From 7585be3dac300e04fc640eea61f7ca6a6aba02dd Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Sat, 22 Nov 2025 05:00:57 +0100
Subject: [PATCH 1/8] bump version

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index b70a3c3..4782076 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "hardware": {
       "locked": {
-        "lastModified": 1753122741,
-        "narHash": "sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM=",
+        "lastModified": 1762847253,
+        "narHash": "sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR+ZdLX8IbrU=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "cc66fddc6cb04ab479a1bb062f4d4da27c936a22",
+        "rev": "899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9",
         "type": "github"
       },
       "original": {

From a5dc014e6562146988ecf38cfbbf149f61f1780c Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Wed, 26 Nov 2025 02:50:41 +0100
Subject: [PATCH 2/8] make home-manager optional

As the home-manager depends on the actual used nixpkgs version
and is not always used, remove it from the base dependencies but
use still use it implictely if a home-manager input exists.
---
 export/nixosConfigurations.nix | 10 +++++++---
 flake.lock                     | 22 ----------------------
 flake.nix                      |  4 ----
 3 files changed, 7 insertions(+), 29 deletions(-)

diff --git a/export/nixosConfigurations.nix b/export/nixosConfigurations.nix
index e712097..f8e8118 100644
--- a/export/nixosConfigurations.nix
+++ b/export/nixosConfigurations.nix
@@ -5,9 +5,13 @@
       modules = builtins.concatLists (map (base: builtins.attrValues (flake.lib.scan { base = "${base}/host/${name}"; })) flake.lib.schema.base)
         ++ [ { config.networking.hostName = name; } ]
         ++ [ nixosModules.default ]
-        ++ [ inputs.home-manager.nixosModules.default ]
-        ++ [ { config.home-manager.sharedModules = [ hmModules.default ]; } ]
-        ++ [ { config.home-manager.extraSpecialArgs = { inherit flake namespace; }; } ]
+        ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {
+          imports = [ inputs.home-manager.nixosModules.default ];
+          config.home-manager = {
+            sharedModules = [ hmModules.default ];
+            extraSpecialArgs = { inherit flake namespace; };
+          };
+        }
         ++ builtins.attrValues nixosUsers
         ++ builtins.attrValues nixosGroups
         ;
diff --git a/flake.lock b/flake.lock
index 4782076..40bcf9f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -15,27 +15,6 @@
         "type": "github"
       }
     },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1747688870,
-        "narHash": "sha256-ypL9WAZfmJr5V70jEVzqGjjQzF0uCkz+AFQF7n9NmNc=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "d5f1f641b289553927b3801580598d200a501863",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-24.11",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1751274312,
@@ -55,7 +34,6 @@
     "root": {
       "inputs": {
         "hardware": "hardware",
-        "home-manager": "home-manager",
         "nixpkgs": "nixpkgs"
       }
     }
diff --git a/flake.nix b/flake.nix
index 5f5c238..3006b89 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,10 +2,6 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
     hardware.url = "github:nixos/nixos-hardware";
-    home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs = { self, ... }@inputs: import ./lib/flake.nix inputs ./.;

From f3f83a56ab109207812b61812eb61dee1e63521d Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Sat, 22 Nov 2025 05:00:57 +0100
Subject: [PATCH 3/8] bump version

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 40bcf9f..c5c30f9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "hardware": {
       "locked": {
-        "lastModified": 1762847253,
-        "narHash": "sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR+ZdLX8IbrU=",
+        "lastModified": 1764080039,
+        "narHash": "sha256-b1MtLQsQc4Ji1u08f+C6g5XrmLPkJQ1fhNkCt+0AERQ=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9",
+        "rev": "da17006633ca9cda369be82893ae36824a2ddf1a",
         "type": "github"
       },
       "original": {

From 72f2a2ddc0c85376ffa5ad10526b8eb00fc8daf4 Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Wed, 26 Nov 2025 02:52:11 +0100
Subject: [PATCH 4/8] remove inputs

We actually do not depend on any input here. Only if a
nixosConfiguration should be instantiated, but it is already
expected that the user will provide a (more up-to-date) nixpkgs
flake that we use.
---
 export/nixosConfigurations.nix | 38 +++++++++++++++-------------------
 flake.lock                     | 38 +---------------------------------
 flake.nix                      |  5 -----
 3 files changed, 18 insertions(+), 63 deletions(-)

diff --git a/export/nixosConfigurations.nix b/export/nixosConfigurations.nix
index f8e8118..8e180d9 100644
--- a/export/nixosConfigurations.nix
+++ b/export/nixosConfigurations.nix
@@ -1,23 +1,19 @@
 { nixosUsers ? {}, nixosGroups ? {}, nixosModules, hmModules ? { default = {}; }, ...}@flake: { ... }@inputs: { host, ... }@imports: let
-  host' = name: snippets: let
-    system = { namespace?"fbs42", nixpkgs?"nixpkgs" }: inputs.${nixpkgs}.lib.nixosSystem {
-      specialArgs = { inherit inputs flake namespace; };
-      modules = builtins.concatLists (map (base: builtins.attrValues (flake.lib.scan { base = "${base}/host/${name}"; })) flake.lib.schema.base)
-        ++ [ { config.networking.hostName = name; } ]
-        ++ [ nixosModules.default ]
-        ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {
-          imports = [ inputs.home-manager.nixosModules.default ];
-          config.home-manager = {
-            sharedModules = [ hmModules.default ];
-            extraSpecialArgs = { inherit flake namespace; };
-          };
-        }
-        ++ builtins.attrValues nixosUsers
-        ++ builtins.attrValues nixosGroups
-        ;
-    };
+  system = hostname: { namespace ? "fbs42", nixpkgs ? "nixpkgs" }: inputs.${nixpkgs}.lib.nixosSystem {
+    specialArgs = { inherit inputs flake namespace; };
+    modules = builtins.concatLists (map (base: builtins.attrValues (flake.lib.scan { base = "${base}/host/${hostname}"; })) flake.lib.schema.base)
+      ++ [ { config.networking.hostName = hostname; } ]
+      ++ [ nixosModules.default ]
+      ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {
+        imports = [ inputs.home-manager.nixosModules.default ];
+        config.home-manager = {
+          sharedModules = [ hmModules.default ];
+          extraSpecialArgs = { inherit flake namespace; };
+        };
+      }
+      ++ builtins.attrValues nixosUsers
+      ++ builtins.attrValues nixosGroups
+      ;
+  };
 
-    cfg = assert builtins.length snippets == 1; builtins.head snippets;
-  in system cfg;
-
-in builtins.mapAttrs host' host
+in builtins.mapAttrs (name: value: assert builtins.length value == 1; system name (builtins.head value)) host
diff --git a/flake.lock b/flake.lock
index c5c30f9..5999137 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,42 +1,6 @@
 {
   "nodes": {
-    "hardware": {
-      "locked": {
-        "lastModified": 1764080039,
-        "narHash": "sha256-b1MtLQsQc4Ji1u08f+C6g5XrmLPkJQ1fhNkCt+0AERQ=",
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "rev": "da17006633ca9cda369be82893ae36824a2ddf1a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1751274312,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-24.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "hardware": "hardware",
-        "nixpkgs": "nixpkgs"
-      }
-    }
+    "root": {}
   },
   "root": "root",
   "version": 7
diff --git a/flake.nix b/flake.nix
index 3006b89..4c62af4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,8 +1,3 @@
 {
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
-    hardware.url = "github:nixos/nixos-hardware";
-  };
-
   outputs = { self, ... }@inputs: import ./lib/flake.nix inputs ./.;
 }

From 1b5b697dfb01e5df8802999ce1d1884a123b5668 Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Sun, 14 Sep 2025 23:25:22 +0200
Subject: [PATCH 5/8] nix fmt: automatically expose the default nix formatter

---
 flake.lock    | 22 +++++++++++++++++++++-
 flake.nix     |  3 +++
 lib/flake.nix |  4 +++-
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/flake.lock b/flake.lock
index 5999137..340835b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,6 +1,26 @@
 {
   "nodes": {
-    "root": {}
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1763966396,
+        "narHash": "sha256-6eeL1YPcY1MV3DDStIDIdy/zZCDKgHdkCmsrLJFiZf0=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "5ae3b07d8d6527c42f17c876e404993199144b6a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
   },
   "root": "root",
   "version": 7
diff --git a/flake.nix b/flake.nix
index 4c62af4..ee3f3c4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,3 +1,6 @@
 {
+  # only used for nixfmt-tree
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
   outputs = { self, ... }@inputs: import ./lib/flake.nix inputs ./.;
 }
diff --git a/lib/flake.nix b/lib/flake.nix
index 4655a5d..d208f47 100644
--- a/lib/flake.nix
+++ b/lib/flake.nix
@@ -11,7 +11,9 @@ let
     convert = attr: value: value self inputs imports;
 
     result = (builtins.mapAttrs convert schema.exports);
-  in result // { lib = lib // (result.lib or {}); };
+  in {
+    formatter = builtins.mapAttrs (_: pkgs: pkgs.nixfmt-tree) inputs.nixpkgs.legacyPackages;
+  } // result // { lib = lib // (result.lib or {}); };
 
   flake =  { imports?{}, exports?{}, base?[] }@schema'old: { ... }@inputs'old: { ... }@imports'old: { ... }@inputs'new: base: let
     schema = {

From d281a23a8a4f587638dce9abe71fc1e1f812ff44 Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Sun, 14 Sep 2025 23:29:30 +0200
Subject: [PATCH 6/8] run nix format on this repository

---
 export/hmModule.nix            |   7 ++-
 export/hmModules.nix           |   8 ++-
 export/hmProfiles.nix          |   9 ++-
 export/iso.nix                 |  68 ++++++++++++++--------
 export/nixosConfigurations.nix |  62 ++++++++++++++------
 export/nixosGroup.nix          |  35 ++++++++----
 export/nixosModules.nix        |  17 +++++-
 export/nixosProfiles.nix       |   6 +-
 export/nixosUsers.nix          |  32 ++++++++---
 export/sdcard-rpi4.nix         |  72 ++++++++++++++---------
 group/nix.nix                  |   2 +-
 import/user.nix                |  43 +++++++++-----
 import/user/profile.nix        |   1 -
 lib/flake.nix                  | 101 ++++++++++++++++++++++++---------
 lib/host.nix                   |   1 -
 lib/scan.nix                   |  53 +++++++++++------
 user/root.nix                  |   2 +-
 17 files changed, 354 insertions(+), 165 deletions(-)
 delete mode 100644 lib/host.nix

diff --git a/export/hmModule.nix b/export/hmModule.nix
index 165dbac..8bac504 100644
--- a/export/hmModule.nix
+++ b/export/hmModule.nix
@@ -1,3 +1,6 @@
-{ ... }@flake: { ... }@inputs: { ... }@imports: {
-  imports = builtins.attrValues (flake.hmModules or {});
+{ ... }@flake:
+{ ... }@inputs:
+{ ... }@imports:
+{
+  imports = builtins.attrValues (flake.hmModules or { });
 }
diff --git a/export/hmModules.nix b/export/hmModules.nix
index ff37dd1..22a47bf 100644
--- a/export/hmModules.nix
+++ b/export/hmModules.nix
@@ -1,4 +1,8 @@
-flake: { ... }@inputs: { ... }@imports: let
+flake:
+{ ... }@inputs:
+{ ... }@imports:
+let
   module' = name: imports: builtins.trace "user module: ${name}" { inherit imports; };
   modules = builtins.mapAttrs module' imports."user/module";
-in { default = module' "default" (builtins.attrValues modules); } // modules
+in
+{ default = module' "default" (builtins.attrValues modules); } // modules
diff --git a/export/hmProfiles.nix b/export/hmProfiles.nix
index 192bda7..0ce4160 100644
--- a/export/hmProfiles.nix
+++ b/export/hmProfiles.nix
@@ -1,4 +1,7 @@
-{ ... }@flake: { ... }@inputs: { profile, ... }@imports: let
+{ ... }@flake:
+{ ... }@inputs:
+{ profile, ... }@imports:
+let
   profile' = name: snippets: builtins.trace "home-manager: profile: ${name}" { imports = snippets; };
-in builtins.mapAttrs profile' profile
-
+in
+builtins.mapAttrs profile' profile
diff --git a/export/iso.nix b/export/iso.nix
index 153bd59..68c076d 100644
--- a/export/iso.nix
+++ b/export/iso.nix
@@ -1,32 +1,50 @@
-{ nixosUsers ? {}, nixosGroups ? {}, nixosModules, hmModules ? { default = {}; }, ...}@flake: { ... }@inputs: { host, ... }@imports: let
-  host' = name: snippets: let
+{
+  nixosUsers ? { },
+  nixosGroups ? { },
+  nixosModules,
+  hmModules ? {
+    default = { };
+  },
+  ...
+}@flake:
+{ ... }@inputs:
+{ host, ... }@imports:
+let
+  host' =
+    name: snippets:
+    let
 
-    overlay = self: super: {
-      makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
-    };
-
-    common = { modulesPath, lib, ... }: {
-      config.nixpkgs.overlays = [ overlay ];
-      config.networking.hostName = lib.mkForce name;
-      config.home-manager = {
-        sharedModules = [ hmModules.default ] ;
+      overlay = self: super: {
+        makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
       };
 
-      imports = [
-        (modulesPath + "/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix")
-        nixosModules.default
-        inputs.home-manager.nixosModules.default
-      ];
-    };
+      common =
+        { modulesPath, lib, ... }:
+        {
+          config.nixpkgs.overlays = [ overlay ];
+          config.networking.hostName = lib.mkForce name;
+          config.home-manager = {
+            sharedModules = [ hmModules.default ];
+          };
 
-    system = inputs.nixpkgs.lib.nixosSystem {
-      specialArgs = { inherit inputs flake; };
-      modules = [ common ]
+          imports = [
+            (modulesPath + "/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix")
+            nixosModules.default
+            inputs.home-manager.nixosModules.default
+          ];
+        };
+
+      system = inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = { inherit inputs flake; };
+        modules = [
+          common
+        ]
         ++ snippets
         ++ builtins.attrValues nixosUsers
-        ++ builtins.attrValues nixosGroups
-        ;
-    };
-  in system.config.system.build.isoImage;
+        ++ builtins.attrValues nixosGroups;
+      };
+    in
+    system.config.system.build.isoImage;
 
-in builtins.mapAttrs host' host
+in
+builtins.mapAttrs host' host
diff --git a/export/nixosConfigurations.nix b/export/nixosConfigurations.nix
index 8e180d9..f8dba98 100644
--- a/export/nixosConfigurations.nix
+++ b/export/nixosConfigurations.nix
@@ -1,19 +1,45 @@
-{ nixosUsers ? {}, nixosGroups ? {}, nixosModules, hmModules ? { default = {}; }, ...}@flake: { ... }@inputs: { host, ... }@imports: let
-  system = hostname: { namespace ? "fbs42", nixpkgs ? "nixpkgs" }: inputs.${nixpkgs}.lib.nixosSystem {
-    specialArgs = { inherit inputs flake namespace; };
-    modules = builtins.concatLists (map (base: builtins.attrValues (flake.lib.scan { base = "${base}/host/${hostname}"; })) flake.lib.schema.base)
-      ++ [ { config.networking.hostName = hostname; } ]
-      ++ [ nixosModules.default ]
-      ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {
-        imports = [ inputs.home-manager.nixosModules.default ];
-        config.home-manager = {
-          sharedModules = [ hmModules.default ];
-          extraSpecialArgs = { inherit flake namespace; };
-        };
-      }
-      ++ builtins.attrValues nixosUsers
-      ++ builtins.attrValues nixosGroups
-      ;
-  };
+{
+  nixosUsers ? { },
+  nixosGroups ? { },
+  nixosModules,
+  hmModules ? {
+    default = { };
+  },
+  ...
+}@flake:
+{ ... }@inputs:
+{ host, ... }@imports:
+let
+  system =
+    hostname:
+    {
+      namespace ? "fbs42",
+      nixpkgs ? "nixpkgs",
+    }:
+    inputs.${nixpkgs}.lib.nixosSystem {
+      specialArgs = { inherit inputs flake namespace; };
+      modules =
+        builtins.concatLists (
+          map (
+            base: builtins.attrValues (flake.lib.scan { base = "${base}/host/${hostname}"; })
+          ) flake.lib.schema.base
+        )
+        ++ [ { config.networking.hostName = hostname; } ]
+        ++ [ nixosModules.default ]
+        ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {
+          imports = [ inputs.home-manager.nixosModules.default ];
+          config.home-manager = {
+            sharedModules = [ hmModules.default ];
+            extraSpecialArgs = { inherit flake namespace; };
+          };
+        }
+        ++ builtins.attrValues nixosUsers
+        ++ builtins.attrValues nixosGroups;
+    };
 
-in builtins.mapAttrs (name: value: assert builtins.length value == 1; system name (builtins.head value)) host
+in
+builtins.mapAttrs (
+  name: value:
+  assert builtins.length value == 1;
+  system name (builtins.head value)
+) host
diff --git a/export/nixosGroup.nix b/export/nixosGroup.nix
index 159b8c1..5deaea2 100644
--- a/export/nixosGroup.nix
+++ b/export/nixosGroup.nix
@@ -1,10 +1,25 @@
-flake: { ... }@inputs: { group, ... }@imports: let
-  group' = name: snippets: { pkgs, lib, options, config, ... }@args: let
-    invoke = x: if builtins.isFunction x then x args else x;
-  in {
-    options.fbs42.group.${name} = lib.mkEnableOption name;
-    config.users.groups.${name} = lib.mkIf
-      (config.fbs42.group.${name} || builtins.any (usr: usr.group == name) (builtins.attrValues config.users.users))
-      (lib.mkMerge (map invoke snippets));
-  };
-in builtins.mapAttrs group' group
+flake:
+{ ... }@inputs:
+{ group, ... }@imports:
+let
+  group' =
+    name: snippets:
+    {
+      pkgs,
+      lib,
+      options,
+      config,
+      ...
+    }@args:
+    let
+      invoke = x: if builtins.isFunction x then x args else x;
+    in
+    {
+      options.fbs42.group.${name} = lib.mkEnableOption name;
+      config.users.groups.${name} = lib.mkIf (
+        config.fbs42.group.${name}
+        || builtins.any (usr: usr.group == name) (builtins.attrValues config.users.users)
+      ) (lib.mkMerge (map invoke snippets));
+    };
+in
+builtins.mapAttrs group' group
diff --git a/export/nixosModules.nix b/export/nixosModules.nix
index c5dae22..e91361c 100644
--- a/export/nixosModules.nix
+++ b/export/nixosModules.nix
@@ -1,3 +1,14 @@
-flake: { ... }@inputs: { module, ... }@imports: let
-  modules = builtins.mapAttrs (name: imports: builtins.trace "module: ${name}" { inherit imports; }) module;
-in { default = { imports = builtins.attrValues modules; }; } // modules
+flake:
+{ ... }@inputs:
+{ module, ... }@imports:
+let
+  modules = builtins.mapAttrs (
+    name: imports: builtins.trace "module: ${name}" { inherit imports; }
+  ) module;
+in
+{
+  default = {
+    imports = builtins.attrValues modules;
+  };
+}
+// modules
diff --git a/export/nixosProfiles.nix b/export/nixosProfiles.nix
index 1655190..8b22fd4 100644
--- a/export/nixosProfiles.nix
+++ b/export/nixosProfiles.nix
@@ -1,2 +1,4 @@
-{ ... }@flake: { ... }@inputs: { profile, ... }@imports:
-  builtins.mapAttrs (name: imports: builtins.trace "profile: ${name}" { inherit imports; }) profile
+{ ... }@flake:
+{ ... }@inputs:
+{ profile, ... }@imports:
+builtins.mapAttrs (name: imports: builtins.trace "profile: ${name}" { inherit imports; }) profile
diff --git a/export/nixosUsers.nix b/export/nixosUsers.nix
index f0ff763..ca13dbd 100644
--- a/export/nixosUsers.nix
+++ b/export/nixosUsers.nix
@@ -1,5 +1,15 @@
-self: { ... }@inputs: { user, ... }@imports: let
-  user' = name: snippets: { pkgs, lib, config, ... }@args:
+self:
+{ ... }@inputs:
+{ user, ... }@imports:
+let
+  user' =
+    name: snippets:
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }@args:
     builtins.trace "user: ${name}" {
       options.fbs42.user.${name} = lib.mkEnableOption name;
       ## no longer with nixos-24.11
@@ -7,11 +17,15 @@ self: { ... }@inputs: { user, ... }@imports: let
       #  group = lib.mkDefault name;
       #};
 
-      imports = map ({ user, home-manager}: {
-        config = lib.mkIf config.fbs42.user.${name} {
-          users.users.${name} = (user args);
-          home-manager.users.${name} = home-manager;
-        };
-      }) snippets;
+      imports = map (
+        { user, home-manager }:
+        {
+          config = lib.mkIf config.fbs42.user.${name} {
+            users.users.${name} = (user args);
+            home-manager.users.${name} = home-manager;
+          };
+        }
+      ) snippets;
     };
-in builtins.mapAttrs user' user
+in
+builtins.mapAttrs user' user
diff --git a/export/sdcard-rpi4.nix b/export/sdcard-rpi4.nix
index 24a1a9d..8c8359a 100644
--- a/export/sdcard-rpi4.nix
+++ b/export/sdcard-rpi4.nix
@@ -1,34 +1,52 @@
-{ nixosUsers ? {}, nixosGroups ? {}, nixosModules, hmModules ? { default = {}; }, ...}@flake: { ... }@inputs: { host, ... }@imports: let
-  host' = name: snippets: let
+{
+  nixosUsers ? { },
+  nixosGroups ? { },
+  nixosModules,
+  hmModules ? {
+    default = { };
+  },
+  ...
+}@flake:
+{ ... }@inputs:
+{ host, ... }@imports:
+let
+  host' =
+    name: snippets:
+    let
 
-    overlay = self: super: {
-      makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
-    };
-
-    common = { modulesPath, lib, ... }: {
-      config.nixpkgs.overlays = [ overlay ];
-      config.networking.hostName = lib.mkForce name;
-      config.home-manager = {
-        sharedModules = [ hmModules.default ] ;
+      overlay = self: super: {
+        makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });
       };
 
-      imports = [
-        #(modulesPath + "/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix")
-        #(modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
-        (modulesPath + "/installer/sd-card/sd-image-raspberrypi.nix")
-        nixosModules.default
-        inputs.home-manager.nixosModules.default
-      ];
-    };
+      common =
+        { modulesPath, lib, ... }:
+        {
+          config.nixpkgs.overlays = [ overlay ];
+          config.networking.hostName = lib.mkForce name;
+          config.home-manager = {
+            sharedModules = [ hmModules.default ];
+          };
 
-    system = inputs.nixpkgs.lib.nixosSystem {
-      specialArgs = { inherit inputs flake; };
-      modules = [ common ]
+          imports = [
+            #(modulesPath + "/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix")
+            #(modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
+            (modulesPath + "/installer/sd-card/sd-image-raspberrypi.nix")
+            nixosModules.default
+            inputs.home-manager.nixosModules.default
+          ];
+        };
+
+      system = inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = { inherit inputs flake; };
+        modules = [
+          common
+        ]
         ++ snippets
         ++ builtins.attrValues nixosUsers
-        ++ builtins.attrValues nixosGroups
-        ;
-    };
-  in system.config.system.build.sdImage;
+        ++ builtins.attrValues nixosGroups;
+      };
+    in
+    system.config.system.build.sdImage;
 
-in builtins.mapAttrs host' host
+in
+builtins.mapAttrs host' host
diff --git a/group/nix.nix b/group/nix.nix
index 0967ef4..ffcd441 100644
--- a/group/nix.nix
+++ b/group/nix.nix
@@ -1 +1 @@
-{}
+{ }
diff --git a/import/user.nix b/import/user.nix
index 0e5562d..dd76452 100644
--- a/import/user.nix
+++ b/import/user.nix
@@ -1,21 +1,34 @@
 let
-  function = name: value: let
-    result = if builtins.isAttrs value then {...}: value else value;
-    result' = builtins.trace "result ${name}=${builtins.typeOf result}" result;
-  in
+  function =
+    name: value:
+    let
+      result = if builtins.isAttrs value then { ... }: value else value;
+      result' = builtins.trace "result ${name}=${builtins.typeOf result}" result;
+    in
     assert builtins.isFunction result';
     result;
 
-  config = { user?{}, home-manager?{} }@set:
+  config =
+    {
+      user ? { },
+      home-manager ? { },
+    }@set:
     builtins.mapAttrs function { inherit user home-manager; };
 
-in name: value: let
-  result = if builtins.isFunction value
-    then 
-       config { user = value; }
-    else if builtins.any (attr: builtins.hasAttr attr value) [ "user" "home-manager" ]
-      then
-        config value
-      else
-        config { user = value; };
-in result
+in
+name: value:
+let
+  result =
+    if builtins.isFunction value then
+      config { user = value; }
+    else if
+      builtins.any (attr: builtins.hasAttr attr value) [
+        "user"
+        "home-manager"
+      ]
+    then
+      config value
+    else
+      config { user = value; };
+in
+result
diff --git a/import/user/profile.nix b/import/user/profile.nix
index db2953a..bdf2229 100644
--- a/import/user/profile.nix
+++ b/import/user/profile.nix
@@ -1,2 +1 @@
 name: profile: profile
-
diff --git a/lib/flake.nix b/lib/flake.nix
index d208f47..d607d90 100644
--- a/lib/flake.nix
+++ b/lib/flake.nix
@@ -1,36 +1,81 @@
 let
   scan = import ./scan.nix;
 
-  flake' = self: { imports, exports , base }@schema: { ... }@inputs: { ... }@imports: let
-    lib = {
-      inherit scan schema inputs imports;
-      extend = flake schema inputs imports;
-      new = flake {} {} {};
-      # TODO: override
-    };
-    convert = attr: value: value self inputs imports;
+  flake' =
+    self:
+    {
+      imports,
+      exports,
+      base,
+    }@schema:
+    { ... }@inputs:
+    { ... }@imports:
+    let
+      lib = {
+        inherit
+          scan
+          schema
+          inputs
+          imports
+          ;
+        extend = flake schema inputs imports;
+        new = flake { } { } { };
+        # TODO: override
+      };
+      convert = attr: value: value self inputs imports;
 
-    result = (builtins.mapAttrs convert schema.exports);
-  in {
-    formatter = builtins.mapAttrs (_: pkgs: pkgs.nixfmt-tree) inputs.nixpkgs.legacyPackages;
-  } // result // { lib = lib // (result.lib or {}); };
-
-  flake =  { imports?{}, exports?{}, base?[] }@schema'old: { ... }@inputs'old: { ... }@imports'old: { ... }@inputs'new: base: let
-    schema = {
-      imports = (schema'old.imports or {}) // scan { base = base + "/import"; recursive = true; };
-      exports = (schema'old.exports or {}) // scan { base = base + "/export"; };
-      base = [ base ] ++ (schema'old.base or []);
+      result = (builtins.mapAttrs convert schema.exports);
+    in
+    {
+      formatter = builtins.mapAttrs (_: pkgs: pkgs.nixfmt-tree) inputs.nixpkgs.legacyPackages;
+    }
+    // result
+    // {
+      lib = lib // (result.lib or { });
     };
 
-    merge = attr: let
-      old = imports'old.${attr} or {};
-      new = imports'new.${attr} or {};
-    in builtins.mapAttrs (attr: _: (old.${attr} or []) ++ (new.${attr} or [])) (old//new);
+  flake =
+    {
+      imports ? { },
+      exports ? { },
+      base ? [ ],
+    }@schema'old:
+    { ... }@inputs'old:
+    { ... }@imports'old:
+    { ... }@inputs'new:
+    base:
+    let
+      schema = {
+        imports =
+          (schema'old.imports or { })
+          // scan {
+            base = base + "/import";
+            recursive = true;
+          };
+        exports = (schema'old.exports or { }) // scan { base = base + "/export"; };
+        base = [ base ] ++ (schema'old.base or [ ]);
+      };
 
-    imports'new = builtins.mapAttrs (name: value: scan { base = base + "/${name}"; convert = name: content: [ (value name content) ]; }) schema.imports;
-    result = flake' result schema
-      (inputs'old // (builtins.removeAttrs inputs'new ["self"]))
-      (builtins.mapAttrs (attr: _: merge attr) schema.imports);
-  in result;
+      merge =
+        attr:
+        let
+          old = imports'old.${attr} or { };
+          new = imports'new.${attr} or { };
+        in
+        builtins.mapAttrs (attr: _: (old.${attr} or [ ]) ++ (new.${attr} or [ ])) (old // new);
 
-in flake {} {} {}
+      imports'new = builtins.mapAttrs (
+        name: value:
+        scan {
+          base = base + "/${name}";
+          convert = name: content: [ (value name content) ];
+        }
+      ) schema.imports;
+      result = flake' result schema (inputs'old // (builtins.removeAttrs inputs'new [ "self" ])) (
+        builtins.mapAttrs (attr: _: merge attr) schema.imports
+      );
+    in
+    result;
+
+in
+flake { } { } { }
diff --git a/lib/host.nix b/lib/host.nix
deleted file mode 100644
index b387ebc..0000000
--- a/lib/host.nix
+++ /dev/null
@@ -1 +0,0 @@
-self: 
diff --git a/lib/scan.nix b/lib/scan.nix
index d664df9..dfb9eb1 100644
--- a/lib/scan.nix
+++ b/lib/scan.nix
@@ -1,23 +1,42 @@
-{ base, convert ? name: value: value, recursive ? false }:
+{
+  base,
+  convert ? name: value: value,
+  recursive ? false,
+}:
 let
-  scan = sub: let
-    all = builtins.readDir (base + "/${builtins.concatStringsSep "/" sub}");
-    names = filter: builtins.filter filter (builtins.attrNames all);
-    nix = name: all.${name} == "regular" && builtins.stringLength name > 4 && builtins.substring (builtins.stringLength name - 4) 4 name == ".nix";
-    dir = name: all.${name} == "directory";
-    files = map (name: sub ++ [ (builtins.substring 0 (builtins.stringLength name - 4) name) ]) (names nix);
-    dirs = builtins.concatLists (map (name: scan (sub ++ [name])) (names dir));
-  in if recursive then files ++ dirs else files;
+  scan =
+    sub:
+    let
+      all = builtins.readDir (base + "/${builtins.concatStringsSep "/" sub}");
+      names = filter: builtins.filter filter (builtins.attrNames all);
+      nix =
+        name:
+        all.${name} == "regular"
+        && builtins.stringLength name > 4
+        && builtins.substring (builtins.stringLength name - 4) 4 name == ".nix";
+      dir = name: all.${name} == "directory";
+      files = map (name: sub ++ [ (builtins.substring 0 (builtins.stringLength name - 4) name) ]) (
+        names nix
+      );
+      dirs = builtins.concatLists (map (name: scan (sub ++ [ name ])) (names dir));
+    in
+    if recursive then files ++ dirs else files;
 
-  root = scan [];
+  root = scan [ ];
 
-  item = relative: let
-    name = builtins.concatStringsSep "/" relative;
-    absolute = base + "/${name}.nix";
-    content = import absolute;
-    value = convert name content;
-  in { inherit name value; };
+  item =
+    relative:
+    let
+      name = builtins.concatStringsSep "/" relative;
+      absolute = base + "/${name}.nix";
+      content = import absolute;
+      value = convert name content;
+    in
+    {
+      inherit name value;
+    };
 
   items = map item root;
 
-in if builtins.pathExists base then builtins.listToAttrs (map item root) else {}
+in
+if builtins.pathExists base then builtins.listToAttrs (map item root) else { }
diff --git a/user/root.nix b/user/root.nix
index 0967ef4..ffcd441 100644
--- a/user/root.nix
+++ b/user/root.nix
@@ -1 +1 @@
-{}
+{ }

From 01106110fe027fd6bf93dad3f7e4652ef86321fb Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Wed, 26 Nov 2025 02:40:42 +0100
Subject: [PATCH 7/8] automatically import ${namespace}.${class(es)} as modules

Allow to specify a list of classes in the host/<hostname>.nix (by
default the class <hostname> is used) that will automatically load
specified outputs of inputs.
---
 export/nixosConfigurations.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/export/nixosConfigurations.nix b/export/nixosConfigurations.nix
index f8dba98..eb8c570 100644
--- a/export/nixosConfigurations.nix
+++ b/export/nixosConfigurations.nix
@@ -15,6 +15,7 @@ let
     {
       namespace ? "fbs42",
       nixpkgs ? "nixpkgs",
+      classes ? [ hostname ],
     }:
     inputs.${nixpkgs}.lib.nixosSystem {
       specialArgs = { inherit inputs flake namespace; };
@@ -24,6 +25,9 @@ let
             base: builtins.attrValues (flake.lib.scan { base = "${base}/host/${hostname}"; })
           ) flake.lib.schema.base
         )
+        ++ map (class: {
+          imports = map (input: input.${namespace}.${class} or { }) (builtins.attrValues inputs);
+        }) classes
         ++ [ { config.networking.hostName = hostname; } ]
         ++ [ nixosModules.default ]
         ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {

From d1e661df5d4ed4d754ecf3b93af65964f3617b47 Mon Sep 17 00:00:00 2001
From: Jonas Rabenstein <nonapode@fbs42.ddnss.de>
Date: Wed, 26 Nov 2025 15:58:37 +0100
Subject: [PATCH 8/8] nixosConfiguration: preSwitchCkeck: nvd

---
 export/nixosConfigurations.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/export/nixosConfigurations.nix b/export/nixosConfigurations.nix
index eb8c570..21e8a45 100644
--- a/export/nixosConfigurations.nix
+++ b/export/nixosConfigurations.nix
@@ -10,6 +10,23 @@
 { ... }@inputs:
 { host, ... }@imports:
 let
+  pre-switch-check =
+    { pkgs, lib, config, ... }:
+    {
+      config.system.preSwitchChecks.nvd = ''
+        nvd_check=y
+        if [[ -d /run/current-system ]]
+        then
+          ${lib.getExe pkgs.nvd} --nix-bin-dir ${config.nix.package}/bin diff /run/current-system "''${1}"
+          if [[ -t 0 ]]; then
+            printf 'really %s to %s? [y]es/[N]o ' "''${2}" "''${1}"
+            read -r nvd_check
+          fi
+        fi
+        [[ "''${nvd_check}" == y ]]
+      '';
+    };
+
   system =
     hostname:
     {
@@ -28,6 +45,7 @@ let
         ++ map (class: {
           imports = map (input: input.${namespace}.${class} or { }) (builtins.attrValues inputs);
         }) classes
+        ++ [ pre-switch-check ]
         ++ [ { config.networking.hostName = hostname; } ]
         ++ [ nixosModules.default ]
         ++ inputs.${nixpkgs}.lib.optional (inputs ? home-manager) {