The base image (nixos-uconsole v1.1.0) was built with nixpkgs
commit 54170c54449ea4d6725efd30d719c5e505f1c10e (2026-04-10),
NOT the flake.lock pin (89dbf01df7 from Dec 2025). By pinning to
the exact commit the image used, the kernel derivation hash should
match what's already in the store.
Using nixos-uconsole.lib.mkUConsoleSystem ensures the exact same
module composition as the pre-built image, so the kernel derivation
hash matches what'\''s already in the store (6.12.47).
Remove inputs.nixpkgs.follows so these inputs use their own pinned nixpkgs.
This lets the uConsole build use the nixos-uconsole Cachix cache for the kernel,
avoiding 4h kernel recompilation on every config change.
Rex's Trixie images use [pi5] for the CM5 display overlays
(clockworkpi-uconsole-cm5, vc4-kms-v3d-pi5). The nixos-uconsole
module generates [cm5] which the firmware may not apply on
some CM5 EEPROM configurations. Adding explicit [pi5] section
ensures the display overlays are always loaded.
The ter-v24n Terminus font renders garbled on CM5 DSI 720x1280
panel (green stretched line across screen). Switching to the
kernel's built-in Lat2-Terminus16 font for correct text rendering.
GPIO 23 service used gpioset 0 23=1 on BCM2712 chip 0 instead
of the RP1 chip (base 512), writing to a critical pin and
freezing the system. Commented out until correct chip is confirmed.
SSH opened with PasswordAuthentication + PermitRootLogin for
first deployment. Lock down after initial boot.
Replace recursive `final.lib.optionalAttrs` with `prev.lib.optionalAttrs`
using the `?` operator to check for meshtastic existence safely.
This allows the overlay to work with both stable (25.11) and unstable.
meshtastic package doesn't exist in nixpkgs 25.11 stable.
Use optionalAttrs to skip the override when not available,
allowing the flake to build against both stable and unstable.
The uConsole CM5 has kernel 6.12.47 in its store from the
nixos-uconsole-cm5-v1.1.0 image (built with nixpkgs 25.11).
By switching to the same nixpkgs version, Nix will reuse
the existing kernel instead of rebuilding it from source.
sysfs node is read-only (0444), even root cannot write.
The AXP228 PMU manages power path in hardware.
Practical fix: disconnect batteries during heavy builds.
nixos-uconsole's Cachix cache is built with nixpkgs-stable (25.11).
Following our unstable caused a full kernel rebuild every time.
By using nixos-uconsole's pinned nixpkgs, future builds will
download the pre-compiled kernel from the cache instead of
compiling it locally on the CM5.
The nixpkgs attribute for userspace GPIO tools is 'libgpiod',
not 'gpiod'. This provides the gpioset binary used by the
GPIO 23 internal USB hub service.
Disko auto-generates fileSystems with by-partlabel paths, but
for manual install via loop devices we need by-label paths.
mkForce ensures our paths win during evaluation.
disko module defines options under `disko.devices.disk.*`, not
`disk.*`. This was causing evaluation error:
"The option 'disk' does not exist. Did you mean 'disko'?"
- Add disko flake input + partition config (/boot/firmware, /, /home)
- Add cm5-backlight-fix service as display fallback
- Add enable-gpio23-usb-hub service for internal USB hub
- Add mt7921u kernel module for MediaTek AC1200 WiFi
- Add gpiod package for GPIO userspace control
Updates the assets/compose submodule to point to the fix/vpn-iptables-nft-upstream
branch which contains:
- Switch FROM weejewel/wg-easy:latest (Alpine 3.11, stale 4yr) to
ghcr.io/wg-easy/wg-easy:latest (actively maintained, Alpine krypton)
- Use update-alternatives instead of raw ln -sf to flip iptables
from legacy to nftables backend
- Fix compose build context: ./vpn -> . (Dockerfile is at same level)
