fix(certificates): temporarily distrust emSign ECC Root CA - G3

Eight eMudhra intermediates chaining to this root were generated with
trivially recoverable private keys (Mozilla bug 2083449), so anyone can
mint certificates that non-browser clients using the system bundle will
accept. Browsers already block them; the system bundle does not until
cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable
yet. Drop this once the flake lock includes that commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

INSTALLATION.md

@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
   { device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
   };
 fileSystems."/home" =
   { device = "/dev/disk/by-label/nixhome";
@@ -102,8 +102,96 @@ nixos-install
 
 ## how to deploy the initial config
 - Don't forget to install the bootloader, if you changed it since `nixos-install`
+- The fresh install has no flakes and no git yet, a temporary shell is enough
+- If the installer iso is older than the flake's nixpkgs, `--no-reexec` keeps
+  `nixos-rebuild` from re-executing a newer version of itself, which can fail
+  against the older systemd of the fresh install (only needed once)
+- Set a password for the user before rebooting, `users.nix` doesn't set one
 ```bash
-$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
+$ export NIX_CONFIG="experimental-features = nix-command flakes"
+$ nix-shell -p git
+$ sudo nixos-rebuild --install-bootloader boot --flake .#host_name --no-reexec
+$ sudo passwd aaron
+```
+
+## how to enable secure boot
+Secure Boot uses lanzaboote with our own keys, see `modules/nixos/lanzaboote.nix`.
+Do this after the initial config is deployed and boots.
+
+1. create the keys, before the first rebuild with the lanzaboote module
+```bash
+# the keys end up in /var/lib/sbctl, they never leave the host
+$ sudo nix run nixpkgs#sbctl -- create-keys
+```
+
+2. import `modules/nixos/lanzaboote.nix` in the host's `configuration.nix`, rebuild and check the signatures
+```bash
+$ sudo nixos-rebuild switch --flake .#host_name
+# EFI/Linux/*.efi and the bootloader must be signed, kernels in EFI/nixos
+# are not, lanzaboote checks them by hash
+$ sudo sbctl verify
+```
+
+3. reboot once with Secure Boot still disabled, to make sure the new entries boot
+
+4. in the firmware (F2), erase all Secure Boot keys, then boot nixos again
+```bash
+# "Setup Mode: ✗ Enabled", the ✗ only means the state is insecure
+$ sudo sbctl status
+```
+
+5. enroll the keys
+```bash
+# only our own keys, no microsoft keys
+$ sudo sbctl enroll-keys
+```
+- sbctl refuses if the TPM eventlog shows option ROMs (e.g. a dedicated gpu).
+  Don't force it, either trust exactly those with `--tpm-eventlog` or
+  microsoft's keys with `--microsoft`. Without either, the firmware may not
+  start the device, in the worst case the machine doesn't boot at all.
+- Check what sbctl found first, a real option ROM has a PCI device path:
+```bash
+$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
+```
+- Paths starting with `0407` (firmware volume) are drivers from the firmware
+  itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
+  exactly those, after a firmware update they may need to be enrolled again
+  (disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
+- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
+  setup too, use `--microsoft` there, a refused gpu means no picture at all
+- On the Framework (krypton), keep the firmware's built-in OEM certificates
+  with `--firmware-builtin`, vendor firmware updates may need them. If an
+  update fails or the keys were enrolled without them, erase the keys in the
+  firmware again (Setup Mode) and re-enroll:
+```bash
+$ sudo sbctl enroll-keys --firmware-builtin
+```
+
+6. enable Secure Boot in the firmware and set a firmware password, then check
+```bash
+$ bootctl status | grep "Secure Boot"   # enabled (user)
+$ sudo sbctl status                     # Secure Boot: ✓ Enabled
+```
+- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
+- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
+
+## how to unlock the disk with the tpm (laptops)
+Needs Secure Boot first. The TPM releases the key only with the PIN and while
+the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
+
+1. enroll the TPM with a PIN as an additional key slot
+```bash
+# asks for the current passphrase, then the new PIN
+$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
+2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
+
+- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
+  state changed. After a firmware update that's expected, otherwise investigate
+  before typing the passphrase. To re-enroll:
+```bash
+$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
 ```
 
 ## how to upgrade the system

README.md

@@ -10,7 +10,7 @@ My personal NixOS configurations.
 ├── hosts
 │   ├── argon # desktop
 │   ├── neon # laptop
-│   └── default # test vm
+│   └── krypton # second laptop
 │       ├── configuration.nix # host-specific settings and module imports
 │       ├── hardware-configuration.nix # generated by nixos-generate-config
 │       └── niri.nix # host-specific niri settings (outputs, input)

flake.lock

@@ -1,5 +1,120 @@
 {
   "nodes": {
+    "base16": {
+      "inputs": {
+        "fromYaml": "fromYaml"
+      },
+      "locked": {
+        "lastModified": 1755819240,
+        "narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "type": "github"
+      }
+    },
+    "base16-fish": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1765809053,
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      }
+    },
+    "base16-helix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "type": "github"
+      }
+    },
+    "base16-vim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1732806396,
+        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1789760033,
+        "narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "firefox-gnome-theme": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1783570805,
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -8,11 +123,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788450739,
+        "lastModified": 1790898470,
-        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
         "type": "github"
       },
       "original": {
@@ -21,6 +136,62 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "fromYaml": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731966426,
+        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "type": "github"
+      }
+    },
+    "gnome-shell": {
+      "flake": false,
+      "locked": {
+        "host": "gitlab.gnome.org",
+        "lastModified": 1776175984,
+        "narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
+        "owner": "GNOME",
+        "repo": "gnome-shell",
+        "rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
+        "type": "gitlab"
+      },
+      "original": {
+        "host": "gitlab.gnome.org",
+        "owner": "GNOME",
+        "ref": "50.1",
+        "repo": "gnome-shell",
+        "type": "gitlab"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -28,11 +199,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790819692,
+        "lastModified": 1791642191,
-        "narHash": "sha256-rvubAPbh3QCliic3sAK+CXTrPCGgJstY52OTs/5H1J4=",
+        "narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c8ecc29e5175452bee4a2aa1ba2383856d795338",
+        "rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
         "type": "github"
       },
       "original": {
@@ -41,6 +212,30 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1790423250,
+        "narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v1.2.0",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "nixos-hardware": {
       "inputs": {
         "nixpkgs": [
@@ -48,11 +243,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790948122,
+        "lastModified": 1791721963,
-        "narHash": "sha256-fDMYyzY1lI5b8RuCMrvoaIgTeRwNnTG4dNk1ucROlQE=",
+        "narHash": "sha256-BYhx89XJltnRyQeuDKHVL5eSqbbfAcOKuDts7QRsrxQ=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "0953bb1a609df63013176e3463393f8df993d3ef",
+        "rev": "60a624466c08787ee8303393b7d4752d1826f14f",
         "type": "github"
       },
       "original": {
@@ -63,11 +258,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790689126,
+        "lastModified": 1791594108,
-        "narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
         "type": "github"
       },
       "original": {
@@ -86,11 +281,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1790541651,
+        "lastModified": 1791769517,
-        "narHash": "sha256-/496IQz8qNWHHLnc3Zvr0l4uxJ34igNhJhn7ZKAefFk=",
+        "narHash": "sha256-OVx8OKPdW1fLfDi1oemFkfSvF354UwU5I0GXnNAGygw=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "5980a626794486abad69fca7667f9c11dfbc3bd7",
+        "rev": "84e901ee80e6523068dc3baf86cbf7cdcbf16902",
         "type": "github"
       },
       "original": {
@@ -106,11 +301,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790718664,
+        "lastModified": 1791817518,
-        "narHash": "sha256-LWil4xgSyqIFZ9sydvL1glFOoiqAOknWUwykC4sqxuY=",
+        "narHash": "sha256-DGVFzc0YXy38vCuS43PZPIkTVKaKxpNgzkNmJsHouP8=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "fd9759c892fe5034b682c185695f1bee121cd5b3",
+        "rev": "02cb10745d6274e4a696a00308c8ef4cefa7416d",
         "type": "github"
       },
       "original": {
@@ -119,17 +314,136 @@
         "type": "github"
       }
     },
+    "nur": {
+      "inputs": {
+        "flake-parts": [
+          "stylix",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785549842,
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
+    "pre-commit": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789514889,
+        "narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nixvim": "nixvim",
-        "noctalia": "noctalia"
+        "noctalia": "noctalia",
+        "stylix": "stylix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789889921,
+        "narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "stylix": {
+      "inputs": {
+        "base16": "base16",
+        "base16-fish": "base16-fish",
+        "base16-helix": "base16-helix",
+        "base16-vim": "base16-vim",
+        "firefox-gnome-theme": "firefox-gnome-theme",
+        "flake-parts": "flake-parts_2",
+        "gnome-shell": "gnome-shell",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur",
+        "systems": "systems_2",
+        "tinted-kitty": "tinted-kitty",
+        "tinted-schemes": "tinted-schemes",
+        "tinted-tmux": "tinted-tmux",
+        "tinted-zed": "tinted-zed"
+      },
+      "locked": {
+        "lastModified": 1791574276,
+        "narHash": "sha256-UMnLnZ3JlA7UTBNNNx1rNsXYoPP/cirXLCKGiQ/yDx8=",
+        "owner": "nix-community",
+        "repo": "stylix",
+        "rev": "2856c4c6a845b9bec98828ef197abe176e4806bb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "stylix",
+        "type": "github"
       }
     },
     "systems": {
       "flake": false,
+      "locked": {
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
       "locked": {
         "lastModified": 1774449309,
         "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
@@ -144,6 +458,70 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "tinted-kitty": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1735730497,
+        "narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "type": "github"
+      }
+    },
+    "tinted-schemes": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785153830,
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "type": "github"
+      }
+    },
+    "tinted-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785031658,
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "type": "github"
+      }
+    },
+    "tinted-zed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785030526,
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -11,6 +11,10 @@
       url = "github:noctalia-dev/noctalia-shell";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.2.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -19,6 +23,10 @@
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    stylix = {
+      url = "github:nix-community/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -26,6 +34,7 @@
       nixpkgs,
       home-manager,
       nixvim,
+      stylix,
       ...
     }@inputs:
     let
@@ -45,6 +54,7 @@
               home-manager.extraSpecialArgs = { inherit inputs; };
               home-manager.users.aaron.imports = [
                 nixvim.homeModules.nixvim
+                stylix.homeModules.stylix
                 ./users/aaron/home.nix
               ];
             }
@@ -53,7 +63,6 @@
     in
     {
       nixosConfigurations = {
-        default = mkHost "default";
         neon = mkHost "neon";
         argon = mkHost "argon";
         krypton = mkHost "krypton";

hosts/argon/configuration.nix

@@ -1,17 +1,7 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
-# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
 
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 
-let
-  # luks name -> partition uuid, mounted at /mnt/<name>
-  drives = {
-    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-  };
-  key = name: "/etc/nixos/keys/${name}.key";
-in
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -19,11 +9,14 @@ in
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
+    ../../modules/nixos/data-drives.nix
+    ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/greetd.nix
+    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia-greeter.nix
     ../../modules/nixos/noctalia.nix
     ../../modules/nixos/openssh.nix
     ../../modules/nixos/packages.nix
@@ -32,6 +25,7 @@ in
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
     ../../modules/nixos/thunar.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];
@@ -46,22 +40,12 @@ in
   };
   hardware.amdgpu.initrd.enable = true;
 
-  # encrypted data drives
+  # encrypted data drives, see data-drives.nix
-  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
+  local.dataDrives = {
-  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
+    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    device = "/dev/disk/by-uuid/${uuid}";
+    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    keyFile = key name;
+    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-    # trim for ssds, ignored by drives without discard support
+  };
-    allowDiscards = true;
-  }) drives;
-  fileSystems = lib.mapAttrs' (
-    name: _:
-    lib.nameValuePair "/mnt/${name}" {
-      device = "/dev/mapper/${name}";
-      fsType = "ext4";
-      options = [ "nofail" ];
-    }
-  ) drives;
 
   environment.systemPackages = with pkgs; [
     amdgpu_top

hosts/argon/hardware-configuration.nix

@@ -39,8 +39,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
+      "fmask=0077"
-      "dmask=0022"
+      "dmask=0077"
     ];
   };
 

hosts/default/configuration.nix

@@ -1,139 +0,0 @@
-# 0x29a nixos config
-
-{ pkgs, ... }:
-
-{
-  # use flakes
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  # configure bootloader
-  boot.loader.systemd-boot.enable = false;
-  boot.loader.grub = {
-    enable = true;
-    device = "nodev";
-    efiSupport = true;
-  };
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelParams = [
-    "quiet"
-    "console.ttyS0,115200n8" # allow terminals on serial console
-  ];
-  # plymouth boot eye candy
-  boot.initrd.systemd.enable = true;
-  boot.plymouth.enable = true;
-  boot.plymouth.theme = "spinner";
-  # use latest kernel
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  # guest agent for proxmox
-  services.qemuGuest.enable = true;
-
-  # networking
-  networking.hostName = "nixos";
-  networking.networkmanager.enable = true;
-
-  # time zone.
-  time.timeZone = "Europe/Amsterdam";
-  # select internationalisation properties
-  i18n.defaultLocale = "en_US.UTF-8";
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
-    LC_NAME = "en_US.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "en_US.UTF-8";
-  };
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "de_CH-latin1";
-  };
-
-  # window manager configs
-  services.xserver = {
-    enable = true;
-    xkb.layout = "ch";
-    xkb.options = "eurosign:e,caps:escape";
-
-    windowManager.qtile = {
-      enable = true;
-      extraPackages =
-        python3Packages: with python3Packages; [
-          qtile-extras
-        ];
-    };
-  };
-
-  environment.pathsToLink = [ "/libexec" ];
-  environment.variables.EDITOR = "vim";
-
-  # enable sound
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-  };
-
-  # define a user account
-  users.users.aaron = {
-    isNormalUser = true;
-    group = "users";
-    extraGroups = [ "wheel" ];
-    shell = pkgs.zsh;
-    packages = with pkgs; [
-      tree
-      fastfetch
-    ];
-  };
-
-  # browser
-  programs.firefox.enable = true;
-
-  # zsh config
-  programs.zsh = {
-    enable = true;
-    enableCompletion = true;
-    autosuggestions.enable = true;
-    ohMyZsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "sudo"
-      ];
-      theme = "agnoster";
-    };
-  };
-
-  # system packages
-  environment.systemPackages = with pkgs; [
-    vim
-    neovim
-    git
-    ghostty
-    kitty
-    wget
-    gnupg
-  ];
-
-  # Some programs need SUID wrappers
-  programs.mtr.enable = true;
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # enable the OpenSSH daemon
-  services.openssh.enable = true;
-
-  # firewall configs
-  networking.firewall.allowedTCPPorts = [ 22 ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-
-  # install state version
-  system.stateVersion = "25.05"; # Don't change
-}

hosts/default/hardware-configuration.nix

@@ -1,60 +0,0 @@
-# 0x29a nixos hardware configuration
-
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # boot and initrd configs
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [
-    "dm-snapshot"
-    "cryptd"
-  ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
-
-  # file systems
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixroot";
-    fsType = "ext4";
-  };
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/nixboot";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
-  };
-  fileSystems."/home" = {
-    device = "/dev/disk/by-label/nixhome";
-    fsType = "ext4";
-  };
-  swapDevices = [
-    { device = "/dev/disk/by-label/nixswap"; }
-  ];
-
-  # enable dhcp on all interfaces
-  networking.useDHCP = lib.mkDefault true;
-
-  # set host arch
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/default/home.nix

@@ -1,79 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # user config
-  home.username = "aaron";
-  home.homeDirectory = "/home/aaron";
-
-  # packages
-  home.packages = with pkgs; [
-    fastfetch
-    zip
-    xz
-    unzip
-    p7zip
-    jq
-    mtr
-    iperf3
-    dnsutils
-    ldns
-    socat
-    nmap
-    cowsay
-    file
-    which
-    tree
-    zstd
-    gnupg
-    btop
-    iotop
-    iftop
-    strace
-    lsof
-    sysstat
-    lm_sensors
-    ethtool
-    pciutils
-    usbutils
-  ];
-
-  # configure git
-  programs.git.settings = {
-    enable = true;
-    userName = "aaron";
-    userEmail = "aaron@0x29a.ch";
-  };
-
-  programs.zsh = {
-    enable = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-    oh-my-zsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "sudo"
-        "python"
-        "ansible"
-      ];
-      theme = "agnoster";
-    };
-  };
-
-  ## deploy qtile config
-  #home.file."qtile-config" = {
-  #  target = ".config/qtile/config.py";
-  #  source = "${inputs.qtile-config}/qtile_config/config.py";
-  #  force = true;
-  #};
-
-  home.sessionVariables = {
-    EDITOR = "vim";
-  };
-
-  # enable home manager
-  programs.home-manager.enable = true;
-
-  # don't change
-  home.stateVersion = "25.05";
-}

hosts/krypton/configuration.nix

@@ -12,6 +12,7 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -23,6 +24,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];
@@ -30,6 +32,13 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
+  # hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
+  services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
+
+  # bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
+  # what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
+  boot.lanzaboote.settings.console-mode = "6";
+
   networking.hostName = "krypton";
   system.stateVersion = "26.05"; # don't change
 }

hosts/krypton/hardware-configuration.nix

@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
+      "fmask=0077"
-      "dmask=0022"
+      "dmask=0077"
     ];
   };
 

hosts/neon/configuration.nix

@@ -1,6 +1,11 @@
 # neon: thinkpad t14 gen1 (intel)
 
-{ inputs, ... }:
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   imports = [
@@ -12,6 +17,7 @@
     ../../modules/nixos/certificates.nix
     ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/lanzaboote.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
     ../../modules/nixos/niri.nix
@@ -23,6 +29,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];
@@ -30,6 +37,16 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
+  # nixos-hardware's intel module adds intel-compute-runtime-legacy1 (opencl),
+  # which isn't cached and currently fails to build; not needed on neon
+  hardware.graphics.extraPackages = lib.mkForce (
+    with pkgs;
+    [
+      intel-media-driver
+      vpl-gpu-rt
+    ]
+  );
+
   networking.hostName = "neon";
   system.stateVersion = "25.11"; # don't change
 }

hosts/neon/hardware-configuration.nix

@@ -43,8 +43,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
+      "fmask=0077"
-      "dmask=0022"
+      "dmask=0077"
     ];
   };
 

modules/home-manager/ghostty.nix

@@ -4,13 +4,10 @@
     settings = {
       clipboard-paste-protection = false;
       clipboard-read = "allow";
-      font-family = "0xProto Nerd Font Mono";
-      font-size = 12;
       gtk-titlebar = false;
       scrollback-limit = 100000;
       shell-integration = "zsh";
       shell-integration-features = "ssh-env,ssh-terminfo";
-      theme = "noctalia"; # generated by noctalia-shell
       window-decoration = "auto";
       window-padding-x = 10;
       window-padding-y = 10;

modules/home-manager/git.nix

@@ -14,6 +14,7 @@ let
   signingKeys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
   ];
 in
 {
@@ -23,6 +24,7 @@ in
 
   programs.git = {
     enable = true;
+    lfs.enable = true;
     settings = {
       push.autoSetupRemote = true;
       user = {

modules/home-manager/niri.nix

@@ -2,7 +2,12 @@
 # come from modules/nixos/niri.nix. Outputs and input devices that differ
 # per machine live in hosts/<host>/niri.nix.
 
-{ lib, osConfig, ... }:
+{
+  config,
+  lib,
+  osConfig,
+  ...
+}:
 
 let
   # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there
@@ -18,6 +23,9 @@ let
     _props.allow-when-locked = true;
     spawn-sh = cmd;
   };
+
+  # niri has no stylix target, so the colors are picked here
+  colors = config.lib.stylix.colors.withHashtag;
 in
 {
   wayland.windowManager.niri = {
@@ -34,6 +42,7 @@ in
       input = {
         keyboard = {
           xkb.layout = "ch";
+          xkb.variant = "de_nodeadkeys";
           numlock = { };
         };
         mouse = {
@@ -61,9 +70,9 @@ in
         focus-ring = {
           on = { };
           width = 2;
-          active-color = "#4c566a";
+          active-color = colors.base03;
-          inactive-color = "#2e3440";
+          inactive-color = colors.base00;
-          urgent-color = "#a3be8c";
+          urgent-color = colors.base0B;
         };
 
         border.off = { };

modules/home-manager/nixvim.nix

@@ -23,7 +23,7 @@
 
     # nvim mapleader for all command below
     globals.mapleader = " ";
-    # set colorscheme to nord
+    # set colorscheme to nord, stylix's base16 version is disabled in stylix.nix
     colorschemes.nord.enable = true;
 
     # nvim plugins

modules/home-manager/noctalia.nix

@@ -14,13 +14,7 @@
 
     # settings is rendered to ~/.config/noctalia/config.toml
     settings = {
-      # theme / colors
+      # theme / colors come from stylix, see stylix.nix
-      theme = {
-        source = "builtin";
-        builtin = "Nord";
-        mode = "dark";
-        templates.builtin_ids = [ "ghostty" ];
-      };
 
       # general
       shell = {
@@ -76,6 +70,8 @@
           radius = 0;
           scale = 1.2;
           widget_spacing = 20;
+          # no dark gradient on the seam between the bar and attached panels (e.g. control center)
+          contact_shadow = false;
           start = [
             "control-center"
             "cpu"

modules/home-manager/programs.nix

@@ -7,6 +7,8 @@
     discord
     fastfetch
     keepassxc
+    signal-desktop
+    tea
     teamspeak6-client
     typst
     zathura

modules/home-manager/styling.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-
-{
-  gtk = {
-    enable = true;
-    theme = {
-      name = "Adwaita-dark";
-      package = pkgs.gnome-themes-extra;
-    };
-    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
-    gtk4.theme = null;
-    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
-  };
-
-  qt = {
-    enable = true;
-    platformTheme.name = "qt6";
-    style = {
-      name = "adwaita-dark";
-      package = pkgs.adwaita-qt;
-    };
-  };
-}

modules/home-manager/stylix.nix

@@ -0,0 +1,41 @@
+# One Nord palette for everything stylix has a target for: gtk, qt,
+# noctalia, ghostty. Niri has no target and reads the colors in niri.nix.
+# Only the home-manager module is used, so boot, console and sddm are left alone.
+
+{ pkgs, ... }:
+
+{
+  stylix = {
+    enable = true;
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
+    polarity = "dark";
+
+    fonts = {
+      monospace = {
+        name = "0xProto Nerd Font Mono";
+        package = pkgs.nerd-fonts._0xproto;
+      };
+      sizes.terminal = 12;
+    };
+
+    # its overlays (nixos-icons, gtksourceview) clash with useGlobalPkgs
+    overlays.enable = false;
+
+    targets = {
+      # profiles aren't managed by home-manager, declaring one here would
+      # take over the existing profile
+      firefox.enable = false;
+      # the bar keeps 0xProto instead of the sans-serif font
+      noctalia.fonts.enable = false;
+      # nord.nvim is calmer than the base16 palette, e.g. no line number
+      # background, see nixvim.nix
+      nixvim.enable = false;
+      # the hand-built status line in tmux.nix uses ANSI color names, which
+      # already follow the terminal palette
+      tmux.enable = false;
+      # rofi isn't used, and the target still sets the renamed
+      # programs.rofi.font, which warns on every evaluation
+      rofi.enable = false;
+    };
+  };
+}

modules/nixos/bootloader.nix

@@ -4,6 +4,8 @@
   # set bootloader to systemd
   boot.loader = {
     systemd-boot.enable = true;
+    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
+    systemd-boot.editor = false;
     efi.canTouchEfiVariables = true;
   };
 

modules/nixos/certificates.nix

@@ -17,4 +17,9 @@ in
   security.pki.certificates = [
     caddyRootCA # self-signed pki ca for my home-lab
   ];
+
+  # Temporary: eMudhra intermediates under this root have recoverable private
+  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
+  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
+  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }

modules/nixos/data-drives.nix

@@ -0,0 +1,37 @@
+# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
+# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
+# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
+# on the unencrypted /boot.
+
+{ config, lib, ... }:
+
+let
+  drives = config.local.dataDrives;
+in
+{
+  options.local.dataDrives = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    default = { };
+    example = {
+      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    };
+    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
+  };
+
+  config = lib.mkIf (drives != { }) {
+    environment.etc.crypttab.text = lib.concatStrings (
+      lib.mapAttrsToList (
+        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
+      ) drives
+    );
+
+    fileSystems = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "/mnt/${name}" {
+        device = "/dev/mapper/${name}";
+        fsType = "ext4";
+        options = [ "nofail" ];
+      }
+    ) drives;
+  };
+}

modules/nixos/docker.nix

@@ -8,8 +8,14 @@
         "1.1.1.1"
         "8.8.8.8"
       ];
-      log-driver = "journald";
+      log-driver = "local";
       registry-mirrors = [ "https://mirror.gcr.io" ];
     };
   };
+
+  # k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
+  systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
+
+  # let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
+  boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
 }

modules/nixos/lanzaboote.nix

@@ -0,0 +1,25 @@
+# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
+# installs it signed and writes signed boot entries instead of the nixos module.
+# The keys are created once per host with `sudo sbctl create-keys` before the
+# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
+
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
+  # key management and verification
+  environment.systemPackages = [ pkgs.sbctl ];
+}

modules/nixos/noctalia-greeter.nix

@@ -0,0 +1,22 @@
+{
+  # greetd display manager with the graphical noctalia greeter, replaces greetd.nix.
+  # The nixpkgs module enables greetd, accountsservice (avatars) and polkit, and
+  # launches noctalia-greeter-session. Sessions (niri) are discovered from
+  # wayland-sessions, the last one picked is remembered.
+  # See https://docs.noctalia.dev/greeter/
+  services.displayManager.noctalia-greeter = {
+    enable = true;
+
+    # lets the shell's "Sync Now" / auto-sync copy wallpaper, palette and monitor
+    # layout to the greeter without an admin prompt (appearance only)
+    passwordlessSyncUsers = [ "aaron" ];
+
+    # rendered to /var/lib/noctalia-greeter/greeter.toml, wins over synced values
+    settings = {
+      user.default = "aaron";
+      # same layout as niri, otherwise the password is typed on a us keymap
+      keyboard.layout = "ch";
+      keyboard.variant = "de_nodeadkeys";
+    };
+  };
+}

modules/nixos/services.nix

@@ -4,6 +4,10 @@
     tuned.enable = true;
     upower.enable = true;
     fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
   };
 }

modules/nixos/tpm-unlock.nix

@@ -0,0 +1,8 @@
+# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
+# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
+# so this needs lanzaboote.nix. Enrolled once per host with
+# `systemd-cryptenroll`, see INSTALLATION.md.
+
+{
+  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
+}

users/aaron/home.nix

@@ -8,7 +8,7 @@
     ../../modules/home-manager/noctalia.nix
     ../../modules/home-manager/programs.nix
     ../../modules/home-manager/shell.nix
-    ../../modules/home-manager/styling.nix
+    ../../modules/home-manager/stylix.nix
     ../../modules/home-manager/tmux.nix
   ];