framenix: move nix build dir to tmpfs

Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/366f00797b1efb70f2882d3da485e3c10fd3d557' (2025-06-24)
  → 'github:nix-community/home-manager/501cfec8277f931a9c9af9f23d3105c537faeafe' (2025-07-02)
• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/f49bb3b4107a0917ee144337bb02d311033ee1ba' (2025-07-01)
  → 'github:NixOS/nixos-hardware/497ae1357f1ac97f1aea31a4cb74ad0d534ef41f' (2025-07-02)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/b43c397f6c213918d6cfe6e3550abfe79b5d1c51' (2025-06-29)
  → 'github:NixOS/nixpkgs/34627c90f062da515ea358360f448da57769236e' (2025-07-02)
• Updated input 'nur':
    'github:nix-community/NUR/326860af7a41ac4d1ab8055bf88fdc8e79b82acf' (2025-07-01)
  → 'github:nix-community/NUR/42cd07059585b6f8fa44c9cd585099339bc52606' (2025-07-04)

flake.lock

@@ -102,11 +102,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750792728,
-        "narHash": "sha256-Lh3dopA8DdY+ZoaAJPrtkZOZaFEJGSYjOdAYYgOPgE4=",
+        "lastModified": 1751468302,
+        "narHash": "sha256-tWosziZTT039x6PgEZUhzGlV8oLvdDmIgKTE8ESMaEA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "366f00797b1efb70f2882d3da485e3c10fd3d557",
+        "rev": "501cfec8277f931a9c9af9f23d3105c537faeafe",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1751393906,
-        "narHash": "sha256-I1x6K61ZcdFlqc07weRBy3erCAB0lVkX10i0c9eXjDI=",
+        "lastModified": 1751432711,
+        "narHash": "sha256-136MeWtckSHTN9Z2WRNRdZ8oRP3vyx3L8UxeBYE+J9w=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f49bb3b4107a0917ee144337bb02d311033ee1ba",
+        "rev": "497ae1357f1ac97f1aea31a4cb74ad0d534ef41f",
         "type": "github"
       },
       "original": {
@@ -243,11 +243,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1751211869,
-        "narHash": "sha256-1Cu92i1KSPbhPCKxoiVG5qnoRiKTgR5CcGSRyLpOd7Y=",
+        "lastModified": 1751479989,
+        "narHash": "sha256-M5KgdpVBVcW4HRVq9/OSRbrxlwsQ1ogEKqnvzsClDqU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b43c397f6c213918d6cfe6e3550abfe79b5d1c51",
+        "rev": "34627c90f062da515ea358360f448da57769236e",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1751397775,
-        "narHash": "sha256-LMe/4mpv23Lkk9tLsTrxAB5nvLbQd92dkDz/MPqlvqM=",
+        "lastModified": 1751612801,
+        "narHash": "sha256-rxV0IvUfylILksY7+jGbA+3v1ed2cth9lpVLiVRgmYY=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "326860af7a41ac4d1ab8055bf88fdc8e79b82acf",
+        "rev": "42cd07059585b6f8fa44c9cd585099339bc52606",
         "type": "github"
       },
       "original": {

hosts/framenix/storage.nix

@@ -39,6 +39,17 @@ in
       fsType = "vfat";
       options = [ "discard" ];
     };
+    # nix/ lix build directory
+    # lix:
+    # > If you plan to use a tmpfs, we **strongly recommend** to set `mode=0755` as a mount option for that `tmpfs`, otherwise you are effectively reverting this mitigation.
+    "/nix/var/nix/builds" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = [
+        "mode=0755"
+        "size=75%"
+      ];
+    };
   };
 
   services.fstrim.enable = true;