chore(flake): update flake file

2026-07-12 14:34:20 +02:00
10 changed files with 43 additions and 194 deletions
@@ -8,11 +8,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -28,11 +28,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787797243,
-        "narHash": "sha256-8+Q7NOB7RPajRjA4pbCDLzqH+MTjnG9x6LUPLfL2joA=",
+        "lastModified": 1783823409,
+        "narHash": "sha256-OI4IkRjRXa1e7hYmCGJDPDq5H/kPwhsyoS80cNUF9fI=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "99c9ec63390f1d8c14d95d9e8b17cc29cfbd4e11",
+        "rev": "7566825d4652a1b885bd4ce65bd9e8def432fec9",
        "type": "github"
      },
      "original": {
@@ -43,11 +43,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1787900134,
-        "narHash": "sha256-VYXO0XZlgj06dxJZRhrD3WoSsvq/c7+/Akyoa22pefw=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "83199d0d373dd3ac2b9a1996b1d0263f76ab7a4c",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
        "type": "github"
      },
      "original": {
@@ -66,11 +66,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1787862710,
-        "narHash": "sha256-dL1Tv7LekaTWUJxHRckjbupWczDdc3QOgRuVCM+WAvQ=",
+        "lastModified": 1783647864,
+        "narHash": "sha256-gtVkWD4SbsvQQ8aSFEsrUTxxyuim4/ZC6lBJmA+sE/k=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "8c096abcf376137527c134da4ee210332b08ccc0",
+        "rev": "ebffdb62cd1604537ee51d4d23258c002f1c90f8",
        "type": "github"
      },
      "original": {
@@ -86,11 +86,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788099672,
-        "narHash": "sha256-t4Rw5OeULK/WA2Jh9ja615sCs2AmvahkAUx/ymdf2YQ=",
+        "lastModified": 1783830881,
+        "narHash": "sha256-V75/tqvYElVWyXnFf+0jh89wMh5a/cbV5YYe/P7RFDM=",
        "owner": "noctalia-dev",
        "repo": "noctalia-shell",
-        "rev": "d891007c022a3a1d4484495fe8b350a00deafae9",
+        "rev": "ed3cb98536eaec92c2b523ddf703e1dc6728f535",
        "type": "github"
      },
      "original": {
@@ -108,7 +108,6 @@
      }
    },
    "systems": {
-      "flake": false,
      "locked": {
        "lastModified": 1774449309,
        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
@@ -2,7 +2,6 @@

 {
  imports = [
-    ../../modules/nixos/appimage.nix
    ../../modules/nixos/astro.nix
    ../../modules/nixos/audio.nix
    ../../modules/nixos/bootloader.nix
@@ -26,7 +25,6 @@
    ../../modules/nixos/steam.nix
    ../../modules/nixos/thunar.nix
    ../../modules/nixos/users.nix
-    ../../modules/nixos/vial.nix
  ];

  # set hostname
@@ -2,7 +2,6 @@

 {
  imports = [
-    ../../modules/nixos/appimage.nix
    ../../modules/nixos/astro.nix
    ../../modules/nixos/audio.nix
    ../../modules/nixos/bootloader.nix
@@ -22,7 +21,6 @@
    ../../modules/nixos/settings.nix
    ../../modules/nixos/steam.nix
    ../../modules/nixos/users.nix
-    ../../modules/nixos/vial.nix
  ];

  # set hostname
@@ -1,38 +1,17 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, pkgs, inputs, ... }:

-let
-  email = "aaron@0x29a.ch";
-
-  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
-  # signing key in gitea. the key a host signs with is picked up from the key
-  # file itself, this list only tells the local git which machines to trust
-  signingKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
-  ];
-in
 {
-  # gitea verifies signatures against the account keys, this teaches the local
-  # git the same trust so `git log --show-signature` resolves as well
-  xdg.configFile."git/allowed_signers".text =
-    lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
-
  programs.git = {
    enable = true;
    settings = {
      push = { autoSetupRemote = true; };
      user = {
        name  = "aaron";
-        email = email;
+        email = "aaron@0x29a.ch";
      };
-      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
    };
    signing = {
-      format = "ssh";
-      # point at the *public* key so ssh-keygen signs through the ssh agent
-      # instead of reading the passphrase protected private key from disk
-      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
-      signer = "${pkgs.openssh}/bin/ssh-keygen";
+      key = "7A830180A05DAC59CDE43B0677D2F5DB48184456";
      signByDefault = true;
    };
  };
@@ -1,123 +1,60 @@
 { config, pkgs, inputs, ... }:

-let
-  # Powerline separators, U+E0B0..U+E0B3.
-  #
-  # Written as escapes rather than literal glyphs. These are Private Use Area
-  # codepoints: they render only with a patched font, they survive copy/paste
-  # badly, and when they get stripped the loss is invisible, the config still
-  # parses, the status bar just quietly loses its separators. Nix has no \u
-  # escape of its own, but fromJSON does.
-  sep = builtins.fromJSON ''
-    {
-      "right":     "\ue0b0",
-      "rightThin": "\ue0b1",
-      "left":      "\ue0b2",
-      "leftThin":  "\ue0b3"
-    }
-  '';
-in
 {
  programs.tmux = {
-    # defaults
    enable = true;
    prefix = "C-a";
    keyMode = "vi";
    mouse = true;
-
-    # tmux-256color gives truecolor, italics and undercurl in nvim.
-    terminal = "tmux-256color";
-
-    # Default is 500ms. Causes lag you feel when leaving insert mode in nvim,
-    # because tmux is waiting to see whether Esc starts an escape sequence.
-    escapeTime = 10;
-
-    # nvim autoread / :checktime react to focus.
-    focusEvents = true;
-
-    # History limit.
-    historyLimit = 50000;
-
-    # Window numbers matching the number row.
-    baseIndex = 1;
-
+    terminal = "screen-256color";
    extraConfig = ''
      # Status keys
      set -g status-keys vi
-
-      # Tell tmux the outer terminal can do 24-bit colour (tmux >= 3.2).
-      set -sa terminal-features ",*:RGB"
-
-      # Shift+Enter / extended keys
-      # These make tmux forward CSI-u sequences unconditionally.
-      # Needs tmux >= 3.5 for the format option,
-      set -s extended-keys always
-      set -s extended-keys-format csi-u
-      set -as terminal-features '*:extkeys'
-
      # Status bar options
-      set -g status-interval 5
+      set -g status-interval 1
+      set -g status on
      set -g status-justify left
-
      # Clock mode
      setw -g clock-mode-colour cyan
-
      # Colors
      set -g status-bg black
      set -g status-fg white
-
      # Key bindings
-      bind r source-file ~/.config/tmux/tmux.conf \; display-message "tmux.conf reloaded"
-
-      # Panel split and selection, new panes/windows inherit the cwd
+      # Reload configuration 
+      bind r source-file ~/.config/tmux/tmux.conf
+      # Panel split and selection
      unbind %
      unbind '"'
-      bind v split-window -v -c "#{pane_current_path}"
-      bind c split-window -h -c "#{pane_current_path}"
-      bind i new-window -c "#{pane_current_path}"
-      bind -r b previous-window
-      bind -r n next-window
-
+      bind v split-window -v
+      bind c split-window -h
+      bind i new-window
+      bind b previous-window
+      bind n next-window
      # Move around panes with hjkl
      bind h select-pane -L
      bind j select-pane -D
      bind k select-pane -U
      bind l select-pane -R
-
      # Resize panes
-      bind -r H resize-pane -L 5
-      bind -r J resize-pane -D 5
-      bind -r K resize-pane -U 5
-      bind -r L resize-pane -R 5
-
+      bind H resize-pane -L 5
+      bind J resize-pane -D 5
+      bind K resize-pane -U 5
+      bind L resize-pane -R 5
      # Wayland clipboard integration
      # Copy selection to both clipboard (Ctrl+V / Shift+Insert) and primary (middle-click)
-      bind -T copy-mode-vi v send-keys -X begin-selection
-      bind -T copy-mode-vi C-v send-keys -X rectangle-toggle
      bind -T copy-mode-vi y send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
      bind -T copy-mode-vi Enter send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
      bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
-      # Uncomment if you want yanks to also travel over SSH via OSC52.
-      # Locally redundant with wl-copy above.
-      #set -g set-clipboard on
-
      # Kill commands
-      bind q confirm-before -p "kill window #W? (y/n)" kill-window
-      bind Q confirm-before -p "kill session #S? (y/n)" kill-session
-
+      bind q kill-window
+      bind Q kill-session
      # Bars
-      # This is the nord-tmux status line. #{prefix_highlight} came from that
-      # theme's tmux-prefix-highlight integration -- a plugin you never loaded,
-      # so the token expanded to nothing. tmux can do it natively. Commas inside
-      # #{?...} are argument separators and have to be escaped as #, hence the
-      # look of the style spec.
      set -g status-left-length 24
-      set -g status-left "#[fg=black,bg=blue,bold] #{=20:session_name} #[fg=blue,bg=black,nobold,noitalics,nounderscore]${sep.right}"
-      set -g status-right "#{?client_prefix,#[fg=black#,bg=yellow#,bold] ^A ,}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]${sep.left}#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]${sep.leftThin}#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]${sep.left}#[fg=black,bg=cyan,bold] #H "
-
+      set -g status-left "#[fg=black,bg=blue,bold] #{=20:session_name} #[fg=blue,bg=black,nobold,noitalics,nounderscore]"
+      set -g status-right "#{prefix_highlight}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]#[fg=black,bg=cyan,bold] #H "
      # Windows
-      set -g window-status-format "#[fg=black,bg=brightblack,nobold,noitalics,nounderscore]${sep.right} #[fg=white,bg=brightblack]#I #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]${sep.rightThin} #[fg=white,bg=brightblack]#W #F #[fg=brightblack,bg=black,nobold,noitalics,nounderscore]${sep.right}"
-      set -g window-status-current-format "#[fg=black,bg=cyan,nobold,noitalics,nounderscore]${sep.right} #[fg=black,bg=cyan]#I #[fg=black,bg=cyan,nobold,noitalics,nounderscore]${sep.rightThin} #[fg=black,bg=cyan]#W #F #[fg=cyan,bg=black,nobold,noitalics,nounderscore]${sep.right}"
+      set -g window-status-format "#[fg=black,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#I #[fg=white,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#W #F #[fg=brightblack,bg=black,nobold,noitalics,nounderscore]"
+      set -g window-status-current-format "#[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#I #[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#W #F #[fg=cyan,bg=black,nobold,noitalics,nounderscore]"
      set -g window-status-separator ""
    '';
  };
@@ -1,19 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  # AppImages ship a squashfs payload that the bundled runtime mounts through
-  # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that
-  # dlopen, so running one directly dies with "dlopen(): error loading
-  # libfuse.so.2". appimage-run sidesteps the mount entirely: it unpacks the
-  # image and runs the payload inside an FHS sandbox, which the bundled Qt and
-  # electron style binaries need anyway.
-  #
-  # Used for the BitBox02 wallet AppImage, downloaded fresh from
-  # https://bitbox.swiss/download/ rather than installed from nixpkgs.
-  programs.appimage = {
-    enable = true;
-    # register AppImages with binfmt_misc so ./Something.AppImage runs as-is,
-    # no appimage-run prefix to remember.
-    binfmt = true;
-  };
-}
@@ -17,7 +17,7 @@
  };

  # kernel options
-  boot.kernelParams = [ "quiet" "acpi.debug_level=0" ];
+  boot.kernelParams = [ "quiet" "acpi.debug_level=0"];
  boot.kernelPackages = pkgs.linuxPackages_latest;
  boot.consoleLogLevel = 2;

@@ -4,28 +4,12 @@
  # enable gnupg agent
  programs.gnupg.agent = {
    enable = true;
-    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
-    # longer take over a terminal that a coding agent is driving
-    pinentryPackage = pkgs.pinentry-qt;
-    settings = {
-      # keep the key unlocked for a full working day instead of 10 minutes,
-      # so signing commits asks at most once per session
-      default-cache-ttl = 86400;
-      max-cache-ttl = 86400;
-      # fail an unattended signature instead of blocking on a prompt forever
-      pinentry-timeout = 120;
-    };
+    enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-curses;
  };

  environment.systemPackages = with pkgs; [ 
    gnupg
-    pinentry-qt
-    # fallback for sessions without a display, switch pinentryPackage to use it
    pinentry-curses
-    # prime the passphrase cache on demand, e.g. before an agent session
-    (writeShellScriptBin "gpg-unlock" ''
-      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
-      echo "gpg key unlocked"
-    '')
  ];
 }
@@ -35,7 +35,6 @@
    tree
    unzip
    usbutils
-    vial
    vim
    wget
    which
@@ -1,26 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw
-  # HID interface that vial.rocks drives over WebHID. Its /dev/hidraw* node is
-  # root-only by default, so neither chromium nor the native app can open it.
-  #
-  # This has to ship as a numbered rules file rather than via
-  # services.udev.extraRules: extraRules lands in 99-local.rules, but the
-  # builtin that turns TAG+="uaccess" into an actual ACL is invoked from
-  # systemd's 73-seat-late.rules. A tag set at 99 is set too late to be seen,
-  # so the device ends up correctly tagged and still unreadable. 60- sorts
-  # safely ahead of 73.
-  services.udev.packages = [
-    (pkgs.writeTextFile {
-      name = "vial-udev-rules";
-      destination = "/lib/udev/rules.d/60-vial.rules";
-      # Vial firmware advertises itself through a magic USB serial, so this
-      # matches any vial board rather than just the lily58. uaccess hands the
-      # device to whoever owns the active seat, no group membership needed.
-      text = ''
-        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", TAG+="uaccess"
-      '';
-    })
-  ];
-}