refactor(nixvim): change back mini.base16 to dedicated nord theme plugin

Reviewed-on: #96

INSTALLATION.md

@@ -149,6 +149,23 @@ $ sudo sbctl enroll-keys
   Don't force it, either trust exactly those with `--tpm-eventlog` or
   microsoft's keys with `--microsoft`. Without either, the firmware may not
   start the device, in the worst case the machine doesn't boot at all.
+- Check what sbctl found first, a real option ROM has a PCI device path:
+```bash
+$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
+```
+- Paths starting with `0407` (firmware volume) are drivers from the firmware
+  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
+  exactly those, after a firmware update they may need to be enrolled again
+  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
+- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
+  setup too, use `--microsoft` there, a refused gpu means no picture at all
+- On the Framework (krypton), keep the firmware's built-in OEM certificates
+  with `--firmware-builtin`, vendor firmware updates may need them. If an
+  update fails or the keys were enrolled without them, erase the keys in the
+  firmware again (Setup Mode) and re-enroll:
+```bash
+$ sudo sbctl enroll-keys --firmware-builtin
+```
 
 6. enable Secure Boot in the firmware and set a firmware password, then check
 ```bash

flake.lock

@@ -1,5 +1,73 @@
 {
   "nodes": {
+    "base16": {
+      "inputs": {
+        "fromYaml": "fromYaml"
+      },
+      "locked": {
+        "lastModified": 1755819240,
+        "narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "type": "github"
+      }
+    },
+    "base16-fish": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1765809053,
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      }
+    },
+    "base16-helix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "type": "github"
+      }
+    },
+    "base16-vim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1732806396,
+        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1789760033,
@@ -15,6 +83,22 @@
         "type": "github"
       }
     },
+    "firefox-gnome-theme": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783570805,
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -52,6 +136,62 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "fromYaml": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731966426,
+        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "type": "github"
+      }
+    },
+    "gnome-shell": {
+      "flake": false,
+      "locked": {
+        "host": "gitlab.gnome.org",
+        "lastModified": 1776175984,
+        "narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
+        "owner": "GNOME",
+        "repo": "gnome-shell",
+        "rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
+        "type": "gitlab"
+      },
+      "original": {
+        "host": "gitlab.gnome.org",
+        "owner": "GNOME",
+        "ref": "50.1",
+        "repo": "gnome-shell",
+        "type": "gitlab"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -174,6 +314,31 @@
         "type": "github"
       }
     },
+    "nur": {
+      "inputs": {
+        "flake-parts": [
+          "stylix",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785549842,
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -203,7 +368,8 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
-        "noctalia": "noctalia"
+        "noctalia": "noctalia",
+        "stylix": "stylix"
       }
     },
     "rust-overlay": {
@@ -227,6 +393,39 @@
         "type": "github"
       }
     },
+    "stylix": {
+      "inputs": {
+        "base16": "base16",
+        "base16-fish": "base16-fish",
+        "base16-helix": "base16-helix",
+        "base16-vim": "base16-vim",
+        "firefox-gnome-theme": "firefox-gnome-theme",
+        "flake-parts": "flake-parts_2",
+        "gnome-shell": "gnome-shell",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur",
+        "systems": "systems_2",
+        "tinted-kitty": "tinted-kitty",
+        "tinted-schemes": "tinted-schemes",
+        "tinted-tmux": "tinted-tmux",
+        "tinted-zed": "tinted-zed"
+      },
+      "locked": {
+        "lastModified": 1790880877,
+        "narHash": "sha256-j42XqSKOAtuqtfHiElyHre2YS/h3Y3q1DjFnKODN1/k=",
+        "owner": "nix-community",
+        "repo": "stylix",
+        "rev": "7c065d1ed05381fceb2403b963c5ad150f32fe39",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "stylix",
+        "type": "github"
+      }
+    },
     "systems": {
       "flake": false,
       "locked": {
@@ -243,6 +442,86 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "tinted-kitty": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1735730497,
+        "narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "type": "github"
+      }
+    },
+    "tinted-schemes": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785153830,
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "type": "github"
+      }
+    },
+    "tinted-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785031658,
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "type": "github"
+      }
+    },
+    "tinted-zed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785030526,
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -23,6 +23,10 @@
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    stylix = {
+      url = "github:nix-community/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -30,6 +34,7 @@
       nixpkgs,
       home-manager,
       nixvim,
+      stylix,
       ...
     }@inputs:
     let
@@ -49,6 +54,7 @@
               home-manager.extraSpecialArgs = { inherit inputs; };
               home-manager.users.aaron.imports = [
                 nixvim.homeModules.nixvim
+                stylix.homeModules.stylix
                 ./users/aaron/home.nix
               ];
             }

hosts/neon/configuration.nix

@@ -17,6 +17,7 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -28,6 +29,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];

modules/home-manager/ghostty.nix

@@ -4,13 +4,10 @@
     settings = {
       clipboard-paste-protection = false;
       clipboard-read = "allow";
-      font-family = "0xProto Nerd Font Mono";
-      font-size = 12;
       gtk-titlebar = false;
       scrollback-limit = 100000;
       shell-integration = "zsh";
       shell-integration-features = "ssh-env,ssh-terminfo";
-      theme = "noctalia"; # generated by noctalia-shell
       window-decoration = "auto";
       window-padding-x = 10;
       window-padding-y = 10;

modules/home-manager/git.nix

@@ -14,6 +14,7 @@ let
   signingKeys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
   ];
 in
 {

modules/home-manager/niri.nix

@@ -2,7 +2,12 @@
 # come from modules/nixos/niri.nix. Outputs and input devices that differ
 # per machine live in hosts/<host>/niri.nix.
 
-{ lib, osConfig, ... }:
+{
+  config,
+  lib,
+  osConfig,
+  ...
+}:
 
 let
   # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there
@@ -18,6 +23,9 @@ let
     _props.allow-when-locked = true;
     spawn-sh = cmd;
   };
+
+  # niri has no stylix target, so the colors are picked here
+  colors = config.lib.stylix.colors.withHashtag;
 in
 {
   wayland.windowManager.niri = {
@@ -61,9 +69,9 @@ in
         focus-ring = {
           on = { };
           width = 2;
-          active-color = "#4c566a";
+          active-color = colors.base03;
-          inactive-color = "#2e3440";
+          inactive-color = colors.base00;
-          urgent-color = "#a3be8c";
+          urgent-color = colors.base0B;
         };
 
         border.off = { };

modules/home-manager/nixvim.nix

@@ -23,7 +23,7 @@
 
     # nvim mapleader for all command below
     globals.mapleader = " ";
-    # set colorscheme to nord
+    # set colorscheme to nord, stylix's base16 version is disabled in stylix.nix
     colorschemes.nord.enable = true;
 
     # nvim plugins

modules/home-manager/noctalia.nix

@@ -14,13 +14,7 @@
 
     # settings is rendered to ~/.config/noctalia/config.toml
     settings = {
-      # theme / colors
+      # theme / colors come from stylix, see stylix.nix
-      theme = {
-        source = "builtin";
-        builtin = "Nord";
-        mode = "dark";
-        templates.builtin_ids = [ "ghostty" ];
-      };
 
       # general
       shell = {

modules/home-manager/programs.nix

@@ -7,6 +7,7 @@
     discord
     fastfetch
     keepassxc
+    signal-desktop
     teamspeak6-client
     typst
     zathura

modules/home-manager/styling.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  gtk = {
-    enable = true;
-    theme = {
-      name = "Adwaita-dark";
-      package = pkgs.gnome-themes-extra;
-    };
-    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
-    gtk4.theme = null;
-    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
-  };
-
-  qt = {
-    enable = true;
-    platformTheme.name = "qt6";
-    style = {
-      name = "adwaita-dark";
-      package = pkgs.adwaita-qt;
-    };
-  };
-}

modules/home-manager/stylix.nix

@@ -0,0 +1,38 @@
+# One Nord palette for everything stylix has a target for: gtk, qt,
+# noctalia, ghostty. Niri has no target and reads the colors in niri.nix. 
+# Only the home-manager module is used, so boot, console and sddm are left alone.
+
+{ pkgs, ... }:
+
+{
+  stylix = {
+    enable = true;
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
+    polarity = "dark";
+
+    fonts = {
+      monospace = {
+        name = "0xProto Nerd Font Mono";
+        package = pkgs.nerd-fonts._0xproto;
+      };
+      sizes.terminal = 12;
+    };
+
+    # its overlays (nixos-icons, gtksourceview) clash with useGlobalPkgs
+    overlays.enable = false;
+
+    targets = {
+      # profiles aren't managed by home-manager, declaring one here would
+      # take over the existing profile
+      firefox.enable = false;
+      # the bar keeps 0xProto instead of the sans-serif font
+      noctalia.fonts.enable = false;
+      # nord.nvim is calmer than the base16 palette, e.g. no line number
+      # background, see nixvim.nix
+      nixvim.enable = false;
+      # the hand-built status line in tmux.nix uses ANSI color names, which
+      # already follow the terminal palette
+      tmux.enable = false;
+    };
+  };
+}

users/aaron/home.nix

@@ -8,7 +8,7 @@
     ../../modules/home-manager/noctalia.nix
     ../../modules/home-manager/programs.nix
     ../../modules/home-manager/shell.nix
-    ../../modules/home-manager/styling.nix
+    ../../modules/home-manager/stylix.nix
     ../../modules/home-manager/tmux.nix
   ];