Empty initrd for display, add rp1_dsi module

ALL RP1 hardware (gpio, clocks, dsi) sits behind the RP1 PCIe southbridge, which isn't ready until ~12s. Loading any display module in initrd (~3s) crashes the system. Nothing in initrd now: - boot.initrd.kernelModules: empty (nothing touches RP1 early) - boot.kernelModules: vc4, panel_cwu50, rp1_dsi (stage-2)
Revert vc4/panel_cwu50 to boot.kernelModules (stage-2 loading)
2026-06-09 23:14:44 -04:00 · 2026-06-09 22:46:43 -04:00 · 2026-06-09 22:44:45 -04:00 · 2026-06-09 22:39:13 -04:00 · 2026-06-09 22:20:27 -04:00 · 2026-06-09 21:42:24 -04:00
17 changed files with 444 additions and 504 deletions
--- a/assets/compose
+++ b/assets/compose
--- a/assets/ollama/Dockerfile
+++ b/assets/ollama/Dockerfile
@@ -0,0 +1,106 @@
 # ollama-gfx906/Dockerfile
 #
 # Custom ollama image with ROCm 6.1 + gfx906 (MI50) support.
 # The official ollama/rocm image ships ROCm 7.2 which dropped gfx906.
 # This uses v0.23.2's native CMake build system with AMDGPU_TARGETS including gfx906.
 #
 # Build: docker build -t ollama/ollama:rocm-gfx906 ai/ollama
 FROM rocm/dev-ubuntu-22.04:6.1.2-complete AS builder
 # Build dependencies (CMake, Ninja, Go)
 ARG CMAKEVERSION=3.31.2
 ARG NINJAVERSION=1.12.1
 ARG GOLANG_VERSION=1.22.0
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
    curl git ccache build-essential pkg-config unzip \
    && rm -rf /var/lib/apt/lists/*
 # Install CMake from official binaries
 RUN curl -fsSL https://github.com/Kitware/CMake/releases/download/v${CMAKEVERSION}/cmake-${CMAKEVERSION}-linux-x86_64.tar.gz \
    | tar xz -C /usr/local --strip-components 1
 # Install Ninja
 RUN curl -fsSL -o /tmp/ninja.zip \
    https://github.com/ninja-build/ninja/releases/download/v${NINJAVERSION}/ninja-linux.zip \
    && unzip /tmp/ninja.zip -d /usr/local/bin && rm /tmp/ninja.zip
 # Install Go
 RUN curl -fsSL https://go.dev/dl/go${GOLANG_VERSION}.linux-amd64.tar.gz \
    | tar xz -C /usr/local
 ENV PATH=/usr/local/go/bin:$PATH
 ARG OLLAMA_VERSION=v0.23.2
 RUN git clone --depth 1 --branch ${OLLAMA_VERSION} https://github.com/ollama/ollama.git /build
 WORKDIR /build
 # ROCm paths
 ENV HIP_PATH=/opt/rocm
 ENV ROCM_PATH=/opt/rocm
 ENV CMAKE_GENERATOR=Ninja
 ENV LDFLAGS=-s
 # Step 1: Build CPU backends with GCC (no ROCm preset)
 # Pre-set CMAKE_HIP_COMPILER="" to prevent check_language(HIP) from
 # finding a HIP compiler (it searches /opt/rocm even without PATH).
 # Remove /opt/rocm from PATH to prevent find_program from finding hipcc.
 RUN mkdir -p build-cpu && \
    PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    cmake -B build-cpu -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_HIP_COMPILER="" \
      -DCMAKE_INSTALL_PREFIX=/build/dist && \
    cmake --build build-cpu --target ggml-cpu -- -l $(nproc) && \
    cmake --install build-cpu --component CPU --strip && \
    echo "=== CPU install ===" && \
    (find /build/dist/lib/ollama -type f -o -type l 2>&1 | head -20 || echo "empty")
 # Step 2: Build HIP backend with ROCm preset + gfx906 target only
 # The ROCm 6 preset enables HIP language detection (enable_language(HIP))
 # which ensures GPU kernels are properly compiled for gfx906.
 # OLLAMA_RUNNER_DIR=rocm from the preset, so HIP goes to lib/ollama/rocm/
 # Need CMAKE_PREFIX_PATH so find_package(hip) finds hip-config.cmake
 # at /opt/rocm/lib/cmake/hip/hip-config.cmake.
 RUN mkdir -p build-hip && \
    cmake -B build-hip \
      --preset 'ROCm 6' \
      -DAMDGPU_TARGETS="gfx906:xnack-" \
      -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_PREFIX_PATH="/opt/rocm" && \
    cmake --build build-hip --target ggml-hip -- -l $(nproc) && \
    cmake --install build-hip --component HIP --strip && \
    echo "=== HIP install ===" && \
    find /build/dist/lib/ollama -type f -o -type l | head -20
 # Step 3: Build Go binary (GCC for CGo linking)
 ENV CGO_ENABLED=1
 RUN go build -trimpath -ldflags="-X=github.com/ollama/ollama/version.Version=${OLLAMA_VERSION}" -o /build/dist/ollama .
 # ---------- Runtime image ----------
 FROM ubuntu:24.04
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
    ca-certificates curl libstdc++6 libgomp1 libvulkan1 libopenblas0 \
    && rm -rf /var/lib/apt/lists/*
 # Copy ROCm 6.1 runtime libraries
 # These are needed at runtime by ggml-hip via LD_LIBRARY_PATH
 COPY --from=builder /opt/rocm/lib/ /opt/rocm/lib/
 COPY --from=builder /opt/rocm/share/ /opt/rocm/share/
 # Copy ollama binary + all backends (CPU + HIP)
 # CPU install:  /build/dist/lib/ollama/libggml-*.so
 # HIP install:  /build/dist/lib/ollama/rocm/libggml-hip.so
 COPY --from=builder /build/dist/ollama /usr/bin/ollama
 COPY --from=builder /build/dist/lib/ollama/ /usr/lib/ollama/
 RUN ldconfig
 ENV LD_LIBRARY_PATH=/opt/rocm/lib:/usr/lib/ollama/rocm:/usr/lib/ollama
 ENV HSA_OVERRIDE_GFX_VERSION=9.0.6
 ENV HCC_AMDGPU_TARGET=gfx906
 ENV HSA_ENABLE_SDMA=0
 EXPOSE 11434
 ENTRYPOINT ["/bin/ollama"]
 CMD ["serve"]
--- a/flake.lock
+++ b/flake.lock
@@ -23,38 +23,6 @@
        "type": "github"
      }
    },
    "argononed": {
      "flake": false,
      "locked": {
        "lastModified": 1729566243,
        "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
        "owner": "nvmd",
        "repo": "argononed",
        "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
        "type": "github"
      },
      "original": {
        "owner": "nvmd",
        "repo": "argononed",
        "type": "github"
      }
    },
    "argononed_2": {
      "flake": false,
      "locked": {
        "lastModified": 1729566243,
        "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
        "owner": "nvmd",
        "repo": "argononed",
        "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
        "type": "github"
      },
      "original": {
        "owner": "nvmd",
        "repo": "argononed",
        "type": "github"
      }
    },
    "flake-compat": {
      "flake": false,
      "locked": {
@@ -69,54 +37,6 @@
        "url": "https://git.lix.systems/lix-project/flake-compat/archive/main.tar.gz"
      }
    },
    "flake-compat_2": {
      "locked": {
        "lastModified": 1767039857,
        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
        "owner": "edolstra",
        "repo": "flake-compat",
        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
        "owner": "edolstra",
        "repo": "flake-compat",
        "type": "github"
      }
    },
    "flake-compat_3": {
      "locked": {
        "lastModified": 1767039857,
        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
        "owner": "edolstra",
        "repo": "flake-compat",
        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
        "owner": "edolstra",
        "repo": "flake-compat",
        "type": "github"
      }
    },
    "flake-utils": {
      "inputs": {
        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1731533236,
        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -224,150 +144,6 @@
        "type": "github"
      }
    },
    "nixmate": {
      "inputs": {
        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs_2",
        "rust-overlay": "rust-overlay"
      },
      "locked": {
        "lastModified": 1771085058,
        "narHash": "sha256-w9qE5zZ8mEHPbR84OuJoFWFvmMuKpvq/ANwyDUEvbPo=",
        "owner": "daskladas",
        "repo": "nixmate",
        "rev": "9030841d4c3ec72359643d7af68bfdac428f1636",
        "type": "github"
      },
      "original": {
        "owner": "daskladas",
        "repo": "nixmate",
        "type": "github"
      }
    },
    "nixos-images": {
      "inputs": {
        "nixos-stable": [
          "nixos-raspberrypi",
          "nixpkgs"
        ],
        "nixos-unstable": [
          "nixos-raspberrypi",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1747747741,
        "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
        "owner": "nvmd",
        "repo": "nixos-images",
        "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
        "type": "github"
      },
      "original": {
        "owner": "nvmd",
        "ref": "sdimage-installer",
        "repo": "nixos-images",
        "type": "github"
      }
    },
    "nixos-images_2": {
      "inputs": {
        "nixos-stable": [
          "nixos-uconsole",
          "nixos-raspberrypi",
          "nixpkgs"
        ],
        "nixos-unstable": [
          "nixos-uconsole",
          "nixos-raspberrypi",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1747747741,
        "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
        "owner": "nvmd",
        "repo": "nixos-images",
        "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
        "type": "github"
      },
      "original": {
        "owner": "nvmd",
        "ref": "sdimage-installer",
        "repo": "nixos-images",
        "type": "github"
      }
    },
    "nixos-raspberrypi": {
      "inputs": {
        "argononed": "argononed",
        "flake-compat": "flake-compat_2",
        "nixos-images": "nixos-images",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1779023229,
        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
        "owner": "nvmd",
        "repo": "nixos-raspberrypi",
        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
        "type": "github"
      },
      "original": {
        "owner": "nvmd",
        "ref": "v1.20260517.0",
        "repo": "nixos-raspberrypi",
        "type": "github"
      }
    },
    "nixos-raspberrypi_2": {
      "inputs": {
        "argononed": "argononed_2",
        "flake-compat": "flake-compat_3",
        "nixos-images": "nixos-images_2",
        "nixpkgs": [
          "nixos-uconsole",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1779023229,
        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
        "owner": "nvmd",
        "repo": "nixos-raspberrypi",
        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
        "type": "github"
      },
      "original": {
        "owner": "nvmd",
        "ref": "v1.20260517.0",
        "repo": "nixos-raspberrypi",
        "type": "github"
      }
    },
    "nixos-uconsole": {
      "inputs": {
        "nixos-raspberrypi": "nixos-raspberrypi_2",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1780333979,
        "narHash": "sha256-yjp/gWRqWCxalYLe2+27gbxhttL+46Ozm7qvccpFbv4=",
        "owner": "nixos-uconsole",
        "repo": "nixos-uconsole",
        "rev": "1e6a8dc51c7b26e15850688a0b01121c3fea4b30",
        "type": "github"
      },
      "original": {
        "owner": "nixos-uconsole",
        "repo": "nixos-uconsole",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1705033721,
@@ -401,22 +177,6 @@
      }
    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1770562336,
        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_3": {
      "locked": {
        "lastModified": 1774386573,
        "narHash": "sha256-4hAV26quOxdC6iyG7kYaZcM3VOskcPUrdCQd/nx8obc=",
@@ -452,31 +212,7 @@
      "inputs": {
        "agenix": "agenix",
        "lix": "lix",
-        "nixmate": "nixmate",
+        "nixpkgs": "nixpkgs_2"
        "nixos-raspberrypi": "nixos-raspberrypi",
        "nixos-uconsole": "nixos-uconsole",
        "nixpkgs": "nixpkgs_3"
      }
    },
    "rust-overlay": {
      "inputs": {
        "nixpkgs": [
          "nixmate",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1770606655,
        "narHash": "sha256-rpJf+kxvLWv32ivcgu8d+JeJooog3boJCT8J3joJvvM=",
        "owner": "oxalica",
        "repo": "rust-overlay",
        "rev": "11a396520bf911e4ed01e78e11633d3fc63b350e",
        "type": "github"
      },
      "original": {
        "owner": "oxalica",
        "repo": "rust-overlay",
        "type": "github"
      }
    },
    "systems": {
@@ -493,21 +229,6 @@
        "repo": "default",
        "type": "github"
      }
    },
    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -2,29 +2,34 @@
  description = "Gortium infra flake";
  inputs = {
-    nixmate.url = "github:daskladas/nixmate";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=25.11";
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
    agenix = {
      url = "github:ryantm/agenix";
      inputs.darwin.follows = "";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    lix = {
      url = "git+https://git.lix.systems/lix-project/lix?ref=main";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixpkgs-uconsole = {
      url = "github:nixos/nixpkgs/54170c54449ea4d6725efd30d719c5e505f1c10e";
    };
    nixos-uconsole = {
-      url = "github:nixos-uconsole/nixos-uconsole";
+      url = "github:nixos-uconsole/nixos-uconsole/v1.1.0";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs-uconsole";
    };
    nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/v1.20260517.0";
+      url = "github:nvmd/nixos-raspberrypi/v1.20260317.0";
-      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs.follows = "nixos-uconsole/nixpkgs";
    };
    self.submodules = true;
  };
-  outputs = { self, nixmate, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
+  outputs = { self, nixpkgs, agenix, disko, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
    let
      system = "x86_64-linux";
      keys = import ./lib/keys.nix;
@@ -35,11 +40,7 @@
          "/etc/ssh/ssh_host_ed25519_key"
          "/root/.age/bootstrap.key" ];
      };
-      overlays = [
+      overlays = [ agenix.overlays.default (import ./overlays/reticulum.nix) ];
        agenix.overlays.default
        (import ./overlays/reticulum.nix)
        (import ./overlays/nixmate.nix inputs)
      ];
      pkgs = import nixpkgs {
        inherit system overlays;
        config.allowUnfree = true;
@@ -94,19 +95,21 @@
            ];
          };
-          uConsole = nixos-raspberrypi.lib.nixosSystem {
+          uConsole = nixos-uconsole.lib.mkUConsoleSystem {
            variant = "cm5";
            specialArgs = { inherit self keys paths inputs nixos-raspberrypi; };
            modules = [
              {
                nixpkgs.overlays = overlays;
                nixpkgs.config.allowUnfree = true;
-                nixpkgs.hostPlatform = "aarch64-linux";
+                nixpkgs.config.permittedInsecurePackages = [
-                nix.package = lix.packages."aarch64-linux".default;
+                  "openclaw-2026.3.12"
                ];
              }
-              nixos-raspberrypi.nixosModules.raspberry-pi-5.base
+              disko.nixosModules.disko
              nixos-uconsole.nixosModules.uconsole-cm5
              ./hosts/uConsole/configuration.nix
              ./hosts/uConsole/hardware-configuration.nix
              ./hosts/uConsole/disko-config.nix
            ];
          };
        };
--- a/hosts/lazyworkhorse/configuration.nix
+++ b/hosts/lazyworkhorse/configuration.nix
@@ -144,14 +144,12 @@
  # You can use https://Search.nixos.org/ to find more packages (and options).
  environment.systemPackages = with pkgs; [
    neovim
    tmux
    docker-compose
    wget
    age
    agenix
    git
    nh
    nixmate
    lm_sensors
    rocmPackages.rocminfo
    rocmPackages.rocm-smi
@@ -258,6 +256,12 @@
    # };
  };
  services.opencode = {
    enable = true;
    port = 4099;
    ollamaUrl = "http://127.0.0.1:11434/v1"; 
  };
  # Private host ssh key managed by agenix
  age = {
    identityPaths = paths.identities;
@@ -307,6 +311,16 @@
    };
  };
  # OpenClaw Node service (host-side execution for Docker gateway)
  services.openclaw-node = {
    enable = true;
    user = "ai-worker";
    gatewayHost = "127.0.0.1";
    gatewayPort = 18789;
    gatewayTokenFile = "/run/secrets/openclaw_gateway_token";
    displayName = "lazyworkhorse-host";
  };
  # Public host ssh key (kept in sync with the private one)
  environment.etc."ssh/ssh_host_ed25519_key.pub".text =
    "${keys.hosts.lazyworkhorse.main}";
--- a/hosts/uConsole/configuration.nix
+++ b/hosts/uConsole/configuration.nix
@@ -1,5 +1,19 @@
 { config, lib, pkgs, paths, self, keys, ... }:
 let
  # Backlight fallback for CM5 display quirk
  # The kernel driver usually handles this, but some boots need a kick
  backlightFixScript = pkgs.writeShellScript "backlight-fix" ''
    # Try sysfs backlight control
    for bl in /sys/class/backlight/*/brightness; do
      if [ -f "$bl" ]; then
        max=$(cat "$(dirname "$bl")/max_brightness" 2>/dev/null || echo 100)
        echo "$max" > "$bl" 2>/dev/null || true
      fi
    done
  '';
 in
 {
  # Basic Host Info
  networking.hostName = "uConsole";
@@ -7,19 +21,37 @@
  i18n.defaultLocale = "en_CA.UTF-8";
  # System State
-  system.stateVersion = "25.05";
+  system.stateVersion = "25.11";
  # Boot & Hardware (migrated to kernel bootloader per nixos-raspberrypi deprecation notice)
  boot.loader.raspberry-pi.bootloader = "kernel";
  # kernel managed by nixos-raspberrypi module — don't override, patches are version-specific
  # boot.kernelPackages = pkgs.linuxPackages_latest;
  # Kernel parameters matching nixos-uconsole CM5 module
  # console=tty1 is critical — without it, console output goes to ttyAMA0 not fb0
  boot.kernelParams = [
    "8250.nr_uarts=1"
    "console=tty1"
  ];
  # Enable Mesa GPU drivers — REQUIRED for VC4 display pipeline to initialize
  hardware.graphics.enable = true;
  # Console font sized for the 5" 720x1280 display (from nixos-uconsole base module)
  console = {
    earlySetup = true;
    font = "ter-v24n";
    packages = with pkgs; [ terminus_font ];
  };
  # Networking
  networking.networkmanager.enable = true;
  services.openssh = {
    enable = true;
-    settings.PermitRootLogin = lib.mkForce "prohibit-password";
+    # TODO: lock down after first deployment
-    settings.PasswordAuthentication = lib.mkForce false;
+    settings.PermitRootLogin = lib.mkForce "yes";
    settings.PasswordAuthentication = lib.mkForce true;
  };
  # User
@@ -56,6 +88,7 @@
    htop
    tmux
    neovim
    libgpiod                    # GPIO control (for internal USB hub, AIO modules)
    # ===== HAM Radio =====
    js8call
@@ -75,7 +108,8 @@
    soapysdr-with-plugins      # SoapySDR + hardware support plugins
    # ===== Mesh / LoRa =====
-    meshtastic                 # Python CLI for Meshtastic devices
+    # meshtastic not available in nixpkgs 25.11 stable; install manually:
    # nix shell nixpkgs#meshtastic -c meshtastic
    reticulumStack             # Reticulum Network Stack (rnsd, rnsh, rncp, rnx, rnpath, etc.)
    lxmf                       # LXMF messaging protocol
    nomadnet                   # Nomad Network client
@@ -139,22 +173,33 @@
  };
  # ============================================================
-  # Kernel modules for SDR and radio
+  # Kernel modules for SDR, radio, and WiFi
  # ============================================================
  boot.kernelModules = [
    "mt7921u"         # MediaTek MT7921 USB WiFi (uConsole AC1200)
    "88x2bu"          # Realtek 8812/8821BU USB WiFi (common adapter)
    "rtl8xxxu"        # RTL8188/8192/8723 USB WiFi
    "rtl2832_sdr"     # RTL-SDR kernel module
    "dvb_usb_rtl28xxu" # RTL-SDR DVB-T
    # Display drivers — loaded AFTER RP1 PCIe southbridge init (~12s)
    # NOTHING in initrd — ALL RP1 hardware is behind PCIe
    "panel_cwu50"     # uConsole DSI panel driver
    "vc4"             # VideoCore 4 KMS GPU driver
    "rp1_dsi"         # RP1 DSI bridge driver
  ];
  boot.blacklistedKernelModules = [ ];
  # Rien dans initrd pour le display — tout RP1 est derrière PCIe
  boot.initrd.kernelModules = lib.mkForce [ ];
  # ============================================================
  # Extra udev rules for SDR and HAM radio devices
  # ============================================================
  services.udev.packages = with pkgs; [ rtl-sdr ];
  # ============================================================
  # Enable IPv6 for Reticulum mesh
  # ============================================================
@@ -168,4 +213,74 @@
  # Reticulum uses its own encryption and doesn't need open ports
  # for basic mesh operations (peer-to-peer discovery).
  # For TCP interfaces, open additional ports as needed.
  # ============================================================
  # Hyprland Wayland compositor (manual start)
  # No SDDM — boot to console, user starts Hyprland with command
  # Display modules (vc4/panel_cwu50) load late after RP1 PCIe init
  # ============================================================
  programs.hyprland = {
    enable = true;
    xwayland.enable = true;
  };
  # SDDM disabled — was blocking boot when display isn't ready
  # services.displayManager.sddm = {
  #   enable = true;
  #   wayland.enable = true;
  # };
  # ============================================================
  # CM5 Config.txt Fix: use [pi5] section (not [cm5])
  # Rex's images use [pi5], the CM5 firmware may not detect [cm5]
  # ============================================================
  # Merge nixos-uconsole GPIO config with our [pi5] overrides
  # GPIO 10/11 are from nixos-uconsole configtxt.nix (audio amplifier)
  # [pi5] section fixes the CM5 detection issue — firmware matches [pi5] not [cm5]
  hardware.raspberry-pi.extra-config = ''
    [all]
    gpio=10=ip,np
    gpio=11=op,dh
    [pi5]
    dtparam=pciex1=off
    dtoverlay=clockworkpi-uconsole-cm5
    dtoverlay=dwc2,dr_mode=host
    dtoverlay=vc4-kms-v3d-pi5,cma-384
    dtparam=nohdmi1=off
  '';
  # ============================================================
  # CM5 Display Backlight Fix
  # The kernel driver initializes backlight, but some boots fail.
  # This service kicks it after boot as a reliable fallback.
  # ============================================================
  systemd.services.cm5-backlight-fix = {
    description = "CM5 Display Backlight Fix";
    after = [ "multi-user.target" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${backlightFixScript}";
    };
  };
  # ============================================================
  # Internal USB Hub Enable (GPIO 23) — DISABLED
  # This service freeze the CM5 because gpioset 0 23=1 writes
  # to the wrong GPIO chip (BCM2712 native, not RP1).
  # Enable manually after boot once the correct chip is confirmed:
  #   gpioset 0 23=1   # on chip 0 (BCM2712, CORE_VOLT or critical)
  #   gpioset 512 23=1 # on chip 512 (RP1, likely correct)
  # ============================================================
  # systemd.services.enable-gpio23-usb-hub = {
  #   description = "Enable Internal USB Hub (GPIO 23)";
  #   before = [ "network.target" ];
  #   wantedBy = [ "multi-user.target" ];
  #   serviceConfig = {
  #     Type = "oneshot";
  #     RemainAfterExit = true;
  #     ExecStart = "${pkgs.libgpiod}/bin/gpioset 0 23=1";
  #     ExecStop = "${pkgs.libgpiod}/bin/gpioset 0 23=0";
  #   };
  # };
 }
--- a/hosts/uConsole/disko-config.nix
+++ b/hosts/uConsole/disko-config.nix
@@ -0,0 +1,46 @@
 { lib, ... }:
 {
  disko.devices.disk.main = {
    type = "disk";
    device = "/dev/mmcblk0";
    content = {
      type = "gpt";
      partitions = {
        boot = {
          name = "FIRMWARE";
          size = "1G";
          type = "EF00";
          content = {
            type = "filesystem";
            format = "vfat";
            mountpoint = "/boot/firmware";
            mountOptions = [
              "fmask=0022"
              "dmask=0022"
            ];
          };
        };
        root = {
          name = "NIXOS_UCM5";
          size = "30G";
          content = {
            type = "filesystem";
            format = "ext4";
            mountpoint = "/";
            mountOptions = [ "noatime" ];
          };
        };
        home = {
          name = "NIXOS_HOME";
          size = "100%";
          content = {
            type = "filesystem";
            format = "ext4";
            mountpoint = "/home";
            mountOptions = [ "noatime" ];
          };
        };
      };
    };
  };
 }
--- a/hosts/uConsole/hardware-configuration.nix
+++ b/hosts/uConsole/hardware-configuration.nix
@@ -9,15 +9,28 @@
  boot.initrd.kernelModules = [ ];
  boot.extraModulePackages = [ ];
-  # uConsole CM5 uses NVMe or eMMC for boot storage
+  # Filesystems for NixOS install.
-  # The uconsole-cm5 module sets up /boot/firmware and default /
+  # mkForce overrides disko's auto-generated paths so we can use
-  # Override device label here if using different storage
+  # filesystem labels (by-label) which work with loop device installs.
-  fileSystems."/" = lib.mkDefault {
+  # Disko will set its own paths when nixos-anywhere is used.
  fileSystems."/" = lib.mkForce {
    device = "/dev/disk/by-label/NIXOS_UCM5";
    fsType = "ext4";
    options = [ "noatime" ];
  };
  fileSystems."/boot/firmware" = lib.mkForce {
    device = "/dev/disk/by-label/FIRMWARE";
    fsType = "vfat";
    options = [ "fmask=0022" "dmask=0022" ];
  };
  fileSystems."/home" = lib.mkForce {
    device = "/dev/disk/by-label/NIXOS_HOME";
    fsType = "ext4";
    options = [ "noatime" ];
  };
  swapDevices = [ ];
  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
--- a/overlays/nixmate.nix
+++ b/overlays/nixmate.nix
@@ -1,6 +0,0 @@
 # ./overlays/nixmate.nix
 inputs: # We pass inputs here so the overlay can see the nixmate flake
 final: prev: {
  nixmate = inputs.nixmate.packages.${prev.system}.default;
 }
--- a/overlays/reticulum.nix
+++ b/overlays/reticulum.nix
@@ -1,7 +1,8 @@
 final: prev: let
  python3 = final.python3;
  pyPkgs = python3.pkgs;
-in {
+in
  {
    reticulumStack = python3.pkgs.buildPythonApplication rec {
      pname = "reticulum";
      version = "1.2.9";
@@ -11,6 +12,12 @@ in {
        inherit version;
        sha256 = "554814231c237b9caacf8df669312e57dd7d3f84b6d4810125087d1a79a75d75";
      };
      patchPhase = ''
        # Fix license_files syntax: ("LICENSE") is a string not tuple
        # Newer setuptools iterates over it char by char, fails on 'S'
        substituteInPlace setup.py \
          --replace-fail 'license_files = ("LICENSE")' 'license_files = ("LICENSE",)'
      '';
      propagatedBuildInputs = with pyPkgs; [ cryptography pyserial ];
      doCheck = false;
      pythonImportsCheck = [ "RNS" ];
@@ -79,3 +86,7 @@ in {
      };
    };
  }
  # meshtastic may not exist in all nixpkgs versions (e.g. not in 25.11)
  // prev.lib.optionalAttrs (prev ? meshtastic) {
    inherit (prev) meshtastic;
  }
--- a/secrets/ai.age
+++ b/secrets/ai.age
@@ -1,19 +0,0 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSA2QUFR
 RmlnY2pYUFBHZGN3dzNpNVc0UW14V2NaVWZHWDJmcU1iWStsSHpJCnRYQUtEalNt
 SzFYWUF6VWRyYWF5VCtsSGduRU96MHA0WlI0b0lpUGFram8KLT4gM0stZ3JlYXNl
 IC5DPExhJQpCMlZRR0E1NGdsYlhNRXZUTVJqTTNHZUZQVUJoYkhheWd3TktvVEFp
 WnFqbS9xWUxJSmI0U0hqQkdzQU1EVy9BCkhWc3A0Mk45YVBxcnJFWU5qa01LRTVw
 WlNoWm40cjgyb1RXS3hGdlpRSEs5V0x0cHNvcVBOek0KLS0tIFhiOFExNnRSbEgz
 M3FmS1owQUdHSXpiWVhLQ0R6emtuK2hZSkkrSTFtTTAKi2hXxTslGLlneDJlvHUm
 OFsvgsHmiADRaiwDC/iCfWyEFzHyupXKX79B6rjt4Up2yUWHLHy4pyCvJiezAh1J
 uxvtVmUYrqYOUoUHCEMLjjVydh5tt+22yXezV0ecU2ePiAgb0gv9EwH8t+70An6Z
 fgvtZZqJ1hK6dTyTf4oROUjPD8RgfjDnRTTvTM1COMvwgpK+cboYAvJ4BhUsn70V
 B3Gveg7++1U2ECF8YHKZGfSuWn0ajT5RzdgRXTveGAINiW4G98oyXnOVhRHmXo9i
 8T/41afy4xhUbNCRsaAApFjS6y8xrpGtrOcpw0u3y3T/bjYHq8VDi4ttYWIF8hJD
 HPo44+SDj0g9lr/UPQDWXaiZjdD6xdioUqnHnaAdyOPPf5D6C5I7WIQPPIjnJ1yc
 PmQkIV4rtb+e7cWrGbnd9stCBZ2F+HcORfjgnJzKI5asy9rmdWPIIHkcZoPFZ/K8
 2ZWXUVgAZvwzcFxSjh5uXKvkOgYixdVLRfa88+KM++vwz0y3O5naq3d1SaLxV4dk
 mRifLNhF9y2MKjX0bZ86Wm74NlhGGQSnUuUHpPLSA6McVOfleN/yJ9gMsosxUc9U
 xIsKHYn8gN0lPVtyTSBTomK6kxoKJXxia50x/XAhJwI9X3ydLg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/cloudstorage.age
+++ b/secrets/cloudstorage.age
@@ -1,10 +0,0 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBaT3h1
 K28zWlE3N3BMdHRFaldkZ0F2YVZjT3kxK2dpV1RxZUVOSElsbkdJCnF2M1ZkUWky
 cGtPaXdzMmU1cllsWWtQK3R4Z0xhUExxSW9xUVh3eUo5RjQKLT4geHEtZ3JlYXNl
 IEQ5JWBWM0QKS1N5WlpnbEtLTFNxQVFvbkVEa1BOTDhQRDV0SDhsdWFEdE5xMDRa
 b3loMDZEeGZTZ1NzaFM5UlZYT0NjMHVvWAordjh4cFhnb2pOc3JPZlFLbFU0eC9O
 WWFFVlUKLS0tIEJnMm9LM09KQ3VXNXpNNU1kS3V5VDNOTGozdDdGdWQxcFc3Mk5j
 R0p0WVkKIX6p7MGDZOxS5qVgYs5K5sKC31IPIEMaWAqA5Gygegj5rVnKtN/jn7+9
 L5CBbzaSXzNwRce0WPVi0mQp56lL12mRlXXamOx/E9Q+r2rznFYdQA==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/containers.env.age
+++ b/secrets/containers.env.age
@@ -1,43 +1,36 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBVYWFV
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBWNEpt
-U1dWcVVoZVJ2a1Bmd00zbnRvYnNTb0RvUlhJSVZheVlZcGlKRFgwCmVNTVNzVk8z
+cGFNeVBBaDRqb3pLSEZGQW0wb3VmVnBoZCswUFkzbnBLUnJ0QTNrClRqVkk4RUVO
-ZSszVUN2enhIV09UMkpGNG9vZlhTTVZrd1U1QnB6OVpnOU0KLT4gSCgtZ3JlYXNl
+d29KYjd5YUcwankvaTFmVHUxQVpDT2ZYWHRaY3JXTUtQMU0KLT4gKXBtQ3UsXi1n
-IFtVXTlQIGl6YXRHCjdqNS9oa3p5dGZseWV5NDNadjN2VDVheCtkRm1jRWpuY0Y3
+cmVhc2UgNnwxYCBXVyA/KCQmIHt9NAo3OTZVUHR2UXkvaEFwY0ZBdEJsaFpsbHJ0
-Sk1aWHhyQQotLS0gaFo5TjM1bFdKOEJVenZHK3RXOHExeXV0dFIrTUNMc0pnTXBM
+cklKcDVHcEdWMEdPSkpnN0FiRU43RW5hUWFMdjR3WFRRSFBLSGlmClM3cTNJWlNM
-YWIrNHdHNAqkUzENsQawFRPRh6K13pJN9pkDGpvpx07kTPkUWbocUQoJMxeXdAlh
+TExkdHdXUHJISkNIaE1TTUxUc1NUWkV1a09HeFU3bVZwQXMKLS0tIGhOcXFTUElS
-Syw6Ca2X2Xb2QGnO6EIoMsfs6Tg78cEiDH4DEcdcNdHoSZlaNGLrUHnvE/Ygc/G0
+azJJNnEreUhMWTJBaVZGSTJPRUFqQkVYS01KRENUVVpZSDgK8+8onFejroBo7MeO
-vz0D3uxTTvRBFYPNSONt+uN9j2p3JEZK5Hllt1GRmo6c8xnktDQpkwYLgegPYYxW
+dW+so4lOsq4zJKn3f0cxmCFg1f0X8zt6h4Uc3A5Cvr1uU+6yw1FWmJ7xa3jJz3lO
-5Ge/ywwPlKp1WzqVVBQv2FH1/qm0QcBUhtjrkTTPFOjk3vlrXqbSM7n4cMZJYWRi
+EEaKQJXYC+xIIKGcA7qILa0SFp4a/4OuYjcg27HrlPhg7u5wDhQrd0LdVEe1Xngp
-kMK51q2H49anwT8gkaeJ7hwlJpmzNIocDpD5sxxXj1NGc+uogEfaZrP7IRsACSTa
+ZivX7P7HwIna3X8C+TL+K2v/AG2N/z86cdKfRvxyMKNbHhYw+CfHEnWgh8tJ++4h
-ggub/LYjPyajj4CLjt+6O3KNepNsOTEiGH11TZ6cyjipDerIcZx1rO/6cnOPpN40
+G9evNniuNqte6cQaRe7jODfPNW4FuY/Sb7barlJ/M9iAQdYAdyLAzU1LABeHeUfD
-TZQc1IW+oGrbJk7WNNX4gjX2t0+ElVeDVQ2wEe862Yh4OxyMVUkCyh9DGFu5RxL4
+wtHjxy9DUZ55Vg8bB8M2JJU9MkoRT4ewiVd9LeC1GWeVmKsm93wsmrov714i7U2j
-veKJfvs6VSjS4GtaOOXAxYra5GXGaNAx9w53MRSWXd7T9eh4VnYr0pvdRPMYyQAe
+wHtDkjqEF2MmzuQc18sjNaAHiwz8j6o5xU2L/Q4+Q707yISWG7RGZYh389Cr1rnw
-H/aNl9lqtQt1r4DtfF/RMOuqIiKFlnnhKlVfp5uCAn5Bgn4nCBMvQrAlghXWzI+N
+siUq/Vunqw2wk13+J/4vu9nqt5mMktBaCtp+QiWIurjwB5LUAyChrSm+dg5lb0Mt
-rou2kBuzI3yKDO+8VJlacEVXM9vwv/O15XYpY/Mn1TYzbsOQi7FgnFatAWr6Uinh
+UhSc0lq1+E3vxAXM2Hmk+vP86VD+6WJvAU82VFApF1s6zG2FU1/AcOVVf54nan/q
-gmay4WDxikIlKdhV1CqOJek5AAC1ptVCDgDcOpERDdZ+whBHUDTJ4NjMEPPcmlyw
+f+rgSFfASHQCYSblUJHyEtwLNsWEmTGmOEn1buUKD/H0zatPQnc0rYpjlx2V0Sjd
-9sejEf7mjuqKY5VGAVy2CRqV0wIMJ3nIo8Um2NNQE2BKCVyucmxhPVA6NieRgG8F
+6yB5+wPrZ0AkN1pjcsPKOv8Kaog2DzqIjib+SaSTaRxWHQEb9uzvaReAcYI5HOpE
-NvqIE3Iji1xFiUC+twjOkTcVAl7hKk2yLjZxF6KqoP7rWr787qr3qNA3cXhxgSUN
+gkC040HN33BItATbo4+hz70Im8Ni/VXD+g6yzM6Hj1hJL+PinTKeg5keQRFIZjMx
-ZX9kzepy7pTyHADqK4j1Hum8o6/OjKaGQy/HIiywMjfk7zl3+Cs0PhjKG9HBReIQ
+grzievB2wVBBgLgN3qMdTFmpplaL7iL702JjXZUTTK9Izp+9wiCsV1fTa53FWDht
-MqbJqa2fyAqOuHk/44Lpja1CI7LGWxOrctTixG3+Gy3JmTrZh8pDqzzNmPrByrHO
+ylFL5SWElqXjK+QBXxAe+Jk6VQov5HI21YDXL67S554ABeRok23wxrQ31TCI4xq9
-+nN3HzUZ/4sw5ONUz/GQ89WcSjez1TNr+lwRsYMf8tUCRHgdxUT9HRXUeOd8eD4d
+PQV7VtNRjyVud7S29m3OwpWOsgTZhn+JclHj2v4bNJzJkJnZRTmcvGPktzRI5+R4
-CDyoAYpab01ZFkHzRhBOWJlqjqhDNIDEzMjImU4ieBsgCh9ZyIZF2HetLov6xESo
+e5vxVhGnJDzI71txaHl8+xS1lu9VzCQUrxX6TXyTRV4KjIOz0g06JOBgmBRBvJca
-FYCDb7UqIXsw7n04wSTbwcYV2iPQ0EowPrADcSvqq+9YVr8Tsw6pmTaxC18Wi+zY
+7MZbC65xpisl/gyLRbgkVga3t94dPV+dpZsn8eq6427IyRbKslJefatggR9//c6I
-7R9ALANy9qgxLnBAAXIbp2iyJayFQDNONkOlp4NV2RiVN/UrHcZNsZsSfM0DFzqh
+5N5fl0fR3gJQMB+HRbipBH2YsdbdWJyb4Nn6STZxIfrqoG/xC6C1raF0xK7hUx6i
-spuqt3czmAdvUzWpnghjMRUC49kkW2XNJxS9dREHmEPVZnzQo457CCCFsAqmrRB6
+4DUDSPohM8fOIswQPfE+FH3eygfzu/Ln5+ghsgHTEhgFvmgMvyxaAt6kHIzIUhMX
-c/wvyKD86Z89l/tkrLVz+sLQJMYfc5zED+EjyZyghHprkqZ6iDjFaEQUO8Fk2FwX
+M3dASr4VPDpIXuXsRWwYLEifhzxsuvwVxfwtsnCaR6XKijsYECWGDdYOWHdleeqx
-wCDqJhJGXs3MT7tJnfIrwy4AvJv9FgUnMYYpQiyv+ToDqgAWGVDfxGieQo6r59El
+wDPhxEesfFVhKxhrKY9Ir8k9/FFBKQU/3GjW4+SMAg5Al1YEzxshP9vKuVcsei7W
-ZpTx+qt3jT+jI5Z6v4OVRODU2FFlee+YcF3ooF3yiwNdvuRhIgOVCNXkD/9QBOyq
+JDwAwotNXaCm6NBckiyZJE53ou6+gckPY7V9cOfnuH74Z9ywkFzB3HW3ZlonaGyM
-MiOcCcGNxWx3COGIdshg/HVjGfxm+zZUYW0ktn3/YNkUHPIPxIWPNRdlQ9xbu3kD
+oGmLGcccavFtyhg5s/As4i6X8ARIpDiwe59Pn3GNXMctySqIrrr2ogUoXgrfFCie
-vd1Ivx8wsUfo7soMffjdYKoAbAWS/3Ce/Sgpk15uo7CzGoO7Egzj+cb4GtvgojDD
+6GOTdeMW7GeOSdJUxCofghlspS/nq01Og77VI/beWYrIwLubSka6Zaltww9zgObk
-BwG3CSzUJcXV2zbRwxfHRanko0RN/Qpskc/P1DiSMduxP8nZT+/r2HCykX+CRkM7
+/FGEMgFkEpq7iyCvYSPA8F46pJKvnMP3S84AWCPmcTcHeg4lwGPvs6btexXBGdoz
-PtnG0moKD3i5u3X/jQAAPA1X9BPbbwgTE/nmHpgMxG1BD5GlLmeY1hkBRwEUlnSr
+nkCyq7wdH5Nngm7jUbl88LtaLZPAQkuqXphBVTnrF9Ofbnb4iRZ2Op4xpx9rGyvx
-UsN8FaWGBKyPMtMhK8EcjzmH259NJYguDgpBgMiIpO3sXst4yK5RuxR22+S8AI6X
+mO6UEhL6V1i2YZFNkNMg/W8aoMiUgBdqbkxaxblT9L0aNdlFU9+LbWYolURVEadd
-VucMZWa+BzyHc3Oej/T5UrCIZ/tDzktD0Xp76EZxPD7ADw2z0+7TQ5YSYFal3+X1
+Qjv0Z1gMA+tsuBbVszwsMfneZ5+B9Q==
 fcdKTphts2YRvtXLQuv+8SCIcf8VKMVjIkRCtE5ez1Isk+ZHEtprKsp9ZFsj9cFV
 R6c2d1YqoW7IGWfcZL4snG09DaifPtwiwJBdYxRfGXgOq1fxtszzAxdlIoT3HRVo
 pBHZp+7zcAXFyjgPDGOP5fcfGbMD41Vr9W9DVzioBIZDDQLRs4M6DZDgqgWv32tO
 P7s2TivIEoAnirtic+tQZe5lXwndPUou0qYTO28diLSCTj29S+Vw9/ftah7qOqy6
 iDdf2rhbMNSRoywZOwQer6aLHePkSq7yDRRnQburIaUyy4FWjSYumx3O/2++JrkW
 uFhLRIOu4M3gkgyqb4xOscxl/aEGZADR8tLIeqn/Bnt/Bub8vTph1H/ZCYEvjZA5
 afmShsiIKw==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/homeautomation.age
+++ b/secrets/homeautomation.age
@@ -1,19 +0,0 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBOSk9J
 RDF0bk4zNmdWRXhFTU1xUlVKeDJkTU51UDRiNjcvWlVKT3cxNzBvCk00ZEtMdlI2
 L2xiS3BnT1g0aEd3VmgydCtSVERrTjNraHNmSHZicENLODAKLT4gI0crX0A0Zmst
 Z3JlYXNlIE8wNCBfPz5uSy4KSGxzcnJlM1FRamI0VWlZbTJvRnRuanlwSjN0eisy
 bnlHSDZZbHpIbGNZUngvS1Fqb2dzd1p6UjZKZGowOUhONgoKLS0tIE1NMUV3QlpV
 dEFXMUVOTFBGSlpVSjFzRlpjVTk2dkx1VURUaFl3R014a2cKTnWIRQg4txvZZ4A5
 XdwnXZqmYzOX7l2UrjmP/TJA++EURZzYtTS+q3FV9QTIj+7k0DOLf9nKq7XHlGM8
 Ptkaf/s1Ly7ke+v9l9C2uf9oNI6b+m3d7QqZC5WWvRXWvl9ImaJ3xVi9AM5f5NWH
 Likn6GZDir4ihAec8pAi3H2SCCjkhqF/TlLe99tp+7AAUiOjNuNlej1OUOmJNxEr
 GnHePwZZqa6/F9YnYQ0tKKRsZH5whxUPYUwhHSuWa/NidBK7lqKqdaPBevfdqWLg
 59gkaL9BeGG5FUXg1cPEWAvOQ5Ajae/kVH6aRi5LXJPZfA/DetWgm9mmxJ2qPpFD
 /n/JCsQUOnpk66j38bWMW5uok51s61oG1OZWGpPYstoLtivKOlVpG7xgioGqIIuc
 c2ZsKK/iCauwX3sGQtpX9DbILrtOnzxU2B/dclcXe2EDfSJH0u2RrefxcqPG87pI
 BAosRdq7GUUISSCTccaswwG555a7/Z5gzXOwXeQYNlK1HRnkF9oBsKTUoAI2b+VO
 Hdv1uw9u5JLcZt+5qSB6AxJuk8yDF0KXIqkaCiwl2fV3bBkehPru7oCJFTtVMFVZ
 u0A0h+n8KJCvyRKe/Tl+lT+JHM6Mk7SkFrmsaepZPnAtfLht+bP6b0oHrUsVx/iI
 r7o=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/network.age
+++ b/secrets/network.age
@@ -1,12 +0,0 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBVMEhO
 RWdybFg4VWJaMjRWYm1ac2pzZ3R5aFZEM1o4dUtFZ0M4QnVKRzIwCnNGRFRjb01X
 QU5mQTRSb21MV3lMMERIMGI1RHFQVFFZNlVlMnk4aTdna1kKLT4gM24xLWdyZWFz
 ZSA/bVhubQplcXNVN3kxOEpqY2hUbkV3MG5PNVJtRGhORVVLdFVCRnFFVjRneEFI
 VWFyZTRNS280RXlnckJpdFR4V1NBSTUzCjlxZkZ3UllpZXUwczR0T3JGRzUzMEhV
 U1hobC84eWtEWWZOYyt6M2c3OUZIUTlKTm41dVp5UEZVSmVwWHBmR00KCi0tLSBF
 ZnJ5QzN2VXpsY3JQQ3lmbklxcldydm1MSlFlejJ2S3hVVUtka0hTM044CvqhtnFn
 pZsgP6w5uKh9CtVQpcyST8hA9P24e1opfu1JN3m/8g9XiJrMT5qVYtUXkV+pr4s6
 pVGsp9KScaS0T8TpLxvZoUAAdvVtdHh6GSbbszR6gZbStbWXmb6THYKHOghpK9HD
 cDEoRmzcmFdwi3m26Xppmi2R6NmeKI4S6pbY95bfh2E6jn+7
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -11,8 +11,4 @@ in
  "lazyworkhorse_host_ssh_key.age".publicKeys = authorizedKeys;
  "n8n_ssh_key.age".publicKeys = authorizedKeys;
  "openclaw_gateway_token.age".publicKeys = authorizedKeys;
  "ai.age".publicKeys = authorizedKeys;
  "cloudstorege.age".publicKeys = authorizedKeys;
  "homeautomation.age".age".publicKeys = authorizedKeys;
  "network.age".age".publicKeys = authorizedKeys;
 }
--- a/secrets/tak.age
+++ b/secrets/tak.age
@@ -1,12 +0,0 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEdoTUQ4QSBsYXVu
 Sk5CSjNsbHBRZkNXUGZVeGNva3FKMUdHV0RiQzJLNHVvSHZzd0dRClNnbzZvUFFR
 Ty96OXZ4R2lCMHpnclpVaEZ1TEYvb0tTSVRwdWV1amdIL0UKLT4gYTtvOmAtZ3Jl
 YXNlICk5WkE7USUgSyRLCjBmTWRTdEJJV2lNbVRlL3VidmZza1NTTWhIcG1vVFY5
 OUUxcG4ycTMraUUKLS0tIEVlaUdlcUFPMkZSMUpJVEFzTksrVC9lZGlMNEJ1SFBv
 SFNtc0wwQ05nQ0EKYlRGYGeKlfW0lTPdpCtcTfh2NWUuyZnDFe6VAWLYL3PW42od
 a+bhlgxTi9KF5FLjVA3IIdQSsKiMya+PI0VfOLWkA24ZN+4uilsQkicxnnRR1z8o
 hv9G8N3eYqBsLylg8rW2Xkn4RzT/S5TyJZPFG4HsUYWtHS+iomg4HbQrgIrpIde9
 Th3V8WQB1HfKs9ilg8Q/DvDckFjevWYz2OXMYx4ZHWS53huQfE/oWPZfQid6Dd06
 NXcvCHPVDUszhWvcoOsSpK6vaOnuY1B32/qExw==
 -----END AGE ENCRYPTED FILE-----
Author	SHA1	Message	Date
Hermes	ca3faf40cf	Empty initrd for display, add rp1_dsi module ALL RP1 hardware (gpio, clocks, dsi) sits behind the RP1 PCIe southbridge, which isn't ready until ~12s. Loading any display module in initrd (~3s) crashes the system. Nothing in initrd now: - boot.initrd.kernelModules: empty (nothing touches RP1 early) - boot.kernelModules: vc4, panel_cwu50, rp1_dsi (stage-2)	2026-06-09 23:14:44 -04:00
Hermes	4f1864af70	Revert vc4/panel_cwu50 to boot.kernelModules (stage-2 loading) Loading via boot.kernelModules ensures they're loaded after initrd, by which time RP1 PCIe southbridge is initialized (~12s). This avoids the 'Cannot find any crtc' error from premature probe. - boot.kernelModules: explicit vc4 + panel_cwu50 (stage-2) - boot.initrd.kernelModules: only ocp8178_bl (backlight)	2026-06-09 22:46:43 -04:00
Hermes	67418f037a	Rex timing: remove vc4/panel_cwu50 from boot.kernelModules too Let udev auto-load display modules when RP1 PCIe southbridge appears on the bus (~12s). This is exactly how Rex's Debian image works — no forced loading in initrd or stage-2. - boot.initrd.kernelModules: only ocp8178_bl (backlight only) - boot.kernelModules: no display modules (udev handles it) - SDDM disabled (Hyprland kept for manual start)	2026-06-09 22:44:45 -04:00
Hermes	fb01e4be1d	SDDM disabled, Hyprland kept (manual start only) - Removed SDDM display manager (was blocking boot when display fails) - Kept Hyprland installed for manual start (hyprland command) - Display modules load in stage-2 via boot.kernelModules (Rex timing)	2026-06-09 22:39:13 -04:00
Hermes	f57f2846ff	Fix duplicate boot.kernelModules, merge vc4/panel_cwu50 into existing list	2026-06-09 22:20:27 -04:00
Hermes	288b7538d5	Fix CM5 display: delay vc4/panel_cwu50 to after RP1 PCIe init Loading display drivers in initrd (~3s) before RP1 PCIe southbridge is ready (~12s) causes 'Cannot find any crtc or sizes' because the DSI encoder isn't reachable. Rex loads these via udev late in boot. - boot.initrd.kernelModules: only ocp8178_bl (backlight, RP1-independent) - boot.kernelModules: vc4 + panel_cwu50 loaded in stage 2 after RP1	2026-06-09 21:42:24 -04:00
Hermes	fb7c3e6424	Fix RNS setup.py license_files tuple for setuptools 80.x	2026-06-09 20:49:16 -04:00
Hermes	6961027218	Fix reticulum build: add sourceRoot for PyPI package	2026-06-09 20:47:45 -04:00
Hermes	8bf44a066e	Add nixpkgs-uconsole pinned to commit that base image used The base image (nixos-uconsole v1.1.0) was built with nixpkgs commit 54170c54449ea4d6725efd30d719c5e505f1c10e (2026-04-10), NOT the flake.lock pin (89dbf01df7 from Dec 2025). By pinning to the exact commit the image used, the kernel derivation hash should match what's already in the store.	2026-06-09 20:38:05 -04:00
Hermes	644c9a7645	uConsole: use mkUConsoleSystem instead of manual nixosSystem Using nixos-uconsole.lib.mkUConsoleSystem ensures the exact same module composition as the pre-built image, so the kernel derivation hash matches what'\''s already in the store (6.12.47).	2026-06-09 20:16:31 -04:00
Hermes	52fa439409	Align pins with nixos-uconsole v1.1.0 for kernel cache hit - nixos-uconsole: main -> v1.1.0 (tag) - nixos-raspberrypi: v1.20260517.0 -> v1.20260317.0 (matches nixos-uconsole v1.1.0's flake.lock) - Keeps nixos-raspberrypi.inputs.nixpkgs.follows = nixos-uconsole/nixpkgs This ensures the kernel derivation hash matches the pre-built image's kernel already in the uConsole store.	2026-06-09 19:52:40 -04:00
Hermes	db2deda941	fix(uconsole): align nixos-raspberrypi nixpkgs with nixos-uconsole Make nixos-raspberrypi follow nixos-uconsole's nixpkgs so the kernel uses the same nixpkgs that the uconsole Cachix was built with.	2026-06-09 19:34:31 -04:00
Hermes	7f7634c1b1	fix(uconsole): stop following nixpkgs for nixos-uconsole and nixos-raspberrypi Remove inputs.nixpkgs.follows so these inputs use their own pinned nixpkgs. This lets the uConsole build use the nixos-uconsole Cachix cache for the kernel, avoiding 4h kernel recompilation on every config change.	2026-06-09 19:23:53 -04:00
Hermes	1fa1cfaa76	fix(uconsole): apply CM5 display fixes from nixos-uconsole comparison - Add hardware.graphics.enable = true (Mesa GPU required for VC4) - Add boot.kernelParams with console=tty1 (console on fb0 not ttyAMA0) - Fix console.font to ter-v24n with proper package (match nixos-uconsole) - Merge GPIO 10/11 from nixos-uconsole extra-config (audio amp) - Bump stateVersion to 25.11	2026-06-08 23:40:19 -04:00
Hermes	4d2cba77e1	fix(display): use [pi5] config.txt section instead of [cm5] Rex's Trixie images use [pi5] for the CM5 display overlays (clockworkpi-uconsole-cm5, vc4-kms-v3d-pi5). The nixos-uconsole module generates [cm5] which the firmware may not apply on some CM5 EEPROM configurations. Adding explicit [pi5] section ensures the display overlays are always loaded.	2026-06-07 22:49:01 -04:00
Hermes	8d54e5e8fa	fix(display): use kernel default console font instead of ter-v24n The ter-v24n Terminus font renders garbled on CM5 DSI 720x1280 panel (green stretched line across screen). Switching to the kernel's built-in Lat2-Terminus16 font for correct text rendering.	2026-06-07 22:10:46 -04:00
Hermes	42e5d4dd2d	fix(uconsole): disable GPIO 23 service (causes CM5 freeze) + open SSH GPIO 23 service used gpioset 0 23=1 on BCM2712 chip 0 instead of the RP1 chip (base 512), writing to a critical pin and freezing the system. Commented out until correct chip is confirmed. SSH opened with PasswordAuthentication + PermitRootLogin for first deployment. Lock down after initial boot.	2026-06-07 21:57:13 -04:00
Hermes	682402e0e6	fix(uconsole): use nixpkgs default nix instead of lix dev lix dev (20260606) is incompatible with nixpkgs 25.11 stable. Still on other hosts. This avoids the lix build failure.	2026-06-07 10:08:35 -04:00
Hermes	9c4b50b4c3	fix(config): remove meshtastic from packages — not in nixpkgs 25.11	2026-06-07 06:47:32 -04:00
Hermes	8e395729ff	fix(overlay): avoid recursion with final.lib, use prev.lib.optionalAttrs Replace recursive `final.lib.optionalAttrs` with `prev.lib.optionalAttrs` using the `?` operator to check for meshtastic existence safely. This allows the overlay to work with both stable (25.11) and unstable.	2026-06-07 06:45:16 -04:00
Hermes	346b41995f	fix(overlay): make meshtastic conditional for stable nixpkgs (25.11) meshtastic package doesn't exist in nixpkgs 25.11 stable. Use optionalAttrs to skip the override when not available, allowing the flake to build against both stable and unstable.	2026-06-07 06:43:09 -04:00
Hermes	68900ca7b3	fix: switch to nixpkgs 25.11 stable to match pre-built uConsole kernel The uConsole CM5 has kernel 6.12.47 in its store from the nixos-uconsole-cm5-v1.1.0 image (built with nixpkgs 25.11). By switching to the same nixpkgs version, Nix will reuse the existing kernel instead of rebuilding it from source.	2026-06-07 06:37:25 -04:00
Hermes	38eea77fd9	fix(uconsole): remove useless udev rule for voltage_min_design sysfs node is read-only (0444), even root cannot write. The AXP228 PMU manages power path in hardware. Practical fix: disconnect batteries during heavy builds.	2026-06-06 23:01:14 -04:00
Hermes	b7b5ef0b53	fix(uconsole): lower voltage_min_design to 2.7V to prevent random power-off under heavy CPU load	2026-06-06 22:54:59 -04:00
Hermes	f0954efcaa	fix(sddm): enable wayland support for Hyprland	2026-06-06 21:29:51 -04:00
Hermes	b0be414649	revert(nixos-uconsole): follow unstable nixpkgs again Cachix has no CM5 kernel anyway, so sticking to stable doesn't save build time. Might as well stay on unstable for latest pkgs.	2026-06-06 21:27:47 -04:00
Hermes	31dd0f36d4	feat(uconsole): add Hyprland + SDDM display manager Enables Hyprland Wayland compositor with XWayland support and SDDM display manager for graphical desktop on the uConsole CM5.	2026-06-06 21:23:15 -04:00
Hermes	653c69fcfd	fix(flake): detach nixos-uconsole nixpkgs from unstable to hit Cachix nixos-uconsole's Cachix cache is built with nixpkgs-stable (25.11). Following our unstable caused a full kernel rebuild every time. By using nixos-uconsole's pinned nixpkgs, future builds will download the pre-compiled kernel from the cache instead of compiling it locally on the CM5.	2026-06-06 21:07:37 -04:00
Hermes	a9b95c5d48	fix(config): use libgpiod instead of gpiod for gpioset The nixpkgs attribute for userspace GPIO tools is 'libgpiod', not 'gpiod'. This provides the gpioset binary used by the GPIO 23 internal USB hub service.	2026-06-06 17:27:12 -04:00
Hermes	6771c9882a	fix(hw-config): use mkForce for filesystems to avoid disko conflict Disko auto-generates fileSystems with by-partlabel paths, but for manual install via loop devices we need by-label paths. mkForce ensures our paths win during evaluation.	2026-06-06 17:23:50 -04:00
Hermes	897f470a16	fix(disko): use /dev/mmcblk0 instead of wrong by-path platform-fe340000.mmc doesn't exist on the uConsole CM5. The eMMC is at /dev/mmcblk0 in normal boot mode.	2026-06-06 16:51:46 -04:00
Hermes	eaf879c4d1	fix(disko-config): use disko.devices.disk instead of top-level disk disko module defines options under `disko.devices.disk.`, not `disk.`. This was causing evaluation error: "The option 'disk' does not exist. Did you mean 'disko'?"	2026-06-06 16:39:46 -04:00
Hermes	486758e51a	feat(uConsole): add disko, backlight fix, GPIO 23, mt7921u - Add disko flake input + partition config (/boot/firmware, /, /home) - Add cm5-backlight-fix service as display fallback - Add enable-gpio23-usb-hub service for internal USB hub - Add mt7921u kernel module for MediaTek AC1200 WiFi - Add gpiod package for GPIO userspace control	2026-06-06 16:38:41 -04:00
Hermes	34cc0a161a	fix: override meshtastic to skip runtime deps check (tabulate 0.10.0 incompatibility)	2026-06-06 10:17:04 -04:00