Release 0.1.1: audit fixes (audio, printing, scanning, emoji, ssh, supply-chain, coverage)

bram.buijs commented

2026-07-08 16:45:18 +00:00

Collaborator

Reopened as you suggested on 10 July, brought up to the latest point on main.

Everything here came out of the first real use of 0.1.0. Issues #35 to #44.

What a user notices

Sound, emoji, printing and scanning work out of the box: PipeWire in the core baseline (GNOME hosts had no sound), Noto Color Emoji, an opt-in CUPS + mDNS block, and SANE alongside it.
NTFS and zram in the base, so a Windows USB stick mounts and a small-memory laptop stops thrashing.
Tokodon is opt-in behind dawo.desktop.plasma.socialClient instead of arriving unasked.

What an administrator notices

comin is the only thing that updates a device; system.autoUpgrade is off. Two update mechanisms on one machine is one too many, and the second one wins at the worst moment.
SSH is key-only fleet-wide, password login disabled rather than discouraged.
15 flake inputs instead of 25. The ten that went were unused, and each one could break a build for nothing.
A coverage gate on the workplace baseline, so CI notices a module that stopped being built rather than a user.

Also: a zero-external-dependencies sovereignty plan, an imaging runbook in docs/, and two flake.lock bumps. CHANGELOG.md now has the 0.1.1 entry, which the release commit had left out.

About the tag

v0.1.1 was already on the repo pointing at dc1d667, which main cannot reach: main is 15 commits behind it. That is the unreviewed release you flagged, and it should not have happened. I have removed the tag; once you merge this I will tag the merge commit on main instead, so the history matches. Nothing depended on it: our overlay pins a revision on main (4c15a62, which is v0.1.0), not the tag.

From the next release I will open separate PRs and bundle them into a release with milestones, as agreed.

Closes #35, closes #36, closes #37, closes #38, closes #39, closes #40, closes #41, closes #42, closes #43, closes #44.

Reopened as you suggested on 10 July, brought up to the latest point on main. Everything here came out of the first real use of 0.1.0. Issues #35 to #44. **What a user notices** - Sound, emoji, printing and scanning work out of the box: PipeWire in the core baseline (GNOME hosts had no sound), Noto Color Emoji, an opt-in CUPS + mDNS block, and SANE alongside it. - NTFS and zram in the base, so a Windows USB stick mounts and a small-memory laptop stops thrashing. - Tokodon is opt-in behind `dawo.desktop.plasma.socialClient` instead of arriving unasked. **What an administrator notices** - comin is the only thing that updates a device; `system.autoUpgrade` is off. Two update mechanisms on one machine is one too many, and the second one wins at the worst moment. - SSH is key-only fleet-wide, password login disabled rather than discouraged. - 15 flake inputs instead of 25. The ten that went were unused, and each one could break a build for nothing. - A coverage gate on the workplace baseline, so CI notices a module that stopped being built rather than a user. Also: a zero-external-dependencies sovereignty plan, an imaging runbook in `docs/`, and two flake.lock bumps. CHANGELOG.md now has the 0.1.1 entry, which the release commit had left out. **About the tag** `v0.1.1` was already on the repo pointing at `dc1d667`, which main cannot reach: main is 15 commits behind it. That is the unreviewed release you flagged, and it should not have happened. I have removed the tag; once you merge this I will tag the merge commit on main instead, so the history matches. Nothing depended on it: our overlay pins a revision on main (`4c15a62`, which is `v0.1.0`), not the tag. From the next release I will open separate PRs and bundle them into a release with milestones, as agreed. Closes #35, closes #36, closes #37, closes #38, closes #39, closes #40, closes #41, closes #42, closes #43, closes #44.

bram.buijs added 15 commits

2026-07-08 16:45:18 +00:00

chore(deps): weekly flake.lock bump (nixpkgs 2026-06-23) 52229c5042

feat(printing): add opt-in CUPS + mDNS printing block 8a5bb81210

New services-printing block exposes dawo.printing.enable: CUPS with
driverless IPP plus gutenprint/hplip drivers, Avahi/mDNS network-printer
discovery (nssmdns4 + openFirewall), and system-config-printer for
DE-agnostic printer administration. Off by default; wired into
profiles-dawo-generic so any host or workplace overlay can flip it on.

Printing to a network printer is outbound IPP (TCP 631) -> unaffected by
the deny-inbound firewall; only mDNS discovery needs a port, which
services.avahi.openFirewall handles (UDP 5353).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(audio): PipeWire in the core baseline (fixes silent GNOME hosts) 3ed90f94f2

Audit finding: no services.pipewire anywhere in core. Plasma6 enables it
via nixpkgs mkDefault, but GNOME does not - so GNOME hosts shipped with no
audio server (silent laptop), same class of gap as the missing CUPS.

New services-audio block (dawo.audio, on by default, DE-agnostic):
PipeWire + ALSA + pulse compat + rtkit, PulseAudio daemon off. Imported
in profiles-dawo-generic. Build-verified on a GNOME (dawo-t495s-gnome)
and a Plasma (dawo-hp-probook-4g1i) host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(fonts): add Noto Color Emoji (fixes tofu in chat/web) 2e93b05f1d

Audit finding: fonts.packages had noto-fonts/cjk/font-awesome but no
color emoji font, so emoji rendered as tofu (boxes) in Element, the
browser and documents. Add noto-fonts-color-emoji; fontconfig picks it
up as the emoji fallback. Build-verified on the NUC.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(scanning): SANE scanning in the core baseline (print/scan companion) ddba0b0adb

Audit finding: printing shipped but scanning did not (no hardware.sane,
no backend, no scan app on GNOME) - a half-covered MFP. New
services-scanning block (dawo.scanning, on by default): SANE + sane-airscan
(driverless eSCL/WSD network MFPs) + simple-scan (DE-agnostic frontend).
Imported in profiles-dawo-generic. Build-verified on a GNOME host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(update): disable system.autoUpgrade (comin is the single update source) 051b57d2af

Audit finding: system.autoUpgrade.enable=true ran alongside comin
(dawo.autoUpdate) - two mechanisms rebuilding the machine, and the
generic auto-upgrade fails nightly with no channel/flake configured (as
seen on the station). Disable it; comin's git-driven pull-deploy is the
sole updater. Makes the station's mkForce-false redundant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(hardware): NTFS support + zram swap in the base 3763eeadc1

Audit nice-to-haves: NTFS read/write for Windows-formatted USB sticks
(boot.supportedFilesystems), and zram compressed RAM swap for better
low-memory behaviour. NL keyboard intentionally skipped (US is the de
facto standard). Build-verified on the NUC.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test(checks): workplace-baseline coverage gate 3c19269563

nix flake check now fails if a host drops a promised baseline
functionality - the class of gap that shipped silent GNOME audio and a
missing CUPS. Cheap eval-time assertions (PipeWire, SANE, NetworkManager,
no generic autoUpgrade, color emoji) on a Plasma and a GNOME host, no VM
boot. Extend the claims list when a new baseline is promised.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(deps): drop 10 dead flake inputs (25 -> 15) 8d32e6f1dd

Sovereignty audit: 10 inputs had zero code references (verified) and
their removal leaves every host drvPath functionally identical (nix-diff:
only the embedded flake-rev string changes). Dropped: nixos-blocks,
nix-vscode-extensions, systems, nixos-facter-modules, treefmt-nix,
headplane, zen-browser, plasma-manager, lsfg-vk-flake, nixos-generators.

The 15 load-bearing inputs remain, all still github.com-hosted - next up
for the mirror-to-code.overheid pass toward zero foreign-hosted deps
(Dutch digital autonomy). NOTE: with `systems` gone, flake-parts perSystem
has no systems list (it was never wired); set `systems = ["x86_64-linux"]`
if a devShell/formatter is wanted later.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(deps): flake.lock update (nixpkgs 06-23 -> 07-04 + 7 inputs) dbaf870759

Bumped nixpkgs, nixpkgs-unstable, home-manager, lanzaboote, comin,
flake-parts, nixos-hardware, rust-overlay to current. Build-verified on
the NUC: Plasma + both GNOME hosts + the workplace-baseline check all
green, no breakage on the Secure Boot / boot path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(ssh): key-only auth fleet-wide (disable SSH password login) 702cee0922

Audit S3: laptops accepted SSH password logins with port 22 open -
brute-forceable against the committed hashes. Force PasswordAuthentication
off in the mandatory SSH hardening (was left as a per-host call, on by
default). Remote SSH is key-only; local console login is unaffected.
Makes the station's per-host override redundant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs: zero-external-dependencies sovereignty plan 58b2fcc9fb

Phased plan for Dutch digital autonomy: mirror the 15 FOSS inputs +
libfprint fork to code.overheid.nl, stand up a self-hosted NL binary
cache (drop cache.nixos.org/cachix), pin all revs, and a reviewed
mirror-sync CI - so the fleet fetches only from NL infrastructure.
Honest residuals: Omnissa Horizon + Entra (client's US stack, runtime).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(plasma): gate Tokodon behind dawo.desktop.plasma.socialClient ed22aa1db1

Make the Mastodon client optional (default true, unchanged for existing hosts)
so a deployment overlay can drop it without a mkForce on the whole package list.
CIO-rijk-overlay sets socialClient = false.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

release: markeer versie 0.1.1 14190c15c5

Bump releaseVersion naar 0.1.1. Deze release bundelt de audit-fixes:
audio (PipeWire), emoji-font, scannen (SANE), printen (CUPS), autoUpgrade
uit, NTFS + zram, SSH key-only, 10 dode flake-inputs geschrapt, coverage-gate
en de optionele social client. Zie issues #35 t/m #44.

Code AI-ondersteund; testen, review en integratie door mens.

docs: inspoel-runbook voor het imagen van laptops met de DAWO-image 720fc63b5e

Herhaalbare instructie om een batch laptops te imagen met de generieke
DAWO-NixOS image via het inspoelstraat-station (PXE), inclusief de Secure
Boot + TPM2-ceremonie en een verificatie-checklist. Secret-vrij.

Code AI-ondersteund; testen, review en integratie door mens.

bram.buijs closed this pull request

2026-07-08 16:49:52 +00:00

bram.buijs changed title from ~~Release 0.1.1: audit-fixes (audio, printen, scannen, emoji, ssh, supply-chain, coverage)~~ to Release 0.1.1: audit fixes (audio, printing, scanning, emoji, ssh, supply-chain, coverage)

2026-08-04 00:49:32 +00:00

bram.buijs reopened this pull request

2026-08-04 00:49:32 +00:00