Reapply "modules.system.nixpkgs: enable ca-derivation"

This reverts commit 48797c252b.

devices/pc/default.nix

@@ -142,8 +142,9 @@ inputs:
         waydroid = {};
         docker = {};
         ananicy = {};
+        keyd = {};
       };
-      bugs = [ "xmunet" "backlight" "amdpstate" "plasma" ];
+      bugs = [ "xmunet" "backlight" "amdpstate" ];
     };
     boot =
     {

devices/surface/default.nix

@@ -54,7 +54,7 @@ inputs:
         waydroid = {};
         docker = {};
       };
-      bugs = [ "xmunet" "suspend-hibernate-no-platform" "plasma" ];
+      bugs = [ "xmunet" "suspend-hibernate-no-platform" ];
       packages.vasp = null;
     };
     powerManagement.resumeCommands = ''${inputs.pkgs.systemd}/bin/systemctl restart iptsd'';

flake.lock

@@ -990,11 +990,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728960512,
-        "narHash": "sha256-SmpNwQSMjkkIsxYGc4nK5lXji1V2ftGdvO63YQp+wLY=",
+        "lastModified": 1729222179,
+        "narHash": "sha256-a6OsOKlxF/+UVf7bUi9l09iGkt8vswpE0R8pUnNdOIs=",
         "owner": "CHN-beta",
         "repo": "nixpkgs",
-        "rev": "e3f3809400ebf3521fb15822bd779e332362bfb1",
+        "rev": "a60d02ef57437f359be6c57d5247c9eb96174345",
         "type": "github"
       },
       "original": {

modules/bugs/default.nix

@@ -40,9 +40,6 @@ inputs:
       amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
       hibernate-mt7921e.powerManagement.resumeCommands =
         let modprobe = "${inputs.pkgs.kmod}/bin/modprobe"; in "${modprobe} -r -w 3000 mt7921e && ${modprobe} mt7921e";
-      # https://discuss.kde.org/t/bug-power-profiles-daemon-0-23-seems-starts-too-late-for-powerdevil/21416
-      # remove in plasma 6.2
-      plasma.systemd.services.display-manager.after = [ "power-profiles-daemon.service" ];
     };
   in
     {

modules/services/keyd.nix

@@ -0,0 +1,21 @@
+inputs:
+{
+  options.nixos.services.keyd = let inherit (inputs.lib) mkOption types; in mkOption
+    { type = types.nullOr (types.submodule {}); default = null; };
+  config = let inherit (inputs.config.nixos.services) keyd; in inputs.lib.mkIf (keyd != null)
+  {
+    services.keyd =
+    {
+      enable = true;
+      keyboards.default =
+      {
+        ids = [ "*" ];
+        settings =
+        {
+          main.rightcontrol = "overload(r_ctrl, rightcontrol)";
+          "r_ctrl:C" = { left = "home"; right = "end"; up = "pageup"; down = "pagedown"; };
+        };
+      };
+    };
+  };
+}

modules/system/nix.nix

@@ -36,7 +36,11 @@ inputs:
         experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
         keep-failed = true;
         max-substitution-jobs = 4;
-        trusted-public-keys = [ "chn:Cc+nowW1LIpe1kyXOZmNaznFDiH1glXmpb4A+WD/DTE=" ];
+        trusted-public-keys =
+        [
+          "chn:Cc+nowW1LIpe1kyXOZmNaznFDiH1glXmpb4A+WD/DTE="
+          "cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="
+        ];
         trusted-users = [ "@wheel" ];
         show-trace = true;
         max-jobs = 4;
@@ -88,7 +92,11 @@ inputs:
     })
     # substituters
     {
-      nix.settings.substituters = inputs.lib.mkIf (nix.substituters != null) nix.substituters;
+      nix.settings.substituters = inputs.lib.mkMerge
+      [
+        (inputs.lib.mkIf (nix.substituters != null) nix.substituters)
+        [ "https://cache.ngi0.nixos.org/" ]
+      ];
     }
     # autoOptimiseStore
     (inputs.lib.mkIf nix.autoOptimiseStore

modules/system/nixpkgs.nix

@@ -51,7 +51,7 @@ inputs:
             oneapiArch = let match = { znver3 = "CORE-AVX2"; znver4 = "core-avx2"; };
               in match.${nixpkgs.march} or nixpkgs.march;
             nvhpcArch = nixpkgs.march;
-            # contentAddressedByDefault = true;
+            contentAddressedByDefault = true;
             enableCcache = true;
           });
           overlays =
@@ -87,7 +87,7 @@ inputs:
                     config = cudaConfig //
                     {
                       allowUnfree = true;
-                      # contentAddressedByDefault = true;
+                      contentAddressedByDefault = true;
                       permittedInsecurePackages =
                         let pkgs = inputs.topInputs.${source.${name}}.legacyPackages.${system};
                         in map