diff --git a/.gitignore b/.gitignore index 5989bf18..5e1e1746 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ result .pre-commit-config.yaml /.codex +/.claude diff --git a/README.md b/README.md index b5bdfb25..fa211bd3 100644 --- a/README.md +++ b/README.md @@ -45,9 +45,9 @@ nh home switch -c nix@firefly . # nix build installer iso nix build .#nixosConfigurations.vinox.config.system.build.isoImage -# nh remote switch -nh os switch --hostname kubex . -d always --target-host kubex -nh os switch --hostname nixberry . -d always --target-host +# nh remote switch / update +nh os boot --hostname kubex . -d always --target-host kubex +nh os boot --hostname nixberry . -d always --target-host # nix remote switch nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo @@ -78,6 +78,7 @@ sudo nixos-install --flake .#zion ## :open_book: Docs +- [Gaming and Battle.net](./docs/gaming.md) - [Hyprland - Keymap](./docs/hyprland.md#keymap) - [NVIM - Keymap](https://github.com/RAPSNX/neonix/tree/main/docs/keymap.md) diff --git a/dev-shells.nix b/dev-shells.nix index 850a268c..9c5de6e9 100644 --- a/dev-shells.nix +++ b/dev-shells.nix @@ -34,6 +34,7 @@ in deadnix nixfmt nix-inspect + nix-tree ; inherit diff --git a/docs/firefly.md b/docs/firefly.md deleted file mode 100644 index 7b5dfe76..00000000 --- a/docs/firefly.md +++ /dev/null @@ -1,93 +0,0 @@ -# Backups - -1. Firefox profile - -```bash -# TODO: Add this to home.nix -rsync -av --update ~/.mozilla/firefox/default ~/Nextcloud/Home/Backups/firefox_profile/ -``` - -2. Check atuin `key` match with the key in vault. - -# Install device -1. Install `nix` (May disable any VPN) - -```bash -Verify command on nixos.org/download -sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon -``` - -2. Clone dotfiles - 1. Change username `home.nix`, if necessary. -3. Switch config via `devshells` target. - -```bash -nix develop -switch-firefly -``` - -4. Create `hyprland` desktop file. - -```bash -echo "[Desktop Entry] -Name=Hyprland -Comment=An intelligent dynamic tiling Wayland compositor -Exec=/home/$USER/.nix-profile/bin/start-hyprland -Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop -``` - -5. Copy user-certificate to firefox - -```bash -# TODO: Add this to home.nix (as activation script for example) -ln -sf ~/.pki/nssdb/* ~/.mozilla/firefox/default/ -``` - -## Manual things - -### Disable gpg-agent -``` -systemctl --user mask --now gpg-agent.service gpg-agent.socket \ - gpg-agent-ssh.socket gpg-agent-extra.socket gpg-agent-browser.socket -``` - -### Chromium - -Extension: `Open in firefox`: - -**Other Settings** - -- Enable Reverse Mode - -**Automation Rules** - -Comma-separated list of URLs: -``` -*://*.google.com/*, *://chat.ske.eu01.stackit.cloud/* -``` - - -### GTK Theme - -`nwg-look` is used to configure theme in multiple locations. -Run it, ensure to remove the check of `GTK4` files in preferences. -Set `widgets -> colorScheme -> prefer dark`. - -```bash -dconf read /org/gnome/desktop/interface/gtk-theme # Read the actual name -``` - -## Installed via APT - -Those programs are installed via apt, since they do not work within `nix`. - -```bash -# TODO: Check why hyprlock not working -sudo add-apt-repository ppa:cppiber/hyprland -sudo apt update -sudo apt -y install \ - xdg-desktop-portal-wlr \ - mumble \ - swaylock \ - podman -``` diff --git a/docs/bootstrap.md b/docs/guides/bootstrap.md similarity index 61% rename from docs/bootstrap.md rename to docs/guides/bootstrap.md index 92c716de..ced5678b 100644 --- a/docs/bootstrap.md +++ b/docs/guides/bootstrap.md @@ -4,6 +4,3 @@ ### PWAs Manually installed `PWAs` in `Chromium`: - todoist - -## Firefly -Look into [./firefly.md](Firefly bootstrap) diff --git a/docs/guides/dual-boot.md b/docs/guides/dual-boot.md new file mode 100644 index 00000000..a916e9de --- /dev/null +++ b/docs/guides/dual-boot.md @@ -0,0 +1,31 @@ +# Dual-boot +If reinstall / install `zion` or a workstation with dual-boot, follow this order: + +1. Install `Windows` first, create the correct partitions while running the installer. +Ensure that the bootloader partition is big enough. +2. Next boot into `NixOS` live and install `NixOS` with the bootloader partition from windows. +// TODO: Add / Update this to use directly `nixos-install`? + +# Dual-boot entry lost +When updating the `BIOS` the `nvram` gets cleared, resulting in a lost boot entry for `NixOS`. +This can not be fixed by simply boot into live-system and rebuild the bootloader like written in the public docs. +Follow this procedure to recreate the `nvram` boot-entry again: + +1. Boot into `NixOS` live system using the `vinox` iso. +2. Mount and `chroot` into the main system. + +```bash +sudo -i # Sudo is needed for every action + +mount /dev/nvme0n1p{X} /mnt # mount root system +mount /dev/nvme0n1p{X} /mnt/boot # mount bootloader + +nixos-enter +NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot # not sure if this is needed + +sudo efibootmgr --create \ + --disk /dev/nvme0n1 \ # Disk not partition + --part 1 \ + --label "NixOS" \ + --loader '\EFI\systemd\systemd-bootx64.efi' \ # Mind the backslashes +``` diff --git a/docs/guides/flake-update.md b/docs/guides/flake-update.md new file mode 100644 index 00000000..e69de29b diff --git a/docs/guides/gaming.md b/docs/guides/gaming.md new file mode 100644 index 00000000..6cb207a0 --- /dev/null +++ b/docs/guides/gaming.md @@ -0,0 +1,58 @@ +# Gaming and Battle.net + +`hostConfig.roles.gaming.enable` installs Steam, Lutris, UMU, Gamescope, and +GameMode. Steam owns the Proton 11+ runtime; Home Manager links that runtime to +UMU so it can launch Lutris games without downloading a second copy. + +## One-time Steam Runtime setup + +Run these commands as `rap` after enabling the gaming role. Steam Runtime 4.0 +is Steam tool `4183110` and is required by Proton 11+. + +```sh +steam steam://install/4183110 +``` + +Wait for Steam to finish the download, then verify the runtime exists: + +```sh +runtime="$HOME/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4" +test -f "$runtime/toolmanifest.vdf" && test -f "$runtime/mtree.txt.gz" \ + && echo "Steam Runtime 4 is ready" +``` + +Remove any incomplete runtime that UMU created before activating the Home +Manager link: + +```sh +rm -rf "$HOME/.local/share/umu/steamrt4" +``` + +From this repository, apply the system and home configurations: + +```sh +nh os switch . +nh home switch . +``` + +Start a new graphical session, then confirm that UMU resolves to Steam's +runtime: + +```sh +readlink -f "$HOME/.local/share/umu/steamrt4" +``` + +The command should print +`$HOME/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4`. + +## Battle.net + +Open Lutris, select **+** → **Search the Lutris website for installers**, and +install the standard Battle.net entry into a new Lutris-managed directory such +as `~/Games/battlenet`. Do not run the Battle.net installer manually with +`wine` or set `WINEPREFIX` yourself. + +If UMU reports an HTTP 403 while checking for runtime updates, the valid linked +Steam runtime is still used. A `FileNotFoundError` for +`steamrt4/toolmanifest.vdf` means the Steam Runtime bootstrap or Home Manager +link is incomplete. diff --git a/docs/guides/new-host.md b/docs/guides/new-host.md new file mode 100644 index 00000000..216726d2 --- /dev/null +++ b/docs/guides/new-host.md @@ -0,0 +1,11 @@ +# Setup new host + +Create host directory with `hardware-configuration.nix` & `default.nix`, configuring NixOS modules via the `system` +option. + +## Github action + +There are Github Actions, to check and build every host against a `PR`. +For each new host there needs to be config for the pipeline. + +# TODO(docs): Add workdevice manual steps, ppa hyprland and uwsm diff --git a/docs/hosts/firefly.md b/docs/hosts/firefly.md new file mode 100644 index 00000000..8f30b805 --- /dev/null +++ b/docs/hosts/firefly.md @@ -0,0 +1,134 @@ +# Backups + +1. Firefox profile + +```bash +# TODO: Add this to home.nix +rsync -av --update ~/.mozilla/firefox/default ~/Nextcloud/Home/Backups/firefox_profile/ +``` + +2. Check atuin `key` match with the key in vault. + +# Install device +1. Install `nix` (May disable any VPN) + +```bash +Verify command on nixos.org/download +sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon +``` + +2. Clone dotfiles + 1. Change username `home.nix`, if necessary. +3. Switch config via `devshells` target. + +```bash +nix develop +switch-firefly +``` + +4. Create compositor desktop files. + +`firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly. + +```bash +echo "[Desktop Entry] +Name=Hyprland +Comment=An intelligent dynamic tiling Wayland compositor +Exec=/usr/bin/Hyprland +Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop +``` + +`firefly` also has `roles.desktop.niri.enable = true` (PoC), backed by [niri-flake](https://github.com/sodiboo/niri-flake)'s `homeModules.niri`. Unlike Hyprland, there is no APT/PPA package for niri, so this module lets Home Manager install and manage niri itself (`programs.niri.package`, default `niri-stable` from niri-flake) in addition to generating `~/.config/niri/config.kdl` from `programs.niri.settings` (validated at build time via `niri validate`). + +niri-flake has its own binary cache to avoid building niri from source. Since `firefly` doesn't use the NixOS module (which wires the cache in automatically), add it once manually: + +```bash +cachix use niri +``` + +The display manager launches session files without the user's shell `PATH`, so the `Exec` line must use the absolute path into the Home Manager profile (`niri-session` handles systemd/portal integration, unlike calling the raw `niri` binary). `DesktopNames=niri` sets `XDG_CURRENT_DESKTOP`, which portals/theming rely on to detect the session: + +```bash +echo "[Desktop Entry] +Name=Niri +Comment=A scrollable-tiling Wayland compositor +Exec=/home/$(whoami)/.nix-profile/bin/niri-session +Type=Application +DesktopNames=niri" | sudo tee /usr/share/wayland-sessions/niri.desktop +``` + +`niri --session` (invoked by `niri-session`) is systemd-integrated, like Hyprland — it expects `niri.service`/`niri-shutdown.target` user units to exist so GDM can track the session. Those ship inside the niri package itself, but only get linked into `~/.config/systemd/user/` automatically on NixOS; the `roles.desktop.niri` Home Manager module links them explicitly for non-NixOS hosts like `firefly` (see `modules/home/desktops/niri/default.nix`). Without that, GDM logs `Failed to start niri.service: Unit niri.service not found.` and silently falls back to another session. + +5. Copy user-certificate to firefox + +```bash +# TODO: Add this to home.nix (as activation script for example) +ln -sf ~/.pki/nssdb/* ~/.mozilla/firefox/default/ +``` + +## Manual things + +### Disable gpg-agent +``` +systemctl --user mask --now gpg-agent.service gpg-agent.socket \ + gpg-agent-ssh.socket gpg-agent-extra.socket gpg-agent-browser.socket +``` + +### Chromium + +Extension: `Open in firefox`: + +**Other Settings** + +- Enable Reverse Mode + +**Automation Rules** + +Comma-separated list of URLs: +``` +*://*.google.com/*, *://chat.ske.eu01.stackit.cloud/* +``` + + +### GTK Theme + +`nwg-look` is used to configure theme in multiple locations. +Run it, ensure to remove the check of `GTK4` files in preferences. +Set `widgets -> colorScheme -> prefer dark`. + +```bash +dconf read /org/gnome/desktop/interface/gtk-theme # Read the actual name +``` + +## Installed via APT + +Those programs are installed via apt, since they do not work within `nix`. + +```bash +sudo add-apt-repository ppa:cppiber/hyprland +sudo apt update +sudo apt -y install \ + hyprland \ + xdg-desktop-portal \ + xdg-desktop-portal-hyprland \ + xdg-desktop-portal-gtk \ + mumble \ + swaylock \ + podman +``` + +Home Manager must not manage Hyprland or portal packages on `firefly`. Verify the active setup after switching: + +```bash +readlink -f "$(command -v Hyprland)" +systemctl --user cat xdg-desktop-portal*.service +systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR +find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null +``` + +Expected results: + +- `Hyprland` resolves to `/usr/bin/Hyprland`. +- Portal services come from the host packages, not Home Manager-generated user units. +- `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment. +- The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`. diff --git a/docs/k3s.md b/docs/hosts/kubex.md similarity index 82% rename from docs/k3s.md rename to docs/hosts/kubex.md index dd6cd7bc..56e5d049 100644 --- a/docs/k3s.md +++ b/docs/hosts/kubex.md @@ -31,6 +31,13 @@ sudo zpool create -f \ raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd ``` +The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main` +if needed, then loads its encryption key from `rap@nixberry` before `k3s.service` +starts. + +Because the unit runs non-interactively, `kubex` is configured for passwordless sudo +for members of the `wheel` group. + ## Copy kubeconfig ```bash diff --git a/docs/misc.md b/docs/misc.md deleted file mode 100644 index e49b05a9..00000000 --- a/docs/misc.md +++ /dev/null @@ -1,67 +0,0 @@ -# Dual-boot -If reinstall / install `zion` or a workstation with dual-boot, follow this order: - -1. Install `Windows` first, create the correct partitions while running the installer. -Ensure that the bootloader partition is big enough. -2. Next boot into `NixOS` live and install `NixOS` with the bootloader partition from windows. -// TODO: Add / Update this to use directly `nixos-install`? - -# Dual-boot entry lost -When updating the `BIOS` the `nvram` gets cleared, resulting in a lost boot entry for `NixOS`. -This can not be fixed by simply boot into live-system and rebuild the bootloader like written in the public docs. -Follow this procedure to recreate the `nvram` boot-entry again: - -1. Boot into `NixOS` live system using the `vinox` iso. -2. Mount and `chroot` into the main system. - -```bash -sudo -i # Sudo is needed for every action - -mount /dev/nvme0n1p{X} /mnt # mount root system -mount /dev/nvme0n1p{X} /mnt/boot # mount bootloader - -nixos-enter -NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot # not sure if this is needed - -sudo efibootmgr --create \ - --disk /dev/nvme0n1 \ # Disk not partition - --part 1 \ - --label "NixOS" \ - --loader '\EFI\systemd\systemd-bootx64.efi' \ # Mind the backslashes -``` - -## Monitor setup - -All possible monitor configurations are configured via `kanshi`, which maches automatically the correct profile. -They configured for exact matches, not only monitor outputs. - -## Nix follows - -``` - neonix = { - url = "github:rgroemmer/neonix/plugin-enhancement"; - inputs.nixpkgs.follows = "nixpkgs"; - }; -``` - -This will follow the actual flakes `nixpkgs`, neonix by itself uses `nixvim` from its own inputs, which is not part -of `nixpkgs`. -If the flakes `nixpkgs` is to new, plugins and packages from it will be "to new" for the rather outdated `nixvim` from neonix repo. -This can lead to problems starting nvim, this can be fixed by update the `neonix` flake accordingly. -> There is also a nix (lix?) bug, which does not update the `flake.lock` when a follows is removed. - -## Neonix - -`neonix` needs to have its own `nixpkgs`, so no `nixpkgs.follows` is configured. -Instead this should be updated on its own, because if nixpkgs in dotfiles is to new, all dependencies and plugins of -nvim may not work anymore with the `neonix` upstream configuration. - -## Monitor / Workspace setup - -`kanshi` is used to match all possible desktop / office setups via profiles. -These profiles have the primary and secondary display configured, and will execute a script to adapt the workspace pinning. -This will write its config to `~/.config/hypr/workspaces.conf`, same as `nwg-desktop`. -`nwg-desktop` can still be used for both monitor and workspace dynamic configuration. - -**To actually change the monitor config, the `kanshi` systemd service needs to be stopped.** - diff --git a/docs/new-host.md b/docs/new-host.md deleted file mode 100644 index d148f236..00000000 --- a/docs/new-host.md +++ /dev/null @@ -1,27 +0,0 @@ -# Setup new host - -Create host directory with `hardware-configuration.nix` & `default.nix`, configuring NixOS modules via the `system` -option. - -## Sops-nix - -In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied -over to the `.sops.yaml` config. - -``` -# Connect to the new host, and copy the public key of the autogenerated age-key. -sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key" - -# Add recipient in .sops.yaml and paste public key, assign it to a creaton_rule. -# Then a rekey for the secrets.yaml is necessary. -sops updatekeys secrets/secrets.yaml -``` - -## Github action - -There are Github Actions, to check and build every host against a `PR`. -For each new host there needs to be config for the pipeline. - -# TODO(docs): Add sops-nix docs, add & edit secrets - -# TODO(docs): Add workdevice manual steps, ppa hyprland and uwsm diff --git a/docs/hyprland.md b/docs/reference/hyprland.md similarity index 100% rename from docs/hyprland.md rename to docs/reference/hyprland.md diff --git a/docs/monitors.md b/docs/reference/monitors.md similarity index 66% rename from docs/monitors.md rename to docs/reference/monitors.md index 06782fd0..dd8acf11 100644 --- a/docs/monitors.md +++ b/docs/reference/monitors.md @@ -1,9 +1,8 @@ # Monitor / Workspace setup `kanshi` is used to match all possible desktop / office setups via profiles. -These profiles have the primary and secondary display configured, and will execute a script to adapt the workspace pinning. -This will write its config to `~/.config/hypr/workspaces.conf`, same as `nwg-desktop`. -`nwg-desktop` can still be used for both monitor and workspace dynamic configuration. +These profiles configure the primary and secondary display (position, mode, scale) for each known monitor combination. +`nwg-desktop` can still be used for workspace dynamic configuration. **To actually change the monitor config, the `kanshi` systemd service needs to be stopped.** diff --git a/docs/reference/neonix-flake.md b/docs/reference/neonix-flake.md new file mode 100644 index 00000000..37e3f710 --- /dev/null +++ b/docs/reference/neonix-flake.md @@ -0,0 +1,20 @@ +## Nix follows + +``` + neonix = { + url = "github:rgroemmer/neonix/plugin-enhancement"; + inputs.nixpkgs.follows = "nixpkgs"; + }; +``` + +This will follow the actual flakes `nixpkgs`, neonix by itself uses `nixvim` from its own inputs, which is not part +of `nixpkgs`. +If the flakes `nixpkgs` is to new, plugins and packages from it will be "to new" for the rather outdated `nixvim` from neonix repo. +This can lead to problems starting nvim, this can be fixed by update the `neonix` flake accordingly. +> There is also a nix (lix?) bug, which does not update the `flake.lock` when a follows is removed. + +## Neonix + +`neonix` needs to have its own `nixpkgs`, so no `nixpkgs.follows` is configured. +Instead this should be updated on its own, because if nixpkgs in dotfiles is to new, all dependencies and plugins of +nvim may not work anymore with the `neonix` upstream configuration. diff --git a/docs/nix-lang.md b/docs/reference/nix-lang.md similarity index 100% rename from docs/nix-lang.md rename to docs/reference/nix-lang.md diff --git a/docs/structure.md b/docs/reference/structure.md similarity index 100% rename from docs/structure.md rename to docs/reference/structure.md diff --git a/flake.lock b/flake.lock index e54688b8..dcc73478 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1778857089, - "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=", + "lastModified": 1784368054, + "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8", + "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0", "type": "github" }, "original": { @@ -38,11 +38,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1780833533, - "narHash": "sha256-0StMUC1sOkiQq7qoLQpobwVlad09EA5cy7HZit172Fw=", + "lastModified": 1784366307, + "narHash": "sha256-VKatYOZwLQ+MuNkWH6/gZYxrNeSK1Mqb7mC0H1WSu+M=", "owner": "catppuccin", "repo": "nix", - "rev": "4dd4177dc14b0c0b23bf3ce403f813be0c4c30de", + "rev": "673f730d0fc8db3468c51575f1d3d777cc55e51f", "type": "github" }, "original": { @@ -58,11 +58,11 @@ ] }, "locked": { - "lastModified": 1780290312, - "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=", + "lastModified": 1781152676, + "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", "owner": "nix-community", "repo": "disko", - "rev": "115e5211780054d8a890b41f0b7734cafad54dfe", + "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", "type": "github" }, "original": { @@ -128,11 +128,11 @@ ] }, "locked": { - "lastModified": 1778716662, - "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", + "lastModified": 1782949081, + "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", + "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", "type": "github" }, "original": { @@ -159,104 +159,39 @@ "type": "github" } }, - "flake-utils_2": { - "inputs": { - "systems": [ - "nfsm", - "systems" - ] - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "gitignore": { - "inputs": { - "nixpkgs": [ - "hyprland-git", - "pre-commit-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, - "gitignore_2": { - "inputs": { - "nixpkgs": [ - "neonix", - "pre-commit-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, - "gitignore_3": { + "home-manager": { "inputs": { "nixpkgs": [ - "pre-commit-hooks", "nixpkgs" ] }, "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "lastModified": 1785119578, + "narHash": "sha256-3VMVuOJ6fK+RNOXVmqusqUwQ1sDfPeddNKaM2JR/4Y0=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "e83dffa86cccb6237fe194d4eeb47f41557749d1", "type": "github" }, "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", + "owner": "nix-community", + "repo": "home-manager", "type": "github" } }, - "home-manager": { + "home-manager_2": { "inputs": { "nixpkgs": [ + "tflow", "nixpkgs" ] }, "locked": { - "lastModified": 1780679734, - "narHash": "sha256-KmRNvpNOb7QEORa06bVgjW9kITcx0VhsI7w0vhmZyD8=", + "lastModified": 1783222121, + "narHash": "sha256-E/ElL373TO8lQ2aMvYyzN+k4xkVaUGoRqoa8AtM71tI=", "owner": "nix-community", "repo": "home-manager", - "rev": "b2b7db486e06e098711dc291bb25db82850e1d16", + "rev": "a1645f40777620c4bd2b6d854b290c2fc354a266", "type": "github" }, "original": { @@ -310,11 +245,11 @@ ] }, "locked": { - "lastModified": 1776426399, - "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=", + "lastModified": 1782566056, + "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84", + "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8", "type": "github" }, "original": { @@ -342,11 +277,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1780768552, - "narHash": "sha256-J2gBzBBE9C6LMMJec8buysLAQl7QmqtP/oMrPfVioYc=", + "lastModified": 1785081751, + "narHash": "sha256-0vZbjVqutPmzfAQjNv9QJ/GhvTaeCG+Hh6gfyBNU/s8=", "owner": "hyprwm", "repo": "hyprland", - "rev": "20ee7553c95dd1fa30a00564561f40f7986ffbc7", + "rev": "d8dc50309c551cfa44fee70744397311b8b7c5fc", "type": "github" }, "original": { @@ -388,11 +323,11 @@ ] }, "locked": { - "lastModified": 1776426575, - "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=", + "lastModified": 1784196523, + "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "a968d211048e3ed538e47b84cb3649299578f19d", + "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0", "type": "github" }, "original": { @@ -494,11 +429,11 @@ ] }, "locked": { - "lastModified": 1772462885, - "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=", + "lastModified": 1782554491, + "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=", "owner": "hyprwm", "repo": "hyprtoolkit", - "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998", + "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35", "type": "github" }, "original": { @@ -519,11 +454,11 @@ ] }, "locked": { - "lastModified": 1779475241, - "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=", + "lastModified": 1784323413, + "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "3cd3972b2ee658a14d2610d8494e09259e530124", + "rev": "5f03477ab3a005ff27c527486f551883535aea2f", "type": "github" }, "original": { @@ -588,11 +523,11 @@ }, "import-tree": { "locked": { - "lastModified": 1778781969, - "narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=", + "lastModified": 1784254960, + "narHash": "sha256-iI88R3wHz8wTKQb5orvpc51L/Xr64AJyxid/0MKa/b8=", "owner": "vic", "repo": "import-tree", - "rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274", + "rev": "4ebb10ae17d5f1ad366e7aef5b92cb8eecf24f69", "type": "github" }, "original": { @@ -645,41 +580,19 @@ "pre-commit-hooks": "pre-commit-hooks_2" }, "locked": { - "lastModified": 1780865186, - "narHash": "sha256-GXjj3r00JhjYtVZZtDTz99ZPcJqTTcrsF1NS+jEdDhk=", - "owner": "rgroemmer", + "lastModified": 1784321871, + "narHash": "sha256-mSjRx9c1jOIZPQwas8Sm9biipxiaoj5WvKPWJ8LUPgE=", + "owner": "rapsnx", "repo": "neonix", - "rev": "16a56ef334a7117f1124b4082121fbe6787f94d9", + "rev": "afd1f809b8aa23bd57fc91ab31d1e61749ce3e14", "type": "github" }, "original": { - "owner": "rgroemmer", + "owner": "rapsnx", "repo": "neonix", "type": "github" } }, - "nfsm": { - "inputs": { - "flake-utils": "flake-utils_2", - "nixpkgs": [ - "nixpkgs" - ], - "systems": "systems_4" - }, - "locked": { - "lastModified": 1779536651, - "narHash": "sha256-RnjrNx/+TI7VpIpsAih9OD5/i2DIFzB3tt3aWHYbJvg=", - "owner": "gvolpe", - "repo": "nfsm", - "rev": "181a22e8915e4d2ee0adb54b893474f310f0924a", - "type": "github" - }, - "original": { - "owner": "gvolpe", - "repo": "nfsm", - "type": "github" - } - }, "niri": { "inputs": { "niri-stable": "niri-stable", @@ -692,11 +605,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1780694373, - "narHash": "sha256-wuj6QmOlLsGjBOut+Ki/hiOT/H5ONzBePqOkOolsNfo=", + "lastModified": 1785133905, + "narHash": "sha256-cXE11IuEJe+Oqk+gnNIxUSfHW+ekrc8Mx48pNv0RvuI=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "8f7043c852210cd0875a1bbe9ca872c90ab5ac74", + "rev": "81b9856c2f1f5a425e5048219c0899cb48c52d3f", "type": "github" }, "original": { @@ -725,11 +638,11 @@ "niri-unstable": { "flake": false, "locked": { - "lastModified": 1780637332, - "narHash": "sha256-FeKyLRxLZu2EUnhifijZPDZRl0sVnPVHMtizAINNiN4=", + "lastModified": 1784570726, + "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=", "owner": "YaLTeR", "repo": "niri", - "rev": "f717ae030fe56fc52522ebef69f17f3f09064ac4", + "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc", "type": "github" }, "original": { @@ -743,11 +656,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1780310866, - "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=", + "lastModified": 1784723954, + "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "4ed851c979641e28597a05086332d75cdc9e395f", + "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd", "type": "github" }, "original": { @@ -759,11 +672,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1780365719, - "narHash": "sha256-JX05Ms/dk0c+UoW9IqQriB53HNZFckX9Qd3EJqmcqEw=", - "rev": "ffa10e26ae11d676b2db836259889f1f571cb14f", + "lastModified": 1783279667, + "narHash": "sha256-2l8yOB5aYd+05Q9V9Y1YhgbSa1j1o5QX+nvYs5FL80A=", + "rev": "f205b5574fd0cb7da5b702a2da51507b7f4fdd1b", "type": "tarball", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1009182.ffa10e26ae11/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1028110.f205b5574fd0/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -772,11 +685,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1780511130, - "narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=", + "lastModified": 1782847189, + "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "535f3e6942cb1cead3929c604320d3db54b542b9", + "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", "type": "github" }, "original": { @@ -788,11 +701,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1784120854, + "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46", "type": "github" }, "original": { @@ -817,11 +730,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1785090369, + "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "624af665418d3c65d544145b4d34ad696439570e", "type": "github" }, "original": { @@ -841,11 +754,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1780849525, - "narHash": "sha256-yjtMubbmPi4Y4pgDSdmytqUutGJ+LJLcPgXGNNdXiUs=", + "lastModified": 1784057377, + "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=", "owner": "nix-community", "repo": "nixvim", - "rev": "98acb923e5882a6a6a2b660d99e8c5124e08b838", + "rev": "07180a087e4a00720dc0731cbcd8dec796974381", "type": "github" }, "original": { @@ -857,18 +770,17 @@ "pre-commit-hooks": { "inputs": { "flake-compat": "flake-compat", - "gitignore": "gitignore", "nixpkgs": [ "hyprland-git", "nixpkgs" ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1784288435, + "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", "type": "github" }, "original": { @@ -880,18 +792,17 @@ "pre-commit-hooks_2": { "inputs": { "flake-compat": "flake-compat_2", - "gitignore": "gitignore_2", "nixpkgs": [ "neonix", "nixpkgs" ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1783008725, + "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe", "type": "github" }, "original": { @@ -903,17 +814,16 @@ "pre-commit-hooks_3": { "inputs": { "flake-compat": "flake-compat_3", - "gitignore": "gitignore_3", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1784288435, + "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", "type": "github" }, "original": { @@ -931,11 +841,11 @@ "import-tree": "import-tree", "krewfile": "krewfile", "neonix": "neonix", - "nfsm": "nfsm", "niri": "niri", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", - "pre-commit-hooks": "pre-commit-hooks_3" + "pre-commit-hooks": "pre-commit-hooks_3", + "tflow": "tflow" } }, "systems": { @@ -984,18 +894,24 @@ "type": "github" } }, - "systems_4": { + "tflow": { + "inputs": { + "home-manager": "home-manager_2", + "nixpkgs": [ + "nixpkgs" + ] + }, "locked": { - "lastModified": 1689347949, - "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", - "owner": "nix-systems", - "repo": "default-linux", - "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68", + "lastModified": 1785086276, + "narHash": "sha256-fG2j5/tn89K7MOd2eTPO9GmzrVAflZJPaUzkzwWfuVQ=", + "owner": "rapsnx", + "repo": "tflow", + "rev": "4895dc509ce11bf3002409899aacd0c88b7bbedb", "type": "github" }, "original": { - "owner": "nix-systems", - "repo": "default-linux", + "owner": "rapsnx", + "repo": "tflow", "type": "github" } }, @@ -1027,11 +943,11 @@ ] }, "locked": { - "lastModified": 1778265244, - "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=", + "lastModified": 1784371182, + "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968", + "rev": "08d99f727944dd15e4740090305e31c5fb92a50a", "type": "github" }, "original": { @@ -1060,11 +976,11 @@ "xwayland-satellite-unstable": { "flake": false, "locked": { - "lastModified": 1779745227, - "narHash": "sha256-yqY7RtEJGJiENzR0GwL6q69tSAy6xAAmAcLuIhLjPf8=", + "lastModified": 1784679892, + "narHash": "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=", "owner": "Supreeeme", "repo": "xwayland-satellite", - "rev": "5d1efbc9dc3ab1c10160b656e0247f3325daf0f2", + "rev": "8d135d3b2854b30fd01ea6cd6c27e523dd50a839", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 0ebaf259..8058e6a2 100644 --- a/flake.nix +++ b/flake.nix @@ -11,13 +11,21 @@ url = "github:hyprwm/hyprland"; inputs.nixpkgs.follows = "nixpkgs"; }; + niri = { + url = "github:sodiboo/niri-flake"; + inputs.nixpkgs.follows = "nixpkgs"; + }; neonix = { - url = "github:rgroemmer/neonix"; + url = "github:rapsnx/neonix"; }; krewfile = { url = "github:brumhard/krewfile"; inputs.nixpkgs.follows = "nixpkgs"; }; + tflow = { + url = "github:rapsnx/tflow"; + inputs.nixpkgs.follows = "nixpkgs"; + }; disko = { url = "github:nix-community/disko"; inputs.nixpkgs.follows = "nixpkgs"; @@ -29,16 +37,6 @@ nixos-hardware.url = "github:nixos/nixos-hardware/master"; catppuccin.url = "github:catppuccin/nix"; - niri = { - url = "github:sodiboo/niri-flake"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - nfsm = { - # Niri fullscreen manager - url = "github:gvolpe/nfsm"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - import-tree.url = "github:vic/import-tree"; }; @@ -61,7 +59,6 @@ overlays = [ (import ./overlays) - inputs.niri.overlays.niri ]; pkgsFor = lib.genAttrs systems ( @@ -84,6 +81,7 @@ inputs.catppuccin.homeModules.catppuccin inputs.neonix.homeManagerModules.neonix inputs.krewfile.homeManagerModules.krewfile + inputs.tflow.homeManagerModules.default inputs.niri.homeModules.niri (inputs.import-tree.match ".*/default\\.nix" ./modules/home) ./modules/nix.nix diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index cde409df..222d1118 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -24,9 +24,9 @@ desktop = { hyprland = { enable = true; - package = pkgs.hyprland; + configOnly = true; - hyprlock.enable = true; + hyprlock.enable = false; hypridle = { enable = true; cmd = "/usr/bin/swaylock"; @@ -37,6 +37,24 @@ "chromium" ]; }; + + niri = { + enable = false; + autostart = [ + "sleep 3 && mumble" # Need to sleep for tray icon + "firefox" + "chromium" + ]; + }; + + sway = { + enable = false; + autostart = [ + "sleep 3 && mumble" # Need to sleep for tray icon + "firefox" + "chromium" + ]; + }; }; cli = { @@ -51,7 +69,7 @@ home.packages = builtins.attrValues { inherit (pkgs) stackit-cli - openstackclient-full + openstackclient vault-bin brightnessctl ; diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index fc3c4c0c..597d9181 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -20,10 +20,6 @@ user = { name = "kubex"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; - keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi@rapsn.me" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn" - ]; extraOptions = { }; extraGroups = [ ]; }; @@ -31,6 +27,8 @@ roles = { k3s = true; }; + + services.ssh = true; }; networking = { @@ -38,6 +36,12 @@ hostId = "5851308f"; # Required by zfs }; + boot.zfs.forceImportRoot = false; + + security = { + sudo.wheelNeedsPassword = false; + }; + environment = { variables = { PROMPT = "%m@%n> "; diff --git a/hosts/nixberry/default.nix b/hosts/nixberry/default.nix index 0f32d00d..1df3d727 100644 --- a/hosts/nixberry/default.nix +++ b/hosts/nixberry/default.nix @@ -13,9 +13,6 @@ user = { name = "rap"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; - keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn" - ]; extraOptions = { }; extraGroups = [ ]; }; @@ -23,6 +20,7 @@ boot.enable = false; services = { + ssh = true; tailscale = true; }; }; diff --git a/hosts/vinox/default.nix b/hosts/vinox/default.nix index faf32ae6..9f6906b3 100644 --- a/hosts/vinox/default.nix +++ b/hosts/vinox/default.nix @@ -24,8 +24,9 @@ initialHashedPassword = ""; extraOptions = { }; extraGroups = [ ]; - keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v" ]; }; + + services.ssh = true; }; networking.hostName = "vinox"; diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index db650f31..2de9cd39 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -22,7 +22,6 @@ extraOptions = { initialHashedPassword = "$y$j9T$DZQaaK3xGqarN8KE8qnw..$dvgiS7dso5LboGRRf0dcyct/LQUFp4J0LUo2ZRRdTr8"; }; - keys = [ ]; }; services = { @@ -36,6 +35,7 @@ roles = { desktop = true; + gaming.enable = true; }; }; @@ -54,7 +54,9 @@ }; environment = { - systemPackages = [ pkgs.qt6.qtwayland ]; + systemPackages = [ + pkgs.qt6.qtwayland + ]; sessionVariables = { WLR_NO_HARDWARE_CURSORS = "1"; @@ -64,7 +66,9 @@ hardware.i2c.enable = true; - services.udev.packages = [ - pkgs.qmk-udev-rules - ]; + services.udev = { + packages = [ + pkgs.qmk-udev-rules + ]; + }; } diff --git a/hosts/zion/home.nix b/hosts/zion/home.nix index 1912ee81..3d118b55 100644 --- a/hosts/zion/home.nix +++ b/hosts/zion/home.nix @@ -11,6 +11,10 @@ stateVersion = lib.mkDefault "22.05"; }; + # UMU uses Steam's Proton 11+ runtime instead of maintaining a second copy. + xdg.dataFile."umu/steamrt4".source = + config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4"; + roles = { work = false; email = "mail@rapsn.me"; @@ -32,9 +36,5 @@ ]; }; }; - - desktop.niri = { - enable = true; - }; }; } diff --git a/modules/home/browsers/chromium/default.nix b/modules/home/browsers/chromium/default.nix index e866c3e6..d91b26b1 100644 --- a/modules/home/browsers/chromium/default.nix +++ b/modules/home/browsers/chromium/default.nix @@ -9,6 +9,7 @@ commandLineArgs = [ "--enable-features=UseOzonePlatform" "--ozone-platform=wayland" + "--disable-features=WebRtcAllowInputVolumeAdjustment" ]; }; } diff --git a/modules/home/browsers/firefox/default.nix b/modules/home/browsers/firefox/default.nix index 28d0ff2f..a88e79a9 100644 --- a/modules/home/browsers/firefox/default.nix +++ b/modules/home/browsers/firefox/default.nix @@ -10,6 +10,7 @@ in { programs.firefox = { enable = true; + configPath = ".mozilla/firefox"; profiles.default = { name = "Default"; @@ -40,6 +41,8 @@ in "widget.use-xdg-desktop-portal.file-picker" = 0; # Use new gtk file picker instead of legacy one + "widget.wayland.fractional-scale.enabled" = false; # Disable buggy scaling + "toolkit.legacyUserProfileCustomizations.stylesheets" = true; "layers.acceleration.force-enabled" = true; "gfx.webrender.all" = true; diff --git a/modules/home/cli/tools/atuin/default.nix b/modules/home/cli/atuin/default.nix similarity index 100% rename from modules/home/cli/tools/atuin/default.nix rename to modules/home/cli/atuin/default.nix diff --git a/modules/home/cli/tools/core/packages.nix b/modules/home/cli/core/default.nix similarity index 70% rename from modules/home/cli/tools/core/packages.nix rename to modules/home/cli/core/default.nix index cb8d269b..cc80dce7 100644 --- a/modules/home/cli/tools/core/packages.nix +++ b/modules/home/cli/core/default.nix @@ -1,4 +1,7 @@ -{ pkgs, ... }: +{ + pkgs, + ... +}: { home.packages = builtins.attrValues { # Core utility @@ -46,13 +49,29 @@ openssh libfido2 keepassxc - sops # Clipboard wl-clipboard + # AI Shit + codex + claude-code + nodejs + # Monitor / I2C com ddcutil + ; }; + programs = { + bat.enable = true; + fzf = { + enable = true; + historyWidget.command = ""; + }; + btop.enable = true; + zoxide.enable = true; + neonix.enable = true; + eza.enable = true; + }; } diff --git a/modules/home/cli/tools/custom/default.nix b/modules/home/cli/custom/default.nix similarity index 100% rename from modules/home/cli/tools/custom/default.nix rename to modules/home/cli/custom/default.nix diff --git a/modules/home/cli/tools/custom/shell-scripts.nix b/modules/home/cli/custom/shell-scripts.nix similarity index 100% rename from modules/home/cli/tools/custom/shell-scripts.nix rename to modules/home/cli/custom/shell-scripts.nix diff --git a/modules/home/cli/tools/direnv/default.nix b/modules/home/cli/direnv/default.nix similarity index 100% rename from modules/home/cli/tools/direnv/default.nix rename to modules/home/cli/direnv/default.nix diff --git a/modules/home/cli/tools/git/default.nix b/modules/home/cli/git/default.nix similarity index 100% rename from modules/home/cli/tools/git/default.nix rename to modules/home/cli/git/default.nix diff --git a/modules/home/cli/tools/k8s/default.nix b/modules/home/cli/k8s/default.nix similarity index 100% rename from modules/home/cli/tools/k8s/default.nix rename to modules/home/cli/k8s/default.nix diff --git a/modules/home/cli/tools/k8s/k9s.nix b/modules/home/cli/k8s/k9s.nix similarity index 84% rename from modules/home/cli/tools/k8s/k9s.nix rename to modules/home/cli/k8s/k9s.nix index a4b97ba2..648354d8 100644 --- a/modules/home/cli/tools/k8s/k9s.nix +++ b/modules/home/cli/k8s/k9s.nix @@ -4,6 +4,23 @@ ... }: let + gardenerScopes = [ + "shoots" + # all resources in extensions.gardener.cloud/v1alpha1 + "backupbuckets" + "backupentries" + "bastions" + "clusters" + "containerruntimes" + "controlplanes" + "dnsrecords" + "extensions" + "infrastructures" + "networks" + "operatingsystemconfigs" + "workers" + ]; + defaultPlugins = { edit-secret = { description = "Edit Decoded Secret"; @@ -23,22 +40,7 @@ let reconcile = { description = "Reconcile resource"; shortCut = "r"; - scopes = [ - "shoots" - # all resources in extensions.gardener.cloud/v1alpha1 - "backupbuckets" - "backupentries" - "bastions" - "clusters" - "containerruntimes" - "controlplanes" - "dnsrecords" - "extensions" - "infrastructures" - "networks" - "operatingsystemconfigs" - "workers" - ]; + scopes = gardenerScopes; command = "kubectl"; background = true; args = [ diff --git a/modules/home/cli/tools/k8s/krewfile.nix b/modules/home/cli/k8s/krewfile.nix similarity index 100% rename from modules/home/cli/tools/k8s/krewfile.nix rename to modules/home/cli/k8s/krewfile.nix diff --git a/modules/home/cli/tools/k8s/kubecolor.nix b/modules/home/cli/k8s/kubecolor.nix similarity index 100% rename from modules/home/cli/tools/k8s/kubecolor.nix rename to modules/home/cli/k8s/kubecolor.nix diff --git a/modules/home/cli/tools/langs/default.nix b/modules/home/cli/langs/default.nix similarity index 100% rename from modules/home/cli/tools/langs/default.nix rename to modules/home/cli/langs/default.nix diff --git a/modules/home/cli/tools/langs/go.nix b/modules/home/cli/langs/go.nix similarity index 91% rename from modules/home/cli/tools/langs/go.nix rename to modules/home/cli/langs/go.nix index b2375cd0..f45ca07b 100644 --- a/modules/home/cli/tools/langs/go.nix +++ b/modules/home/cli/langs/go.nix @@ -9,6 +9,7 @@ package = pkgs.go; env = { GOPATH = "${config.home.homeDirectory}/go"; + CGO_ENABLED = "0"; GOPRIVATE = [ "github.com/stackitcloud" "dev.azure.com/*" diff --git a/modules/home/cli/tools/langs/rust.nix b/modules/home/cli/langs/rust.nix similarity index 100% rename from modules/home/cli/tools/langs/rust.nix rename to modules/home/cli/langs/rust.nix diff --git a/modules/home/cli/tools/lazygit/default.nix b/modules/home/cli/lazygit/default.nix similarity index 100% rename from modules/home/cli/tools/lazygit/default.nix rename to modules/home/cli/lazygit/default.nix diff --git a/modules/home/cli/tools/pet/default.nix b/modules/home/cli/pet/default.nix similarity index 63% rename from modules/home/cli/tools/pet/default.nix rename to modules/home/cli/pet/default.nix index b8090478..470b5b89 100644 --- a/modules/home/cli/tools/pet/default.nix +++ b/modules/home/cli/pet/default.nix @@ -1,6 +1,6 @@ { lib, - inputs, + config, ... }: { @@ -8,7 +8,7 @@ enable = true; settings = { General = lib.mkForce { - snippetfile = "${inputs.self.outPath}/extra/snippet.toml"; + snippetfile = "${config.home.homeDirectory}/Projects/rapsnx/dotfiles/extra/snippet.toml"; selectcmd = "fzf --ansi"; color = true; }; diff --git a/modules/home/cli/tools/starship/default.nix b/modules/home/cli/starship/default.nix similarity index 98% rename from modules/home/cli/tools/starship/default.nix rename to modules/home/cli/starship/default.nix index b67a0d3e..ec7b44c9 100644 --- a/modules/home/cli/tools/starship/default.nix +++ b/modules/home/cli/starship/default.nix @@ -20,11 +20,7 @@ "$git_branch$git_status" "[](fg:yellow bg:base)" "$git_metrics" - - "$fill" - "$nix_shell" - "$shlvl" "$line_break" diff --git a/modules/home/cli/terminals/alacritty/default.nix b/modules/home/cli/terminals/alacritty/default.nix index 2ac151fd..f65db5a4 100644 --- a/modules/home/cli/terminals/alacritty/default.nix +++ b/modules/home/cli/terminals/alacritty/default.nix @@ -1,4 +1,22 @@ { pkgs, ... }: +let + generalBinding = { + key = "H"; + mods = "Control"; + }; + + platformBinding = { + key = "K"; + mods = "Control"; + }; + + # Keep these as one alternation per mode. This prevents overlapping matches + # such as a hostname inside a URL from producing duplicate hint labels. + generalRegex = ''(?:ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh://|ftp://)[^[:space:]<>"\x27{}^\x60]+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?-u:\b)(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}(?-u:\b)|\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|(?-u:\b)[0-9A-Fa-f]{8}(?:-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}(?-u:\b)|(?-u:\b)[0-9A-Fa-f]{32}(?-u:\b)|(?:~|\.{1,2})/[^[:space:]<>"\x27\x60]+|/(?:home|etc|var|tmp|usr|opt|run|dev|mnt|root)/[^[:space:]<>"\x27\x60]+|(?-u:\b)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}(?-u:\b)|(?-u:\b)[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+:[^[:space:]<>"\x27\x60]+''; + + platformRegex = ''(?-u:\b)shoot-[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:-[a-z0-9](?:[-a-z0-9]*[a-z0-9])?)+(?-u:\b)|(?-u:\b)(?:source-)?shoot--[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:--[a-z0-9](?:[-a-z0-9]*[a-z0-9])?){1,2}(?-u:\b)|(?-u:\b)[a-z0-9](?:[a-z0-9._-]*[a-z0-9])*(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})(?-u:\b)|(?-u:\b)[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)+(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})(?-u:\b)|(?:context|ctx|namespace|ns)[=:][[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:--context|--namespace|-n)[=:[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?\.)+[a-z0-9](?:[-a-z0-9]*[a-z0-9])?/[A-Za-z0-9][A-Za-z0-9_.-]*(?:[=:][[:space:]]*[A-Za-z0-9_.:/-]+)?|(?-u:\b)[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:/-]+(?-u:\b)|(?-u:\b)[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.svc(?:\.cluster\.local)?(?-u:\b)|(?:\[[0-9A-Fa-f:]+\]|(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}):[0-9]{1,5}''; + +in { home.packages = [ pkgs.nerd-fonts.caskaydia-cove @@ -25,18 +43,23 @@ }; hints.enabled = [ - # Hint to copy uuids + # General copy hints: links, network identifiers, paths, and Git + # artifacts without matching arbitrary hyphenated words. { action = "Copy"; + binding = generalBinding; hyperlinks = true; post_processing = true; - # URL, email, ipv4/6, UUID, Git-Hash - regex = ''(?:(?:https?://|ssh://)[^\\s<>"']+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}|\\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|[0-9a-fA-F]{7,40})''; + regex = generalRegex; + } - binding = { - key = "H"; - mods = "Control|Shift"; - }; + # Kubernetes and Gardener copy hints: images, Shoot technical IDs, + # selectors, annotations, contexts, namespaces, and endpoints. + { + action = "Copy"; + binding = platformBinding; + post_processing = true; + regex = platformRegex; } ]; diff --git a/modules/home/cli/terminals/tmux/default.nix b/modules/home/cli/terminals/tmux/default.nix new file mode 100644 index 00000000..bf75f263 --- /dev/null +++ b/modules/home/cli/terminals/tmux/default.nix @@ -0,0 +1,6 @@ +{ + programs.tmux = { + enable = true; + mouse = true; + }; +} diff --git a/modules/home/cli/tflow/default.nix b/modules/home/cli/tflow/default.nix new file mode 100644 index 00000000..1d901a63 --- /dev/null +++ b/modules/home/cli/tflow/default.nix @@ -0,0 +1,5 @@ +{ + programs.tflow = { + enable = true; + }; +} diff --git a/modules/home/cli/tools/core/default.nix b/modules/home/cli/tools/core/default.nix deleted file mode 100644 index ccf22c23..00000000 --- a/modules/home/cli/tools/core/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - imports = [ - ./packages.nix - ./programs.nix - ]; -} diff --git a/modules/home/cli/tools/core/programs.nix b/modules/home/cli/tools/core/programs.nix deleted file mode 100644 index 889d1a85..00000000 --- a/modules/home/cli/tools/core/programs.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ - # catppuccin = { - # bat.enable = true; - # fzf.enable = true; - # btop.enable = true; - # }; - - programs = { - bat.enable = true; - fzf.enable = true; - btop.enable = true; - - zoxide.enable = true; - neonix.enable = true; - eza.enable = true; - }; -} diff --git a/modules/home/cli/shells/zsh/default.nix b/modules/home/cli/zsh/default.nix similarity index 97% rename from modules/home/cli/shells/zsh/default.nix rename to modules/home/cli/zsh/default.nix index 00dfde98..5f85bbd5 100644 --- a/modules/home/cli/shells/zsh/default.nix +++ b/modules/home/cli/zsh/default.nix @@ -13,6 +13,10 @@ inherit (pkgs) zsh-completions; }; + home.sessionPath = [ + "$HOME/.local/bin" + ]; + programs.zsh = { enable = true; diff --git a/modules/home/common/default.nix b/modules/home/common/default.nix index 48666c57..688d6c8a 100644 --- a/modules/home/common/default.nix +++ b/modules/home/common/default.nix @@ -7,6 +7,7 @@ catppuccin = { enable = true; + autoEnable = true; flavor = "mocha"; }; diff --git a/modules/home/common/roles.nix b/modules/home/common/roles.nix index 5bc2e338..5e24cd42 100644 --- a/modules/home/common/roles.nix +++ b/modules/home/common/roles.nix @@ -17,8 +17,7 @@ config = let - apparmorRuleGen = app: path: '' - cat </etc/apparmor.d/${app}-nix + apparmorRule = app: path: '' # Warning this is auto-generated apparmor profile via nix. abi , include @@ -26,17 +25,52 @@ profile ${app}-nix ${path} flags=(unconfined) { userns, } - EOF ''; + apparmorRuleGen = app: path: '' + cat </etc/apparmor.d/${app}-nix + ${apparmorRule app path}EOF + ''; + + apparmorProfiles = map (pkg: { + app = pkg.pname; + path = lib.getExe pkg; + content = pkgs.writeText "${pkg.pname}-apparmor-profile" (apparmorRule pkg.pname (lib.getExe pkg)); + }) config.roles.apparmor-gen; + apparmorProfilesGen = lib.strings.concatStrings ( - (map (pkg: apparmorRuleGen pkg.pname (lib.getExe pkg)) config.roles.apparmor-gen) + (map (profile: apparmorRuleGen profile.app profile.path) apparmorProfiles) ++ [ "sudo systemctl reload apparmor" ] ); + + apparmorProfilesChanged = pkgs.writeShellScript "apparmor-profiles-changed" '' + ${lib.strings.concatStringsSep "\n" ( + map (profile: '' + if ! ${lib.getExe' pkgs.diffutils "cmp"} --silent ${profile.content} /etc/apparmor.d/${profile.app}-nix; then + exit 0 + fi + '') apparmorProfiles + )} + exit 1 + ''; + + noisetorchExe = lib.getExe pkgs.noisetorch; + noisetorchCapsSet = pkgs.writeShellScript "noisetorch-caps-set" '' + test "$(${lib.getExe' pkgs.libcap "getcap"} ${noisetorchExe} 2>/dev/null)" = "${noisetorchExe} cap_sys_resource=ep" + ''; in - lib.mkIf (config.roles.apparmor-gen != [ ]) { - home.activation.apparmor-gen = lib.hm.dag.entryAfter [ "writeBoundary" ] '' - run warnEcho "sudo ${pkgs.writeShellScript "apparmor-gen" apparmorProfilesGen}" + lib.mkIf (config.roles.apparmor-gen != [ ] || config.roles.work) { + home.activation.roles = lib.hm.dag.entryAfter [ "writeBoundary" ] '' + ${lib.optionalString (config.roles.apparmor-gen != [ ]) '' + if ${apparmorProfilesChanged}; then + run warnEcho "sudo ${pkgs.writeShellScript "apparmor-gen" apparmorProfilesGen}" + fi + ''} + ${lib.optionalString config.roles.work '' + if ! ${noisetorchCapsSet}; then + run warnEcho "sudo setcap 'CAP_SYS_RESOURCE=+ep' ${noisetorchExe}" + fi + ''} ''; }; } diff --git a/modules/home/desktops/addons/idle-lock/default.nix b/modules/home/desktops/addons/idle-lock/default.nix new file mode 100644 index 00000000..8f927bb6 --- /dev/null +++ b/modules/home/desktops/addons/idle-lock/default.nix @@ -0,0 +1,80 @@ +{ + lib, + pkgs, + config, + ... +}: +let + enabled = config.roles.desktop.sway.enable || config.roles.desktop.niri.enable; + + # Sway and niri both need swayidle/swaylock (compositor-agnostic wlr-protocol + # tools despite the name), but each needs a different DPMS command. Both + # compositors can be enabled at once (as separate selectable sessions), so + # this detects which one is actually running rather than being duplicated + # per-compositor, which would double up the swayidle timeout list. + # + # Built as a real script (not an inline multi-line string) because + # services.swayidle.timeouts[].command is embedded verbatim into a + # systemd unit file's ExecStart= line -- a raw multi-line value there + # breaks systemd's unit-file parser (each embedded newline starts a new, + # invalid "key=value" line) unless every line ends with a `\` line + # continuation. A script path avoids that entirely. + dpmsToggle = pkgs.writeShellScript "dpms-toggle" '' + set -euo pipefail + state="''${1:?missing state (on|off)}" + if pgrep -x sway >/dev/null; then + swaymsg output '*' dpms "$state" + elif pgrep -x niri >/dev/null; then + case "$state" in + off) niri msg action power-off-monitors ;; + on) niri msg action power-on-monitors ;; + esac + fi + ''; + + lockCmd = "${config.programs.swaylock.package}/bin/swaylock -f"; +in +{ + config = lib.mkIf enabled { + catppuccin.swaylock.enable = false; + + programs.swaylock = { + enable = true; + settings = { + color = "1e1e2e"; + indicator = true; + indicator-radius = 100; + indicator-thickness = 10; + inside-color = "5b6078"; + ring-color = "cad3f5"; + line-color = "00000000"; + separator-color = "00000000"; + key-hl-color = "a6da95"; + bs-hl-color = "ed8796"; + ignore-empty-password = true; + }; + }; + + services.swayidle = { + enable = true; + systemdTargets = [ + "sway-session.target" + "graphical-session.target" + ]; + + timeouts = [ + { + timeout = 300; + command = lockCmd; + } + { + timeout = 3600; + command = "${dpmsToggle} off"; + resumeCommand = "${dpmsToggle} on"; + } + ]; + + events.lock = lockCmd; + }; + }; +} diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 3ff4b50b..2566b878 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -1,100 +1,50 @@ -{ pkgs, lib, ... }: { - services.kanshi = - let - hyprctl = lib.getExe' pkgs.hyprland "hyprctl"; - - # Pins Hyprland workspaces to monitors. - # Args: primary matcher, optional secondary matcher. - # Writes workspace config for hyprland, reloads it, and sets focus. - workspaceSetup = pkgs.writeShellScriptBin "workspaceSetup" '' - set -euo pipefail - - monitors="$(${hyprctl} monitors -j)" - - match_monitor() { - ${lib.getExe pkgs.jq} -r --arg matcher "$1" ' - [.[] | select(.description | test($matcher)) | .name][0]' <<< "$monitors" - } - - primary="$(match_monitor "''${1:?missing primary monitor matcher}")" - secondary="$(match_monitor "''${2:-$1}")" - - cat > "$HOME/.config/hypr/workspaces.conf" </dev/null 2>&1; then + ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zpool import -aN + fi + + until ${pkgs.zfs}/bin/zpool list -H "$pool" >/dev/null 2>&1; do + echo "Waiting for ZFS pool $pool to appear" + sleep 2 + done + + echo "Loading encryption key for $pool from $key_source" + # Refuse an unverified nixberry host key; accepting a new key here + # would allow a network attacker to impersonate the key server. + while true; do + if key="$(${pkgs.openssh}/bin/ssh \ + -o BatchMode=yes \ + -o ConnectTimeout=10 \ + -o StrictHostKeyChecking=yes \ + "$key_source" ulock-agent get)"; then + break + fi + + echo "Waiting for SSH access to $key_source" + sleep 5 + done + + printf '%s\n' "$key" | ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zfs load-key "$pool" + ''; + }; + + systemd.services.k3s = { + requires = [ "wait-for-zfs-pool.service" ]; + after = [ "wait-for-zfs-pool.service" ]; + }; + }; +} diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix index 3f00e110..1783a191 100644 --- a/modules/nixos/services/default.nix +++ b/modules/nixos/services/default.nix @@ -7,5 +7,6 @@ ./tailscale.nix ./printer.nix ./bluetooth.nix + ./ssh.nix ]; } diff --git a/modules/nixos/services/nh.nix b/modules/nixos/services/nh.nix index b0f9f4ac..34d06270 100644 --- a/modules/nixos/services/nh.nix +++ b/modules/nixos/services/nh.nix @@ -3,6 +3,6 @@ enable = true; clean.enable = true; clean.extraArgs = "--keep 5 --keep-since 5d"; - flake = "/home/rap/Projects/rgroemmer/dotfiles"; + flake = "/home/rap/Projects/rapsnx/dotfiles"; }; } diff --git a/modules/nixos/services/ssh.nix b/modules/nixos/services/ssh.nix new file mode 100644 index 00000000..da5babb9 --- /dev/null +++ b/modules/nixos/services/ssh.nix @@ -0,0 +1,23 @@ +{ + lib, + config, + ... +}: +let + cfg = config.hostConfig.services.ssh; +in +{ + options.hostConfig.services.ssh = lib.mkEnableOption "OpenSSH server"; + + config = lib.mkIf cfg { + services.openssh = { + enable = true; + settings = { + PubkeyAuthentication = true; + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + PermitRootLogin = "prohibit-password"; + }; + }; + }; +} diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix index 244a8961..9dd58b2d 100644 --- a/modules/nixos/system/boot.nix +++ b/modules/nixos/system/boot.nix @@ -26,14 +26,13 @@ in kernelParams = [ "quiet" - "splash" "boot.shell_on_fail" "udev.log_priority=3" "rd.systemd.show_status=auto" ]; loader = { - timeout = lib.mkDefault 3; + timeout = lib.mkDefault 0; systemd-boot = { enable = true; diff --git a/modules/nixos/system/env.nix b/modules/nixos/system/env.nix index 5cfa7f83..b066a974 100644 --- a/modules/nixos/system/env.nix +++ b/modules/nixos/system/env.nix @@ -26,10 +26,12 @@ ; } # TODO: wtf? - ++ lib.optionals (!config.hostConfig.roles.desktop) (lib.attrValues { - inherit (inputs.neonix.packages.${pkgs.stdenv.hostPlatform.system}) mini; - inherit (pkgs) jq tmux; - }); + ++ lib.optionals (!config.hostConfig.roles.desktop) ( + lib.attrValues { + inherit (inputs.neonix.packages.${pkgs.stdenv.hostPlatform.system}) mini; + inherit (pkgs) jq; + } + ); variables = { EDITOR = "vim"; VISUAL = "vim"; diff --git a/modules/nixos/system/user.nix b/modules/nixos/system/user.nix index 7fe57285..958484cf 100644 --- a/modules/nixos/system/user.nix +++ b/modules/nixos/system/user.nix @@ -12,7 +12,6 @@ in options.hostConfig.user = { name = mylib.mkOpt lib.types.str "Name of user."; initialHashedPassword = mylib.mkOpt lib.types.str "Password of user."; - keys = mylib.mkOpt (lib.types.listOf lib.types.str) "Public SSH keys of user."; extraGroups = mylib.mkOpt' (lib.types.listOf lib.types.str) [ ] "Additional groups for the user."; extraOptions = mylib.mkOpt lib.types.attrs "Additional options for the user."; }; @@ -24,7 +23,10 @@ in shell = pkgs.zsh; initialHashedPassword = lib.mkForce cfg.initialHashedPassword; - openssh.authorizedKeys.keys = cfg.keys; + openssh.authorizedKeys.keys = [ + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" + ]; extraGroups = [ "wheel" @@ -42,7 +44,6 @@ in "/share/zsh" # autocompletion "/share/xdg-desktop-portal" ]; - services.openssh.enable = true; nix.optimise.automatic = true; system.stateVersion = "24.11"; };