diff --git a/.sops.yaml b/.sops.yaml index a2fd479..cf54058 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,14 +1,10 @@ keys: - &jmug age1psyctjy329r9v07uqu72vkjl06f26f0epvh6zxejdkwp3m0tnyvq88rnr4 # This key is in cold storage. - &hosts: - - &nixlap age1cfcfye2unv89fgyuwpvy9sas40jd87kksw7rlgy4cwmcfjqntv2st2jcnp - - &asahi age1y2kfnx87z2j7te9hu0guderrf2x9m8d0f3gfjjxcdk2va77yj3hsngj2f5 - - &devbox age1208zkkd9hh8n6v9zn6w75x9ajxd798kc4cv53d6qhkx55juflumquyh3ge + - &nixbox age1nhlguc8xf7m4sdn087vqcnc9uj3n4zv09l9043u395acrd3lrscq9fzv66 creation_rules: - path_regex: secrets.yaml$ key_groups: - age: - *jmug - - *nixlap - - *asahi - - *devbox + - *nixbox diff --git a/flake.nix b/flake.nix index 8f52021..ef4e303 100644 --- a/flake.nix +++ b/flake.nix @@ -129,6 +129,27 @@ } ]; }; + nixbox = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { + inherit inputs ghostty; + }; + modules = [ + ./hosts/nixbox/configuration.nix + home-manager.nixosModules.home-manager + ({config, ...}: { + home-manager.extraSpecialArgs = { + inherit inputs; + inherit ssh-agent-switcher; + inherit (config) user; + }; + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.users.jmug = import ./hosts/nixbox/home.nix; + # home-manager.users.root = import ./hosts/devbox/home-root.nix; + }) + ]; + }; }; # Build darwin flake using: diff --git a/home-modules/hyprland/default.nix b/home-modules/hyprland/default.nix index 3114c7e..aa39f64 100644 --- a/home-modules/hyprland/default.nix +++ b/home-modules/hyprland/default.nix @@ -10,6 +10,7 @@ # Screenshots. home.packages = with pkgs; [ hyprshot + hyprlauncher ]; # Notifications daemon. services.swaync.enable = true; @@ -18,13 +19,13 @@ wayland.windowManager.hyprland.settings = { monitor = [ ",preferred,auto,auto" - "HDMI-A-1,preferred,auto,1.333333" + "HDMI-A-1,3840x2160@60.00Hz,auto,1.3333" "eDP-1,preferred,auto,1.6" ]; "$terminal" = "ghostty"; "$fileManager" = "dolphin"; # TODO: Change. - "$menu" = "GSK_RENDERER=ngl walker"; + "$menu" = "hyprlauncher"; env = [ "XCURSOR_SIZE,24" @@ -118,11 +119,11 @@ }; }; - gestures = { - workspace_swipe = true; - workspace_swipe_fingers = 3; - workspace_swipe_distance = 150; - }; + # gestures = { + # workspace_swipe = true; + # workspace_swipe_fingers = 3; + # workspace_swipe_distance = 150; + # }; "$mainMod" = "SUPER"; # Sets "Windows" key as main modifier @@ -177,7 +178,7 @@ "$mainMod, mouse_up, workspace, e-1" # App launcher - "$mainMod, space, exec, $menu" + "$mainMod, space, exec, pkil $menu || $menu" ]; bindm = [ diff --git a/hosts/common/core/default.nix b/hosts/common/core/default.nix index 4f1bd70..482cbf5 100644 --- a/hosts/common/core/default.nix +++ b/hosts/common/core/default.nix @@ -4,5 +4,6 @@ ./sops.nix ../../../modules/nixos + ../../../modules/common ]; } diff --git a/hosts/devbox/home.nix b/hosts/devbox/home.nix index 6915826..246d93e 100644 --- a/hosts/devbox/home.nix +++ b/hosts/devbox/home.nix @@ -1,4 +1,11 @@ -{ lib, inputs, config, pkgs, ssh-agent-switcher, ... } : +{ lib, + inputs, + config, + pkgs, + ssh-agent-switcher, + user, + ... +} : let pathToKeys = ../common/keys/yubi; yubiKeys = @@ -9,6 +16,8 @@ let (key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; }) yubiKeys ); + username = user.name; + homeDirectory = user.homeDirectory; in { imports = [ @@ -31,8 +40,8 @@ in { ghostty.window-decoration = false; home = { - username = "jmug"; - homeDirectory = "/home/jmug"; + username = username; + homeDirectory = homeDirectory; packages = with pkgs; [ # Media diff --git a/hosts/nixbox/configuration.nix b/hosts/nixbox/configuration.nix new file mode 100644 index 0000000..6d0db92 --- /dev/null +++ b/hosts/nixbox/configuration.nix @@ -0,0 +1,160 @@ +{ config, lib, pkgs, ghostty, ... }: +let + pubKeys = lib.filesystem.listFilesRecursive ../common/keys; +in +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + # Sops and other stuff. + ../common/core + ../common/optional/yubikey.nix + ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + nixpkgs.config.allowUnfree = true; + virtualisation.docker.enable = true; + + hardware.graphics = { + enable = true; + enable32Bit = true; + }; + + # Bluetooth. + hardware.bluetooth.enable = true; + hardware.bluetooth.powerOnBoot = true; + services.blueman.enable = true; + + # Use latest kernel. + boot.kernelPackages = pkgs.linuxPackages_latest; + + # networking.hostName = "nixos"; # Define your hostname. + networking.hostName = "nixbox"; + networking.wireless = { + enable = true; + secretsFile = config.sops.secrets."wireless.env".path; + networks = { + "UG_LivingRoom_5G" = { + pskRaw = "ext:home_psk"; + }; + }; + }; + # Configure network connections interactively with nmcli or nmtui. + + # Set your time zone. + time.timeZone = "America/Los_Angeles"; + i18n.defaultLocale = "en_US.UTF-8"; + i18n.extraLocaleSettings = { + LC_ADDRESS = "en_US.UTF-8"; + LC_IDENTIFICATION = "en_US.UTF-8"; + LC_MEASUREMENT = "en_US.UTF-8"; + LC_MONETARY = "en_US.UTF-8"; + LC_NAME = "en_US.UTF-8"; + LC_NUMERIC = "en_US.UTF-8"; + LC_PAPER = "en_US.UTF-8"; + LC_TELEPHONE = "en_US.UTF-8"; + LC_TIME = "en_US.UTF-8"; + }; + + programs.zsh.enable = true; + user.name = "jmug"; + users.users.jmug = { + isNormalUser = true; + description = "Mariano Uvalle"; + extraGroups = [ "wheel" "docker"]; # Enable ‘sudo’ for the user. + shell = pkgs.zsh; + packages = with pkgs; [ + tree + btop + git + ]; + openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key); + }; + users.users.root = { + shell = pkgs.zsh; + }; + programs.neovim = { + enable = true; + defaultEditor = true; + }; + + # List packages installed in system profile. + # You can use https://search.nixos.org/ to find more packages (and options). + environment.systemPackages = with pkgs; [ + # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + wget + curl + # Misc utils + ripgrep + fzf + unzip + nautilus + # Terminal + ghostty.packages.x86_64-linux.default + kitty + # Theming + palenight-theme + # Lock screen + hyprlock + # Idling + sway-audio-idle-inhibit + ]; + environment.pathsToLink = [ "/share/applications" "/share/xdg-desktop-portal" ]; + fonts = { + fontDir.enable = true; + packages = with pkgs; [ + nerd-fonts.bigblue-terminal + nerd-fonts.fira-code + nerd-fonts.caskaydia-cove + ]; + }; + + security.pam.services.hyprlock = {}; + programs.hyprland = { + enable = true; + xwayland.enable = true; + }; + environment.sessionVariables = { + # Enable wayland support for chromium/electron apps. + GDK_BACKEND = "wayland"; + NIXOS_OZONE_WL = "1"; + MOZ_ENABLE_WAYLAND = "1"; + QT_QPA_PLATFORM = "wayland"; + # This caused issues with walker, but might be some other + # issue with wayland/hyprland, so will leave it here for now. + # QT_WAYLAND_DISABLE_WINDOWDECORATION = "1"; + # WLR_NO_HARDWARE_CURSORS = "1"; + }; + + # This is not really enabling X11, bad naming. + services.xserver = { + enable = true; + displayManager.gdm = { + enable = true; + wayland = true; + }; + }; + + # USB devices. + services.devmon.enable = true; + services.gvfs.enable = true; + services.udisks2.enable = true; + + # Enable the OpenSSH daemon. + # Enable the OpenSSH daemon. + services.openssh = { + enable = true; + # ports = [ 69 ]; + settings = { + PasswordAuthentication = false; + PermitRootLogin = "no"; + }; + }; + + system.stateVersion = "25.11"; # Did you read the comment? +} + diff --git a/hosts/nixbox/hardware-configuration.nix b/hosts/nixbox/hardware-configuration.nix new file mode 100644 index 0000000..c978c98 --- /dev/null +++ b/hosts/nixbox/hardware-configuration.nix @@ -0,0 +1,33 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/f2e5ca11-456d-4b58-b610-07bc2d2a82c8"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/46D5-FFDE"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/7eaba32d-2d0f-4c8d-99ac-a6f16477e6cb"; } + ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/nixbox/home.nix b/hosts/nixbox/home.nix new file mode 100644 index 0000000..4fcdacb --- /dev/null +++ b/hosts/nixbox/home.nix @@ -0,0 +1,169 @@ +{ + lib, + inputs, + config, + pkgs, + ssh-agent-switcher, + user, + ... +} : +let + pathToKeys = ../common/keys/yubi; + yubiKeys = + lib.lists.forEach (builtins.attrNames (builtins.readDir pathToKeys)) + (key: lib.substring 0 (lib.stringLength key - lib.stringLength ".pub") key); # Remove .pub suffix. + yubikeyPublicKeyEntries = lib.attrsets.mergeAttrsList ( + lib.lists.map + (key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; }) + yubiKeys + ); + username = user.name; + homeDirectory = user.homeDirectory; +in { + + imports = [ + ../../home-modules/hyprland + + ../../home-modules + ../../home-modules/direnv.nix + ../../home-modules/ghostty-config.nix + ../../home-modules/git.nix + ../../home-modules/lazygit.nix + ../../home-modules/nvim.nix + ../../home-modules/sops.nix + # ../../home-modules/ssh-client.nix + ../../home-modules/starship.nix + ../../home-modules/tmux.nix + ../../home-modules/zsh.nix + ]; + + # Custom options for my packages. + nvim = { + enable = true; + }; + ghostty = { + font-size = "14"; + window-decoration = false; + }; + + home = { + username = username; + homeDirectory = homeDirectory; + + packages = with pkgs; [ + # Media + loupe + vlc + bluetui + # Audio + wireplumber + spotify-player + # Secret management. + age + sops + # Browsers + firefox + # Coms + discord + obs-studio + + # AWS tools + # awscli2 + # (callPackage ../../nixos-modules/shell-apps/aws-cli-mfa.nix {}) + + # Misc + # zig + fastfetch + fzf + ripgrep + git + wget + exercism + ]; + + file = {} // yubikeyPublicKeyEntries; + + pointerCursor = { + gtk.enable = true; + x11.enable = true; + hyprcursor.enable = true; + name = "Posy_Cursor_Black"; + package = pkgs."posy-cursors"; + }; + + stateVersion = "25.11"; + }; + + # home.activation.aws-cli-mfa-config = lib.hm.dag.entryAfter ["writeBoundary"] '' + # mkdir -p ~/.config/aws-cli-mfa + # cat > ~/.config/aws-cli-mfa/config.yaml << EOF +# mfa_serial: $(cat ${config.sops.secrets."aws/jmug_matcha_mfa_serial".path}) +# role_arn: $(cat ${config.sops.secrets."aws/role_arn".path}) +# session_duration: 43200 +# EOF + # ''; + + programs.zsh = { + shellAliases = { + # TODO BEGIN Interpolate the name of the host here. + # flakeconf = "sudo nvim /etc/nixos/flake.nix"; + # nosconf = "sudo nvim /etc/nixos/hosts/devbox/configuration.nix"; + # homeconf = "sudo nvim /etc/nixos/hosts/devbox/home.nix"; + # nvconf = "sudo nvim /etc/nixos/home-modules/explicit-configs/nvim/init.lua"; + # TODO END Interpolate the name of the host here. + rshellconf = "source ~/.zshrc"; + # TODO: Interpolate the name of the host here. + nrsw = "sudo nixos-rebuild switch --flake ${homeDirectory}/nixos#nixbox"; + fly = "flyctl"; + # awsmfa = "eval $(aws-cli-mfa)"; + # uawsmfa = "eval $(aws-cli-mfa --unset)"; + }; + loginExtra = '' + if [ ! -e "/tmp/ssh-agent.''${USER}" ]; then + if [ -n "''${ZSH_VERSION}" ]; then + eval ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null "&!" + else + ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null & + disown 2>/dev/null || true + fi + fi + export SSH_AUTH_SOCK="/tmp/ssh-agent.''${USER}" + ''; + }; + + services.ssh-agent.enable = true; + programs.ssh = { + enable = true; + addKeysToAgent = "confirm"; + matchBlocks = { + "git" = { + host = "github.com"; + user = "git"; + identityFile = [ + "/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys. + "/home/jmug/.ssh/id_jmug" # Fallback key with passphrase. + ]; + }; + "forgejo" = { + host = "code.jmug.me"; + user = "forgejo"; + identityFile = [ + "/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys. + "/home/jmug/.ssh/id_jmug" # Fallback key with passphrase. + ]; + }; + }; + # matchBlocks = { + # ws = { + # user = "aym"; + # hostname = "73.118.150.68"; + # port = 69; + # forwardAgent = true; + # identityFile = "/home/jmug/.ssh/id_ed25519"; + # }; + # }; + }; + + # Let Home Manager install and manage itself. + programs.home-manager.enable = true; +} diff --git a/secrets.yaml b/secrets.yaml index d7ef9e5..6411910 100644 --- a/secrets.yaml +++ b/secrets.yaml @@ -15,38 +15,20 @@ sops: - recipient: age1psyctjy329r9v07uqu72vkjl06f26f0epvh6zxejdkwp3m0tnyvq88rnr4 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXYjZnMW0vM2J1YXZHRS9Z - YXFwakZWV05qVHBremlHME9KamZmemlsZXh3CkxzaURINVF5UWtCWm5NQUVNdWRu - OXd0REt3S21HRWdVYzBTUG1nTFRBQmMKLS0tIDhJODZ0OFM4QzlPYlhGT2lScGhT - d05INzlEUFgzRzZrKzhCSUt5eHRSMWMKMeRv2XewX2VC+gEJrPqBBDTY9Z6uwBUV - x8hCgD2WQgIYiFGLZy+FsgOhOin4VRIB6u1aTAFQpne81TPCKBIVDQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MnB6MDFBVHkzalpHTUhR + bytETmZzOWphNk1MZDc4Z1RhLzFmUEdCa0JFCjJ3MmJUcjJ0WXU5bE5QbDRCdU9t + YnRHQ1Q1czhIcUFIaUNkenJuUkF1MEUKLS0tIFd4WjlXcFQ0ZWJZc3NNZHRZdUwv + ZVRFaVYzeHZvczdLUXphZUJsV1NGY0EK7IszzgPi07C2Ha+3D3DXrV1q71oh9aKV + dD0J5um7fRK2bIeGMMwIaE32nC880rTHQTvqpteGfiE8pyfWAlthRA== -----END AGE ENCRYPTED FILE----- - - recipient: age1cfcfye2unv89fgyuwpvy9sas40jd87kksw7rlgy4cwmcfjqntv2st2jcnp + - recipient: age1nhlguc8xf7m4sdn087vqcnc9uj3n4zv09l9043u395acrd3lrscq9fzv66 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Y2l4bmxvMUoydTUxeVJV - cG53MVBSZTVCdEJVc3lIUG80NUhRR3JHVHg0CktiZG1qQXhObEJlb1l1TXdMWG1K - MFJzTFhkRzBCbHUrVWQyYU9jZTI3bFEKLS0tIEMyTEhxUHVEQ3p2RU1uUFdEQjhm - OS9jTkVwdWFCRGh4eU9HZkg2bjFKcEUKF5ImHatfTNVrw9hWBTAfCYLSdWaX4eo2 - ykwh2iK58JT3gXr9WsnWlf7/6VqZV+28eaptL34larbhdVGCgJsKMQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1y2kfnx87z2j7te9hu0guderrf2x9m8d0f3gfjjxcdk2va77yj3hsngj2f5 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMHVuUjNyWDdyWlUvMWVq - ZWxPS0NCYXQwU0lWOGhyc2JmaFpEcWo2eFJrCkJlMHFYUFd3Rk13YTllSktjaWR0 - N0w2SzcvaW11SjBkL3B5eHAySUoyWDAKLS0tIFgzYmtCcjVkaTZiQXd0NmQ2ckVB - OU01OGJUZ0ZIemw3elB0a1NjUXlNODgKyBNUqDdZuwY4Li9C6Bjv38rr/k6kva0u - rdr3QPSihgLv4+xaSFlpnK5zpVuSbh02+igKXnB2Pm7876iVxsE9ng== - -----END AGE ENCRYPTED FILE----- - - recipient: age1208zkkd9hh8n6v9zn6w75x9ajxd798kc4cv53d6qhkx55juflumquyh3ge - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOE9uYUxYaWt6S3BXTFZM - NWRHNm5jVUpsblJaZUo4bjlBK2FHb21nWFJBCk4zRTIzV0laQTJMbUwrNm10eVlr - TTByUlVvRytOQ0x4RDUxbzhnN0VCeGMKLS0tIG8zcDdwc01VWmU5THk0RmRLWGhG - UjlDQ0Y5QnY4dmlVVFZrM0IyZzlISWcKwpQY9/f1O2v78/9/dCZ7HPE3wVwQ4COG - a0E+oMEgBIeQny9LyfhUW2V/HKhYhFNPJaZrNM4J1zL+bz2ucdErmw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZENXbklWOWRkK2QwRG5i + VlA1dkt4b2pST1JieFdid05VMWNwMEt3VkFBCmJUM00vRVZSZU5mOU1hWjYvR0Q3 + NWpMd1JjZ2hpdHMxWmVkNGtxYTRhRm8KLS0tIGpKak9acEovc3VNRWlqSEdkYlZO + bTd5UEllblFEdHhzaHQ0Nk5rdFRSSmMKmGaPtpT/zDSYEd1vsSA3lkMyPIiCOKlb + S/QDTRQVZWKwBnl6Mw7trQVdIxZm9pNp6PhgC+ZIUivMREY9QaFLiA== -----END AGE ENCRYPTED FILE----- lastmodified: "2025-07-15T01:46:53Z" mac: ENC[AES256_GCM,data:emLL9w/oBY8EfWYlFlYfxqJr5cJT0Rt7VQ6evUSrG5exh7AJMSr3mAxrjmQ/09ZThubevNWSKdbq3EPdgj4zQ9W17xhn+K0H810M/e0Lnaia6Th40rdS9NASdDUB3qKNf5TLlXY5D0phB5Q2nxSnXxNTkQpYCtYsM6QSbeoe1MY=,iv:wcN7z1hpBRiqWIGxMDGEMYaIPDRH7sk1XZoqjzyRsYI=,tag:pQYKivueVO4KcwyKVhyQ6A==,type:str]