From 755cad64c6c08baf6296962c85b3624ad647d80a Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 00:40:06 +0200 Subject: [PATCH 01/71] Use regreet and playmouth --- modules/nixos/roles/desktop/hyprland.nix | 83 ++++++++++++++++++++---- 1 file changed, 72 insertions(+), 11 deletions(-) diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix index c9d854f1..8cc9f19b 100644 --- a/modules/nixos/roles/desktop/hyprland.nix +++ b/modules/nixos/roles/desktop/hyprland.nix @@ -6,26 +6,87 @@ }: let cfg = config.hostConfig.roles.desktop; + catppuccinFlavor = "mocha"; + catppuccinAccent = "mauve"; + cursorTheme = { + name = "catppuccin-${catppuccinFlavor}-${catppuccinAccent}-cursors"; + package = pkgs.catppuccin-cursors.mochaMauve; + }; + gtkTheme = { + name = "Catppuccin-GTK-Mauve-Dark"; + package = pkgs.magnetic-catppuccin-gtk.override { + tweaks = [ "black" ]; + accent = [ catppuccinAccent ]; + }; + }; in { config = lib.mkIf cfg { - programs.hyprland = { + boot.plymouth.enable = true; + + catppuccin = { enable = true; - withUWSM = false; + autoEnable = true; + flavor = catppuccinFlavor; + accent = catppuccinAccent; + + cursors.enable = true; + plymouth.enable = true; + tty.enable = true; }; - programs.niri.enable = true; + programs = { + hyprland = { + enable = true; + withUWSM = false; + }; + + niri.enable = true; + + regreet = { + enable = true; + + theme = gtkTheme; + + font = { + name = "CaskaydiaCove Nerd Font"; + package = pkgs.nerd-fonts.caskaydia-cove; + size = 15; + }; + + inherit cursorTheme; + + settings = { + background = { + path = ../../../../extra/wallpapers/minimal-space.jpg; + fit = "Cover"; + }; + + GTK.application_prefer_dark_theme = true; + }; + + extraCss = '' + window { + background-color: rgba(17, 17, 27, 0.92); + } + + box#body { + background-color: rgba(24, 24, 37, 0.78); + border: 1px solid rgba(203, 166, 247, 0.35); + border-radius: 12px; + padding: 32px; + } + + button { + border-radius: 8px; + } + ''; + }; + }; services.greetd = { enable = true; - - settings.default_session.command = '' - ${pkgs.tuigreet}/bin/tuigreet \ - --time \ - --remember \ - --theme 'border=magenta;text=cyan;prompt=green;time=red;action=blue;button=yellow;container=black;input=red' \ - --cmd start-hyprland - ''; + greeterManagesPlymouth = true; }; }; } From 6381119be6956a514ec5ace9a303b21cfcdf5ddb Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 00:58:52 +0200 Subject: [PATCH 02/71] Flake update --- README.md | 6 +- flake.lock | 92 +++++++++++------------ modules/home/browsers/firefox/default.nix | 2 + 3 files changed, 51 insertions(+), 49 deletions(-) diff --git a/README.md b/README.md index b5bdfb25..a113cc32 100644 --- a/README.md +++ b/README.md @@ -45,9 +45,9 @@ nh home switch -c nix@firefly . # nix build installer iso nix build .#nixosConfigurations.vinox.config.system.build.isoImage -# nh remote switch -nh os switch --hostname kubex . -d always --target-host kubex -nh os switch --hostname nixberry . -d always --target-host +# nh remote switch / update +nh os boot --hostname kubex . -d always --target-host kubex +nh os boot --hostname nixberry . -d always --target-host # nix remote switch nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo diff --git a/flake.lock b/flake.lock index e54688b8..e76881c2 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1778857089, - "narHash": "sha256-TclWRW2SdFeETLaiTG4BA8C8C4m/LppQEldncqyTzAQ=", + "lastModified": 1780756231, + "narHash": "sha256-tXQxKdG5716uB9/LIkLQqQwHKf5mRSpHoZhz3lyI2Cg=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "ab2b0af63fbc9fb779d684f19149b790978be8a8", + "rev": "6ecde03f47172753fe5a2f334f9d3facfb7e6784", "type": "github" }, "original": { @@ -38,11 +38,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1780833533, - "narHash": "sha256-0StMUC1sOkiQq7qoLQpobwVlad09EA5cy7HZit172Fw=", + "lastModified": 1782117778, + "narHash": "sha256-x6vIJpJziw3Hs0JKKDP+AeRPWwqyMDOmK6I26tqbYj4=", "owner": "catppuccin", "repo": "nix", - "rev": "4dd4177dc14b0c0b23bf3ce403f813be0c4c30de", + "rev": "e98afe2dfd950bda4e6a8ef32bb563ec2f04505a", "type": "github" }, "original": { @@ -58,11 +58,11 @@ ] }, "locked": { - "lastModified": 1780290312, - "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=", + "lastModified": 1781152676, + "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", "owner": "nix-community", "repo": "disko", - "rev": "115e5211780054d8a890b41f0b7734cafad54dfe", + "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", "type": "github" }, "original": { @@ -252,11 +252,11 @@ ] }, "locked": { - "lastModified": 1780679734, - "narHash": "sha256-KmRNvpNOb7QEORa06bVgjW9kITcx0VhsI7w0vhmZyD8=", + "lastModified": 1782233665, + "narHash": "sha256-h/xOtrByoA/Ak1lWHn0O1lVZz4qWYbwOSLQ8YSwQO0I=", "owner": "nix-community", "repo": "home-manager", - "rev": "b2b7db486e06e098711dc291bb25db82850e1d16", + "rev": "062581938b4a378a82dfbb294b494808157153a1", "type": "github" }, "original": { @@ -342,11 +342,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1780768552, - "narHash": "sha256-J2gBzBBE9C6LMMJec8buysLAQl7QmqtP/oMrPfVioYc=", + "lastModified": 1782226626, + "narHash": "sha256-aFkQmqXUPXzV117P853JKe6s/pzohzxZSjzCs9Pw9fc=", "owner": "hyprwm", "repo": "hyprland", - "rev": "20ee7553c95dd1fa30a00564561f40f7986ffbc7", + "rev": "049595e196db4a4ab162ce58aadd016e929327c8", "type": "github" }, "original": { @@ -519,11 +519,11 @@ ] }, "locked": { - "lastModified": 1779475241, - "narHash": "sha256-Nw4DN0A5krWNcPBvuWe5Gz2yuxsUUPiDgtu6SVPJQeU=", + "lastModified": 1780251518, + "narHash": "sha256-fG9xbb1SOAAJ+2kJRakp3ch+BmA/3dEg/K3PoAZTKkw=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "3cd3972b2ee658a14d2610d8494e09259e530124", + "rev": "40ede2e7bdec80ba5d4c443160d905e9f841ae5f", "type": "github" }, "original": { @@ -692,11 +692,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1780694373, - "narHash": "sha256-wuj6QmOlLsGjBOut+Ki/hiOT/H5ONzBePqOkOolsNfo=", + "lastModified": 1781795508, + "narHash": "sha256-VKrApQ3WCkEe9D8DbaeFjGqLAh7zqYGYjbQYtY5ikxc=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "8f7043c852210cd0875a1bbe9ca872c90ab5ac74", + "rev": "493ce1e33e72f86312584f331c8cf52b3432ec99", "type": "github" }, "original": { @@ -725,11 +725,11 @@ "niri-unstable": { "flake": false, "locked": { - "lastModified": 1780637332, - "narHash": "sha256-FeKyLRxLZu2EUnhifijZPDZRl0sVnPVHMtizAINNiN4=", + "lastModified": 1781781064, + "narHash": "sha256-Ii/koEm/sRyg65qbAQWqEgboSEIhdH0EL4KglAc14p0=", "owner": "YaLTeR", "repo": "niri", - "rev": "f717ae030fe56fc52522ebef69f17f3f09064ac4", + "rev": "49fc6117fd6c043adaa2ead316b82db5ed735d36", "type": "github" }, "original": { @@ -743,11 +743,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1780310866, - "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=", + "lastModified": 1782166108, + "narHash": "sha256-/EtnQBcKbsaCAGQ5VRcplrHRkR4ryqyLMpBfkVuG9Xw=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "4ed851c979641e28597a05086332d75cdc9e395f", + "rev": "875776f0252fcb8618bb948640a0d1f7a5b362be", "type": "github" }, "original": { @@ -759,11 +759,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1780365719, - "narHash": "sha256-JX05Ms/dk0c+UoW9IqQriB53HNZFckX9Qd3EJqmcqEw=", - "rev": "ffa10e26ae11d676b2db836259889f1f571cb14f", + "lastModified": 1781607440, + "narHash": "sha256-eM+l4TVD26SNoEjcxRcpispqZi5Qrqj/G0ZY4LfqwfM=", + "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158", "type": "tarball", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1009182.ffa10e26ae11/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1017567.3e41b24abd26/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -772,11 +772,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1780511130, - "narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=", + "lastModified": 1781509190, + "narHash": "sha256-uJZs9Di8I6ciTp6jiojj0HzlNpBkud8ax5aT/O5aJkw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "535f3e6942cb1cead3929c604320d3db54b542b9", + "rev": "d6df3513510aa548c83868fd22bfddd0a8c0a0d4", "type": "github" }, "original": { @@ -817,11 +817,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1781577229, + "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", "type": "github" }, "original": { @@ -909,11 +909,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { @@ -1027,11 +1027,11 @@ ] }, "locked": { - "lastModified": 1778265244, - "narHash": "sha256-8jlPtGSsv/CQY6tVVyLF4Jjd0gnS+Zbn9yk/V13A9nM=", + "lastModified": 1780133819, + "narHash": "sha256-0YPKIY3dlnR7SPq7Z8ekFVvzFsfeiAtEj+QUI3KHrlI=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "813ea5ca9a1702a9a2d1f5836bc00172ef698968", + "rev": "4a170c0ba96fd37374f93d8f91c9ed91814828ac", "type": "github" }, "original": { @@ -1060,11 +1060,11 @@ "xwayland-satellite-unstable": { "flake": false, "locked": { - "lastModified": 1779745227, - "narHash": "sha256-yqY7RtEJGJiENzR0GwL6q69tSAy6xAAmAcLuIhLjPf8=", + "lastModified": 1781226823, + "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=", "owner": "Supreeeme", "repo": "xwayland-satellite", - "rev": "5d1efbc9dc3ab1c10160b656e0247f3325daf0f2", + "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e", "type": "github" }, "original": { diff --git a/modules/home/browsers/firefox/default.nix b/modules/home/browsers/firefox/default.nix index 28d0ff2f..b8d07d95 100644 --- a/modules/home/browsers/firefox/default.nix +++ b/modules/home/browsers/firefox/default.nix @@ -40,6 +40,8 @@ in "widget.use-xdg-desktop-portal.file-picker" = 0; # Use new gtk file picker instead of legacy one + "widget.wayland.fractional-scale.enabled" = false; # Disable buggy scaling + "toolkit.legacyUserProfileCustomizations.stylesheets" = true; "layers.acceleration.force-enabled" = true; "gfx.webrender.all" = true; From ead8d3f0ddacef47961b8325eeca5faaae181a16 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 14:30:28 +0200 Subject: [PATCH 03/71] Set sk-keys everywhere, remove tech-key --- hosts/kubex/default.nix | 4 ++-- hosts/nixberry/default.nix | 3 ++- hosts/vinox/default.nix | 5 ++++- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index fc3c4c0c..f01448a6 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -21,8 +21,8 @@ name = "kubex"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi@rapsn.me" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" ]; extraOptions = { }; extraGroups = [ ]; diff --git a/hosts/nixberry/default.nix b/hosts/nixberry/default.nix index 0f32d00d..9194bf81 100644 --- a/hosts/nixberry/default.nix +++ b/hosts/nixberry/default.nix @@ -14,7 +14,8 @@ name = "rap"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v techkey@rapsn" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" ]; extraOptions = { }; extraGroups = [ ]; diff --git a/hosts/vinox/default.nix b/hosts/vinox/default.nix index faf32ae6..a58eb360 100644 --- a/hosts/vinox/default.nix +++ b/hosts/vinox/default.nix @@ -24,7 +24,10 @@ initialHashedPassword = ""; extraOptions = { }; extraGroups = [ ]; - keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqKYXW07z0llbDKRIakLD1PjHe3HxK9iu6czXs+ZU7v" ]; + keys = [ + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" + ]; }; }; From 40ad8e1cd1d376bec146b2734c3265366f96d4c3 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 15:37:41 +0200 Subject: [PATCH 04/71] plymouth + greeter --- modules/nixos/roles/desktop/hyprland.nix | 82 ++++-------------------- 1 file changed, 12 insertions(+), 70 deletions(-) diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix index 8cc9f19b..a23a7ce5 100644 --- a/modules/nixos/roles/desktop/hyprland.nix +++ b/modules/nixos/roles/desktop/hyprland.nix @@ -6,87 +6,29 @@ }: let cfg = config.hostConfig.roles.desktop; - catppuccinFlavor = "mocha"; - catppuccinAccent = "mauve"; - cursorTheme = { - name = "catppuccin-${catppuccinFlavor}-${catppuccinAccent}-cursors"; - package = pkgs.catppuccin-cursors.mochaMauve; - }; - gtkTheme = { - name = "Catppuccin-GTK-Mauve-Dark"; - package = pkgs.magnetic-catppuccin-gtk.override { - tweaks = [ "black" ]; - accent = [ catppuccinAccent ]; - }; - }; in { config = lib.mkIf cfg { - boot.plymouth.enable = true; - - catppuccin = { + boot.plymouth = { enable = true; - autoEnable = true; - flavor = catppuccinFlavor; - accent = catppuccinAccent; - - cursors.enable = true; - plymouth.enable = true; - tty.enable = true; }; - programs = { - hyprland = { - enable = true; - withUWSM = false; - }; - - niri.enable = true; - - regreet = { - enable = true; - - theme = gtkTheme; - - font = { - name = "CaskaydiaCove Nerd Font"; - package = pkgs.nerd-fonts.caskaydia-cove; - size = 15; - }; - - inherit cursorTheme; - - settings = { - background = { - path = ../../../../extra/wallpapers/minimal-space.jpg; - fit = "Cover"; - }; - - GTK.application_prefer_dark_theme = true; - }; - - extraCss = '' - window { - background-color: rgba(17, 17, 27, 0.92); - } - - box#body { - background-color: rgba(24, 24, 37, 0.78); - border: 1px solid rgba(203, 166, 247, 0.35); - border-radius: 12px; - padding: 32px; - } + programs.hyprland = { + enable = true; + withUWSM = false; + }; - button { - border-radius: 8px; - } - ''; - }; + catppuccin = { + enable = true; + flavor = "macchiato"; }; + programs.niri.enable = true; + services.greetd = { enable = true; - greeterManagesPlymouth = true; + + settings.default_session.command = "${pkgs.tuigreet}/bin/tuigreet --cmd start-hyprland"; }; }; } From f01e80c74d171b1e5e36dde84acb537a13c94650 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 15:54:48 +0200 Subject: [PATCH 05/71] keyring shit --- modules/home/services/keyring.nix | 18 ++++++++++-------- modules/nixos/roles/desktop/default.nix | 17 +++++++++++++++++ 2 files changed, 27 insertions(+), 8 deletions(-) diff --git a/modules/home/services/keyring.nix b/modules/home/services/keyring.nix index 8d27aa7f..111e8d49 100644 --- a/modules/home/services/keyring.nix +++ b/modules/home/services/keyring.nix @@ -1,12 +1,14 @@ -{ pkgs, ... }: { - services.gnome-keyring = { - enable = true; - components = [ - "pkcs11" - "secrets" - ]; - }; + config, + lib, + pkgs, + ... +}: +{ + # On NixOS, PAM starts and unlocks the login keyring. On generic Linux hosts, + # Home Manager still needs to provide the user service. + services.gnome-keyring.enable = lib.mkForce config.targets.genericLinux.enable; + home.packages = builtins.attrValues { inherit (pkgs) gcr seahorse; }; diff --git a/modules/nixos/roles/desktop/default.nix b/modules/nixos/roles/desktop/default.nix index 502715d1..ef9c9b52 100644 --- a/modules/nixos/roles/desktop/default.nix +++ b/modules/nixos/roles/desktop/default.nix @@ -1,3 +1,11 @@ +{ + lib, + config, + ... +}: +let + cfg = config.hostConfig.roles.desktop; +in { imports = [ ./hyprland.nix @@ -5,4 +13,13 @@ ./power.nix ./explorer.nix ]; + + config = lib.mkIf cfg { + services.gnome.gnome-keyring.enable = true; + + security.pam.services = { + greetd.enableGnomeKeyring = true; + login.enableGnomeKeyring = true; + }; + }; } From 9dd6028ff3cca090e8a13fc24666df64738af0e7 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 15:54:50 +0200 Subject: [PATCH 06/71] lel --- modules/home/cli/tools/core/packages.nix | 3 ++ modules/nixos/roles/desktop/hyprland.nix | 57 +++++++++++++++++++++--- modules/nixos/system/boot.nix | 1 - 3 files changed, 53 insertions(+), 8 deletions(-) diff --git a/modules/home/cli/tools/core/packages.nix b/modules/home/cli/tools/core/packages.nix index cb8d269b..a13b7aa6 100644 --- a/modules/home/cli/tools/core/packages.nix +++ b/modules/home/cli/tools/core/packages.nix @@ -51,6 +51,9 @@ # Clipboard wl-clipboard + # AI Shit + codex + # Monitor / I2C com ddcutil ; diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix index a23a7ce5..5569222f 100644 --- a/modules/nixos/roles/desktop/hyprland.nix +++ b/modules/nixos/roles/desktop/hyprland.nix @@ -6,29 +6,72 @@ }: let cfg = config.hostConfig.roles.desktop; + + tuigreetTheme = lib.concatStringsSep ";" [ + "container=black" + "text=white" + "border=magenta" + "title=magenta" + "greet=cyan" + "prompt=blue" + "input=magenta" + "time=green" + "action=yellow" + "button=red" + ]; + + tuigreetCommand = lib.escapeShellArgs [ + "${pkgs.tuigreet}/bin/tuigreet" + "--sessions" + "${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" + "--session-wrapper" + "${config.services.displayManager.sessionData.wrapper}" + "--time" + "--remember" + "--remember-user-session" + "--asterisks" + "--theme" + tuigreetTheme + ]; in { config = lib.mkIf cfg { - boot.plymouth = { - enable = true; - }; + boot.plymouth.enable = true; - programs.hyprland = { - enable = true; - withUWSM = false; + console = { + font = "ter-v32n"; + packages = [ pkgs.terminus_font ]; }; catppuccin = { enable = true; flavor = "macchiato"; + accent = "mauve"; + + cursors.enable = true; + plymouth.enable = true; + tty.enable = true; + }; + + programs.hyprland = { + enable = true; + withUWSM = false; }; programs.niri.enable = true; services.greetd = { enable = true; + useTextGreeter = true; + + settings = { + terminal.vt = 1; - settings.default_session.command = "${pkgs.tuigreet}/bin/tuigreet --cmd start-hyprland"; + default_session = { + command = tuigreetCommand; + user = "greeter"; + }; + }; }; }; } diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix index 244a8961..946bc878 100644 --- a/modules/nixos/system/boot.nix +++ b/modules/nixos/system/boot.nix @@ -26,7 +26,6 @@ in kernelParams = [ "quiet" - "splash" "boot.shell_on_fail" "udev.log_priority=3" "rd.systemd.show_status=auto" From 4e90c4448c30751d3e7a6f509a369cac5aa89277 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 24 Jun 2026 22:24:22 +0200 Subject: [PATCH 07/71] Fix warnings --- hosts/kubex/default.nix | 2 ++ modules/home/browsers/firefox/default.nix | 1 + modules/home/common/default.nix | 1 + modules/home/desktops/hyprland/default.nix | 1 + modules/nixos/roles/desktop/hyprland.nix | 1 + 5 files changed, 6 insertions(+) diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index f01448a6..2823e810 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -38,6 +38,8 @@ hostId = "5851308f"; # Required by zfs }; + boot.zfs.forceImportRoot = false; + environment = { variables = { PROMPT = "%m@%n> "; diff --git a/modules/home/browsers/firefox/default.nix b/modules/home/browsers/firefox/default.nix index b8d07d95..a88e79a9 100644 --- a/modules/home/browsers/firefox/default.nix +++ b/modules/home/browsers/firefox/default.nix @@ -10,6 +10,7 @@ in { programs.firefox = { enable = true; + configPath = ".mozilla/firefox"; profiles.default = { name = "Default"; diff --git a/modules/home/common/default.nix b/modules/home/common/default.nix index 48666c57..688d6c8a 100644 --- a/modules/home/common/default.nix +++ b/modules/home/common/default.nix @@ -7,6 +7,7 @@ catppuccin = { enable = true; + autoEnable = true; flavor = "mocha"; }; diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 57a6c42e..3d1fb09a 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -51,6 +51,7 @@ in catppuccin.hyprland.enable = false; wayland.windowManager.hyprland = { enable = true; + configType = "hyprlang"; inherit (cfg) package; systemd.enable = true; diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix index 5569222f..9ef2ae48 100644 --- a/modules/nixos/roles/desktop/hyprland.nix +++ b/modules/nixos/roles/desktop/hyprland.nix @@ -45,6 +45,7 @@ in catppuccin = { enable = true; + autoEnable = true; flavor = "macchiato"; accent = "mauve"; From c18e8b175acfb17259da08b018b53908ed683294 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Thu, 25 Jun 2026 00:17:26 +0200 Subject: [PATCH 08/71] Automate zfs-key-encryption --- docs/k3s.md | 7 ++++ hosts/kubex/default.nix | 4 ++ modules/nixos/roles/k3s/default.nix | 1 + modules/nixos/roles/k3s/zfs.nix | 63 +++++++++++++++++++++++++++++ 4 files changed, 75 insertions(+) create mode 100644 modules/nixos/roles/k3s/zfs.nix diff --git a/docs/k3s.md b/docs/k3s.md index dd6cd7bc..56e5d049 100644 --- a/docs/k3s.md +++ b/docs/k3s.md @@ -31,6 +31,13 @@ sudo zpool create -f \ raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd ``` +The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main` +if needed, then loads its encryption key from `rap@nixberry` before `k3s.service` +starts. + +Because the unit runs non-interactively, `kubex` is configured for passwordless sudo +for members of the `wheel` group. + ## Copy kubeconfig ```bash diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index 2823e810..30ec4d10 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -40,6 +40,10 @@ boot.zfs.forceImportRoot = false; + security = { + sudo.wheelNeedsPassword = false; + }; + environment = { variables = { PROMPT = "%m@%n> "; diff --git a/modules/nixos/roles/k3s/default.nix b/modules/nixos/roles/k3s/default.nix index 9f843074..4f877fbb 100644 --- a/modules/nixos/roles/k3s/default.nix +++ b/modules/nixos/roles/k3s/default.nix @@ -16,6 +16,7 @@ in imports = [ ./service.nix ./network.nix + ./zfs.nix ]; options.hostConfig.roles.k3s = lib.mkEnableOption "Enable k3s cluster configuration."; diff --git a/modules/nixos/roles/k3s/zfs.nix b/modules/nixos/roles/k3s/zfs.nix new file mode 100644 index 00000000..c4a7c5be --- /dev/null +++ b/modules/nixos/roles/k3s/zfs.nix @@ -0,0 +1,63 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.hostConfig.roles.k3s; + poolName = "kubex-main"; +in +{ + config = lib.mkIf cfg { + systemd.services.wait-for-zfs-pool = { + description = "Prepare ZFS pool ${poolName} for k3s"; + before = [ "k3s.service" ]; + wants = [ "network-online.target" ]; + after = [ "network-online.target" ]; + serviceConfig = { + Type = "oneshot"; + User = config.hostConfig.user.name; + RemainAfterExit = true; + TimeoutStartSec = "infinity"; + }; + script = '' + set -euo pipefail + + pool="${poolName}" + key_source="rap@nixberry" + + echo "Ensuring ZFS pool $pool is imported" + if ! ${pkgs.zfs}/bin/zpool list -H "$pool" >/dev/null 2>&1; then + ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zpool import -aN + fi + + until ${pkgs.zfs}/bin/zpool list -H "$pool" >/dev/null 2>&1; do + echo "Waiting for ZFS pool $pool to appear" + sleep 2 + done + + echo "Loading encryption key for $pool from $key_source" + while true; do + if key="$(${pkgs.openssh}/bin/ssh \ + -o BatchMode=yes \ + -o ConnectTimeout=10 \ + -o StrictHostKeyChecking=accept-new \ + "$key_source" ulock-agent get)"; then + break + fi + + echo "Waiting for SSH access to $key_source" + sleep 5 + done + + printf '%s\n' "$key" | ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zfs load-key "$pool" + ''; + }; + + systemd.services.k3s = { + requires = [ "wait-for-zfs-pool.service" ]; + after = [ "wait-for-zfs-pool.service" ]; + }; + }; +} From 04e292847663642a46e20367308fbdbd662290cc Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Fri, 26 Jun 2026 02:11:21 +0200 Subject: [PATCH 09/71] fix --- .sops.yaml | 12 +++ docs/new-host.md | 5 +- flake.lock | 23 ++++- flake.nix | 6 ++ hosts/kubex/default.nix | 4 - hosts/nixberry/default.nix | 4 - hosts/vinox/default.nix | 4 - hosts/zion/default.nix | 1 - .../home/desktops/addons/kanshi/default.nix | 90 +++++++++++-------- .../desktops/hyprland/addons/hyprlock.nix | 1 - .../desktops/hyprland/addons/hyprpaper.nix | 22 ----- modules/home/desktops/hyprland/default.nix | 2 + modules/nixos/system/user.nix | 6 +- 13 files changed, 102 insertions(+), 78 deletions(-) create mode 100644 .sops.yaml delete mode 100644 modules/home/desktops/hyprland/addons/hyprpaper.nix diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 00000000..d9792794 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,12 @@ +keys: + users: + - &rap_zion age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf + - &kubex age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr + - &firefly age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp +creation_rules: + - path_regex: secrets/common/ssh.yaml$ + key_groups: + - age: + - *rap_zion + - *kubex + - *firefly diff --git a/docs/new-host.md b/docs/new-host.md index d148f236..a8edddb3 100644 --- a/docs/new-host.md +++ b/docs/new-host.md @@ -12,9 +12,8 @@ over to the `.sops.yaml` config. # Connect to the new host, and copy the public key of the autogenerated age-key. sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key" -# Add recipient in .sops.yaml and paste public key, assign it to a creaton_rule. -# Then a rekey for the secrets.yaml is necessary. -sops updatekeys secrets/secrets.yaml +# Add recipient in `.sops.yaml` and paste the public key, then update the secret file. +sops updatekeys secrets/common/ssh.yaml ``` ## Github action diff --git a/flake.lock b/flake.lock index e76881c2..e8d98020 100644 --- a/flake.lock +++ b/flake.lock @@ -935,7 +935,28 @@ "niri": "niri", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", - "pre-commit-hooks": "pre-commit-hooks_3" + "pre-commit-hooks": "pre-commit-hooks_3", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782165805, + "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=", + "owner": "mic92", + "repo": "sops-nix", + "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24", + "type": "github" + }, + "original": { + "owner": "mic92", + "repo": "sops-nix", + "type": "github" } }, "systems": { diff --git a/flake.nix b/flake.nix index 0ebaf259..a71a48ce 100644 --- a/flake.nix +++ b/flake.nix @@ -14,6 +14,10 @@ neonix = { url = "github:rgroemmer/neonix"; }; + sops-nix = { + url = "github:mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; krewfile = { url = "github:brumhard/krewfile"; inputs.nixpkgs.follows = "nixpkgs"; @@ -76,6 +80,7 @@ nixosModules = [ inputs.catppuccin.nixosModules.catppuccin inputs.niri.nixosModules.niri + inputs.sops-nix.nixosModules.sops (inputs.import-tree.match ".*/default\\.nix" ./modules/nixos) ./modules/nix.nix ]; @@ -85,6 +90,7 @@ inputs.neonix.homeManagerModules.neonix inputs.krewfile.homeManagerModules.krewfile inputs.niri.homeModules.niri + inputs.sops-nix.homeManagerModules.sops (inputs.import-tree.match ".*/default\\.nix" ./modules/home) ./modules/nix.nix ]; diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index 30ec4d10..200e3a08 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -20,10 +20,6 @@ user = { name = "kubex"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; - keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" - ]; extraOptions = { }; extraGroups = [ ]; }; diff --git a/hosts/nixberry/default.nix b/hosts/nixberry/default.nix index 9194bf81..aec94dd4 100644 --- a/hosts/nixberry/default.nix +++ b/hosts/nixberry/default.nix @@ -13,10 +13,6 @@ user = { name = "rap"; initialHashedPassword = "$y$j9T$8uQSJbY6w9kjXnj74JKjA1$pWYgNf.gb497suX//oIw6aggEPoD2Xv1kvMKZfDTOU/"; - keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" - ]; extraOptions = { }; extraGroups = [ ]; }; diff --git a/hosts/vinox/default.nix b/hosts/vinox/default.nix index a58eb360..4e0f7d02 100644 --- a/hosts/vinox/default.nix +++ b/hosts/vinox/default.nix @@ -24,10 +24,6 @@ initialHashedPassword = ""; extraOptions = { }; extraGroups = [ ]; - keys = [ - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" - ]; }; }; diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index db650f31..b93aaf20 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -22,7 +22,6 @@ extraOptions = { initialHashedPassword = "$y$j9T$DZQaaK3xGqarN8KE8qnw..$dvgiS7dso5LboGRRf0dcyct/LQUFp4J0LUo2ZRRdTr8"; }; - keys = [ ]; }; services = { diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 3ff4b50b..10b2e393 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -1,43 +1,61 @@ -{ pkgs, lib, ... }: +{ + pkgs, + lib, + self, + ... +}: { services.kanshi = let hyprctl = lib.getExe' pkgs.hyprland "hyprctl"; - - # Pins Hyprland workspaces to monitors. - # Args: primary matcher, optional secondary matcher. - # Writes workspace config for hyprland, reloads it, and sets focus. - workspaceSetup = pkgs.writeShellScriptBin "workspaceSetup" '' - set -euo pipefail - - monitors="$(${hyprctl} monitors -j)" - - match_monitor() { - ${lib.getExe pkgs.jq} -r --arg matcher "$1" ' - [.[] | select(.description | test($matcher)) | .name][0]' <<< "$monitors" - } - - primary="$(match_monitor "''${1:?missing primary monitor matcher}")" - secondary="$(match_monitor "''${2:-$1}")" - - cat > "$HOME/.config/hypr/workspaces.conf" < "$HOME/.config/hypr/workspaces.conf" < Date: Fri, 26 Jun 2026 02:11:30 +0200 Subject: [PATCH 10/71] add sops and ssh_config --- modules/home/services/default.nix | 1 + modules/home/services/sops.nix | 14 ++++++++++++ modules/nixos/system/default.nix | 1 + modules/nixos/system/sops.nix | 13 +++++++++++ secrets/common/ssh.yaml | 38 +++++++++++++++++++++++++++++++ 5 files changed, 67 insertions(+) create mode 100644 modules/home/services/sops.nix create mode 100644 modules/nixos/system/sops.nix create mode 100644 secrets/common/ssh.yaml diff --git a/modules/home/services/default.nix b/modules/home/services/default.nix index a699bd63..099be714 100644 --- a/modules/home/services/default.nix +++ b/modules/home/services/default.nix @@ -1,6 +1,7 @@ { imports = [ ./ssh.nix + ./sops.nix ./tray.nix ./keyring.nix ./nextcloud.nix diff --git a/modules/home/services/sops.nix b/modules/home/services/sops.nix new file mode 100644 index 00000000..1a91a65b --- /dev/null +++ b/modules/home/services/sops.nix @@ -0,0 +1,14 @@ +{ + config, + ... +}: +{ + sops = { + age = { + generateKey = true; + keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt"; + }; + + defaultSopsFile = ../../../secrets/common/ssh.yaml; + }; +} diff --git a/modules/nixos/system/default.nix b/modules/nixos/system/default.nix index 89a3a136..ad8e35be 100644 --- a/modules/nixos/system/default.nix +++ b/modules/nixos/system/default.nix @@ -4,6 +4,7 @@ ./boot.nix ./user.nix ./locale.nix + ./sops.nix ./zsh.nix ]; } diff --git a/modules/nixos/system/sops.nix b/modules/nixos/system/sops.nix new file mode 100644 index 00000000..bd9e5ead --- /dev/null +++ b/modules/nixos/system/sops.nix @@ -0,0 +1,13 @@ +{ + lib, + config, + ... +}: +lib.mkIf (config.hostConfig.user.name != "root") { + sops = { + age = { + generateKey = false; + keyFile = "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt"; + }; + }; +} diff --git a/secrets/common/ssh.yaml b/secrets/common/ssh.yaml new file mode 100644 index 00000000..069701ac --- /dev/null +++ b/secrets/common/ssh.yaml @@ -0,0 +1,38 @@ +ssh_config: ENC[AES256_GCM,data:Z9shLNRk+XM0Y5jDAMLDyF9EGqYXiOGm6AO2LARTW8bXWYYihDmoG9xxbmRF9QpUOqdKz9pdc1/jjTcdXJ5w4xawNFUxIiA2HeS62JXZj8SGsO1T7Hn9Z4zHpKnaDt6tWCgp9XO1mAJ0iUvExKkDaqjwidYSwZGmXtxivgsuOL00QipwnNUM9JCepcIvkvtAUj+5MzaBp5vxMTq3VbABmf08rxO8eFR6Ctr9diTDagZuaW+82kk0uX2/bu6E1Fg/fVzdeLgn4UUl2key2n3MSHnQYhuQFaxp0W5WXZoXB56y05vLRFygIL0SHE3I3f66gz155g9+D8pSfQC7xonemLBp0Gnid/5LXQPggy+fAxxbEb5rCCBwRCFoPEUGBielzbOVDcdS90hng0rFJPpu99pSygbhPv0fhnr68NnBxZ/HqpXruYInkca5AxK/XrPy5MlTrvhrm4A6FuGfYepMpiWJxh0GPHOjM5T2UNKYIIYqWofIOaS82+dZf0ADd7vwCpm2CV3gXLLTiiT981kHPrY6Y7XI62l0n/AQeyXemPRjYbWeF9VDtvS+sIVuQZzOhWhpB2XJCo85b2fnDmrYxgcHHyyvAl9bZ/biGvghtR4Cdw+lNV7jgcpUPgnfekm13RAylV3hfWaZWC9/XqSuVN7tar+7zfuJKUVcCmpB8B25wwwVzdfm/X8dVzQk02sBn9lT+jdTLvF7oUSptkhWjjH+De0lZaZB2B27npTTUk4hCGL17hqPhW8pE92QM7gbW5JLQ0xoa4UDb8jZH33rIijQ4NmgngkEMdeuk1ettRkrqOeFvu2rB5V1tTm3Naa5BBhn4su8PVDfAMGh829cLHgAtrerIxA1iQfG/y3VfrBW/3exPuv09Sb4ZPkLNlkK813hc1fj6KOrZRzT54vPyUoy/CHPLEoUHQx0SxUTiu5f5gLWDXVRejMFM2KUJ87iWbTLbHs1oRa3/yUJx2aBojP1GevMXq2ON7nO2vAu7ikLLQ==,iv:V2hkvW6tLfvTfM0kAipEWi9ss0Dv8vhtk+ucwJrjOq8=,tag:VYyv5/6a1a9SHUHOgLnv0w==,type:str] +swiss: ENC[AES256_GCM,data:+et6FzVAAJIMq7/81xtDX4JQ1jtPbdxSPEFvEMyvi9OB9LWYXYFf47CyM8yIgEDZOOeh/htY227VeXr5TkKN6ss2HSjVqa28AgkaIBmO5fMJws+XGfjwj4GUmP97DxtWtrssFoNs6vXCEzhLXAlt/pbtQhfNusndgBga13XCtwT7Im5RLOIedns+92hh2E+SJquvzGyZwyHrHTGJtSXEfcDUU64W2lVeN0LahOmaptwcJ/EHPQLnxlcwE1vk0UbaD1VfzXZZvq5+BU7CaSbLCjppSHS6MYOKVvIzdoxQCdJ2nZ9m1YAWmcuKKZdjwGJXTIBehxhyRvAvcm45ugN1hwg/m/s1q3Ze1BCrB1lYlbsP/Aibu90P2DHpELHGQXf6+qBx6KqZUycBFLCEb1HWn3ufNucqTzc/FoBdQPJqO3Mcn41eoYRGIjWGvJMz98maUOQkzf5Wp/ekm8sca76wQxYQP9XmVdz1ZMjIGcAwwBQ5Mmzlj4p/eactVLsbwQ1tRKl9kCmJqWipHUNZdkc=,iv:sP7umLgBcerWK4jucQGHnPbmcxe9TtaJHakCo+ZW6uY=,tag:4h0ZtwpyCIHRBoM6Ljw6Ag==,type:str] +swiss.pub: ENC[AES256_GCM,data:wGUgxBYiTu0PcDSK/wNgIfdFyOIuqXkr7cOkXDkN3TdccYa/Lsa1qhm5ZXfVpktQE00oVLEHF8hnJfLUfPgOb44XfwhoWUFIdJRDokLSZoLwT/zlOqzEgJ1o1QZxm73xO5wFG1ns4+Fl2Jz5HJ55U3FHMP88B/UY5hYw6vNXfxcpPGbMOA==,iv:tdXPLgImFmEcMiqBSYMzTWFWbK2+5DKdvRyg+luEE0U=,tag:RsEI/YH0z8LW6f1cGhf68g==,type:str] +yubi: ENC[AES256_GCM,data:i68pIXEaRPU09GY8kO/XPDp95tgCL+La5AL2TDK67Cz9Df1LYpMSp9dlZGl5IUxbF3wu92wA4HS5e5k3577wucSgRHf307YiZn9u/gZV/d6Lr6/OIt9rqcbj6TRZhXacutJPYXjudsqLdVaLl9gsd6t+kBK6aqEpk7ZNpj9cd5pINwNxjNLlm2olt7weCTDsT1Vq0lb24ECxqXXeuTvB7CeBximCD5QvJz4YxZpC7fqwab3ihMm/b6iliYDKWtgAVPNQXfM6As7T6ACSVMR2BBx2o16wPTDtAzxLIJ3p2nA4P0ROQsx4pnlMe1mNdabUwnbwmoPTM7m7MexCt/jEwsH4oNWOKQoWY8q+LvC0RSLUhqKaxq/yfbA+be8tIrPbLByO+2vXYCkuK+nE5x+zn0KjVxigpG+LhrhVLexYJHkzR8ehToWqWM/s35HozdLOZksNMQkfR8CKsnJxoYYEDMmvWGGVE+rn48e/YBloYA/q+BpSW+WI0c7gBa+m5DuhcDjpJRPg1b7HM0GqXA1ynEjYeeYiX9FFcVPUePJqsdP/lCgqiBhhG51JJwvUj9cVdShrFqKrlw==,iv:obBR2mVO606OmYC+XKsfmtzd4ZxMBELEiWTdMUvDFDs=,tag:biWJy77Q5KHO91rtjZ5JGQ==,type:str] +yubi.pub: ENC[AES256_GCM,data:MdT+SaIQ4Uf+7SXPTE9dKo9pLdfP299qUSeg5XITB5APs7jOleh6VIZXXamitYm9YQLHrwIZJdTql66SfNyRp0YbkEbd5VGBYKSkHj1taDqFoEG8HCv9DTBj/CiNEimrVcbAFU4zgc6S4jAbY4C3WIDiJ2+GsNjZJgIKOtYwCVKxheRW,iv:TwkpyyiFvOtiKxrtcxn6vgP5yCfW/1bDRGUpCSrJw84=,tag:+1YVdIqiY5VQnfOJK1Syzw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VHNVeE1hWWw2K3RDTEdv + UXlyMHRuVVhtSHF1VVRkcEE5VFNFcVFDelRNCkJSd1hwWXZNSWE4MWxLeEhWNmdw + bUg4S0ptSW1MZTV2NVlweUdyTFhGVEkKLS0tIHJuYWI2YjkrVU5LSU44MHZrYVVq + OHp6dUlaVkh3SGlJVUdIbkFvQVBJMWcKyivsQOeFIt19FqMdNrwphoUbbVmHZEL0 + auPp4D2lfZeN+qThhSqlL7gwAMgYII07Bxy+zdfRzDgZG4Vu9wSkOw== + -----END AGE ENCRYPTED FILE----- + recipient: age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdG1RRGFMbk11KzJBMnU2 + YW1GeFBzYUVURDlsenFldlZ5Q0FxUHdCU0RZCnIvUnlmKzlzSUtMVzlMSHVib2Zp + eEl0dlRNZlpqWTVKQVV1N2pVcTZwazQKLS0tIDM0Q1pMNFhVVlRoSDRkOUVnd0JI + cHVTZmpYcjk5ZTBMT09wbkNEY05hSlEKsDWV8a0HjyOgpusWHVKEkmt8yKAofVTD + LWmnHHwKMmORSke7Sv2w8HnLc3yBMJ7kIXdqzNL+qoD8ntxI/LkxaQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsRnJ1Nkw2bXQwSUYxR29i + cGsweXpKNEFObUROVjU4TmtJWjhib2ZuckRvCkg5MHkwdVlnQnBYMmpseEhxMXI3 + Rm5tMmpFSzd6ZEZTWW5IWW1zWC9JL2sKLS0tIFpSc1EvckhuVTdqOFBia0RkTjBl + N0Y2anMzSm9mU1ZnZU9wN3h2Q0lud3cKKB3WZzhBM2scG0tBDa+QOxt9IcHFQw9T + 4QAZU7kwgzEZuAOty9OYvsSa2ArFlhMxF1SPasO1iBgeQG8PL7ifIg== + -----END AGE ENCRYPTED FILE----- + recipient: age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp + lastmodified: "2026-06-26T00:01:09Z" + mac: ENC[AES256_GCM,data:TzPOERgrzoEX70FRLm7Ia8iNZCaekd1TIE8w3VsdUeR41DsB30mkYtSD9Jtka4AWUB9QvE5kVJgTqROUi4AZ99z7w2yCPmCnZp+VSsp9VJ69suDR5q7LRECvl7dVPlE2VYb57J/bk7DEQDgt8etUXvHKhia+PSw78gXhYcxOrds=,iv:w4di6hDv1VzRU8aUZfWHhPTSANUwYrgK1vx8MLTO+MQ=,tag:ddy4mVZKSV58Z1OVojKf/w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 From 6e2eb3f18af18d07833806a83ab7f06984f8f9c8 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Fri, 26 Jun 2026 14:07:24 +0200 Subject: [PATCH 11/71] update sops --- docs/new-host.md | 6 +++ modules/home/cli/tools/k8s/k9s.nix | 66 ++++++++++++++++++++++-------- modules/home/services/sops.nix | 30 +++++++++++++- modules/nixos/system/sops.nix | 34 +++++++++++++++ secrets/common/ssh.yaml | 8 ++-- 5 files changed, 123 insertions(+), 21 deletions(-) diff --git a/docs/new-host.md b/docs/new-host.md index a8edddb3..58a317a3 100644 --- a/docs/new-host.md +++ b/docs/new-host.md @@ -8,6 +8,12 @@ option. In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied over to the `.sops.yaml` config. +This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`: + +- NixOS hosts get them from `modules/nixos/system/sops.nix` +- standalone Home Manager hosts get them from `modules/home/services/sops.nix` +- hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files + ``` # Connect to the new host, and copy the public key of the autogenerated age-key. sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key" diff --git a/modules/home/cli/tools/k8s/k9s.nix b/modules/home/cli/tools/k8s/k9s.nix index a4b97ba2..a1ed7961 100644 --- a/modules/home/cli/tools/k8s/k9s.nix +++ b/modules/home/cli/tools/k8s/k9s.nix @@ -4,6 +4,23 @@ ... }: let + gardenerScopes = [ + "shoots" + # all resources in extensions.gardener.cloud/v1alpha1 + "backupbuckets" + "backupentries" + "bastions" + "clusters" + "containerruntimes" + "controlplanes" + "dnsrecords" + "extensions" + "infrastructures" + "networks" + "operatingsystemconfigs" + "workers" + ]; + defaultPlugins = { edit-secret = { description = "Edit Decoded Secret"; @@ -23,22 +40,7 @@ let reconcile = { description = "Reconcile resource"; shortCut = "r"; - scopes = [ - "shoots" - # all resources in extensions.gardener.cloud/v1alpha1 - "backupbuckets" - "backupentries" - "bastions" - "clusters" - "containerruntimes" - "controlplanes" - "dnsrecords" - "extensions" - "infrastructures" - "networks" - "operatingsystemconfigs" - "workers" - ]; + scopes = gardenerScopes; command = "kubectl"; background = true; args = [ @@ -51,6 +53,38 @@ let ]; }; + suspend = { + description = "Suspend resource"; + shortCut = "s"; + scopes = gardenerScopes; + command = "kubectl"; + background = true; + args = [ + "annotate" + "-n" + "$NAMESPACE" + "$RESOURCE_NAME" + "$NAME" + "gardener.cloud/operation=suspend" + ]; + }; + + resume = { + description = "Resume resource"; + shortCut = "u"; + scopes = gardenerScopes; + command = "kubectl"; + background = true; + args = [ + "annotate" + "-n" + "$NAMESPACE" + "$RESOURCE_NAME" + "$NAME" + "gardener.cloud/operation=resume" + ]; + }; + reconcile-seed = { description = "Reconcile seed"; shortCut = "r"; diff --git a/modules/home/services/sops.nix b/modules/home/services/sops.nix index 1a91a65b..bf24d544 100644 --- a/modules/home/services/sops.nix +++ b/modules/home/services/sops.nix @@ -1,8 +1,9 @@ { + lib, config, ... }: -{ +lib.mkIf (config ? targets && config.targets ? genericLinux && config.targets.genericLinux.enable) { sops = { age = { generateKey = true; @@ -10,5 +11,32 @@ }; defaultSopsFile = ../../../secrets/common/ssh.yaml; + + secrets = { + ssh_config = { + path = "${config.home.homeDirectory}/.ssh/config"; + mode = "0600"; + }; + + swiss = { + path = "${config.home.homeDirectory}/.ssh/swiss"; + mode = "0600"; + }; + + "swiss.pub" = { + path = "${config.home.homeDirectory}/.ssh/swiss.pub"; + mode = "0644"; + }; + + yubi = { + path = "${config.home.homeDirectory}/.ssh/yubi"; + mode = "0600"; + }; + + "yubi.pub" = { + path = "${config.home.homeDirectory}/.ssh/yubi.pub"; + mode = "0644"; + }; + }; }; } diff --git a/modules/nixos/system/sops.nix b/modules/nixos/system/sops.nix index bd9e5ead..d7577af7 100644 --- a/modules/nixos/system/sops.nix +++ b/modules/nixos/system/sops.nix @@ -9,5 +9,39 @@ lib.mkIf (config.hostConfig.user.name != "root") { generateKey = false; keyFile = "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt"; }; + + defaultSopsFile = ../../../secrets/common/ssh.yaml; + + secrets = { + ssh_config = { + path = "/home/${config.hostConfig.user.name}/.ssh/config"; + owner = config.hostConfig.user.name; + mode = "0600"; + }; + + swiss = { + path = "/home/${config.hostConfig.user.name}/.ssh/swiss"; + owner = config.hostConfig.user.name; + mode = "0600"; + }; + + "swiss.pub" = { + path = "/home/${config.hostConfig.user.name}/.ssh/swiss.pub"; + owner = config.hostConfig.user.name; + mode = "0644"; + }; + + yubi = { + path = "/home/${config.hostConfig.user.name}/.ssh/yubi"; + owner = config.hostConfig.user.name; + mode = "0600"; + }; + + "yubi.pub" = { + path = "/home/${config.hostConfig.user.name}/.ssh/yubi.pub"; + owner = config.hostConfig.user.name; + mode = "0644"; + }; + }; }; } diff --git a/secrets/common/ssh.yaml b/secrets/common/ssh.yaml index 069701ac..4d564229 100644 --- a/secrets/common/ssh.yaml +++ b/secrets/common/ssh.yaml @@ -1,7 +1,7 @@ ssh_config: ENC[AES256_GCM,data:Z9shLNRk+XM0Y5jDAMLDyF9EGqYXiOGm6AO2LARTW8bXWYYihDmoG9xxbmRF9QpUOqdKz9pdc1/jjTcdXJ5w4xawNFUxIiA2HeS62JXZj8SGsO1T7Hn9Z4zHpKnaDt6tWCgp9XO1mAJ0iUvExKkDaqjwidYSwZGmXtxivgsuOL00QipwnNUM9JCepcIvkvtAUj+5MzaBp5vxMTq3VbABmf08rxO8eFR6Ctr9diTDagZuaW+82kk0uX2/bu6E1Fg/fVzdeLgn4UUl2key2n3MSHnQYhuQFaxp0W5WXZoXB56y05vLRFygIL0SHE3I3f66gz155g9+D8pSfQC7xonemLBp0Gnid/5LXQPggy+fAxxbEb5rCCBwRCFoPEUGBielzbOVDcdS90hng0rFJPpu99pSygbhPv0fhnr68NnBxZ/HqpXruYInkca5AxK/XrPy5MlTrvhrm4A6FuGfYepMpiWJxh0GPHOjM5T2UNKYIIYqWofIOaS82+dZf0ADd7vwCpm2CV3gXLLTiiT981kHPrY6Y7XI62l0n/AQeyXemPRjYbWeF9VDtvS+sIVuQZzOhWhpB2XJCo85b2fnDmrYxgcHHyyvAl9bZ/biGvghtR4Cdw+lNV7jgcpUPgnfekm13RAylV3hfWaZWC9/XqSuVN7tar+7zfuJKUVcCmpB8B25wwwVzdfm/X8dVzQk02sBn9lT+jdTLvF7oUSptkhWjjH+De0lZaZB2B27npTTUk4hCGL17hqPhW8pE92QM7gbW5JLQ0xoa4UDb8jZH33rIijQ4NmgngkEMdeuk1ettRkrqOeFvu2rB5V1tTm3Naa5BBhn4su8PVDfAMGh829cLHgAtrerIxA1iQfG/y3VfrBW/3exPuv09Sb4ZPkLNlkK813hc1fj6KOrZRzT54vPyUoy/CHPLEoUHQx0SxUTiu5f5gLWDXVRejMFM2KUJ87iWbTLbHs1oRa3/yUJx2aBojP1GevMXq2ON7nO2vAu7ikLLQ==,iv:V2hkvW6tLfvTfM0kAipEWi9ss0Dv8vhtk+ucwJrjOq8=,tag:VYyv5/6a1a9SHUHOgLnv0w==,type:str] -swiss: ENC[AES256_GCM,data:+et6FzVAAJIMq7/81xtDX4JQ1jtPbdxSPEFvEMyvi9OB9LWYXYFf47CyM8yIgEDZOOeh/htY227VeXr5TkKN6ss2HSjVqa28AgkaIBmO5fMJws+XGfjwj4GUmP97DxtWtrssFoNs6vXCEzhLXAlt/pbtQhfNusndgBga13XCtwT7Im5RLOIedns+92hh2E+SJquvzGyZwyHrHTGJtSXEfcDUU64W2lVeN0LahOmaptwcJ/EHPQLnxlcwE1vk0UbaD1VfzXZZvq5+BU7CaSbLCjppSHS6MYOKVvIzdoxQCdJ2nZ9m1YAWmcuKKZdjwGJXTIBehxhyRvAvcm45ugN1hwg/m/s1q3Ze1BCrB1lYlbsP/Aibu90P2DHpELHGQXf6+qBx6KqZUycBFLCEb1HWn3ufNucqTzc/FoBdQPJqO3Mcn41eoYRGIjWGvJMz98maUOQkzf5Wp/ekm8sca76wQxYQP9XmVdz1ZMjIGcAwwBQ5Mmzlj4p/eactVLsbwQ1tRKl9kCmJqWipHUNZdkc=,iv:sP7umLgBcerWK4jucQGHnPbmcxe9TtaJHakCo+ZW6uY=,tag:4h0ZtwpyCIHRBoM6Ljw6Ag==,type:str] +swiss: ENC[AES256_GCM,data:zDBhSsPOguZuD6Kx+rMYR9KAjXxycbjXMhL5MZabZShKV+1ICZBsfnWOnBcfxX281hXf2K/TNbphC3KLnTaV0+Ti43BKunSDJp8qyEKgG3xsd7Zf8/i/eMQJygMphCF3XvJJjc3wBEUf/mZ1ObJKYueqtTdSZzx4orR6X93Vdt13GgFJLaX4/8XYsAeBXf4RwYD5gsVjg2QI0t48vnvlU0xN6oFvJAYedvyxgPL3z1pGv+0k/85XtaCfy38LQ5ddOYGxH+XKDzCfkskhd3X6cUeMbDfLrelGwvTB967wHAulgilBR1ObhV1SoUiz6K1a1PRy9XjuzwTbFG8fjFrGk+9yJtucFp1Vgtf6L+pgLxc5HzkC+f9tEldslJQC6y1045s/OWp+ghL+auzFuJGhDuq8JJUSF9Pk0LeDOb67wIrW+2250PTYJbINk2Sdo09Bj7GUCCBkrDHT+IcA/qF0saQ25QTE/BtPLEMiPhwgkYAhrL1uz7s6+HfuUiFPKY0jOn0q0xTxfV00G+wGJFp7,iv:uZxwZQZhmBKUQnAPuf6NFk9TRWH16PmVu5RoTmmxN9Y=,tag:hbvkjfxuSUM2MOyrUzhDrg==,type:str] swiss.pub: ENC[AES256_GCM,data:wGUgxBYiTu0PcDSK/wNgIfdFyOIuqXkr7cOkXDkN3TdccYa/Lsa1qhm5ZXfVpktQE00oVLEHF8hnJfLUfPgOb44XfwhoWUFIdJRDokLSZoLwT/zlOqzEgJ1o1QZxm73xO5wFG1ns4+Fl2Jz5HJ55U3FHMP88B/UY5hYw6vNXfxcpPGbMOA==,iv:tdXPLgImFmEcMiqBSYMzTWFWbK2+5DKdvRyg+luEE0U=,tag:RsEI/YH0z8LW6f1cGhf68g==,type:str] -yubi: ENC[AES256_GCM,data:i68pIXEaRPU09GY8kO/XPDp95tgCL+La5AL2TDK67Cz9Df1LYpMSp9dlZGl5IUxbF3wu92wA4HS5e5k3577wucSgRHf307YiZn9u/gZV/d6Lr6/OIt9rqcbj6TRZhXacutJPYXjudsqLdVaLl9gsd6t+kBK6aqEpk7ZNpj9cd5pINwNxjNLlm2olt7weCTDsT1Vq0lb24ECxqXXeuTvB7CeBximCD5QvJz4YxZpC7fqwab3ihMm/b6iliYDKWtgAVPNQXfM6As7T6ACSVMR2BBx2o16wPTDtAzxLIJ3p2nA4P0ROQsx4pnlMe1mNdabUwnbwmoPTM7m7MexCt/jEwsH4oNWOKQoWY8q+LvC0RSLUhqKaxq/yfbA+be8tIrPbLByO+2vXYCkuK+nE5x+zn0KjVxigpG+LhrhVLexYJHkzR8ehToWqWM/s35HozdLOZksNMQkfR8CKsnJxoYYEDMmvWGGVE+rn48e/YBloYA/q+BpSW+WI0c7gBa+m5DuhcDjpJRPg1b7HM0GqXA1ynEjYeeYiX9FFcVPUePJqsdP/lCgqiBhhG51JJwvUj9cVdShrFqKrlw==,iv:obBR2mVO606OmYC+XKsfmtzd4ZxMBELEiWTdMUvDFDs=,tag:biWJy77Q5KHO91rtjZ5JGQ==,type:str] +yubi: ENC[AES256_GCM,data:cUO0Yf06ZCIDXe6XBAvHcF+4/rFz3iC8rkgWKtyp5e8nJ80jXF9U00g8zns1yfnRG92QfHNH9hewDepSjkNY/j3SjhUbJynKjJpMTxZURVURJtrVwVbtlN/PvPyffxjolEFzzjM62wCNUCtF4lSZn1p8RQ/G38MI3wTP2JSAOFn4cA2nvJ5rL1vs05pElBfT19hDUfImFR4L5A7Q/bkfIpO7bO0D2qBbiCO6NI0epYXPUp0yize2+hu1mDPCLPIL29P3q7ycVJAXFqxyTvweo72qY7he1dqNEKu/hIFDuHMS+n9fhzf6Qn+5eJcljMofeYLXcLQn57TtUMFkiMRc9t50sip/S0DuPrFO87zf7FZYeHaRKs35gKktVPKl3Vgb+On6BO3A4oU1Ru/EiCdRiYL8d7yTKe9CcU7Hghz41ToAH6PEvx+uCFNvWvmIOlTfGHCik4uwPa35H/aUzLAd736AtcrjyNfvISx6MdtbS83+UFi+clM6ZDvLn/YShEBiipWzJuhK6ZjVq47kDxKFW1ym6ybihL/c+dXS7NcNigkJgpEpZMuFvPDyk/thmyhE3GgBExC/Lms=,iv:XmGbA9MElvTgd4cyjtPAy7uKC0GTqpQksX/8UBl1r+k=,tag:Ox8HK8XVRFGc8CYcnwKn5w==,type:str] yubi.pub: ENC[AES256_GCM,data:MdT+SaIQ4Uf+7SXPTE9dKo9pLdfP299qUSeg5XITB5APs7jOleh6VIZXXamitYm9YQLHrwIZJdTql66SfNyRp0YbkEbd5VGBYKSkHj1taDqFoEG8HCv9DTBj/CiNEimrVcbAFU4zgc6S4jAbY4C3WIDiJ2+GsNjZJgIKOtYwCVKxheRW,iv:TwkpyyiFvOtiKxrtcxn6vgP5yCfW/1bDRGUpCSrJw84=,tag:+1YVdIqiY5VQnfOJK1Syzw==,type:str] sops: age: @@ -32,7 +32,7 @@ sops: 4QAZU7kwgzEZuAOty9OYvsSa2ArFlhMxF1SPasO1iBgeQG8PL7ifIg== -----END AGE ENCRYPTED FILE----- recipient: age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp - lastmodified: "2026-06-26T00:01:09Z" - mac: ENC[AES256_GCM,data:TzPOERgrzoEX70FRLm7Ia8iNZCaekd1TIE8w3VsdUeR41DsB30mkYtSD9Jtka4AWUB9QvE5kVJgTqROUi4AZ99z7w2yCPmCnZp+VSsp9VJ69suDR5q7LRECvl7dVPlE2VYb57J/bk7DEQDgt8etUXvHKhia+PSw78gXhYcxOrds=,iv:w4di6hDv1VzRU8aUZfWHhPTSANUwYrgK1vx8MLTO+MQ=,tag:ddy4mVZKSV58Z1OVojKf/w==,type:str] + lastmodified: "2026-06-26T12:06:25Z" + mac: ENC[AES256_GCM,data:Yq2tg9luzGmqHsYI7hIbFa5ZuRUDZ3GVRmHgsBP4UnqVNq++62M83ew7Doj8wMO5yeeocrN43UW29+w2Hb3DCxq9iRm430/8zzf+R3R8XqINp1++SAnblCPzqoJXxJvT9ta8X71OqZadglUApzxrR0CyOv+r8xlOdsgA0QeQVts=,iv:kSxrIcpMXO42qWcxeWoKhSQfJ+HO29bZdFHKMLlyCiM=,tag:8rDmIKKlcem3NPbqcZQmng==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 From 43f88b43d8455c63e562b069ff28c2c7dbc867ac Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sat, 27 Jun 2026 00:12:14 +0200 Subject: [PATCH 12/71] Flatten structure --- .../home/cli/{tools => }/atuin/default.nix | 0 .../core/packages.nix => core/default.nix} | 9 ++++++ .../home/cli/{tools => }/custom/default.nix | 0 .../cli/{tools => }/custom/shell-scripts.nix | 0 .../home/cli/{tools => }/direnv/default.nix | 0 modules/home/cli/{tools => }/git/default.nix | 0 modules/home/cli/{tools => }/k8s/default.nix | 0 modules/home/cli/{tools => }/k8s/k9s.nix | 0 modules/home/cli/{tools => }/k8s/krewfile.nix | 0 .../home/cli/{tools => }/k8s/kubecolor.nix | 0 .../home/cli/{tools => }/langs/default.nix | 0 modules/home/cli/{tools => }/langs/go.nix | 0 modules/home/cli/{tools => }/langs/rust.nix | 0 .../home/cli/{tools => }/lazygit/default.nix | 0 modules/home/cli/{tools => }/pet/default.nix | 0 .../home/cli/{tools => }/starship/default.nix | 0 modules/home/cli/tools/core/default.nix | 6 ---- modules/home/cli/tools/core/programs.nix | 17 ---------- modules/home/cli/{shells => }/zsh/default.nix | 0 modules/home/programs/default.nix | 31 +++++++++++++++++-- modules/home/programs/guis/default.nix | 27 ---------------- 21 files changed, 37 insertions(+), 53 deletions(-) rename modules/home/cli/{tools => }/atuin/default.nix (100%) rename modules/home/cli/{tools/core/packages.nix => core/default.nix} (82%) rename modules/home/cli/{tools => }/custom/default.nix (100%) rename modules/home/cli/{tools => }/custom/shell-scripts.nix (100%) rename modules/home/cli/{tools => }/direnv/default.nix (100%) rename modules/home/cli/{tools => }/git/default.nix (100%) rename modules/home/cli/{tools => }/k8s/default.nix (100%) rename modules/home/cli/{tools => }/k8s/k9s.nix (100%) rename modules/home/cli/{tools => }/k8s/krewfile.nix (100%) rename modules/home/cli/{tools => }/k8s/kubecolor.nix (100%) rename modules/home/cli/{tools => }/langs/default.nix (100%) rename modules/home/cli/{tools => }/langs/go.nix (100%) rename modules/home/cli/{tools => }/langs/rust.nix (100%) rename modules/home/cli/{tools => }/lazygit/default.nix (100%) rename modules/home/cli/{tools => }/pet/default.nix (100%) rename modules/home/cli/{tools => }/starship/default.nix (100%) delete mode 100644 modules/home/cli/tools/core/default.nix delete mode 100644 modules/home/cli/tools/core/programs.nix rename modules/home/cli/{shells => }/zsh/default.nix (100%) delete mode 100644 modules/home/programs/guis/default.nix diff --git a/modules/home/cli/tools/atuin/default.nix b/modules/home/cli/atuin/default.nix similarity index 100% rename from modules/home/cli/tools/atuin/default.nix rename to modules/home/cli/atuin/default.nix diff --git a/modules/home/cli/tools/core/packages.nix b/modules/home/cli/core/default.nix similarity index 82% rename from modules/home/cli/tools/core/packages.nix rename to modules/home/cli/core/default.nix index a13b7aa6..1841188d 100644 --- a/modules/home/cli/tools/core/packages.nix +++ b/modules/home/cli/core/default.nix @@ -58,4 +58,13 @@ ddcutil ; }; + programs = { + bat.enable = true; + fzf.enable = true; + btop.enable = true; + + zoxide.enable = true; + neonix.enable = true; + eza.enable = true; + }; } diff --git a/modules/home/cli/tools/custom/default.nix b/modules/home/cli/custom/default.nix similarity index 100% rename from modules/home/cli/tools/custom/default.nix rename to modules/home/cli/custom/default.nix diff --git a/modules/home/cli/tools/custom/shell-scripts.nix b/modules/home/cli/custom/shell-scripts.nix similarity index 100% rename from modules/home/cli/tools/custom/shell-scripts.nix rename to modules/home/cli/custom/shell-scripts.nix diff --git a/modules/home/cli/tools/direnv/default.nix b/modules/home/cli/direnv/default.nix similarity index 100% rename from modules/home/cli/tools/direnv/default.nix rename to modules/home/cli/direnv/default.nix diff --git a/modules/home/cli/tools/git/default.nix b/modules/home/cli/git/default.nix similarity index 100% rename from modules/home/cli/tools/git/default.nix rename to modules/home/cli/git/default.nix diff --git a/modules/home/cli/tools/k8s/default.nix b/modules/home/cli/k8s/default.nix similarity index 100% rename from modules/home/cli/tools/k8s/default.nix rename to modules/home/cli/k8s/default.nix diff --git a/modules/home/cli/tools/k8s/k9s.nix b/modules/home/cli/k8s/k9s.nix similarity index 100% rename from modules/home/cli/tools/k8s/k9s.nix rename to modules/home/cli/k8s/k9s.nix diff --git a/modules/home/cli/tools/k8s/krewfile.nix b/modules/home/cli/k8s/krewfile.nix similarity index 100% rename from modules/home/cli/tools/k8s/krewfile.nix rename to modules/home/cli/k8s/krewfile.nix diff --git a/modules/home/cli/tools/k8s/kubecolor.nix b/modules/home/cli/k8s/kubecolor.nix similarity index 100% rename from modules/home/cli/tools/k8s/kubecolor.nix rename to modules/home/cli/k8s/kubecolor.nix diff --git a/modules/home/cli/tools/langs/default.nix b/modules/home/cli/langs/default.nix similarity index 100% rename from modules/home/cli/tools/langs/default.nix rename to modules/home/cli/langs/default.nix diff --git a/modules/home/cli/tools/langs/go.nix b/modules/home/cli/langs/go.nix similarity index 100% rename from modules/home/cli/tools/langs/go.nix rename to modules/home/cli/langs/go.nix diff --git a/modules/home/cli/tools/langs/rust.nix b/modules/home/cli/langs/rust.nix similarity index 100% rename from modules/home/cli/tools/langs/rust.nix rename to modules/home/cli/langs/rust.nix diff --git a/modules/home/cli/tools/lazygit/default.nix b/modules/home/cli/lazygit/default.nix similarity index 100% rename from modules/home/cli/tools/lazygit/default.nix rename to modules/home/cli/lazygit/default.nix diff --git a/modules/home/cli/tools/pet/default.nix b/modules/home/cli/pet/default.nix similarity index 100% rename from modules/home/cli/tools/pet/default.nix rename to modules/home/cli/pet/default.nix diff --git a/modules/home/cli/tools/starship/default.nix b/modules/home/cli/starship/default.nix similarity index 100% rename from modules/home/cli/tools/starship/default.nix rename to modules/home/cli/starship/default.nix diff --git a/modules/home/cli/tools/core/default.nix b/modules/home/cli/tools/core/default.nix deleted file mode 100644 index ccf22c23..00000000 --- a/modules/home/cli/tools/core/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - imports = [ - ./packages.nix - ./programs.nix - ]; -} diff --git a/modules/home/cli/tools/core/programs.nix b/modules/home/cli/tools/core/programs.nix deleted file mode 100644 index 889d1a85..00000000 --- a/modules/home/cli/tools/core/programs.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ - # catppuccin = { - # bat.enable = true; - # fzf.enable = true; - # btop.enable = true; - # }; - - programs = { - bat.enable = true; - fzf.enable = true; - btop.enable = true; - - zoxide.enable = true; - neonix.enable = true; - eza.enable = true; - }; -} diff --git a/modules/home/cli/shells/zsh/default.nix b/modules/home/cli/zsh/default.nix similarity index 100% rename from modules/home/cli/shells/zsh/default.nix rename to modules/home/cli/zsh/default.nix diff --git a/modules/home/programs/default.nix b/modules/home/programs/default.nix index 1a9fd6eb..5e56457c 100644 --- a/modules/home/programs/default.nix +++ b/modules/home/programs/default.nix @@ -1,5 +1,30 @@ +{ pkgs, ... }: { - imports = [ - ./guis - ]; + home.packages = builtins.attrValues { + # Audio + inherit (pkgs) + pavucontrol + spek + vlc + + # Screenshot / Recording + grimblast + wf-recorder + + # Tools + nwg-displays + nwg-look + gparted + gnome-disk-utility + + # Explorer + thunar + + # Note taking + obsidian + + # Keyboard + zmk-studio + ; + }; } diff --git a/modules/home/programs/guis/default.nix b/modules/home/programs/guis/default.nix deleted file mode 100644 index 0f50d4ca..00000000 --- a/modules/home/programs/guis/default.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ pkgs, ... }: -{ - home.packages = builtins.attrValues { - # Audio - inherit (pkgs) - pavucontrol - spek - vlc - - # Screenshot / Recording - grimblast - wf-recorder - - # Tools - nwg-displays - nwg-look - gparted - gnome-disk-utility - - # Explorer - thunar - - # Note taking - obsidian - ; - }; -} From 315802e7cf5a4ac4325785fe407be38d4b8c20c9 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 28 Jun 2026 00:18:28 +0200 Subject: [PATCH 13/71] minors --- flake.lock | 4 ++-- flake.nix | 2 +- modules/home/cli/pet/default.nix | 4 ++-- modules/nixos/services/nh.nix | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index e8d98020..7581e00d 100644 --- a/flake.lock +++ b/flake.lock @@ -647,13 +647,13 @@ "locked": { "lastModified": 1780865186, "narHash": "sha256-GXjj3r00JhjYtVZZtDTz99ZPcJqTTcrsF1NS+jEdDhk=", - "owner": "rgroemmer", + "owner": "rapsnx", "repo": "neonix", "rev": "16a56ef334a7117f1124b4082121fbe6787f94d9", "type": "github" }, "original": { - "owner": "rgroemmer", + "owner": "rapsnx", "repo": "neonix", "type": "github" } diff --git a/flake.nix b/flake.nix index a71a48ce..f1d24734 100644 --- a/flake.nix +++ b/flake.nix @@ -12,7 +12,7 @@ inputs.nixpkgs.follows = "nixpkgs"; }; neonix = { - url = "github:rgroemmer/neonix"; + url = "github:rapsnx/neonix"; }; sops-nix = { url = "github:mic92/sops-nix"; diff --git a/modules/home/cli/pet/default.nix b/modules/home/cli/pet/default.nix index b8090478..470b5b89 100644 --- a/modules/home/cli/pet/default.nix +++ b/modules/home/cli/pet/default.nix @@ -1,6 +1,6 @@ { lib, - inputs, + config, ... }: { @@ -8,7 +8,7 @@ enable = true; settings = { General = lib.mkForce { - snippetfile = "${inputs.self.outPath}/extra/snippet.toml"; + snippetfile = "${config.home.homeDirectory}/Projects/rapsnx/dotfiles/extra/snippet.toml"; selectcmd = "fzf --ansi"; color = true; }; diff --git a/modules/nixos/services/nh.nix b/modules/nixos/services/nh.nix index b0f9f4ac..34d06270 100644 --- a/modules/nixos/services/nh.nix +++ b/modules/nixos/services/nh.nix @@ -3,6 +3,6 @@ enable = true; clean.enable = true; clean.extraArgs = "--keep 5 --keep-since 5d"; - flake = "/home/rap/Projects/rgroemmer/dotfiles"; + flake = "/home/rap/Projects/rapsnx/dotfiles"; }; } From 6f85b688ec07128840e99f6c2f0d298ad9a311b3 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 28 Jun 2026 16:16:31 +0200 Subject: [PATCH 14/71] remove opacity --- modules/home/desktops/hyprland/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index a1da03c9..d809a636 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -98,8 +98,6 @@ in new_optimizations = true; }; rounding = 5; - active_opacity = 0.98; - inactive_opacity = 0.85; }; # Autostart From d0eb46edd7ac5f1f122210001f1e6f735aa762f5 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 28 Jun 2026 16:29:04 +0200 Subject: [PATCH 15/71] update ssh --- secrets/common/ssh.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/secrets/common/ssh.yaml b/secrets/common/ssh.yaml index 4d564229..e7af406f 100644 --- a/secrets/common/ssh.yaml +++ b/secrets/common/ssh.yaml @@ -1,4 +1,4 @@ -ssh_config: ENC[AES256_GCM,data:Z9shLNRk+XM0Y5jDAMLDyF9EGqYXiOGm6AO2LARTW8bXWYYihDmoG9xxbmRF9QpUOqdKz9pdc1/jjTcdXJ5w4xawNFUxIiA2HeS62JXZj8SGsO1T7Hn9Z4zHpKnaDt6tWCgp9XO1mAJ0iUvExKkDaqjwidYSwZGmXtxivgsuOL00QipwnNUM9JCepcIvkvtAUj+5MzaBp5vxMTq3VbABmf08rxO8eFR6Ctr9diTDagZuaW+82kk0uX2/bu6E1Fg/fVzdeLgn4UUl2key2n3MSHnQYhuQFaxp0W5WXZoXB56y05vLRFygIL0SHE3I3f66gz155g9+D8pSfQC7xonemLBp0Gnid/5LXQPggy+fAxxbEb5rCCBwRCFoPEUGBielzbOVDcdS90hng0rFJPpu99pSygbhPv0fhnr68NnBxZ/HqpXruYInkca5AxK/XrPy5MlTrvhrm4A6FuGfYepMpiWJxh0GPHOjM5T2UNKYIIYqWofIOaS82+dZf0ADd7vwCpm2CV3gXLLTiiT981kHPrY6Y7XI62l0n/AQeyXemPRjYbWeF9VDtvS+sIVuQZzOhWhpB2XJCo85b2fnDmrYxgcHHyyvAl9bZ/biGvghtR4Cdw+lNV7jgcpUPgnfekm13RAylV3hfWaZWC9/XqSuVN7tar+7zfuJKUVcCmpB8B25wwwVzdfm/X8dVzQk02sBn9lT+jdTLvF7oUSptkhWjjH+De0lZaZB2B27npTTUk4hCGL17hqPhW8pE92QM7gbW5JLQ0xoa4UDb8jZH33rIijQ4NmgngkEMdeuk1ettRkrqOeFvu2rB5V1tTm3Naa5BBhn4su8PVDfAMGh829cLHgAtrerIxA1iQfG/y3VfrBW/3exPuv09Sb4ZPkLNlkK813hc1fj6KOrZRzT54vPyUoy/CHPLEoUHQx0SxUTiu5f5gLWDXVRejMFM2KUJ87iWbTLbHs1oRa3/yUJx2aBojP1GevMXq2ON7nO2vAu7ikLLQ==,iv:V2hkvW6tLfvTfM0kAipEWi9ss0Dv8vhtk+ucwJrjOq8=,tag:VYyv5/6a1a9SHUHOgLnv0w==,type:str] +ssh_config: ENC[AES256_GCM,data:jy99anNQWbZG41aa6HeTdGsKsjDWg2B72RTQk2MmeLlhQhBOMn4639G4ibkWFlCTkmRtz+XCHTiuUUnvChLxtFz7/osGGpKmBr6mVBG78Hftbf97UP88Ydt5zOLWRIb2U1i5dzLxiLFfbYl0bVKd7DHrsM9KLRlWtpGOJ2WW1Qubg1MrXjQc0Wcv/hYjoLfysyNYeBRAHDmuAVlsqrWvXT/hs11xHxLeyBU1NjkmdKjtQ54y6yoS4bYbMAXa2WDsM1iZVsrBvadkOn+/C02QWI/nugPb5ycTaWLbu342ixBrDyyvZkmX+HHkR0h4yjqDGfYT62be4lTn3iyFjNno/VgORat8VTFzBubpnpm+AfhdG+4EqqBu5sJejZbGTIa0kfkfTG0pCzLNvh1HyvO38Ccjluhx8pbSHdlbK0Gj0Lu1+WMVxlXCYNTTJWKuS3isZhtA6Mk5HJNwpdQZo8XD2OJGKWQKLPHmp/K4x7HfLmRYyB+p+EPfT/CMFisYVKiQZle0tHq5aQ0czzeZpXSwi4J06UF3W2hPLMN2Eup9bRF8gg39+6gh5Ceji7RCqc9iw/CVUdq7KvlR1tky7jQP8VRrFUAjMYm8dy8Lrmbs/BT0kDlqkaReIHpSXJn2z19O86Si7yEEbLIyUWEaMhzW4lEkbel6X6ZOc8SRIlDak7JcPSagDDZo1LTjgDvyzQNkfEV4v2JKJTVNI+bqXzC34ss5sUs0cHSwWeQ7ja88ef4Fe74ySea/unt7qbkzkdzWg9i4jfPRA/clZ7CYSpLU0v5/H3zijZbrGmsgskVsJHUHxptsgzkFI4eu4ISeQUyiP3IjkfmL4UEVO4dvpNFBa1kourh0FyEfvN1hb1C3Vg18i1ltvj8kCUntmXGHMJxz7idSPP8Hl/dYG+y8fWa45cvgDRVs+bNm50qr2zyPLOpIdRt8hPFLKGFJT3113h1D/BAn2765kbO3jZ7KGG6wVIitEYwgmPitq41C3rIa+J+tYANQ47rK82nyacnRCVphnZl6hsd7LNtrDx+BkLNoM7BPpKK2i4yml1v9amgqWRc58y3e8X797AGCkJZJroqytdXmamuAUlc9kZ0VTI7YXDJuIg3ysll5Hv61Zg1eW6m/NZqsy0fHfMJmpDFvyqF4gATqN3Rfsdn5YFv7hF6VY5Q=,iv:oAOfe0qlOanFFgH4CjKtHYPAUujM4xid+U3zKQhtJbI=,tag:mxYZxlsv/WLQYRGdoeh+9g==,type:str] swiss: ENC[AES256_GCM,data:zDBhSsPOguZuD6Kx+rMYR9KAjXxycbjXMhL5MZabZShKV+1ICZBsfnWOnBcfxX281hXf2K/TNbphC3KLnTaV0+Ti43BKunSDJp8qyEKgG3xsd7Zf8/i/eMQJygMphCF3XvJJjc3wBEUf/mZ1ObJKYueqtTdSZzx4orR6X93Vdt13GgFJLaX4/8XYsAeBXf4RwYD5gsVjg2QI0t48vnvlU0xN6oFvJAYedvyxgPL3z1pGv+0k/85XtaCfy38LQ5ddOYGxH+XKDzCfkskhd3X6cUeMbDfLrelGwvTB967wHAulgilBR1ObhV1SoUiz6K1a1PRy9XjuzwTbFG8fjFrGk+9yJtucFp1Vgtf6L+pgLxc5HzkC+f9tEldslJQC6y1045s/OWp+ghL+auzFuJGhDuq8JJUSF9Pk0LeDOb67wIrW+2250PTYJbINk2Sdo09Bj7GUCCBkrDHT+IcA/qF0saQ25QTE/BtPLEMiPhwgkYAhrL1uz7s6+HfuUiFPKY0jOn0q0xTxfV00G+wGJFp7,iv:uZxwZQZhmBKUQnAPuf6NFk9TRWH16PmVu5RoTmmxN9Y=,tag:hbvkjfxuSUM2MOyrUzhDrg==,type:str] swiss.pub: ENC[AES256_GCM,data:wGUgxBYiTu0PcDSK/wNgIfdFyOIuqXkr7cOkXDkN3TdccYa/Lsa1qhm5ZXfVpktQE00oVLEHF8hnJfLUfPgOb44XfwhoWUFIdJRDokLSZoLwT/zlOqzEgJ1o1QZxm73xO5wFG1ns4+Fl2Jz5HJ55U3FHMP88B/UY5hYw6vNXfxcpPGbMOA==,iv:tdXPLgImFmEcMiqBSYMzTWFWbK2+5DKdvRyg+luEE0U=,tag:RsEI/YH0z8LW6f1cGhf68g==,type:str] yubi: ENC[AES256_GCM,data:cUO0Yf06ZCIDXe6XBAvHcF+4/rFz3iC8rkgWKtyp5e8nJ80jXF9U00g8zns1yfnRG92QfHNH9hewDepSjkNY/j3SjhUbJynKjJpMTxZURVURJtrVwVbtlN/PvPyffxjolEFzzjM62wCNUCtF4lSZn1p8RQ/G38MI3wTP2JSAOFn4cA2nvJ5rL1vs05pElBfT19hDUfImFR4L5A7Q/bkfIpO7bO0D2qBbiCO6NI0epYXPUp0yize2+hu1mDPCLPIL29P3q7ycVJAXFqxyTvweo72qY7he1dqNEKu/hIFDuHMS+n9fhzf6Qn+5eJcljMofeYLXcLQn57TtUMFkiMRc9t50sip/S0DuPrFO87zf7FZYeHaRKs35gKktVPKl3Vgb+On6BO3A4oU1Ru/EiCdRiYL8d7yTKe9CcU7Hghz41ToAH6PEvx+uCFNvWvmIOlTfGHCik4uwPa35H/aUzLAd736AtcrjyNfvISx6MdtbS83+UFi+clM6ZDvLn/YShEBiipWzJuhK6ZjVq47kDxKFW1ym6ybihL/c+dXS7NcNigkJgpEpZMuFvPDyk/thmyhE3GgBExC/Lms=,iv:XmGbA9MElvTgd4cyjtPAy7uKC0GTqpQksX/8UBl1r+k=,tag:Ox8HK8XVRFGc8CYcnwKn5w==,type:str] @@ -32,7 +32,7 @@ sops: 4QAZU7kwgzEZuAOty9OYvsSa2ArFlhMxF1SPasO1iBgeQG8PL7ifIg== -----END AGE ENCRYPTED FILE----- recipient: age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp - lastmodified: "2026-06-26T12:06:25Z" - mac: ENC[AES256_GCM,data:Yq2tg9luzGmqHsYI7hIbFa5ZuRUDZ3GVRmHgsBP4UnqVNq++62M83ew7Doj8wMO5yeeocrN43UW29+w2Hb3DCxq9iRm430/8zzf+R3R8XqINp1++SAnblCPzqoJXxJvT9ta8X71OqZadglUApzxrR0CyOv+r8xlOdsgA0QeQVts=,iv:kSxrIcpMXO42qWcxeWoKhSQfJ+HO29bZdFHKMLlyCiM=,tag:8rDmIKKlcem3NPbqcZQmng==,type:str] + lastmodified: "2026-06-28T14:28:58Z" + mac: ENC[AES256_GCM,data:9ImIbWTSPIhFpgx+DhICpgTF2feJ9tlikEdlbpEMz5d9zpxHq4O2zxJwmUg8m547lhz5EN9ZwT+Al002DR2396n+tg6NsLCbUNMcf2BelW+2EWSsEPt3tNzazEW4EQIKHWS4y1FPXnQBpPtXPNHBuhWabMwCICk8uD2TFe+snL0=,iv:a0ZbRl6GqbOcSkUvavi0lTQkFEUcK1kgKWtVO1o0kRc=,tag:bL9M9kw7Q/o1K/+pYgRSFA==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 From c75d4eb248cac618c56c7de5f96b4c925c771cf0 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 28 Jun 2026 16:33:58 +0200 Subject: [PATCH 16/71] Improve keybinds --- flake.lock | 92 ++++++++++----------- modules/home/desktops/hyprland/keybinds.nix | 4 +- 2 files changed, 48 insertions(+), 48 deletions(-) diff --git a/flake.lock b/flake.lock index 7581e00d..bd16fcc5 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1780756231, - "narHash": "sha256-tXQxKdG5716uB9/LIkLQqQwHKf5mRSpHoZhz3lyI2Cg=", + "lastModified": 1782073106, + "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "6ecde03f47172753fe5a2f334f9d3facfb7e6784", + "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457", "type": "github" }, "original": { @@ -38,11 +38,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1782117778, - "narHash": "sha256-x6vIJpJziw3Hs0JKKDP+AeRPWwqyMDOmK6I26tqbYj4=", + "lastModified": 1782648384, + "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=", "owner": "catppuccin", "repo": "nix", - "rev": "e98afe2dfd950bda4e6a8ef32bb563ec2f04505a", + "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803", "type": "github" }, "original": { @@ -252,11 +252,11 @@ ] }, "locked": { - "lastModified": 1782233665, - "narHash": "sha256-h/xOtrByoA/Ak1lWHn0O1lVZz4qWYbwOSLQ8YSwQO0I=", + "lastModified": 1782657028, + "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=", "owner": "nix-community", "repo": "home-manager", - "rev": "062581938b4a378a82dfbb294b494808157153a1", + "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365", "type": "github" }, "original": { @@ -310,11 +310,11 @@ ] }, "locked": { - "lastModified": 1776426399, - "narHash": "sha256-RUESLKNikIeEq9ymGJ6nmcDXiSFQpUW1IhJ245nL3xM=", + "lastModified": 1782566056, + "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "68d064434787cf1ed4a2fe257c03c5f52f33cf84", + "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8", "type": "github" }, "original": { @@ -342,11 +342,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1782226626, - "narHash": "sha256-aFkQmqXUPXzV117P853JKe6s/pzohzxZSjzCs9Pw9fc=", + "lastModified": 1782651619, + "narHash": "sha256-c4+F2jy0EGwEwraHz1xNiVLgghw96MkPZxvYO6w9LPQ=", "owner": "hyprwm", "repo": "hyprland", - "rev": "049595e196db4a4ab162ce58aadd016e929327c8", + "rev": "685dbb3d717bb9f11ccdc6b8437a772b83e16785", "type": "github" }, "original": { @@ -388,11 +388,11 @@ ] }, "locked": { - "lastModified": 1776426575, - "narHash": "sha256-KI6nIfVihn/DPaeB5Et46Xg3dkNHrrEtUd5LBBVomB0=", + "lastModified": 1782563850, + "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "a968d211048e3ed538e47b84cb3649299578f19d", + "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178", "type": "github" }, "original": { @@ -494,11 +494,11 @@ ] }, "locked": { - "lastModified": 1772462885, - "narHash": "sha256-5pHXrQK9zasMnIo6yME6EOXmWGFMSnCITcfKshhKJ9I=", + "lastModified": 1782554491, + "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=", "owner": "hyprwm", "repo": "hyprtoolkit", - "rev": "9af245a69fa6b286b88ddfc340afd288e00a6998", + "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35", "type": "github" }, "original": { @@ -519,11 +519,11 @@ ] }, "locked": { - "lastModified": 1780251518, - "narHash": "sha256-fG9xbb1SOAAJ+2kJRakp3ch+BmA/3dEg/K3PoAZTKkw=", + "lastModified": 1782035033, + "narHash": "sha256-pUtCphVzH1iNUTMGdJr4+e/yzUXA6/DZwsn+cyfIVJU=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "40ede2e7bdec80ba5d4c443160d905e9f841ae5f", + "rev": "9d8bf6e810597152eef8906c670b96679af2faec", "type": "github" }, "original": { @@ -692,11 +692,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1781795508, - "narHash": "sha256-VKrApQ3WCkEe9D8DbaeFjGqLAh7zqYGYjbQYtY5ikxc=", + "lastModified": 1782592242, + "narHash": "sha256-kgINba6Ilpj3rdTi2BeKlQBs6ZxTdu3Gb49U5gDUVhg=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "493ce1e33e72f86312584f331c8cf52b3432ec99", + "rev": "9e26dfe0fb8d61475b6f9e8d63477fe92509f1db", "type": "github" }, "original": { @@ -743,11 +743,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1782166108, - "narHash": "sha256-/EtnQBcKbsaCAGQ5VRcplrHRkR4ryqyLMpBfkVuG9Xw=", + "lastModified": 1782562157, + "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "875776f0252fcb8618bb948640a0d1f7a5b362be", + "rev": "a9cf7546a938c737b079e738de73934a13de9784", "type": "github" }, "original": { @@ -759,11 +759,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1781607440, - "narHash": "sha256-eM+l4TVD26SNoEjcxRcpispqZi5Qrqj/G0ZY4LfqwfM=", - "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158", + "lastModified": 1782175435, + "narHash": "sha256-8d2wCNWKnd86GzKZvbuqqlS+HqMrheXkvRf0qGJ/oA0=", + "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775", "type": "tarball", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1017567.3e41b24abd26/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1020805.89570f24e97e/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -772,11 +772,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1781509190, - "narHash": "sha256-uJZs9Di8I6ciTp6jiojj0HzlNpBkud8ax5aT/O5aJkw=", + "lastModified": 1782498288, + "narHash": "sha256-8/X3yyTXiE82b38n32ItbOqfWOVBl+gKa8fILyZfR4Q=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d6df3513510aa548c83868fd22bfddd0a8c0a0d4", + "rev": "3cac626ec5e3703e835f227687e88aa9e2f25701", "type": "github" }, "original": { @@ -817,11 +817,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1781577229, - "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", + "lastModified": 1782467914, + "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", + "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", "type": "github" }, "original": { @@ -864,11 +864,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { @@ -1048,11 +1048,11 @@ ] }, "locked": { - "lastModified": 1780133819, - "narHash": "sha256-0YPKIY3dlnR7SPq7Z8ekFVvzFsfeiAtEj+QUI3KHrlI=", + "lastModified": 1782311043, + "narHash": "sha256-07zLc2M3/ax+JsjxGTft17/Joua41LHE9/9AC/F9zeU=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "4a170c0ba96fd37374f93d8f91c9ed91814828ac", + "rev": "882ad01e195ce201b07c618bbee44a0cad8b9e5a", "type": "github" }, "original": { diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index bf9b38f4..f75446b0 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -65,8 +65,8 @@ in # Emoji picker "SUPER,period, exec, rofimoji --action copy --action type" - # Emoji picker - "SUPER,I, exec, systemctl restart --user kanshi.service" + # Reload kanshi + "SUPER+SHIFT,I, exec, systemctl restart --user kanshi.service" ]; extraConfig = '' From 228d77b50ba75df9c0c502544ff09ed6b921632d Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 28 Jun 2026 17:08:22 +0200 Subject: [PATCH 17/71] nix flake update --- flake.lock | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/flake.lock b/flake.lock index bd16fcc5..2509eaf0 100644 --- a/flake.lock +++ b/flake.lock @@ -342,11 +342,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1782651619, - "narHash": "sha256-c4+F2jy0EGwEwraHz1xNiVLgghw96MkPZxvYO6w9LPQ=", + "lastModified": 1782658834, + "narHash": "sha256-OYjcMSNogYWLbeP4nxpUVJaO72o6yIK00bDYaAuQI2Y=", "owner": "hyprwm", "repo": "hyprland", - "rev": "685dbb3d717bb9f11ccdc6b8437a772b83e16785", + "rev": "75f558a536f8003bf80af5cb1a3e91529e78cb6b", "type": "github" }, "original": { @@ -645,11 +645,11 @@ "pre-commit-hooks": "pre-commit-hooks_2" }, "locked": { - "lastModified": 1780865186, - "narHash": "sha256-GXjj3r00JhjYtVZZtDTz99ZPcJqTTcrsF1NS+jEdDhk=", + "lastModified": 1782657946, + "narHash": "sha256-drO3tcL528kWQpktth5PeT6jVQRPJge24y/7KMFAe5g=", "owner": "rapsnx", "repo": "neonix", - "rev": "16a56ef334a7117f1124b4082121fbe6787f94d9", + "rev": "4bc7283e07684c468e7139135fb8ee2a5297d6d0", "type": "github" }, "original": { @@ -788,11 +788,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1780243769, - "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", + "lastModified": 1781577229, + "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", "owner": "nixos", "repo": "nixpkgs", - "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", + "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", "type": "github" }, "original": { @@ -841,11 +841,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1780849525, - "narHash": "sha256-yjtMubbmPi4Y4pgDSdmytqUutGJ+LJLcPgXGNNdXiUs=", + "lastModified": 1782254890, + "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=", "owner": "nix-community", "repo": "nixvim", - "rev": "98acb923e5882a6a6a2b660d99e8c5124e08b838", + "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554", "type": "github" }, "original": { @@ -887,11 +887,11 @@ ] }, "locked": { - "lastModified": 1778507602, - "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=", + "lastModified": 1781733627, + "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a", + "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", "type": "github" }, "original": { From bae470bb68b227875c7e99ecead898e4ad50efbb Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 29 Jun 2026 01:02:23 +0200 Subject: [PATCH 18/71] WIP --- docs/new-host.md | 26 ++++++++---- hosts/zion/default.nix | 14 +++++-- hosts/zion/home.nix | 5 +++ modules/home/desktops/hyprland/default.nix | 1 + modules/home/desktops/hyprland/keybinds.nix | 44 ++++----------------- modules/home/services/sops.nix | 4 +- modules/nixos/system/sops.nix | 4 +- 7 files changed, 46 insertions(+), 52 deletions(-) diff --git a/docs/new-host.md b/docs/new-host.md index 58a317a3..459cbbad 100644 --- a/docs/new-host.md +++ b/docs/new-host.md @@ -5,8 +5,8 @@ option. ## Sops-nix -In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied -over to the `.sops.yaml` config. +In order to access secrets via `sops-nix`, this repo uses an `age` identity file by default. For a YubiKey-backed +setup, point the host at an `age-plugin-yubikey` identity file instead. This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`: @@ -15,11 +15,23 @@ This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys - hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files ``` -# Connect to the new host, and copy the public key of the autogenerated age-key. -sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key" - -# Add recipient in `.sops.yaml` and paste the public key, then update the secret file. -sops updatekeys secrets/common/ssh.yaml +# Install the tools needed for a YubiKey-backed age identity. +services.pcscd.enable = true; +environment.systemPackages = with pkgs; [ + age + age-plugin-yubikey +]; + +# Generate a YubiKey identity and use it in the host config. +age-plugin-yubikey --generate \ + --name swiss \ + --slot 82 \ + --pin-policy once \ + --touch-policy cached \ + > ~/.config/sops/age/yubikey-identity.txt + +# The corresponding recipient can then be added to `.sops.yaml`. +age-plugin-yubikey --list ``` ## Github action diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index b93aaf20..b8a7ac71 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -53,7 +53,11 @@ }; environment = { - systemPackages = [ pkgs.qt6.qtwayland ]; + systemPackages = [ + pkgs.age + pkgs.age-plugin-yubikey + pkgs.qt6.qtwayland + ]; sessionVariables = { WLR_NO_HARDWARE_CURSORS = "1"; @@ -63,7 +67,9 @@ hardware.i2c.enable = true; - services.udev.packages = [ - pkgs.qmk-udev-rules - ]; + services.udev = { + packages = [ + pkgs.qmk-udev-rules + ]; + } diff --git a/hosts/zion/home.nix b/hosts/zion/home.nix index 1912ee81..6546fd8d 100644 --- a/hosts/zion/home.nix +++ b/hosts/zion/home.nix @@ -11,6 +11,11 @@ stateVersion = lib.mkDefault "22.05"; }; + sops.age = { + generateKey = false; + keyFile = "${config.home.homeDirectory}/.config/sops/age/yubikey-identity.txt"; + }; + roles = { work = false; email = "mail@rapsn.me"; diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index d809a636..04bbeab0 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -51,6 +51,7 @@ in services.hyprpaper.enable = true; catppuccin.hyprland.enable = false; + catppuccin.hyprlock.enable = false; wayland.windowManager.hyprland = { enable = true; configType = "hyprlang"; diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index f75446b0..c189ddce 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -45,10 +45,13 @@ in "SUPER,3, workspace, 3" "SUPER,4, workspace, 4" "SUPER,5, workspace, 5" - "SUPER,6, workspace, 6" - "SUPER,7, workspace, 7" - "SUPER,8, workspace, 8" - "SUPER,9, workspace, 9" + + # Workspace selection + "SUPER+SHIFT,1, movetoworkspace, 1" + "SUPER+SHIFT,2, movetoworkspace, 2" + "SUPER+SHIFT,3, movetoworkspace, 3" + "SUPER+SHIFT,4, movetoworkspace, 4" + "SUPER+SHIFT,5, movetoworkspace, 5" # Workpace handling sratchy "SUPER,O, togglespecialworkspace, scratchy" @@ -90,39 +93,6 @@ in bind = , return, submap, reset bind = , escape, submap, reset submap = reset - - - # Window mode - bind = SUPER, G, submap, windows - - submap = windows - bind = , Q, movetoworkspace, 1 - bind = , Q, submap, reset - - bind = , W, movetoworkspace, 2 - bind = , W, submap, reset - - bind = , E, movetoworkspace, 3 - bind = , E, submap, reset - - bind = , R, movetoworkspace, 4 - bind = , R, submap, reset - - bind = , B, movetoworkspace, +0,class:firefox - bind = , B, submap, reset - - bind = SHIFT, B, movetoworkspacesilent, 3,class:firefox - bind = SHIFT, B, submap, reset - - bind = , return, submap, reset - bind = , escape, submap, reset - submap = reset - - # Lid closed: disable internal laptop display - bindl = , switch:on:Lid Switch, exec, hyprctl keyword monitor "eDP-1, disable" - - # Lid opened: enable internal laptop display again - bindl = , switch:off:Lid Switch, exec, hyprctl keyword monitor "eDP-1, 1920x1200@60, 0x0, 1" ''; }; }; diff --git a/modules/home/services/sops.nix b/modules/home/services/sops.nix index bf24d544..ea4a5ca5 100644 --- a/modules/home/services/sops.nix +++ b/modules/home/services/sops.nix @@ -6,8 +6,8 @@ lib.mkIf (config ? targets && config.targets ? genericLinux && config.targets.genericLinux.enable) { sops = { age = { - generateKey = true; - keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt"; + generateKey = lib.mkDefault true; + keyFile = lib.mkDefault "${config.home.homeDirectory}/.config/sops/age/keys.txt"; }; defaultSopsFile = ../../../secrets/common/ssh.yaml; diff --git a/modules/nixos/system/sops.nix b/modules/nixos/system/sops.nix index d7577af7..468d9c76 100644 --- a/modules/nixos/system/sops.nix +++ b/modules/nixos/system/sops.nix @@ -6,8 +6,8 @@ lib.mkIf (config.hostConfig.user.name != "root") { sops = { age = { - generateKey = false; - keyFile = "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt"; + generateKey = lib.mkDefault false; + keyFile = lib.mkDefault "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt"; }; defaultSopsFile = ../../../secrets/common/ssh.yaml; From 20e5d3d063a60a407466a675892a1e4fb370f4a3 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 5 Jul 2026 04:36:04 +0200 Subject: [PATCH 19/71] set local bin and disable cgo --- hosts/zion/default.nix | 2 +- modules/home/cli/langs/go.nix | 1 + modules/home/cli/zsh/default.nix | 4 ++++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index b8a7ac71..90cef8ed 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -71,5 +71,5 @@ packages = [ pkgs.qmk-udev-rules ]; - + }; } diff --git a/modules/home/cli/langs/go.nix b/modules/home/cli/langs/go.nix index b2375cd0..f45ca07b 100644 --- a/modules/home/cli/langs/go.nix +++ b/modules/home/cli/langs/go.nix @@ -9,6 +9,7 @@ package = pkgs.go; env = { GOPATH = "${config.home.homeDirectory}/go"; + CGO_ENABLED = "0"; GOPRIVATE = [ "github.com/stackitcloud" "dev.azure.com/*" diff --git a/modules/home/cli/zsh/default.nix b/modules/home/cli/zsh/default.nix index 00dfde98..5f85bbd5 100644 --- a/modules/home/cli/zsh/default.nix +++ b/modules/home/cli/zsh/default.nix @@ -13,6 +13,10 @@ inherit (pkgs) zsh-completions; }; + home.sessionPath = [ + "$HOME/.local/bin" + ]; + programs.zsh = { enable = true; From 9eefe6cbbda96e81693630312df6204effbb3084 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 5 Jul 2026 21:14:42 +0200 Subject: [PATCH 20/71] add tmux --- modules/home/cli/terminals/tmux/default.nix | 26 +++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 modules/home/cli/terminals/tmux/default.nix diff --git a/modules/home/cli/terminals/tmux/default.nix b/modules/home/cli/terminals/tmux/default.nix new file mode 100644 index 00000000..94466145 --- /dev/null +++ b/modules/home/cli/terminals/tmux/default.nix @@ -0,0 +1,26 @@ +{ pkgs, ... }: +{ + programs.tmux = { + enable = true; + package = pkgs.tmux; + + shell = "${pkgs.zsh}/bin/zsh"; + terminal = "xterm-256color"; + mouse = true; + keyMode = "vi"; + clock24 = true; + historyLimit = 100000; + escapeTime = 10; + + extraConfig = '' + set -g focus-events on + set -g set-clipboard on + set -g allow-passthrough on + set -ga terminal-features ',alacritty:RGB' + set -ga terminal-features ',xterm-256color:RGB' + set -ga terminal-features ',tmux-256color:RGB' + + set -g update-environment "DISPLAY WAYLAND_DISPLAY SSH_AUTH_SOCK XAUTHORITY XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_CONFIG_HOME XDG_DATA_HOME XDG_CACHE_HOME KUBECONFIG" + ''; + }; +} From add49936506d665721b8698e8f570fc1707cca4f Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 29 Jun 2026 01:02:23 +0200 Subject: [PATCH 21/71] WIP --- modules/home/browsers/chromium/default.nix | 1 + modules/home/cli/terminals/alacritty/default.nix | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/modules/home/browsers/chromium/default.nix b/modules/home/browsers/chromium/default.nix index e866c3e6..d91b26b1 100644 --- a/modules/home/browsers/chromium/default.nix +++ b/modules/home/browsers/chromium/default.nix @@ -9,6 +9,7 @@ commandLineArgs = [ "--enable-features=UseOzonePlatform" "--ozone-platform=wayland" + "--disable-features=WebRtcAllowInputVolumeAdjustment" ]; }; } diff --git a/modules/home/cli/terminals/alacritty/default.nix b/modules/home/cli/terminals/alacritty/default.nix index 2ac151fd..4b10569f 100644 --- a/modules/home/cli/terminals/alacritty/default.nix +++ b/modules/home/cli/terminals/alacritty/default.nix @@ -35,7 +35,17 @@ binding = { key = "H"; - mods = "Control|Shift"; + mods = "Control"; + }; + } + { + action = "Copy"; + post_processing = true; + regex = "[a-z0-9]+(?:--?[a-z0-9]+)*(?:-[a-z0-9]+)*"; + + binding = { + key = "G"; + mods = "Control"; }; } ]; From d3d279689533703955153ae08f8386f5e23b6bd4 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 5 Jul 2026 22:30:16 +0200 Subject: [PATCH 22/71] lel --- modules/home/desktops/hyprland/keybinds.nix | 29 +++++++++++++++++++++ modules/nixos/system/env.nix | 10 ++++--- 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index c189ddce..b44cd55f 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -93,6 +93,35 @@ in bind = , return, submap, reset bind = , escape, submap, reset submap = reset + + # Window mode + bind = SUPER, G, submap, windows + submap = windows + bind = , Q, movetoworkspace, 1 + bind = , Q, submap, reset + + bind = , W, movetoworkspace, 2 + bind = , W, submap, reset + + bind = , E, movetoworkspace, 3 + bind = , E, submap, reset + + bind = , R, movetoworkspace, 4 + bind = , R, submap, reset + + bind = , B, movetoworkspace, +0,class:firefox + bind = , B, submap, reset + + bind = SHIFT, B, movetoworkspacesilent, 3,class:firefox + bind = SHIFT, B, submap, reset + + bind = , return, submap, reset + bind = , escape, submap, reset + submap = reset + + # Lid closed: let kanshi apply the docked profile. Lid opened: keep kanshi out of the way and force-enable the panel. + bindl = , switch:on:Lid Switch, exec, systemctl --user start kanshi.service + bindl = , switch:off:Lid Switch, exec, sh -c 'systemctl --user stop kanshi.service; sleep 2; hyprctl keyword monitor "eDP-1,preferred,0x0,1"' ''; }; }; diff --git a/modules/nixos/system/env.nix b/modules/nixos/system/env.nix index 5cfa7f83..b066a974 100644 --- a/modules/nixos/system/env.nix +++ b/modules/nixos/system/env.nix @@ -26,10 +26,12 @@ ; } # TODO: wtf? - ++ lib.optionals (!config.hostConfig.roles.desktop) (lib.attrValues { - inherit (inputs.neonix.packages.${pkgs.stdenv.hostPlatform.system}) mini; - inherit (pkgs) jq tmux; - }); + ++ lib.optionals (!config.hostConfig.roles.desktop) ( + lib.attrValues { + inherit (inputs.neonix.packages.${pkgs.stdenv.hostPlatform.system}) mini; + inherit (pkgs) jq; + } + ); variables = { EDITOR = "vim"; VISUAL = "vim"; From 95c663d4b6c1087ca9d359f337fe1cd5c9d7dcdd Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 5 Jul 2026 22:34:57 +0200 Subject: [PATCH 23/71] renable superior keymap --- modules/home/desktops/hyprland/keybinds.nix | 43 ++++++++++++--------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index b44cd55f..7954b132 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -1,10 +1,32 @@ { lib, config, + pkgs, ... }: let cfg = config.roles.desktop.hyprland; + toggleFirefox = pkgs.writeShellScriptBin "toggleFirefox" '' + #!/usr/bin/env bash + set -euo pipefail + + CLASS="firefox" + DEDICATED_WS="3" + + current_ws="$(hyprctl activeworkspace -j | jq -r '.id')" + + firefox_on_current="$( + hyprctl clients -j | jq -r --arg class "$CLASS" --argjson ws "$current_ws" ' + any(.[]; (.class | ascii_downcase) == $class and .workspace.id == $ws) + ' + )" + + if [[ "$firefox_on_current" == "true" ]]; then + hyprctl dispatch movetoworkspacesilent "$DEDICATED_WS,class:$CLASS" + else + hyprctl dispatch movetoworkspace "+0,class:$CLASS" + fi + ''; in { config = lib.mkIf cfg.enable { @@ -46,13 +68,6 @@ in "SUPER,4, workspace, 4" "SUPER,5, workspace, 5" - # Workspace selection - "SUPER+SHIFT,1, movetoworkspace, 1" - "SUPER+SHIFT,2, movetoworkspace, 2" - "SUPER+SHIFT,3, movetoworkspace, 3" - "SUPER+SHIFT,4, movetoworkspace, 4" - "SUPER+SHIFT,5, movetoworkspace, 5" - # Workpace handling sratchy "SUPER,O, togglespecialworkspace, scratchy" "SUPER,M, togglespecialworkspace, aux" @@ -60,13 +75,12 @@ in "SUPER SHIFT,M, movetoworkspace, special:aux" # -- Programs - # Mumble "SUPER,Z, exec, mumble rpc togglemute" "SUPER+SHIFT,Z, exec, mumble rpc toggledeaf" # Emoji picker - "SUPER,period, exec, rofimoji --action copy --action type" + "SUPER,period, exec, rofimoji --action copy type" # Reload kanshi "SUPER+SHIFT,I, exec, systemctl restart --user kanshi.service" @@ -109,19 +123,12 @@ in bind = , R, movetoworkspace, 4 bind = , R, submap, reset - bind = , B, movetoworkspace, +0,class:firefox - bind = , B, submap, reset - - bind = SHIFT, B, movetoworkspacesilent, 3,class:firefox - bind = SHIFT, B, submap, reset + # Special app toggle + bing = , B, exec, ${lib.getExe toggleFirefox}" bind = , return, submap, reset bind = , escape, submap, reset submap = reset - - # Lid closed: let kanshi apply the docked profile. Lid opened: keep kanshi out of the way and force-enable the panel. - bindl = , switch:on:Lid Switch, exec, systemctl --user start kanshi.service - bindl = , switch:off:Lid Switch, exec, sh -c 'systemctl --user stop kanshi.service; sleep 2; hyprctl keyword monitor "eDP-1,preferred,0x0,1"' ''; }; }; From 9b3af832edffd408227c023a8564b913c7465370 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 5 Jul 2026 22:58:52 +0200 Subject: [PATCH 24/71] Enable tflow --- flake.lock | 79 ++++++++++++++++++++- flake.nix | 5 ++ modules/home/cli/tflow/default.nix | 6 ++ modules/home/desktops/hyprland/keybinds.nix | 2 +- 4 files changed, 90 insertions(+), 2 deletions(-) create mode 100644 modules/home/cli/tflow/default.nix diff --git a/flake.lock b/flake.lock index 2509eaf0..49ffa5d5 100644 --- a/flake.lock +++ b/flake.lock @@ -180,6 +180,24 @@ "type": "github" } }, + "flake-utils_3": { + "inputs": { + "systems": "systems_5" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -265,6 +283,27 @@ "type": "github" } }, + "home-manager_2": { + "inputs": { + "nixpkgs": [ + "tflow", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1783222121, + "narHash": "sha256-E/ElL373TO8lQ2aMvYyzN+k4xkVaUGoRqoa8AtM71tI=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "a1645f40777620c4bd2b6d854b290c2fc354a266", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, "hyprcursor": { "inputs": { "hyprlang": [ @@ -936,7 +975,8 @@ "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", "pre-commit-hooks": "pre-commit-hooks_3", - "sops-nix": "sops-nix" + "sops-nix": "sops-nix", + "tflow": "tflow" } }, "sops-nix": { @@ -1020,6 +1060,43 @@ "type": "github" } }, + "systems_5": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, + "tflow": { + "inputs": { + "flake-utils": "flake-utils_3", + "home-manager": "home-manager_2", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1783282777, + "narHash": "sha256-ePQa0pLCHtPEL/vPgMd4EHrGoBorejRExJ+iCmSv3Es=", + "owner": "rapsnx", + "repo": "tflow", + "rev": "84b4bc0aa8623c8ea5a1542026bd426151654123", + "type": "github" + }, + "original": { + "owner": "rapsnx", + "repo": "tflow", + "type": "github" + } + }, "xdph": { "inputs": { "hyprland-protocols": [ diff --git a/flake.nix b/flake.nix index f1d24734..e80f72b0 100644 --- a/flake.nix +++ b/flake.nix @@ -22,6 +22,10 @@ url = "github:brumhard/krewfile"; inputs.nixpkgs.follows = "nixpkgs"; }; + tflow = { + url = "github:rapsnx/tflow"; + inputs.nixpkgs.follows = "nixpkgs"; + }; disko = { url = "github:nix-community/disko"; inputs.nixpkgs.follows = "nixpkgs"; @@ -89,6 +93,7 @@ inputs.catppuccin.homeModules.catppuccin inputs.neonix.homeManagerModules.neonix inputs.krewfile.homeManagerModules.krewfile + inputs.tflow.homeManagerModules.default inputs.niri.homeModules.niri inputs.sops-nix.homeManagerModules.sops (inputs.import-tree.match ".*/default\\.nix" ./modules/home) diff --git a/modules/home/cli/tflow/default.nix b/modules/home/cli/tflow/default.nix new file mode 100644 index 00000000..7364d5a8 --- /dev/null +++ b/modules/home/cli/tflow/default.nix @@ -0,0 +1,6 @@ +{ inputs, pkgs, ... }: { + programs.tflow = { + enable = true; + package = inputs.tflow.packages.${pkgs.stdenv.hostPlatform.system}.default; + }; +} diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index 7954b132..93a9fe32 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -33,7 +33,7 @@ in wayland.windowManager.hyprland.settings = { bind = [ # Common - "SUPER,RETURN, exec, alacritty" + "SUPER,RETURN, exec, alacritty -e tflow" "SUPER,E, exec, fuzzel" "SUPER,P, exec, wlogout" "SUPER,Q, killactive" From c55fb8fb3983825f27fb8c82ab75efd7fdb89e2d Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 6 Jul 2026 08:55:39 +0200 Subject: [PATCH 25/71] remove tflow --- modules/home/desktops/hyprland/keybinds.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index 93a9fe32..7954b132 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -33,7 +33,7 @@ in wayland.windowManager.hyprland.settings = { bind = [ # Common - "SUPER,RETURN, exec, alacritty -e tflow" + "SUPER,RETURN, exec, alacritty" "SUPER,E, exec, fuzzel" "SUPER,P, exec, wlogout" "SUPER,Q, killactive" From 8c353604ddc76403247f11fba135578d7be329bc Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 6 Jul 2026 22:16:59 +0200 Subject: [PATCH 26/71] WIP: portal-fuckup --- TASK.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 TASK.md diff --git a/TASK.md b/TASK.md new file mode 100644 index 00000000..af670d65 --- /dev/null +++ b/TASK.md @@ -0,0 +1,24 @@ +# Sway Home-Manager Module Task List + +- [x] Inspect the existing Hyprland Home Manager module and keybinding file to identify the small shared surface worth migrating. +- [x] Confirm first-iteration scope: + - Sway is additive alongside Hyprland. + - Do not migrate Hyprland addons or wallpapers. + - Only migrate keybindings and core Hyprland config where Sway has a simple equivalent. +- [ ] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland. +- [ ] Keep the Sway role option surface intentionally small for the first pass: + - `enable` + - `autostart` + - package option only if needed by the Home Manager Sway module +- [ ] Translate the relevant Hyprland core config into Sway equivalents: + - session environment variables + - keyboard layout / variant / repeat settings + - gaps and border settings + - basic floating / assignment rules where Sway supports an equivalent +- [ ] Migrate the current Hyprland key mapping into an initial Sway binding set, simplifying or dropping Hyprland-only behavior where there is no cheap equivalent. +- [ ] Keep side-by-side enablement conflict-aware: + - avoid migrating portal config unless Sway specifically needs separate wiring + - avoid addon-specific services and wallpaper handling +- [ ] Enable the Sway role in the target Home Manager host configuration without removing Hyprland. +- [ ] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass. +- [ ] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only. From ba6bc2666d1e64cc52695b90287ad541a46898bb Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 6 Jul 2026 22:42:57 +0200 Subject: [PATCH 27/71] Disable sops! --- modules/home/services/sops.nix | 53 +++++++++++++++++----------------- 1 file changed, 27 insertions(+), 26 deletions(-) diff --git a/modules/home/services/sops.nix b/modules/home/services/sops.nix index ea4a5ca5..88c5eac4 100644 --- a/modules/home/services/sops.nix +++ b/modules/home/services/sops.nix @@ -12,31 +12,32 @@ lib.mkIf (config ? targets && config.targets ? genericLinux && config.targets.ge defaultSopsFile = ../../../secrets/common/ssh.yaml; - secrets = { - ssh_config = { - path = "${config.home.homeDirectory}/.ssh/config"; - mode = "0600"; - }; - - swiss = { - path = "${config.home.homeDirectory}/.ssh/swiss"; - mode = "0600"; - }; - - "swiss.pub" = { - path = "${config.home.homeDirectory}/.ssh/swiss.pub"; - mode = "0644"; - }; - - yubi = { - path = "${config.home.homeDirectory}/.ssh/yubi"; - mode = "0600"; - }; - - "yubi.pub" = { - path = "${config.home.homeDirectory}/.ssh/yubi.pub"; - mode = "0644"; - }; - }; + # TODO: Use this on firefly when adding it to the key + # secrets = { + # ssh_config = { + # path = "${config.home.homeDirectory}/.ssh/config"; + # mode = "0600"; + # }; + # + # swiss = { + # path = "${config.home.homeDirectory}/.ssh/swiss"; + # mode = "0600"; + # }; + # + # "swiss.pub" = { + # path = "${config.home.homeDirectory}/.ssh/swiss.pub"; + # mode = "0644"; + # }; + # + # yubi = { + # path = "${config.home.homeDirectory}/.ssh/yubi"; + # mode = "0600"; + # }; + # + # "yubi.pub" = { + # path = "${config.home.homeDirectory}/.ssh/yubi.pub"; + # mode = "0644"; + # }; + # }; }; } From 43f785301c68d18a5eb30fea30dba1639208abf2 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Tue, 7 Jul 2026 10:34:26 +0200 Subject: [PATCH 28/71] Introduce configOnly for hypr --- docs/firefly.md | 26 ++- hosts/firefly/home.nix | 4 +- .../home/desktops/addons/kanshi/default.nix | 8 +- modules/home/desktops/hyprland/default.nix | 200 +++++++++++------- 4 files changed, 150 insertions(+), 88 deletions(-) diff --git a/docs/firefly.md b/docs/firefly.md index 7b5dfe76..20bdc277 100644 --- a/docs/firefly.md +++ b/docs/firefly.md @@ -28,11 +28,13 @@ switch-firefly 4. Create `hyprland` desktop file. +`firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly. + ```bash echo "[Desktop Entry] Name=Hyprland Comment=An intelligent dynamic tiling Wayland compositor -Exec=/home/$USER/.nix-profile/bin/start-hyprland +Exec=/usr/bin/Hyprland Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop ``` @@ -82,12 +84,30 @@ dconf read /org/gnome/desktop/interface/gtk-theme # Read the actual name Those programs are installed via apt, since they do not work within `nix`. ```bash -# TODO: Check why hyprlock not working sudo add-apt-repository ppa:cppiber/hyprland sudo apt update sudo apt -y install \ - xdg-desktop-portal-wlr \ + hyprland \ + xdg-desktop-portal \ + xdg-desktop-portal-hyprland \ + xdg-desktop-portal-gtk \ mumble \ swaylock \ podman ``` + +Home Manager must not manage Hyprland or portal packages on `firefly`. Verify the active setup after switching: + +```bash +readlink -f "$(command -v Hyprland)" +systemctl --user cat xdg-desktop-portal*.service +systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR +find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null +``` + +Expected results: + +- `Hyprland` resolves to `/usr/bin/Hyprland`. +- Portal services come from the host packages, not Home Manager-generated user units. +- `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment. +- The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`. diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index cde409df..60829025 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -24,9 +24,9 @@ desktop = { hyprland = { enable = true; - package = pkgs.hyprland; + configOnly = true; - hyprlock.enable = true; + hyprlock.enable = false; hypridle = { enable = true; cmd = "/usr/bin/swaylock"; diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 10b2e393..991267ed 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -2,12 +2,18 @@ pkgs, lib, self, + config, ... }: { services.kanshi = let - hyprctl = lib.getExe' pkgs.hyprland "hyprctl"; + hyprlandCfg = config.roles.desktop.hyprland; + hyprctl = + if hyprlandCfg.enable && hyprlandCfg.configOnly then + "/usr/bin/hyprctl" + else + lib.getExe' pkgs.hyprland "hyprctl"; workspaceSetup = let wallpaperPath = "${self.outPath}/extra/wallpapers"; diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 04bbeab0..3180d764 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -10,7 +10,17 @@ let in { options.roles.desktop.hyprland = { - enable = lib.mkEnableOption "Enable hyprland"; + enable = lib.mkEnableOption "Enable Hyprland"; + + configOnly = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + Generate Hyprland configuration without installing or managing the + compositor or portal packages. Systemd session integration stays enabled + so user services can bind to hyprland-session.target. + ''; + }; package = lib.mkPackageOption pkgs "hyprland" { nullable = true; @@ -31,98 +41,124 @@ in imports = [ ./addons/hypridle.nix ./addons/hyprlock.nix - ./keybinds.nix ]; - config = lib.mkIf cfg.enable { - - home.packages = builtins.attrValues { - inherit (pkgs) hyprland-qtutils rofimoji slurp; - }; - - # environment.d defines environment variables for the user session, beyond shell level. - # It is processed by `systemd --user`, basically after login. - xdg.configFile."environment.d/envvars.conf".text = '' - PATH="$HOME/.nix-profile/bin:$PATH" - ''; - - # TODO: remove this when changed to lua - services.hyprpaper.enable = true; - - catppuccin.hyprland.enable = false; - catppuccin.hyprlock.enable = false; - wayland.windowManager.hyprland = { - enable = true; - configType = "hyprlang"; - inherit (cfg) package; - systemd.enable = true; - - settings = { - general = { - gaps_in = 8; - gaps_out = 10; - border_size = 3; + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + { + catppuccin.hyprland.enable = false; + catppuccin.hyprlock.enable = false; + + services.hyprpaper.enable = true; + + xdg.configFile."hypr/xdph.conf".text = '' + screencopy { + force_shm = true + } + ''; + + home.packages = builtins.attrValues { + inherit (pkgs) + rofimoji + slurp + ; }; - # Source autogenerated configs - source = [ - "${config.xdg.configHome}/hypr/monitors.conf" - "${config.xdg.configHome}/hypr/workspaces.conf" - ]; + xdg.configFile."environment.d/envvars.conf".text = '' + PATH="$HOME/.nix-profile/bin:$PATH" + ''; - # Auto tile new windows - dwindle = { - preserve_split = "yes"; - special_scale_factor = 0.8; - }; + programs.waybar.systemd.target = lib.mkDefault "hyprland-session.target"; - input = { - kb_layout = "eu,de,de"; - kb_variant = ",neo_qwertz,"; - repeat_rate = 45; - repeat_delay = 150; - accel_profile = "flat"; - sensitivity = 1; # -1.0 - 1.0, 0 means no modification. - }; + wayland.windowManager.hyprland = { + enable = true; + configType = "hyprlang"; - xwayland = { - force_zero_scaling = true; - }; + inherit (cfg) package; - decoration = { - blur = { - enabled = true; - size = 3; - passes = 2; - ignore_opacity = true; - new_optimizations = true; + systemd = { + enable = true; + variables = [ "--all" ]; }; - rounding = 5; - }; - # Autostart - exec-once = [ - "[ workspace special:scratchy silent ] alacritty -t scratchy" - - "[ workspace special:aux silent ] sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga" - ] - ++ cfg.autostart; - - windowrule = [ - "match:class ^(firefox)$, workspace 3" - "match:class ^(chromium-browser)$, workspace 4" - - "match:class ^(.*mumble.*)$, workspace special:aux silent" - "match:class ^(.*keepassxc.*)$, workspace special:aux silent" - - # Force floating - "match:class steam, float yes" - "match:class ^(.*nextcloud.*)$, float yes" - ]; + settings = { + env = [ + "XDG_CURRENT_DESKTOP,Hyprland" + "XDG_SESSION_DESKTOP,Hyprland" + "XDG_SESSION_TYPE,wayland" + ]; + + general = { + gaps_in = 8; + gaps_out = 10; + border_size = 3; + }; + + source = [ + "${config.xdg.configHome}/hypr/monitors.conf" + "${config.xdg.configHome}/hypr/workspaces.conf" + ]; + + dwindle = { + preserve_split = "yes"; + special_scale_factor = 0.8; + }; + + input = { + kb_layout = "eu,de,de"; + kb_variant = ",neo_qwertz,"; + repeat_rate = 45; + repeat_delay = 150; + accel_profile = "flat"; + sensitivity = 1; + }; + + xwayland = { + force_zero_scaling = true; + }; + + decoration = { + blur = { + enabled = true; + size = 3; + passes = 2; + ignore_opacity = true; + new_optimizations = true; + }; + + rounding = 5; + }; + + exec-once = [ + "[ workspace special:scratchy silent ] alacritty -t scratchy" + # todoist app + "[ workspace special:aux silent ] sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga" + ] + ++ cfg.autostart; + + windowrule = [ + "match:class ^(firefox)$, workspace 3" + "match:class ^(chromium-browser)$, workspace 4" + + "match:class ^(.*mumble.*)$, workspace special:aux silent" + "match:class ^(.*keepassxc.*)$, workspace special:aux silent" + + "match:class steam, float yes" + "match:class ^(.*nextcloud.*)$, float yes" + ]; + }; + }; + } - }; - }; + (lib.mkIf cfg.configOnly { + wayland.windowManager.hyprland = { + package = lib.mkForce null; + portalPackage = lib.mkForce null; + }; - }; + xdg.portal.enable = lib.mkForce false; + }) + ] + ); } From ebd06f6afe092017939d71c0bb8aed8259701f6d Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Tue, 7 Jul 2026 10:50:40 +0200 Subject: [PATCH 29/71] Update tasks --- TASK.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/TASK.md b/TASK.md index af670d65..a94009ff 100644 --- a/TASK.md +++ b/TASK.md @@ -5,6 +5,7 @@ - Sway is additive alongside Hyprland. - Do not migrate Hyprland addons or wallpapers. - Only migrate keybindings and core Hyprland config where Sway has a simple equivalent. + - Ignore the `configOnly` options its only for hyprland - [ ] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland. - [ ] Keep the Sway role option surface intentionally small for the first pass: - `enable` @@ -22,3 +23,4 @@ - [ ] Enable the Sway role in the target Home Manager host configuration without removing Hyprland. - [ ] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass. - [ ] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only. +- [ ] Update the docs for firefly, to create all necessary files outside of Home-Manager. From 574af3b82801146e2109fdb95284a50255740982 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Tue, 7 Jul 2026 12:07:04 +0200 Subject: [PATCH 30/71] Introduce sway --- TASK.md | 18 +- docs/firefly.md | 15 +- hosts/firefly/home.nix | 10 ++ modules/home/desktops/hyprland/default.nix | 2 +- modules/home/desktops/sway/default.nix | 189 +++++++++++++++++++++ 5 files changed, 222 insertions(+), 12 deletions(-) create mode 100644 modules/home/desktops/sway/default.nix diff --git a/TASK.md b/TASK.md index a94009ff..75612586 100644 --- a/TASK.md +++ b/TASK.md @@ -6,21 +6,21 @@ - Do not migrate Hyprland addons or wallpapers. - Only migrate keybindings and core Hyprland config where Sway has a simple equivalent. - Ignore the `configOnly` options its only for hyprland -- [ ] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland. -- [ ] Keep the Sway role option surface intentionally small for the first pass: +- [x] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland. +- [x] Keep the Sway role option surface intentionally small for the first pass: - `enable` - `autostart` - package option only if needed by the Home Manager Sway module -- [ ] Translate the relevant Hyprland core config into Sway equivalents: +- [x] Translate the relevant Hyprland core config into Sway equivalents: - session environment variables - keyboard layout / variant / repeat settings - gaps and border settings - basic floating / assignment rules where Sway supports an equivalent -- [ ] Migrate the current Hyprland key mapping into an initial Sway binding set, simplifying or dropping Hyprland-only behavior where there is no cheap equivalent. -- [ ] Keep side-by-side enablement conflict-aware: +- [x] Migrate the current Hyprland key mapping into an initial Sway binding set, simplifying or dropping Hyprland-only behavior where there is no cheap equivalent. +- [x] Keep side-by-side enablement conflict-aware: - avoid migrating portal config unless Sway specifically needs separate wiring - avoid addon-specific services and wallpaper handling -- [ ] Enable the Sway role in the target Home Manager host configuration without removing Hyprland. -- [ ] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass. -- [ ] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only. -- [ ] Update the docs for firefly, to create all necessary files outside of Home-Manager. +- [x] Enable the Sway role in the target Home Manager host configuration without removing Hyprland. +- [x] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass. +- [x] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only. +- [x] Update the docs for firefly, to create all necessary files outside of Home-Manager. diff --git a/docs/firefly.md b/docs/firefly.md index 20bdc277..f046e308 100644 --- a/docs/firefly.md +++ b/docs/firefly.md @@ -26,16 +26,24 @@ nix develop switch-firefly ``` -4. Create `hyprland` desktop file. +4. Create compositor desktop files. `firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly. +`firefly` also uses `roles.desktop.sway.package = null`, so Home Manager writes Sway configuration without installing or wrapping Sway. Sway and the display manager session file must exist on the host. + ```bash echo "[Desktop Entry] Name=Hyprland Comment=An intelligent dynamic tiling Wayland compositor Exec=/usr/bin/Hyprland Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop + +echo "[Desktop Entry] +Name=Sway +Comment=An i3-compatible Wayland compositor +Exec=/usr/bin/sway +Type=Application" | sudo tee /usr/share/wayland-sessions/sway.desktop ``` 5. Copy user-certificate to firefox @@ -88,6 +96,7 @@ sudo add-apt-repository ppa:cppiber/hyprland sudo apt update sudo apt -y install \ hyprland \ + sway \ xdg-desktop-portal \ xdg-desktop-portal-hyprland \ xdg-desktop-portal-gtk \ @@ -96,10 +105,11 @@ sudo apt -y install \ podman ``` -Home Manager must not manage Hyprland or portal packages on `firefly`. Verify the active setup after switching: +Home Manager must not manage Hyprland, Sway, or portal packages on `firefly`. Verify the active setup after switching: ```bash readlink -f "$(command -v Hyprland)" +readlink -f "$(command -v sway)" systemctl --user cat xdg-desktop-portal*.service systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null @@ -108,6 +118,7 @@ find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxde Expected results: - `Hyprland` resolves to `/usr/bin/Hyprland`. +- `sway` resolves to `/usr/bin/sway`. - Portal services come from the host packages, not Home Manager-generated user units. - `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment. - The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`. diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index 60829025..0efd4efd 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -37,6 +37,16 @@ "chromium" ]; }; + + sway = { + enable = true; + package = null; + autostart = [ + "sleep 3 && mumble" # Need to sleep for tray icon + "firefox" + "chromium" + ]; + }; }; cli = { diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 3180d764..70e40d08 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -69,7 +69,7 @@ in PATH="$HOME/.nix-profile/bin:$PATH" ''; - programs.waybar.systemd.target = lib.mkDefault "hyprland-session.target"; + programs.waybar.systemd.targets = lib.mkDefault [ "hyprland-session.target" ]; wayland.windowManager.hyprland = { enable = true; diff --git a/modules/home/desktops/sway/default.nix b/modules/home/desktops/sway/default.nix new file mode 100644 index 00000000..f2e9b44d --- /dev/null +++ b/modules/home/desktops/sway/default.nix @@ -0,0 +1,189 @@ +{ + pkgs, + lib, + mylib, + config, + ... +}: +let + cfg = config.roles.desktop.sway; + modifier = "Mod4"; +in +{ + options.roles.desktop.sway = { + enable = lib.mkEnableOption "Enable Sway"; + + package = lib.mkPackageOption pkgs "sway" { + nullable = true; + }; + + autostart = mylib.mkOpt (lib.types.listOf lib.types.str) "autostart"; + }; + + config = lib.mkIf cfg.enable { + home.packages = builtins.attrValues { + inherit (pkgs) + rofimoji + slurp + ; + }; + + xdg.configFile."environment.d/envvars.conf".text = '' + PATH="$HOME/.nix-profile/bin:$PATH" + ''; + + programs.waybar.systemd.targets = lib.mkDefault [ "sway-session.target" ]; + + wayland.windowManager.sway = { + enable = true; + + inherit (cfg) package; + + systemd = { + enable = true; + variables = [ "--all" ]; + xdgAutostart = true; + }; + + extraSessionCommands = '' + export XDG_CURRENT_DESKTOP=sway + export XDG_SESSION_DESKTOP=sway + export XDG_SESSION_TYPE=wayland + ''; + + config = { + inherit modifier; + + terminal = "alacritty"; + menu = "fuzzel"; + bars = [ ]; + + gaps = { + inner = 8; + outer = 10; + }; + + window = { + border = 3; + titlebar = false; + commands = [ + { + command = "move scratchpad"; + criteria.title = "scratchy"; + } + { + command = "move scratchpad"; + criteria.class = ".*mumble.*"; + } + { + command = "move scratchpad"; + criteria.class = ".*keepassxc.*"; + } + ]; + }; + + input = { + "type:keyboard" = { + xkb_layout = "eu,de,de"; + xkb_variant = ",neo_qwertz,"; + repeat_rate = "45"; + repeat_delay = "150"; + }; + + "type:pointer" = { + accel_profile = "flat"; + pointer_accel = "1"; + }; + }; + + startup = [ + { command = "alacritty -t scratchy"; } + { + command = "sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga"; + } + ] + ++ map (command: { inherit command; }) cfg.autostart; + + assigns = { + "3" = [ { class = "^firefox$"; } ]; + "4" = [ { class = "^chromium-browser$"; } ]; + }; + + floating.criteria = [ + { class = "^steam$"; } + { class = "^.*nextcloud.*$"; } + ]; + + keybindings = lib.mkOptionDefault { + "${modifier}+Return" = "exec alacritty"; + "${modifier}+e" = "exec fuzzel"; + "${modifier}+p" = "exec wlogout"; + "${modifier}+q" = "kill"; + + "${modifier}+n" = "exec swaync-client -t"; + + "${modifier}+f" = "fullscreen toggle"; + "${modifier}+Shift+f" = "fullscreen toggle global"; + + "${modifier}+h" = "focus left"; + "${modifier}+j" = "focus down"; + "${modifier}+k" = "focus up"; + "${modifier}+l" = "focus right"; + + "${modifier}+Shift+h" = "move left"; + "${modifier}+Shift+j" = "move down"; + "${modifier}+Shift+k" = "move up"; + "${modifier}+Shift+l" = "move right"; + + "${modifier}+t" = "layout toggle split"; + "${modifier}+u" = "floating toggle"; + + "${modifier}+1" = "workspace number 1"; + "${modifier}+2" = "workspace number 2"; + "${modifier}+3" = "workspace number 3"; + "${modifier}+4" = "workspace number 4"; + "${modifier}+5" = "workspace number 5"; + + "${modifier}+o" = "scratchpad show"; + "${modifier}+Shift+o" = "move scratchpad"; + + "${modifier}+z" = "exec mumble rpc togglemute"; + "${modifier}+Shift+z" = "exec mumble rpc toggledeaf"; + + "${modifier}+period" = "exec rofimoji --action copy type"; + "${modifier}+Shift+i" = "exec systemctl restart --user kanshi.service"; + + "${modifier}+r" = "mode resize"; + "${modifier}+g" = "mode windows"; + }; + + modes = { + resize = { + h = "resize shrink width 60 px"; + j = "resize grow height 60 px"; + k = "resize shrink height 60 px"; + l = "resize grow width 60 px"; + + "Shift+h" = "resize shrink width 20 px"; + "Shift+j" = "resize grow height 20 px"; + "Shift+k" = "resize shrink height 20 px"; + "Shift+l" = "resize grow width 20 px"; + + Return = "mode default"; + Escape = "mode default"; + }; + + windows = { + q = "move container to workspace number 1; mode default"; + w = "move container to workspace number 2; mode default"; + e = "move container to workspace number 3; mode default"; + r = "move container to workspace number 4; mode default"; + + Return = "mode default"; + Escape = "mode default"; + }; + }; + }; + }; + }; +} From 52ca2db2cc83b2474138a9513e1b19b124bad47a Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 8 Jul 2026 18:58:36 +0200 Subject: [PATCH 31/71] adjust rate --- modules/home/desktops/hyprland/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 70e40d08..fcf79472 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -108,8 +108,8 @@ in input = { kb_layout = "eu,de,de"; kb_variant = ",neo_qwertz,"; - repeat_rate = 45; - repeat_delay = 150; + repeat_rate = 40; + repeat_delay = 250; accel_profile = "flat"; sensitivity = 1; }; From 8b5a94f8816f34f3af045b780c5c78db36e4a458 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Fri, 17 Jul 2026 22:32:07 +0200 Subject: [PATCH 32/71] disable --- modules/home/desktops/addons/kanshi/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 991267ed..e5a73154 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -134,7 +134,8 @@ mode = "2560x1440@239.96Hz"; } { - criteria = "*"; + criteria = "eDP-1"; + status = "disable"; } ]; }) From 4b3fe35ff6bdbb81eeb21f65bccfeae212ea4444 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Fri, 17 Jul 2026 22:58:58 +0200 Subject: [PATCH 33/71] update --- flake.lock | 202 ++++++++++-------------------- modules/home/cli/core/default.nix | 6 +- 2 files changed, 71 insertions(+), 137 deletions(-) diff --git a/flake.lock b/flake.lock index 49ffa5d5..3c7f687a 100644 --- a/flake.lock +++ b/flake.lock @@ -38,11 +38,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1782648384, - "narHash": "sha256-OlHdAqdXasZk1U+Zf9n+ivqHL9kj/UD0DFO4yYTNBYc=", + "lastModified": 1783674541, + "narHash": "sha256-vmUhEF/jBCZJeK0dInOls+HOAR0yiiQusN1+FZKaJss=", "owner": "catppuccin", "repo": "nix", - "rev": "f2c7dd14ecce785c206a39466cbe227ff62e3803", + "rev": "96799f24cf1366fe88e1293c3d27521a8f2129cf", "type": "github" }, "original": { @@ -128,11 +128,11 @@ ] }, "locked": { - "lastModified": 1778716662, - "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=", + "lastModified": 1782949081, + "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb", + "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", "type": "github" }, "original": { @@ -198,71 +198,6 @@ "type": "github" } }, - "gitignore": { - "inputs": { - "nixpkgs": [ - "hyprland-git", - "pre-commit-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, - "gitignore_2": { - "inputs": { - "nixpkgs": [ - "neonix", - "pre-commit-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, - "gitignore_3": { - "inputs": { - "nixpkgs": [ - "pre-commit-hooks", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1709087332, - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", - "owner": "hercules-ci", - "repo": "gitignore.nix", - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", - "type": "github" - }, - "original": { - "owner": "hercules-ci", - "repo": "gitignore.nix", - "type": "github" - } - }, "home-manager": { "inputs": { "nixpkgs": [ @@ -270,11 +205,11 @@ ] }, "locked": { - "lastModified": 1782657028, - "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=", + "lastModified": 1784129366, + "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=", "owner": "nix-community", "repo": "home-manager", - "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365", + "rev": "165228b0efefc3e635e5174020c40ea64271dc25", "type": "github" }, "original": { @@ -381,11 +316,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1782658834, - "narHash": "sha256-OYjcMSNogYWLbeP4nxpUVJaO72o6yIK00bDYaAuQI2Y=", + "lastModified": 1784303676, + "narHash": "sha256-yjLMggvtVM67XDngpjIGZnmM8uGEjYXHHN+z+UP6F4I=", "owner": "hyprwm", "repo": "hyprland", - "rev": "75f558a536f8003bf80af5cb1a3e91529e78cb6b", + "rev": "4afc273db287ad4069cc8ab3edff4a09c31d3410", "type": "github" }, "original": { @@ -558,11 +493,11 @@ ] }, "locked": { - "lastModified": 1782035033, - "narHash": "sha256-pUtCphVzH1iNUTMGdJr4+e/yzUXA6/DZwsn+cyfIVJU=", + "lastModified": 1783002634, + "narHash": "sha256-xGqHIUK0wIZoW7SiMalwvO6uGOO/VrlQwoRobpE7dDI=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "9d8bf6e810597152eef8906c670b96679af2faec", + "rev": "41fb809557abd29a57151b6e1aaeabd05f9437e1", "type": "github" }, "original": { @@ -627,11 +562,11 @@ }, "import-tree": { "locked": { - "lastModified": 1778781969, - "narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=", + "lastModified": 1784254960, + "narHash": "sha256-iI88R3wHz8wTKQb5orvpc51L/Xr64AJyxid/0MKa/b8=", "owner": "vic", "repo": "import-tree", - "rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274", + "rev": "4ebb10ae17d5f1ad366e7aef5b92cb8eecf24f69", "type": "github" }, "original": { @@ -684,11 +619,11 @@ "pre-commit-hooks": "pre-commit-hooks_2" }, "locked": { - "lastModified": 1782657946, - "narHash": "sha256-drO3tcL528kWQpktth5PeT6jVQRPJge24y/7KMFAe5g=", + "lastModified": 1784321871, + "narHash": "sha256-mSjRx9c1jOIZPQwas8Sm9biipxiaoj5WvKPWJ8LUPgE=", "owner": "rapsnx", "repo": "neonix", - "rev": "4bc7283e07684c468e7139135fb8ee2a5297d6d0", + "rev": "afd1f809b8aa23bd57fc91ab31d1e61749ce3e14", "type": "github" }, "original": { @@ -731,11 +666,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1782592242, - "narHash": "sha256-kgINba6Ilpj3rdTi2BeKlQBs6ZxTdu3Gb49U5gDUVhg=", + "lastModified": 1784189744, + "narHash": "sha256-D8oh9imibOynWAOUnvgG3w2EKDYqf8OTTaLCcTA4ePg=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "9e26dfe0fb8d61475b6f9e8d63477fe92509f1db", + "rev": "f4b479398c967d2c8d5a38b6d2c87283ae5078c4", "type": "github" }, "original": { @@ -764,11 +699,11 @@ "niri-unstable": { "flake": false, "locked": { - "lastModified": 1781781064, - "narHash": "sha256-Ii/koEm/sRyg65qbAQWqEgboSEIhdH0EL4KglAc14p0=", + "lastModified": 1783522755, + "narHash": "sha256-dI0HkX1djETia7cD/Y64h8BNIsSOfTRMzfNum2J6UhE=", "owner": "YaLTeR", "repo": "niri", - "rev": "49fc6117fd6c043adaa2ead316b82db5ed735d36", + "rev": "0777769e719b7c9b7c980d4ea66288bfbb4da5b3", "type": "github" }, "original": { @@ -782,11 +717,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1782562157, - "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=", + "lastModified": 1784310968, + "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "a9cf7546a938c737b079e738de73934a13de9784", + "rev": "779c32a00155994c86cde8213a8dd4df139d4355", "type": "github" }, "original": { @@ -798,11 +733,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1782175435, - "narHash": "sha256-8d2wCNWKnd86GzKZvbuqqlS+HqMrheXkvRf0qGJ/oA0=", - "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775", + "lastModified": 1783279667, + "narHash": "sha256-2l8yOB5aYd+05Q9V9Y1YhgbSa1j1o5QX+nvYs5FL80A=", + "rev": "f205b5574fd0cb7da5b702a2da51507b7f4fdd1b", "type": "tarball", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1020805.89570f24e97e/nixexprs.tar.xz" + "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1028110.f205b5574fd0/nixexprs.tar.xz" }, "original": { "type": "tarball", @@ -811,11 +746,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1782498288, - "narHash": "sha256-8/X3yyTXiE82b38n32ItbOqfWOVBl+gKa8fILyZfR4Q=", + "lastModified": 1782847189, + "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "3cac626ec5e3703e835f227687e88aa9e2f25701", + "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", "type": "github" }, "original": { @@ -827,11 +762,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1781577229, - "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", + "lastModified": 1784120854, + "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=", "owner": "nixos", "repo": "nixpkgs", - "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", + "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46", "type": "github" }, "original": { @@ -856,11 +791,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1782467914, - "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", + "lastModified": 1784120854, + "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=", "owner": "nixos", "repo": "nixpkgs", - "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", + "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46", "type": "github" }, "original": { @@ -880,11 +815,11 @@ "systems": "systems_3" }, "locked": { - "lastModified": 1782254890, - "narHash": "sha256-kjsEECqhpPnJWqhooXp6tWh2qGQftCPAo2G1GvZtKdw=", + "lastModified": 1784057377, + "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=", "owner": "nix-community", "repo": "nixvim", - "rev": "dbf9550dba8448b03e11d58e5695d6c44a464554", + "rev": "07180a087e4a00720dc0731cbcd8dec796974381", "type": "github" }, "original": { @@ -896,18 +831,17 @@ "pre-commit-hooks": { "inputs": { "flake-compat": "flake-compat", - "gitignore": "gitignore", "nixpkgs": [ "hyprland-git", "nixpkgs" ] }, "locked": { - "lastModified": 1781733627, - "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", + "lastModified": 1783008725, + "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", + "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe", "type": "github" }, "original": { @@ -919,18 +853,17 @@ "pre-commit-hooks_2": { "inputs": { "flake-compat": "flake-compat_2", - "gitignore": "gitignore_2", "nixpkgs": [ "neonix", "nixpkgs" ] }, "locked": { - "lastModified": 1781733627, - "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", + "lastModified": 1783008725, + "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", + "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe", "type": "github" }, "original": { @@ -942,17 +875,16 @@ "pre-commit-hooks_3": { "inputs": { "flake-compat": "flake-compat_3", - "gitignore": "gitignore_3", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1781733627, - "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=", + "lastModified": 1784288435, + "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39", + "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", "type": "github" }, "original": { @@ -986,11 +918,11 @@ ] }, "locked": { - "lastModified": 1782165805, - "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=", + "lastModified": 1783174389, + "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", "owner": "mic92", "repo": "sops-nix", - "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24", + "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", "type": "github" }, "original": { @@ -1084,11 +1016,11 @@ ] }, "locked": { - "lastModified": 1783282777, - "narHash": "sha256-ePQa0pLCHtPEL/vPgMd4EHrGoBorejRExJ+iCmSv3Es=", + "lastModified": 1784146867, + "narHash": "sha256-4MszpU7lygYZnr1R5kLBVUJSR49Ag/kW2UmcdAPMnSk=", "owner": "rapsnx", "repo": "tflow", - "rev": "84b4bc0aa8623c8ea5a1542026bd426151654123", + "rev": "b08293ceb859e6cd0a04fa87e147ce7ade56fdeb", "type": "github" }, "original": { @@ -1125,11 +1057,11 @@ ] }, "locked": { - "lastModified": 1782311043, - "narHash": "sha256-07zLc2M3/ax+JsjxGTft17/Joua41LHE9/9AC/F9zeU=", + "lastModified": 1782644412, + "narHash": "sha256-/iSa/bL1QQFLv+uJ9gI0N87J8gOeZXvca7EjoPGKE6w=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "882ad01e195ce201b07c618bbee44a0cad8b9e5a", + "rev": "c01c99fc278ec68c82e9865923088f043c7c1621", "type": "github" }, "original": { @@ -1158,11 +1090,11 @@ "xwayland-satellite-unstable": { "flake": false, "locked": { - "lastModified": 1781226823, - "narHash": "sha256-28696iIw8uE0ZUyFTtzhEM8xMh85clCYypMxkvUi+sc=", + "lastModified": 1783895132, + "narHash": "sha256-Dl0Gvrig3EpE962hzF3ETPhUztlfuRhcmlpd8ioHN54=", "owner": "Supreeeme", "repo": "xwayland-satellite", - "rev": "8575d0ef55d70f9b4c46b6bffb3accf912217e1e", + "rev": "a2b5c635d8c8c99b286967658d0d177044887eb8", "type": "github" }, "original": { diff --git a/modules/home/cli/core/default.nix b/modules/home/cli/core/default.nix index 1841188d..03e6769d 100644 --- a/modules/home/cli/core/default.nix +++ b/modules/home/cli/core/default.nix @@ -60,9 +60,11 @@ }; programs = { bat.enable = true; - fzf.enable = true; + fzf = { + enable = true; + historyWidget.command = ""; + }; btop.enable = true; - zoxide.enable = true; neonix.enable = true; eza.enable = true; From b9952abe2340052a147df11a9d774db6099d02d9 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sat, 18 Jul 2026 18:19:48 +0200 Subject: [PATCH 34/71] remove tflowe --- modules/home/cli/tflow/default.nix | 6 ------ 1 file changed, 6 deletions(-) delete mode 100644 modules/home/cli/tflow/default.nix diff --git a/modules/home/cli/tflow/default.nix b/modules/home/cli/tflow/default.nix deleted file mode 100644 index 7364d5a8..00000000 --- a/modules/home/cli/tflow/default.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ inputs, pkgs, ... }: { - programs.tflow = { - enable = true; - package = inputs.tflow.packages.${pkgs.stdenv.hostPlatform.system}.default; - }; -} From d9b9906970b991d93948e2df1bb15829e0e83a27 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 19 Jul 2026 20:59:10 +0200 Subject: [PATCH 35/71] WIP: test windows session --- hosts/zion/default.nix | 2 ++ modules/nixos/roles/desktop/hyprland.nix | 25 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index 90cef8ed..e88ab369 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -44,6 +44,8 @@ sudo.wheelNeedsPassword = false; }; + boot.loader.timeout = 0; + networking = { hostName = "zion"; networkmanager.enable = true; diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix index 9ef2ae48..1c9ce086 100644 --- a/modules/nixos/roles/desktop/hyprland.nix +++ b/modules/nixos/roles/desktop/hyprland.nix @@ -20,16 +20,28 @@ let "button=red" ]; + rebootWindows = pkgs.writeShellScript "reboot-windows" '' + exec ${lib.getExe' pkgs.systemd "systemctl"} reboot \ + --boot-loader-entry=auto-windows + ''; + tuigreetCommand = lib.escapeShellArgs [ "${pkgs.tuigreet}/bin/tuigreet" + "--sessions" "${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" + "--session-wrapper" "${config.services.displayManager.sessionData.wrapper}" + + "--power-reboot" + "/run/wrappers/bin/sudo ${rebootWindows}" + "--time" "--remember" "--remember-user-session" "--asterisks" + "--theme" tuigreetTheme ]; @@ -61,6 +73,19 @@ in programs.niri.enable = true; + security.sudo.extraRules = [ + { + users = [ "greeter" ]; + + commands = [ + { + command = "${rebootWindows}"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; + services.greetd = { enable = true; useTextGreeter = true; From ee15bbd60288761a654909ad8bc980c2aa243b05 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 19 Jul 2026 21:10:52 +0200 Subject: [PATCH 36/71] WIP: update kanshi --- .../home/desktops/addons/kanshi/default.nix | 68 ++++++++++++------- 1 file changed, 45 insertions(+), 23 deletions(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index e5a73154..9a2986b1 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -22,18 +22,8 @@ pkgs.writeShellScriptBin "workspaceSetup" '' set -euo pipefail - primary_desc="''${1:?missing primary monitor description}" - secondary_desc="''${2:-""}" - monitors="$(${hyprctl} monitors -j)" - - # get_output gets the output name of a monitor description. - get_output() { - ${lib.getExe pkgs.jq} -r --arg matcher "$1" ' - [.[] | select(.description | test($matcher)) | .name][0]' <<< "$monitors" - } - - primary="$(get_output $primary_desc)" - secondary="$(get_output $secondary_desc)" + primary="''${1:?missing primary monitor}" + secondary="''${2:?missing secondary monitor}" # Generate workspace config cat > "$HOME/.config/hypr/workspaces.conf" < Date: Sun, 19 Jul 2026 22:04:35 +0200 Subject: [PATCH 37/71] Update display config --- modules/home/desktops/addons/kanshi/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 9a2986b1..cae25c60 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -96,7 +96,7 @@ { output = { criteria = "eDP-1"; - position = "0,0"; + position = "6000,0"; mode = "1920x1200@60.00Hz"; }; } @@ -117,9 +117,7 @@ name = "office"; outputs = [ { - # TODO: confirm this connector name via `hyprctl monitors -j` - # while docked. The port is stable across desks even though the - # monitor's description (and serial) varies desk to desk. + # TODO: test this connector, may overload this config with all possible connectors criteria = "DP-1"; mode = "3440x1440@99.98Hz"; scale = 1.0; From 4e7858242bc35581bb23be5bcc1fa23ed749ca3e Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 19 Jul 2026 22:06:57 +0200 Subject: [PATCH 38/71] update --- modules/home/desktops/addons/kanshi/default.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index cae25c60..3410ff5a 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -53,9 +53,7 @@ ''; # toMonitorId turns a kanshi criteria string into the identifier Hyprland's - # workspace/dispatch syntax expects: connector names (DP-1, eDP-1, ...) are - # passed through as-is, descriptions (which always contain spaces) are - # prefixed with "desc:". + # workspace/dispatch syntax expects. toMonitorId = criteria: if lib.hasInfix " " criteria then "desc:${criteria}" else criteria; # mkExec picks which output(s) receive workspaces. A single entry means From 8fb672d8cc9a552f9e8c734259b9235b29d83bc4 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 19 Jul 2026 22:16:35 +0200 Subject: [PATCH 39/71] Remove niri + sway --- TASK.md | 26 ---- docs/firefly.md | 13 +- flake.lock | 171 +------------------- flake.nix | 13 -- hosts/firefly/home.nix | 10 -- hosts/zion/home.nix | 4 - modules/home/desktops/niri/default.nix | 152 ------------------ modules/home/desktops/sway/default.nix | 189 ----------------------- modules/nixos/roles/desktop/hyprland.nix | 2 - 9 files changed, 3 insertions(+), 577 deletions(-) delete mode 100644 TASK.md delete mode 100644 modules/home/desktops/niri/default.nix delete mode 100644 modules/home/desktops/sway/default.nix diff --git a/TASK.md b/TASK.md deleted file mode 100644 index 75612586..00000000 --- a/TASK.md +++ /dev/null @@ -1,26 +0,0 @@ -# Sway Home-Manager Module Task List - -- [x] Inspect the existing Hyprland Home Manager module and keybinding file to identify the small shared surface worth migrating. -- [x] Confirm first-iteration scope: - - Sway is additive alongside Hyprland. - - Do not migrate Hyprland addons or wallpapers. - - Only migrate keybindings and core Hyprland config where Sway has a simple equivalent. - - Ignore the `configOnly` options its only for hyprland -- [x] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland. -- [x] Keep the Sway role option surface intentionally small for the first pass: - - `enable` - - `autostart` - - package option only if needed by the Home Manager Sway module -- [x] Translate the relevant Hyprland core config into Sway equivalents: - - session environment variables - - keyboard layout / variant / repeat settings - - gaps and border settings - - basic floating / assignment rules where Sway supports an equivalent -- [x] Migrate the current Hyprland key mapping into an initial Sway binding set, simplifying or dropping Hyprland-only behavior where there is no cheap equivalent. -- [x] Keep side-by-side enablement conflict-aware: - - avoid migrating portal config unless Sway specifically needs separate wiring - - avoid addon-specific services and wallpaper handling -- [x] Enable the Sway role in the target Home Manager host configuration without removing Hyprland. -- [x] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass. -- [x] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only. -- [x] Update the docs for firefly, to create all necessary files outside of Home-Manager. diff --git a/docs/firefly.md b/docs/firefly.md index f046e308..c38d1fc7 100644 --- a/docs/firefly.md +++ b/docs/firefly.md @@ -30,20 +30,12 @@ switch-firefly `firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly. -`firefly` also uses `roles.desktop.sway.package = null`, so Home Manager writes Sway configuration without installing or wrapping Sway. Sway and the display manager session file must exist on the host. - ```bash echo "[Desktop Entry] Name=Hyprland Comment=An intelligent dynamic tiling Wayland compositor Exec=/usr/bin/Hyprland Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop - -echo "[Desktop Entry] -Name=Sway -Comment=An i3-compatible Wayland compositor -Exec=/usr/bin/sway -Type=Application" | sudo tee /usr/share/wayland-sessions/sway.desktop ``` 5. Copy user-certificate to firefox @@ -96,7 +88,6 @@ sudo add-apt-repository ppa:cppiber/hyprland sudo apt update sudo apt -y install \ hyprland \ - sway \ xdg-desktop-portal \ xdg-desktop-portal-hyprland \ xdg-desktop-portal-gtk \ @@ -105,11 +96,10 @@ sudo apt -y install \ podman ``` -Home Manager must not manage Hyprland, Sway, or portal packages on `firefly`. Verify the active setup after switching: +Home Manager must not manage Hyprland or portal packages on `firefly`. Verify the active setup after switching: ```bash readlink -f "$(command -v Hyprland)" -readlink -f "$(command -v sway)" systemctl --user cat xdg-desktop-portal*.service systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null @@ -118,7 +108,6 @@ find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxde Expected results: - `Hyprland` resolves to `/usr/bin/Hyprland`. -- `sway` resolves to `/usr/bin/sway`. - Portal services come from the host packages, not Home Manager-generated user units. - `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment. - The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`. diff --git a/flake.lock b/flake.lock index 3c7f687a..bfeece7d 100644 --- a/flake.lock +++ b/flake.lock @@ -161,28 +161,7 @@ }, "flake-utils_2": { "inputs": { - "systems": [ - "nfsm", - "systems" - ] - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, - "flake-utils_3": { - "inputs": { - "systems": "systems_5" + "systems": "systems_4" }, "locked": { "lastModified": 1731533236, @@ -632,86 +611,6 @@ "type": "github" } }, - "nfsm": { - "inputs": { - "flake-utils": "flake-utils_2", - "nixpkgs": [ - "nixpkgs" - ], - "systems": "systems_4" - }, - "locked": { - "lastModified": 1779536651, - "narHash": "sha256-RnjrNx/+TI7VpIpsAih9OD5/i2DIFzB3tt3aWHYbJvg=", - "owner": "gvolpe", - "repo": "nfsm", - "rev": "181a22e8915e4d2ee0adb54b893474f310f0924a", - "type": "github" - }, - "original": { - "owner": "gvolpe", - "repo": "nfsm", - "type": "github" - } - }, - "niri": { - "inputs": { - "niri-stable": "niri-stable", - "niri-unstable": "niri-unstable", - "nixpkgs": [ - "nixpkgs" - ], - "nixpkgs-stable": "nixpkgs-stable", - "xwayland-satellite-stable": "xwayland-satellite-stable", - "xwayland-satellite-unstable": "xwayland-satellite-unstable" - }, - "locked": { - "lastModified": 1784189744, - "narHash": "sha256-D8oh9imibOynWAOUnvgG3w2EKDYqf8OTTaLCcTA4ePg=", - "owner": "sodiboo", - "repo": "niri-flake", - "rev": "f4b479398c967d2c8d5a38b6d2c87283ae5078c4", - "type": "github" - }, - "original": { - "owner": "sodiboo", - "repo": "niri-flake", - "type": "github" - } - }, - "niri-stable": { - "flake": false, - "locked": { - "lastModified": 1756556321, - "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=", - "owner": "YaLTeR", - "repo": "niri", - "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294", - "type": "github" - }, - "original": { - "owner": "YaLTeR", - "ref": "v25.08", - "repo": "niri", - "type": "github" - } - }, - "niri-unstable": { - "flake": false, - "locked": { - "lastModified": 1783522755, - "narHash": "sha256-dI0HkX1djETia7cD/Y64h8BNIsSOfTRMzfNum2J6UhE=", - "owner": "YaLTeR", - "repo": "niri", - "rev": "0777769e719b7c9b7c980d4ea66288bfbb4da5b3", - "type": "github" - }, - "original": { - "owner": "YaLTeR", - "repo": "niri", - "type": "github" - } - }, "nixos-hardware": { "inputs": { "nixpkgs": "nixpkgs_3" @@ -744,22 +643,6 @@ "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz" } }, - "nixpkgs-stable": { - "locked": { - "lastModified": 1782847189, - "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-25.11", - "repo": "nixpkgs", - "type": "github" - } - }, "nixpkgs_2": { "locked": { "lastModified": 1784120854, @@ -902,8 +785,6 @@ "import-tree": "import-tree", "krewfile": "krewfile", "neonix": "neonix", - "nfsm": "nfsm", - "niri": "niri", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", "pre-commit-hooks": "pre-commit-hooks_3", @@ -978,21 +859,6 @@ } }, "systems_4": { - "locked": { - "lastModified": 1689347949, - "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", - "owner": "nix-systems", - "repo": "default-linux", - "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default-linux", - "type": "github" - } - }, - "systems_5": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -1009,7 +875,7 @@ }, "tflow": { "inputs": { - "flake-utils": "flake-utils_3", + "flake-utils": "flake-utils_2", "home-manager": "home-manager_2", "nixpkgs": [ "nixpkgs" @@ -1069,39 +935,6 @@ "repo": "xdg-desktop-portal-hyprland", "type": "github" } - }, - "xwayland-satellite-stable": { - "flake": false, - "locked": { - "lastModified": 1755491097, - "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=", - "owner": "Supreeeme", - "repo": "xwayland-satellite", - "rev": "388d291e82ffbc73be18169d39470f340707edaa", - "type": "github" - }, - "original": { - "owner": "Supreeeme", - "ref": "v0.7", - "repo": "xwayland-satellite", - "type": "github" - } - }, - "xwayland-satellite-unstable": { - "flake": false, - "locked": { - "lastModified": 1783895132, - "narHash": "sha256-Dl0Gvrig3EpE962hzF3ETPhUztlfuRhcmlpd8ioHN54=", - "owner": "Supreeeme", - "repo": "xwayland-satellite", - "rev": "a2b5c635d8c8c99b286967658d0d177044887eb8", - "type": "github" - }, - "original": { - "owner": "Supreeeme", - "repo": "xwayland-satellite", - "type": "github" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index e80f72b0..c167ac59 100644 --- a/flake.nix +++ b/flake.nix @@ -37,16 +37,6 @@ nixos-hardware.url = "github:nixos/nixos-hardware/master"; catppuccin.url = "github:catppuccin/nix"; - niri = { - url = "github:sodiboo/niri-flake"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - nfsm = { - # Niri fullscreen manager - url = "github:gvolpe/nfsm"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - import-tree.url = "github:vic/import-tree"; }; @@ -69,7 +59,6 @@ overlays = [ (import ./overlays) - inputs.niri.overlays.niri ]; pkgsFor = lib.genAttrs systems ( @@ -83,7 +72,6 @@ nixosModules = [ inputs.catppuccin.nixosModules.catppuccin - inputs.niri.nixosModules.niri inputs.sops-nix.nixosModules.sops (inputs.import-tree.match ".*/default\\.nix" ./modules/nixos) ./modules/nix.nix @@ -94,7 +82,6 @@ inputs.neonix.homeManagerModules.neonix inputs.krewfile.homeManagerModules.krewfile inputs.tflow.homeManagerModules.default - inputs.niri.homeModules.niri inputs.sops-nix.homeManagerModules.sops (inputs.import-tree.match ".*/default\\.nix" ./modules/home) ./modules/nix.nix diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index 0efd4efd..60829025 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -37,16 +37,6 @@ "chromium" ]; }; - - sway = { - enable = true; - package = null; - autostart = [ - "sleep 3 && mumble" # Need to sleep for tray icon - "firefox" - "chromium" - ]; - }; }; cli = { diff --git a/hosts/zion/home.nix b/hosts/zion/home.nix index 6546fd8d..7a8167f8 100644 --- a/hosts/zion/home.nix +++ b/hosts/zion/home.nix @@ -37,9 +37,5 @@ ]; }; }; - - desktop.niri = { - enable = true; - }; }; } diff --git a/modules/home/desktops/niri/default.nix b/modules/home/desktops/niri/default.nix deleted file mode 100644 index fb062699..00000000 --- a/modules/home/desktops/niri/default.nix +++ /dev/null @@ -1,152 +0,0 @@ -{ - lib, - config, - ... -}: -let - cfg = config.roles.desktop.niri; - inherit (config.lib.niri) actions; -in -{ - options.roles.desktop.niri = { - enable = lib.mkEnableOption "Enable hyprland"; - }; - - config = lib.mkIf cfg.enable { - # TODO: WIP - Niri is currently in a trial phase. - # This config needs to be updated in a seperate PR, when niri got evaluated. - programs.niri = { - enable = true; - - settings = { - - input = { - keyboard = { - xkb = { - layout = "eu"; - }; - - repeat-delay = 150; - repeat-rate = 45; - }; - - focus-follows-mouse = { - enable = true; - max-scroll-amount = "0%"; - }; - }; - - outputs = { - "DP-1" = { - mode = { - width = 3840; - height = 2160; - refresh = 239.991; - }; - scale = 1.5; - position = { - x = 0; - y = 0; - }; - }; - }; - - workspaces = { - "term" = { - open-on-output = "DP-1"; - }; - "code" = { - open-on-output = "DP-1"; - }; - "spare" = { - open-on-output = "DP-1"; - }; - "browser" = { - open-on-output = "DP-2"; - }; - "chat" = { - open-on-output = "DP-2"; - }; - "gear" = { - open-on-output = "DP-2"; - }; - }; - - prefer-no-csd = true; - - layout = { - gaps = 8; - default-column-width = { - proportion = 0.5; - }; - preset-column-widths = [ - { proportion = 0.25; } - { proportion = 0.33333; } - { proportion = 0.5; } - { proportion = 0.66667; } - { proportion = 0.75; } - { proportion = 1.0; } - ]; - }; - - window-rules = [ - { - clip-to-geometry = true; - geometry-corner-radius = { - bottom-left = 10.0; - bottom-right = 10.0; - top-left = 10.0; - top-right = 10.0; - }; - open-maximized = true; - } - ]; - - binds = { - "Mod+Return".action.spawn = [ "alacritty" ]; - "Mod+E".action.spawn = [ "fuzzel" ]; - "Mod+P".action.spawn = [ "wlogout" ]; - - "Mod+Q".action = actions."close-window"; - "Mod+F".action = actions."fullscreen-window"; - - "Mod+H".action = actions."focus-column-or-monitor-left"; - "Mod+L".action = actions."focus-column-or-monitor-right"; - "Mod+J".action = actions."focus-window-or-workspace-down"; - "Mod+K".action = actions."focus-window-or-workspace-up"; - - # Smart movement: move within monitor, then to adjacent monitor when at edge - "Mod+Shift+H".action = actions."consume-or-expel-window-left"; - "Mod+Shift+L".action = actions."consume-or-expel-window-right"; - - # then reorder inside the column (up/down) - "Mod+Shift+K".action = actions."move-window-up"; - "Mod+Shift+J".action = actions."move-window-down"; - - "Mod+R".action = actions."switch-preset-column-width"; - "Mod+Shift+R".action = actions."switch-preset-column-width-back"; - - "Mod+1".action.focus-workspace = "term"; - "Mod+2".action.focus-workspace = "code"; - "Mod+3".action.focus-workspace = "spare"; - "Mod+4".action.focus-workspace = "browser"; - "Mod+5".action.focus-workspace = "chat"; - "Mod+6".action.focus-workspace = "gear"; - "Mod+7".action.focus-workspace = 7; - "Mod+8".action.focus-workspace = 8; - - # Move only window to workspace (not whole column) - "Mod+Alt+1".action.move-window-to-workspace = 1; - "Mod+Alt+2".action.move-window-to-workspace = 2; - "Mod+Alt+3".action.move-window-to-workspace = 3; - "Mod+Alt+4".action.move-window-to-workspace = 4; - "Mod+Alt+5".action.move-window-to-workspace = 5; - "Mod+Alt+6".action.move-window-to-workspace = 6; - "Mod+Alt+7".action.move-window-to-workspace = 7; - "Mod+Alt+8".action.move-window-to-workspace = 8; - "Mod+Alt+9".action.move-window-to-workspace = 9; - }; - }; - }; - }; -} diff --git a/modules/home/desktops/sway/default.nix b/modules/home/desktops/sway/default.nix deleted file mode 100644 index f2e9b44d..00000000 --- a/modules/home/desktops/sway/default.nix +++ /dev/null @@ -1,189 +0,0 @@ -{ - pkgs, - lib, - mylib, - config, - ... -}: -let - cfg = config.roles.desktop.sway; - modifier = "Mod4"; -in -{ - options.roles.desktop.sway = { - enable = lib.mkEnableOption "Enable Sway"; - - package = lib.mkPackageOption pkgs "sway" { - nullable = true; - }; - - autostart = mylib.mkOpt (lib.types.listOf lib.types.str) "autostart"; - }; - - config = lib.mkIf cfg.enable { - home.packages = builtins.attrValues { - inherit (pkgs) - rofimoji - slurp - ; - }; - - xdg.configFile."environment.d/envvars.conf".text = '' - PATH="$HOME/.nix-profile/bin:$PATH" - ''; - - programs.waybar.systemd.targets = lib.mkDefault [ "sway-session.target" ]; - - wayland.windowManager.sway = { - enable = true; - - inherit (cfg) package; - - systemd = { - enable = true; - variables = [ "--all" ]; - xdgAutostart = true; - }; - - extraSessionCommands = '' - export XDG_CURRENT_DESKTOP=sway - export XDG_SESSION_DESKTOP=sway - export XDG_SESSION_TYPE=wayland - ''; - - config = { - inherit modifier; - - terminal = "alacritty"; - menu = "fuzzel"; - bars = [ ]; - - gaps = { - inner = 8; - outer = 10; - }; - - window = { - border = 3; - titlebar = false; - commands = [ - { - command = "move scratchpad"; - criteria.title = "scratchy"; - } - { - command = "move scratchpad"; - criteria.class = ".*mumble.*"; - } - { - command = "move scratchpad"; - criteria.class = ".*keepassxc.*"; - } - ]; - }; - - input = { - "type:keyboard" = { - xkb_layout = "eu,de,de"; - xkb_variant = ",neo_qwertz,"; - repeat_rate = "45"; - repeat_delay = "150"; - }; - - "type:pointer" = { - accel_profile = "flat"; - pointer_accel = "1"; - }; - }; - - startup = [ - { command = "alacritty -t scratchy"; } - { - command = "sleep 2 && chromium --profile-directory=Default --app-id=dlgohinmglaoopaiplliaecdpmnepmga"; - } - ] - ++ map (command: { inherit command; }) cfg.autostart; - - assigns = { - "3" = [ { class = "^firefox$"; } ]; - "4" = [ { class = "^chromium-browser$"; } ]; - }; - - floating.criteria = [ - { class = "^steam$"; } - { class = "^.*nextcloud.*$"; } - ]; - - keybindings = lib.mkOptionDefault { - "${modifier}+Return" = "exec alacritty"; - "${modifier}+e" = "exec fuzzel"; - "${modifier}+p" = "exec wlogout"; - "${modifier}+q" = "kill"; - - "${modifier}+n" = "exec swaync-client -t"; - - "${modifier}+f" = "fullscreen toggle"; - "${modifier}+Shift+f" = "fullscreen toggle global"; - - "${modifier}+h" = "focus left"; - "${modifier}+j" = "focus down"; - "${modifier}+k" = "focus up"; - "${modifier}+l" = "focus right"; - - "${modifier}+Shift+h" = "move left"; - "${modifier}+Shift+j" = "move down"; - "${modifier}+Shift+k" = "move up"; - "${modifier}+Shift+l" = "move right"; - - "${modifier}+t" = "layout toggle split"; - "${modifier}+u" = "floating toggle"; - - "${modifier}+1" = "workspace number 1"; - "${modifier}+2" = "workspace number 2"; - "${modifier}+3" = "workspace number 3"; - "${modifier}+4" = "workspace number 4"; - "${modifier}+5" = "workspace number 5"; - - "${modifier}+o" = "scratchpad show"; - "${modifier}+Shift+o" = "move scratchpad"; - - "${modifier}+z" = "exec mumble rpc togglemute"; - "${modifier}+Shift+z" = "exec mumble rpc toggledeaf"; - - "${modifier}+period" = "exec rofimoji --action copy type"; - "${modifier}+Shift+i" = "exec systemctl restart --user kanshi.service"; - - "${modifier}+r" = "mode resize"; - "${modifier}+g" = "mode windows"; - }; - - modes = { - resize = { - h = "resize shrink width 60 px"; - j = "resize grow height 60 px"; - k = "resize shrink height 60 px"; - l = "resize grow width 60 px"; - - "Shift+h" = "resize shrink width 20 px"; - "Shift+j" = "resize grow height 20 px"; - "Shift+k" = "resize shrink height 20 px"; - "Shift+l" = "resize grow width 20 px"; - - Return = "mode default"; - Escape = "mode default"; - }; - - windows = { - q = "move container to workspace number 1; mode default"; - w = "move container to workspace number 2; mode default"; - e = "move container to workspace number 3; mode default"; - r = "move container to workspace number 4; mode default"; - - Return = "mode default"; - Escape = "mode default"; - }; - }; - }; - }; - }; -} diff --git a/modules/nixos/roles/desktop/hyprland.nix b/modules/nixos/roles/desktop/hyprland.nix index 1c9ce086..fdfd6acc 100644 --- a/modules/nixos/roles/desktop/hyprland.nix +++ b/modules/nixos/roles/desktop/hyprland.nix @@ -71,8 +71,6 @@ in withUWSM = false; }; - programs.niri.enable = true; - security.sudo.extraRules = [ { users = [ "greeter" ]; From 3721e8a15c597f42f8539bcdabdee0ec78157fd7 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 19 Jul 2026 22:18:10 +0200 Subject: [PATCH 40/71] Adapt zion --- hosts/zion/default.nix | 2 -- modules/nixos/system/boot.nix | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index e88ab369..90cef8ed 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -44,8 +44,6 @@ sudo.wheelNeedsPassword = false; }; - boot.loader.timeout = 0; - networking = { hostName = "zion"; networkmanager.enable = true; diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix index 946bc878..9dd58b2d 100644 --- a/modules/nixos/system/boot.nix +++ b/modules/nixos/system/boot.nix @@ -32,7 +32,7 @@ in ]; loader = { - timeout = lib.mkDefault 3; + timeout = lib.mkDefault 0; systemd-boot = { enable = true; From 7e549e69d46025ee984fb2c3e502fe98d208c376 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 19 Jul 2026 22:24:23 +0200 Subject: [PATCH 41/71] add tools --- modules/home/cli/core/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/home/cli/core/default.nix b/modules/home/cli/core/default.nix index 03e6769d..80213b99 100644 --- a/modules/home/cli/core/default.nix +++ b/modules/home/cli/core/default.nix @@ -53,9 +53,14 @@ # AI Shit codex + claude-code + nodejs # Monitor / I2C com ddcutil + + # Compiler + gcc ; }; programs = { From 4ec24ffb8d2e089cb137973eb1d066e1f9422886 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 20 Jul 2026 00:52:31 +0200 Subject: [PATCH 42/71] fix keybings --- modules/home/desktops/hyprland/keybinds.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/home/desktops/hyprland/keybinds.nix b/modules/home/desktops/hyprland/keybinds.nix index 7954b132..107469bb 100644 --- a/modules/home/desktops/hyprland/keybinds.nix +++ b/modules/home/desktops/hyprland/keybinds.nix @@ -124,7 +124,7 @@ in bind = , R, submap, reset # Special app toggle - bing = , B, exec, ${lib.getExe toggleFirefox}" + bind = , B, exec, ${lib.getExe toggleFirefox} bind = , return, submap, reset bind = , escape, submap, reset From 1f78a92f997aefdf9d834ddaf0bba4abd2370273 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 17:21:08 +0200 Subject: [PATCH 43/71] some stuff --- flake.lock | 40 ++------------------- modules/home/cli/terminals/tmux/default.nix | 20 ----------- modules/home/cli/tflow/default.nix | 5 +++ 3 files changed, 8 insertions(+), 57 deletions(-) create mode 100644 modules/home/cli/tflow/default.nix diff --git a/flake.lock b/flake.lock index bfeece7d..76edb698 100644 --- a/flake.lock +++ b/flake.lock @@ -159,24 +159,6 @@ "type": "github" } }, - "flake-utils_2": { - "inputs": { - "systems": "systems_4" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, "home-manager": { "inputs": { "nixpkgs": [ @@ -858,35 +840,19 @@ "type": "github" } }, - "systems_4": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, "tflow": { "inputs": { - "flake-utils": "flake-utils_2", "home-manager": "home-manager_2", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1784146867, - "narHash": "sha256-4MszpU7lygYZnr1R5kLBVUJSR49Ag/kW2UmcdAPMnSk=", + "lastModified": 1784656234, + "narHash": "sha256-K21jySfHFlbzZKPejD4v5vLdbpWtje2o6CtsDfdUSHQ=", "owner": "rapsnx", "repo": "tflow", - "rev": "b08293ceb859e6cd0a04fa87e147ce7ade56fdeb", + "rev": "5bdabe5a31df3665363cbcd1a0ed8610f96528bf", "type": "github" }, "original": { diff --git a/modules/home/cli/terminals/tmux/default.nix b/modules/home/cli/terminals/tmux/default.nix index 94466145..bf75f263 100644 --- a/modules/home/cli/terminals/tmux/default.nix +++ b/modules/home/cli/terminals/tmux/default.nix @@ -1,26 +1,6 @@ -{ pkgs, ... }: { programs.tmux = { enable = true; - package = pkgs.tmux; - - shell = "${pkgs.zsh}/bin/zsh"; - terminal = "xterm-256color"; mouse = true; - keyMode = "vi"; - clock24 = true; - historyLimit = 100000; - escapeTime = 10; - - extraConfig = '' - set -g focus-events on - set -g set-clipboard on - set -g allow-passthrough on - set -ga terminal-features ',alacritty:RGB' - set -ga terminal-features ',xterm-256color:RGB' - set -ga terminal-features ',tmux-256color:RGB' - - set -g update-environment "DISPLAY WAYLAND_DISPLAY SSH_AUTH_SOCK XAUTHORITY XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_CONFIG_HOME XDG_DATA_HOME XDG_CACHE_HOME KUBECONFIG" - ''; }; } diff --git a/modules/home/cli/tflow/default.nix b/modules/home/cli/tflow/default.nix new file mode 100644 index 00000000..1d901a63 --- /dev/null +++ b/modules/home/cli/tflow/default.nix @@ -0,0 +1,5 @@ +{ + programs.tflow = { + enable = true; + }; +} From ecb2d9313f0f0bb4730d35de9ba0270cc6cb5013 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 18:38:22 +0200 Subject: [PATCH 44/71] add niri --- docs/firefly.md | 21 ++++ flake.lock | 108 +++++++++++++++++++++ flake.nix | 6 ++ hosts/firefly/home.nix | 4 + modules/home/desktops/hyprland/default.nix | 10 +- modules/home/desktops/niri/default.nix | 97 ++++++++++++++++++ modules/nixos/roles/desktop/default.nix | 1 + modules/nixos/roles/desktop/niri.nix | 15 +++ 8 files changed, 257 insertions(+), 5 deletions(-) create mode 100644 modules/home/desktops/niri/default.nix create mode 100644 modules/nixos/roles/desktop/niri.nix diff --git a/docs/firefly.md b/docs/firefly.md index c38d1fc7..8f30b805 100644 --- a/docs/firefly.md +++ b/docs/firefly.md @@ -38,6 +38,27 @@ Exec=/usr/bin/Hyprland Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop ``` +`firefly` also has `roles.desktop.niri.enable = true` (PoC), backed by [niri-flake](https://github.com/sodiboo/niri-flake)'s `homeModules.niri`. Unlike Hyprland, there is no APT/PPA package for niri, so this module lets Home Manager install and manage niri itself (`programs.niri.package`, default `niri-stable` from niri-flake) in addition to generating `~/.config/niri/config.kdl` from `programs.niri.settings` (validated at build time via `niri validate`). + +niri-flake has its own binary cache to avoid building niri from source. Since `firefly` doesn't use the NixOS module (which wires the cache in automatically), add it once manually: + +```bash +cachix use niri +``` + +The display manager launches session files without the user's shell `PATH`, so the `Exec` line must use the absolute path into the Home Manager profile (`niri-session` handles systemd/portal integration, unlike calling the raw `niri` binary). `DesktopNames=niri` sets `XDG_CURRENT_DESKTOP`, which portals/theming rely on to detect the session: + +```bash +echo "[Desktop Entry] +Name=Niri +Comment=A scrollable-tiling Wayland compositor +Exec=/home/$(whoami)/.nix-profile/bin/niri-session +Type=Application +DesktopNames=niri" | sudo tee /usr/share/wayland-sessions/niri.desktop +``` + +`niri --session` (invoked by `niri-session`) is systemd-integrated, like Hyprland — it expects `niri.service`/`niri-shutdown.target` user units to exist so GDM can track the session. Those ship inside the niri package itself, but only get linked into `~/.config/systemd/user/` automatically on NixOS; the `roles.desktop.niri` Home Manager module links them explicitly for non-NixOS hosts like `firefly` (see `modules/home/desktops/niri/default.nix`). Without that, GDM logs `Failed to start niri.service: Unit niri.service not found.` and silently falls back to another session. + 5. Copy user-certificate to firefox ```bash diff --git a/flake.lock b/flake.lock index 76edb698..f3b47a8d 100644 --- a/flake.lock +++ b/flake.lock @@ -593,6 +593,64 @@ "type": "github" } }, + "niri": { + "inputs": { + "niri-stable": "niri-stable", + "niri-unstable": "niri-unstable", + "nixpkgs": [ + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable", + "xwayland-satellite-stable": "xwayland-satellite-stable", + "xwayland-satellite-unstable": "xwayland-satellite-unstable" + }, + "locked": { + "lastModified": 1784686714, + "narHash": "sha256-6HCWRBQq/U2NPY2msnnysnWczZYzEzhS1UZURmrr2f0=", + "owner": "sodiboo", + "repo": "niri-flake", + "rev": "4dfd38bad6150c07be6cc3fd7682787765092eea", + "type": "github" + }, + "original": { + "owner": "sodiboo", + "repo": "niri-flake", + "type": "github" + } + }, + "niri-stable": { + "flake": false, + "locked": { + "lastModified": 1756556321, + "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=", + "owner": "YaLTeR", + "repo": "niri", + "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294", + "type": "github" + }, + "original": { + "owner": "YaLTeR", + "ref": "v25.08", + "repo": "niri", + "type": "github" + } + }, + "niri-unstable": { + "flake": false, + "locked": { + "lastModified": 1784570726, + "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=", + "owner": "YaLTeR", + "repo": "niri", + "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc", + "type": "github" + }, + "original": { + "owner": "YaLTeR", + "repo": "niri", + "type": "github" + } + }, "nixos-hardware": { "inputs": { "nixpkgs": "nixpkgs_3" @@ -625,6 +683,22 @@ "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz" } }, + "nixpkgs-stable": { + "locked": { + "lastModified": 1782847189, + "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.11", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs_2": { "locked": { "lastModified": 1784120854, @@ -767,6 +841,7 @@ "import-tree": "import-tree", "krewfile": "krewfile", "neonix": "neonix", + "niri": "niri", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", "pre-commit-hooks": "pre-commit-hooks_3", @@ -901,6 +976,39 @@ "repo": "xdg-desktop-portal-hyprland", "type": "github" } + }, + "xwayland-satellite-stable": { + "flake": false, + "locked": { + "lastModified": 1755491097, + "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=", + "owner": "Supreeeme", + "repo": "xwayland-satellite", + "rev": "388d291e82ffbc73be18169d39470f340707edaa", + "type": "github" + }, + "original": { + "owner": "Supreeeme", + "ref": "v0.7", + "repo": "xwayland-satellite", + "type": "github" + } + }, + "xwayland-satellite-unstable": { + "flake": false, + "locked": { + "lastModified": 1784679892, + "narHash": "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=", + "owner": "Supreeeme", + "repo": "xwayland-satellite", + "rev": "8d135d3b2854b30fd01ea6cd6c27e523dd50a839", + "type": "github" + }, + "original": { + "owner": "Supreeeme", + "repo": "xwayland-satellite", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index c167ac59..c1019e4f 100644 --- a/flake.nix +++ b/flake.nix @@ -11,6 +11,10 @@ url = "github:hyprwm/hyprland"; inputs.nixpkgs.follows = "nixpkgs"; }; + niri = { + url = "github:sodiboo/niri-flake"; + inputs.nixpkgs.follows = "nixpkgs"; + }; neonix = { url = "github:rapsnx/neonix"; }; @@ -73,6 +77,7 @@ nixosModules = [ inputs.catppuccin.nixosModules.catppuccin inputs.sops-nix.nixosModules.sops + inputs.niri.nixosModules.niri (inputs.import-tree.match ".*/default\\.nix" ./modules/nixos) ./modules/nix.nix ]; @@ -83,6 +88,7 @@ inputs.krewfile.homeManagerModules.krewfile inputs.tflow.homeManagerModules.default inputs.sops-nix.homeManagerModules.sops + inputs.niri.homeModules.niri (inputs.import-tree.match ".*/default\\.nix" ./modules/home) ./modules/nix.nix ]; diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index 60829025..b7281fc1 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -37,6 +37,10 @@ "chromium" ]; }; + + niri = { + enable = true; + }; }; cli = { diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index fcf79472..6b9f3a4d 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -52,11 +52,11 @@ in services.hyprpaper.enable = true; - xdg.configFile."hypr/xdph.conf".text = '' - screencopy { - force_shm = true - } - ''; + # xdg.configFile."hypr/xdph.conf".text = '' + # screencopy { + # force_shm = true + # } + # ''; home.packages = builtins.attrValues { inherit (pkgs) diff --git a/modules/home/desktops/niri/default.nix b/modules/home/desktops/niri/default.nix new file mode 100644 index 00000000..35e03d01 --- /dev/null +++ b/modules/home/desktops/niri/default.nix @@ -0,0 +1,97 @@ +{ + lib, + config, + ... +}: +let + cfg = config.roles.desktop.niri; +in +{ + options.roles.desktop.niri.enable = lib.mkEnableOption "Enable niri"; + + # Migrated from modules/home/desktops/hyprland/keybinds.nix. + # Only binds with a direct niri equivalent are included; modal submaps, + # special workspaces, and hyprctl-scripted binds have no niri equivalent + # and were left out of this PoC. + config = lib.mkIf cfg.enable { + programs.niri = { + enable = true; + + settings.binds = { + "Mod+Return".action.spawn = "alacritty"; + "Mod+E".action.spawn = "fuzzel"; + "Mod+P".action.spawn = "wlogout"; + "Mod+Q".action.close-window = [ ]; + + "Mod+N".action.spawn = [ + "swaync-client" + "-t" + ]; + + "Mod+F".action.fullscreen-window = [ ]; + + "Mod+H".action.focus-column-left = [ ]; + "Mod+J".action.focus-window-down = [ ]; + "Mod+K".action.focus-window-up = [ ]; + "Mod+L".action.focus-column-right = [ ]; + + "Mod+Shift+H".action.move-column-left = [ ]; + "Mod+Shift+J".action.move-window-down = [ ]; + "Mod+Shift+K".action.move-window-up = [ ]; + "Mod+Shift+L".action.move-column-right = [ ]; + + "Mod+U".action.toggle-window-floating = [ ]; + + "Mod+1".action.focus-workspace = 1; + "Mod+2".action.focus-workspace = 2; + "Mod+3".action.focus-workspace = 3; + "Mod+4".action.focus-workspace = 4; + "Mod+5".action.focus-workspace = 5; + + "Mod+Z".action.spawn = [ + "mumble" + "rpc" + "togglemute" + ]; + "Mod+Shift+Z".action.spawn = [ + "mumble" + "rpc" + "toggledeaf" + ]; + + "Mod+Period".action.spawn = [ + "rofimoji" + "--action" + "copy" + "type" + ]; + + "Mod+Shift+I".action.spawn = [ + "systemctl" + "restart" + "--user" + "kanshi.service" + ]; + }; + }; + + xdg.configFile = { + # Links the package-shipped niri systemd units into ~/.config/systemd/user, + # since home.packages alone doesn't register them (that only happens + # automatically on NixOS, via environment.systemPackages unit scanning). + "systemd/user/niri.service".source = + "${config.programs.niri.package}/share/systemd/user/niri.service"; + "systemd/user/niri-shutdown.target".source = + "${config.programs.niri.package}/share/systemd/user/niri-shutdown.target"; + + # Stops sd-switch from restarting the live compositor on every + # home-manager switch. Both this override and the base niri.service must + # live under .config/systemd/user/ -- that's the only directory the + # activation script passes to sd-switch. + "systemd/user/niri.service.d/overrides.conf".text = '' + [Unit] + X-SwitchMethod=keep-old + ''; + }; + }; +} diff --git a/modules/nixos/roles/desktop/default.nix b/modules/nixos/roles/desktop/default.nix index ef9c9b52..17cac25c 100644 --- a/modules/nixos/roles/desktop/default.nix +++ b/modules/nixos/roles/desktop/default.nix @@ -9,6 +9,7 @@ in { imports = [ ./hyprland.nix + ./niri.nix ./fonts.nix ./power.nix ./explorer.nix diff --git a/modules/nixos/roles/desktop/niri.nix b/modules/nixos/roles/desktop/niri.nix new file mode 100644 index 00000000..26cd4a90 --- /dev/null +++ b/modules/nixos/roles/desktop/niri.nix @@ -0,0 +1,15 @@ +{ + lib, + config, + ... +}: +let + cfg = config.hostConfig.roles.niri; +in +{ + options.hostConfig.roles.niri = lib.mkEnableOption "Enable niri as a display manager session."; + + config = lib.mkIf cfg { + programs.niri.enable = true; + }; +} From 059447f2f9e262ace0d924e56899054fb7ff50f3 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 20:32:52 +0200 Subject: [PATCH 45/71] sway: add basic module with migrated Hyprland keybinds Mirrors the niri module's shape: a NixOS-level programs.sway.enable toggle plus a home-manager module that ports the Hyprland keymap where sway has a direct equivalent (real i3-style focus/move, and unlike niri, genuine modal `mode` blocks for the resize/window submaps). Wired into firefly for testing; the existing sway-home.desktop session file already points at the right binary path. --- hosts/firefly/home.nix | 4 + modules/home/desktops/sway/default.nix | 99 +++++++++++++++++++++++++ modules/nixos/roles/desktop/default.nix | 1 + modules/nixos/roles/desktop/sway.nix | 15 ++++ 4 files changed, 119 insertions(+) create mode 100644 modules/home/desktops/sway/default.nix create mode 100644 modules/nixos/roles/desktop/sway.nix diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index b7281fc1..2ec76a71 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -41,6 +41,10 @@ niri = { enable = true; }; + + sway = { + enable = true; + }; }; cli = { diff --git a/modules/home/desktops/sway/default.nix b/modules/home/desktops/sway/default.nix new file mode 100644 index 00000000..9cbf4544 --- /dev/null +++ b/modules/home/desktops/sway/default.nix @@ -0,0 +1,99 @@ +{ + lib, + config, + ... +}: +let + cfg = config.roles.desktop.sway; +in +{ + options.roles.desktop.sway.enable = lib.mkEnableOption "Enable sway"; + + # Migrated from modules/home/desktops/hyprland/keybinds.nix. + # Sway's own default keybindings (splith/splitv, scratchpad, exit dialog, + # etc.) are replaced entirely (lib.mkForce) rather than merged in, to keep + # this migration predictable -- only what's listed below exists. + # Special workspaces (two independently toggleable named scratch areas) + # and the hyprctl-scripted firefox toggle have no clean sway equivalent and + # were left out, same as the niri migration. Unlike niri, sway's real + # `mode` blocks are a direct equivalent of Hyprland's submaps, so the + # resize and window-move submaps *are* migrated here. + config = lib.mkIf cfg.enable { + wayland.windowManager.sway = { + enable = true; + + config = { + modifier = "Mod4"; + terminal = "alacritty"; + menu = "fuzzel"; + + keybindings = lib.mkForce { + "Mod4+Return" = "exec alacritty"; + "Mod4+e" = "exec fuzzel"; + "Mod4+p" = "exec wlogout"; + "Mod4+q" = "kill"; + + "Mod4+n" = "exec swaync-client -t"; + + "Mod4+f" = "fullscreen toggle"; + + "Mod4+h" = "focus left"; + "Mod4+j" = "focus down"; + "Mod4+k" = "focus up"; + "Mod4+l" = "focus right"; + + "Mod4+Shift+h" = "move left"; + "Mod4+Shift+j" = "move down"; + "Mod4+Shift+k" = "move up"; + "Mod4+Shift+l" = "move right"; + + "Mod4+t" = "layout toggle split"; + "Mod4+u" = "floating toggle"; + + "Mod4+1" = "workspace number 1"; + "Mod4+2" = "workspace number 2"; + "Mod4+3" = "workspace number 3"; + "Mod4+4" = "workspace number 4"; + "Mod4+5" = "workspace number 5"; + + "Mod4+z" = "exec mumble rpc togglemute"; + "Mod4+Shift+z" = "exec mumble rpc toggledeaf"; + + "Mod4+period" = "exec rofimoji --action copy type"; + + "Mod4+Shift+i" = "exec systemctl restart --user kanshi.service"; + + "Mod4+r" = "mode resize"; + "Mod4+g" = "mode window"; + }; + + modes = lib.mkForce { + resize = { + "h" = "resize shrink width 60px"; + "j" = "resize grow height 60px"; + "k" = "resize shrink height 60px"; + "l" = "resize grow width 60px"; + + "Shift+h" = "resize shrink width 20px"; + "Shift+j" = "resize grow height 20px"; + "Shift+k" = "resize shrink height 20px"; + "Shift+l" = "resize grow width 20px"; + + "Return" = "mode default"; + "Escape" = "mode default"; + }; + + window = { + "q" = "move container to workspace number 1; mode default"; + "w" = "move container to workspace number 2; mode default"; + "e" = "move container to workspace number 3; mode default"; + "r" = "move container to workspace number 4; mode default"; + + "Return" = "mode default"; + "Escape" = "mode default"; + }; + }; + }; + }; + }; +} diff --git a/modules/nixos/roles/desktop/default.nix b/modules/nixos/roles/desktop/default.nix index 17cac25c..9b848c7b 100644 --- a/modules/nixos/roles/desktop/default.nix +++ b/modules/nixos/roles/desktop/default.nix @@ -10,6 +10,7 @@ in imports = [ ./hyprland.nix ./niri.nix + ./sway.nix ./fonts.nix ./power.nix ./explorer.nix diff --git a/modules/nixos/roles/desktop/sway.nix b/modules/nixos/roles/desktop/sway.nix new file mode 100644 index 00000000..f9dd9643 --- /dev/null +++ b/modules/nixos/roles/desktop/sway.nix @@ -0,0 +1,15 @@ +{ + lib, + config, + ... +}: +let + cfg = config.hostConfig.roles.sway; +in +{ + options.hostConfig.roles.sway = lib.mkEnableOption "Enable sway as a display manager session."; + + config = lib.mkIf cfg { + programs.sway.enable = true; + }; +} From b011e5ceb8347ba6f669054eba864c0831f60659 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 20:48:40 +0200 Subject: [PATCH 46/71] sway: migrate gaps/border/input/window-rules parity from Hyprland Adds gaps.inner/outer, window/floating border width, sway-input(5) keyboard settings, and window-rules (assigns for firefox/chromium workspaces, floating criteria for steam/nextcloud) -- all direct sway equivalents of the corresponding Hyprland settings. Also wires waybar's systemd target and disables sway's own default i3status bar and catppuccin theming, matching how Hyprland is already configured. --- modules/home/desktops/sway/default.nix | 48 +++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/modules/home/desktops/sway/default.nix b/modules/home/desktops/sway/default.nix index 9cbf4544..e0f8e61e 100644 --- a/modules/home/desktops/sway/default.nix +++ b/modules/home/desktops/sway/default.nix @@ -1,5 +1,6 @@ { lib, + mylib, config, ... }: @@ -7,7 +8,10 @@ let cfg = config.roles.desktop.sway; in { - options.roles.desktop.sway.enable = lib.mkEnableOption "Enable sway"; + options.roles.desktop.sway = { + enable = lib.mkEnableOption "Enable sway"; + autostart = mylib.mkOpt (lib.types.listOf lib.types.str) "autostart"; + }; # Migrated from modules/home/desktops/hyprland/keybinds.nix. # Sway's own default keybindings (splith/splitv, scratchpad, exit dialog, @@ -19,6 +23,10 @@ in # `mode` blocks are a direct equivalent of Hyprland's submaps, so the # resize and window-move submaps *are* migrated here. config = lib.mkIf cfg.enable { + catppuccin.sway.enable = false; + + programs.waybar.systemd.targets = lib.mkDefault [ "sway-session.target" ]; + wayland.windowManager.sway = { enable = true; @@ -27,6 +35,44 @@ in terminal = "alacritty"; menu = "fuzzel"; + gaps = { + inner = 8; + outer = 10; + }; + + window.border = 3; + floating.border = 3; + + bars = lib.mkForce [ ]; + + input."*" = { + xkb_layout = "eu,de,de"; + xkb_variant = ",neo_qwertz,"; + repeat_delay = "250"; + repeat_rate = "40"; + accel_profile = "flat"; + pointer_accel = "1"; + }; + + startup = map (cmd: { command = cmd; }) cfg.autostart; + + assigns = { + "3" = [ + { app_id = "^firefox$"; } + { class = "^firefox$"; } + ]; + "4" = [ + { app_id = "^chromium.*"; } + { class = "^chromium.*"; } + ]; + }; + + floating.criteria = [ + { app_id = "steam"; } + { class = "steam"; } + { class = ".*nextcloud.*"; } + ]; + keybindings = lib.mkForce { "Mod4+Return" = "exec alacritty"; "Mod4+e" = "exec fuzzel"; From 72ed97b7231df45f842d04a100864b2f63932b3c Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 20:48:50 +0200 Subject: [PATCH 47/71] addons: shared swayidle/swaylock idle-lock for sway and niri Mirrors hypridle/hyprlock's lock-on-timeout + DPMS-off-on-timeout behavior, gated on either sway or niri being enabled. Implemented as a single shared module rather than one copy per compositor: both can be enabled simultaneously as separate selectable sessions, and duplicating services.swayidle.timeouts per compositor would double-register the same timeout list. The DPMS command detects which compositor is actually running at fire time (swaymsg vs niri msg), since both can be installed at once even though only one runs. One accepted gap, not a workaround: hyprlock's live blurred-screenshot background has no swaylock equivalent (static image/color only), so this falls back to a solid catppuccin-flavored color. --- .../desktops/addons/idle-lock/default.nix | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 modules/home/desktops/addons/idle-lock/default.nix diff --git a/modules/home/desktops/addons/idle-lock/default.nix b/modules/home/desktops/addons/idle-lock/default.nix new file mode 100644 index 00000000..70db66d3 --- /dev/null +++ b/modules/home/desktops/addons/idle-lock/default.nix @@ -0,0 +1,67 @@ +{ + lib, + config, + ... +}: +let + enabled = config.roles.desktop.sway.enable || config.roles.desktop.niri.enable; + + # Sway and niri both need swayidle/swaylock (compositor-agnostic wlr-protocol + # tools despite the name), but each needs a different DPMS command. Both + # compositors can be enabled at once (as separate selectable sessions), so + # this detects which one is actually running rather than being duplicated + # per-compositor, which would double up the swayidle timeout list. + dpms = state: '' + if pgrep -x sway >/dev/null; then + swaymsg output '*' dpms ${state} + elif pgrep -x niri >/dev/null; then + niri msg action power-${if state == "off" then "off" else "on"}-monitors + fi + ''; + + lockCmd = "${config.programs.swaylock.package}/bin/swaylock -f"; +in +{ + config = lib.mkIf enabled { + catppuccin.swaylock.enable = false; + + programs.swaylock = { + enable = true; + settings = { + color = "1e1e2e"; + indicator = true; + indicator-radius = 100; + indicator-thickness = 10; + inside-color = "5b6078"; + ring-color = "cad3f5"; + line-color = "00000000"; + separator-color = "00000000"; + key-hl-color = "a6da95"; + bs-hl-color = "ed8796"; + ignore-empty-password = true; + }; + }; + + services.swayidle = { + enable = true; + systemdTargets = [ + "sway-session.target" + "graphical-session.target" + ]; + + timeouts = [ + { + timeout = 300; + command = lockCmd; + } + { + timeout = 3600; + command = dpms "off"; + resumeCommand = dpms "on"; + } + ]; + + events.lock = lockCmd; + }; + }; +} From 426ba1304e64fb394bcd318363c1af6dbdd74336 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 20:49:43 +0200 Subject: [PATCH 48/71] niri: migrate gaps/border/corners/input/window-rules parity from Hyprland Adds layout.gaps/border, niri's native window-open animations (default, no config needed) and geometry-corner-radius (a real niri feature, unlike sway which needs the SwayFX fork for either) for Hyprland's decoration.rounding equivalent, input.keyboard/mouse settings, and window-rules for steam/nextcloud floating. Firefox/Chromium placement on the secondary monitor is a static open-on-output rule hardcoded to firefly's real secondary from the home-firefly kanshi profile. This was originally meant to be a kanshi- managed dynamic include file, but niri-flake's homeModules.config hardcodes its generated config's file target internally, so there's no supported way to combine programs.niri.settings with an extra include line. A static rule was chosen over a niri-msg-event-stream watcher daemon as the simpler option -- it just won't retarget itself at other locations/kanshi profiles, gracefully falling back to normal placement there instead (per niri's own open-on-output fallback behavior). Also wires waybar's systemd target, since niri.service itself BindsTo graphical-session.target rather than a dedicated *-session.target. --- modules/home/desktops/niri/default.nix | 169 ++++++++++++++++++------- 1 file changed, 123 insertions(+), 46 deletions(-) diff --git a/modules/home/desktops/niri/default.nix b/modules/home/desktops/niri/default.nix index 35e03d01..d4980143 100644 --- a/modules/home/desktops/niri/default.nix +++ b/modules/home/desktops/niri/default.nix @@ -1,5 +1,6 @@ { lib, + mylib, config, ... }: @@ -7,71 +8,147 @@ let cfg = config.roles.desktop.niri; in { - options.roles.desktop.niri.enable = lib.mkEnableOption "Enable niri"; + options.roles.desktop.niri = { + enable = lib.mkEnableOption "Enable niri"; + autostart = mylib.mkOpt (lib.types.listOf lib.types.str) "autostart"; + }; # Migrated from modules/home/desktops/hyprland/keybinds.nix. # Only binds with a direct niri equivalent are included; modal submaps, # special workspaces, and hyprctl-scripted binds have no niri equivalent # and were left out of this PoC. config = lib.mkIf cfg.enable { + # niri.service itself BindsTo graphical-session.target (there's no + # dedicated niri-session.target the way Hyprland/sway each have one), + # so that's what waybar binds against here. + programs.waybar.systemd.targets = lib.mkDefault [ "graphical-session.target" ]; + programs.niri = { enable = true; - settings.binds = { - "Mod+Return".action.spawn = "alacritty"; - "Mod+E".action.spawn = "fuzzel"; - "Mod+P".action.spawn = "wlogout"; - "Mod+Q".action.close-window = [ ]; + settings = { + layout = { + gaps = 10; + border.enable = true; + border.width = 3; + }; + + input = { + keyboard = { + xkb = { + layout = "eu,de,de"; + variant = ",neo_qwertz,"; + }; + repeat-delay = 250; + repeat-rate = 40; + }; + mouse = { + accel-profile = "flat"; + accel-speed = 1.0; + }; + }; - "Mod+N".action.spawn = [ - "swaync-client" - "-t" + # spawn-at-startup runs each command directly (not through a shell), + # so autostart entries with shell syntax (&&, etc.) need "sh" "-c". + spawn-at-startup = map (cmd: { + command = [ + "sh" + "-c" + cmd + ]; + }) cfg.autostart; + + window-rules = [ + { + # Default: rounded corners everywhere (native niri feature, no + # SwayFX-style fork needed). No `matches` means it applies to + # every window. + geometry-corner-radius = { + top-left = 5.0; + top-right = 5.0; + bottom-left = 5.0; + bottom-right = 5.0; + }; + clip-to-geometry = true; + } + { + matches = [ + { app-id = "^steam$"; } + { app-id = ".*nextcloud.*"; } + ]; + open-floating = true; + } + { + # Hardcoded to firefly's real secondary monitor from the + # "home-firefly" kanshi profile (modules/home/desktops/addons/kanshi). + # Not dynamic across locations/profiles: at other kanshi profiles + # (office/home) this output doesn't exist, so per niri's own + # fallback behaviour the window just opens on the currently + # focused output instead of erroring. + matches = [ + { app-id = "^firefox$"; } + { app-id = "^chromium.*"; } + ]; + open-on-output = "Samsung Electric Company LC27G7xT H4ZNC00167"; + } ]; - "Mod+F".action.fullscreen-window = [ ]; + binds = { + "Mod+Return".action.spawn = "alacritty"; + "Mod+E".action.spawn = "fuzzel"; + "Mod+P".action.spawn = "wlogout"; + "Mod+Q".action.close-window = [ ]; - "Mod+H".action.focus-column-left = [ ]; - "Mod+J".action.focus-window-down = [ ]; - "Mod+K".action.focus-window-up = [ ]; - "Mod+L".action.focus-column-right = [ ]; + "Mod+N".action.spawn = [ + "swaync-client" + "-t" + ]; - "Mod+Shift+H".action.move-column-left = [ ]; - "Mod+Shift+J".action.move-window-down = [ ]; - "Mod+Shift+K".action.move-window-up = [ ]; - "Mod+Shift+L".action.move-column-right = [ ]; + "Mod+F".action.fullscreen-window = [ ]; - "Mod+U".action.toggle-window-floating = [ ]; + "Mod+H".action.focus-column-left = [ ]; + "Mod+J".action.focus-window-down = [ ]; + "Mod+K".action.focus-window-up = [ ]; + "Mod+L".action.focus-column-right = [ ]; - "Mod+1".action.focus-workspace = 1; - "Mod+2".action.focus-workspace = 2; - "Mod+3".action.focus-workspace = 3; - "Mod+4".action.focus-workspace = 4; - "Mod+5".action.focus-workspace = 5; + "Mod+Shift+H".action.move-column-left = [ ]; + "Mod+Shift+J".action.move-window-down = [ ]; + "Mod+Shift+K".action.move-window-up = [ ]; + "Mod+Shift+L".action.move-column-right = [ ]; - "Mod+Z".action.spawn = [ - "mumble" - "rpc" - "togglemute" - ]; - "Mod+Shift+Z".action.spawn = [ - "mumble" - "rpc" - "toggledeaf" - ]; + "Mod+U".action.toggle-window-floating = [ ]; - "Mod+Period".action.spawn = [ - "rofimoji" - "--action" - "copy" - "type" - ]; + "Mod+1".action.focus-workspace = 1; + "Mod+2".action.focus-workspace = 2; + "Mod+3".action.focus-workspace = 3; + "Mod+4".action.focus-workspace = 4; + "Mod+5".action.focus-workspace = 5; - "Mod+Shift+I".action.spawn = [ - "systemctl" - "restart" - "--user" - "kanshi.service" - ]; + "Mod+Z".action.spawn = [ + "mumble" + "rpc" + "togglemute" + ]; + "Mod+Shift+Z".action.spawn = [ + "mumble" + "rpc" + "toggledeaf" + ]; + + "Mod+Period".action.spawn = [ + "rofimoji" + "--action" + "copy" + "type" + ]; + + "Mod+Shift+I".action.spawn = [ + "systemctl" + "restart" + "--user" + "kanshi.service" + ]; + }; }; }; From 61f6a86fc51bf565521de65ea5039b0223a8636e Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 20:49:51 +0200 Subject: [PATCH 49/71] kanshi: add sway support alongside Hyprland Adds swayWorkspaceSetup, a swaymsg-based equivalent of the existing hyprctl-based workspaceSetup (pins workspaces 1-2/3-4 to the profile's primary/secondary output and sets a random wallpaper via swaymsg output bg, since sway has no hyprpaper equivalent). kanshi's systemdTarget only accepts one target string, so it can't bind to both hyprland-session.target and sway-session.target at once. Changed to the shared graphical-session.target (which both compositors' session units already BindsTo) and added runtime compositor detection (runWorkspaceSetup, pgrep-based) so the profile exec script dispatches to whichever compositor is actually running. --- .../home/desktops/addons/kanshi/default.nix | 145 ++++++++++++------ 1 file changed, 99 insertions(+), 46 deletions(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 3410ff5a..f66220c9 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -14,59 +14,112 @@ "/usr/bin/hyprctl" else lib.getExe' pkgs.hyprland "hyprctl"; - workspaceSetup = - let - wallpaperPath = "${self.outPath}/extra/wallpapers"; - wallpapers = builtins.attrNames (builtins.readDir wallpaperPath); - in - pkgs.writeShellScriptBin "workspaceSetup" '' - set -euo pipefail - - primary="''${1:?missing primary monitor}" - secondary="''${2:?missing secondary monitor}" - - # Generate workspace config - cat > "$HOME/.config/hypr/workspaces.conf" < "$HOME/.config/hypr/workspaces.conf" </dev/null; then + exec ${lib.getExe workspaceSetup} "$@" + elif pgrep -x sway >/dev/null; then + exec ${lib.getExe swayWorkspaceSetup} "$@" + fi + ''; # mkExec picks which output(s) receive workspaces. A single entry means # all four workspaces go to that one monitor (primary == secondary). + # Raw kanshi criteria strings are passed through; any Hyprland-specific + # identifier conversion happens inside workspaceSetup itself. mkExec = workspaceOutputs: let - primary = toMonitorId (builtins.elemAt workspaceOutputs 0); - secondary = toMonitorId ( - builtins.elemAt workspaceOutputs (if builtins.length workspaceOutputs == 2 then 1 else 0) + primary = builtins.elemAt workspaceOutputs 0; + secondary = builtins.elemAt workspaceOutputs ( + if builtins.length workspaceOutputs == 2 then 1 else 0 ); in - "${lib.getExe workspaceSetup} ${ + "${lib.getExe runWorkspaceSetup} ${ lib.escapeShellArgs [ primary secondary @@ -88,7 +141,7 @@ in { enable = true; - systemdTarget = "hyprland-session.target"; + systemdTarget = "graphical-session.target"; settings = [ { From cc81b64bc4d65921429ca0e7df682ba35954a1ce Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 20:49:58 +0200 Subject: [PATCH 50/71] firefly: wire autostart lists for sway and niri Matches Hyprland's existing autostart (mumble, firefox, chromium) now that both compositor modules have an autostart option to migrate it into. --- hosts/firefly/home.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index 2ec76a71..81982d2f 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -40,10 +40,20 @@ niri = { enable = true; + autostart = [ + "sleep 3 && mumble" # Need to sleep for tray icon + "firefox" + "chromium" + ]; }; sway = { enable = true; + autostart = [ + "sleep 3 && mumble" # Need to sleep for tray icon + "firefox" + "chromium" + ]; }; }; From 24dabc5119e1493dfa693713a48a4d77396ebda1 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 21:02:39 +0200 Subject: [PATCH 51/71] ignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 5989bf18..5e1e1746 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ result .pre-commit-config.yaml /.codex +/.claude From c61662f255ff34e64963662aa6e96c0e8725abda Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 21:10:28 +0200 Subject: [PATCH 52/71] waybar: add sway/niri workspace and mode modules hyprland/workspaces and hyprland/submap only connect to Hyprland's own IPC socket, so under sway or niri the workspace indicator rendered nothing. Adds sway/workspaces, niri/workspaces, and sway/mode (niri has no modal binds, so no submap-equivalent needed there) to the same shared waybar.json rather than maintaining a separate config per compositor -- each compositor-specific module checks for its own socket/env var at startup and silently no-ops if it's not the one running, which is the standard way to run one waybar config across multiple compositors. --- .../home/desktops/addons/waybar/waybar.json | 28 ++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/modules/home/desktops/addons/waybar/waybar.json b/modules/home/desktops/addons/waybar/waybar.json index 67ae2698..c9c895af 100644 --- a/modules/home/desktops/addons/waybar/waybar.json +++ b/modules/home/desktops/addons/waybar/waybar.json @@ -6,7 +6,10 @@ "modules-left": [ "custom/logo", "hyprland/workspaces", - "hyprland/submap" + "sway/workspaces", + "niri/workspaces", + "hyprland/submap", + "sway/mode" ], "modules-center": [ "clock" @@ -48,6 +51,29 @@ "tooltip": false, "always-on": false }, + "sway/workspaces": { + "on-click": "activate", + "format": "{icon}", + "format-icons": { + "1": "", + "2": "λ", + "3": "", + "4": "󰍩" + } + }, + "niri/workspaces": { + "format": "{icon}", + "format-icons": { + "1": "", + "2": "λ", + "3": "", + "4": "󰍩" + } + }, + "sway/mode": { + "format": "MODE: {}", + "tooltip": false + }, "memory": { "interval": 5, "format": "󰍛 {}%", From 8fda719cda6cf3dc662f7f8853b3e350f99b1373 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 21:16:04 +0200 Subject: [PATCH 53/71] addons: fix swayidle DPMS command breaking systemd unit parsing services.swayidle.timeouts[].command gets embedded verbatim into swayidle.service's ExecStart= line. The DPMS command was a multi-line Nix string (an if/elif/fi block), so its raw embedded newlines broke systemd's unit-file parser: "expected '=' but got 'o'" on switch, since each newline started a new, invalid key=value line. Moved the compositor-detection logic into a real script (pkgs.writeShellScript) referenced by store path instead, which is inherently a single-line value in the unit file. Verified this time with systemd-analyze verify against the generated unit, not just a nix build -- a nix build alone doesn't catch that the generated text is invalid systemd syntax, only that the Nix evaluated successfully. --- .../desktops/addons/idle-lock/default.nix | 23 +++++++++++++++---- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/modules/home/desktops/addons/idle-lock/default.nix b/modules/home/desktops/addons/idle-lock/default.nix index 70db66d3..8f927bb6 100644 --- a/modules/home/desktops/addons/idle-lock/default.nix +++ b/modules/home/desktops/addons/idle-lock/default.nix @@ -1,5 +1,6 @@ { lib, + pkgs, config, ... }: @@ -11,11 +12,23 @@ let # compositors can be enabled at once (as separate selectable sessions), so # this detects which one is actually running rather than being duplicated # per-compositor, which would double up the swayidle timeout list. - dpms = state: '' + # + # Built as a real script (not an inline multi-line string) because + # services.swayidle.timeouts[].command is embedded verbatim into a + # systemd unit file's ExecStart= line -- a raw multi-line value there + # breaks systemd's unit-file parser (each embedded newline starts a new, + # invalid "key=value" line) unless every line ends with a `\` line + # continuation. A script path avoids that entirely. + dpmsToggle = pkgs.writeShellScript "dpms-toggle" '' + set -euo pipefail + state="''${1:?missing state (on|off)}" if pgrep -x sway >/dev/null; then - swaymsg output '*' dpms ${state} + swaymsg output '*' dpms "$state" elif pgrep -x niri >/dev/null; then - niri msg action power-${if state == "off" then "off" else "on"}-monitors + case "$state" in + off) niri msg action power-off-monitors ;; + on) niri msg action power-on-monitors ;; + esac fi ''; @@ -56,8 +69,8 @@ in } { timeout = 3600; - command = dpms "off"; - resumeCommand = dpms "on"; + command = "${dpmsToggle} off"; + resumeCommand = "${dpmsToggle} on"; } ]; From b333a7f2dc864383850b42f9fa6e6ebe7b621357 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 21:20:41 +0200 Subject: [PATCH 54/71] sway: restore scratchy scratchpad and add catppuccin border colors scratchy was dropped along with the rest of Hyprland's special workspaces during the parity migration, but sway's real scratchpad (a single unnamed pool) is actually an exact match for a single scratch terminal -- "scratchpad show" is a genuine hide/show toggle. Only "aux" stays dropped, since it needs two independently named pools, which sway's scratchpad can't do. Mod4+o toggles it, Mod4+Shift+o sends the focused window there, and the scratchy-titled alacritty autostarts hidden straight into the scratchpad via a window command. Also sets config.colors to Catppuccin Macchiato with a mauve focused border, matching the accent used elsewhere in this repo, without re-enabling full catppuccin.sway theming (which would also bring back sway's own bar, already disabled in favor of waybar). --- modules/home/desktops/sway/default.nix | 56 +++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/modules/home/desktops/sway/default.nix b/modules/home/desktops/sway/default.nix index e0f8e61e..f4077146 100644 --- a/modules/home/desktops/sway/default.nix +++ b/modules/home/desktops/sway/default.nix @@ -43,6 +43,42 @@ in window.border = 3; floating.border = 3; + # Catppuccin Macchiato, mauve accent -- matches the accent used + # elsewhere in this repo (see catppuccin.accent on the NixOS side). + # Not full catppuccin.sway theming (kept disabled below, since that + # also brings back sway's own bar) -- just the window border colors. + colors = { + background = "#24273a"; + focused = { + border = "#c6a0f6"; + background = "#24273a"; + text = "#cad3f5"; + indicator = "#c6a0f6"; + childBorder = "#c6a0f6"; + }; + focusedInactive = { + border = "#5b6078"; + background = "#24273a"; + text = "#cad3f5"; + indicator = "#5b6078"; + childBorder = "#5b6078"; + }; + unfocused = { + border = "#363a4f"; + background = "#24273a"; + text = "#a5adcb"; + indicator = "#363a4f"; + childBorder = "#363a4f"; + }; + urgent = { + border = "#ed8796"; + background = "#24273a"; + text = "#cad3f5"; + indicator = "#ed8796"; + childBorder = "#ed8796"; + }; + }; + bars = lib.mkForce [ ]; input."*" = { @@ -54,7 +90,10 @@ in pointer_accel = "1"; }; - startup = map (cmd: { command = cmd; }) cfg.autostart; + startup = [ + { command = "alacritty -t scratchy"; } + ] + ++ map (cmd: { command = cmd; }) cfg.autostart; assigns = { "3" = [ @@ -73,6 +112,18 @@ in { class = ".*nextcloud.*"; } ]; + # Sway's real scratchpad is a single unnamed pool (unlike Hyprland's + # two independently named special workspaces), so only "scratchy" is + # restored this way -- "aux" still has no clean sway equivalent. + window.commands = [ + { + criteria = { + title = "^scratchy$"; + }; + command = "floating enable, move to scratchpad"; + } + ]; + keybindings = lib.mkForce { "Mod4+Return" = "exec alacritty"; "Mod4+e" = "exec fuzzel"; @@ -96,6 +147,9 @@ in "Mod4+t" = "layout toggle split"; "Mod4+u" = "floating toggle"; + "Mod4+o" = "scratchpad show"; + "Mod4+Shift+o" = "move scratchpad"; + "Mod4+1" = "workspace number 1"; "Mod4+2" = "workspace number 2"; "Mod4+3" = "workspace number 3"; From a3ad8914247056a8eb4fb9a8362ccd03e730788c Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Wed, 22 Jul 2026 21:31:33 +0200 Subject: [PATCH 55/71] niri: restore scratchy as a real hide/show toggle Niri has no scratchpad, so this reconstructs Hyprland's scratchy toggle using niri's window-id IPC instead (niri msg action focus-window / move-window-to-workspace, confirmed against the niri-ipc source's Window/Workspace structs). Mod+O runs a script that queries the scratchy window's is_focused state: if focused, moves it to a dedicated "scratch-hidden" named workspace (kept out of the Mod+1..5 binds so it's never visible in normal use); otherwise moves it to the currently focused workspace and focuses it. Single keypress-invoked script, not a persistent daemon. The scratchy-titled Alacritty autostarts floating (a real niri window-rule, unlike sway which needed no extra rule since its scratchpad handles floating implicitly). --- modules/home/desktops/niri/default.nix | 59 +++++++++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) diff --git a/modules/home/desktops/niri/default.nix b/modules/home/desktops/niri/default.nix index d4980143..d6b19c93 100644 --- a/modules/home/desktops/niri/default.nix +++ b/modules/home/desktops/niri/default.nix @@ -1,11 +1,43 @@ { lib, + pkgs, mylib, config, ... }: let cfg = config.roles.desktop.niri; + + # Niri has no scratchpad, unlike sway, but its IPC can address windows by + # id directly (niri msg action focus-window/move-window-to-workspace), + # which is enough to reconstruct a real hide/show toggle: hide by moving + # the window to a dedicated, otherwise-unused named workspace; show by + # moving it back to whatever workspace is currently focused and focusing + # it. This is a single script invoked per keypress, not a persistent + # daemon. + toggleScratchy = pkgs.writeShellScript "toggle-scratchy" '' + set -euo pipefail + + scratchy_id=$(niri msg --json windows | ${lib.getExe pkgs.jq} -r ' + .[] | select(.app_id == "Alacritty" and .title == "scratchy") | .id + ' | head -n1) + + if [ -z "$scratchy_id" ]; then + exit 0 + fi + + is_focused=$(niri msg --json windows | ${lib.getExe pkgs.jq} -r --argjson id "$scratchy_id" ' + .[] | select(.id == $id) | .is_focused + ') + + if [ "$is_focused" = "true" ]; then + niri msg action move-window-to-workspace --window-id "$scratchy_id" --focus false "scratch-hidden" + else + current_idx=$(niri msg --json workspaces | ${lib.getExe pkgs.jq} -r '.[] | select(.is_focused == true) | .idx') + niri msg action move-window-to-workspace --window-id "$scratchy_id" --focus false "$current_idx" + niri msg action focus-window --id "$scratchy_id" + fi + ''; in { options.roles.desktop.niri = { @@ -33,6 +65,11 @@ in border.width = 3; }; + # Parking spot for the scratchy toggle script (see toggleScratchy + # above) -- deliberately not bound to any Mod+N workspace-switch + # key, so it's never visible during regular use. + workspaces."scratch-hidden" = { }; + input = { keyboard = { xkb = { @@ -50,7 +87,16 @@ in # spawn-at-startup runs each command directly (not through a shell), # so autostart entries with shell syntax (&&, etc.) need "sh" "-c". - spawn-at-startup = map (cmd: { + spawn-at-startup = [ + { + command = [ + "alacritty" + "-t" + "scratchy" + ]; + } + ] + ++ map (cmd: { command = [ "sh" "-c" @@ -78,6 +124,15 @@ in ]; open-floating = true; } + { + matches = [ + { + app-id = "^Alacritty$"; + title = "^scratchy$"; + } + ]; + open-floating = true; + } { # Hardcoded to firefly's real secondary monitor from the # "home-firefly" kanshi profile (modules/home/desktops/addons/kanshi). @@ -118,6 +173,8 @@ in "Mod+U".action.toggle-window-floating = [ ]; + "Mod+O".action.spawn = "${toggleScratchy}"; + "Mod+1".action.focus-workspace = 1; "Mod+2".action.focus-workspace = 2; "Mod+3".action.focus-workspace = 3; From c8b8630c162e9a03f4ea2733c5f2b511f9b6cdd3 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Thu, 23 Jul 2026 09:45:28 +0200 Subject: [PATCH 56/71] alacrity kungfui --- flake.lock | 6 +-- .../home/cli/terminals/alacritty/default.nix | 41 ++++++++++++------- 2 files changed, 30 insertions(+), 17 deletions(-) diff --git a/flake.lock b/flake.lock index f3b47a8d..741026b0 100644 --- a/flake.lock +++ b/flake.lock @@ -923,11 +923,11 @@ ] }, "locked": { - "lastModified": 1784656234, - "narHash": "sha256-K21jySfHFlbzZKPejD4v5vLdbpWtje2o6CtsDfdUSHQ=", + "lastModified": 1784753614, + "narHash": "sha256-o+wcNoHf3osmjglOY+VouUqnAzdoDB+ZLgY99w4BFgQ=", "owner": "rapsnx", "repo": "tflow", - "rev": "5bdabe5a31df3665363cbcd1a0ed8610f96528bf", + "rev": "9bddddb1d89a89965af68240006535a1672eb55e", "type": "github" }, "original": { diff --git a/modules/home/cli/terminals/alacritty/default.nix b/modules/home/cli/terminals/alacritty/default.nix index 4b10569f..ea3299fe 100644 --- a/modules/home/cli/terminals/alacritty/default.nix +++ b/modules/home/cli/terminals/alacritty/default.nix @@ -1,4 +1,22 @@ { pkgs, ... }: +let + generalBinding = { + key = "H"; + mods = "Control"; + }; + + kubernetesBinding = { + key = "K"; + mods = "Control"; + }; + + # Keep these as one alternation per mode. This prevents overlapping matches + # such as a hostname inside a URL from producing duplicate hint labels. + generalRegex = ''(?:ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh://|ftp://)[^[:space:]<>"\x27{}^⟨⟩\x60]+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|\b[0-9a-fA-F]{7,40}\b|(?:~|\.{1,2})/[^[:space:]<>"\x27\x60]+|/(?:home|etc|var|tmp|usr|opt|run|dev|mnt|root)/[^[:space:]<>"\x27\x60]+|\b(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}\b|\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+:[^[:space:]<>"\x27\x60]+''; + + kubernetesRegex = ''\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])*(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)+(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|(?:pods?|deployments?|statefulsets?|daemonsets?|jobs?|cronjobs?|replicasets?|services?|svc|ingresses?|configmaps?|cm|secrets?|namespaces?|ns|nodes?|no|events?|ev|serviceaccounts?|sa|roles?|rolebindings?|customresourcedefinitions?|crds?|shoots?|seeds?|managedseeds?|projects?|clusters?|cloudprofiles?|backupbuckets?|backupentries?|bastions?|containerruntimes?|controlplanes?|dnsrecords?|extensions?|infrastructures?|networks?|operatingsystemconfigs?|workers?|machinedeployments?|machinesets?|machines?|machineclasses?)/[a-z0-9][a-z0-9.-]*[a-z0-9]|(?:context|ctx|namespace|ns)[=:][[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:--context|--namespace|-n)[=:[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?\.)+[a-z0-9](?:[-a-z0-9]*[a-z0-9])?/[A-Za-z0-9][A-Za-z0-9_.-]*(?:[=:][[:space:]]*[A-Za-z0-9_.:/-]+)?|\b[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:/-]+\b|\b[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.svc(?:\.cluster\.local)?\b|(?:\[[0-9A-Fa-f:]+\]|(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}):[0-9]{1,5}''; + +in { home.packages = [ pkgs.nerd-fonts.caskaydia-cove @@ -25,28 +43,23 @@ }; hints.enabled = [ - # Hint to copy uuids + # General copy hints: links, network identifiers, paths, and Git + # artifacts without matching arbitrary hyphenated words. { action = "Copy"; + binding = generalBinding; hyperlinks = true; post_processing = true; - # URL, email, ipv4/6, UUID, Git-Hash - regex = ''(?:(?:https?://|ssh://)[^\\s<>"']+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}|(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}|\\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|[0-9a-fA-F]{7,40})''; - - binding = { - key = "H"; - mods = "Control"; - }; + regex = generalRegex; } + + # Kubernetes and Gardener copy hints: resources, selectors, + # annotations, contexts, namespaces, endpoints, and images. { action = "Copy"; + binding = kubernetesBinding; post_processing = true; - regex = "[a-z0-9]+(?:--?[a-z0-9]+)*(?:-[a-z0-9]+)*"; - - binding = { - key = "G"; - mods = "Control"; - }; + regex = kubernetesRegex; } ]; From e53cbb682580ef2b85e02c087262711077df0c17 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Thu, 23 Jul 2026 21:45:45 +0200 Subject: [PATCH 57/71] boot --- modules/nixos/system/boot.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix index 9dd58b2d..b8ef13e3 100644 --- a/modules/nixos/system/boot.nix +++ b/modules/nixos/system/boot.nix @@ -32,7 +32,7 @@ in ]; loader = { - timeout = lib.mkDefault 0; + timeout = 0; systemd-boot = { enable = true; From 4e8f348a37f3a8fb41e0a0c2f920955dc3a2c87b Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 14:56:25 +0200 Subject: [PATCH 58/71] alacritty: fix hint regex Unicode/DFA compile error; kanshi: drop custom exec scripts for plain settings Alacritty's hint regexes embedded literal non-ASCII characters and relied on Unicode-mode word boundaries, which its lazy-DFA hint compiler can't build; force ASCII mode with (?-u) and drop the stray Unicode brackets. kanshi's workspace-pinning scripts (workspaceSetup/swayWorkspaceSetup/ runWorkspaceSetup, mkExec, mkProfile) were dead/half-disabled leftovers from an abandoned auto-pin-workspaces feature. Replaced with a plain services.kanshi.settings list: no exec, external monitors matched by vendor/model/serial identifier, eDP-1 kept as a connector name since the internal panel reports no identifier. Removed the now-orphaned hypr/workspaces.conf source line and updated docs/monitors.md to match. --- docs/monitors.md | 5 +- .../home/cli/terminals/alacritty/default.nix | 4 +- .../home/desktops/addons/kanshi/default.nix | 216 +++--------------- modules/home/desktops/hyprland/default.nix | 1 - 4 files changed, 40 insertions(+), 186 deletions(-) diff --git a/docs/monitors.md b/docs/monitors.md index 06782fd0..dd8acf11 100644 --- a/docs/monitors.md +++ b/docs/monitors.md @@ -1,9 +1,8 @@ # Monitor / Workspace setup `kanshi` is used to match all possible desktop / office setups via profiles. -These profiles have the primary and secondary display configured, and will execute a script to adapt the workspace pinning. -This will write its config to `~/.config/hypr/workspaces.conf`, same as `nwg-desktop`. -`nwg-desktop` can still be used for both monitor and workspace dynamic configuration. +These profiles configure the primary and secondary display (position, mode, scale) for each known monitor combination. +`nwg-desktop` can still be used for workspace dynamic configuration. **To actually change the monitor config, the `kanshi` systemd service needs to be stopped.** diff --git a/modules/home/cli/terminals/alacritty/default.nix b/modules/home/cli/terminals/alacritty/default.nix index ea3299fe..ab848d08 100644 --- a/modules/home/cli/terminals/alacritty/default.nix +++ b/modules/home/cli/terminals/alacritty/default.nix @@ -12,9 +12,9 @@ let # Keep these as one alternation per mode. This prevents overlapping matches # such as a hostname inside a URL from producing duplicate hint labels. - generalRegex = ''(?:ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh://|ftp://)[^[:space:]<>"\x27{}^⟨⟩\x60]+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|\b[0-9a-fA-F]{7,40}\b|(?:~|\.{1,2})/[^[:space:]<>"\x27\x60]+|/(?:home|etc|var|tmp|usr|opt|run|dev|mnt|root)/[^[:space:]<>"\x27\x60]+|\b(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}\b|\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+:[^[:space:]<>"\x27\x60]+''; + generalRegex = ''(?-u)(?:ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh://|ftp://)[^[:space:]<>"\x27{}^\x60]+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|\b[0-9a-fA-F]{7,40}\b|(?:~|\.{1,2})/[^[:space:]<>"\x27\x60]+|/(?:home|etc|var|tmp|usr|opt|run|dev|mnt|root)/[^[:space:]<>"\x27\x60]+|\b(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}\b|\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+:[^[:space:]<>"\x27\x60]+''; - kubernetesRegex = ''\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])*(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)+(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|(?:pods?|deployments?|statefulsets?|daemonsets?|jobs?|cronjobs?|replicasets?|services?|svc|ingresses?|configmaps?|cm|secrets?|namespaces?|ns|nodes?|no|events?|ev|serviceaccounts?|sa|roles?|rolebindings?|customresourcedefinitions?|crds?|shoots?|seeds?|managedseeds?|projects?|clusters?|cloudprofiles?|backupbuckets?|backupentries?|bastions?|containerruntimes?|controlplanes?|dnsrecords?|extensions?|infrastructures?|networks?|operatingsystemconfigs?|workers?|machinedeployments?|machinesets?|machines?|machineclasses?)/[a-z0-9][a-z0-9.-]*[a-z0-9]|(?:context|ctx|namespace|ns)[=:][[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:--context|--namespace|-n)[=:[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?\.)+[a-z0-9](?:[-a-z0-9]*[a-z0-9])?/[A-Za-z0-9][A-Za-z0-9_.-]*(?:[=:][[:space:]]*[A-Za-z0-9_.:/-]+)?|\b[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:/-]+\b|\b[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.svc(?:\.cluster\.local)?\b|(?:\[[0-9A-Fa-f:]+\]|(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}):[0-9]{1,5}''; + kubernetesRegex = ''(?-u)\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])*(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)+(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|(?:pods?|deployments?|statefulsets?|daemonsets?|jobs?|cronjobs?|replicasets?|services?|svc|ingresses?|configmaps?|cm|secrets?|namespaces?|ns|nodes?|no|events?|ev|serviceaccounts?|sa|roles?|rolebindings?|customresourcedefinitions?|crds?|shoots?|seeds?|managedseeds?|projects?|clusters?|cloudprofiles?|backupbuckets?|backupentries?|bastions?|containerruntimes?|controlplanes?|dnsrecords?|extensions?|infrastructures?|networks?|operatingsystemconfigs?|workers?|machinedeployments?|machinesets?|machines?|machineclasses?)/[a-z0-9][a-z0-9.-]*[a-z0-9]|(?:context|ctx|namespace|ns)[=:][[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:--context|--namespace|-n)[=:[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?\.)+[a-z0-9](?:[-a-z0-9]*[a-z0-9])?/[A-Za-z0-9][A-Za-z0-9_.-]*(?:[=:][[:space:]]*[A-Za-z0-9_.:/-]+)?|\b[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:/-]+\b|\b[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.svc(?:\.cluster\.local)?\b|(?:\[[0-9A-Fa-f:]+\]|(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}):[0-9]{1,5}''; in { diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index f66220c9..2a0c5927 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -1,170 +1,30 @@ { - pkgs, - lib, - self, - config, - ... -}: -{ - services.kanshi = - let - hyprlandCfg = config.roles.desktop.hyprland; - hyprctl = - if hyprlandCfg.enable && hyprlandCfg.configOnly then - "/usr/bin/hyprctl" - else - lib.getExe' pkgs.hyprland "hyprctl"; - - wallpaperPath = "${self.outPath}/extra/wallpapers"; - wallpapers = builtins.attrNames (builtins.readDir wallpaperPath); - - # Turns a kanshi criteria string into the identifier Hyprland's - # workspace/dispatch syntax expects for multi-word (description-based) - # criteria. Applied inside the script itself (not at the Nix level, via - # mkExec) since it's Hyprland-specific -- sway accepts the same raw - # description string directly, no prefixing needed. - toMonitorIdSh = '' - toMonitorId() { - case "$1" in - *" "*) printf 'desc:%s' "$1" ;; - *) printf '%s' "$1" ;; - esac - } - ''; - - workspaceSetup = pkgs.writeShellScriptBin "workspaceSetup" '' - set -euo pipefail - ${toMonitorIdSh} - - primary="$(toMonitorId "''${1:?missing primary monitor}")" - secondary="$(toMonitorId "''${2:?missing secondary monitor}")" - - # Generate workspace config - cat > "$HOME/.config/hypr/workspaces.conf" </dev/null; then - exec ${lib.getExe workspaceSetup} "$@" - elif pgrep -x sway >/dev/null; then - exec ${lib.getExe swayWorkspaceSetup} "$@" - fi - ''; - - # mkExec picks which output(s) receive workspaces. A single entry means - # all four workspaces go to that one monitor (primary == secondary). - # Raw kanshi criteria strings are passed through; any Hyprland-specific - # identifier conversion happens inside workspaceSetup itself. - mkExec = - workspaceOutputs: - let - primary = builtins.elemAt workspaceOutputs 0; - secondary = builtins.elemAt workspaceOutputs ( - if builtins.length workspaceOutputs == 2 then 1 else 0 - ); - in - "${lib.getExe runWorkspaceSetup} ${ - lib.escapeShellArgs [ - primary - secondary - ] - }"; - - mkProfile = - { - name, - outputs, - workspaceOutputs, - }: - { - profile = { - inherit name outputs; - exec = mkExec workspaceOutputs; - }; + services.kanshi = { + enable = true; + systemdTarget = "graphical-session.target"; + + settings = [ + { + output = { + criteria = "eDP-1"; + position = "6000,0"; + mode = "1920x1200@60.00Hz"; }; - in - { - enable = true; - systemdTarget = "graphical-session.target"; - - settings = [ - { - output = { - criteria = "eDP-1"; - position = "6000,0"; - mode = "1920x1200@60.00Hz"; - }; - } + } - { - # Default profile, without exec - profile = { - name = "undocked"; - outputs = [ - { - criteria = "eDP-1"; - } - ]; - }; - } + { + profile = { + name = "undocked"; + outputs = [ + { + criteria = "eDP-1"; + } + ]; + }; + } - (mkProfile { + { + profile = { name = "office"; outputs = [ { @@ -177,12 +37,13 @@ criteria = "eDP-1"; } ]; - workspaceOutputs = [ "DP-1" ]; - }) + }; + } - # TODO: Add meeting room here + # TODO: Add meeting room here - (mkProfile { + { + profile = { name = "home-firefly"; outputs = [ { @@ -201,13 +62,11 @@ criteria = "eDP-1"; } ]; - workspaceOutputs = [ - "Dell Inc. AW2725Q G2QC174" - "Samsung Electric Company LC27G7xT H4ZNC00167" - ]; - }) + }; + } - (mkProfile { + { + profile = { name = "home"; outputs = [ { @@ -223,11 +82,8 @@ mode = "2560x1440@239.96Hz"; } ]; - workspaceOutputs = [ - "Dell Inc. AW2725Q G2QC174" - "Samsung Electric Company LC27G7xT H4ZNC00167" - ]; - }) - ]; - }; + }; + } + ]; + }; } diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 6b9f3a4d..9a23b647 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -97,7 +97,6 @@ in source = [ "${config.xdg.configHome}/hypr/monitors.conf" - "${config.xdg.configHome}/hypr/workspaces.conf" ]; dwindle = { From 1f77b22ad74ded6550419cf06bbdbf4c438f9b10 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 15:20:24 +0200 Subject: [PATCH 59/71] hyprland: statically pin workspaces 1-2/3-4 to Dell/Samsung; kanshi: disable eDP-1 when docked Replaces the exec-script-based workspace pinning with Hyprland's native workspace = N, monitor:desc: rules. These are no-ops when the named monitor isn't connected (verified against hyprwm/hyprland@4afc273, the pinned hyprland-git rev), so a single static list correctly pins workspaces on home/home-firefly and is inert on office/undocked. For that fallback to actually land everything on the single active monitor at the office (and when docked at home), eDP-1 now gets `status = "disable"` in those kanshi profiles instead of staying enabled alongside the external monitor. --- modules/home/desktops/addons/kanshi/default.nix | 2 ++ modules/home/desktops/hyprland/default.nix | 7 +++++++ 2 files changed, 9 insertions(+) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 2a0c5927..2566b878 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -35,6 +35,7 @@ } { criteria = "eDP-1"; + status = "disable"; } ]; }; @@ -60,6 +61,7 @@ } { criteria = "eDP-1"; + status = "disable"; } ]; }; diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 9a23b647..6538001a 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -136,6 +136,13 @@ in ] ++ cfg.autostart; + workspace = [ + "1, monitor:desc:Dell Inc. AW2725Q G2QC174, default:true" + "2, monitor:desc:Dell Inc. AW2725Q G2QC174" + "3, monitor:desc:Samsung Electric Company LC27G7xT H4ZNC00167, default:true" + "4, monitor:desc:Samsung Electric Company LC27G7xT H4ZNC00167" + ]; + windowrule = [ "match:class ^(firefox)$, workspace 3" "match:class ^(chromium-browser)$, workspace 4" From 97f2770653a75edcd0a80c818a59e2c0c2e471b5 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 15:34:02 +0200 Subject: [PATCH 60/71] boot: restore mkDefault on loader.timeout to fix CI conflict on vinox boot.loader.timeout = 0 (a plain, priority-100 definition) collided with nixpkgs' own nixos/modules/installer/cd-dvd/iso-image.nix, which sets the same option to 10 at the same priority for live-ISO hosts like vinox (imported via installation-cd-graphical-gnome.nix). NixOS's module system throws "conflicting definition values" for two same-priority definitions that disagree, which is exactly what failed in the "Host vinox" CI job. Restoring mkDefault drops our value back to low priority so real hosts (zion, kubex, nixberry) still get timeout=0 as the sole definition, while vinox's installer-provided timeout=10 (a sensible interactive value for a live-boot menu) wins instead of erroring. Verified locally: `nix build .#nixosConfigurations.vinox.config.system.build.toplevel` now succeeds. --- modules/nixos/system/boot.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/nixos/system/boot.nix b/modules/nixos/system/boot.nix index b8ef13e3..9dd58b2d 100644 --- a/modules/nixos/system/boot.nix +++ b/modules/nixos/system/boot.nix @@ -32,7 +32,7 @@ in ]; loader = { - timeout = 0; + timeout = lib.mkDefault 0; systemd-boot = { enable = true; From 82dcfcc506bb80b00c11dc40dd28d1d4718c3392 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 18:52:16 +0200 Subject: [PATCH 61/71] fix: resolve PR review issues --- modules/home/cli/core/default.nix | 111 +++++++++--------- modules/home/cli/k8s/k9s.nix | 32 ----- .../home/cli/terminals/alacritty/default.nix | 14 +-- modules/nixos/roles/k3s/zfs.nix | 4 +- 4 files changed, 68 insertions(+), 93 deletions(-) diff --git a/modules/home/cli/core/default.nix b/modules/home/cli/core/default.nix index 80213b99..06f2f6dd 100644 --- a/modules/home/cli/core/default.nix +++ b/modules/home/cli/core/default.nix @@ -1,68 +1,73 @@ -{ pkgs, ... }: { - home.packages = builtins.attrValues { - # Core utility - inherit (pkgs) - coreutils - dnsutils - gnumake - gnutar - gzip - unzip - gnused - gnugrep - killall - pciutils - parallel + config, + lib, + pkgs, + ... +}: +{ + home.packages = + builtins.attrValues { + # Core utility + inherit (pkgs) + coreutils + dnsutils + gnumake + gnutar + gzip + unzip + gnused + gnugrep + killall + pciutils + parallel - # Inspection - htop + # Inspection + htop - # Network tools - inetutils - curl - wget + # Network tools + inetutils + curl + wget - # Network inspection - termshark - nmap - netcat - tcpdump - iproute2 + # Network inspection + termshark + nmap + netcat + tcpdump + iproute2 - # Text processing - jq - yq-go - gawk + # Text processing + jq + yq-go + gawk - # Find utils - fd - ripgrep + # Find utils + fd + ripgrep - # Copy tools - rclone + # Copy tools + rclone - # SSH / Security - openssh - libfido2 - keepassxc - sops + # SSH / Security + openssh + libfido2 + keepassxc + sops - # Clipboard - wl-clipboard + # Clipboard + wl-clipboard - # AI Shit - codex - claude-code - nodejs + # AI Shit + codex + claude-code + nodejs - # Monitor / I2C com - ddcutil + # Monitor / I2C com + ddcutil - # Compiler - gcc - ; - }; + ; + } + ++ lib.optional config.roles.work pkgs.gcc; programs = { bat.enable = true; fzf = { diff --git a/modules/home/cli/k8s/k9s.nix b/modules/home/cli/k8s/k9s.nix index a1ed7961..648354d8 100644 --- a/modules/home/cli/k8s/k9s.nix +++ b/modules/home/cli/k8s/k9s.nix @@ -53,38 +53,6 @@ let ]; }; - suspend = { - description = "Suspend resource"; - shortCut = "s"; - scopes = gardenerScopes; - command = "kubectl"; - background = true; - args = [ - "annotate" - "-n" - "$NAMESPACE" - "$RESOURCE_NAME" - "$NAME" - "gardener.cloud/operation=suspend" - ]; - }; - - resume = { - description = "Resume resource"; - shortCut = "u"; - scopes = gardenerScopes; - command = "kubectl"; - background = true; - args = [ - "annotate" - "-n" - "$NAMESPACE" - "$RESOURCE_NAME" - "$NAME" - "gardener.cloud/operation=resume" - ]; - }; - reconcile-seed = { description = "Reconcile seed"; shortCut = "r"; diff --git a/modules/home/cli/terminals/alacritty/default.nix b/modules/home/cli/terminals/alacritty/default.nix index ab848d08..f65db5a4 100644 --- a/modules/home/cli/terminals/alacritty/default.nix +++ b/modules/home/cli/terminals/alacritty/default.nix @@ -5,16 +5,16 @@ let mods = "Control"; }; - kubernetesBinding = { + platformBinding = { key = "K"; mods = "Control"; }; # Keep these as one alternation per mode. This prevents overlapping matches # such as a hostname inside a URL from producing duplicate hint labels. - generalRegex = ''(?-u)(?:ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh://|ftp://)[^[:space:]<>"\x27{}^\x60]+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|\b[0-9a-fA-F]{7,40}\b|(?:~|\.{1,2})/[^[:space:]<>"\x27\x60]+|/(?:home|etc|var|tmp|usr|opt|run|dev|mnt|root)/[^[:space:]<>"\x27\x60]+|\b(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}\b|\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+:[^[:space:]<>"\x27\x60]+''; + generalRegex = ''(?:ipfs:|ipns:|magnet:|mailto:|gemini://|gopher://|https://|http://|news:|file:|git://|ssh://|ftp://)[^[:space:]<>"\x27{}^\x60]+|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|(?-u:\b)(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}(?-u:\b)|\[(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}\]|(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}|(?-u:\b)[0-9A-Fa-f]{8}(?:-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}(?-u:\b)|(?-u:\b)[0-9A-Fa-f]{32}(?-u:\b)|(?:~|\.{1,2})/[^[:space:]<>"\x27\x60]+|/(?:home|etc|var|tmp|usr|opt|run|dev|mnt|root)/[^[:space:]<>"\x27\x60]+|(?-u:\b)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,}(?-u:\b)|(?-u:\b)[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+:[^[:space:]<>"\x27\x60]+''; - kubernetesRegex = ''(?-u)\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])*(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|\b[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)+(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})\b|(?:pods?|deployments?|statefulsets?|daemonsets?|jobs?|cronjobs?|replicasets?|services?|svc|ingresses?|configmaps?|cm|secrets?|namespaces?|ns|nodes?|no|events?|ev|serviceaccounts?|sa|roles?|rolebindings?|customresourcedefinitions?|crds?|shoots?|seeds?|managedseeds?|projects?|clusters?|cloudprofiles?|backupbuckets?|backupentries?|bastions?|containerruntimes?|controlplanes?|dnsrecords?|extensions?|infrastructures?|networks?|operatingsystemconfigs?|workers?|machinedeployments?|machinesets?|machines?|machineclasses?)/[a-z0-9][a-z0-9.-]*[a-z0-9]|(?:context|ctx|namespace|ns)[=:][[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:--context|--namespace|-n)[=:[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?\.)+[a-z0-9](?:[-a-z0-9]*[a-z0-9])?/[A-Za-z0-9][A-Za-z0-9_.-]*(?:[=:][[:space:]]*[A-Za-z0-9_.:/-]+)?|\b[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:/-]+\b|\b[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.svc(?:\.cluster\.local)?\b|(?:\[[0-9A-Fa-f:]+\]|(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}):[0-9]{1,5}''; + platformRegex = ''(?-u:\b)shoot-[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:-[a-z0-9](?:[-a-z0-9]*[a-z0-9])?)+(?-u:\b)|(?-u:\b)(?:source-)?shoot--[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:--[a-z0-9](?:[-a-z0-9]*[a-z0-9])?){1,2}(?-u:\b)|(?-u:\b)[a-z0-9](?:[a-z0-9._-]*[a-z0-9])*(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})(?-u:\b)|(?-u:\b)[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)+(?::[A-Za-z0-9._-]+|@sha256:[0-9a-fA-F]{64})(?-u:\b)|(?:context|ctx|namespace|ns)[=:][[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:--context|--namespace|-n)[=:[:space:]]*[A-Za-z0-9][A-Za-z0-9._-]*|(?:[a-z0-9](?:[-a-z0-9]*[a-z0-9])?\.)+[a-z0-9](?:[-a-z0-9]*[a-z0-9])?/[A-Za-z0-9][A-Za-z0-9_.-]*(?:[=:][[:space:]]*[A-Za-z0-9_.:/-]+)?|(?-u:\b)[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:/-]+(?-u:\b)|(?-u:\b)[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.svc(?:\.cluster\.local)?(?-u:\b)|(?:\[[0-9A-Fa-f:]+\]|(?:[A-Za-z0-9-]+\.)+[A-Za-z0-9-]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}):[0-9]{1,5}''; in { @@ -53,13 +53,13 @@ in regex = generalRegex; } - # Kubernetes and Gardener copy hints: resources, selectors, - # annotations, contexts, namespaces, endpoints, and images. + # Kubernetes and Gardener copy hints: images, Shoot technical IDs, + # selectors, annotations, contexts, namespaces, and endpoints. { action = "Copy"; - binding = kubernetesBinding; + binding = platformBinding; post_processing = true; - regex = kubernetesRegex; + regex = platformRegex; } ]; diff --git a/modules/nixos/roles/k3s/zfs.nix b/modules/nixos/roles/k3s/zfs.nix index c4a7c5be..f5623de2 100644 --- a/modules/nixos/roles/k3s/zfs.nix +++ b/modules/nixos/roles/k3s/zfs.nix @@ -38,11 +38,13 @@ in done echo "Loading encryption key for $pool from $key_source" + # Refuse an unverified nixberry host key; accepting a new key here + # would allow a network attacker to impersonate the key server. while true; do if key="$(${pkgs.openssh}/bin/ssh \ -o BatchMode=yes \ -o ConnectTimeout=10 \ - -o StrictHostKeyChecking=accept-new \ + -o StrictHostKeyChecking=yes \ "$key_source" ulock-agent get)"; then break fi From 105d4a90b17ff8df7b241d6d2ed2684d07a95788 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 18:56:25 +0200 Subject: [PATCH 62/71] lel --- modules/home/cli/core/default.nix | 104 ++++++++++++++---------------- 1 file changed, 50 insertions(+), 54 deletions(-) diff --git a/modules/home/cli/core/default.nix b/modules/home/cli/core/default.nix index 06f2f6dd..41a64c1c 100644 --- a/modules/home/cli/core/default.nix +++ b/modules/home/cli/core/default.nix @@ -1,73 +1,69 @@ { - config, - lib, pkgs, ... }: { - home.packages = - builtins.attrValues { - # Core utility - inherit (pkgs) - coreutils - dnsutils - gnumake - gnutar - gzip - unzip - gnused - gnugrep - killall - pciutils - parallel + home.packages = builtins.attrValues { + # Core utility + inherit (pkgs) + coreutils + dnsutils + gnumake + gnutar + gzip + unzip + gnused + gnugrep + killall + pciutils + parallel - # Inspection - htop + # Inspection + htop - # Network tools - inetutils - curl - wget + # Network tools + inetutils + curl + wget - # Network inspection - termshark - nmap - netcat - tcpdump - iproute2 + # Network inspection + termshark + nmap + netcat + tcpdump + iproute2 - # Text processing - jq - yq-go - gawk + # Text processing + jq + yq-go + gawk - # Find utils - fd - ripgrep + # Find utils + fd + ripgrep - # Copy tools - rclone + # Copy tools + rclone - # SSH / Security - openssh - libfido2 - keepassxc - sops + # SSH / Security + openssh + libfido2 + keepassxc + sops - # Clipboard - wl-clipboard + # Clipboard + wl-clipboard - # AI Shit - codex - claude-code - nodejs + # AI Shit + codex + claude-code + nodejs - # Monitor / I2C com - ddcutil + # Monitor / I2C com + ddcutil - ; - } - ++ lib.optional config.roles.work pkgs.gcc; + ; + }; programs = { bat.enable = true; fzf = { From da614806f380278d5c755297566f8536fd850996 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 20:05:45 +0200 Subject: [PATCH 63/71] add gaming --- hosts/zion/default.nix | 1 + modules/nixos/roles/gaming/default.nix | 42 ++++++++++++-------------- 2 files changed, 21 insertions(+), 22 deletions(-) diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index 90cef8ed..ce86d10e 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -35,6 +35,7 @@ roles = { desktop = true; + gaming.enable = true; }; }; diff --git a/modules/nixos/roles/gaming/default.nix b/modules/nixos/roles/gaming/default.nix index ad8d2e4f..9a69466c 100644 --- a/modules/nixos/roles/gaming/default.nix +++ b/modules/nixos/roles/gaming/default.nix @@ -8,40 +8,38 @@ let cfg = config.hostConfig.roles.gaming; in { - options.hostConfig.roles.gaming = lib.mkEnableOption "Enable NixOS gaming environment."; + options.hostConfig.roles.gaming = { + enable = lib.mkEnableOption "NixOS gaming environment."; - config = lib.mkIf cfg { - services.ratbagd.enable = true; # Daemon to configure gaming mice, GUI piper comes through HM. + mouse.enable = lib.mkEnableOption "ratbagd and Piper support for compatible gaming mice."; + }; + + config = lib.mkIf cfg.enable { + services.ratbagd.enable = cfg.mouse.enable; programs = { - gamemode.enable = true; # Performance increase through niceness while gaming. - gamescope.enable = true; # Wayland steam-compositor + gamemode.enable = true; + gamescope = { + enable = true; + capSysNice = true; + }; steam = { enable = true; - package = pkgs.steam.override { - extraPkgs = - p: - builtins.attrValues { - inherit (p) - gamemode - mangohud # Fps widget ingame - ; - }; + extraPackages = builtins.attrValues { + inherit (pkgs) gamemode mangohud; }; gamescopeSession.enable = true; - # Compatiblility tools accessable for steam extraCompatPackages = builtins.attrValues { inherit (pkgs) proton-ge-bin; }; + protontricks.enable = true; }; }; - environment.systemPackages = builtins.attrValues { - inherit (pkgs) - adwsteamgtk # Gnome theme for steam - winetricks # DLL libary collection - ; - inherit (pkgs.wineWowPackages) waylandFull; # OpenSouce implementation of WinAPI - }; + environment.systemPackages = + builtins.attrValues { + inherit (pkgs) lutris umu-launcher; + } + ++ lib.optionals cfg.mouse.enable [ pkgs.piper ]; }; } From 2dc9201d525df221611d681f5a1e9e3ecc78ccc0 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 20:15:59 +0200 Subject: [PATCH 64/71] remove sops --- .sops.yaml | 12 -------- docs/new-host.md | 33 ---------------------- flake.lock | 21 -------------- flake.nix | 6 ---- hosts/zion/default.nix | 2 -- hosts/zion/home.nix | 5 ---- modules/home/cli/core/default.nix | 1 - modules/home/services/default.nix | 1 - modules/home/services/sops.nix | 43 ---------------------------- modules/nixos/system/default.nix | 1 - modules/nixos/system/sops.nix | 47 ------------------------------- secrets/common/ssh.yaml | 38 ------------------------- 12 files changed, 210 deletions(-) delete mode 100644 .sops.yaml delete mode 100644 modules/home/services/sops.nix delete mode 100644 modules/nixos/system/sops.nix delete mode 100644 secrets/common/ssh.yaml diff --git a/.sops.yaml b/.sops.yaml deleted file mode 100644 index d9792794..00000000 --- a/.sops.yaml +++ /dev/null @@ -1,12 +0,0 @@ -keys: - users: - - &rap_zion age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf - - &kubex age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr - - &firefly age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp -creation_rules: - - path_regex: secrets/common/ssh.yaml$ - key_groups: - - age: - - *rap_zion - - *kubex - - *firefly diff --git a/docs/new-host.md b/docs/new-host.md index 459cbbad..216726d2 100644 --- a/docs/new-host.md +++ b/docs/new-host.md @@ -3,42 +3,9 @@ Create host directory with `hardware-configuration.nix` & `default.nix`, configuring NixOS modules via the `system` option. -## Sops-nix - -In order to access secrets via `sops-nix`, this repo uses an `age` identity file by default. For a YubiKey-backed -setup, point the host at an `age-plugin-yubikey` identity file instead. - -This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`: - -- NixOS hosts get them from `modules/nixos/system/sops.nix` -- standalone Home Manager hosts get them from `modules/home/services/sops.nix` -- hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files - -``` -# Install the tools needed for a YubiKey-backed age identity. -services.pcscd.enable = true; -environment.systemPackages = with pkgs; [ - age - age-plugin-yubikey -]; - -# Generate a YubiKey identity and use it in the host config. -age-plugin-yubikey --generate \ - --name swiss \ - --slot 82 \ - --pin-policy once \ - --touch-policy cached \ - > ~/.config/sops/age/yubikey-identity.txt - -# The corresponding recipient can then be added to `.sops.yaml`. -age-plugin-yubikey --list -``` - ## Github action There are Github Actions, to check and build every host against a `PR`. For each new host there needs to be config for the pipeline. -# TODO(docs): Add sops-nix docs, add & edit secrets - # TODO(docs): Add workdevice manual steps, ppa hyprland and uwsm diff --git a/flake.lock b/flake.lock index 741026b0..0fc125ea 100644 --- a/flake.lock +++ b/flake.lock @@ -845,30 +845,9 @@ "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_4", "pre-commit-hooks": "pre-commit-hooks_3", - "sops-nix": "sops-nix", "tflow": "tflow" } }, - "sops-nix": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1783174389, - "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", - "owner": "mic92", - "repo": "sops-nix", - "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", - "type": "github" - }, - "original": { - "owner": "mic92", - "repo": "sops-nix", - "type": "github" - } - }, "systems": { "locked": { "lastModified": 1689347949, diff --git a/flake.nix b/flake.nix index c1019e4f..8058e6a2 100644 --- a/flake.nix +++ b/flake.nix @@ -18,10 +18,6 @@ neonix = { url = "github:rapsnx/neonix"; }; - sops-nix = { - url = "github:mic92/sops-nix"; - inputs.nixpkgs.follows = "nixpkgs"; - }; krewfile = { url = "github:brumhard/krewfile"; inputs.nixpkgs.follows = "nixpkgs"; @@ -76,7 +72,6 @@ nixosModules = [ inputs.catppuccin.nixosModules.catppuccin - inputs.sops-nix.nixosModules.sops inputs.niri.nixosModules.niri (inputs.import-tree.match ".*/default\\.nix" ./modules/nixos) ./modules/nix.nix @@ -87,7 +82,6 @@ inputs.neonix.homeManagerModules.neonix inputs.krewfile.homeManagerModules.krewfile inputs.tflow.homeManagerModules.default - inputs.sops-nix.homeManagerModules.sops inputs.niri.homeModules.niri (inputs.import-tree.match ".*/default\\.nix" ./modules/home) ./modules/nix.nix diff --git a/hosts/zion/default.nix b/hosts/zion/default.nix index ce86d10e..2de9cd39 100644 --- a/hosts/zion/default.nix +++ b/hosts/zion/default.nix @@ -55,8 +55,6 @@ environment = { systemPackages = [ - pkgs.age - pkgs.age-plugin-yubikey pkgs.qt6.qtwayland ]; diff --git a/hosts/zion/home.nix b/hosts/zion/home.nix index 7a8167f8..8f9a58fc 100644 --- a/hosts/zion/home.nix +++ b/hosts/zion/home.nix @@ -11,11 +11,6 @@ stateVersion = lib.mkDefault "22.05"; }; - sops.age = { - generateKey = false; - keyFile = "${config.home.homeDirectory}/.config/sops/age/yubikey-identity.txt"; - }; - roles = { work = false; email = "mail@rapsn.me"; diff --git a/modules/home/cli/core/default.nix b/modules/home/cli/core/default.nix index 41a64c1c..cc80dce7 100644 --- a/modules/home/cli/core/default.nix +++ b/modules/home/cli/core/default.nix @@ -49,7 +49,6 @@ openssh libfido2 keepassxc - sops # Clipboard wl-clipboard diff --git a/modules/home/services/default.nix b/modules/home/services/default.nix index 099be714..a699bd63 100644 --- a/modules/home/services/default.nix +++ b/modules/home/services/default.nix @@ -1,7 +1,6 @@ { imports = [ ./ssh.nix - ./sops.nix ./tray.nix ./keyring.nix ./nextcloud.nix diff --git a/modules/home/services/sops.nix b/modules/home/services/sops.nix deleted file mode 100644 index 88c5eac4..00000000 --- a/modules/home/services/sops.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - lib, - config, - ... -}: -lib.mkIf (config ? targets && config.targets ? genericLinux && config.targets.genericLinux.enable) { - sops = { - age = { - generateKey = lib.mkDefault true; - keyFile = lib.mkDefault "${config.home.homeDirectory}/.config/sops/age/keys.txt"; - }; - - defaultSopsFile = ../../../secrets/common/ssh.yaml; - - # TODO: Use this on firefly when adding it to the key - # secrets = { - # ssh_config = { - # path = "${config.home.homeDirectory}/.ssh/config"; - # mode = "0600"; - # }; - # - # swiss = { - # path = "${config.home.homeDirectory}/.ssh/swiss"; - # mode = "0600"; - # }; - # - # "swiss.pub" = { - # path = "${config.home.homeDirectory}/.ssh/swiss.pub"; - # mode = "0644"; - # }; - # - # yubi = { - # path = "${config.home.homeDirectory}/.ssh/yubi"; - # mode = "0600"; - # }; - # - # "yubi.pub" = { - # path = "${config.home.homeDirectory}/.ssh/yubi.pub"; - # mode = "0644"; - # }; - # }; - }; -} diff --git a/modules/nixos/system/default.nix b/modules/nixos/system/default.nix index ad8e35be..89a3a136 100644 --- a/modules/nixos/system/default.nix +++ b/modules/nixos/system/default.nix @@ -4,7 +4,6 @@ ./boot.nix ./user.nix ./locale.nix - ./sops.nix ./zsh.nix ]; } diff --git a/modules/nixos/system/sops.nix b/modules/nixos/system/sops.nix deleted file mode 100644 index 468d9c76..00000000 --- a/modules/nixos/system/sops.nix +++ /dev/null @@ -1,47 +0,0 @@ -{ - lib, - config, - ... -}: -lib.mkIf (config.hostConfig.user.name != "root") { - sops = { - age = { - generateKey = lib.mkDefault false; - keyFile = lib.mkDefault "/home/${config.hostConfig.user.name}/.config/sops/age/keys.txt"; - }; - - defaultSopsFile = ../../../secrets/common/ssh.yaml; - - secrets = { - ssh_config = { - path = "/home/${config.hostConfig.user.name}/.ssh/config"; - owner = config.hostConfig.user.name; - mode = "0600"; - }; - - swiss = { - path = "/home/${config.hostConfig.user.name}/.ssh/swiss"; - owner = config.hostConfig.user.name; - mode = "0600"; - }; - - "swiss.pub" = { - path = "/home/${config.hostConfig.user.name}/.ssh/swiss.pub"; - owner = config.hostConfig.user.name; - mode = "0644"; - }; - - yubi = { - path = "/home/${config.hostConfig.user.name}/.ssh/yubi"; - owner = config.hostConfig.user.name; - mode = "0600"; - }; - - "yubi.pub" = { - path = "/home/${config.hostConfig.user.name}/.ssh/yubi.pub"; - owner = config.hostConfig.user.name; - mode = "0644"; - }; - }; - }; -} diff --git a/secrets/common/ssh.yaml b/secrets/common/ssh.yaml deleted file mode 100644 index e7af406f..00000000 --- a/secrets/common/ssh.yaml +++ /dev/null @@ -1,38 +0,0 @@ -ssh_config: ENC[AES256_GCM,data:jy99anNQWbZG41aa6HeTdGsKsjDWg2B72RTQk2MmeLlhQhBOMn4639G4ibkWFlCTkmRtz+XCHTiuUUnvChLxtFz7/osGGpKmBr6mVBG78Hftbf97UP88Ydt5zOLWRIb2U1i5dzLxiLFfbYl0bVKd7DHrsM9KLRlWtpGOJ2WW1Qubg1MrXjQc0Wcv/hYjoLfysyNYeBRAHDmuAVlsqrWvXT/hs11xHxLeyBU1NjkmdKjtQ54y6yoS4bYbMAXa2WDsM1iZVsrBvadkOn+/C02QWI/nugPb5ycTaWLbu342ixBrDyyvZkmX+HHkR0h4yjqDGfYT62be4lTn3iyFjNno/VgORat8VTFzBubpnpm+AfhdG+4EqqBu5sJejZbGTIa0kfkfTG0pCzLNvh1HyvO38Ccjluhx8pbSHdlbK0Gj0Lu1+WMVxlXCYNTTJWKuS3isZhtA6Mk5HJNwpdQZo8XD2OJGKWQKLPHmp/K4x7HfLmRYyB+p+EPfT/CMFisYVKiQZle0tHq5aQ0czzeZpXSwi4J06UF3W2hPLMN2Eup9bRF8gg39+6gh5Ceji7RCqc9iw/CVUdq7KvlR1tky7jQP8VRrFUAjMYm8dy8Lrmbs/BT0kDlqkaReIHpSXJn2z19O86Si7yEEbLIyUWEaMhzW4lEkbel6X6ZOc8SRIlDak7JcPSagDDZo1LTjgDvyzQNkfEV4v2JKJTVNI+bqXzC34ss5sUs0cHSwWeQ7ja88ef4Fe74ySea/unt7qbkzkdzWg9i4jfPRA/clZ7CYSpLU0v5/H3zijZbrGmsgskVsJHUHxptsgzkFI4eu4ISeQUyiP3IjkfmL4UEVO4dvpNFBa1kourh0FyEfvN1hb1C3Vg18i1ltvj8kCUntmXGHMJxz7idSPP8Hl/dYG+y8fWa45cvgDRVs+bNm50qr2zyPLOpIdRt8hPFLKGFJT3113h1D/BAn2765kbO3jZ7KGG6wVIitEYwgmPitq41C3rIa+J+tYANQ47rK82nyacnRCVphnZl6hsd7LNtrDx+BkLNoM7BPpKK2i4yml1v9amgqWRc58y3e8X797AGCkJZJroqytdXmamuAUlc9kZ0VTI7YXDJuIg3ysll5Hv61Zg1eW6m/NZqsy0fHfMJmpDFvyqF4gATqN3Rfsdn5YFv7hF6VY5Q=,iv:oAOfe0qlOanFFgH4CjKtHYPAUujM4xid+U3zKQhtJbI=,tag:mxYZxlsv/WLQYRGdoeh+9g==,type:str] -swiss: ENC[AES256_GCM,data:zDBhSsPOguZuD6Kx+rMYR9KAjXxycbjXMhL5MZabZShKV+1ICZBsfnWOnBcfxX281hXf2K/TNbphC3KLnTaV0+Ti43BKunSDJp8qyEKgG3xsd7Zf8/i/eMQJygMphCF3XvJJjc3wBEUf/mZ1ObJKYueqtTdSZzx4orR6X93Vdt13GgFJLaX4/8XYsAeBXf4RwYD5gsVjg2QI0t48vnvlU0xN6oFvJAYedvyxgPL3z1pGv+0k/85XtaCfy38LQ5ddOYGxH+XKDzCfkskhd3X6cUeMbDfLrelGwvTB967wHAulgilBR1ObhV1SoUiz6K1a1PRy9XjuzwTbFG8fjFrGk+9yJtucFp1Vgtf6L+pgLxc5HzkC+f9tEldslJQC6y1045s/OWp+ghL+auzFuJGhDuq8JJUSF9Pk0LeDOb67wIrW+2250PTYJbINk2Sdo09Bj7GUCCBkrDHT+IcA/qF0saQ25QTE/BtPLEMiPhwgkYAhrL1uz7s6+HfuUiFPKY0jOn0q0xTxfV00G+wGJFp7,iv:uZxwZQZhmBKUQnAPuf6NFk9TRWH16PmVu5RoTmmxN9Y=,tag:hbvkjfxuSUM2MOyrUzhDrg==,type:str] -swiss.pub: ENC[AES256_GCM,data:wGUgxBYiTu0PcDSK/wNgIfdFyOIuqXkr7cOkXDkN3TdccYa/Lsa1qhm5ZXfVpktQE00oVLEHF8hnJfLUfPgOb44XfwhoWUFIdJRDokLSZoLwT/zlOqzEgJ1o1QZxm73xO5wFG1ns4+Fl2Jz5HJ55U3FHMP88B/UY5hYw6vNXfxcpPGbMOA==,iv:tdXPLgImFmEcMiqBSYMzTWFWbK2+5DKdvRyg+luEE0U=,tag:RsEI/YH0z8LW6f1cGhf68g==,type:str] -yubi: ENC[AES256_GCM,data:cUO0Yf06ZCIDXe6XBAvHcF+4/rFz3iC8rkgWKtyp5e8nJ80jXF9U00g8zns1yfnRG92QfHNH9hewDepSjkNY/j3SjhUbJynKjJpMTxZURVURJtrVwVbtlN/PvPyffxjolEFzzjM62wCNUCtF4lSZn1p8RQ/G38MI3wTP2JSAOFn4cA2nvJ5rL1vs05pElBfT19hDUfImFR4L5A7Q/bkfIpO7bO0D2qBbiCO6NI0epYXPUp0yize2+hu1mDPCLPIL29P3q7ycVJAXFqxyTvweo72qY7he1dqNEKu/hIFDuHMS+n9fhzf6Qn+5eJcljMofeYLXcLQn57TtUMFkiMRc9t50sip/S0DuPrFO87zf7FZYeHaRKs35gKktVPKl3Vgb+On6BO3A4oU1Ru/EiCdRiYL8d7yTKe9CcU7Hghz41ToAH6PEvx+uCFNvWvmIOlTfGHCik4uwPa35H/aUzLAd736AtcrjyNfvISx6MdtbS83+UFi+clM6ZDvLn/YShEBiipWzJuhK6ZjVq47kDxKFW1ym6ybihL/c+dXS7NcNigkJgpEpZMuFvPDyk/thmyhE3GgBExC/Lms=,iv:XmGbA9MElvTgd4cyjtPAy7uKC0GTqpQksX/8UBl1r+k=,tag:Ox8HK8XVRFGc8CYcnwKn5w==,type:str] -yubi.pub: ENC[AES256_GCM,data:MdT+SaIQ4Uf+7SXPTE9dKo9pLdfP299qUSeg5XITB5APs7jOleh6VIZXXamitYm9YQLHrwIZJdTql66SfNyRp0YbkEbd5VGBYKSkHj1taDqFoEG8HCv9DTBj/CiNEimrVcbAFU4zgc6S4jAbY4C3WIDiJ2+GsNjZJgIKOtYwCVKxheRW,iv:TwkpyyiFvOtiKxrtcxn6vgP5yCfW/1bDRGUpCSrJw84=,tag:+1YVdIqiY5VQnfOJK1Syzw==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VHNVeE1hWWw2K3RDTEdv - UXlyMHRuVVhtSHF1VVRkcEE5VFNFcVFDelRNCkJSd1hwWXZNSWE4MWxLeEhWNmdw - bUg4S0ptSW1MZTV2NVlweUdyTFhGVEkKLS0tIHJuYWI2YjkrVU5LSU44MHZrYVVq - OHp6dUlaVkh3SGlJVUdIbkFvQVBJMWcKyivsQOeFIt19FqMdNrwphoUbbVmHZEL0 - auPp4D2lfZeN+qThhSqlL7gwAMgYII07Bxy+zdfRzDgZG4Vu9wSkOw== - -----END AGE ENCRYPTED FILE----- - recipient: age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdG1RRGFMbk11KzJBMnU2 - YW1GeFBzYUVURDlsenFldlZ5Q0FxUHdCU0RZCnIvUnlmKzlzSUtMVzlMSHVib2Zp - eEl0dlRNZlpqWTVKQVV1N2pVcTZwazQKLS0tIDM0Q1pMNFhVVlRoSDRkOUVnd0JI - cHVTZmpYcjk5ZTBMT09wbkNEY05hSlEKsDWV8a0HjyOgpusWHVKEkmt8yKAofVTD - LWmnHHwKMmORSke7Sv2w8HnLc3yBMJ7kIXdqzNL+qoD8ntxI/LkxaQ== - -----END AGE ENCRYPTED FILE----- - recipient: age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsRnJ1Nkw2bXQwSUYxR29i - cGsweXpKNEFObUROVjU4TmtJWjhib2ZuckRvCkg5MHkwdVlnQnBYMmpseEhxMXI3 - Rm5tMmpFSzd6ZEZTWW5IWW1zWC9JL2sKLS0tIFpSc1EvckhuVTdqOFBia0RkTjBl - N0Y2anMzSm9mU1ZnZU9wN3h2Q0lud3cKKB3WZzhBM2scG0tBDa+QOxt9IcHFQw9T - 4QAZU7kwgzEZuAOty9OYvsSa2ArFlhMxF1SPasO1iBgeQG8PL7ifIg== - -----END AGE ENCRYPTED FILE----- - recipient: age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp - lastmodified: "2026-06-28T14:28:58Z" - mac: ENC[AES256_GCM,data:9ImIbWTSPIhFpgx+DhICpgTF2feJ9tlikEdlbpEMz5d9zpxHq4O2zxJwmUg8m547lhz5EN9ZwT+Al002DR2396n+tg6NsLCbUNMcf2BelW+2EWSsEPt3tNzazEW4EQIKHWS4y1FPXnQBpPtXPNHBuhWabMwCICk8uD2TFe+snL0=,iv:a0ZbRl6GqbOcSkUvavi0lTQkFEUcK1kgKWtVO1o0kRc=,tag:bL9M9kw7Q/o1K/+pYgRSFA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.1 From 66724ef0e52671e585e0f96de304a6612362dc45 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 20:34:23 +0200 Subject: [PATCH 65/71] ssh --- hosts/kubex/default.nix | 2 ++ hosts/nixberry/default.nix | 1 + hosts/vinox/default.nix | 2 ++ modules/nixos/services/default.nix | 1 + modules/nixos/services/ssh.nix | 23 +++++++++++++++++++++++ modules/nixos/system/user.nix | 1 - 6 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 modules/nixos/services/ssh.nix diff --git a/hosts/kubex/default.nix b/hosts/kubex/default.nix index 200e3a08..597d9181 100644 --- a/hosts/kubex/default.nix +++ b/hosts/kubex/default.nix @@ -27,6 +27,8 @@ roles = { k3s = true; }; + + services.ssh = true; }; networking = { diff --git a/hosts/nixberry/default.nix b/hosts/nixberry/default.nix index aec94dd4..1df3d727 100644 --- a/hosts/nixberry/default.nix +++ b/hosts/nixberry/default.nix @@ -20,6 +20,7 @@ boot.enable = false; services = { + ssh = true; tailscale = true; }; }; diff --git a/hosts/vinox/default.nix b/hosts/vinox/default.nix index 4e0f7d02..9f6906b3 100644 --- a/hosts/vinox/default.nix +++ b/hosts/vinox/default.nix @@ -25,6 +25,8 @@ extraOptions = { }; extraGroups = [ ]; }; + + services.ssh = true; }; networking.hostName = "vinox"; diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix index 3f00e110..1783a191 100644 --- a/modules/nixos/services/default.nix +++ b/modules/nixos/services/default.nix @@ -7,5 +7,6 @@ ./tailscale.nix ./printer.nix ./bluetooth.nix + ./ssh.nix ]; } diff --git a/modules/nixos/services/ssh.nix b/modules/nixos/services/ssh.nix new file mode 100644 index 00000000..da5babb9 --- /dev/null +++ b/modules/nixos/services/ssh.nix @@ -0,0 +1,23 @@ +{ + lib, + config, + ... +}: +let + cfg = config.hostConfig.services.ssh; +in +{ + options.hostConfig.services.ssh = lib.mkEnableOption "OpenSSH server"; + + config = lib.mkIf cfg { + services.openssh = { + enable = true; + settings = { + PubkeyAuthentication = true; + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + PermitRootLogin = "prohibit-password"; + }; + }; + }; +} diff --git a/modules/nixos/system/user.nix b/modules/nixos/system/user.nix index 7566bfc6..958484cf 100644 --- a/modules/nixos/system/user.nix +++ b/modules/nixos/system/user.nix @@ -44,7 +44,6 @@ in "/share/zsh" # autocompletion "/share/xdg-desktop-portal" ]; - services.openssh.enable = true; nix.optimise.automatic = true; system.stateVersion = "24.11"; }; From c3dd204824de7988db8cbc3b7b8624ea5c9af771 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 21:03:51 +0200 Subject: [PATCH 66/71] lul --- .../home/desktops/addons/kanshi/default.nix | 42 +++++++++++++++++++ modules/home/desktops/hyprland/default.nix | 11 ++++- modules/home/services/ssh.nix | 13 ++++++ 3 files changed, 65 insertions(+), 1 deletion(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 2566b878..93c5990a 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -1,3 +1,35 @@ +{ lib, pkgs, ... }: +let + wallpapers = builtins.concatStringsSep " " ( + map toString [ + ../../../../../extra/wallpapers/anime-city.jpg + ../../../../../extra/wallpapers/gohan-supersaiyan.png + ../../../../../extra/wallpapers/luffy-gear-5.jpg + ../../../../../extra/wallpapers/minimal-space.jpg + ../../../../../extra/wallpapers/one-piece-logo.jpg + ] + ); + + shuffleWallpaper = pkgs.writeShellApplication { + name = "shuffle-wallpaper"; + runtimeInputs = [ + pkgs.coreutils + pkgs.hyprland + ]; + text = '' + [ -n "''${HYPRLAND_INSTANCE_SIGNATURE:-}" ] || exit 0 + sleep 1 + hyprctl hyprpaper wallpaper "$1,$(shuf -n 1 -e ${wallpapers}),cover" + ''; + }; + + randomWallpaper = + monitor: + lib.escapeShellArgs [ + "${shuffleWallpaper}/bin/shuffle-wallpaper" + monitor + ]; +in { services.kanshi = { enable = true; @@ -15,6 +47,7 @@ { profile = { name = "undocked"; + exec = randomWallpaper "eDP-1"; outputs = [ { criteria = "eDP-1"; @@ -26,6 +59,7 @@ { profile = { name = "office"; + exec = randomWallpaper "DP-1"; outputs = [ { # TODO: test this connector, may overload this config with all possible connectors @@ -46,6 +80,10 @@ { profile = { name = "home-firefly"; + exec = [ + (randomWallpaper "desc:Dell Inc. AW2725Q G2QC174") + (randomWallpaper "desc:Samsung Electric Company LC27G7xT H4ZNC00167") + ]; outputs = [ { criteria = "Dell Inc. AW2725Q G2QC174"; @@ -70,6 +108,10 @@ { profile = { name = "home"; + exec = [ + (randomWallpaper "desc:Dell Inc. AW2725Q G2QC174") + (randomWallpaper "desc:Samsung Electric Company LC27G7xT H4ZNC00167") + ]; outputs = [ { criteria = "Dell Inc. AW2725Q G2QC174"; diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index 6538001a..c8256c51 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -50,7 +50,16 @@ in catppuccin.hyprland.enable = false; catppuccin.hyprlock.enable = false; - services.hyprpaper.enable = true; + services.hyprpaper = { + enable = true; + settings.wallpaper = [ + { + monitor = ""; + path = toString ../../../../extra/wallpapers/minimal-space.jpg; + fit_mode = "cover"; + } + ]; + }; # xdg.configFile."hypr/xdph.conf".text = '' # screencopy { diff --git a/modules/home/services/ssh.nix b/modules/home/services/ssh.nix index 2d8cb2b8..604c3df5 100644 --- a/modules/home/services/ssh.nix +++ b/modules/home/services/ssh.nix @@ -1,3 +1,16 @@ +{ config, ... }: +let + sensitiveSshDir = "${config.home.homeDirectory}/Nextcloud/Home/Sensitive/.ssh"; + linkFromSensitiveSsh = config.lib.file.mkOutOfStoreSymlink; +in { services.ssh-agent.enable = true; + + home.file = { + ".ssh/config".source = linkFromSensitiveSsh "${sensitiveSshDir}/config"; + ".ssh/swiss".source = linkFromSensitiveSsh "${sensitiveSshDir}/swiss"; + ".ssh/swiss.pub".source = linkFromSensitiveSsh "${sensitiveSshDir}/swiss.pub"; + ".ssh/yubi".source = linkFromSensitiveSsh "${sensitiveSshDir}/yubi"; + ".ssh/yubi.pub".source = linkFromSensitiveSsh "${sensitiveSshDir}/yubi.pub"; + }; } From 1bb4f92d4422aab5d1b5937edde85e01fcde6efb Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 21:31:18 +0200 Subject: [PATCH 67/71] gaming --- README.md | 1 + docs/gaming.md | 58 ++++++++++++++++++++++++++ hosts/zion/home.nix | 4 ++ modules/nixos/roles/gaming/default.nix | 4 ++ 4 files changed, 67 insertions(+) create mode 100644 docs/gaming.md diff --git a/README.md b/README.md index a113cc32..fa211bd3 100644 --- a/README.md +++ b/README.md @@ -78,6 +78,7 @@ sudo nixos-install --flake .#zion ## :open_book: Docs +- [Gaming and Battle.net](./docs/gaming.md) - [Hyprland - Keymap](./docs/hyprland.md#keymap) - [NVIM - Keymap](https://github.com/RAPSNX/neonix/tree/main/docs/keymap.md) diff --git a/docs/gaming.md b/docs/gaming.md new file mode 100644 index 00000000..6cb207a0 --- /dev/null +++ b/docs/gaming.md @@ -0,0 +1,58 @@ +# Gaming and Battle.net + +`hostConfig.roles.gaming.enable` installs Steam, Lutris, UMU, Gamescope, and +GameMode. Steam owns the Proton 11+ runtime; Home Manager links that runtime to +UMU so it can launch Lutris games without downloading a second copy. + +## One-time Steam Runtime setup + +Run these commands as `rap` after enabling the gaming role. Steam Runtime 4.0 +is Steam tool `4183110` and is required by Proton 11+. + +```sh +steam steam://install/4183110 +``` + +Wait for Steam to finish the download, then verify the runtime exists: + +```sh +runtime="$HOME/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4" +test -f "$runtime/toolmanifest.vdf" && test -f "$runtime/mtree.txt.gz" \ + && echo "Steam Runtime 4 is ready" +``` + +Remove any incomplete runtime that UMU created before activating the Home +Manager link: + +```sh +rm -rf "$HOME/.local/share/umu/steamrt4" +``` + +From this repository, apply the system and home configurations: + +```sh +nh os switch . +nh home switch . +``` + +Start a new graphical session, then confirm that UMU resolves to Steam's +runtime: + +```sh +readlink -f "$HOME/.local/share/umu/steamrt4" +``` + +The command should print +`$HOME/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4`. + +## Battle.net + +Open Lutris, select **+** → **Search the Lutris website for installers**, and +install the standard Battle.net entry into a new Lutris-managed directory such +as `~/Games/battlenet`. Do not run the Battle.net installer manually with +`wine` or set `WINEPREFIX` yourself. + +If UMU reports an HTTP 403 while checking for runtime updates, the valid linked +Steam runtime is still used. A `FileNotFoundError` for +`steamrt4/toolmanifest.vdf` means the Steam Runtime bootstrap or Home Manager +link is incomplete. diff --git a/hosts/zion/home.nix b/hosts/zion/home.nix index 8f9a58fc..3d118b55 100644 --- a/hosts/zion/home.nix +++ b/hosts/zion/home.nix @@ -11,6 +11,10 @@ stateVersion = lib.mkDefault "22.05"; }; + # UMU uses Steam's Proton 11+ runtime instead of maintaining a second copy. + xdg.dataFile."umu/steamrt4".source = + config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/.local/share/Steam/steamapps/common/SteamLinuxRuntime_4"; + roles = { work = false; email = "mail@rapsn.me"; diff --git a/modules/nixos/roles/gaming/default.nix b/modules/nixos/roles/gaming/default.nix index 9a69466c..9dc8a4ab 100644 --- a/modules/nixos/roles/gaming/default.nix +++ b/modules/nixos/roles/gaming/default.nix @@ -17,6 +17,10 @@ in config = lib.mkIf cfg.enable { services.ratbagd.enable = cfg.mouse.enable; + # Steam owns the runtime used by Proton 11+. Prevent UMU from attempting to + # replace that runtime through its separate updater. + environment.sessionVariables.UMU_RUNTIME_UPDATE = "0"; + programs = { gamemode.enable = true; gamescope = { From b0d1a7c778f1fc2bc62fdadc1b85425c006138d9 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Sun, 26 Jul 2026 21:39:11 +0200 Subject: [PATCH 68/71] Update docs --- docs/{ => guides}/bootstrap.md | 3 -- docs/guides/dual-boot.md | 31 ++++++++++++++ docs/{ => guides}/gaming.md | 0 docs/{ => guides}/new-host.md | 0 docs/{ => hosts}/firefly.md | 0 docs/{k3s.md => hosts/kubex.md} | 0 docs/misc.md | 67 ------------------------------- docs/{ => reference}/hyprland.md | 0 docs/{ => reference}/monitors.md | 0 docs/reference/neonix-flake.md | 20 +++++++++ docs/{ => reference}/nix-lang.md | 0 docs/{ => reference}/structure.md | 0 12 files changed, 51 insertions(+), 70 deletions(-) rename docs/{ => guides}/bootstrap.md (61%) create mode 100644 docs/guides/dual-boot.md rename docs/{ => guides}/gaming.md (100%) rename docs/{ => guides}/new-host.md (100%) rename docs/{ => hosts}/firefly.md (100%) rename docs/{k3s.md => hosts/kubex.md} (100%) delete mode 100644 docs/misc.md rename docs/{ => reference}/hyprland.md (100%) rename docs/{ => reference}/monitors.md (100%) create mode 100644 docs/reference/neonix-flake.md rename docs/{ => reference}/nix-lang.md (100%) rename docs/{ => reference}/structure.md (100%) diff --git a/docs/bootstrap.md b/docs/guides/bootstrap.md similarity index 61% rename from docs/bootstrap.md rename to docs/guides/bootstrap.md index 92c716de..ced5678b 100644 --- a/docs/bootstrap.md +++ b/docs/guides/bootstrap.md @@ -4,6 +4,3 @@ ### PWAs Manually installed `PWAs` in `Chromium`: - todoist - -## Firefly -Look into [./firefly.md](Firefly bootstrap) diff --git a/docs/guides/dual-boot.md b/docs/guides/dual-boot.md new file mode 100644 index 00000000..a916e9de --- /dev/null +++ b/docs/guides/dual-boot.md @@ -0,0 +1,31 @@ +# Dual-boot +If reinstall / install `zion` or a workstation with dual-boot, follow this order: + +1. Install `Windows` first, create the correct partitions while running the installer. +Ensure that the bootloader partition is big enough. +2. Next boot into `NixOS` live and install `NixOS` with the bootloader partition from windows. +// TODO: Add / Update this to use directly `nixos-install`? + +# Dual-boot entry lost +When updating the `BIOS` the `nvram` gets cleared, resulting in a lost boot entry for `NixOS`. +This can not be fixed by simply boot into live-system and rebuild the bootloader like written in the public docs. +Follow this procedure to recreate the `nvram` boot-entry again: + +1. Boot into `NixOS` live system using the `vinox` iso. +2. Mount and `chroot` into the main system. + +```bash +sudo -i # Sudo is needed for every action + +mount /dev/nvme0n1p{X} /mnt # mount root system +mount /dev/nvme0n1p{X} /mnt/boot # mount bootloader + +nixos-enter +NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot # not sure if this is needed + +sudo efibootmgr --create \ + --disk /dev/nvme0n1 \ # Disk not partition + --part 1 \ + --label "NixOS" \ + --loader '\EFI\systemd\systemd-bootx64.efi' \ # Mind the backslashes +``` diff --git a/docs/gaming.md b/docs/guides/gaming.md similarity index 100% rename from docs/gaming.md rename to docs/guides/gaming.md diff --git a/docs/new-host.md b/docs/guides/new-host.md similarity index 100% rename from docs/new-host.md rename to docs/guides/new-host.md diff --git a/docs/firefly.md b/docs/hosts/firefly.md similarity index 100% rename from docs/firefly.md rename to docs/hosts/firefly.md diff --git a/docs/k3s.md b/docs/hosts/kubex.md similarity index 100% rename from docs/k3s.md rename to docs/hosts/kubex.md diff --git a/docs/misc.md b/docs/misc.md deleted file mode 100644 index e49b05a9..00000000 --- a/docs/misc.md +++ /dev/null @@ -1,67 +0,0 @@ -# Dual-boot -If reinstall / install `zion` or a workstation with dual-boot, follow this order: - -1. Install `Windows` first, create the correct partitions while running the installer. -Ensure that the bootloader partition is big enough. -2. Next boot into `NixOS` live and install `NixOS` with the bootloader partition from windows. -// TODO: Add / Update this to use directly `nixos-install`? - -# Dual-boot entry lost -When updating the `BIOS` the `nvram` gets cleared, resulting in a lost boot entry for `NixOS`. -This can not be fixed by simply boot into live-system and rebuild the bootloader like written in the public docs. -Follow this procedure to recreate the `nvram` boot-entry again: - -1. Boot into `NixOS` live system using the `vinox` iso. -2. Mount and `chroot` into the main system. - -```bash -sudo -i # Sudo is needed for every action - -mount /dev/nvme0n1p{X} /mnt # mount root system -mount /dev/nvme0n1p{X} /mnt/boot # mount bootloader - -nixos-enter -NIXOS_INSTALL_BOOTLOADER=1 /nix/var/nix/profiles/system/bin/switch-to-configuration boot # not sure if this is needed - -sudo efibootmgr --create \ - --disk /dev/nvme0n1 \ # Disk not partition - --part 1 \ - --label "NixOS" \ - --loader '\EFI\systemd\systemd-bootx64.efi' \ # Mind the backslashes -``` - -## Monitor setup - -All possible monitor configurations are configured via `kanshi`, which maches automatically the correct profile. -They configured for exact matches, not only monitor outputs. - -## Nix follows - -``` - neonix = { - url = "github:rgroemmer/neonix/plugin-enhancement"; - inputs.nixpkgs.follows = "nixpkgs"; - }; -``` - -This will follow the actual flakes `nixpkgs`, neonix by itself uses `nixvim` from its own inputs, which is not part -of `nixpkgs`. -If the flakes `nixpkgs` is to new, plugins and packages from it will be "to new" for the rather outdated `nixvim` from neonix repo. -This can lead to problems starting nvim, this can be fixed by update the `neonix` flake accordingly. -> There is also a nix (lix?) bug, which does not update the `flake.lock` when a follows is removed. - -## Neonix - -`neonix` needs to have its own `nixpkgs`, so no `nixpkgs.follows` is configured. -Instead this should be updated on its own, because if nixpkgs in dotfiles is to new, all dependencies and plugins of -nvim may not work anymore with the `neonix` upstream configuration. - -## Monitor / Workspace setup - -`kanshi` is used to match all possible desktop / office setups via profiles. -These profiles have the primary and secondary display configured, and will execute a script to adapt the workspace pinning. -This will write its config to `~/.config/hypr/workspaces.conf`, same as `nwg-desktop`. -`nwg-desktop` can still be used for both monitor and workspace dynamic configuration. - -**To actually change the monitor config, the `kanshi` systemd service needs to be stopped.** - diff --git a/docs/hyprland.md b/docs/reference/hyprland.md similarity index 100% rename from docs/hyprland.md rename to docs/reference/hyprland.md diff --git a/docs/monitors.md b/docs/reference/monitors.md similarity index 100% rename from docs/monitors.md rename to docs/reference/monitors.md diff --git a/docs/reference/neonix-flake.md b/docs/reference/neonix-flake.md new file mode 100644 index 00000000..37e3f710 --- /dev/null +++ b/docs/reference/neonix-flake.md @@ -0,0 +1,20 @@ +## Nix follows + +``` + neonix = { + url = "github:rgroemmer/neonix/plugin-enhancement"; + inputs.nixpkgs.follows = "nixpkgs"; + }; +``` + +This will follow the actual flakes `nixpkgs`, neonix by itself uses `nixvim` from its own inputs, which is not part +of `nixpkgs`. +If the flakes `nixpkgs` is to new, plugins and packages from it will be "to new" for the rather outdated `nixvim` from neonix repo. +This can lead to problems starting nvim, this can be fixed by update the `neonix` flake accordingly. +> There is also a nix (lix?) bug, which does not update the `flake.lock` when a follows is removed. + +## Neonix + +`neonix` needs to have its own `nixpkgs`, so no `nixpkgs.follows` is configured. +Instead this should be updated on its own, because if nixpkgs in dotfiles is to new, all dependencies and plugins of +nvim may not work anymore with the `neonix` upstream configuration. diff --git a/docs/nix-lang.md b/docs/reference/nix-lang.md similarity index 100% rename from docs/nix-lang.md rename to docs/reference/nix-lang.md diff --git a/docs/structure.md b/docs/reference/structure.md similarity index 100% rename from docs/structure.md rename to docs/reference/structure.md From 9488075f7e73e740ac8f103f35578e4b5d1ee49d Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 27 Jul 2026 10:24:28 +0200 Subject: [PATCH 69/71] nix update --- dev-shells.nix | 1 + docs/guides/flake-update.md | 0 flake.lock | 72 ++++++++++++++++++------------------- hosts/firefly/home.nix | 6 ++-- 4 files changed, 40 insertions(+), 39 deletions(-) create mode 100644 docs/guides/flake-update.md diff --git a/dev-shells.nix b/dev-shells.nix index 850a268c..9c5de6e9 100644 --- a/dev-shells.nix +++ b/dev-shells.nix @@ -34,6 +34,7 @@ in deadnix nixfmt nix-inspect + nix-tree ; inherit diff --git a/docs/guides/flake-update.md b/docs/guides/flake-update.md new file mode 100644 index 00000000..e69de29b diff --git a/flake.lock b/flake.lock index 0fc125ea..dcc73478 100644 --- a/flake.lock +++ b/flake.lock @@ -20,11 +20,11 @@ ] }, "locked": { - "lastModified": 1782073106, - "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=", + "lastModified": 1784368054, + "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457", + "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0", "type": "github" }, "original": { @@ -38,11 +38,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1783674541, - "narHash": "sha256-vmUhEF/jBCZJeK0dInOls+HOAR0yiiQusN1+FZKaJss=", + "lastModified": 1784366307, + "narHash": "sha256-VKatYOZwLQ+MuNkWH6/gZYxrNeSK1Mqb7mC0H1WSu+M=", "owner": "catppuccin", "repo": "nix", - "rev": "96799f24cf1366fe88e1293c3d27521a8f2129cf", + "rev": "673f730d0fc8db3468c51575f1d3d777cc55e51f", "type": "github" }, "original": { @@ -166,11 +166,11 @@ ] }, "locked": { - "lastModified": 1784129366, - "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=", + "lastModified": 1785119578, + "narHash": "sha256-3VMVuOJ6fK+RNOXVmqusqUwQ1sDfPeddNKaM2JR/4Y0=", "owner": "nix-community", "repo": "home-manager", - "rev": "165228b0efefc3e635e5174020c40ea64271dc25", + "rev": "e83dffa86cccb6237fe194d4eeb47f41557749d1", "type": "github" }, "original": { @@ -277,11 +277,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1784303676, - "narHash": "sha256-yjLMggvtVM67XDngpjIGZnmM8uGEjYXHHN+z+UP6F4I=", + "lastModified": 1785081751, + "narHash": "sha256-0vZbjVqutPmzfAQjNv9QJ/GhvTaeCG+Hh6gfyBNU/s8=", "owner": "hyprwm", "repo": "hyprland", - "rev": "4afc273db287ad4069cc8ab3edff4a09c31d3410", + "rev": "d8dc50309c551cfa44fee70744397311b8b7c5fc", "type": "github" }, "original": { @@ -323,11 +323,11 @@ ] }, "locked": { - "lastModified": 1782563850, - "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=", + "lastModified": 1784196523, + "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178", + "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0", "type": "github" }, "original": { @@ -454,11 +454,11 @@ ] }, "locked": { - "lastModified": 1783002634, - "narHash": "sha256-xGqHIUK0wIZoW7SiMalwvO6uGOO/VrlQwoRobpE7dDI=", + "lastModified": 1784323413, + "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "41fb809557abd29a57151b6e1aaeabd05f9437e1", + "rev": "5f03477ab3a005ff27c527486f551883535aea2f", "type": "github" }, "original": { @@ -605,11 +605,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1784686714, - "narHash": "sha256-6HCWRBQq/U2NPY2msnnysnWczZYzEzhS1UZURmrr2f0=", + "lastModified": 1785133905, + "narHash": "sha256-cXE11IuEJe+Oqk+gnNIxUSfHW+ekrc8Mx48pNv0RvuI=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "4dfd38bad6150c07be6cc3fd7682787765092eea", + "rev": "81b9856c2f1f5a425e5048219c0899cb48c52d3f", "type": "github" }, "original": { @@ -656,11 +656,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1784310968, - "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=", + "lastModified": 1784723954, + "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "779c32a00155994c86cde8213a8dd4df139d4355", + "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd", "type": "github" }, "original": { @@ -730,11 +730,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1784120854, - "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=", + "lastModified": 1785090369, + "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46", + "rev": "624af665418d3c65d544145b4d34ad696439570e", "type": "github" }, "original": { @@ -776,11 +776,11 @@ ] }, "locked": { - "lastModified": 1783008725, - "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=", + "lastModified": 1784288435, + "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe", + "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9", "type": "github" }, "original": { @@ -902,11 +902,11 @@ ] }, "locked": { - "lastModified": 1784753614, - "narHash": "sha256-o+wcNoHf3osmjglOY+VouUqnAzdoDB+ZLgY99w4BFgQ=", + "lastModified": 1785086276, + "narHash": "sha256-fG2j5/tn89K7MOd2eTPO9GmzrVAflZJPaUzkzwWfuVQ=", "owner": "rapsnx", "repo": "tflow", - "rev": "9bddddb1d89a89965af68240006535a1672eb55e", + "rev": "4895dc509ce11bf3002409899aacd0c88b7bbedb", "type": "github" }, "original": { @@ -943,11 +943,11 @@ ] }, "locked": { - "lastModified": 1782644412, - "narHash": "sha256-/iSa/bL1QQFLv+uJ9gI0N87J8gOeZXvca7EjoPGKE6w=", + "lastModified": 1784371182, + "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "c01c99fc278ec68c82e9865923088f043c7c1621", + "rev": "08d99f727944dd15e4740090305e31c5fb92a50a", "type": "github" }, "original": { diff --git a/hosts/firefly/home.nix b/hosts/firefly/home.nix index 81982d2f..222d1118 100644 --- a/hosts/firefly/home.nix +++ b/hosts/firefly/home.nix @@ -39,7 +39,7 @@ }; niri = { - enable = true; + enable = false; autostart = [ "sleep 3 && mumble" # Need to sleep for tray icon "firefox" @@ -48,7 +48,7 @@ }; sway = { - enable = true; + enable = false; autostart = [ "sleep 3 && mumble" # Need to sleep for tray icon "firefox" @@ -69,7 +69,7 @@ home.packages = builtins.attrValues { inherit (pkgs) stackit-cli - openstackclient-full + openstackclient vault-bin brightnessctl ; From e35f24020c2da18f25aa024ee0dbade60418128d Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Mon, 27 Jul 2026 14:39:44 +0200 Subject: [PATCH 70/71] Update monitors --- .../home/desktops/addons/kanshi/default.nix | 42 ------------------- modules/home/desktops/hyprland/default.nix | 20 +++++++++ modules/home/programs/default.nix | 1 + 3 files changed, 21 insertions(+), 42 deletions(-) diff --git a/modules/home/desktops/addons/kanshi/default.nix b/modules/home/desktops/addons/kanshi/default.nix index 93c5990a..2566b878 100644 --- a/modules/home/desktops/addons/kanshi/default.nix +++ b/modules/home/desktops/addons/kanshi/default.nix @@ -1,35 +1,3 @@ -{ lib, pkgs, ... }: -let - wallpapers = builtins.concatStringsSep " " ( - map toString [ - ../../../../../extra/wallpapers/anime-city.jpg - ../../../../../extra/wallpapers/gohan-supersaiyan.png - ../../../../../extra/wallpapers/luffy-gear-5.jpg - ../../../../../extra/wallpapers/minimal-space.jpg - ../../../../../extra/wallpapers/one-piece-logo.jpg - ] - ); - - shuffleWallpaper = pkgs.writeShellApplication { - name = "shuffle-wallpaper"; - runtimeInputs = [ - pkgs.coreutils - pkgs.hyprland - ]; - text = '' - [ -n "''${HYPRLAND_INSTANCE_SIGNATURE:-}" ] || exit 0 - sleep 1 - hyprctl hyprpaper wallpaper "$1,$(shuf -n 1 -e ${wallpapers}),cover" - ''; - }; - - randomWallpaper = - monitor: - lib.escapeShellArgs [ - "${shuffleWallpaper}/bin/shuffle-wallpaper" - monitor - ]; -in { services.kanshi = { enable = true; @@ -47,7 +15,6 @@ in { profile = { name = "undocked"; - exec = randomWallpaper "eDP-1"; outputs = [ { criteria = "eDP-1"; @@ -59,7 +26,6 @@ in { profile = { name = "office"; - exec = randomWallpaper "DP-1"; outputs = [ { # TODO: test this connector, may overload this config with all possible connectors @@ -80,10 +46,6 @@ in { profile = { name = "home-firefly"; - exec = [ - (randomWallpaper "desc:Dell Inc. AW2725Q G2QC174") - (randomWallpaper "desc:Samsung Electric Company LC27G7xT H4ZNC00167") - ]; outputs = [ { criteria = "Dell Inc. AW2725Q G2QC174"; @@ -108,10 +70,6 @@ in { profile = { name = "home"; - exec = [ - (randomWallpaper "desc:Dell Inc. AW2725Q G2QC174") - (randomWallpaper "desc:Samsung Electric Company LC27G7xT H4ZNC00167") - ]; outputs = [ { criteria = "Dell Inc. AW2725Q G2QC174"; diff --git a/modules/home/desktops/hyprland/default.nix b/modules/home/desktops/hyprland/default.nix index c8256c51..cbbd778d 100644 --- a/modules/home/desktops/hyprland/default.nix +++ b/modules/home/desktops/hyprland/default.nix @@ -53,6 +53,26 @@ in services.hyprpaper = { enable = true; settings.wallpaper = [ + { + monitor = "eDP-1"; + path = toString ../../../../extra/wallpapers/anime-city.jpg; + fit_mode = "cover"; + } + { + monitor = "DP-1"; + path = toString ../../../../extra/wallpapers/gohan-supersaiyan.png; + fit_mode = "cover"; + } + { + monitor = "desc:Dell Inc. AW2725Q G2QC174"; + path = toString ../../../../extra/wallpapers/luffy-gear-5.jpg; + fit_mode = "cover"; + } + { + monitor = "desc:Samsung Electric Company LC27G7xT H4ZNC00167"; + path = toString ../../../../extra/wallpapers/one-piece-logo.jpg; + fit_mode = "cover"; + } { monitor = ""; path = toString ../../../../extra/wallpapers/minimal-space.jpg; diff --git a/modules/home/programs/default.nix b/modules/home/programs/default.nix index 5e56457c..5602cb1c 100644 --- a/modules/home/programs/default.nix +++ b/modules/home/programs/default.nix @@ -10,6 +10,7 @@ # Screenshot / Recording grimblast wf-recorder + noisetorch # Tools nwg-displays From cb7a0170b2dc8ffacdb5ec1b2524750d9260e607 Mon Sep 17 00:00:00 2001 From: RAPSNX Date: Tue, 28 Jul 2026 10:14:56 +0200 Subject: [PATCH 71/71] update roles --- modules/home/cli/starship/default.nix | 4 --- modules/home/common/roles.nix | 48 +++++++++++++++++++++++---- 2 files changed, 41 insertions(+), 11 deletions(-) diff --git a/modules/home/cli/starship/default.nix b/modules/home/cli/starship/default.nix index b67a0d3e..ec7b44c9 100644 --- a/modules/home/cli/starship/default.nix +++ b/modules/home/cli/starship/default.nix @@ -20,11 +20,7 @@ "$git_branch$git_status" "[](fg:yellow bg:base)" "$git_metrics" - - "$fill" - "$nix_shell" - "$shlvl" "$line_break" diff --git a/modules/home/common/roles.nix b/modules/home/common/roles.nix index 5bc2e338..5e24cd42 100644 --- a/modules/home/common/roles.nix +++ b/modules/home/common/roles.nix @@ -17,8 +17,7 @@ config = let - apparmorRuleGen = app: path: '' - cat </etc/apparmor.d/${app}-nix + apparmorRule = app: path: '' # Warning this is auto-generated apparmor profile via nix. abi , include @@ -26,17 +25,52 @@ profile ${app}-nix ${path} flags=(unconfined) { userns, } - EOF ''; + apparmorRuleGen = app: path: '' + cat </etc/apparmor.d/${app}-nix + ${apparmorRule app path}EOF + ''; + + apparmorProfiles = map (pkg: { + app = pkg.pname; + path = lib.getExe pkg; + content = pkgs.writeText "${pkg.pname}-apparmor-profile" (apparmorRule pkg.pname (lib.getExe pkg)); + }) config.roles.apparmor-gen; + apparmorProfilesGen = lib.strings.concatStrings ( - (map (pkg: apparmorRuleGen pkg.pname (lib.getExe pkg)) config.roles.apparmor-gen) + (map (profile: apparmorRuleGen profile.app profile.path) apparmorProfiles) ++ [ "sudo systemctl reload apparmor" ] ); + + apparmorProfilesChanged = pkgs.writeShellScript "apparmor-profiles-changed" '' + ${lib.strings.concatStringsSep "\n" ( + map (profile: '' + if ! ${lib.getExe' pkgs.diffutils "cmp"} --silent ${profile.content} /etc/apparmor.d/${profile.app}-nix; then + exit 0 + fi + '') apparmorProfiles + )} + exit 1 + ''; + + noisetorchExe = lib.getExe pkgs.noisetorch; + noisetorchCapsSet = pkgs.writeShellScript "noisetorch-caps-set" '' + test "$(${lib.getExe' pkgs.libcap "getcap"} ${noisetorchExe} 2>/dev/null)" = "${noisetorchExe} cap_sys_resource=ep" + ''; in - lib.mkIf (config.roles.apparmor-gen != [ ]) { - home.activation.apparmor-gen = lib.hm.dag.entryAfter [ "writeBoundary" ] '' - run warnEcho "sudo ${pkgs.writeShellScript "apparmor-gen" apparmorProfilesGen}" + lib.mkIf (config.roles.apparmor-gen != [ ] || config.roles.work) { + home.activation.roles = lib.hm.dag.entryAfter [ "writeBoundary" ] '' + ${lib.optionalString (config.roles.apparmor-gen != [ ]) '' + if ${apparmorProfilesChanged}; then + run warnEcho "sudo ${pkgs.writeShellScript "apparmor-gen" apparmorProfilesGen}" + fi + ''} + ${lib.optionalString config.roles.work '' + if ! ${noisetorchCapsSet}; then + run warnEcho "sudo setcap 'CAP_SYS_RESOURCE=+ep' ${noisetorchExe}" + fi + ''} ''; }; }