Merge pull request 'fix(certificates): temporarily distrust emSign ECC Root CA - G3' (#111 ) from fix/distrust-emudhra-ecc-root into main

Reviewed-on: #111
fix(certificates): temporarily distrust emSign ECC Root CA - G3
2026-10-21 14:02:23 +02:00 · 2026-10-21 13:39:53 +02:00 · 2026-10-20 12:50:24 +02:00 · 2026-10-20 12:48:41 +02:00 · 2026-10-18 14:43:17 +02:00 · 2026-10-18 14:42:07 +02:00
8 changed files with 41 additions and 3 deletions
@@ -10,12 +10,13 @@
    ../../modules/nixos/bootloader.nix
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/data-drives.nix
+    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
-    ../../modules/nixos/greetd.nix
    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia-greeter.nix
    ../../modules/nixos/noctalia.nix
    ../../modules/nixos/openssh.nix
    ../../modules/nixos/packages.nix
@@ -24,6 +24,7 @@ in

  programs.git = {
    enable = true;
+    lfs.enable = true;
    settings = {
      push.autoSetupRemote = true;
      user = {
@@ -42,6 +42,7 @@ in
      input = {
        keyboard = {
          xkb.layout = "ch";
+          xkb.variant = "de_nodeadkeys";
          numlock = { };
        };
        mouse = {
@@ -8,6 +8,7 @@
    fastfetch
    keepassxc
    signal-desktop
+    tea
    teamspeak6-client
    typst
    zathura
@@ -33,6 +33,9 @@
      # the hand-built status line in tmux.nix uses ANSI color names, which
      # already follow the terminal palette
      tmux.enable = false;
+      # rofi isn't used, and the target still sets the renamed
+      # programs.rofi.font, which warns on every evaluation
+      rofi.enable = false;
    };
  };
 }
@@ -17,4 +17,9 @@ in
  security.pki.certificates = [
    caddyRootCA # self-signed pki ca for my home-lab
  ];
+
+  # Temporary: eMudhra intermediates under this root have recoverable private
+  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
+  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
+  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }
@@ -0,0 +1,22 @@
+{
+  # greetd display manager with the graphical noctalia greeter, replaces greetd.nix.
+  # The nixpkgs module enables greetd, accountsservice (avatars) and polkit, and
+  # launches noctalia-greeter-session. Sessions (niri) are discovered from
+  # wayland-sessions, the last one picked is remembered.
+  # See https://docs.noctalia.dev/greeter/
+  services.displayManager.noctalia-greeter = {
+    enable = true;
+
+    # lets the shell's "Sync Now" / auto-sync copy wallpaper, palette and monitor
+    # layout to the greeter without an admin prompt (appearance only)
+    passwordlessSyncUsers = [ "aaron" ];
+
+    # rendered to /var/lib/noctalia-greeter/greeter.toml, wins over synced values
+    settings = {
+      user.default = "aaron";
+      # same layout as niri, otherwise the password is typed on a us keymap
+      keyboard.layout = "ch";
+      keyboard.variant = "de_nodeadkeys";
+    };
+  };
+}
@@ -4,6 +4,10 @@
    tuned.enable = true;
    upower.enable = true;
    fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
  };
 }
Author	SHA1	Message	Date
aaron	f54798a8be	Merge pull request 'fix(certificates): temporarily distrust emSign ECC Root CA - G3' (#111 ) from fix/distrust-emudhra-ecc-root into main Reviewed-on: #111	2026-10-21 14:02:23 +02:00
aaronandClaude Opus 5.5	5b38fc4155	fix(certificates): temporarily distrust emSign ECC Root CA - G3 Eight eMudhra intermediates chaining to this root were generated with trivially recoverable private keys (Mozilla bug 2083449), so anyone can mint certificates that non-browser clients using the system bundle will accept. Browsers already block them; the system bundle does not until cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable yet. Drop this once the flake lock includes that commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 13:39:53 +02:00
aaron	6c1c4403c2	Merge pull request 'fix(tailscale): open Tailscale's WireGuard port in the firewall' (#109 ) from fix/tailscale-open-firewall into main Reviewed-on: #109	2026-10-20 12:50:24 +02:00
aaronandClaude Opus 5.5	fb3e2864d6	fix(tailscale): open Tailscale's WireGuard port in the firewall services.tailscale.openFirewall defaults to false while the NixOS firewall is enabled, so argon, krypton and neon dropped unsolicited inbound 41641/udp. Direct connections then only succeed if the other peer accepts inbound; between two of these hosts (or a host and a phone) traffic can fall back to a DERP relay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 12:48:41 +02:00
aaron	8701507742	Merge pull request 'feature(git): enable git lfs for my user' (#108 ) from feature/add_tea into main Reviewed-on: #108	2026-10-18 14:43:17 +02:00
aaron	c748f22033	feature(git): enable git lfs for my user	2026-10-18 14:42:07 +02:00
aaron	a9e17a8c35	Merge pull request 'feature(programs): add the tea binary to my user to communicate with my gitea server' (#107 ) from feature/add_tea into main Reviewed-on: #107	2026-10-18 14:16:55 +02:00
aaron	69adfc9890	feature(programs): add the tea binary to my user to communicate with my gitea server	2026-10-18 14:15:52 +02:00
aaron	c9c15addcc	Merge pull request 'feature(argon): add rootless docker to argon' (#106 ) from feature/docker_on_argon into main Reviewed-on: #106	2026-10-16 20:14:45 +02:00
aaron	abe6fd5c18	feature(argon): add rootless docker to argon	2026-10-16 20:06:09 +02:00
aaron	49a8b574bf	Merge pull request 'feature: add de_nodeadkeys to niri-greet as well' (#105 ) from feature/nodeadkeys into main Reviewed-on: #105	2026-10-15 21:00:16 +02:00
aaron	b07d8aefa4	feature: add de_nodeadkeys to niri-greet as well	2026-10-15 20:59:52 +02:00
aaron	ff7b34fedd	Merge pull request 'feature(niri): change keyboard layout to the nondeadkeys variant' (#104 ) from feature/nodeadkeys into main Reviewed-on: #104	2026-10-15 18:47:29 +02:00
aaron	1030fdfd8f	fix(niri): add correct nodeadkeys designator	2026-10-15 16:31:29 +02:00
aaron	186c3e971d	feature(niri): change keyboard layout to the nondeadkeys variant	2026-10-14 09:40:30 +02:00
aaron	1e6d041c45	Merge pull request 'feature(greetd): add noctalia-greeter to greetd' (#103 ) from feature/noctialia-greeter into main Reviewed-on: #103	2026-10-14 09:20:22 +02:00
aaron	75f7acbf2e	feature(greetd): add noctalia-greeter to greetd	2026-10-14 09:19:40 +02:00
aaron	414f579ccf	Merge pull request 'feature: use the local log driver insteald of journald for rootless docker' (#102 ) from feature/rootless_docker into main Reviewed-on: #102	2026-10-12 19:22:42 +02:00