flake.nix

@@ -135,13 +135,7 @@
           inherit (self.checks.${system}.pre-commit) shellHook;
         };
 
-        packages =
-          let
-            packages = import ./pkgs { inherit pkgs; };
-            isSystem = pkg: builtins.elem system pkg.meta.platforms;
-            finalPackages = lib.flip lib.filterAttrs packages (_: isSystem);
-          in
-          finalPackages;
+        packages = import ./pkgs { inherit pkgs; };
       }) // {
       overlay = self.overlays.pkgs;
 

home/secrets/default.nix

@@ -2,17 +2,13 @@
 
 with lib;
 let
-  throwOnCanary =
-    let
-      canaryHash = builtins.hashFile "sha256" ./canary;
-      expectedHash =
-        "9df8c065663197b5a1095122d48e140d3677d860343256abd5ab6e4fb4c696ab";
-    in
-    if canaryHash != expectedHash
-    then throw "Secrets are not readable. Have you run `git-crypt unlock`?"
-    else id;
+  canaryHash = builtins.hashFile "sha256" ./canary;
+  expectedHash =
+    "9df8c065663197b5a1095122d48e140d3677d860343256abd5ab6e4fb4c696ab";
 in
-throwOnCanary {
+if canaryHash != expectedHash then
+  abort "Secrets are not readable. Have you run `git-crypt unlock`?"
+else {
   options.my.secrets = mkOption {
     type = types.attrs;
   };

pkgs/bw-pass/default.nix

@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation rec {
     description = "A simple script to query a password from bitwarden";
     homepage = "https://gitea.belanyi.fr/ambroisie/nix-config";
     license = with licenses; [ mit ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ ambroisie ];
   };
 }

secrets/default.nix

@@ -1,18 +1,14 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 with lib;
 let
-  throwOnCanary =
-    let
-      canaryHash = builtins.hashFile "sha256" ./canary;
-      expectedHash =
-        "9df8c065663197b5a1095122d48e140d3677d860343256abd5ab6e4fb4c696ab";
-    in
-    if canaryHash != expectedHash
-    then throw "Secrets are not readable. Have you run `git-crypt unlock`?"
-    else id;
+  canaryHash = builtins.hashFile "sha256" ./canary;
+  expectedHash =
+    "9df8c065663197b5a1095122d48e140d3677d860343256abd5ab6e4fb4c696ab";
 in
-throwOnCanary {
+if canaryHash != expectedHash then
+  abort "Secrets are not readable. Have you run `git-crypt unlock`?"
+else {
   options.my.secrets = mkOption {
     type = types.attrs;
   };
@@ -54,6 +50,6 @@ throwOnCanary {
       root.hashedPassword = fileContents ./users/root/password.txt;
     };
 
-    wireguard = import ./wireguard { inherit lib; };
+    wireguard = pkgs.callPackage ./wireguard { };
   };
 }