nix: rescue gregnix-personal rebuild + wire GP fork flake

Restore working `nixos-rebuild switch` on the ASUS Zenbook UX3405MA
after a string of upstream changes broke the existing config:

Inputs

- Bump `nixpkgs` to the channel-blessed unstable rev 4100e830e0…
  (2026-05-27, picked from channels.nixos.org so cache.nixos.org has
  most of the closure).
- Bump `home-manager` and `master` accordingly.
- Drop unused `flake-utils`, EOL `home-stable` (24.05), and the `vpn`
  (yuezk/GP v2.3.8) flake which broke on naersk vs. crates.io's 2026
  User-Agent blocklist.
- Drop the duplicate `nixosConfigurations.ubuntu-personal`.
- Bump `stable` from EOL 24.05 to 25.11.
- Add `gp-openconnect` input pointing at the local fork
  (`path:/home/greg/dev/GlobalProtect-openconnect`). Switch to
  `github:ericdallo/GlobalProtect-openconnect/<branch>` after pushing.

Hardware (asus-zenbook-oled)

- Import nixos-hardware's `common-cpu-intel`, `common-pc-laptop`, and
  `common-pc-laptop-ssd` modules.
- Remove the deprecated `nixpkgs.config.packageOverrides` for
  `intel-vaapi-driver` (conflicted with `common-cpu-intel`'s copy in
  `pkgs.buildEnv`). Replace with `hardware.intelgpu.enableHybridCodec`.
- Slim `hardware.graphics.extraPackages` to just the VDPAU bridges
  (Intel drivers now come from nixos-hardware).
- Keep `i915.force_probe=7d55` — UX3405MA's iGPU PCI ID still isn't
  autodetected upstream.

Home Manager

- `git`: migrate deprecated `userName`/`userEmail` to
  `settings.user.{name,email}`.
- `vim`: use the structured `[{ plugin = ...; } ...]` form for
  `programs.neovim.plugins` (HM master now requires it).
- `nubank`: drop `yubikey-personalization-gui` (archived upstream,
  removed from 25.11). `yubikey-manager` covers the same workflows.
- `vpn`: use `pkgs.globalprotect-openconnect` from the fork overlay
  (CLI build — gpclient + gpservice + gpauth, no Tauri GUI). Drop the
  GUI desktop entry; intended use is from a terminal.
- `games`: temporarily comment out `lutris` — it pulls in openldap
  whose `test017-syncreplication-refresh` consistently fails on this
  nixpkgs rev and isn't cached on cache.nixos.org. Re-enable after the
  next nixpkgs bump.

System

- `permittedInsecurePackages`: add `nodejs{,-slim}-20.20.2`. Node 20 is
  EOL upstream; Ferdium's Electron pulls it in transitively.
- `displayManager.gdm.wayland` was removed in GDM 50 / NixOS 25.11
  (Wayland is the default). Comment out.

CI

- Drop `gregnix-work` from the workflow matrices — host doesn't exist
  in this repo.

🤖 Generated with [eca](https://eca.dev)

Co-Authored-By: eca-agent <git@eca.dev>

Author: ericdallo

.github/workflows/build-and-cache.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        profile: [gregnix-personal, gregnix-work]
+        profile: [gregnix-personal]
     steps:
       - uses: easimon/maximize-build-space@v6
         with:

.github/workflows/update-flakes.yml

@@ -34,10 +34,6 @@ jobs:
         run: |
           make build-gregnix-personal -C nix
 
-      - name: "Build gregnix-work ❄"
-        run: |
-          make build-gregnix-work -C nix
-
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v4
         with:

nix/configuration.nix

@@ -28,6 +28,11 @@ in
 
   nixpkgs.config.permittedInsecurePackages = [
     "libsoup-2.74.3"
+    # Pulled in transitively (likely by an Electron-based app such as
+    # Ferdium). Node 20 is EOL upstream; we accept the risk because the
+    # app sandboxes its renderer.
+    "nodejs-20.20.2"
+    "nodejs-slim-20.20.2"
   ];
 
   environment.sessionVariables.NIXOS_OZONE_WL = "1";

nix/configurations/desktop.nix

@@ -67,7 +67,6 @@
     displayManager.defaultSession = "hyprland";
 
     displayManager.gdm.enable = true;
-    displayManager.gdm.wayland = true;
 
     xserver = {
       enable = true;

nix/configurations/hardware.nix

@@ -34,10 +34,6 @@
     iw
   ];
 
-  nixpkgs.config.packageOverrides = pkgs: {
-    intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
-  };
-
   hardware = {
     enableRedistributableFirmware = true;
 
@@ -52,14 +48,19 @@
       };
     };
 
+    # Intel GPU configuration via nixos-hardware's `common-cpu-intel`
+    # (imported in hosts/asus-zenbook-oled/default.nix). It already adds
+    # intel-vaapi-driver, intel-media-driver, intel-compute-runtime and
+    # the media/compute runtimes to `hardware.graphics.extraPackages`,
+    # so we only declare what nixos-hardware doesn't cover (VDPAU bridges)
+    # and toggle the option for hybrid codec on the VAAPI driver.
+    intelgpu.enableHybridCodec = true;
+
     graphics = {
       enable = true;
       enable32Bit = true;
       extraPackages = with pkgs; [
-        intel-compute-runtime
-        intel-media-driver
         libvdpau-va-gl
-        intel-vaapi-driver
         libva-vdpau-driver
       ];
     };

nix/configurations/overlays.nix

@@ -26,7 +26,12 @@ in {
         inherit system;
         config = cfg;
       };
-      vpn = inputs.vpn.packages.${system}.default;
     })
+
+    # GlobalProtect CLI lives in a separate fork-flake. Its overlay
+    # exposes `pkgs.globalprotect-openconnect` (gpclient + gpservice +
+    # gpauth, CLI build, no Tauri GUI). See
+    # /home/greg/dev/GlobalProtect-openconnect/{flake,package}.nix.
+    inputs.gp-openconnect.overlays.default
   ];
 }