loki: Enable 32bit graphics, add workaround for ROCm/HIP

Flake lock file updates:

• Updated input 'atuin':
    'github:atuinsh/atuin/c32bbcc7edc2cf99da52b1407c90238bc781a804?narHash=sha256-jx%2BxuNZ/8azfFYMlZyYa6e%2BOiTlf%2B4GVYtbfv1%2BTows%3D' (2024-07-25)
  → 'github:atuinsh/atuin/db2d6c3d83e927185068aab457396ee1a21994ff?narHash=sha256-lUKDWPgfT6mr50WZgSq3/hJtZ8gYxr3PCLghek5EFaE%3D' (2024-07-29)
• Updated input 'disko':
    'github:nix-community/disko/55e874b9c14764cb791e5740f0e92202e41393fc?narHash=sha256-NyWVCnSeePnJHGJxZ0l3zdGQGrVjUcx2IJbV8KIsPf0%3D' (2024-07-25)
  → 'github:nix-community/disko/1e6f8a7b4634fc051cc9361959bf414fcf17e094?narHash=sha256-8r5AJ3n8WEDw3rsZLALSuFQ5kJyWOcssNZvPxYLr2yc%3D' (2024-07-29)
• Updated input 'emacs-overlay':
    'github:nix-community/emacs-overlay/24c391d8fe03854d1eedea66c241b176e97f5f6c?narHash=sha256-EGeUu2Veg2p4fiGZ%2B22kNSpucrYxZn6NTdXVS989GGk%3D' (2024-07-26)
  → 'github:nix-community/emacs-overlay/087cf45264b4487b2848e08548bb4c5f933d460c?narHash=sha256-uELMts/UTJ4jTPQbQgOnE75flmdbWm672yDvL3QLWOI%3D' (2024-07-29)
• Updated input 'emacs-overlay/nixpkgs-stable':
    'github:NixOS/nixpkgs/d0907b75146a0ccc1ec0d6c3db287ec287588ef6?narHash=sha256-PhmkdTJs2SfqKzSyDB74rDKp1MH4mGk0pG/%2BWqrnGEw%3D' (2024-07-24)
  → 'github:NixOS/nixpkgs/8c50662509100d53229d4be607f1a3a31157fa12?narHash=sha256-2ShmEaFi0kJVOEEu5gmlykN5dwjWYWYUJmlRTvZQRpU%3D' (2024-07-27)
• Updated input 'home-manager':
    'github:nix-community/home-manager/304a011325b7ac7b8c9950333cd215a7aa146b0e?narHash=sha256-JH8N5uoqoVA6erV4O40VtKKHsnfmhvMGbxMNDLtim5o%3D' (2024-07-24)
  → 'github:nix-community/home-manager/4fcd54df7cbb1d79cbe81209909ee8514d6b17a4?narHash=sha256-WeVWVRqkgrbLzmk6FfJoloJ7Xe7HWD27Pv950IUG2kI%3D' (2024-07-30)
• Updated input 'nix-ld-rs':
    'github:nix-community/nix-ld-rs/2f1fe38bc69d2400652e0848d9d2ce2955a39cf6?narHash=sha256-VnayJVKngasaNNiMlBhkeA//%2BV9EpEuT/mkOsFUbFDg%3D' (2024-07-19)
  → 'github:nix-community/nix-ld-rs/178b100f4dda6b1280e9619270009fc8c0938e73?narHash=sha256-SUHIztj/CoqqtwEjSA9cnJb%2BIIFIr2ntrzn0Ly1DCB8%3D' (2024-07-29)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/d3c993c851ad40bbab7e08d566138ff72cd8744f?narHash=sha256-5OrkPJsiZmNe99C6%2BKX0qx9sphoVLvldFjuqDYAZ8GQ%3D' (2024-07-25)
  → 'github:NixOS/nixos-hardware/eab049fe178c11395d65a858ba1b56461ba9652d?narHash=sha256-xLBAegsn9wbj%2BpQfbX07kykd5VBV3Ywk3IbObVAAlWA%3D' (2024-07-29)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/5ad6a14c6bf098e98800b091668718c336effc95?narHash=sha256-Sb1jlyRO%2BN8jBXEX9Pg9Z1Qb8Bw9QyOgLDNMEpmjZ2M%3D' (2024-07-25)
  → 'github:nixos/nixpkgs/b73c2221a46c13557b1b3be9c2070cc42cf01eb3?narHash=sha256-QOS0ykELUmPbrrUGmegAUlpmUFznDQeR4q7rFhl8eQg%3D' (2024-07-27)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/9cbf831c5b20a53354fc12758abd05966f9f1699?narHash=sha256-o21ax%2B745ETGXrcgc/yUuLw1SI77ymp3xEpJt%2Bw/kks%3D' (2024-07-26)
  → 'github:oxalica/rust-overlay/38c2f156fca1868c8be7195ddac150522752f6ab?narHash=sha256-ljiuTGSFuEtudqFqp/5Wr1OuEsVCjur/F2CmlNujSjc%3D' (2024-07-30)
• Updated input 'sops':
    'github:Mic92/sops-nix/aff2f88277dabe695de4773682842c34a0b7fd54?narHash=sha256-9jsjsRKtJRqNSTXKj9zuDFRf2PGix30nMx9VKyPgD2U%3D' (2024-07-22)
  → 'github:Mic92/sops-nix/eb34eb588132d653e4c4925d862f1e5a227cc2ab?narHash=sha256-s6YhI8UHwQvO4cIFLwl1wZ1eS5Cuuw7ld2VzUchdFP0%3D' (2024-07-27)

flake.lock

@@ -56,11 +56,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721946698,
-        "narHash": "sha256-jx+xuNZ/8azfFYMlZyYa6e+OiTlf+4GVYtbfv1+Tows=",
+        "lastModified": 1722262249,
+        "narHash": "sha256-lUKDWPgfT6mr50WZgSq3/hJtZ8gYxr3PCLghek5EFaE=",
         "owner": "atuinsh",
         "repo": "atuin",
-        "rev": "c32bbcc7edc2cf99da52b1407c90238bc781a804",
+        "rev": "db2d6c3d83e927185068aab457396ee1a21994ff",
         "type": "github"
       },
       "original": {
@@ -197,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721871128,
-        "narHash": "sha256-NyWVCnSeePnJHGJxZ0l3zdGQGrVjUcx2IJbV8KIsPf0=",
+        "lastModified": 1722217815,
+        "narHash": "sha256-8r5AJ3n8WEDw3rsZLALSuFQ5kJyWOcssNZvPxYLr2yc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "55e874b9c14764cb791e5740f0e92202e41393fc",
+        "rev": "1e6f8a7b4634fc051cc9361959bf414fcf17e094",
         "type": "github"
       },
       "original": {
@@ -221,11 +221,11 @@
         "nixpkgs-stable": "nixpkgs-stable_2"
       },
       "locked": {
-        "lastModified": 1721985045,
-        "narHash": "sha256-EGeUu2Veg2p4fiGZ+22kNSpucrYxZn6NTdXVS989GGk=",
+        "lastModified": 1722273087,
+        "narHash": "sha256-uELMts/UTJ4jTPQbQgOnE75flmdbWm672yDvL3QLWOI=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "24c391d8fe03854d1eedea66c241b176e97f5f6c",
+        "rev": "087cf45264b4487b2848e08548bb4c5f933d460c",
         "type": "github"
       },
       "original": {
@@ -609,11 +609,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721852138,
-        "narHash": "sha256-JH8N5uoqoVA6erV4O40VtKKHsnfmhvMGbxMNDLtim5o=",
+        "lastModified": 1722321190,
+        "narHash": "sha256-WeVWVRqkgrbLzmk6FfJoloJ7Xe7HWD27Pv950IUG2kI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "304a011325b7ac7b8c9950333cd215a7aa146b0e",
+        "rev": "4fcd54df7cbb1d79cbe81209909ee8514d6b17a4",
         "type": "github"
       },
       "original": {
@@ -702,11 +702,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721394956,
-        "narHash": "sha256-VnayJVKngasaNNiMlBhkeA//+V9EpEuT/mkOsFUbFDg=",
+        "lastModified": 1722257939,
+        "narHash": "sha256-SUHIztj/CoqqtwEjSA9cnJb+IIFIr2ntrzn0Ly1DCB8=",
         "owner": "nix-community",
         "repo": "nix-ld-rs",
-        "rev": "2f1fe38bc69d2400652e0848d9d2ce2955a39cf6",
+        "rev": "178b100f4dda6b1280e9619270009fc8c0938e73",
         "type": "github"
       },
       "original": {
@@ -717,11 +717,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1721911538,
-        "narHash": "sha256-5OrkPJsiZmNe99C6+KX0qx9sphoVLvldFjuqDYAZ8GQ=",
+        "lastModified": 1722278305,
+        "narHash": "sha256-xLBAegsn9wbj+pQfbX07kykd5VBV3Ywk3IbObVAAlWA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "d3c993c851ad40bbab7e08d566138ff72cd8744f",
+        "rev": "eab049fe178c11395d65a858ba1b56461ba9652d",
         "type": "github"
       },
       "original": {
@@ -776,11 +776,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1721821769,
-        "narHash": "sha256-PhmkdTJs2SfqKzSyDB74rDKp1MH4mGk0pG/+WqrnGEw=",
+        "lastModified": 1722087241,
+        "narHash": "sha256-2ShmEaFi0kJVOEEu5gmlykN5dwjWYWYUJmlRTvZQRpU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d0907b75146a0ccc1ec0d6c3db287ec287588ef6",
+        "rev": "8c50662509100d53229d4be607f1a3a31157fa12",
         "type": "github"
       },
       "original": {
@@ -824,11 +824,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1721924956,
-        "narHash": "sha256-Sb1jlyRO+N8jBXEX9Pg9Z1Qb8Bw9QyOgLDNMEpmjZ2M=",
+        "lastModified": 1722062969,
+        "narHash": "sha256-QOS0ykELUmPbrrUGmegAUlpmUFznDQeR4q7rFhl8eQg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5ad6a14c6bf098e98800b091668718c336effc95",
+        "rev": "b73c2221a46c13557b1b3be9c2070cc42cf01eb3",
         "type": "github"
       },
       "original": {
@@ -983,11 +983,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721960387,
-        "narHash": "sha256-o21ax+745ETGXrcgc/yUuLw1SI77ymp3xEpJt+w/kks=",
+        "lastModified": 1722305989,
+        "narHash": "sha256-ljiuTGSFuEtudqFqp/5Wr1OuEsVCjur/F2CmlNujSjc=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "9cbf831c5b20a53354fc12758abd05966f9f1699",
+        "rev": "38c2f156fca1868c8be7195ddac150522752f6ab",
         "type": "github"
       },
       "original": {
@@ -1004,11 +1004,11 @@
         "nixpkgs-stable": "nixpkgs-stable_4"
       },
       "locked": {
-        "lastModified": 1721688883,
-        "narHash": "sha256-9jsjsRKtJRqNSTXKj9zuDFRf2PGix30nMx9VKyPgD2U=",
+        "lastModified": 1722114803,
+        "narHash": "sha256-s6YhI8UHwQvO4cIFLwl1wZ1eS5Cuuw7ld2VzUchdFP0=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "aff2f88277dabe695de4773682842c34a0b7fd54",
+        "rev": "eb34eb588132d653e4c4925d862f1e5a227cc2ab",
         "type": "github"
       },
       "original": {

machines/loki/configuration.nix

@@ -103,11 +103,16 @@
   # high-resolution display
   # hardware.video.hidpi.enable = lib.mkDefault true;
 
+  hardware = {
     # Enable firmware
-  hardware.enableAllFirmware = true;
+    enableAllFirmware = true;
+    graphics = {
+      enable32Bit = true;
+    };
 
     # i2c support
-  hardware.i2c.enable = true;
+    i2c.enable = true;
+  };
 
   boot = {
     initrd.availableKernelModules = [
@@ -232,6 +237,9 @@
       enable = true;
     };
     sudo.enable = false;
+    apparmor = {
+      enable = true;
+    };
     pam.services.swaylock = {
       unixAuth = true;
       setLoginUid = true;
@@ -502,10 +510,27 @@
     ];
   };
 
+  # Workaround for packages that has HIP paths hardcoded
+  systemd.tmpfiles.rules =
+    let
+      rocmEnv = pkgs.symlinkJoin {
+        name = "rocm-combined";
+        paths = with pkgs.rocmPackages; [
+          rocblas
+          hipblas
+          clr
+        ];
+      };
+    in
+    [ "L+    /opt/rocm   -    -    -     -    ${rocmEnv}" ];
+
   nix.settings.post-build-hook =
     let
       inherit (attic.packages.${pkgs.system}) attic-client;
-      cachedPackagePatterns = builtins.concatStringsSep "|" [ "mongodb" ];
+      cachedPackagePatterns = builtins.concatStringsSep "|" [
+        "mongodb"
+        "qgis"
+      ];
     in
     pkgs.writeScript "upload-to-cache" ''
       set -eu

machines/odin/configuration.nix

@@ -45,6 +45,9 @@
       enable = true;
     };
     sudo.enable = false;
+    apparmor = {
+      enable = true;
+    };
   };
 
   boot = {