From 14e184ba431bdb7ef5dc175d60e6c49be26891e0 Mon Sep 17 00:00:00 2001
From: Joe Mou <dev@mou.fo>
Date: Tue, 2 Sep 2025 11:12:31 -0400
Subject: make upgrade, remove broadcom_sta WiFi

broadcom_sta WiFi driver is considered insecure. We weren't using WiFi
anyway, so remove it. It may be possible to use Broadcom open source
drivers for our BCM4360, but these may only support newer hardware.

Also use allowUnfreePredicate to explicitly whitelist packages.
---
 hostnix/elmo/configuration.nix          | 7 +++++--
 hostnix/elmo/flake.lock                 | 6 +++---
 hostnix/elmo/hardware-configuration.nix | 1 -
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/hostnix/elmo/configuration.nix b/hostnix/elmo/configuration.nix
index 4516c1e..dec1dfa 100644
--- a/hostnix/elmo/configuration.nix
+++ b/hostnix/elmo/configuration.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   imports = [
@@ -42,7 +42,10 @@
     ];
   };
 
-  nixpkgs.config.allowUnfree = true;
+  # TODO make into a module
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+    "unrar"  # from nzbget
+  ];
 
   environment.systemPackages = with pkgs; [
     dig
diff --git a/hostnix/elmo/flake.lock b/hostnix/elmo/flake.lock
index 8d211fc..7666840 100644
--- a/hostnix/elmo/flake.lock
+++ b/hostnix/elmo/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751211869,
-        "narHash": "sha256-1Cu92i1KSPbhPCKxoiVG5qnoRiKTgR5CcGSRyLpOd7Y=",
+        "lastModified": 1756754095,
+        "narHash": "sha256-9Rsn9XEWINExosFkKEqdp8EI6Mujr1gmQiyrEcts2ls=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b43c397f6c213918d6cfe6e3550abfe79b5d1c51",
+        "rev": "7c815e513adbf03c9098b2bd230c1e0525c8a7f9",
         "type": "github"
       },
       "original": {
diff --git a/hostnix/elmo/hardware-configuration.nix b/hostnix/elmo/hardware-configuration.nix
index 55b2bdd..8dc6c69 100644
--- a/hostnix/elmo/hardware-configuration.nix
+++ b/hostnix/elmo/hardware-configuration.nix
@@ -11,7 +11,6 @@
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" "wl" ];
-  boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
   boot.loader.grub.configurationLimit = 10;
 
   fileSystems."/" =
-- 
cgit v1.3.1