dust: use etc overlay & userborn

flake.lock

@@ -231,17 +231,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1724748588,
-        "narHash": "sha256-NlpGA4+AIf1dKNq76ps90rxowlFXUsV9x7vK/mN37JM=",
+        "lastModified": 1725013374,
+        "narHash": "sha256-fbz8MUVDWHchQSA4uguP9YYDXnX4bEdlP7YvsMcXZu4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a6292e34000dc93d43bccf78338770c1c5ec8a99",
+        "rev": "c169763c3087b02a8308e2f8a9bba77c428dcca1",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
+        "rev": "c169763c3087b02a8308e2f8a9bba77c428dcca1",
         "type": "github"
       }
     },

flake.nix

@@ -7,7 +7,8 @@
     #       `nixpkgs-unstable` contains less(?) jobs, and usually updates faster.
     #
     # REFERENCE: https://discourse.nixos.org/t/differences-between-nix-channels/13998/5
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/c169763c3087b02a8308e2f8a9bba77c428dcca1"; # userborn
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 
     disko = {
       url = "github:nix-community/disko";

hosts/dust/default.nix

@@ -21,6 +21,13 @@
   time.timeZone = "Asia/Shanghai";
   system.stateVersion = "24.05";
 
+  # TODO: move to 'core' profile
+  system.etc.overlay.enable = true;
+  services.userborn.enable = true;
+
+  # TODO: this is currently broken
+  # system.etc.overlay.mutable = false;
+
   users.users = {
     "guanranwang" = {
       isNormalUser = true;

nixos/profiles/core/hardening.nix

@@ -17,7 +17,6 @@
     "befs"
     "cramfs"
     "efs"
-    "erofs"
     "exofs"
     "freevxfs"
     "f2fs"