hitagi: Use nixpkgs unstable

This is needed for Intel Arc support (Mesa 22.3+).

This also makes changes so the nixpkgs system evaluates without
errors/warnings (caused by my configuration).

machines/default.nix

@@ -16,6 +16,9 @@ in
       hardware.common-cpu-amd
       hardware.common-pc-ssd
     ];
+    # Intel Arc requires mesa 22.3, which only is in unstable.
+    # Using mesa from untable is quite hard, so this is a workaround.
+    nixpkgs = inputs.nixpkgs-unstable;
   };
   vueko = {
     system = "x86_64-linux";

modules/ssh.nix

@@ -2,9 +2,16 @@
 {
   services.openssh = {
     enable = true;
+  } // (if (lib.versionAtLeast (lib.substring 0 5 lib.version) "23.05") then {
+    # TODO: Remove with 23.05
+    settings = {
+      permitRootLogin = "yes";
+      passwordAuthentication = false;
+    };
+  } else {
     permitRootLogin = "yes";
     passwordAuthentication = false;
-  };
+  });
 
   users.users.root.openssh.authorizedKeys.keys = config.sbruder.pubkeys.trustedKeys;
 

pkgs/default.nix

@@ -48,6 +48,9 @@ in
     ];
   });
 
+  # FIXME: Remove once khal from unstable passes tests again.
+  khal = prev.khal.overridePythonAttrs (o: { doCheck = false; });
+
   mumble = prev.mumble.overrideAttrs (o: rec {
     version = "1.5.517";
 

users/simon/modules/mail/aerc/default.nix

@@ -16,7 +16,7 @@
       extraAccounts =
         (lib.mapAttrs
           (name: accountConfig: with accountConfig; let
-            quoteMailAddress = lib.replaceChars [ "@" "\\" ] [ "%40" "%5C" ];
+            quoteMailAddress = lib.replaceStrings [ "@" "\\" ] [ "%40" "%5C" ];
             # home-manager has no way to set if an account requires AUTH LOGIN
             # this emulats this by setting a list of known providers that do require it
             requiresLogin = lib.elem

users/simon/modules/mpv/default.nix

@@ -50,13 +50,17 @@ in
     enable = nixosConfig.sbruder.gui.enable || nixosConfig.sbruder.full;
 
     package = pkgs.wrapMpv
-      (pkgs.mpv-unwrapped.override {
-        ffmpeg = pkgs.ffmpeg-full;
+      (pkgs.mpv-unwrapped.override ({
         vapoursynthSupport = true;
         vapoursynth = pkgs.vapoursynth.withPlugins (with pkgs; [
           vapoursynth-mvtools
         ]);
-      })
+      } // (if (pkgs.lib.versionAtLeast (pkgs.lib.substring 0 5 pkgs.lib.version) "23.05") then {
+        # TODO: Remove with 23.05
+        ffmpeg_5 = pkgs.ffmpeg_5-full;
+      } else {
+        ffmpeg = pkgs.ffmpeg-full;
+      })))
       {
         scripts = with pkgs.mpvScripts; [
           pitchcontrol