diff --git a/README.md b/README.md index 02e8484..cb1307c 100644 --- a/README.md +++ b/README.md @@ -6,20 +6,20 @@ My personal NixOS configurations. ```bash . -├── flake.lock -├── flake.nix # flake definition +├── flake.nix # hosts and home-manager wiring ├── hosts -│   └── neon -│   ├── configuration.nix # import nix-modules for specific host -│   └── hardware-configuration.nix # hardware configs for specific host +│ ├── argon # desktop +│ ├── neon # laptop +│ └── default # test vm +│ ├── configuration.nix # host-specific settings and module imports +│ ├── hardware-configuration.nix # generated by nixos-generate-config +│ └── niri.nix # host-specific niri settings (outputs, input) ├── modules -│   ├── home-manager -│   │   ├── xyz_module.nix -│   └── nixos -│   └── xyz_module.nix +│ ├── home-manager # user modules, imported by users/aaron/home.nix +│ └── nixos # system modules, imported by the hosts └── users └── aaron - └── home.nix # import home-manager modules for specific user + └── home.nix # imports home-manager modules ``` ## installation diff --git a/flake.nix b/flake.nix index 37cba33..cf7edb1 100644 --- a/flake.nix +++ b/flake.nix @@ -35,6 +35,9 @@ ./hosts/${hostName}/configuration.nix home-manager.nixosModules.home-manager { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.backupCommand = "mv -f {file} {file}.hm-bak-$(date +%Y%m%d%H%M%S)"; home-manager.extraSpecialArgs = { inherit inputs; }; home-manager.users.aaron.imports = [ nixvim.homeModules.nixvim diff --git a/hosts/argon/configuration.nix b/hosts/argon/configuration.nix index 5a44438..f12c342 100644 --- a/hosts/argon/configuration.nix +++ b/hosts/argon/configuration.nix @@ -1,15 +1,25 @@ +# argon: desktop with an amd gpu and three luks-encrypted data drives. +# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys. + +{ lib, pkgs, ... }: + +let + # luks name -> partition uuid, mounted at /mnt/ + drives = { + data1 = "dfae62cc-bad1-4879-bf9a-461bde833625"; + data2 = "8312edae-9247-481b-a313-52a7f848f027"; + nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8"; + }; + key = name: "/etc/nixos/keys/${name}.key"; +in { imports = [ ../../modules/nixos/appimage.nix ../../modules/nixos/astro.nix ../../modules/nixos/audio.nix ../../modules/nixos/bootloader.nix - ../../modules/nixos/calibre.nix ../../modules/nixos/certificates.nix - ../../modules/nixos/claudecode.nix - ../../modules/nixos/drives.nix ../../modules/nixos/gnupg.nix - ../../modules/nixos/graphics.nix ../../modules/nixos/greetd.nix ../../modules/nixos/locales.nix ../../modules/nixos/networking.nix @@ -29,9 +39,33 @@ # host-specific niri config (outputs, input devices) home-manager.users.aaron.imports = [ ./niri.nix ]; - # set hostname - networking.hostName = "argon"; + # amd gpu: mesa/vulkan, and amdgpu in the initrd for plymouth + hardware.graphics = { + enable = true; + enable32Bit = true; + }; + hardware.amdgpu.initrd.enable = true; - # install state version - system.stateVersion = "25.11"; # Don't change + # encrypted data drives + boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives; + boot.initrd.luks.devices = lib.mapAttrs (name: uuid: { + device = "/dev/disk/by-uuid/${uuid}"; + keyFile = key name; + }) drives; + fileSystems = lib.mapAttrs' ( + name: _: + lib.nameValuePair "/mnt/${name}" { + device = "/dev/mapper/${name}"; + fsType = "ext4"; + options = [ "nofail" ]; + } + ) drives; + + environment.systemPackages = with pkgs; [ + amdgpu_top + calibre # ebook management and kobo syncing + ]; + + networking.hostName = "argon"; + system.stateVersion = "25.11"; # don't change } diff --git a/hosts/argon/niri.nix b/hosts/argon/niri.nix index 03ba3ab..cb4484a 100644 --- a/hosts/argon/niri.nix +++ b/hosts/argon/niri.nix @@ -1,4 +1,5 @@ # argon: desktop with two 1440p monitors side by side + { wayland.windowManager.niri.settings = { input = { diff --git a/hosts/default/configuration.nix b/hosts/default/configuration.nix index 10ddc47..b0bf438 100644 --- a/hosts/default/configuration.nix +++ b/hosts/default/configuration.nix @@ -1,4 +1,4 @@ -# 0x29a nixos conifg +# 0x29a nixos config { pkgs, ... }: diff --git a/hosts/neon/configuration.nix b/hosts/neon/configuration.nix index 2b9a93a..8febcdb 100644 --- a/hosts/neon/configuration.nix +++ b/hosts/neon/configuration.nix @@ -5,7 +5,6 @@ ../../modules/nixos/audio.nix ../../modules/nixos/bootloader.nix ../../modules/nixos/certificates.nix - ../../modules/nixos/claudecode.nix ../../modules/nixos/docker.nix ../../modules/nixos/gnupg.nix ../../modules/nixos/locales.nix @@ -26,9 +25,6 @@ # host-specific niri config (input devices, laptop binds) home-manager.users.aaron.imports = [ ./niri.nix ]; - # set hostname networking.hostName = "neon"; - - # install state version - system.stateVersion = "25.11"; # Don't change + system.stateVersion = "25.11"; # don't change } diff --git a/hosts/neon/niri.nix b/hosts/neon/niri.nix index b6c52b0..8eb3e35 100644 --- a/hosts/neon/niri.nix +++ b/hosts/neon/niri.nix @@ -1,17 +1,7 @@ -# neon: laptop, built-in display is auto-configured by niri +# neon: laptop, the built-in display is auto-configured by niri + { lib, ... }: -let - brightness = step: { - _props.allow-when-locked = true; - spawn = [ - "brightnessctl" - "--class=backlight" - "set" - step - ]; - }; -in { wayland.windowManager.niri.settings = { input.touchpad = { @@ -26,9 +16,9 @@ in "Ctrl+Print".screenshot-screen = { }; "Mod+Shift+P".power-off-monitors = { }; - # finer brightness steps; mkForce, since spawn lists would otherwise be concatenated - "XF86MonBrightnessUp" = lib.mkForce (brightness "+1%"); - "XF86MonBrightnessDown" = lib.mkForce (brightness "1%-"); + # finer brightness steps + "XF86MonBrightnessUp".spawn-sh = lib.mkForce "brightnessctl --class=backlight set +1%"; + "XF86MonBrightnessDown".spawn-sh = lib.mkForce "brightnessctl --class=backlight set 1%-"; }; }; } diff --git a/modules/home-manager/git.nix b/modules/home-manager/git.nix index 8a3364b..4e00d5c 100644 --- a/modules/home-manager/git.nix +++ b/modules/home-manager/git.nix @@ -1,3 +1,7 @@ +# Commits are signed with each machine's ~/.ssh/id_ed25519 through the ssh +# agent. gitea verifies them against the account keys; allowed_signers gives +# the local git the same trust, so `git log --show-signature` resolves too. + { config, lib, @@ -7,18 +11,12 @@ let email = "aaron@0x29a.ch"; - - # public half of every machine's ~/.ssh/id_ed25519, each one verified as a - # signing key in gitea. the key a host signs with is picked up from the key - # file itself, this list only tells the local git which machines to trust signingKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon" ]; in { - # gitea verifies signatures against the account keys, this teaches the local - # git the same trust so `git log --show-signature` resolves as well xdg.configFile."git/allowed_signers".text = lib.concatMapStrings ( key: "${email} ${key}\n" ) signingKeys; @@ -26,9 +24,7 @@ in programs.git = { enable = true; settings = { - push = { - autoSetupRemote = true; - }; + push.autoSetupRemote = true; user = { name = "aaron"; inherit email; @@ -37,8 +33,7 @@ in }; signing = { format = "ssh"; - # point at the *public* key so ssh-keygen signs through the ssh agent - # instead of reading the passphrase protected private key from disk + # the public key makes ssh-keygen sign through the agent key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub"; signer = "${pkgs.openssh}/bin/ssh-keygen"; signByDefault = true; diff --git a/modules/home-manager/niri.nix b/modules/home-manager/niri.nix index 0d5a694..d51a8ab 100644 --- a/modules/home-manager/niri.nix +++ b/modules/home-manager/niri.nix @@ -1,7 +1,11 @@ +# Only renders ~/.config/niri/config.kdl; niri itself, its session and portals +# come from modules/nixos/niri.nix. Outputs and input devices that differ +# per machine live in hosts//niri.nix. + { lib, osConfig, ... }: let - # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there. + # Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there workspaceBinds = lib.mergeAttrsList ( map (n: { "Mod+${toString n}".focus-workspace = n; @@ -9,24 +13,18 @@ let }) (lib.range 1 9) ); - # Shorthand for binds that only run spawn-sh while allowed on the lock screen. + # shell command that also works on the lock screen lockedSh = cmd: { _props.allow-when-locked = true; spawn-sh = cmd; }; in { - # Niri config, rendered to ~/.config/niri/config.kdl by home-manager's built-in - # wayland.windowManager.niri module. The compositor itself, its session, systemd - # units and portals are provided by the NixOS module (modules/nixos/niri.nix), so - # this module only writes the config. Host-specific outputs and input devices - # live in hosts//niri.nix. - wayland.windowManager.niri = { - # only on hosts that run niri (see modules/nixos/niri.nix) + # only on hosts that run niri enable = osConfig.programs.niri.enable; - # Use the system's niri so the config is validated against the running version. + # validate the config against the installed niri package = osConfig.programs.niri.package; systemd.enable = false; portalPackage = null; @@ -125,21 +123,11 @@ in }; "Mod+D" = { _props.hotkey-overlay-title = "Run an Application"; - spawn = [ - "noctalia" - "msg" - "panel-toggle" - "launcher" - ]; + spawn-sh = "noctalia msg panel-toggle launcher"; }; "Super+Alt+L" = { _props.hotkey-overlay-title = "Lock the Screen"; - spawn = [ - "noctalia" - "msg" - "session" - "lock" - ]; + spawn-sh = "noctalia msg session lock"; }; # media keys (PipeWire / WirePlumber) @@ -151,24 +139,8 @@ in "XF86AudioStop" = lockedSh "playerctl stop"; "XF86AudioPrev" = lockedSh "playerctl previous"; "XF86AudioNext" = lockedSh "playerctl next"; - "XF86MonBrightnessUp" = { - _props.allow-when-locked = true; - spawn = [ - "brightnessctl" - "--class=backlight" - "set" - "+10%" - ]; - }; - "XF86MonBrightnessDown" = { - _props.allow-when-locked = true; - spawn = [ - "brightnessctl" - "--class=backlight" - "set" - "10%-" - ]; - }; + "XF86MonBrightnessUp" = lockedSh "brightnessctl --class=backlight set +10%"; + "XF86MonBrightnessDown" = lockedSh "brightnessctl --class=backlight set 10%-"; "Mod+O" = { _props.repeat = false; diff --git a/modules/home-manager/nixvim.nix b/modules/home-manager/nixvim.nix index e5fa692..a1e58ec 100644 --- a/modules/home-manager/nixvim.nix +++ b/modules/home-manager/nixvim.nix @@ -4,10 +4,7 @@ programs.nixvim = { enable = true; - # We keep `inputs.nixvim.inputs.nixpkgs.follows = "nixpkgs"` in flake.nix so - # the whole config shares a single nixpkgs. Setting `source` explicitly to - # that same nixpkgs acknowledges the override and silences nixvim's warning - # about its pinned nixpkgs being bypassed. + # same nixpkgs as the flake's `follows`, silences nixvim's pin warning nixpkgs.source = inputs.nixpkgs; # set aliases @@ -104,8 +101,6 @@ }; }; - # install dependencies - home.packages = with pkgs; [ - ripgrep - ]; + # telescope live_grep + home.packages = [ pkgs.ripgrep ]; } diff --git a/modules/home-manager/noctalia.nix b/modules/home-manager/noctalia.nix index f3d625b..1aee051 100644 --- a/modules/home-manager/noctalia.nix +++ b/modules/home-manager/noctalia.nix @@ -24,15 +24,18 @@ # general shell = { - font_family = "0xProto Nerd Font Mono"; - ui_scale = 1.2; + font_family = "0xProto Nerd Font"; avatar_path = "/home/aaron/syncthing/pictures/Logo-Aaron-Totenkopf-rund-schwarz.png"; telemetry_enabled = false; clipboard_enabled = true; password_style = "random"; + launcher = { + categories = false; + providers.emoji.global = false; + }; + panel = { - launcher_compact = true; open_near_click_control_center = true; open_near_click_session = true; open_near_click_wallpaper = true; @@ -97,7 +100,7 @@ bluetooth.capsule = true; control-center = { capsule_radius = 8; - custom_image = "/home/aaron/Pictures/nix_flake_logo.png"; + custom_image = "/home/aaron/syncthing/pictures/nix_flake_logo.png"; scale = 1.4; }; cpu.capsule = true; @@ -116,6 +119,7 @@ # idle behavior idle = { + pre_action_fade_seconds = 5; behavior_order = [ "screen-off" "lock" @@ -123,14 +127,17 @@ ]; behavior = { "screen-off" = { + action = "screen_off"; + enabled = true; + timeout = 300; + }; + "lock" = { + action = "lock"; enabled = true; timeout = 600; }; - "lock" = { - enabled = true; - timeout = 660; - }; "lock-and-suspend" = { + action = "lock_and_suspend"; enabled = true; timeout = 1800; }; diff --git a/modules/home-manager/shell.nix b/modules/home-manager/shell.nix index 1859f1b..3f73c84 100644 --- a/modules/home-manager/shell.nix +++ b/modules/home-manager/shell.nix @@ -1,25 +1,26 @@ +# zsh with oh-my-zsh: agnoster where glyphs render, gentoo on the console. +# Deep paths are shortened to `…/last/two` so the prompt stays on one line: +# `%(4~|…/%2~|%~)` shows the last two components from four levels down. + { lib, ... }: { - # configure z-shell to use omz with some plugins programs.zsh = { enable = true; autosuggestion.enable = true; syntaxHighlighting.enable = true; oh-my-zsh = { enable = true; - # add git and agents as plugins plugins = [ "git" "ssh-agent" "gpg-agent" ]; - # everything here lands before `source $ZSH/oh-my-zsh.sh` + # runs before oh-my-zsh is sourced extraConfig = '' - # make omz faster on large repositories + # faster git status on large repositories DISABLE_UNTRACKED_FILES_DIRTY=true - # only display a fancy theme when glyphs are rendered if [[ "$TERM" == "linux" || "$TERM" == "screen" ]]; then ZSH_THEME="gentoo" else @@ -28,37 +29,20 @@ ''; }; - # Unlike oh-my-zsh.extraConfig above, this lands *after* - # `source $ZSH/oh-my-zsh.sh`, which is where the theme's prompt functions - # come into existence. + # runs after oh-my-zsh, once the theme's prompt exists initContent = lib.mkAfter '' - # Keep the prompt on one line in deeply nested trees. - # - # Both themes render the working directory as `%~`, the full path with - # $HOME collapsed to `~`. Somewhere like - # ~/git/bfh/cas-pml-sem/documents/bericht that is 39 columns on its own, - # and together with user@host and a long branch name the line wraps. - # - # `%(4~|…/%2~|%~)` is a prompt ternary: at four or more components show - # an ellipsis and the last two, otherwise show the path whole. Short - # paths like ~/git/nixconfig are left alone. if [[ "$ZSH_THEME" == "agnoster" ]]; then - # agnoster calls prompt_dir on every render, so redefining it is - # enough. AGNOSTER_DIR_* keep the segment's own colours. + # agnoster renders prompt_dir on every prompt, so override it prompt_dir() { prompt_segment "$AGNOSTER_DIR_BG" "$AGNOSTER_DIR_FG" '%(4~|…/%2~|%~)' } else - # gentoo builds PROMPT once at load time, so patch the string. Its - # `%~` is the non-root branch of `%(!.%1~.%~)`, and it is the first - # literal `%~` in there, so the root branch is untouched. ASCII `...` - # because this branch is the Linux console, whose font may lack U+2026. + # gentoo builds PROMPT once; ascii dots, the console font lacks … PROMPT="''${PROMPT/\%~/%(4~|.../%2~|%~)}" fi ''; }; - # set important env vars home.sessionVariables = { EDITOR = "vim"; NH_FLAKE = "/home/aaron/git/nixconfig"; diff --git a/modules/home-manager/styling.nix b/modules/home-manager/styling.nix index 2a03ff5..c223d7c 100644 --- a/modules/home-manager/styling.nix +++ b/modules/home-manager/styling.nix @@ -1,7 +1,6 @@ { pkgs, ... }: { - # set gtk theme gtk = { enable = true; theme = { @@ -13,7 +12,6 @@ gtk4.extraConfig.gtk-application-prefer-dark-theme = 1; }; - # set qt theme qt = { enable = true; platformTheme.name = "qt6"; @@ -22,10 +20,4 @@ package = pkgs.adwaita-qt; }; }; - - # ensure packages are installed - home.packages = with pkgs; [ - gnome-themes-extra - adwaita-qt - ]; } diff --git a/modules/home-manager/tmux.nix b/modules/home-manager/tmux.nix index fd74183..3d4a33c 100644 --- a/modules/home-manager/tmux.nix +++ b/modules/home-manager/tmux.nix @@ -1,54 +1,37 @@ +# Nord-style status line built natively, no theme plugin. +# The powerline separators (U+E0B0..U+E0B3) are written as escapes via +# fromJSON: literal private-use glyphs get stripped silently on copy/paste. +# Commas inside #{?...} separate arguments, hence the escaped `#,` below. + let - # Powerline separators, U+E0B0..U+E0B3. - # - # Written as escapes rather than literal glyphs. These are Private Use Area - # codepoints: they render only with a patched font, they survive copy/paste - # badly, and when they get stripped the loss is invisible, the config still - # parses, the status bar just quietly loses its separators. Nix has no \u - # escape of its own, but fromJSON does. sep = builtins.fromJSON '' { - "right": "\ue0b0", - "rightThin": "\ue0b1", - "left": "\ue0b2", - "leftThin": "\ue0b3" + "right": "", + "rightThin": "", + "left": "", + "leftThin": "" } ''; in { programs.tmux = { - # defaults enable = true; prefix = "C-a"; keyMode = "vi"; mouse = true; - - # tmux-256color gives truecolor, italics and undercurl in nvim. - terminal = "tmux-256color"; - - # Default is 500ms. Causes lag you feel when leaving insert mode in nvim, - # because tmux is waiting to see whether Esc starts an escape sequence. - escapeTime = 10; - - # nvim autoread / :checktime react to focus. - focusEvents = true; - - # History limit. + terminal = "tmux-256color"; # truecolor, italics and undercurl in nvim + escapeTime = 10; # the 500ms default lags leaving insert mode in nvim + focusEvents = true; # nvim autoread historyLimit = 50000; - - # Window numbers matching the number row. - baseIndex = 1; + baseIndex = 1; # window numbers match the number row extraConfig = '' - # Status keys set -g status-keys vi - # Tell tmux the outer terminal can do 24-bit colour (tmux >= 3.2). + # outer terminal does 24-bit colour set -sa terminal-features ",*:RGB" - # Shift+Enter / extended keys - # These make tmux forward CSI-u sequences unconditionally. - # Needs tmux >= 3.5 for the format option, + # forward Shift+Enter and other extended keys as CSI-u (tmux >= 3.5) set -s extended-keys always set -s extended-keys-format csi-u set -as terminal-features '*:extkeys' @@ -88,27 +71,18 @@ in bind -r K resize-pane -U 5 bind -r L resize-pane -R 5 - # Wayland clipboard integration - # Copy selection to both clipboard (Ctrl+V / Shift+Insert) and primary (middle-click) + # copy to both the clipboard and primary selection bind -T copy-mode-vi v send-keys -X begin-selection bind -T copy-mode-vi C-v send-keys -X rectangle-toggle bind -T copy-mode-vi y send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary" bind -T copy-mode-vi Enter send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary" bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary" - # Uncomment if you want yanks to also travel over SSH via OSC52. - # Locally redundant with wl-copy above. - #set -g set-clipboard on # Kill commands bind q confirm-before -p "kill window #W? (y/n)" kill-window bind Q confirm-before -p "kill session #S? (y/n)" kill-session # Bars - # This is the nord-tmux status line. #{prefix_highlight} came from that - # theme's tmux-prefix-highlight integration -- a plugin you never loaded, - # so the token expanded to nothing. tmux can do it natively. Commas inside - # #{?...} are argument separators and have to be escaped as #, hence the - # look of the style spec. set -g status-left-length 24 set -g status-left "#[fg=black,bg=blue,bold] #{=20:session_name} #[fg=blue,bg=black,nobold,noitalics,nounderscore]${sep.right}" set -g status-right "#{?client_prefix,#[fg=black#,bg=yellow#,bold] ^A ,}#[fg=brightblack,bg=black,nobold,noitalics,nounderscore]${sep.left}#[fg=white,bg=brightblack] %Y-%m-%d #[fg=white,bg=brightblack,nobold,noitalics,nounderscore]${sep.leftThin}#[fg=white,bg=brightblack] %H:%M #[fg=cyan,bg=brightblack,nobold,noitalics,nounderscore]${sep.left}#[fg=black,bg=cyan,bold] #H " diff --git a/modules/nixos/appimage.nix b/modules/nixos/appimage.nix index d475331..8a57ec3 100644 --- a/modules/nixos/appimage.nix +++ b/modules/nixos/appimage.nix @@ -1,17 +1,10 @@ +# Running an AppImage directly fails on NixOS: its runtime dlopens +# libfuse.so.2, which nix-ld doesn't cover. appimage-run unpacks the image +# into an FHS sandbox instead. Used for the BitBox02 wallet from bitbox.swiss. + { - # AppImages ship a squashfs payload that the bundled runtime mounts through - # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that - # dlopen, so running one directly dies with "dlopen(): error loading - # libfuse.so.2". appimage-run sidesteps the mount entirely: it unpacks the - # image and runs the payload inside an FHS sandbox, which the bundled Qt and - # electron style binaries need anyway. - # - # Used for the BitBox02 wallet AppImage, downloaded fresh from - # https://bitbox.swiss/download/ rather than installed from nixpkgs. programs.appimage = { enable = true; - # register AppImages with binfmt_misc so ./Something.AppImage runs as-is, - # no appimage-run prefix to remember. - binfmt = true; + binfmt = true; # ./Something.AppImage runs without the appimage-run prefix }; } diff --git a/modules/nixos/astro.nix b/modules/nixos/astro.nix index 1c9d126..4840878 100644 --- a/modules/nixos/astro.nix +++ b/modules/nixos/astro.nix @@ -1,37 +1,23 @@ +# Stellarium for target finding, Siril for stacking. +# +# Siril's python plugins run in a venv of foreign manylinux wheels (numpy, +# PyQt6, ...), dlopened by nixpkgs python, so nix-ld doesn't help. The wrapper +# puts their libs on LD_LIBRARY_PATH, a python on PATH to bootstrap the venv, +# and adwaita-qt6 on QT_PLUGIN_PATH so the dark style override resolves. +# The python comes from /etc/siril/bin, a stable symlink: a /nix/store path +# would leave the venv dangling after the next python bump and gc. +# +# StarNet++ has no package: unzip the v2 ORT cli build from starnetastro.com +# to ~/.local/share/siril/starnet/ and point Siril's preferences at ./starnet2. +# It runs through nix-ld and finds its own libs in the bundled ./lib. + { lib, pkgs, ... }: let - # Siril's Python plugins (sirilpy) run in a venv that pip-installs foreign - # manylinux wheels (numpy, GraXpert deps, ...). Those .so files need - # libstdc++ at runtime. nix-ld does NOT cover this: it only handles the - # initial exec of a foreign binary, but here a *native* nixpkgs python - # dlopen()s the foreign wheel. So we put the libs on LD_LIBRARY_PATH, which - # the python subprocess inherits from the Siril process. sirilWithPlugins = pkgs.symlinkJoin { name = "siril-with-plugins"; paths = [ pkgs.siril ]; nativeBuildInputs = [ pkgs.makeWrapper ]; - # Siril bootstraps its sirilpy venv at first run by locating a `python3` - # on PATH. nixpkgs only *propagates* python3 from the siril derivation (it - # isn't on the runtime PATH), so without the --prefix PATH below the GUI - # fails with "Python not found in system PATH" and never creates - # ~/.local/share/siril/venv. - # - # We deliberately do NOT put ${pkgs.python3}/bin on PATH directly: `venv` - # symlinks bin/python3 to whatever sys.executable was, so the venv would - # hard-link a /nix/store hash that gets garbage-collected after the next - # python bump, leaving a dangling symlink ("Error finding venv python - # path, unable to spawn python"). Instead we go through the stable - # /etc/siril/bin/python3 symlink (see environment.etc below), which NixOS - # re-points at the current python on every rebuild. - # - # The VeraLux PyQt6 wheel ships only the built-in Windows/Fusion styles, so - # the global QT_STYLE_OVERRIDE=adwaita-dark (inherited from the session) is - # rejected ("invalid style override") and windows fall back to a light - # theme. We expose nixpkgs adwaita-qt6's style plugin on QT_PLUGIN_PATH so - # the override resolves. This works because nixpkgs qt6 and the bundled Qt - # share a major.minor (6.11); if they ever drift the plugin is simply - # ignored again (harmless warning + Fusion fallback, no loss of function). postBuild = '' wrapProgram $out/bin/siril \ --prefix PATH : /etc/siril/bin \ @@ -40,21 +26,19 @@ let lib.makeLibraryPath ( with pkgs; [ - stdenv.cc.cc.lib # libstdc++ / libgcc_s / libgomp (numpy etc.) + stdenv.cc.cc.lib # libstdc++, libgcc_s, libgomp (numpy) zlib - zstd # libzstd.so.1 (PyQt6) - libGL # libGL.so.1 (PyQt6) - # PyQt6 (VeraLux) — Qt bundles xcb support so it needs these even - # on Wayland; libxkbcommon is the keymap lib used by Wayland too. + zstd # PyQt6 + libGL # PyQt6 + # Qt needs these even on wayland glib fontconfig freetype dbus libxkbcommon - # Qt platform plugins: the wayland plugin (libqwayland.so) needs the - # wayland client libs; the xcb fallback needs libxcb-cursor.so.0. - wayland # libwayland-client/cursor/egl (wayland plugin) - libxcb-cursor # libxcb-cursor.so.0 (xcb plugin) + # Qt platform plugins: wayland, and the xcb fallback + wayland + libxcb-cursor libx11 libxcb libxcb-util @@ -69,27 +53,20 @@ let }; in { - # install stellarium for target finding and siril for stacking - environment.systemPackages = with pkgs; [ - stellarium + environment.systemPackages = [ + pkgs.stellarium sirilWithPlugins ]; - # Stable, GC-safe interpreter path for Siril's venv (see sirilWithPlugins). - # Same python as siril itself propagates, so sirilpy's ABI matches. + # same python siril propagates, so sirilpy's abi matches environment.etc."siril/bin/python3".source = "${pkgs.python3}/bin/python3"; - # StarNet++ has no nixpkgs package. Download the StarNet v2 ORT CLI build - # (starnet2_linux_*_ORT_x64_cli) from https://www.starnetastro.com/download/ - # and unzip it to ~/.local/share/siril/starnet/. Then in Siril set - # Preferences -> Miscellaneous -> StarNet executable - # to the extracted ./starnet2 binary. - # - # The binary is a generic dynamically-linked ELF, so NixOS needs nix-ld to - # run it. Its own opencv/onnxruntime libs are found via the bundled ./lib. - programs.nix-ld.enable = true; - programs.nix-ld.libraries = with pkgs; [ - stdenv.cc.cc.lib # libstdc++ / libgcc_s - zlib - ]; + # for StarNet++ + programs.nix-ld = { + enable = true; + libraries = with pkgs; [ + stdenv.cc.cc.lib + zlib + ]; + }; } diff --git a/modules/nixos/calibre.nix b/modules/nixos/calibre.nix deleted file mode 100644 index 5e42588..0000000 --- a/modules/nixos/calibre.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ pkgs, ... }: - -{ - # install calibre for ebook management and kobo syncing - environment.systemPackages = with pkgs; [ - calibre - ]; -} diff --git a/modules/nixos/claudecode.nix b/modules/nixos/claudecode.nix deleted file mode 100644 index c1b1097..0000000 --- a/modules/nixos/claudecode.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ pkgs, ... }: - -{ - environment.systemPackages = with pkgs; [ - claude-code - ]; -} diff --git a/modules/nixos/docker.nix b/modules/nixos/docker.nix index 1307a73..c06235c 100644 --- a/modules/nixos/docker.nix +++ b/modules/nixos/docker.nix @@ -1,12 +1,8 @@ -{ pkgs, ... }: - { - # add docker group to user - users.users.aaron.extraGroups = [ "docker" ]; - - virtualisation.docker = { + # rootless only: no root daemon and no root-equivalent docker group + virtualisation.docker.rootless = { enable = true; - # Customize Docker daemon settings + setSocketVariable = true; daemon.settings = { dns = [ "1.1.1.1" @@ -14,16 +10,6 @@ ]; log-driver = "journald"; registry-mirrors = [ "https://mirror.gcr.io" ]; - storage-driver = "overlay2"; }; - # Use the rootless mode - rootless = { - enable = true; - setSocketVariable = true; - }; - # Install docker-compose - extraPackages = with pkgs; [ - docker-compose - ]; }; } diff --git a/modules/nixos/drives.nix b/modules/nixos/drives.nix deleted file mode 100644 index d7a3dce..0000000 --- a/modules/nixos/drives.nix +++ /dev/null @@ -1,45 +0,0 @@ -# Add encrypted drives to argon - -{ - # copy keyfiles into initrd to make them available during early boot - boot.initrd.secrets = { - "/etc/nixos/keys/data1.key" = "/etc/nixos/keys/data1.key"; - "/etc/nixos/keys/data2.key" = "/etc/nixos/keys/data2.key"; - "/etc/nixos/keys/nvmecache.key" = "/etc/nixos/keys/nvmecache.key"; - }; - - # decrypt data drives with keyfiles for argon - boot.initrd.luks.devices = { - "data1" = { - device = "/dev/disk/by-uuid/dfae62cc-bad1-4879-bf9a-461bde833625"; - keyFile = "/etc/nixos/keys/data1.key"; - }; - "data2" = { - device = "/dev/disk/by-uuid/8312edae-9247-481b-a313-52a7f848f027"; - keyFile = "/etc/nixos/keys/data2.key"; - }; - "nvmecache" = { - device = "/dev/disk/by-uuid/2352250e-4ebe-4f9a-bf66-0d4aaa961bd8"; - keyFile = "/etc/nixos/keys/nvmecache.key"; - }; - }; - - # mount decrypted filesystems - fileSystems."/mnt/data1" = { - device = "/dev/mapper/data1"; - fsType = "ext4"; - options = [ "nofail" ]; - }; - - fileSystems."/mnt/data2" = { - device = "/dev/mapper/data2"; - fsType = "ext4"; - options = [ "nofail" ]; - }; - - fileSystems."/mnt/nvmecache" = { - device = "/dev/mapper/nvmecache"; - fsType = "ext4"; - options = [ "nofail" ]; - }; -} diff --git a/modules/nixos/gnupg.nix b/modules/nixos/gnupg.nix index ff8d3bc..adf4a97 100644 --- a/modules/nixos/gnupg.nix +++ b/modules/nixos/gnupg.nix @@ -1,29 +1,24 @@ +# A graphical pinentry never grabs the tty, so a passphrase prompt can't take +# over a terminal driven by a coding agent. The cache lasts a working day, and +# an unattended signature fails after two minutes instead of blocking forever. + { config, pkgs, ... }: { - # enable gnupg agent programs.gnupg.agent = { enable = true; - # a graphical pinentry never grabs the tty, so a passphrase prompt can no - # longer take over a terminal that a coding agent is driving pinentryPackage = pkgs.pinentry-qt; settings = { - # keep the key unlocked for a full working day instead of 10 minutes, - # so signing commits asks at most once per session default-cache-ttl = 86400; max-cache-ttl = 86400; - # fail an unattended signature instead of blocking on a prompt forever pinentry-timeout = 120; }; }; - environment.systemPackages = with pkgs; [ - gnupg - pinentry-qt - # fallback for sessions without a display, switch pinentryPackage to use it - pinentry-curses + environment.systemPackages = [ + pkgs.pinentry-curses # fallback for sessions without a display # prime the passphrase cache on demand, e.g. before an agent session - (writeShellScriptBin "gpg-unlock" '' + (pkgs.writeShellScriptBin "gpg-unlock" '' echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null echo "gpg key unlocked" '') diff --git a/modules/nixos/gnuradio.nix b/modules/nixos/gnuradio.nix deleted file mode 100644 index c7a3fc3..0000000 --- a/modules/nixos/gnuradio.nix +++ /dev/null @@ -1,12 +0,0 @@ -{ pkgs, ... }: - -{ - # install gnuradio companion along with it's osmocom library - environment.systemPackages = with pkgs; [ - (gnuradio.override { - extraPackages = with gnuradio.pkgs; [ osmosdr ]; - }) - gqrx - hackrf - ]; -} diff --git a/modules/nixos/graphics.nix b/modules/nixos/graphics.nix deleted file mode 100644 index ade9567..0000000 --- a/modules/nixos/graphics.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ pkgs, ... }: - -{ - # enable amd GPU acceleration (mesa, vulkan, egl) - hardware.graphics = { - enable = true; - enable32Bit = true; - }; - - # install amdgpu_top - environment.systemPackages = with pkgs; [ - amdgpu_top - ]; - - # add amdgpu to the initrd for plymouth - hardware.amdgpu.initrd.enable = true; -} diff --git a/modules/nixos/networking.nix b/modules/nixos/networking.nix index e30d243..99de910 100644 --- a/modules/nixos/networking.nix +++ b/modules/nixos/networking.nix @@ -1,20 +1,12 @@ { pkgs, ... }: { - # user networkmanager networking.networkmanager.enable = true; - # firewall default configs - networking.firewall.allowedTCPPorts = [ ]; - networking.firewall.allowedUDPPorts = [ ]; - - # enable wifi firmware + # wifi firmware and bluetooth hardware.enableAllFirmware = true; - - # enable bluetooth hardware.bluetooth.enable = true; - # Add network-related packages environment.systemPackages = with pkgs; [ wireguard-tools update-systemd-resolved diff --git a/modules/nixos/niri.nix b/modules/nixos/niri.nix index 41b6ceb..034aa24 100644 --- a/modules/nixos/niri.nix +++ b/modules/nixos/niri.nix @@ -1,11 +1,7 @@ { pkgs, ... }: { - # just enable and install niri + # compositor and session; the config itself lives in home-manager programs.niri.enable = true; - - # Add compositor-related packages - environment.systemPackages = with pkgs; [ - xwayland-satellite - ]; + environment.systemPackages = [ pkgs.xwayland-satellite ]; } diff --git a/modules/nixos/noctalia.nix b/modules/nixos/noctalia.nix index 1e66649..8dcacef 100644 --- a/modules/nixos/noctalia.nix +++ b/modules/nixos/noctalia.nix @@ -1,14 +1,14 @@ -{ pkgs, inputs, ... }: +{ pkgs, ... }: + { - # install noctalia and helper packages + # helpers for the noctalia shell (the shell itself comes from home-manager) environment.systemPackages = with pkgs; [ - inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default adw-gtk3 - adwaita-qt adwaita-qt6 brightnessctl ddcutil playerctl + wl-clipboard wl-mirror ]; } diff --git a/modules/nixos/packages.nix b/modules/nixos/packages.nix index 62b0cf7..05ce2f5 100644 --- a/modules/nixos/packages.nix +++ b/modules/nixos/packages.nix @@ -1,10 +1,11 @@ { pkgs, ... }: { - # system packages + # baseline tools for every host environment.systemPackages = with pkgs; [ btop cifs-utils + claude-code cowsay dnsutils ethtool @@ -14,31 +15,25 @@ imv iperf3 jq - kdePackages.qtmultimedia ldns lm_sensors lsof mtr - neovim nfs-utils nh nix-output-monitor nmap - nvd p7zip pciutils socat - sof-firmware strace sysstat tree unzip usbutils - vial vim wget which - wl-clipboard xz zip zstd diff --git a/modules/nixos/protonvpn.nix b/modules/nixos/protonvpn.nix index c8dc1fe..de3d419 100644 --- a/modules/nixos/protonvpn.nix +++ b/modules/nixos/protonvpn.nix @@ -1,13 +1,8 @@ { pkgs, ... }: { - # protonvpn uses wireguard tunnels, which break strict reverse path filtering - # because packets arrive on the tunnel interface but may be routed back differently. - # "loose" checks that the source is routable through *any* interface (not necessarily - # the same one), which is sufficient for wireguard while still preventing IP spoofing. + # wireguard replies may leave on another interface, so strict rpfilter drops them networking.firewall.checkReversePath = "loose"; - environment.systemPackages = with pkgs; [ - proton-vpn - ]; + environment.systemPackages = [ pkgs.proton-vpn ]; } diff --git a/modules/nixos/sddm.nix b/modules/nixos/sddm.nix index ff01042..e263efb 100644 --- a/modules/nixos/sddm.nix +++ b/modules/nixos/sddm.nix @@ -1,25 +1,15 @@ { pkgs, ... }: { - # enable sddm and use astronaut theme services.displayManager.sddm = { enable = true; wayland.enable = true; autoNumlock = true; enableHidpi = true; theme = "sddm-astronaut-theme"; - settings = { - Theme = { - Current = "sddm-astronaut-theme"; - }; - }; - extraPackages = with pkgs; [ - sddm-astronaut - ]; + extraPackages = [ pkgs.sddm-astronaut ]; # theme's qml dependencies }; - # Make the theme available in the system path so sddm can find it - environment.systemPackages = with pkgs; [ - sddm-astronaut - ]; + # sddm looks for themes in the system path + environment.systemPackages = [ pkgs.sddm-astronaut ]; } diff --git a/modules/nixos/settings.nix b/modules/nixos/settings.nix index b09a9a3..2f46fe7 100644 --- a/modules/nixos/settings.nix +++ b/modules/nixos/settings.nix @@ -1,31 +1,25 @@ { nix = { - # nix settings settings = { - # enable flakes and nix-command experimental-features = [ "nix-command" "flakes" ]; - # auto-optimize my nix-store auto-optimise-store = true; - # use all cores + # parallel builds, each using all cores max-jobs = "auto"; - # use all available cores per job cores = 0; - # add trusted substituters (binary caches) - substituters = [ - "https://cache.nixos.org" - "https://nix-community.cachix.org" - ]; - # add keys - trusted-public-keys = [ - "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" + # cache.nixos.org is the default, these come on top + extra-substituters = [ "https://nix-community.cachix.org" ]; + extra-trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; + trusted-users = [ + "root" + "@wheel" + ]; }; - # enable automatic garbage collection gc = { automatic = true; dates = "weekly"; @@ -33,20 +27,9 @@ }; }; - # add trusted users (able to modify the nix store) - nix.settings.trusted-users = [ - "root" - "@wheel" - ]; - - # allow unfree packages (steam, protonvpn, discord, etc.) + # steam, protonvpn, discord, etc. nixpkgs.config.allowUnfree = true; # links /libexec from derivations to /run/current-system/sw environment.pathsToLink = [ "/libexec" ]; - - # enable home-manager globally - home-manager.useGlobalPkgs = true; - home-manager.useUserPackages = true; - home-manager.backupCommand = "mv -f {file} {file}.hm-bak-$(date +%Y%m%d%H%M%S)"; } diff --git a/modules/nixos/steam.nix b/modules/nixos/steam.nix index 88671e2..593729e 100644 --- a/modules/nixos/steam.nix +++ b/modules/nixos/steam.nix @@ -1,20 +1,13 @@ { pkgs, ... }: { - # enable steam and open firewall programs.steam = { enable = true; + # fix black screen when running under xwayland-satellite + package = pkgs.steam.override { extraArgs = "-system-composer"; }; remotePlay.openFirewall = true; dedicatedServer.openFirewall = true; localNetworkGameTransfers.openFirewall = true; - # add proton-glorious-eggroll - extraCompatPackages = with pkgs; [ - proton-ge-bin - ]; - }; - - # fix black screen in steam when using xwayland-satellite - programs.steam.package = pkgs.steam.override { - extraArgs = "-system-composer"; + extraCompatPackages = [ pkgs.proton-ge-bin ]; }; } diff --git a/modules/nixos/thunar.nix b/modules/nixos/thunar.nix index f52061a..cb6a910 100644 --- a/modules/nixos/thunar.nix +++ b/modules/nixos/thunar.nix @@ -1,14 +1,9 @@ { pkgs, ... }: { - # Enable Thunar programs.thunar.enable = true; - # Install Tumbler thumbnailer service - environment.systemPackages = with pkgs; [ - tumbler - ]; - - # Ensure Thunar can locate the thumbnailer extensions + # thumbnails: tumbler service plus the path it loads extensions from + environment.systemPackages = [ pkgs.tumbler ]; environment.pathsToLink = [ "share/thumbnailers" ]; } diff --git a/modules/nixos/users.nix b/modules/nixos/users.nix index bd952dd..203b71f 100644 --- a/modules/nixos/users.nix +++ b/modules/nixos/users.nix @@ -1,10 +1,8 @@ { pkgs, ... }: { - # create users users.users.aaron = { isNormalUser = true; - group = "users"; extraGroups = [ "wheel" "networkmanager" @@ -13,10 +11,6 @@ shell = pkgs.zsh; }; - # add default zsh config - programs.zsh = { - enable = true; - enableCompletion = true; - autosuggestions.enable = true; - }; + # login shell; plugins and prompt are configured in home-manager + programs.zsh.enable = true; } diff --git a/modules/nixos/vial.nix b/modules/nixos/vial.nix index 5ffef76..5175017 100644 --- a/modules/nixos/vial.nix +++ b/modules/nixos/vial.nix @@ -1,26 +1,21 @@ +# Vial keyboards (lily58 pro r2g) expose a raw HID interface that vial.rocks +# drives over WebHID; its /dev/hidraw* node is root-only by default. +# The rule ships as 60-vial.rules because uaccess is only applied by +# 73-seat-late.rules, and services.udev.extraRules lands at 99, too late. + { pkgs, ... }: { - # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw - # HID interface that vial.rocks drives over WebHID. Its /dev/hidraw* node is - # root-only by default, so neither chromium nor the native app can open it. - # - # This has to ship as a numbered rules file rather than via - # services.udev.extraRules: extraRules lands in 99-local.rules, but the - # builtin that turns TAG+="uaccess" into an actual ACL is invoked from - # systemd's 73-seat-late.rules. A tag set at 99 is set too late to be seen, - # so the device ends up correctly tagged and still unreadable. 60- sorts - # safely ahead of 73. services.udev.packages = [ (pkgs.writeTextFile { name = "vial-udev-rules"; destination = "/lib/udev/rules.d/60-vial.rules"; - # Vial firmware advertises itself through a magic USB serial, so this - # matches any vial board rather than just the lily58. uaccess hands the - # device to whoever owns the active seat, no group membership needed. + # the magic serial matches any vial board; uaccess grants the seat owner text = '' KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", TAG+="uaccess" ''; }) ]; + + environment.systemPackages = [ pkgs.vial ]; }