nixos: container profile, fix a few things