[chore] Add config for new nix box.

.sops.yaml

@@ -1,14 +1,10 @@
 keys:
   - &jmug age1psyctjy329r9v07uqu72vkjl06f26f0epvh6zxejdkwp3m0tnyvq88rnr4 # This key is in cold storage.
   - &hosts:
-    - &nixlap age1cfcfye2unv89fgyuwpvy9sas40jd87kksw7rlgy4cwmcfjqntv2st2jcnp
+    - &nixbox age1nhlguc8xf7m4sdn087vqcnc9uj3n4zv09l9043u395acrd3lrscq9fzv66
-    - &asahi age1y2kfnx87z2j7te9hu0guderrf2x9m8d0f3gfjjxcdk2va77yj3hsngj2f5
-    - &devbox age1208zkkd9hh8n6v9zn6w75x9ajxd798kc4cv53d6qhkx55juflumquyh3ge
 creation_rules:
   - path_regex: secrets.yaml$
     key_groups:
     - age:
       - *jmug
-      - *nixlap
+      - *nixbox
-      - *asahi
-      - *devbox

flake.nix

@@ -129,6 +129,27 @@
           }
         ];
       };
+      nixbox = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = {
+          inherit inputs ghostty;
+        };
+        modules = [
+          ./hosts/nixbox/configuration.nix
+          home-manager.nixosModules.home-manager
+          ({config, ...}: {
+            home-manager.extraSpecialArgs = {
+              inherit inputs;
+              inherit ssh-agent-switcher;
+              inherit (config) user;
+            };
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.jmug = import ./hosts/nixbox/home.nix;
+            # home-manager.users.root = import ./hosts/devbox/home-root.nix;
+          })
+        ];
+      };
     };
 
     # Build darwin flake using:

home-modules/hyprland/default.nix

@@ -10,6 +10,7 @@
   # Screenshots.
   home.packages = with pkgs; [
     hyprshot
+    hyprlauncher
   ];
   # Notifications daemon.
   services.swaync.enable = true;
@@ -18,13 +19,13 @@
   wayland.windowManager.hyprland.settings = {
     monitor = [
       ",preferred,auto,auto"
-      "HDMI-A-1,preferred,auto,1.333333"
+      "HDMI-A-1,3840x2160@60.00Hz,auto,1.3333"
       "eDP-1,preferred,auto,1.6"
     ];
 
     "$terminal" = "ghostty";
     "$fileManager" = "dolphin"; # TODO: Change.
-    "$menu" = "GSK_RENDERER=ngl walker";
+    "$menu" = "hyprlauncher";
 
     env = [
       "XCURSOR_SIZE,24"
@@ -118,11 +119,11 @@
       };
     };
 
-    gestures = {
+    # gestures = {
-      workspace_swipe = true;
+    #   workspace_swipe = true;
-      workspace_swipe_fingers = 3;
+    #   workspace_swipe_fingers = 3;
-      workspace_swipe_distance = 150;
+    #   workspace_swipe_distance = 150;
-    };
+    # };
 
     "$mainMod" = "SUPER"; # Sets "Windows" key as main modifier
 
@@ -177,7 +178,7 @@
       "$mainMod, mouse_up, workspace, e-1"
 
       # App launcher
-      "$mainMod, space, exec, $menu"
+      "$mainMod, space, exec, pkil $menu || $menu"
     ];
 
     bindm = [

hosts/common/core/default.nix

@@ -4,5 +4,6 @@
     ./sops.nix
 
     ../../../modules/nixos
+    ../../../modules/common
   ];
 }

hosts/devbox/home.nix

@@ -1,4 +1,11 @@
-{ lib, inputs, config, pkgs, ssh-agent-switcher, ... } :
+{ lib,
+  inputs,
+  config,
+  pkgs,
+  ssh-agent-switcher,
+  user,
+  ...
+} :
 let
   pathToKeys = ../common/keys/yubi;
   yubiKeys =
@@ -9,6 +16,8 @@ let
       (key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; })
       yubiKeys
   );
+  username = user.name;
+  homeDirectory = user.homeDirectory;
 in {
 
   imports = [
@@ -31,8 +40,8 @@ in {
   ghostty.window-decoration = false;
 
   home = {
-    username = "jmug";
+    username = username;
-    homeDirectory = "/home/jmug";
+    homeDirectory = homeDirectory;
 
     packages = with pkgs; [
       # Media

hosts/nixbox/configuration.nix

@@ -0,0 +1,160 @@
+{ config, lib, pkgs, ghostty, ... }:
+let
+  pubKeys = lib.filesystem.listFilesRecursive ../common/keys;
+in
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      # Sops and other stuff.
+      ../common/core
+      ../common/optional/yubikey.nix
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nixpkgs.config.allowUnfree = true;  
+  virtualisation.docker.enable = true;
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  # Bluetooth.
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+  services.blueman.enable = true;
+
+  # Use latest kernel.
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # networking.hostName = "nixos"; # Define your hostname.
+  networking.hostName = "nixbox";
+  networking.wireless = {
+    enable = true;
+    secretsFile = config.sops.secrets."wireless.env".path;
+    networks = {
+      "UG_LivingRoom_5G" = {
+        pskRaw = "ext:home_psk";
+      };
+    };
+  };
+  # Configure network connections interactively with nmcli or nmtui.
+
+  # Set your time zone.
+  time.timeZone = "America/Los_Angeles";
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  programs.zsh.enable = true;
+  user.name = "jmug";
+  users.users.jmug = {
+    isNormalUser = true;
+    description = "Mariano Uvalle";
+    extraGroups = [ "wheel" "docker"]; # Enable ‘sudo’ for the user.
+    shell = pkgs.zsh;
+    packages = with pkgs; [
+      tree
+      btop
+      git
+    ];
+    openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+  };
+  users.users.root = {
+    shell = pkgs.zsh;
+  };
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+  };
+
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
+  environment.systemPackages = with pkgs; [
+    # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    curl
+    # Misc utils
+    ripgrep
+    fzf
+    unzip
+    nautilus
+    # Terminal
+    ghostty.packages.x86_64-linux.default
+    kitty
+    # Theming
+    palenight-theme
+    # Lock screen
+    hyprlock
+    # Idling
+    sway-audio-idle-inhibit
+  ];
+  environment.pathsToLink = [ "/share/applications" "/share/xdg-desktop-portal" ];
+  fonts = {
+    fontDir.enable = true;
+    packages = with pkgs; [
+      nerd-fonts.bigblue-terminal
+      nerd-fonts.fira-code
+      nerd-fonts.caskaydia-cove
+    ];
+  };
+
+  security.pam.services.hyprlock = {};
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+  environment.sessionVariables = {
+    # Enable wayland support for chromium/electron apps.
+    GDK_BACKEND = "wayland";
+    NIXOS_OZONE_WL = "1";
+    MOZ_ENABLE_WAYLAND = "1";
+    QT_QPA_PLATFORM = "wayland";
+    # This caused issues with walker, but might be some other
+    # issue with wayland/hyprland, so will leave it here for now.
+    # QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
+    # WLR_NO_HARDWARE_CURSORS = "1";
+  };
+
+  # This is not really enabling X11, bad naming.
+  services.xserver = {
+    enable = true;
+    displayManager.gdm = {
+      enable = true;
+      wayland = true;
+    };
+  };
+
+  # USB devices.
+  services.devmon.enable = true;
+  services.gvfs.enable = true;
+  services.udisks2.enable = true;
+
+  # Enable the OpenSSH daemon.
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    # ports = [ 69 ];
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  system.stateVersion = "25.11"; # Did you read the comment?
+}
+

hosts/nixbox/hardware-configuration.nix

@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f2e5ca11-456d-4b58-b610-07bc2d2a82c8";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/46D5-FFDE";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/7eaba32d-2d0f-4c8d-99ac-a6f16477e6cb"; }
+    ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/nixbox/home.nix

@@ -0,0 +1,169 @@
+{
+  lib,
+  inputs,
+  config,
+  pkgs,
+  ssh-agent-switcher,
+  user,
+  ...
+} :
+let
+  pathToKeys = ../common/keys/yubi;
+  yubiKeys =
+    lib.lists.forEach (builtins.attrNames (builtins.readDir pathToKeys))
+    (key: lib.substring 0 (lib.stringLength key - lib.stringLength ".pub") key); # Remove .pub suffix.
+  yubikeyPublicKeyEntries = lib.attrsets.mergeAttrsList (
+    lib.lists.map
+      (key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; })
+      yubiKeys
+  );
+  username = user.name;
+  homeDirectory = user.homeDirectory;
+in {
+
+  imports = [
+    ../../home-modules/hyprland
+
+    ../../home-modules
+    ../../home-modules/direnv.nix
+    ../../home-modules/ghostty-config.nix
+    ../../home-modules/git.nix
+    ../../home-modules/lazygit.nix
+    ../../home-modules/nvim.nix
+    ../../home-modules/sops.nix
+    # ../../home-modules/ssh-client.nix
+    ../../home-modules/starship.nix
+    ../../home-modules/tmux.nix
+    ../../home-modules/zsh.nix
+  ];
+
+  # Custom options for my packages.
+  nvim = {
+    enable = true;
+  };
+  ghostty = {
+    font-size = "14";
+    window-decoration = false;
+  };
+
+  home = {
+    username = username;
+    homeDirectory = homeDirectory;
+
+    packages = with pkgs; [
+      # Media
+      loupe
+      vlc
+      bluetui
+      # Audio
+      wireplumber
+      spotify-player
+      # Secret management.
+      age
+      sops
+      # Browsers
+      firefox
+      # Coms
+      discord
+      obs-studio
+
+      # AWS tools
+      # awscli2
+      # (callPackage ../../nixos-modules/shell-apps/aws-cli-mfa.nix {})
+
+      # Misc
+      # zig
+      fastfetch
+      fzf
+      ripgrep
+      git
+      wget
+      exercism
+    ];
+
+    file = {} // yubikeyPublicKeyEntries;
+
+    pointerCursor = {
+      gtk.enable = true;
+      x11.enable = true;
+      hyprcursor.enable = true;
+      name = "Posy_Cursor_Black";
+      package = pkgs."posy-cursors";
+    };
+
+    stateVersion = "25.11";
+  };
+
+  # home.activation.aws-cli-mfa-config = lib.hm.dag.entryAfter ["writeBoundary"] ''
+  #   mkdir -p ~/.config/aws-cli-mfa
+  #   cat > ~/.config/aws-cli-mfa/config.yaml << EOF
+# mfa_serial: $(cat ${config.sops.secrets."aws/jmug_matcha_mfa_serial".path})
+# role_arn: $(cat ${config.sops.secrets."aws/role_arn".path})
+# session_duration: 43200
+# EOF
+  # '';
+
+  programs.zsh = {
+    shellAliases = {
+      # TODO BEGIN Interpolate the name of the host here.
+      # flakeconf = "sudo nvim /etc/nixos/flake.nix";
+      # nosconf = "sudo nvim /etc/nixos/hosts/devbox/configuration.nix";
+      # homeconf = "sudo nvim /etc/nixos/hosts/devbox/home.nix";
+      # nvconf = "sudo nvim /etc/nixos/home-modules/explicit-configs/nvim/init.lua";
+      # TODO END Interpolate the name of the host here.
+      rshellconf = "source ~/.zshrc";
+      # TODO: Interpolate the name of the host here.
+      nrsw = "sudo nixos-rebuild switch --flake ${homeDirectory}/nixos#nixbox";
+      fly = "flyctl";
+      # awsmfa = "eval $(aws-cli-mfa)";
+      # uawsmfa = "eval $(aws-cli-mfa --unset)";
+    };
+    loginExtra = ''
+    if [ ! -e "/tmp/ssh-agent.''${USER}" ]; then
+      if [ -n "''${ZSH_VERSION}" ]; then
+          eval ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null "&!"
+      else
+          ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null &
+          disown 2>/dev/null || true
+      fi
+    fi
+    export SSH_AUTH_SOCK="/tmp/ssh-agent.''${USER}"
+    '';
+  };
+  
+  services.ssh-agent.enable = true;
+  programs.ssh = {
+    enable = true;
+    addKeysToAgent = "confirm";
+    matchBlocks = {
+      "git" = {
+        host = "github.com";
+        user = "git";
+        identityFile = [
+          "/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys.
+          "/home/jmug/.ssh/id_jmug" # Fallback key with passphrase.
+        ];
+      };
+      "forgejo" = {
+        host = "code.jmug.me";
+        user = "forgejo";
+        identityFile = [
+          "/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys.
+          "/home/jmug/.ssh/id_jmug" # Fallback key with passphrase.
+        ];
+      };
+    };
+    # matchBlocks = {
+    #   ws = {
+    #     user = "aym";
+    #     hostname = "73.118.150.68";
+    #     port = 69;
+    #     forwardAgent = true;
+    #     identityFile = "/home/jmug/.ssh/id_ed25519";
+    #   };
+    # };
+  };
+
+  # Let Home Manager install and manage itself.
+  programs.home-manager.enable = true;
+}

secrets.yaml

@@ -15,38 +15,20 @@ sops:
         - recipient: age1psyctjy329r9v07uqu72vkjl06f26f0epvh6zxejdkwp3m0tnyvq88rnr4
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXYjZnMW0vM2J1YXZHRS9Z
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MnB6MDFBVHkzalpHTUhR
-            YXFwakZWV05qVHBremlHME9KamZmemlsZXh3CkxzaURINVF5UWtCWm5NQUVNdWRu
+            bytETmZzOWphNk1MZDc4Z1RhLzFmUEdCa0JFCjJ3MmJUcjJ0WXU5bE5QbDRCdU9t
-            OXd0REt3S21HRWdVYzBTUG1nTFRBQmMKLS0tIDhJODZ0OFM4QzlPYlhGT2lScGhT
+            YnRHQ1Q1czhIcUFIaUNkenJuUkF1MEUKLS0tIFd4WjlXcFQ0ZWJZc3NNZHRZdUwv
-            d05INzlEUFgzRzZrKzhCSUt5eHRSMWMKMeRv2XewX2VC+gEJrPqBBDTY9Z6uwBUV
+            ZVRFaVYzeHZvczdLUXphZUJsV1NGY0EK7IszzgPi07C2Ha+3D3DXrV1q71oh9aKV
-            x8hCgD2WQgIYiFGLZy+FsgOhOin4VRIB6u1aTAFQpne81TPCKBIVDQ==
+            dD0J5um7fRK2bIeGMMwIaE32nC880rTHQTvqpteGfiE8pyfWAlthRA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1cfcfye2unv89fgyuwpvy9sas40jd87kksw7rlgy4cwmcfjqntv2st2jcnp
+        - recipient: age1nhlguc8xf7m4sdn087vqcnc9uj3n4zv09l9043u395acrd3lrscq9fzv66
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Y2l4bmxvMUoydTUxeVJV
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZENXbklWOWRkK2QwRG5i
-            cG53MVBSZTVCdEJVc3lIUG80NUhRR3JHVHg0CktiZG1qQXhObEJlb1l1TXdMWG1K
+            VlA1dkt4b2pST1JieFdid05VMWNwMEt3VkFBCmJUM00vRVZSZU5mOU1hWjYvR0Q3
-            MFJzTFhkRzBCbHUrVWQyYU9jZTI3bFEKLS0tIEMyTEhxUHVEQ3p2RU1uUFdEQjhm
+            NWpMd1JjZ2hpdHMxWmVkNGtxYTRhRm8KLS0tIGpKak9acEovc3VNRWlqSEdkYlZO
-            OS9jTkVwdWFCRGh4eU9HZkg2bjFKcEUKF5ImHatfTNVrw9hWBTAfCYLSdWaX4eo2
+            bTd5UEllblFEdHhzaHQ0Nk5rdFRSSmMKmGaPtpT/zDSYEd1vsSA3lkMyPIiCOKlb
-            ykwh2iK58JT3gXr9WsnWlf7/6VqZV+28eaptL34larbhdVGCgJsKMQ==
+            S/QDTRQVZWKwBnl6Mw7trQVdIxZm9pNp6PhgC+ZIUivMREY9QaFLiA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1y2kfnx87z2j7te9hu0guderrf2x9m8d0f3gfjjxcdk2va77yj3hsngj2f5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMHVuUjNyWDdyWlUvMWVq
-            ZWxPS0NCYXQwU0lWOGhyc2JmaFpEcWo2eFJrCkJlMHFYUFd3Rk13YTllSktjaWR0
-            N0w2SzcvaW11SjBkL3B5eHAySUoyWDAKLS0tIFgzYmtCcjVkaTZiQXd0NmQ2ckVB
-            OU01OGJUZ0ZIemw3elB0a1NjUXlNODgKyBNUqDdZuwY4Li9C6Bjv38rr/k6kva0u
-            rdr3QPSihgLv4+xaSFlpnK5zpVuSbh02+igKXnB2Pm7876iVxsE9ng==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1208zkkd9hh8n6v9zn6w75x9ajxd798kc4cv53d6qhkx55juflumquyh3ge
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOE9uYUxYaWt6S3BXTFZM
-            NWRHNm5jVUpsblJaZUo4bjlBK2FHb21nWFJBCk4zRTIzV0laQTJMbUwrNm10eVlr
-            TTByUlVvRytOQ0x4RDUxbzhnN0VCeGMKLS0tIG8zcDdwc01VWmU5THk0RmRLWGhG
-            UjlDQ0Y5QnY4dmlVVFZrM0IyZzlISWcKwpQY9/f1O2v78/9/dCZ7HPE3wVwQ4COG
-            a0E+oMEgBIeQny9LyfhUW2V/HKhYhFNPJaZrNM4J1zL+bz2ucdErmw==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-07-15T01:46:53Z"
     mac: ENC[AES256_GCM,data:emLL9w/oBY8EfWYlFlYfxqJr5cJT0Rt7VQ6evUSrG5exh7AJMSr3mAxrjmQ/09ZThubevNWSKdbq3EPdgj4zQ9W17xhn+K0H810M/e0Lnaia6Th40rdS9NASdDUB3qKNf5TLlXY5D0phB5Q2nxSnXxNTkQpYCtYsM6QSbeoe1MY=,iv:wcN7z1hpBRiqWIGxMDGEMYaIPDRH7sk1XZoqjzyRsYI=,tag:pQYKivueVO4KcwyKVhyQ6A==,type:str]