Merge pull request 'chore: repository cleanup and noctalia baseline' (#83) from chore/cleanup into main

Reviewed-on: #83
2026-10-02 09:51:23 +02:00
parent 99a910265f 3fed9c1fc8
commit 3e0e1d48f9
34 changed files with 208 additions and 475 deletions
@@ -6,20 +6,20 @@ My personal NixOS configurations.
 ```bash
 .
-├── flake.lock
+├── flake.nix # hosts and home-manager wiring
 ├── flake.nix # flake definition
 ├── hosts
-│   └── neon
+│   ├── argon # desktop
-│       ├── configuration.nix # import nix-modules for specific host
+│   ├── neon # laptop
-│       └── hardware-configuration.nix # hardware configs for specific host
+│   └── default # test vm
 │       ├── configuration.nix # host-specific settings and module imports
 │       ├── hardware-configuration.nix # generated by nixos-generate-config
 │       └── niri.nix # host-specific niri settings (outputs, input)
 ├── modules
-│   ├── home-manager
+│   ├── home-manager # user modules, imported by users/aaron/home.nix
-│   │   ├── xyz_module.nix
+│   └── nixos # system modules, imported by the hosts
 │   └── nixos
 │       └── xyz_module.nix
 └── users
    └── aaron
-        └── home.nix # import home-manager modules for specific user
+        └── home.nix # imports home-manager modules
 ```
 ## installation
@@ -35,6 +35,9 @@
            ./hosts/${hostName}/configuration.nix
            home-manager.nixosModules.home-manager
            {
              home-manager.useGlobalPkgs = true;
              home-manager.useUserPackages = true;
              home-manager.backupCommand = "mv -f {file} {file}.hm-bak-$(date +%Y%m%d%H%M%S)";
              home-manager.extraSpecialArgs = { inherit inputs; };
              home-manager.users.aaron.imports = [
                nixvim.homeModules.nixvim
@@ -1,15 +1,25 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
 # The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
 { lib, pkgs, ... }:
 let
  # luks name -> partition uuid, mounted at /mnt/<name>
  drives = {
    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
    data2 = "8312edae-9247-481b-a313-52a7f848f027";
    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
  };
  key = name: "/etc/nixos/keys/${name}.key";
 in
 {
  imports = [
    ../../modules/nixos/appimage.nix
    ../../modules/nixos/astro.nix
    ../../modules/nixos/audio.nix
    ../../modules/nixos/bootloader.nix
    ../../modules/nixos/calibre.nix
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/claudecode.nix
    ../../modules/nixos/drives.nix
    ../../modules/nixos/gnupg.nix
    ../../modules/nixos/graphics.nix
    ../../modules/nixos/greetd.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
@@ -29,9 +39,33 @@
  # host-specific niri config (outputs, input devices)
  home-manager.users.aaron.imports = [ ./niri.nix ];
-  # set hostname
+  # amd gpu: mesa/vulkan, and amdgpu in the initrd for plymouth
-  networking.hostName = "argon";
+  hardware.graphics = {
    enable = true;
    enable32Bit = true;
  };
  hardware.amdgpu.initrd.enable = true;
-  # install state version
+  # encrypted data drives
-  system.stateVersion = "25.11"; # Don't change
+  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
    device = "/dev/disk/by-uuid/${uuid}";
    keyFile = key name;
  }) drives;
  fileSystems = lib.mapAttrs' (
    name: _:
    lib.nameValuePair "/mnt/${name}" {
      device = "/dev/mapper/${name}";
      fsType = "ext4";
      options = [ "nofail" ];
    }
  ) drives;
  environment.systemPackages = with pkgs; [
    amdgpu_top
    calibre # ebook management and kobo syncing
  ];
  networking.hostName = "argon";
  system.stateVersion = "25.11"; # don't change
 }
@@ -1,4 +1,5 @@
 # argon: desktop with two 1440p monitors side by side
 {
  wayland.windowManager.niri.settings = {
    input = {
@@ -1,4 +1,4 @@
-# 0x29a nixos conifg
+# 0x29a nixos config
 { pkgs, ... }:
@@ -5,7 +5,6 @@
    ../../modules/nixos/audio.nix
    ../../modules/nixos/bootloader.nix
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/claudecode.nix
    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
    ../../modules/nixos/locales.nix
@@ -26,9 +25,6 @@
  # host-specific niri config (input devices, laptop binds)
  home-manager.users.aaron.imports = [ ./niri.nix ];
  # set hostname
  networking.hostName = "neon";
-
+  system.stateVersion = "25.11"; # don't change
  # install state version
  system.stateVersion = "25.11"; # Don't change
 }
@@ -1,17 +1,7 @@
-# neon: laptop, built-in display is auto-configured by niri
+# neon: laptop, the built-in display is auto-configured by niri
 { lib, ... }:
 let
  brightness = step: {
    _props.allow-when-locked = true;
    spawn = [
      "brightnessctl"
      "--class=backlight"
      "set"
      step
    ];
  };
 in
 {
  wayland.windowManager.niri.settings = {
    input.touchpad = {
@@ -26,9 +16,9 @@ in
      "Ctrl+Print".screenshot-screen = { };
      "Mod+Shift+P".power-off-monitors = { };
-      # finer brightness steps; mkForce, since spawn lists would otherwise be concatenated
+      # finer brightness steps
-      "XF86MonBrightnessUp" = lib.mkForce (brightness "+1%");
+      "XF86MonBrightnessUp".spawn-sh = lib.mkForce "brightnessctl --class=backlight set +1%";
-      "XF86MonBrightnessDown" = lib.mkForce (brightness "1%-");
+      "XF86MonBrightnessDown".spawn-sh = lib.mkForce "brightnessctl --class=backlight set 1%-";
    };
  };
 }
@@ -1,3 +1,7 @@
 # Commits are signed with each machine's ~/.ssh/id_ed25519 through the ssh
 # agent. gitea verifies them against the account keys; allowed_signers gives
 # the local git the same trust, so `git log --show-signature` resolves too.
 {
  config,
  lib,
@@ -7,18 +11,12 @@
 let
  email = "aaron@0x29a.ch";
  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
  # signing key in gitea. the key a host signs with is picked up from the key
  # file itself, this list only tells the local git which machines to trust
  signingKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
  ];
 in
 {
  # gitea verifies signatures against the account keys, this teaches the local
  # git the same trust so `git log --show-signature` resolves as well
  xdg.configFile."git/allowed_signers".text = lib.concatMapStrings (
    key: "${email} ${key}\n"
  ) signingKeys;
@@ -26,9 +24,7 @@ in
  programs.git = {
    enable = true;
    settings = {
-      push = {
+      push.autoSetupRemote = true;
        autoSetupRemote = true;
      };
      user = {
        name = "aaron";
        inherit email;
@@ -37,8 +33,7 @@ in
    };
    signing = {
      format = "ssh";
-      # point at the *public* key so ssh-keygen signs through the ssh agent
+      # the public key makes ssh-keygen sign through the agent
      # instead of reading the passphrase protected private key from disk
      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
      signer = "${pkgs.openssh}/bin/ssh-keygen";
      signByDefault = true;
@@ -1,7 +1,11 @@
 # Only renders ~/.config/niri/config.kdl; niri itself, its session and portals
 # come from modules/nixos/niri.nix. Outputs and input devices that differ
 # per machine live in hosts/<host>/niri.nix.
 { lib, osConfig, ... }:
 let
-  # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there.
+  # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there
  workspaceBinds = lib.mergeAttrsList (
    map (n: {
      "Mod+${toString n}".focus-workspace = n;
@@ -9,24 +13,18 @@ let
    }) (lib.range 1 9)
  );
-  # Shorthand for binds that only run spawn-sh while allowed on the lock screen.
+  # shell command that also works on the lock screen
  lockedSh = cmd: {
    _props.allow-when-locked = true;
    spawn-sh = cmd;
  };
 in
 {
  # Niri config, rendered to ~/.config/niri/config.kdl by home-manager's built-in
  # wayland.windowManager.niri module. The compositor itself, its session, systemd
  # units and portals are provided by the NixOS module (modules/nixos/niri.nix), so
  # this module only writes the config. Host-specific outputs and input devices
  # live in hosts/<host>/niri.nix.
  wayland.windowManager.niri = {
-    # only on hosts that run niri (see modules/nixos/niri.nix)
+    # only on hosts that run niri
    enable = osConfig.programs.niri.enable;
-    # Use the system's niri so the config is validated against the running version.
+    # validate the config against the installed niri
    package = osConfig.programs.niri.package;
    systemd.enable = false;
    portalPackage = null;
@@ -125,21 +123,11 @@ in
        };
        "Mod+D" = {
          _props.hotkey-overlay-title = "Run an Application";
-          spawn = [
+          spawn-sh = "noctalia msg panel-toggle launcher";
            "noctalia"
            "msg"
            "panel-toggle"
            "launcher"
          ];
        };
        "Super+Alt+L" = {
          _props.hotkey-overlay-title = "Lock the Screen";
-          spawn = [
+          spawn-sh = "noctalia msg session lock";
            "noctalia"
            "msg"
            "session"
            "lock"
          ];
        };
        # media keys (PipeWire / WirePlumber)
@@ -151,24 +139,8 @@ in
        "XF86AudioStop" = lockedSh "playerctl stop";
        "XF86AudioPrev" = lockedSh "playerctl previous";
        "XF86AudioNext" = lockedSh "playerctl next";
-        "XF86MonBrightnessUp" = {
+        "XF86MonBrightnessUp" = lockedSh "brightnessctl --class=backlight set +10%";
-          _props.allow-when-locked = true;
+        "XF86MonBrightnessDown" = lockedSh "brightnessctl --class=backlight set 10%-";
          spawn = [
            "brightnessctl"
            "--class=backlight"
            "set"
            "+10%"
          ];
        };
        "XF86MonBrightnessDown" = {
          _props.allow-when-locked = true;
          spawn = [
            "brightnessctl"
            "--class=backlight"
            "set"
            "10%-"
          ];
        };
        "Mod+O" = {
          _props.repeat = false;
@@ -4,10 +4,7 @@
  programs.nixvim = {
    enable = true;
-    # We keep `inputs.nixvim.inputs.nixpkgs.follows = "nixpkgs"` in flake.nix so
+    # same nixpkgs as the flake's `follows`, silences nixvim's pin warning
    # the whole config shares a single nixpkgs. Setting `source` explicitly to
    # that same nixpkgs acknowledges the override and silences nixvim's warning
    # about its pinned nixpkgs being bypassed.
    nixpkgs.source = inputs.nixpkgs;
    # set aliases
@@ -104,8 +101,6 @@
    };
  };
-  # install dependencies
+  # telescope live_grep
-  home.packages = with pkgs; [
+  home.packages = [ pkgs.ripgrep ];
    ripgrep
  ];
 }
@@ -24,15 +24,18 @@
      # general
      shell = {
-        font_family = "0xProto Nerd Font Mono";
+        font_family = "0xProto Nerd Font";
        ui_scale = 1.2;
        avatar_path = "/home/aaron/syncthing/pictures/Logo-Aaron-Totenkopf-rund-schwarz.png";
        telemetry_enabled = false;
        clipboard_enabled = true;
        password_style = "random";
        launcher = {
          categories = false;
          providers.emoji.global = false;
        };
        panel = {
          launcher_compact = true;
          open_near_click_control_center = true;
          open_near_click_session = true;
          open_near_click_wallpaper = true;
@@ -97,7 +100,7 @@
        bluetooth.capsule = true;
        control-center = {
          capsule_radius = 8;
-          custom_image = "/home/aaron/Pictures/nix_flake_logo.png";
+          custom_image = "/home/aaron/syncthing/pictures/nix_flake_logo.png";
          scale = 1.4;
        };
        cpu.capsule = true;
@@ -116,6 +119,7 @@
      # idle behavior
      idle = {
        pre_action_fade_seconds = 5;
        behavior_order = [
          "screen-off"
          "lock"
@@ -123,14 +127,17 @@
        ];
        behavior = {
          "screen-off" = {
            action = "screen_off";
            enabled = true;
            timeout = 300;
          };
          "lock" = {
            action = "lock";
            enabled = true;
            timeout = 600;
          };
          "lock" = {
            enabled = true;
            timeout = 660;
          };
          "lock-and-suspend" = {
            action = "lock_and_suspend";
            enabled = true;
            timeout = 1800;
          };
@@ -1,25 +1,26 @@
 # zsh with oh-my-zsh: agnoster where glyphs render, gentoo on the console.
 # Deep paths are shortened to `…/last/two` so the prompt stays on one line:
 # `%(4~|…/%2~|%~)` shows the last two components from four levels down.
 { lib, ... }:
 {
  # configure z-shell to use omz with some plugins
  programs.zsh = {
    enable = true;
    autosuggestion.enable = true;
    syntaxHighlighting.enable = true;
    oh-my-zsh = {
      enable = true;
      # add git and agents as plugins
      plugins = [
        "git"
        "ssh-agent"
        "gpg-agent"
      ];
-      # everything here lands before `source $ZSH/oh-my-zsh.sh`
+      # runs before oh-my-zsh is sourced
      extraConfig = ''
-        # make omz faster on large repositories
+        # faster git status on large repositories
        DISABLE_UNTRACKED_FILES_DIRTY=true
        # only display a fancy theme when glyphs are rendered
        if [[ "$TERM" == "linux" || "$TERM" == "screen" ]]; then
          ZSH_THEME="gentoo"
        else
@@ -28,37 +29,20 @@
      '';
    };
-    # Unlike oh-my-zsh.extraConfig above, this lands *after*
+    # runs after oh-my-zsh, once the theme's prompt exists
    # `source $ZSH/oh-my-zsh.sh`, which is where the theme's prompt functions
    # come into existence.
    initContent = lib.mkAfter ''
      # Keep the prompt on one line in deeply nested trees.
      #
      # Both themes render the working directory as `%~`, the full path with
      # $HOME collapsed to `~`. Somewhere like
      # ~/git/bfh/cas-pml-sem/documents/bericht that is 39 columns on its own,
      # and together with user@host and a long branch name the line wraps.
      #
      # `%(4~|…/%2~|%~)` is a prompt ternary: at four or more components show
      # an ellipsis and the last two, otherwise show the path whole. Short
      # paths like ~/git/nixconfig are left alone.
      if [[ "$ZSH_THEME" == "agnoster" ]]; then
-        # agnoster calls prompt_dir on every render, so redefining it is
+        # agnoster renders prompt_dir on every prompt, so override it
        # enough. AGNOSTER_DIR_* keep the segment's own colours.
        prompt_dir() {
          prompt_segment "$AGNOSTER_DIR_BG" "$AGNOSTER_DIR_FG" '%(4~|…/%2~|%~)'
        }
      else
-        # gentoo builds PROMPT once at load time, so patch the string. Its
+        # gentoo builds PROMPT once; ascii dots, the console font lacks …
        # `%~` is the non-root branch of `%(!.%1~.%~)`, and it is the first
        # literal `%~` in there, so the root branch is untouched. ASCII `...`
        # because this branch is the Linux console, whose font may lack U+2026.
        PROMPT="''${PROMPT/\%~/%(4~|.../%2~|%~)}"
      fi
    '';
  };
  # set important env vars
  home.sessionVariables = {
    EDITOR = "vim";
    NH_FLAKE = "/home/aaron/git/nixconfig";
@@ -1,7 +1,6 @@
 { pkgs, ... }:
 {
  # set gtk theme
  gtk = {
    enable = true;
    theme = {
@@ -13,7 +12,6 @@
    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
  };
  # set qt theme
  qt = {
    enable = true;
    platformTheme.name = "qt6";
@@ -22,10 +20,4 @@
      package = pkgs.adwaita-qt;
    };
  };
  # ensure packages are installed
  home.packages = with pkgs; [
    gnome-themes-extra
    adwaita-qt
  ];
 }
@@ -1,54 +1,37 @@
 # Nord-style status line built natively, no theme plugin.
 # The powerline separators (U+E0B0..U+E0B3) are written as escapes via
 # fromJSON: literal private-use glyphs get stripped silently on copy/paste.
 # Commas inside #{?...} separate arguments, hence the escaped `#,` below.
 let
  # Powerline separators, U+E0B0..U+E0B3.
  #
  # Written as escapes rather than literal glyphs. These are Private Use Area
  # codepoints: they render only with a patched font, they survive copy/paste
  # badly, and when they get stripped the loss is invisible, the config still
  # parses, the status bar just quietly loses its separators. Nix has no \u
  # escape of its own, but fromJSON does.
  sep = builtins.fromJSON ''
    {
-      "right":     "\ue0b0",
+      "right":     "",
-      "rightThin": "\ue0b1",
+      "rightThin": "",
-      "left":      "\ue0b2",
+      "left":      "",
-      "leftThin":  "\ue0b3"
+      "leftThin":  ""
    }
  '';
 in
 {
  programs.tmux = {
    # defaults
    enable = true;
    prefix = "C-a";
    keyMode = "vi";
    mouse = true;
-
+    terminal = "tmux-256color"; # truecolor, italics and undercurl in nvim
-    # tmux-256color gives truecolor, italics and undercurl in nvim.
+    escapeTime = 10; # the 500ms default lags leaving insert mode in nvim
-    terminal = "tmux-256color";
+    focusEvents = true; # nvim autoread
    # Default is 500ms. Causes lag you feel when leaving insert mode in nvim,
    # because tmux is waiting to see whether Esc starts an escape sequence.
    escapeTime = 10;
    # nvim autoread / :checktime react to focus.
    focusEvents = true;
    # History limit.
    historyLimit = 50000;
-
+    baseIndex = 1; # window numbers match the number row
    # Window numbers matching the number row.
    baseIndex = 1;
    extraConfig = ''
      # Status keys
      set -g status-keys vi
-      # Tell tmux the outer terminal can do 24-bit colour (tmux >= 3.2).
+      # outer terminal does 24-bit colour
      set -sa terminal-features ",*:RGB"
-      # Shift+Enter / extended keys
+      # forward Shift+Enter and other extended keys as CSI-u (tmux >= 3.5)
      # These make tmux forward CSI-u sequences unconditionally.
      # Needs tmux >= 3.5 for the format option,
      set -s extended-keys always
      set -s extended-keys-format csi-u
      set -as terminal-features '*:extkeys'
@@ -88,27 +71,18 @@ in
      bind -r K resize-pane -U 5
      bind -r L resize-pane -R 5
-      # Wayland clipboard integration
+      # copy to both the clipboard and primary selection
      # Copy selection to both clipboard (Ctrl+V / Shift+Insert) and primary (middle-click)
      bind -T copy-mode-vi v send-keys -X begin-selection
      bind -T copy-mode-vi C-v send-keys -X rectangle-toggle
      bind -T copy-mode-vi y send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
      bind -T copy-mode-vi Enter send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
      bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
      # Uncomment if you want yanks to also travel over SSH via OSC52.
      # Locally redundant with wl-copy above.
      #set -g set-clipboard on
      # Kill commands
      bind q confirm-before -p "kill window #W? (y/n)" kill-window
      bind Q confirm-before -p "kill session #S? (y/n)" kill-session
      # Bars
      # This is the nord-tmux status line. #{prefix_highlight} came from that
      # theme's tmux-prefix-highlight integration -- a plugin you never loaded,
      # so the token expanded to nothing. tmux can do it natively. Commas inside
      # #{?...} are argument separators and have to be escaped as #, hence the
      # look of the style spec.
      set -g status-left-length 24
      set -g status-left "#[fg=black,bg=blue,bold] #{=20:session_name} #[fg=blue,bg=black,nobold,noitalics,nounderscore]${sep.right}"
      set -g status-right "#{?client_prefix,#[fg=black#,bg=yellow#,bold] ^A ,}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]${sep.left}#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]${sep.leftThin}#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]${sep.left}#[fg=black,bg=cyan,bold] #H "
@@ -1,17 +1,10 @@
 # Running an AppImage directly fails on NixOS: its runtime dlopens
 # libfuse.so.2, which nix-ld doesn't cover. appimage-run unpacks the image
 # into an FHS sandbox instead. Used for the BitBox02 wallet from bitbox.swiss.
 {
  # AppImages ship a squashfs payload that the bundled runtime mounts through
  # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that
  # dlopen, so running one directly dies with "dlopen(): error loading
  # libfuse.so.2". appimage-run sidesteps the mount entirely: it unpacks the
  # image and runs the payload inside an FHS sandbox, which the bundled Qt and
  # electron style binaries need anyway.
  #
  # Used for the BitBox02 wallet AppImage, downloaded fresh from
  # https://bitbox.swiss/download/ rather than installed from nixpkgs.
  programs.appimage = {
    enable = true;
-    # register AppImages with binfmt_misc so ./Something.AppImage runs as-is,
+    binfmt = true; # ./Something.AppImage runs without the appimage-run prefix
    # no appimage-run prefix to remember.
    binfmt = true;
  };
 }
@@ -1,37 +1,23 @@
 # Stellarium for target finding, Siril for stacking.
 #
 # Siril's python plugins run in a venv of foreign manylinux wheels (numpy,
 # PyQt6, ...), dlopened by nixpkgs python, so nix-ld doesn't help. The wrapper
 # puts their libs on LD_LIBRARY_PATH, a python on PATH to bootstrap the venv,
 # and adwaita-qt6 on QT_PLUGIN_PATH so the dark style override resolves.
 # The python comes from /etc/siril/bin, a stable symlink: a /nix/store path
 # would leave the venv dangling after the next python bump and gc.
 #
 # StarNet++ has no package: unzip the v2 ORT cli build from starnetastro.com
 # to ~/.local/share/siril/starnet/ and point Siril's preferences at ./starnet2.
 # It runs through nix-ld and finds its own libs in the bundled ./lib.
 { lib, pkgs, ... }:
 let
  # Siril's Python plugins (sirilpy) run in a venv that pip-installs foreign
  # manylinux wheels (numpy, GraXpert deps, ...). Those .so files need
  # libstdc++ at runtime. nix-ld does NOT cover this: it only handles the
  # initial exec of a foreign binary, but here a *native* nixpkgs python
  # dlopen()s the foreign wheel. So we put the libs on LD_LIBRARY_PATH, which
  # the python subprocess inherits from the Siril process.
  sirilWithPlugins = pkgs.symlinkJoin {
    name = "siril-with-plugins";
    paths = [ pkgs.siril ];
    nativeBuildInputs = [ pkgs.makeWrapper ];
    # Siril bootstraps its sirilpy venv at first run by locating a `python3`
    # on PATH. nixpkgs only *propagates* python3 from the siril derivation (it
    # isn't on the runtime PATH), so without the --prefix PATH below the GUI
    # fails with "Python not found in system PATH" and never creates
    # ~/.local/share/siril/venv.
    #
    # We deliberately do NOT put ${pkgs.python3}/bin on PATH directly: `venv`
    # symlinks bin/python3 to whatever sys.executable was, so the venv would
    # hard-link a /nix/store hash that gets garbage-collected after the next
    # python bump, leaving a dangling symlink ("Error finding venv python
    # path, unable to spawn python"). Instead we go through the stable
    # /etc/siril/bin/python3 symlink (see environment.etc below), which NixOS
    # re-points at the current python on every rebuild.
    #
    # The VeraLux PyQt6 wheel ships only the built-in Windows/Fusion styles, so
    # the global QT_STYLE_OVERRIDE=adwaita-dark (inherited from the session) is
    # rejected ("invalid style override") and windows fall back to a light
    # theme. We expose nixpkgs adwaita-qt6's style plugin on QT_PLUGIN_PATH so
    # the override resolves. This works because nixpkgs qt6 and the bundled Qt
    # share a major.minor (6.11); if they ever drift the plugin is simply
    # ignored again (harmless warning + Fusion fallback, no loss of function).
    postBuild = ''
      wrapProgram $out/bin/siril \
        --prefix PATH : /etc/siril/bin \
@@ -40,21 +26,19 @@ let
          lib.makeLibraryPath (
            with pkgs;
            [
-              stdenv.cc.cc.lib # libstdc++ / libgcc_s / libgomp  (numpy etc.)
+              stdenv.cc.cc.lib # libstdc++, libgcc_s, libgomp (numpy)
              zlib
-              zstd # libzstd.so.1                     (PyQt6)
+              zstd # PyQt6
-              libGL # libGL.so.1                       (PyQt6)
+              libGL # PyQt6
-              # PyQt6 (VeraLux) — Qt bundles xcb support so it needs these even
+              # Qt needs these even on wayland
              # on Wayland; libxkbcommon is the keymap lib used by Wayland too.
              glib
              fontconfig
              freetype
              dbus
              libxkbcommon
-              # Qt platform plugins: the wayland plugin (libqwayland.so) needs the
+              # Qt platform plugins: wayland, and the xcb fallback
-              # wayland client libs; the xcb fallback needs libxcb-cursor.so.0.
+              wayland
-              wayland # libwayland-client/cursor/egl       (wayland plugin)
+              libxcb-cursor
              libxcb-cursor # libxcb-cursor.so.0                 (xcb plugin)
              libx11
              libxcb
              libxcb-util
@@ -69,27 +53,20 @@ let
  };
 in
 {
-  # install stellarium for target finding and siril for stacking
+  environment.systemPackages = [
-  environment.systemPackages = with pkgs; [
+    pkgs.stellarium
    stellarium
    sirilWithPlugins
  ];
-  # Stable, GC-safe interpreter path for Siril's venv (see sirilWithPlugins).
+  # same python siril propagates, so sirilpy's abi matches
  # Same python as siril itself propagates, so sirilpy's ABI matches.
  environment.etc."siril/bin/python3".source = "${pkgs.python3}/bin/python3";
-  # StarNet++ has no nixpkgs package. Download the StarNet v2 ORT CLI build
+  # for StarNet++
-  # (starnet2_linux_*_ORT_x64_cli) from https://www.starnetastro.com/download/
+  programs.nix-ld = {
-  # and unzip it to ~/.local/share/siril/starnet/. Then in Siril set
+    enable = true;
-  #   Preferences -> Miscellaneous -> StarNet executable
+    libraries = with pkgs; [
-  # to the extracted ./starnet2 binary.
+      stdenv.cc.cc.lib
  #
  # The binary is a generic dynamically-linked ELF, so NixOS needs nix-ld to
  # run it. Its own opencv/onnxruntime libs are found via the bundled ./lib.
  programs.nix-ld.enable = true;
  programs.nix-ld.libraries = with pkgs; [
    stdenv.cc.cc.lib # libstdc++ / libgcc_s
      zlib
    ];
  };
 }
@@ -1,8 +0,0 @@
 { pkgs, ... }:
 {
  # install calibre for ebook management and kobo syncing
  environment.systemPackages = with pkgs; [
    calibre
  ];
 }
@@ -1,7 +0,0 @@
 { pkgs, ... }:
 {
  environment.systemPackages = with pkgs; [
    claude-code
  ];
 }
@@ -1,12 +1,8 @@
 { pkgs, ... }:
 {
-  # add docker group to user
+  # rootless only: no root daemon and no root-equivalent docker group
-  users.users.aaron.extraGroups = [ "docker" ];
+  virtualisation.docker.rootless = {
  virtualisation.docker = {
    enable = true;
-    # Customize Docker daemon settings
+    setSocketVariable = true;
    daemon.settings = {
      dns = [
        "1.1.1.1"
@@ -14,16 +10,6 @@
      ];
      log-driver = "journald";
      registry-mirrors = [ "https://mirror.gcr.io" ];
      storage-driver = "overlay2";
    };
    # Use the rootless mode
    rootless = {
      enable = true;
      setSocketVariable = true;
    };
    # Install docker-compose
    extraPackages = with pkgs; [
      docker-compose
    ];
  };
 }
@@ -1,45 +0,0 @@
 # Add encrypted drives to argon
 {
  # copy keyfiles into initrd to make them available during early boot
  boot.initrd.secrets = {
    "/etc/nixos/keys/data1.key" = "/etc/nixos/keys/data1.key";
    "/etc/nixos/keys/data2.key" = "/etc/nixos/keys/data2.key";
    "/etc/nixos/keys/nvmecache.key" = "/etc/nixos/keys/nvmecache.key";
  };
  # decrypt data drives with keyfiles for argon
  boot.initrd.luks.devices = {
    "data1" = {
      device = "/dev/disk/by-uuid/dfae62cc-bad1-4879-bf9a-461bde833625";
      keyFile = "/etc/nixos/keys/data1.key";
    };
    "data2" = {
      device = "/dev/disk/by-uuid/8312edae-9247-481b-a313-52a7f848f027";
      keyFile = "/etc/nixos/keys/data2.key";
    };
    "nvmecache" = {
      device = "/dev/disk/by-uuid/2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
      keyFile = "/etc/nixos/keys/nvmecache.key";
    };
  };
  # mount decrypted filesystems
  fileSystems."/mnt/data1" = {
    device = "/dev/mapper/data1";
    fsType = "ext4";
    options = [ "nofail" ];
  };
  fileSystems."/mnt/data2" = {
    device = "/dev/mapper/data2";
    fsType = "ext4";
    options = [ "nofail" ];
  };
  fileSystems."/mnt/nvmecache" = {
    device = "/dev/mapper/nvmecache";
    fsType = "ext4";
    options = [ "nofail" ];
  };
 }
@@ -1,29 +1,24 @@
 # A graphical pinentry never grabs the tty, so a passphrase prompt can't take
 # over a terminal driven by a coding agent. The cache lasts a working day, and
 # an unattended signature fails after two minutes instead of blocking forever.
 { config, pkgs, ... }:
 {
  # enable gnupg agent
  programs.gnupg.agent = {
    enable = true;
    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
    # longer take over a terminal that a coding agent is driving
    pinentryPackage = pkgs.pinentry-qt;
    settings = {
      # keep the key unlocked for a full working day instead of 10 minutes,
      # so signing commits asks at most once per session
      default-cache-ttl = 86400;
      max-cache-ttl = 86400;
      # fail an unattended signature instead of blocking on a prompt forever
      pinentry-timeout = 120;
    };
  };
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = [
-    gnupg
+    pkgs.pinentry-curses # fallback for sessions without a display
    pinentry-qt
    # fallback for sessions without a display, switch pinentryPackage to use it
    pinentry-curses
    # prime the passphrase cache on demand, e.g. before an agent session
-    (writeShellScriptBin "gpg-unlock" ''
+    (pkgs.writeShellScriptBin "gpg-unlock" ''
      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
      echo "gpg key unlocked"
    '')
@@ -1,12 +0,0 @@
 { pkgs, ... }:
 {
  # install gnuradio companion along with it's osmocom library
  environment.systemPackages = with pkgs; [
    (gnuradio.override {
      extraPackages = with gnuradio.pkgs; [ osmosdr ];
    })
    gqrx
    hackrf
  ];
 }
@@ -1,17 +0,0 @@
 { pkgs, ... }:
 {
  # enable amd GPU acceleration (mesa, vulkan, egl)
  hardware.graphics = {
    enable = true;
    enable32Bit = true;
  };
  # install amdgpu_top
  environment.systemPackages = with pkgs; [
    amdgpu_top
  ];
  # add amdgpu to the initrd for plymouth
  hardware.amdgpu.initrd.enable = true;
 }
@@ -1,20 +1,12 @@
 { pkgs, ... }:
 {
  # user networkmanager
  networking.networkmanager.enable = true;
-  # firewall default configs
+  # wifi firmware and bluetooth
  networking.firewall.allowedTCPPorts = [ ];
  networking.firewall.allowedUDPPorts = [ ];
  # enable wifi firmware
  hardware.enableAllFirmware = true;
  # enable bluetooth
  hardware.bluetooth.enable = true;
  # Add network-related packages
  environment.systemPackages = with pkgs; [
    wireguard-tools
    update-systemd-resolved
@@ -1,11 +1,7 @@
 { pkgs, ... }:
 {
-  # just enable and install niri
+  # compositor and session; the config itself lives in home-manager
  programs.niri.enable = true;
-
+  environment.systemPackages = [ pkgs.xwayland-satellite ];
  # Add compositor-related packages
  environment.systemPackages = with pkgs; [
    xwayland-satellite
  ];
 }
@@ -1,14 +1,14 @@
-{ pkgs, inputs, ... }:
+{ pkgs, ... }:
 {
-  # install noctalia and helper packages
+  # helpers for the noctalia shell (the shell itself comes from home-manager)
  environment.systemPackages = with pkgs; [
    inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default
    adw-gtk3
    adwaita-qt
    adwaita-qt6
    brightnessctl
    ddcutil
    playerctl
    wl-clipboard
    wl-mirror
  ];
 }
@@ -1,10 +1,11 @@
 { pkgs, ... }:
 {
-  # system packages
+  # baseline tools for every host
  environment.systemPackages = with pkgs; [
    btop
    cifs-utils
    claude-code
    cowsay
    dnsutils
    ethtool
@@ -14,31 +15,25 @@
    imv
    iperf3
    jq
    kdePackages.qtmultimedia
    ldns
    lm_sensors
    lsof
    mtr
    neovim
    nfs-utils
    nh
    nix-output-monitor
    nmap
    nvd
    p7zip
    pciutils
    socat
    sof-firmware
    strace
    sysstat
    tree
    unzip
    usbutils
    vial
    vim
    wget
    which
    wl-clipboard
    xz
    zip
    zstd
@@ -1,13 +1,8 @@
 { pkgs, ... }:
 {
-  # protonvpn uses wireguard tunnels, which break strict reverse path filtering
+  # wireguard replies may leave on another interface, so strict rpfilter drops them
  # because packets arrive on the tunnel interface but may be routed back differently.
  # "loose" checks that the source is routable through *any* interface (not necessarily
  # the same one), which is sufficient for wireguard while still preventing IP spoofing.
  networking.firewall.checkReversePath = "loose";
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = [ pkgs.proton-vpn ];
    proton-vpn
  ];
 }
@@ -1,25 +1,15 @@
 { pkgs, ... }:
 {
  # enable sddm and use astronaut theme
  services.displayManager.sddm = {
    enable = true;
    wayland.enable = true;
    autoNumlock = true;
    enableHidpi = true;
    theme = "sddm-astronaut-theme";
-    settings = {
+    extraPackages = [ pkgs.sddm-astronaut ]; # theme's qml dependencies
      Theme = {
        Current = "sddm-astronaut-theme";
      };
    };
    extraPackages = with pkgs; [
      sddm-astronaut
    ];
  };
-  # Make the theme available in the system path so sddm can find it
+  # sddm looks for themes in the system path
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = [ pkgs.sddm-astronaut ];
    sddm-astronaut
  ];
 }
@@ -1,31 +1,25 @@
 {
  nix = {
    # nix settings
    settings = {
      # enable flakes and nix-command
      experimental-features = [
        "nix-command"
        "flakes"
      ];
      # auto-optimize my nix-store
      auto-optimise-store = true;
-      # use all cores
+      # parallel builds, each using all cores
      max-jobs = "auto";
      # use all available cores per job
      cores = 0;
-      # add trusted substituters (binary caches)
+      # cache.nixos.org is the default, these come on top
-      substituters = [
+      extra-substituters = [ "https://nix-community.cachix.org" ];
-        "https://cache.nixos.org"
+      extra-trusted-public-keys = [
        "https://nix-community.cachix.org"
      ];
      # add keys
      trusted-public-keys = [
        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      ];
      trusted-users = [
        "root"
        "@wheel"
      ];
    };
    # enable automatic garbage collection
    gc = {
      automatic = true;
      dates = "weekly";
@@ -33,20 +27,9 @@
    };
  };
-  # add trusted users (able to modify the nix store)
+  # steam, protonvpn, discord, etc.
  nix.settings.trusted-users = [
    "root"
    "@wheel"
  ];
  # allow unfree packages (steam, protonvpn, discord, etc.)
  nixpkgs.config.allowUnfree = true;
  # links /libexec from derivations to /run/current-system/sw
  environment.pathsToLink = [ "/libexec" ];
  # enable home-manager globally
  home-manager.useGlobalPkgs = true;
  home-manager.useUserPackages = true;
  home-manager.backupCommand = "mv -f {file} {file}.hm-bak-$(date +%Y%m%d%H%M%S)";
 }
@@ -1,20 +1,13 @@
 { pkgs, ... }:
 {
  # enable steam and open firewall
  programs.steam = {
    enable = true;
    # fix black screen when running under xwayland-satellite
    package = pkgs.steam.override { extraArgs = "-system-composer"; };
    remotePlay.openFirewall = true;
    dedicatedServer.openFirewall = true;
    localNetworkGameTransfers.openFirewall = true;
-    # add proton-glorious-eggroll
+    extraCompatPackages = [ pkgs.proton-ge-bin ];
    extraCompatPackages = with pkgs; [
      proton-ge-bin
    ];
  };
  # fix black screen in steam when using xwayland-satellite
  programs.steam.package = pkgs.steam.override {
    extraArgs = "-system-composer";
  };
 }
@@ -1,14 +1,9 @@
 { pkgs, ... }:
 {
  # Enable Thunar
  programs.thunar.enable = true;
-  # Install Tumbler thumbnailer service
+  # thumbnails: tumbler service plus the path it loads extensions from
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = [ pkgs.tumbler ];
    tumbler
  ];
  # Ensure Thunar can locate the thumbnailer extensions
  environment.pathsToLink = [ "share/thumbnailers" ];
 }
@@ -1,10 +1,8 @@
 { pkgs, ... }:
 {
  # create users
  users.users.aaron = {
    isNormalUser = true;
    group = "users";
    extraGroups = [
      "wheel"
      "networkmanager"
@@ -13,10 +11,6 @@
    shell = pkgs.zsh;
  };
-  # add default zsh config
+  # login shell; plugins and prompt are configured in home-manager
-  programs.zsh = {
+  programs.zsh.enable = true;
    enable = true;
    enableCompletion = true;
    autosuggestions.enable = true;
  };
 }
@@ -1,26 +1,21 @@
 # Vial keyboards (lily58 pro r2g) expose a raw HID interface that vial.rocks
 # drives over WebHID; its /dev/hidraw* node is root-only by default.
 # The rule ships as 60-vial.rules because uaccess is only applied by
 # 73-seat-late.rules, and services.udev.extraRules lands at 99, too late.
 { pkgs, ... }:
 {
  # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw
  # HID interface that vial.rocks drives over WebHID. Its /dev/hidraw* node is
  # root-only by default, so neither chromium nor the native app can open it.
  #
  # This has to ship as a numbered rules file rather than via
  # services.udev.extraRules: extraRules lands in 99-local.rules, but the
  # builtin that turns TAG+="uaccess" into an actual ACL is invoked from
  # systemd's 73-seat-late.rules. A tag set at 99 is set too late to be seen,
  # so the device ends up correctly tagged and still unreadable. 60- sorts
  # safely ahead of 73.
  services.udev.packages = [
    (pkgs.writeTextFile {
      name = "vial-udev-rules";
      destination = "/lib/udev/rules.d/60-vial.rules";
-      # Vial firmware advertises itself through a magic USB serial, so this
+      # the magic serial matches any vial board; uaccess grants the seat owner
      # matches any vial board rather than just the lily58. uaccess hands the
      # device to whoever owns the active seat, no group membership needed.
      text = ''
        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", TAG+="uaccess"
      '';
    })
  ];
  environment.systemPackages = [ pkgs.vial ];
 }
`@@ -1,4 +1,4 @@`
	`# 0x29a nixos conifg`	`# 0x29a nixos config`

	`{ pkgs, ... }:`	`{ pkgs, ... }:`