Merge pull request 'feature(ssl/tls): add my homelab pki root ca to the trust store' (#12) from feature/add_homelab_ca into main

Reviewed-on: #12

README.md

@@ -1,10 +1,10 @@
 # 0x29a nixos config
 
-My personal nixos configuration files.
+My personal nixos configuration files for different environments.
 
 ## basic system installation
 
-- The installations in this repository are always luks encrypted
+- The installations presented in this repository are always luks encrypted
 - For simplicity I'm using device labels rather than uuids
 
 1. the partitioning layout should look somewhat like this after the installation
@@ -111,8 +111,24 @@ $ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
 $ cd /path/to/repo
 $ sudo nix flake update
 $ sudo nixos-rebuild switch --flake .#host_name
+$ sudo nix-collect-garbage
 ```
 
+## how to use nix-helper
+
+The tool nix-helper is installed by this configuration. It simplifies administrating nixos and adds more output to the rebuild command. It also features a diff after a successful build. The command uses the `NH_FLAKE` environment variable to be able to run from whatever directory.
+
+Basic commands with a set `NH_FLAKE` variable are:
+
+```bash
+$ nh os switch
+$ nh os build
+$ nh os test
+$ nh clean all --keep 5
+```
+
+There is also the option to interface with home-manager by using `nh home switch`but this isn't necessary since home-manager is imported as a module in this config.
+
 ## author
 
 aaron <aaron@0x29a.ch>

flake.lock

@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766282146,
+        "lastModified": 1769187349,
-        "narHash": "sha256-0V/nKU93KdYGi+5LB/MVo355obBJw/2z9b2xS3bPJxY=",
+        "narHash": "sha256-clG+nT6I2qxjIgk5WoSDKJyNhzKJs9jzbCujPF2S/yg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "61fcc9de76b88e55578eb5d79fc80f2b236df707",
+        "rev": "082a4cd87c6089d1d9c58ebe52655f9e07245fcb",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766070988,
+        "lastModified": 1769018530,
-        "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=",
+        "narHash": "sha256-MJ27Cy2NtBEV5tsK+YraYr2g851f3Fl1LpNHDzDX15c=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8",
+        "rev": "88d3861acdd3d2f0e361767018218e51810df8a1",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1766273987,
+        "lastModified": 1768910181,
-        "narHash": "sha256-Y8hL2zGyt7xn5J1V806GJ9tMEk6NgVlU7xe4dS4fThE=",
+        "narHash": "sha256-YRU0IHMzXluZxr0JDfq9jtblb4DV7MIB5wj2jYMFKQc=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "ff00fe1512dfcb31b01d770738de9299b434449b",
+        "rev": "5b138edcb2f1c3ed4b29eca3658f04f0639b98b3",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766317205,
+        "lastModified": 1769192065,
-        "narHash": "sha256-PYlMsenwZCG5TrxQSyTraPw8WQwk4FGnbyFdFMuAeYA=",
+        "narHash": "sha256-8RXIQ8gGxB7lmQOJuhhq3UiGhO3zzKiPaDRigR4Fu9Y=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "51aa9fe16b0cc0dc4daa7c447843b36923434f2e",
+        "rev": "9bd9d3cfc9c7b80eabd933ed8033e9f9d1021953",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,5 +1,5 @@
 {
-  description = "0x29a ecosystem NixOS flake";
+  description = "0x29a NixOS flake";
   
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
@@ -28,8 +28,6 @@
           ./hosts/default/configuration.nix
           home-manager.nixosModules.home-manager
           {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
             home-manager.extraSpecialArgs = { inherit inputs; };
             home-manager.users.aaron.imports = [
               nixvim.homeModules.nixvim
@@ -47,8 +45,6 @@
           ./hosts/neon/configuration.nix
           home-manager.nixosModules.home-manager
           {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
             home-manager.extraSpecialArgs = { inherit inputs; };
             home-manager.users.aaron.imports = [
               nixvim.homeModules.nixvim

hosts/neon/configuration.nix

@@ -2,12 +2,13 @@
 
 {
   imports = [
-    ../../modules/nixos/bootloader.nix
     ../../modules/nixos/audio.nix
-    ../../modules/nixos/compositor.nix
+    ../../modules/nixos/bootloader.nix
+    ../../modules/nixos/certificates.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
+    ../../modules/nixos/niri.nix
     ../../modules/nixos/noctalia.nix
     ../../modules/nixos/openssh.nix
     ../../modules/nixos/packages.nix

modules/home-manager/git.nix

@@ -0,0 +1,18 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  programs.git = {
+    enable = true;
+    settings = {
+      push = { autoSetupRemote = true; };
+      user = {
+        name  = "aaron";
+        email = "aaron@0x29a.ch";
+      };
+    };
+    signing = {
+      key = "7A830180A05DAC59CDE43B0677D2F5DB48184456";
+      signByDefault = true;
+    };
+  };
+}

modules/home-manager/nixvim.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  programs.nixvim = {
+    globals.mapleader = " ";
+    enable = true;
+    viAlias = false;
+    vimAlias = true;
+    opts = {
+      number = true;
+      relativenumber = true;
+      shiftwidth = 2;
+      tabstop = 2;
+      expandtab = true;
+      incsearch = true;
+    };
+    colorschemes.nord.enable = true;
+    plugins.lualine.enable = true;
+    plugins.nix.enable = true;
+    plugins.nvim-tree.enable = true;
+    plugins.treesitter.enable = true;
+    plugins.telescope.enable = true;
+    plugins.web-devicons.enable = true;
+    plugins.indent-blankline.enable = true;
+  };
+}

modules/home-manager/programs.nix

@@ -0,0 +1,18 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  # user packages
+  home.packages = with pkgs; [
+    discord
+    fastfetch
+    keepassxc
+    nerd-fonts.sauce-code-pro
+    powerline-fonts
+    powerline-symbols
+    screenfetch
+  ];
+
+  # services and other software
+  services.syncthing.enable = true;
+  programs.home-manager.enable = true;
+}

modules/home-manager/shell.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, inputs, ... }:
+ 
+{
+  programs.zsh = {
+    enable = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+    oh-my-zsh = {
+      enable = true;
+      theme = "agnoster";
+      #plugins = [ "git" "ssh-agent" ];
+    };
+  };
+
+  # set important env vars
+  home.sessionVariables = {
+    EDITOR = "vim";
+    NH_FLAKE = "/home/aaron/git/nixconfig";
+  };
+}

modules/home-manager/styling.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  # set gtk theme
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Adwaita-dark";
+        package = pkgs.gnome-themes-extra;
+      };
+    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
+    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
+  };
+
+  # set qt theme
+  qt = {
+    enable = true;
+    platformTheme.name = "qt6";
+    style = {
+      name = "adwaita-dark";
+      package = pkgs.adwaita-qt;
+    };
+  };
+
+  # ensure packages are installed
+  home.packages = with pkgs; [
+    gnome-themes-extra
+    adwaita-qt
+  ];
+}

modules/home-manager/tmux.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, inputs, ... }:
+
+{
+  programs.tmux = {
+    enable = true;
+    prefix = "C-a";
+    keyMode = "vi";
+    mouse = true;
+    terminal = "screen-256color";
+    extraConfig = ''
+      # Status keys
+      set -g status-keys vi
+      # Status bar options
+      set -g status-interval 1
+      set -g status on
+      set -g status-justify left
+      # Clock mode
+      setw -g clock-mode-colour cyan
+      # Colors
+      set -g status-bg black
+      set -g status-fg white
+      # Key bindings
+      # Reload configuration 
+      bind r source-file ~/.config/tmux/tmux.conf
+      # Panel split and selection
+      unbind %
+      unbind '"'
+      bind v split-window -v
+      bind c split-window -h
+      bind i new-window
+      bind b previous-window
+      bind n next-window
+      # Move around panes with hjkl
+      bind h select-pane -L
+      bind j select-pane -D
+      bind k select-pane -U
+      bind l select-pane -R
+      # Resize panes
+      bind H resize-pane -L 5
+      bind J resize-pane -D 5
+      bind K resize-pane -U 5
+      bind L resize-pane -R 5
+      # Kill commands
+      bind q kill-window
+      bind Q kill-session
+      # Bars
+      set -g status-left "#[fg=black,bg=blue,bold] #S#[fg=blue,bg=black,nobold,noitalics,nounderscore]"
+      set -g status-left "#[fg=black,bg=blue,bold] #S #[fg=blue,bg=black,nobold,noitalics,nounderscore]"
+      set -g status-right "#{prefix_highlight}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]#[fg=black,bg=cyan,bold] #H "
+      # Windows
+      set -g window-status-format "#[fg=black,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#I #[fg=white,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#W #F #[fg=brightblack,bg=black,nobold,noitalics,nounderscore]"
+      set -g window-status-current-format "#[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#I #[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#W #F #[fg=cyan,bg=black,nobold,noitalics,nounderscore]"
+      set -g window-status-separator ""
+    '';
+  };
+}

modules/nixos/bootloader.nix

@@ -17,11 +17,13 @@
   };
 
   # kernel options
-  boot.kernelParams = [ "quiet" "loglevel=2" ];
+  boot.kernelParams = [ "quiet" "acpi.debug_level=0"];
   boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.consoleLogLevel = 2;
 
   # Add boot-related packages
   environment.systemPackages = with pkgs; [
     efibootmgr
+    terminus_font
   ];
 }

modules/nixos/certificates.nix

@@ -0,0 +1,22 @@
+{ config, lib, pkgs, ... }:
+
+let
+  caddyRootCA = ''
+    -----BEGIN CERTIFICATE-----
+    MIIBozCCAUmgAwIBAgIQf2N1DGp2HVOoPaGuGDEnwjAKBggqhkjOPQQDAjAwMS4w
+    LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI1IEVDQyBSb290MB4X
+    DTI1MTEwNjE5NDA1OFoXDTM1MDkxNTE5NDA1OFowMDEuMCwGA1UEAxMlQ2FkZHkg
+    TG9jYWwgQXV0aG9yaXR5IC0gMjAyNSBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG
+    SM49AwEHA0IABGR9mSgKCSjvcv7LvvIcO84Wpf/KtC/aexT5shSKXd1R97kIyMI5
+    SUYz0MzbRZHJ4QMpIeALirOK9Eoy2zht0dKjRTBDMA4GA1UdDwEB/wQEAwIBBjAS
+    BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRHKfIfJrrA2DACFrunVSmdnJHO
+    1zAKBggqhkjOPQQDAgNIADBFAiAoqc0+cHeq/8SQN16CKjVvXpZuMkg7NLDoWYMw
+    KgmzowIhAJlkxzBdVngwnJu8uPrVizTGF6XtmUHdJ0NDeccEqUCr
+    -----END CERTIFICATE-----
+  '';
+in
+{
+  security.pki.certificates = [
+    caddyRootCA # self-signed pki ca for my home-lab
+  ];
+}

modules/nixos/packages.nix

@@ -9,6 +9,8 @@
     dnsutils
     ethtool
     file
+    fwupd
+    fwupd-efi
     ghostty
     git
     imagemagick
@@ -31,8 +33,10 @@
     pciutils
     sddm-astronaut
     socat
+    sof-firmware
     strace
     sysstat
+    terminus_font
     tree
     unzip
     usbutils

modules/nixos/services.nix

@@ -5,5 +5,7 @@
   services = {
     tuned.enable = true;
     upower.enable = true;
+    fwupd.enable = true;
+    tailscale.enable = true;
   };
 }

modules/nixos/settings.nix

@@ -1,8 +1,36 @@
 { config, lib, pkgs, ... }:
 
 {
-  # use flakes and nix command
+  nix = {
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+    # nix settings
+    settings = {
+      # enable flakes and nix-command
+      experimental-features = [ "nix-command" "flakes" ];
+      # auto-optimize my nix-store
+      auto-optimise-store = true;
+      # use all cores
+      max-jobs = "auto";  
+      # use all available cores per job
+      cores = 0;          
+      # add trusted substituters (binary caches)
+      substituters = [
+        "https://cache.nixos.org"
+        "https://nix-community.cachix.org"
+      ];
+      # add keys
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+    };
+    
+    # enable automatic garbage collection
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
 
   # links /libexec from derivations to /run/current-system/sw
   environment.pathsToLink = [ "/libexec" ];

modules/nixos/steam.nix

@@ -10,6 +10,10 @@
     remotePlay.openFirewall = true;
     dedicatedServer.openFirewall = true;
     localNetworkGameTransfers.openFirewall = true;
+    # add proton-glorious-eggroll
+    extraCompatPackages = with pkgs; [
+      proton-ge-bin
+    ];
   };
 
   # fix black screen in steam when using xwayland-satellite

users/aaron/home.nix

@@ -1,151 +1,18 @@
-{ config, pkgs, inputs, ... }:
+{ config, pkgs, ... }:
 
 {
-  # user config
+  imports = [
-  home.username = "aaron";
+    ../../modules/home-manager/git.nix
-  home.homeDirectory = "/home/aaron";
+    ../../modules/home-manager/nixvim.nix
-  # set env vars
+    ../../modules/home-manager/programs.nix
-  home.sessionVariables = {
+    ../../modules/home-manager/shell.nix
-    EDITOR = "vim";
+    ../../modules/home-manager/styling.nix
-    NH_FLAKE = "/home/aaron/git/nixconfig";
+    ../../modules/home-manager/tmux.nix
-  };
-  # don't change
-  home.stateVersion = "25.11";
-
-  # nixvim config
-  programs.nixvim = {
-    globals.mapleader = " ";
-    enable = true;
-    viAlias = false;
-    vimAlias = true;
-    opts = {
-      number = true;
-      relativenumber = true;
-      shiftwidth = 2;
-      tabstop = 2;
-      expandtab = true;
-      incsearch = true;
-    };
-    colorschemes.nord.enable = true;
-    plugins.lualine.enable = true;
-    plugins.nix.enable = true;
-    plugins.nvim-tree.enable = true;
-    plugins.treesitter.enable = true;
-    plugins.telescope.enable = true;
-    plugins.web-devicons.enable = true;
-    plugins.indent-blankline.enable = true;
-  };
-
-  # tmux config
-  programs.tmux = {
-    enable = true;
-    # Basic options
-    prefix = "C-a";
-    keyMode = "vi";
-    mouse = true;
-    # Terminal settings
-    terminal = "screen-256color";
-    # Extra configuration
-    extraConfig = ''
-      # Status keys
-      set -g status-keys vi
-      # Status bar options
-      set -g status-interval 1
-      set -g status on
-      set -g status-justify left
-      # Clock mode
-      setw -g clock-mode-colour cyan
-      # Colors
-      set -g status-bg black
-      set -g status-fg white
-      # Key bindings
-      # Reload configuration 
-      bind r source-file ~/.config/tmux/tmux.conf
-      # Panel split and selection
-      unbind %
-      unbind '"'
-      bind v split-window -v
-      bind c split-window -h
-      bind i new-window
-      bind b previous-window
-      bind n next-window
-      # Move around panes with hjkl
-      bind h select-pane -L
-      bind j select-pane -D
-      bind k select-pane -U
-      bind l select-pane -R
-      # Resize panes
-      bind H resize-pane -L 5
-      bind J resize-pane -D 5
-      bind K resize-pane -U 5
-      bind L resize-pane -R 5
-      # Kill commands
-      bind q kill-window
-      bind Q kill-session
-      # Bars
-      set -g status-left "#[fg=black,bg=blue,bold] #S#[fg=blue,bg=black,nobold,noitalics,nounderscore]"
-      set -g status-left "#[fg=black,bg=blue,bold] #S #[fg=blue,bg=black,nobold,noitalics,nounderscore]"
-      set -g status-right "#{prefix_highlight}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]#[fg=black,bg=cyan,bold] #H "
-      # Windows
-      set -g window-status-format "#[fg=black,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#I #[fg=white,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#W #F #[fg=brightblack,bg=black,nobold,noitalics,nounderscore]"
-      set -g window-status-current-format "#[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#I #[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#W #F #[fg=cyan,bg=black,nobold,noitalics,nounderscore]"
-      set -g window-status-separator ""
-    '';
-  };
-
-  # user packages
-  home.packages = with pkgs; [
-    discord
-    fastfetch
-    keepassxc
-    nerd-fonts.sauce-code-pro
-    powerline-fonts
-    powerline-symbols
-    screenfetch
   ];
 
-  # configure git
+  home = {
-  programs.git.settings = {
+    username = "aaron";
-    enable = true;
+    homeDirectory = "/home/aaron";
-    userName = "aaron";
+    stateVersion = "25.11";
-    userEmail = "aaron@0x29a.ch";
   };
-
-  # configure zsh theme
-  programs.zsh = {
-    enable = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-    oh-my-zsh = {
-      enable = true;
-      theme = "agnoster";
-      #plugins = [ "git" "ssh-agent" ];
-    };
-  };
-
-  # set gtk theme
-  gtk = {
-    enable = true;
-    theme = {
-      name = "Adwaita-dark";
-        package = pkgs.gnome-themes-extra;
-      };
-    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
-    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
-  };
-
-  # set qt theme
-  qt = {
-    enable = true;
-    platformTheme.name = "qt6";
-    style = {
-      name = "adwaita-dark";
-      package = pkgs.adwaita-qt;
-    };
-  };
-
-  # enable syncthing for user
-  services.syncthing.enable = true;
-  # enable home manager
-  programs.home-manager.enable = true;
 }