Merge pull request 'feature(greetd): add noctalia-greeter to greetd' (#103 ) from feature/noctialia-greeter into main

Reviewed-on: #103
feature(greetd): add noctalia-greeter to greetd
2026-10-14 09:20:22 +02:00 · 2026-10-14 09:19:40 +02:00 · 2026-10-12 19:22:42 +02:00 · 2026-10-12 19:15:51 +02:00 · 2026-10-12 18:24:46 +02:00 · 2026-10-12 18:10:15 +02:00
28 changed files with 683 additions and 375 deletions
@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
  { device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
  };
 fileSystems."/home" =
  { device = "/dev/disk/by-label/nixhome";
@@ -102,8 +102,96 @@ nixos-install

 ## how to deploy the initial config
 - Don't forget to install the bootloader, if you changed it since `nixos-install`
+- The fresh install has no flakes and no git yet, a temporary shell is enough
+- If the installer iso is older than the flake's nixpkgs, `--no-reexec` keeps
+  `nixos-rebuild` from re-executing a newer version of itself, which can fail
+  against the older systemd of the fresh install (only needed once)
+- Set a password for the user before rebooting, `users.nix` doesn't set one
 ```bash
-$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
+$ export NIX_CONFIG="experimental-features = nix-command flakes"
+$ nix-shell -p git
+$ sudo nixos-rebuild --install-bootloader boot --flake .#host_name --no-reexec
+$ sudo passwd aaron
+```
+
+## how to enable secure boot
+Secure Boot uses lanzaboote with our own keys, see `modules/nixos/lanzaboote.nix`.
+Do this after the initial config is deployed and boots.
+
+1. create the keys, before the first rebuild with the lanzaboote module
+```bash
+# the keys end up in /var/lib/sbctl, they never leave the host
+$ sudo nix run nixpkgs#sbctl -- create-keys
+```
+
+2. import `modules/nixos/lanzaboote.nix` in the host's `configuration.nix`, rebuild and check the signatures
+```bash
+$ sudo nixos-rebuild switch --flake .#host_name
+# EFI/Linux/*.efi and the bootloader must be signed, kernels in EFI/nixos
+# are not, lanzaboote checks them by hash
+$ sudo sbctl verify
+```
+
+3. reboot once with Secure Boot still disabled, to make sure the new entries boot
+
+4. in the firmware (F2), erase all Secure Boot keys, then boot nixos again
+```bash
+# "Setup Mode: ✗ Enabled", the ✗ only means the state is insecure
+$ sudo sbctl status
+```
+
+5. enroll the keys
+```bash
+# only our own keys, no microsoft keys
+$ sudo sbctl enroll-keys
+```
+- sbctl refuses if the TPM eventlog shows option ROMs (e.g. a dedicated gpu).
+  Don't force it, either trust exactly those with `--tpm-eventlog` or
+  microsoft's keys with `--microsoft`. Without either, the firmware may not
+  start the device, in the worst case the machine doesn't boot at all.
+- Check what sbctl found first, a real option ROM has a PCI device path:
+```bash
+$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
+```
+- Paths starting with `0407` (firmware volume) are drivers from the firmware
+  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
+  exactly those, after a firmware update they may need to be enrolled again
+  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
+- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
+  setup too, use `--microsoft` there, a refused gpu means no picture at all
+- On the Framework (krypton), keep the firmware's built-in OEM certificates
+  with `--firmware-builtin`, vendor firmware updates may need them. If an
+  update fails or the keys were enrolled without them, erase the keys in the
+  firmware again (Setup Mode) and re-enroll:
+```bash
+$ sudo sbctl enroll-keys --firmware-builtin
+```
+
+6. enable Secure Boot in the firmware and set a firmware password, then check
+```bash
+$ bootctl status | grep "Secure Boot"   # enabled (user)
+$ sudo sbctl status                     # Secure Boot: ✓ Enabled
+```
+- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
+- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
+
+## how to unlock the disk with the tpm (laptops)
+Needs Secure Boot first. The TPM releases the key only with the PIN and while
+the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
+
+1. enroll the TPM with a PIN as an additional key slot
+```bash
+# asks for the current passphrase, then the new PIN
+$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
+2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
+
+- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
+  state changed. After a firmware update that's expected, otherwise investigate
+  before typing the passphrase. To re-enroll:
+```bash
+$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
 ```

 ## how to upgrade the system
@@ -10,7 +10,7 @@ My personal NixOS configurations.
 ├── hosts
 │   ├── argon # desktop
 │   ├── neon # laptop
-│   └── default # test vm
+│   └── krypton # second laptop
 │       ├── configuration.nix # host-specific settings and module imports
 │       ├── hardware-configuration.nix # generated by nixos-generate-config
 │       └── niri.nix # host-specific niri settings (outputs, input)
@@ -1,5 +1,120 @@
 {
  "nodes": {
+    "base16": {
+      "inputs": {
+        "fromYaml": "fromYaml"
+      },
+      "locked": {
+        "lastModified": 1755819240,
+        "narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "type": "github"
+      }
+    },
+    "base16-fish": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1765809053,
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      }
+    },
+    "base16-helix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "type": "github"
+      }
+    },
+    "base16-vim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1732806396,
+        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1789760033,
+        "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "firefox-gnome-theme": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783570805,
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -8,11 +123,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788450739,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "lastModified": 1790898470,
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
        "type": "github"
      },
      "original": {
@@ -21,6 +136,62 @@
        "type": "github"
      }
    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "fromYaml": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731966426,
+        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "type": "github"
+      }
+    },
+    "gnome-shell": {
+      "flake": false,
+      "locked": {
+        "host": "gitlab.gnome.org",
+        "lastModified": 1776175984,
+        "narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
+        "owner": "GNOME",
+        "repo": "gnome-shell",
+        "rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
+        "type": "gitlab"
+      },
+      "original": {
+        "host": "gitlab.gnome.org",
+        "owner": "GNOME",
+        "ref": "50.1",
+        "repo": "gnome-shell",
+        "type": "gitlab"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -28,11 +199,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1790819692,
-        "narHash": "sha256-rvubAPbh3QCliic3sAK+CXTrPCGgJstY52OTs/5H1J4=",
+        "lastModified": 1791642191,
+        "narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "c8ecc29e5175452bee4a2aa1ba2383856d795338",
+        "rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
        "type": "github"
      },
      "original": {
@@ -41,6 +212,30 @@
        "type": "github"
      }
    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1790423250,
+        "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v1.2.0",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
    "nixos-hardware": {
      "inputs": {
        "nixpkgs": [
@@ -48,11 +243,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1790948122,
-        "narHash": "sha256-fDMYyzY1lI5b8RuCMrvoaIgTeRwNnTG4dNk1ucROlQE=",
+        "lastModified": 1791721963,
+        "narHash": "sha256-BYhx89XJltnRyQeuDKHVL5eSqbbfAcOKuDts7QRsrxQ=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "0953bb1a609df63013176e3463393f8df993d3ef",
+        "rev": "60a624466c08787ee8303393b7d4752d1826f14f",
        "type": "github"
      },
      "original": {
@@ -63,11 +258,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1790689126,
-        "narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
+        "lastModified": 1791594108,
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
        "type": "github"
      },
      "original": {
@@ -86,11 +281,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1790541651,
-        "narHash": "sha256-/496IQz8qNWHHLnc3Zvr0l4uxJ34igNhJhn7ZKAefFk=",
+        "lastModified": 1791769517,
+        "narHash": "sha256-OVx8OKPdW1fLfDi1oemFkfSvF354UwU5I0GXnNAGygw=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "5980a626794486abad69fca7667f9c11dfbc3bd7",
+        "rev": "84e901ee80e6523068dc3baf86cbf7cdcbf16902",
        "type": "github"
      },
      "original": {
@@ -106,11 +301,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1790718664,
-        "narHash": "sha256-LWil4xgSyqIFZ9sydvL1glFOoiqAOknWUwykC4sqxuY=",
+        "lastModified": 1791817518,
+        "narHash": "sha256-DGVFzc0YXy38vCuS43PZPIkTVKaKxpNgzkNmJsHouP8=",
        "owner": "noctalia-dev",
        "repo": "noctalia-shell",
-        "rev": "fd9759c892fe5034b682c185695f1bee121cd5b3",
+        "rev": "02cb10745d6274e4a696a00308c8ef4cefa7416d",
        "type": "github"
      },
      "original": {
@@ -119,17 +314,136 @@
        "type": "github"
      }
    },
+    "nur": {
+      "inputs": {
+        "flake-parts": [
+          "stylix",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785549842,
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
+    "pre-commit": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789514889,
+        "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
        "nixvim": "nixvim",
-        "noctalia": "noctalia"
+        "noctalia": "noctalia",
+        "stylix": "stylix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789889921,
+        "narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "stylix": {
+      "inputs": {
+        "base16": "base16",
+        "base16-fish": "base16-fish",
+        "base16-helix": "base16-helix",
+        "base16-vim": "base16-vim",
+        "firefox-gnome-theme": "firefox-gnome-theme",
+        "flake-parts": "flake-parts_2",
+        "gnome-shell": "gnome-shell",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur",
+        "systems": "systems_2",
+        "tinted-kitty": "tinted-kitty",
+        "tinted-schemes": "tinted-schemes",
+        "tinted-tmux": "tinted-tmux",
+        "tinted-zed": "tinted-zed"
+      },
+      "locked": {
+        "lastModified": 1791574276,
+        "narHash": "sha256-UMnLnZ3JlA7UTBNNNx1rNsXYoPP/cirXLCKGiQ/yDx8=",
+        "owner": "nix-community",
+        "repo": "stylix",
+        "rev": "2856c4c6a845b9bec98828ef197abe176e4806bb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "stylix",
+        "type": "github"
      }
    },
    "systems": {
      "flake": false,
+      "locked": {
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
      "locked": {
        "lastModified": 1774449309,
        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
@@ -144,6 +458,70 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "tinted-kitty": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1735730497,
+        "narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "type": "github"
+      }
+    },
+    "tinted-schemes": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785153830,
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "type": "github"
+      }
+    },
+    "tinted-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785031658,
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "type": "github"
+      }
+    },
+    "tinted-zed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785030526,
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -11,6 +11,10 @@
      url = "github:noctalia-dev/noctalia-shell";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.2.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    nixos-hardware = {
      url = "github:NixOS/nixos-hardware";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -19,6 +23,10 @@
      url = "github:nix-community/nixvim";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    stylix = {
+      url = "github:nix-community/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

  outputs =
@@ -26,6 +34,7 @@
      nixpkgs,
      home-manager,
      nixvim,
+      stylix,
      ...
    }@inputs:
    let
@@ -45,6 +54,7 @@
              home-manager.extraSpecialArgs = { inherit inputs; };
              home-manager.users.aaron.imports = [
                nixvim.homeModules.nixvim
+                stylix.homeModules.stylix
                ./users/aaron/home.nix
              ];
            }
@@ -53,7 +63,6 @@
    in
    {
      nixosConfigurations = {
-        default = mkHost "default";
        neon = mkHost "neon";
        argon = mkHost "argon";
        krypton = mkHost "krypton";
@@ -1,17 +1,7 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
-# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.

-{ lib, pkgs, ... }:
+{ pkgs, ... }:

-let
-  # luks name -> partition uuid, mounted at /mnt/<name>
-  drives = {
-    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-  };
-  key = name: "/etc/nixos/keys/${name}.key";
-in
 {
  imports = [
    ../../modules/nixos/appimage.nix
@@ -19,8 +9,10 @@ in
    ../../modules/nixos/audio.nix
    ../../modules/nixos/bootloader.nix
    ../../modules/nixos/certificates.nix
+    ../../modules/nixos/data-drives.nix
    ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/greetd.nix
+    ../../modules/nixos/noctalia-greeter.nix
+    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
@@ -32,6 +24,7 @@ in
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
    ../../modules/nixos/thunar.nix
+    ../../modules/nixos/tpm-unlock.nix
    ../../modules/nixos/users.nix
    ../../modules/nixos/vial.nix
  ];
@@ -46,22 +39,12 @@ in
  };
  hardware.amdgpu.initrd.enable = true;

-  # encrypted data drives
-  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
-  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
-    device = "/dev/disk/by-uuid/${uuid}";
-    keyFile = key name;
-    # trim for ssds, ignored by drives without discard support
-    allowDiscards = true;
-  }) drives;
-  fileSystems = lib.mapAttrs' (
-    name: _:
-    lib.nameValuePair "/mnt/${name}" {
-      device = "/dev/mapper/${name}";
-      fsType = "ext4";
-      options = [ "nofail" ];
-    }
-  ) drives;
+  # encrypted data drives, see data-drives.nix
+  local.dataDrives = {
+    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    data2 = "8312edae-9247-481b-a313-52a7f848f027";
+    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
+  };

  environment.systemPackages = with pkgs; [
    amdgpu_top
@@ -39,8 +39,8 @@
    device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
    ];
  };

@@ -1,139 +0,0 @@
-# 0x29a nixos config
-
-{ pkgs, ... }:
-
-{
-  # use flakes
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  # configure bootloader
-  boot.loader.systemd-boot.enable = false;
-  boot.loader.grub = {
-    enable = true;
-    device = "nodev";
-    efiSupport = true;
-  };
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelParams = [
-    "quiet"
-    "console.ttyS0,115200n8" # allow terminals on serial console
-  ];
-  # plymouth boot eye candy
-  boot.initrd.systemd.enable = true;
-  boot.plymouth.enable = true;
-  boot.plymouth.theme = "spinner";
-  # use latest kernel
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  # guest agent for proxmox
-  services.qemuGuest.enable = true;
-
-  # networking
-  networking.hostName = "nixos";
-  networking.networkmanager.enable = true;
-
-  # time zone.
-  time.timeZone = "Europe/Amsterdam";
-  # select internationalisation properties
-  i18n.defaultLocale = "en_US.UTF-8";
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
-    LC_NAME = "en_US.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "en_US.UTF-8";
-  };
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "de_CH-latin1";
-  };
-
-  # window manager configs
-  services.xserver = {
-    enable = true;
-    xkb.layout = "ch";
-    xkb.options = "eurosign:e,caps:escape";
-
-    windowManager.qtile = {
-      enable = true;
-      extraPackages =
-        python3Packages: with python3Packages; [
-          qtile-extras
-        ];
-    };
-  };
-
-  environment.pathsToLink = [ "/libexec" ];
-  environment.variables.EDITOR = "vim";
-
-  # enable sound
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-  };
-
-  # define a user account
-  users.users.aaron = {
-    isNormalUser = true;
-    group = "users";
-    extraGroups = [ "wheel" ];
-    shell = pkgs.zsh;
-    packages = with pkgs; [
-      tree
-      fastfetch
-    ];
-  };
-
-  # browser
-  programs.firefox.enable = true;
-
-  # zsh config
-  programs.zsh = {
-    enable = true;
-    enableCompletion = true;
-    autosuggestions.enable = true;
-    ohMyZsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "sudo"
-      ];
-      theme = "agnoster";
-    };
-  };
-
-  # system packages
-  environment.systemPackages = with pkgs; [
-    vim
-    neovim
-    git
-    ghostty
-    kitty
-    wget
-    gnupg
-  ];
-
-  # Some programs need SUID wrappers
-  programs.mtr.enable = true;
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # enable the OpenSSH daemon
-  services.openssh.enable = true;
-
-  # firewall configs
-  networking.firewall.allowedTCPPorts = [ 22 ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-
-  # install state version
-  system.stateVersion = "25.05"; # Don't change
-}
@@ -1,60 +0,0 @@
-# 0x29a nixos hardware configuration
-
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # boot and initrd configs
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [
-    "dm-snapshot"
-    "cryptd"
-  ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
-
-  # file systems
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixroot";
-    fsType = "ext4";
-  };
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/nixboot";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
-  };
-  fileSystems."/home" = {
-    device = "/dev/disk/by-label/nixhome";
-    fsType = "ext4";
-  };
-  swapDevices = [
-    { device = "/dev/disk/by-label/nixswap"; }
-  ];
-
-  # enable dhcp on all interfaces
-  networking.useDHCP = lib.mkDefault true;
-
-  # set host arch
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
@@ -1,79 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # user config
-  home.username = "aaron";
-  home.homeDirectory = "/home/aaron";
-
-  # packages
-  home.packages = with pkgs; [
-    fastfetch
-    zip
-    xz
-    unzip
-    p7zip
-    jq
-    mtr
-    iperf3
-    dnsutils
-    ldns
-    socat
-    nmap
-    cowsay
-    file
-    which
-    tree
-    zstd
-    gnupg
-    btop
-    iotop
-    iftop
-    strace
-    lsof
-    sysstat
-    lm_sensors
-    ethtool
-    pciutils
-    usbutils
-  ];
-
-  # configure git
-  programs.git.settings = {
-    enable = true;
-    userName = "aaron";
-    userEmail = "aaron@0x29a.ch";
-  };
-
-  programs.zsh = {
-    enable = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-    oh-my-zsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "sudo"
-        "python"
-        "ansible"
-      ];
-      theme = "agnoster";
-    };
-  };
-
-  ## deploy qtile config
-  #home.file."qtile-config" = {
-  #  target = ".config/qtile/config.py";
-  #  source = "${inputs.qtile-config}/qtile_config/config.py";
-  #  force = true;
-  #};
-
-  home.sessionVariables = {
-    EDITOR = "vim";
-  };
-
-  # enable home manager
-  programs.home-manager.enable = true;
-
-  # don't change
-  home.stateVersion = "25.05";
-}
@@ -12,6 +12,7 @@
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
@@ -23,6 +24,7 @@
    ../../modules/nixos/services.nix
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
    ../../modules/nixos/users.nix
    ../../modules/nixos/vial.nix
  ];
@@ -30,6 +32,13 @@
  # host-specific niri config (input devices, laptop binds)
  home-manager.users.aaron.imports = [ ./niri.nix ];

+  # hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
+  services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
+
+  # bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
+  # what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
+  boot.lanzaboote.settings.console-mode = "6";
+
  networking.hostName = "krypton";
  system.stateVersion = "26.05"; # don't change
 }
@@ -40,8 +40,8 @@
    device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
    ];
  };

@@ -17,6 +17,7 @@
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
@@ -28,6 +29,7 @@
    ../../modules/nixos/services.nix
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
    ../../modules/nixos/users.nix
    ../../modules/nixos/vial.nix
  ];
@@ -43,8 +43,8 @@
    device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
    ];
  };

@@ -4,13 +4,10 @@
    settings = {
      clipboard-paste-protection = false;
      clipboard-read = "allow";
-      font-family = "0xProto Nerd Font Mono";
-      font-size = 12;
      gtk-titlebar = false;
      scrollback-limit = 100000;
      shell-integration = "zsh";
      shell-integration-features = "ssh-env,ssh-terminfo";
-      theme = "noctalia"; # generated by noctalia-shell
      window-decoration = "auto";
      window-padding-x = 10;
      window-padding-y = 10;
@@ -14,6 +14,7 @@ let
  signingKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
  ];
 in
 {
@@ -2,7 +2,12 @@
 # come from modules/nixos/niri.nix. Outputs and input devices that differ
 # per machine live in hosts/<host>/niri.nix.

-{ lib, osConfig, ... }:
+{
+  config,
+  lib,
+  osConfig,
+  ...
+}:

 let
  # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there
@@ -18,6 +23,9 @@ let
    _props.allow-when-locked = true;
    spawn-sh = cmd;
  };
+
+  # niri has no stylix target, so the colors are picked here
+  colors = config.lib.stylix.colors.withHashtag;
 in
 {
  wayland.windowManager.niri = {
@@ -61,9 +69,9 @@ in
        focus-ring = {
          on = { };
          width = 2;
-          active-color = "#4c566a";
-          inactive-color = "#2e3440";
-          urgent-color = "#a3be8c";
+          active-color = colors.base03;
+          inactive-color = colors.base00;
+          urgent-color = colors.base0B;
        };

        border.off = { };
@@ -23,7 +23,7 @@

    # nvim mapleader for all command below
    globals.mapleader = " ";
-    # set colorscheme to nord
+    # set colorscheme to nord, stylix's base16 version is disabled in stylix.nix
    colorschemes.nord.enable = true;

    # nvim plugins
@@ -14,13 +14,7 @@

    # settings is rendered to ~/.config/noctalia/config.toml
    settings = {
-      # theme / colors
-      theme = {
-        source = "builtin";
-        builtin = "Nord";
-        mode = "dark";
-        templates.builtin_ids = [ "ghostty" ];
-      };
+      # theme / colors come from stylix, see stylix.nix

      # general
      shell = {
@@ -76,6 +70,8 @@
          radius = 0;
          scale = 1.2;
          widget_spacing = 20;
+          # no dark gradient on the seam between the bar and attached panels (e.g. control center)
+          contact_shadow = false;
          start = [
            "control-center"
            "cpu"
@@ -7,6 +7,7 @@
    discord
    fastfetch
    keepassxc
+    signal-desktop
    teamspeak6-client
    typst
    zathura
@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  gtk = {
-    enable = true;
-    theme = {
-      name = "Adwaita-dark";
-      package = pkgs.gnome-themes-extra;
-    };
-    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
-    gtk4.theme = null;
-    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
-  };
-
-  qt = {
-    enable = true;
-    platformTheme.name = "qt6";
-    style = {
-      name = "adwaita-dark";
-      package = pkgs.adwaita-qt;
-    };
-  };
-}
@@ -0,0 +1,38 @@
+# One Nord palette for everything stylix has a target for: gtk, qt,
+# noctalia, ghostty. Niri has no target and reads the colors in niri.nix. 
+# Only the home-manager module is used, so boot, console and sddm are left alone.
+
+{ pkgs, ... }:
+
+{
+  stylix = {
+    enable = true;
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
+    polarity = "dark";
+
+    fonts = {
+      monospace = {
+        name = "0xProto Nerd Font Mono";
+        package = pkgs.nerd-fonts._0xproto;
+      };
+      sizes.terminal = 12;
+    };
+
+    # its overlays (nixos-icons, gtksourceview) clash with useGlobalPkgs
+    overlays.enable = false;
+
+    targets = {
+      # profiles aren't managed by home-manager, declaring one here would
+      # take over the existing profile
+      firefox.enable = false;
+      # the bar keeps 0xProto instead of the sans-serif font
+      noctalia.fonts.enable = false;
+      # nord.nvim is calmer than the base16 palette, e.g. no line number
+      # background, see nixvim.nix
+      nixvim.enable = false;
+      # the hand-built status line in tmux.nix uses ANSI color names, which
+      # already follow the terminal palette
+      tmux.enable = false;
+    };
+  };
+}
@@ -4,6 +4,8 @@
  # set bootloader to systemd
  boot.loader = {
    systemd-boot.enable = true;
+    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
+    systemd-boot.editor = false;
    efi.canTouchEfiVariables = true;
  };

@@ -0,0 +1,37 @@
+# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
+# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
+# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
+# on the unencrypted /boot.
+
+{ config, lib, ... }:
+
+let
+  drives = config.local.dataDrives;
+in
+{
+  options.local.dataDrives = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    default = { };
+    example = {
+      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    };
+    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
+  };
+
+  config = lib.mkIf (drives != { }) {
+    environment.etc.crypttab.text = lib.concatStrings (
+      lib.mapAttrsToList (
+        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
+      ) drives
+    );
+
+    fileSystems = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "/mnt/${name}" {
+        device = "/dev/mapper/${name}";
+        fsType = "ext4";
+        options = [ "nofail" ];
+      }
+    ) drives;
+  };
+}
@@ -8,8 +8,14 @@
        "1.1.1.1"
        "8.8.8.8"
      ];
-      log-driver = "journald";
+      log-driver = "local";
      registry-mirrors = [ "https://mirror.gcr.io" ];
    };
  };
+
+  # k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
+  systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
+
+  # let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
+  boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
 }
@@ -0,0 +1,25 @@
+# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
+# installs it signed and writes signed boot entries instead of the nixos module.
+# The keys are created once per host with `sudo sbctl create-keys` before the
+# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
+
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  # key management and verification
+  environment.systemPackages = [ pkgs.sbctl ];
+}
@@ -0,0 +1,21 @@
+{
+  # greetd display manager with the graphical noctalia greeter, replaces greetd.nix.
+  # The nixpkgs module enables greetd, accountsservice (avatars) and polkit, and
+  # launches noctalia-greeter-session. Sessions (niri) are discovered from
+  # wayland-sessions, the last one picked is remembered.
+  # See https://docs.noctalia.dev/greeter/
+  services.displayManager.noctalia-greeter = {
+    enable = true;
+
+    # lets the shell's "Sync Now" / auto-sync copy wallpaper, palette and monitor
+    # layout to the greeter without an admin prompt (appearance only)
+    passwordlessSyncUsers = [ "aaron" ];
+
+    # rendered to /var/lib/noctalia-greeter/greeter.toml, wins over synced values
+    settings = {
+      user.default = "aaron";
+      # same layout as niri, otherwise the password is typed on a us keymap
+      keyboard.layout = "ch";
+    };
+  };
+}
@@ -0,0 +1,8 @@
+# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
+# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
+# so this needs lanzaboote.nix. Enrolled once per host with
+# `systemd-cryptenroll`, see INSTALLATION.md.
+
+{
+  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
+}
@@ -8,7 +8,7 @@
    ../../modules/home-manager/noctalia.nix
    ../../modules/home-manager/programs.nix
    ../../modules/home-manager/shell.nix
-    ../../modules/home-manager/styling.nix
+    ../../modules/home-manager/stylix.nix
    ../../modules/home-manager/tmux.nix
  ];
Author	SHA1	Message	Date
aaron	1e6d041c45	Merge pull request 'feature(greetd): add noctalia-greeter to greetd' (#103 ) from feature/noctialia-greeter into main Reviewed-on: #103	2026-10-14 09:20:22 +02:00
aaron	75f7acbf2e	feature(greetd): add noctalia-greeter to greetd	2026-10-14 09:19:40 +02:00
aaron	414f579ccf	Merge pull request 'feature: use the local log driver insteald of journald for rootless docker' (#102 ) from feature/rootless_docker into main Reviewed-on: #102	2026-10-12 19:22:42 +02:00
aaron	104e0a7cb3	feature: use the local log driver insteald of journald for rootless docker	2026-10-12 19:15:51 +02:00
aaron	3418b08772	Merge pull request 'chore: update nix flakes' (#101 ) from chore/update into main Reviewed-on: #101	2026-10-12 18:24:46 +02:00
aaron	a8aefcbfdd	chore: update nix flakes	2026-10-12 18:10:15 +02:00
aaron	653e56f40c	Merge pull request 'fix: remove contact_shadow between bar and attached panels' (#100 ) from fix/contact_shadow into main Reviewed-on: #100	2026-10-10 20:52:23 +02:00
aaron	74b64368aa	fix: remove contact_shadow between bar and attached panels	2026-10-10 20:50:40 +02:00
aaron	1883b6cb05	Merge pull request 'feature(docker): make changes to the rootless docker setup to support the netgame webapp which relies on k3d and traefik' (#99 ) from feature/rootless_docker_improvements into main Reviewed-on: #99	2026-10-07 16:08:46 +02:00
aaron	e9b3e5961c	feature(docker): make changes to the rootless docker setup to support the netgame webapp which relies on k3d and traefik	2026-10-07 16:05:46 +02:00
aaron	3b961d447b	Merge pull request 'chore: update nix flakes' (#98 ) from chore/update into main Reviewed-on: #98	2026-10-06 17:39:53 +02:00
aaron	edcc71b435	chore: update nix flakes	2026-10-06 17:39:33 +02:00
aaron	88aeea31f8	Merge pull request 'feature(theme): replace all color theme configs with stylix' (#97 ) from feature/add_stylix into main Reviewed-on: #97	2026-10-06 17:32:26 +02:00
aaron	8f86bcb365	refactor(nixvim): change back mini.base16 to dedicated nord theme plugin	2026-10-05 21:23:51 +02:00
aaron	2b55ec9873	feature(theme): replace all color theme configs with stylix	2026-10-05 12:39:24 +02:00
aaron	6a5eaca649	Merge pull request 'feature(git): add kryptons ssh key as signing key' (#96 ) from feature/add_krypton_sk into main Reviewed-on: #96	2026-10-04 14:43:27 +02:00
aaron	4409e2a9e6	feature(git): add kryptons ssh key as signing key	2026-10-04 14:43:11 +02:00
aaron	441d954b85	Merge pull request 'feature(software): add signal-desktop electron app' (#95 ) from feature/add_signal into main Reviewed-on: #95	2026-10-04 10:56:43 +02:00
aaron	e602ba9df1	feature(software): add signal-desktop electron app	2026-10-04 10:29:30 +02:00
aaron	863c496400	chore: update installation guide	2026-10-03 22:49:18 +02:00
aaron	20bf806666	Merge pull request 'feature(boot): add secure-boot and tpm-unlock to neon' (#94 ) from feature/neon_secureboot into main Reviewed-on: #94	2026-10-03 16:22:29 +02:00
aaron	e35311dfd5	chore: update installation guide with secure-boot setup pitfalls	2026-10-03 16:21:54 +02:00
aaron	beb520a615	feature(boot): add secure-boot support and tpm-unlock to neon	2026-10-03 15:55:36 +02:00
aaron	4eb3e27f8b	Merge pull request 'feature(boot): add secure-boot support and tpm-unlock to argon' (#93 ) from feature/argon_secureboot into main Reviewed-on: #93	2026-10-03 15:48:06 +02:00
aaron	8c56b00247	feature(boot): add secure-boot support and tpm-unlock to argon	2026-10-03 15:07:13 +02:00
aaron	ff2e4d2f69	Merge pull request 'fix: do not allow edits to the bootloader' (#92 ) from feature/bootloader_security into main Reviewed-on: #92	2026-10-03 14:11:56 +02:00
aaron	318e17ac27	fix: do not allow edits to the bootloader	2026-10-03 14:11:29 +02:00
aaron	c66549f3bf	Merge pull request 'feature(hidpi): adapt sddm and systemd-boot to hidpi display' (#91 ) from feature/krypton_hidpi into main Reviewed-on: #91	2026-10-03 13:44:31 +02:00
aaron	620c415be9	fix: adapt systemd-boot for kryptons hidpi screen by using the right console mode	2026-10-03 13:39:35 +02:00
aaron	472f359f80	fix: adapt kryptons sddm for hidpi using the qt scale factor	2026-10-03 13:35:50 +02:00
aaron	ad494d1209	Merge pull request 'feature(boot): add luks unlock method using TPM+PIN' (#90 ) from feature/tpm_unlock into main Reviewed-on: #90	2026-10-03 13:28:35 +02:00
aaron	d26bd424cc	feature(boot): add luks unlock method using TPM+PIN	2026-10-03 13:25:18 +02:00
aaron	a7bba82b5b	Merge pull request 'feature(lanzaboote): add support for secure-boot through lanazaboote' (#88 ) from feature/secure_boot into main Reviewed-on: #88	2026-10-03 12:48:11 +02:00
aaron	a5e69c043d	chore: update installation guide with secure-boot setup	2026-10-03 12:47:27 +02:00
aaron	b2a2e7d161	Merge remote-tracking branch 'origin/main' into feature/secure_boot	2026-10-03 11:41:27 +02:00
aaron	66a19890bd	chore: remove old vm host entry since it is not used anymore (#89 ) Reviewed-on: #89 Co-authored-by: aaron <aaron@0x29a.ch>	2026-10-03 11:37:40 +02:00
aaron	450559f8c6	feature: data-drives on argon and boot securty (#87 ) - increase security by restricting /boot to root only - add data-drives for encrypted drives that will get mounted through crypttab rather than the initrd Reviewed-on: #87 Co-authored-by: aaron <aaron@0x29a.ch>	2026-10-03 10:57:34 +02:00
aaron	b75f44ceab	feature(lanzaboote): add support for secure-boot through lanazaboote	2026-10-03 10:39:28 +02:00