chore: ignore nixfmt reformat in git blame

Reviewed-on: #80

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# nixfmt reformat
+2231d2fc3fb4dc140c5f3257523dcdb513ac4dea

.gitignore

@@ -8,3 +8,7 @@ result-*
 
 # vim
 *.swp
+
+# devenv
+.devenv*
+devenv.local.nix

INSTALLATION.md

@@ -0,0 +1,118 @@
+# basic system installation
+
+- The installations presented in this repository are always luks encrypted
+- For simplicity I'm using device labels rather than uuids
+
+1. the partitioning layout should look somewhat like this after the installation
+```bash
+NAME               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
+nvme0n1            259:0    0 476.9G  0 disk
+├─nvme0n1p1        259:1    0     2G  0 part  /boot
+└─nvme0n1p2        259:2    0 474.9G  0 part
+  └─cryptroot      254:0    0 474.9G  0 crypt
+    ├─lvmroot-swap 254:1    0    20G  0 lvm   [SWAP]
+    ├─lvmroot-home 254:2    0   250G  0 lvm   /home
+    └─lvmroot-root 254:3    0 204.9G  0 lvm   /
+```
+
+> Note: `lsblk` may additionally show `/nix/store` as a mountpoint on `lvmroot-root`. This is not a separate partition. NixOS mounts the root device a second time at `/nix/store` with `ro,nosuid,nodev` flags to enforce store immutability at runtime.
+
+2. prepare the installation
+```bash
+# format the boot partition
+mkfs.fat -F 32 /dev/nvme0n1p1 -n "nixboot"
+# create an encrypted partition
+cryptsetup luksFormat -y --label="nixcrypt" /dev/nvme0n1p2
+# open the encrypted partition and map it to /dev/mapper/cryptroot
+cryptsetup luksOpen /dev/nvme0n1p2 cryptroot
+
+# create the physical volume
+pvcreate /dev/mapper/cryptroot
+# create a volume group inside
+vgcreate lvmroot /dev/mapper/cryptroot
+# create the swap volume
+lvcreate --size 8G lvmroot --name swap
+# if you desire, create a home volume
+lvcreate --size 150G lvmroot --name home
+# create the root volume
+lvcreate -l 100%FREE lvmroot --name root
+
+# format as usual for root partition
+mkfs.ext4 -L "nixroot" /dev/mapper/lvmroot-root
+# if you previously made the home partition, do it too
+mkfs.ext4 -L "nixhome" /dev/mapper/lvmroot-home
+# format the swap partition
+mkswap -L "nixswap" /dev/mapper/lvmroot-swap
+
+# mount root
+mount /dev/disk/by-label/nixroot /mnt
+# mount boot
+mount --mkdir /dev/nvme0n1p1 /mnt/boot
+# again, if you did the home volume
+mount --mkdir /dev/disk/by-label/nixhome /mnt/home
+# turn on swap
+swapon /dev/disk/by-label/nixswap
+```
+
+3. prepare nixos
+```bash
+# generate templates and update the hardware-configuration.nix
+nixos-generate-config --root /mnt
+
+# add dm-crypt and dm-mod to the kernelModules
+boot.initrd.kernelModules = [ "dm-crypt" "dm-mod" ];
+
+# add file systems using labels
+fileSystems."/" =
+  { device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
+fileSystems."/boot" =
+  { device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [ "fmask=0022" "dmask=0022" ];
+  };
+fileSystems."/home" =
+  { device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+swapDevices =
+  [ { device = "/dev/disk/by-label/nixswap"; }
+  ];
+
+# point the bootloader to the luks device
+boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+```
+
+4. install nixos
+```bash
+nixos-install
+```
+
+## how to deploy the initial config
+- Don't forget to install the bootloader, if you changed it since `nixos-install`
+```bash
+$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
+```
+
+## how to upgrade the system
+```bash
+$ cd /path/to/repo
+$ nix flake update
+$ sudo nixos-rebuild switch --flake .#host_name
+$ sudo nix-collect-garbage
+```
+
+## how to use nix-helper
+
+The tool nix-helper is installed by this configuration. It simplifies administrating nixos and adds more output to the rebuild command. It also features a diff after a successful build. The command uses the `NH_FLAKE` environment variable to be able to run from whatever directory.
+
+Basic commands with a set `NH_FLAKE` variable are:
+```bash
+$ nh os switch
+$ nh os build
+$ nh os test
+$ nh clean all --keep 5
+```
+
+There is also the option to interface with home-manager by using `nh home switch` but this isn't necessary since home-manager is imported as a module in this config.

README.md

@@ -1,133 +1,30 @@
-# 0x29a nixos config
+# NixOS config
 
-My personal nixos configuration files for different environments.
+My personal NixOS configurations.
 
-## basic system installation
+## config structure
-
-- The installations presented in this repository are always luks encrypted
-- For simplicity I'm using device labels rather than uuids
-
-1. the partitioning layout should look somewhat like this after the installation
 
 ```bash
-NAME               MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
+.
-nvme0n1            259:0    0 476.9G  0 disk
+├── flake.lock
-├─nvme0n1p1        259:1    0     2G  0 part  /boot
+├── flake.nix # flake definition
-└─nvme0n1p2        259:2    0 474.9G  0 part
+├── hosts
-  └─cryptroot      254:0    0 474.9G  0 crypt
+│   └── neon
-    ├─lvmroot-swap 254:1    0    20G  0 lvm   [SWAP]
+│       ├── configuration.nix # import nix-modules for specific host
-    ├─lvmroot-home 254:2    0   250G  0 lvm   /home
+│       └── hardware-configuration.nix # hardware configs for specific host
-    └─lvmroot-root 254:3    0 204.9G  0 lvm   /nix/store
+├── modules
-``` 
+│   ├── home-manager
-
+│   │   ├── xyz_module.nix
-2. prepare the installation
+│   └── nixos
-
+│       └── xyz_module.nix
-```bash
+└── users
-# format the boot partition
+    └── aaron
-mkfs.fat -F 32 /dev/sda1 -n "nixboot"
+        └── home.nix # import home-manager modules for specific user
-# create an encrypted partition
-cryptsetup luksFormat -y --label="nixcrypt" /dev/sda2
-# open the encrypted partition and map it to /dev/mapper/cryptroot
-cryptsetup luksOpen /dev/sda2 cryptroot
-
-# create the physical volume
-pvcreate /dev/mapper/cryptroot
-# create a volume group inside
-vgcreate lvmroot /dev/mapper/cryptroot
-# create the swap volume
-lvcreate --size 8G lvmroot --name nwap
-# if you desire, create a home volume
-lvcreate --size 150G lvmroot --name home
-# create the root volume
-lvcreate -l 100%FREE lvmroot --name root
-
-# format as usual for root partition
-mkfs.ext4 -L "nixroot" /dev/mapper/lvmroot-root
-# if you previously made the home partition, do it too
-mkfs.ext4 -L "nixhome" /dev/mapper/lvmroot-home
-# format the swap partition
-mkswap -L "nixswap" /dev/mapper/lvmroot-swap
-
-# mount root
-mount /dev/disk/by-label/nixroot /mnt
-# mount boot
-mount --mkdir /dev/sda1 /mnt/boot
-# again, if you did the home volume
-mount --mkdir /dev/disk/by-label/nixhome /mnt/home
-# turn on swap
-swapon /dev/disk/by-label/nixswap
 ```
 
-3. prepare nixos
+## installation
 
-
+For more details about the installation procedure see: [INSTALLATION.md](INSTALLATION.md)
-```bash
-# generate templates and update the hardware-configuration.nix
-sudo nixos-generate-config --root /mnt
-
-# add cryptd to the kernelModules
-boot.initrd.kernelModules = [ "dm-snapshot" "cryptd" ];
-
-# add file systems using labels
-fileSystems."/" =
-  { device = "/dev/disk/by-label/nixroot";
-    fsType = "ext4";
-  };
-fileSystems."/boot" =
-  { device = "/dev/disk/by-label/nixboot";
-    fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
-  };
-fileSystems."/home" =
-  { device = "/dev/disk/by-label/nixhome";
-    fsType = "ext4";
-  };
-swapDevices =
-  [ { device = "/dev/disk/by-label/nixswap"; }
-  ];
-
-# point the bootloader to the luks device
-boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
-```
-
-4. install nixos
-
-```bash
-cd /mnt
-sudo nixos-install
-```
-
-## how to deploy the inital config
-
-- Don't forget to install the bootloader, if you changed it since `nixos-install`
-
-```bash
-$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
-```
-
-## how to upgrade the system
-
-```bash
-$ cd /path/to/repo
-$ sudo nix flake update
-$ sudo nixos-rebuild switch --flake .#host_name
-$ sudo nix-collect-garbage
-```
-
-## how to use nix-helper
-
-The tool nix-helper is installed by this configuration. It simplifies administrating nixos and adds more output to the rebuild command. It also features a diff after a successful build. The command uses the `NH_FLAKE` environment variable to be able to run from whatever directory.
-
-Basic commands with a set `NH_FLAKE` variable are:
-
-```bash
-$ nh os switch
-$ nh os build
-$ nh os test
-$ nh clean all --keep 5
-```
-
-There is also the option to interface with home-manager by using `nh home switch`but this isn't necessary since home-manager is imported as a module in this config.
 
 ## author
 

devenv.lock

@@ -0,0 +1,65 @@
+{
+  "nodes": {
+    "devenv": {
+      "locked": {
+        "dir": "src/modules",
+        "lastModified": 1790701375,
+        "narHash": "sha256-0FpLHIRDYiyo3EMTnMQSobZQknZaa3JuWo6vmMCK76o=",
+        "owner": "cachix",
+        "repo": "devenv",
+        "rev": "fe20b5cba7ab5e93ae73f956a8d3efc50e1753f4",
+        "type": "github"
+      },
+      "original": {
+        "dir": "src/modules",
+        "owner": "cachix",
+        "repo": "devenv",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "inputs": {
+        "nixpkgs-src": "nixpkgs-src"
+      },
+      "locked": {
+        "lastModified": 1789506231,
+        "narHash": "sha256-vNkJbtmqyBfFhn/HnzQo4ROuoyYWuy/allqTfJb4kMY=",
+        "owner": "cachix",
+        "repo": "devenv-nixpkgs",
+        "rev": "c2f38fe7f9e04d9aadd354d380f2bd40531d9737",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "rolling",
+        "repo": "devenv-nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1789370336,
+        "narHash": "sha256-6RSEDHIWQtesQKWSu5qRai8L2h4KgCgMEfJHstW99G4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c7def046b9a883d46974757852106483d741586f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "devenv": "devenv",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

devenv.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+
+{
+  packages = with pkgs; [
+    # issue tracker (git.0x29a.ch)
+    tea
+
+    # nix tooling
+    nixfmt # official formatter (RFC 166 style)
+    statix # lints for nix anti-patterns
+    deadnix # finds unused bindings and arguments
+    nixd # language server
+    nvd # diff system generations
+  ];
+
+  scripts = {
+    lint.exec = ''
+      set -e
+      statix check .
+      # hardware-configuration.nix is generated; statix skips it via statix.toml
+      deadnix --fail --exclude hosts/*/hardware-configuration.nix -- .
+    '';
+    fmt.exec = ''
+      nixfmt $(git ls-files '*.nix')
+    '';
+  };
+
+  enterShell = ''
+    echo "nixconfig devenv: tea, lint, fmt"
+  '';
+}

devenv.yaml

@@ -0,0 +1,3 @@
+inputs:
+  nixpkgs:
+    url: github:cachix/devenv-nixpkgs/rolling

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768135262,
+        "lastModified": 1788450739,
-        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769872935,
+        "lastModified": 1790819692,
-        "narHash": "sha256-07HMIGQ/WJeAQJooA7Kkg1SDKxhAiV6eodvOwTX6WKI=",
+        "narHash": "sha256-rvubAPbh3QCliic3sAK+CXTrPCGgJstY52OTs/5H1J4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f4ad5068ee8e89e4a7c2e963e10dd35cd77b37b7",
+        "rev": "c8ecc29e5175452bee4a2aa1ba2383856d795338",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1769789167,
+        "lastModified": 1790689126,
-        "narHash": "sha256-kKB3bqYJU5nzYeIROI82Ef9VtTbu4uA3YydSk/Bioa8=",
+        "narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "62c8382960464ceb98ea593cb8321a2cf8f9e3e5",
+        "rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1769644746,
+        "lastModified": 1790541651,
-        "narHash": "sha256-1X9o0GjCzku03magX4pM+1OZXA0aUTN7KvEReZ9t3OU=",
+        "narHash": "sha256-/496IQz8qNWHHLnc3Zvr0l4uxJ34igNhJhn7ZKAefFk=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "3c27e1b35ca0fee6a89bfc20840654361ffe888d",
+        "rev": "5980a626794486abad69fca7667f9c11dfbc3bd7",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769946076,
+        "lastModified": 1790718664,
-        "narHash": "sha256-Iek7AHXTMzWi3U5EeCM1pygtvyANKY1Ax8WGn4FXh+Y=",
+        "narHash": "sha256-LWil4xgSyqIFZ9sydvL1glFOoiqAOknWUwykC4sqxuY=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "348763cc9645fb53bebde40fae9ec4122ee51b60",
+        "rev": "fd9759c892fe5034b682c185695f1bee121cd5b3",
         "type": "github"
       },
       "original": {
@@ -108,16 +108,18 @@
       }
     },
     "systems": {
+      "flake": false,
       "locked": {
-        "lastModified": 1681028828,
+        "lastModified": 1774449309,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }

flake.nix

@@ -1,6 +1,6 @@
 {
   description = "0x29a NixOS flake";
-  
+
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     home-manager = {
@@ -16,43 +16,39 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  
-  outputs = { self, nixpkgs, home-manager, nixvim, ... }@inputs: {
-    nixosConfigurations = {
 
-      default = nixpkgs.lib.nixosSystem {
+  outputs =
-        system = "x86_64-linux";
+    {
-        specialArgs = { inherit inputs; };
+      nixpkgs,
-        modules = [
+      home-manager,
-          ./hosts/default/hardware-configuration.nix
+      nixvim,
-          ./hosts/default/configuration.nix
+      ...
-          home-manager.nixosModules.home-manager
+    }@inputs:
-          {
+    let
-            home-manager.extraSpecialArgs = { inherit inputs; };
+      mkHost =
-            home-manager.users.aaron.imports = [
+        hostName:
-              nixvim.homeModules.nixvim
+        nixpkgs.lib.nixosSystem {
-              ./users/aaron/home.nix
+          system = "x86_64-linux";
-            ];
+          specialArgs = { inherit inputs; };
-          }
+          modules = [
-        ];
+            ./hosts/${hostName}/hardware-configuration.nix
-      };
+            ./hosts/${hostName}/configuration.nix
-      
+            home-manager.nixosModules.home-manager
-      neon = nixpkgs.lib.nixosSystem {
+            {
-        system = "x86_64-linux";
+              home-manager.extraSpecialArgs = { inherit inputs; };
-        specialArgs = { inherit inputs; };
+              home-manager.users.aaron.imports = [
-        modules = [
+                nixvim.homeModules.nixvim
-          ./hosts/neon/hardware-configuration.nix
+                ./users/aaron/home.nix
-          ./hosts/neon/configuration.nix
+              ];
-          home-manager.nixosModules.home-manager
+            }
-          {
+          ];
-            home-manager.extraSpecialArgs = { inherit inputs; };
+        };
-            home-manager.users.aaron.imports = [
+    in
-              nixvim.homeModules.nixvim
+    {
-              ./users/aaron/home.nix
+      nixosConfigurations = {
-            ];
+        default = mkHost "default";
-          }
+        neon = mkHost "neon";
-        ];
+        argon = mkHost "argon";
       };
     };
-  };
 }

hosts/argon/configuration.nix

@@ -0,0 +1,34 @@
+{
+  imports = [
+    ../../modules/nixos/appimage.nix
+    ../../modules/nixos/astro.nix
+    ../../modules/nixos/audio.nix
+    ../../modules/nixos/bootloader.nix
+    ../../modules/nixos/calibre.nix
+    ../../modules/nixos/certificates.nix
+    ../../modules/nixos/claudecode.nix
+    ../../modules/nixos/drives.nix
+    ../../modules/nixos/gnupg.nix
+    ../../modules/nixos/graphics.nix
+    ../../modules/nixos/greetd.nix
+    ../../modules/nixos/locales.nix
+    ../../modules/nixos/networking.nix
+    ../../modules/nixos/niri.nix
+    ../../modules/nixos/noctalia.nix
+    ../../modules/nixos/openssh.nix
+    ../../modules/nixos/packages.nix
+    ../../modules/nixos/protonvpn.nix
+    ../../modules/nixos/services.nix
+    ../../modules/nixos/settings.nix
+    ../../modules/nixos/steam.nix
+    ../../modules/nixos/thunar.nix
+    ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
+  ];
+
+  # set hostname
+  networking.hostName = "argon";
+
+  # install state version
+  system.stateVersion = "25.11"; # Don't change
+}

hosts/argon/hardware-configuration.nix

@@ -0,0 +1,55 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ "dm-crypt dm-mod" ];
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/mapper/lvmroot-root";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/AC1C-20EB";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/mapper/lvmroot-home";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/mapper/lvmroot-swap"; }
+  ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/default/configuration.nix

@@ -1,15 +1,13 @@
 # 0x29a nixos conifg
 
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 
 {
-  imports =
-    [ 
-      ./hardware-configuration.nix
-    ];
-
   # use flakes
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   # configure bootloader
   boot.loader.systemd-boot.enable = false;
@@ -34,7 +32,7 @@
   services.qemuGuest.enable = true;
 
   # networking
-  networking.hostName = "nixos"; 
+  networking.hostName = "nixos";
   networking.networkmanager.enable = true;
 
   # time zone.
@@ -65,9 +63,10 @@
 
     windowManager.qtile = {
       enable = true;
-      extraPackages = python3Packages: with python3Packages; [
+      extraPackages =
-        qtile-extras
+        python3Packages: with python3Packages; [
-      ];
+          qtile-extras
+        ];
     };
   };
 
@@ -76,8 +75,8 @@
 
   # enable sound
   services.pipewire = {
-     enable = true;
+    enable = true;
-     pulse.enable = true;
+    pulse.enable = true;
   };
 
   # define a user account
@@ -102,7 +101,10 @@
     autosuggestions.enable = true;
     ohMyZsh = {
       enable = true;
-      plugins = [ "git" "sudo" ];
+      plugins = [
+        "git"
+        "sudo"
+      ];
       theme = "agnoster";
     };
   };
@@ -121,8 +123,8 @@
   # Some programs need SUID wrappers
   programs.mtr.enable = true;
   programs.gnupg.agent = {
-     enable = true;
+    enable = true;
-     enableSSHSupport = true;
+    enableSSHSupport = true;
   };
 
   # enable the OpenSSH daemon
@@ -135,4 +137,3 @@
   # install state version
   system.stateVersion = "25.05"; # Don't change
 }
-

hosts/default/hardware-configuration.nix

@@ -1,36 +1,56 @@
 # 0x29a nixos hardware configuration
 
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
   # boot and initrd configs
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
-  boot.initrd.kernelModules = [ "dm-snapshot" "cryptd" ];
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "cryptd"
+  ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
   boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
 
   # file systems
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-label/nixroot";
+    device = "/dev/disk/by-label/nixroot";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-label/nixboot";
+    device = "/dev/disk/by-label/nixboot";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
-  fileSystems."/home" =
+      "dmask=0022"
-    { device = "/dev/disk/by-label/nixhome";
-      fsType = "ext4";
-    };
-  swapDevices =
-    [ { device = "/dev/disk/by-label/nixswap"; }
     ];
+  };
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
 
   # enable dhcp on all interfaces
   networking.useDHCP = lib.mkDefault true;

hosts/default/home.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # user config
@@ -29,7 +29,6 @@
     iotop
     iftop
     strace
-    ltrace
     lsof
     sysstat
     lm_sensors
@@ -51,12 +50,16 @@
     syntaxHighlighting.enable = true;
     oh-my-zsh = {
       enable = true;
-      plugins = [ "git" "sudo" "python" "ansible" ];
+      plugins = [
+        "git"
+        "sudo"
+        "python"
+        "ansible"
+      ];
       theme = "agnoster";
     };
   };
 
-
   ## deploy qtile config
   #home.file."qtile-config" = {
   #  target = ".config/qtile/config.py";

hosts/neon/configuration.nix

@@ -1,10 +1,12 @@
-{ config, pkgs, inputs, ... }:
-
 {
   imports = [
+    ../../modules/nixos/appimage.nix
+    ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
+    ../../modules/nixos/claudecode.nix
+    ../../modules/nixos/docker.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/locales.nix
     ../../modules/nixos/networking.nix
@@ -12,14 +14,18 @@
     ../../modules/nixos/noctalia.nix
     ../../modules/nixos/openssh.nix
     ../../modules/nixos/packages.nix
+    ../../modules/nixos/protonvpn.nix
     ../../modules/nixos/sddm.nix
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
     ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
   ];
 
+  # set hostname
+  networking.hostName = "neon";
+
   # install state version
   system.stateVersion = "25.11"; # Don't change
 }
-

hosts/neon/hardware-configuration.nix

@@ -1,39 +1,57 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [
-  boot.initrd.kernelModules = [ "dm-snapshot" "cryptd" ];
+    "xhci_pci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "cryptd"
+  ];
   boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
 
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-label/nixroot";
+    device = "/dev/disk/by-label/nixroot";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-label/nixboot";
+    device = "/dev/disk/by-label/nixboot";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
-
+      "dmask=0022"
-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/nixhome";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-label/nixswap"; }
     ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
 
   networking.useDHCP = lib.mkDefault true;
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

modules/home-manager/fonts.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, ... }:
 
 {
   # user fonts

modules/home-manager/ghostty.nix

@@ -1,5 +1,3 @@
-{ config, pkgs, inputs, ... }:
-
 {
   programs.ghostty = {
     enable = true;
@@ -7,10 +5,11 @@
       clipboard-paste-protection = false;
       clipboard-read = "allow";
       font-family = "0xProto Nerd Font Mono";
-      font-size = 9;
+      font-size = 12;
       gtk-titlebar = false;
-      scrollback-limit = 10000;
+      scrollback-limit = 100000;
       shell-integration = "zsh";
+      shell-integration-features = "ssh-env,ssh-terminfo";
       theme = "noctalia"; # generated by noctalia-shell
       window-decoration = "auto";
       window-padding-x = 10;

modules/home-manager/git.nix

@@ -1,17 +1,46 @@
-{ config, pkgs, inputs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  email = "aaron@0x29a.ch";
+
+  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
+  # signing key in gitea. the key a host signs with is picked up from the key
+  # file itself, this list only tells the local git which machines to trust
+  signingKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+  ];
+in
+{
+  # gitea verifies signatures against the account keys, this teaches the local
+  # git the same trust so `git log --show-signature` resolves as well
+  xdg.configFile."git/allowed_signers".text = lib.concatMapStrings (
+    key: "${email} ${key}\n"
+  ) signingKeys;
+
   programs.git = {
     enable = true;
     settings = {
-      push = { autoSetupRemote = true; };
+      push = {
-      user = {
+        autoSetupRemote = true;
-        name  = "aaron";
-        email = "aaron@0x29a.ch";
       };
+      user = {
+        name = "aaron";
+        inherit email;
+      };
+      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
     };
     signing = {
-      key = "7A830180A05DAC59CDE43B0677D2F5DB48184456";
+      format = "ssh";
+      # point at the *public* key so ssh-keygen signs through the ssh agent
+      # instead of reading the passphrase protected private key from disk
+      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+      signer = "${pkgs.openssh}/bin/ssh-keygen";
       signByDefault = true;
     };
   };

modules/home-manager/nixvim.nix

@@ -1,11 +1,20 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, inputs, ... }:
 
 {
   programs.nixvim = {
-    globals.mapleader = " ";
     enable = true;
-    viAlias = false;
+
+    # We keep `inputs.nixvim.inputs.nixpkgs.follows = "nixpkgs"` in flake.nix so
+    # the whole config shares a single nixpkgs. Setting `source` explicitly to
+    # that same nixpkgs acknowledges the override and silences nixvim's warning
+    # about its pinned nixpkgs being bypassed.
+    nixpkgs.source = inputs.nixpkgs;
+
+    # set aliases
+    viAlias = true;
     vimAlias = true;
+
+    # default vim options
     opts = {
       number = true;
       relativenumber = true;
@@ -14,13 +23,89 @@
       expandtab = true;
       incsearch = true;
     };
+
+    # nvim mapleader for all command below
+    globals.mapleader = " ";
+    # set colorscheme to nord
     colorschemes.nord.enable = true;
+
+    # nvim plugins
+    plugins.indent-blankline.enable = true;
     plugins.lualine.enable = true;
     plugins.nix.enable = true;
     plugins.nvim-tree.enable = true;
-    plugins.treesitter.enable = true;
-    plugins.telescope.enable = true;
     plugins.web-devicons.enable = true;
-    plugins.indent-blankline.enable = true;
+    plugins.telescope = {
+      enable = true;
+      keymaps = {
+        "<leader>ff" = "find_files";
+        "<leader>fg" = "live_grep";
+        "<leader>fb" = "buffers";
+        "<leader>fh" = "help_tags";
+      };
+    };
+    plugins.lsp = {
+      enable = true;
+      servers.tinymist = {
+        enable = true;
+        settings = {
+          formatterMode = "typstyle";
+          exportPdf = "onSave";
+          semanticTokens = "disable"; # treesitter handles highlighting better
+        };
+      };
+      servers.pyright.enable = true;
+      servers.ruff.enable = true;
+      keymaps.lspBuf = {
+        "<leader>K" = "hover";
+        "<leader>gd" = "definition";
+        "<leader>gr" = "references";
+        "<leader>f" = "format";
+        "<leader>rn" = "rename";
+        "<leader>ca" = "code_action";
+      };
+    };
+    plugins.treesitter = {
+      enable = true;
+      settings.ensure_installed = [
+        "markdown"
+        "markdown_inline"
+        "typst"
+      ];
+    };
+    plugins.typst-preview = {
+      enable = true;
+      settings = {
+        open_cmd = "firefox %s";
+        dependencies_bin = {
+          tinymist = "tinymist";
+          websocat = null;
+        };
+      };
+    };
+    plugins.typst-vim = {
+      enable = true;
+      settings.pdf_viewer = "zathura";
+    };
+    plugins.render-markdown = {
+      enable = true;
+      settings = {
+        # render in normal mode, raw source in insert
+        render_modes = [
+          "n"
+          "c"
+          "t"
+        ];
+        pipe_table.preset = "round";
+        heading.width = "block";
+        file_types = [ "markdown" ];
+        completions.lsp.enabled = true;
+      };
+    };
   };
+
+  # install dependencies
+  home.packages = with pkgs; [
+    ripgrep
+  ];
 }

modules/home-manager/noctalia.nix

@@ -0,0 +1,141 @@
+{ pkgs, inputs, ... }:
+
+{
+  # Noctalia v5 shell, managed via home-manager's built-in programs.noctalia module.
+  # The noctalia flake's homeModules.default is not imported: it redeclares the same
+  # options and its disabledModules path ("programs/noctalia.nix") doesn't match HM's.
+  # See https://docs.noctalia.dev/v5/getting-started/nixos/
+
+  programs.noctalia = {
+    enable = true;
+
+    # Use the package from the noctalia flake rather than nixpkgs.
+    package = inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+    # settings is rendered to ~/.config/noctalia/config.toml
+    settings = {
+      # theme / colors
+      theme = {
+        source = "builtin";
+        builtin = "Nord";
+        mode = "dark";
+        templates.builtin_ids = [ "ghostty" ];
+      };
+
+      # general
+      shell = {
+        font_family = "0xProto Nerd Font Mono";
+        ui_scale = 1.2;
+        avatar_path = "/home/aaron/syncthing/pictures/Logo-Aaron-Totenkopf-rund-schwarz.png";
+        telemetry_enabled = false;
+        clipboard_enabled = true;
+        password_style = "random";
+
+        panel = {
+          launcher_compact = true;
+          open_near_click_control_center = true;
+          open_near_click_session = true;
+          open_near_click_wallpaper = true;
+          transparency_mode = "glass";
+        };
+
+        screen_corners = {
+          enabled = true;
+          size = 10;
+        };
+      };
+
+      # location / weather
+      location.address = "Bern";
+
+      weather = {
+        enabled = true;
+        unit = "metric";
+      };
+
+      # wallpaper
+      wallpaper = {
+        enabled = true;
+        directory = "/home/aaron/Pictures/Wallpapers";
+        fill_mode = "crop";
+        default.path = "/home/aaron/Pictures/Wallpapers/nord-theme-tower.png";
+      };
+
+      # bar layout
+      bar = {
+        order = [ "default" ];
+        default = {
+          position = "top";
+          background_opacity = 0.93;
+          font_weight = 400;
+          margin_edge = 0;
+          margin_ends = 0;
+          radius = 0;
+          scale = 1.2;
+          widget_spacing = 20;
+          start = [
+            "control-center"
+            "cpu"
+            "ram"
+            "temp"
+            "active_window"
+          ];
+          center = [ "workspaces" ];
+          end = [
+            "tray"
+            "bluetooth"
+            "notifications"
+            "volume"
+            "network"
+            "clock"
+          ];
+        };
+      };
+
+      # per-widget styling
+      widget = {
+        bluetooth.capsule = true;
+        control-center = {
+          capsule_radius = 8;
+          custom_image = "/home/aaron/Pictures/nix_flake_logo.png";
+          scale = 1.4;
+        };
+        cpu.capsule = true;
+        network = {
+          capsule = true;
+          show_label = false;
+        };
+        notifications.capsule = true;
+        ram.capsule = true;
+        temp.capsule = true;
+        volume = {
+          capsule = true;
+          show_label = false;
+        };
+      };
+
+      # idle behavior
+      idle = {
+        behavior_order = [
+          "screen-off"
+          "lock"
+          "lock-and-suspend"
+        ];
+        behavior = {
+          "screen-off" = {
+            enabled = true;
+            timeout = 600;
+          };
+          "lock" = {
+            enabled = true;
+            timeout = 660;
+          };
+          "lock-and-suspend" = {
+            enabled = true;
+            timeout = 1800;
+          };
+        };
+      };
+    };
+  };
+}

modules/home-manager/programs.nix

@@ -1,15 +1,25 @@
-{ config, pkgs, inputs, ... }:
+{ config, pkgs, ... }:
 
 {
   # user packages
   home.packages = with pkgs; [
+    devenv
     discord
     fastfetch
     keepassxc
-    screenfetch
+    teamspeak6-client
+    typst
+    zathura
   ];
 
   # services and other software
   services.syncthing.enable = true;
   programs.home-manager.enable = true;
+
+  # browsers
+  programs.chromium.enable = true;
+  programs.firefox = {
+    enable = true;
+    configPath = "${config.xdg.configHome}/mozilla/firefox";
+  };
 }

modules/home-manager/shell.nix

@@ -1,15 +1,61 @@
-{ config, pkgs, inputs, ... }:
+{ lib, ... }:
- 
+
 {
+  # configure z-shell to use omz with some plugins
   programs.zsh = {
     enable = true;
     autosuggestion.enable = true;
     syntaxHighlighting.enable = true;
     oh-my-zsh = {
       enable = true;
-      theme = "agnoster";
+      # add git and agents as plugins
-      #plugins = [ "git" "ssh-agent" ];
+      plugins = [
+        "git"
+        "ssh-agent"
+        "gpg-agent"
+      ];
+      # everything here lands before `source $ZSH/oh-my-zsh.sh`
+      extraConfig = ''
+        # make omz faster on large repositories
+        DISABLE_UNTRACKED_FILES_DIRTY=true
+
+        # only display a fancy theme when glyphs are rendered
+        if [[ "$TERM" == "linux" || "$TERM" == "screen" ]]; then
+          ZSH_THEME="gentoo"
+        else
+          ZSH_THEME="agnoster"
+        fi
+      '';
     };
+
+    # Unlike oh-my-zsh.extraConfig above, this lands *after*
+    # `source $ZSH/oh-my-zsh.sh`, which is where the theme's prompt functions
+    # come into existence.
+    initContent = lib.mkAfter ''
+      # Keep the prompt on one line in deeply nested trees.
+      #
+      # Both themes render the working directory as `%~`, the full path with
+      # $HOME collapsed to `~`. Somewhere like
+      # ~/git/bfh/cas-pml-sem/documents/bericht that is 39 columns on its own,
+      # and together with user@host and a long branch name the line wraps.
+      #
+      # `%(4~|…/%2~|%~)` is a prompt ternary: at four or more components show
+      # an ellipsis and the last two, otherwise show the path whole. Short
+      # paths like ~/git/nixconfig are left alone.
+      if [[ "$ZSH_THEME" == "agnoster" ]]; then
+        # agnoster calls prompt_dir on every render, so redefining it is
+        # enough. AGNOSTER_DIR_* keep the segment's own colours.
+        prompt_dir() {
+          prompt_segment "$AGNOSTER_DIR_BG" "$AGNOSTER_DIR_FG" '%(4~|…/%2~|%~)'
+        }
+      else
+        # gentoo builds PROMPT once at load time, so patch the string. Its
+        # `%~` is the non-root branch of `%(!.%1~.%~)`, and it is the first
+        # literal `%~` in there, so the root branch is untouched. ASCII `...`
+        # because this branch is the Linux console, whose font may lack U+2026.
+        PROMPT="''${PROMPT/\%~/%(4~|.../%2~|%~)}"
+      fi
+    '';
   };
 
   # set important env vars

modules/home-manager/styling.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, ... }:
 
 {
   # set gtk theme
@@ -6,9 +6,10 @@
     enable = true;
     theme = {
       name = "Adwaita-dark";
-        package = pkgs.gnome-themes-extra;
+      package = pkgs.gnome-themes-extra;
-      };
+    };
     gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
+    gtk4.theme = null;
     gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
   };
 

modules/home-manager/tmux.nix

@@ -1,55 +1,121 @@
-{ config, pkgs, inputs, ... }:
+let
-
+  # Powerline separators, U+E0B0..U+E0B3.
+  #
+  # Written as escapes rather than literal glyphs. These are Private Use Area
+  # codepoints: they render only with a patched font, they survive copy/paste
+  # badly, and when they get stripped the loss is invisible, the config still
+  # parses, the status bar just quietly loses its separators. Nix has no \u
+  # escape of its own, but fromJSON does.
+  sep = builtins.fromJSON ''
+    {
+      "right":     "\ue0b0",
+      "rightThin": "\ue0b1",
+      "left":      "\ue0b2",
+      "leftThin":  "\ue0b3"
+    }
+  '';
+in
 {
   programs.tmux = {
+    # defaults
     enable = true;
     prefix = "C-a";
     keyMode = "vi";
     mouse = true;
-    terminal = "screen-256color";
+
+    # tmux-256color gives truecolor, italics and undercurl in nvim.
+    terminal = "tmux-256color";
+
+    # Default is 500ms. Causes lag you feel when leaving insert mode in nvim,
+    # because tmux is waiting to see whether Esc starts an escape sequence.
+    escapeTime = 10;
+
+    # nvim autoread / :checktime react to focus.
+    focusEvents = true;
+
+    # History limit.
+    historyLimit = 50000;
+
+    # Window numbers matching the number row.
+    baseIndex = 1;
+
     extraConfig = ''
       # Status keys
       set -g status-keys vi
+
+      # Tell tmux the outer terminal can do 24-bit colour (tmux >= 3.2).
+      set -sa terminal-features ",*:RGB"
+
+      # Shift+Enter / extended keys
+      # These make tmux forward CSI-u sequences unconditionally.
+      # Needs tmux >= 3.5 for the format option,
+      set -s extended-keys always
+      set -s extended-keys-format csi-u
+      set -as terminal-features '*:extkeys'
+
       # Status bar options
-      set -g status-interval 1
+      set -g status-interval 5
-      set -g status on
       set -g status-justify left
+
       # Clock mode
       setw -g clock-mode-colour cyan
+
       # Colors
       set -g status-bg black
       set -g status-fg white
+
       # Key bindings
-      # Reload configuration 
+      bind r source-file ~/.config/tmux/tmux.conf \; display-message "tmux.conf reloaded"
-      bind r source-file ~/.config/tmux/tmux.conf
+
-      # Panel split and selection
+      # Panel split and selection, new panes/windows inherit the cwd
       unbind %
       unbind '"'
-      bind v split-window -v
+      bind v split-window -v -c "#{pane_current_path}"
-      bind c split-window -h
+      bind c split-window -h -c "#{pane_current_path}"
-      bind i new-window
+      bind i new-window -c "#{pane_current_path}"
-      bind b previous-window
+      bind -r b previous-window
-      bind n next-window
+      bind -r n next-window
+
       # Move around panes with hjkl
       bind h select-pane -L
       bind j select-pane -D
       bind k select-pane -U
       bind l select-pane -R
+
       # Resize panes
-      bind H resize-pane -L 5
+      bind -r H resize-pane -L 5
-      bind J resize-pane -D 5
+      bind -r J resize-pane -D 5
-      bind K resize-pane -U 5
+      bind -r K resize-pane -U 5
-      bind L resize-pane -R 5
+      bind -r L resize-pane -R 5
+
+      # Wayland clipboard integration
+      # Copy selection to both clipboard (Ctrl+V / Shift+Insert) and primary (middle-click)
+      bind -T copy-mode-vi v send-keys -X begin-selection
+      bind -T copy-mode-vi C-v send-keys -X rectangle-toggle
+      bind -T copy-mode-vi y send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
+      bind -T copy-mode-vi Enter send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
+      bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
+      # Uncomment if you want yanks to also travel over SSH via OSC52.
+      # Locally redundant with wl-copy above.
+      #set -g set-clipboard on
+
       # Kill commands
-      bind q kill-window
+      bind q confirm-before -p "kill window #W? (y/n)" kill-window
-      bind Q kill-session
+      bind Q confirm-before -p "kill session #S? (y/n)" kill-session
+
       # Bars
-      set -g status-left "#[fg=black,bg=blue,bold] #S#[fg=blue,bg=black,nobold,noitalics,nounderscore]"
+      # This is the nord-tmux status line. #{prefix_highlight} came from that
-      set -g status-left "#[fg=black,bg=blue,bold] #S #[fg=blue,bg=black,nobold,noitalics,nounderscore]"
+      # theme's tmux-prefix-highlight integration -- a plugin you never loaded,
-      set -g status-right "#{prefix_highlight}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]#[fg=black,bg=cyan,bold] #H "
+      # so the token expanded to nothing. tmux can do it natively. Commas inside
+      # #{?...} are argument separators and have to be escaped as #, hence the
+      # look of the style spec.
+      set -g status-left-length 24
+      set -g status-left "#[fg=black,bg=blue,bold] #{=20:session_name} #[fg=blue,bg=black,nobold,noitalics,nounderscore]${sep.right}"
+      set -g status-right "#{?client_prefix,#[fg=black#,bg=yellow#,bold] ^A ,}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]${sep.left}#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]${sep.leftThin}#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]${sep.left}#[fg=black,bg=cyan,bold] #H "
+
       # Windows
-      set -g window-status-format "#[fg=black,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#I #[fg=white,bg=brightblack,nobold,noitalics,nounderscore] #[fg=white,bg=brightblack]#W #F #[fg=brightblack,bg=black,nobold,noitalics,nounderscore]"
+      set -g window-status-format "#[fg=black,bg=brightblack,nobold,noitalics,nounderscore]${sep.right} #[fg=white,bg=brightblack]#I #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]${sep.rightThin} #[fg=white,bg=brightblack]#W #F #[fg=brightblack,bg=black,nobold,noitalics,nounderscore]${sep.right}"
-      set -g window-status-current-format "#[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#I #[fg=black,bg=cyan,nobold,noitalics,nounderscore] #[fg=black,bg=cyan]#W #F #[fg=cyan,bg=black,nobold,noitalics,nounderscore]"
+      set -g window-status-current-format "#[fg=black,bg=cyan,nobold,noitalics,nounderscore]${sep.right} #[fg=black,bg=cyan]#I #[fg=black,bg=cyan,nobold,noitalics,nounderscore]${sep.rightThin} #[fg=black,bg=cyan]#W #F #[fg=cyan,bg=black,nobold,noitalics,nounderscore]${sep.right}"
       set -g window-status-separator ""
     '';
   };

modules/nixos/appimage.nix

@@ -0,0 +1,17 @@
+{
+  # AppImages ship a squashfs payload that the bundled runtime mounts through
+  # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that
+  # dlopen, so running one directly dies with "dlopen(): error loading
+  # libfuse.so.2". appimage-run sidesteps the mount entirely: it unpacks the
+  # image and runs the payload inside an FHS sandbox, which the bundled Qt and
+  # electron style binaries need anyway.
+  #
+  # Used for the BitBox02 wallet AppImage, downloaded fresh from
+  # https://bitbox.swiss/download/ rather than installed from nixpkgs.
+  programs.appimage = {
+    enable = true;
+    # register AppImages with binfmt_misc so ./Something.AppImage runs as-is,
+    # no appimage-run prefix to remember.
+    binfmt = true;
+  };
+}

modules/nixos/astro.nix

@@ -0,0 +1,95 @@
+{ lib, pkgs, ... }:
+
+let
+  # Siril's Python plugins (sirilpy) run in a venv that pip-installs foreign
+  # manylinux wheels (numpy, GraXpert deps, ...). Those .so files need
+  # libstdc++ at runtime. nix-ld does NOT cover this: it only handles the
+  # initial exec of a foreign binary, but here a *native* nixpkgs python
+  # dlopen()s the foreign wheel. So we put the libs on LD_LIBRARY_PATH, which
+  # the python subprocess inherits from the Siril process.
+  sirilWithPlugins = pkgs.symlinkJoin {
+    name = "siril-with-plugins";
+    paths = [ pkgs.siril ];
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+    # Siril bootstraps its sirilpy venv at first run by locating a `python3`
+    # on PATH. nixpkgs only *propagates* python3 from the siril derivation (it
+    # isn't on the runtime PATH), so without the --prefix PATH below the GUI
+    # fails with "Python not found in system PATH" and never creates
+    # ~/.local/share/siril/venv.
+    #
+    # We deliberately do NOT put ${pkgs.python3}/bin on PATH directly: `venv`
+    # symlinks bin/python3 to whatever sys.executable was, so the venv would
+    # hard-link a /nix/store hash that gets garbage-collected after the next
+    # python bump, leaving a dangling symlink ("Error finding venv python
+    # path, unable to spawn python"). Instead we go through the stable
+    # /etc/siril/bin/python3 symlink (see environment.etc below), which NixOS
+    # re-points at the current python on every rebuild.
+    #
+    # The VeraLux PyQt6 wheel ships only the built-in Windows/Fusion styles, so
+    # the global QT_STYLE_OVERRIDE=adwaita-dark (inherited from the session) is
+    # rejected ("invalid style override") and windows fall back to a light
+    # theme. We expose nixpkgs adwaita-qt6's style plugin on QT_PLUGIN_PATH so
+    # the override resolves. This works because nixpkgs qt6 and the bundled Qt
+    # share a major.minor (6.11); if they ever drift the plugin is simply
+    # ignored again (harmless warning + Fusion fallback, no loss of function).
+    postBuild = ''
+      wrapProgram $out/bin/siril \
+        --prefix PATH : /etc/siril/bin \
+        --prefix QT_PLUGIN_PATH : ${pkgs.adwaita-qt6}/lib/qt-6/plugins \
+        --prefix LD_LIBRARY_PATH : ${
+          lib.makeLibraryPath (
+            with pkgs;
+            [
+              stdenv.cc.cc.lib # libstdc++ / libgcc_s / libgomp  (numpy etc.)
+              zlib
+              zstd # libzstd.so.1                     (PyQt6)
+              libGL # libGL.so.1                       (PyQt6)
+              # PyQt6 (VeraLux) — Qt bundles xcb support so it needs these even
+              # on Wayland; libxkbcommon is the keymap lib used by Wayland too.
+              glib
+              fontconfig
+              freetype
+              dbus
+              libxkbcommon
+              # Qt platform plugins: the wayland plugin (libqwayland.so) needs the
+              # wayland client libs; the xcb fallback needs libxcb-cursor.so.0.
+              wayland # libwayland-client/cursor/egl       (wayland plugin)
+              libxcb-cursor # libxcb-cursor.so.0                 (xcb plugin)
+              libx11
+              libxcb
+              libxcb-util
+              libxcb-wm
+              libxcb-image
+              libxcb-keysyms
+              libxcb-render-util
+            ]
+          )
+        }
+    '';
+  };
+in
+{
+  # install stellarium for target finding and siril for stacking
+  environment.systemPackages = with pkgs; [
+    stellarium
+    sirilWithPlugins
+  ];
+
+  # Stable, GC-safe interpreter path for Siril's venv (see sirilWithPlugins).
+  # Same python as siril itself propagates, so sirilpy's ABI matches.
+  environment.etc."siril/bin/python3".source = "${pkgs.python3}/bin/python3";
+
+  # StarNet++ has no nixpkgs package. Download the StarNet v2 ORT CLI build
+  # (starnet2_linux_*_ORT_x64_cli) from https://www.starnetastro.com/download/
+  # and unzip it to ~/.local/share/siril/starnet/. Then in Siril set
+  #   Preferences -> Miscellaneous -> StarNet executable
+  # to the extracted ./starnet2 binary.
+  #
+  # The binary is a generic dynamically-linked ELF, so NixOS needs nix-ld to
+  # run it. Its own opencv/onnxruntime libs are found via the bundled ./lib.
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    stdenv.cc.cc.lib # libstdc++ / libgcc_s
+    zlib
+  ];
+}

modules/nixos/audio.nix

@@ -1,9 +1,7 @@
-{ config, lib, pkgs, ... }:
-
 {
   # enable sound through pipewire
   services.pipewire = {
-     enable = true;
+    enable = true;
-     pulse.enable = true;
+    pulse.enable = true;
   };
 }

modules/nixos/bootloader.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # set bootloader to systemd
@@ -9,7 +9,7 @@
 
   # enable systemd initrd
   boot.initrd.systemd.enable = true;
-  
+
   # plymouth
   boot.plymouth = {
     enable = true;
@@ -17,7 +17,10 @@
   };
 
   # kernel options
-  boot.kernelParams = [ "quiet" "acpi.debug_level=0"];
+  boot.kernelParams = [
+    "quiet"
+    "acpi.debug_level=0"
+  ];
   boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.consoleLogLevel = 2;
 

modules/nixos/calibre.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+
+{
+  # install calibre for ebook management and kobo syncing
+  environment.systemPackages = with pkgs; [
+    calibre
+  ];
+}

modules/nixos/certificates.nix

@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 let
   caddyRootCA = ''
     -----BEGIN CERTIFICATE-----

modules/nixos/claudecode.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    claude-code
+  ];
+}

modules/nixos/docker.nix

@@ -0,0 +1,29 @@
+{ pkgs, ... }:
+
+{
+  # add docker group to user
+  users.users.aaron.extraGroups = [ "docker" ];
+
+  virtualisation.docker = {
+    enable = true;
+    # Customize Docker daemon settings
+    daemon.settings = {
+      dns = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
+      log-driver = "journald";
+      registry-mirrors = [ "https://mirror.gcr.io" ];
+      storage-driver = "overlay2";
+    };
+    # Use the rootless mode
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+    # Install docker-compose
+    extraPackages = with pkgs; [
+      docker-compose
+    ];
+  };
+}

modules/nixos/drives.nix

@@ -0,0 +1,45 @@
+# Add encrypted drives to argon
+
+{
+  # copy keyfiles into initrd to make them available during early boot
+  boot.initrd.secrets = {
+    "/etc/nixos/keys/data1.key" = "/etc/nixos/keys/data1.key";
+    "/etc/nixos/keys/data2.key" = "/etc/nixos/keys/data2.key";
+    "/etc/nixos/keys/nvmecache.key" = "/etc/nixos/keys/nvmecache.key";
+  };
+
+  # decrypt data drives with keyfiles for argon
+  boot.initrd.luks.devices = {
+    "data1" = {
+      device = "/dev/disk/by-uuid/dfae62cc-bad1-4879-bf9a-461bde833625";
+      keyFile = "/etc/nixos/keys/data1.key";
+    };
+    "data2" = {
+      device = "/dev/disk/by-uuid/8312edae-9247-481b-a313-52a7f848f027";
+      keyFile = "/etc/nixos/keys/data2.key";
+    };
+    "nvmecache" = {
+      device = "/dev/disk/by-uuid/2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
+      keyFile = "/etc/nixos/keys/nvmecache.key";
+    };
+  };
+
+  # mount decrypted filesystems
+  fileSystems."/mnt/data1" = {
+    device = "/dev/mapper/data1";
+    fsType = "ext4";
+    options = [ "nofail" ];
+  };
+
+  fileSystems."/mnt/data2" = {
+    device = "/dev/mapper/data2";
+    fsType = "ext4";
+    options = [ "nofail" ];
+  };
+
+  fileSystems."/mnt/nvmecache" = {
+    device = "/dev/mapper/nvmecache";
+    fsType = "ext4";
+    options = [ "nofail" ];
+  };
+}

modules/nixos/gnupg.nix

@@ -1,15 +1,31 @@
-{ config, lib, pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   # enable gnupg agent
   programs.gnupg.agent = {
     enable = true;
-    enableSSHSupport = true;
+    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
-    pinentryPackage = pkgs.pinentry-curses;
+    # longer take over a terminal that a coding agent is driving
+    pinentryPackage = pkgs.pinentry-qt;
+    settings = {
+      # keep the key unlocked for a full working day instead of 10 minutes,
+      # so signing commits asks at most once per session
+      default-cache-ttl = 86400;
+      max-cache-ttl = 86400;
+      # fail an unattended signature instead of blocking on a prompt forever
+      pinentry-timeout = 120;
+    };
   };
 
-  environment.systemPackages = with pkgs; [ 
+  environment.systemPackages = with pkgs; [
     gnupg
+    pinentry-qt
+    # fallback for sessions without a display, switch pinentryPackage to use it
     pinentry-curses
+    # prime the passphrase cache on demand, e.g. before an agent session
+    (writeShellScriptBin "gpg-unlock" ''
+      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
+      echo "gpg key unlocked"
+    '')
   ];
 }

modules/nixos/gnuradio.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+
+{
+  # install gnuradio companion along with it's osmocom library
+  environment.systemPackages = with pkgs; [
+    (gnuradio.override {
+      extraPackages = with gnuradio.pkgs; [ osmosdr ];
+    })
+    gqrx
+    hackrf
+  ];
+}

modules/nixos/graphics.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+
+{
+  # enable amd GPU acceleration (mesa, vulkan, egl)
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # install amdgpu_top
+  environment.systemPackages = with pkgs; [
+    amdgpu_top
+  ];
+
+  # add amdgpu to the initrd for plymouth
+  hardware.amdgpu.initrd.enable = true;
+}

modules/nixos/greetd.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  # greetd display manager with tuigreet
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd niri-session";
+        user = "greeter";
+      };
+    };
+  };
+}

modules/nixos/locales.nix

@@ -1,21 +1,19 @@
-{ config, lib, pkgs, ... }:
-
 {
   # set the time zone
   time.timeZone = "Europe/Zurich";
 
-  # set internationalisation properties
+  # keep system language in english, but use swiss locale for formatting
   i18n.defaultLocale = "en_US.UTF-8";
   i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
+    LC_ADDRESS = "de_CH.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_IDENTIFICATION = "de_CH.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MEASUREMENT = "de_CH.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
+    LC_MONETARY = "de_CH.UTF-8";
-    LC_NAME = "en_US.UTF-8";
+    LC_NAME = "de_CH.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
+    LC_NUMERIC = "de_CH.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
+    LC_PAPER = "de_CH.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TELEPHONE = "de_CH.UTF-8";
-    LC_TIME = "en_US.UTF-8";
+    LC_TIME = "de_CH.UTF-8";
   };
 
   # set console font and keymap

modules/nixos/networking.nix

@@ -1,9 +1,6 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
-  # set hostnname
-  networking.hostName = "neon";
-
   # user networkmanager
   networking.networkmanager.enable = true;
 
@@ -11,9 +8,12 @@
   networking.firewall.allowedTCPPorts = [ ];
   networking.firewall.allowedUDPPorts = [ ];
 
+  # enable wifi firmware
+  hardware.enableAllFirmware = true;
+
   # enable bluetooth
   hardware.bluetooth.enable = true;
-  
+
   # Add network-related packages
   environment.systemPackages = with pkgs; [
     wireguard-tools

modules/nixos/niri.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # just enable and install niri

modules/nixos/noctalia.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ pkgs, inputs, ... }:
 {
   # install noctalia and helper packages
   environment.systemPackages = with pkgs; [
@@ -7,6 +7,8 @@
     adwaita-qt
     adwaita-qt6
     brightnessctl
+    ddcutil
     playerctl
+    wl-mirror
   ];
 }

modules/nixos/openssh.nix

@@ -1,9 +1,17 @@
-{ config, lib, pkgs, ... }:
-
 {
   # enable the openssh daemon
   services.openssh = {
     enable = true;
     openFirewall = true;
+    ports = [ 666 ];
+
+    settings = {
+      AuthenticationMethods = "publickey";
+      KbdInteractiveAuthentication = false;
+      MaxAuthTries = 5;
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      X11Forwarding = false;
+    };
   };
 }

modules/nixos/packages.nix

@@ -1,53 +1,46 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
-  # system packges
+  # system packages
   environment.systemPackages = with pkgs; [
-    alacritty
     btop
+    cifs-utils
     cowsay
     dnsutils
     ethtool
     file
-    fwupd
-    fwupd-efi
-    ghostty
     git
     imagemagick
     imv
     iperf3
     jq
     kdePackages.qtmultimedia
-    kitty
     ldns
     lm_sensors
     lsof
-    ltrace
     mtr
     neovim
+    nfs-utils
     nh
     nix-output-monitor
     nmap
     nvd
     p7zip
     pciutils
-    sddm-astronaut
     socat
     sof-firmware
     strace
     sysstat
-    terminus_font
     tree
     unzip
     usbutils
+    vial
     vim
     wget
     which
+    wl-clipboard
     xz
     zip
     zstd
   ];
-
-  # browser
-  programs.firefox.enable = true;
 }

modules/nixos/protonvpn.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  # protonvpn uses wireguard tunnels, which break strict reverse path filtering
+  # because packets arrive on the tunnel interface but may be routed back differently.
+  # "loose" checks that the source is routable through *any* interface (not necessarily
+  # the same one), which is sufficient for wireguard while still preventing IP spoofing.
+  networking.firewall.checkReversePath = "loose";
+
+  environment.systemPackages = with pkgs; [
+    proton-vpn
+  ];
+}

modules/nixos/sddm.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # enable sddm and use astronaut theme
@@ -17,4 +17,9 @@
       sddm-astronaut
     ];
   };
+
+  # Make the theme available in the system path so sddm can find it
+  environment.systemPackages = with pkgs; [
+    sddm-astronaut
+  ];
 }

modules/nixos/services.nix

@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 {
   # list of enabled services on the system
   services = {

modules/nixos/settings.nix

@@ -1,17 +1,18 @@
-{ config, lib, pkgs, ... }:
-
 {
   nix = {
     # nix settings
     settings = {
       # enable flakes and nix-command
-      experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
       # auto-optimize my nix-store
       auto-optimise-store = true;
       # use all cores
-      max-jobs = "auto";  
+      max-jobs = "auto";
       # use all available cores per job
-      cores = 0;          
+      cores = 0;
       # add trusted substituters (binary caches)
       substituters = [
         "https://cache.nixos.org"
@@ -23,7 +24,7 @@
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
     };
-    
+
     # enable automatic garbage collection
     gc = {
       automatic = true;
@@ -32,13 +33,20 @@
     };
   };
 
+  # add trusted users (able to modify the nix store)
+  nix.settings.trusted-users = [
+    "root"
+    "@wheel"
+  ];
+
+  # allow unfree packages (steam, protonvpn, discord, etc.)
+  nixpkgs.config.allowUnfree = true;
+
   # links /libexec from derivations to /run/current-system/sw
   environment.pathsToLink = [ "/libexec" ];
-  # set the default editor to vim
-  environment.variables.EDITOR = "vim";
 
   # enable home-manager globally
   home-manager.useGlobalPkgs = true;
   home-manager.useUserPackages = true;
-  home-manager.backupFileExtension = "backup";
+  home-manager.backupCommand = "mv -f {file} {file}.hm-bak-$(date +%Y%m%d%H%M%S)";
 }

modules/nixos/steam.nix

@@ -1,9 +1,6 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
-  # allow unfree to install steam
-  nixpkgs.config.allowUnfree = true;
-
   # enable steam and open firewall
   programs.steam = {
     enable = true;

modules/nixos/thunar.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  # Enable Thunar
+  programs.thunar.enable = true;
+
+  # Install Tumbler thumbnailer service
+  environment.systemPackages = with pkgs; [
+    tumbler
+  ];
+
+  # Ensure Thunar can locate the thumbnailer extensions
+  environment.pathsToLink = [ "share/thumbnailers" ];
+}

modules/nixos/users.nix

@@ -1,11 +1,15 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # create users
   users.users.aaron = {
     isNormalUser = true;
     group = "users";
-    extraGroups = [ "wheel" "networkmanager" ];
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "dialout"
+    ];
     shell = pkgs.zsh;
   };
 
@@ -14,10 +18,5 @@
     enable = true;
     enableCompletion = true;
     autosuggestions.enable = true;
-    ohMyZsh = {
-      enable = true;
-      plugins = [ "git" "sudo" ];
-      theme = "gentoo";
-    };
   };
 }

modules/nixos/vial.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw
+  # HID interface that vial.rocks drives over WebHID. Its /dev/hidraw* node is
+  # root-only by default, so neither chromium nor the native app can open it.
+  #
+  # This has to ship as a numbered rules file rather than via
+  # services.udev.extraRules: extraRules lands in 99-local.rules, but the
+  # builtin that turns TAG+="uaccess" into an actual ACL is invoked from
+  # systemd's 73-seat-late.rules. A tag set at 99 is set too late to be seen,
+  # so the device ends up correctly tagged and still unreadable. 60- sorts
+  # safely ahead of 73.
+  services.udev.packages = [
+    (pkgs.writeTextFile {
+      name = "vial-udev-rules";
+      destination = "/lib/udev/rules.d/60-vial.rules";
+      # Vial firmware advertises itself through a magic USB serial, so this
+      # matches any vial board rather than just the lily58. uaccess hands the
+      # device to whoever owns the active seat, no group membership needed.
+      text = ''
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", TAG+="uaccess"
+      '';
+    })
+  ];
+}

statix.toml

@@ -0,0 +1,8 @@
+# statix configuration (run via `lint` in the devenv)
+
+# Flat assignments like `boot.loader = ...; boot.plymouth = ...;` are the
+# preferred style in this repo, so don't ask for them to be merged.
+disabled = [ "repeated_keys" ]
+
+# Generated by nixos-generate-config, not maintained by hand.
+ignore = [ "hosts/*/hardware-configuration.nix" ]

users/aaron/home.nix

@@ -1,11 +1,10 @@
-{ config, pkgs, ... }:
-
 {
   imports = [
     ../../modules/home-manager/fonts.nix
     ../../modules/home-manager/git.nix
     ../../modules/home-manager/ghostty.nix
     ../../modules/home-manager/nixvim.nix
+    ../../modules/home-manager/noctalia.nix
     ../../modules/home-manager/programs.nix
     ../../modules/home-manager/shell.nix
     ../../modules/home-manager/styling.nix