fmt

Makefile

@@ -7,7 +7,7 @@ HOSTS = nixbook nixpad tuxcomp
 switch:
 	nixos-rebuild switch --flake . --sudo --ask-sudo-password
 
-# build this host's system (./result) without activating it.
+# build this host's system without activating it.
 build:
 	nixos-rebuild build --flake .
 

README.md

@@ -1,3 +1,57 @@
 # nixos
 
-configuration files for nixos
+NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
+
+
+<!-- TODO: rewrite rest of this file  -->
+## Layout
+
+| Path | Contents |
+| --- | --- |
+| `flake.nix` | Inputs + one nixosConfigurations entry per hostname. |
+| `hosts/<hostname>/` | Configuration unique to each machine: hardware, wireguard tunnels. `hardware-configuration.nix` should not be edited as these are generated by `nixos-generate-config`. |
+| `modules/` | Everything shared; one file/folder per feature. |
+| `secrets/` | sops-encrypted files + the only place `sops.secrets` are declared. |
+| `patches/` | Custom patches, currently only a gamescope patch. |
+
+Each modules feature sets the required system options and packages.
+When i get around to it i'll add the home-manager options here as well.
+
+
+## Building
+
+```sh
+make          # nixos-rebuild switch for this host
+make build    # build ./result without switching
+make check    # evaluate all configs
+make update   # update flake.lock
+nix fmt       # format the Nix files (nixfmt)
+```
+
+Do not run the above commands as root.
+nixos-rebuild asks for the sudo password when it activates. 
+Generations older than 30 days are garbage-collected weekly.
+
+## Secrets
+
+Every secret is stored as its own file, encrypted with sops to each machine's age key.
+Public keys are in `.sops.yaml`. 
+Private keys are in `~/.config/sops/age/keys.txt`; sops-nix decrypts with it on every switch, and `sops` also finds it:
+
+```sh
+sops edit secrets/<name>.bin
+```
+
+To add a machine, give it a key before its first boot with
+`mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
+put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
+every `.bin` from a machine that can already decrypt them.
+
+`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
+`logins.json` and `key4.db`, and it only seeds profiles that have no
+`logins.json` yet. To update it, change the password in Thunderbird, close
+Thunderbird, and update the tarball:
+
+```sh
+tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
+```

flake.lock

@@ -0,0 +1,125 @@
+{
+  "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790365885,
+        "narHash": "sha256-iQ0ebhiVo64NktTnwft9hNxlFu4j5cvljVxyJaEVIP4=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "7b4c5ec4bedaf1e062bbc1bcaeddbc6bd242aa1b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1767983141,
+        "narHash": "sha256-7ZCulYUD9RmJIDULTRkGLSW1faMpDlPKcbWJLYHoXcs=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "440818969ac2cbd77bfe025e884d0aa528991374",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
+    "nix4nvchad": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nvchad-starter": "nvchad-starter"
+      },
+      "locked": {
+        "lastModified": 1790046371,
+        "narHash": "sha256-j1q/Bx89d5PM7CRBqdV1RDvmTwwfAqIBEthXg39pUWE=",
+        "owner": "nix-community",
+        "repo": "nix4nvchad",
+        "rev": "706a5c7d9fb40395c9c4805a0316ab32622beb36",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix4nvchad",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1790185690,
+        "narHash": "sha256-xJ+X4hBtOcAFGBOe5nAMyMUeF9foJBmIOu3NjBqBycU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4975466d324710c576dc11ad614684e6bd8cad8e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nvchad-starter": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1753939018,
+        "narHash": "sha256-xdLr6tlU9uA+wu0pqha2br0fdVm+1MjgjbB5awz9ICU=",
+        "owner": "NvChad",
+        "repo": "starter",
+        "rev": "e3572e1f5e1c297212c3deeb17b7863139ce663e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NvChad",
+        "ref": "main",
+        "repo": "starter",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nix-flatpak": "nix-flatpak",
+        "nix4nvchad": "nix4nvchad",
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790247521,
+        "narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

hosts/nixbook/default.nix

@@ -1,16 +1,16 @@
 { config, pkgs, ... }:
 
 {
-  imports =
+  imports = [
-    [ 
+    ./hardware-configuration.nix
-      ./hardware-configuration.nix
+    ../../modules
-      ../../modules
+  ];
-    ];
 
   networking.hostName = "nixbook";
   system.stateVersion = "26.05";
 
-  boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
+  boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device =
+    "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
 
   services.power-profiles-daemon.enable = true;
 
@@ -20,28 +20,36 @@
     steam
   ];
 
+  # explicitly override videoDrivers (nvidia doesnt like us on nixbook )
+  services.xserver.videoDrivers = lib.mkForce [ "intel" ];
+
   # BELOW IS OLD!! remove as we make more modular
-  # custom certificates
   # TODO: move certs to secrets, make this a module not a host based thing
-  security.pki.certificateFiles = [
+  # custom certificates
-    ./certs/npm-caddy-private.crt
+  # security.pki.certificateFiles = [
-    ./certs/npm-caddy-public.crt
+  #   ./certs/npm-caddy-private.crt
-    ./certs/npm-caddy-shared.crt
+  #   ./certs/npm-caddy-public.crt
-  ];
+  #   ./certs/npm-caddy-shared.crt
+  # ];
 
   # TODO: move to secrets
   # tunnel
   networking.wg-quick.interfaces = {
     npm = {
-      address = ["10.8.0.3/32"];
+      address = [ "10.8.0.3/32" ];
       privateKeyFile = "/root/wireguard-keys/npm";
-      peers = [{
+      peers = [
-        publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
+        {
-        presharedKeyFile = "/root/wireguard-keys/npm_preshared";
+          publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
-        allowedIPs = ["10.9.11.0/24" "10.8.0.0/24"];
+          presharedKeyFile = "/root/wireguard-keys/npm_preshared";
-        endpoint = "wg-easy.u.djairo.dev:51820";
+          allowedIPs = [
-        persistentKeepalive = 25;
+            "10.9.11.0/24"
-      }];
+            "10.8.0.0/24"
+          ];
+          endpoint = "wg-easy.u.djairo.dev:51820";
+          persistentKeepalive = 25;
+        }
+      ];
     };
   };
 }

hosts/tuxcomp/default.nix

@@ -1,12 +1,11 @@
 { config, pkgs, ... }:
 
 {
-  imports =
+  imports = [
-    [ 
+    ./hardware-configuration.nix
-      ./hardware-configuration.nix
+    ../../modules
-      ../../modules
+    ./gaming.nix
-      ./gaming.nix
+  ];
-    ];
   # TODO: literally this whole configuration lmao
 
   # adds a `stretch_aspect` scaler (Valve/gamescope#927) and lets `--rt` use the

hosts/tuxcomp/gaming.nix

@@ -30,7 +30,6 @@
   # than esync/fsync under thread contention.
   boot.kernelModules = [ "ntsync" ];
 
-
   users.users.djai.packages = with pkgs; [
     desmume
     eden
@@ -38,7 +37,7 @@
     prismlauncher
     steam
     winetricks
-  ]:
+  ];
 
   services.flatpak.packages = [
     "org.vinegarhq.Sober"

modules/audio.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 
 {
-  software.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
 
   services.pipewire = {

modules/base.nix

@@ -30,10 +30,10 @@
     isNormalUser = true;
     description = "djai";
     extraGroups = [
-    "docker" 
+      "docker"
-    "networkmanager"
+      "networkmanager"
-    "video"
+      "video"
-    "wheel"
+      "wheel"
     ];
   };
 
@@ -50,7 +50,6 @@
     vim
   ];
 
-
   # TODO: use home-manager
   # home-manager = {
   #   useGlobalPkgs = true;

modules/default.nix

@@ -1,6 +1,6 @@
 {
   imports = [
-    ../secrets
+    # ../secrets # TODO: uncomment
     ./apps.nix
     ./audio.nix
     ./base.nix

modules/desktop/default.nix

@@ -4,15 +4,15 @@
   services.displayManager.sddm.enable = true;
   services.displayManager.autoLogin = {
     enable = true;
-    user = djai;
+    user = "djai";
   };
 
   services.xserver = {
     enable = true;
     videoDrivers = [
-      nvidia 
+      "nvidia"
-      amdgpu
+      "amdgpu"
-      intel
+      "intel"
     ];
     xkb = {
       layout = "us";
@@ -33,11 +33,11 @@
   services.blueman.enable = true;
 
   fonts.packages = with pkgs; [
-  nerd-fonts.caskaydia-cove
+    nerd-fonts.caskaydia-cove
-  nerd-fonts.fira-code
+    nerd-fonts.fira-code
-  nerd-fonts.iosevka 
+    nerd-fonts.iosevka
-  nerd-fonts.shure-tech-mono
+    nerd-fonts.shure-tech-mono
-  nerd-fonts.symbols-only
+    nerd-fonts.symbols-only
   ];
 
   # services.gvfs.enable = true;

modules/dev.nix

@@ -2,6 +2,70 @@
 
 let
   system = pkgs.stdenv.hostPlatform.system;
+  nvchad = inputs.nix4nvchad.packages.${system}.default.override {
+    extraConfig = ''
+      local map = vim.keymap.set
+      local builtin = require('telescope.builtin')
+
+      map("n", ";", ":", { desc = "CMD enter command mode" })
+      map("n", "<leader>sw", "<cmd> set wrap! <CR>", {desc = "Toggle text wrapping"})
+      map("n", "<leader>fm", function() require("conform").format() end, {desc = "Format with conform"})
+      map("n", "<leader>-", "<cmd> Oil <CR>", {desc = "Open directory in oil"})
+      map("n", "<leader>rcu", function() require('crates').upgrade_all_crates() end, {desc = "Upgrade rust crates"})
+      map("n", "<leader>ca", function() vim.lsp.buf.code_action() end, {desc = "Lsp code action"})
+      map("n", "<leader>gr", function() vim.lsp.buf.references() end, {desc = "Lsp references"})
+      map("n", "<leader>gm", "<cmd>Telescope git_commits<CR>", { desc = "telescope git commits" })
+
+      map('n', '<leader>fi', function()
+        builtin.live_grep({
+          prompt_title = "Files matching TODO",
+          default_text = "(TODO|todo|FIXME|THOUGHT|REFACTOR|TEST)",
+        })
+      end, {desc = "find comments using telescope"})
+
+      -- stay in v mode after indenting
+      map("v", "<", "<gv")
+      map("v", ">", ">gv")
+    '';
+
+    extraPlugins = ''
+      return {
+        {
+          "neovim/nvim-lspconfig",
+          config = function()
+            require "configs.lspconfig"
+          end,
+        },{
+          "rcarriga/nvim-notify",
+          event = "VeryLazy",
+          config = function()
+            local notify = require "notify"
+            notify.setup {
+              background_colour = "#2D3540",
+            }
+            vim.notify = notify
+          end,
+        },{
+          "stevearc/oil.nvim",
+          opts = {},
+          dependencies = { "nvim-tree/nvim-web-devicons"},
+          lazy = false
+        },{
+          'saecki/crates.nvim',
+          event = { "BufRead Cargo.toml" },
+          config = function()
+              require('crates').setup()
+          end,
+        },{
+          "jglasovic/venv-lsp.nvim",
+          config = function()
+            require("venv-lsp").setup()
+          end,
+          lazy = false,
+        }
+      }
+    '';
+  };
 in
 {
   programs.java.enable = true;
@@ -37,7 +101,7 @@ in
   users.users.djai.packages = with pkgs; [
     # dev environment
     godot
-    inputs.nix4nvchad.packages.${system}.nvchad
+    nvchad
     jq
     lazygit
     ripgrep
@@ -69,68 +133,4 @@ in
   # FIXME: use builtins.readfile to store these config options i think
   # home-manager.users.djai.home.packages = with pkgs; [];
 
-  nvchad = inputs.nix4nvchad.packages.${system}.default.override {
-    extraConfig = ''
-      local map = vim.keymap.set
-      local builtin = require('telescope.builtin')
-
-      map("n", ";", ":", { desc = "CMD enter command mode" })
-      map("n", "<leader>sw", "<cmd> set wrap! <CR>", {desc = "Toggle text wrapping"})
-      map("n", "<leader>fm", function() require("conform").format() end, {desc = "Format with conform"})
-      map("n", "<leader>-", "<cmd> Oil <CR>", {desc = "Open directory in oil"})
-      map("n", "<leader>rcu", function() require('crates').upgrade_all_crates() end, {desc = "Upgrade rust crates"})
-      map("n", "<leader>ca", function() vim.lsp.buf.code_action() end, {desc = "Lsp code action"})
-      map("n", "<leader>gr", function() vim.lsp.buf.references() end, {desc = "Lsp references"})
-      map("n", "<leader>gm", "<cmd>Telescope git_commits<CR>", { desc = "telescope git commits" })
-
-      map('n', '<leader>fi', function()
-        builtin.live_grep({
-          prompt_title = "Files matching TODO",
-          default_text = "(TODO|todo|FIXME|THOUGHT|REFACTOR|TEST)",
-        })
-      end, {desc = "find comments using telescope"})
-
-      -- stay in v mode after indenting
-      map("v", "<", "<gv")
-      map("v", ">", ">gv")
-    '';
-
-    extraPlugins = ''
-    return {
-      {
-        "neovim/nvim-lspconfig",
-        config = function()
-          require "configs.lspconfig"
-        end,
-      },{
-        "rcarriga/nvim-notify",
-        event = "VeryLazy",
-        config = function()
-          local notify = require "notify"
-          notify.setup {
-            background_colour = "#2D3540",
-          }
-          vim.notify = notify
-        end,
-      },{
-        "stevearc/oil.nvim",
-        opts = {},
-        dependencies = { "nvim-tree/nvim-web-devicons"},
-        lazy = false
-      },{
-        'saecki/crates.nvim',
-        event = { "BufRead Cargo.toml" },
-        config = function()
-            require('crates').setup()
-        end,
-      },{
-        "jglasovic/venv-lsp.nvim",
-        config = function()
-          require("venv-lsp").setup()
-        end,
-        lazy = false,
-      }
-    }
-    '';
-  };
 }

modules/dunst.nix

@@ -18,7 +18,7 @@
         corners = "bottom-left, top-right";
         ellipsize = "middle";
         enable_posix_regex = true;
-        follow = mouse;
+        follow = "mouse";
         font = "Iosevka Mono Nerd Font Medium 10";
         force_xinerama = false;
         force_xwayland = false;
@@ -32,7 +32,7 @@
         idle_threshold = 120;
         ignore_dbusclose = false;
         ignore_newline = false;
-        indicate_hidden = yes;
+        indicate_hidden = true;
         line_height = 0;
         markup = "full";
         max_icon_size = 32;
@@ -47,19 +47,19 @@
         progress_bar_max_width = 400;
         progress_bar_min_width = 150;
         progress_bar = true;
-        separator_color = frame;
+        separator_color = "frame";
         separator_height = 2;
         show_age_threshold = 60;
         show_indicators = true;
-        shrink = no;
+        shrink = false;
-        sort = yes;
+        sort = true;
         stack_duplicates = true;
         sticky_history = true;
         text_icon_padding = 15;
         title = "Dunst";
         vertical_alignment = "center";
         width = 250;
-        word_wrap =false;
+        word_wrap = false;
       };
 
       experimental.per_monitor_dpi = false;
@@ -82,7 +82,7 @@
         foreground = "#F38BA8";
         format = "<b>%s</b>\n%b";
         frame_color = "#F38BA8";
-        timeout = 60 ;
+        timeout = 60;
       };
 
       fcitx5-filter = {

modules/email.nix

@@ -1,6 +1,5 @@
 { config, pkgs, ... }:
 
-
 {
   programs.thunderbird.enable = true;
 }

modules/web/default.nix

@@ -15,4 +15,3 @@
     firefox
   ];
 }
-

modules/web/firefox.nix

@@ -3,7 +3,8 @@
 {
   programs.firefox = {
     enable = true;
-    preferences = { #TODO: port over all changes in about:config from tuxcomp
+    preferences = {
+      # TODO: port over all changes in about:config from tuxcomp
       "browser.resistFingerPrinting" = true;
     };
 
@@ -12,26 +13,22 @@
       ExtensionSettings = {
         "uBlock0@raymondhill.net" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
         };
 
         "vimium@vimium.org" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/vimium/latest.xpi";
         };
 
         "addon@darkreader.org" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
         };
 
         "{446900e4-71c2-419f-a6a7-df9c091e268b}" = {
           installation_mode = "force_installed";
-          install_url =
+          install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
-            "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
         };
       };
     };