feat: Flake | revamp entire flake (#1)

Reviewed-on: #1

flake.lock

@@ -490,16 +490,15 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1738638143,
+        "lastModified": 1738816619,
-        "narHash": "sha256-ZYMe4c4OCtIUBn5hx15PEGr0+B1cNEpl2dsaLxwY2W0=",
+        "narHash": "sha256-5yRlg48XmpcX5b5HesdGMOte+YuCy9rzQkJz+imcu6I=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "9bdd53f5908453e4d03f395eb1615c3e9a351f70",
+        "rev": "2eccff41bab80839b1d25b303b53d339fbb07087",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "master",
         "repo": "nixos-hardware",
         "type": "github"
       }

flake.nix

@@ -13,7 +13,7 @@
     hyprland.url = "github:hyprwm/Hyprland";
 
     # NixOS community managed hardware specific features/fixes
-    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
 
     # Secure boot
     lanzaboote = {
@@ -41,37 +41,47 @@
   };
 
   outputs = {nixpkgs, ...} @ inputs: let
-    system = "x86_64-linux";
+    inherit (nixpkgs) lib;
-    hostName = "rihla";
+    mkHost = host: {
-    pkgs = nixpkgs.legacyPackages.${system};
+      ${host} = nixpkgs.lib.nixosSystem {
-  in {
-    nixosConfigurations = {
-      "${hostName}" = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [
-          inputs.lanzaboote.nixosModules.lanzaboote
-          inputs.disko.nixosModules.disko
-          inputs.nixos-hardware.nixosModules.framework-13-7040-amd
-          inputs.sops-nix.nixosModules.sops
-          inputs.home-manager.nixosModules.home-manager
-          ./nixos/configuration.nix
-          ./nixos/disko-config.nix
-          ./nixos/hardware-configuration.nix
-          {
-            home-manager = {
-              sharedModules = [
-                ./modules/home-manager/yubikey-touch-detector.nix
-              ];
-            };
-          }
-        ];
         specialArgs = {
-          inherit inputs hostName;
+          inherit inputs;
+
+          # Extend lib with lib.custom
+          lib = nixpkgs.lib.extend (self: super: { custom = import ./lib { inherit (nixpkgs) lib; }; });
         };
+
+        modules = [ ./hosts/nixos/${host} ];
       };
     };
+    mkHostConfigs = hosts: lib.foldl (acc: set: acc // set) { } (lib.map (host: mkHost host) hosts);
+    readHosts = folder: lib.attrNames (builtins.readDir ./hosts/${folder});
+  in {
+    nixosConfigurations = mkHostConfigs (readHosts "nixos");
 
-    devShell.x86_64-linux = pkgs.mkShell {
+    # nixosConfigurations = {
+    #   rihla = nixpkgs.lib.nixosSystem {
+    #     system = "x86_64-linux";
+    #     modules = [
+    #       inputs.lanzaboote.nixosModules.lanzaboote
+    #       inputs.disko.nixosModules.disko
+    #       inputs.nixos-hardware.nixosModules.framework-13-7040-amd
+    #       inputs.sops-nix.nixosModules.sops
+    #       inputs.home-manager.nixosModules.home-manager
+    #       ./nixos/configuration.nix
+    #       ./nixos/disko-config.nix
+    #       ./nixos/hardware-configuration.nix
+    #     ];
+    #     specialArgs = {
+    #       inherit inputs;
+	  #       hostName = "rihla";
+    #     };
+    #   };
+    # };
+
+    devShell.x86_64-linux = let 
+      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+    in pkgs.mkShell {
       buildInputs = with pkgs; [
         nil
         alejandra

home-manager/home.nix

@@ -1,131 +0,0 @@
-# This is your home-manager configuration file
-# Use this to configure your home environment (it replaces ~/.config/nixpkgs/home.nix)
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}: let
-  # Be sure to actually install the font first!
-  font = "ComicCodeLigatures";
-  username = "shahab";
-  email = "${username}@dogar.dev";
-  fullName = "Shahab Dogar";
-in {
-  # You can import other home-manager modules here
-  imports = [
-    # Custom import to configure font
-    (import ./configs/alacritty.nix {
-      inherit pkgs config font;
-    })
-
-    # Custom import for username and email
-    (import ./configs/git.nix {
-      inherit pkgs config lib;
-      userEmail = email;
-      userName = fullName;
-    })
-
-    ./configs/firefox.nix
-    ./configs/direnv.nix
-    ./configs/ssh.nix
-    ./configs/nvim.nix
-    ./configs/starship.nix
-    ./configs/zsh.nix
-    ./configs/btop.nix
-  ];
-
-  nixpkgs = {
-    # Configure your nixpkgs instance
-    config = {
-      # Disable if you don't want unfree packages
-      allowUnfree = true;
-
-      # Workaround for https://github.com/nix-community/home-manager/issues/2942
-      allowUnfreePredicate = _: true;
-    };
-  };
-
-  fonts = {
-    fontconfig.enable = true;
-  };
-
-  home = {
-    inherit username;
-
-    # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
-    stateVersion = "24.05";
-    homeDirectory = "/home/${username}";
-    sessionVariables = {
-      EDITOR = "nvim";
-      NIXOS_OZONE_WL = "1";
-    };
-
-    file = {
-      "${config.xdg.configHome}/tmux".source = ./dotfiles/tmux;
-      "${config.xdg.configHome}/bottom".source = ./dotfiles/bottom;
-      "${config.xdg.configHome}/nvim".source = ./dotfiles/nvim;
-      "${config.xdg.configHome}/hypr".source = ./dotfiles/hypr;
-      "${config.xdg.configHome}/waybar".source = ./dotfiles/waybar;
-      "${config.xdg.configHome}/wofi".source = ./dotfiles/wofi;
-      "${config.xdg.configHome}/mako".source = ./dotfiles/mako;
-    };
-
-    packages = with pkgs; [
-      nh
-      bottom
-      lazygit
-      neofetch
-      discord
-      eza
-      ripgrep
-      rm-improved
-      dust
-      gh
-      zoxide
-      xcp
-      unzip
-      prismlauncher
-      tmux
-      lazygit
-      gcc
-      zig
-      protonmail-desktop
-      protonvpn-gui
-      cloudflare-warp
-      kubectl
-      gparted
-      k9s
-      gnupg
-      postgresql_17
-      dig
-      bash
-      kitty
-      wofi
-      dolphin
-      waybar
-      font-awesome
-      mako
-      hyprshot
-      hyprlock
-      hypridle
-      hyprpolkitagent
-      pavucontrol
-      tree
-      wl-clipboard-rs
-      brightnessctl
-      age
-      nerd-fonts.jetbrains-mono
-      obsidian
-    ];
-  };
-
-  # Enable home-manager
-  programs.home-manager.enable = true;
-
-  # Add service to monitor yubikey requirement
-  services.yubikey-touch-detector.enable = true;
-
-  # Nicely reload system units when changing configs
-  systemd.user.startServices = "sd-switch";
-}

home/shahab/common/core/alacritty.nix

@@ -1,4 +1,9 @@
-{font, ...}: {
+{
+  config,
+  ...
+}:
+
+{
   programs.alacritty = {
     enable = true;
 
@@ -24,9 +29,9 @@
 
       font = {
         size = 14;
-        normal.family = font;
+        normal.family = config.hostSpec.font;
-        bold.family = font;
+        bold.family = config.hostSpec.font;
-        italic.family = font;
+        italic.family = config.hostSpec.font;
       };
 
       cursor = {

home/shahab/common/core/default.nix

@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  hostSpec,
+  ...
+}:
+{
+  imports = lib.flatten [
+    (map lib.custom.relativeToRoot [
+      "modules/common"
+      "modules/home-manager"
+    ])
+
+    ./alacritty.nix
+    ./direnv.nix
+    ./git.nix
+    ./fonts.nix
+  ];
+
+  inherit hostSpec;
+
+  home = {
+    username = lib.mkDefault config.hostSpec.username;
+    homeDirectory = lib.mkDefault config.hostSpec.home;
+    stateVersion = lib.mkDefault "25.05";
+    sessionPath = [
+      "$HOME/.local/bin"
+    ];
+    sessionVariables = {
+      FLAKE = "$HOME/src/nix/nix-config";
+      SHELL = "zsh";
+      TERM = "alacritty";
+      TERMINAL = "alacritty";
+      VISUAL = "nvim";
+      EDITOR = "nvim";
+    };
+
+    file = {
+      "${config.xdg.configHome}/nvim".source = lib.custom.relativeToRoot "dotfiles/nvim";
+    };
+  };
+
+  home.packages = with pkgs; [
+    bottom
+    lazygit
+    discord
+    eza
+    ripgrep
+    rm-improved
+    dust
+    gh
+    zoxide
+    xcp
+    unzip
+    prismlauncher
+    tmux
+    lazygit
+    gcc
+    zig
+    protonmail-desktop
+    protonvpn-gui
+    cloudflare-warp
+    kubectl
+    gparted
+    k9s
+    gnupg
+    postgresql_17
+    dig
+    bash
+    dolphin
+    font-awesome
+    tree
+    wl-clipboard-rs
+    brightnessctl
+    age
+    nerd-fonts.jetbrains-mono
+    obsidian
+  ];
+
+  nix = {
+    package = lib.mkDefault pkgs.nix;
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      warn-dirty = false;
+    };
+  };
+
+  programs.home-manager.enable = true;
+
+  # Nicely reload system units when changing configs
+  systemd.user.startServices = "sd-switch";
+}

home/shahab/common/core/direnv.nix

@@ -1,8 +1,8 @@
-{...}: {
+{
   programs.direnv = {
     enable = true;
-    enableZshIntegration = true;
     enableBashIntegration = true;
+    enableZshIntegration = true;
     nix-direnv.enable = true;
   };
 }

home/shahab/common/core/fonts.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  fonts.fontconfig.enable = true;
+  home.packages = with pkgs; [
+    nerd-fonts.jetbrains-mono
+  ];
+}

home/shahab/common/core/git.nix

@@ -1,15 +1,14 @@
 {
   lib,
   pkgs,
-  userName,
+  config,
-  userEmail,
   ...
 }: {
   programs.git = {
     package = pkgs.gitAndTools.gitFull;
     enable = true;
-    userName = userName;
+    userName = config.hostSpec.userFullName;
-    userEmail = userEmail;
+    userEmail = config.hostSpec.email.user;
 
     extraConfig = {
       gpg = {
@@ -22,7 +21,7 @@
         gpgsign = true;
       };
       user = {
-        signingKey = "~/.ssh/id_ed25519.pub";
+        signingKey = "~/.ssh/id_rihla.pub";
       };
       pull = {
         rebase = true;

home/shahab/common/optional/hyprland.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  home = {
+    file = {
+      "${config.xdg.configHome}/hypr".source = lib.custom.relativeToRoot "dotfiles/hypr";
+      "${config.xdg.configHome}/waybar".source = lib.custom.relativeToRoot "dotfiles/waybar";
+      "${config.xdg.configHome}/wofi".source = lib.custom.relativeToRoot "dotfiles/wofi";
+      "${config.xdg.configHome}/mako".source = lib.custom.relativeToRoot "dotfiles/mako";
+    };
+      
+    packages = with pkgs; [
+      hyprshot
+      hyprlock
+      hypridle
+      hyprpolkitagent
+      waybar
+      wofi
+      mako
+    ];
+  };
+}

home/shahab/common/optional/misc-packages.nix

@@ -0,0 +1,43 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  home.packages = with pkgs; [
+    nh
+    bottom
+    discord
+    eza
+    ripgrep
+    rm-improved
+    dust
+    gh
+    zoxide
+    xcp
+    unzip
+    prismlauncher
+    lazygit
+    gcc
+    zig
+    protonmail-desktop
+    protonvpn-gui
+    cloudflare-warp
+    kubectl
+    gparted
+    k9s
+    gnupg
+    postgresql_17
+    dig
+    bash
+    kitty
+    dolphin
+    waybar
+    font-awesome
+    tree
+    wl-clipboard-rs
+    brightnessctl
+    age
+    obsidian
+  ];
+}

home/shahab/common/optional/nvim.nix

@@ -1,4 +1,8 @@
-{...}: {
+{
+  ...
+}:
+
+{
   programs.neovim = {
     enable = true;
     defaultEditor = true;

home/shahab/common/optional/tmux.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  home = {
+    file = {
+      "${config.xdg.configHome}/tmux".source = lib.custom.relativeToRoot "dotfiles/tmux";
+    };
+
+    packages = with pkgs; [
+      tmux
+    ];
+  };
+}

home/shahab/rihla.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  ...
+}:
+{
+  imports = lib.flatten [
+    #
+    # ========== Required Configs ==========
+    #
+    ./common/core
+
+    #
+    # ========== Host-specific Optional Configs ==========
+    #
+    (map (config: "${builtins.toString ./.}/common/optional/${config}.nix") [
+      "hyprland"
+      "starship"
+      "ssh"
+      "zsh"
+      "btop"
+      "firefox"
+      "nvim"
+      "tmux"
+      "misc-packages"
+    ])
+  ];
+
+  services.yubikey-touch-detector.enable = true;
+
+  home = {
+    # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
+    stateVersion = "25.05";
+    sessionVariables = {
+      EDITOR = "nvim";
+      NIXOS_OZONE_WL = "1";
+    };
+  };
+}

hosts/common/core/default.nix

@@ -0,0 +1,102 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}:
+
+{
+  imports = lib.flatten [
+    inputs.home-manager.nixosModules.home-manager
+    inputs.sops-nix.nixosModules.sops
+
+    (map lib.custom.relativeToRoot [
+      "modules/common"
+      "hosts/common/users/primary"
+    ])
+  ];
+
+  hostSpec = {
+    username = "shahab";
+    handle = "shahab96";
+    email = {
+      user = "shahab@dogar.dev";
+    };
+    userFullName = "Shahab Dogar";
+    domain = "rihla";
+    networking.ports.tcp.ssh = 22;
+  };
+
+  networking.hostName = config.hostSpec.hostName;
+
+  home-manager = {
+    useGlobalPkgs = true;
+    backupFileExtension = "bk";
+  };
+
+  #
+  # ========= Overlays =========
+  #
+  nixpkgs = {
+    config = {
+      allowUnfree = true;
+      allowUnfreePredicate = _: true;
+    };
+  };
+
+  #
+  # ========= Nix Settings =========
+  #
+  nix = {
+    settings = {
+      # See https://jackson.dev/post/nix-reasonable-defaults/
+      connect-timeout = 5;
+      log-lines = 25;
+      min-free = 128000000; # 128MB
+      max-free = 1000000000; # 1GB
+
+      auto-optimise-store = true;
+      warn-dirty = false;
+      trusted-users = [ "@wheel" ];
+
+      substituters = ["https://hyprland.cachix.org"];
+      trusted-public-keys = ["hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+    };
+  };
+
+  # ========== Nix Helper ==========
+  # Provide better build output and will also handle garbage collection in place of standard nix gc (garbace collection)
+  programs.nh = {
+    enable = true;
+    clean.enable = true;
+    clean.extraArgs = "--keep-since 10d --keep 10";
+    flake = "/home/user/${config.hostSpec.home}/nix-config";
+  };
+
+  # ========= Sops =========
+  environment.systemPackages = with pkgs; [
+    sops
+  ];
+
+  #
+  # ========== Localization ==========
+  #
+  i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "ur_PK";
+    LC_IDENTIFICATION = "ur_PK";
+    LC_MEASUREMENT = "ur_PK";
+    LC_MONETARY = "ur_PK";
+    LC_NAME = "ur_PK";
+    LC_NUMERIC = "ur_PK";
+    LC_PAPER = "ur_PK";
+    LC_TELEPHONE = "ur_PK";
+    LC_TIME = "ur_PK";
+  };
+  time.timeZone = lib.mkDefault "Asia/Karachi";
+}

hosts/common/disks/rihla.nix

@@ -0,0 +1,100 @@
+{
+  disko = {
+    devices = {
+      disk = {
+        main = {
+          device = "/dev/nvme0n1";
+          type = "disk";
+          content = {
+            type = "gpt";
+            partitions = {
+              boot = {
+                name = "boot";
+                size = "1M";
+                type = "EF02";
+              };
+              esp = {
+                name = "ESP";
+                size = "500M";
+                type = "EF00";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                };
+              };
+              luks = {
+                size = "100%";
+                content = {
+                  name = "crypted";
+                  type = "luks";
+                  passwordFile = "/tmp/secret.key";
+                  settings = {
+                    allowDiscards = true;
+                    crypttabExtraOpts = [
+                      "fido2-device=auto"
+                      "token-timeout=10"
+                    ];
+                  };
+                  content = {
+                    type = "lvm_pv";
+                    vg = "crypt_vg";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+      lvm_vg = {
+        crypt_vg = {
+          type = "lvm_vg";
+          lvs = {
+            swap = {
+              size = "64G";
+              content = {
+                type = "swap";
+                resumeDevice = true;
+              };
+            };
+            main = {
+              size = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = [
+                  "-L"
+                  "nixos"
+                  "-f"
+                ];
+                subvolumes = {
+                  "@root" = {
+                    mountpoint = "/";
+                    mountOptions = [
+                      "compress=zstd"
+                    ];
+                  };
+                  "@home" = {
+                    mountpoint = "/home";
+                    mountOptions = [
+                      "subvol=home"
+                      "compress=zstd"
+                      "noatime"
+                    ];
+                  };
+                  "@nix" = {
+                    mountpoint = "/nix";
+                    mountOptions = [
+                      "subvol=nix"
+                      "compress=zstd"
+                      "noatime"
+                    ];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/common/optional/1password.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  ...
+}:
+
+{
+  programs = {
+    _1password.enable = true;
+    _1password-gui = {
+      enable = true;
+      polkitPolicyOwners = [ config.hostSpec.username ];
+    };
+  };
+}

hosts/common/optional/dconf.nix

@@ -0,0 +1,7 @@
+{
+  ...
+}:
+
+{
+  programs.dconf.enable = true;
+}

hosts/common/optional/docker.nix

@@ -0,0 +1,47 @@
+{
+  pkgs,
+  ...
+}: {
+  virtualisation = {
+    podman = {
+      enable = true;
+      dockerSocket.enable = true;
+      dockerCompat = true;
+
+      autoPrune = {
+        enable = true;
+        dates = "weekly";
+      };
+    };
+
+    containers = {
+      registries = {
+        search = ["docker.io"];
+      };
+    };
+
+    libvirtd = {
+      enable = true;
+      qemu = {
+        swtpm.enable = true;
+
+        ovmf = {
+          enable = true;
+          packages = with pkgs; [OVMFFull.fd];
+        };
+      };
+    };
+
+    spiceUSBRedirection.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    virt-manager
+    virt-viewer
+    spice
+    spice-gtk
+    spice-protocol
+    win-virtio
+    win-spice
+  ];
+}

hosts/common/optional/gaming.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  programs = {
+    steam = {
+      enable = true;
+      gamescopeSession.enable = true;
+    };
+
+    # to run steam games in game mode, add the following to the game's properties from within steam
+    # gamemoderun %command%
+    gamemode.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    mangohud
+    protonup-qt
+  ];
+}

hosts/common/optional/hyprland.nix

@@ -0,0 +1,24 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+
+{
+  programs.hyprland = {
+    enable = true;
+    package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
+    portalPackage =
+      inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
+  };
+
+  environment.systemPackages = with pkgs; [
+    hyprshot
+    hyprlock
+    hypridle
+    hyprpolkitagent
+    mako
+    waybar
+    wofi
+  ];
+}

hosts/common/optional/nix-ld.nix

@@ -0,0 +1,7 @@
+{
+  ...
+}:
+
+{
+  programs.nix-ld.enable = true;
+}

hosts/common/optional/secure-boot.nix

@@ -0,0 +1,10 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  environment.systemPackages = with pkgs; [
+    sbctl
+  ];
+}

hosts/common/optional/services/audio.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  services = {
+    # Enable sound with pipewire.
+    pulseaudio.enable = false;
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      wireplumber.enable = true;
+    };
+  };
+  security.rtkit.enable = true;
+
+  environment.systemPackages = builtins.attrValues {
+    inherit (pkgs) pavucontrol;
+  };
+}

hosts/common/optional/services/bluetooth.nix

@@ -0,0 +1,11 @@
+{
+  ...
+}:
+
+{
+  services.blueman.enable = true;
+  hardware = {
+    bluetooth.enable = true;
+    bluetooth.powerOnBoot = true;
+  };
+}

hosts/common/optional/services/firmware.nix

@@ -0,0 +1,7 @@
+{
+  ...
+}:
+
+{
+  services.fwupd.enable = true;
+}

hosts/common/optional/services/greetd.nix

@@ -0,0 +1,16 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --greeting 'Welcome to NixOS!' --asterisks --remember --remember-user-session --time --cmd ${pkgs.hyprland}/bin/Hyprland";
+        user = "greeter";
+      };
+    };
+  };
+}

hosts/common/optional/services/openssh.nix

@@ -0,0 +1,15 @@
+{
+  config,
+  ...
+}:
+let
+  sshPort = config.hostSpec.networking.ports.tcp.ssh;
+in
+{
+  services.openssh = {
+    enable = true;
+    ports = [ sshPort ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+}

hosts/common/optional/services/printing.nix

@@ -0,0 +1,8 @@
+# Reminder that CUPS cpanel defaults to localhost:631
+{
+  ...
+}:
+
+{
+  services.printing.enable = true;
+}

hosts/common/optional/services/smart-card.nix

@@ -0,0 +1,7 @@
+{
+  ...
+}:
+
+{
+  services.pcscd.enable = true;
+}

hosts/common/optional/yubikey.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  # yubikey login / sudo
+  security.pam = {
+    u2f = {
+      enable = true;
+      settings.cue = true;
+    };
+    services = {
+      login.u2fAuth = true;
+      sudo.u2fAuth = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    yubikey-manager
+  ];
+}

hosts/common/users/primary/default.nix

@@ -0,0 +1,53 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  hostSpec = config.hostSpec;
+  pubKeys = lib.filesystem.listFilesRecursive ./keys;
+in {
+  users = {
+    mutableUsers = false;
+    users.${hostSpec.username} = {
+      # Only do this if you have already configured zsh in home manager
+      ignoreShellProgramCheck = true;
+
+      name = hostSpec.username;
+      shell = pkgs.zsh;
+      home = hostSpec.home;
+      isNormalUser = true;
+      hashedPassword = "$y$j9T$pvjyL7hL5x2VBarGNTnMl1$mLA2UsWTbfp8Hgp/ug5l8224thi..Mo8.p7ME.tDZ.4";
+      extraGroups = [
+        "networkmanager"
+        "wheel"
+        "input"
+        "libvirtd"
+      ];
+
+      # Read all keys in ./keys and add them to authorizedKeys.
+      openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+
+      packages = with pkgs; [
+        libnotify
+      ];
+    };
+  };
+
+  home-manager = {
+    extraSpecialArgs = {
+      inherit pkgs inputs;
+      hostSpec = config.hostSpec;
+    };
+    users.${hostSpec.username}.imports = lib.flatten [ 
+      (
+        { config, ... }:
+        import (lib.custom.relativeToRoot "home/${hostSpec.username}/${hostSpec.hostName}.nix") {
+          inherit pkgs inputs config lib hostSpec;
+        }
+      )
+    ];
+  };
+}

hosts/common/users/primary/keys/id_dogar.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBijtTtb6UT5gssWolNGX1rcjAKsdtfz25fZMMnzq4v

hosts/common/users/primary/keys/id_rihla.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGD/V4jLpuk7uAovkbHFr6uulfBKZmsH+BqmXIR2aYD0

hosts/nixos/rihla/default.nix

@@ -0,0 +1,92 @@
+{
+  inputs,
+  lib,
+  ...
+}:
+
+{
+  imports = lib.flatten [
+    #
+    # ========= Hardware =========
+    #
+    ./hardware-configuration.nix
+    inputs.nixos-hardware.nixosModules.common-cpu-amd
+    inputs.nixos-hardware.nixosModules.common-gpu-amd
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    inputs.nixos-hardware.nixosModules.framework-13-7040-amd
+
+    #
+    # ======== Secure Boot =========
+    #
+    inputs.lanzaboote.nixosModules.lanzaboote
+
+    #
+    # ========= Disk Layout =========
+    #
+    inputs.disko.nixosModules.disko
+    (lib.custom.relativeToRoot "hosts/common/disks/rihla.nix")
+
+    #
+    # ========= Required Configs =========
+    #
+    (map lib.custom.relativeToRoot [
+      "hosts/common/core"
+    ])
+
+    #
+    # ========= Optional Configs =========
+    #
+    (map (config: lib.custom.relativeToRoot "hosts/common/optional/${config}.nix") [
+      "1password"
+      "dconf"
+      "docker"
+      "gaming"
+      "hyprland"
+      "nix-ld"
+      "secure-boot"
+      "yubikey"
+    ])
+
+    #
+    # ========= Optional Services =========
+    #
+    (map (service: lib.custom.relativeToRoot "hosts/common/optional/services/${service}.nix") [
+      "audio"
+      "bluetooth"
+      "firmware"
+      "greetd"
+      "openssh"
+      "printing"
+      "smart-card"
+    ])
+  ];
+
+  #
+  # ========= Host specification =========
+  #
+  hostSpec = {
+    hostName = "rihla";
+  };
+
+  networking = {
+    networkmanager.enable = true;
+    enableIPv6 = false;
+  };
+
+  boot = {
+    loader = {
+      # Set this to true on first install. This must be false for secure boot.
+      systemd-boot.enable = lib.mkForce false;
+      efi.canTouchEfiVariables = true;
+    };
+
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+
+  security.rtkit.enable = true;
+
+  system.stateVersion = "25.05";
+}

hosts/nixos/rihla/hardware-configuration.nix

@@ -0,0 +1,47 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  pkgs,
+  config,
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "nvme"
+        "xhci_pci"
+        "ahci"
+        "usbhid"
+        "thunderbolt"
+        "usb_storage"
+        "sd_mod"
+      ];
+      kernelModules = [];
+    };
+
+    kernelModules = ["kvm-amd"];
+    extraModulePackages = [];
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp193s0f3u2.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware = {
+    cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+    graphics = {
+      enable = true;
+      extraPackages = with pkgs; [amdvlk];
+    };
+  };
+}

lib/default.nix

@@ -0,0 +1,8 @@
+{
+  lib,
+  ...
+}:
+
+{
+  relativeToRoot = lib.path.append ../.;
+}

modules/common/default.nix

@@ -0,0 +1,9 @@
+{
+  ...
+}:
+
+{
+  imports = [
+    ./host-spec.nix
+  ];
+}

modules/common/host-spec.nix

@@ -0,0 +1,64 @@
+# Specifications For Differentiating Hosts
+{
+  config,
+  lib,
+  ...
+}:
+{
+  options.hostSpec = {
+    username = lib.mkOption {
+      type = lib.types.str;
+      description = "The username of the host";
+    };
+    hostName = lib.mkOption {
+      type = lib.types.str;
+      description = "The hostname of the host";
+    };
+    email = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      description = "The email of the user";
+    };
+    networking = lib.mkOption {
+      default = { };
+      type = lib.types.attrsOf lib.types.anything;
+      description = "An attribute set of networking information";
+    };
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "The domain of the host";
+    };
+    userFullName = lib.mkOption {
+      type = lib.types.str;
+      description = "The full name of the user";
+    };
+    handle = lib.mkOption {
+      type = lib.types.str;
+      description = "The handle of the user (eg: github user)";
+    };
+    home = lib.mkOption {
+      type = lib.types.str;
+      description = "The home directory of the user";
+      default = "/home/${config.hostSpec.username}";
+    };
+    useYubikey = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Used to indicate if the host uses a yubikey";
+    };
+    hdr = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Used to indicate a host that uses HDR";
+    };
+    scaling = lib.mkOption {
+      type = lib.types.str;
+      default = "1";
+      description = "Used to indicate what scaling to use. Floating point number";
+    };
+    font = lib.mkOption {
+      type = lib.types.str;
+      default = "ComicCodeLigatures";
+      description = "Used to specify the system font";
+    };
+  };
+}

modules/home-manager/default.nix

@@ -0,0 +1,9 @@
+{
+  ...
+}:
+
+{
+  imports = [
+    ./yubikey-touch-detector.nix
+  ];
+}