Merge pull request '📦 stalwart package, module' (#32) from stalwart into master

Reviewed-on: #32

.gitea/workflows/publish-attic.yaml

@@ -67,9 +67,14 @@ jobs:
 
           system="$(nix eval --impure --raw --expr builtins.currentSystem)"
 
-          NIXPKGS_ALLOW_UNFREE=1 nix build --impure --accept-flake-config --no-link --print-out-paths -L \
+          NIXPKGS_ALLOW_UNFREE=1 nix build --impure --sandbox --no-sandbox-fallback --accept-flake-config --no-link --print-out-paths -L \
             ".#packages.${system}.atuinLatest" \
             ".#packages.${system}.cliampLatest" \
+            ".#packages.${system}.lazygitLatest" \
+            ".#packages.${system}.ghDashLatest" \
+            ".#packages.${system}.diffNavLatest" \
+            ".#packages.${system}.k9sLatest" \
+            ".#packages.${system}.sable-web" \
             ".#packages.${system}.musicpresence" \
             ".#packages.${system}.vintage-story" \
             ".#packages.${system}.swaytreesave" \

flake.lock

@@ -9,11 +9,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1787797120,
-        "narHash": "sha256-88Di5b78X0LI0BkGehewOIbA9wrnNf6PD1VTz+gv910=",
+        "lastModified": 1791702392,
+        "narHash": "sha256-8uWZP3UiJBtYzBzazI18WvlshKYHxPb+8aqm02OxL5M=",
         "ref": "refs/heads/master",
-        "rev": "707867341ac6f89193da112b42f05534016aa325",
-        "revCount": 21,
+        "rev": "ee2a27ad749d6d774e26c2be5de5f3a5ecd4a93f",
+        "revCount": 28,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
       },
@@ -42,14 +42,30 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-schemas": {
       "locked": {
-        "lastModified": 1761577921,
-        "narHash": "sha256-eK3/xbUOrxp9fFlei09XNjqcdiHXxndzrTXp7jFpOk8=",
-        "rev": "47849c7625e223d36766968cc6dc23ba0e135922",
-        "revCount": 107,
+        "lastModified": 1780327564,
+        "narHash": "sha256-HiRPtA0spK+Dkgbhz/1zW9glXxNVB+L4Rj2VYmdawb8=",
+        "rev": "6cc9bd98891b1fc6bb2b8cb3277df8bc72799ca6",
+        "revCount": 149,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.2.0/019a4a84-544d-7c59-b26d-e334e320c932/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/flake-schemas/0.5.0/019e83cf-9af3-78b1-ac5b-70e68ad1efe1/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -70,6 +86,68 @@
         "url": "https://flakehub.com/f/DeterminateSystems/flake-schemas/%2A"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "go-overlay",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "go-overlay": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "git-hooks": "git-hooks",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
+        "owner": "purpleclay",
+        "repo": "go-overlay",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "purpleclay",
+        "repo": "go-overlay",
+        "type": "github"
+      }
+    },
     "hildibrand": {
       "inputs": {
         "flake-schemas": "flake-schemas_2",
@@ -79,11 +157,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1785717646,
-        "narHash": "sha256-j6MlkwaYOLa3bogK4SbOnVI5eMZ9j2GdExSiKMaELPo=",
+        "lastModified": 1791702441,
+        "narHash": "sha256-qHf8tVIYu6OE1PKcthmpBgblg27u3bU7v4TVqy0B3jg=",
         "ref": "refs/heads/master",
-        "rev": "9588520925513ed0e47711a5798c6e9958143a0a",
-        "revCount": 5,
+        "rev": "2c2e99f6347e9be744a72f7df6043015989d6cd7",
+        "revCount": 17,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
       },
@@ -99,11 +177,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787797243,
-        "narHash": "sha256-8+Q7NOB7RPajRjA4pbCDLzqH+MTjnG9x6LUPLfL2joA=",
+        "lastModified": 1792098797,
+        "narHash": "sha256-u4DIIZgznEGzByxXrxWCXK19VcMtTBmi/M9gZ7Jk9bM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "99c9ec63390f1d8c14d95d9e8b17cc29cfbd4e11",
+        "rev": "640725978b99076e18e069f6e7d2959124584f8f",
         "type": "github"
       },
       "original": {
@@ -114,11 +192,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787962033,
-        "narHash": "sha256-u6z9VTZA4Kf3RkHQo9sQI7NI4Ei/uiU9vrMqOiwWP1Y=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c5c4a43b0e8056328ec4529f735cabdb8f1942bb",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -132,6 +210,7 @@
       "inputs": {
         "caitsith": "caitsith",
         "darwin": "darwin",
+        "go-overlay": "go-overlay",
         "hildibrand": "hildibrand",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
@@ -146,11 +225,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771729765,
-        "narHash": "sha256-HNsDSR5bhLSrIpi9bTb2uTK1qnPo1xFSBxs6YmFyprk=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "be926cb1a76e8450ab2b92121b2e88d09fa4d41c",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -167,11 +246,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784438913,
-        "narHash": "sha256-NYF7ZM5ip0u+w1pBFDpIGEbrbgN/wpnLFAmBkWkYMXw=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "afacd6819d3765a05814ee8e3de74c77d42ac799",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -187,11 +266,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788077403,
-        "narHash": "sha256-c20YZQKzQ27qC6Wh729fWRTpI7oV4+7Ur4icKssD4Wc=",
+        "lastModified": 1792219666,
+        "narHash": "sha256-RMO08tKD+hFIL5ryWi85VY4aHE5oIpdV1h4kVFctOkw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "89e26eeaafa88a2ede4778734acc794ff0299beb",
+        "rev": "a110337465cfb76e3806b81b9db3094c3e6e770a",
         "type": "github"
       },
       "original": {
@@ -199,6 +278,21 @@
         "repo": "rust-overlay",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -11,6 +11,10 @@
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    go-overlay = {
+      url = "github:purpleclay/go-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     hildibrand.url = "git+https://scm.wyattjmiller.com/wymiller/hildibrand.git";
     hildibrand.inputs.nixpkgs.follows = "nixpkgs";
@@ -18,7 +22,7 @@
     caitsith.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = inputs@{ self, nixpkgs, home-manager, darwin, rust-overlay, ... }:
+  outputs = inputs@{ self, nixpkgs, home-manager, darwin, rust-overlay, go-overlay, ... }:
     let
       supportedSystems = [
         "x86_64-linux"
@@ -61,6 +65,7 @@
 
       overlays.default = nixpkgs.lib.composeManyExtensions [
         rust-overlay.overlays.default
+        go-overlay.overlays.default
         (import ./overlays)
       ];
       homeManagerModules = import ./modules/home-manager self;

modules/nixos/default.nix

@@ -0,0 +1,3 @@
+self: {
+  stalwart = import ./stalwart.nix self;
+}

modules/nixos/stalwart.nix

@@ -0,0 +1,311 @@
+self: {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.stalwart;
+  configFormat = pkgs.formats.toml { };
+  configFile = configFormat.generate "stalwart.toml" cfg.settings;
+  useLegacyStorage = lib.versionOlder cfg.stateVersion "24.11";
+  pre2605 = lib.versionOlder cfg.stateVersion "26.05";
+  stalwartIdentifier = if pre2605 then "stalwart-mail" else "stalwart";
+  stalwartIdentifierText = ''if lib.versionOlder config.services.stalwart.stateVersion "26.05" then "stalwart-mail" else "stalwart"'';
+
+  parsePorts =
+    listeners:
+    let
+      parseAddresses = listeners: lib.flatten (lib.mapAttrsToList (name: value: value.bind) listeners);
+      splitAddress = addr: lib.splitString ":" addr;
+      extractPort = addr: lib.toInt (builtins.foldl' (a: b: b) "" (splitAddress addr));
+    in
+    map (address: extractPort address) (parseAddresses listeners);
+
+in
+{
+  imports = [
+    # since 0.12.0 (2025-05-26) release, upstream re-branded project to 'stalwart' due to inclusion of collaboration features (CalDAV, CardDAV, and WebDAV)
+    #  https://github.com/stalwartlabs/stalwart/releases/tag/v0.12.0
+    (lib.mkRenamedOptionModule [ "services" "stalwart-mail" ] [ "services" "stalwart" ])
+  ];
+  options.services.stalwart = {
+    enable = lib.mkEnableOption "the all-in-one collaboration and mail server, Stalwart";
+
+    stateVersion = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        The version of this module (=version of NixOS) when this module was first enabled on this particular machine, used to maintain compatibility with application data created on older versions of this module.
+
+        See {option}`system.stateVersion` for details on the NixOS-global equivalent to this option.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "stalwart" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open TCP firewall ports, which are specified in
+        {option}`services.stalwart.settings.server.listener` on all interfaces.
+      '';
+    };
+
+    settings = lib.mkOption {
+      inherit (configFormat) type;
+      default = { };
+      description = ''
+        Configuration options for the Stalwart server.
+        See <https://stalw.art/docs/configuration> for available options.
+
+        By default, the module is configured to store everything locally.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/${stalwartIdentifier}";
+      defaultText = lib.literalExpression "/var/lib/\${${stalwartIdentifierText}}";
+      description = ''
+        Data directory for stalwart
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = stalwartIdentifier;
+      defaultText = lib.literalExpression stalwartIdentifierText;
+      description = ''
+        User ownership of service
+      '';
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = stalwartIdentifier;
+      defaultText = lib.literalExpression stalwartIdentifierText;
+      description = ''
+        Group ownership of service
+      '';
+    };
+
+    credentials = lib.mkOption {
+      description = ''
+        Credentials envs used to configure Stalwart secrets.
+        These secrets can be accessed in configuration values with
+        the macros such as
+        `%{file:/run/credentials/stalwart.service/VAR_NAME}%`.
+      '';
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = {
+        user_admin_password = "/run/keys/stalwart_admin_password";
+      };
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          !(
+            (lib.hasAttrByPath [ "settings" "queue" ] cfg)
+            && (builtins.any (lib.hasAttrByPath [
+              "value"
+              "next-hop"
+            ]) (lib.attrsToList cfg.settings.queue))
+          );
+        message = ''
+          Stalwart deprecated `next-hop` in favor of "virtual queues" `queue.strategy.route` \
+          with v0.13.0 see [Outbound Strategy](https://stalw.art/docs/mta/outbound/strategy/#configuration) \
+          and [release announcement](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md#upgrading-from-v012x-and-v011x-to-v013x).
+        '';
+      }
+    ];
+
+    # Default config: all local
+    services.stalwart.settings = {
+      tracer =
+        if pre2605 then
+          {
+            stdout = {
+              type = lib.mkDefault "stdout";
+              level = lib.mkDefault "info";
+              ansi = lib.mkDefault false; # no colour markers to journald
+              enable = lib.mkDefault true;
+            };
+          }
+        else
+          {
+            journal = {
+              type = lib.mkDefault "journal";
+              level = lib.mkDefault "info";
+              enable = lib.mkDefault true;
+            };
+          };
+      store =
+        if useLegacyStorage then
+          {
+            # structured data in SQLite, blobs on filesystem
+            db.type = lib.mkDefault "sqlite";
+            db.path = lib.mkDefault "${cfg.dataDir}/data/index.sqlite3";
+            fs.type = lib.mkDefault "fs";
+            fs.path = lib.mkDefault "${cfg.dataDir}/data/blobs";
+          }
+        else
+          {
+            # everything in RocksDB
+            db.type = lib.mkDefault "rocksdb";
+            db.path = lib.mkDefault "${cfg.dataDir}/db";
+            db.compression = lib.mkDefault "lz4";
+          };
+      storage.data = lib.mkDefault "db";
+      storage.fts = lib.mkDefault "db";
+      storage.lookup = lib.mkDefault "db";
+      storage.blob = lib.mkDefault (if useLegacyStorage then "fs" else "db");
+      directory.internal.type = lib.mkDefault "internal";
+      directory.internal.store = lib.mkDefault "db";
+      storage.directory = lib.mkDefault "internal";
+      resolver.type = lib.mkDefault "system";
+      resolver.public-suffix = lib.mkDefault [
+        "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
+      ];
+      spam-filter.resource = lib.mkDefault "file://${cfg.package.spam-filter}/spam-filter.toml";
+      webadmin =
+        let
+          hasHttpListener = builtins.any (listener: listener.protocol == "http") (
+            lib.attrValues (cfg.settings.server.listener or { })
+          );
+        in
+        {
+          path = "/var/cache/${stalwartIdentifier}";
+          resource = lib.mkIf hasHttpListener (lib.mkDefault "file://${cfg.package.webadmin}/webadmin.zip");
+        };
+    };
+
+    # This service stores a potentially large amount of data.
+    # Running it as a dynamic user would force chown to be run everytime the
+    # service is restarted on a potentially large number of files.
+    # That would cause unnecessary and unwanted delays.
+    users = {
+      groups = lib.mkIf (cfg.group == stalwartIdentifier) {
+        ${cfg.group} = { };
+      };
+      users = lib.mkIf (cfg.user == stalwartIdentifier) {
+        ${cfg.user} = {
+          isSystemUser = true;
+          inherit (cfg) group;
+        };
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' - '${cfg.user}' '${cfg.group}' - -"
+    ];
+
+    systemd = {
+      services.stalwart = {
+        description = "Stalwart Server";
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "local-fs.target"
+          "network.target"
+        ];
+
+        serviceConfig = {
+          # Upstream service config
+          Type = "simple";
+          LimitNOFILE = 65536;
+          KillMode = "process";
+          KillSignal = "SIGINT";
+          Restart = "on-failure";
+          RestartSec = 5;
+          SyslogIdentifier = stalwartIdentifier;
+
+          ExecStartPre =
+            if useLegacyStorage then
+              ''
+                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/data/blobs
+              ''
+            else
+              ''
+                ${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}/db
+              '';
+          ExecStart = [
+            ""
+            "${lib.getExe cfg.package} --config=${configFile}"
+          ];
+          LoadCredential = lib.mapAttrsToList (key: value: "${key}:${value}") cfg.credentials;
+
+          ReadWritePaths = [
+            cfg.dataDir
+          ];
+          CacheDirectory = stalwartIdentifier;
+          StateDirectory = stalwartIdentifier;
+
+          # Upstream uses "stalwart" as the username since 0.12.0
+          User = cfg.user;
+          Group = cfg.group;
+
+          # Bind standard privileged ports
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+
+          # Hardening
+          DeviceAllow = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          PrivateUsers = false; # incompatible with CAP_NET_BIND_SERVICE
+          ProcSubset = "pid";
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+        unitConfig.ConditionPathExists = [
+          "${configFile}"
+        ];
+      };
+    };
+
+    # Make admin commands available in the shell
+    environment.systemPackages = [ cfg.package ];
+
+    networking.firewall =
+      lib.mkIf (cfg.openFirewall && (builtins.hasAttr "listener" cfg.settings.server))
+        {
+          allowedTCPPorts = parsePorts cfg.settings.server.listener;
+        };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      happysalada
+      onny
+      norpol
+    ];
+  };
+}

overlays/cliamp.nix

@@ -1,24 +1,24 @@
-final: prev: {
-  cliampLatest = prev.cliamp.overrideAttrs (oldAttrs: rec {
-    version = "2.0.1";
+_: prev: {
+  cliampLatest = prev.cliamp.overrideAttrs (_: rec {
+    version = "2.3.0";
 
     src = prev.fetchFromGitHub {
       owner = "bjarneo";
       repo = "cliamp";
       tag = "v${version}";
-      sha256 = "sha256-r7MrrcVt+/f+iPozn9jaczJmpPv431wAoW8LvHKBtB8=";
+      sha256 = "sha256-+q3/AfxHtEYH/gzaiimn0gDx98vlytVsJFfYnq04U9Y=";
     };
 
-    vendorHash = "sha256-rtwUWbft5XGEbuBCn0OMCn4TS5Ul+UXJNIqNOzXfU+M=";
+    vendorHash = "sha256-cythuV9J/Iu+ibRVza8dQ6RHjYKa0hVllc2t6dh3hhs=";
 
-  buildInputs = with prev; [
-    libogg
-    libvorbis
-    flac
-    mpg123
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    alsa-lib
-  ];
+    buildInputs = with prev; [
+      libogg
+      libvorbis
+      flac
+      mpg123
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+    ];
   });
 }

overlays/container.nix

@@ -1,10 +1,10 @@
-final: prev: {
-  containerLatest = prev.container.overrideAttrs (oldAttrs: rec {
-    version = "1.3.1";
+_: prev: {
+  containerLatest = prev.container.overrideAttrs (_: rec {
+    version = "1.4.1";
 
     src = prev.fetchurl {
       url = "https://github.com/apple/container/releases/download/${version}/container-${version}-installer-signed.pkg";
-      hash = "sha256-p8G515J9MIdfL2x70dDLBsLapspXzp6QpRROiY/fVKg=";
+      hash = "sha256-wNJxav77sZTJP65mLpyufMGGvLz3RoFmCOxnPdZIpqQ=";
     };
   });
 }

overlays/default.nix

@@ -3,4 +3,8 @@ prev.lib.composeManyExtensions [
   (import ./atuin.nix)
   (import ./container.nix)
   (import ./cliamp.nix)
+  (import ./diffnav.nix)
+  (import ./gh-dash.nix)
+  (import ./lazygit.nix)
+  (import ./k9s.nix)
 ] final prev

overlays/diffnav.nix

@@ -0,0 +1,25 @@
+final: prev: let
+  golang_latest = prev.go-bin.latestStable;
+  buildGoModuleLatest = prev.buildGoModule.override {
+    go = golang_latest;
+  };
+in {
+   diffNavLatest = (prev.diffnav.override {
+    buildGoModule = buildGoModuleLatest;
+  }).overrideAttrs (_: rec {
+    version = "0.12.0";
+    src = prev.fetchFromGitHub {
+      owner = "dlvhdr";
+      repo = "diffnav";
+      rev = "v${version}";
+      hash = "sha256-DrEbo9YYg4FCXQXuIkbPxO5Z3ZOPZJYeGoLoP/vT0Y0=";
+    };
+
+    vendorHash = "sha256-2OzHyBPsylQVXhPlqk2owEhiibFi3H1UENvGGDdzGss";
+
+    ldflags = [
+      "-s"
+      "-w"
+    ];
+  }); 
+}

overlays/gh-dash.nix

@@ -0,0 +1,36 @@
+final: prev: let
+  golang_latest = prev.go-bin.latestStable;
+  buildGoModuleLatest = prev.buildGoModule.override {
+    go = golang_latest;
+  };
+in {
+ ghDashLatest = (prev.gh-dash.override {
+    buildGoModule = buildGoModuleLatest;
+  }).overrideAttrs (oldAttrs: rec {
+    version = "4.25.2";
+    src = prev.fetchFromGitHub {
+      owner = "dlvhdr";
+      repo = "gh-dash";
+      rev = "v${version}";
+      hash = "sha256-3iUBuMvA2Xh7UjTiFNEs3tuZMCnSt/bIhTSEDD92yCU=";
+    };
+
+    vendorHash = "sha256-Teu+8jiZE2gZ+0ErKsunhotY9W4Hjg6PAeFkFLgESIk=";
+    doCheck = false;
+    checkFlags = [
+      "-skip=TestFullOutput"
+    ];
+
+    ldflags = [
+      "-s"
+      "-w"
+      "-X github.com/dlvhdr/gh-dash/v4/cmd.Version=${version}"
+    ];
+
+    passthru = (oldAttrs.passthru or {}) // {
+      tests = {
+        version = oldAttrs.testers.testVersion { package = final.ghDashLatest; };
+      };
+    };
+  });
+}

overlays/k9s.nix

@@ -0,0 +1,18 @@
+final: prev: {
+  k9sLatest = prev.k9s.overrideAttrs (oldAttrs: rec {
+    version = "0.51.0";
+    src = prev.fetchFromGitHub {
+      owner = "derailed";
+      repo = "k9s";
+      rev = "v${version}";
+      hash = "sha256-70Rfu1BVd/QnwWXRRpwIeZ2UJNWIGixpdiOHo4v7adA=";
+    };
+
+    vendorHash = "sha256-PkYDJK2oGl+siCG9p4R8shC0e5BhGFdJsc+ksL9J5zw=";
+
+    ldflags = [
+      "-X github.com/derailed/k9s/version.Version=${version}"
+      "-X github.com/derailed/k9s/version.BuildSource=nix"
+    ];
+  });
+}

overlays/lazygit.nix

@@ -0,0 +1,18 @@
+final: prev: {
+    lazygitLatest = prev.lazygit.overrideAttrs (_: rec {
+    version = "0.65.0";
+    src = prev.fetchFromGitHub {
+      owner = "jesseduffield";
+      repo = "lazygit";
+      rev = "v${version}";
+      hash = "sha256-W/Z/BnA5L8tXYrKn3bnekNnx7bEaaJRoHSGAeygcK0E=";
+    };
+
+    vendorHash = null;
+    subPackages = [ "." ];
+    ldflags = [
+      "-X main.version=${version}"
+      "-X main.buildSource=nix"
+    ];
+  });
+}

pkgs/common/sable.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  pnpm_10,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  nodejs_24,
-  fetchFromGitHub,
-}:
-buildNpmPackage (finalAttrs:
-let
-  pnpm = pnpm_10.override {
-    nodejs = nodejs_24;
-  };
-in {
-  pname = "sable-unwrapped";
-  version = "1.14.0";
-
-  src = fetchFromGitHub {
-    owner = "SableClient";
-    repo = "Sable";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-zoGKs0pm9m42JrTNAdU33LP139JlVz3RZnkTyY0aiqY=";
-  };
-
-  nodejs = nodejs_24;
-
-  nativeBuildInputs = [ pnpm ];
-  npmConfigHook = pnpmConfigHook;
-
-  npmDeps = finalAttrs.pnpmDeps;
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-2GwUz0jsuVKQZyeidM0F4rDzijm9AFcAxN7x/m/b3Is=";
-  };
-
-  npmInstallFlags = [
-    "--ignore-scripts"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r dist $out
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "An almost stable Matrix client";
-    homepage = "https://app.sable.moe/";
-    maintainers = with lib.maintainers; [
-      wymillerlinux
-    ];
-    license = lib.licenses.agpl3Only;
-    platforms = lib.platforms.all;
-  };
-})

pkgs/common/sable/0001-races-patch.patch

@@ -0,0 +1,31 @@
+diff --git a/src/app/pages/client/ClientRoot.tsx b/src/app/pages/client/ClientRoot.tsx
+index acdeab967..d64f32c53 100644
+--- a/src/app/pages/client/ClientRoot.tsx
++++ b/src/app/pages/client/ClientRoot.tsx
+@@ -86,8 +86,6 @@ function ClientRootLoading() {
+   const activeSessionId = useAtomValue(activeSessionIdAtom);
+   const setSessions = useSetAtom(sessionsAtom);
+ 
+-  const [showEasterEggs] = useSetting(settingsAtom, 'showEasterEggs');
+-  const [animalKind] = useSetting(settingsAtom, 'animalKind');
+ 
+   const activeSession: Session | undefined =
+     sessions.find((session) => session.userId === activeSessionId) ?? sessions[0];
+@@ -108,14 +106,15 @@ function ClientRootLoading() {
+     window.location.reload();
+   };
+ 
+-  const loadingAnimal = showEasterEggs && animalKind ? animalKind : 'cats';
++  const races = ["Petting Miqo’te", "Hugging Roegadyn", "Punting Lalafell", "Climbing Elezen", "Booping Viera"];
++  const result = races[Math.floor(Math.random() * races.length)];
+ 
+   return (
+     <SplashScreen>
+       <Box direction="Column" grow="Yes" alignItems="Center" justifyContent="Center" gap="400">
+         <Spinner variant="Secondary" size="600" />
+ 
+-        <Text>{`Petting ${loadingAnimal}`}</Text>
++        <Text>{`${result}`}</Text>
+ 
+         {activeSession && (
+           <Text

pkgs/common/sable/sable.nix

@@ -0,0 +1,93 @@
+{
+  lib,
+  buildNpmPackage,
+  pnpm_10_latest,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  nodejs_24,
+  fetchFromGitHub,
+}:
+buildNpmPackage (
+  finalAttrs:
+  let
+    pnpm = pnpm_10_latest.override {
+      nodejs-slim = nodejs_24;
+    };
+    matrixrtcSrc = fetchFromGitHub {
+      owner = "SableClient";
+      repo = "matrix-rtc";
+      rev = "519fe6b863cfac78700f4e2b1748649103bb8a8d";
+      hash = "sha256-n5f7529RdRxY8/a43Xkgrhg4yRz5aNgfoZqWrB7kvak=";
+    };
+    livekitMobileSrc = fetchFromGitHub {
+      owner = "SableClient";
+      repo = "tauri-plugin-livekit-mobile";
+      rev = "c6f0d02ab3da1174535bc1dc8e598a2e6873f977";
+      hash = "sha256-ZPx6Ic+Gkvzg9LXYP9BaQALzOrvLCcQHOms8U3VfnU0=";
+    };
+  in
+  {
+    pname = "sable-unwrapped";
+    version = "1.22.11";
+
+    src = fetchFromGitHub {
+      owner = "SableClient";
+      repo = "Sable";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-RwYKaJ4k2lqXjVSPN/o0Qw8GIGnXfb6acCpva36qQoM=";
+    };
+
+    nodejs = nodejs_24;
+
+    nativeBuildInputs = [ pnpm ];
+    npmConfigHook = pnpmConfigHook;
+
+    npmDeps = finalAttrs.pnpmDeps;
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      inherit pnpm;
+      fetcherVersion = 3;
+      hash = "sha256-sI0tE73l+yKS8186tUHrNAJmGD26XEe7828ohvvc+1o=";
+    };
+
+    npmInstallFlags = [
+      "--ignore-scripts"
+    ];
+
+    preBuild = ''
+      cp -r --no-preserve=mode ${matrixrtcSrc}/. node_modules/@sableclient/matrixrtc/
+      pnpm exec tsc \
+        -p node_modules/@sableclient/matrixrtc/tsconfig.build.json \
+        --rootDir node_modules/@sableclient/matrixrtc/src
+      cp -r --no-preserve=mode ${livekitMobileSrc}/. node_modules/@sableclient/tauri-plugin-livekit-mobile/
+      pnpm exec tsc \
+        -p node_modules/@sableclient/tauri-plugin-livekit-mobile/tsconfig.json \
+        --noEmit false \
+        --declaration \
+        --rootDir node_modules/@sableclient/tauri-plugin-livekit-mobile/guest-js \
+        --outDir node_modules/@sableclient/tauri-plugin-livekit-mobile/dist-js
+    '';
+
+    patches = [
+      ./0001-races-patch.patch
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r dist $out
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "An almost stable Matrix client";
+      homepage = "https://app.sable.moe/";
+      maintainers = with lib.maintainers; [
+        (wymillerlinux or) "wymillerlinux"
+      ];
+      license = lib.licenses.agpl3Only;
+      platforms = lib.platforms.all;
+    };
+  }
+)

pkgs/common/stalwart/spam-filter.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+  stalwart_0_16,
+  nix-update-script,
+  python3,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "spam-filter";
+  version = "3.0.2";
+
+  src = fetchFromGitHub {
+    owner = "stalwartlabs";
+    repo = "spam-filter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dMHfVzSTP/J+ohBIOIXZ3eKPVK+gnLZ0ifq5/u2EBFE=";
+  };
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ python3 ];
+
+  buildPhase = ''
+    runHook preBuild
+    python3 generate_rules_json.py
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp spam-filter-rules.json.gz $out
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Spam filter module for the Stalwart server";
+    homepage = "https://github.com/stalwartlabs/spam-filter";
+    changelog = "https://github.com/stalwartlabs/spam-filter/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license =
+      with lib.licenses;
+      OR [
+        mit
+        asl20
+      ];
+    inherit (stalwart_0_16.meta) maintainers;
+  };
+})

pkgs/common/stalwart/stalwart.nix

@@ -0,0 +1,315 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  protobuf,
+  bzip2,
+  openssl,
+  sqlite,
+  foundationdb,
+  zstd,
+  stdenv,
+  _experimental-update-script-combinators,
+  nix-update-script,
+  rocksdb,
+  callPackage,
+  python3Packages,
+  cacert,
+  libredirect,
+  writeTextFile,
+  withFoundationdb ? false,
+  stalwartEnterprise ? false,
+}:
+let
+  migrate_v016 =
+    {
+      src,
+      version,
+    }:
+    python3Packages.buildPythonApplication {
+      pname = "migrate_v016";
+      inherit src version;
+      __structuredAttrs = true;
+      format = "other";
+      dontBuild = true;
+      dependencies = [
+        python3Packages.urllib3
+        python3Packages.requests
+      ];
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out/bin
+        cp $src/resources/scripts/migrate_v016.py $out/bin/migrate_v016
+        chmod +x $out/bin/migrate_v016
+        runHook postInstall
+      '';
+      postFixUp = ''
+        wrapPythonPrograms
+      '';
+    };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stalwart" + (lib.optionalString stalwartEnterprise "-enterprise");
+  version = "0.16.26";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stalwartlabs";
+    repo = "stalwart";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CJ8XOWojIOD0/xBMDnZq0oS68vd77AEXkbT1nZx7bzY=";
+  };
+
+  cargoHash = "sha256-fE4+Dq6SGDA6FVDPO1Zf/Ow2VUALRQlPxGk+iETxqts=";
+
+  env = {
+    # https://docs.rs/openssl/latest/openssl/#manual
+    OPENSSL_NO_VENDOR = true;
+    OPENSSL_DIR = lib.getDev openssl;
+    OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+    ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
+    ROCKSDB_LIB_DIR = "${rocksdb}/lib";
+  }
+  //
+    lib.optionalAttrs
+      (stdenv.hostPlatform.isLinux && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isArmv7))
+      {
+        # Required to fix Stalwart on ARM systems with 16 KB page size.
+        # Using rust-jemalloc-sys causes segmentation faults on x86_64.
+        JEMALLOC_SYS_WITH_LG_PAGE = 16;
+      };
+
+  depsBuildBuild = [
+    pkg-config
+    zstd
+  ];
+
+  nativeBuildInputs = [
+    protobuf
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    bzip2
+    openssl
+    sqlite
+    zstd
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && withFoundationdb) [ foundationdb ];
+
+  # Issue: https://github.com/stalwartlabs/stalwart/issues/1104
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "sqlite"
+    "postgres"
+    "mysql"
+    "rocks"
+    "s3"
+    "redis"
+    "azure"
+    "nats"
+  ]
+  ++ lib.optionals withFoundationdb [ "foundationdb" ]
+  ++ lib.optionals stalwartEnterprise [ "enterprise" ];
+
+  cargoBuildFlags = [
+    "-p"
+    "stalwart"
+  ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
+  doCheck = true;
+  nativeCheckInputs = [
+    openssl
+    # ... panicked at crates/utils/src/lib.rs:94:17: Failed to build TLS connectors: Failed to build platform verifier: unexpected error: No CA certificates were loaded from the system
+    cacert
+  ];
+
+  # Allow network access during tests on Darwin/macOS
+  __darwinAllowLocalNetworking = true;
+  # Allow access to DNS settings exposed via config daemon
+  # thread ... panicked at tests/src/lib.rs:49:13: Errors: [ Build { ... , message: "Failed to read system DNS config: failed to access System Configuration dynamic store", }, ]
+  #  -> https://github.com/hickory-dns/hickory-dns/blob/f09321075b1f97902b7bc4ca4ffda7816fcf2971/crates/resolver/src/system_conf/apple.rs#L21
+  #    ->  https://crates.io/crates/system-configuration
+  #      -> https://developer.apple.com/documentation/systemconfiguration/scdynamicstore?language=objc
+  #        -> "The handle to an open dynamic store session with the system configuration daemon." (configd)
+  sandboxProfile = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    (allow mach-lookup (global-name "com.apple.SystemConfiguration.configd"))
+  '';
+
+  preCheck =
+    let
+      nsswitch = writeTextFile {
+        name = "nsswitch.conf";
+        text = ''
+          hosts: files dns
+        '';
+      };
+      hosts = writeTextFile {
+        name = "hosts";
+        text = ''
+          127.0.0.1 localhost
+        '';
+      };
+      # ... panicked at tests/src/lib.rs:49:13: Errors: [ Build { ... , message: "Failed to read system DNS config: io error: No such file or directory (os error 2)" }, ... ]
+      #   -> https://github.com/hickory-dns/hickory-dns/blob/v0.26.1/crates/resolver/src/system_conf/unix.rs#L25
+      #   -> known issue: https://github.com/hickory-dns/hickory-dns/issues/2959
+      resolvConf = writeTextFile {
+        name = "resolv.conf";
+        text = ''
+          nameserver 127.0.0.1
+        '';
+      };
+    in
+    (lib.optionalString stdenv.hostPlatform.isLinux ''
+      export NIX_REDIRECTS="/etc/nsswitch.conf=${nsswitch}:/etc/hosts=${hosts}:/etc/resolv.conf=${resolvConf}"
+      export LD_PRELOAD="${libredirect}/lib/libredirect.so"
+    '')
+    + ''
+      export STORE=RocksDb
+    '';
+
+  checkFlags = lib.forEach (
+    [
+      # Require running mysql, postgresql daemon
+      "directory::imap::imap_directory"
+      "directory::internal::internal_directory"
+      "directory::ldap::ldap_directory"
+      "directory::sql::sql_directory"
+      "directory::oidc::oidc_directory"
+      "store::blob::blob_tests"
+      "store::lookup::lookup_tests"
+      "smtp::lookup::sql::lookup_sql"
+      # Require running ldap directory
+      "directory::directory_tests"
+      # Require running nats or redis instance
+      "cluster::broadcast::cluster_tests"
+      # flaky tests: ... panicked at tests/src/utils/jmap.rs:434:32: Missing created item 0: { "methodResponses": [ [ "x:Domain/set", { "accountId": "d333333", "notCreated": { "i0": { "type": "primaryKeyViolation", "properties": [ "name" ], "objectId": { "object": "Domain", "id": "c" } } } }, "0" ] ], "sessionState": "a22d1fca" }
+      "cluster::stress::stress_tests"
+      "imap::imap_tests"
+      "system::system_tests"
+      "telemetry::telemetry_tests"
+      # flaky test: ... panicked at tests/src/utils/jmap.rs:434:32: Missing created item 0: { "methodResponses": [ [ "error", { "type": "serverUnavailable", description": "This server is temporarily unavailable. Attempting this same operation later may succeed." }, "0" ] ], "sessionState": "a22d1fca" }
+      "jmap::jmap_tests"
+      "automation::automation_tests"
+      # thread 'webdav::webdav_tests' (4676902) panicked at tests/src/utils/webdav.rs:591:13: Expected 201 Created but got 409 Conflict
+      "webdav::webdav_tests"
+      # panicked at tests/src/smtp/inbound/mod.rs:270:18: Unexpected event: WorkerDone { queue_id: 312710620013133824, queue_name: QueueName([100, 101, 102, 97, 117, 108, 116, 0]), status: Completed }
+      "smtp::outbound::smtp::smtp_delivery"
+      # flaky test: ... panicked at tests/src/smtp/outbound/lmtp.rs:245:5: assertion `left == right` failed
+      #   left: 3
+      #   right: 4
+      "smtp::outbound::lmtp::lmtp_delivery"
+      # flaky test: ... panicked at tests/src/smtp/reporting/analyze.rs:110:5: assertion `left == right` failed
+      #   left: 0
+      #   right: 5
+      "smtp::reporting::analyze::report_analyze"
+      # flaky test: ... panicked at tests/src/smtp/queue/manager.rs:200:32: Expected rcpt b not found in [Recipient { address: "c", retry: Schedule { due: 1781399468, inner: 0 }, notify: Schedule { due: 1781399473, inner: 0 }, expires: Ttl(9), queue: QueueName([100, 101, 102, 97, 117, 108, 116, 0]), status: Scheduled, flags: 0, orcpt: None }]
+      "smtp::queue::manager::queue_due"
+      # flaky test: ... panicked at tests/src/smtp/queue/retry.rs:237:5: assertion `left == right` failed
+      #   left: [1, 2, 2]
+      #  right: [1, 2, 3]
+      "smtp::queue::retry::queue_retry"
+      # error[E0432]: unresolved import `r2d2_sqlite`
+      "backend::sqlite::pool::SqliteConnectionManager::with_init"
+      # thread 'smtp::management::queue::manage_queue' panicked at tests/src/smtp/inbound/mod.rs:45:23: No queue event received.
+      # NOTE: Test unreliable on high load systems
+      "smtp::management::queue::manage_queue"
+      # NOTE: long running test(s), needs live dependencies, likely to fail on systems under high load
+      "smtp::inbound::antispam::antispam"
+      # flaky test (darwin): ... panicked at tests/src/smtp/inbound/mod.rs:287:18:
+      # Unexpected event: Refresh
+      # (linux): Invalid address: failed to lookup address information: Temporary failure in name resolution
+      "smtp::outbound::dane::dane_verify"
+    ]
+    # ... panicked at tests/src/lib.rs:49:13: Errors: [ Build { ... , message: "Invalid address: failed to lookup address information: Temporary failure in name resolution", }, ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      "smtp::inbound::auth::auth"
+      "smtp::inbound::basic::basic_commands"
+      "smtp::inbound::data::data"
+      "smtp::inbound::dmarc::dmarc"
+      "smtp::inbound::ehlo::ehlo"
+      "smtp::inbound::limits::limits"
+      "smtp::inbound::mail::mail"
+      "smtp::inbound::milter::milter_session"
+      "smtp::inbound::milter::mta_hook_session"
+      "smtp::inbound::rcpt::rcpt"
+      "smtp::inbound::rewrite::address_rewrite"
+      "smtp::inbound::scripts::sieve_scripts"
+      "smtp::inbound::sign::sign_and_seal"
+      "smtp::inbound::throttle::throttle_inbound"
+      "smtp::inbound::vrfy::vrfy_expn"
+      "smtp::lookup::expressions::expressions"
+      "smtp::lookup::utils::strategies"
+      "smtp::management::report::manage_reports"
+      "smtp::outbound::dane::dane_test"
+      "smtp::outbound::extensions::extensions"
+      "smtp::outbound::fallback_relay::fallback_relay"
+      "smtp::outbound::ip_lookup::ip_lookup_strategy"
+      "smtp::outbound::mta_sts::mta_sts_verify"
+      "smtp::outbound::throttle::throttle_outbound"
+      "smtp::outbound::tls::starttls_optional"
+      "smtp::queue::concurrent::concurrent_queue"
+      "smtp::queue::dsn::generate_dsn"
+      "smtp::queue::virtualq::virtual_queue"
+      "smtp::reporting::dmarc::report_dmarc"
+      "smtp::reporting::scheduler::report_scheduler"
+      "smtp::reporting::tls::report_tls"
+      "store::search_tests"
+      "store::store_tests"
+      # since 0.16.10
+      "smtp::outbound::dane::dane_downgrade_on_tlsa_servfail"
+    ]
+  ) (test: "--skip=${test}");
+
+  postInstall = ''
+    mkdir -p $out/etc/stalwart
+
+    mkdir -p $out/lib/systemd/system
+
+    substitute resources/systemd/stalwart-mail.service $out/lib/systemd/system/stalwart.service \
+      --replace-fail "__PATH__" "$out"
+
+    ln -s ${migrate_v016 { inherit (finalAttrs) src version; }}/bin/migrate_v016 $out/bin/migrate_v016
+  '';
+
+  passthru = {
+    inherit rocksdb; # make used rocksdb version available (e.g., for backup scripts)
+    webui = callPackage ./webui.nix { };
+    spam-filter = callPackage ./spam-filter.nix { };
+    # subpackages have distinct version numbers, so we can't use nix-update's `--subpackage`
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { })
+      (nix-update-script { attrPath = "stalwart_0_16.webui"; })
+      (nix-update-script { attrPath = "stalwart_0_16.spam-filter"; })
+    ];
+  };
+
+  meta = {
+    description = "Secure, modern, all-in-one mail and collaboration server";
+    longDescription = ''
+      Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV).
+    '';
+    homepage = "https://github.com/stalwartlabs/stalwart";
+    changelog = "https://github.com/stalwartlabs/stalwart/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = [
+      lib.licenses.agpl3Only
+    ]
+    ++ lib.optionals stalwartEnterprise [
+      lib.licenses.stalwart
+    ];
+    maxSilent = 14400; # 4 hours
+    mainProgram = "stalwart";
+    maintainers = with lib.maintainers; [
+      happysalada
+      onny
+      oddlama
+      pandapip1
+      norpol
+      debtquity
+    ];
+  };
+})

pkgs/common/stalwart/webui.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  buildNpmPackage,
+  zip,
+  stalwart_0_16,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildNpmPackage (finalAttrs: {
+  pname = "webui";
+  version = "1.0.11";
+
+  src = fetchFromGitHub {
+    owner = "stalwartlabs";
+    repo = "webui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-luaNHpPg7XHnPfQqhLEq+wW1/crXLogzyyltFr4mdBk=";
+  };
+
+  npmDepsHash = "sha256-qe9cSrvs6kWwgbOO0xL7MBaJvICOvyuLFVi9R0dgnXQ=";
+  __structuredAttrs = true;
+
+  env = {
+    # https://github.com/stalwartlabs/webui/tree/main#environment-variables
+    # https://github.com/stalwartlabs/webui/blob/main/.env.development
+    VITE_API_BASE_URL = "";
+    VITE_OAUTH_CLIENT_ID = "stalwart-webui";
+  };
+
+  nativeBuildInputs = [ zip ];
+  preBuild = ''
+    rm .env.development
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    npm run test
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cd dist
+    zip -r $out/webui.zip *
+    cd ..
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Stalwart WebUI";
+    longDescription = ''
+      Stalwart WebUI is schema-driven single-page application for administering Stalwart.
+
+      After authentication the panel fetches a JSON schema from the server and dynamically
+      generates all forms, lists, navigation, and layouts from that schema. Nothing is hardcoded.
+    '';
+    homepage = "https://github.com/stalwartlabs/webui";
+    changelog = "https://github.com/stalwartlabs/webui/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.OR [
+      lib.licenses.agpl3Only
+      {
+        fullName = "Stalwart Enterprise License 2.0 (SELv2) Agreement";
+        url = "https://github.com/stalwartlabs/webui/blob/main/LICENSES/LicenseRef-SEL.txt";
+        free = false;
+        redistributable = false;
+      }
+    ];
+    inherit (stalwart_0_16.meta) maintainers;
+  };
+})

pkgs/default.nix

@@ -8,13 +8,17 @@
   atuinLatest = pkgs.atuinLatest;
   containerLatest = pkgs.containerLatest;
   cliampLatest = pkgs.cliampLatest;
+  lazygitLatest = pkgs.lazygitLatest;
+  ghDashLatest = pkgs.ghDashLatest;
+  diffNavLatest = pkgs.diffNavLatest;
+  k9sLatest = pkgs.k9sLatest;
 
   # any packages that are added to pkgs and are inputs, we inherit them here
   inherit hildibrand;
   inherit caitsith;
 
   # any packages that build instructions are in this repo, they go here
-  # sable-web = pkgs.callPackage ./common/sable.nix {};
+  sable-web = pkgs.callPackage ./common/sable/sable.nix { };
   swaytreesave = pkgs.callPackage ./linux/swaytreesave.nix { };
   musicpresence = pkgs.callPackage ./linux/musicpresence.nix { };
   vintage-story = pkgs.callPackage ./linux/vintage-story.nix { };
@@ -22,4 +26,5 @@
   yubilock = pkgs.callPackage ./linux/yubilock/default.nix { };
   ani-cli-rs = pkgs.callPackage ./linux/ani-cli-rs.nix { };
   opengoal = pkgs.callPackage ./linux/opengoal.nix { };
+  stalwart = pkgs.callPackage ./common/stalwart/stalwart.nix { };
 }

pkgs/linux/archon.nix

@@ -1,11 +1,11 @@
 { pkgs }:
 let
   pname = "archon";
-  version = "9.5.8";
+  version = "9.6.94";
 
   src = pkgs.fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-archon/releases/download/v${version}/${pname}-v${version}.AppImage";
-    hash = "sha256-tEMfDK0BCBvNWFlA78FKWcOvU1wzIorBM4ZmLQ+6hzU=";
+    hash = "sha256-l38nmbxLDdi/yMtoamG+hPqT22y32CfvdGtFitqIiZk=";
   };
 
   appimageContents = pkgs.appimageTools.extract {

pkgs/linux/vintage-story.nix

@@ -27,11 +27,11 @@ assert waylandSupport -> libxkbcommon != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vintagestory";
-  version = "1.22.6";
+  version = "1.22.7";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${finalAttrs.version}.tar.gz";
-    hash = "sha256-xJPyaYklEq2BeUX9+7hNPI6WC6ibcQDS+sKeqKYSh3A=";
+    hash = "sha256-SDzGgnpQwIxcQczQJixvEiPBBOVMpxNcRmBSeNifXeE=";
   };
 
   __structuredAttrs = true;