From d5224d79acf8e0a3359c527fc3af07f7d393c754 Mon Sep 17 00:00:00 2001
From: Evan Reichard <evan@reichard.io>
Date: Wed, 15 Apr 2026 11:01:58 -0400
Subject: [PATCH] fix: darwin, feat: work vm auto connect

---
 .../evanreichard@mac-va-mbp-work/default.nix  |  3 +-
 .../evanreichard@mac-va-mbp-work/vm-init.sh   | 39 +++++++++++++++++++
 .../home/programs/terminal/bash/default.nix   |  4 +-
 overlays/fish/default.nix                     | 12 ++++++
 4 files changed, 56 insertions(+), 2 deletions(-)
 create mode 100755 homes/aarch64-darwin/evanreichard@mac-va-mbp-work/vm-init.sh
 create mode 100644 overlays/fish/default.nix

diff --git a/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/default.nix b/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/default.nix
index 2ec47f2..f8d3d26 100755
--- a/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/default.nix
+++ b/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/default.nix
@@ -24,6 +24,7 @@ in
       terminal = {
         bash = {
           enable = true;
+          customProfile = builtins.readFile ./vm-init.sh;
           customFastFetchLogo = ./prophet.txt;
         };
         aws = enabled;
@@ -48,7 +49,7 @@ in
   programs.jq = enabled;
   programs.pandoc = enabled;
   home.packages = with pkgs; [
-    colima
+    # colima
     docker
     keycastr
     _1password-cli
diff --git a/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/vm-init.sh b/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/vm-init.sh
new file mode 100755
index 0000000..f0d4665
--- /dev/null
+++ b/homes/aarch64-darwin/evanreichard@mac-va-mbp-work/vm-init.sh
@@ -0,0 +1,39 @@
+echo "
+ ██████╗██████╗  ██████╗ ██╗    ██╗██████╗ ███████╗████████╗██████╗ ██╗██╗  ██╗███████╗
+██╔════╝██╔══██╗██╔═══██╗██║    ██║██╔══██╗██╔════╝╚══██╔══╝██╔══██╗██║██║ ██╔╝██╔════╝
+██║     ██████╔╝██║   ██║██║ █╗ ██║██║  ██║███████╗   ██║   ██████╔╝██║█████╔╝ █████╗  
+██║     ██╔══██╗██║   ██║██║███╗██║██║  ██║╚════██║   ██║   ██╔══██╗██║██╔═██╗ ██╔══╝  
+╚██████╗██║  ██║╚██████╔╝╚███╔███╔╝██████╔╝███████║   ██║   ██║  ██║██║██║  ██╗███████╗
+ ╚═════╝╚═╝  ╚═╝ ╚═════╝  ╚══╝╚══╝ ╚═════╝ ╚══════╝   ╚═╝   ╚═╝  ╚═╝╚═╝╚═╝  ╚═╝╚══════╝
+         EVASION SYSTEM  -  Because IT can't handle Nix 
+"
+
+# Start VM
+utmctl=/Applications/UTM.app/Contents/MacOS/utmctl
+vm="lin-va-mbp-work-vm"
+
+if ! "$utmctl" status "$vm" | grep -q "started"; then
+    echo "  [*] CrowdStrike Evasion VM Starting..."
+    "$utmctl" start "$vm"
+fi
+
+# Wait for VM & Start Tunnel
+if ! pgrep -f "ssh -N -D 1080 adios-cs" > /dev/null; then
+    echo "  [*] VM Starting..."
+    until nc -z -w 2 192.168.64.3 22 &> /dev/null; do
+        sleep 2
+    done
+    echo "  [✓] VM Started"
+
+    echo "  [*] VM SOCKS Proxy Starting..."
+    ssh -N -D 1080 adios-cs &> /dev/null &
+    disown
+    echo "  [✓] VM SOCKS Proxy Started"
+else
+    echo "  [✓] VM SOCKS Proxy Already Running"
+fi
+
+echo -e "  [*] Connecting..."
+
+# Connect to VM
+mosh --ssh="ssh -q" adios-cs -- tmux new-session -A -s main
diff --git a/modules/home/programs/terminal/bash/default.nix b/modules/home/programs/terminal/bash/default.nix
index 7cf46ab..70dc5ea 100755
--- a/modules/home/programs/terminal/bash/default.nix
+++ b/modules/home/programs/terminal/bash/default.nix
@@ -14,6 +14,7 @@ in
 {
   options.${namespace}.programs.terminal.bash = with lib.types; {
     enable = mkEnableOption "bash";
+    customProfile = mkOpt str "" "custom profile";
     customFastFetchLogo = mkOpt (nullOr path) null "custom fast fetch logo path";
   };
 
@@ -49,7 +50,8 @@ in
         [[ -f ~/.bash_custom ]] && . ~/.bash_custom
 
         source ${./config/hey-intern.sh}
-      '';
+      ''
+      + cfg.customProfile;
     };
 
     programs.powerline-go = {
diff --git a/overlays/fish/default.nix b/overlays/fish/default.nix
new file mode 100644
index 0000000..1e10d3b
--- /dev/null
+++ b/overlays/fish/default.nix
@@ -0,0 +1,12 @@
+# Workaround for aarch64-darwin codesigning bug (nixpkgs#208951 / #507531):
+# fish binaries from the binary cache occasionally have invalid ad-hoc
+# signatures on Apple Silicon. Forcing a local rebuild ensures codesigning
+# is applied on this machine with a valid signature.
+{ inputs, ... }:
+final: prev: {
+  fish = prev.fish.overrideAttrs (_old: {
+    # Bust the cache key so fish is always built locally rather than
+    # substituted from the binary cache where the signature may be stale.
+    NIX_FORCE_LOCAL_REBUILD = "darwin-codesign-fix";
+  });
+}