adriangl/nix-dotfiles-v2
1
1
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: adriangl/nix-dotfiles-v2:main
Branches Tags
adriangl/nix-dotfiles-v2:main adriangl/nix-dotfiles-v2:galadriel-fra-legolas
..
pull from: adriangl/nix-dotfiles-v2:galadriel-fra-legolas
Branches Tags
adriangl/nix-dotfiles-v2:main adriangl/nix-dotfiles-v2:galadriel-fra-legolas

1 Commits
main .. galadriel-fra-legolas

Author SHA1 Message Date
adriangl d03b4ba609 snapshot 2025-10-14 21:27:46 +02:00
111 changed files with 2456 additions and 5383 deletions
Expand all files Collapse all files
.gitignore
-1
View File
@@ -1,2 +1 @@
flake.lock
result
README.md
+1 -1
View File
@@ -2,4 +2,4 @@ first install enable lanzaboote 'sudo sbctl create-keys'
rebuild 'sudo nixos-rebuild switch --flake .# --no-write-lock-file -L --builders ""'
![](assets/2026-05-01-07-57-20.png)
developmentlog.md
-79
View File
@@ -1,79 +0,0 @@
# Development log
## legolas: NVMe (Corsair MP600 ELITE / Phison E21) suspend/resume crashes
The drive hung on resume from S3 (deep) suspend — boot logs ended at `PM: suspend entry (deep)` with no resume, followed by a hard reboot. The Phison E21 can't recover from the D3 transition that S3 forces.
Investigation also found two existing workarounds were doing nothing:
- The udev rule `ATTR{d3cold_allowed}="0"` was a no-op — that sysfs attribute doesn't exist on this Phison endpoint or its parent root port (`0000:00:1d.0`).
- The `nvme-resume-fix` service was broken: `ExecStart` used `>` redirection without a shell, so `echo` just printed the string and never wrote to the `rescan` sysfs file. It never actually rescanned.
Changes (`hosts/legolas/hardware-configuration.nix`):
- Switched `mem_sleep_default` from `deep` (S3) to `s2idle` (modern standby). s2idle avoids the deep D3 path that hangs the drive.
- Removed the no-op `d3cold_allowed` rule and the broken rescan service.
- Added a correct runtime-PM-off udev rule on both the NVMe endpoint (`0000:6e:00.0`) and its parent root port (`0000:00:1d.0`), keeping the PCIe wakeup disable.
Note: runtime PM was already off on the endpoint (`power/control=on`); that alone never fixed the crash because system suspend uses a separate code path. Verify after rebuild that the cmdline has `mem_sleep_default=s2idle` (the running generation showed a stale duplicate `deep`).
## Headless home-manager configs (galadriel, elros, elrond)
Added minimal home-manager configs for `gunalx` and `root` on headless hosts. These skip all GUI/desktop modules (niri, stylix, foot, noctalia, etc.) and keep only CLI tools: bash (with sops AI keys), git, nixvim (full config reused), opencode, atuin, sshconfig, sops.
Files:
- `home/gunalx-headless.nix` — gunalx's minimal config, same module set as `gunalx.nix` minus all GUI imports.
- `home/root.nix` — identical CLI stack, explicitly sets `home.username`/`home.homeDirectory` to root.
- `home/sops.nix` — parameterized age key paths to use `config.home.homeDirectory` so both users work without duplication.
- `home/sshconfig.nix` — removed `ssh-askpass-fullscreen` (unwired GUI dependency, was dead weight).
- `flake.nix` — added `headlessHmModules` let binding (shared by all three hosts) wiring `home-manager.users.gunalx` + `home-manager.users.root`.
Manual step: root needs the sops age key at `/root/.config/sops/age/key.txt` (or SSH key at `/root/.ssh/nixos`) to decrypt AI API secrets. `age.generateKey = true` will create a new key, but it won't match the encrypted secrets — copy gunalx's age key to root's path, or re-encrypt the secrets with root's age public key.
## galadriel: kernel 7.0 EOL
Linux 7.0 was removed from nixpkgs (EOL). `pkgs.zfs` (stable) is now 2.4.2, same version previously pulled from unstable. Switched `boot.kernelPackages` to the default (6.18) and `boot.zfs.package` to `pkgs.zfs`. No pool compatibility concern since ZFS version is unchanged.
## legolas: lid-close still killing the NVMe — stale `deep` + logind suspend
Root cause of the recurring "SSD dies when lid closed": the *booted* generation carried a duplicate `mem_sleep_default=deep` after `mem_sleep_default=s2idle` (last wins), so `/sys/power/mem_sleep` was `s2idle [deep]` — every suspend went to S3. The source config only had `s2idle`; the stale param lived in the old generation. ACPI advertises S3 (`supports S0 S3 S4 S5`) but S3 is broken for the Phison E21 on this Skylake-era Intel platform, so only s0/s2idle is reliable. Separately, `HandleLidSwitch` was unset → defaulted to `suspend`, which was the actual lid-close trigger.
Changes (`hosts/legolas/hardware-configuration.nix`):
- `services.logind.lidSwitch`/`lidSwitchExternalPower`/`lidSwitchDocked` = `ignore`. Lid close no longer suspends; niri's `switch-events` still locks via noctalia, so the laptop stays on (RAM powered) but can't enter the S3 path.
- `systemd.services.force-s2idle` writes `s2idle` to `/sys/power/mem_sleep` at boot — guarantees the active mode is s2idle even if a future cmdline carries a stray `deep`.
- Suspend (s2idle) remains available via `systemctl suspend`; hibernation stays disabled.
Also fixed `home/niri.nix` lid-close command from the undocumented `lockScreen lock` to the v5-canonical `session lock` (matching the `Mod+M` binding).
Verify after rebuild+reboot: `/proc/cmdline` has no `deep`, and `/sys/power/mem_sleep` shows `[s2idle] deep`.
## Bumped locally packaged packages
Version + hash bumps for the upstream-tracking packages under `packages/`. All hashes recomputed from the actual fetched outputs (src FOD builds for the `postFetch` sources, `nurl` for plain `fetchFromGitHub`, FOD builds for `npmDepsHash`/`vendorHash`).
- `llama-cpp-nightly` + `ui.nix`: `b9665` -> `b10034` (src + npmDepsHash).
- `llama-swap` + `ui.nix`: `v226` -> `v240` (src + vendorHash + ui npmDepsHash). UI version is inherited.
- `s2cpp`: pin `e48ce8e` (2026-04-12) -> `2c33261` (2026-05-27).
- `intel-sycl`: `nightly-2026-01-01` -> `nightly-2026-07-13` (src hash only).
Not bumped: `qwen-asr` (still at upstream latest `1.0.3`); the model packages (`s2-model`, `whisper-models`, `z-image-models`) and `android-cli` use fixed URLs with no version tag to bump.
Note: `intel-sycl` is packaged but not currently wired into the flake (`llama-cpp-nightly-sycl` leaves `syclStdenv = null` and is marked broken). The vc-intrinsics pin in `intel-sycl/pins` was left as-is. Builds must use `--builders ""` locally — the configured remote builder `aragon` is unreachable and its SSH retries stall fetches.
## restic backup architecture
Hub-and-spoke via `modules/restic-server.nix` + `modules/restic-client.nix`. `services.restic.server` on galadriel (rest-server, tailnet-only on `${hostname}:8008`, no nginx — Tailscale already encrypts the transport), one shared restic repo at `/var/lib/restic/main`. Every host incl. galadriel runs `services.restic.backups.main` against `rest:http://restic:<transportpw>@galadriel:8008/main/`. Single transport credential (one htpasswd user) + single repo encryption password. Restic tags snapshots per-host, so one repo holds all hosts and retention is per-host by default (`forget` defaults to `--group-by host,paths`).
- `appendOnly = true` (`lib.mkDefault`): clients write but can't forget/prune over HTTP — the one cheap control stopping a compromised client from wiping the shared history.
- Prune: native prune-only job on galadriel (`services.restic.backups.prune`, `paths = [ ]` — the module's documented escape hatch) running `forget --prune` + `check` against the local path. Must be local; append-only blocks it over HTTP for everyone.
- Offsite: `restic copy` from the local repo to `restic/offsite_repository`. The restic module has NO native `copy` (only backup/prune/check — checked against master), so this is the one hand-rolled systemd service. Picked over per-host dual-destination backups to keep the offsite upload centralized and the offsite secret off the clients.
Secrets (`secrets/secrets.yaml`): `restic/server_htpasswd` (bcrypt hash, server), `restic/repository` (repo URL incl. transport pw, clients), `restic/repo_password` (encryption key, clients + server prune/offsite), `restic/offsite_repository` (offsite URL, galadriel). On galadriel both modules declare `restic/repo_password`; the server's `owner = "restic"` wins the merge, and root (the client job user) reads it regardless.
Manual: add secrets; make every using-host a sops recipient; `restic init` the offsite repo once with `repo_password`; set `services.restic.backups.main.paths` per host. Caveat: `listenAddress = "${hostname}:8008"` relies on Tailscale MagicDNS resolving at socket-activation time — bind the tailnet IP directly if it ever flakes at boot.
## restic-client on all hosts
Rolled `../../modules/restic-client.nix` into the remaining hosts (aragon, elros, elrond); legolas and galadriel already had it. All three use the module's `mkDefault` paths (`/var/lib`, `/var/backups`, `/home/gunalx`) — no per-host `paths` override needed. No secret changes: the shared `restic/repository` + `restic/repo_password` already cover every host, and sops-nix auto-derives each host's age key from `age.sshKeyPaths`, so existing recipients decrypt the same secrets.
Left to do manually: confirm each new client's SSH key (`/etc/ssh/nixos` on the host) is a sops recipient in `secrets/secrets.yaml` — if a host can't decrypt, re-run `sops updatekeys secrets/secrets.yaml`. Verify the first backup runs (`systemctl start restic-backups-main`) and shows in `restic snapshots` on galadriel.
flake.lock
Generated
+475
View File
@@ -0,0 +1,475 @@
{
"nodes": {
"base16-schemes": {
"flake": false,
"locked": {
"lastModified": 1696158499,
"narHash": "sha256-5yIHgDTPjoX/3oDEfLSQ0eJZdFL1SaCfb9d6M0RmOTM=",
"owner": "tinted-theming",
"repo": "base16-schemes",
"rev": "a9112eaae86d9dd8ee6bb9445b664fba2f94037a",
"type": "github"
},
"original": {
"owner": "tinted-theming",
"repo": "base16-schemes",
"type": "github"
}
},
"base16-schemes_2": {
"flake": false,
"locked": {
"lastModified": 1696158499,
"narHash": "sha256-5yIHgDTPjoX/3oDEfLSQ0eJZdFL1SaCfb9d6M0RmOTM=",
"owner": "tinted-theming",
"repo": "base16-schemes",
"rev": "a9112eaae86d9dd8ee6bb9445b664fba2f94037a",
"type": "github"
},
"original": {
"owner": "tinted-theming",
"repo": "base16-schemes",
"type": "github"
}
},
"blog-generator": {
"inputs": {
"flake-utils": "flake-utils",
"nix-colors": "nix-colors",
"nixpkgs": "nixpkgs",
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1760358235,
"narHash": "sha256-uR6lu5QtudOPQrUVVziEzJqAdYMZn+maPxn95a3bs1U=",
"owner": "adrlau",
"repo": "blog-generator",
"rev": "8497f0fada979c6f67e11c5e70f1eb1f6a5e0d4b",
"type": "github"
},
"original": {
"owner": "adrlau",
"repo": "blog-generator",
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1731098351,
"narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
"owner": "ipetkov",
"repo": "crane",
"rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
"type": "github"
},
"original": {
"owner": "ipetkov",
"repo": "crane",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1696426674,
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github"
},
"original": {
"owner": "edolstra",
"repo": "flake-compat",
"type": "github"
}
},
"flake-parts": {
"inputs": {
"nixpkgs-lib": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1730504689,
"narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "506278e768c2a08bec68eb62932193e341f55c90",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "flake-parts",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"gitignore": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"pre-commit-hooks-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1758463745,
"narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-25.05",
"repo": "home-manager",
"type": "github"
}
},
"lanzaboote": {
"inputs": {
"crane": "crane",
"flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"nixpkgs": [
"nixpkgs"
],
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
"rust-overlay": "rust-overlay_2"
},
"locked": {
"lastModified": 1737639419,
"narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
"owner": "nix-community",
"repo": "lanzaboote",
"rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "v0.4.2",
"repo": "lanzaboote",
"type": "github"
}
},
"nix-colors": {
"inputs": {
"base16-schemes": "base16-schemes",
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1707825078,
"narHash": "sha256-hTfge2J2W+42SZ7VHXkf4kjU+qzFqPeC9k66jAUBMHk=",
"owner": "misterio77",
"repo": "nix-colors",
"rev": "b01f024090d2c4fc3152cd0cf12027a7b8453ba1",
"type": "github"
},
"original": {
"owner": "misterio77",
"repo": "nix-colors",
"type": "github"
}
},
"nix-colors_2": {
"inputs": {
"base16-schemes": "base16-schemes_2",
"nixpkgs-lib": "nixpkgs-lib_2"
},
"locked": {
"lastModified": 1707825078,
"narHash": "sha256-hTfge2J2W+42SZ7VHXkf4kjU+qzFqPeC9k66jAUBMHk=",
"owner": "misterio77",
"repo": "nix-colors",
"rev": "b01f024090d2c4fc3152cd0cf12027a7b8453ba1",
"type": "github"
},
"original": {
"owner": "misterio77",
"repo": "nix-colors",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1760106635,
"narHash": "sha256-2GoxVaKWTHBxRoeUYSjv0AfSOx4qw5CWSFz2b+VolKU=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "9ed85f8afebf2b7478f25db0a98d0e782c0ed903",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "master",
"repo": "nixos-hardware",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1759831965,
"narHash": "sha256-vgPm2xjOmKdZ0xKA6yLXPJpjOtQPHfaZDRtH+47XEBo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c9b6fb798541223bbb396d287d16f43520250518",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-lib": {
"locked": {
"lastModified": 1697935651,
"narHash": "sha256-qOfWjQ2JQSQL15KLh6D7xQhx0qgZlYZTYlcEiRuAMMw=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "e1e11fdbb01113d85c7f41cada9d2847660e3902",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nixpkgs.lib",
"type": "github"
}
},
"nixpkgs-lib_2": {
"locked": {
"lastModified": 1697935651,
"narHash": "sha256-qOfWjQ2JQSQL15KLh6D7xQhx0qgZlYZTYlcEiRuAMMw=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "e1e11fdbb01113d85c7f41cada9d2847660e3902",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nixpkgs.lib",
"type": "github"
}
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1730741070,
"narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1744536153,
"narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1760139962,
"narHash": "sha256-4xggC56Rub3WInz5eD7EZWXuLXpNvJiUPahGtMkwtuc=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "7e297ddff44a3cc93673bb38d0374df8d0ad73e4",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05",
"repo": "nixpkgs",
"type": "github"
}
},
"pre-commit-hooks-nix": {
"inputs": {
"flake-compat": [
"lanzaboote",
"flake-compat"
],
"gitignore": "gitignore",
"nixpkgs": [
"lanzaboote",
"nixpkgs"
],
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
"lastModified": 1731363552,
"narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"root": {
"inputs": {
"blog-generator": "blog-generator",
"home-manager": "home-manager",
"lanzaboote": "lanzaboote",
"nix-colors": "nix-colors_2",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_3",
"sops-nix": "sops-nix",
"unstable": "unstable"
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1760063676,
"narHash": "sha256-s5Fjh43skH2L+avOGioLmEHoYZffDbg3abV5h0gjeew=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "897deed0923cc5a1d560c5176abe0d172ec9716d",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"rust-overlay_2": {
"inputs": {
"nixpkgs": [
"lanzaboote",
"nixpkgs"
]
},
"locked": {
"lastModified": 1731897198,
"narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1760240450,
"narHash": "sha256-sa9bS9jSyc4vH0jSWrUsPGdqtMvDwmkLg971ntWOo2U=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "41fd1f7570c89f645ee0ada0be4e2d3c4b169549",
"type": "github"
},
"original": {
"owner": "Mic92",
"repo": "sops-nix",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"unstable": {
"locked": {
"lastModified": 1760038930,
"narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
}
},
"root": "root",
"version": 7
}
flake.nix
+25 -219
View File
@@ -2,24 +2,15 @@
description = "NixOS configuration for legolas (laptop)";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
home-manager = {
url = "github:nix-community/home-manager/release-26.05";
url = "github:nix-community/home-manager/release-25.05";
inputs.nixpkgs.follows = "nixpkgs";
};
noctalia = {
url = "github:noctalia-dev/noctalia/v5.0.0-beta.7"; # remember to update this commit hash
#inputs.nixpkgs.follows = "nixpkgs";
};
nix-colors.url = "github:misterio77/nix-colors";
stylix = {
url = "github:nix-community/stylix/release-26.05";
inputs.nixpkgs.follows = "nixpkgs";
};
sops-nix = {
url = "github:Mic92/sops-nix";
@@ -27,21 +18,14 @@
};
lanzaboote = {
url = "github:nix-community/lanzaboote/v1.0.0";
url = "github:nix-community/lanzaboote/v0.4.2";
inputs.nixpkgs.follows = "nixpkgs";
};
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
nixvim = {
url = "github:nix-community/nixvim/nixos-26.05";
inputs.nixpkgs.follows = "nixpkgs";
};
niri = {
url = "github:sodiboo/niri-flake";
inputs.nixpkgs.follows = "nixpkgs";
};
blog-generator.url = "github:adrlau/blog-generator";
};
@@ -52,155 +36,31 @@
unstable,
home-manager,
nix-colors,
stylix,
sops-nix,
lanzaboote,
nixos-hardware,
niri,
noctalia,
nixvim,
blog-generator,
...
}@inputs:
let
system = "x86_64-linux";
headlessHmModules = [
home-manager.nixosModules.home-manager
{
home-manager.backupFileExtension = "bac";
home-manager.extraSpecialArgs = { inherit inputs; };
home-manager.sharedModules = [
inputs.sops-nix.homeManagerModules.sops
inputs.nixvim.homeModules.nixvim
];
home-manager.users.gunalx = import ./home/gunalx-headless.nix;
home-manager.users.root = import ./home/root.nix;
}
{
home-manager.users.gunalx = {
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
];
};
home-manager.users.root = {
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
];
};
}
];
in
{
packages.${system} =
let
lib = nixpkgs.lib;
pkgs = import nixpkgs {
inherit system;
overlays = [ self.overlays.custom ];
config.allowUnfree = true;
};
in
{
inherit (pkgs.custom)
qwen-asr
llama-swap
z-image-models
whisper-models
s2cpp
s2-model
vllm-omni
llama-cpp-ui
llama-cpp-nightly
llama-cpp-nightly-vulkan
llama-cpp-nightly-sycl
android-cli
;
};
overlays.custom =
final: _prev:
let
unstable-pkgs = import inputs.unstable { inherit (final.stdenv.hostPlatform) system; };
in
{
custom = {
qwen-asr = final.callPackage ./packages/qwen-asr { };
llama-swap = final.callPackage ./packages/llama-swap {
buildGoModule = unstable-pkgs.buildGoModule;
};
z-image-models = final.callPackage ./packages/z-image-models { };
whisper-models = final.callPackage ./packages/whisper-models { };
s2cpp = final.callPackage ./packages/s2cpp { };
s2-model = final.callPackage ./packages/s2-model { };
vllm-omni = final.python3Packages.callPackage ./packages/vllm-omni { };
llama-cpp-ui = final.callPackage ./packages/llama-cpp-nightly/ui.nix { };
llama-cpp-nightly = final.callPackage ./packages/llama-cpp-nightly {
uiAssets = final.custom.llama-cpp-ui;
};
llama-cpp-nightly-vulkan = final.callPackage ./packages/llama-cpp-nightly {
vulkanSupport = true;
uiAssets = final.custom.llama-cpp-ui;
};
llama-cpp-nightly-sycl = final.callPackage ./packages/llama-cpp-nightly {
syclSupport = true;
mkl = final.mkl;
oneDNN = final.oneDNN;
uiAssets = final.custom.llama-cpp-ui;
};
android-cli = final.callPackage ./packages/android-cli { };
};
};
overlays.unstable = final: _prev: {
unstable = import inputs.unstable {
inherit (final.stdenv.hostPlatform) system;
config = {
allowUnfree = true;
segger-jlink.acceptLicense = true;
};
};
};
# legolas
nixosConfigurations.legolas = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit inputs system; };
specialArgs = { inherit inputs; };
modules = [
./hosts/legolas/configuration.nix
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.gunalx = import ./home/gunalx.nix;
home-manager.backupFileExtension = "bac";
home-manager.extraSpecialArgs = { inherit nix-colors inputs; };
home-manager.sharedModules = [
inputs.sops-nix.homeManagerModules.sops
inputs.stylix.homeModules.stylix
inputs.niri.homeModules.niri
inputs.noctalia.homeModules.default
inputs.nixvim.homeModules.nixvim
];
}
{
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
niri.overlays.niri
];
home-manager.users.gunalx = {
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
niri.overlays.niri
];
};
home-manager.sharedModules = [ inputs.sops-nix.homeManagerModules.sops ];
}
sops-nix.nixosModules.sops
@@ -208,45 +68,30 @@
lanzaboote.nixosModules.lanzaboote
nixos-hardware.nixosModules.dell-xps-13-9370
#temporarily for testing run my blog on my laptop
blog-generator.nixosModules.default
];
};
# aragon
nixosConfigurations.aragon = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit inputs system; };
specialArgs = { inherit inputs; };
modules = [
./hosts/aragon/configuration.nix
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.users.gunalx = import ./home/gunalx.nix;
home-manager.backupFileExtension = "bac";
home-manager.extraSpecialArgs = { inherit nix-colors inputs; };
home-manager.sharedModules = [
inputs.sops-nix.homeManagerModules.sops
inputs.stylix.homeModules.stylix
inputs.niri.homeModules.niri
inputs.noctalia.homeModules.default
inputs.nixvim.homeModules.nixvim
];
}
{
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
niri.overlays.niri
];
home-manager.users.gunalx = {
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
niri.overlays.niri
];
};
home-manager.sharedModules = [ inputs.sops-nix.homeManagerModules.sops ];
}
sops-nix.nixosModules.sops
@@ -256,63 +101,24 @@
];
};
# galadriel
nixosConfigurations.galadriel = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit inputs system; };
specialArgs = { inherit inputs; };
modules = [
{
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
];
}
./hosts/galadriel/configuration.nix
sops-nix.nixosModules.sops
lanzaboote.nixosModules.lanzaboote
] ++ headlessHmModules;
];
};
# elros
nixosConfigurations.elros = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit inputs system; };
modules = [
{
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
];
}
./hosts/elros/configuration.nix
sops-nix.nixosModules.sops
lanzaboote.nixosModules.lanzaboote
] ++ headlessHmModules;
};
# elrond
nixosConfigurations.elrond = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = { inherit inputs system; };
modules = [
{
nixpkgs.config.allowUnfree = true;
nixpkgs.overlays = [
self.overlays.custom
self.overlays.unstable
];
}
./hosts/elrond/configuration.nix
sops-nix.nixosModules.sops
lanzaboote.nixosModules.lanzaboote
] ++ headlessHmModules;
};
};
}
home/Wallpapers/evergarden-telescope-2.jpg
BIN
View File
Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 203 KiB

home/aider.nix
-36
View File
@@ -1,36 +0,0 @@
{
pkgs,
lib,
unstable,
config,
...
}:
{
home.packages = with pkgs; [
#aider-chat-full
];
programs.aider-chat = {
enable = true;
package = pkgs.unstable.aider-chat-with-playwright;
settings = {
architect = true;
auto-accept-architect = false;
cache-prompts = true;
check-model-accepts-settings = false;
dark-mode = true;
dirty-commits = false;
lint = true;
show-model-warnings = false;
verify-ssl = false;
watch-files = true;
analytics-disable = true;
check-update = false;
multiline = true;
notifications = true;
show-diffs = true;
};
};
}
home/applications.nix
-49
View File
@@ -1,49 +0,0 @@
{ pkgs, ... }:
{
home.packages = with pkgs; [
bitwarden-cli
fluffychat
vesktop
firefox
nautilus
gimp
feh
gparted
libreoffice-fresh
kdePackages.okular
audacity
openvpn
pandoc
typst
texliveMedium
prusa-slicer
freecad-wayland
openscad-unstable
unstable.kicad
mpv
spotify
spotify-tray
rclone
distrobox
boxbuddy
dbeaver-bin
sqlite
sqlitebrowser
bibletime
thunderbird
prismlauncher
qbittorrent
kdePackages.filelight
solaar
cheese
wireguard-tools
piper-tts
yt-dlp
tealdeer
clipboard-jh
ydotool
wl-mirror
];
}
home/bash.nix
+3 -6
View File
@@ -13,7 +13,6 @@
"ai/cerebras" = { };
"ai/groq" = { };
"ai/mistral" = { };
"ai/zai" = { };
};
programs.bash = {
enable = true;
@@ -49,8 +48,6 @@
export CEREBRAS_API_KEY="$(cat ${config.sops.secrets."ai/cerebras".path})"
export GROQ_API_KEY="$(cat ${config.sops.secrets."ai/groq".path})"
export MISTRAL_API_KEY="$(cat ${config.sops.secrets."ai/mistral".path})"
export ZAI_API_KEY="$(cat ${config.sops.secrets."ai/zai".path})"
export ZAI_API_BASE="https://api.z.ai/api/coding/paas/v4"
#PS1 section
@@ -62,18 +59,18 @@
YELLOW='\[\e[33m\]'
MAGENTA='\[\e[35m\]'
RED='\[\e[31m\]'
if [[ -n "$SSH_CONNECTION" ]]; then
REMOTE_LABEL="\[''${YELLOW}\] (ssh)\[''${RESET}\]"
else
REMOTE_LABEL=""
fi
# Git branch function
parse_git_branch() {
git branch --show-current 2>/dev/null | awk '{print " (" $1 ")"}'
}
# Set prompt
if [[ $EUID -eq 0 ]]; then
PS1="''${BOLD}''${RED}\u''${RESET}:''${BOLD}''${RED}\h''${REMOTE_LABEL}''${RESET}:''${BOLD}''${GREEN}\w''${MAGENTA}\$(parse_git_branch) ''${BLUE}\A''${RESET}\$ "
home/colors.nix
+237 -36
View File
@@ -6,10 +6,150 @@
...
}:
let
nix-colors-lib = nix-colors.lib.contrib { inherit pkgs; };
c = config.colorScheme.palette; # Access palette colors
# Generate comprehensive CSS overrides using your color palette
gtkColorOverrides = ''
/* UI Colors - Main variables */
@define-color accent_bg_color #${c.base0D};
@define-color accent_fg_color #${c.base07};
@define-color accent_color #${c.base0D};
@define-color destructive_bg_color #${c.base08};
@define-color destructive_fg_color #${c.base07};
@define-color destructive_color #${c.base08};
@define-color success_bg_color #${c.base0B};
@define-color success_fg_color #${c.base07};
@define-color success_color #${c.base0B};
@define-color warning_bg_color #${c.base0A};
@define-color warning_fg_color #${c.base00};
@define-color warning_color #${c.base0A};
@define-color error_bg_color #${c.base08};
@define-color error_fg_color #${c.base07};
@define-color error_color #${c.base08};
/* Window Colors */
@define-color window_bg_color #${c.base00};
@define-color window_fg_color #${c.base05};
/* View Colors */
@define-color view_bg_color #${c.base00};
@define-color view_fg_color #${c.base05};
/* Header Bar Colors */
@define-color headerbar_bg_color #${c.base01};
@define-color headerbar_fg_color #${c.base05};
@define-color headerbar_border_color #${c.base03};
@define-color headerbar_backdrop_color #${c.base00};
@define-color headerbar_shade_color rgba(0, 0, 0, 0.12);
@define-color headerbar_darker_shade_color rgba(0, 0, 0, 0.12);
/* Sidebar Colors */
@define-color sidebar_bg_color #${c.base01};
@define-color sidebar_fg_color #${c.base05};
@define-color sidebar_backdrop_color #${c.base00};
@define-color sidebar_border_color rgba(0, 0, 0, 0.07);
@define-color sidebar_shade_color rgba(0, 0, 0, 0.07);
/* Card Colors */
@define-color card_bg_color #${c.base01};
@define-color card_fg_color #${c.base05};
@define-color card_shade_color rgba(0, 0, 0, 0.07);
/* Dialog Colors */
@define-color dialog_bg_color #${c.base01};
@define-color dialog_fg_color #${c.base05};
/* Popover Colors */
@define-color popover_bg_color #${c.base01};
@define-color popover_fg_color #${c.base05};
@define-color popover_shade_color rgba(0, 0, 0, 0.07);
/* Miscellaneous Colors */
@define-color shade_color rgba(0, 0, 0, 0.07);
@define-color scrollbar_outline_color #${c.base07};
/* Palette Colors */
@define-color blue_1 #99c1f1;
@define-color blue_2 #62a0ea;
@define-color blue_3 #3584e4;
@define-color blue_4 #1c71d8;
@define-color blue_5 #1a5fb4;
@define-color green_1 #8ff0a4;
@define-color green_2 #57e389;
@define-color green_3 #33d17a;
@define-color green_4 #2ec27e;
@define-color green_5 #26a269;
@define-color yellow_1 #f9f06b;
@define-color yellow_2 #f8e45c;
@define-color yellow_3 #f6d32d;
@define-color yellow_4 #f5c211;
@define-color yellow_5 #e5a50a;
@define-color orange_1 #ffbe6f;
@define-color orange_2 #ffa348;
@define-color orange_3 #ff7800;
@define-color orange_4 #e66100;
@define-color orange_5 #c64600;
@define-color red_1 #f66151;
@define-color red_2 #ed333b;
@define-color red_3 #e01b24;
@define-color red_4 #c01c28;
@define-color red_5 #a51d2d;
@define-color purple_1 #dc8add;
@define-color purple_2 #c061cb;
@define-color purple_3 #9141ac;
@define-color purple_4 #813d9c;
@define-color purple_5 #613583;
@define-color brown_1 #cdab8f;
@define-color brown_2 #b5835a;
@define-color brown_3 #986a44;
@define-color brown_4 #865e3c;
@define-color brown_5 #63452c;
@define-color light_1 #ffffff;
@define-color light_2 #f6f5f4;
@define-color light_3 #deddda;
@define-color light_4 #c0bfbc;
@define-color light_5 #9a9996;
@define-color dark_1 #77767b;
@define-color dark_2 #5e5c64;
@define-color dark_3 #3d3846;
@define-color dark_4 #241f31;
@define-color dark_5 #000000;
/* Compatibility Colors */
@define-color theme_bg_color #${c.base00};
@define-color theme_fg_color #${c.base05};
@define-color theme_base_color #${c.base00};
@define-color theme_text_color #${c.base05};
@define-color theme_selected_bg_color #${c.base0D};
@define-color theme_selected_fg_color #${c.base07};
@define-color insensitive_bg_color #${c.base01};
@define-color insensitive_fg_color #${c.base03};
@define-color insensitive_base_color #${c.base00};
@define-color borders rgba(0, 0, 0, 0.15);
@define-color theme_unfocused_bg_color #${c.base00};
@define-color theme_unfocused_fg_color #${c.base05};
@define-color theme_unfocused_base_color #${c.base00};
@define-color theme_unfocused_text_color #${c.base05};
@define-color theme_unfocused_selected_bg_color #${c.base0D};
@define-color theme_unfocused_selected_fg_color #${c.base07};
@define-color unfocused_insensitive_color #${c.base01};
@define-color unfocused_borders rgba(0, 0, 0, 0.15);
/* Standard GTK Colors */
@define-color bg_color #${c.base00};
@define-color fg_color #${c.base05};
@define-color base_color #${c.base00};
@define-color text_color #${c.base05};
@define-color selected_bg_color #${c.base0D};
@define-color selected_fg_color #${c.base07};
@define-color tooltip_bg_color #${c.base01};
@define-color tooltip_fg_color #${c.base05};
'';
in
{
imports = [
nix-colors.homeManagerModules.default
];
imports = [ nix-colors.homeManagerModules.default ];
colorScheme = {
slug = "teal-green-dark";
@@ -17,40 +157,101 @@
author = "Adrian";
palette = {
# Base16 Teal‐Green Dark Theme - Enhanced Teal Version
# base00 = "0c1f1d"; # Default background - deeper teal base
# base01 = "12302d"; # Lighter background (status bars)
# base02 = "1c3b38"; # Selection background
# base03 = "26514d"; # Comments, secondary content
# base04 = "447b76"; # Dark foreground (status bars)
# base05 = "c4e5e0"; # Default foreground
# base06 = "d4f0ed"; # Light foreground
# base07 = "f0fbfa"; # Lightest background
# base08 = "5fcac0"; # Variables, markup link text - teal accent
# base09 = "40bfa5"; # Integers, constants - teal-green
# base0A = "60d5b0"; # Classes, search highlight - bright teal
# base0B = "40c0a0"; # Strings, inserted - true teal (less green)
# base0C = "30d0c0"; # Support, escape characters - cyan-teal
# base0D = "2aa198"; # Functions, headings - classic teal
# base0E = "3cb4ac"; # Keywords, selectors - teal-blue
# base0F = "70d0c0"; # Deprecated tags - light teal
base00 = "0c1f1d"; # Default background - deeper teal base
base01 = "12302d"; # Lighter background (status bars)
base02 = "1c3b38"; # Selection background
base03 = "26514d"; # Comments, secondary content
base04 = "447b76"; # Dark foreground (status bars)
base05 = "c4e5e0"; # Default foreground
base06 = "d4f0ed"; # Light foreground
base07 = "f0fbfa"; # Lightest background
base08 = "5fcac0"; # Variables, markup link text - teal accent
base09 = "40bfa5"; # Integers, constants - teal-green
base0A = "60d5b0"; # Classes, search highlight - bright teal
base0B = "40c0a0"; # Strings, inserted - true teal (less green)
base0C = "30d0c0"; # Support, escape characters - cyan-teal
base0D = "2aa198"; # Functions, headings - classic teal
base0E = "3cb4ac"; # Keywords, selectors - teal-blue
base0F = "70d0c0"; # Deprecated tags - light teal
## catppuccin mocha based
base00 = "0b1c1a"; # Default background — deeper teal-dark background
base01 = "153532"; # Lighter background / status bars
base02 = "1b3d39"; # Selection background / line highlight
base03 = "275454"; # Comments, secondary UI elements
base04 = "6f7389"; # Dark foreground / secondary text
base05 = "95a0b8"; # Default foreground / main text
base06 = "a8b2ce"; # Light foreground / lighter UI elements
base07 = "ccdffa"; # Lightest background / highlight background
base08 = "f38ba8"; # Errors, alerts — red-pink accent
base09 = "e0a878"; # Numbers, constants — muted peach/orange
base0A = "b8c071"; # Warnings, highlights — golden-yellow
base0B = "4fbf93"; # Strings, inserts — teal-green
base0C = "2ac5c2"; # Support, escape/sequences — cyan-teal
base0D = "2fa6b0"; # Functions, types — classic teal-blue
base0E = "c7a8f5"; # Keywords, special — soft magenta/purple
base0F = "b2b4cf"; # Deprecated / special tags — light cool grey-lavender
};
};
# GTK configuration with custom theme
gtk = {
enable = true;
iconTheme = {
name = "Papirus-Dark";
package = pkgs.papirus-icon-theme;
};
cursorTheme = {
name = "Adwaita-Dark";
package = pkgs.adwaita-icon-theme;
size = 24;
};
gtk2.extraConfig = ''
style "custom-dark" {
bg[NORMAL] = "#${c.base00}"
bg[PRELIGHT] = "#${c.base02}"
bg[ACTIVE] = "#${c.base01}"
bg[SELECTED] = "#${c.base0D}"
bg[INSENSITIVE] = "#${c.base01}"
fg[NORMAL] = "#${c.base05}"
fg[PRELIGHT] = "#${c.base06}"
fg[ACTIVE] = "#${c.base07}"
fg[SELECTED] = "#${c.base07}"
fg[INSENSITIVE] = "#${c.base03}"
base[NORMAL] = "#${c.base01}"
base[PRELIGHT] = "#${c.base02}"
base[ACTIVE] = "#${c.base0D}"
base[SELECTED] = "#${c.base0D}"
base[INSENSITIVE] = "#${c.base00}"
text[NORMAL] = "#${c.base05}"
text[PRELIGHT] = "#${c.base06}"
text[ACTIVE] = "#${c.base07}"
text[SELECTED] = "#${c.base07}"
text[INSENSITIVE] = "#${c.base03}"
}
widget_class "*" style "custom-dark"
gtk-application-prefer-dark-theme="true"
'';
gtk3.extraConfig = {
gtk-application-prefer-dark-theme = true;
};
gtk4.extraConfig = {
gtk-application-prefer-dark-theme = true;
};
# Inject comprehensive color overrides for GTK 3
gtk3.extraCss = gtkColorOverrides;
# Inject comprehensive color overrides for GTK 4
gtk4.extraCss = gtkColorOverrides;
};
dconf.settings = {
"org/gnome/desktop/interface" = {
color-scheme = "prefer-dark";
icon-theme = "Papirus-Dark";
};
};
home.packages = with pkgs; [
papirus-icon-theme
gnome-themes-extra
adwaita-icon-theme
];
qt = {
enable = true;
#platformTheme.name = "gtk";
platformTheme.name = "gtk3";
style.name = "gtk2";
};
}
modules/fcitx5.nix → home/fcitx5.nix
+25 -24
View File
@@ -1,28 +1,38 @@
{ pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
# System-level fcitx5 configuration for Wayland
# This prevents GTK_IM_MODULE from being set, which is recommended for Wayland
i18n.inputMethod = {
enable = true;
type = "fcitx5";
fcitx5 = {
waylandFrontend = true;
addons = with pkgs; [
fcitx5-rime
fcitx5-mozc
fcitx5-gtk
fcitx5-configtool
fcitx5-material-color # Add the theme package
];
settings = {
# Correct hotkey section:
globalOptions.Hotkey = {
TriggerKey = "Control+space";
};
# Addon settings for the theme
addons.classicui = {
globalSection = {
Theme = "Material-Color-Dark";
DarkTheme = "Material-Color-Dark";
UseDarkTheme = true;
};
};
inputMethod = {
GroupOrder."0" = "Default";
"Groups/0" = {
Name = "Default";
"Default Layout" = "us";
DefaultIM = "mozc";
"DefaultIM" = "keyboard-us";
};
"Groups/0/Items/0" = {
Name = "keyboard-us";
@@ -36,21 +46,12 @@
Name = "keyboard-no";
Layout = "no";
};
"Groups" = {
GroupOrder = "Default";
};
};
};
addons = with pkgs; [
fcitx5-rime
fcitx5-mozc
fcitx5-gtk
qt6Packages.fcitx5-configtool
];
};
};
# Ensure fcitx5 starts with the session
services.xserver.desktopManager.runXdgAutostartIfNone = true;
# environment.sessionVariables = {
# GTK_IM_MODULE = lib.mkForce "";
# };
}
home/fonts.nix
-1
View File
@@ -25,7 +25,6 @@
nerd-fonts.noto
nerd-fonts.hack
nerd-fonts.fira-code
zpix-pixel-font
font-awesome_4
home/foot.nix
+26 -24
View File
@@ -5,43 +5,45 @@
...
}:
{
home.packages = with pkgs; [ foot ];
programs.foot.enable = true;
programs.foot.settings = {
main = {
term = "xterm-256color";
#font = "0xproto:size=14";
font = "0xproto:size=14";
#dpi-aware = "yes";
};
mouse = {
hide-when-typing = "yes";
};
#colors = {
#alpha = "0.7";
#foreground = "${config.colorScheme.palette.base05}";
#background = "${config.colorScheme.palette.base00}";
colors = {
alpha = "0.7";
foreground = "${config.colorScheme.palette.base05}";
background = "${config.colorScheme.palette.base00}";
#regular0 = "${config.colorScheme.palette.base00}";
#regular1 = "${config.colorScheme.palette.base08}";
#regular2 = "${config.colorScheme.palette.base0B}";
#regular3 = "${config.colorScheme.palette.base0A}";
#regular4 = "${config.colorScheme.palette.base0D}";
#regular5 = "${config.colorScheme.palette.base0E}";
#regular6 = "${config.colorScheme.palette.base0C}";
#regular7 = "${config.colorScheme.palette.base05}";
regular0 = "${config.colorScheme.palette.base00}";
regular1 = "${config.colorScheme.palette.base08}";
regular2 = "${config.colorScheme.palette.base0B}";
regular3 = "${config.colorScheme.palette.base0A}";
regular4 = "${config.colorScheme.palette.base0D}";
regular5 = "${config.colorScheme.palette.base0E}";
regular6 = "${config.colorScheme.palette.base0C}";
regular7 = "${config.colorScheme.palette.base05}";
#bright0 = "${config.colorScheme.palette.base03}";
#bright1 = "${config.colorScheme.palette.base08}";
#bright2 = "${config.colorScheme.palette.base0B}";
#bright3 = "${config.colorScheme.palette.base0A}";
#bright4 = "${config.colorScheme.palette.base0D}";
#bright5 = "${config.colorScheme.palette.base0E}";
#bright6 = "${config.colorScheme.palette.base0C}";
#bright7 = "${config.colorScheme.palette.base07}";
#selection-foreground = "${config.colorScheme.palette.base00}";
#selection-background = "${config.colorScheme.palette.base0A}";
#};
bright0 = "${config.colorScheme.palette.base03}";
bright1 = "${config.colorScheme.palette.base08}";
bright2 = "${config.colorScheme.palette.base0B}";
bright3 = "${config.colorScheme.palette.base0A}";
bright4 = "${config.colorScheme.palette.base0D}";
bright5 = "${config.colorScheme.palette.base0E}";
bright6 = "${config.colorScheme.palette.base0C}";
bright7 = "${config.colorScheme.palette.base07}";
selection-foreground = "${config.colorScheme.palette.base00}";
selection-background = "${config.colorScheme.palette.base0A}";
};
};
home/git.nix
+1 -1
View File
@@ -7,7 +7,7 @@
{
programs.git = {
enable = true;
settings = {
extraConfig = {
pull.rebase = true;
push.autoSetupRemote = true;
color.ui = "auto";
home/gtklock.nix
+84
View File
@@ -0,0 +1,84 @@
{
pkgs,
config,
lib,
...
}:
let
p = config.colorScheme.palette;
# Get files from ./Wallpapers relative to this flake/module
wallpapersPath = ./Wallpapers;
# Get all image file names
wallpaperFiles = builtins.attrNames (builtins.readDir wallpapersPath);
# Pick a "random" file (first one deterministically)
selectedWallpaper = builtins.elemAt wallpaperFiles 0;
# Define the path to copy the selected wallpaper to
wallpaperTargetPath = ".config/gtklock/${selectedWallpaper}";
in
{
# Install gtklock
home.packages = [
pkgs.gtklock
];
# Copy the selected wallpaper into the config dir
home.file.${wallpaperTargetPath}.source = "${wallpapersPath}/${selectedWallpaper}";
# GTKlock config
xdg.configFile."gtklock/config.ini".text = ''
[main]
# Plugins/configuration here
'';
# GTK CSS styling
xdg.configFile."gtklock/style.css".text = ''
window {
background-image: url("${config.xdg.configHome}/gtklock/${selectedWallpaper}");
background-size: cover;
background-repeat: no-repeat;
background-position: center;
background-color: #${p.base00};
}
label {
color: #${p.base05};
font-weight: bold;
font-size: 16px;
}
entry {
background-color: #${p.base01};
color: #${p.base06};
border: none;
padding: 8px;
border-radius: 4px;
}
button {
background-color: #${p.base02};
color: #${p.base05};
border-radius: 6px;
padding: 6px 12px;
font-weight: bold;
font-size: 14px;
border-width: 2px;
border-style: solid;
border-color: #${p.base0D};
}
button:hover {
background-color: #${p.base03};
border-color: #${p.base0C};
}
button:active {
background-color: #${p.base0D};
color: #${p.base00};
}
'';
}
home/gunalx-headless.nix
-31
View File
@@ -1,31 +0,0 @@
{
pkgs,
lib,
inputs,
...
}:
{
imports = [
./sshconfig.nix
./atuin.nix
./git.nix
./bash.nix
./opencode.nix
./nixvim.nix
inputs.sops-nix.homeManagerModules.sops
./sops.nix
];
programs.nix-index = {
enableBashIntegration = true;
enable = true;
};
home.packages = with pkgs; [
comma
];
home.stateVersion = "25.05";
}
home/gunalx.nix
+15 -11
View File
@@ -10,27 +10,27 @@
./atuin.nix
./git.nix
./bash.nix
#./xdg.nix
# theming
./colors.nix
./stylix.nix
./xdg.nix
#graphical
#./fuzzel.nix #depracted by noctalia v5 now with fuzzy search as well
./colors.nix
./fuzzel.nix
./swaylock.nix
./gtklock.nix
./swayidle.nix
./waybar.nix
./wlogout.nix
./niri.nix
./noctalia.nix
./wallpapers.nix
./swww.nix
./fonts.nix
#applications
#./mako.nix # superseeded by noctalia
./mako.nix
./foot.nix
./zed.nix
./opencode.nix
./nixvim.nix
./applications.nix
./neovim.nix
./fcitx5.nix
./python.nix
@@ -45,6 +45,10 @@
};
home.packages = with pkgs; [
bottom
fastfetch
eza
ripgrep
foot.terminfo
comma
];
home/mako.nix
-7
View File
@@ -46,12 +46,5 @@ in
border-color = "#${palette.base08}FF";
};
settings."mode=silent" = {
invisible = 1;
actions = false;
icons = false;
default-timeout = 0;
};
};
}
home/neovim.nix
+51
View File
@@ -0,0 +1,51 @@
{ pkgs, ... }:
{
programs.neovim = {
enable = true;
viAlias = true;
vimAlias = true;
defaultEditor = true;
withPython3 = true;
withNodeJs = true;
extraConfig = ''
set backspace=indent,eol,start
syntax on
set tabstop=2 softtabstop=0 autoindent expandtab shiftwidth=2 smarttab
" Use <Tab> completion instead of ctrl n and ctrl p
inoremap <expr> <Tab> pumvisible() ? "\<C-y>" : "\<Tab>"
inoremap <expr> <S-Tab> "\<Tab>"
'';
extraLuaConfig = ''
vim.wo.number = true
-- vim.wo.relativenumber = true
vim.api.nvim_set_option("clipboard", "unnamedplus")
'';
extraPackages = [ pkgs.fzf ]; # For fzf-vim functionality
plugins = with pkgs.vimPlugins; [
vim-nix
vim-lastplace
vim-yaml
fzf-vim
chadtree
typst-vim
typst-preview-nvim
aider-nvim
#magma-nvim #jupyter
#molten-nvim #jupyter
];
# CoC configuration (replacing coc-rust-analyzer plugin)
coc.enable = true;
coc.settings = {
"coc.globalExtensions" = [
"coc-rust-analyzer"
];
};
};
}
home/niri.nix
+640 -638
View File
File diff suppressed because it is too large Load Diff
home/nixvim.nix
-232
View File
@@ -1,232 +0,0 @@
{ pkgs, inputs, ... }:
{
programs.nixvim = {
enable = true;
viAlias = true;
vimAlias = true;
defaultEditor = true;
# Pin nixvim's nixpkgs to our flake's nixpkgs (shared via `follows`).
# Explicitly setting this suppresses nixvim's follows-mismatch warning.
nixpkgs.source = inputs.nixpkgs;
withPython3 = true;
extraPython3Packages = ps: [ ps.pylatexenc ];
extraPackages = with pkgs; [
xclip
tree-sitter
imagemagick
];
globals.mapleader = " ";
opts = {
number = true;
relativenumber = true;
tabstop = 4;
softtabstop = 0;
shiftwidth = 4;
expandtab = true;
smarttab = true;
autoindent = true;
backspace = [
"indent"
"eol"
"start"
];
mouse = "a";
clipboard = "unnamedplus";
};
userCommands = {
E = {
command = "Oil";
desc = "Open oil file explorer";
};
};
plugins = {
web-devicons.enable = true;
treesitter = {
enable = true;
settings = {
highlight.enable = true;
indent.enable = true;
ensure_installed = [
"markdown"
"markdown_inline"
"latex"
"yaml"
"bash"
"rust"
"nix"
"lua"
];
};
};
lsp = {
enable = true;
servers = {
rust_analyzer = {
enable = true;
installCargo = true;
installRustc = true;
};
nil_ls.enable = true;
lua_ls.enable = true;
yamlls.enable = true;
};
};
cmp-nvim-lsp.enable = true;
cmp-buffer.enable = true;
cmp-path.enable = true;
cmp = {
enable = true;
autoEnableSources = true;
settings = {
mapping = {
"<Tab>" = "cmp.mapping.select_next_item()";
"<S-Tab>" = "cmp.mapping.select_prev_item()";
"<CR>" = "cmp.mapping.confirm({ select = true })";
"<C-Space>" = "cmp.mapping.complete()";
"<C-e>" = "cmp.mapping.abort()";
};
sources = [
{ name = "nvim_lsp"; }
{ name = "path"; }
{ name = "buffer"; }
];
};
};
telescope = {
enable = true;
keymaps = {
"<leader>ff" = "find_files";
"<leader>fg" = "live_grep";
"<leader>fb" = "buffers";
};
};
oil = {
enable = true;
settings = {
default_file_explorer = true;
columns = [ "icon" ];
view_options.show_hidden = false;
preview_win = {
update_on_cursor_moved = true;
};
keymaps = {
"<C-p>" = "actions.preview";
"-" = "actions.parent";
};
};
};
render-markdown = {
enable = true;
settings = {
latex = {
enabled = true;
converter = "latex2text";
highlight = "RenderMarkdownMath";
top_pad = 0;
bottom_pad = 0;
};
};
};
markdown-preview.enable = true;
vimtex.enable = true;
typst-vim.enable = true;
typst-preview.enable = true;
lastplace.enable = true;
indent-blankline.enable = true;
nix.enable = true;
clipboard-image = {
enable = true;
clipboardPackage = pkgs.wl-clipboard;
settings = {
default = {
img_dir = "assets";
img_dir_txt = "assets";
affix = "![]({img_path})";
};
};
};
image.enable = true;
};
extraConfigLua = ''
require("image").setup({
backend = "sixel",
processor = "magick_cli",
integrations = {
markdown = {
enabled = true,
only_render_image_at_cursor = true,
only_render_image_at_cursor_mode = "popup",
},
typst = {
enabled = true,
},
},
max_height_window_percentage = 50,
hijack_file_patterns = { "*.png", "*.jpg", "*.jpeg", "*.gif", "*.webp", "*.avif" },
})
'';
keymaps = [
{
mode = "n";
key = "<leader>e";
action = "<cmd>Oil<CR>";
options.desc = "Open oil file explorer";
}
{
mode = "n";
key = "<leader>m";
action = "<cmd>MarkdownPreviewToggle<CR>";
options.desc = "Toggle markdown preview";
}
{
mode = "n";
key = "<leader>fm";
action = "<cmd>lua vim.lsp.buf.format()<CR>";
options.desc = "Format with LSP";
}
{
mode = "n";
key = "<leader>bn";
action = "<cmd>bnext<CR>";
options.desc = "Next buffer";
}
{
mode = "n";
key = "<leader>bp";
action = "<cmd>bprev<CR>";
options.desc = "Previous buffer";
}
{
mode = "n";
key = "<leader>bd";
action = "<cmd>bdelete<CR>";
options.desc = "Delete buffer";
}
{
mode = "n";
key = "<leader>bN";
action = "<cmd>enew<CR>";
options.desc = "New buffer";
}
];
};
}
home/noctalia.nix
-392
View File
@@ -1,392 +0,0 @@
{
pkgs,
config,
lib,
...
}:
let
paletteName = "custom-teal";
p = config.colorScheme.palette;
hex = c: "#${c}";
noctaliaPalette = {
dark = {
mPrimary = hex p.base0D;
mOnPrimary = hex p.base00;
mSecondary = hex p.base0B;
mOnSecondary = hex p.base00;
mTertiary = hex p.base0C;
mOnTertiary = hex p.base00;
mError = hex p.base08;
mOnError = hex p.base00;
mSurface = hex p.base00;
mOnSurface = hex p.base05;
mSurfaceVariant = hex p.base01;
mOnSurfaceVariant = hex p.base04;
mOutline = hex p.base03;
mShadow = hex p.base00;
mHover = hex p.base02;
mOnHover = hex p.base06;
terminal = {
background = hex p.base00;
foreground = hex p.base05;
cursor = hex p.base05;
cursorText = hex p.base00;
selectionBg = hex p.base02;
selectionFg = hex p.base05;
normal = {
black = hex p.base00;
red = hex p.base08;
green = hex p.base0B;
yellow = hex p.base0A;
blue = hex p.base0D;
magenta = hex p.base0E;
cyan = hex p.base0C;
white = hex p.base05;
};
bright = {
black = hex p.base03;
red = hex p.base08;
green = hex p.base0B;
yellow = hex p.base0A;
blue = hex p.base0D;
magenta = hex p.base0E;
cyan = hex p.base0C;
white = hex p.base07;
};
};
};
};
outputs = [
"eDP-1"
"DP-1"
"DP-2"
"DP-3"
"HDMI-A-1"
"HDMI-A-2"
"HDMI-A-3"
];
mkLockscreenWidgets =
outputs:
let
widgetTemplates = {
"lockscreen-login-box" = {
box_height = 0.0;
box_width = 0.0;
cx = 960.0;
cy = 832.0;
rotation = 0.0;
type = "login_box";
settings = {
background_opacity = 0.2;
input_opacity = 0.85;
input_radius = 32.0;
show_login_button = true;
};
};
"lockscreen-widget-clock" = {
box_height = 272.0;
box_width = 544.0;
cx = 960.0;
cy = 432.0;
rotation = 0.0;
type = "clock";
settings = {
background = true;
background_color = "surface_variant";
background_opacity = 0.20;
background_padding = 0.0;
background_radius = 32.0;
clock_style = "digital";
color = "primary";
shadow = true;
};
};
"lockscreen-widget-media" = {
box_height = 288.0;
box_width = 320.0;
cx = 1632.0;
cy = 864.0;
rotation = 0.0;
type = "media_player";
settings = {
background = false;
hide_when_no_media = true;
layout = "vertical";
shadow = true;
};
};
"lockscreen-widget-audio" = {
box_height = 288.0;
box_width = 320.0;
cx = 288.0;
cy = 864.0;
rotation = 0.0;
type = "audio_visualizer";
settings = {
aspect_ratio = 2.5;
background = false;
bands = 32;
low_color = "primary";
show_when_idle = false;
};
};
"lockscreen-widget-weather" = {
box_height = 112.0;
box_width = 480.0;
cx = 960.0;
cy = 672.0;
rotation = 0.0;
type = "weather";
settings = {
background = false;
color = "primary";
};
};
};
widgetIds = builtins.attrNames widgetTemplates;
perOutput =
output:
let
suffixedId = base: "${base}@${output}";
in
builtins.listToAttrs (
map (id: {
name = suffixedId id;
value = widgetTemplates.${id} // {
output = output;
};
}) widgetIds
);
allWidgets = builtins.foldl' (acc: output: acc // (perOutput output)) { } outputs;
allOrder = builtins.concatLists (map (output: map (id: "${id}@${output}") widgetIds) outputs);
in
{
enabled = true;
schema_version = 2;
widget_order = allOrder;
grid = {
cell_size = 16;
major_interval = 4;
visible = true;
};
widget = allWidgets;
};
in
{
programs.noctalia = {
enable = true;
customPalettes.${paletteName} = noctaliaPalette;
settings = {
shell = {
animation.enabled = false;
date_format = "%Y-%m-%d";
setup_wizard_enabled = false;
panel = {
transparency_mode = "glass"; # solid | soft | glass;
# open all panels attached to the bar, near the click position
launcher_placement = "center";
clipboard_placement = "attached";
control_center_placement = "attached";
wallpaper_placement = "attached";
session_placement = "attached";
open_near_click_launcher = true;
open_near_click_clipboard = true;
open_near_click_control_center = true;
open_near_click_wallpaper = true;
open_near_click_session = true;
};
screenshot = {
directory = "~/Pictures/screenshots/";
filename_pattern = "screenshot-%Y-%m-%d %H-%M-%S.png";
copy_to_clipboard = true;
freeze_screen = true;
pipe_to_command = false;
pipe_command = "";
};
};
bar = {
order = [ "main" ];
main = {
position = "top";
enabled = true;
auto_hide = false;
reserve_space = true;
layer = "top";
thickness = 32;
background_opacity = 0.8;
border = "outline";
border_width = 0.0;
shadow = true;
contact_shadow = false;
panel_overlap = 0;
radius = 24;
radius_top_left = 0;
radius_top_right = 0;
radius_bottom_left = 24;
radius_bottom_right = 24;
margin_ends = 80;
margin_edge = 0; # 0 to disable floating
padding = 14;
widget_spacing = 6;
scale = 1.0;
font_weight = "regular";
capsule = false;
capsule_fill = "surface_variant";
capsule_radius = 8.0;
capsule_opacity = 1.0;
start = [
"osk"
"launcher"
"spacer"
"sysmon"
"media"
"spacer"
"workspaces"
];
center = [ "active_window" ];
end = [
"clock"
"tray"
"notifications"
"battery"
"brightness"
"volume"
"bluetooth"
"network"
"control-center"
#"session"
];
};
};
widget = {
tray = {
hidden = [ ];
pinned = [ ];
drawer = true;
drawer_columns = 3;
};
media = {
min_length = 80;
max_length = 220;
art_size = 24;
title_scroll = "on_hover";
hide_when_no_media = true;
};
osk = {
type = "custom_button";
glyph = "keyboard";
actions = {
left = "exec pkill wvkbd-mobintl || wvkbd-mobintl --bg 00000099 -L 200 -R 15 &";
right = "keyboard-layout-cycle";
scroll_down = "keyboard-backlight-down";
scroll_up = "keyboard-backlight-up";
};
};
};
plugins = {
auto_update = true;
enabled = [
"noctalia/bitwarden"
"noctalia/notes"
"noctalia/translator"
"alexander/mimir"
"elijaharch/wl-screen-mirror"
"pozzoo/hassio"
"yocraft/web-launcher"
"nightwatch75/todo"
"icefish/phone-connect"
];
source = [
{
name = "official";
kind = "git";
location = "https://github.com/noctalia-dev/official-plugins";
enabled = true;
}
{
name = "community";
kind = "git";
location = "https://github.com/noctalia-dev/community-plugins";
enabled = true;
}
];
};
plugin_settings = {
"alexander/mimir" = {
api_endpoint = "http://galadriel:11112/v1";
};
};
theme = {
mode = "dark";
source = "custom";
custom_palette = paletteName;
};
wallpaper = {
enabled = true;
fill_mode = "crop"; # center | crop | fit | stretch | repeat
fill_color = "#111111"; # optional fallback/fill color; image wallpapers take priority
transition = [
"fade"
"wipe"
#"disc"
"stripes"
#"zoom"
#"honeycomb"
];
transition_duration = 7500; # milliseconds
edge_smoothness = 0.3; # 0.0 – 1.0
transition_on_startup = false;
directory = "${config.home.homeDirectory}/Pictures/wallpapers"; # open in picker
per_monitor_directories = false;
default = {
path = "${config.home.homeDirectory}/Pictures/wallpapers/violet-evergarden-in-aurora-sky-wallpaper-1920x1200_6.jpg";
};
automation = {
enabled = true;
interval_seconds = 120;
order = "random"; # random | alphabetical
recursive = true; # subdirs
};
};
backdrop = {
enabled = true;
blur_intensity = 0.5; # 0.0 = no blur, 1.0 = maximum blur
tint_intensity = 0.3; # 0.0 = no tint, 1.0 = fully opaque tint
};
lockscreen_widgets = mkLockscreenWidgets outputs;
};
};
}
home/opencode.nix
-114
View File
@@ -1,114 +0,0 @@
{
pkgs,
lib,
unstable,
config,
...
}:
{
programs.opencode = {
package = pkgs.opencode;
enable = true;
enableMcpIntegration = true;
settings = {
model = "zai-coding-plan/glm-5.2";
small_model = "zai-coding-plan/glm-5.2";
autoshare = false;
autoupdate = false;
mcp = {
web-search-prime = {
type = "remote";
enabled = true;
url = "https://api.z.ai/api/mcp/web_search_prime/mcp";
headers = {
Authorization = "Bearer {env:ZAI_API_KEY}";
};
};
web-reader = {
type = "remote";
enabled = true;
url = "https://api.z.ai/api/mcp/web_reader/mcp";
headers = {
Authorization = "Bearer {env:ZAI_API_KEY}";
};
};
zread = {
type = "remote";
enabled = true;
url = "https://api.z.ai/api/mcp/zread/mcp";
headers = {
Authorization = "Bearer {env:ZAI_API_KEY}";
};
};
};
};
commands = {
commit = ''
# Commit Command
Create a git commit with proper message formatting following conventional commits.
Keep it simple and only have one simple commit line. If you need to know what was changed, look at the staged files, and the diffs of the relevant ones.
Usage: /commit [message]
'';
};
context = ''
### **General Project Guidelines**
#### **Separation of Concerns**
* Keep your code **loosely coupled** components/modules should only know about what they need.
* Maintain clear **separation between domain logic and business logic** ensure your domain layer is independent of infrastructure or framework specific details.
* Ensure **separation of data concerns** never mix UI data, business data, and domain entities in a single layer.
#### **Typing and Type Safety**
* **Always define types** explicitly for variables, parameters, and return values.
* Avoid using `any` if you're unsure about a type, lean on **unknown** or **generics** until you can define it properly.
* **Interfaces and Types** should be descriptive and reusable prefer interfaces for object shapes, and types for unions/intersections or specific business rules.
* Avoid overcomplicating types focus on clarity and consistency.
#### **Code Simplicity**
* Write **simple, understandable code** don't over engineer solutions unless absolutely necessary.
* Keep methods and functions **small and focused** follow the Single Responsibility Principle.
* **Comment only when necessary** to explain complex or non obvious patterns **no comments for simple or self explanatory code**.
#### **Production-Ready Code**
* Always write **production-grade code** optimize for maintainability, readability, and scalability.
* Ensure **robust error handling** catch edge cases, validate inputs, and handle exceptions gracefully.
#### **Framework and Library Usage**
* Use frameworks and libraries **where they make sense**, but avoid unnecessary dependencies, we usually want to keep dependencies down.
* Follow **framework best practices** for structure, state management, and lifecycle methods
* Keep **UI and business logic separate** don't directly tie your UI components to business logic; use hooks or services to handle interactions.
#### **Documentation**
* **Document key architecture decisions** especially if they are complex or non intuitive.
* Only document the **why** and **how** when it's not obvious avoid redundant or trivial comments.
* Keep your documentation to the developmentlog.md Make a new section, dont write to long, just briefely what needs to be documented.
#### **Performance Considerations**
* Optimize for **readability first**, then **performance** measure performance bottlenecks before optimizing.
* When optimizing, our first priority is finding arcitectural problems, then finding out ways to parralelize.
# General Rules
Keep things understandable for a software engineer. You dont need to over explain, and rather keep things a bit simpler. and tify.
Dont overly format your text as well. When writing plain text, markdown or similat, keep the writing in a human style with minimal formating, and good but simple explanations.
Be brief, you dont need to overly explain concepts or content that dont really need more explanation.
Tell the user where it takes wrong if the user does. You are allowed to think critically, and find problems in existing solutions, but start by asking, to get more clarification.
Dont do all the work for the user, rather let the user know where some help from them are needed. Some things are better done manually, and should not be done by you the assistant.
'';
};
}
home/python.nix
+22 -1
View File
@@ -1,6 +1,27 @@
{ pkgs, ... }:
{
home.packages = [
(pkgs.python3.withPackages (import ../modules/python-packages.nix))
(pkgs.python312.withPackages (ppkgs: [
ppkgs.uv
ppkgs.pip
ppkgs.numpy
ppkgs.sympy
ppkgs.scipy
ppkgs.matplotlib
ppkgs.requests
ppkgs.pandas
ppkgs.scikit-learn
ppkgs.nltk
ppkgs.huggingface-hub
ppkgs.flask
ppkgs.gunicorn
ppkgs.torch
ppkgs.opencv-python
ppkgs.pillow
ppkgs.keras
ppkgs.tqdm
ppkgs.ipykernel
]))
];
}
home/root.nix
-33
View File
@@ -1,33 +0,0 @@
{
pkgs,
lib,
inputs,
...
}:
{
imports = [
./sshconfig.nix
./atuin.nix
./git.nix
./bash.nix
./opencode.nix
./nixvim.nix
inputs.sops-nix.homeManagerModules.sops
./sops.nix
];
programs.nix-index = {
enableBashIntegration = true;
enable = true;
};
home.packages = with pkgs; [
comma
];
home.username = "root";
home.homeDirectory = "/root";
home.stateVersion = "25.05";
}
home/sops.nix
+2 -2
View File
@@ -3,8 +3,8 @@
sops = {
defaultSopsFile = ../secrets/secrets.yaml;
validateSopsFiles = false;
age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/nixos" ];
age.keyFile = "${config.home.homeDirectory}/.config/sops/age/key.txt";
age.sshKeyPaths = [ "/home/gunalx/.ssh/nixos" ];
age.keyFile = "/home/gunalx/.config/sops/age/key.txt";
age.generateKey = true;
# This is the actual specification of the secrets.
#secrets."myservice/my_subdir/my_secret" = {};
home/sshconfig.nix
+12 -8
View File
@@ -9,6 +9,7 @@
home.packages = with pkgs; [
openssh
ssh-askpass-fullscreen
sshfs
];
@@ -16,11 +17,10 @@
programs.ssh = {
enable = true;
enableDefaultConfig = false;
compression = true;
settings = {
matchBlocks = {
"*" = {
compression = true;
identityFile = [
"~/.ssh/nixos"
"~/.ssh/id_ed25519"
@@ -46,14 +46,18 @@
"garp.pbsds.net" = {
user = "adrlau";
proxyJump = "login.pvv.ntnu.no";
StrictHostKeyChecking = "no";
UserKnownHostsFile = "/dev/null";
extraOptions = {
StrictHostKeyChecking = "no";
UserKnownHostsFile = "/dev/null";
};
};
"bolle.pbsds.net" = {
user = "adrlau";
proxyJump = "login.pvv.ntnu.no";
StrictHostKeyChecking = "no";
UserKnownHostsFile = "/dev/null";
extraOptions = {
StrictHostKeyChecking = "no";
UserKnownHostsFile = "/dev/null";
};
};
#pvv
@@ -78,7 +82,7 @@
"galadriel" = {
port = 6969;
hostname = "100.110.96.125";
hostname = "100.84.215.84";
};
"gandalf" = {
home/stylix.nix
-61
View File
@@ -1,61 +0,0 @@
{ pkgs, config, ... }:
{
stylix = {
enable = true;
#autoEnable = false;
#targets.gtk.enable = true;
#targets.qt.enable = true;
#manually disable stuff i have done manually
targets.mako.enable = false;
#targets.foot.enable = false;
targets.fuzzel.enable = false;
targets.zed.enable = false;
base16Scheme = {
scheme = config.colorScheme.name;
author = config.colorScheme.author;
base00 = config.colorScheme.palette.base00;
base01 = config.colorScheme.palette.base01;
base02 = config.colorScheme.palette.base02;
base03 = config.colorScheme.palette.base03;
base04 = config.colorScheme.palette.base04;
base05 = config.colorScheme.palette.base05;
base06 = config.colorScheme.palette.base06;
base07 = config.colorScheme.palette.base07;
base08 = config.colorScheme.palette.base08;
base09 = config.colorScheme.palette.base09;
base0A = config.colorScheme.palette.base0A;
base0B = config.colorScheme.palette.base0B;
base0C = config.colorScheme.palette.base0C;
base0D = config.colorScheme.palette.base0D;
base0E = config.colorScheme.palette.base0E;
base0F = config.colorScheme.palette.base0F;
};
opacity = {
desktop = 0.7;
terminal = 0.7;
};
fonts = {
sizes = {
applications = 14;
terminal = 24;
desktop = 12;
};
serif = config.stylix.fonts.monospace;
sansSerif = config.stylix.fonts.monospace;
monospace = {
package = pkgs.notonoto-35;
#name = "NOTONOTO-35-Bold";
name = "NOTONOTO-35";
};
emoji = {
package = pkgs.noto-fonts-monochrome-emoji;
name = "Noto Emoji";
};
};
};
}
home/swayidle.nix
+38
View File
@@ -0,0 +1,38 @@
{
pkgs,
inputs,
lib,
config,
...
}:
{
services.swayidle = {
enable = true;
timeouts = [
{
timeout = 180;
#command = "swaylock";
command = "gtklock";
resumeCommand = null;
}
{
timeout = 210;
command = "niri msg action power-off-monitors";
resumeCommand = null;
}
];
events = [
#{
# event = "before-sleep";
# #command = "swaylock";
# command = "gtklock";
#}
];
extraArgs = [ "-w" ];
package = pkgs.swayidle;
systemdTarget = "graphical-session.target";
};
}
home/swaylock.nix
+50
View File
@@ -0,0 +1,50 @@
{
pkgs,
inputs,
lib,
config,
nix-colors,
...
}:
let
palette = config.colorScheme.palette;
in
{
programs.swaylock = {
enable = true;
package = pkgs.swaylock-effects;
settings = {
# screen & indicator
color = "#${palette.base00}AA"; # --color
screenshots = true; # --screenshots
fade-in = 0.1; # --fade-in
scaling = "fill"; # e.g. --scaling=fill
# authentication grace
grace = 3; # --grace
submit-on-touch = false; # --submit-on-touch
ignore-empty-password = true;
show-failed-attempts = true;
# clock
clock = true; # --clock
# indicator visuals
indicator-idle-visible = true; # --indicator-idle-visible
indicator-radius = 100; # --indicator-radius
indicator-thickness = 7; # --indicator-thickness
# indicator colors
ring-color = "#${palette.base0D}C0"; # --ring-color
key-hl-color = "#${palette.base0E}C0"; # --key-hl-color
text-color = "#${palette.base05}FF"; # --text-color
inside-color = "#${palette.base02}CC"; # --inside-color
line-color = "#${palette.base01}99"; # --line-color
separator-color = "#${palette.base01}99"; # --separator-color
# effects
effect-scale = 0.6; # --effect-scale
effect-blur = "7x3"; # --effect-blur
};
};
}
home/swww.nix
+1 -1
View File
@@ -4,5 +4,5 @@ let
palette = config.colorscheme.palette;
in
{
services.awww.enable = true;
services.swww.enable = true;
}
home/wlogout.nix
+103
View File
@@ -0,0 +1,103 @@
{
pkgs,
lib,
inputs,
config,
nix-colors,
...
}:
let
# Grab your palette and the hex→RGBA helper
palette = config.colorscheme.palette;
toRGBA =
color: alpha:
let
rgb = nix-colors.lib.conversions.hexToRGBString "," (lib.removePrefix "#" color);
in
"rgba(${rgb},${alpha})";
# Path to the wleave-provided icons
iconsDir = "${pkgs.wleave}/share/wleave/icons";
in
{
programs.wlogout = {
enable = true;
package = pkgs.wlogout;
# Your button layout
layout = [
{
label = "lock";
action = "swaylock";
text = "Lock";
keybind = "l";
}
{
label = "hibernate";
action = "systemctl hibernate";
text = "Hibernate";
keybind = "h";
}
{
label = "logout";
action = "loginctl terminate-user $USER";
text = "Logout";
keybind = "e";
}
{
label = "shutdown";
action = "systemctl poweroff";
text = "Shutdown";
keybind = "s";
}
{
label = "suspend";
action = "systemctl suspend";
text = "Suspend";
keybind = "u";
}
{
label = "reboot";
action = "systemctl reboot";
text = "Reboot";
keybind = "r";
}
];
style = ''
* { background-image: none; }
window {
background-color: ${toRGBA palette.base00 "0.7"};
}
button {
color: #${palette.base0C};
background-color: ${toRGBA palette.base02 "0.8"};
border: 2px solid #${palette.base0C};
border-radius: 1em;
margin: 0.75em;
background-repeat: no-repeat;
background-position: center;
box-shadow: 0 0 4px #${palette.base0C};
padding: 0.6em 1.2em;
}
button:focus,
button:active {
background-color: ${toRGBA palette.base03 "0.9"};
box-shadow: 0 0 6px #${palette.base0C};
outline: none;
}
#lock { background-image: image(url("${iconsDir}/lock.svg")); }
#logout { background-image: image(url("${iconsDir}/logout.svg")); }
#suspend { background-image: image(url("${iconsDir}/suspend.svg")); }
#hibernate { background-image: image(url("${iconsDir}/hibernate.svg")); }
#shutdown { background-image: image(url("${iconsDir}/shutdown.svg")); }
#reboot { background-image: image(url("${iconsDir}/reboot.svg")); }
'';
};
}
home/xdg.nix
+9 -27
View File
@@ -4,39 +4,21 @@
config,
...
}:
{
# Enable XDG base directories
xdg.enable = true;
# Install the necessary packages for XDG compliance and management
home.packages = with pkgs; [
xdg-utils
xdg-desktop-portal-gtk
xdg-desktop-portal
xdg-desktop-portal-wlr
xdg-desktop-portal-gtk
xdg-desktop-portal-gnome
xdg-launch
xdg-ninja
xdg-utils
];
# Define session variables for XDG directories
home.sessionVariables = {
# Set other tools' paths to XDG directories (they should be relative to XDG_DATA_HOME or XDG_STATE_HOME)
GOPATH = "$XDG_DATA_HOME/go";
CARGO_HOME = "$XDG_DATA_HOME/cargo";
RUSTUP_HOME = "$XDG_DATA_HOME/rustup";
DOTNET_CLI_HOME = "$XDG_DATA_HOME/dotnet";
GNUPGHOME = "$XDG_DATA_HOME/gnupg";
ZDOTDIR = "$XDG_CONFIG_HOME/zsh"; # Optional, for Zsh configuration
HISTFILE = "$XDG_STATE_HOME/bash/history"; # Optional, for Bash history file location
};
xdg.enable = true;
# Enable XDG user directories (like Documents, Downloads, etc.)
xdg.userDirs.enable = true;
xdg.userDirs.createDirectories = true;
# home.sessionVariables = {
# };
# Enable autostart functionality with read-only mode (prevents arbitrary service additions)
xdg.autostart.enable = true;
xdg.autostart.readOnly = true;
# Handle XDG MIME type associations (useful for apps)
xdg.mime.enable = true;
xdg.mimeApps.enable = true;
}
home/zed.nix
+1 -63
View File
@@ -5,70 +5,8 @@
...
}:
{
programs.zed-editor = {
enable = true;
package = pkgs.unstable.zed-editor-fhs;
extraPackages = with pkgs; [
nodejs
nixd
];
extensions = [
"nix"
"toml"
"rust"
"html"
"yaml"
"python"
"make"
"xml"
"dockerfile"
"vue"
"latex"
"csv"
"rainbow csv"
"snippets"
"typst"
"mermaid"
"markdownlint"
"markdown oxide"
"dart"
"go"
"c#"
"json"
"flask snippets"
"python snippets"
"flutter snippets"
"tokyo night themes"
"opencode"
];
userSettings = {
theme = {
mode = "system";
dark = "Tokyo Night";
light = "Tokyo Night Storm";
};
features = {
edit_prediction_provider = "copilot";
};
agent = {
default_profile = "write";
default_model = {
provider = "zed";
model = "claude-sonnet-4";
};
model_parameters = [ ];
};
hour_format = "hour24";
node = {
path = lib.getExe pkgs.nodejs;
npm_path = lib.getExe' pkgs.nodejs "npm";
};
load_direnv = "shell_hook";
base_keymap = "VSCode";
show_whitespaces = "boundary";
};
package = pkgs.zed-editor-fhs;
};
}
hosts/aragon/configuration.nix
+23 -58
View File
@@ -2,75 +2,41 @@
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{
config,
pkgs,
lib,
...
}:
{ config, pkgs, lib, ... }:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
# Core system modules
../../modules/boot.nix
../../modules/nix.nix
../../modules/pam.nix
../../modules/polkit.nix
../../modules/zram.nix
../../modules/thermal.nix
# Networking and remote access
../../modules/openssh.nix
../../modules/tailscale.nix
# User interface and desktop
../../modules/displaymanager.nix
../../modules/xdg.nix
../../modules/sound.nix
../../modules/bluetooth.nix
../../modules/kdeconnect.nix
../../modules/desktopApplications.nix
# Development tools and user configuration
../../modules/basePackages.nix
../../modules/develPackages.nix
../../modules/gunalx.nix
# Containerization and cloud
../../modules/podman.nix
# Scientific and data tools
../../modules/jupyterhub.nix
# Software and gaming
../../modules/steam.nix
# SDR (Software Defined Radio)
../../modules/rtlsdr.nix
../../modules/websdr.nix
# Secrets management
../../modules/polkit.nix
../../modules/nix.nix
../../modules/openssh.nix
../../secrets/sops.nix
../../secrets/sopsconf.nix
# Backup
../../modules/restic-client.nix
../../modules/sound.nix
../../modules/gunalx.nix
../../modules/pam.nix
../../modules/tailscale.nix
../../modules/podman.nix
../../modules/steam.nix
../../modules/xdg.nix
../../modules/bluetooth.nix
../../modules/basePackages.nix
../../modules/develPackages.nix
../../modules/desktopApplications.nix
../../modules/comfyui.nix
];
services.desktopManager.gnome.enable = true;
environment.systemPackages = [
pkgs.custom.qwen-asr
];
# Bootloader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
# Setup keyfile
boot.initrd.secrets = {
@@ -78,10 +44,8 @@
};
# Enable swap on luks
boot.initrd.luks.devices."luks-08650b6b-6143-4503-8bf5-a3d32ef62d73".device =
"/dev/disk/by-uuid/08650b6b-6143-4503-8bf5-a3d32ef62d73";
boot.initrd.luks.devices."luks-08650b6b-6143-4503-8bf5-a3d32ef62d73".keyFile =
"/crypto_keyfile.bin";
boot.initrd.luks.devices."luks-08650b6b-6143-4503-8bf5-a3d32ef62d73".device = "/dev/disk/by-uuid/08650b6b-6143-4503-8bf5-a3d32ef62d73";
boot.initrd.luks.devices."luks-08650b6b-6143-4503-8bf5-a3d32ef62d73".keyFile = "/crypto_keyfile.bin";
networking.hostName = "aragon"; # Define your hostname.
time.timeZone = "Europe/Amsterdam";
@@ -95,14 +59,15 @@
# sleep wakeup rules
services.udev.extraRules = ''
ACTION=="add", SUBSYSTEM=="pci", DRIVER=="pcieport", ATTR{power/wakeup}="disabled"
'';
ACTION=="add", SUBSYSTEM=="pci", DRIVER=="pcieport", ATTR{power/wakeup}="disabled"
'';
#comment out to enable sleep. Uncommented over vacations
# systemd.targets.sleep.enable = false;
# systemd.targets.suspend.enable = false;
# systemd.targets.hibernate.enable = false;
# systemd.targets.hybrid-sleep.enable = false;
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
hosts/aragon/hardware-configuration.nix
+61 -87
View File
@@ -1,35 +1,26 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}:
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [
"nvme"
"xhci_pci"
"ahci"
"usb_storage"
"usbhid"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ "amdgpu" ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = ["amdgpu" ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
hardware.amdgpu.opencl.enable = true;
hardware.amdgpu.amdvlk.enable = true;
boot.kernelPackages = pkgs.linuxPackages_latest;
hardware.graphics = {
enable = true;
};
services.xserver.videoDrivers = [ "amdgpu" ];
systemd.tmpfiles.rules = [
@@ -37,79 +28,62 @@
];
nixpkgs.config.rocmSupport = true;
nixpkgs.config.rocmTargets = [ "gfx1030" ];
environment.variables = {
HSA_OVERRIDE_GFX_VERSION = "10.3.0";
};
# Environment variables for ROCm
environment.sessionVariables = {
HSA_OVERRIDE_GFX_VERSION = "10.3.0";
ROCM_PATH = "${pkgs.rocmPackages.rocm-core}/opt/rocm";
HIP_PATH = "${pkgs.rocmPackages.rocm-core}/opt/rocm/hip";
HSA_OVERRIDE_GFX_VERSION="10.3.0";
};
hardware.graphics = {
enable = true;
extraPackages = with pkgs; [
rocmPackages.clr.icd
vulkan-loader
vulkan-tools
vulkan-headers
#hardware.opengl.extraPackages32 = with pkgs; [
# driversi686Linux.amdvlk
#];
environment.systemPackages = with pkgs; [
lact
rocmPackages.rocminfo
rocmPackages.rocm-smi
rocmPackages.rocm-runtime
rocmPackages.rocm-device-libs
rocmPackages.rocm-core
rocmPackages.rocm-cmake
rocmPackages.rocgdb
rocmPackages.rocblas
rocmPackages.rccl
];
systemd.packages = with pkgs; [ lact ];
systemd.services.lactd.wantedBy = ["multi-user.target"];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/8ab16ad5-08d2-44f9-a9e4-2e6240bfd8f8";
fsType = "ext4";
};
fileSystems."/mnt/steam" =
{ device = "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_with_Heatsink_2TB_S7HPNJ0X304250L-part1";
fsType = "ext4";
};
boot.initrd.luks.devices."luks-31bf11fb-518a-408a-af06-93af528a5985".device = "/dev/disk/by-uuid/31bf11fb-518a-408a-af06-93af528a5985";
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/9A50-906F";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/c7cdfab4-2c92-42de-b951-ccc6fcd7b7d7"; }
];
};
# You *can* still put utilities here
environment.systemPackages = with pkgs; [
vulkan-tools
clinfo
rocmPackages.clr
rocmPackages.rocminfo
rocmPackages.rocm-runtime
rocmPackages.rocm-core
rocmPackages.rocm-smi
rocmPackages.rocblas
rocmPackages.rccl
rocmPackages.hipcc
lact
rocmPackages.rocminfo
rocmPackages.rocm-smi
rocmPackages.rocm-runtime
rocmPackages.rocm-device-libs
rocmPackages.rocm-core
rocmPackages.rocm-cmake
rocmPackages.rocgdb
rocmPackages.rocblas
rocmPackages.rccl
rocmPackages.hipcc
];
systemd.packages = with pkgs; [ lact ];
systemd.services.lactd.wantedBy = [ "multi-user.target" ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/8ab16ad5-08d2-44f9-a9e4-2e6240bfd8f8";
fsType = "ext4";
};
fileSystems."/mnt/steam" = {
device = "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_with_Heatsink_2TB_S7HPNJ0X304250L-part1";
fsType = "ext4";
};
boot.initrd.luks.devices."luks-31bf11fb-518a-408a-af06-93af528a5985".device =
"/dev/disk/by-uuid/31bf11fb-518a-408a-af06-93af528a5985";
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/9A50-906F";
fsType = "vfat";
};
swapDevices = [
{ device = "/dev/disk/by-uuid/c7cdfab4-2c92-42de-b951-ccc6fcd7b7d7"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp10s0.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp7s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
hosts/elrond/configuration.nix
-50
View File
@@ -1,50 +0,0 @@
{
config,
lib,
pkgs,
...
}:
{
imports = [
./hardware-configuration.nix
../../modules/boot.nix
../../modules/zram.nix
../../modules/nix.nix
../../modules/openssh.nix
../../modules/gunalx.nix
../../secrets/sops.nix
../../secrets/sopsconf.nix
../../modules/pam.nix
../../modules/tailscale.nix
../../modules/basePackages.nix
../../modules/zfs.nix
../../modules/vm.nix
../../modules/restic-client.nix
../../modules/restic-server.nix
];
networking.hostName = "elrond";
# Required by ZFS. Generate with: head -c 4 /dev/urandom | od -An -tx1 | tr -d ' \n'
networking.hostId = "8ead4526";
networking.networkmanager.enable = true;
services.restic.server.dataDir = "/rivendell/backup";
services.restic.backups.main.paths = [
"/var/lib"
"/rivendell/media/pictures"
"/rivendell/documents"
"/shire/media/pictures"
"/shire/documents"
"/var/backup"
];
# Import these once the pool exists. Encrypted pools also need:
boot.zfs.requestEncryptionCredentials = true;
boot.zfs.extraPools = [ "rivendell" "shire" ];
time.timeZone = "Europe/Amsterdam";
system.stateVersion = "26.05";
}
hosts/elrond/hardware-configuration.nix
-32
View File
@@ -1,32 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/mapper/luks-064c765e-fca0-4aa1-a761-e3548a0d1d2d";
fsType = "ext4";
};
boot.initrd.luks.devices."luks-064c765e-fca0-4aa1-a761-e3548a0d1d2d".device = "/dev/disk/by-uuid/064c765e-fca0-4aa1-a761-e3548a0d1d2d";
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/4E18-6764";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
hosts/elros/configuration.nix
-65
View File
@@ -1,65 +0,0 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{
config,
lib,
pkgs,
...
}:
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
../../modules/boot.nix
../../modules/zram.nix
../../modules/nix.nix
../../modules/openssh.nix
../../modules/gunalx.nix
../../secrets/sops.nix
../../secrets/sopsconf.nix
../../modules/pam.nix
../../modules/tailscale.nix
../../modules/basePackages.nix
../../modules/vm.nix
../../modules/acme.nix
../../modules/pangolin.nix
../../modules/restic-client.nix
];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; # support rpi building
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "elros";
networking.networkmanager.enable = true;
time.timeZone = "Europe/Amsterdam";
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "25.05"; # Did you read the comment?
}
hosts/elros/hardware-configuration.nix
-55
View File
@@ -1,55 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}:
{
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/7fa4de3a-20bb-4d0f-b049-dd6a0a0aee6e";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/E04D-431D";
fsType = "vfat";
options = [
"fmask=0022"
"dmask=0022"
];
};
swapDevices = [ ];
services.qemuGuest.enable = true;
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
hosts/elros/routes.nix
-88
View File
@@ -1,88 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
services.caddy.virtualHosts = {
"managment.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.104.182.48
basicauth {
import ${config.sops.secrets."nginx/defaultpass".path}
}
'';
};
"funn-nas.lauterer.it" = {
extraConfig = ''
reverse_proxy https://100.104.182.48:30044 {
transport http {
tls_insecure_skip_verify
}
}
basicauth {
import ${config.sops.secrets."nginx/defaultpass".path}
}
'';
};
"film.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.104.182.48:8096
'';
};
"home.lauterer.it" = {
extraConfig = ''
reverse_proxy http://10.0.0.32:8123
'';
};
"jellyfin.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:8096
'';
};
"podgrab.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:4242
basicauth {
import ${config.sops.secrets."nginx/defaultpass".path}
}
'';
};
"jupyter.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:8771
'';
};
"rss.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:8089
'';
};
"ai.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:11111
'';
};
"chat.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:11111
'';
};
"archive.lauterer.it" = {
extraConfig = ''
reverse_proxy http://100.84.215.84:8082
'';
};
};
}
hosts/galadriel/configuration.nix
+100 -74
View File
@@ -1,92 +1,118 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
{
config,
lib,
pkgs,
...
}:
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
../../modules/boot.nix
../../modules/zram.nix
../../modules/nix.nix
../../modules/openssh.nix
../../secrets/sops.nix
../../secrets/sopsconf.nix
../../modules/pam.nix
../../modules/tailscale.nix
../../modules/podman.nix
../../modules/basePackages.nix
../../modules/develPackages.nix
{
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
#./nvidia.nix #we have intel gpu now
../../modules/boot.nix
../../modules/zram.nix
../../modules/zfs.nix
../../modules/polkit.nix
../../modules/nix.nix
../../modules/openssh.nix
../../modules/gunalx.nix
../../secrets/sops.nix
../../secrets/sopsconf.nix
../../modules/pam.nix
../../modules/tailscale.nix
../../modules/podman.nix
../../modules/basePackages.nix
../../modules/develPackages.nix
../../modules/blog.nix
../../modules/jupyterhub.nix
../../modules/jellyfin.nix
../../modules/qbittorrent.nix
../../modules/miniflux.rss
../../modules/mealie.nix
../../modules/openwebui.nix
../../modules/ollama.nix
../../modules/snakeoil-certs.nix
../../modules/vaultvarden.nix
../../modules/immich.nix
../../modules/qbittorrent.nix
../../modules/jellyfin.nix
../../modules/mealie.nix
../../modules/miniflux.nix
../../modules/jupyterhub.nix
../../modules/openwebui.nix
../../modules/llama-swap.nix
../../modules/restic-server.nix
../../modules/restic-offsite.nix
../../modules/restic-client.nix
];
];
# Bootloader.
#boot.loader.grub.enable = true;
#boot.loader.grub.device = "/dev/nvme0n1";
#boot.loader.grub.useOSProber = true;
networking.hostId = "1ccccd3a";
# Setup keyfile
boot.initrd.secrets = {
"/boot/crypto_keyfile.bin" = null;
};
## Load zfs pool
boot.zfs.extraPools = [
"lorien"
];
boot.zfs.requestEncryptionCredentials = true;
#boot.loader.grub.enableCryptodisk = true;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.initrd.luks.devices."luks-c88c45f4-58e0-424c-98e0-6e4a73655349".keyFile = "/boot/crypto_keyfile.bin";
networking.hostName = "galadriel"; # Define your hostname.
networking.hostName = "galadriel";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Enable networking
networking.networkmanager.enable = true;
services.restic.server.dataDir = "/lorien/backup";
# Set your time zone.
time.timeZone = "Europe/Oslo";
services.restic.backups.main.paths = [
"/var/lib"
"/lorien/media/pictures"
"/var/backup"
];
# Select internationalisation properties.
i18n.defaultLocale = "nb_NO.UTF-8";
time.timeZone = "Europe/Amsterdam";
# Configure keymap in X11
services.xserver.xkb = {
layout = "no";
variant = "";
};
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
# to actually do that.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
# Configure console keymap
console.keyMap = "no";
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.gunalx = {
isNormalUser = true;
description = "Adrian Gunnar Lauterer";
extraGroups = [ "networkmanager" "wheel" ];
packages = with pkgs; [];
};
# Allow unfree packages
nixpkgs.config.allowUnfree = true;
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
wget
git
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# List services that you want to enable:
# Enable the OpenSSH daemon.
services.openssh.enable = true;
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "25.05"; # Did you read the comment?
}
hosts/galadriel/hardware-configuration.nix
+11 -73
View File
@@ -1,86 +1,24 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
modulesPath,
...
}:
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usb_storage"
"usbhid"
"sd_mod"
];
boot.zfs.package = pkgs.zfs;
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
boot.kernelParams = [
"xe.force_probe=e212"
"xe.vram_force_mmapable=1"
"transparent_hugepage=always"
];
services.udev.extraRules = ''
ACTION=="add", SUBSYSTEM=="drm", KERNEL=="card*", ATTR{device/tile0/gt0/engines/ccs0/job_timeout_ms}="100000"
ACTION=="add", SUBSYSTEM=="drm", KERNEL=="card*", ATTR{device/tile0/gt0/engines/rcs0/job_timeout_ms}="100000"
'';
fileSystems."/" =
{ device = "/dev/disk/by-uuid/edc50395-0b8d-4945-8d9e-69fd3dbb6e7e";
fsType = "ext4";
};
hardware.enableRedistributableFirmware = true;
hardware.firmware = [ pkgs.linux-firmware ];
environment.systemPackages = with pkgs; [
mkl
];
hardware.graphics = {
enable = true;
extraPackages = with pkgs; [
vpl-gpu-rt
mkl
#hardware decode and opencl
intel-media-driver # LIBVA_DRIVER_NAME=iHD (for HD Graphics starting Broadwell (2014) and newer)
intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
libvdpau-va-gl
intel-compute-runtime
intel-ocl
intel-graphics-compiler
level-zero
vulkan-loader
vulkan-validation-layers
];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/7789ad41-d578-40bc-bf86-b761e0a4921e";
fsType = "btrfs";
};
boot.initrd.luks.devices."NIXROOT".device =
"/dev/disk/by-uuid/082790fd-3d4b-4307-8a43-b9c56bd86e03";
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/3DE0-D86E";
fsType = "vfat";
options = [
"fmask=0022"
"dmask=0022"
];
};
boot.initrd.luks.devices."luks-c88c45f4-58e0-424c-98e0-6e4a73655349".device = "/dev/disk/by-uuid/c88c45f4-58e0-424c-98e0-6e4a73655349";
swapDevices = [ ];
@@ -90,7 +28,7 @@
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
# networking.interfaces.enp7s0f3u2.useDHCP = lib.mkDefault true;
# networking.interfaces.enp7s0f3u3.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
hosts/legolas/configuration.nix
+2 -23
View File
@@ -31,37 +31,18 @@
../../modules/powerprofiles.nix
../../modules/basePackages.nix
../../modules/develPackages.nix
#../../modules/jupyterhub.nix
#../../modules/ollama.nix
#../../modules/docling.nix # temp for dev ... Waiting for non broken docling-serve
../../modules/kdeconnect.nix
../../modules/jupyterhub.nix
../../modules/blog.nix
../../modules/desktopApplications.nix
../../modules/fcitx5.nix
../../modules/restic-client.nix
];
networking.hostName = "legolas";
networking.networkmanager.enable = true;
time.timeZone = "Europe/Amsterdam";
services.restic.backups.main.exclude = [
"/home/gunalx/Documents/div/qwen-asr-no"
"/home/gunalx/Pictures/google"
"/home/gunalx/.local/share/zed"
"/home/gunalx/.local/share/qwen-asr"
"/home/gunalx/.local/share/opencode"
];
# Select internationalisation properties.
# i18n.defaultLocale = "en_US.UTF-8";
#testing terminal from printer cable.
services.printing.enable = true;
boot.kernelModules = [ "usblp" ];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
# Enable the X11 windowing system.
services.xserver.enable = true;
services.xserver.videoDrivers = [
@@ -78,8 +59,6 @@
enableSSHSupport = true;
};
services.dbus.enable = true;
services.dbus.implementation = "broker";
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
hosts/legolas/hardware-configuration.nix
+34 -70
View File
@@ -1,40 +1,20 @@
{
config,
lib,
pkgs,
modulesPath,
...
}:
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
#boot.kernelPackages = pkgs.linuxPackages_zen;
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelPackages = pkgs.linuxPackages_zen;
boot.kernelParams = lib.mkForce [
# s2idle (modern standby) instead of deep (S3): the Phison E21 NVMe
# controller (Corsair MP600 ELITE) hangs on resume from the D3 transition
# that S3 forces. s2idle avoids that path.
"mem_sleep_default=s2idle"
boot.kernelParams = [
"nvme_core.default_ps_max_latency_us=0"
"pcie_aspm=off"
# from hardware config we are overriding away the deep sleep of.
"i915.enable_guc=2"
"i915.enable_fbc=1"
"i915.enable_psr=2"
"pcie_port_pm=off"
];
boot.initrd.availableKernelModules = [
"xhci_pci"
"nvme"
"uas"
"rtsx_pci_sdmmc"
];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "uas" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-label/NIXROOT";
@@ -44,62 +24,46 @@
fileSystems."/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
options = [
"fmask=0022"
"dmask=0022"
];
options = [ "fmask=0022" "dmask=0022" ];
};
boot.initrd.luks.devices.luks_secure = {
device = "/dev/disk/by-uuid/c21c8089-29a7-4266-a8a6-6e80ccca167c";
device = "/dev/disk/by-uuid/c21c8089-29a7-4266-a8a6-6e80ccca167c";
crypttabExtraOpts = [
#"tpm2-device=auto"
#"tpm2-measure-pcr=yes"
"tpm2-device=auto"
"tpm2-measure-pcr=yes"
];
};
swapDevices = [
{
device = "/swapfile";
size = 98 * 1024; # 32GB in MB
}
];
boot.kernel.sysctl = {
# "vm.swappiness" = 10;
"vm.swappiness" = 10;
};
systemd.targets.hibernate.enable = false;
powerManagement.enable = true;
# Disable hibernation
systemd.sleep = {
settings.Sleep = {
AllowHibernation = "no";
AllowHybridSleep = "no";
AllowSuspendThenHibernate = "no";
};
};
# Lid close must NOT suspend. The Phison E21 NVMe hangs on resume from any
# system suspend, and logind defaults to HandleLidSwitch=suspend (the trigger
# that kills the drive). Ignore the lid at the logind level; niri's
# switch-events handler still locks the session via noctalia, so the laptop
# stays on (RAM powered, s0idle) but never enters the death path.
services.logind.settings.Login = {
HandleLidSwitch = "ignore";
HandleLidSwitchExternalPower = "ignore";
HandleLidSwitchDocked = "ignore";
};
# Keep runtime PM off on the NVMe controller and its parent root port, and
# disable PCIe wakeup events. (The previous d3cold_allowed rule was a no-op:
# that sysfs attribute doesn't exist on this Phison endpoint or its root port.)
services.udev.extraRules = ''
ACTION=="add", SUBSYSTEM=="pci", DRIVER=="pcieport", ATTR{power/wakeup}="disabled"
ACTION=="add", SUBSYSTEM=="pci", KERNEL=="0000:6e:00.0", ATTR{power/control}="on"
ACTION=="add", SUBSYSTEM=="pci", KERNEL=="0000:00:1d.0", ATTR{power/control}="on"
'';
services.logind.lidSwitch = "suspend-then-hibernate";
powerManagement.enable = true;
hardware.graphics = {
enable = true;
extraPackages = with pkgs; [ vpl-gpu-rt ];
enable = true;
extraPackages = with pkgs; [ vpl-gpu-rt intel-media-sdk ];
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
modules/acme.nix
-43
View File
@@ -1,43 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
sops.secrets."acme/certs" = { };
networking.enableIPv6 = false; # For some reason acme only works without ipv6, probably because of missing AAAA records.
networking.domain = "lauterer.it";
#acme and certs helpful blog https://carjorvaz.com/posts/
security.acme = {
acceptTerms = true;
defaults.email = "adrian+acme@lauterer.it";
certs."${config.networking.domain}" = {
domain = "${config.networking.domain}";
extraDomainNames = [
"*.${config.networking.domain}"
"lb0fj.eu"
"*.lb0fj.eu"
"256.no"
"*.256.no"
"*.addictedmaker.eu"
"addictedmaker.eu"
];
## for testing.
#server = "https://acme-staging-v02.api.letsencrypt.org/directory";
#enableDebugLogs = true;
#legos registrar specific stuff.
dnsResolver = "ns1.hyp.net:53";
dnsProvider = "domeneshop";
dnsPropagationCheck = true;
#need to manually create this file according to dnsprovider secrets, and format of key according to lego in privider and add to secrets.yaml
environmentFile = config.sops.secrets."acme/certs".path;
};
};
#add proxyserver to acme group
#users.users.nginx.extraGroups = [ "acme" ];
users.users.root.extraGroups = [ "acme" ];
}
modules/authelia.nix
-70
View File
@@ -1,70 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
sops.secrets."authelia/usersFile" = {
owner = "authelia-main";
group = "authelia-main";
mode = "0400";
};
sops.secrets."authelia/jwtSecretFile" = {
owner = "authelia-main";
group = "authelia-main";
mode = "0400";
};
sops.secrets."authelia/storageEncryptionKeyFile" = {
owner = "authelia-main";
group = "authelia-main";
mode = "0400";
};
sops.secrets."authelia/sessionSecretFile" = {
owner = "authelia-main";
group = "authelia-main";
mode = "0400";
};
services.authelia.instances.main = {
enable = true;
secrets.storageEncryptionKeyFile = config.sops.secrets."authelia/storageEncryptionKeyFile".path;
secrets.jwtSecretFile = config.sops.secrets."authelia/jwtSecretFile".path;
secrets.sessionSecretFile = config.sops.secrets."authelia/sessionSecretFile".path;
settings = {
theme = "dark";
default_2fa_method = "totp";
log.level = "warn";
server.disable_healthcheck = false;
server.address = "tcp://0.0.0.0:9091/";
authentication_backend = {
file = {
path = lib.mkDefault config.sops.secrets."authelia/usersFile".path;
};
};
session = {
cookies = [
{
domain = "lauterer.it";
authelia_url = "https://authelia.lauterer.it";
}
];
};
access_control = {
default_policy = "one_factor";
};
storage = {
local = {
path = lib.mkDefault "/var/lib/authelia/main/db.sqlite3";
};
};
notifier = {
filesystem = {
filename = lib.mkDefault "/var/lib/authelia/main/notification.txt";
};
};
};
};
}
modules/basePackages.nix
+2 -15
View File
@@ -6,26 +6,13 @@
}:
{
environment.systemPackages = with pkgs; [
git
vim
wget
bottom
nvtopPackages.full
uutils-coreutils
nixfmt
git
nixfmt-rfc-style
nixfmt-tree
zip
unzip
ripgrep
eza
fastfetch
ffmpeg
rsync
screen
];
}
modules/blog.nix
+3 -3
View File
@@ -1,8 +1,8 @@
{ pkgs, ... }:
{ pkgs, ... }:
{
services.blog-generator = {
enable = true;
contentDir = "/var/lib/www/blog/content";
port = 8080;
};
}
};
}
modules/boot.nix
+9 -6
View File
@@ -13,6 +13,13 @@
kernelParams = [
"quiet"
"splash"
"loglevel=0"
"udev.log_priority=3"
"vt.global_cursor_default=0"
"rd.systemd.show_status=auto"
"rd.udev.log_level=3"
"boot.shell_on_fail"
"console=tty1"
];
initrd = {
@@ -37,12 +44,8 @@
boot.loader.grub.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
autoGenerateKeys.enable = true;
autoEnrollKeys = {
enable = true;
includeMicrosoftKeys = true;
};
#pkiBundle = "/etc/secureboot"; # old way. use sbctl setup --migrate
pkiBundle = "/var/lib/sbctl"; # sudo sbctl create-keys
};
# TPM-based LUKS unlock put in hardware configuration.nix.
modules/desktopApplications.nix
+78
View File
@@ -1,3 +1,81 @@
{
config,
pkgs,
lib,
...
}:
{
environment.systemPackages = with pkgs; [
element-desktop
discord
firefox
nautilus
obs-studio
gimp
feh
gparted
libreoffice-fresh
kdePackages.okular
zed-editor-fhs
inkscape
krita
sweethome3d.application
audacity
bitwarden
openvpn
zettlr # notes
logseq
pandoc
typst
texliveFull
openscad
prusa-slicer
freecad-wayland
openscad-unstable
kicad-unstable
kicadAddons.kikit
kicadAddons.kikit-library
easyeffects
musescore
mpv
spotify
spotify-tray
rclone
distrobox
boxbuddy
dbeaver-bin
sqlite
sqlitebrowser
postman
mitmproxy
wireshark
gdb
calibre
anki
bibletime
aerc
thunderbird
#eddie # old dotnet
steam
prismlauncher
protonplus
qbittorrent
kdePackages.filelight
kdePackages.kdeconnect-kde # could use valent instead.
solaar
cheese
ffmpeg
openvpn
wireguard-tools
fontforge
piper-tts
yt-dlp
tealdeer
clipboard-jh
noto-fonts-cjk-sans
];
programs.dconf.enable = true;
}
modules/develPackages.nix
+23 -16
View File
@@ -6,9 +6,10 @@
}:
{
environment.systemPackages = with pkgs; [
aider-chat-full
jq
curl
zip
unzip
openssl
gdb
@@ -31,10 +32,7 @@
libpkgconf
pkg-config
valgrind
imagemagickBig
plantuml
fontconfig
rustup
rustfmt
@@ -42,9 +40,24 @@
yarn
nodejs-slim
node2nix
uv
thonny
jupyter
python3
python3Packages.uv
python3Packages.ipykernel
python3Packages.flask
python3Packages.flask-sqlalchemy
python3Packages.flask-socketio
python3Packages.werkzeug
python3Packages.pyyaml
python3Packages.authlib
python3Packages.litellm
python3Packages.requests
python3Packages.flake8
python3Packages.torch
python3Packages.pycryptodome
#dotnet-sdk_8
#dotnet-sdk_9
@@ -52,15 +65,9 @@
#dotnet-aspnetcore
#dotnet-ef
unstable.nrfconnect
unstable.nrfutil
#gamedev
godot
];
services.udev.enable = lib.mkDefault true;
services.udev.packages = with pkgs; [ nrf-udev ];
programs.dconf.enable = lib.mkDefault true;
}
modules/displaymanager.nix
+1 -14
View File
@@ -6,29 +6,16 @@
}:
{
environment.systemPackages = [
(pkgs.catppuccin-sddm.override {
flavor = "mocha";
accent = "teal";
fontSize = "24";
background = ../home/Wallpapers/1346679.jpg;
loginBackground = true;
})
];
imports = [ ];
services.displayManager = {
enable = true;
sessionPackages = with pkgs; [ niri ];
defaultSession = "niri";
sddm = {
enable = true;
autoNumlock = true;
enableHidpi = true;
wayland.enable = true;
theme = "catppuccin-mocha-teal";
package = pkgs.kdePackages.sddm;
};
};
modules/docling.nix
-16
View File
@@ -1,16 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
services.docling-serve = {
enable = true;
package = pkgs.unstable.docling-serve;
port = 5001;
host = "127.0.0.1";
openFirewall = true;
};
}
modules/gunalx.nix
-2
View File
@@ -15,8 +15,6 @@
"networking"
"podman"
"pipewire"
"plugdev"
"dialout"
];
packages = with pkgs; [ ];
};
modules/immich.nix
+13 -9
View File
@@ -1,23 +1,27 @@
{
config,
pkgs,
lib,
...
}:
{
}: {
services.immich = {
enable = true;
port = 2283;
#mediaLocation = "/Main/Data/photos"; # Your photo/video directory
port = 8082;
host = "0.0.0.0";
openFirewall = true;
mediaLocation = "/lorien/media/pictures";
accelerationDevices = null;
user = "immich";
group = "immich";
settings = {
newVersionCheck.enabled = false;
machine-learning = {
enable = true;
#environment = {
# CUDA_VISIBLE_DEVICES = "0";
#};
};
};
}
modules/jellyfin.nix
+3 -8
View File
@@ -1,14 +1,9 @@
{ config, pkgs, lib, ... }:
{
config,
pkgs,
lib,
...
}:
{
users.groups.media.members = [ "jellyfin" ]; # have media directory owned by media group
users.groups.media.members = ["jellyfin"]; #have media directory owned by media group
services.jellyfin = {
enable = true;
group = "media";
group = "media";
openFirewall = true;
};
modules/jupyterhub.nix
+65 -45
View File
@@ -1,40 +1,50 @@
{
config,
pkgs,
lib,
...
}:
{ config, pkgs, lib, ... }:
let
myPythonPackages = import ./python-packages.nix;
myPython = pkgs.python3;
myPython = pkgs.python3;
myJupyterHubEnv = myPython.withPackages (ps: with ps; [
jupyterhub
jupyterhub-systemdspawner
ipython
jupyterlab
notebook
ipykernel
numpy
scipy
pandas
matplotlib
seaborn
scikit-learn
]);
myJupyterHubEnv = myPython.withPackages (
ps:
with ps;
[
jupyterhub
jupyterhub-systemdspawner
]
++ myPythonPackages ps
);
myJupyterLabEnv = myPython.withPackages (
ps:
with ps;
[
jupyterhub
]
++ myPythonPackages ps
);
myJupyterLabEnv = myPython.withPackages (ps: with ps; [
jupyterhub
jupyterlab
ipykernel
numpy
scipy
pandas
matplotlib
seaborn
scikit-learn
]);
in
{
environment.systemPackages = with pkgs; [
python3Packages.numpy
python3Packages.scipy
python3Packages.pandas
python3Packages.matplotlib
python3Packages.seaborn
python3Packages.scikit-learn
];
users.users.tdt4117 = {
isNormalUser = true;
home = "/home/tdt4117";
description = "tdt4117 - delete after h25";
extraGroups = [ ];
extraGroups = [ ];
# openssh.authorizedKeys.keys = [ "ssh-dss AAAAB3Nza... " ];
};
@@ -48,26 +58,36 @@ in
c.Authenticator.allow_all = True
c.ConfigurableHTTPProxy.api_url = 'http://0.0.0.0:8770'
c.JupyterHub.bind_url = 'http://0.0.0.0:8771'
'';
'';
kernels = {
python3 =
let
env = pkgs.python3.withPackages myPythonPackages;
in
{
displayName = "Python 3 for machine learning";
argv = [
"${env.interpreter}"
"-m"
"ipykernel_launcher"
"-f"
"{connection_file}"
];
language = "python";
logo32 = "${env}/${env.sitePackages}/ipykernel/resources/logo-32x32.png";
logo64 = "${env}/${env.sitePackages}/ipykernel/resources/logo-64x64.png";
};
python3 = let
env = (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
ipykernel
pandas
scikit-learn
seaborn
huggingface-hub
datasets
matplotlib
tqdm
numpy
scipy
]));
in {
displayName = "Python 3 for machine learning";
argv = [
"${env.interpreter}"
"-m"
"ipykernel_launcher"
"-f"
"{connection_file}"
];
language = "python";
logo32 = "${env}/${env.sitePackages}/ipykernel/resources/logo-32x32.png";
logo64 = "${env}/${env.sitePackages}/ipykernel/resources/logo-64x64.png";
};
};
};
}
modules/kdeconnect.nix
-27
View File
@@ -1,27 +0,0 @@
{
pkgs,
lib,
config,
...
}:
{
environment.systemPackages = with pkgs; [
kdePackages.xdg-desktop-portal-kde
kdePackages.kdeconnect-kde
kdePackages.qttools
sshfs
];
programs.kdeconnect = {
package = pkgs.kdePackages.kdeconnect-kde;
enable = true;
};
networking.firewall = rec {
allowedTCPPortRanges = [
{
from = 1714;
to = 1764;
}
];
allowedUDPPortRanges = allowedTCPPortRanges;
};
}
modules/librechat.nix
-70
View File
@@ -1,70 +0,0 @@
{ config, pkgs, ... }:
let
librechatPort = 3080;
mongoUri = "mongodb://127.0.0.1:27017/LibreChat";
in
{
sops.secrets."librechat/environmentFile" = { };
# Enable MongoDB
services.mongodb = {
enable = true;
package = pkgs.mongodb-ce;
# Optional: enableAuth = true;
# initialRootPasswordFile = "/path/to/mongo-root-password-file";
};
# LibreChat systemd service
systemd.services.librechat = {
# Make enable flagged when built
enable = true;
description = "LibreChat server";
# **Native systemd dependency declarations**
requires = [ "mongodb.service" ];
after = [
"network.target"
"mongodb.service"
];
serviceConfig = {
EnvironmentFile = config.sops.secrets."librechat/environmentFile".path;
Restart = "on-failure";
User = "librechat";
Group = "librechat";
# ExecStart binds to package binary
ExecStart = ''
${pkgs.librechat}/bin/librechat-server \
--host 0.0.0.0 \
--port ${toString librechatPort} \
--config /var/lib/librechat/config.yaml
'';
WorkingDirectory = "/var/lib/librechat";
};
wantedBy = [ "multi-user.target" ];
};
# Create user
users.users.librechat = {
isSystemUser = true;
description = "LibreChat service user";
home = "/var/lib/librechat";
createHome = true;
};
users.users.librechat.group = "librechat";
users.groups.librechat = { };
systemd.tmpfiles.rules = [
"d /var/lib/librechat 0755 librechat librechat -"
];
networking.firewall.allowedTCPPorts = [
librechatPort
27017
];
}
modules/llama-cpp.nix
-43
View File
@@ -1,43 +0,0 @@
{
config,
pkgs,
lib,
unstable,
inputs,
system,
...
}:
let
hostname = config.networking.hostName;
in
{
environment.systemPackages = [ pkgs.unstable.ollama ];
services.llama-cpp = {
enable = true;
host = "0.0.0.0";
port = 11111;
package = inputs.self.packages.${system}.llama-cpp-nightly-vulkan;
openFirewall = true;
model = "/var/lib/llama/models/Qwen3.5-35B-A3B-UD-Q2_K_XL.gguf";
extraFlags = [
"-c"
"32000"
"-ngl"
"41" # techincally entire qwen3.5
"--image-min-tokens"
"1024"
"--image-max-tokens"
"2048"
#"--hf-repo" "unsloth/Qwen3.5-35B-A3B-GGUF:Q2_K_L"
"--mmproj"
"/var/lib/llama/models/mmproj-F16.gguf"
"-ctk"
"q4_0"
"-ctv"
"q4_0" # quantisize kv cache.
"--no-mmap"
];
};
}
modules/llama-swap.nix
-249
View File
@@ -1,249 +0,0 @@
{
config,
pkgs,
lib,
inputs,
system,
...
}:
{
environment.systemPackages = [
inputs.self.packages.${system}.llama-cpp-nightly-vulkan
pkgs.unstable.stable-diffusion-cpp-vulkan
pkgs.unstable.whisper-cpp-vulkan
inputs.self.packages.${system}.z-image-models
inputs.self.packages.${system}.whisper-models
#inputs.self.packages.${system}.fish-speech-models
];
services.lact.enable = lib.mkDefault true;
services.llama-swap = {
enable = true;
package = inputs.self.packages.${system}.llama-swap;
listenAddress = "0.0.0.0";
port = 11112;
openFirewall = true;
settings =
let
llama-server = lib.getExe' inputs.self.packages.${system}.llama-cpp-nightly-vulkan "llama-server";
sd-server = lib.getExe' pkgs.unstable.stable-diffusion-cpp-vulkan "sd-server";
whisper-server = lib.getExe' pkgs.unstable.whisper-cpp-vulkan "whisper-server";
podman = lib.getExe pkgs.podman;
z-image-models = inputs.self.packages.${system}.z-image-models;
whisper-models = inputs.self.packages.${system}.whisper-models;
in
{
healthCheckTimeout = 180;
startPort = 12000;
globalTTL = 600;
logLevel = "info";
macros = {
ctx = 32000;
ngl = 99;
kv_cache = "-ctk q4_0 -ctv q4_0 -fa 1";
batch = "-b 1024 -ub 1024"; # default 512 512
hf_repo = "";
image-tokens = "--image-min-tokens 256 --image-max-tokens 1536";
tools = "--tools 'all'";
thinking = "--reasoning on";
no-thinking = "--reasoning off";
};
models = {
"qwen3.6-35b-a3b" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} -ngl $\{ngl\} $\{kv_cache\} $\{batch\} --hf-repo $\{hf_repo\} $\{image-tokens\} $\{no-thinking\} $\{tools\}";
aliases = [
"qwen3.6"
"qwen3.5"
"qwen3.5-35b-a3b"
"4o"
];
ttl = 1800;
macros = {
ctx = 49152;
hf_repo = "unsloth/Qwen3.6-35B-A3B-GGUF:UD-IQ3_XXS";
};
};
"qwen3.5-9b" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} $\{kv_cache\} -ngl $\{ngl\} --hf-repo $\{hf_repo\} $\{batch\} $\{image-tokens\} $\{thinking\} $\{tools\}";
ttl = 900;
macros = {
hf_repo = "unsloth/Qwen3.5-9B-GGUF:UD-Q4_K_XL";
ctx = 128000;
};
};
"gemma4-26b-a4b" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} -fa 0 -ngl $\{ngl\} --hf-repo $\{hf_repo\} $\{tools\}";
aliases = [
"gemma4"
];
ttl = 900;
macros = {
hf_repo = "unsloth/gemma-4-26B-A4B-it-GGUF:UD-IQ3_XXS";
ctx = 36000;
};
};
"gemma4-12b" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} -fa 0 -ngl $\{ngl\} --hf-repo $\{hf_repo\} --spec-type draft-mtp $\{tools\}";
ttl = 900;
macros = {
hf_repo = "unsloth/gemma-4-12B-it-qat-GGUF:UD-Q4_K_XL";
ctx = 128000;
};
};
"gemma4E4" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} $\{kv_cache\} -ngl $\{ngl\} --hf-repo $\{hf_repo\} $\{tools\} ";
ttl = 900;
macros = {
hf_repo = "unsloth/gemma-4-E4B-it-GGUF";
ctx = 128000;
};
};
"LFM2.5-8B-A1B" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} $\{kv_cache\} -ngl $\{ngl\} --hf-repo $\{hf_repo\} $\{tools\} ";
ttl = 900;
macros = {
hf_repo = "LiquidAI/LFM2.5-8B-A1B-GGUF";
ctx = 128000;
};
};
"ministal-3-3b" = {
cmd = "${llama-server} --port $\{PORT\} --host 0.0.0.0 --ctx-size $\{ctx\} -ngl $\{ngl\} --hf-repo $\{hf_repo\} $\{tools\} ";
aliases = [ "ministral3-mini" ];
ttl = 900;
macros.hf_repo = "mistralai/Ministral-3-3B-Instruct-2512-GGUF";
};
"z-image-turbo" = {
cmd = "${sd-server} --listen-port $\{PORT\} --diffusion-model $\{diffusion_model\} --vae $\{vae\} --llm $\{llm\} --offload-to-cpu --cfg-scale 1.0 --height 1024 --width 1024 --steps 4";
checkEndpoint = "/";
ttl = 300;
aliases = [
"gpt-image-1"
"dall-e-3"
];
macros = {
diffusion_model = "${z-image-models}/models/z-image-turbo-Q4_K.gguf";
vae = "${z-image-models}/models/ae.safetensors";
llm = "${z-image-models}/models/Qwen3-4B-Instruct-2507-Q4_K_M.gguf";
};
};
"distil-whisper-v3.5" = {
cmd = "${whisper-server} --host 127.0.0.1 --port $\{PORT\} -m $\{model\} --request-path /v1/audio/transcriptions --inference-path \"\"";
checkEndpoint = "/v1/audio/transcriptions/";
ttl = 0;
aliases = [
"whisper"
"whisper-1"
];
macros.model = "${whisper-models}/models/distil-large-v3.5.bin";
};
"nb-whisper-small" = {
cmd = "${whisper-server} --host 127.0.0.1 --port $\{PORT\} -m $\{model\} --request-path /v1/audio/transcriptions --inference-path \"\" --language no";
checkEndpoint = "/v1/audio/transcriptions/";
ttl = 0;
aliases = [
"whisper-no"
"whisper-nb"
];
macros.model = "${whisper-models}/models/nb-whisper-small-q5_0.bin";
};
"omnivoice" = {
cmd = "${pkgs.bash}/bin/bash -c '${pkgs.systemd}/bin/systemctl start podman-omnivoice.service && exec sleep infinity'";
cmdStop = "${pkgs.systemd}/bin/systemctl stop podman-omnivoice.service";
checkEndpoint = "/v1/audio/voices";
proxy = "http://127.0.0.1:8091";
ttl = 900;
};
"kokoro" = {
cmd = "${podman} run --init --rm --name kokoro-tts -p $\{PORT\}:8880 ghcr.io/remsky/kokoro-fastapi-cpu:latest";
cmdStop = "${podman} stop kokoro-tts";
checkEndpoint = "/v1/audio/voices";
ttl = 900;
};
};
};
};
virtualisation.oci-containers.containers.omnivoice = {
image = "vllm/vllm-openai:nightly";
ports = [ "8091:8091" ];
environment = {
VLLM_DEVICE = "cpu";
};
cmd = [
"vllm"
"serve"
"k2-fsa/OmniVoice"
"--omni"
"--device"
"cpu"
"--port"
"8091"
"--trust-remote-code"
];
extraOptions = [ "--rm" ];
autoStart = false;
};
systemd.services.llama-swap = {
serviceConfig = {
StateDirectory = "llama-swap";
CacheDirectory = "llama-swap";
RuntimeDirectory = "llama-swap";
Environment = [
"HOME=/var/lib/llama-swap"
"XDG_CACHE_HOME=/var/cache/llama-swap"
"MESA_SHADER_CACHE_DIR=/var/cache/llama-swap/mesa"
];
DynamicUser = lib.mkForce false;
User = "root";
Group = "root";
PrivateDevices = lib.mkForce false;
PrivateTmp = lib.mkForce false;
PrivateMounts = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectControlGroups = lib.mkForce false;
ProtectHome = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
ProtectSystem = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectProc = lib.mkForce "";
MemoryDenyWriteExecute = lib.mkForce false;
LockPersonality = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
RemoveIPC = lib.mkForce false;
RestrictNamespaces = lib.mkForce true;
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
RestrictAddressFamilies = lib.mkForce [
"AF_INET"
"AF_INET6"
"AF_UNIX"
"AF_NETLINK"
];
CapabilityBoundingSet = lib.mkForce "";
SystemCallArchitectures = lib.mkForce "";
SystemCallFilter = lib.mkForce [ ];
SystemCallErrorNumber = lib.mkForce "";
ProcSubset = lib.mkForce "all";
};
};
}
modules/mealie.nix
+1 -6
View File
@@ -1,9 +1,4 @@
{
config,
pkgs,
lib,
...
}:
{ config, pkgs, lib, ... }:
{
services.mealie = {
enable = true;
modules/miniflux.nix
-17
View File
@@ -1,17 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
sops.secrets."miniflux/adminCredentialsFile" = {
restartUnits = [ "miniflux.service" ];
mode = "0755";
};
services.miniflux.enable = true;
services.miniflux.config.LISTEN_ADDR = "0.0.0.0:8089";
services.miniflux.adminCredentialsFile = config.sops.secrets."miniflux/adminCredentialsFile".path;
}
modules/miniflux.rss
+14
View File
@@ -0,0 +1,14 @@
{ config, pkgs, lib, ... }:
{
sops.secrets."miniflux/adminCredentialsFile" = {
restartUnits = [ "miniflux.service" ];
owner = "miniflux";
mode = "0755";
};
services.miniflux.enable = true;
services.miniflux.config.LISTEN_ADDR = "0.0.0.0:8089";
services.miniflux.adminCredentialsFile = config.sops.secrets."miniflux/adminCredentialsFile".path;
}
modules/nix.nix
+18 -21
View File
@@ -6,8 +6,14 @@
}:
{
imports = [ ./nixpkgs.nix ]; # migrate this afterwards.
imports = [ ];
system.rebuild.enableNg = true;
nixpkgs.config.allowUnfree = true;
nixpkgs.config.permittedInsecurePackages = [
# example "python3.11-youtube-dl-2021.12.17"
];
sops.secrets."github/api" = {
mode = "0444";
group = "root";
@@ -29,11 +35,10 @@
];
substituters = [
"https://cache.nixos.org/"
"https://nixpkgs-unfree.cachix.org"
"https://nix-community.cachix.org"
"https://noctalia.cachix.org"
"https://cuda-maintainers.cachix.org"
"https://nix-community.cachix.org"
"https://nixos-rocm.cachix.org"
"https://nixpkgs-unfree.cachix.org"
];
trusted-public-keys = [
@@ -41,7 +46,6 @@
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"nixos-rocm.cachix.org-1:VEpsf7pRIijjd8csKjFNBGzkBqOmw8H9PRmgAq14LnE="
"nixpkgs-unfree.cachix.org-1:hqvoInulhbV4nJ9yJOEr+4wxhDV4xq2d1DK7S6Nj6rs="
"noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
];
};
@@ -50,35 +54,30 @@
hostName = "localhost";
system = "x86_64-linux";
maxJobs = 4;
speedFactor = 2000;
speedFactor = 8000;
supportedFeatures = [ ];
mandatoryFeatures = [ ];
}
{
hostName = "aragon";
systems = [
"x86_64-linux"
"aarch64-linux"
];
system = "x86_64-linux";
# if the builder supports building for multiple architectures,
# replace the previous line by, e.g.,
# systems = ["x86_64-linux" "aarch64-linux"];
maxJobs = 6;
speedFactor = 6000;
speedFactor = 6001;
supportedFeatures = [ ];
mandatoryFeatures = [ ];
sshUser = "root";
sshKey = "/root/.ssh/nixos";
protocol = "ssh";
}
{
hostName = "galadriel";
system = "x86_64-linux";
maxJobs = 4;
speedFactor = 4000;
supportedFeatures = [ ];
speedFactor = 4001;
supportedFeatures = [ "cuda" ];
mandatoryFeatures = [ ];
sshUser = "root";
sshKey = "/root/.ssh/nixos";
protocol = "ssh";
}
];
distributedBuilds = true;
};
@@ -89,8 +88,6 @@
flags = [
#"--no-write-lock-file"
"--print-build-logs" # -L
"--builders """
"--no-write-lock-file"
];
};
modules/nixpkgs.nix
-20
View File
@@ -1,20 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
imports = [ ];
nixpkgs = {
config = {
allowUnfree = true;
segger-jlink.acceptLicense = true;
permittedInsecurePackages = [
# example "python3.11-youtube-dl-2021.12.17"
];
};
};
}
modules/nvidia.nix
-51
View File
@@ -1,51 +0,0 @@
{
config,
lib,
pkgs,
...
}:
{
# Enable OpenGL
hardware.graphics = {
enable = true;
enable32Bit = true;
};
# Load nvidia driver for Xorg and Wayland
services.xserver.videoDrivers = [ "nvidia" ];
boot = {
blacklistedKernelModules = [ "nouveau" ];
extraModulePackages = [ config.boot.kernelPackages.nvidia_x11 ];
initrd.kernelModules = [ "nvidia" ];
};
hardware.nvidia = {
modesetting.enable = true;
# Nvidia power management. Experimental, and can cause sleep/suspend to fail.
#powerManagement.enable = true;
# Fine-grained power management. Turns off GPU when not in use. Experimental and only works on modern Nvidia GPUs (Turing or newer).
powerManagement.finegrained = false;
# Use the NVidia open source kernel module (not to be confused with the independent third-party "nouveau" open source driver).
# Currently alpha-quality/buggy, so false is currently the recommended setting.
open = false; # need proprietary for cuda.
# Enable the Nvidia settings menu, accessible via `nvidia-settings`.
#nvidiaSettings = true;
# Optionally, you may need to select the appropriate driver version for your specific GPU.
package = config.boot.kernelPackages.nvidiaPackages.stable;
};
# Enable the CUDA toolkit
#install packages
environment.systemPackages = with pkgs; [
cudaPackages.cudatoolkit
cudaPackages.cudnn
nvtopPackages.nvidia
cudaPackages.nccl
pkgs.cudaPackages.libcublas
];
}
modules/ollama.nix
+6 -21
View File
@@ -1,10 +1,4 @@
{
config,
pkgs,
lib,
unstable,
...
}:
{ config, pkgs, lib, ... }:
let
hostname = config.networking.hostName;
@@ -15,30 +9,21 @@ in
services.ollama = {
enable = true;
package = lib.mkDefault pkgs.unstable.ollama-vulkan;
acceleration = lib.mkDefault "vulkan";
package = pkgs.unstable.ollama;
host = "0.0.0.0";
openFirewall = true;
port = 11434;
home = "/var/lib/ollama";
environmentVariables = {
OLLAMA_CONTEXT_LENGTH = "32000";
};
# Preloaded models
loadModels = [
"gemma3:1b"
"qwen3:latest"
"qwen3:4b"
"glm-4.7-flash:latest"
"rnj-1:latest"
"lfm2.5-thinking:latest"
"qwen3-vl:4b"
"qwen3-vl:2b-instruct-q8_0"
"qwen3-vl:latest"
"qwen3:0.6b"
"gemma3:4b"
"ministral-3:3b"
"ministral-3:latest"
"qwen2.5vl:3b"
"granite3.2-vision"
"granite4:tiny-h"
"gpt-oss:20b"
];
};
modules/openssh.nix
+3 -25
View File
@@ -1,15 +1,4 @@
{
config,
pkgs,
lib,
...
}:
let
sshLookup = pkgs.writeShellScriptBin "ssh-lookup-root-pubs" ''
#!/bin/sh
cat /root/.ssh/*.pub 2>/dev/null
'';
in
{ config, pkgs, lib, ... }:
{
services.openssh = {
enable = true;
@@ -25,23 +14,12 @@ in
# "aes256-ctr"
# # remove some weaker ciphers
#];
authorizedKeysCommand = "${sshLookup}";
};
programs.ssh.extraConfig = ''
Host aragon
Port 6969
ConnectTimeout 3
Host galadriel
Port 6969
ConnectTimeout 3
Host localhost
ConnectTimeout 3
'';
services.endlessh-go = {
enable = true;
port = 22;
openFirewall = true;
};
services.sshguard.enable = true; # protection against brute force attacks
services.sshguard.enable = true; #protection against brute force attacks
}
modules/openwebui.nix
+43 -48
View File
@@ -1,59 +1,54 @@
{
config,
pkgs,
lib,
...
}:
{ config, pkgs, lib, ... }:
let
stateDir = "/var/lib/open-webui";
port = 11111;
port = 8081;
in
{
virtualisation.podman.enable = true;
virtualisation = {
podman.enable = true;
podman.dockerCompat = true;
virtualisation.oci-containers.backend = "podman";
virtualisation.oci-containers.containers.openwebui = {
image = "ghcr.io/open-webui/open-webui:latest";
autoStart = true;
ports = [
"0.0.0.0:${toString port}:8080"
];
volumes = [
"${stateDir}/data:/app/backend/data"
"${stateDir}/static:/app/backend/static"
"${stateDir}/build:/app/frontend/build"
];
extraOptions = [ "--pull=newer" ];
environment = {
ANONYMIZED_TELEMETRY = "False";
DO_NOT_TRACK = "True";
SCARF_NO_ANALYTICS = "True";
WEBUI_AUTH = "True";
ENABLE_SIGNUP = "True";
DEFAULT_USER_ROLE = "pending";
ENV = "prod";
# Optional — helps internal routing
WEBUI_PORT = toString port;
WEBUI_HOST = "0.0.0.0";
oci-containers = {
backend = "podman";
containers = {
openwebui = {
autoStart = true;
image = "ghcr.io/open-webui/open-webui:main";
ports = [ "0.0.0.0:${lib.mkStr port}:8080" ];
environment = {
ANONYMIZED_TELEMETRY = "False";
DO_NOT_TRACK = "True";
SCARF_NO_ANALYTICS = "True";
WEBUI_AUTH = "True";
#ENABLE_SIGNUP = "True";
ENABLE_SIGNUP_PASSWORD_CONFIRMATION = "True";
#DEFAULT_USER_ROLE = "admin";
ENV = "prod";
};
volumes = [
"${stateDir}:/app/backend/data"
];
extraOptions = [ "--pull=always" ];
};
};
};
};
# Create persistent state directories (like StateDirectory in systemd)
systemd.tmpfiles.rules = [
"d ${stateDir}/data 0755 root root - -"
"d ${stateDir}/static 0755 root root - -"
"d ${stateDir}/build 0755 root root - -"
];
# make sure the directory exists
environment.etc = {
"var/lib/open-webui" = {
source = null;
mode = "0755";
owner = "root";
group = "root";
};
};
# Optional — open firewall for access
networking.firewall.allowedTCPPorts = [ port ];
# open firewall port 3000 if you run a firewall
networking.firewall = {
allowedTCPPorts = lib.mkList port;
};
}
modules/pam.nix
+5
View File
@@ -10,4 +10,9 @@
security.polkit.enable = true;
security.pam.services.gtklock = { };
security.pam.services.swaylock = { };
security.pam.services.swaylock-effects = { };
}
modules/pangolin.nix
-31
View File
@@ -1,31 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
sops.secrets."pangolin/environmentFile" = {
restartUnits = [ "pangolin.service" ];
owner = "pangolin";
mode = "0755";
};
users.users.pangolin.extraGroups = [ "acme" ];
services.pangolin = {
enable = true;
openFirewall = true;
package = pkgs.unstable.fosrl-pangolin;
baseDomain = "lauterer.it";
dashboardDomain = "auth.lauterer.it";
dnsProvider = "domeneshop";
#settings
environmentFile = config.sops.secrets."pangolin/environmentFile".path;
#dataDir
};
}
modules/powerprofiles.nix
+1 -1
View File
@@ -11,5 +11,5 @@
];
services.power-profiles-daemon.enable = true;
services.upower.enable = true;
}
modules/python-packages.nix
-51
View File
@@ -1,51 +0,0 @@
ps: with ps; [
ipykernel
jupyter
jupyterlab
notebook
numpy
scipy
pandas
polars
matplotlib
seaborn
scikit-learn
scikit-image
sympy
nltk
huggingface-hub
datasets
tokenizers
transformers
accelerate
peft
bitsandbytes
torch
torchvision
lightning
keras
opencv-python
pillow
pyvista
vispy
pygame
tqdm
flask
flask-sqlalchemy
flask-socketio
werkzeug
gunicorn
requests
pyyaml
authlib
litellm
openai
pydantic
pydantic-core
docling-core
pycryptodome
flake8
pip
tkinter
]
modules/qbittorrent.nix
+50 -60
View File
@@ -1,11 +1,6 @@
{
config,
lib,
pkgs,
...
}:
{ config, lib, pkgs, ... }:
let
dataLocation = "/lorien/media/";
interfaceaddress = builtins.readFile config.sops.secrets."qbittorrent/interfaceAddress".path;
in
{
sops.secrets."qbittorrent/interfaceAddress" = {
@@ -13,16 +8,11 @@ in
owner = "qbittorrent";
mode = "0755";
};
sops.templates."qbittorrent-interface-addr.conf".content = ''
# This is injected via sops template
interfaceAddress = "${config.sops.placeholder."qbittorrent/interfaceAddress"}";
'';
sops.templates."qbittorrent-interface-addr.conf".owner = "qbittorrent";
users.users.qbittorrent = {
group = lib.mkForce "media";
};
users.groups.qbittorrent = { };
users.groups.qbittorrent = {};
services.qbittorrent = {
enable = true;
@@ -32,58 +22,58 @@ in
serverConfig = {
LegalNotice.Accepted = true;
Meta.MigrationVersion = 6;
Network.PortForwardingEnabled = true;
Meta.MigrationVersion=6;
Network.PortForwardingEnabled=true;
Preferences = {
WebUI = {
AuthSubnetWhitelist = "192.168.1.0/24, 100.0.0.0/8";
AuthSubnetWhitelistEnabled = true;
UseUPnP = false;
AuthSubnetWhitelist="192.168.1.0/24, 100.0.0.0/8";
AuthSubnetWhitelistEnabled=true;
UseUPnP=false;
};
BitTorrent = {
Session = {
AddExtensionToIncompleteFiles = true;
AlternativeGlobalDLSpeedLimit = 1000;
AlternativeGlobalUPSpeedLimit = 1000;
AnonymousModeEnabled = false;
BTProtocol = "Both";
BandwidthSchedulerEnabled = false;
DefaultSavePath = dataLocation + "Downloads";
Encryption = 1;
FinishedTorrentExportDirectory = dataLocation + "Downloads/torrents-complete";
GlobalDLSpeedLimit = 0;
GlobalMaxRatio = 1.5;
GlobalUPSpeedLimit = 0;
I2P.Enabled = true;
IgnoreLimitsOnLAN = true;
IncludeOverheadInLimits = true;
Interface = "tun0";
InterfaceAddress = "${config.sops.placeholder."qbittorrent/interfaceAddress"}";
#InterfaceAddress="${interfaceaddress}";
InterfaceName = "tun0";
LSDEnabled = "true";
MaxActiveCheckingTorrents = 15;
MaxRatioAction = 1;
Port = 44183;
Preallocation = true;
QueueingSystemEnabled = false;
SubcategoriesEnabled = true;
Tags = "movie, anime";
TempPath = "/Main/Data/media/Downloads/temp";
TempPathEnabled = true;
TorrentContentLayout = "Subfolder";
TorrentExportDirectory = dataLocation + "Downloads/torrents";
UseAlternativeGlobalSpeedLimit = false;
};
BitTorrent = {
Session = {
AddExtensionToIncompleteFiles=true;
AlternativeGlobalDLSpeedLimit=1000;
AlternativeGlobalUPSpeedLimit=1000;
AnonymousModeEnabled=false;
BTProtocol="Both";
BandwidthSchedulerEnabled=false;
DefaultSavePath="/Main/Data/media/Downloads";
Encryption=1;
FinishedTorrentExportDirectory="/Main/Data/media/Downloads/torrents-complete";
GlobalDLSpeedLimit=0;
GlobalMaxRatio=1.5;
GlobalUPSpeedLimit=0;
I2P.Enabled=true;
IgnoreLimitsOnLAN=true;
IncludeOverheadInLimits=true;
Interface="tun0";
#InterfaceAddress="${config.sops.placeholder."qbittorrent/interfaceAddress"}";
InterfaceAddress="${interfaceaddress}";
InterfaceName="tun0";
LSDEnabled="true";
MaxActiveCheckingTorrents=15;
MaxRatioAction=1;
Port=44183;
Preallocation=true;
QueueingSystemEnabled=false;
SubcategoriesEnabled=true;
Tags="movie, anime";
TempPath="/Main/Data/media/Downloads/temp";
TempPathEnabled=true;
TorrentContentLayout="Subfolder";
TorrentExportDirectory="/Main/Data/media/Downloads/torrents";
UseAlternativeGlobalSpeedLimit=false;
};
RSS = {
AutoDownloader = {
DownloadRepacks = true;
EnableProcessing = true;
SmartEpisodeFilter = "s(\\d+)e(\\d+), (\\d+)x(\\d+), \"(\\d{4}[.\\-]\\d{1,2}[.\\-]\\d{1,2})\", \"(\\d{1,2}[.\\-]\\d{1,2}[.\\-]\\d{4})\"";
};
Session.EnableProcessing = true;
};
RSS = {
AutoDownloader = {
DownloadRepacks=true;
EnableProcessing=true;
SmartEpisodeFilter="s(\\d+)e(\\d+), (\\d+)x(\\d+), \"(\\d{4}[.\\-]\\d{1,2}[.\\-]\\d{1,2})\", \"(\\d{1,2}[.\\-]\\d{1,2}[.\\-]\\d{4})\"";
};
Session.EnableProcessing=true;
};
General.Locale = "en";
};
};
modules/restic-client.nix
-64
View File
@@ -1,64 +0,0 @@
{
config,
lib,
...
}:
{
sops.secrets."restic/repository" = {
mode = "0400";
restartUnits = [ "restic-backups-main.service" ];
};
sops.secrets."restic/repo_password" = {
mode = "0400";
restartUnits = [ "restic-backups-main.service" ];
};
services.restic.backups.main = {
initialize = true;
repositoryFile = config.sops.secrets."restic/repository".path;
passwordFile = config.sops.secrets."restic/repo_password".path;
paths = lib.mkDefault [
"/var/lib"
"/var/backups"
"/home/gunalx"
];
exclude = [
".cache"
"__pycache__"
"*.pyc"
"*.pyo"
".pytest_cache"
".mypy_cache"
".ruff_cache"
"node_modules"
".cargo"
".rustup"
".platformio"
".ipython"
".config"
".gitconfig"
".bashrc"
".bash_history"
".zsh_history"
".atuin"
".history.db*"
".tmp"
"*.tmp"
"*.swp"
".Trash-*"
"Trash"
".zcompdump*"
".nix-defexpr"
".steam"
".SteamCloud"
"Steam"
"/var/lib/containers"
".local/share/containers"
];
timerConfig = {
OnCalendar = "daily";
Persistent = true;
};
};
}
modules/restic-offsite.nix
-49
View File
@@ -1,49 +0,0 @@
{
config,
lib,
pkgs,
...
}:
{
sops.secrets."restic/repo_password" = {
owner = "restic";
mode = "0400";
restartUnits = [ "restic-offsite.service" ];
};
sops.secrets."restic/offsite_repository" = {
owner = "restic";
mode = "0400";
restartUnits = [ "restic-offsite.service" ];
};
# destination = offsite repo (primary global opts: --repository-file/--password-file)
# source = local repo (--from-repo/--from-password-file)
# the legacy --repo2/--repository-file2/--password-file2 flags are deprecated in restic.
systemd.services.restic-offsite = {
description = "Mirror restic snapshots to the offsite repo";
serviceConfig = {
Type = "oneshot";
User = "restic";
Group = "restic";
};
path = [ pkgs.restic ];
script = ''
restic \
--repository-file ${config.sops.secrets."restic/offsite_repository".path} \
--password-file ${config.sops.secrets."restic/repo_password".path} \
--from-repo ${config.services.restic.server.dataDir}/main \
--from-password-file ${config.sops.secrets."restic/repo_password".path} \
copy
'';
};
systemd.timers.restic-offsite = {
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "daily";
Persistent = true;
};
};
}
modules/restic-server.nix
-41
View File
@@ -1,41 +0,0 @@
{
config,
lib,
...
}:
{
sops.secrets."restic/repo_password" = {
owner = "restic";
mode = "0400";
restartUnits = [ "restic-backups-prune.service" ];
};
services.restic.server = {
enable = true;
listenAddress = "0.0.0.0:8008";
# mkDefault: set services.restic.server.dataDir in a host config to relocate the repo.
dataDir = lib.mkDefault "/var/lib/restic";
appendOnly = lib.mkDefault true;
extraFlags = lib.mkDefault [ "--no-auth" ]; #lets just ignore the auth parts, keep it on internal network.
};
services.restic.backups.prune = {
repository = "${config.services.restic.server.dataDir}/main";
passwordFile = config.sops.secrets."restic/repo_password".path;
user = "restic";
paths = [ ];
pruneOpts = [
"--keep-daily 3"
"--keep-weekly 5"
"--keep-monthly 6"
"--keep-yearly 5"
];
runCheck = true;
timerConfig = {
OnCalendar = "weekly";
Persistent = true;
};
};
networking.firewall.allowedTCPPorts = [ 8008 ];
}
modules/rtlsdr.nix
-21
View File
@@ -1,21 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
hardware.rtl-sdr.enable = true;
environment.systemPackages = with pkgs; [
libusb1
pkgs.rtl-sdr
gqrx
cubicsdr
openwebrx
];
}
modules/snakeoil-certs.nix
-99
View File
@@ -1,99 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.environment.snakeoil-certs;
in
{
options.environment.snakeoil-certs = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule (
{ name, ... }:
{
options = {
certificate = lib.mkOption {
type = lib.types.str;
default = "/var/lib/snakeoil-certs/${name}.crt";
};
certificateKey = lib.mkOption {
type = lib.types.str;
default = "/var/lib/snakeoil-certs/${name}.key";
};
owner = lib.mkOption {
type = lib.types.str;
default = "root";
};
group = lib.mkOption {
type = lib.types.str;
default = "root";
};
mode = lib.mkOption {
type = lib.types.str;
default = "0660";
};
daysValid = lib.mkOption {
type = lib.types.int;
default = 3650;
};
subject = lib.mkOption {
type = lib.types.str;
default = "/CN=${name}";
};
extraOpenSSLArgs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
};
};
}
)
);
default = { };
description = "Self-signed (snakeoil) certificates generated at runtime.";
};
config = lib.mkIf (cfg != { }) {
systemd.services.generate-snakeoil-certs = {
description = "Generate self-signed certificates";
after = [ "local-fs.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script =
let
openssl = lib.getExe pkgs.openssl;
in
lib.concatMapStringsSep "\n" (
{ value, ... }:
''
mkdir -p "$(dirname "${value.certificate}")" "$(dirname "${value.certificateKey}")"
if ! ${openssl} x509 -checkend 86400 -noout -in "${value.certificate}" 2>/dev/null; then
${openssl} req \
-newkey rsa:2048 \
-nodes \
-x509 \
-days ${toString value.daysValid} \
-subj "${value.subject}" \
-out "${value.certificate}" \
-keyout "${value.certificateKey}" \
${lib.escapeShellArgs value.extraOpenSSLArgs}
fi
chown "${value.owner}:${value.group}" "${value.certificate}" "${value.certificateKey}"
chmod "${value.mode}" "${value.certificate}" "${value.certificateKey}"
''
) (lib.attrsToList cfg);
};
systemd.timers.generate-snakeoil-certs = {
description = "Periodically ensure self-signed certificates exist";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "*-*-* 02:00:00";
Persistent = true;
Unit = "generate-snakeoil-certs.service";
};
};
};
}
modules/sound.nix
+1
View File
@@ -24,6 +24,7 @@
environment.systemPackages = with pkgs; [
pavucontrol
wireplumber
easyeffects
];
modules/thermal.nix
-38
View File
@@ -1,38 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
services.thermald.enable = true;
environment.systemPackages = with pkgs; [
lm_sensors
];
systemd.services.thermal-log = {
description = "Periodic thermal logging to journal";
serviceConfig.Type = "oneshot";
path = with pkgs; [
lm_sensors
gnugrep
coreutils
util-linux
];
script = ''
TEMP=$(sensors 2>/dev/null | grep -i 'Tctl\|Tdie' | head -1 || echo "N/A")
logger -t thermal-log "CPU Temp: $TEMP"
'';
};
systemd.timers.thermal-log = {
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "5min";
OnUnitActiveSec = "5min";
Persistent = true;
};
};
}
modules/vaultvarden.nix
+14 -62
View File
@@ -1,69 +1,21 @@
{
config,
pkgs,
lib,
...
}:
{ config, pkgs, lib, ... }:
{
environment.systemPackages = [
pkgs.system-sendmail
];
# environment.systemPackages = [
# pkgs.sendmail
# ];
sops.secrets."vaultwarden/environmentFile" = {
restartUnits = [ "vaultwarden.service" ];
owner = "vaultwarden";
mode = "0755";
};
services.vaultwarden = {
enable = true;
environmentFile = config.sops.secrets."vaultwarden/environmentFile".path;
dbBackend = "sqlite";
backupDir = "/var/backup/vaultwarden";
};
environment.snakeoil-certs.vaultwarden = {
owner = "nginx";
group = "nginx";
subject = "/CN=vaultwarden";
extraOpenSSLArgs = [
"-addext"
"subjectAltName=DNS:galadriel,DNS:*.galadriel,DNS:localhost,IP:127.0.0.1,IP:100.110.96.125"
];
};
services.nginx = {
enable = lib.mkDefault true;
recommendedProxySettings = true;
virtualHosts."vaultwarden" = {
onlySSL = true;
sslCertificate = config.environment.snakeoil-certs.vaultwarden.certificate;
sslCertificateKey = config.environment.snakeoil-certs.vaultwarden.certificateKey;
listen = [
{
addr = "0.0.0.0";
port = 8001;
ssl = true;
}
{
addr = "[::]";
port = 8001;
ssl = true;
}
];
locations."/" = {
proxyPass = "http://127.0.0.1:8000";
proxyWebsockets = true;
};
sops.secrets."vaultwarden/environmentFile" = {
restartUnits = [ "vaultwarden.service" ];
owner = "vaultwarden";
mode = "0755";
};
};
systemd.services.nginx = {
after = [ "generate-snakeoil-certs.service" ];
wants = [ "generate-snakeoil-certs.service" ];
};
networking.firewall.allowedTCPPorts = [ 8001 ];
services.vaultwarden = {
enable = true;
environmentFile = config.sops.secrets."vaultwarden/environmentFile".path;
dbBackend = "sqlite";
backupDir = "/var/backup/vaultwarden";
};
}
modules/vm.nix
-16
View File
@@ -1,16 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
imports = [ ];
services.qemuGuest.enable = lib.mkDefault true;
boot.growPartition = lib.mkDefault true;
services.spice-vdagentd.enable = lib.mkDefault true;
}
modules/websdr.nix
-13
View File
@@ -1,13 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
hardware.rtl-sdr.enable = true;
services.openwebrx.enable = true;
}
modules/xdg.nix
+19 -55
View File
@@ -4,73 +4,37 @@
config,
...
}:
{
# XDG related configurations
environment.systemPackages = [
pkgs.xdg-desktop-portal-gtk
pkgs.xdg-desktop-portal-gnome
pkgs.xdg-desktop-portal
];
xdg = {
# Enable desktop portal integration
#portal = {
# enable = true; # Enable the portal system
# xdgOpenUsePortal = true; # Use portal for opening files and URLs
# # Additional portals for specific environments
# extraPortals = with pkgs; [
# xdg-desktop-portal-gtk
# xdg-desktop-portal
# xdg-desktop-portal-gnome
# kdePackages.xdg-desktop-portal-kde # For KDE environment
# ];
# # Configuration packages for portals (like GNOME session, Niri, etc.)
# configPackages = with pkgs; [
# gnome-session
# niri
# ];
#};
autostart.enable = true;
menus.enable= true;
icons.enable= true;
sounds.enable= true;
portal = {
enable = true;
xdgOpenUsePortal = true;
config.common.default = [ "gnome" ];
extraPortals = [
pkgs.xdg-desktop-portal
pkgs.xdg-desktop-portal-gtk
pkgs.xdg-desktop-portal-gnome
extraPortals = with pkgs; [
xdg-desktop-portal-gtk
xdg-desktop-portal
xdg-desktop-portal-wlr
xdg-desktop-portal-gtk
xdg-desktop-portal-gnome
xdg-launch
xdg-ninja
xdg-utils
];
configPackages = with pkgs; [
gnome-session
niri
];
};
# Enable autostart functionality (launch apps on login)
autostart.enable = true;
# Enable menu support for applications
menus.enable = true;
# Enable icon theme support (icons for applications, etc.)
icons.enable = true;
# Enable sounds for system events (like notifications)
sounds.enable = true;
# Terminal execution for XDG spec
terminal-exec.enable = true;
};
# Enable MIME type handling for file associations
xdg.mime.enable = true;
# Enable additional configurations for portals
xdg.portal.wlr.enable = true; # Disable Wayland/Weston portal support (as you've commented out)
# Icons
xdg.icons.fallbackCursorThemes = [ "Adwaita" ]; # Set a default cursor theme (you can change this)
# Terminal execution configuration
xdg.terminal-exec.package = pkgs.foot; # Choose the terminal emulator (can be changed to your preference)
xdg.terminal-exec.settings = { }; # Terminal-specific settings (customizable)
}
modules/zfs.nix
-23
View File
@@ -1,23 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.forceImportRoot = lib.mkDefault false;
#boot.zfs.package = lib.mkDefault pkgs.zfs_unstable;
services.zfs.trim.enable = true;
services.zfs.autoScrub.enable = true;
services.zfs.autoSnapshot.enable = true;
services.zfs.autoSnapshot.flags = lib.mkDefault "-k -p --utc";
environment.systemPackages = with pkgs; [
zfs
zfstools
zfsbackup
lz4
];
}
modules/zram.nix
+1 -1
View File
@@ -10,7 +10,7 @@
zramSwap = lib.mkDefault {
enable = true;
memoryPercent = 90;
memoryPercent = 25;
};
}
packages/android-cli/default.nix
-51
View File
@@ -1,51 +0,0 @@
{
lib,
stdenv,
fetchurl,
autoPatchelfHook,
buildFHSEnv,
glibc,
}:
let
pname = "android-cli";
version = "latest";
bootstrap = stdenv.mkDerivation {
pname = "${pname}-bootstrap";
inherit version;
src = fetchurl {
url = "https://dl.google.com/android/cli/latest/linux_x86_64/android";
hash = "sha256-JP87rF2xblvMX9KlTcWAQf0G2zczic1kQt7bAE/gkr4=";
};
nativeBuildInputs = [ autoPatchelfHook ];
dontUnpack = true;
installPhase = ''
runHook preInstall
mkdir -p $out/libexec
cp $src $out/libexec/android
chmod +x $out/libexec/android
runHook postInstall
'';
};
in
buildFHSEnv {
name = pname;
targetPkgs = pkgs: [ pkgs.glibc ];
runScript = "${bootstrap}/libexec/android";
meta = {
description = "Android CLI - lightweight programmatic interface for Android development";
homepage = "https://developer.android.com/tools/agents";
license = lib.licenses.unfree;
platforms = [ "x86_64-linux" ];
mainProgram = "android-cli";
};
}
packages/intel-sycl/bintools-unwrapped/default.nix
-19
View File
@@ -1,19 +0,0 @@
{
runCommand,
llvm,
lld,
}:
runCommand "intel-sycl-bintools-${llvm.version}" { preferLocalBuild = true; } ''
mkdir -p $out/bin
ln -s ${llvm}/bin/llvm-ar $out/bin/ar
ln -s ${llvm}/bin/llvm-objcopy $out/bin/objcopy
ln -s ${llvm}/bin/llvm-size $out/bin/size
ln -s ${lld}/bin/lld $out/bin/ld
ln -s ${llvm}/bin/llvm-cov $out/bin/cov
ln -s ${llvm}/bin/llvm-foreach $out/bin/foreach
ln -s ${llvm}/bin/llvm-link $out/bin/link
ln -s ${llvm}/bin/llvm-profdata $out/bin/profdata
ln -s ${llvm}/bin/llvm-spirv $out/bin/spirv
''
packages/intel-sycl/clang/default.nix
-36
View File
@@ -1,36 +0,0 @@
{
wrapCCWith,
llvm,
bintools,
gcc,
stdenv,
}:
wrapCCWith {
inherit bintools;
cc = llvm;
extraBuildCommands = ''
echo "" > $out/nix-support/add-hardening.sh
'';
extraPackages = [
llvm.dev
llvm.lib
];
nixSupport = {
cc-cflags = [
"-isystem ${llvm.dev}/include"
"-isystem ${llvm.dev}/include/sycl"
"-resource-dir=${llvm.rsrc}"
"--gcc-toolchain=${gcc.cc}"
];
cc-ldflags = [
"-L${llvm.lib}/lib"
"-L${gcc.cc}/lib/gcc/${stdenv.targetPlatform.config}/${gcc.version}"
"-L${gcc.cc.lib}/lib"
];
};
}
packages/intel-sycl/default.nix
-51
View File
@@ -1,51 +0,0 @@
global: self:
let
inherit (global) callPackage;
pins = callPackage ./pins { };
version = "nightly-2026-07-13";
src = global.fetchFromGitHub {
owner = "intel";
repo = "llvm";
rev = version;
hash = "sha256-Nm2aHYuP9ums+J+0VSIew3B3ynfYv293UxV/4AyBcMQ=";
};
in
{
lld = callPackage ./lld {
inherit (self) llvm;
inherit src version;
};
llvm = callPackage ./llvm {
inherit src version pins;
};
bintools-unwrapped = callPackage ./bintools-unwrapped {
inherit (self) llvm lld;
};
bintools = global.wrapBintoolsWith {
bintools = self.bintools-unwrapped;
};
clang = callPackage ./clang {
inherit (self) bintools llvm;
};
stdenv = global.overrideCC global.stdenv self.clang;
openmp = callPackage ./openmp {
inherit (self) stdenv;
inherit src version;
};
xpti = callPackage ./xpti {
inherit (self) stdenv;
inherit src version;
};
xptifw = callPackage ./xptifw {
inherit (self) stdenv;
inherit src version pins;
};
}
packages/intel-sycl/lld/default.nix
-33
View File
@@ -1,33 +0,0 @@
{
lib,
stdenv,
src,
version,
cmake,
llvm,
libz,
libxml2,
}:
stdenv.mkDerivation {
inherit src version;
pname = "intel-lld";
sourceRoot = "${src.name}/lld";
outputs = [
"out"
"dev"
];
nativeBuildInputs = [ cmake ];
buildInputs = [
llvm
libz
libxml2
];
cmakeFlags = [
(lib.cmakeFeature "LLD_INSTALL_PACKAGE_DIR" "${placeholder "dev"}/lib/cmake/lld")
];
}
packages/intel-sycl/llvm/default.nix
-156
View File
@@ -1,156 +0,0 @@
{
stdenv,
gcc,
writeShellApplication,
wrapCCWith,
src,
version,
cmake,
pkg-config,
python3,
perl,
libz,
libxml2,
ncurses,
hwloc,
level-zero,
unified-memory-framework,
emhash,
parallel-hashmap,
spirv-headers,
opencl-headers,
ocl-icd,
intel-compute-runtime,
pins,
}:
let
root = "/build/source";
cc = wrapCCWith {
cc = writeShellApplication {
name = "clang";
text = ''
exec ${root}/build/bin/clang-22 "$@"
'';
passthru.isClang = true;
};
extraBuildCommands = ''
echo "" > $out/nix-support/add-hardening.sh
'';
nixSupport = {
cc-cflags = [
"-isystem /build/source/build/include"
"-resource-dir=/build/source/build/lib/clang/22"
"--gcc-toolchain=${gcc.cc}"
];
cc-ldflags = [
"-L/build/source/build/lib"
"-L${gcc.cc}/lib/gcc/${stdenv.targetPlatform.config}/${gcc.version}"
"-L${gcc.cc.lib}/lib"
];
};
};
in
stdenv.mkDerivation {
inherit src version;
pname = "intel-llvm";
NIX_CFLAGS_COMPILE = [ "-Wno-unused-command-line-argument" ];
patches = [ ./gnu-install-dirs.patch ];
outputs = [
"out"
"lib"
"dev"
"rsrc"
"python"
];
nativeBuildInputs = [
cmake
pkg-config
python3
perl
];
buildInputs = [
libz
libxml2
ncurses
hwloc
unified-memory-framework
emhash
parallel-hashmap
level-zero
opencl-headers
ocl-icd
];
cmakeBuildType = "Release";
cmakeDir = "../llvm";
cmakeFlags = [
"-DCMAKE_BUILD_TYPE=Release"
"-DLLVM_TARGETS_TO_BUILD=Native"
"-DLLVM_INSTALL_UTILS=ON"
"-DLLVM_ENABLE_ZSTD=ON"
"-DLLVM_USE_STATIC_ZSTD=ON"
"-DLLVM_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/cmake/llvm"
"-DLLVM_INCLUDE_TESTS=OFF"
"-DLLVM_BUILD_TESTS=OFF"
"-DLLVM_ENABLE_ASSERTIONS=OFF"
"-DLLVM_ENABLE_DOXYGEN=OFF"
"-DLLVM_ENABLE_SPHINX=OFF"
"-DLLVM_EXTERNAL_PROJECTS=sycl;sycl-jit;llvm-spirv;opencl;xpti;xptifw;libdevice"
"-DLLVM_EXTERNAL_SYCL_SOURCE_DIR=/build/source/sycl"
"-DLLVM_EXTERNAL_SYCL_JIT_SOURCE_DIR=/build/source/sycl-jit"
"-DLLVM_EXTERNAL_LLVM_SPIRV_SOURCE_DIR=/build/source/llvm-spirv"
"-DLLVM_EXTERNAL_XPTI_SOURCE_DIR=/build/source/xpti"
"-DLLVM_EXTERNAL_XPTIFW_SOURCE_DIR=/build/source/xptifw"
"-DLLVM_EXTERNAL_LIBDEVICE_SOURCE_DIR=/build/source/libdevice"
"-DLLVM_ENABLE_PROJECTS=clang;clang-tools-extra;sycl;sycl-jit;llvm-spirv;opencl;xpti;xptifw;libdevice"
"-DSYCL_ENABLE_XPTI_TRACING=ON"
"-DSYCL_COMPILER_VERSION=20260101"
"-DCLANG_RESOURCE_DIR=../lib/clang/22"
"-DFETCHCONTENT_SOURCE_DIR_VC-INTRINSICS=${pins.vc-intrinsics}"
"-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers}"
"-DUR_USE_EXTERNAL_UMF=ON"
"-DL0_COMPUTE_RUNTIME_HEADERS=${intel-compute-runtime.src}/level_zero/include"
];
postPatch = ''
substituteInPlace libdevice/cmake/modules/SYCLLibdevice.cmake \
--replace-fail "\''${clang_exe}" "${cc}/bin/clang"
substituteInPlace unified-runtime/cmake/FetchOpenCL.cmake \
--replace-fail "NO_CMAKE_PACKAGE_REGISTRY" ""
'';
postInstall = ''
mkdir -p $python/share
mv $out/share/opt-viewer $python/share/opt-viewer
moveToOutput "bin/llvm-config*" "$dev"
substituteInPlace "$dev/lib/cmake/llvm/LLVMExports-release.cmake" \
--replace-fail "$out/bin/llvm-config" "$dev/bin/llvm-config"
substituteInPlace "$dev/lib/cmake/llvm/LLVMExports.cmake" \
--replace-fail "\''${_IMPORT_PREFIX}/include" "$dev/include"
substituteInPlace "$dev/lib/cmake/llvm/LLVMConfig.cmake" \
--replace-fail 'set(LLVM_BINARY_DIR "''${LLVM_INSTALL_PREFIX}")' "set(LLVM_BINARY_DIR \"$lib\")"
'';
postFixup = ''
mkdir -p $rsrc
mv $out/lib/clang/22/include $rsrc/include
rm -rf $out/lib/clang
'';
passthru.isLLVM = true;
passthru.isClang = true;
}
packages/intel-sycl/openmp/default.nix
-23
View File
@@ -1,23 +0,0 @@
{
stdenv,
src,
version,
cmake,
python3,
}:
stdenv.mkDerivation {
inherit src version;
pname = "intel-openmp";
sourceRoot = "${src.name}/openmp";
outputs = [
"out"
"dev"
];
nativeBuildInputs = [
cmake
python3
];
}
packages/intel-sycl/pins/default.nix
-9
View File
@@ -1,9 +0,0 @@
{ fetchFromGitHub }:
{
vc-intrinsics = fetchFromGitHub {
owner = "intel";
repo = "vc-intrinsics";
rev = "60cea7590bd022d95f5cf336ee765033bd114d69";
hash = "sha256-1K16UEa6DHoP2ukSx58OXJdtDWyUyHkq5Gd2DUj1644=";
};
}
packages/intel-sycl/xpti/default.nix
-19
View File
@@ -1,19 +0,0 @@
{
stdenv,
src,
version,
cmake,
}:
stdenv.mkDerivation {
inherit src version;
pname = "intel-xpti";
sourceRoot = "${src.name}/xpti";
outputs = [
"out"
"dev"
];
nativeBuildInputs = [ cmake ];
}
packages/intel-sycl/xptifw/default.nix
-26
View File
@@ -1,26 +0,0 @@
{
stdenv,
src,
version,
cmake,
parallel-hashmap,
emhash,
}:
stdenv.mkDerivation {
inherit src version;
pname = "intel-xptifw";
sourceRoot = "${src.name}/xptifw";
outputs = [
"out"
"dev"
];
nativeBuildInputs = [ cmake ];
buildInputs = [
emhash
parallel-hashmap
];
}
packages/llama-cpp-nightly/default.nix
-187
View File
@@ -1,187 +0,0 @@
{
lib,
autoAddDriverRunpath,
cmake,
fetchFromGitHub,
stdenv,
ninja,
pkg-config,
curl,
config,
cudaSupport ? config.cudaSupport,
cudaPackages ? { },
rocmSupport ? config.rocmSupport,
rocmPackages ? { },
rocmGpuTargets ? rocmPackages.clr.localGpuTargets or rocmPackages.clr.gpuTargets,
openclSupport ? false,
clblast,
blasSupport ? builtins.all (x: !x) [
cudaSupport
metalSupport
openclSupport
rocmSupport
syclSupport
vulkanSupport
],
blas,
metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 && !openclSupport,
vulkanSupport ? false,
rpcSupport ? false,
shaderc,
spirv-headers,
vulkan-headers,
vulkan-loader,
syclSupport ? false,
mkl ? null,
oneDNN ? null,
syclStdenv ? null,
syclF16Support ? false,
syclDeviceArch ? "",
uiAssets ? null,
}:
let
effectiveStdenv =
if cudaSupport then
cudaPackages.backendStdenv
else if syclSupport && syclStdenv != null then
syclStdenv
else
stdenv;
inherit (lib)
cmakeBool
cmakeFeature
optionals
optionalString
;
cudaBuildInputs = with cudaPackages; [
cuda_cccl
cuda_cudart
libcublas
];
rocmBuildInputs = with rocmPackages; [
clr
hipblas
rocblas
];
vulkanBuildInputs = [
shaderc
spirv-headers
vulkan-headers
vulkan-loader
];
in
effectiveStdenv.mkDerivation (finalAttrs: {
pname = "llama-cpp-nightly";
version = "10034";
src = fetchFromGitHub {
owner = "ggml-org";
repo = "llama.cpp";
tag = "b${finalAttrs.version}";
hash = "sha256-pbQyfntd8JGx+ZVnis9CzJ9dNFqBEwKwYt4iHRWiC7g=";
leaveDotGit = true;
postFetch = ''
git -C "$out" rev-parse --short HEAD > $out/COMMIT
find "$out" -name .git -print0 | xargs -0 rm -rf
'';
};
nativeBuildInputs = [
cmake
ninja
pkg-config
]
++ optionals cudaSupport [
cudaPackages.cuda_nvcc
autoAddDriverRunpath
];
buildInputs =
optionals cudaSupport cudaBuildInputs
++ optionals openclSupport [ clblast ]
++ optionals rocmSupport rocmBuildInputs
++ optionals blasSupport [ blas ]
++ optionals vulkanSupport vulkanBuildInputs
++ optionals syclSupport ([ mkl ] ++ optionals (oneDNN != null) [ oneDNN ])
++ [ curl ];
postPatch = optionalString (uiAssets != null) ''
mkdir -p tools/ui/dist
cp -r ${uiAssets}/* tools/ui/dist/
'';
preConfigure = ''
prependToVar cmakeFlags "-DLLAMA_BUILD_COMMIT:STRING=$(cat COMMIT)"
'';
cmakeFlags = [
(cmakeBool "GGML_NATIVE" false)
(cmakeBool "LLAMA_BUILD_EXAMPLES" false)
(cmakeBool "LLAMA_BUILD_SERVER" true)
(cmakeBool "LLAMA_BUILD_TESTS" false)
(cmakeBool "LLAMA_BUILD_UI" (uiAssets != null))
(cmakeBool "BUILD_SHARED_LIBS" true)
(cmakeBool "GGML_BLAS" blasSupport)
(cmakeBool "GGML_CLBLAST" openclSupport)
(cmakeBool "GGML_CUDA" cudaSupport)
(cmakeBool "GGML_HIP" rocmSupport)
(cmakeBool "GGML_METAL" metalSupport)
(cmakeBool "GGML_RPC" rpcSupport)
(cmakeBool "GGML_VULKAN" vulkanSupport)
(cmakeBool "GGML_SYCL" syclSupport)
(cmakeFeature "LLAMA_BUILD_NUMBER" finalAttrs.version)
]
++ optionals cudaSupport [
(cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
]
++ optionals rocmSupport [
(cmakeFeature "CMAKE_HIP_COMPILER" "${rocmPackages.clr.hipClangPath}/clang++")
(cmakeFeature "CMAKE_HIP_ARCHITECTURES" (builtins.concatStringsSep ";" rocmGpuTargets))
]
++ optionals metalSupport [
(cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1")
(cmakeBool "LLAMA_METAL_EMBED_LIBRARY" true)
]
++ optionals rpcSupport [
(cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
]
++ optionals syclSupport [
(cmakeFeature "GGML_SYCL_TARGET" "INTEL")
(cmakeBool "GGML_SYCL_DNN" (oneDNN != null))
(cmakeBool "GGML_SYCL_F16" syclF16Support)
]
++ optionals (syclSupport && syclDeviceArch != "") [
(cmakeFeature "GGML_SYCL_DEVICE_ARCH" syclDeviceArch)
];
postInstall = ''
ln -sf $out/bin/llama-cli $out/bin/llama
mkdir -p $out/include
cp $src/include/llama.h $out/include/
''
+ optionalString rpcSupport "cp bin/rpc-server $out/bin/llama-rpc-server";
doCheck = false;
meta = {
description = "Inference of Meta's LLaMA model (and others) in pure C/C++)";
homepage = "https://github.com/ggml-org/llama.cpp";
license = lib.licenses.mit;
mainProgram = "llama";
platforms = if syclSupport then [ "x86_64-linux" ] else lib.platforms.unix;
badPlatforms = optionals (cudaSupport || openclSupport) lib.platforms.darwin;
broken =
(metalSupport && !effectiveStdenv.hostPlatform.isDarwin) || (syclSupport && syclStdenv == null);
};
})

Some files were not shown because too many files have changed in this diff Show More