Do not force derviation inputs, use booleans instead

Add ompss2rt to wrapper passthru
Use explicit splicing in clang wrapper
2026-01-21 15:16:06 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:24 +01:00 · 2026-01-21 12:46:23 +01:00
78 changed files with 1574 additions and 304 deletions
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -12,4 +12,9 @@ jobs:
    runs-on: native
    steps:
      - uses: https://gitea.com/ScMi1/checkout@v1.4
-      - run: nix build -L --no-link --print-out-paths .#bsc-ci.all
+      - run: nix build -L --no-link --print-out-paths .#bsc.ci.all
+  build:cross:
+    runs-on: native
+    steps:
+      - uses: https://gitea.com/ScMi1/checkout@v1.4
+      - run: nix build -L --no-link --print-out-paths .#bsc.ci.cross
--- a/doc/maintainers.md
+++ b/doc/maintainers.md
@@ -0,0 +1,30 @@
+# Maintainers
+
+## Role of a maintainer
+The responsibilities of maintainers are quite lax, and similar in spirit to
+[nixpkgs' maintainers][1]:
+
+    The main responsibility of a maintainer is to keep the packages they
+    maintain in a functioning state, and keep up with updates. In order to do
+    that, they are empowered to make decisions over the packages they maintain.
+
+    That being said, the maintainer is not alone in proposing changes to the
+    packages. Anybody (both bots and humans) can send PRs to bump or tweak the
+    package.
+
+In practice, this means that when updating or proposing changes to a package,
+we will notify maintainers by mentioning them in Gitea so they can test changes
+and give feedback.
+
+Since we do bi-yearly release cycles, there is no expectation from maintainers
+to update packages at each upstream release. Nevertheless, on each release cycle
+we may request help from maintainers when updating or testing their packages.
+
+## Becoming a maintainer
+
+
+You'll have to add yourself in the `maintainers.nix` list; your username should
+match your `bsc.es` email. Then you can add yourself to the `meta.maintainers`
+of any package you are interested in maintaining.
+
+[1]: [https://github.com/NixOS/nixpkgs/tree/nixos-25.05/maintainers]
--- a/flake.lock
+++ b/flake.lock
@@ -1,107 +1,25 @@
 {
  "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1750173260,
-        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1752436162,
-        "narHash": "sha256-Kt1UIPi7kZqkSc5HVj6UY5YLHHEzPBkgpNUByuyxtlw=",
+        "lastModified": 1767634882,
+        "narHash": "sha256-2GffSfQxe3sedHzK+sTKlYo/NTIAGzbFCIsNMUPAAnk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "dfcd5b901dbab46c9c6e80b265648481aafb01f8",
+        "rev": "3c9db02515ef1d9b6b709fc60ba9a540957f661c",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
-        "agenix": "agenix",
        "nixpkgs": "nixpkgs"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -1,15 +1,13 @@
 {
  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
-    agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  };

-  outputs = { self, nixpkgs, agenix, ... }:
+  outputs = { self, nixpkgs, ... }:
 let
  mkConf = name: nixpkgs.lib.nixosSystem {
    system = "x86_64-linux";
-    specialArgs = { inherit nixpkgs agenix; theFlake = self; };
+    specialArgs = { inherit nixpkgs; theFlake = self; };
    modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
  };
  # For now we only support x86
@@ -42,13 +40,13 @@ in
    # full nixpkgs with our overlay applied
    legacyPackages.${system} = pkgs;

-    hydraJobs = {
-      inherit (self.legacyPackages.${system}.bsc-ci) tests pkgs cross;
-    };
+    hydraJobs = self.legacyPackages.${system}.bsc.hydraJobs;

    # propagate nixpkgs lib, so we can do bscpkgs.lib
    lib = nixpkgs.lib // {
-      bsc.maintainers = import ./maintainers/maintainer-list.nix;
+      maintainers = nixpkgs.lib.maintainers // {
+        bsc = import ./pkgs/maintainers.nix;
+      };
    };
  };
 }
--- a/m/apex/configuration.nix
+++ b/m/apex/configuration.nix
@@ -57,6 +57,18 @@
    };
  };

+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    bantime-increment = {
+      enable = true; # Double ban time on each attack
+      maxtime = "7d"; # Ban up to a week
+    };
+  };
+
+  # Disable SSH login with password, allow only keypair
+  services.openssh.settings.PasswordAuthentication = false;
+
  networking.firewall = {
    extraCommands = ''
      # Blackhole BSC vulnerability scanner (OpenVAS) as it is spamming our
--- a/m/bay/configuration.nix
+++ b/m/bay/configuration.nix
@@ -24,7 +24,7 @@
      address = "10.0.40.40";
      prefixLength = 24;
    } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
      address = "10.0.42.40";
      prefixLength = 24;
    } ];
--- a/m/common/base/agenix.nix
+++ b/m/common/base/agenix.nix
@@ -1,9 +1,8 @@
-{ agenix, ... }:
+{ pkgs, ... }:

 {
-  imports = [ agenix.nixosModules.default ];
+  imports = [ ../../module/agenix.nix ];

-  environment.systemPackages = [
-    agenix.packages.x86_64-linux.default
-  ];
+  # Add agenix to system packages
+  environment.systemPackages = [ pkgs.agenix ];
 }
--- a/m/common/base/env.nix
+++ b/m/common/base/env.nix
@@ -1,12 +1,12 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:

 {
  environment.systemPackages = with pkgs; [
    vim wget git htop tmux pciutils tcpdump ripgrep nix-index nixos-option
    nix-diff ipmitool freeipmi ethtool lm_sensors cmake gnumake file tree
-    ncdu config.boot.kernelPackages.perf ldns pv
-    # From bsckgs overlay
-    osumb
+    ncdu perf ldns pv
+    # From jungle overlay
+    osumb nixgen
  ];

  programs.direnv.enable = true;
--- a/m/common/base/users.nix
+++ b/m/common/base/users.nix
@@ -139,6 +139,7 @@
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
        ];
+        shell = pkgs.zsh;
      };

      pmartin1 = {
@@ -180,6 +181,19 @@
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmMqKqPg4uocNOr3O41kLbZMOMJn3m2ZdN1JvTR96z3 bsccns@arnau-bsc"
        ];
      };
+
+      aaguirre = {
+        uid = 9655;
+        isNormalUser = true;
+        home = "/home/Computational/aaguirre";
+        description = "Alejandro Aguirre";
+        group = "Computational";
+        hosts = [ "apex" "hut" ];
+        hashedPassword = "$6$TXRXQT6jjBvxkxU6$E.sh5KspAm1qeG5Ct7OPHpo8REmbGDwjFGvqeGgTVz3GASGOAnPL7UMZsMAsAKBoahOw.v8LNno6XGrTEPzZH1";
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOlRX7ZCnqtUJYCxKgWmgSrFCYuA2LHY96rVwqxXPl86 aaguirre@BSC-8488184117"
+        ];
+      };
    };

    groups = {
--- a/m/common/base/watchdog.nix
+++ b/m/common/base/watchdog.nix
@@ -5,5 +5,5 @@
  boot.kernelModules = [ "ipmi_watchdog" ];

  # Enable systemd watchdog with 30 s interval
-  systemd.watchdog.runtimeTime = "30s";
+  systemd.settings.Manager.RuntimeWatchdogSec = 30;
 }
--- a/m/eudy/kernel/perf.nix
+++ b/m/eudy/kernel/perf.nix
@@ -1,11 +1,6 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, lib, ... }:

 {
-  # add the perf tool
-  environment.systemPackages = with pkgs; [
-    config.boot.kernelPackages.perf
-  ];
-
  # allow non-root users to read tracing data from the kernel
  boot.kernel.sysctl."kernel.perf_event_paranoid" = -2;
  boot.kernel.sysctl."kernel.kptr_restrict" = 0;
--- a/m/fox/configuration.nix
+++ b/m/fox/configuration.nix
@@ -93,20 +93,4 @@
    wantedBy = [ "multi-user.target" ];
    serviceConfig.ExecStart = script;
  };
-
-  # Only allow SSH connections from users who have a SLURM allocation
-  # See: https://slurm.schedmd.com/pam_slurm_adopt.html
-  security.pam.services.sshd.rules.account.slurm = {
-    control = "required";
-    enable = true;
-    modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
-    args = [ "log_level=debug5" ];
-    order = 999999; # Make it last one
-  };
-
-  # Disable systemd session (pam_systemd.so) as it will conflict with the
-  # pam_slurm_adopt.so module. What happens is that the shell is first adopted
-  # into the slurmstepd task and then into the systemd session, which is not
-  # what we want, otherwise it will linger even if all jobs are gone.
-  security.pam.services.sshd.startSession = lib.mkForce false;
 }
--- a/m/hut/configuration.nix
+++ b/m/hut/configuration.nix
@@ -17,6 +17,7 @@
    ./postgresql.nix
    ./nginx.nix
    ./p.nix
+    ./ompss2-timer.nix
    #./pxe.nix
  ];

@@ -44,7 +45,7 @@
      address = "10.0.40.7";
      prefixLength = 24;
    } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
      address = "10.0.42.7";
      prefixLength = 24;
    } ];
--- a/m/hut/gitea.nix
+++ b/m/hut/gitea.nix
@@ -29,6 +29,9 @@
    };
  };

+  # Allow gitea user to send mail
+  users.users.gitea.extraGroups = [ "mail-robot" ];
+
  services.gitea-actions-runner.instances = {
    runrun = {
      enable = true;
--- a/m/hut/msmtp.nix
+++ b/m/hut/msmtp.nix
@@ -1,8 +1,11 @@
 { config, lib, ... }:
 {
+  # Robot user that can see the password to send mail from jungle-robot
+  users.groups.mail-robot = {};
+
  age.secrets.jungleRobotPassword = {
    file = ../../secrets/jungle-robot-password.age;
-    group = "gitea";
+    group = "mail-robot";
    mode = "440";
  };

--- a/m/hut/nginx.nix
+++ b/m/hut/nginx.nix
@@ -4,8 +4,8 @@ let
    name = "jungle-web";
    src = pkgs.fetchgit {
      url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "739bf0175a7f05380fe7ad7023ff1d60db1710e1";
-      hash = "sha256-ea5DzhYTzZ9TmqD+x95rdNdLbxPnBluqlYH2NmBYmc4=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
    };
    buildInputs = [ pkgs.hugo ];
    buildPhase = ''
--- a/m/hut/ompss2-timer.nix
+++ b/m/hut/ompss2-timer.nix
@@ -0,0 +1,85 @@
+{ config, pkgs, ... }:
+{
+  systemd.timers = {
+    "ompss2-closing" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-closing.service";
+        OnCalendar = [ "*-03-15 07:00:00" "*-09-15 07:00:00"];
+      };
+    };
+    "ompss2-freeze" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-freeze.service";
+        OnCalendar = [ "*-04-15 07:00:00" "*-10-15 07:00:00" ];
+      };
+    };
+    "ompss2-release" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        Unit = "ompss2-release.service";
+        OnCalendar = [ "*-05-15 07:00:00" "*-11-15 07:00:00" ];
+      };
+    };
+  };
+
+  systemd.services =
+  let
+    closing = pkgs.writeText "closing.txt"
+    ''
+      Subject: OmpSs-2 release enters closing period
+
+      Hi,
+
+      You have one month to merge the remaining features for the next OmpSs-2
+      release. Please, identify what needs to be merged and discuss it in the next
+      OmpSs-2 meeting.
+
+      Thanks!,
+      Jungle robot
+    '';
+    freeze = pkgs.writeText "freeze.txt"
+    ''
+      Subject: OmpSs-2 release enters freeze period
+
+      Hi,
+
+      The period to introduce new features or breaking changes is over, only bug
+      fixes are allowed now. During this time, please prepare the release notes
+      to be included in the next OmpSs-2 release.
+
+      Thanks!,
+      Jungle robot
+    '';
+    release = pkgs.writeText "release.txt"
+    ''
+      Subject: OmpSs-2 release now
+
+      Hi,
+
+      The period to introduce bug fixes is now over. Please, proceed to do the
+      OmpSs-2 release.
+
+      Thanks!,
+      Jungle robot
+    '';
+    mkServ = name: mail: {
+      "ompss2-${name}" = {
+        script = ''
+          set -eu
+          set -o pipefail
+          cat ${mail} | ${config.security.wrapperDir}/sendmail star@bsc.es
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+          DynamicUser = true;
+          Group = "mail-robot";
+        };
+      };
+    };
+  in
+    (mkServ "closing" closing) //
+    (mkServ "freeze" freeze) //
+    (mkServ "release" release);
+}
--- a/m/lake2/configuration.nix
+++ b/m/lake2/configuration.nix
@@ -46,7 +46,7 @@
      address = "10.0.40.42";
      prefixLength = 24;
    } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
      address = "10.0.42.42";
      prefixLength = 24;
    } ];
--- a/m/module/agenix.nix
+++ b/m/module/agenix.nix
@@ -0,0 +1,357 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  cfg = config.age;
+
+  isDarwin = lib.attrsets.hasAttrByPath [ "environment" "darwinConfig" ] options;
+
+  ageBin = config.age.ageBin;
+
+  users = config.users.users;
+
+  sysusersEnabled =
+    if isDarwin then
+      false
+    else
+      options.systemd ? sysusers && (config.systemd.sysusers.enable || config.services.userborn.enable);
+
+  mountCommand =
+    if isDarwin then
+      ''
+        if ! diskutil info "${cfg.secretsMountPoint}" &> /dev/null; then
+            num_sectors=1048576
+            dev=$(hdiutil attach -nomount ram://"$num_sectors" | sed 's/[[:space:]]*$//')
+            newfs_hfs -v agenix "$dev"
+            mount -t hfs -o nobrowse,nodev,nosuid,-m=0751 "$dev" "${cfg.secretsMountPoint}"
+        fi
+      ''
+    else
+      ''
+        grep -q "${cfg.secretsMountPoint} ramfs" /proc/mounts ||
+          mount -t ramfs none "${cfg.secretsMountPoint}" -o nodev,nosuid,mode=0751
+      '';
+  newGeneration = ''
+    _agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
+    (( ++_agenix_generation ))
+    echo "[agenix] creating new generation in ${cfg.secretsMountPoint}/$_agenix_generation"
+    mkdir -p "${cfg.secretsMountPoint}"
+    chmod 0751 "${cfg.secretsMountPoint}"
+    ${mountCommand}
+    mkdir -p "${cfg.secretsMountPoint}/$_agenix_generation"
+    chmod 0751 "${cfg.secretsMountPoint}/$_agenix_generation"
+  '';
+
+  chownGroup = if isDarwin then "admin" else "keys";
+  # chown the secrets mountpoint and the current generation to the keys group
+  # instead of leaving it root:root.
+  chownMountPoint = ''
+    chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
+  '';
+
+  setTruePath = secretType: ''
+    ${
+      if secretType.symlink then
+        ''
+          _truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
+        ''
+      else
+        ''
+          _truePath="${secretType.path}"
+        ''
+    }
+  '';
+
+  installSecret = secretType: ''
+    ${setTruePath secretType}
+    echo "decrypting '${secretType.file}' to '$_truePath'..."
+    TMP_FILE="$_truePath.tmp"
+
+    IDENTITIES=()
+    for identity in ${toString cfg.identityPaths}; do
+      test -r "$identity" || continue
+      test -s "$identity" || continue
+      IDENTITIES+=(-i)
+      IDENTITIES+=("$identity")
+    done
+
+    test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
+
+    mkdir -p "$(dirname "$_truePath")"
+    [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
+    (
+      umask u=r,g=,o=
+      test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
+      test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
+      LANG=${
+        config.i18n.defaultLocale or "C"
+      } ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
+    )
+    chmod ${secretType.mode} "$TMP_FILE"
+    mv -f "$TMP_FILE" "$_truePath"
+
+    ${optionalString secretType.symlink ''
+      [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
+    ''}
+  '';
+
+  testIdentities = map (path: ''
+    test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!'
+  '') cfg.identityPaths;
+
+  cleanupAndLink = ''
+    _agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
+    (( ++_agenix_generation ))
+    echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
+    ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
+
+    (( _agenix_generation > 1 )) && {
+    echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
+    rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
+    }
+  '';
+
+  installSecrets = builtins.concatStringsSep "\n" (
+    [ "echo '[agenix] decrypting secrets...'" ]
+    ++ testIdentities
+    ++ (map installSecret (builtins.attrValues cfg.secrets))
+    ++ [ cleanupAndLink ]
+  );
+
+  chownSecret = secretType: ''
+    ${setTruePath secretType}
+    chown ${secretType.owner}:${secretType.group} "$_truePath"
+  '';
+
+  chownSecrets = builtins.concatStringsSep "\n" (
+    [ "echo '[agenix] chowning...'" ]
+    ++ [ chownMountPoint ]
+    ++ (map chownSecret (builtins.attrValues cfg.secrets))
+  );
+
+  secretType = types.submodule (
+    { config, ... }:
+    {
+      options = {
+        name = mkOption {
+          type = types.str;
+          default = config._module.args.name;
+          defaultText = literalExpression "config._module.args.name";
+          description = ''
+            Name of the file used in {option}`age.secretsDir`
+          '';
+        };
+        file = mkOption {
+          type = types.path;
+          description = ''
+            Age file the secret is loaded from.
+          '';
+        };
+        path = mkOption {
+          type = types.str;
+          default = "${cfg.secretsDir}/${config.name}";
+          defaultText = literalExpression ''
+            "''${cfg.secretsDir}/''${config.name}"
+          '';
+          description = ''
+            Path where the decrypted secret is installed.
+          '';
+        };
+        mode = mkOption {
+          type = types.str;
+          default = "0400";
+          description = ''
+            Permissions mode of the decrypted secret in a format understood by chmod.
+          '';
+        };
+        owner = mkOption {
+          type = types.str;
+          default = "0";
+          description = ''
+            User of the decrypted secret.
+          '';
+        };
+        group = mkOption {
+          type = types.str;
+          default = users.${config.owner}.group or "0";
+          defaultText = literalExpression ''
+            users.''${config.owner}.group or "0"
+          '';
+          description = ''
+            Group of the decrypted secret.
+          '';
+        };
+        symlink = mkEnableOption "symlinking secrets to their destination" // {
+          default = true;
+        };
+      };
+    }
+  );
+in
+{
+  imports = [
+    (mkRenamedOptionModule [ "age" "sshKeyPaths" ] [ "age" "identityPaths" ])
+  ];
+
+  options.age = {
+    ageBin = mkOption {
+      type = types.str;
+      default = "${pkgs.age}/bin/age";
+      defaultText = literalExpression ''
+        "''${pkgs.age}/bin/age"
+      '';
+      description = ''
+        The age executable to use.
+      '';
+    };
+    secrets = mkOption {
+      type = types.attrsOf secretType;
+      default = { };
+      description = ''
+        Attrset of secrets.
+      '';
+    };
+    secretsDir = mkOption {
+      type = types.path;
+      default = "/run/agenix";
+      description = ''
+        Folder where secrets are symlinked to
+      '';
+    };
+    secretsMountPoint = mkOption {
+      type =
+        types.addCheck types.str (
+          s:
+          (builtins.match "[ \t\n]*" s) == null # non-empty
+          && (builtins.match ".+/" s) == null
+        ) # without trailing slash
+        // {
+          description = "${types.str.description} (with check: non-empty without trailing slash)";
+        };
+      default = "/run/agenix.d";
+      description = ''
+        Where secrets are created before they are symlinked to {option}`age.secretsDir`
+      '';
+    };
+    identityPaths = mkOption {
+      type = types.listOf types.path;
+      default =
+        if isDarwin then
+          [
+            "/etc/ssh/ssh_host_ed25519_key"
+            "/etc/ssh/ssh_host_rsa_key"
+          ]
+        else if (config.services.openssh.enable or false) then
+          map (e: e.path) (
+            lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys
+          )
+        else
+          [ ];
+      defaultText = literalExpression ''
+        if isDarwin
+        then [
+          "/etc/ssh/ssh_host_ed25519_key"
+          "/etc/ssh/ssh_host_rsa_key"
+        ]
+        else if (config.services.openssh.enable or false)
+        then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
+        else [];
+      '';
+      description = ''
+        Path to SSH keys to be used as identities in age decryption.
+      '';
+    };
+  };
+
+  config = mkIf (cfg.secrets != { }) (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.identityPaths != [ ];
+          message = "age.identityPaths must be set, for example by enabling openssh.";
+        }
+      ];
+    }
+    (optionalAttrs (!isDarwin) {
+      # When using sysusers we no longer be started as an activation script
+      # because those are started in initrd while sysusers is started later.
+      systemd.services.agenix-install-secrets = mkIf sysusersEnabled {
+        wantedBy = [ "sysinit.target" ];
+        after = [ "systemd-sysusers.service" ];
+        unitConfig.DefaultDependencies = "no";
+
+        path = [ pkgs.mount ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = pkgs.writeShellScript "agenix-install" (concatLines [
+            newGeneration
+            installSecrets
+            chownSecrets
+          ]);
+          RemainAfterExit = true;
+        };
+      };
+
+      # Create a new directory full of secrets for symlinking (this helps
+      # ensure removed secrets are actually removed, or at least become
+      # invalid symlinks).
+      system.activationScripts = mkIf (!sysusersEnabled) {
+        agenixNewGeneration = {
+          text = newGeneration;
+          deps = [
+            "specialfs"
+          ];
+        };
+
+        agenixInstall = {
+          text = installSecrets;
+          deps = [
+            "agenixNewGeneration"
+            "specialfs"
+          ];
+        };
+
+        # So user passwords can be encrypted.
+        users.deps = [ "agenixInstall" ];
+
+        # Change ownership and group after users and groups are made.
+        agenixChown = {
+          text = chownSecrets;
+          deps = [
+            "users"
+            "groups"
+          ];
+        };
+
+        # So other activation scripts can depend on agenix being done.
+        agenix = {
+          text = "";
+          deps = [ "agenixChown" ];
+        };
+      };
+    })
+
+    (optionalAttrs isDarwin {
+      launchd.daemons.activate-agenix = {
+        script = ''
+          set -e
+          set -o pipefail
+          export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+          ${newGeneration}
+          ${installSecrets}
+          ${chownSecrets}
+          exit 0
+        '';
+        serviceConfig = {
+          RunAtLoad = true;
+          KeepAlive.SuccessfulExit = false;
+        };
+      };
+    })
+  ]);
+}
--- a/m/module/debuginfod.nix
+++ b/m/module/debuginfod.nix
@@ -1,3 +1,10 @@
 {
-  services.nixseparatedebuginfod.enable = true;
+  services.nixseparatedebuginfod2 = {
+    enable = true;
+    substituters = [
+      "local:"
+      "https://cache.nixos.org"
+      "http://hut/cache"
+    ];
+  };
 }
--- a/m/module/slurm-client.nix
+++ b/m/module/slurm-client.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:

 {
  imports = [
@@ -21,4 +21,20 @@
  };

  services.slurm.client.enable = true;
+
+  # Only allow SSH connections from users who have a SLURM allocation
+  # See: https://slurm.schedmd.com/pam_slurm_adopt.html
+  security.pam.services.sshd.rules.account.slurm = {
+    control = "required";
+    enable = true;
+    modulePath = "${pkgs.slurm}/lib/security/pam_slurm_adopt.so";
+    args = [ "log_level=debug5" ];
+    order = 999999; # Make it last one
+  };
+
+  # Disable systemd session (pam_systemd.so) as it will conflict with the
+  # pam_slurm_adopt.so module. What happens is that the shell is first adopted
+  # into the slurmstepd task and then into the systemd session, which is not
+  # what we want, otherwise it will linger even if all jobs are gone.
+  security.pam.services.sshd.startSession = lib.mkForce false;
 }
--- a/m/module/slurm-common.nix
+++ b/m/module/slurm-common.nix
@@ -1,31 +1,6 @@
 { config, pkgs, ... }:

-let
-  suspendProgram = pkgs.writeShellScript "suspend.sh" ''
-    exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
-    set -x
-    export "PATH=/run/current-system/sw/bin:$PATH"
-    echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
-    hosts=$(scontrol show hostnames $1)
-    for host in $hosts; do
-      echo Shutting down host: $host
-      ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power off
-    done
-  '';
-
-  resumeProgram = pkgs.writeShellScript "resume.sh" ''
-    exec 1>>/var/log/power_save.log 2>>/var/log/power_save.log
-    set -x
-    export "PATH=/run/current-system/sw/bin:$PATH"
-    echo "$(date) Suspend invoked $0 $*" >> /var/log/power_save.log
-    hosts=$(scontrol show hostnames $1)
-    for host in $hosts; do
-      echo Starting host: $host
-      ipmitool -I lanplus -H ''${host}-ipmi -P "" -U "" chassis power on
-    done
-  '';
-
-in {
+{
  services.slurm = {
    controlMachine = "apex";
    clusterName = "jungle";
@@ -59,16 +34,6 @@ in {
      # the resources. Use the task/cgroup plugin to enable process containment.
      TaskPlugin=task/affinity,task/cgroup

-      # Power off unused nodes until they are requested
-      SuspendProgram=${suspendProgram}
-      SuspendTimeout=60
-      ResumeProgram=${resumeProgram}
-      ResumeTimeout=300
-      SuspendExcNodes=fox
-
-      # Turn the nodes off after 1 hour of inactivity
-      SuspendTime=3600
-
      # Reduce port range so we can allow only this range in the firewall
      SrunPortRange=60000-61000

@@ -86,9 +51,7 @@ in {
      # when a task runs (srun) so we can ssh early.
      PrologFlags=Alloc,Contain,X11

-      # LaunchParameters=ulimit_pam_adopt will set RLIMIT_RSS in processes
-      # adopted by the external step, similar to tasks running in regular steps
-      # LaunchParameters=ulimit_pam_adopt
+      LaunchParameters=use_interactive_step
      SlurmdDebug=debug5
      #DebugFlags=Protocol,Cgroup
    '';
--- a/m/owl1/configuration.nix
+++ b/m/owl1/configuration.nix
@@ -20,7 +20,7 @@
      address = "10.0.40.1";
      prefixLength = 24;
    } ];
-    interfaces.ibp5s0.ipv4.addresses = [ {
+    interfaces.ibs785.ipv4.addresses = [ {
      address = "10.0.42.1";
      prefixLength = 24;
    } ];
--- a/m/owl2/configuration.nix
+++ b/m/owl2/configuration.nix
@@ -21,7 +21,7 @@
      prefixLength = 24;
    } ];
    # Watch out! The OmniPath device is not in the same place here:
-    interfaces.ibp129s0.ipv4.addresses = [ {
+    interfaces.ibs801.ipv4.addresses = [ {
      address = "10.0.42.2";
      prefixLength = 24;
    } ];
--- a/m/tent/gitea.nix
+++ b/m/tent/gitea.nix
@@ -27,4 +27,7 @@
      };
    };
  };
+
+  # Allow gitea user to send mail
+  users.users.gitea.extraGroups = [ "mail-robot" ];
 }
--- a/m/tent/nginx.nix
+++ b/m/tent/nginx.nix
@@ -4,8 +4,8 @@ let
    name = "jungle-web";
    src = pkgs.fetchgit {
      url = "https://jungle.bsc.es/git/rarias/jungle-website.git";
-      rev = "739bf0175a7f05380fe7ad7023ff1d60db1710e1";
-      hash = "sha256-ea5DzhYTzZ9TmqD+x95rdNdLbxPnBluqlYH2NmBYmc4=";
+      rev = "52abaf4d71652a9ef77a0b098db14ca33bffff4c";
+      hash = "sha256-/ul9GazbOrOkmlvSgDz/+2W+V+ir5725Y7mVLc3rb0M=";
    };
    buildInputs = [ pkgs.hugo ];
    buildPhase = ''
--- a/overlay.nix
+++ b/overlay.nix
@@ -7,13 +7,14 @@ let
  callPackage = final.callPackage;

  bscPkgs = {
+    agenix = prev.callPackage ./pkgs/agenix/default.nix { };
    amd-uprof = prev.callPackage ./pkgs/amd-uprof/default.nix { };
    bench6 = callPackage ./pkgs/bench6/default.nix { };
    bigotes = callPackage ./pkgs/bigotes/default.nix { };
    clangOmpss2 = callPackage ./pkgs/llvm-ompss2/default.nix { };
-    clangOmpss2Nanos6 = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nanos6; };
-    clangOmpss2Nodes = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmp; };
-    clangOmpss2NodesOmpv = callPackage ./pkgs/llvm-ompss2/default.nix { ompss2rt = final.nodes; openmp = final.openmpv; };
+    clangOmpss2Nanos6 = callPackage ./pkgs/llvm-ompss2/default.nix { useNanos6 = true; };
+    clangOmpss2Nodes = callPackage ./pkgs/llvm-ompss2/default.nix { useNodes = true; useOpenmp = true; };
+    clangOmpss2NodesOmpv = callPackage ./pkgs/llvm-ompss2/default.nix { useNodes = true; useOpenmpV = true; };
    clangOmpss2Unwrapped = callPackage ./pkgs/llvm-ompss2/clang.nix { };
    cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
    #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
@@ -29,13 +30,15 @@ let
      amd-uprof-driver = _prev.callPackage ./pkgs/amd-uprof/driver.nix { };
    });
    lmbench = callPackage ./pkgs/lmbench/default.nix { };
-    mcxx = callPackage ./pkgs/mcxx/default.nix { };
+    # Broken and unmantained
+    # mcxx = callPackage ./pkgs/mcxx/default.nix { };
    meteocat-exporter = prev.callPackage ./pkgs/meteocat-exporter/default.nix { };
    mpi = final.mpich; # Set MPICH as default
    mpich = callPackage ./pkgs/mpich/default.nix { mpich = prev.mpich; };
    nanos6 = callPackage ./pkgs/nanos6/default.nix { };
    nanos6Debug = final.nanos6.override { enableDebug = true; };
    nixtools = callPackage ./pkgs/nixtools/default.nix { };
+    nixgen = callPackage ./pkgs/nixgen/default.nix { };
    # Broken because of pkgsStatic.libcap
    # See: https://github.com/NixOS/nixpkgs/pull/268791
    #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
@@ -46,15 +49,17 @@ let
    osumb = callPackage ./pkgs/osu/default.nix { };
    ovni = callPackage ./pkgs/ovni/default.nix { };
    ovniGit = final.ovni.override { useGit = true; };
+    papi = callPackage ./pkgs/papi/default.nix { papi = prev.papi; };
    paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
    prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
    #pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
    #psmpi = callPackage ./pkgs/parastation/psmpi.nix { }; # Unmaintaned
+    slurm = import ./pkgs/slurm/default.nix { slurm = prev.slurm; };
    sonar = callPackage ./pkgs/sonar/default.nix { };
-    stdenvClangOmpss2 = final.stdenv.override { cc = final.clangOmpss2; allowedRequisites = null; };
-    stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.clangOmpss2Nanos6; allowedRequisites = null; };
-    stdenvClangOmpss2Nodes = final.stdenv.override { cc = final.clangOmpss2Nodes; allowedRequisites = null; };
-    stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
+    stdenvClangOmpss2 = final.stdenv.override { cc = final.buildPackages.clangOmpss2; allowedRequisites = null; };
+    stdenvClangOmpss2Nanos6 = final.stdenv.override { cc = final.buildPackages.clangOmpss2Nanos6; allowedRequisites = null; };
+    stdenvClangOmpss2Nodes = final.stdenv.override { cc = final.buildPackages.clangOmpss2Nodes; allowedRequisites = null; };
+    stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.buildPackages.clangOmpss2NodesOmpv; allowedRequisites = null; };
    tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
    tampi = callPackage ./pkgs/tampi/default.nix { };
    upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
@@ -94,12 +99,20 @@ let
    };
  };

-  pkgs = filterAttrs (_: isDerivation) bscPkgs;
+  # For now, only build toplevel packages in CI/Hydra
+  pkgsTopLevel = filterAttrs (_: isDerivation) bscPkgs;

-  crossTargets = [ "riscv64" ];
-  cross = prev.lib.genAttrs crossTargets (target:
-    final.pkgsCross.${target}.bsc-ci.pkgs
-  );
+  # Native build in that platform doesn't imply cross build works
+  canCrossCompile = platform: default: pkg:
+    (isDerivation pkg) &&
+    # If meta.cross is undefined, use default
+    (pkg.meta.cross or default) &&
+    (meta.availableOn final.pkgsCross.${platform}.stdenv.hostPlatform pkg);
+
+  # For now only RISC-V
+  crossSet = genAttrs [ "riscv64" ] (platform:
+    filterAttrs (_: canCrossCompile platform true)
+      final.pkgsCross.${platform}.bsc.pkgsTopLevel);

  buildList = name: paths:
    final.runCommandLocal name { } ''
@@ -113,27 +126,38 @@ let
      printf '%s\n' $deps >$out
    '';

-  crossList = builtins.mapAttrs (t: v: buildList t (builtins.attrValues v)) cross;
-
-  pkgsList = buildList "ci-pkgs" (builtins.attrValues pkgs);
-  testList = buildList "ci-tests" (collect isDerivation tests);
-
-  all = buildList' "ci-all" [ pkgsList testList ];
+  pkgsList = buildList "ci-pkgs" (builtins.attrValues pkgsTopLevel);
+  testsList = buildList "ci-tests" (collect isDerivation tests);
+  allList = buildList' "ci-all" [ pkgsList testsList ];
+  # For now only RISC-V
+  crossList = buildList "ci-cross"
+    (filter
+      (canCrossCompile "riscv64" false) # opt-in (pkgs with: meta.cross = true)
+        (builtins.attrValues crossSet.riscv64));

 in bscPkgs // {

- lib = prev.lib // {
-   bsc.maintainers = import ./maintainers/maintainer-list.nix;
- };
+  lib = prev.lib // {
+    maintainers = prev.lib.maintainers // {
+      bsc = import ./pkgs/maintainers.nix;
+    };
+  };

-  # Prevent accidental usage of bsc attribute
-  bsc = throw "the bsc attribute is deprecated, packages are now in the root";
+  # Prevent accidental usage of bsc-ci attribute
+  bsc-ci = throw "the bsc-ci attribute is deprecated, use bsc.ci";

  # Internal for our CI tests
-  bsc-ci = {
-    inherit pkgs pkgsList;
-    inherit tests testList;
-    inherit cross crossList;
-    inherit all;
+  bsc = {
+    # CI targets for nix build
+    ci = { pkgs = pkgsList; tests = testsList; all = allList; cross = crossList; };
+
+    # Direct access to package sets
+    tests = tests;
+    pkgs = bscPkgs;
+    pkgsTopLevel = pkgsTopLevel;
+    cross = crossSet;
+
+    # Hydra uses attribute sets of pkgs
+    hydraJobs = { tests = tests; pkgs = pkgsTopLevel; cross = crossSet; };
  };
 }
--- a/pkgs/agenix/agenix.sh
+++ b/pkgs/agenix/agenix.sh
@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+PACKAGE="agenix"
+
+function show_help () {
+  echo "$PACKAGE - edit and rekey age secret files"
+  echo " "
+  echo "$PACKAGE -e FILE [-i PRIVATE_KEY]"
+  echo "$PACKAGE -r [-i PRIVATE_KEY]"
+  echo ' '
+  echo 'options:'
+  echo '-h, --help                show help'
+  # shellcheck disable=SC2016
+  echo '-e, --edit FILE           edits FILE using $EDITOR'
+  echo '-r, --rekey               re-encrypts all secrets with specified recipients'
+  echo '-d, --decrypt FILE        decrypts FILE to STDOUT'
+  echo '-i, --identity            identity to use when decrypting'
+  echo '-v, --verbose             verbose output'
+  echo ' '
+  echo 'FILE an age-encrypted file'
+  echo ' '
+  echo 'PRIVATE_KEY a path to a private SSH key used to decrypt file'
+  echo ' '
+  echo 'EDITOR environment variable of editor to use when editing FILE'
+  echo ' '
+  echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"'
+  echo ' '
+  echo 'RULES environment variable with path to Nix file specifying recipient public keys.'
+  echo "Defaults to './secrets.nix'"
+  echo ' '
+  echo "agenix version: @version@"
+  echo "age binary path: @ageBin@"
+  echo "age version: $(@ageBin@ --version)"
+}
+
+function warn() {
+  printf '%s\n' "$*" >&2
+}
+
+function err() {
+  warn "$*"
+  exit 1
+}
+
+test $# -eq 0 && (show_help && exit 1)
+
+REKEY=0
+DECRYPT_ONLY=0
+DEFAULT_DECRYPT=(--decrypt)
+
+while test $# -gt 0; do
+  case "$1" in
+    -h|--help)
+      show_help
+      exit 0
+      ;;
+    -e|--edit)
+      shift
+      if test $# -gt 0; then
+        export FILE=$1
+      else
+        echo "no FILE specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -i|--identity)
+      shift
+      if test $# -gt 0; then
+        DEFAULT_DECRYPT+=(--identity "$1")
+      else
+        echo "no PRIVATE_KEY specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -r|--rekey)
+      shift
+      REKEY=1
+      ;;
+    -d|--decrypt)
+      shift
+      DECRYPT_ONLY=1
+      if test $# -gt 0; then
+        export FILE=$1
+      else
+        echo "no FILE specified"
+        exit 1
+      fi
+      shift
+      ;;
+    -v|--verbose)
+      shift
+      set -x
+      ;;
+    *)
+      show_help
+      exit 1
+      ;;
+  esac
+done
+
+RULES=${RULES:-./secrets.nix}
+function cleanup {
+    if [ -n "${CLEARTEXT_DIR+x}" ]
+    then
+        rm -rf -- "$CLEARTEXT_DIR"
+    fi
+    if [ -n "${REENCRYPTED_DIR+x}" ]
+    then
+        rm -rf -- "$REENCRYPTED_DIR"
+    fi
+}
+trap "cleanup" 0 2 3 15
+
+function keys {
+    (@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in rules.\"$1\".publicKeys)" | @jqBin@ -r .[]) || exit 1
+}
+
+function armor {
+    (@nixInstantiate@ --json --eval --strict -E "(let rules = import $RULES; in (builtins.hasAttr \"armor\" rules.\"$1\" && rules.\"$1\".armor))") || exit 1
+}
+
+function decrypt {
+    FILE=$1
+    KEYS=$2
+    if [ -z "$KEYS" ]
+    then
+        err "There is no rule for $FILE in $RULES."
+    fi
+
+    if [ -f "$FILE" ]
+    then
+        DECRYPT=("${DEFAULT_DECRYPT[@]}")
+        if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
+            if [ -f "$HOME/.ssh/id_rsa" ]; then
+                DECRYPT+=(--identity "$HOME/.ssh/id_rsa")
+            fi
+            if [ -f "$HOME/.ssh/id_ed25519" ]; then
+                DECRYPT+=(--identity "$HOME/.ssh/id_ed25519")
+            fi
+        fi
+        if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
+          err "No identity found to decrypt $FILE. Try adding an SSH key at $HOME/.ssh/id_rsa or $HOME/.ssh/id_ed25519 or using the --identity flag to specify a file."
+        fi
+
+        @ageBin@ "${DECRYPT[@]}" -- "$FILE" || exit 1
+    fi
+}
+
+function edit {
+    FILE=$1
+    KEYS=$(keys "$FILE") || exit 1
+    ARMOR=$(armor "$FILE") || exit 1
+
+    CLEARTEXT_DIR=$(@mktempBin@ -d)
+    CLEARTEXT_FILE="$CLEARTEXT_DIR/$(basename -- "$FILE")"
+    DEFAULT_DECRYPT+=(-o "$CLEARTEXT_FILE")
+
+    decrypt "$FILE" "$KEYS" || exit 1
+
+    [ ! -f "$CLEARTEXT_FILE" ] || cp -- "$CLEARTEXT_FILE" "$CLEARTEXT_FILE.before"
+
+    [ -t 0 ] || EDITOR='cp -- /dev/stdin'
+
+    $EDITOR "$CLEARTEXT_FILE"
+
+    if [ ! -f "$CLEARTEXT_FILE" ]
+    then
+      warn "$FILE wasn't created."
+      return
+    fi
+    [ -f "$FILE" ] && [ "$EDITOR" != ":" ] && @diffBin@ -q -- "$CLEARTEXT_FILE.before" "$CLEARTEXT_FILE" && warn "$FILE wasn't changed, skipping re-encryption." && return
+
+    ENCRYPT=()
+    if [[ "$ARMOR" == "true" ]]; then
+        ENCRYPT+=(--armor)
+    fi
+    while IFS= read -r key
+    do
+        if [ -n "$key" ]; then
+            ENCRYPT+=(--recipient "$key")
+        fi
+    done <<< "$KEYS"
+
+    REENCRYPTED_DIR=$(@mktempBin@ -d)
+    REENCRYPTED_FILE="$REENCRYPTED_DIR/$(basename -- "$FILE")"
+
+    ENCRYPT+=(-o "$REENCRYPTED_FILE")
+
+    @ageBin@ "${ENCRYPT[@]}" <"$CLEARTEXT_FILE" || exit 1
+
+    mkdir -p -- "$(dirname -- "$FILE")"
+
+    mv -f -- "$REENCRYPTED_FILE" "$FILE"
+}
+
+function rekey {
+    FILES=$( (@nixInstantiate@ --json --eval -E "(let rules = import $RULES; in builtins.attrNames rules)"  | @jqBin@ -r .[]) || exit 1)
+
+    for FILE in $FILES
+    do
+        warn "rekeying $FILE..."
+        EDITOR=: edit "$FILE"
+        cleanup
+    done
+}
+
+[ $REKEY -eq 1 ] && rekey && exit 0
+[ $DECRYPT_ONLY -eq 1 ] && DEFAULT_DECRYPT+=("-o" "-") && decrypt "${FILE}" "$(keys "$FILE")" && exit 0
+edit "$FILE" && cleanup && exit 0
--- a/pkgs/agenix/default.nix
+++ b/pkgs/agenix/default.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  age,
+  jq,
+  nix,
+  mktemp,
+  diffutils,
+  replaceVars,
+  ageBin ? "${age}/bin/age",
+  shellcheck,
+}:
+let
+  bin = "${placeholder "out"}/bin/agenix";
+in
+stdenv.mkDerivation rec {
+  pname = "agenix";
+  version = "0.15.0";
+  src = replaceVars ./agenix.sh {
+    inherit ageBin version;
+    jqBin = "${jq}/bin/jq";
+    nixInstantiate = "${nix}/bin/nix-instantiate";
+    mktempBin = "${mktemp}/bin/mktemp";
+    diffBin = "${diffutils}/bin/diff";
+  };
+  dontUnpack = true;
+  doInstallCheck = true;
+  installCheckInputs = [ shellcheck ];
+  postInstallCheck = ''
+    shellcheck ${bin}
+    ${bin} -h | grep ${version}
+
+    test_tmp=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
+    export HOME="$test_tmp/home"
+    export NIX_STORE_DIR="$test_tmp/nix/store"
+    export NIX_STATE_DIR="$test_tmp/nix/var"
+    mkdir -p "$HOME" "$NIX_STORE_DIR" "$NIX_STATE_DIR"
+    function cleanup {
+      rm -rf "$test_tmp"
+    }
+    trap "cleanup" 0 2 3 15
+
+    mkdir -p $HOME/.ssh
+    cp -r "${./example}" $HOME/secrets
+    chmod -R u+rw $HOME/secrets
+    (
+    umask u=rw,g=r,o=r
+    cp ${./example_keys/user1.pub} $HOME/.ssh/id_ed25519.pub
+    chown $UID $HOME/.ssh/id_ed25519.pub
+    )
+    (
+    umask u=rw,g=,o=
+    cp ${./example_keys/user1} $HOME/.ssh/id_ed25519
+    chown $UID $HOME/.ssh/id_ed25519
+    )
+
+    cd $HOME/secrets
+    test $(${bin} -d secret1.age) = "hello"
+  '';
+
+  installPhase = ''
+    install -D $src ${bin}
+  '';
+
+  meta.description = "age-encrypted secrets for NixOS";
+}
--- a/pkgs/agenix/example/-leading-hyphen-filename.age
+++ b/pkgs/agenix/example/-leading-hyphen-filename.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 V3XmEA zirqdzZZ1E+sedBn7fbEHq4ntLEkokZ4GctarBBOHXY
+Rvs5YHaAUeCZyNwPedubPcHClWYIuXXWA5zadXPWY6w
+-> ssh-ed25519 KLPP8w BVp4rDkOYSQyn8oVeHFeinSqW+pdVtxBF9+5VM1yORY
+bMwppAi8Nhz0328taU4AzUkTVyWtSLvFZG6c5W/Fs78
+--- xCbqLhXAcOziO2wmbjTiSQfZvt5Rlsc4SCvF+iEzpQA
+<EFBFBD>KB<EFBFBD><EFBFBD>/<2F>Z<><5A>r<EFBFBD>%<01><>4<EFBFBD><34><EFBFBD>Mq5<71><35>_<EFBFBD><5F>ݒ<><DD92><EFBFBD><EFBFBD><EFBFBD>11ܨqM;& <20><>Lr<4C><72><EFBFBD>f<EFBFBD><66><EFBFBD>]>N
--- a/pkgs/agenix/example/armored-secret.age
+++ b/pkgs/agenix/example/armored-secret.age
@@ -0,0 +1,7 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFYzWG1FQSBpZkZW
+aFpLNnJxc0VUMHRmZ2dZS0pjMGVENnR3OHd5K0RiT1RjRUhibFZBCnN5UG5vUjA3
+SXpsNGtiVUw4T0tIVFo5Wkk5QS9NQlBndzVvektiQ0ozc0kKLS0tIGxyY1Q4dEZ1
+VGZEanJyTFNta2JNRmpZb2FnK2JyS1hSVml1UGdMNWZKQXMKYla+wTXcRedyZoEb
+LVWaSx49WoUTU0KBPJg9RArxaeC23GoCDzR/aM/1DvYU
+-----END AGE ENCRYPTED FILE-----
--- a/pkgs/agenix/example/passwordfile-user1.age
+++ b/pkgs/agenix/example/passwordfile-user1.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 KLPP8w s1DYZRlZuSsyhmZCF1lFB+E9vB8bZ/+ZhBRlx8nprwE
+nmYVCsVBrX2CFXXPU+D+bbkkIe/foofp+xoUrg9DHZw
+-> ssh-ed25519 V3XmEA Pwv3oCwcY0DX8rY48UNfsj9RumWsn4dbgorYHCwObgI
+FKxRYkL3JHtJxUwymWDF0rAtJ33BivDI6IfPsfumM90
+-> V'v(/u$-grease em/Vgf 2qDuk
+7I3iiQLPGi1COML9u/JeYkr7EqbSLoU
+--- 57WJRigUGtmcObrssS3s4PvmR8wgh1AOC/ijJn1s3xI
+<EFBFBD>'K<>ƷY&<26>7G<37>O<EFBFBD><4F>Fj<13>k<EFBFBD>X<EFBFBD><58>BnuJ<75><4A>:9<>(<><7F><EFBFBD>X<EFBFBD>#<23>A<EFBFBD><41><EFBFBD><EFBFBD>ڧj<DAA7>,<02>_<17><><EFBFBD>?<3F>Z<EFBFBD><17>v<EFBFBD><76>V<EFBFBD>96]oks~%<25>c	<04>e^C<>%JQ5<51><H<>z}<7D>C<EFBFBD>,<2C>p<EFBFBD><70>*!W<><57><EFBFBD>A<EFBFBD><41><EFBFBD>҅dC<15>K)<10><>-<2D>y
--- a/pkgs/agenix/example/secret1.age
+++ b/pkgs/agenix/example/secret1.age
--- a/pkgs/agenix/example/secret2.age
+++ b/pkgs/agenix/example/secret2.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 V3XmEA OB4+1FbPhQ3r6iGksM7peWX5it8NClpXIq/o5nnP7GA
+FmHVUj+A5i5+bDFgySQskmlvynnosJiWUTJmBRiNA9I
+--- tP+3mFVtd7ogVu1Lkboh55zoi5a77Ht08Uc/QuIviv4
+<EFBFBD><EFBFBD>X<EFBFBD>{<7B><>O<EFBFBD><4F><1F><04>tMXx<58>vӪ(<28>I<EFBFBD>myP<79><50><EFBFBD><EFBFBD>+3<>S3i
--- a/pkgs/agenix/example/secrets.nix
+++ b/pkgs/agenix/example/secrets.nix
@@ -0,0 +1,23 @@
+let
+  user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
+  system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
+in
+{
+  "secret1.age".publicKeys = [
+    user1
+    system1
+  ];
+  "secret2.age".publicKeys = [ user1 ];
+  "passwordfile-user1.age".publicKeys = [
+    user1
+    system1
+  ];
+  "-leading-hyphen-filename.age".publicKeys = [
+    user1
+    system1
+  ];
+  "armored-secret.age" = {
+    publicKeys = [ user1 ];
+    armor = true;
+  };
+}
--- a/pkgs/agenix/example_keys/system1
+++ b/pkgs/agenix/example_keys/system1
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxAAAAJA3yvCWN8rw
+lgAAAAtzc2gtZWQyNTUxOQAAACDyQ8iK/xUs9XCXXKFuvUfja1s8Biv/t4Caag9bfC9sxA
+AAAEA+J2V6AG1NriAIvnNKRauIEh1JE9HSdhvKJ68a5Fm0w/JDyIr/FSz1cJdcoW69R+Nr
+WzwGK/+3gJpqD1t8L2zEAAAADHJ5YW50bUBob21lMQE=
+-----END OPENSSH PRIVATE KEY-----
--- a/pkgs/agenix/example_keys/system1.pub
+++ b/pkgs/agenix/example_keys/system1.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE
--- a/pkgs/agenix/example_keys/user1
+++ b/pkgs/agenix/example_keys/user1
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRwAAAJC2JJ8htiSf
+IQAAAAtzc2gtZWQyNTUxOQAAACC9InTb4BornFoLqf5j+/M8gtt7hY2KtHr3FnYxkFGgRw
+AAAEDxt5gC/s53IxiKAjfZJVCCcFIsdeERdIgbYhLO719+Kb0idNvgGiucWgup/mP78zyC
+23uFjYq0evcWdjGQUaBHAAAADHJ5YW50bUBob21lMQE=
+-----END OPENSSH PRIVATE KEY-----
--- a/pkgs/agenix/example_keys/user1.pub
+++ b/pkgs/agenix/example_keys/user1.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH
--- a/pkgs/agenix/update.sh
+++ b/pkgs/agenix/update.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+# All operations are done relative to root
+GITROOT=$(git rev-parse --show-toplevel)
+cd "$GITROOT"
+
+REVISION=${1:-main}
+
+TMPCLONE=$(mktemp -d)
+trap "rm -rf ${TMPCLONE}" EXIT
+
+git clone https://github.com/ryantm/agenix.git --revision="$REVISION" "$TMPCLONE" --depth=1
+
+cp "${TMPCLONE}/pkgs/agenix.sh" pkgs/agenix/agenix.sh
+cp "${TMPCLONE}/pkgs/agenix.nix" pkgs/agenix/default.nix
+sed -i 's#../example#./example#' pkgs/agenix/default.nix
+
+cp "${TMPCLONE}/example/"* pkgs/agenix/example/
+cp "${TMPCLONE}/example_keys/"* pkgs/agenix/example_keys/
+
+cp "${TMPCLONE}/modules/age.nix" m/module/agenix.nix
--- a/pkgs/amd-uprof/default.nix
+++ b/pkgs/amd-uprof/default.nix
@@ -47,6 +47,7 @@ in
    inherit version;
    src = uprofSrc;
    dontStrip = true;
+    strictDeps = true;
    phases = [ "installPhase" "fixupPhase" ];
    nativeBuildInputs = [ autoPatchelfHook radare2 ];
    buildInputs = [
@@ -86,4 +87,13 @@ in
      patchelf --add-needed libnuma.so $out/bin/AMDuProfPcm
      set +x
    '';
+
+    meta = {
+      description = "Performance analysis tool-suite for x86 based applications";
+      homepage = "https://www.amd.com/es/developer/uprof.html";
+      platforms = [ "x86_64-linux" ];
+      license = lib.licenses.unfree;
+      maintainers = with lib.maintainers.bsc; [ rarias varcila ];
+    };
+
  }
--- a/pkgs/amd-uprof/driver.nix
+++ b/pkgs/amd-uprof/driver.nix
@@ -18,8 +18,9 @@ in stdenv.mkDerivation {
    set +x
  '';
  hardeningDisable = [ "pic" "format" ];
+  strictDeps = true;
  nativeBuildInputs = kernel.moduleBuildDependencies;
-  patches = [ ./makefile.patch ./hrtimer.patch ];
+  patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
  makeFlags = [
    "KERNEL_VERSION=${kernel.modDirVersion}"
    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
@@ -29,5 +30,7 @@ in stdenv.mkDerivation {
    description = "AMD Power Profiler Driver";
    homepage = "https://www.amd.com/es/developer/uprof.html";
    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers.bsc; [ rarias varcila ];
  };
 }
--- a/pkgs/amd-uprof/remove-wr-rdmsrq.patch
+++ b/pkgs/amd-uprof/remove-wr-rdmsrq.patch
@@ -0,0 +1,20 @@
+diff --git a/inc/PwrProfAsm.h b/inc/PwrProfAsm.h
+index d77770a..c93a0e9 100644
+--- a/inc/PwrProfAsm.h
+++ b/inc/PwrProfAsm.h
+@@ -347,6 +347,7 @@
+ 
+ #endif
+ 
+/*
+ #define rdmsrq(msr,val1,val2,val3,val4) ({ \
+         __asm__ __volatile__( \
+                               "rdmsr\n" \
+@@ -362,6 +363,7 @@
+                               :"c"(msr), "a"(val1), "d"(val2), "S"(val3), "D"(val4) \
+                             ); \
+     })
+*/
+ 
+ #define rdmsrpw(msr,val1,val2,val3,val4) ({ \
+         __asm__ __volatile__( \
--- a/pkgs/bench6/default.nix
+++ b/pkgs/bench6/default.nix
@@ -59,12 +59,13 @@ stdenv.mkDerivation rec {
  ];
  hardeningDisable = [ "all" ];
  dontStrip = true;
+  strictDeps = true;

  meta = {
    homepage = "https://gitlab.pm.bsc.es/rarias/bench6";
    description = "Set of micro-benchmarks for OmpSs-2 and several mini-apps";
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
  };
 }
--- a/pkgs/bigotes/default.nix
+++ b/pkgs/bigotes/default.nix
@@ -16,11 +16,13 @@ stdenv.mkDerivation {
  };
  nativeBuildInputs = [ cmake ];

+  strictDeps = true;
+
  meta = {
    homepage = "https://github.com/rodarima/bigotes";
    description = "Versatile benchmark tool";
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
  };
 }
--- a/pkgs/cudainfo/default.nix
+++ b/pkgs/cudainfo/default.nix
@@ -1,5 +1,6 @@
 {
  stdenv
+, lib
 , cudatoolkit
 , cudaPackages
 , autoAddDriverRunpath
@@ -9,11 +10,14 @@
 stdenv.mkDerivation (finalAttrs: {
  name = "cudainfo";
  src = ./.;
-  buildInputs = [
+  strictDeps = true;
+  nativeBuildInputs = [
    cudatoolkit # Required for nvcc
-    cudaPackages.cuda_cudart.static # Required for -lcudart_static
    autoAddDriverRunpath
  ];
+  buildInputs = [
+    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
+  ];
  installPhase = ''
    mkdir -p $out/bin
    cp -a cudainfo $out/bin
@@ -22,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
    name = "cudainfo-test";
    requiredSystemFeatures = [ "cuda" ];
    dontBuild = true;
+    strictDeps = true;
    nativeCheckInputs = [
      finalAttrs.finalPackage # The cudainfo package from above
      strace # When it fails, it will show the trace
@@ -40,4 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    installPhase = "touch $out";
  };
+
+  meta = {
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+  };
 })
--- a/pkgs/extrae/default.nix
+++ b/pkgs/extrae/default.nix
@@ -20,7 +20,7 @@
 #, python3Packages
 , installShellFiles
 , symlinkJoin
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 }:

 let
@@ -115,7 +115,8 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = "https://github.com/bsc-performance-tools/extrae";
    description = "Instrumentation framework to generate execution traces of the most used parallel runtimes";
-    maintainers = with lib.maintainers.bsc; [ rarias ];
+    maintainers = [ ];
+    broken = true;
    platforms = lib.platforms.linux;
    license = lib.licenses.lgpl21Plus;
  };
--- a/pkgs/gpi-2/default.nix
+++ b/pkgs/gpi-2/default.nix
@@ -9,7 +9,6 @@
 , automake
 , libtool
 , mpi
-, rsync
 , gfortran
 }:

@@ -34,6 +33,7 @@ stdenv.mkDerivation rec {
  };

  enableParallelBuilding = true;
+  strictDeps = true;

  patches = [ ./rdma-core.patch ./max-mem.patch ];

@@ -44,13 +44,24 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--with-infiniband=${rdma-core-all}"
-    "--with-mpi=${mpiAll}"
+    "--with-mpi=yes" # fixes mpi detection when cross-compiling
    "--with-slurm"
    "CFLAGS=-fPIC"
    "CXXFLAGS=-fPIC"
  ];

-  buildInputs = [ slurm mpiAll rdma-core-all autoconf automake libtool rsync gfortran ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    gfortran
+    libtool
+  ];
+
+  buildInputs = [
+    slurm
+    mpiAll
+    rdma-core-all
+  ];

  hardeningDisable = [ "all" ];

@@ -59,6 +70,7 @@ stdenv.mkDerivation rec {
    description = "GPI-2 extended for supporting Task-Aware GASPI (TAGASPI) library";
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
+    cross = false; # infiniband detection does not work
  };
 }
--- a/pkgs/intel-mpi/default.nix
+++ b/pkgs/intel-mpi/default.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation rec {

  meta = {
    homepage = "https://www.intel.com/content/www/us/en/developer/tools/overview.html";
-    description = "Intel compiler";
+    description = "Intel MPI";
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.unfree;
--- a/pkgs/intel-oneapi/2023.nix
+++ b/pkgs/intel-oneapi/2023.nix
@@ -10,7 +10,7 @@
 , zlib
 , autoPatchelfHook
 , libfabric
-, gcc13
+, gcc
 , wrapCCWith
 }:

@@ -33,8 +33,6 @@ let
    maintainers = with lib.maintainers.bsc; [ abonerib ];
  };

-  gcc = gcc13;
-
  v = {
    hpckit   = "2023.1.0";
    compiler = "2023.1.0";
@@ -130,6 +128,7 @@ let

    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
+    strictDeps = true;
    installPhase = ''
      mkdir -p $out/{bin,etc,lib,include}
      mkdir -p $out/share/man
@@ -181,6 +180,7 @@ let
    ];
    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
+    strictDeps = true;

    autoPatchelfIgnoreMissingDeps = [ "libhwloc.so.5" ];

@@ -224,6 +224,7 @@ let
    ];
    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
+    strictDeps = true;

    autoPatchelfIgnoreMissingDeps = [ "libsycl.so.6" ];

@@ -291,6 +292,7 @@ let
    phases = [ "installPhase" "fixupPhase" ];

    dontStrip = true;
+    strictDeps = true;

    installPhase = ''
      mkdir -p $out/{bin,lib,include}
@@ -379,6 +381,7 @@ let
    phases = [ "installPhase" "fixupPhase" ];

    dontStrip = true;
+    strictDeps = true;

    installPhase = ''
      mkdir -p $out/{bin,lib}
--- a/pkgs/llvm-ompss2/clang.nix
+++ b/pkgs/llvm-ompss2/clang.nix
@@ -1,9 +1,9 @@
 {
-  llvmPackages_latest
+  stdenv
+, llvmPackages_latest
 , lib
 , fetchFromGitHub
 , cmake
-, bash
 , python3
 , perl
 , which
@@ -11,24 +11,26 @@
 , libffi
 , zlib
 , pkg-config
-, gcc # needed to set the rpath of libstdc++ for clang-tblgen
 , enableDebug ? false
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/llvm-ompss/llvm-mono.git"
 , gitBranch ? "master"
-, gitCommit ? "880e2341c56bad1dc14e8c369fb3356bec19018e"
+, gitCommit ? "872ba63f86edaefc9787984ef3fae9f2f94e0124" # github-release-2025.11
 }:

 let
-  stdenv = llvmPackages_latest.stdenv;
+  llvmPackages = llvmPackages_latest;
+  llvmStdenv = llvmPackages.stdenv;
+  # needed to set the rpath of libstdc++ for clang-tblgen
+  gcc = stdenv.cc;

  release = rec {
-    version = "2025.06";
+    version = "2025.11";
    src = fetchFromGitHub {
      owner = "bsc-pm";
      repo = "llvm";
      rev = "refs/tags/github-release-${version}";
-      hash = "sha256-ww9PpRmtz/M9IyLiZ8rAehx2UW4VpQt+svf4XfKBzKo=";
+      hash = "sha256-UgwMTUkM9Z87dDH205swZFBeFhrcbLAxginViG40pBM=";
    };
  };

@@ -43,11 +45,12 @@ let

  source = if (useGit) then git else release;

-in stdenv.mkDerivation {
+in llvmStdenv.mkDerivation {
  pname = "clang-ompss2";
  inherit (source) src version;

  enableParallelBuilding = true;
+  strictDeps = true;

  passthru = {
    CC = "clang";
@@ -60,13 +63,12 @@ in stdenv.mkDerivation {
  };

  nativeBuildInputs = [
-    bash
    cmake
    elfutils
-    llvmPackages_latest.lld
+    llvmPackages.lld
+    perl
    pkg-config
    python3
-    perl
    which
    zlib
  ];
@@ -97,8 +99,13 @@ in stdenv.mkDerivation {
    cd build
    cmakeDir="../llvm"
    cmakeFlagsArray=(
-      "-DLLVM_HOST_TRIPLE=${stdenv.targetPlatform.config}"
+      "-DLLVM_HOST_TRIPLE=${llvmStdenv.targetPlatform.config}"
+    '' + (if "${llvmStdenv.targetPlatform.config}" == "riscv64-unknown-linux-gnu" then ''
+      "-DLLVM_DEFAULT_TARGET_TRIPLE=riscv64-unknown-linux-gnu"
+      "-DLLVM_TARGETS_TO_BUILD=RISCV"
+    '' else ''
      "-DLLVM_TARGETS_TO_BUILD=host"
+    '') + ''
      "-DLLVM_BUILD_LLVM_DYLIB=ON"
      "-DLLVM_LINK_LLVM_DYLIB=ON"
      # Required to run clang-ast-dump and clang-tblgen during build
@@ -107,7 +114,8 @@ in stdenv.mkDerivation {
      "-DCMAKE_CXX_FLAGS_DEBUG=-g -ggnu-pubnames"
      "-DCMAKE_EXE_LINKER_FLAGS_DEBUG=-Wl,--gdb-index"
      "-DLLVM_LIT_ARGS=-sv --xunit-xml-output=xunit.xml"
-      "-DLLVM_ENABLE_PROJECTS=clang;compiler-rt;lld"
+      "-DLLVM_ENABLE_PROJECTS=clang;lld"
+      "-DLLVM_ENABLE_RUNTIMES=compiler-rt"
      "-DLLVM_ENABLE_ASSERTIONS=ON"
      "-DLLVM_INSTALL_TOOLCHAIN_ONLY=ON"
      "-DCMAKE_INSTALL_BINDIR=bin"
@@ -126,4 +134,12 @@ in stdenv.mkDerivation {
 # nanos6 installation, but this is would require a recompilation of clang each
 # time nanos6 is changed. Better to use the environment variable NANOS6_HOME,
 # and specify nanos6 at run time.
+
+  meta = {
+    homepage = "https://gitlab.pm.bsc.es/llvm-ompss/llvm-mono";
+    description = "C language family frontend for LLVM (for OmpSs-2)";
+    maintainers = with lib.maintainers.bsc; [ rpenacob ];
+    platforms = lib.platforms.linux;
+    license = [ lib.licenses.asl20 lib.licenses.llvm-exception ];
+  };
 }
--- a/pkgs/llvm-ompss2/default.nix
+++ b/pkgs/llvm-ompss2/default.nix
@@ -3,44 +3,61 @@
 , lib
 , gcc
 , clangOmpss2Unwrapped
-, openmp ? null
+
+, openmp
+, useOpenmp  ? false
+, openmpv
+, useOpenmpV ? false
+, nanos6
+, useNanos6 ? false
+, nodes
+, useNodes ? false
+
 , wrapCCWith
 , llvmPackages_latest
-, ompss2rt ? null
 }:

 with lib;

 let
-  usingNodesAndOmpv = (openmp.pname == "openmp-v" && ompss2rt.pname == "nodes");
-  sameNosv = openmp.nosv == ompss2rt.nosv;
+  getSplice = target: pkg: if pkg ? "__spliced" && pkg.__spliced ? target then pkg.__spliced."${target}" else pkg;
+  getSpliceTargetTarget = getSplice "targetTarget";
+  omp = if useOpenmp then openmp else if useOpenmpV then openmpv else null;
+  ompss2rtUnspliced = if useNanos6 then nanos6 else if useNodes then nodes else null;
+  ompss2rt = getSpliceTargetTarget ompss2rtUnspliced;
+  usingNodesAndOmpv = omp != null && ompss2rt != null && (omp.pname == "openmp-v" && ompss2rt.pname == "nodes");
+  sameNosvUnspliced = omp != null && ompss2rtUnspliced != null && omp.nosv == ompss2rtUnspliced.nosv;
+  sameNosvSpliced = (getSpliceTargetTarget omp.nosv) == ompss2rt.nosv;
 in

-assert assertMsg (usingNodesAndOmpv -> sameNosv) "OpenMP-V and NODES must share the same nOS-V";
+assert assertMsg (usingNodesAndOmpv -> sameNosvUnspliced) "OpenMP-V and NODES must share the same nOS-V before splice";
+assert assertMsg (usingNodesAndOmpv -> sameNosvSpliced) "OpenMP-V and NODES must share the same nOS-V after splice";
+assert assertMsg (useOpenmp -> !useOpenmpV) "Either OpenMP or OpenMP-V may be enabled, but not both";
+assert assertMsg (useNanos6 -> !useNodes) "Either Nanos6 or NODES may be enabled, but not both";

 let
  homevar = if ompss2rt.pname == "nanos6" then "NANOS6_HOME" else "NODES_HOME";
  rtname  = if ompss2rt.pname == "nanos6" then "libnanos6" else "libnodes";
-  ompname = if openmp.pname == "openmp-v" then  "libompv" else "libomp";
+  ompname = if omp.pname == "openmp-v" then  "libompv" else "libomp";


  # We need to replace the lld linker from bintools with our linker just built,
  # otherwise we run into incompatibility issues when mixing compiler and linker
  # versions.
-  bintools-unwrapped = llvmPackages_latest.tools.bintools-unwrapped.override {
+  bintools-unwrapped = llvmPackages_latest.bintools-unwrapped.override {
    lld = clangOmpss2Unwrapped;
  };
-  bintools = llvmPackages_latest.tools.bintools.override {
+  bintools = llvmPackages_latest.bintools.override {
    bintools = bintools-unwrapped;
  };
  targetConfig = stdenv.targetPlatform.config;
  inherit gcc;
  cc = clangOmpss2Unwrapped;
  gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
-in wrapCCWith {
+in (wrapCCWith {
  inherit cc bintools;
  # extraPackages adds packages to depsTargetTargetPropagated
-  extraPackages = optional (openmp != null) openmp;
+  extraPackages = optional (omp != null) omp;
  extraBuildCommands = ''
    echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
    echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
@@ -56,15 +73,15 @@ in wrapCCWith {

    echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags

-    wrap clang++  $wrapper $ccPath/clang++
+    wrap ${targetConfig}clang++  $wrapper $ccPath/clang++
+    wrap ${targetConfig}clang    $wrapper $ccPath/clang

-  '' + optionalString (openmp != null) ''
+  '' + optionalString (omp != null) ''
    echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
  '' + optionalString (ompss2rt != null) ''
    echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
    echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
  '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
-    echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
+    echo "export NOSV_HOME=${ompss2rt}" >> $out/nix-support/cc-wrapper-hook
  '';
-}
-
+}).overrideAttrs (prev: { passthru = (prev.passthru or {}) // { inherit ompss2rt; }; })
--- a/pkgs/llvm-ompss2/openmp.nix
+++ b/pkgs/llvm-ompss2/openmp.nix
@@ -39,7 +39,9 @@ stdenv.mkDerivation rec {
    perl
    pkg-config
    python3
-  ] ++ lib.optionals enableNosv [
+  ];
+
+  buildInputs = lib.optionals enableNosv [
    nosv
  ] ++ lib.optionals enableOvni [
    ovni
@@ -54,6 +56,7 @@ stdenv.mkDerivation rec {
  dontStrip = enableDebug;

  separateDebugInfo = true;
+  strictDeps = true;

  cmakeFlags = [
    "-DLIBOMP_OMPD_SUPPORT=OFF"
@@ -71,8 +74,38 @@ stdenv.mkDerivation rec {
    rm -f $out/libllvmrt/libomp.*
  '';

+  doInstallCheck = true;
+  # There are not cmake flags to force nOS-V, it enables it when found through
+  # pkg-config. If enableNosv is set, but we fail to find it at build time,
+  # the build will succeed but won't use nOS-V (libompv won't be created).
+  # This is a sanity check to ensure that after install we have the proper
+  # files.
+  installCheckPhase =
+    if enableNosv then
+      ''
+        test -f $out/lib/libompv.so
+        test -f $out/libllvmrt/libompv.so
+        test ! -f $out/lib/libomp.so
+        test ! -f $out/libllvmrt/libomp.so
+      ''
+    else
+      ''
+        test -f $out/lib/libomp.so
+        test -f $out/libllvmrt/libomp.so
+        test ! -f $out/lib/libompv.so
+        test ! -f $out/libllvmrt/libompv.so
+      '';
+
  passthru = {
    inherit nosv;
  };
+
+  meta = {
+    homepage = "https://gitlab.pm.bsc.es/llvm-ompss/llvm-mono";
+    description = "Support for the OpenMP language (with nOS-V)";
+    maintainers = with lib.maintainers.bsc; [ rpenacob ];
+    platforms = lib.platforms.linux;
+    license = [ lib.licenses.asl20 lib.licenses.llvm-exception ];
+  };
 }

--- a/pkgs/lmbench/default.nix
+++ b/pkgs/lmbench/default.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
  hardeningDisable = [ "all" ];

  enableParallelBuilding = false;
+  strictDeps = true;

  preBuild = ''
    makeFlagsArray+=(
@@ -42,8 +43,9 @@ stdenv.mkDerivation rec {

  meta = {
    description = "lmbench";
-    homepage = "http://www.bitmover.com/lmbench/";
-    maintainers = [ ];
+    homepage = "https://github.com/intel/lmbench";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.all;
+    license = lib.licenses.gpl2Plus;
  };
 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3,4 +3,5 @@ builtins.mapAttrs (name: value: { email = name + "@bsc.es"; } // value) {
  arocanon.name = "Aleix Roca";
  rarias.name = "Rodrigo Arias";
  rpenacob.name = "Raúl Peñacoba";
+  varcila.name = "Vincent Arcila";
 }
--- a/pkgs/mcxx/default.nix
+++ b/pkgs/mcxx/default.nix
@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
  ];

  meta = {
+    broken = true;
    homepage = "https://github.com/bsc-pm/mcxx";
    description = "C/C++/Fortran source-to-source compilation infrastructure aimed at fast prototyping";
    maintainers = with lib.maintainers.bsc; [ rpenacob ];
--- a/pkgs/meteocat-exporter/default.nix
+++ b/pkgs/meteocat-exporter/default.nix
@@ -1,12 +1,15 @@
 { python3Packages, lib }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
  pname = "meteocat-exporter";
  version = "1.0";

+  pyproject = true;
+
  src = ./.;

  doCheck = false;
+  strictDeps = true;

  build-system = with python3Packages; [
    setuptools
--- a/pkgs/mpich/default.nix
+++ b/pkgs/mpich/default.nix
@@ -6,6 +6,13 @@
 , pmix
 , gfortran
 , symlinkJoin
+# Disabled when cross-compiling
+# To fix cross compilation, we should fill the values in:
+# https://github.com/pmodels/mpich/blob/main/maint/fcrosscompile/cross_values.txt.in
+# For each arch
+, enableFortran ? stdenv.hostPlatform == stdenv.buildPlatform
+, perl
+, targetPackages
 }:

 let
@@ -15,10 +22,13 @@ let
    paths = [ pmix.dev pmix.out ];
  };
 in mpich.overrideAttrs (old: {
-  buildInput = old.buildInputs ++ [
+  buildInputs = old.buildInputs ++ [
    libfabric
    pmixAll
  ];
+  nativeBuildInputs = old.nativeBuildInputs ++ [
+    perl
+  ];
  configureFlags = [
    "--enable-shared"
    "--enable-sharedlib"
@@ -31,10 +41,22 @@ in mpich.overrideAttrs (old: {
  ] ++ lib.optionals (lib.versionAtLeast gfortran.version "10") [
    "FFLAGS=-fallow-argument-mismatch" # https://github.com/pmodels/mpich/issues/4300
    "FCFLAGS=-fallow-argument-mismatch"
+  ] ++ lib.optionals (!enableFortran) [
+    "--disable-fortran"
  ];
+
+  preFixup = ''
+    sed -i 's:^CC=.*:CC=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}cc:' $out/bin/mpicc
+    sed -i 's:^CXX=.*:CXX=${targetPackages.stdenv.cc}/bin/${targetPackages.stdenv.cc.targetPrefix}c++:' $out/bin/mpicxx
+  '' + lib.optionalString enableFortran ''
+    sed -i 's:^FC=.*:FC=${targetPackages.gfortran or gfortran}/bin/${targetPackages.gfortran.targetPrefix or gfortran.targetPrefix}gfortran:' $out/bin/mpifort
+  '';
+
  hardeningDisable = [ "all" ];
+  strictDeps = true;

  meta = old.meta // {
    maintainers = old.meta.maintainers ++ (with lib.maintainers.bsc; [ rarias ]);
+    cross = true;
  };
 })
--- a/pkgs/nanos6/default.nix
+++ b/pkgs/nanos6/default.nix
@@ -16,7 +16,7 @@
 , jemallocNanos6 ? null
 , cachelineBytes ? 64
 , enableGlibcxxDebug ? false
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/nanos6/nanos6"
 , gitBranch ? "master"
@@ -80,7 +80,8 @@ in
      (optional enableGlibcxxDebug "CXXFLAGS=-D_GLIBCXX_DEBUG") ++
      # Most nanos6 api symbols are resolved at runtime, so prefer
      # ifunc by default
-      (optional isCross "--with-symbol-resolution=ifunc");
+      (optional isCross "--with-symbol-resolution=ifunc") ++
+      (optional enablePapi "--with-papi=${papi}");

    postConfigure = lib.optionalString (!enableDebug) ''
      # Disable debug
@@ -95,16 +96,14 @@ in
    dontStrip = enableDebug;
    separateDebugInfo = true;

+    strictDeps = true;
+
    nativeBuildInputs = [
      autoconf
      automake
      libtool
      pkg-config
-
-      # TODO: papi_version is needed for configure:
-      # ./configure: line 27378: papi_version: command not found
-      # This probably breaks cross-compilation
-    ] ++ lib.optionals enablePapi [ papi ];
+    ];

    buildInputs = [
      boost
@@ -124,7 +123,7 @@ in
      description = "Nanos6 runtime for OmpSs-2" +
        optionalString (enableDebug) " (with debug symbols)";
      maintainers = with lib.maintainers.bsc; [ rarias ];
-      platforms = lib.latforms.linux;
-      license = lib.licenses.gpl3;
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
    };
  })
--- a/pkgs/nix-wrap/default.nix
+++ b/pkgs/nix-wrap/default.nix
@@ -91,9 +91,10 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = null;
    description = "nix bubblewrap wrapper";
-    maintainers = with lib.maintainers.bsc; [ rarias ];
+    maintainers = [ ];
+    broken = true;
    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3Plus; # TODO: license?
+    license = lib.licenses.mit;
  };
 }

--- a/pkgs/nixgen/default.nix
+++ b/pkgs/nixgen/default.nix
@@ -0,0 +1,23 @@
+{
+  stdenv
+, lib
+}:
+
+stdenv.mkDerivation {
+  pname = "nixgen";
+  version = "0.0.1";
+  src = ./nixgen;
+  dontUnpack = true;
+  strictDeps = true;
+  phases = [ "installPhase" ];
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a $src $out/bin/nixgen
+  '';
+  meta = {
+    description = "Quickly generate flake.nix from command line";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl3Plus;
+  };
+}
--- a/pkgs/nixgen/nixgen
+++ b/pkgs/nixgen/nixgen
@@ -0,0 +1,97 @@
+#!/bin/sh
+#
+# Copyright (c) 2025, Barcelona Supercomputing Center (BSC)
+# SPDX-License-Identifier: GPL-3.0+
+# Author: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
+
+function usage() {
+  echo "USAGE: nixgen [-f] [package [...]] [-b package [...]]" >&2
+  echo "  Generates a flake.nix file with the given packages." >&2
+  echo "  After flake.nix is created, use 'nix develop' to enter the shell." >&2
+  echo "OPTIONS" >&2
+  echo "  -f               Overwrite existing flake.nix (default: no)." >&2
+  echo "  packages...      Add these packages to the shell." >&2
+  echo "  -b packages...   Add the dependencies needed to build these packages." >&2
+  echo "EXAMPLE" >&2
+  echo "  $ nixgen ovni bigotes -b nosv tampi" >&2
+  echo "  Adds the packages ovni and bigotes as well as all required dependencies" >&2
+  echo "  to build nosv and tampi." >&2
+  echo "AUTHOR" >&2
+  echo "  Rodrigo Arias Mallo <rodrigo.arias@bsc.es>" >&2
+  exit 1
+}
+
+mode=package
+packages=
+inputsFrom=
+force=
+
+if [[ $# -eq 0 ]]; then
+  usage
+fi
+
+while [[ $# -gt 0 ]]; do
+    case $1 in -b)
+      mode=build
+      shift
+      ;;
+    -f)
+      force=1
+      shift
+      ;;
+    -h)
+      usage
+      ;;
+    -*|--*)
+      echo "error: unknown option $1" >&2
+      exit 1
+      ;;
+    *)
+      if [ "$mode" == "package" ]; then
+        packages+="${packages:+ }$1"
+      else
+        inputsFrom+="${inputsFrom:+ }$1"
+      fi
+      shift
+      ;;
+  esac
+done
+
+if [ ! "$force" -a -e flake.nix ]; then
+  echo "error: flake.nix exists, force overwrite with -f" >&2
+  exit 1
+fi
+
+cat > flake.nix <<EOF
+{
+  inputs.jungle.url = "git+https://jungle.bsc.es/git/rarias/jungle";
+  outputs = { self, jungle }:
+  let
+    nixpkgs = jungle.inputs.nixpkgs;
+    customOverlay = (final: prev: {
+      # Example overlay, for now empty
+    });
+    pkgs = import nixpkgs {
+      system = "x86_64-linux";
+      overlays = [
+        # Apply jungle overlay to get our BSC custom packages
+        jungle.outputs.bscOverlay
+        # And on top apply our local changes to customize for cluster
+        customOverlay
+      ];
+    };
+  in {
+    devShells.x86_64-linux.default = pkgs.mkShell {
+      pname = "devshell";
+      # Include these packages in the shell
+      packages = with pkgs; [
+        $packages
+      ];
+      # The dependencies needed to build these packages will be also included
+      inputsFrom = with pkgs; [
+        $inputsFrom
+      ];
+    };
+  };
+}
+EOF
--- a/pkgs/nixtools/default.nix
+++ b/pkgs/nixtools/default.nix
@@ -16,12 +16,12 @@ stdenv.mkDerivation rec {
  makeFlags = [ "DESTDIR=$(out)" ];
  preBuild = "env";
  dontPatchShebangs = true;
+  strictDeps = true;

  meta = {
    homepage = "https://gitlab.pm.bsc.es/rarias/nixtools";
    description = "nix bubblewrap wrapper";
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3Plus; # TODO: license?
  };
 }
--- a/pkgs/nodes/default.nix
+++ b/pkgs/nodes/default.nix
@@ -3,7 +3,6 @@
 , lib
 , fetchFromGitHub
 , pkg-config
-, perl
 , numactl
 , hwloc
 , boost
@@ -11,22 +10,23 @@
 , ovni
 , nosv
 , clangOmpss2
+, which
 , useGit ? false
 , gitUrl ? "ssh://git@gitlab-internal.bsc.es/nos-v/nodes.git"
 , gitBranch ? "master"
-, gitCommit ? "6002ec9ae6eb876d962cc34366952a3b26599ba6"
+, gitCommit ? "511489e71504a44381e0930562e7ac80ac69a848" # version-1.4
 }:

 with lib;

 let
  release = rec {
-    version = "1.3";
+    version = "1.4";
    src = fetchFromGitHub {
      owner = "bsc-pm";
      repo = "nodes";
      rev = "version-${version}";
-      hash = "sha256-cFb9pxcjtkMmH0CsGgUO9LTdXDNh7MCqicgGWawLrsU=";
+      hash = "sha256-+lR/R0l3fGZO3XG7whMorFW2y2YZ0ZFnLeOHyQYrAsQ=";
    };
  };

@@ -48,6 +48,7 @@ in
    enableParallelBuilding = true;
    dontStrip = true;
    separateDebugInfo = true;
+    strictDeps = true;

    configureFlags = [
      "--with-nosv=${nosv}"
@@ -59,6 +60,7 @@ in
    doCheck = false;
    nativeCheckInputs = [
      clangOmpss2
+      which
    ];

    # The "bindnow" flags are incompatible with ifunc resolution mechanism. We
@@ -85,7 +87,7 @@ in
    meta = {
      homepage = "https://gitlab.bsc.es/nos-v/nodes";
      description = "Runtime library designed to work on top of the nOS-V runtime";
-      maintainers = with lib.maintainers.bsc; [ rarias ];
+      maintainers = with lib.maintainers.bsc; [ abonerib rarias ];
      platforms = lib.platforms.linux;
      license = lib.licenses.gpl3Plus;
    };
--- a/pkgs/nosv/default.nix
+++ b/pkgs/nosv/default.nix
@@ -7,25 +7,25 @@
 , numactl
 , hwloc
 , papi
-, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
+, enablePapi ? true
 , cacheline ? 64 # bits
 , ovni ? null
 , useGit ? false
 , gitUrl ? "git@gitlab-internal.bsc.es:nos-v/nos-v.git"
 , gitBranch ? "master"
-, gitCommit ? "9f47063873c3aa9d6a47482a82c5000a8c813dd8"
+, gitCommit ? "1108e4786b58e0feb9a16fa093010b763eb2f8e8" # version 4.0.0
 }:

 with lib;

 let
  release = rec {
-    version = "3.2.0";
+    version = "4.0.0";
    src = fetchFromGitHub {
      owner = "bsc-pm";
      repo = "nos-v";
      rev = "${version}";
-      hash = "sha256-yaz92426EM8trdkBJlISmAoG9KJCDTvoAW/HKrasvOw=";
+      hash = "sha256-llaq73bd/YxLVKNlMebnUHKa4z3sdcsuDUoVwUxNuw8=";
    };
  };

@@ -40,16 +40,17 @@ let

  source = if (useGit) then git else release;
 in
-  stdenv.mkDerivation rec {
+  stdenv.mkDerivation {
    pname = "nosv";
    inherit (source) src version;
    hardeningDisable = [ "all" ];
    dontStrip = true;
    separateDebugInfo = true;
+    strictDeps = true;
    configureFlags = [
      "--with-ovni=${ovni}"
      "CACHELINE_WIDTH=${toString cacheline}"
-    ];
+    ] ++ lib.optionals enablePapi [ "--with-papi=${papi}" ];
    nativeBuildInputs = [
      autoreconfHook
      pkg-config
@@ -59,11 +60,12 @@ in
      hwloc
      ovni
    ] ++ lib.optionals enablePapi [ papi ];
+    patches = [ ./fix-papi.patch ];

    meta = {
      homepage = "https://gitlab.bsc.es/nos-v/nos-v";
      description = "Tasking library enables the co-execution of multiple applications with system-wide scheduling and a centralized management of resources";
-      maintainers = with lib.maintainers.bsc; [ abonerib ];
+      maintainers = with lib.maintainers.bsc; [ abonerib rarias ];
      platforms = lib.platforms.linux;
      license = lib.licenses.gpl3Plus;
    };
--- a/pkgs/nosv/fix-papi.patch
+++ b/pkgs/nosv/fix-papi.patch
@@ -0,0 +1,136 @@
+Commit ID: c09633f172ce4075e0a05a33f6dcbe8e03e1202a
+Change ID: onmwypnnrysktutwsvotqovzponvwrxs
+Bookmarks: fix/papi fix/papi@git fix/papi@origin
+Author   : Aleix Boné <aleix.boneribo@bsc.es> (2025-12-10 11:14:14)
+Committer: Aleix Boné <aleix.boneribo@bsc.es> (2025-12-12 12:56:48)
+
+    Improve PAPI m4 module for cross compilation
+
+diff --git a/m4/papi.m4 b/m4/papi.m4
+index de90584870..8398f856f5 100644
+--- a/m4/papi.m4
+++ b/m4/papi.m4
+@@ -1,6 +1,6 @@
+ #	This file is part of Nanos6 and is licensed under the terms contained in the COPYING file.
+ #
+-#	Copyright (C) 2021-2022 Barcelona Supercomputing Center (BSC)
+#	Copyright (C) 2021-2025 Barcelona Supercomputing Center (BSC)
+ 
+ AC_DEFUN([AC_CHECK_PAPI],
+ 	[
+@@ -8,34 +8,38 @@
+ 			[papi],
+ 			[AS_HELP_STRING([--with-papi=prefix], [specify the installation prefix of PAPI])],
+ 			[ ac_cv_use_papi_prefix=$withval ],
+-			[ ac_cv_use_papi_prefix="" ]
+			[ ac_cv_use_papi_prefix="check" ]
+ 		)
+ 
+ 		if test x"${ac_cv_use_papi_prefix}" = x"no"; then
+ 			AC_MSG_CHECKING([the PAPI installation prefix])
+ 			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+ 			ac_use_papi=no
+-		elif test x"${ac_cv_use_papi_prefix}" != x"" ; then
+-			AC_MSG_CHECKING([the PAPI installation prefix])
+-			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+-			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
+-			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
+-			ac_use_papi=yes
+-		else
+		elif test x"${ac_cv_use_papi_prefix}" = x""; then
+			AC_MSG_RESULT([invalid prefix])
+			AC_MSG_ERROR([papi prefix specified but empty])
+		elif test x"${ac_cv_use_papi_prefix}" = x"yes" -o x"${ac_cv_use_papi_prefix}" = x"check"; then
+ 			PKG_CHECK_MODULES(
+ 				[papi],
+-				[papi],
+				[papi >= 5.6.0],
+ 				[
+ 					AC_MSG_CHECKING([the PAPI installation prefix])
+ 					AC_MSG_RESULT([retrieved from pkg-config])
+ 					papi_CFLAGS="${papi_CFLAGS}"
+ 					ac_use_papi=yes
+					ac_papi_version_correct=yes
+ 				], [
+ 					AC_MSG_CHECKING([the PAPI installation prefix])
+ 					AC_MSG_RESULT([not available])
+ 					ac_use_papi=no
+ 				]
+ 			)
+		else
+			AC_MSG_CHECKING([the PAPI installation prefix])
+			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
+			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
+			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
+			ac_use_papi=yes
+ 		fi
+ 
+ 		if test x"${ac_use_papi}" = x"yes" ; then
+@@ -53,10 +57,10 @@
+ 					ac_use_papi=yes
+ 				],
+ 				[
+-					if test x"${ac_cv_use_papi_prefix}" != x"" ; then
+-						AC_MSG_ERROR([PAPI cannot be found.])
+					if test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
+						AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
+ 					else
+-						AC_MSG_WARN([PAPI cannot be found.])
+						AC_MSG_WARN([PAPI >= 5.6.0 not available.])
+ 					fi
+ 					ac_use_papi=no
+ 				]
+@@ -64,30 +68,38 @@
+ 
+ 			CFLAGS="${ac_save_CFLAGS}"
+ 			LIBS="${ac_save_LIBS}"
+		elif test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
+			AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
+ 		fi
+ 
+-		if test x"${ac_use_papi}" = x"yes" ; then
+-			if test x"${ac_cv_use_papi_prefix}" != x"" ; then
+		if test x"${ac_use_papi}" = x"yes" -a x"${ac_papi_version_correct}" != x"yes" ; then
+			if test x"${ac_cv_use_papi_prefix}" != x"yes" -a x"${ac_cv_use_papi_prefix}" != x"check" ; then
+ 				papiBinary=${ac_cv_use_papi_prefix}/bin/papi_version
+ 			else
+ 				papiBinary=papi_version
+ 			fi
+-			papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
+ 
+-			AX_COMPARE_VERSION(
+-				[[${papiVersion}]],
+-				[[ge]],
+-				[[5.6.0]],
+-				[[ac_papi_version_correct=yes]],
+-				[[ac_papi_version_correct=no]]
+-			)
+ 
+-			if test x"${ac_papi_version_correct}" != x"yes" ; then
+-				AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
+-				ac_use_papi=no
+			if test x"$cross_compiling" = x"yes" ; then
+				AC_MSG_WARN([Cross-compiling detected, skipping PAPI version check])
+ 			else
+-				AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
+-				AC_MSG_RESULT([${ac_papi_version_correct}])
+				papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
+
+				AX_COMPARE_VERSION(
+					[[${papiVersion}]],
+					[[ge]],
+					[[5.6.0]],
+					[[ac_papi_version_correct=yes]],
+					[[ac_papi_version_correct=no]]
+				)
+
+				if test x"${ac_papi_version_correct}" != x"yes" ; then
+					AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
+					ac_use_papi=no
+				else
+					AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
+					AC_MSG_RESULT([${ac_papi_version_correct}])
+				fi
+ 			fi
+ 		fi
+ 
--- a/pkgs/osu/default.nix
+++ b/pkgs/osu/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {

  doCheck = true;
  enableParallelBuilding = true;
+  strictDeps = true;
  nativeBuildInputs = [ mpiAll ];
  buildInputs = [ mpiAll ];
  hardeningDisable = [ "all" ];
@@ -32,6 +33,11 @@ stdenv.mkDerivation rec {
      "CXX=mpicxx"
  ];

+  env = {
+    MPICH_CC="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc";
+    MPICH_CXX="${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++";
+  };
+
  postInstall = ''
    mkdir -p $out/bin
    for f in $(find $out -executable -type f); do
@@ -44,5 +50,6 @@ stdenv.mkDerivation rec {
    homepage = "http://mvapich.cse.ohio-state.edu/benchmarks/";
    maintainers = [ ];
    platforms = lib.platforms.all;
+    cross = true;
  };
 }
--- a/pkgs/ovni/default.nix
+++ b/pkgs/ovni/default.nix
@@ -7,7 +7,7 @@
 , useGit ? false
 , gitBranch ? "master"
 , gitUrl ? "ssh://git@bscpm04.bsc.es/rarias/ovni.git"
-, gitCommit ? "e4f62382076f0cf0b1d08175cf57cc0bc51abc61"
+, gitCommit ? "06432668f346c8bdc1006fabc23e94ccb81b0d8b" # version 1.13.0
 , enableDebug ? false
 # Only enable MPI if the build is native (fails on cross-compilation)
 , useMpi ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform)
@@ -15,13 +15,13 @@

 let
  release = rec {
-    version = "1.12.0";
+    version = "1.13.0";
    src = fetchFromGitHub {
      owner = "bsc-pm";
      repo = "ovni";
      rev = "${version}";
-      hash = "sha256-H04JvsVKrdqr3ON7JhU0g17jjlg/jzQ7eTfx9vUNd3E=";
-    } // { shortRev = "a73afcf"; };
+      hash = "sha256-0l2ryIyWNiZqeYdVlnj/WnQGS3xFCY4ICG8JedX424w=";
+    } // { shortRev = "0643266"; };
  };

  git = rec {
@@ -40,6 +40,7 @@ in
    inherit (source) src version;
    dontStrip = true;
    separateDebugInfo = true;
+    strictDeps = true;
    postPatch = ''
      patchShebangs --build test/
    '';
@@ -62,5 +63,6 @@ in
      maintainers = with lib.maintainers.bsc; [ rarias ];
      platforms = lib.platforms.linux;
      license = lib.licenses.gpl3Plus;
+      cross = true;
    };
  }
--- a/pkgs/papi/default.nix
+++ b/pkgs/papi/default.nix
@@ -0,0 +1,22 @@
+{
+  stdenv,
+  papi,
+}:
+
+if stdenv.hostPlatform == stdenv.buildPlatform then
+  papi
+else
+  papi.overrideAttrs (old: {
+    configureFlags = (old.configureFlags or [ ]) ++ [
+      "--enable-perf_event_uncore=no"
+      "--with-sysdetect=no"
+      "--with-ffsll"
+      "--with-tls=__thread"
+      "--with-virtualtimer=clock_thread_cputime_id"
+      "--with-walltimer=clock_realtime"
+      "--with-perf-events"
+      "--with-CPU=${stdenv.hostPlatform.uname.processor}"
+      "--with-arch=${stdenv.hostPlatform.uname.processor}"
+    ];
+    patches = (old.patches or [ ]) ++ [ ./fix-ar-cross.patch ];
+  })
--- a/pkgs/papi/fix-ar-cross.patch
+++ b/pkgs/papi/fix-ar-cross.patch
@@ -0,0 +1,19 @@
+diff --git a/sde_lib/Makefile b/sde_lib/Makefile
+index 8518f92..90a9953 100644
+--- a/sde_lib/Makefile
+++ b/sde_lib/Makefile
+@@ -1,4 +1,5 @@
+ CC ?= gcc
+AR ?= ar
+ SDE_INC = -I. -I..
+ SDE_LD = -ldl -pthread
+ CFLAGS += -Wextra -Wall -O2
+@@ -18,7 +19,7 @@ dynamic: $(DOBJS)
+ 	rm -f *_d.o
+ 
+ static: $(SOBJS)
+-	ar rs libsde.a $(SOBJS)
+	$(AR) rs libsde.a $(SOBJS)
+ 	rm -f *_s.o
+ 
+ clean:
--- a/pkgs/paraver/default.nix
+++ b/pkgs/paraver/default.nix
@@ -12,7 +12,7 @@
 , paraverKernel
 , openssl
 , glibcLocales
-, wrapGAppsHook
+, wrapGAppsHook3
 }:

 let
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {

  dontStrip = true;
  enableParallelBuilding = true;
+  strictDeps = true;

  preConfigure = ''
    export CFLAGS="-O3"
@@ -64,7 +65,7 @@ stdenv.mkDerivation rec {
    autoconf
    automake
    autoreconfHook
-    wrapGAppsHook
+    wrapGAppsHook3
  ];

  buildInputs = [
@@ -91,8 +92,14 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage = "https://github.com/bsc-performance-tools/wxparaver";
-    description = "Trace-based visualization and analysis tool designed to study quantitative detailed metrics and obtain qualitative knowledge of the performance of applications, libraries, processors and whole architectures";
+    homepage = "https://tools.bsc.es/paraver";
+    downloadPage = "https://github.com/bsc-performance-tools/wxparaver";
+    description = "Performance analyzer based on event traces";
+    longDescription = ''
+      Trace-based visualization and analysis tool designed to study quantitative
+      detailed metrics and obtain qualitative knowledge of the performance of
+      applications, libraries, processors and whole architectures
+    '';
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.lgpl21Plus;
--- a/pkgs/paraver/kernel.nix
+++ b/pkgs/paraver/kernel.nix
@@ -1,5 +1,6 @@
 {
  stdenv
+, lib
 , fetchFromGitHub
 , autoreconfHook
 , boost
@@ -33,6 +34,7 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  dontStrip = true;
+  strictDeps = true;

  preConfigure = ''
    export CFLAGS="-O3 -DPARALLEL_ENABLED"
@@ -57,4 +59,13 @@ stdenv.mkDerivation rec {
    xml2
    zlib
  ];
+
+  meta = {
+    homepage = "https://tools.bsc.es/paraver";
+    downloadPage = "https://github.com/bsc-performance-tools/paraver-kernel";
+    description = "Kernel library used by wxparaver";
+    maintainers = with lib.maintainers.bsc; [ rarias ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl21Plus;
+  };
 }
--- a/pkgs/slurm-exporter/default.nix
+++ b/pkgs/slurm-exporter/default.nix
@@ -13,6 +13,7 @@ buildGoModule rec {

  vendorHash = "sha256-A1dd9T9SIEHDCiVT2UwV6T02BSLh9ej6LC/2l54hgwI=";
  doCheck = false;
+  strictDeps = true;

  meta = with lib; {
    description = "Prometheus SLURM Exporter";
--- a/pkgs/sonar/default.nix
+++ b/pkgs/sonar/default.nix
@@ -18,6 +18,7 @@ stdenv.mkDerivation rec {
  };
  hardeningDisable = [ "all" ];
  dontStrip = true;
+  strictDeps = true;
  configureFlags = [ "--with-ovni=${ovni}" ];

  nativeBuildInputs = [
@@ -35,5 +36,6 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.mit;
+    cross = true;
  };
 }
--- a/pkgs/tagaspi/default.nix
+++ b/pkgs/tagaspi/default.nix
@@ -5,27 +5,19 @@
 , automake
 , autoconf
 , libtool
-, mpi
 , autoreconfHook
 , gpi-2
 , boost
 , numactl
 , rdma-core
 , gfortran
-, symlinkJoin
 }:

-let
-  mpiAll = symlinkJoin {
-    name = "mpi-all";
-    paths = [ mpi.all ];
-  };
-in
-
 stdenv.mkDerivation rec {
  pname = "tagaspi";
  enableParallelBuilding = true;
  separateDebugInfo = true;
+  strictDeps = true;

  version = "2.0";
  src = fetchFromGitHub {
@@ -35,16 +27,18 @@ stdenv.mkDerivation rec {
    hash = "sha256-RGG/Re2uM293HduZfGzKUWioDtwnSYYdfeG9pVrX9EM=";
  };

-  buildInputs = [
+  nativeBuildInputs = [
    autoreconfHook
    automake
    autoconf
    libtool
+    gfortran
+  ];
+
+  buildInputs = [
    boost
    numactl
    rdma-core
-    gfortran
-    mpiAll
  ];

  dontDisableStatic = true;
@@ -63,5 +57,6 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl3Plus;
+    cross = false; # gpi-2 cannot cross
  };
 }
--- a/pkgs/tampi/default.nix
+++ b/pkgs/tampi/default.nix
@@ -45,6 +45,7 @@ in stdenv.mkDerivation {
  inherit (source) src version;
  enableParallelBuilding = true;
  separateDebugInfo = true;
+  strictDeps = true;

  nativeBuildInputs = [
    autoconf
@@ -68,5 +69,6 @@ in stdenv.mkDerivation {
    maintainers = with lib.maintainers.bsc; [ rarias ];
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl3Plus;
+    cross = true;
  };
 }
--- a/pkgs/upc-qaire-exporter/default.nix
+++ b/pkgs/upc-qaire-exporter/default.nix
@@ -1,12 +1,15 @@
 { python3Packages, lib }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
  pname = "upc-qaire-exporter";
  version = "1.0";

+  pyproject = true;
+
  src = ./.;

  doCheck = false;
+  strictDeps = true;

  build-system = with python3Packages; [
    setuptools
--- a/test/compilers/clang-openmp-ld.nix
+++ b/test/compilers/clang-openmp-ld.nix
@@ -23,9 +23,6 @@ in stdenv.mkDerivation {
  dontUnpack = true;
  dontConfigure = true;

-  # nOS-V requires access to /sys/devices to request NUMA information
-  requiredSystemFeatures = [ "sys-devices" ];
-
  buildInputs = [ openmp ];

  buildPhase = ''
Author	SHA1	Message	Date
Aleix Roca Nonell	9c6f2e0097	Do not force derviation inputs, use booleans instead Some checks failed CI / build:cross (pull_request) Successful in 8s Details CI / build:all (pull_request) Failing after 35m38s Details	2026-01-21 15:16:06 +01:00
Aleix Roca Nonell	61ed93c951	Add ompss2rt to wrapper passthru Some checks failed CI / build:cross (pull_request) Successful in 8s Details CI / build:all (pull_request) Failing after 44m56s Details	2026-01-21 12:46:24 +01:00
Aleix Roca Nonell	7d02658e44	Use explicit splicing in clang wrapper	2026-01-21 12:46:24 +01:00
Aleix Roca Nonell	06aa1fc5d4	Fix clang cross-build	2026-01-21 12:46:24 +01:00
Aleix Boné	1178574891	Add install check for OpenMP{,-V}	2026-01-21 12:46:24 +01:00
Aleix Boné	5a4e9ae48a	Fix openmp buildInputs	2026-01-21 12:46:23 +01:00
Aleix Boné	15ebb94645	Remove unused sys-devices requirement in ld test	2026-01-21 12:46:23 +01:00
Aleix Boné	ada96f349c	Enable papi when cross-compiling	2026-01-21 12:46:23 +01:00
Aleix Boné	1427e357f5	Fix papi cross compilation	2026-01-21 12:46:23 +01:00
Aleix Boné	435699357d	Use pkg-config instead of papi_version_check	2026-01-21 12:46:23 +01:00
Aleix Boné	a238824ff1	Fix cudainfo buildInputs	2026-01-21 12:46:23 +01:00
Aleix Boné	de6124f8ca	Set strictDeps to true on all our packages	2026-01-21 12:46:22 +01:00
Rodrigo Arias Mallo	dda6a66782	Fix gitea user to allow sending email All checks were successful CI / build:cross (pull_request) Successful in 8s Details CI / build:all (pull_request) Successful in 16s Details CI / build:all (push) Successful in 4s Details CI / build:cross (push) Successful in 8s Details In order to send email, the gitea user needs to be in the mail-robot group. Fixes: #220 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-20 12:18:52 +01:00
Rodrigo Arias Mallo	22420e6ac8	Remove unneeded perf package from eudy It is already included in the base list of packages, which is now only "perf" and doesn't depend on the kernel version. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-20 12:18:49 +01:00
Rodrigo Arias Mallo	a71cd78b4c	Fix infiniband interface names Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-20 12:18:46 +01:00
Rodrigo Arias Mallo	e84a2cadbb	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/8bb5646e0bed5dbd3ab08c7a7cc15b75ab4e1d0f?narHash=sha256-SqUuBFjhl/kpDiVaKLQBoD8TLD%2B/cTUzzgVFoaHrkqY%3D' (2025-11-30) → 'github:NixOS/nixpkgs/3c9db02515ef1d9b6b709fc60ba9a540957f661c?narHash=sha256-2GffSfQxe3sedHzK%2BsTKlYo/NTIAGzbFCIsNMUPAAnk%3D' (2026-01-05) Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-20 12:18:41 +01:00
Aleix Boné	d3e43eb651	Remove conflicting definitions in amd-uprof-driver See: https://lkml.org/lkml/2025/4/9/1709 Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:15:18 +01:00
Aleix Boné	a491546ffb	Mark mcxx as broken and remove from package list Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:15:14 +01:00
Aleix Boné	933c78a80b	Fix moved package linuxPackages.perf is now perf Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:15:10 +01:00
Aleix Boné	150969be9b	Fix replaced nixseparatedebuginfod nixseparatedebuginfod has been replaced by nixseparatedebuginfod2 Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:15:06 +01:00
Aleix Boné	9097729759	Use standard gcc for intel packages This reverts `26f52aa27d` Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:15:02 +01:00
Aleix Boné	779449f1db	Fix renamed option watchdog.runtimeTime The option 'systemd.watchdog.runtimeTime' has been renamed to 'systemd.settings.Manager.RuntimeWatchdogSec'. Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:14:59 +01:00
Aleix Boné	6cbe33bd80	Replace wrapGAppsHook with wrapGAppsHook3 Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:14:56 +01:00
Aleix Boné	3f1f5ae8f2	Fix changed cudaPackages.cuda_cudart output See: https://github.com/NixOS/nixpkgs/pull/437723 Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:14:49 +01:00
Aleix Boné	fe8586e780	Set pyproject=true in buildPythonApplication The buildPythonPackage and buildPythonApplication functions now require an explicit format attribute. Previously the default format used setuptools and called setup.py from the source tree, which is deprecated. The modern alternative is to configure pyproject = true with build-system = [ setuptools ]. Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:14:31 +01:00
Aleix Boné	8677adba27	Fix renamed llvm bintools Moved from llvmPackages_latest.tools.bintools to llvmPackages_latest.bintools Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:14:27 +01:00
Aleix Boné	f614149edf	Upgrade nixpkgs to 25.11 Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-20 12:14:11 +01:00
Vincent A. Arcila	859eebda98	Change varcila shell to zsh All checks were successful CI / build:all (push) Successful in 59m37s Details CI / build:cross (push) Successful in 1h27m33s Details CI / build:cross (pull_request) Successful in 1h29m20s Details CI / build:all (pull_request) Successful in 1h29m22s Details Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2026-01-07 13:22:17 +01:00
Rodrigo Arias Mallo	c2a201b085	Increase fail2ban ban time on each attempt Some checks failed CI / build:all (push) Has been cancelled Details CI / build:cross (push) Has been cancelled Details CI / build:all (pull_request) Successful in 1h38m5s Details CI / build:cross (pull_request) Successful in 1h38m3s Details Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-07 13:14:34 +01:00
Rodrigo Arias Mallo	f921f0a4bd	Disable password login via SSH in apex Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-07 13:14:30 +01:00
Rodrigo Arias Mallo	aa16bfc0bc	Enable fail2ban in apex login node We are seeing a lot of failed attempts from the same IPs: apex% sudo journalctl -u sshd -b0 \| grep 'Failed password' \| wc -l 2441 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2026-01-07 13:14:22 +01:00
Aleix Boné	a173af654f	Fix osu cross-compilation All checks were successful CI / build:cross (pull_request) Successful in 12s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 12s Details Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Aleix Boné	2fff7e4a7b	Set mpich default compilers from targetPackages Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Aleix Boné	a761b73336	Enable meta.cross for mpich related packages Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Aleix Boné	86eb796771	Disable meta.cross for gpi-2 and tagaspi Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Aleix Boné	08633435cf	Fix nativeBuildInputs for tagaspi Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Aleix Boné	39d64456a4	Fix nativeBuildInputs for gpi-2 Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Aleix Boné	410040a4a0	Fix mpich cross compilation (disable fortran) Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 16:23:46 +01:00
Rodrigo Arias Mallo	fc69ef3217	Enable pam_slurm_adopt in all compute nodes All checks were successful CI / build:cross (pull_request) Successful in 5s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 6s Details Prevents access to owl1 and owl2 too if the user doesn't have any jobs running there. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-31 11:41:50 +01:00
Rodrigo Arias Mallo	1d025f7a38	Don't suspend owl compute nodes Currently the owl nodes are located on top of the rack and turning them off causes a high temperature increase at that region, which accumulates heat from the whole rack. To maximize airflow we will leave them on at all times. This also makes allocations immediate at the extra cost of around 200 W. In the future, if we include more nodes in SLURM we can configure those to turn off if needed. Fixes: #156 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-31 11:41:44 +01:00
Aleix Boné	7989779c8f	Filter out packages by platform from crossSet All checks were successful CI / build:cross (pull_request) Successful in 5s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 6s Details CI / build:cross (push) Successful in 8s Details Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es> Tested-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 11:21:13 +01:00
Aleix Boné	7d721084a7	Add meta to cudainfo Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 11:20:01 +01:00
Aleix Boné	796d34a549	Set amd-uprof platforms to x86_64-linux only Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-31 11:19:57 +01:00
Rodrigo Arias Mallo	5ff1b1343b	Add nixgen to all machines All checks were successful CI / build:cross (pull_request) Successful in 5s Details CI / build:all (pull_request) Successful in 16s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 5s Details Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-29 16:28:05 +01:00
Rodrigo Arias Mallo	c5cc13fad8	Add nixgen package Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-29 16:27:56 +01:00
Rodrigo Arias Mallo	2e09314a7e	Update OmpSs-2 LLVM to 2025.11 All checks were successful CI / build:cross (pull_request) Successful in 9s Details CI / build:all (pull_request) Successful in 3m34s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 5s Details Reviewed-by: Aleix Boné <abonerib@bsc.es> Tested-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-29 16:22:57 +01:00
Rodrigo Arias Mallo	217d9c1fc0	Update NODES to 1.4 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-29 16:21:46 +01:00
Rodrigo Arias Mallo	f47ab7757e	Update nOS-V to 4.0.0 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-29 16:21:43 +01:00
Rodrigo Arias Mallo	4b265c071e	Update ovni to 1.13.0 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-29 16:21:32 +01:00
Rodrigo Arias Mallo	019826d09e	Add OmpSs-2 release timers and services All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 4s Details CI / build:cross (push) Successful in 6s Details Send a reminder email to the STAR group to mark the release cycle dates. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-28 12:38:37 +01:00
Rodrigo Arias Mallo	a294daf7e3	Use specific mail-robot group to send mail Allows any user to be able to send mail from the robot account as long as it is added to the mail-robot group. Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-28 12:38:17 +01:00
Rodrigo Arias Mallo	a7018250ca	Add missing slurm package to overlay All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 4s Details CI / build:cross (push) Successful in 6s Details Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-28 11:44:40 +01:00
Rodrigo Arias Mallo	e3d1785285	Run a shell in the allocated node with salloc By default, salloc will open a new shell in the current node instead of in the allocated node. This often causes users to leave the extra shell running once the allocation ends. Repeating this process several times causes chains of shells. By running the shell in the remote node, once the allocation ends the shell finishes as well. Fixes: #174 See: https://slurm.schedmd.com/faq.html#prompt Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-28 11:44:14 +01:00
Aleix Boné	ab86243a07	Add missing which in nodes checkPhase All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 16s Details CI / build:all (push) Successful in 4s Details CI / build:cross (push) Successful in 6s Details When enabling checks, the build log is polluted with errors. Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es> Tested-by: Aleix Boné <abonerib@bsc.es>	2025-10-23 15:59:21 +02:00
Rodrigo Arias Mallo	14f2393d30	Update website All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 4s Details CI / build:cross (push) Successful in 6s Details Add apex page and replace bscpkgs references for jungle after the merge. See: rarias/jungle-website#1 Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-22 15:48:13 +02:00
Rodrigo Arias Mallo	f115d611e7	Add aaguirre user All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 6s Details Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-22 15:28:29 +02:00
Rodrigo Arias Mallo	4261d327c6	Include agenix module and package directly All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 4s Details CI / build:cross (push) Successful in 6s Details Avoids adding an extra flake input only to fetch a single module and package. Reviewed-by: Aleix Boné <abonerib@bsc.es> Tested-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-14 09:37:47 +02:00
Aleix Boné	4685c36e2f	Add brief documentation on maintainer roles All checks were successful CI / build:cross (pull_request) Successful in 6s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 6s Details Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es> Tested-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-10 16:37:00 +02:00
Aleix Boné	c6c788f1e2	Add meta to packages Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-10 16:36:56 +02:00
Aleix Boné	606386d006	Add maintainers Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-10 16:36:38 +02:00
Rodrigo Arias Mallo	1fba0a14a8	Enable ovni for cross compilation All checks were successful CI / build:cross (pull_request) Successful in 5s Details CI / build:all (pull_request) Successful in 15s Details CI / build:all (push) Successful in 3s Details CI / build:cross (push) Successful in 6s Details Reviewed-by: Aleix Boné <abonerib@bsc.es> Tested-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>	2025-10-10 12:08:28 +02:00
Rodrigo Arias Mallo	d6621e939a	Add RISC-V cross-compilation target for CI Reviewed-by: Aleix Boné <abonerib@bsc.es>	2025-10-10 12:08:24 +02:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH`