fix?

hosts/server/configuration.nix

@@ -81,6 +81,51 @@
     shell = pkgs.zsh;
   };
 
+  nixpkgs.overlays = [
+    (final: prev: {
+      nixos-rebuild = prev.writeShellScriptBin "nixos-rebuild" ''
+                set -euo pipefail
+
+                action="''${1:-}"
+                case "$action" in
+                  switch|boot|test|build|dry-activate)
+                    needs_flake=1
+                    ;;
+                  *)
+                    needs_flake=0
+                    ;;
+                esac
+
+                has_flake=0
+                for arg in "$@"; do
+                  case "$arg" in
+                    --flake|--flake=*)
+                      has_flake=1
+                      break
+                      ;;
+                  esac
+                done
+
+                if [ "$needs_flake" -eq 1 ] && [ "$has_flake" -eq 0 ]; then
+                  cat >&2 <<'EOF'
+
+        🚨🚨🚨 WARNING: DANGEROUS SYSTEM REBUILD 🚨🚨🚨
+        This host is FLAKE-MANAGED. Do not attempt to rebuild the system from /etc/nixos.
+
+        Please ensure you are running THIS EXACT COMMAND inside /home/ocbwoy3/config:
+
+           sudo nixos-rebuild switch --flake /home/ocbwoy3/config#server --impure --cores 4 -L --upgrade
+
+        Aborting unsafe nixos-rebuild invocation.
+        EOF
+                  exit 64
+                fi
+
+                exec ${prev.nixos-rebuild}/bin/nixos-rebuild "$@"
+      '';
+    })
+  ];
+
   virtualisation.docker = {
     enable = true;
     daemon.settings = {
@@ -134,7 +179,10 @@
   ];
 
   # Force resolver config to Cloudflare only.
-  networking.nameservers = lib.mkForce [ "1.1.1.1" "1.0.0.1" ];
+  networking.nameservers = lib.mkForce [
+    "1.1.1.1"
+    "1.0.0.1"
+  ];
   environment.etc."resolv.conf".text = lib.mkForce ''
     nameserver 1.1.1.1
     nameserver 1.0.0.1