jory cba6b18914 Harden server and add Nix-native CI + self-hosted Gitea Actions
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/
  X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail
  upstream copies via header_down on mail.severijnse.eu
- tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync
  _25/_465/_993, fail-safe placeholders; coredns zone updated
- pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint,
  ...); CI pre-commit job over x86_64 + aarch64 matrix
- gitea: enable Gitea Actions + self-hosted runner (native:host,
  aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook
- fix statix warnings (merge repeated systemd/database/configFile keys,
  inherit, bool-compare guards); add missing trailing newlines
2026-07-12 01:48:46 +02:00
2026-03-31 16:53:11 +02:00

awesome-rice-badge

芯 (Shin)

PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP.

Note: Built with flake-parts. The client configurations (desktop, laptop, tty) use Home Manager, while the Hetzner server is isolated on nixos-24.05. The flake builds for both x86_64-linux and aarch64-linux.


SETUPGUIDESKEYBINDSGALLERY


  • Window ManagerNiri🎨 Scrolleable WM!
  • ShellFish 🐟 with starship Cross Shell Platform!
  • TerminalGhostty 💻 Powerful Hyped term
  • PanelNoctalia! 🍧 Beautiful and minimalist desktop shell
  • File ManagerYazi 🔖 Rustacean File Manager!
  • GUI Basic-IDEHelix ✴️ Rustacean vim version!
  • GTK ThemeGTK 🐾 My Fork of colloid

🌼 INSTALLATION (NixOS)

Request: NixOS

This flake targets both x86_64-linux and aarch64-linux, so grab the minimal ISO for your architecture:

# x86_64
wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso

# aarch64 (e.g. Raspberry Pi / ARM boxes)
wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso
  • Boot Into the Installer.

  • Switch to Root: sudo -i

  • Partitions:

I prefer to use 1GB on the EFI partition. Specifically because the 'generations' list may become very long, and to avoid overloading the partition.

# Replace nvme with your disk partition
gdisk /dev/nvme0n1
- `o` (create new partition table)
- `n` (add partition, 512M, type ef00 EFI)
- `n` (add partition, remaining space, type 8300 Linux)
`w` (write partition table and exit)
  • Format Partitions:
mkfs.fat -F 32 -n EFI /dev/nvme0n1p1
mkfs.xfs -L NIXOS /dev/nvme0n1p2
  • Mount Partitions:
mount /dev/disk/by-label/NIXOS /mnt
mkdir -p /mnt/boot
mount /dev/disk/by-label/EFI /mnt/boot
  • Enable nixFlakes
nix-shell -p nixVersions.stable git
  • Clone my Dotfiles
git clone --depth 1 https://github.com/someone/shin /mnt/etc/nixos
  • Generate your Own Nix Hardware Settings:

DON'T FORGET IT

sudo nixos-generate-config --dir /mnt/etc/nixos/hosts/aesthetic

# Remove configuration.nix
rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix
  • Install Dotfiles Using Flake
# Move to folder
cd /mnt/etc/nixos

# Install (desktop for a graphical machine, or #laptop)
nixos-install --flake .#desktop
  • Reboot

🐙 Remember Default User & password are: nixos

  • Change Default password for User.
passwd YourUser

🌻 TODO LIST

🧩 ADDITIONAL TIPS

If you're using this NixOS configuration flake locally, you can simplify the process of switching and managing your system using nh, a CLI helper for Nix Flakes.

To switch your system configuration with nh, use:

NH_FLAKE=/etc/nixos nh os switch

This avoids needing to type out the full nixos-rebuild command manually and provides a cleaner workflow when iterating on your setup.

💡 Make sure nh is installed in your system environment or user profile.

🍀 KEY BINDINGS

💐 ACKNOWLEDGEMENTS

Inspiration and Resources
1 owl4ce
2 Ilham25
3 Siduck
4 NvChad
5 Rxyhn
6 HeinzDev
7 fufexan
8 AmitGolden

🌳 CONTRIBUTING

WIP

🎃 SECURITY POLICY

BACK TO TOP
S
Description
No description provided
Readme 17 MiB
Languages
Nix 94%
Lua 4.2%
Shell 1.8%