chore: flake update 04-07-2026

This commit is contained in:
2026-04-07 13:56:05 +05:00
parent 044e1e415e
commit cf4842a5b6
83 changed files with 581 additions and 352 deletions

View File

@@ -4,7 +4,8 @@
config,
lib,
...
}: {
}:
{
imports = lib.flatten [
inputs.home-manager.nixosModules.home-manager
inputs.sops-nix.nixosModules.sops
@@ -50,14 +51,20 @@
auto-optimise-store = true;
warn-dirty = false;
trusted-users = ["@wheel"];
trusted-users = [ "@wheel" ];
substituters = ["https://hyprland.cachix.org" "https://nix.dogar.dev"];
trusted-substituters = ["https://hyprland.cachix.org"];
substituters = [
"https://hyprland.cachix.org"
"https://nix.dogar.dev"
];
trusted-substituters = [ "https://hyprland.cachix.org" ];
trusted-public-keys = [
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
];
experimental-features = ["nix-command" "flakes"];
experimental-features = [
"nix-command"
"flakes"
];
};
};
@@ -71,7 +78,7 @@
};
# ========= Sops =========
environment.systemPackages = with pkgs; [sops];
environment.systemPackages = with pkgs; [ sops ];
#
# ========== Localization ==========

View File

@@ -27,7 +27,10 @@
passwordFile = "/tmp/secret.key";
settings = {
allowDiscards = true;
crypttabExtraOpts = ["fido2-device=auto" "token-timeout=10"];
crypttabExtraOpts = [
"fido2-device=auto"
"token-timeout=10"
];
};
content = {
type = "filesystem";

View File

@@ -6,7 +6,8 @@
swapSize,
label,
...
}: {
}:
{
disko = {
devices = {
disk = {
@@ -40,7 +41,10 @@
passwordFile = "/tmp/secret.key";
settings = {
allowDiscards = true;
crypttabExtraOpts = ["fido2-device=auto" "token-timeout=10"];
crypttabExtraOpts = [
"fido2-device=auto"
"token-timeout=10"
];
};
content = {
type = "lvm_pv";
@@ -66,15 +70,22 @@
passwordFile = "/tmp/secret.key";
settings = {
allowDiscards = true;
crypttabExtraOpts = ["fido2-device=auto" "token-timeout=10"];
crypttabExtraOpts = [
"fido2-device=auto"
"token-timeout=10"
];
};
content = {
type = "btrfs";
extraArgs = ["-L nix -f"];
extraArgs = [ "-L nix -f" ];
subvolumes = {
"@nix" = {
mountpoint = "/nix";
mountOptions = ["subvol=nix" "compress=zstd" "noatime"];
mountOptions = [
"subvol=nix"
"compress=zstd"
"noatime"
];
};
};
};
@@ -99,11 +110,19 @@
size = "100%";
content = {
type = "btrfs";
extraArgs = ["-L" label "-f"];
extraArgs = [
"-L"
label
"-f"
];
subvolumes = {
"@root" = {
mountpoint = "/";
mountOptions = ["subvol=root" "compress=zstd" "noatime"];
mountOptions = [
"subvol=root"
"compress=zstd"
"noatime"
];
};
};
};

View File

@@ -6,7 +6,8 @@
swapSize,
label,
...
}: {
}:
{
disko = {
devices = {
disk = {
@@ -40,7 +41,10 @@
passwordFile = "/tmp/secret.key";
settings = {
allowDiscards = true;
crypttabExtraOpts = ["fido2-device=auto" "token-timeout=10"];
crypttabExtraOpts = [
"fido2-device=auto"
"token-timeout=10"
];
};
content = {
type = "lvm_pv";
@@ -67,19 +71,35 @@
size = "100%";
content = {
type = "btrfs";
extraArgs = ["-L" label "-f"];
extraArgs = [
"-L"
label
"-f"
];
subvolumes = {
"@root" = {
mountpoint = "/";
mountOptions = ["subvol=root" "compress=zstd" "noatime"];
mountOptions = [
"subvol=root"
"compress=zstd"
"noatime"
];
};
"@persist" = {
mountpoint = config.hostSpec.persist;
mountOptions = ["subvol=persist" "compress=zstd" "noatime"];
mountOptions = [
"subvol=persist"
"compress=zstd"
"noatime"
];
};
"@nix" = {
mountpoint = "/nix";
mountOptions = ["subvol=nix" "compress=zstd" "noatime"];
mountOptions = [
"subvol=nix"
"compress=zstd"
"noatime"
];
};
};
};

View File

@@ -1,9 +1,10 @@
{config, ...}: {
{ config, ... }:
{
programs = {
_1password.enable = true;
_1password-gui = {
enable = true;
polkitPolicyOwners = [config.hostSpec.username];
polkitPolicyOwners = [ config.hostSpec.username ];
};
};
}

View File

@@ -1,3 +1,4 @@
{pkgs, ...}: {
environment.systemPackages = with pkgs; [claude-code];
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [ claude-code ];
}

View File

@@ -1,3 +1,4 @@
{...}: {
{ ... }:
{
programs.dconf.enable = true;
}

View File

@@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
virtualisation = {
docker = {
enable = true;
@@ -11,7 +12,11 @@
};
};
containers = {registries = {search = ["docker.io"];};};
containers = {
registries = {
search = [ "docker.io" ];
};
};
libvirtd = {
enable = true;

View File

@@ -1,3 +1,4 @@
{pkgs, ...}: {
environment.systemPackages = with pkgs; [hoppscotch];
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [ hoppscotch ];
}

View File

@@ -2,14 +2,16 @@
inputs,
pkgs,
...
}: {
}:
{
programs = {
hyprland = {
enable = true;
xwayland.enable = true;
systemd.setPath.enable = true;
package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
portalPackage = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
portalPackage =
inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
};
hyprlock.enable = true;

View File

@@ -1,3 +1,4 @@
{...}: {
{ ... }:
{
programs.nix-ld.enable = true;
}

View File

@@ -1,3 +1,4 @@
{pkgs, ...}: {
environment.systemPackages = with pkgs; [sbctl];
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [ sbctl ];
}

View File

@@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
services = {
# Enable sound with pipewire.
pulseaudio.enable = false;
@@ -12,6 +13,5 @@
};
security.rtkit.enable = true;
environment.systemPackages =
builtins.attrValues {inherit (pkgs) pavucontrol;};
environment.systemPackages = builtins.attrValues { inherit (pkgs) pavucontrol; };
}

View File

@@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
services.blueman.enable = true;
hardware = {
bluetooth.enable = true;

View File

@@ -1,3 +1,4 @@
{...}: {
{ ... }:
{
services.fwupd.enable = true;
}

View File

@@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
services.greetd = {
enable = true;
settings = {

View File

@@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
environment.systemPackages = with pkgs; [
k3s_1_35
cifs-utils

View File

@@ -1,6 +1,8 @@
{config, ...}: let
{ config, ... }:
let
hostName = config.hostSpec.hostName;
in {
in
{
services.openiscsi = {
enable = true;
name = "iqn.2016-04.com.open-iscsi:${hostName}";

View File

@@ -1,9 +1,11 @@
{config, ...}: let
{ config, ... }:
let
sshPort = config.hostSpec.networking.ports.tcp.ssh;
in {
in
{
services.openssh = {
enable = true;
ports = [sshPort];
ports = [ sshPort ];
settings = {
PermitRootLogin = "no";
@@ -14,5 +16,5 @@ in {
openFirewall = true;
};
networking.firewall.allowedTCPPorts = [sshPort];
networking.firewall.allowedTCPPorts = [ sshPort ];
}

View File

@@ -1,4 +1,5 @@
# Reminder that CUPS cpanel defaults to localhost:631
{...}: {
{ ... }:
{
services.printing.enable = true;
}

View File

@@ -1,3 +1,4 @@
{...}: {
{ ... }:
{
services.pcscd.enable = true;
}

View File

@@ -1,4 +1,5 @@
{ pkgs, ...}: {
{ pkgs, ... }:
{
services.netbird.enable = true;
environment.systemPackages = with pkgs; [ netbird-ui ];

View File

@@ -1,7 +1,8 @@
{
pkgs,
...
}: {
}:
{
environment.systemPackages = with pkgs; [
slack
];

View File

@@ -1,4 +1,5 @@
{...}: {
{ ... }:
{
programs.thunderbird = {
enable = true;
};

View File

@@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
# yubikey login / sudo
security.pam = {
u2f = {
@@ -11,5 +12,5 @@
};
};
environment.systemPackages = with pkgs; [yubikey-manager];
environment.systemPackages = with pkgs; [ yubikey-manager ];
}

View File

@@ -1,7 +1,8 @@
{
pkgs,
...
}: {
}:
{
environment.systemPackages = with pkgs; [
zoom-us
];

View File

@@ -3,9 +3,11 @@
config,
lib,
...
}: let
}:
let
hostSpec = config.hostSpec;
in {
in
{
specialisation.gaming.configuration = {
programs = {
steam = {
@@ -19,15 +21,19 @@ in {
};
home-manager.users."${hostSpec.username}".imports = lib.flatten [
({config, ...}:
import (lib.custom.relativeToRoot
"home/${hostSpec.username}/specialisations/gaming.nix") {
(
{ config, ... }:
import (lib.custom.relativeToRoot "home/${hostSpec.username}/specialisations/gaming.nix") {
inherit pkgs;
})
}
)
];
powerManagement.cpuFreqGovernor = "performance";
environment.systemPackages = with pkgs; [mangohud protonup-qt];
environment.systemPackages = with pkgs; [
mangohud
protonup-qt
];
};
}

View File

@@ -4,10 +4,12 @@
lib,
inputs,
...
}: let
}:
let
hostSpec = config.hostSpec;
pubKeys = lib.filesystem.listFilesRecursive ./keys;
in {
in
{
users = {
mutableUsers = false;
users.${hostSpec.username} = {
@@ -19,13 +21,18 @@ in {
home = hostSpec.home;
isNormalUser = true;
hashedPassword = "$y$j9T$pvjyL7hL5x2VBarGNTnMl1$mLA2UsWTbfp8Hgp/ug5l8224thi..Mo8.p7ME.tDZ.4";
extraGroups = ["networkmanager" "wheel" "input" "libvirtd" "docker"];
extraGroups = [
"networkmanager"
"wheel"
"input"
"libvirtd"
"docker"
];
# Read all keys in ./keys and add them to authorizedKeys.
openssh.authorizedKeys.keys =
lib.lists.forEach pubKeys (key: builtins.readFile key);
openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
packages = with pkgs; [libnotify];
packages = with pkgs; [ libnotify ];
};
};
@@ -35,11 +42,18 @@ in {
hostSpec = config.hostSpec;
};
users.${hostSpec.username}.imports = lib.flatten [
({config, ...}:
import (lib.custom.relativeToRoot
"home/${hostSpec.username}/${hostSpec.hostName}.nix") {
inherit pkgs inputs config lib hostSpec;
})
(
{ config, ... }:
import (lib.custom.relativeToRoot "home/${hostSpec.username}/${hostSpec.hostName}.nix") {
inherit
pkgs
inputs
config
lib
hostSpec
;
}
)
];
};
}

View File

@@ -3,9 +3,11 @@
pkgs,
lib,
...
}: let
}:
let
hostName = "aamil-1";
in {
in
{
imports = lib.flatten [
#
# ========= Hardware =========
@@ -21,17 +23,16 @@ in {
#
# ========= Required Configs =========
#
(map lib.custom.relativeToRoot ["hosts/common/core"])
(map lib.custom.relativeToRoot [ "hosts/common/core" ])
#
# ========= Services =========
#
(map
(s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"k3s"
"openiscsi"
"openssh"
])
(map (s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"k3s"
"openiscsi"
"openssh"
])
];
#
@@ -52,7 +53,10 @@ in {
nix = {
settings = {
require-sigs = false;
experimental-features = ["nix-command" "flakes"];
experimental-features = [
"nix-command"
"flakes"
];
};
};
@@ -74,11 +78,11 @@ in {
security.sudo.extraRules = [
{
users = ["shahab"];
users = [ "shahab" ];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
options = [ "NOPASSWD" ];
}
];
}

View File

@@ -6,8 +6,9 @@
lib,
modulesPath,
...
}: {
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
loader = {
@@ -19,11 +20,17 @@
efi.canTouchEfiVariables = true;
};
initrd = {
availableKernelModules = ["ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
kernelModules = [];
availableKernelModules = [
"ahci"
"xhci_pci"
"usbhid"
"usb_storage"
"sd_mod"
];
kernelModules = [ ];
};
kernelModules = ["kvm-amd"];
extraModulePackages = [];
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

View File

@@ -3,9 +3,11 @@
pkgs,
lib,
...
}: let
}:
let
hostName = "aamil-2";
in {
in
{
imports = lib.flatten [
#
# ========= Hardware =========
@@ -21,17 +23,16 @@ in {
#
# ========= Required Configs =========
#
(map lib.custom.relativeToRoot ["hosts/common/core"])
(map lib.custom.relativeToRoot [ "hosts/common/core" ])
#
# ========= Services =========
#
(map
(s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"k3s"
"openiscsi"
"openssh"
])
(map (s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"k3s"
"openiscsi"
"openssh"
])
];
#
@@ -52,7 +53,10 @@ in {
nix = {
settings = {
require-sigs = false;
experimental-features = ["nix-command" "flakes"];
experimental-features = [
"nix-command"
"flakes"
];
};
};
@@ -74,11 +78,11 @@ in {
security.sudo.extraRules = [
{
users = ["shahab"];
users = [ "shahab" ];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
options = [ "NOPASSWD" ];
}
];
}

View File

@@ -6,8 +6,9 @@
lib,
modulesPath,
...
}: {
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
loader = {
@@ -19,11 +20,17 @@
efi.canTouchEfiVariables = true;
};
initrd = {
availableKernelModules = ["nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
kernelModules = [];
availableKernelModules = [
"nvme"
"xhci_pci"
"usbhid"
"usb_storage"
"sd_mod"
];
kernelModules = [ ];
};
kernelModules = ["kvm-amd"];
extraModulePackages = [];
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

View File

@@ -3,9 +3,11 @@
pkgs,
lib,
...
}: let
}:
let
hostName = "aamil-3";
in {
in
{
imports = lib.flatten [
#
# ========= Hardware =========
@@ -21,17 +23,16 @@ in {
#
# ========= Required Configs =========
#
(map lib.custom.relativeToRoot ["hosts/common/core"])
(map lib.custom.relativeToRoot [ "hosts/common/core" ])
#
# ========= Services =========
#
(map
(s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"k3s"
"openiscsi"
"openssh"
])
(map (s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"k3s"
"openiscsi"
"openssh"
])
];
#
@@ -52,7 +53,10 @@ in {
nix = {
settings = {
require-sigs = false;
experimental-features = ["nix-command" "flakes"];
experimental-features = [
"nix-command"
"flakes"
];
};
};
@@ -74,11 +78,11 @@ in {
security.sudo.extraRules = [
{
users = ["shahab"];
users = [ "shahab" ];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
options = [ "NOPASSWD" ];
}
];
}

View File

@@ -6,8 +6,9 @@
lib,
modulesPath,
...
}: {
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
loader = {
@@ -19,11 +20,17 @@
efi.canTouchEfiVariables = true;
};
initrd = {
availableKernelModules = ["nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod"];
kernelModules = [];
availableKernelModules = [
"nvme"
"xhci_pci"
"usbhid"
"usb_storage"
"sd_mod"
];
kernelModules = [ ];
};
kernelModules = ["kvm-amd"];
extraModulePackages = [];
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

View File

@@ -3,7 +3,8 @@
lib,
config,
...
}: {
}:
{
imports = lib.flatten [
#
# ========= Hardware =========
@@ -32,7 +33,7 @@
#
# ========= Required Configs =========
#
(map lib.custom.relativeToRoot ["hosts/common/core"])
(map lib.custom.relativeToRoot [ "hosts/common/core" ])
#
# ========= Optional Configs =========
@@ -54,17 +55,16 @@
#
# ========= Optional Services =========
#
(map
(s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"audio"
"bluetooth"
"firmware"
"greetd"
"openssh"
"printing"
"smart-card"
"vpn"
])
(map (s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"audio"
"bluetooth"
"firmware"
"greetd"
"openssh"
"printing"
"smart-card"
"vpn"
])
];
#
@@ -74,7 +74,9 @@
hostName = "blueocean";
username = "dogar";
handle = "shadogar";
email = {user = "shahab.dogar@blueocean.ai";};
email = {
user = "shahab.dogar@blueocean.ai";
};
useYubikey = lib.mkForce true;
};

View File

@@ -6,8 +6,9 @@
lib,
modulesPath,
...
}: {
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
initrd = {
@@ -20,12 +21,12 @@
"usb_storage"
"sd_mod"
];
kernelModules = [];
kernelModules = [ ];
};
kernelModules = ["kvm-amd"];
extraModulePackages = [];
binfmt.emulatedSystems = ["aarch64-linux"]; # Add other target architectures as needed
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
binfmt.emulatedSystems = [ "aarch64-linux" ]; # Add other target architectures as needed
};
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
@@ -38,8 +39,7 @@
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware = {
cpu.amd.updateMicrocode =
lib.mkDefault config.hardware.enableRedistributableFirmware;
cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
graphics = {
enable = true;
};

View File

@@ -4,7 +4,8 @@
lib,
config,
...
}: {
}:
{
imports = lib.flatten [
#
# ========= Hardware =========
@@ -37,7 +38,7 @@
#
# ========= Required Configs =========
#
(map lib.custom.relativeToRoot ["hosts/common/core"])
(map lib.custom.relativeToRoot [ "hosts/common/core" ])
#
# ========= Optional Configs =========
@@ -58,17 +59,16 @@
#
# ========= Optional Services =========
#
(map
(s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"audio"
"bluetooth"
"firmware"
"greetd"
"openssh"
"printing"
"smart-card"
"vpn"
])
(map (s: lib.custom.relativeToRoot "hosts/common/optional/services/${s}.nix") [
"audio"
"bluetooth"
"firmware"
"greetd"
"openssh"
"printing"
"smart-card"
"vpn"
])
#
# ========= Specialisations ========
@@ -90,7 +90,9 @@
impermanance = false;
username = "shahab";
handle = "shahab96";
email = {user = "shahab@dogar.dev";};
email = {
user = "shahab@dogar.dev";
};
};
networking = {
@@ -108,9 +110,8 @@
efi.canTouchEfiVariables = true;
};
initrd.postResumeCommands =
lib.mkIf config.hostSpec.impermanance
(lib.mkAfter ''
initrd.postResumeCommands = lib.mkIf config.hostSpec.impermanance (
lib.mkAfter ''
mkdir /btrfs_tmp
mount /dev/crypt_vg/root /btrfs_tmp
if [[ -e /btrfs_tmp/root ]]; then
@@ -133,7 +134,8 @@
btrfs subvolume create /btrfs_tmp/root
umount /btrfs_tmp
'');
''
);
lanzaboote = {
enable = config.hostSpec.secureBoot;
@@ -143,7 +145,10 @@
security.rtkit.enable = true;
environment.systemPackages = with pkgs; [pciutils bc];
environment.systemPackages = with pkgs; [
pciutils
bc
];
system.stateVersion = "25.05";
}

View File

@@ -5,8 +5,9 @@
lib,
modulesPath,
...
}: {
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
}:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot = {
initrd = {
@@ -19,12 +20,12 @@
"usb_storage"
"sd_mod"
];
kernelModules = [];
kernelModules = [ ];
};
kernelModules = ["kvm-amd"];
extraModulePackages = [];
binfmt.emulatedSystems = ["aarch64-linux"]; # Add other target architectures as needed
kernelModules = [ "kvm-amd" ];
extraModulePackages = [ ];
binfmt.emulatedSystems = [ "aarch64-linux" ]; # Add other target architectures as needed
};
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking