<p align="center">
  <a href="https://github.com/YaLTeR/niri/">
    <img src="https://img.shields.io/static/v1?label=WM&message=Niri&style=flat&logo=hyprland&colorA=24273A&colorB=8AADF4&logoColor=CAD3F5"/>
  </a>
  <a href="https://nixos.wiki/wiki/Flakes">
    <img src="https://img.shields.io/static/v1?label=Nix&message=Flakes&style=flat&logo=nixos&colorA=24273A&colorB=9173ff&logoColor=CAD3F5"/>
  </a>
  <a href="https://nixos.org/">
    <img src="https://img.shields.io/badge/NixOS-unstable-informational.svg?style=flat&logo=nixos&logoColor=CAD3F5&colorA=24273A&colorB=8AADF4"/>
  </a>
</p>

<h1 align="center">芯 (Shin)</h1>

**Personal NixOS + Home Manager flake.** Builds for `x86_64-linux` and `aarch64-linux`. Uses [flake-parts](https://flake.parts/).

| Host | Target | WM | Notes |
|------|--------|-----|-------|
| `desktop` | x86_64 | Niri | Full graphical |
| `laptop` | x86_64 | Niri | Battery, bluetooth, location |
| `tty` | x86_64 | — | Headless server |
| `hetzner` | x86_64 (24.05) | — | Isolated server, disko + sops-nix |

---

## Quick Install (with disko — recommended)

```bash
# Boot NixOS minimal ISO, then:
sudo -i
git clone --depth 1 https://github.com/someone/shin /mnt/etc/nixos

# Auto-partition, format, mount (replace 'laptop' with 'desktop'/'tty')
nix --extra-experimental-features "nix-command flakes" \
  run github:nix-community/disko -- \
  --mode destroy,format,mount /mnt/etc/nixos/hosts/aesthetic/disko-config.nix

# Generate hardware config
nixos-generate-config --dir /mnt/etc/nixos/hosts/aesthetic
rm /mnt/etc/nixos/hosts/aesthetic/configuration.nix

# Install
cd /mnt/etc/nixos
nixos-install --flake .#laptop
```

**BIOS vs UEFI:** Set in `hosts/aesthetic/default.nix`:
```nix
boot.loader.limine.bootMode = "bios";  # or "uefi"
```

---

## Post-Install: Secrets

```bash
# Reboot into new system, then:
sops secrets/secrets.yaml
# Fill in:
#   hetzner_server  — SSH private key for root@severijnse.eu
#   gitea_laptop    — SSH private key for git@git.severijnse.eu:222
#   discordo, openrouter, github, twt, gemini, context7, exa — API tokens
sudo nixos-rebuild switch --flake /etc/nixos#laptop
```

---

## Daily Workflow

```bash
# Rebuild after changes
sudo nixos-rebuild switch --flake /etc/nixos#laptop

# Or with nh (cleaner)
NH_FLAKE=/etc/nixos nh os switch

# Update flake inputs
nix flake update --flake /etc/nixos

# Format Nix code
alejandra /etc/nixos
```

---

## Key Components

| Layer | Tool | Config |
|-------|------|--------|
| WM | Niri | `home/window-managers/niri/` |
| Shell | Fish + Starship | `home/terminal/shell/` |
| Terminal | Ghostty | `home/terminal/emulators/ghostty.nix` |
| Panel | Noctalia | `home/services/wayland/noctalia.nix` |
| Files | Yazi | `home/terminal/software/yazi.nix` |
| Editor | Helix | `home/editors/helix/` |
| Secrets | sops-nix (age via SSH host key) | `secrets/secrets.yaml` |
| Boot | Limine (BIOS/UEFI) | `system/core/limine.nix` |

---

## Flake Structure

```
├── flake.nix              # Inputs, outputs, perSystem
├── hosts/
│   ├── default.nix        # Host definitions (desktop, laptop, tty, hetzner)
│   └── aesthetic/         # Laptop/desktop hardware config
├── home/                  # Home Manager (user config)
│   ├── terminal/          # Shell, emulators, CLI tools
│   ├── editors/           # Helix, Zed, Neovim
│   ├── window-managers/   # Niri, keybinds
│   └── services/          # User systemd services
├── system/                # NixOS modules
│   ├── core/              # Boot, kernel, security
│   └── services/          # System services
├── servers/
│   └── hetzner/           # Isolated server (24.05, disko, sops)
├── secrets/
│   ├── secrets.yaml       # sops-encrypted (age via SSH host key)
│   ├── age.key            # Age private key (for sops decryption)
│   └── .sops.yaml         # sops creation rules
└── pkgs/                  # Custom packages/overlays
```

---

## sops-nix Details

- Encrypts `secrets/secrets.yaml` with **age** using the SSH host ed25519 key (`/etc/ssh/ssh_host_ed25519_key`)
- Auto-decrypts to `/run/secrets/` at activation
- Fish loads secrets from `/run/secrets/` via `home/terminal/shell/fish.nix`
- SSH config references `/run/secrets/hetzner_server` and `/run/secrets/gitea_laptop`

To re-encrypt for a new host key:
```bash
cd /etc/nixos
nix shell nixpkgs#sops -c sops --encrypt --age "$(nix shell nixpkgs#ssh-to-age -c ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub)" secrets/secrets.yaml > secrets/secrets.yaml.new
mv secrets/secrets.yaml.new secrets/secrets.yaml
```

---

## Credits

Inspired by: [hjem](https://github.com/nix-community/hjem), [owl4ce](https://github.com/owl4ce), [Siduck](https://github.com/siduck), [Rxyhn](https://github.com/rxyhn).

---

## License

MIT — use freely, credits appreciated.