feat(github): add auto-conventional-commit hook with opencode integration
- Add prepare-commit-msg git hook that generates conventional commit messages - Modularize fish configuration with separate conf.d files - Convert configuration files from .text to .source format for structured data - Add sops-nix SOPS configuration with explicit secret definitions - Upgrade age identity to single key file management approach - Add system activation script for age key management - Generate .sops.yaml for SOPS creation rules - Restructure README.md with improved table and cleaner formatting - Refactor config files to use pkgs.formats.json/toml generators - Implement YAML format for ashell and walker service configurations - Update SSH config source to use sops secrets - Convert zed and other config files to use structured .source format
This commit is contained in:
@@ -0,0 +1,3 @@
|
||||
creation_rules:
|
||||
- path_regex: secrets/secrets\.yaml$
|
||||
age: age1vtlutzzhgsy4ef8jd97jaay30zwygj68jwgn0zx64m2d5u57sqzsngy7lf
|
||||
@@ -1,185 +1,151 @@
|
||||
<p align="center"><img src="https://i.imgur.com/X5zKxvp.png" width=300px></p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://hyprland.org/">
|
||||
<img src="https://img.shields.io/static/v1?label=NIRI&message=latest&style=flat&logo=hyprland&colorA=24273A&colorB=8AADF4&logoColor=CAD3F5"/>
|
||||
</a>
|
||||
<a href="https://github.com/zemmsoares/awesome-rices">
|
||||
<img src="https://raw.githubusercontent.com/zemmsoares/awesome-rices/main/assets/awesome-rice-badge.svg" alt="awesome-rice-badge">
|
||||
<a href="https://github.com/YaLTeR/niri/">
|
||||
<img src="https://img.shields.io/static/v1?label=WM&message=Niri&style=flat&logo=hyprland&colorA=24273A&colorB=8AADF4&logoColor=CAD3F5"/>
|
||||
</a>
|
||||
<a href="https://nixos.wiki/wiki/Flakes">
|
||||
<img src="https://img.shields.io/static/v1?label=Nix-Flake&message=check&style=flat&logo=nixos&colorA=24273A&colorB=9173ff&logoColor=CAD3F5">
|
||||
<img src="https://img.shields.io/static/v1?label=Nix&message=Flakes&style=flat&logo=nixos&colorA=24273A&colorB=9173ff&logoColor=CAD3F5"/>
|
||||
</a>
|
||||
<a href="https://nixos.org/">
|
||||
<img src="https://img.shields.io/badge/NixOS-unstable-informational.svg?style=flat&logo=nixos&logoColor=CAD3F5&colorA=24273A&colorB=8AADF4">
|
||||
<img src="https://img.shields.io/badge/NixOS-unstable-informational.svg?style=flat&logo=nixos&logoColor=CAD3F5&colorA=24273A&colorB=8AADF4"/>
|
||||
</a>
|
||||
</p>
|
||||
|
||||
<h1 align="center">芯 (Shin)</h1>
|
||||
|
||||
### ⚠ <sup><sub><samp>PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP.</samp></sub></sup>
|
||||
**Personal NixOS + Home Manager flake.** Builds for `x86_64-linux` and `aarch64-linux`. Uses [flake-parts](https://flake.parts/).
|
||||
|
||||
> **Note:** Built with [flake-parts](https://flake.parts/). The client
|
||||
> configurations (`desktop`, `laptop`, `tty`) use Home Manager, while the
|
||||
> Hetzner server is isolated on `nixos-24.05`. The flake builds for both
|
||||
> **x86_64-linux** and **aarch64-linux**.
|
||||
| Host | Target | WM | Notes |
|
||||
|------|--------|-----|-------|
|
||||
| `desktop` | x86_64 | Niri | Full graphical |
|
||||
| `laptop` | x86_64 | Niri | Battery, bluetooth, location |
|
||||
| `tty` | x86_64 | — | Headless server |
|
||||
| `hetzner` | x86_64 (24.05) | — | Isolated server, disko + sops-nix |
|
||||
|
||||
---
|
||||
|
||||
<pre align="center"><p align="center"><a href="#seedling--setup">SETUP</a> • <a href="#herb--guides">GUIDES</a> • <a href="#four_leaf_clover--key-bindings">KEYBINDS</a> • <a href="https://linu.dev/kaku">GALLERY</a></p></pre>
|
||||
|
||||
---
|
||||
|
||||
<a href="#octocat--hi-there-thanks-for-dropping-by">
|
||||
<picture>
|
||||
<img alt="" align="right" width="400px" src="/assets/6.png"/>
|
||||
</picture>
|
||||
</a>
|
||||
|
||||
- **Window Manager** • [Niri](https://github.com/YaLTeR/niri/)🎨 Scrolleable WM!
|
||||
- **Shell** • [Fish](https://fishshell.com/) 🐟 with
|
||||
[starship](https://github.com/starship/starship) Cross Shell Platform!
|
||||
- **Terminal** • [Ghostty](https://ghostty.org/) 💻 Powerful Hyped term
|
||||
- **Panel** • [Noctalia!](https://noctalia.dev/) 🍧 Beautiful and minimalist desktop shell
|
||||
- **File Manager** • [Yazi](https://github.com/sxyazi/yazi) 🔖 Rustacean File
|
||||
Manager!
|
||||
- **GUI Basic-IDE** • [Helix](https://docs.helix-editor.com/) ✴️ Rustacean vim
|
||||
version!
|
||||
- **GTK Theme** • [GTK](https://github.com/someone/Colloid-gtk-theme) 🐾 My
|
||||
Fork of colloid
|
||||
|
||||
## 🌼 <samp>INSTALLATION (NixOS)</samp>
|
||||
|
||||
> Request:
|
||||
> [NixOS](https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso)
|
||||
|
||||
This flake targets **both** `x86_64-linux` and `aarch64-linux`, so grab the
|
||||
minimal ISO for your architecture:
|
||||
|
||||
```bash
|
||||
# x86_64
|
||||
wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
|
||||
|
||||
# aarch64 (e.g. Raspberry Pi / ARM boxes)
|
||||
wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso
|
||||
```
|
||||
|
||||
- Boot Into the Installer.
|
||||
|
||||
- Switch to Root: `sudo -i`
|
||||
|
||||
- Partitions:
|
||||
|
||||
_I prefer to use 1GB on the EFI partition. Specifically because the
|
||||
'generations' list may become very long, and to avoid overloading the
|
||||
partition._
|
||||
|
||||
```bash
|
||||
# Replace nvme with your disk partition
|
||||
gdisk /dev/nvme0n1
|
||||
```
|
||||
|
||||
- `o` (create new partition table)
|
||||
- `n` (add partition, 512M, type ef00 EFI)
|
||||
- `n` (add partition, remaining space, type 8300 Linux)
|
||||
`w` (write partition table and exit)
|
||||
|
||||
- Format Partitions:
|
||||
|
||||
```bash
|
||||
mkfs.fat -F 32 -n EFI /dev/nvme0n1p1
|
||||
mkfs.xfs -L NIXOS /dev/nvme0n1p2
|
||||
```
|
||||
|
||||
- Mount Partitions:
|
||||
|
||||
```bash
|
||||
mount /dev/disk/by-label/NIXOS /mnt
|
||||
mkdir -p /mnt/boot
|
||||
mount /dev/disk/by-label/EFI /mnt/boot
|
||||
```
|
||||
|
||||
- Enable nixFlakes
|
||||
|
||||
```bash
|
||||
nix-shell -p nixVersions.stable git
|
||||
```
|
||||
|
||||
- Clone my Dotfiles
|
||||
## Quick Install (with disko — recommended)
|
||||
|
||||
```bash
|
||||
# Boot NixOS minimal ISO, then:
|
||||
sudo -i
|
||||
git clone --depth 1 https://github.com/someone/shin /mnt/etc/nixos
|
||||
```
|
||||
|
||||
- Generate your Own Nix Hardware Settings:
|
||||
# Auto-partition, format, mount (replace 'laptop' with 'desktop'/'tty')
|
||||
nix --extra-experimental-features "nix-command flakes" \
|
||||
run github:nix-community/disko -- \
|
||||
--mode destroy,format,mount /mnt/etc/nixos/hosts/aesthetic/disko-config.nix
|
||||
|
||||
### ⚠ <sup><sub><samp>DON'T FORGET IT</samp></sub></sup>
|
||||
# Generate hardware config
|
||||
nixos-generate-config --dir /mnt/etc/nixos/hosts/aesthetic
|
||||
rm /mnt/etc/nixos/hosts/aesthetic/configuration.nix
|
||||
|
||||
```bash
|
||||
sudo nixos-generate-config --dir /mnt/etc/nixos/hosts/aesthetic
|
||||
|
||||
# Remove configuration.nix
|
||||
rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix
|
||||
```
|
||||
|
||||
- Install Dotfiles Using Flake
|
||||
|
||||
```bash
|
||||
# Move to folder
|
||||
# Install
|
||||
cd /mnt/etc/nixos
|
||||
|
||||
# Install (desktop for a graphical machine, or #laptop)
|
||||
nixos-install --flake .#desktop
|
||||
nixos-install --flake .#laptop
|
||||
```
|
||||
|
||||
- Reboot
|
||||
|
||||
### 🐙 <sup><sub><samp>Remember <strong>Default</strong> User & password are: nixos</samp></sub></sup>
|
||||
|
||||
- Change Default password for User.
|
||||
|
||||
```bash
|
||||
passwd YourUser
|
||||
**BIOS vs UEFI:** Set in `hosts/aesthetic/default.nix`:
|
||||
```nix
|
||||
boot.loader.limine.bootMode = "bios"; # or "uefi"
|
||||
```
|
||||
|
||||
### 🌻 <samp>TODO LIST</samp>
|
||||
---
|
||||
|
||||
### 🧩 <samp>ADDITIONAL TIPS</samp>
|
||||
|
||||
If you're using this NixOS configuration flake locally, you can simplify the process of switching and managing your system using [`nh`](https://github.com/viperML/nh), a CLI helper for Nix Flakes.
|
||||
|
||||
To switch your system configuration with `nh`, use:
|
||||
## Post-Install: Secrets
|
||||
|
||||
```bash
|
||||
# Reboot into new system, then:
|
||||
sops secrets/secrets.yaml
|
||||
# Fill in:
|
||||
# hetzner_server — SSH private key for root@severijnse.eu
|
||||
# gitea_laptop — SSH private key for git@git.severijnse.eu:222
|
||||
# discordo, openrouter, github, twt, gemini, context7, exa — API tokens
|
||||
sudo nixos-rebuild switch --flake /etc/nixos#laptop
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Daily Workflow
|
||||
|
||||
```bash
|
||||
# Rebuild after changes
|
||||
sudo nixos-rebuild switch --flake /etc/nixos#laptop
|
||||
|
||||
# Or with nh (cleaner)
|
||||
NH_FLAKE=/etc/nixos nh os switch
|
||||
|
||||
# Update flake inputs
|
||||
nix flake update --flake /etc/nixos
|
||||
|
||||
# Format Nix code
|
||||
alejandra /etc/nixos
|
||||
```
|
||||
|
||||
This avoids needing to type out the full `nixos-rebuild` command manually and provides a cleaner workflow when iterating on your setup.
|
||||
---
|
||||
|
||||
> 💡 Make sure `nh` is installed in your system environment or user profile.
|
||||
## Key Components
|
||||
|
||||
## 🍀 <samp>KEY BINDINGS</samp>
|
||||
| Layer | Tool | Config |
|
||||
|-------|------|--------|
|
||||
| WM | Niri | `home/window-managers/niri/` |
|
||||
| Shell | Fish + Starship | `home/terminal/shell/` |
|
||||
| Terminal | Ghostty | `home/terminal/emulators/ghostty.nix` |
|
||||
| Panel | Noctalia | `home/services/wayland/noctalia.nix` |
|
||||
| Files | Yazi | `home/terminal/software/yazi.nix` |
|
||||
| Editor | Helix | `home/editors/helix/` |
|
||||
| Secrets | sops-nix (age via SSH host key) | `secrets/secrets.yaml` |
|
||||
| Boot | Limine (BIOS/UEFI) | `system/core/limine.nix` |
|
||||
|
||||
## 💐 <samp>ACKNOWLEDGEMENTS</samp>
|
||||
---
|
||||
|
||||
| | | Inspiration and Resources | | |
|
||||
| :-: | :-: | :------------------------------------------ | :-- | :-: |
|
||||
| | 1 | [owl4ce](https://github.com/owl4ce) | | |
|
||||
| | 2 | [Ilham25](https://github.com/ilham25) | | |
|
||||
| | 3 | [Siduck](https://github.com/siduck) | | |
|
||||
| | 4 | [NvChad](https://github.com/NvChad) | | |
|
||||
| | 5 | [Rxyhn](https://github.com/rxyhn) | | |
|
||||
| | 6 | [HeinzDev](https://github.com/HeinzDev) | | |
|
||||
| | 7 | [fufexan](https://github.com/fufexan) | | |
|
||||
| | 8 | [AmitGolden](https://github.com/AmitGolden) | | |
|
||||
| | | | | |
|
||||
## Flake Structure
|
||||
|
||||
## 🌳 <samp>CONTRIBUTING</samp>
|
||||
```
|
||||
├── flake.nix # Inputs, outputs, perSystem
|
||||
├── hosts/
|
||||
│ ├── default.nix # Host definitions (desktop, laptop, tty, hetzner)
|
||||
│ └── aesthetic/ # Laptop/desktop hardware config
|
||||
├── home/ # Home Manager (user config)
|
||||
│ ├── terminal/ # Shell, emulators, CLI tools
|
||||
│ ├── editors/ # Helix, Zed, Neovim
|
||||
│ ├── window-managers/ # Niri, keybinds
|
||||
│ └── services/ # User systemd services
|
||||
├── system/ # NixOS modules
|
||||
│ ├── core/ # Boot, kernel, security
|
||||
│ └── services/ # System services
|
||||
├── servers/
|
||||
│ └── hetzner/ # Isolated server (24.05, disko, sops)
|
||||
├── secrets/
|
||||
│ ├── secrets.yaml # sops-encrypted (age via SSH host key)
|
||||
│ ├── age.key # Age private key (for sops decryption)
|
||||
│ └── .sops.yaml # sops creation rules
|
||||
└── pkgs/ # Custom packages/overlays
|
||||
```
|
||||
|
||||
WIP
|
||||
---
|
||||
|
||||
## 🎃 <samp>SECURITY POLICY</samp>
|
||||
## sops-nix Details
|
||||
|
||||
<pre align="center">
|
||||
<a href="#readme">BACK TO TOP</a>
|
||||
</pre>
|
||||
- Encrypts `secrets/secrets.yaml` with **age** using the SSH host ed25519 key (`/etc/ssh/ssh_host_ed25519_key`)
|
||||
- Auto-decrypts to `/run/secrets/` at activation
|
||||
- Fish loads secrets from `/run/secrets/` via `home/terminal/shell/fish.nix`
|
||||
- SSH config references `/run/secrets/hetzner_server` and `/run/secrets/gitea_laptop`
|
||||
|
||||
To re-encrypt for a new host key:
|
||||
```bash
|
||||
cd /etc/nixos
|
||||
nix shell nixpkgs#sops -c sops --encrypt --age "$(nix shell nixpkgs#ssh-to-age -c ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub)" secrets/secrets.yaml > secrets/secrets.yaml.new
|
||||
mv secrets/secrets.yaml.new secrets/secrets.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Credits
|
||||
|
||||
Inspired by: [hjem](https://github.com/nix-community/hjem), [owl4ce](https://github.com/owl4ce), [Siduck](https://github.com/siduck), [Rxyhn](https://github.com/rxyhn).
|
||||
|
||||
---
|
||||
|
||||
## License
|
||||
|
||||
MIT — use freely, credits appreciated.
|
||||
Generated
+39
-22
@@ -105,11 +105,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1775087534,
|
||||
"narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
|
||||
"lastModified": 1782949081,
|
||||
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
|
||||
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -164,14 +164,15 @@
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-darwin": "nixpkgs-darwin",
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777607620,
|
||||
"narHash": "sha256-GGMDVvqo1PwAB6/7yZg651VzexqECdliZCKXlM0UDwI=",
|
||||
"lastModified": 1783756748,
|
||||
"narHash": "sha256-hB8uUHBDsaZafd19ilbNVntTzaF7Sr2zGQDDb1tk8pE=",
|
||||
"owner": "schembriaiden",
|
||||
"repo": "helium-browser-nix-flake",
|
||||
"rev": "10105224eea589de8f0b3292f4e4bca3d52f1ee2",
|
||||
"rev": "2efc1e5eaabb81ffcbd66ded45a18bf3aa1c21c5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -203,11 +204,11 @@
|
||||
},
|
||||
"import-tree": {
|
||||
"locked": {
|
||||
"lastModified": 1773693634,
|
||||
"narHash": "sha256-BtZ2dtkBdSUnFPPFc+n0kcMbgaTxzFNPv2iaO326Ffg=",
|
||||
"lastModified": 1778781969,
|
||||
"narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=",
|
||||
"owner": "vic",
|
||||
"repo": "import-tree",
|
||||
"rev": "c41e7d58045f9057880b0d85e1152d6a4430dbf1",
|
||||
"rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -223,11 +224,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777181277,
|
||||
"narHash": "sha256-yVJbd07ortDRAttDFmDV5p220aOLTHgVAx//0nW/xW8=",
|
||||
"lastModified": 1783835045,
|
||||
"narHash": "sha256-yL4Ptl/aH7kJK/4HtLEzpSE40zdMNdXolfgwwGY3bmk=",
|
||||
"owner": "Mic92",
|
||||
"repo": "nix-index-database",
|
||||
"rev": "b8eb7acee0f7604fe1bf6a5b3dcf5254369180fa",
|
||||
"rev": "9b7545740d701a28a6d46de0665a685191205ba1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -254,11 +255,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1777268161,
|
||||
"narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
|
||||
"lastModified": 1783776592,
|
||||
"narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
|
||||
"rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -268,13 +269,29 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"nixpkgs-darwin": {
|
||||
"locked": {
|
||||
"lastModified": 1783522502,
|
||||
"narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
|
||||
"lastModified": 1783707519,
|
||||
"narHash": "sha256-VJ+eK/EB7aIZ246bXjkYalr4YWQAtHRJeh15Qw2LxUs=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
|
||||
"rev": "2b35450a66cf6ee8492099a6eb1903796965d32d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-26.05-darwin",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1783776592,
|
||||
"narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -378,11 +395,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1777612697,
|
||||
"narHash": "sha256-h+tXBNMDrsKbD1UnYw0IeSIT4RalHtIJ1GLOviib7/8=",
|
||||
"lastModified": 1783668749,
|
||||
"narHash": "sha256-EDJjJYGT5pQKTBqmz+OA2sqE20kjj6mP699JFGDzse4=",
|
||||
"owner": "youwen5",
|
||||
"repo": "zen-browser-flake",
|
||||
"rev": "f9f70d14f9a57c7962c5cfe589461c1391044448",
|
||||
"rev": "e8041a3571e8cadb57dc18a3d6362d753510b94a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -5,7 +5,8 @@
|
||||
}: let
|
||||
configFile = "zed/settings.json";
|
||||
languageConfig = import ./_settings.nix {inherit pkgs lib;};
|
||||
settingsJSON = builtins.toJSON ({
|
||||
toJSON = (pkgs.formats.json {}).generate;
|
||||
settingsJSON = toJSON "settings.json" ({
|
||||
node = {
|
||||
path = "${pkgs.nodejs}/bin/node";
|
||||
npm_path = "${pkgs.nodejs}/bin/npm";
|
||||
@@ -145,7 +146,7 @@ in {
|
||||
zedWithLSP
|
||||
];
|
||||
xdg.configFile."${configFile}" = {
|
||||
text = settingsJSON;
|
||||
source = settingsJSON;
|
||||
mutable = true;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
{pkgs, ...}: let
|
||||
configFile = "pipewire/pipewire.conf.d/99-input-denoising.conf";
|
||||
toJSON = (pkgs.formats.json {}).generate;
|
||||
in {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
rnnoise
|
||||
rnnoise-plugin
|
||||
];
|
||||
|
||||
xdg.configFile."${configFile}".text = builtins.toJSON {
|
||||
xdg.configFile."${configFile}".source = toJSON "99-input-denoising.conf" {
|
||||
"context.modules" = [
|
||||
{
|
||||
"name" = "libpipewire-module-filter-chain";
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{}: {
|
||||
{...}: {
|
||||
"XF86AudioPlay" = {
|
||||
_props.allow-when-locked = true;
|
||||
spawn._args = ["playerctl" "play-pause"];
|
||||
|
||||
@@ -1,40 +1,40 @@
|
||||
{pkgs, ...}: {
|
||||
{pkgs, ...}: let
|
||||
toTOML = (pkgs.formats.toml {}).generate;
|
||||
in {
|
||||
users.users.someone.packages = [pkgs.ashell];
|
||||
|
||||
xdg.configFile."ashell/config.toml".text = ''
|
||||
[modules]
|
||||
left = [ [ "appLauncher", "Updates", "Workspaces", "ScreenMirror" ], "MediaPlayer" ]
|
||||
center = [ "WindowTitle" ]
|
||||
right = [ "SystemInfo", [ "Tray", "Clock", "Privacy", "Settings" ] ]
|
||||
|
||||
|
||||
[system_info]
|
||||
indicators = [ "Cpu", "Memory", "Temperature" ]
|
||||
|
||||
[system_info.cpu]
|
||||
warn_threshold = 60
|
||||
alert_threshold = 80
|
||||
|
||||
[system_info.memory]
|
||||
warn_threshold = 70
|
||||
alert_threshold = 85
|
||||
|
||||
[system_info.temperature]
|
||||
warn_threshold = 60
|
||||
alert_threshold = 80
|
||||
|
||||
[tempo]
|
||||
clock_format = "%a %d %b %R"
|
||||
weather_location = { City = "Amsterdam" }
|
||||
|
||||
[appearance]
|
||||
style = "Islands"
|
||||
|
||||
[[ScreenMirror]]
|
||||
name = "ScreenMirror"
|
||||
icon = ""
|
||||
command = "bash /etc/nixos/scripts/screen-mirror.sh"
|
||||
|
||||
|
||||
'';
|
||||
xdg.configFile."ashell/config.toml".source = toTOML "config.toml" {
|
||||
modules = {
|
||||
left = [["appLauncher" "Updates" "Workspaces" "ScreenMirror"] "MediaPlayer"];
|
||||
center = ["WindowTitle"];
|
||||
right = ["SystemInfo" ["Tray" "Clock" "Privacy" "Settings"]];
|
||||
};
|
||||
system_info = {
|
||||
indicators = ["Cpu" "Memory" "Temperature"];
|
||||
cpu = {
|
||||
warn_threshold = 60;
|
||||
alert_threshold = 80;
|
||||
};
|
||||
memory = {
|
||||
warn_threshold = 70;
|
||||
alert_threshold = 85;
|
||||
};
|
||||
temperature = {
|
||||
warn_threshold = 60;
|
||||
alert_threshold = 80;
|
||||
};
|
||||
};
|
||||
tempo = {
|
||||
clock_format = "%a %d %b %R";
|
||||
weather_location = {City = "Amsterdam";};
|
||||
};
|
||||
appearance.style = "Islands";
|
||||
ScreenMirror = [
|
||||
{
|
||||
name = "ScreenMirror";
|
||||
icon = "";
|
||||
command = "bash /etc/nixos/scripts/screen-mirror.sh";
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,29 +1,32 @@
|
||||
{pkgs, ...}: {
|
||||
{pkgs, ...}: let
|
||||
toTOML = (pkgs.formats.toml {}).generate;
|
||||
in {
|
||||
users.users.someone.packages = [pkgs.walker pkgs.elephant];
|
||||
|
||||
xdg.configFile."walker/config.toml".text = ''
|
||||
[keys]
|
||||
launcher = "Mod+Space"
|
||||
|
||||
[keys.quit]
|
||||
quit = "Mod+Shift+Q"
|
||||
reload = "Mod+Shift+R"
|
||||
|
||||
[look]
|
||||
all_monitors = true
|
||||
background = "#1f1d2e"
|
||||
foreground = "#cdd6f4"
|
||||
selection = "#45475a"
|
||||
active = "#89b4fa"
|
||||
urgent = "#f38ba8"
|
||||
alt_background = "#181825"
|
||||
icon_theme = "Papirus-Dark"
|
||||
terminal = "alacritty"
|
||||
|
||||
[look.font]
|
||||
name = "Source Code Pro"
|
||||
size = 14
|
||||
'';
|
||||
xdg.configFile."walker/config.toml".source = toTOML "config.toml" {
|
||||
keys = {
|
||||
launcher = "Mod+Space";
|
||||
quit = {
|
||||
quit = "Mod+Shift+Q";
|
||||
reload = "Mod+Shift+R";
|
||||
};
|
||||
};
|
||||
look = {
|
||||
all_monitors = true;
|
||||
background = "#1f1d2e";
|
||||
foreground = "#cdd6f4";
|
||||
selection = "#45475a";
|
||||
active = "#89b4fa";
|
||||
urgent = "#f38ba8";
|
||||
alt_background = "#181825";
|
||||
icon_theme = "Papirus-Dark";
|
||||
terminal = "alacritty";
|
||||
font = {
|
||||
name = "Source Code Pro";
|
||||
size = 14;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.user.services.elephant = {
|
||||
wantedBy = ["graphical-session.target"];
|
||||
|
||||
@@ -5,56 +5,56 @@
|
||||
export XDG_SESSION_TYPE="wayland"
|
||||
exec ${pkgs.alacritty}/bin/alacritty "$@"
|
||||
'';
|
||||
toTOML = (pkgs.formats.toml {}).generate;
|
||||
in {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
alacritty
|
||||
alacritty-wrapped
|
||||
];
|
||||
|
||||
xdg.configFile."alacritty/alacritty.toml".text = ''
|
||||
[colors.bright]
|
||||
black = "0x928374"
|
||||
blue = "0x7daea3"
|
||||
cyan = "0x89b482"
|
||||
green = "0xa9b665"
|
||||
magenta = "0xd3869b"
|
||||
red = "0xea6962"
|
||||
white = "0xdfbf8e"
|
||||
yellow = "0xe3a84e"
|
||||
|
||||
[colors.normal]
|
||||
black = "0x665c54"
|
||||
blue = "0x7daea3"
|
||||
cyan = "0x89b482"
|
||||
green = "0xa9b665"
|
||||
magenta = "0xd3869b"
|
||||
red = "0xea6962"
|
||||
white = "0xdfbf8e"
|
||||
yellow = "0xe78a4e"
|
||||
|
||||
[colors.primary]
|
||||
background = "0x1f0d00"
|
||||
foreground = "0xdfbf8e"
|
||||
|
||||
[env]
|
||||
EDITOR = "nvim"
|
||||
XDG_CURRENT_DESKTOP = "Niri"
|
||||
XDG_SESSION_TYPE = "wayland"
|
||||
|
||||
[font]
|
||||
size = 13
|
||||
|
||||
[font.normal]
|
||||
family = "SauceCodePro Nerd Font"
|
||||
|
||||
[window]
|
||||
decorations = "full"
|
||||
opacity = 1.0
|
||||
|
||||
[terminal.shell]
|
||||
program = "fish"
|
||||
|
||||
[scrolling]
|
||||
history = 5000
|
||||
'';
|
||||
xdg.configFile."alacritty/alacritty.toml".source = toTOML "alacritty.toml" {
|
||||
colors = {
|
||||
bright = {
|
||||
black = "0x928374";
|
||||
blue = "0x7daea3";
|
||||
cyan = "0x89b482";
|
||||
green = "0xa9b665";
|
||||
magenta = "0xd3869b";
|
||||
red = "0xea6962";
|
||||
white = "0xdfbf8e";
|
||||
yellow = "0xe3a84e";
|
||||
};
|
||||
normal = {
|
||||
black = "0x665c54";
|
||||
blue = "0x7daea3";
|
||||
cyan = "0x89b482";
|
||||
green = "0xa9b665";
|
||||
magenta = "0xd3869b";
|
||||
red = "0xea6962";
|
||||
white = "0xdfbf8e";
|
||||
yellow = "0xe78a4e";
|
||||
};
|
||||
primary = {
|
||||
background = "0x1f0d00";
|
||||
foreground = "0xdfbf8e";
|
||||
};
|
||||
};
|
||||
env = {
|
||||
EDITOR = "nvim";
|
||||
XDG_CURRENT_DESKTOP = "Niri";
|
||||
XDG_SESSION_TYPE = "wayland";
|
||||
};
|
||||
font = {
|
||||
size = 13;
|
||||
normal = {
|
||||
family = "SauceCodePro Nerd Font";
|
||||
};
|
||||
};
|
||||
window = {
|
||||
decorations = "full";
|
||||
opacity = 1.0;
|
||||
};
|
||||
terminal.shell.program = "fish";
|
||||
scrolling.history = 5000;
|
||||
};
|
||||
}
|
||||
|
||||
+110
-97
@@ -7,64 +7,78 @@
|
||||
'')
|
||||
];
|
||||
xdg.configFile = {
|
||||
"fish/config.fish" = {
|
||||
text = ''
|
||||
for secret in discordo openrouter github twt gemini context7 exa
|
||||
if test -f /run/agenix/$secret
|
||||
set -l val (cat /run/agenix/$secret)
|
||||
set -l up (string upper $secret)
|
||||
switch $secret
|
||||
case discordo
|
||||
set -gx DISCORDO_TOKEN $val
|
||||
set -gx OXICORD_TOKEN $val
|
||||
case openrouter gemini context7 exa
|
||||
set -gx "$up"_API_KEY $val
|
||||
case '*'
|
||||
set -gx "$up"_TOKEN $val
|
||||
end
|
||||
# ── Modular fish conf.d ──────────────────────────────────────────────────
|
||||
# Each file under fish/conf.d/ is sourced automatically by fish at startup,
|
||||
# sorted lexicographically. We use numeric prefixes for ordering.
|
||||
|
||||
# 00: Environment variables
|
||||
"fish/conf.d/00-env.fish".text = ''
|
||||
set -gx GNUPGHOME $HOME/.config/gnupg
|
||||
set -gx NIXPKGS_ALLOW_UNFREE 1
|
||||
set -gx NIXPKGS_ALLOW_INSECURE 1
|
||||
set -gx EDITOR nvim
|
||||
set -gx VISUAL nvim
|
||||
set -g fish_greeting
|
||||
'';
|
||||
|
||||
# 01: SOPS secret loader
|
||||
"fish/conf.d/01-secrets.fish".text = ''
|
||||
for secret in discordo openrouter github twt gemini context7 exa
|
||||
if test -f /run/secrets/$secret
|
||||
set -l val (cat /run/secrets/$secret)
|
||||
set -l up (string upper $secret)
|
||||
switch $secret
|
||||
case discordo
|
||||
set -gx DISCORDO_TOKEN $val
|
||||
set -gx OXICORD_TOKEN $val
|
||||
case openrouter gemini context7 exa
|
||||
set -gx "$up"_API_KEY $val
|
||||
case '*'
|
||||
set -gx "$up"_TOKEN $val
|
||||
end
|
||||
end
|
||||
set -gx GNUPGHOME $HOME/.config/gnupg
|
||||
set -gx NIXPKGS_ALLOW_UNFREE 1
|
||||
set -gx NIXPKGS_ALLOW_INSECURE 1
|
||||
set -gx EDITOR nvim
|
||||
set -gx VISUAL nvim
|
||||
set -g fish_greeting
|
||||
# Vi keybindings
|
||||
fish_vi_key_bindings
|
||||
# Custom key bindings function (REQUIRED to properly unbind keys)
|
||||
function fish_user_key_bindings
|
||||
# Custom bindings
|
||||
for mode in insert default
|
||||
bind -M $mode ctrl-backspace backward-kill-word
|
||||
bind -M $mode ctrl-delete kill-word
|
||||
bind -M $mode alt-backspace backward-kill-token
|
||||
bind -M $mode alt-delete kill-token
|
||||
bind -M $mode ctrl-z undo
|
||||
end
|
||||
bind -M insert \cx\ce edit_command_buffer
|
||||
bind -M default \cx\ce edit_command_buffer
|
||||
bind -M default up history-prefix-search-backward
|
||||
bind -M default down history-prefix-search-forward
|
||||
end
|
||||
'';
|
||||
|
||||
# 02: Vi key bindings and cursor shapes
|
||||
"fish/conf.d/02-key-bindings.fish".text = ''
|
||||
fish_vi_key_bindings
|
||||
|
||||
function fish_user_key_bindings
|
||||
for mode in insert default
|
||||
bind -M $mode ctrl-backspace backward-kill-word
|
||||
bind -M $mode ctrl-delete kill-word
|
||||
bind -M $mode alt-backspace backward-kill-token
|
||||
bind -M $mode alt-delete kill-token
|
||||
bind -M $mode ctrl-z undo
|
||||
end
|
||||
# Cursor shapes per mode
|
||||
set fish_cursor_default block
|
||||
set fish_cursor_insert line
|
||||
set fish_cursor_replace_one underscore
|
||||
set fish_cursor_visual block
|
||||
# Syntax colors
|
||||
set -g fish_color_autosuggestion brblack
|
||||
set -g fish_color_command blue
|
||||
set -g fish_color_error red
|
||||
set -g fish_color_param normal
|
||||
# Search highlight
|
||||
set -g fish_color_search_match --background=normal
|
||||
# Plugin settings
|
||||
set -Ux fifc_editor nvim
|
||||
set -U fifc_keybinding \cv
|
||||
set -g __done_min_cmd_duration 10000
|
||||
'';
|
||||
};
|
||||
bind -M insert \cx\ce edit_command_buffer
|
||||
bind -M default \cx\ce edit_command_buffer
|
||||
bind -M default up history-prefix-search-backward
|
||||
bind -M default down history-prefix-search-forward
|
||||
end
|
||||
|
||||
set fish_cursor_default block
|
||||
set fish_cursor_insert line
|
||||
set fish_cursor_replace_one underscore
|
||||
set fish_cursor_visual block
|
||||
'';
|
||||
|
||||
# 03: Syntax highlighting colors
|
||||
"fish/conf.d/03-syntax.fish".text = ''
|
||||
set -g fish_color_autosuggestion brblack
|
||||
set -g fish_color_command blue
|
||||
set -g fish_color_error red
|
||||
set -g fish_color_param normal
|
||||
set -g fish_color_search_match --background=normal
|
||||
'';
|
||||
|
||||
# 04: Plugin settings
|
||||
"fish/conf.d/04-plugins.fish".text = ''
|
||||
set -Ux fifc_editor nvim
|
||||
set -U fifc_keybinding \cv
|
||||
set -g __done_min_cmd_duration 10000
|
||||
'';
|
||||
"fish/functions/extract.fish" = {
|
||||
text = ''
|
||||
function extract
|
||||
@@ -166,47 +180,46 @@
|
||||
end
|
||||
'';
|
||||
};
|
||||
"fish/conf.d/aliases.fish" = {
|
||||
text = ''
|
||||
alias cleanup="sudo nix-collect-garbage --delete-older-than 1d"
|
||||
alias listgen="sudo nix-env -p /nix/var/nix/profiles/system --list-generations"
|
||||
alias nixremove="nix-store --gc"
|
||||
alias bloat="nix path-info -Sh /run/current-system"
|
||||
alias cleanram="sudo sh -c 'sync; echo 3 > /proc/sys/vm/drop_caches'"
|
||||
alias trimall="sudo fstrim -va"
|
||||
alias c="clear"
|
||||
alias add="git add ."
|
||||
alias commit="git commit"
|
||||
alias push="git push"
|
||||
alias pull="git pull"
|
||||
alias diff="git diff --staged"
|
||||
alias gcld="git clone --depth 1"
|
||||
alias koji="meteor"
|
||||
alias gitui="lazygit"
|
||||
alias ls="eza -lah --grid -s modified --smart-group --group-directories-first --icons"
|
||||
alias l="eza -ah --grid -s modified --smart-group --group-directories-first --icons"
|
||||
alias tree="eza --tree --icons --tree"
|
||||
alias cat="${pkgs.bat}/bin/bat --paging=never --theme gruvbox-dark"
|
||||
alias us="systemctl --user"
|
||||
alias rs="sudo systemctl"
|
||||
alias zed="zeditor"
|
||||
alias nl="nl -ba"
|
||||
alias cp="cp -riv"
|
||||
alias mv="mv -iv"
|
||||
alias mkdir="mkdir -pv"
|
||||
alias less="bat -p --theme gruvbox-dark"
|
||||
alias myip="curl ip.severijnse.eu"
|
||||
alias pscpu="ps -eo pid,ppid,cmd,%mem,%cpu,etime --sort=-%cpu | head -n 21"
|
||||
alias psmem="ps -eo pid,ppid,cmd,%mem,%cpu,etime --sort=-%mem | head -n 21"
|
||||
alias weer="weather"
|
||||
alias v="nvim"
|
||||
alias copy="wl-copy"
|
||||
alias send="croc"
|
||||
alias img="loupe"
|
||||
alias cat-md="glow"
|
||||
alias du="dust"
|
||||
alias df="duf"
|
||||
'';
|
||||
};
|
||||
# 05: Aliases
|
||||
"fish/conf.d/05-aliases.fish".text = ''
|
||||
alias cleanup="sudo nix-collect-garbage --delete-older-than 1d"
|
||||
alias listgen="sudo nix-env -p /nix/var/nix/profiles/system --list-generations"
|
||||
alias nixremove="nix-store --gc"
|
||||
alias bloat="nix path-info -Sh /run/current-system"
|
||||
alias cleanram="sudo sh -c 'sync; echo 3 > /proc/sys/vm/drop_caches'"
|
||||
alias trimall="sudo fstrim -va"
|
||||
alias c="clear"
|
||||
alias add="git add ."
|
||||
alias commit="git commit"
|
||||
alias push="git push"
|
||||
alias pull="git pull"
|
||||
alias diff="git diff --staged"
|
||||
alias gcld="git clone --depth 1"
|
||||
alias koji="meteor"
|
||||
alias gitui="lazygit"
|
||||
alias ls="eza -lah --grid -s modified --smart-group --group-directories-first --icons"
|
||||
alias l="eza -ah --grid -s modified --smart-group --group-directories-first --icons"
|
||||
alias tree="eza --tree --icons --tree"
|
||||
alias cat="${pkgs.bat}/bin/bat --paging=never --theme gruvbox-dark"
|
||||
alias us="systemctl --user"
|
||||
alias rs="sudo systemctl"
|
||||
alias zed="zeditor"
|
||||
alias nl="nl -ba"
|
||||
alias cp="cp -riv"
|
||||
alias mv="mv -iv"
|
||||
alias mkdir="mkdir -pv"
|
||||
alias less="bat -p --theme gruvbox-dark"
|
||||
alias myip="curl ip.severijnse.eu"
|
||||
alias pscpu="ps -eo pid,ppid,cmd,%mem,%cpu,etime --sort=-%cpu | head -n 21"
|
||||
alias psmem="ps -eo pid,ppid,cmd,%mem,%cpu,etime --sort=-%mem | head -n 21"
|
||||
alias weer="weather"
|
||||
alias v="nvim"
|
||||
alias copy="wl-copy"
|
||||
alias send="croc"
|
||||
alias img="loupe"
|
||||
alias cat-md="glow"
|
||||
alias du="dust"
|
||||
alias df="duf"
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,7 +5,40 @@
|
||||
}: let
|
||||
configFile = "git/config";
|
||||
ignoreFile = "git/ignore";
|
||||
hooksDir = "git/hooks";
|
||||
toINI = (pkgs.formats.ini {}).generate;
|
||||
|
||||
# Hook that auto-generates a Conventional Commit message from staged diff
|
||||
prepareCommitMsg = pkgs.writeShellScript "prepare-commit-msg" ''
|
||||
# Only run if there are staged changes
|
||||
if git diff --cached --quiet 2>/dev/null; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Generating commit message from staged changes..." >&2
|
||||
|
||||
# Generate Conventional Commit message using opencode run
|
||||
git diff --cached | timeout 30 ${pkgs.opencode}/bin/opencode run \
|
||||
-m opencode/north-mini-code-free \
|
||||
"You are an expert software engineer writing professional Git commit messages.
|
||||
|
||||
Create a clean Conventional Commit for the provided diff.
|
||||
|
||||
Rules:
|
||||
- Format: type(optional scope): imperative description
|
||||
- Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
|
||||
- First line: maximum 72 characters, starts with capital letter, imperative present tense
|
||||
- If relevant, add a blank line followed by a short body explaining the motivation and key changes
|
||||
- Be concise and professional. No emojis, no markdown.
|
||||
|
||||
Output ONLY the commit message. Do not add any extra text, quotes, or explanations." \
|
||||
2>/dev/null > "$1"
|
||||
|
||||
# Fallback if generation failed or timed out
|
||||
if [ ! -s "$1" ]; then
|
||||
echo "chore: auto-generated commit message" > "$1"
|
||||
fi
|
||||
'';
|
||||
in {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
git
|
||||
@@ -36,6 +69,7 @@ in {
|
||||
};
|
||||
core = {
|
||||
editor = "nvim";
|
||||
hooksPath = "${config.xdg.configHome}/git/hooks";
|
||||
pager = "${pkgs.delta}/bin/delta";
|
||||
whitespace = "fix,-indent-with-non-tab,trailing-space,cr-at-eol";
|
||||
excludesFile = "${config.xdg.configHome}/${ignoreFile}";
|
||||
@@ -124,4 +158,6 @@ in {
|
||||
AGENTS.md
|
||||
.sisyphus
|
||||
'';
|
||||
|
||||
xdg.configFile."${hooksDir}/prepare-commit-msg".source = prepareCommitMsg;
|
||||
}
|
||||
|
||||
@@ -31,12 +31,13 @@
|
||||
'';
|
||||
configFile = "opencode/config.json";
|
||||
tuiFile = "opencode/tui.json";
|
||||
toJSON = (pkgs.formats.json {}).generate;
|
||||
in {
|
||||
users.users.someone.packages = [
|
||||
opencodeWrapped
|
||||
];
|
||||
xdg.configFile = {
|
||||
"${configFile}".text = builtins.toJSON {
|
||||
"${configFile}".source = toJSON "config.json" {
|
||||
"$schema" = "https://opencode.ai/config.json";
|
||||
plugin = [
|
||||
"opencode-antigravity-auth@latest"
|
||||
@@ -118,7 +119,7 @@ in {
|
||||
provider = providers.config;
|
||||
};
|
||||
|
||||
"opencode/oh-my-openagent.json".text = builtins.toJSON {
|
||||
"opencode/oh-my-openagent.json".source = toJSON "oh-my-openagent.json" {
|
||||
"$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-openagent/master/assets/oh-my-opencode.schema.json";
|
||||
agents = {
|
||||
"sisyphus-junior" = {model = "opencode/nemotron-3-super-free";};
|
||||
@@ -134,7 +135,7 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
"${tuiFile}".text = builtins.toJSON {
|
||||
"${tuiFile}".source = toJSON "tui.json" {
|
||||
"$schema" = "https://opencode.ai/tui.json";
|
||||
theme = "gruvbox";
|
||||
};
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
];
|
||||
|
||||
xdg.configFile."ssh/config" = {
|
||||
source = config.age.secrets.ssh_config.path;
|
||||
source = config.sops.secrets.ssh_config.path;
|
||||
};
|
||||
|
||||
home.file.".ssh/config" = {
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
{pkgs, ...}: {
|
||||
{pkgs, ...}: let
|
||||
toJSON = (pkgs.formats.json {}).generate;
|
||||
in {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
television
|
||||
nix-search-tv
|
||||
];
|
||||
|
||||
xdg.configFile = {
|
||||
"nix-search-tv/config.json".text = builtins.toJSON {
|
||||
"nix-search-tv/config.json".source = toJSON "config.json" {
|
||||
indexes = ["nixos" "nixpkgs" "nur"];
|
||||
};
|
||||
"fish/completions/tv.fish".source = "${pkgs.television}/share/fish/vendor_completions.d/tv.fish";
|
||||
|
||||
+46
-46
@@ -143,6 +143,10 @@
|
||||
};
|
||||
};
|
||||
|
||||
# Workaround: aa-remove-unknown references missing rc.apparmor.functions in apparmor-parser 5.0.0
|
||||
# Reload via restart instead (stop → start, reloads all profiles)
|
||||
systemd.services.apparmor.reloadIfChanged = lib.mkForce false;
|
||||
|
||||
services = {
|
||||
# for SSD/NVME
|
||||
fstrim.enable = true;
|
||||
@@ -156,52 +160,48 @@
|
||||
|
||||
# Additional systemd hardening
|
||||
systemd = {
|
||||
coredump.extraConfig = ''
|
||||
Storage=none
|
||||
ProcessSizeMax=0
|
||||
'';
|
||||
};
|
||||
|
||||
environment.systemPackages = [pkgs.cryptsetup pkgs.age inputs.agenix.packages.${pkgs.stdenv.hostPlatform.system}.default];
|
||||
|
||||
age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
|
||||
age.secrets = {
|
||||
gitea_laptop = {
|
||||
file = ../../secrets/gitea_laptop.age;
|
||||
mode = "600";
|
||||
owner = "someone";
|
||||
group = "users";
|
||||
};
|
||||
hetzner_server = {
|
||||
file = ../../secrets/hetzner_server.age;
|
||||
mode = "600";
|
||||
owner = "someone";
|
||||
group = "users";
|
||||
};
|
||||
aur = {
|
||||
file = ../../secrets/aur.age;
|
||||
mode = "600";
|
||||
owner = "someone";
|
||||
group = "users";
|
||||
};
|
||||
ssh_config = {
|
||||
file = ../../secrets/ssh_config.age;
|
||||
mode = "600";
|
||||
owner = "someone";
|
||||
group = "users";
|
||||
};
|
||||
github_key = {
|
||||
file = ../../secrets/github_key.age;
|
||||
mode = "600";
|
||||
owner = "someone";
|
||||
group = "users";
|
||||
};
|
||||
sporestack_server = {
|
||||
file = ../../secrets/sporestack_server.age;
|
||||
mode = "600";
|
||||
owner = "someone";
|
||||
group = "users";
|
||||
coredump.settings = {
|
||||
Coredump.Storage = "none";
|
||||
Coredump.ProcessSizeMax = 0;
|
||||
};
|
||||
};
|
||||
|
||||
boot.loader.limine.bootMode = lib.mkDefault "bios";
|
||||
|
||||
# sops-nix configuration
|
||||
sops = {
|
||||
defaultSopsFile = ./../../secrets/secrets.yaml;
|
||||
age.keyFile = "/etc/age/keys.txt";
|
||||
# Explicitly define secrets to ensure they're generated
|
||||
secrets = {
|
||||
discordo = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
openrouter = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
github = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
twt = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
gemini = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
context7 = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
exa = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
ssh_config = { owner = "someone"; group = "users"; mode = "0440"; };
|
||||
gitea_laptop = { owner = "someone"; group = "users"; mode = "0400"; };
|
||||
hetzner_server = { owner = "someone"; group = "users"; mode = "0400"; };
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [pkgs.cryptsetup pkgs.age pkgs.nixd pkgs.apparmor-parser pkgs.xdg-desktop-portal-wlr];
|
||||
|
||||
# Provide age private key for sops decryption at activation time
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /etc/age 0700 root root -"
|
||||
"w /etc/age/keys.txt 0600 root root - # created by activation script"
|
||||
];
|
||||
|
||||
# Activation script to write age key
|
||||
system.activationScripts.write-age-key = ''
|
||||
cat > /etc/age/keys.txt << 'AGEEOF'
|
||||
# created: 2026-07-12T10:20:38+02:00
|
||||
# public key: age1n2kvnwdzrd5vw70wwmm90a4lg6wj3665egzpnz72r98epr0rhc0q3yp356
|
||||
AGE-SECRET-KEY-1A49GYAG5AJWGW0XM7HWC8QFE6UUF0S3Z99T252SKX2JHW6NM0HDQESWAQC
|
||||
AGEEOF
|
||||
chmod 600 /etc/age/keys.txt
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
{lib, ...}: {
|
||||
disko.devices = {
|
||||
disk.main = {
|
||||
device = lib.mkDefault "/dev/nvme0n1";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
esp = {
|
||||
name = "ESP";
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot/efi";
|
||||
};
|
||||
};
|
||||
root = {
|
||||
name = "root";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
+31
-1
@@ -5,6 +5,7 @@
|
||||
}: let
|
||||
# shorten paths
|
||||
inherit (inputs.nixpkgs.lib) nixosSystem;
|
||||
lib = inputs.nixpkgs.lib;
|
||||
# Server uses its own pinned 24.05 nixpkgs (kept isolated from the laptop's unstable)
|
||||
nixosSystem24 = inputs.nixos-24-05.lib.nixosSystem;
|
||||
unstablePkgs = import inputs.nixpkgs-unstable {system = "x86_64-linux";};
|
||||
@@ -23,7 +24,7 @@
|
||||
"${mod}/services/gnome-services.nix"
|
||||
"${mod}/core/limine.nix"
|
||||
"${home}"
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
in {
|
||||
flake.nixosConfigurations = {
|
||||
@@ -50,6 +51,35 @@ in {
|
||||
];
|
||||
};
|
||||
|
||||
# Laptop UEFI: explicit UEFI boot mode
|
||||
laptop-uefi = nixosSystem {
|
||||
inherit specialArgs;
|
||||
modules =
|
||||
laptop
|
||||
++ sharedModules
|
||||
++ [
|
||||
"${mod}/services/location.nix"
|
||||
({ config, ... }: {
|
||||
boot.loader.limine.bootMode = "uefi";
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
# Laptop BIOS: explicit BIOS boot mode
|
||||
laptop-bios = nixosSystem {
|
||||
inherit specialArgs;
|
||||
modules =
|
||||
laptop
|
||||
++ sharedModules
|
||||
++ [
|
||||
"${mod}/services/location.nix"
|
||||
({ config, ... }: {
|
||||
boot.loader.limine.bootMode = "bios";
|
||||
boot.loader.limine.biosDevice = "/dev/nvme0n1";
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
# Server: severijnse.eu (Hetzner) — fully isolated under servers/hetzner/.
|
||||
# Uses nixos-24.05 + disko + sops-nix and does NOT inherit the laptop's shared modules.
|
||||
hetzner = nixosSystem24 {
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# created: 2026-07-12T10:20:38+02:00
|
||||
# public key: age1n2kvnwdzrd5vw70wwmm90a4lg6wj3665egzpnz72r98epr0rhc0q3yp356
|
||||
AGE-SECRET-KEY-1A49GYAG5AJWGW0XM7HWC8QFE6UUF0S3Z99T252SKX2JHW6NM0HDQESWAQC
|
||||
@@ -0,0 +1,25 @@
|
||||
discordo: ""
|
||||
openrouter: ""
|
||||
github: ""
|
||||
twt: ""
|
||||
gemini: ""
|
||||
context7: ""
|
||||
exa: ""
|
||||
gitea_laptop: ""
|
||||
ssh_config: ENC[AES256_GCM,data:TqAUIElmt9nmVC9GuPoo+4/K1VSjxyJdqKe2ra38cJjC66aozIBk5dHyJPgMai/V7jPfYGk366cQUmkE1cvzz/DCw19Xa06YPM2qr93g0FOq0YFu33Vn+33Sx5UAM2QeaTHlIOqqZDBYhJpiOH/5WwCZ/Ai2qInj2G5lH28FiJU5frpImqY2Sq0E6Mhwt3++4+tAcaam+jp1V+PfdcroCULOjpJkbIpNx34TPZPmAtEN/fkkKr6NLj1Jh4RnmdMSW20FHzKSeDKIuDbFdUODRd+jRGo1G6DyujrWV10JrggxR24cfXA15C4nFaEZ6ZHshU1IXoq2msalGqaAHhLetaJaybsWTVpbpkMEozswrkmHiGSHHmq1b6A15i3QVApvFkT02D2Rihs4i3wTPav3zsPdUEUVTGOKI/VQcbJIfckZLZLxLUQjpX+Y62pbsIjtdfF6c/PvCSp5B0+KSZOGvOmZj/RvpDLLeeg5l0tSz5HBaaNPC5LHNuI9Fjabja6EjLhtmZdffOF0yyHjau0AwYYelyjao87gXSz9SuAt5NBvvkB6QifvLJZS6PaNl38OMkDvl1W5n89S8bJVZfmV/1nDZqDdpAPidn0AtT+iKP8As6tuTWnRKATALNqFKMpac3NOAuDWxzB2awhdGBFOJlwjTeepUVZrAbk9sqr9TsNXv8Kr8CyAW59ZL3GmbEik6JN0yuWJioHL4G6TiYbkAK4iIfjhnoyyyUtQhw==,iv:UsyEPs3PbY4rqS2ovBsUUv50ksVUp6UJyKn39i6G5O8=,tag:7s0iZKcLtlUiP7AIP+d5dA==,type:str]
|
||||
hetzner_server: ENC[AES256_GCM,data:Cb/oa7oDO6nsbxEQmqYHqPP6AEqUHQzHc49axXPJWOkvOb4WMAMh93xVdFzdgPIR1MjLusrD0q2azE6gEQtT+qPbhB0A0/RN/DR49U04UGzWAPltDGlJX+0Z01CL34Kvy6lzOeaVgWLD5Uzg628uGNqL3PKHceJI6Q9lWbH9E19jBGOq86ceXerVlzwDQNyLyrT75O3zOXFy3V0OmG0WDi6pI61ReZVx5HZe3nmxkAMTsRjs+FxA/Yr6hZa0QVqczoZ+i/+qI3RBrWxqUko/A6CGWM/PzMkhw9FCVRoMwRANKoaom2MX+DSDIbg1Bg2JvhUR9oxtNRpO9mj0R6wLlFzA31h9tle0q+7pNxW68G9YDhWUFcxcvb/xFjpSJ7C1kfGQJADpLJoIgT+Fo1XvyiyRKwIXDN2wvAGoCF6gtZcVesN/xhMbmLHPOedHdNrUbSNhZGvR4/mzSlmSLkixddI+r9cXbH/VH+rXd0cCOaqcMEv2FmSRW9z1/y9dPZrpdwg88oouSNzVIE0ANxoARyF8x7mEGNwGHBG1,iv:AreeGiJvChbJDqBdR1L0c/7aqqrfcsQ7ApBpg+0hYOQ=,tag:1lnO8QlFad56basn0NpYmg==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- recipient: age1vtlutzzhgsy4ef8jd97jaay30zwygj68jwgn0zx64m2d5u57sqzsngy7lf
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1WUlMWE93cGJxbDY4VzNB
|
||||
VkVMMXFqZTVXaTFXeFNWdHNJUjV2OE84YVZFClhhK0tUQVlSUXF2NWJFVHFKQXF2
|
||||
VUJ5d0t6Um43bmQ5RmExd1QzZ1BxN0EKLS0tIGNnWlZwUkhxbndSRkxia0dFVjVB
|
||||
TnNEOFBIbU5kSWRCSERQR2hPWnJQM1EKvGPbq3jltkJXL6ExowUeuZ6/WYaBuojX
|
||||
XzUaNchtd22IhWB50V4IDyl79gb4y0felRS4qe5LQvnvXnjCTwoqyQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-07-12T08:59:50Z"
|
||||
mac: ENC[AES256_GCM,data:3faasx6fkL6wv9oDDXlxlcbvGIj1D9l2FpkDhYHhyCjN8ZZeRCX4qznos5eLMnDAQUhUZgyvCCXidlHJsYUZcj11p7T0YcGnr+6lzi/p9VkETA2v42BlgXgz0M9nLY0mB6kbAY8JhaJ5fO59DDEhSZRKNgIvzFv2Rv/SoyjpV10=,iv:J1g5R43LOKMSy0V0/cO8eUiuF52ML+2G8gp1WZeOFNM=,tag:PobaSjf5ZPVcNDYmaX02vA==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.2
|
||||
@@ -4,8 +4,6 @@
|
||||
...
|
||||
}: {
|
||||
boot = {
|
||||
bootspec.enable = true;
|
||||
|
||||
initrd.systemd.enable = true;
|
||||
|
||||
supportedFilesystems = ["ntfs"];
|
||||
|
||||
+14
-6
@@ -1,20 +1,28 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
boot.loader = {
|
||||
}: let
|
||||
cfg = config.boot.loader.limine;
|
||||
in {
|
||||
options.boot.loader.limine.bootMode = lib.mkOption {
|
||||
type = lib.types.enum ["bios" "uefi"];
|
||||
default = "uefi";
|
||||
description = "Boot mode: BIOS (MBR) or UEFI";
|
||||
};
|
||||
|
||||
config.boot.loader = {
|
||||
limine = {
|
||||
enable = true;
|
||||
efiSupport = true;
|
||||
biosSupport = true;
|
||||
biosDevice = "/dev/nvme1n1";
|
||||
efiSupport = cfg.bootMode == "uefi";
|
||||
biosSupport = cfg.bootMode == "bios";
|
||||
biosDevice = lib.mkIf (cfg.bootMode == "bios") (lib.mkDefault "/dev/nvme1n1");
|
||||
maxGenerations = 10;
|
||||
style.wallpapers = [
|
||||
pkgs.nixos-artwork.wallpapers.simple-dark-gray-bootloader.gnomeFilePath
|
||||
];
|
||||
};
|
||||
|
||||
grub.enable = lib.mkForce false;
|
||||
systemd-boot.enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
@@ -17,10 +17,10 @@ in {
|
||||
enable = true;
|
||||
config = {
|
||||
common = {
|
||||
default = ["gnome" "gtk"];
|
||||
"org.freedesktop.impl.portal.ScreenCast" = "gnome";
|
||||
"org.freedesktop.impl.portal.Screenshot" = "gnome";
|
||||
"org.freedesktop.impl.portal.RemoteDesktop" = "gnome";
|
||||
default = ["wlr" "gtk"];
|
||||
"org.freedesktop.impl.portal.ScreenCast" = "wlr";
|
||||
"org.freedesktop.impl.portal.Screenshot" = "wlr";
|
||||
"org.freedesktop.impl.portal.RemoteDesktop" = "wlr";
|
||||
"org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
|
||||
"org.freedesktop.impl.portal.OpenURI" = "gtk";
|
||||
# FileChooser covers both OpenFile and SaveFile use-cases
|
||||
@@ -29,7 +29,7 @@ in {
|
||||
};
|
||||
extraPortals = [
|
||||
pkgs.xdg-desktop-portal-gtk
|
||||
pkgs.xdg-desktop-portal-gnome
|
||||
pkgs.xdg-desktop-portal-wlr
|
||||
termfilechooser-niri
|
||||
];
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user