2 files changed, 120 insertions, 39 deletions

diff --git a/modules/by-name/ni/nix/module.nix b/modules/by-name/ni/nix/module.nix
index 767ab076..5fd10541 100644
--- a/modules/by-name/ni/nix/module.nix
+++ b/modules/by-name/ni/nix/module.nix
@@ -1,61 +1,116 @@
+# nixos-config - My current NixOS configuration
+#
+# Copyright (C) 2025 Benedikt Peetz <benedikt.peetz@b-peetz.de>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# This file is part of my nixos-config.
+#
+# You should have received a copy of the License along with this program.
+# If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
 {
   pkgs,
+  extra_lib,
+  config,
+  lib,
   # flakes
-  nixpkgs_as_input,
-  templates,
+  sources,
   self,
   system,
   ...
-}: {
-  nix = {
-    package = pkgs.lix;
+}: let
+  inherit (sources) nixpkgs-unstable;
 
-    # Disable nix channels  (this is a remnant of old days)
-    channel.enable = false;
+  lix =
+    pkgs.lixPackageSets.latest.lix;
 
-    registry = {
-      nixpkgs.flake = nixpkgs_as_input;
-      n.flake =
-        nixpkgs_as_input
-        // {
-          # Otherwise nixpkgs's config and overlays are not available:
+  nixWrapperBase = pkgs.writeShellApplication {
+    name = "nix";
 
-          # Both attrs exists, so we just override both and hope
-          outputs.legacyPackages."${system}" = pkgs;
-          legacyPackages."${system}" = pkgs;
-        };
+    text = builtins.readFile ./nix_wrapper.sh;
+    runtimeInputs = [
+      pkgs.lixPackageSets.latest.lix
+      pkgs.btrfs-progs
+      pkgs.coreutils
+      pkgs.gnused
+      pkgs.gnugrep
+      pkgs.bc
+    ];
 
-      t.flake = templates;
+    # the wrapped nix command might call random other stuff.
+    inheritPath = true;
 
-      my_flake.flake = self;
-      m.flake = self;
+    derivationArgs = {
+      inherit (lix) meta pname version;
     };
+  };
 
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
+  nixWrapper = pkgs.symlinkJoin {
+    inherit (lix) name;
+    paths = [
+      nixWrapperBase
+      pkgs.lixPackageSets.latest.lix
+    ];
+    inherit (lix) meta pname version;
+  };
+
+  cfg = config.soispha.nix;
+in {
+  options.soispha.nix = {
+    enable = extra_lib.options.mkDefaultEnabled "nix";
+  };
+
+  config = lib.mkIf cfg.enable {
+    nix = {
+      package = nixWrapper;
+
+      # Disable nix channels  (this is a remnant of old days)
+      channel.enable = false;
+
+      registry = {
+        nixpkgs.flake = nixpkgs-unstable;
+        n.flake =
+          nixpkgs-unstable
+          // {
+            # Otherwise nixpkgs's config and overlays are not available:
+
+            # Both attrs exists, so we just override both and hope
+            outputs.legacyPackages."${system}" = pkgs;
+            legacyPackages."${system}" = pkgs;
+          };
+
+        t.flake = sources.templates;
+
+        my_flake.flake = self;
+        m.flake = self;
+      };
+
+      gc = {
+        automatic = true;
+        dates = "weekly";
+        options = "--delete-older-than 7d";
+      };
+
+      settings = {
+        # Don't warn about dirty git trees (It is usually absolutely useless)
+        warn-dirty = false;
 
-    settings = {
-      auto-optimise-store = true;
-      experimental-features = [
-        "nix-command"
-        "flakes"
-        #"ca-derivations"
-      ];
+        # not good for performance.
+        auto-optimise-store = false;
 
-      use-xdg-base-directories = true;
+        experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
 
-      #substituters = ["https://cache.ngi0.nixos.org/"];
-      #trusted-public-keys = ["cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="];
+        use-xdg-base-directories = true;
 
-      fallback = true; # Build from source, if binary can't be substituted
+        fallback = true; # Build from source, if binary can't be substituted
 
-      keep-failed = true; # keep failed tmp build dirs
-      pure-eval = true; # restrict file system and network access to hash
+        keep-failed = false; # keep failed tmp build dirs
+        pure-eval = true; # restrict file system and network access to hash
 
-      sandbox-fallback = false; # Don't disable the sandbox, if the kernel doesn't support it
+        sandbox-fallback = false; # Don't disable the sandbox, if the kernel doesn't support it
+      };
     };
   };
 }
diff --git a/modules/by-name/ni/nix/nix_wrapper.sh b/modules/by-name/ni/nix/nix_wrapper.sh
new file mode 100755
index 00000000..077988d2
--- /dev/null
+++ b/modules/by-name/ni/nix/nix_wrapper.sh
@@ -0,0 +1,26 @@
+#! /usr/bin/env sh
+
+set -eu
+_NIX_WRAPPER_FALLBACK="${_NIX_WRAPPER_FALLBACK-false}"
+
+me="$(basename "$0")"
+
+if [ "$_NIX_WRAPPER_FALLBACK" = "true" ]; then
+    # Allow skipping the size check.
+    "$me" "$@"
+else
+    usage="$(btrfs filesystem usage /nix/store --raw 2>/dev/null)"
+    avail="$(echo "$usage" | grep 'Device size:' | cut -f 3 | sed 's/ //g')"
+    used="$(echo "$usage" | grep 'Used:' | cut -f 4 | head -n 1 | sed 's/ //g')"
+    perc="$(printf "scale=4\n%d / %d\n" "$used" "$avail" | bc)"
+    perc="$(printf "scale=2\n%s * 100\n" "0$perc" | bc)"
+
+    if test "$(printf "%s >= 20\n" "$perc" | bc)" = "1"; then
+        "$me" "$@"
+    else
+        echo "Not enough space free, in nix store: Only, $perc% is still free."
+        exit 3
+    fi
+fi
+
+# vim: ft=sh