #    mypkg = super.overrideSource super.mypkg super.sources.mypkg;
+  overrideSrc = dep: src:
+    dep.overrideAttrs (attrs:
+      attrs // {
+        version = src.version or src.rev;
+        src = src;
+      });
+}
+
diff --git a/Biz/Bild/Haskell.nix b/Biz/Bild/Haskell.nix
new file mode 100644
index 0000000..2c0529a
--- /dev/null
+++ b/Biz/Bild/Haskell.nix
@@ -0,0 +1,44 @@
+_self: super:
+
+let
+  ghcCompiler = "ghc924";
+  buildCabal = sel: name: sel.callCabal2nix name super.sources.${name} { };
+  buildCabalSubdir = sel:
+    { name, src ? super.sources.${name}, subdir ? name }:
+    sel.callCabal2nix name (src + "/${subdir}") { };
+in rec {
+
+  haskell = super.haskell // {
+    packages = super.haskell.packages // {
+      "${ghcCompiler}" = super.haskell.packages."${ghcCompiler}".override
+        (_old: {
+          overrides = with super.pkgs.haskell.lib;
+            sel: sup:
+            super.overridePinnedDeps (buildCabal sel) // {
+              acid-state =
+                dontCheck sup.acid-state; # mac: "too many open files"
+              clay = doJailbreak sup.clay;
+              envy = doJailbreak sup.envy;
+              fast-tags =
+                sup.fast-tags.overrideAttrs (old: old // { patches = [ ]; });
+              generic-data = dontCheck
+                sup.generic-data; # https://github.com/Lysxia/generic-data/issues/56
+              readable =
+                doJailbreak sup.readable; # why is this even being built?
+              servant-auth = doJailbreak (buildCabalSubdir sel {
+                name = "servant-auth";
+                subdir = "servant-auth/servant-auth";
+              });
+              servant-server = doJailbreak sup.servant-server;
+              stripe-core = doJailbreak sup.stripe-core;
+              stripe-haskell = dontCheck sup.stripe-haskell;
+              stripe-http-client =
+                doJailbreak (dontCheck sup.stripe-http-client);
+              temporary = dontCheck sup.temporary;
+              wai-middleware-metrics = dontCheck sup.wai-middleware-metrics;
+            };
+        });
+    };
+  };
+
+}
diff --git a/Biz/Bild/Nixpkgs.nix b/Biz/Bild/Nixpkgs.nix
index 8cb3448..f0e8698 100644
--- a/Biz/Bild/Nixpkgs.nix
+++ b/Biz/Bild/Nixpkgs.nix
@@ -2,54 +2,50 @@ let
   sources = import ./Sources.nix { sourcesFile = ./Sources.json; };
 
   config = {
+    allowAliases = true;
     allowBroken = true;
     allowUnfree = true;
+    checkMeta = true;
     cudaSupport = true;
   };
 
   system = __currentSystem;
 
-in import sources.nixos-23_05 {
-  inherit system config;
-  overlays = [
-    (_: _: { inherit sources; })
-
-    # add some functions
-    (_: old: {
-      # Given a generic `builder`, will generate an attrset for all the packages
-      # pinned by `deps` with `builder` applied to the package. This attrset can
-      # then be merged with the rest of the packages in the set as part of an
-      # overlay or overrides.
-      overridePinnedDeps = builder:
-        old.lib.genAttrs (builtins.attrNames sources) builder;
-
-      # Modifies a derivation with our source and version, keeping old build
-      # rules. This will fail if build steps have changed, or if no build
-      # rules are available upstream.
-      overrideSource = depName:
-        if old ? "${depName}" && old.${depName} ? overrideAttrs then
-          old.${depName}.overrideAttrs (attrs:
-            attrs // rec {
-              version = sources.${depName}.version or sources.${depName}.rev;
-              src = sources.${depName};
-            })
-        else
-          null;
-    })
-
-    # override pinned deps with our sources, this must come before other
-    # package overlays, because of the 'null' above
-    (_: pkgs: pkgs.overridePinnedDeps pkgs.overrideSource)
-
-    # add other nixpkgs distributions
-    (_: _: {
-      unstable = import sources.nixpkgs-unstable { inherit system config; };
-      nixos-23_11 = import sources.nixos-23_11 { inherit system config; };
-    })
-
-    # add our hand-written derivations
-    (import ./Deps.nix)
-    (_: pkgs: { niv = import pkgs.sources.niv { }; })
-  ];
+in {
+  nixos-23_05 = import sources.nixos-23_05 {
+    inherit system config;
+    overlays = [
+      (_: _: { inherit sources; })
+
+      (import ./Functions.nix)
+
+      # override pinned deps with our sources, this must come before other
+      # package overlays, because of the 'null' from 'overrideSource'
+      (_: pkgs: pkgs.overridePinnedDeps pkgs.overrideSource)
+
+      (import ./Deps.nix)
+      (import ./Python.nix)
+      (import ./Haskell.nix)
+    ];
+  };
+
+  nixos-23_11 = import sources.nixos-23_11 {
+    inherit system config;
+    overlays = [
+      (_: _: { inherit sources; })
+      (import ./Functions.nix)
+      (import ./Deps.nix)
+    ];
+  };
+
+  nixos-unstable-small = import sources.nixos-unstable-small {
+    inherit system config;
+    overlays = [
+      (_: _: { inherit sources; })
+      (import ./Functions.nix)
+      (import ./Deps.nix)
+    ];
+  };
+
 }
 
diff --git a/Biz/Bild/Python.nix b/Biz/Bild/Python.nix
new file mode 100644
index 0000000..51f35f1
--- /dev/null
+++ b/Biz/Bild/Python.nix
@@ -0,0 +1,23 @@
+_self: super: {
+  python3 = super.python3.override {
+    packageOverrides = _pyself: pysuper:
+      with pysuper.pkgs.python3Packages;
+      let dontCheck = p: p.overridePythonAttrs (_: { doCheck = false; });
+      in {
+        exllama = callPackage ./Deps/exllama.nix {
+          cudaPackages = super.pkgs.cudaPackages_11_7;
+        };
+        exllamav2 = callPackage ./Deps/exllamav2.nix {
+          cudaPackages = super.pkgs.cudaPackages_11_7;
+        };
+        interegular = callPackage ./Deps/interegular.nix { };
+        mypy = dontCheck pysuper.mypy;
+        outlines = callPackage ./Deps/outlines.nix { };
+        perscache = callPackage ./Deps/perscache.nix { };
+        safetensors = super.nixos-23_11.python310Packages.safetensors.override {
+          buildPythonPackage = pysuper.pkgs.python3Packages.buildPythonPackage;
+        };
+        tokenizers = dontCheck pysuper.tokenizers;
+      };
+  };
+}
diff --git a/Biz/Bild/Sources.json b/Biz/Bild/Sources.json
index 52112b5..ed6b096 100644
--- a/Biz/Bild/Sources.json
+++ b/Biz/Bild/Sources.json
@@ -121,17 +121,28 @@
         "url_template": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/<rev>/nixos-mailserver-<rev>.tar.gz",
         "version": "master"
     },
-    "nixpkgs-unstable": {
-        "branch": "master",
-        "description": "Nix Packages collection",
-        "homepage": "https://github.com/nixos/nixpkgs",
-        "name": "nixpkgs",
+    "nixos-unstable": {
+        "branch": "nixos-unstable",
+        "description": "Nix Packages collection & NixOS",
+        "homepage": "",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "fd281bd6b7d3e32ddfa399853946f782553163b5",
+        "sha256": "1hy81yj2dcg6kfsm63xcqf8kvigxglim1rcg1xpmy2rb6a8vqvsj",
+        "type": "tarball",
+        "url": "https://github.com/nixos/nixpkgs/archive/fd281bd6b7d3e32ddfa399853946f782553163b5.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "nixos-unstable-small": {
+        "branch": "nixos-unstable-small",
+        "description": "Nix Packages collection & NixOS",
+        "homepage": "",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0b6c600141ae4c516593d05b35294c44d55344da",
-        "sha256": "0x76w3rnkmwgscjljd33pv50r2057lbhcwhf1qvmp36vxrxa98w5",
+        "rev": "6cc8dbb00974248cdd1b7ebd05cbc7c0799ce974",
+        "sha256": "09lyljxmzvwc71j5s2k0ya3y04ya3lxy8bgcm36gi8vmrn42dgv0",
         "type": "tarball",
-        "url": "https://github.com/nixos/nixpkgs/archive/0b6c600141ae4c516593d05b35294c44d55344da.tar.gz",
+        "url": "https://github.com/nixos/nixpkgs/archive/6cc8dbb00974248cdd1b7ebd05cbc7c0799ce974.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "outlines": {
diff --git a/Biz/Cloud.nix b/Biz/Cloud.nix
index b379943..4ef98eb 100644
--- a/Biz/Cloud.nix
+++ b/Biz/Cloud.nix
@@ -1,5 +1,4 @@
-{ nixpkgs ? import ./Bild.nix { } }:
-with nixpkgs;
+{ bild ? import ./Bild.nix { } }:
 # Cloud infrastructure, always online. Mostly for messaging-related stuff.
 
 bild.os {
diff --git a/Biz/Dev/Beryllium.nix b/Biz/Dev/Beryllium.nix
index 2cfe61a..b46126d 100644
--- a/Biz/Dev/Beryllium.nix
+++ b/Biz/Dev/Beryllium.nix
@@ -1,5 +1,4 @@
-{ nixpkgs ? import ../Bild.nix { } }:
-with nixpkgs;
+{ bild ? import ../Bild.nix { } }:
 bild.os {
   imports = [
     ../OsBase.nix
diff --git a/Biz/Dev/Lithium.nix b/Biz/Dev/Lithium.nix
index d81b55c..fec8574 100644
--- a/Biz/Dev/Lithium.nix
+++ b/Biz/Dev/Lithium.nix
@@ -1,5 +1,4 @@
-{ nixpkgs ? import ../Bild.nix { } }:
-with nixpkgs;
+{ bild ? import ../Bild.nix { } }:
 # Dev machine for work and building stuff.
 
 bild.os {
diff --git a/Biz/Dragons/Analysis.nix b/Biz/Dragons/Analysis.nix
index 49a76e0..2ff0246 100644
--- a/Biz/Dragons/Analysis.nix
+++ b/Biz/Dragons/Analysis.nix
@@ -1,5 +1,5 @@
-{ nixpkgs ? import ../Bild.nix { } }:
-with nixpkgs;
+{ bild ? import ../Bild.nix { } }:
+
 # Run this like so:
 #
 #    bild Biz/Dragons/Analysis.nix
diff --git a/Biz/Ide/repl.sh b/Biz/Ide/repl.sh
index 1aca862..ceedb71 100755
--- a/Biz/Ide/repl.sh
+++ b/Biz/Ide/repl.sh
@@ -33,23 +33,23 @@ fi
   packageSet=$(jq --raw-output '.[].packageSet' <<< "$json")
   module=$(jq --raw-output '.[].mainModule' <<< "$json")
   BILD="(import ${CODEROOT:?}/Biz/Bild.nix {})"
-  declare -a flags=(--packages "$BILD.bild.pkgs.pkg-config")
+  declare -a flags=(--packages "$BILD.pkgs.pkg-config")
   for lib in "${sysdeps[@]}"; do
-    flags+=(--packages "$BILD.bild.pkgs.${lib}")
+    flags+=(--packages "$BILD.pkgs.${lib}")
   done
   for lib in "${rundeps[@]}"; do
-    flags+=(--packages "$BILD.bild.pkgs.${lib}")
+    flags+=(--packages "$BILD.pkgs.${lib}")
   done
   case $exts in
     C)
-      flags+=(--packages "$BILD.bild.pkgs.gcc")
+      flags+=(--packages "$BILD.pkgs.gcc")
       command="bash"
       ;;
     Hs)
       if [ -z ${var+PORT} ]; then
         echo "warn:  repl:  ghci does not support binding to a port"
       fi
-      flags+=(--packages "$BILD.bild.haskell.ghcWith (h: with h; [${langdeps[*]}])")
+      flags+=(--packages "$BILD.haskell.ghcWith (h: with h; [${langdeps[*]}])")
       command=${CMD:-"ghci -i${CODEROOT:?} -ghci-script ${CODEROOT:?}/.ghci ${targets[@]}"}
       ;;
     Scm)
@@ -60,16 +60,16 @@ fi
       command=${CMD:-"guile -L ${CODEROOT:?} -C ${CODEROOT:?}/_/int --r7rs --listen=${PORT:-37146}"}
       ;;
     Lisp)
-      flags+=(--packages "$BILD.bild.$packageSet (p: with p; [asdf swank ${langdeps[*]}])")
+      flags+=(--packages "$BILD.$packageSet (p: with p; [asdf swank ${langdeps[*]}])")
       command=${CMD:-"sbcl --eval '(require :asdf)' --eval '(require :swank)' --eval '(swank:create-server :port ${PORT:-4005})' --load $targets"}
       ;;
     Rs)
-      flags+=(--packages "$BILD.nixpkgs.rustc")
+      flags+=(--packages "$BILD.pkgs.rustc")
       command=bash
       ;;
     Py)
       langdeps+=("mypy")
-      flags+=(--packages "$BILD.bild.python.pythonWith (p: with p; [${langdeps[*]}])")
+      flags+=(--packages "$BILD.python.pythonWith (p: with p; [${langdeps[*]}])")
       PYTHONPATH=$CODEROOT:$PYTHONPATH
       pycommand="python -i $CODEROOT/Biz/Repl.py $module ${targets[*]}"
       command=${CMD:-"$pycommand"}
@@ -80,5 +80,5 @@ fi
       ;;
   esac
 ##
-  nix-shell "${flags[@]}" --command "$command"
+  nix-shell "${flags[@]}" --command "$command" --show-trace
 ##
diff --git a/Biz/Que.nix b/Biz/Que.nix
index ac89a56..6971914 100644
--- a/Biz/Que.nix
+++ b/Biz/Que.nix
@@ -1,5 +1,4 @@
-{ nixpkgs ? import ./Bild.nix { } }:
-with nixpkgs;
+{ bild ? import ./Bild.nix { } }:
 
 # The production server for que.run
 
@@ -28,7 +27,7 @@ bild.os {
     defaultGateway = "157.245.224.1";
     defaultGateway6 = "2604:a880:2:d1::1";
     dhcpcd.enable = false;
-    usePredictableInterfaceNames = lib.mkForce true;
+    usePredictableInterfaceNames = bild.lib.mkForce true;
     interfaces = {
       eth0 = {
         ipv4.addresses = [