fmt

Makefile

@@ -7,7 +7,7 @@ HOSTS = nixbook nixpad tuxcomp
 switch:
 	nixos-rebuild switch --flake . --sudo --ask-sudo-password
 
-# build this host's system (./result) without activating it.
+# build this host's system without activating it.
 build:
 	nixos-rebuild build --flake .
 

README.md

@@ -1,3 +1,57 @@
 # nixos
 
-configuration files for nixos
+NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
+
+
+<!-- TODO: rewrite rest of this file  -->
+## Layout
+
+| Path | Contents |
+| --- | --- |
+| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
+| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
+| `modules/` | Everything shared; one file/folder per feature. |
+| `secrets/` | sops-encrypted files + the only place `sops.secrets` are declared. |
+| `patches/` | Custom patches, currently only a gamescope patch. |
+
+Each modules feature sets the required system options and packages.
+When i get around to it i'll add the home-manager options here as well.
+
+
+## Building
+
+```sh
+make          # nixos-rebuild switch for this host
+make build    # build ./result without switching
+make check    # evaluate all configs
+make update   # update flake.lock
+nix fmt       # format the Nix files (nixfmt)
+```
+
+Do not run the above commands as root.
+nixos-rebuild asks for the sudo password when it activates. 
+Generations older than 30 days are garbage-collected weekly.
+
+## Secrets
+
+Every secret is stored as its own file, encrypted with sops to each machine's age key.
+Public keys are in `.sops.yaml`. 
+Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:
+
+```sh
+sops edit secrets/<name>.bin
+```
+
+To add a machine, give it a key before its first boot with
+`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
+put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
+every `.bin` from a machine that can already decrypt them.
+
+`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
+`logins.json` and `key4.db`, and it only seeds profiles that have no
+`logins.json` yet. To update it, change the password in Thunderbird, close
+Thunderbird, and update the tarball:
+
+```sh
+tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
+```

flake.lock

@@ -0,0 +1,125 @@
+{
+  "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790365885,
+        "narHash": "sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1767983141,
+        "narHash": "sha256-7ZCulYUD9RmJIDULTRkGLSW1faMpDlPKcbWJLYHoXcs=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "440818969ac2cbd77bfe025e884d0aa528991374",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
+    "nix4nvchad": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nvchad-starter": "nvchad-starter"
+      },
+      "locked": {
+        "lastModified": 1790046371,
+        "narHash": "sha256-j1q/Bx89d5PM7CRBqdV1RDvmTwwfAqIBEthXg39pUWE=",
+        "owner": "nix-community",
+        "repo": "nix4nvchad",
+        "rev": "706a5c7d9fb40395c9c4805a0316ab32622beb36",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix4nvchad",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1790185690,
+        "narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4975466d324710c576dc11ad614684e6bd8cad8e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nvchad-starter": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1753939018,
+        "narHash": "sha256-xdLr6tlU9uA+wu0pqha2br0fdVm+1MjgjbB5awz9ICU=",
+        "owner": "NvChad",
+        "repo": "starter",
+        "rev": "e3572e1f5e1c297212c3deeb17b7863139ce663e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NvChad",
+        "ref": "main",
+        "repo": "starter",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "nix4nvchad": "nix4nvchad",
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790247521,
+        "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

hosts/nixbook/default.nix

@@ -1,8 +1,7 @@
 { config, pkgs, ... }:
 
 {
-  imports =
+  imports = [
-    [ 
     ./hardware-configuration.nix
     ../../modules
   ];
@@ -10,7 +9,8 @@
   networking.hostName = "nixbook";
   system.stateVersion = "26.05";
 
-  boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
+  boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device =
+    "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
 
   services.power-profiles-daemon.enable = true;
 
@@ -20,14 +20,17 @@
     steam
   ];
 
+  # explicitly override videoDrivers (nvidia doesnt like us on nixbook )
+  services.xserver.videoDrivers = lib.mkForce [ "intel" ];
+
   # BELOW IS OLD!! remove as we make more modular
-  # custom certificates
   # TODO: move certs to secrets, make this a module not a host based thing
-  security.pki.certificateFiles = [
+  # custom certificates
-    ./certs/npm-caddy-private.crt
+  # security.pki.certificateFiles = [
-    ./certs/npm-caddy-public.crt
+  #   ./certs/npm-caddy-private.crt
-    ./certs/npm-caddy-shared.crt
+  #   ./certs/npm-caddy-public.crt
-  ];
+  #   ./certs/npm-caddy-shared.crt
+  # ];
 
   # TODO: move to secrets
   # tunnel
@@ -35,13 +38,18 @@
     npm = {
       address = [ "10.8.0.3/32" ];
       privateKeyFile = "/root/wireguard-keys/npm";
-      peers = [{
+      peers = [
+        {
           publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
           presharedKeyFile = "/root/wireguard-keys/npm_preshared";
-        allowedIPs = ["10.9.11.0/24" "10.8.0.0/24"];
+          allowedIPs = [
+            "10.9.11.0/24"
+            "10.8.0.0/24"
+          ];
           endpoint = "wg-easy.u.djairo.dev:51820";
           persistentKeepalive = 25;
-      }];
+        }
+      ];
     };
   };
 }

hosts/tuxcomp/default.nix

@@ -1,8 +1,7 @@
 { config, pkgs, ... }:
 
 {
-  imports =
+  imports = [
-    [ 
     ./hardware-configuration.nix
     ../../modules
     ./gaming.nix

hosts/tuxcomp/gaming.nix

@@ -30,7 +30,6 @@
   # than esync/fsync under thread contention.
   boot.kernelModules = [ "ntsync" ];
 
-
   users.users.djai.packages = with pkgs; [
     desmume
     eden
@@ -38,7 +37,7 @@
     prismlauncher
     steam
     winetricks
-  ]:
+  ];
 
   services.flatpak.packages = [
     "org.vinegarhq.Sober"

modules/audio.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 
 {
-  software.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
 
   services.pipewire = {

modules/base.nix

@@ -50,7 +50,6 @@
     vim
   ];
 
-
   # TODO: use home-manager
   # home-manager = {
   #   useGlobalPkgs = true;

modules/default.nix

@@ -1,6 +1,6 @@
 {
   imports = [
-    ../secrets
+    # ../secrets # TODO: uncomment
     ./apps.nix
     ./audio.nix
     ./base.nix

modules/desktop/default.nix

@@ -4,15 +4,15 @@
   services.displayManager.sddm.enable = true;
   services.displayManager.autoLogin = {
     enable = true;
-    user = djai;
+    user = "djai";
   };
 
   services.xserver = {
     enable = true;
     videoDrivers = [
-      nvidia 
+      "nvidia"
-      amdgpu
+      "amdgpu"
-      intel
+      "intel"
     ];
     xkb = {
       layout = "us";

modules/dev.nix

@@ -2,73 +2,6 @@
 
 let
   system = pkgs.stdenv.hostPlatform.system;
-in
-{
-  programs.java.enable = true;
-  programs.nix-ld.libraries = with pkgs; [
-    stdenv.cc.cc.lib
-    zlib
-    ncurses5
-    libGL
-    libGLU
-    vulkan-loader
-    libdrm
-    mesa
-    libx11
-    libxcursor
-    libxrandr
-    libxi
-    libxext
-    libxfixes
-    libxcb
-    wayland
-    libpulseaudio
-    alsa-lib
-    nss
-    nspr
-    expat
-    glib
-    dbus
-    systemd
-    freetype
-    fontconfig
-  ];
-
-  users.users.djai.packages = with pkgs; [
-    # dev environment
-    godot
-    inputs.nix4nvchad.packages.${system}.nvchad
-    jq
-    lazygit
-    ripgrep
-
-    # toolchains
-    cargo
-    gcc
-    gnumake
-    openssl
-    python3
-    rustc
-    uv
-
-    # containers / secrets
-    age
-    fluxcd
-    k9s
-    kubectl
-    kubectx
-    sops
-
-    # hosts / networks
-    wireguard-tools
-    lm_sensors
-
-  ];
-
-  # TODO: switch to home manager
-  # FIXME: use builtins.readfile to store these config options i think
-  # home-manager.users.djai.home.packages = with pkgs; [];
-
   nvchad = inputs.nix4nvchad.packages.${system}.default.override {
     extraConfig = ''
       local map = vim.keymap.set
@@ -133,4 +66,71 @@ in
       }
     '';
   };
+in
+{
+  programs.java.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    stdenv.cc.cc.lib
+    zlib
+    ncurses5
+    libGL
+    libGLU
+    vulkan-loader
+    libdrm
+    mesa
+    libx11
+    libxcursor
+    libxrandr
+    libxi
+    libxext
+    libxfixes
+    libxcb
+    wayland
+    libpulseaudio
+    alsa-lib
+    nss
+    nspr
+    expat
+    glib
+    dbus
+    systemd
+    freetype
+    fontconfig
+  ];
+
+  users.users.djai.packages = with pkgs; [
+    # dev environment
+    godot
+    nvchad
+    jq
+    lazygit
+    ripgrep
+
+    # toolchains
+    cargo
+    gcc
+    gnumake
+    openssl
+    python3
+    rustc
+    uv
+
+    # containers / secrets
+    age
+    fluxcd
+    k9s
+    kubectl
+    kubectx
+    sops
+
+    # hosts / networks
+    wireguard-tools
+    lm_sensors
+
+  ];
+
+  # TODO: switch to home manager
+  # FIXME: use builtins.readfile to store these config options i think
+  # home-manager.users.djai.home.packages = with pkgs; [];
+
 }

modules/dunst.nix

@@ -18,7 +18,7 @@
         corners = "bottom-left, top-right";
         ellipsize = "middle";
         enable_posix_regex = true;
-        follow = mouse;
+        follow = "mouse";
         font = "Iosevka Mono Nerd Font Medium 10";
         force_xinerama = false;
         force_xwayland = false;
@@ -32,7 +32,7 @@
         idle_threshold = 120;
         ignore_dbusclose = false;
         ignore_newline = false;
-        indicate_hidden = yes;
+        indicate_hidden = true;
         line_height = 0;
         markup = "full";
         max_icon_size = 32;
@@ -47,12 +47,12 @@
         progress_bar_max_width = 400;
         progress_bar_min_width = 150;
         progress_bar = true;
-        separator_color = frame;
+        separator_color = "frame";
         separator_height = 2;
         show_age_threshold = 60;
         show_indicators = true;
-        shrink = no;
+        shrink = false;
-        sort = yes;
+        sort = true;
         stack_duplicates = true;
         sticky_history = true;
         text_icon_padding = 15;

modules/email.nix

@@ -1,6 +1,5 @@
 { config, pkgs, ... }:
 
-
 {
   programs.thunderbird.enable = true;
 }

modules/web/default.nix

@@ -15,4 +15,3 @@
     firefox
   ];
 }
-

modules/web/firefox.nix

@@ -3,7 +3,8 @@
 {
   programs.firefox = {
     enable = true;
-    preferences = { #TODO: port over all changes in about:config from tuxcomp
+    preferences = {
+      # TODO: port over all changes in about:config from tuxcomp
       "browser.resistFingerPrinting" = true;
     };
 
@@ -12,26 +13,22 @@
       ExtensionSettings = {
         "uBlock0@raymondhill.net" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
         };
 
         "vimium@vimium.org" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi";
         };
 
         "addon@darkreader.org" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
         };
 
         "{446900e4-71c2-419f-a6a7-df9c091e268b}" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
         };
       };
     };