[chore] Add config for new nix box.

This commit is contained in:
Mariano Uvalle
2026-01-17 23:10:04 -08:00
committed by jmug
parent 1fea0933d2
commit e87207d4d8
9 changed files with 418 additions and 46 deletions
+2 -6
View File
@@ -1,14 +1,10 @@
keys:
- &jmug age1psyctjy329r9v07uqu72vkjl06f26f0epvh6zxejdkwp3m0tnyvq88rnr4 # This key is in cold storage.
- &hosts:
- &nixlap age1cfcfye2unv89fgyuwpvy9sas40jd87kksw7rlgy4cwmcfjqntv2st2jcnp
- &asahi age1y2kfnx87z2j7te9hu0guderrf2x9m8d0f3gfjjxcdk2va77yj3hsngj2f5
- &devbox age1208zkkd9hh8n6v9zn6w75x9ajxd798kc4cv53d6qhkx55juflumquyh3ge
- &nixbox age1nhlguc8xf7m4sdn087vqcnc9uj3n4zv09l9043u395acrd3lrscq9fzv66
creation_rules:
- path_regex: secrets.yaml$
key_groups:
- age:
- *jmug
- *nixlap
- *asahi
- *devbox
- *nixbox
+21
View File
@@ -129,6 +129,27 @@
}
];
};
nixbox = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
inherit inputs ghostty;
};
modules = [
./hosts/nixbox/configuration.nix
home-manager.nixosModules.home-manager
({config, ...}: {
home-manager.extraSpecialArgs = {
inherit inputs;
inherit ssh-agent-switcher;
inherit (config) user;
};
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.jmug = import ./hosts/nixbox/home.nix;
# home-manager.users.root = import ./hosts/devbox/home-root.nix;
})
];
};
};
# Build darwin flake using:
+9 -8
View File
@@ -10,6 +10,7 @@
# Screenshots.
home.packages = with pkgs; [
hyprshot
hyprlauncher
];
# Notifications daemon.
services.swaync.enable = true;
@@ -18,13 +19,13 @@
wayland.windowManager.hyprland.settings = {
monitor = [
",preferred,auto,auto"
"HDMI-A-1,preferred,auto,1.333333"
"HDMI-A-1,3840x2160@60.00Hz,auto,1.3333"
"eDP-1,preferred,auto,1.6"
];
"$terminal" = "ghostty";
"$fileManager" = "dolphin"; # TODO: Change.
"$menu" = "GSK_RENDERER=ngl walker";
"$menu" = "hyprlauncher";
env = [
"XCURSOR_SIZE,24"
@@ -118,11 +119,11 @@
};
};
gestures = {
workspace_swipe = true;
workspace_swipe_fingers = 3;
workspace_swipe_distance = 150;
};
# gestures = {
# workspace_swipe = true;
# workspace_swipe_fingers = 3;
# workspace_swipe_distance = 150;
# };
"$mainMod" = "SUPER"; # Sets "Windows" key as main modifier
@@ -177,7 +178,7 @@
"$mainMod, mouse_up, workspace, e-1"
# App launcher
"$mainMod, space, exec, $menu"
"$mainMod, space, exec, pkil $menu || $menu"
];
bindm = [
+1
View File
@@ -4,5 +4,6 @@
./sops.nix
../../../modules/nixos
../../../modules/common
];
}
+12 -3
View File
@@ -1,4 +1,11 @@
{ lib, inputs, config, pkgs, ssh-agent-switcher, ... } :
{ lib,
inputs,
config,
pkgs,
ssh-agent-switcher,
user,
...
} :
let
pathToKeys = ../common/keys/yubi;
yubiKeys =
@@ -9,6 +16,8 @@ let
(key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; })
yubiKeys
);
username = user.name;
homeDirectory = user.homeDirectory;
in {
imports = [
@@ -31,8 +40,8 @@ in {
ghostty.window-decoration = false;
home = {
username = "jmug";
homeDirectory = "/home/jmug";
username = username;
homeDirectory = homeDirectory;
packages = with pkgs; [
# Media
+160
View File
@@ -0,0 +1,160 @@
{ config, lib, pkgs, ghostty, ... }:
let
pubKeys = lib.filesystem.listFilesRecursive ../common/keys;
in
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
# Sops and other stuff.
../common/core
../common/optional/yubikey.nix
];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nixpkgs.config.allowUnfree = true;
virtualisation.docker.enable = true;
hardware.graphics = {
enable = true;
enable32Bit = true;
};
# Bluetooth.
hardware.bluetooth.enable = true;
hardware.bluetooth.powerOnBoot = true;
services.blueman.enable = true;
# Use latest kernel.
boot.kernelPackages = pkgs.linuxPackages_latest;
# networking.hostName = "nixos"; # Define your hostname.
networking.hostName = "nixbox";
networking.wireless = {
enable = true;
secretsFile = config.sops.secrets."wireless.env".path;
networks = {
"UG_LivingRoom_5G" = {
pskRaw = "ext:home_psk";
};
};
};
# Configure network connections interactively with nmcli or nmtui.
# Set your time zone.
time.timeZone = "America/Los_Angeles";
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
programs.zsh.enable = true;
user.name = "jmug";
users.users.jmug = {
isNormalUser = true;
description = "Mariano Uvalle";
extraGroups = [ "wheel" "docker"]; # Enable sudo for the user.
shell = pkgs.zsh;
packages = with pkgs; [
tree
btop
git
];
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
};
users.users.root = {
shell = pkgs.zsh;
};
programs.neovim = {
enable = true;
defaultEditor = true;
};
# List packages installed in system profile.
# You can use https://search.nixos.org/ to find more packages (and options).
environment.systemPackages = with pkgs; [
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
wget
curl
# Misc utils
ripgrep
fzf
unzip
nautilus
# Terminal
ghostty.packages.x86_64-linux.default
kitty
# Theming
palenight-theme
# Lock screen
hyprlock
# Idling
sway-audio-idle-inhibit
];
environment.pathsToLink = [ "/share/applications" "/share/xdg-desktop-portal" ];
fonts = {
fontDir.enable = true;
packages = with pkgs; [
nerd-fonts.bigblue-terminal
nerd-fonts.fira-code
nerd-fonts.caskaydia-cove
];
};
security.pam.services.hyprlock = {};
programs.hyprland = {
enable = true;
xwayland.enable = true;
};
environment.sessionVariables = {
# Enable wayland support for chromium/electron apps.
GDK_BACKEND = "wayland";
NIXOS_OZONE_WL = "1";
MOZ_ENABLE_WAYLAND = "1";
QT_QPA_PLATFORM = "wayland";
# This caused issues with walker, but might be some other
# issue with wayland/hyprland, so will leave it here for now.
# QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
# WLR_NO_HARDWARE_CURSORS = "1";
};
# This is not really enabling X11, bad naming.
services.xserver = {
enable = true;
displayManager.gdm = {
enable = true;
wayland = true;
};
};
# USB devices.
services.devmon.enable = true;
services.gvfs.enable = true;
services.udisks2.enable = true;
# Enable the OpenSSH daemon.
# Enable the OpenSSH daemon.
services.openssh = {
enable = true;
# ports = [ 69 ];
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
};
};
system.stateVersion = "25.11"; # Did you read the comment?
}
+33
View File
@@ -0,0 +1,33 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/f2e5ca11-456d-4b58-b610-07bc2d2a82c8";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/46D5-FFDE";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices =
[ { device = "/dev/disk/by-uuid/7eaba32d-2d0f-4c8d-99ac-a6f16477e6cb"; }
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
+169
View File
@@ -0,0 +1,169 @@
{
lib,
inputs,
config,
pkgs,
ssh-agent-switcher,
user,
...
} :
let
pathToKeys = ../common/keys/yubi;
yubiKeys =
lib.lists.forEach (builtins.attrNames (builtins.readDir pathToKeys))
(key: lib.substring 0 (lib.stringLength key - lib.stringLength ".pub") key); # Remove .pub suffix.
yubikeyPublicKeyEntries = lib.attrsets.mergeAttrsList (
lib.lists.map
(key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; })
yubiKeys
);
username = user.name;
homeDirectory = user.homeDirectory;
in {
imports = [
../../home-modules/hyprland
../../home-modules
../../home-modules/direnv.nix
../../home-modules/ghostty-config.nix
../../home-modules/git.nix
../../home-modules/lazygit.nix
../../home-modules/nvim.nix
../../home-modules/sops.nix
# ../../home-modules/ssh-client.nix
../../home-modules/starship.nix
../../home-modules/tmux.nix
../../home-modules/zsh.nix
];
# Custom options for my packages.
nvim = {
enable = true;
};
ghostty = {
font-size = "14";
window-decoration = false;
};
home = {
username = username;
homeDirectory = homeDirectory;
packages = with pkgs; [
# Media
loupe
vlc
bluetui
# Audio
wireplumber
spotify-player
# Secret management.
age
sops
# Browsers
firefox
# Coms
discord
obs-studio
# AWS tools
# awscli2
# (callPackage ../../nixos-modules/shell-apps/aws-cli-mfa.nix {})
# Misc
# zig
fastfetch
fzf
ripgrep
git
wget
exercism
];
file = {} // yubikeyPublicKeyEntries;
pointerCursor = {
gtk.enable = true;
x11.enable = true;
hyprcursor.enable = true;
name = "Posy_Cursor_Black";
package = pkgs."posy-cursors";
};
stateVersion = "25.11";
};
# home.activation.aws-cli-mfa-config = lib.hm.dag.entryAfter ["writeBoundary"] ''
# mkdir -p ~/.config/aws-cli-mfa
# cat > ~/.config/aws-cli-mfa/config.yaml << EOF
# mfa_serial: $(cat ${config.sops.secrets."aws/jmug_matcha_mfa_serial".path})
# role_arn: $(cat ${config.sops.secrets."aws/role_arn".path})
# session_duration: 43200
# EOF
# '';
programs.zsh = {
shellAliases = {
# TODO BEGIN Interpolate the name of the host here.
# flakeconf = "sudo nvim /etc/nixos/flake.nix";
# nosconf = "sudo nvim /etc/nixos/hosts/devbox/configuration.nix";
# homeconf = "sudo nvim /etc/nixos/hosts/devbox/home.nix";
# nvconf = "sudo nvim /etc/nixos/home-modules/explicit-configs/nvim/init.lua";
# TODO END Interpolate the name of the host here.
rshellconf = "source ~/.zshrc";
# TODO: Interpolate the name of the host here.
nrsw = "sudo nixos-rebuild switch --flake ${homeDirectory}/nixos#nixbox";
fly = "flyctl";
# awsmfa = "eval $(aws-cli-mfa)";
# uawsmfa = "eval $(aws-cli-mfa --unset)";
};
loginExtra = ''
if [ ! -e "/tmp/ssh-agent.''${USER}" ]; then
if [ -n "''${ZSH_VERSION}" ]; then
eval ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null "&!"
else
${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null &
disown 2>/dev/null || true
fi
fi
export SSH_AUTH_SOCK="/tmp/ssh-agent.''${USER}"
'';
};
services.ssh-agent.enable = true;
programs.ssh = {
enable = true;
addKeysToAgent = "confirm";
matchBlocks = {
"git" = {
host = "github.com";
user = "git";
identityFile = [
"/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys.
"/home/jmug/.ssh/id_jmug" # Fallback key with passphrase.
];
};
"forgejo" = {
host = "code.jmug.me";
user = "forgejo";
identityFile = [
"/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys.
"/home/jmug/.ssh/id_jmug" # Fallback key with passphrase.
];
};
};
# matchBlocks = {
# ws = {
# user = "aym";
# hostname = "73.118.150.68";
# port = 69;
# forwardAgent = true;
# identityFile = "/home/jmug/.ssh/id_ed25519";
# };
# };
};
# Let Home Manager install and manage itself.
programs.home-manager.enable = true;
}
+11 -29
View File
@@ -15,38 +15,20 @@ sops:
- recipient: age1psyctjy329r9v07uqu72vkjl06f26f0epvh6zxejdkwp3m0tnyvq88rnr4
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXYjZnMW0vM2J1YXZHRS9Z
YXFwakZWV05qVHBremlHME9KamZmemlsZXh3CkxzaURINVF5UWtCWm5NQUVNdWRu
OXd0REt3S21HRWdVYzBTUG1nTFRBQmMKLS0tIDhJODZ0OFM4QzlPYlhGT2lScGhT
d05INzlEUFgzRzZrKzhCSUt5eHRSMWMKMeRv2XewX2VC+gEJrPqBBDTY9Z6uwBUV
x8hCgD2WQgIYiFGLZy+FsgOhOin4VRIB6u1aTAFQpne81TPCKBIVDQ==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MnB6MDFBVHkzalpHTUhR
bytETmZzOWphNk1MZDc4Z1RhLzFmUEdCa0JFCjJ3MmJUcjJ0WXU5bE5QbDRCdU9t
YnRHQ1Q1czhIcUFIaUNkenJuUkF1MEUKLS0tIFd4WjlXcFQ0ZWJZc3NNZHRZdUwv
ZVRFaVYzeHZvczdLUXphZUJsV1NGY0EK7IszzgPi07C2Ha+3D3DXrV1q71oh9aKV
dD0J5um7fRK2bIeGMMwIaE32nC880rTHQTvqpteGfiE8pyfWAlthRA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1cfcfye2unv89fgyuwpvy9sas40jd87kksw7rlgy4cwmcfjqntv2st2jcnp
- recipient: age1nhlguc8xf7m4sdn087vqcnc9uj3n4zv09l9043u395acrd3lrscq9fzv66
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Y2l4bmxvMUoydTUxeVJV
cG53MVBSZTVCdEJVc3lIUG80NUhRR3JHVHg0CktiZG1qQXhObEJlb1l1TXdMWG1K
MFJzTFhkRzBCbHUrVWQyYU9jZTI3bFEKLS0tIEMyTEhxUHVEQ3p2RU1uUFdEQjhm
OS9jTkVwdWFCRGh4eU9HZkg2bjFKcEUKF5ImHatfTNVrw9hWBTAfCYLSdWaX4eo2
ykwh2iK58JT3gXr9WsnWlf7/6VqZV+28eaptL34larbhdVGCgJsKMQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1y2kfnx87z2j7te9hu0guderrf2x9m8d0f3gfjjxcdk2va77yj3hsngj2f5
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMHVuUjNyWDdyWlUvMWVq
ZWxPS0NCYXQwU0lWOGhyc2JmaFpEcWo2eFJrCkJlMHFYUFd3Rk13YTllSktjaWR0
N0w2SzcvaW11SjBkL3B5eHAySUoyWDAKLS0tIFgzYmtCcjVkaTZiQXd0NmQ2ckVB
OU01OGJUZ0ZIemw3elB0a1NjUXlNODgKyBNUqDdZuwY4Li9C6Bjv38rr/k6kva0u
rdr3QPSihgLv4+xaSFlpnK5zpVuSbh02+igKXnB2Pm7876iVxsE9ng==
-----END AGE ENCRYPTED FILE-----
- recipient: age1208zkkd9hh8n6v9zn6w75x9ajxd798kc4cv53d6qhkx55juflumquyh3ge
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOE9uYUxYaWt6S3BXTFZM
NWRHNm5jVUpsblJaZUo4bjlBK2FHb21nWFJBCk4zRTIzV0laQTJMbUwrNm10eVlr
TTByUlVvRytOQ0x4RDUxbzhnN0VCeGMKLS0tIG8zcDdwc01VWmU5THk0RmRLWGhG
UjlDQ0Y5QnY4dmlVVFZrM0IyZzlISWcKwpQY9/f1O2v78/9/dCZ7HPE3wVwQ4COG
a0E+oMEgBIeQny9LyfhUW2V/HKhYhFNPJaZrNM4J1zL+bz2ucdErmw==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZENXbklWOWRkK2QwRG5i
VlA1dkt4b2pST1JieFdid05VMWNwMEt3VkFBCmJUM00vRVZSZU5mOU1hWjYvR0Q3
NWpMd1JjZ2hpdHMxWmVkNGtxYTRhRm8KLS0tIGpKak9acEovc3VNRWlqSEdkYlZO
bTd5UEllblFEdHhzaHQ0Nk5rdFRSSmMKmGaPtpT/zDSYEd1vsSA3lkMyPIiCOKlb
S/QDTRQVZWKwBnl6Mw7trQVdIxZm9pNp6PhgC+ZIUivMREY9QaFLiA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-07-15T01:46:53Z"
mac: ENC[AES256_GCM,data:emLL9w/oBY8EfWYlFlYfxqJr5cJT0Rt7VQ6evUSrG5exh7AJMSr3mAxrjmQ/09ZThubevNWSKdbq3EPdgj4zQ9W17xhn+K0H810M/e0Lnaia6Th40rdS9NASdDUB3qKNf5TLlXY5D0phB5Q2nxSnXxNTkQpYCtYsM6QSbeoe1MY=,iv:wcN7z1hpBRiqWIGxMDGEMYaIPDRH7sk1XZoqjzyRsYI=,tag:pQYKivueVO4KcwyKVhyQ6A==,type:str]