aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
386 Commits 76 Branches 0 Tags
fix/distrust-emudhra-ecc-root
Commit Graph
110 Commits
Author SHA1 Message Date
aaronandClaude Opus 5.5 5b38fc4155 fix(certificates): temporarily distrust emSign ECC Root CA - G3 
Eight eMudhra intermediates chaining to this root were generated with
trivially recoverable private keys (Mozilla bug 2083449), so anyone can
mint certificates that non-browser clients using the system bundle will
accept. Browsers already block them; the system bundle does not until
cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable
yet. Drop this once the flake lock includes that commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-21 13:39:53 +02:00
aaronandClaude Opus 5.5 fb3e2864d6 fix(tailscale): open Tailscale's WireGuard port in the firewall 
services.tailscale.openFirewall defaults to false while the NixOS
firewall is enabled, so argon, krypton and neon dropped unsolicited
inbound 41641/udp. Direct connections then only succeed if the other
peer accepts inbound; between two of these hosts (or a host and a
phone) traffic can fall back to a DERP relay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-20 12:48:41 +02:00
aaron b07d8aefa4 feature: add de_nodeadkeys to niri-greet as well 2026-10-15 20:59:52 +02:00
aaron 75f7acbf2e feature(greetd): add noctalia-greeter to greetd 2026-10-14 09:19:40 +02:00
aaron 104e0a7cb3 feature: use the local log driver insteald of journald for rootless docker 2026-10-12 19:15:51 +02:00
aaron e9b3e5961c feature(docker): make changes to the rootless docker setup to support the netgame webapp which relies on k3d and traefik 2026-10-07 16:05:46 +02:00
aaron 318e17ac27 fix: do not allow edits to the bootloader 2026-10-03 14:11:29 +02:00
aaron d26bd424cc feature(boot): add luks unlock method using TPM+PIN 2026-10-03 13:25:18 +02:00
aaron b2a2e7d161 Merge remote-tracking branch 'origin/main' into feature/secure_boot 2026-10-03 11:41:27 +02:00
aaron 450559f8c6 feature: data-drives on argon and boot securty (#87) 
- increase security by restricting /boot to root only
- add data-drives for encrypted drives that will get mounted through crypttab rather than the initrd

Reviewed-on: #87
Co-authored-by: aaron <aaron@0x29a.ch>
 2026-10-03 10:57:34 +02:00
aaron b75f44ceab feature(lanzaboote): add support for secure-boot through lanazaboote 2026-10-03 10:39:28 +02:00
aaron 6a080b2319 feature(boot): attatch /tmp to tmpfs, but keep nix build in /var/tmp 2026-10-02 16:39:53 +02:00
aaronandClaude Opus 5.5 87eb1bcb72 refactor(docker): rootless only 
Drops the root daemon and the root-equivalent docker group; the daemon settings now apply to the rootless daemon. compose ships with the docker package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 09:25:40 +02:00
aaronandClaude Opus 5.5 06b656477b docs: move explanations into short module headers 
Non-obvious context sits in a brief header at the top of a module, everything else uses single-line comments. niri binds use spawn-sh strings, so neon only overrides the command.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 09:25:40 +02:00
aaronandClaude Opus 5.5 8d19be9527 refactor: fold host-only modules into the hosts 
- argon owns its gpu settings, calibre and the luks drives, now generated from one table
- claudecode.nix is gone, claude-code lives in packages.nix
- home-manager options live next to the home-manager wiring in flake.nix
- settings.nix: one nix block, extra-substituters instead of repeating the cache.nixos.org defaults
- README: current layout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 09:25:40 +02:00
aaronandClaude Opus 5.5 1abb1ca6a1 chore: drop redundant packages and options 
- packages.nix is the baseline: drop neovim (nixvim), nvd, sof-firmware (enableAllFirmware), qtmultimedia (v4 leftover); vial moves to vial.nix, wl-clipboard to noctalia.nix, claude-code becomes a plain package here
- drop packages and options already provided elsewhere: noctalia (home-manager), gnupg/pinentry-qt (agent), gtk/qt themes, sddm Theme.Current, zsh plugins (home-manager), group = users, empty firewall lists
- single-package lists without `with pkgs;`, steam package inside its block

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 09:25:40 +02:00
aaronandClaude Opus 5.5 4633687ccb chore: remove unused gnuradio module 
It isn't imported by any host and doesn't build reliably on unstable; gnuradio moves to a devenv in the projects that need it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 09:25:14 +02:00
aaron 2231d2fc3f style: format all nix files with nixfmt 2026-10-01 11:40:12 +02:00
aaron 4ec579b1fc chore(lint): add statix config and remove unused arguments 2026-10-01 11:40:03 +02:00
aaron c1d11138b3 Merge pull request 'feature: pull in the latest updates, fix some errors and add a devenv for this repository' (#80) from chore/update into main 
Reviewed-on: #80
 2026-10-01 11:26:12 +02:00
aaron 92b170e5e8 feature: pull in the latest updates, fix some errors and add a devenv for this repository 2026-10-01 11:20:22 +02:00
aaron 3b4f05a91c feature(wl-mirror): add wl-mirror as dependency to noctalia 2026-09-29 16:05:18 +02:00
aaron 28f5f4faa9 fix(siri): add venv to the siril installation 2026-09-19 18:48:20 +02:00
aaron d9d6877714 feature(gpg): move git from gpg-signing to ssh-signing 2026-09-05 15:33:05 +02:00
aaron bc11b464a8 fix: ship a numbered udev rule file for vial since otherwise it gets overwritten by systemd's udev file 2026-08-09 14:45:08 +02:00
aaron 0ac9b45286 Merge pull request 'feature(udev): add support for vial.rocks configurable devices and add the native app as well' (#69) from feature/lily58 into main 
Reviewed-on: #69
 2026-08-09 14:27:03 +02:00
aaron 0b1190a257 feature(appimage): add appimage squashfs support for my nixos 2026-08-09 14:13:06 +02:00
aaron 62954a67b5 feature(udev): add support for vial.rocks configurable devices and add the native app as well 2026-08-09 13:49:46 +02:00
aaron 2a3c439993 refactor(sleep): move the s2 sleep change to argon only since s2idle would cost more battery on a laptop that s3 deep sleep 2026-07-23 15:08:24 +02:00
aaron 6fdde12804 fix(sleep): change sleep mode from s3 deep to s2 idle sleep to prevent issues woth radeon RDNA4 cards 2026-07-23 14:51:55 +02:00
aaron dfc2a1ca3a feature(packages): add nfs-utils 2026-06-27 18:51:31 +02:00
aaron ec79afe982 feature(packages): add cifs-utils 2026-06-27 18:35:06 +02:00
aaron 3bd71bb5e1 feature(noctalia): add ddcutil to adjust the screens brightness 2026-06-23 13:02:19 +02:00
aaron dab8e42797 fix(siril): expose adwaita-qt6 style plugin for dark theme 2026-06-23 11:08:10 +02:00
aaron cd905df8b4 fix(siril): add python3 to the siril wrapper so it sees it in its runtime path 2026-06-23 10:53:21 +02:00
aaron 79b24d9439 fix: add more shared objects for sirils plugins 2026-06-20 21:48:26 +02:00
aaron b295a9a330 feature(siril): make siril plugins work by exposing shared objects 2026-06-20 18:11:34 +02:00
aaron 29db6af86b feature(starnet): add starnet to siril to use ml models for star removal, this needs nix-ld to be enabled 2026-06-20 13:58:29 +02:00
aaron 9d7efb69ac feature(astro): collect astrofotography tools in one module 2026-06-20 12:18:45 +02:00
aaron 1d558f3f7c feature(stellarium): add new module for stellarium 2026-06-07 18:33:29 +02:00
aaron a3e09d0019 fix: remove typo 2026-05-29 19:19:10 +02:00
aaron ae895dc55f fix: tumbler is a package rather than a programm and thus must be installed with packages 2026-05-29 19:15:40 +02:00
aaron cb0645dd81 feature(thunar): add thunar and thumbler thumbnailer service 2026-05-29 19:06:02 +02:00
aaron af42bdc7a3 feature(nix): add wheel and root to the list of trusted users 2026-05-21 11:14:55 +02:00
aaron 8605bf7a6b feature(claude): add claude code as a module 2026-05-01 18:35:28 +02:00
aaron a14e5b5a77 feature(gqrx): add gqrx alongside gnuradio since it will be used anyways 2026-04-24 19:15:48 +02:00
aaron 69ca1dbaca feature(gnuradio): add gnuradio-companion with osmocom extension 2026-04-23 20:27:06 +02:00
aaron e0e282a547 feature(calibre): add calibre ebook management 2026-04-09 20:11:19 +02:00
aaron 1b82de5c92 chore(protonvpn): change name to proton-vpn due to deprication 2026-03-31 15:42:14 +02:00
aaron 58509367a3 refactor(browsers): move browser selection to home-manager module since it is a user choice 2026-03-27 11:32:45 +01:00