From a8365a1a73f27e053ad693ae832f7647bff9168d Mon Sep 17 00:00:00 2001 From: Djai Hougee Date: Sat, 26 Sep 2026 02:14:34 +0200 Subject: [PATCH] fmt --- Makefile | 2 +- README.md | 56 +++++++++++++++- flake.lock | 125 ++++++++++++++++++++++++++++++++++ hosts/nixbook/default.nix | 52 +++++++++------ hosts/tuxcomp/default.nix | 11 ++- hosts/tuxcomp/gaming.nix | 3 +- modules/apps.nix | 2 +- modules/audio.nix | 2 +- modules/base.nix | 9 ++- modules/default.nix | 2 +- modules/desktop/default.nix | 18 ++--- modules/dev.nix | 130 ++++++++++++++++++------------------ modules/dunst.nix | 14 ++-- modules/email.nix | 1 - modules/terminal.nix | 2 +- modules/web/default.nix | 3 +- modules/web/firefox.nix | 15 ++--- 17 files changed, 313 insertions(+), 134 deletions(-) create mode 100644 flake.lock diff --git a/Makefile b/Makefile index 9645a59..399dfbc 100644 --- a/Makefile +++ b/Makefile @@ -7,7 +7,7 @@ HOSTS = nixbook nixpad tuxcomp switch: nixos-rebuild switch --flake . --sudo --ask-sudo-password -# build this host's system (./result) without activating it. +# build this host's system without activating it. build: nixos-rebuild build --flake . diff --git a/README.md b/README.md index fdbbcb9..6546387 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,57 @@ # nixos -configuration files for nixos \ No newline at end of file +NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp). + + + +## Layout + +| Path | Contents | +| --- | --- | +| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. | +| `hosts//` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. | +| `modules/` | Everything shared; one file/folder per feature. | +| `secrets/` | sops-encrypted files + the only place `sops.secrets` are declared. | +| `patches/` | Custom patches, currently only a gamescope patch. | + +Each modules feature sets the required system options and packages. +When i get around to it i'll add the home-manager options here as well. + + +## Building + +```sh +make # nixos-rebuild switch for this host +make build # build ./result without switching +make check # evaluate all configs +make update # update flake.lock +nix fmt # format the Nix files (nixfmt) +``` + +Do not run the above commands as root. +nixos-rebuild asks for the sudo password when it activates. +Generations older than 30 days are garbage-collected weekly. + +## Secrets + +Every secret is stored as its own file, encrypted with sops to each machine's age key. +Public keys are in `.sops.yaml`. +Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it: + +```sh +sops edit secrets/.bin +``` + +To add a machine, give it a key before its first boot with +`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`, +put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on +every `.bin` from a machine that can already decrypt them. + +`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's +`logins.json` and `key4.db`, and it only seeds profiles that have no +`logins.json` yet. To update it, change the password in Thunderbird, close +Thunderbird, and update the tarball: + +```sh +tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin +``` diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..c2f4fdb --- /dev/null +++ b/flake.lock @@ -0,0 +1,125 @@ +{ + "nodes": { + "home-manager": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1790365885, + "narHash": "sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, + "nix-flatpak": { + "locked": { + "lastModified": 1767983141, + "narHash": "sha256-7ZCulYUD9RmJIDULTRkGLSW1faMpDlPKcbWJLYHoXcs=", + "owner": "gmodena", + "repo": "nix-flatpak", + "rev": "440818969ac2cbd77bfe025e884d0aa528991374", + "type": "github" + }, + "original": { + "owner": "gmodena", + "ref": "latest", + "repo": "nix-flatpak", + "type": "github" + } + }, + "nix4nvchad": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "nvchad-starter": "nvchad-starter" + }, + "locked": { + "lastModified": 1790046371, + "narHash": "sha256-j1q/Bx89d5PM7CRBqdV1RDvmTwwfAqIBEthXg39pUWE=", + "owner": "nix-community", + "repo": "nix4nvchad", + "rev": "706a5c7d9fb40395c9c4805a0316ab32622beb36", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nix4nvchad", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1790185690, + "narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "4975466d324710c576dc11ad614684e6bd8cad8e", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nvchad-starter": { + "flake": false, + "locked": { + "lastModified": 1753939018, + "narHash": "sha256-xdLr6tlU9uA+wu0pqha2br0fdVm+1MjgjbB5awz9ICU=", + "owner": "NvChad", + "repo": "starter", + "rev": "e3572e1f5e1c297212c3deeb17b7863139ce663e", + "type": "github" + }, + "original": { + "owner": "NvChad", + "ref": "main", + "repo": "starter", + "type": "github" + } + }, + "root": { + "inputs": { + "home-manager": "home-manager", + "nix-flatpak": "nix-flatpak", + "nix4nvchad": "nix4nvchad", + "nixpkgs": "nixpkgs", + "sops-nix": "sops-nix" + } + }, + "sops-nix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1790247521, + "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=", + "owner": "Mic92", + "repo": "sops-nix", + "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f", + "type": "github" + }, + "original": { + "owner": "Mic92", + "repo": "sops-nix", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/hosts/nixbook/default.nix b/hosts/nixbook/default.nix index 6a25d11..155d112 100644 --- a/hosts/nixbook/default.nix +++ b/hosts/nixbook/default.nix @@ -1,16 +1,16 @@ { config, pkgs, ... }: { - imports = - [ - ./hardware-configuration.nix - ../../modules - ]; + imports = [ + ./hardware-configuration.nix + ../../modules + ]; - networking.hostName = "nixbook"; - system.stateVersion = "26.05"; + networking.hostName = "nixbook"; + system.stateVersion = "26.05"; - boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958"; + boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = + "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958"; services.power-profiles-daemon.enable = true; @@ -20,28 +20,36 @@ steam ]; + # explicitly override videoDrivers (nvidia doesnt like us on nixbook ) + services.xserver.videoDrivers = lib.mkForce [ "intel" ]; + # BELOW IS OLD!! remove as we make more modular - # custom certificates # TODO: move certs to secrets, make this a module not a host based thing - security.pki.certificateFiles = [ - ./certs/npm-caddy-private.crt - ./certs/npm-caddy-public.crt - ./certs/npm-caddy-shared.crt - ]; + # custom certificates + # security.pki.certificateFiles = [ + # ./certs/npm-caddy-private.crt + # ./certs/npm-caddy-public.crt + # ./certs/npm-caddy-shared.crt + # ]; # TODO: move to secrets # tunnel networking.wg-quick.interfaces = { npm = { - address = ["10.8.0.3/32"]; + address = [ "10.8.0.3/32" ]; privateKeyFile = "/root/wireguard-keys/npm"; - peers = [{ - publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ="; - presharedKeyFile = "/root/wireguard-keys/npm_preshared"; - allowedIPs = ["10.9.11.0/24" "10.8.0.0/24"]; - endpoint = "wg-easy.u.djairo.dev:51820"; - persistentKeepalive = 25; - }]; + peers = [ + { + publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ="; + presharedKeyFile = "/root/wireguard-keys/npm_preshared"; + allowedIPs = [ + "10.9.11.0/24" + "10.8.0.0/24" + ]; + endpoint = "wg-easy.u.djairo.dev:51820"; + persistentKeepalive = 25; + } + ]; }; }; } diff --git a/hosts/tuxcomp/default.nix b/hosts/tuxcomp/default.nix index 6526de0..ed3058d 100644 --- a/hosts/tuxcomp/default.nix +++ b/hosts/tuxcomp/default.nix @@ -1,12 +1,11 @@ { config, pkgs, ... }: { - imports = - [ - ./hardware-configuration.nix - ../../modules - ./gaming.nix - ]; + imports = [ + ./hardware-configuration.nix + ../../modules + ./gaming.nix + ]; # TODO: literally this whole configuration lmao # adds a `stretch_aspect` scaler (Valve/gamescope#927) and lets `--rt` use the diff --git a/hosts/tuxcomp/gaming.nix b/hosts/tuxcomp/gaming.nix index 060fd85..16ddda0 100644 --- a/hosts/tuxcomp/gaming.nix +++ b/hosts/tuxcomp/gaming.nix @@ -30,7 +30,6 @@ # than esync/fsync under thread contention. boot.kernelModules = [ "ntsync" ]; - users.users.djai.packages = with pkgs; [ desmume eden @@ -38,7 +37,7 @@ prismlauncher steam winetricks - ]: + ]; services.flatpak.packages = [ "org.vinegarhq.Sober" diff --git a/modules/apps.nix b/modules/apps.nix index bb835ae..053a5a4 100644 --- a/modules/apps.nix +++ b/modules/apps.nix @@ -9,7 +9,7 @@ enable = true; onCalendar = "weekly"; }; - packages = [ + packages = [ "io.freetubeapp.FreeTube" ]; }; diff --git a/modules/audio.nix b/modules/audio.nix index 19dadda..d113ee9 100644 --- a/modules/audio.nix +++ b/modules/audio.nix @@ -1,7 +1,7 @@ { pkgs, ... }: { - software.pulseaudio.enable = false; + services.pulseaudio.enable = false; security.rtkit.enable = true; services.pipewire = { diff --git a/modules/base.nix b/modules/base.nix index ac854db..b157640 100644 --- a/modules/base.nix +++ b/modules/base.nix @@ -30,10 +30,10 @@ isNormalUser = true; description = "djai"; extraGroups = [ - "docker" - "networkmanager" - "video" - "wheel" + "docker" + "networkmanager" + "video" + "wheel" ]; }; @@ -50,7 +50,6 @@ vim ]; - # TODO: use home-manager # home-manager = { # useGlobalPkgs = true; diff --git a/modules/default.nix b/modules/default.nix index d6332d2..4c208f5 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,6 +1,6 @@ { imports = [ - ../secrets + # ../secrets # TODO: uncomment ./apps.nix ./audio.nix ./base.nix diff --git a/modules/desktop/default.nix b/modules/desktop/default.nix index ab88dc7..4fc5ec7 100644 --- a/modules/desktop/default.nix +++ b/modules/desktop/default.nix @@ -4,15 +4,15 @@ services.displayManager.sddm.enable = true; services.displayManager.autoLogin = { enable = true; - user = djai; + user = "djai"; }; services.xserver = { enable = true; videoDrivers = [ - nvidia - amdgpu - intel + "nvidia" + "amdgpu" + "intel" ]; xkb = { layout = "us"; @@ -33,11 +33,11 @@ services.blueman.enable = true; fonts.packages = with pkgs; [ - nerd-fonts.caskaydia-cove - nerd-fonts.fira-code - nerd-fonts.iosevka - nerd-fonts.shure-tech-mono - nerd-fonts.symbols-only + nerd-fonts.caskaydia-cove + nerd-fonts.fira-code + nerd-fonts.iosevka + nerd-fonts.shure-tech-mono + nerd-fonts.symbols-only ]; # services.gvfs.enable = true; diff --git a/modules/dev.nix b/modules/dev.nix index 881927e..d5a7acf 100644 --- a/modules/dev.nix +++ b/modules/dev.nix @@ -2,6 +2,70 @@ let system = pkgs.stdenv.hostPlatform.system; + nvchad = inputs.nix4nvchad.packages.${system}.default.override { + extraConfig = '' + local map = vim.keymap.set + local builtin = require('telescope.builtin') + + map("n", ";", ":", { desc = "CMD enter command mode" }) + map("n", "sw", " set wrap! ", {desc = "Toggle text wrapping"}) + map("n", "fm", function() require("conform").format() end, {desc = "Format with conform"}) + map("n", "-", " Oil ", {desc = "Open directory in oil"}) + map("n", "rcu", function() require('crates').upgrade_all_crates() end, {desc = "Upgrade rust crates"}) + map("n", "ca", function() vim.lsp.buf.code_action() end, {desc = "Lsp code action"}) + map("n", "gr", function() vim.lsp.buf.references() end, {desc = "Lsp references"}) + map("n", "gm", "Telescope git_commits", { desc = "telescope git commits" }) + + map('n', 'fi', function() + builtin.live_grep({ + prompt_title = "Files matching TODO", + default_text = "(TODO|todo|FIXME|THOUGHT|REFACTOR|TEST)", + }) + end, {desc = "find comments using telescope"}) + + -- stay in v mode after indenting + map("v", "<", "", ">gv") + ''; + + extraPlugins = '' + return { + { + "neovim/nvim-lspconfig", + config = function() + require "configs.lspconfig" + end, + },{ + "rcarriga/nvim-notify", + event = "VeryLazy", + config = function() + local notify = require "notify" + notify.setup { + background_colour = "#2D3540", + } + vim.notify = notify + end, + },{ + "stevearc/oil.nvim", + opts = {}, + dependencies = { "nvim-tree/nvim-web-devicons"}, + lazy = false + },{ + 'saecki/crates.nvim', + event = { "BufRead Cargo.toml" }, + config = function() + require('crates').setup() + end, + },{ + "jglasovic/venv-lsp.nvim", + config = function() + require("venv-lsp").setup() + end, + lazy = false, + } + } + ''; + }; in { programs.java.enable = true; @@ -37,7 +101,7 @@ in users.users.djai.packages = with pkgs; [ # dev environment godot - inputs.nix4nvchad.packages.${system}.nvchad + nvchad jq lazygit ripgrep @@ -69,68 +133,4 @@ in # FIXME: use builtins.readfile to store these config options i think # home-manager.users.djai.home.packages = with pkgs; []; - nvchad = inputs.nix4nvchad.packages.${system}.default.override { - extraConfig = '' - local map = vim.keymap.set - local builtin = require('telescope.builtin') - - map("n", ";", ":", { desc = "CMD enter command mode" }) - map("n", "sw", " set wrap! ", {desc = "Toggle text wrapping"}) - map("n", "fm", function() require("conform").format() end, {desc = "Format with conform"}) - map("n", "-", " Oil ", {desc = "Open directory in oil"}) - map("n", "rcu", function() require('crates').upgrade_all_crates() end, {desc = "Upgrade rust crates"}) - map("n", "ca", function() vim.lsp.buf.code_action() end, {desc = "Lsp code action"}) - map("n", "gr", function() vim.lsp.buf.references() end, {desc = "Lsp references"}) - map("n", "gm", "Telescope git_commits", { desc = "telescope git commits" }) - - map('n', 'fi', function() - builtin.live_grep({ - prompt_title = "Files matching TODO", - default_text = "(TODO|todo|FIXME|THOUGHT|REFACTOR|TEST)", - }) - end, {desc = "find comments using telescope"}) - - -- stay in v mode after indenting - map("v", "<", "", ">gv") - ''; - - extraPlugins = '' - return { - { - "neovim/nvim-lspconfig", - config = function() - require "configs.lspconfig" - end, - },{ - "rcarriga/nvim-notify", - event = "VeryLazy", - config = function() - local notify = require "notify" - notify.setup { - background_colour = "#2D3540", - } - vim.notify = notify - end, - },{ - "stevearc/oil.nvim", - opts = {}, - dependencies = { "nvim-tree/nvim-web-devicons"}, - lazy = false - },{ - 'saecki/crates.nvim', - event = { "BufRead Cargo.toml" }, - config = function() - require('crates').setup() - end, - },{ - "jglasovic/venv-lsp.nvim", - config = function() - require("venv-lsp").setup() - end, - lazy = false, - } - } - ''; - }; } diff --git a/modules/dunst.nix b/modules/dunst.nix index d3ea6cf..efb2ac5 100644 --- a/modules/dunst.nix +++ b/modules/dunst.nix @@ -18,7 +18,7 @@ corners = "bottom-left, top-right"; ellipsize = "middle"; enable_posix_regex = true; - follow = mouse; + follow = "mouse"; font = "Iosevka Mono Nerd Font Medium 10"; force_xinerama = false; force_xwayland = false; @@ -32,7 +32,7 @@ idle_threshold = 120; ignore_dbusclose = false; ignore_newline = false; - indicate_hidden = yes; + indicate_hidden = true; line_height = 0; markup = "full"; max_icon_size = 32; @@ -47,19 +47,19 @@ progress_bar_max_width = 400; progress_bar_min_width = 150; progress_bar = true; - separator_color = frame; + separator_color = "frame"; separator_height = 2; show_age_threshold = 60; show_indicators = true; - shrink = no; - sort = yes; + shrink = false; + sort = true; stack_duplicates = true; sticky_history = true; text_icon_padding = 15; title = "Dunst"; vertical_alignment = "center"; width = 250; - word_wrap =false; + word_wrap = false; }; experimental.per_monitor_dpi = false; @@ -82,7 +82,7 @@ foreground = "#F38BA8"; format = "%s\n%b"; frame_color = "#F38BA8"; - timeout = 60 ; + timeout = 60; }; fcitx5-filter = { diff --git a/modules/email.nix b/modules/email.nix index 19016a6..7806b2f 100644 --- a/modules/email.nix +++ b/modules/email.nix @@ -1,6 +1,5 @@ { config, pkgs, ... }: - { programs.thunderbird.enable = true; } diff --git a/modules/terminal.nix b/modules/terminal.nix index ee1421d..c0f2417 100644 --- a/modules/terminal.nix +++ b/modules/terminal.nix @@ -108,7 +108,7 @@ ''; plugins = with pkgs.tmuxPlugins; [ - sensible + sensible resurrect ]; }; diff --git a/modules/web/default.nix b/modules/web/default.nix index e4cb655..f8d6f9a 100644 --- a/modules/web/default.nix +++ b/modules/web/default.nix @@ -2,7 +2,7 @@ { # TODO: switch to home manager - # then configure plugins n shi here too + # then configure plugins n shi here too # make a shared section (about:config sections, plugins, profiles) and then have two separate configs in firefox.nix and librewolf.nix # https://wiki.nixos.org/wiki/Librewolf # https://wiki.nixos.org/wiki/Firefox/en @@ -15,4 +15,3 @@ firefox ]; } - diff --git a/modules/web/firefox.nix b/modules/web/firefox.nix index b271870..e657e67 100644 --- a/modules/web/firefox.nix +++ b/modules/web/firefox.nix @@ -3,7 +3,8 @@ { programs.firefox = { enable = true; - preferences = { #TODO: port over all changes in about:config from tuxcomp + preferences = { + # TODO: port over all changes in about:config from tuxcomp "browser.resistFingerPrinting" = true; }; @@ -12,26 +13,22 @@ ExtensionSettings = { "uBlock0@raymondhill.net" = { installation_mode = "force_installed"; - install_url = - "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"; + install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"; }; "vimium@vimium.org" = { installation_mode = "force_installed"; - install_url = - "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi"; + install_url = "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi"; }; "addon@darkreader.org" = { installation_mode = "force_installed"; - install_url = - "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi"; + install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi"; }; "{446900e4-71c2-419f-a6a7-df9c091e268b}" = { installation_mode = "force_installed"; - install_url = - "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi"; + install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi"; }; }; };