chore(flake): update nixpkgs, home-manager, rust-overlay

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -48,7 +48,8 @@ declaratively in `modules/home.nix` (`wayland.windowManager.hyprland`, `programs
 `programs.foot`). Font is JetBrainsMono Nerd Font; Waybar/foot use Nerd Font glyphs
 (nf-md set) for icons, so new glyphs should come from that set for visual consistency.
 
-Hyprland uses the **master** layout and a **German** keyboard (`kb_layout = "de"`).
+Hyprland uses the **master** layout; `kb_layout` ships neutral (`mkDefault "us"`),
+overridden per-inventory like `console.keyMap`.
 Look deliberately minimal: animations, blur, rounding, and shadows are all turned
 **off** on purpose — don't reintroduce them when adding desktop tweaks.
 

README.md

@@ -33,7 +33,7 @@ keeps it.
 
 ```
 your-inventory/
-├── flake.nix                        # inputs (pub + follows) + nixosConfigurations.<host>
+├── flake.nix                        # inputs (baseline + your nixpkgs) + nixosConfigurations.<host>
 ├── flake.lock
 ├── system/                          # system-level modules
 │   ├── regional.nix                 # time zone / keymap / locale (see Overriding)
@@ -55,17 +55,22 @@ The `flake.nix` that wires it together:
 ```nix
 {
   inputs = {
-    pub.url = "github:<owner>/<repo>";
-    # Reuse the public flake's pins so versions never drift between the two.
-    nixpkgs.follows = "pub/nixpkgs";
-    home-manager.follows = "pub/home-manager";
+    # You own nixpkgs, so your update cadence is yours — the baseline modules
+    # build against the versions you pin here.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    home-manager.url = "github:nix-community/home-manager";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+
+    baseline.url = "github:<owner>/<repo>";
+    baseline.inputs.nixpkgs.follows = "nixpkgs";        # baseline builds against YOUR nixpkgs
+    baseline.inputs.home-manager.follows = "home-manager";
   };
 
-  outputs = inputs@{ self, nixpkgs, pub, home-manager, ... }: {
+  outputs = inputs@{ self, nixpkgs, baseline, home-manager, ... }: {
     nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       modules = [
-        pub.nixosModules.default          # generic system baseline
+        baseline.nixosModules.default     # generic system baseline
         ./system/regional.nix             # your regional values (see below)
         ./hosts/myhost                    # hardware + hostname
         home-manager.nixosModules.home-manager
@@ -75,7 +80,7 @@ The `flake.nix` that wires it together:
           # Inject your own inputs into your home modules; the public ones ignore them.
           home-manager.extraSpecialArgs = { inherit inputs; };
           home-manager.users.me.imports = [
-            pub.homeModules.default         # generic home baseline
+            baseline.homeModules.default    # generic home baseline
             ./home/identity.nix             # your git identity, name/email, …
             ./home/ssh.nix                  # your SSH hosts (topology stays private)
             # … more personal home modules
@@ -87,6 +92,12 @@ The `flake.nix` that wires it together:
 }
 ```
 
+This repo ships *modules*, not pinned packages: they build against the `nixpkgs` **you**
+declare above, so you decide when packages move. *Quickstart alternative:* drop your own
+`nixpkgs` and write `nixpkgs.follows = "baseline/nixpkgs"` to pin to this repo's tested
+versions instead — one less thing to think about, but then your update cadence is whatever
+this repo pins, not the reverse.
+
 Your machine list, hostnames, and any private specifics stay in *your* flake — you pull
 only the generic modules from here.
 
@@ -111,6 +122,10 @@ from your private flake, in rough order of how often you reach for them:
    local.texlive.package = pkgs.texlive.withPackages (ps: [ ps.scheme-full ]);
    ```
 
+   A few `local.*` options exist precisely because a module pins a package to a nixpkgs
+   *other* than the one you declare (a deliberate freeze that would otherwise reach you
+   regardless of your own pin); the option is how you pull it back onto your nixpkgs.
+
 3. **Extra modules.** Anything with no public counterpart is just another module in the
    import lists above — personal apps, SSH/Syncthing topology, secrets wiring.
 

flake.lock

@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782704057,
-        "narHash": "sha256-G1I1gd32F7mp9LAe1DaZ4ZL7NX5gyiKwdCMwro1Vrck=",
+        "lastModified": 1785119570,
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "868d0a692de703c2de98fab61968e4e310b7c28e",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782691344,
-        "narHash": "sha256-i5nw9BYYsMDAaOC4J+JmTof6b2GhlyH076awYRNrTV8=",
+        "lastModified": 1785858998,
+        "narHash": "sha256-fKCq5jphd6l/Ms6gc3dptkw/TcKLYub9lQE5g6rbbkc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1f01958ffb5b3545c96d9ef2f4e24c5e5e1eb846",
+        "rev": "04607e1165ac22c5fde6dcc54c9e0b3c0487c555",
         "type": "github"
       },
       "original": {
@@ -96,11 +96,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782875958,
-        "narHash": "sha256-5eqDcnBjb1424HRQdnhuhNOBZguq1Z2tqSa2OMF/m2c=",
+        "lastModified": 1785993740,
+        "narHash": "sha256-naSJ+p7zkIT2hHNSJkhxiPZlmVRgE3UdODinMM7rpD8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "13139aefa973f3d96c60c0fbab801de058ae25ca",
+        "rev": "3d1b34a12a26be073f7ae67165a6b61229ca6025",
         "type": "github"
       },
       "original": {

modules/home.nix

@@ -595,7 +595,8 @@ in
       };
 
       input = {
-        kb_layout = "de";
+        # Neutral default; set the real layout in your inventory (like console.keyMap).
+        kb_layout = lib.mkDefault "us";
         follow_mouse = 1;
         numlock_by_default = true;
       };