jory
205a1ccc8f
- Add prepare-commit-msg git hook that generates conventional commit messages - Modularize fish configuration with separate conf.d files - Convert configuration files from .text to .source format for structured data - Add sops-nix SOPS configuration with explicit secret definitions - Upgrade age identity to single key file management approach - Add system activation script for age key management - Generate .sops.yaml for SOPS creation rules - Restructure README.md with improved table and cleaner formatting - Refactor config files to use pkgs.formats.json/toml generators - Implement YAML format for ashell and walker service configurations - Update SSH config source to use sops secrets - Convert zed and other config files to use structured .source format
151 lines
4.8 KiB
Markdown
151 lines
4.8 KiB
Markdown
<p align="center">
|
|
<a href="https://github.com/YaLTeR/niri/">
|
|
<img src="https://img.shields.io/static/v1?label=WM&message=Niri&style=flat&logo=hyprland&colorA=24273A&colorB=8AADF4&logoColor=CAD3F5"/>
|
|
</a>
|
|
<a href="https://nixos.wiki/wiki/Flakes">
|
|
<img src="https://img.shields.io/static/v1?label=Nix&message=Flakes&style=flat&logo=nixos&colorA=24273A&colorB=9173ff&logoColor=CAD3F5"/>
|
|
</a>
|
|
<a href="https://nixos.org/">
|
|
<img src="https://img.shields.io/badge/NixOS-unstable-informational.svg?style=flat&logo=nixos&logoColor=CAD3F5&colorA=24273A&colorB=8AADF4"/>
|
|
</a>
|
|
</p>
|
|
|
|
<h1 align="center">芯 (Shin)</h1>
|
|
|
|
**Personal NixOS + Home Manager flake.** Builds for `x86_64-linux` and `aarch64-linux`. Uses [flake-parts](https://flake.parts/).
|
|
|
|
| Host | Target | WM | Notes |
|
|
|------|--------|-----|-------|
|
|
| `desktop` | x86_64 | Niri | Full graphical |
|
|
| `laptop` | x86_64 | Niri | Battery, bluetooth, location |
|
|
| `tty` | x86_64 | — | Headless server |
|
|
| `hetzner` | x86_64 (24.05) | — | Isolated server, disko + sops-nix |
|
|
|
|
---
|
|
|
|
## Quick Install (with disko — recommended)
|
|
|
|
```bash
|
|
# Boot NixOS minimal ISO, then:
|
|
sudo -i
|
|
git clone --depth 1 https://github.com/someone/shin /mnt/etc/nixos
|
|
|
|
# Auto-partition, format, mount (replace 'laptop' with 'desktop'/'tty')
|
|
nix --extra-experimental-features "nix-command flakes" \
|
|
run github:nix-community/disko -- \
|
|
--mode destroy,format,mount /mnt/etc/nixos/hosts/aesthetic/disko-config.nix
|
|
|
|
# Generate hardware config
|
|
nixos-generate-config --dir /mnt/etc/nixos/hosts/aesthetic
|
|
rm /mnt/etc/nixos/hosts/aesthetic/configuration.nix
|
|
|
|
# Install
|
|
cd /mnt/etc/nixos
|
|
nixos-install --flake .#laptop
|
|
```
|
|
|
|
**BIOS vs UEFI:** Set in `hosts/aesthetic/default.nix`:
|
|
```nix
|
|
boot.loader.limine.bootMode = "bios"; # or "uefi"
|
|
```
|
|
|
|
---
|
|
|
|
## Post-Install: Secrets
|
|
|
|
```bash
|
|
# Reboot into new system, then:
|
|
sops secrets/secrets.yaml
|
|
# Fill in:
|
|
# hetzner_server — SSH private key for root@severijnse.eu
|
|
# gitea_laptop — SSH private key for git@git.severijnse.eu:222
|
|
# discordo, openrouter, github, twt, gemini, context7, exa — API tokens
|
|
sudo nixos-rebuild switch --flake /etc/nixos#laptop
|
|
```
|
|
|
|
---
|
|
|
|
## Daily Workflow
|
|
|
|
```bash
|
|
# Rebuild after changes
|
|
sudo nixos-rebuild switch --flake /etc/nixos#laptop
|
|
|
|
# Or with nh (cleaner)
|
|
NH_FLAKE=/etc/nixos nh os switch
|
|
|
|
# Update flake inputs
|
|
nix flake update --flake /etc/nixos
|
|
|
|
# Format Nix code
|
|
alejandra /etc/nixos
|
|
```
|
|
|
|
---
|
|
|
|
## Key Components
|
|
|
|
| Layer | Tool | Config |
|
|
|-------|------|--------|
|
|
| WM | Niri | `home/window-managers/niri/` |
|
|
| Shell | Fish + Starship | `home/terminal/shell/` |
|
|
| Terminal | Ghostty | `home/terminal/emulators/ghostty.nix` |
|
|
| Panel | Noctalia | `home/services/wayland/noctalia.nix` |
|
|
| Files | Yazi | `home/terminal/software/yazi.nix` |
|
|
| Editor | Helix | `home/editors/helix/` |
|
|
| Secrets | sops-nix (age via SSH host key) | `secrets/secrets.yaml` |
|
|
| Boot | Limine (BIOS/UEFI) | `system/core/limine.nix` |
|
|
|
|
---
|
|
|
|
## Flake Structure
|
|
|
|
```
|
|
├── flake.nix # Inputs, outputs, perSystem
|
|
├── hosts/
|
|
│ ├── default.nix # Host definitions (desktop, laptop, tty, hetzner)
|
|
│ └── aesthetic/ # Laptop/desktop hardware config
|
|
├── home/ # Home Manager (user config)
|
|
│ ├── terminal/ # Shell, emulators, CLI tools
|
|
│ ├── editors/ # Helix, Zed, Neovim
|
|
│ ├── window-managers/ # Niri, keybinds
|
|
│ └── services/ # User systemd services
|
|
├── system/ # NixOS modules
|
|
│ ├── core/ # Boot, kernel, security
|
|
│ └── services/ # System services
|
|
├── servers/
|
|
│ └── hetzner/ # Isolated server (24.05, disko, sops)
|
|
├── secrets/
|
|
│ ├── secrets.yaml # sops-encrypted (age via SSH host key)
|
|
│ ├── age.key # Age private key (for sops decryption)
|
|
│ └── .sops.yaml # sops creation rules
|
|
└── pkgs/ # Custom packages/overlays
|
|
```
|
|
|
|
---
|
|
|
|
## sops-nix Details
|
|
|
|
- Encrypts `secrets/secrets.yaml` with **age** using the SSH host ed25519 key (`/etc/ssh/ssh_host_ed25519_key`)
|
|
- Auto-decrypts to `/run/secrets/` at activation
|
|
- Fish loads secrets from `/run/secrets/` via `home/terminal/shell/fish.nix`
|
|
- SSH config references `/run/secrets/hetzner_server` and `/run/secrets/gitea_laptop`
|
|
|
|
To re-encrypt for a new host key:
|
|
```bash
|
|
cd /etc/nixos
|
|
nix shell nixpkgs#sops -c sops --encrypt --age "$(nix shell nixpkgs#ssh-to-age -c ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub)" secrets/secrets.yaml > secrets/secrets.yaml.new
|
|
mv secrets/secrets.yaml.new secrets/secrets.yaml
|
|
```
|
|
|
|
---
|
|
|
|
## Credits
|
|
|
|
Inspired by: [hjem](https://github.com/nix-community/hjem), [owl4ce](https://github.com/owl4ce), [Siduck](https://github.com/siduck), [Rxyhn](https://github.com/rxyhn).
|
|
|
|
---
|
|
|
|
## License
|
|
|
|
MIT — use freely, credits appreciated. |