From b29223b723b4794280404f44752da12c017bfa8d Mon Sep 17 00:00:00 2001 From: Romain Delhommais Date: Mon, 18 May 2026 22:44:36 +0200 Subject: [PATCH 01/10] maintainers: add luuumine --- maintainers/maintainer-list.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 70c41ee05e2b..75b924e79319 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -16408,6 +16408,12 @@ githubId = 115777584; name = "Lutz Berger"; }; + luuumine = { + email = "nix@luuumine.com"; + github = "luuumine"; + githubId = 55056797; + name = "Romain Delhommais"; + }; lux = { email = "lux@lux.name"; github = "luxzeitlos"; From dc4c196c3512a893d3324ed827248b567094823f Mon Sep 17 00:00:00 2001 From: Romain Delhommais Date: Mon, 18 May 2026 23:00:47 +0200 Subject: [PATCH 02/10] wealthfolio-server: init at 3.5.2 --- .../by-name/we/wealthfolio-server/package.nix | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 pkgs/by-name/we/wealthfolio-server/package.nix diff --git a/pkgs/by-name/we/wealthfolio-server/package.nix b/pkgs/by-name/we/wealthfolio-server/package.nix new file mode 100644 index 000000000000..e274bed4af0a --- /dev/null +++ b/pkgs/by-name/we/wealthfolio-server/package.nix @@ -0,0 +1,91 @@ +{ + lib, + fetchFromGitHub, + rustPlatform, + fetchPnpmDeps, + stdenv, + pnpm_10, + pnpmConfigHook, + nodejs, + makeWrapper, +}: + +rustPlatform.buildRustPackage ( + finalAttrs: + let + frontendPname = "wealthfolio-frontend"; + + frontend = stdenv.mkDerivation { + pname = frontendPname; + inherit (finalAttrs) version src; + + __structuredAttrs = true; + strictDeps = true; + + pnpmDeps = fetchPnpmDeps { + pname = frontendPname; + inherit (finalAttrs) version src; + + pnpm = pnpm_10; + fetcherVersion = 3; + hash = "sha256-Pt8eDb7tCTM1YD/7I8Ot9+fNzsvpcPfhWsniRD5OjcU="; + }; + + nativeBuildInputs = [ + nodejs + pnpm_10 + pnpmConfigHook + ]; + + buildPhase = '' + export BUILD_TARGET=web + pnpm --filter frontend... build + ''; + + installPhase = '' + mkdir -p $out + cp -R dist/* $out/ + ''; + + inherit (finalAttrs) meta; + }; + in + { + __structuredAttrs = true; + + pname = "wealthfolio-server"; + version = "3.5.2"; + + src = fetchFromGitHub { + owner = "wealthfolio"; + repo = "wealthfolio"; + tag = "v${finalAttrs.version}"; + hash = "sha256-WU87VmnbzUno1CmIVwBLYjmTZybM4qSuRmBH/2n/Tfo="; + }; + + cargoRoot = "."; + buildAndTestSubdir = "apps/server"; + cargoHash = "sha256-KoS2EouZ0Uf3cijUUOpwYBYEjEB5VxIArU1CuCji2+I="; + + nativeBuildInputs = [ makeWrapper ]; + + postInstall = '' + mkdir -p $out/share/wealthfolio/dist + + cp -R ${frontend}/* $out/share/wealthfolio/dist/ + + wrapProgram $out/bin/wealthfolio-server \ + --set WF_STATIC_DIR "$out/share/wealthfolio/dist" + ''; + + meta = { + description = "Self-hosted web app for Wealthfolio"; + homepage = "https://wealthfolio.app/"; + changelog = "https://github.com/wealthfolio/wealthfolio/tag/${finalAttrs.src.tag}"; + mainProgram = "wealthfolio-server"; + license = lib.licenses.agpl3Only; + maintainers = with lib.maintainers; [ luuumine ]; + platforms = lib.platforms.linux; + }; + } +) From cdb61286b353faa449d283e4f0682d91c27d852d Mon Sep 17 00:00:00 2001 From: Romain Delhommais Date: Thu, 25 Jun 2026 19:41:56 +0200 Subject: [PATCH 03/10] nixos/wealthfolio: init --- nixos/modules/module-list.nix | 1 + .../modules/services/web-apps/wealthfolio.nix | 184 ++++++++++++++++++ 2 files changed, 185 insertions(+) create mode 100644 nixos/modules/services/web-apps/wealthfolio.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index a96e30cac837..6bd909f8e5d5 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1805,6 +1805,7 @@ ./services/web-apps/umami.nix ./services/web-apps/vikunja.nix ./services/web-apps/wakapi.nix + ./services/web-apps/wealthfolio.nix ./services/web-apps/weblate.nix ./services/web-apps/websurfx.nix ./services/web-apps/whitebophir.nix diff --git a/nixos/modules/services/web-apps/wealthfolio.nix b/nixos/modules/services/web-apps/wealthfolio.nix new file mode 100644 index 000000000000..61d488595a90 --- /dev/null +++ b/nixos/modules/services/web-apps/wealthfolio.nix @@ -0,0 +1,184 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.services.wealthfolio; +in +{ + options.services.wealthfolio = { + enable = lib.mkEnableOption "Wealthfolio personal investment tracker"; + package = lib.mkPackageOption pkgs "wealthfolio-server" { }; + + address = lib.mkOption { + type = lib.types.str; + default = "127.0.0.1"; + description = "The IP address the Wealthfolio server binds to."; + }; + + port = lib.mkOption { + type = lib.types.port; + default = 8088; + description = "The port the Wealthfolio server listens on."; + }; + + openFirewall = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Whether to automatically open the specified port in the system firewall."; + }; + + secretKeyFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + example = lib.literalExpression "config.age.secrets.wealthfolio-key.path"; + description = '' + Path to a file containing the 32-byte secret key used for encrypting sensitive data + at rest (broker credentials, API keys) and signing JWT tokens. + + Generate with: `openssl rand -base64 32`. + + Note: Losing this key means losing access to all stored encrypted secrets. + There is no recovery. + ''; + }; + + authPasswordHashFile = lib.mkOption { + type = lib.types.nullOr lib.types.path; + default = null; + example = lib.literalExpression "config.age.secrets.wealthfolio-hash.path"; + description = '' + Path to a file containing the Argon2id PHC string defining the login password. + Required for web access unless `authRequired` is false. + + Generate with: `printf 'your-password' | argon2 yoursalt16chars! -id -e` + ''; + }; + + authRequired = lib.mkOption { + type = lib.types.bool; + default = true; + description = '' + Whether to require internal authentication. + + Security Note: The server panics at startup if the listener is bound to a + non-loopback address and authentication is disabled. Set this to `false` + only if a reverse proxy handles authentication for you. + ''; + }; + + corsAllowOrigins = lib.mkOption { + type = lib.types.str; + default = "*"; + example = "https://wealthfolio.example.com"; + description = '' + Comma-separated list of allowed CORS origins. + + Security Note: The server panics at startup if `*` is used while authentication + is enabled, as this is a CSRF vector. Set explicit origins matching your + deployment URL (scheme + host + port). + ''; + }; + + authTokenTtlMinutes = lib.mkOption { + type = lib.types.ints.positive; + default = 60; + description = "JWT access token lifetime in minutes. (e.g., 1440 for 24h, 10080 for 7d)."; + }; + + cookieSecure = lib.mkOption { + type = lib.types.enum [ + "auto" + "true" + "false" + ]; + default = "auto"; + description = '' + Controls the Secure attribute on the authentication session cookie. + - auto: Sets Secure based on HTTPS protocol. + - true: Always sets Secure (Use behind a reverse proxy that terminates HTTPS). + - false: Never sets Secure (Not recommended). + ''; + }; + + requestTimeoutMs = lib.mkOption { + type = lib.types.ints.positive; + default = 300000; + description = "HTTP request timeout in milliseconds. Default (5m) accommodates large broker syncs."; + }; + + logFormat = lib.mkOption { + type = lib.types.enum [ + "text" + "json" + ]; + default = "text"; + description = "Log output format. `json` is recommended if shipping to log aggregators."; + }; + }; + + config = lib.mkIf cfg.enable { + networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port; + + assertions = [ + { + assertion = cfg.secretKeyFile != null; + message = "services.wealthfolio: secretKeyFile must be provided."; + } + { + assertion = cfg.authRequired -> cfg.authPasswordHashFile != null; + message = "services.wealthfolio: authPasswordHashFile must be provided when authRequired is true."; + } + { + assertion = cfg.authRequired -> cfg.corsAllowOrigins != "*"; + message = "services.wealthfolio: corsAllowOrigins cannot be '*' when authRequired is true. Provide an explicit domain."; + } + ]; + + systemd.services.wealthfolio = { + description = "Wealthfolio server service daemon."; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + environment = { + WF_LISTEN_ADDR = "${cfg.address}:${toString cfg.port}"; + WF_DB_PATH = "/var/lib/wealthfolio/wealthfolio.db"; + WF_AUTH_REQUIRED = lib.boolToString cfg.authRequired; + WF_CORS_ALLOW_ORIGINS = cfg.corsAllowOrigins; + WF_AUTH_TOKEN_TTL_MINUTES = toString cfg.authTokenTtlMinutes; + WF_COOKIE_SECURE = cfg.cookieSecure; + WF_REQUEST_TIMEOUT_MS = toString cfg.requestTimeoutMs; + WF_LOG_FORMAT = cfg.logFormat; + }; + + script = '' + ${lib.optionalString ( + cfg.secretKeyFile != null + ) "export WF_SECRET_KEY=$(<\"$CREDENTIALS_DIRECTORY/secret_key\")"} + ${lib.optionalString ( + cfg.authPasswordHashFile != null + ) "export WF_AUTH_PASSWORD_HASH=$(<\"$CREDENTIALS_DIRECTORY/auth_hash\")"} + + exec ${lib.getExe cfg.package} + ''; + + serviceConfig = { + LoadCredential = + lib.optional (cfg.secretKeyFile != null) "secret_key:${cfg.secretKeyFile}" + ++ lib.optional (cfg.authPasswordHashFile != null) "auth_hash:${cfg.authPasswordHashFile}"; + + DynamicUser = true; + StateDirectory = "wealthfolio"; + ProtectSystem = "strict"; + ProtectHome = true; + PrivateTmp = true; + }; + }; + }; + + meta = { + maintainers = with lib.maintainers; [ luuumine ]; + }; +} From 79a8e945864be8980ab4cbd9e11c77dee09d91b7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 27 Jun 2026 08:01:43 +0000 Subject: [PATCH 04/10] igir: 5.1.0 -> 5.2.1 --- pkgs/by-name/ig/igir/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix index e50d1c4c2630..ca52815c8e05 100644 --- a/pkgs/by-name/ig/igir/package.nix +++ b/pkgs/by-name/ig/igir/package.nix @@ -18,16 +18,16 @@ buildNpmPackage rec { pname = "igir"; - version = "5.1.0"; + version = "5.2.1"; src = fetchFromGitHub { owner = "emmercm"; repo = "igir"; rev = "v${version}"; - hash = "sha256-OgWf4xhgYsk9vQSbwrLdjbDElXrhI7r+4CaxZ7yRs7E="; + hash = "sha256-LWdJPweZ0BFIjdXHUZvJuk8oZb8JtuGo3LIJtdwdG70="; }; - npmDepsHash = "sha256-r/1ImMfTFuRHvcH3713sDFNq7LJvgjt8a1rE8JtuaUk="; + npmDepsHash = "sha256-bRZlaRnPY8k2Xahb994GUYlROmR9ZQj2neEPVKDwv4g="; # I have no clue why I have to do this postPatch = '' From aee003a252c6e601564d75106597043166dcd3bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sat, 27 Jun 2026 15:17:28 +0200 Subject: [PATCH 05/10] music-assistant-desktop: 0.4.0 -> 0.4.2 Diff: https://github.com/music-assistant/desktop-app/compare/0.4.0...0.4.2 Changelog: https://github.com/music-assistant/desktop-app/releases/tag/0.4.2 --- pkgs/by-name/mu/music-assistant-desktop/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix index ef4eaff433f0..54179caddd17 100644 --- a/pkgs/by-name/mu/music-assistant-desktop/package.nix +++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix @@ -30,13 +30,13 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "music-assistant-desktop"; - version = "0.4.0"; + version = "0.4.2"; src = fetchFromGitHub { owner = "music-assistant"; repo = "desktop-app"; tag = finalAttrs.version; - hash = "sha256-Gx6bmipNRT5V5EHSCP6KjZ8Lgt7BcNV8zo0nrhaVmOs="; + hash = "sha256-AzKUv0lEpxM4lVEmgDV89RCD78YKcGNj1FTBs8spdyI="; }; patches = [ From 04eba4c46de098df9efa59ebb086fcd4a317f15e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 28 Jun 2026 05:42:25 +0000 Subject: [PATCH 06/10] fasmg: l5p0 -> l7xm --- pkgs/by-name/fa/fasmg/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fa/fasmg/package.nix b/pkgs/by-name/fa/fasmg/package.nix index c504c5e888c0..dec77f1f04d4 100644 --- a/pkgs/by-name/fa/fasmg/package.nix +++ b/pkgs/by-name/fa/fasmg/package.nix @@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "fasmg"; - version = "l5p0"; + version = "l7xm"; src = fetchzip { url = "https://flatassembler.net/fasmg.${finalAttrs.version}.zip"; - sha256 = "sha256-8nX45tHvKq6FPVhWQGNgrpkZgWuNbfsxL9YJxKa7P3I="; + sha256 = "sha256-m/mLZLluvoxr0VsNVcBnHvv1LlagafkX6fwZSovtO9s="; stripRoot = false; }; From 2296dc841ee1af8b41ac39400f386962f7a7fb4c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 28 Jun 2026 12:29:52 +0000 Subject: [PATCH 07/10] davinci-resolve: 20.3.3 -> 21.0.1 --- pkgs/by-name/da/davinci-resolve/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/da/davinci-resolve/package.nix b/pkgs/by-name/da/davinci-resolve/package.nix index 547132815133..657f890d6701 100644 --- a/pkgs/by-name/da/davinci-resolve/package.nix +++ b/pkgs/by-name/da/davinci-resolve/package.nix @@ -56,7 +56,7 @@ let davinci = ( stdenv.mkDerivation rec { pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}"; - version = "20.3.3"; + version = "21.0.1"; nativeBuildInputs = [ appimageTools.appimage-exec @@ -78,9 +78,9 @@ let outputHashAlgo = "sha256"; outputHash = if studioVariant then - "sha256-q5VGp0kkno//nYtT82QDZDJG92uumAtomUK4B55795g=" + "sha256-8JN3ptd8jcacxHihZHXuhdkyambUsnFIj+AruvpztKI=" else - "sha256-2pfJz71fS/oEmK3n4cESKb9EDYCeDBhbzGLgFpb+OLI="; + "sha256-ioAqvqHjwFX1ec6fDoxg2VUZy1moYoGx/aEewDuN1+g="; impureEnvVars = lib.fetchers.proxyImpureEnvVars; From 24eb722bb344774178c79a21aed4cef0c85c747c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sun, 28 Jun 2026 17:51:42 +0200 Subject: [PATCH 08/10] codebase-memory-mcp: add some new lines for clarity --- pkgs/by-name/co/codebase-memory-mcp/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/co/codebase-memory-mcp/package.nix b/pkgs/by-name/co/codebase-memory-mcp/package.nix index c2ed67df3256..84f8362ced0d 100644 --- a/pkgs/by-name/co/codebase-memory-mcp/package.nix +++ b/pkgs/by-name/co/codebase-memory-mcp/package.nix @@ -14,10 +14,14 @@ stdenv.mkDerivation (finalAttrs: { rev = "v${finalAttrs.version}"; hash = "sha256-H0l8H2JhPT1Rs0p+CJC1a1qYtnZNgLGe6n7PmM+WvE4="; }; + nativeBuildInputs = [ gnumake ]; + buildInputs = [ zlib ]; + strictDeps = true; __structuredAttrs = true; + # scripts/build.sh verifies CC via `file`, which fails on Nix's compiler wrapper. # Call make directly — mirrors upstream flake.nix. buildPhase = '' @@ -25,11 +29,13 @@ stdenv.mkDerivation (finalAttrs: { make -j$NIX_BUILD_CORES -f Makefile.cbm cbm CFLAGS_EXTRA='-DCBM_VERSION=\"${finalAttrs.version}\"' runHook postBuild ''; + installPhase = '' runHook preInstall install -Dm755 build/c/codebase-memory-mcp $out/bin/codebase-memory-mcp runHook postInstall ''; + meta = { homepage = "https://github.com/DeusData/codebase-memory-mcp"; description = "High-performance C11 MCP server that indexes codebases into a persistent knowledge graph"; From bee17a8c30986ada0d3640875f730106ef900f1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sun, 28 Jun 2026 17:51:52 +0200 Subject: [PATCH 09/10] codebase-memory-mcp: use makeFlags and makefile --- pkgs/by-name/co/codebase-memory-mcp/package.nix | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/co/codebase-memory-mcp/package.nix b/pkgs/by-name/co/codebase-memory-mcp/package.nix index 84f8362ced0d..702932bfc286 100644 --- a/pkgs/by-name/co/codebase-memory-mcp/package.nix +++ b/pkgs/by-name/co/codebase-memory-mcp/package.nix @@ -22,13 +22,14 @@ stdenv.mkDerivation (finalAttrs: { strictDeps = true; __structuredAttrs = true; + makefile = "Makefile.cbm"; + # scripts/build.sh verifies CC via `file`, which fails on Nix's compiler wrapper. # Call make directly — mirrors upstream flake.nix. - buildPhase = '' - runHook preBuild - make -j$NIX_BUILD_CORES -f Makefile.cbm cbm CFLAGS_EXTRA='-DCBM_VERSION=\"${finalAttrs.version}\"' - runHook postBuild - ''; + makeFlags = [ + "cbm" + "CFLAGS_EXTRA='-DCBM_VERSION=\"${finalAttrs.version}\"'" + ]; installPhase = '' runHook preInstall From a65fda26ccc4f49ab7e8bd3436fd90d2f6d2b6bb Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 28 Jun 2026 16:26:16 +0000 Subject: [PATCH 10/10] python3Packages.databricks-sdk: 0.118.0 -> 0.119.0 --- pkgs/development/python-modules/databricks-sdk/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix index a8b9d27028cf..29e81219d64f 100644 --- a/pkgs/development/python-modules/databricks-sdk/default.nix +++ b/pkgs/development/python-modules/databricks-sdk/default.nix @@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: { pname = "databricks-sdk"; - version = "0.118.0"; + version = "0.119.0"; pyproject = true; __structuredAttrs = true; @@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: { owner = "databricks"; repo = "databricks-sdk-py"; tag = "v${finalAttrs.version}"; - hash = "sha256-ukb5Sit+BRJd7DipvGMqXbFrC8jXsLDJjCbJdIO5G0U="; + hash = "sha256-tdlFT0Rg0VGjtJ9UZSDu6zt5O+fXdmr484+3n4D0p8M="; }; build-system = [