home/neovim: remove unused plugin

flake.lock

@@ -69,19 +69,6 @@
         "type": "github"
       }
     },
-    "fonts": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1668957008,
-        "narHash": "sha256-er2eUfNSG9qdBh0JvtxtftQjFfTFjRqqD8dnk5nZ1qw=",
-        "path": "/home/h7x4/git/fonts",
-        "type": "path"
-      },
-      "original": {
-        "path": "/home/h7x4/git/fonts",
-        "type": "path"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -89,11 +76,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1718530513,
+        "lastModified": 1726989464,
-        "narHash": "sha256-BmO8d0r+BVlwWtMLQEYnwmngqdXIuyFzMwvmTcLMee8=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a1fddf0967c33754271761d91a3d921772b30d0e",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
@@ -103,26 +90,6 @@
         "type": "github"
       }
     },
-    "home-manager-local": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ]
-      },
-      "locked": {
-        "lastModified": 1719170506,
-        "narHash": "sha256-AROqng7/S3mTByq8DBVR6r0iW1yZH+otJkqOwLHvELE=",
-        "ref": "refs/heads/fix-stalonetrayrc-path",
-        "rev": "0e5656163c2f9ac6e2cc4de3b44beb7a137abbe6",
-        "revCount": 3588,
-        "type": "git",
-        "url": "file:///home/h7x4/git/home-manager"
-      },
-      "original": {
-        "type": "git",
-        "url": "file:///home/h7x4/git/home-manager"
-      }
-    },
     "matrix-synapse-next": {
       "inputs": {
         "nixpkgs": [
@@ -191,11 +158,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1719278718,
+        "lastModified": 1728006367,
-        "narHash": "sha256-gWQb4P9CZgKzTn4F4eWMYeUv2AQOXFlcFmFXh2apoyA=",
+        "narHash": "sha256-Bdf5twzinaacnn1JBogvxq0S8Ytm+25mWD2cfJ7fvpo=",
         "owner": "infinidoge",
         "repo": "nix-minecraft",
-        "rev": "b6ff85f3b416a700ac35e33c214d7c9f4fe071fa",
+        "rev": "a3a7888df1b87bdababfd9f0b00b574ee4c2e204",
         "type": "github"
       },
       "original": {
@@ -206,11 +173,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719145550,
+        "lastModified": 1728193676,
-        "narHash": "sha256-K0i/coxxTEl30tgt4oALaylQfxqbotTSNb1/+g+mKMQ=",
+        "narHash": "sha256-PbDWAIjKJdlVg+qQRhzdSor04bAPApDqIv2DofTyynk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e4509b3a560c87a8d4cb6f9992b8915abf9e36d8",
+        "rev": "ecbc1ca8ffd6aea8372ad16be9ebbb39889e55b6",
         "type": "github"
       },
       "original": {
@@ -221,27 +188,27 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1719099622,
+        "lastModified": 1728156290,
-        "narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=",
+        "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e8e3b89adbd0be63192f6e645e0a54080004924",
+        "rev": "17ae88b569bb15590549ff478bab6494dde4a907",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1719254875,
+        "lastModified": 1728018373,
-        "narHash": "sha256-ECni+IkwXjusHsm9Sexdtq8weAq/yUyt1TWIemXt3Ko=",
+        "narHash": "sha256-NOiTvBbRLIOe5F6RbHaAh6++BNjsb149fGZd1T4+KBg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2893f56de08021cffd9b6b6dfc70fd9ccd51eb60",
+        "rev": "bc947f541ae55e999ffdb4013441347d83b00feb",
         "type": "github"
       },
       "original": {
@@ -273,9 +240,7 @@
     "root": {
       "inputs": {
         "dotfiles": "dotfiles",
-        "fonts": "fonts",
         "home-manager": "home-manager",
-        "home-manager-local": "home-manager-local",
         "matrix-synapse-next": "matrix-synapse-next",
         "maunium-stickerpicker": "maunium-stickerpicker",
         "minecraft": "minecraft",
@@ -314,11 +279,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1719268571,
+        "lastModified": 1728342863,
-        "narHash": "sha256-pcUk2Fg5vPXLUEnFI97qaB8hto/IToRfqskFqsjvjb8=",
+        "narHash": "sha256-OeVSBqpigXgX3tuvkO2B3xN1ONSF0iFTbi6et7YhX+M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c2ea1186c0cbfa4d06d406ae50f3e4b085ddc9b3",
+        "rev": "84d006846f98b2bfed3796f1ccc8e62faf0c2ae9",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,10 +1,11 @@
 {
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.05";
+    nixpkgs.url = "nixpkgs/nixos-24.11";
-    nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
+    # nixpkgs-unstable.url = "nixpkgs/nixpkgs-unstable";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/release-24.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -87,7 +88,7 @@
         android_sdk.accept_license = true;
         segger-jlink.acceptLicense = true;
         permittedInsecurePackages = [
-          "segger-jlink-qt4-794l"
+          "segger-jlink-qt4-796s"
         ];
       };
 
@@ -97,30 +98,16 @@
           config.allowUnfree = true;
           config.segger-jlink.acceptLicense = true;
           config.permittedInsecurePackages = [
-            "segger-jlink-qt4-794s"
+            "segger-jlink-qt4-796s"
           ];
         };
       in [
         (self: super: {
           inherit (nonrecursive-unstable-pkgs)
-            atuin
+              calibre
-            wstunnel
+              fcitx5-mozc
-            nrf-udev
-            nrfutil
             ;
         })
-
-        # https://github.com/NixOS/nixpkgs/pull/251706
-        (self: super: {
-          mozc = self.qt6Packages.callPackage ./package-overrides/mozc.nix { };
-          fcitx5-mozc = self.callPackage ./package-overrides/fcitx5-mozc.nix { };
-        })
-
-        (self: super: {
-          mpv-unwrapped = super.mpv-unwrapped.override {
-            ffmpeg = super.ffmpeg_6-full;
-          };
-        })
       ];
     };
 
@@ -221,7 +208,11 @@
             "specialArgs"
           ]));
     in {
-      dosei = nixSys "dosei" { };
+      dosei = nixSys "dosei" {
+        modules = [{
+          home-manager.users.h7x4.home.uid = 1001;
+        }];
+      };
       kasei = nixSys "kasei" { };
       europa = nixSys "europa" { };
       tsuki = nixSys "tsuki" {

home/home.nix

@@ -10,22 +10,34 @@ in {
 
     ./programs/aria2.nix
     ./programs/atuin.nix
+    ./programs/bash.nix
+    ./programs/bat.nix
     ./programs/beets.nix
+    ./programs/bottom.nix
     ./programs/comma.nix
     ./programs/direnv
+    ./programs/eza.nix
+    ./programs/fzf.nix
     ./programs/gdb.nix
-    ./programs/gh.nix
     ./programs/gh-dash.nix
+    ./programs/gh.nix
     ./programs/git
     ./programs/gpg
+    ./programs/home-manager.nix
     ./programs/jq.nix
     ./programs/less.nix
+    ./programs/man.nix
     ./programs/neovim
     ./programs/nix-index
+    ./programs/pandoc.nix
+    ./programs/ripgrep.nix
     ./programs/ssh
     ./programs/tealdeer
+    ./programs/texlive.nix
     ./programs/thunderbird.nix
-    ./programs/tmux.nix
+    ./programs/tmux
+    ./programs/yt-dlp.nix
+    ./programs/zoxide.nix
     ./programs/zsh
 
     ./services/nix-channel-update.nix
@@ -33,14 +45,18 @@ in {
 
     ./modules/colors.nix
     ./modules/shellAliases.nix
+    ./modules/uidGid.nix
   ] ++ optionals graphics [
     ./config/gtk.nix
 
     ./programs/alacritty.nix
     ./programs/emacs
+    ./programs/feh.nix
     ./programs/firefox.nix
+    ./programs/mpv.nix
     ./programs/ncmpcpp.nix
     ./programs/newsboat
+    ./programs/obs-studio.nix
     ./programs/qutebrowser.nix
     ./programs/rofi.nix
     ./programs/taskwarrior.nix
@@ -53,7 +69,10 @@ in {
     ./services/copyq.nix
     ./services/dunst.nix
     ./services/fcitx5.nix
+    ./services/gnome-keyring.nix
+    ./services/keybase.nix
     ./services/mpd.nix
+    ./services/network-manager.nix
     ./services/picom.nix
     ./services/polybar.nix
     ./services/screen-locker.nix
@@ -132,51 +151,6 @@ in {
 
   fonts.fontconfig.enable = mkForce true;
 
-  programs = {
-    home-manager.enable = true;
-
-    bash = {
-      enable = true;
-      historyFile = "${config.xdg.dataHome}/bash_history";
-      historySize = 100000;
-      bashrcExtra = ''
-        source "${config.xdg.configHome}/mutable_env.sh"
-      '';
-    };
-
-    bat.enable = true;
-    bottom = {
-      enable = true;
-      settings.flags.enable_gpu = true;
-    };
-    eza.enable = true;
-    feh.enable = mkIf graphics true;
-    fzf = {
-      enable = true;
-      defaultCommand = "fd --type f";
-    };
-    man = {
-      enable = true;
-      generateCaches = true;
-    };
-    mpv.enable = mkIf graphics true;
-    obs-studio.enable = mkIf graphics true;
-    ssh = {
-      enable = true;
-      includes = [ "mutable_config" ];
-    };
-    texlive = {
-      enable = true;
-      # packageSet = pkgs.texlive.combined.scheme-medium;
-    };
-    zoxide.enable = true;
-  };
-
-  services = {
-    gnome-keyring.enable = mkIf graphics true;
-    network-manager-applet.enable = mkIf graphics true;
-  };
-
   manual = {
     html.enable = true;
     manpages.enable = true;

home/modules/uidGid.nix

@@ -0,0 +1,13 @@
+{ lib, ... }:
+{
+  options.home = {
+    uid = lib.mkOption {
+      default = 1000;
+      type = lib.types.ints.between 0 60000;
+    };
+    gid = lib.mkOption {
+      default = 1000;
+      type = lib.types.ints.between 0 60000;
+    };
+  };
+}

home/packages.nix

@@ -5,13 +5,14 @@
     cloc
     cyme
     czkawka
-    delta
     diskonaut
     duf
     duff
     ffmpeg
     file
     glances
+    gpauth
+    gpclient
     gpg-tui
     gping
     graphviz
@@ -19,7 +20,6 @@
     httpie
     imagemagick
     kepubify
-    # keybase
     keymapviz
     libwebp
     lnav
@@ -39,18 +39,15 @@
     # nixops
     nmap
     ouch
-    pandoc
     parallel
     progress
     pwntools
     python3
     rclone
-    ripgrep
     rsync
     # sc-im
     slack-term
     tea
-    tealdeer
     terminal-parrot
     termtosvg
     toilet
@@ -62,7 +59,6 @@
     waifu2x-converter-cpp
     wavemon
     wiki-tui
-    yt-dlp
     yubico-pam
     yubikey-agent
     yubikey-manager
@@ -89,8 +85,8 @@
       geogebra
       ghidra
       gimp
-      gnome.gnome-font-viewer
+      gnome-font-viewer
-      gnome.seahorse
+      seahorse
       google-chrome
       imhex
       inkscape

home/programs/alacritty.nix

@@ -43,9 +43,9 @@
         duration = 20;
       };
 
-      live_config_reload = true;
+      general.live_config_reload = true;
 
-      shell = {
+      terminal.shell = {
         program = "${pkgs.zsh}/bin/zsh";
         args = [ "--login" ];
       };

home/programs/atuin.nix

@@ -1,9 +1,7 @@
 { config, ... }:
 let
   cfg = config.programs.atuin;
-
+  xdg_runtime_dir = "/run/user/${toString config.home.uid}";
-  # TODO: retrieve this in a more dynamic and correct manner
-  xdg_runtime_dir = "/run/user/1000";
 in
 {
   programs.atuin = {

home/programs/bash.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  programs.bash = {
+    enable = true;
+    historyFile = "${config.xdg.dataHome}/bash_history";
+    historySize = 100000;
+    bashrcExtra = ''
+      source "${config.xdg.configHome}/mutable_env.sh"
+    '';
+  };
+}

home/programs/bat.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.bat.enable = true;
+}

home/programs/bottom.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.bottom = {
+    enable = true;
+    settings.flags.enable_gpu = true;
+  };
+}

home/programs/eza.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.eza.enable = true;
+}

home/programs/feh.nix

@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  programs.feh.enable = !machineVars.headless;
+}

home/programs/fzf.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.fzf = {
+    enable = true;
+    defaultCommand = "fd --type f";
+  };
+}

home/programs/git/default.nix

@@ -48,15 +48,71 @@ in
       aliases = {
         aliases = "!git config --get-regexp alias | sed -re 's/alias\\.(\\S*)\\s(.*)$/\\1 = \\2/g'";
         delete-merged = "!git branch --merged | grep -v '\\*' | xargs -n 1 git branch -d";
-        graph = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
-        graphv = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(bold yellow)%d%C(reset)%n''          %C(white)%s%C(reset) %C(dim white)- %an%C(reset)' --all";
         forcepush = "push --force-with-lease --force-if-includes";
         authors = "shortlog --summary --numbered --email";
         si = "switch-interactive";
+        ff = "fixup-fixup";
+        fi = "fixup-interactive";
+        rf = "rebase-fixups";
+        pp = "post-pr";
         subs = "submodule update --init --recursive";
         rebase-author = "rebase -i -x \"git commit --amend --reset-author -CHEAD\"";
         git = "!git";
-      };
+      } // (let
+        c = c: s: "%C(${c})${s}%C(reset)";
+      in {
+        graph = let
+          fmt = lib.concatStringsSep "" [
+            " - "
+            (c "bold blue" "%h")
+            " - "
+            (c "bold green" "(%ar)")
+            " "
+            (c "white" "> %s")
+            " "
+            (c "dim white" "- %an")
+            (c "bold yellow" "%d")
+          ];
+        in "log --graph --abbrev-commit --decorate --format=format:'${fmt}' --all";
+
+        graphv = let
+          fmt = lib.concatStringsSep "" [
+            (c "bold blue" "%h")
+            " - "
+            (c "bold cyan" "%aD")
+            " "
+            (c "bold green" "(%ar)")
+            (c "bold yellow" "%d")
+            "%n"
+            "          "
+            (c "white" "%s")
+            " "
+            (c "dim white" "- %an")
+          ];
+        in "log --graph --abbrev-commit --decorate --format=format:'${fmt}' --all";
+
+        l = let
+          fmt = lib.concatStringsSep "%n" (map (x: if builtins.isList x then lib.concatStringsSep " " x else x) [
+            [ (c "bold yellow" "%H") (c "auto" "%d") ]
+            [ (c "bold white" "Author:") (c "bold cyan" "%aN <%aE>") (c "bold green" "(%ah)") ]
+            [ (c "bold white" "Committer:") (c "bold cyan" "%cN <%cE>") (c "bold green" "(%ah)") ]
+            [ (c "bold white" "GPG: (%G?)") (c "bold magenta" "%GF") "-" (c "bold cyan" "%GS") (c "bold blue" "(%GT) ") ]
+            ""
+            (c "bold white" "# %s")
+            "%+b"
+            (c "dim yellow" "%+N")
+          ]);
+          # sedExpressions = let
+          #   colorExpr = "\\x1B\\[([0-9]{1,3}(;[0-9]{1,2};?)?)?[mGK]";
+          #   colorEndExpr = "\\x1B\\[m";
+          #   colored = x: "${colorExpr}${x}${colorEndExpr}";
+          # in lib.concatMapStringsSep " " (x: "-e '${x}'") [
+          #   "s|${colored "GPG: \\(N\\)"} ${colored "F3CDA86CC55A9F10D7A069819F2F7D8250F35146"} - ${colored "h7x4 <h7x4@nani.wtf>"} ${colored "\\(ultimate\\)"}|GPG: h7x4|"
+          #   "s|${colored "GPG: \\(N\\)"} ${colored ""} - ${colored ""} ${colored "\\(undefined\\)"}||"
+          # ];
+        in "log --decorate --format=tformat:'${fmt}'";
+        # in "!git log --color=always --format=format:'${fmt}' | sed -E ${sedExpressions} | $PAGER";
+      });
 
       extraConfig = {
         core = {
@@ -270,6 +326,21 @@ in
         (builtins.replaceStrings ["hours" "tcommit"] ["minutes" "tmcommit"])
       ];
     })
+    (pkgs.writeShellApplication {
+      name = "git-fixup-fixup";
+      runtimeInputs = with pkgs; [ cfg.package ];
+      text = lib.fileContents ./scripts/git-fixup-fixup.sh;
+    })
+    (pkgs.writeShellApplication {
+      name = "git-rebase-fixups";
+      runtimeInputs = with pkgs; [ cfg.package gnused ];
+      text = lib.fileContents ./scripts/git-rebase-fixups.sh;
+    })
+    (pkgs.writeShellApplication {
+      name = "git-fixup-interactive";
+      runtimeInputs = with pkgs; [ cfg.package gnused gnugrep fzf ];
+      text = lib.fileContents ./scripts/git-fixup-interactive.sh;
+    })
     (pkgs.writeShellApplication {
       name = "git-switch-interactive";
       runtimeInputs = with pkgs; [ cfg.package fzf gnused coreutils ];
@@ -278,6 +349,21 @@ in
         "SC2001" # (style): See if you can use ${variable//search/replace} instead. (sed invocation)
       ];
     })
+    ((pkgs.writers.writePython3Bin "git-post-pr" {
+      libraries = with pkgs.python3Packages; [
+        tkinter
+      ];
+      flakeIgnore = [
+        "E501" # I like long lines grr
+      ];
+    } (lib.fileContents ./scripts/git-post-pr.py)).overrideAttrs (_: {
+      postFixup = ''
+        wrapProgram $out/bin/git-post-pr \
+          --prefix PATH : ${lib.makeBinPath [
+            pkgs.github-cli
+          ]}
+      '';
+    }))
 
     pkgs.git-absorb
   ];

home/programs/git/scripts/git-fixup-fixup.sh

@@ -0,0 +1,14 @@
+if [ -n "${1:-}" ]; then
+  TARGET_COMMIT="$1"
+  shift
+else
+  TARGET_COMMIT="HEAD"
+fi
+
+COMMIT_MESSAGE=$(git log -1 --pretty=format:'%s' "$TARGET_COMMIT")
+
+if [[ $COMMIT_MESSAGE =~ ^fixup!* ]]; then
+  git commit -m "$COMMIT_MESSAGE" "$@"
+else
+  git commit --fixup "$TARGET_COMMIT" "$@"
+fi

home/programs/git/scripts/git-fixup-interactive.sh

@@ -0,0 +1,18 @@
+if [ -n "${1:-}" ]; then
+  TARGET_BRANCH="$1"
+  shift
+else
+  TARGET_BRANCH=$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')
+fi
+
+FORK_POINT=$(git merge-base --fork-point "$TARGET_BRANCH")
+
+COMMITS_SINCE_FORK_POINT=$(git log --format=format:'%s' "$FORK_POINT"..HEAD | grep -v -E '^fixup!')
+
+RESULT=$(fzf <<<"$COMMITS_SINCE_FORK_POINT")
+
+if [ "$RESULT" == "" ]; then
+  echo "Doing nothing..."
+else
+  git commit -m "fixup! $RESULT" "$@"
+fi

home/programs/git/scripts/git-post-pr.py

@@ -0,0 +1,130 @@
+import argparse
+import json
+import subprocess
+import tkinter
+
+# TODO: add support for gitea, and maybe other git hosting options.
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        prog="post-pr",
+        description="Post links to PRs",
+    )
+
+    parser.add_argument("-n", "--no-clipboard", action="store_true", help="do not copy the message to the clipboard")
+
+    pr_id = parser.add_mutually_exclusive_group()
+    pr_id.add_argument("-c", "--current-branch", action="store_true", help="generate post for the PR for the current branch")
+    pr_id.add_argument("-l", "--latest", action="store_true", help="generate post for the latest PR for the current user")
+    pr_id.add_argument("pr_id", nargs="?", default=None, help="generate post for the PR with the given ID")
+    args = parser.parse_args()
+
+    if not any([args.current_branch, args.latest, args.pr_id,]):
+        args.current_branch = True
+
+    return args
+
+
+def _gh(args: list[str]) -> str:
+    try:
+        return subprocess.check_output(["gh"] + args).decode("utf8")
+    except subprocess.CalledProcessError as e:
+        raise RuntimeError(f"GitHub CLI command failed: 'gh {' '.join(args)}'") from e
+
+
+def _gh_retcode(args: list[str]) -> int:
+    return subprocess.run(["gh"] + args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode
+
+
+def ensure_gh_installed():
+    try:
+        if _gh_retcode(["--version"]) != 0:
+            raise RuntimeError("GitHub CLI (gh) is not installed, please install it")
+    except FileNotFoundError:
+        raise RuntimeError("GitHub CLI (gh) is not installed, please install it")
+
+
+def ensure_gh_authenticated():
+    if _gh_retcode(["auth", "status"]) != 0:
+        raise RuntimeError("Failed to authenticate with GitHub, please run 'gh auth login'")
+
+
+GH_PR_JSON_FIELDS = ",".join([
+    "additions",
+    "deletions",
+    "state",
+    "title",
+    "url",
+])
+
+
+def fetch_pr_data(current_branch: bool, latest: bool, pr_id: str | None) -> dict[str, any]:
+    if pr_id:
+        pr_data = _gh(["pr", "view", pr_id, "--json", GH_PR_JSON_FIELDS])
+        pr_data = json.loads(pr_data)
+
+    elif latest:
+        pr_list = _gh(["pr", "list", "--author", "@me", "--limit", "1", "--json", GH_PR_JSON_FIELDS])
+        pr_list = json.loads(pr_list)
+
+        if len(pr_list) == 0:
+            raise RuntimeError("Failed to find PR, are you sure you have any open PRs?")
+
+        pr_data = pr_list[0]
+
+    elif current_branch:
+        pr_data = _gh(["pr", "view", "--json", GH_PR_JSON_FIELDS])
+        pr_data = json.loads(pr_data)
+
+    return pr_data
+
+
+def format_message(pr_data: dict[str, any]) -> str:
+    additions = pr_data["additions"]
+    deletions = pr_data["deletions"]
+
+    title = pr_data["title"]
+    pr_url = pr_data["url"]
+    pr_state = pr_data["state"]
+
+    state_html = f"({pr_state.lower()}) " if pr_state != "OPEN" else ""
+    additions_html = f"+{additions}" if additions > 0 else str(additions)
+    deletions_html = f"-{deletions}" if deletions > 0 else str(deletions)
+
+    return f"""{state_html}{pr_url} {title} [diff: {additions_html}/{deletions_html}]"""
+
+
+def copy_to_clipboard(message: str):
+    r = tkinter.Tk()
+    r.withdraw()
+    r.clipboard_clear()
+    r.clipboard_append(message)
+    r.update()
+    r.destroy()
+
+
+def main():
+    args = parse_args()
+
+    ensure_gh_installed()
+    ensure_gh_authenticated()
+
+    pr_data = fetch_pr_data(args.current_branch, args.latest, args.pr_id)
+    message = format_message(pr_data)
+
+    print("Message:\n")
+    print(f"    {message}\n")
+
+    if not args.no_clipboard:
+        copy_to_clipboard(message)
+        print("Copied to clipboard")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:
+        print(f"Error: {e}")
+        exit(1)
+

home/programs/git/scripts/git-rebase-fixups.sh

@@ -0,0 +1,10 @@
+if [ -n "${1:-}" ]; then
+  TARGET_BRANCH="$1"
+  shift
+else
+  TARGET_BRANCH=$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')
+fi
+
+FORK_POINT=$(git merge-base --fork-point "$TARGET_BRANCH")
+
+git rebase "$FORK_POINT" --autosquash "$@"

home/programs/home-manager.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.home-manager.enable = true;
+}

home/programs/man.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.man = {
+    enable = true;
+    generateCaches = true;
+  };
+}

home/programs/mpv.nix

@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  programs.mpv.enable = !machineVars.headless;
+}

home/programs/ncmpcpp.nix

@@ -1,4 +1,4 @@
-{pkgs, ...}:
+{ config, pkgs, ... }:
 {
   programs.ncmpcpp = {
     enable = true;
@@ -332,11 +332,11 @@
       window_border_color = "green";
       active_window_border = "red";
 
-      visualizer_data_source = "/tmp/mpd.fifo";
+      visualizer_data_source = "/run/user/${toString config.home.uid}/mpd/visualizer.fifo";
       visualizer_output_name = "Visualizer feed";
       visualizer_in_stereo = "no";
-      visualizer_type = "spectrum"; # spectrum, ellipse, wave_filled, wave
+      # visualizer_type = "spectrum"; # spectrum, ellipse, wave_filled, wave
-      visualizer_look = "+█"; # wave | spectrum, ellipse, wave_filled
+      # visualizer_look = "+█"; # wave | spectrum, ellipse, wave_filled
     };
   };
 }

home/programs/neovim/default.nix

@@ -66,25 +66,58 @@
       }
       limelight-vim
       vim-tmux-navigator
-      vim-polyglot
       lightline-vim
+      vim-better-whitespace
       {
-        plugin = rainbow;
+        plugin = nvim-treesitter.withAllGrammars;
         config = ''
-          let g:rainbow_active = 1
+        packadd! nvim-treesitter
+        lua << EOF
+          require'nvim-treesitter.configs'.setup {
+            highlight = {
+              enable = true,
+            },
+          }
+        EOF
+        '';
+      }
+      {
+        plugin = rainbow-delimiters-nvim;
+        config = ''
+        lua << EOF
+          local rainbow_delimiters = require 'rainbow-delimiters'
+          vim.g.rainbow_delimiters = {
+            ["highlight"] = {
+              'RainbowDelimiterRed',
+              'RainbowDelimiterYellow',
+              'RainbowDelimiterBlue',
+              'RainbowDelimiterGreen',
+              'RainbowDelimiterViolet',
+              'RainbowDelimiterCyan',
+            },
+          }
+        EOF
         '';
       }
       {
         plugin = vim-monokai;
         config = ''
           colorscheme monokai
-          autocmd ColorScheme * highlight Normal ctermbg=0
+
-          autocmd ColorScheme * highlight LineNr ctermbg=0
+          autocmd ColorScheme monokai highlight Normal ctermbg=0
-          autocmd ColorScheme * highlight CursorLineNR ctermbg=0 ctermfg=208
+          autocmd ColorScheme monokai highlight LineNr ctermbg=0
-          autocmd ColorScheme * highlight SignColumn ctermbg=0
+          autocmd ColorScheme monokai highlight CursorLineNR ctermbg=0 ctermfg=208
-          autocmd ColorScheme * highlight GitGutterAdd ctermbg=0
+          autocmd ColorScheme monokai highlight SignColumn ctermbg=0
-          autocmd ColorScheme * highlight GitGutterChange ctermbg=0
+          autocmd ColorScheme monokai highlight GitGutterAdd ctermbg=0
-          autocmd ColorScheme * highlight GitGutterDelete ctermbg=0
+          autocmd ColorScheme monokai highlight GitGutterChange ctermbg=0
+          autocmd ColorScheme monokai highlight GitGutterDelete ctermbg=0
+
+          autocmd ColorScheme monokai highlight RainbowDelimiterRed    { fg = g:terminal_color_9 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterYellow { fg = g:terminal_color_11 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterBlue   { fg = g:terminal_color_12 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterGreen  { fg = g:terminal_color_10 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterViolet { fg = g:terminal_color_13 }
+          autocmd ColorScheme monokai highlight RainbowDelimiterCyan   { fg = g:terminal_color_14 }
         '';
       }
     ];

home/programs/newsboat/sources.nix

@@ -37,6 +37,7 @@ in {
     (mkSource [ "japanese" "language" ] "https://www.outlier-linguistics.com/blogs/japanese.atom")
     (mkSource [ "language" ] "https://feeds.feedburner.com/blogspot/Ckyi")
     (mkSource [ "japanese" "language" "old" ] "http://feeds.feedburner.com/LocalizingJapan")
+    (mkSource [ "japanese" "language" ] "https://wesleycrobertson.wordpress.com/feed/")
     (mkSource [ "tech" "vim" "old" ] "https://castel.dev/rss.xml")
     (mkSource [ "tech" "functional-programming" "old" ] "https://skilpat.tumblr.com/rss")
     (mkSource [ "tech" ] "https://resocoder.com/feed/")

home/programs/obs-studio.nix

@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  programs.obs-studio.enable = !machineVars.headless;
+}

home/programs/pandoc.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.pandoc.enable = true;
+}

home/programs/ripgrep.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.ripgrep.enable = true;
+}

home/programs/ssh/default.nix

@@ -10,5 +10,11 @@
     mode = "0444";
   };
 
-  programs.ssh.includes = [ config.sops.secrets."ssh/secret-config".path ];
+  programs.ssh = {
+    enable = true;
+    includes = [
+      config.sops.secrets."ssh/secret-config".path
+      "mutable_config"
+    ];
+  };
 }

home/programs/texlive.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.texlive = {
+    enable = true;
+    # packageSet = pkgs.texlive.combined.scheme-medium;
+  };
+}

home/programs/tmux/default.nix

@@ -1,4 +1,4 @@
-{pkgs, ...}:
+{ pkgs, lib, ... }:
 {
   programs.tmux = {
     enable = true;
@@ -19,7 +19,25 @@
       tmux-fzf
       urlview
     ];
-    extraConfig = ''
+    extraConfig = let
+      fileContentsWithoutShebang = script: lib.pipe script [
+        lib.fileContents
+        (lib.splitString "\n")
+        (lib.drop 3) # remove shebang
+        (lib.concatStringsSep "\n")
+      ];
+
+      fcitx5-status = (pkgs.writeShellApplication {
+        name = "tmux-fcitx5-status";
+        runtimeInputs = with pkgs; [ dbus ];
+        text = fileContentsWithoutShebang ./scripts/fcitx5-status.sh;
+      });
+      mpd-status = (pkgs.writeShellApplication {
+        name = "tmux-mpd-status";
+        runtimeInputs = with pkgs; [ mpc-cli gawk gnugrep ];
+        text = fileContentsWithoutShebang ./scripts/mpd-status.sh;
+      });
+    in ''
       # Don't rename windows automatically after rename with ','
       set-option -g allow-rename off
 
@@ -91,8 +109,8 @@
       ### DESIGN CHANGES ###
       ######################
 
-      set-option -g status-left '#{prefix_highlight} #[bg=blue]#[fg=black,bold] ###S #[bg=default]  #[fg=green]#(~/.scripts/tmux/fcitx)  #[fg=red]%H:%M   '
+      set-option -g status-left '#{prefix_highlight} #[bg=blue]#[fg=black,bold] ###S #[bg=default]  #[fg=green]#(${lib.getExe fcitx5-status})  #[fg=red]%H:%M   '
-      set-option -g status-right '#[fg=red]#(~/.scripts/tmux/mpd)'
+      set-option -g status-right '#[fg=red]#(${lib.getExe mpd-status})'
       set-window-option -g window-status-current-style fg=magenta
       set-option -g status-style 'bg=black fg=default'
       set-option -g default-shell '${pkgs.zsh}/bin/zsh'

home/programs/tmux/scripts/fcitx5-status.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p dbus
+
+printState() {
+  STATUS=$(dbus-send --session --print-reply=literal --dest='org.fcitx.Fcitx5' '/controller' 'org.fcitx.Fcitx.Controller1.CurrentInputMethod' | tr -d '[:space:]')
+
+  case $STATUS in
+    keyboard-us)
+      echo 'US'
+    ;;
+    keyboard-no)
+      echo 'NO'
+    ;;
+    mozc)
+      echo '日本語'
+    ;;
+    *)
+      echo "$STATUS?"
+    ;;
+  esac
+}
+
+while :; do
+  printState
+  sleep 1
+done

home/programs/tmux/scripts/mpd-status.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i sh -p mpc-cli gawk gnugrep
+
+while true; do
+  MPC_OUTPUT=$(mpc --format '[[%artist% - ]%title%]|[%file%]')
+
+  TITLE=$(head -n 1 <<<"$MPC_OUTPUT")
+
+  if [ ${#TITLE} -gt 60 ]; then
+    TITLE=$(awk '{print substr($0,0,57) "..."}' <<<"$TITLE")
+  fi
+
+  LINE2=$(head -n 2 <<<"$MPC_OUTPUT" | tail -n 1)
+
+  PLAY_STATUS_RAW=$(awk '{print $1}' <<<"$LINE2")
+
+  if [ "$PLAY_STATUS_RAW" == "[playing]" ]; then
+    PLAY_STATUS="▶"
+  elif [ "$PLAY_STATUS_RAW" == "[paused]" ]; then
+    PLAY_STATUS="⏸"
+  else
+    PLAY_STATUS="??"
+  fi
+
+  TIME=$(awk '{print $3}' <<<"$LINE2")
+
+  echo -e "$PLAY_STATUS $TITLE | [$TIME]"
+  sleep 1
+done

home/programs/xmonad/xmonad.hs

@@ -168,7 +168,7 @@ myKeys conf@(XConfig {XMonad.modMask = modm}) = M.fromList $
     , ((modm .|. shiftMask , xK_space ),    spawn $ myTerminal ++ " -e tmux")
 
     -- , ((modm               , xK_v ),        spawn "rofi -modi lpass:$HOME/.scripts/rofi/lpass//rofi-lpass -show lpass")
-    , ((modm .|. shiftMask, xK_d     ), viewDropboxStatus)
+    -- , ((modm .|. shiftMask, xK_d     ), viewDropboxStatus)
     ]
 
 termIsOpen :: X Bool

home/programs/yt-dlp.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.yt-dlp.enable = true;
+}

home/programs/zoxide.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.zoxide.enable = true;
+}

home/services/dunst.nix

@@ -3,7 +3,7 @@
   services.dunst = {
     enable = true;
     iconTheme = {
-      package = pkgs.gnome.adwaita-icon-theme;
+      package = pkgs.adwaita-icon-theme;
       name = "Adwaita";
       size = "32x32";
     };

home/services/gnome-keyring.nix

@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  services.gnome-keyring.enable = !machineVars.headless;
+}

home/services/keybase.nix

@@ -0,0 +1,5 @@
+{ ... }:
+{
+  services.keybase.enable = true;
+  services.kbfs.enable = true;
+}

home/services/mpd.nix

@@ -1,28 +1,141 @@
-{ config, ... }:
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.mpd;
+in
 {
-  services.mpd = rec {
+  services.mpd = {
     enable = true;
     musicDirectory = config.xdg.userDirs.music;
-    playlistDirectory = "${musicDirectory}/playlists/MPD";
+    playlistDirectory = "${cfg.musicDirectory}/playlists/MPD";
     network.startWhenNeeded = true;
 
-    # TODO: make the path specific to the user unit
     extraConfig = ''
-      audio_output {
+      pid_file "/run/user/${toString config.home.uid}/mpd/pid"
-        type "fifo"
+
-        name "Visualizer feed"
+      zeroconf_enabled "no"
-        path "/tmp/mpd.fifo"
+
-        format "44100:16:2"
+      replaygain "auto"
-      }
+
+      restore_paused "yes"
+
+      auto_update "no"
 
       audio_output {
         type "pipewire"
         name "PipeWire Sound Server"
       }
+
+      audio_output {
+        type "fifo"
+        name "Visualizer feed"
+        path "/run/user/${toString config.home.uid}/mpd/visualizer.fifo"
+        format "44100:16:2"
+      }
+
+      resampler {
+        plugin "soxr"
+        quality "very high"
+      }
+
+      playlist_plugin {
+        name "cue"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "m3u"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "extm3u"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "flac"
+        enabled "true"
+      }
+
+      playlist_plugin {
+        name "rss"
+        enabled "true"
+      }
     '';
   };
 
-  # TODO: disable auto_update and use systemd path to listen for changes
   # TODO: upstream unix socket support to home-manager
+
+  systemd.user.services.mpd = {
+    Unit = {
+      Documentation = [
+        "man:mpd(1)"
+        "man:mpd.conf(5)"
+      ];
+    };
+    Service = {
+      WatchdogSec = 120;
+
+      # for io_uring
+      LimitMEMLOCK = "64M";
+
+      # allow MPD to use real-time priority 40
+      LimitRTPRIO = 40;
+      LimitRTTIME = "infinity";
+
+      PrivateUsers = true;
+      ProtectSystem = true;
+      NoNewPrivileges = true;
+      ProtectKernelTunables = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+    };
+  };
+
+  systemd.user.paths.mpd-update-library = {
+    Unit = {
+      Description = "Watchdog that updates the mpd library whenever the files are modified";
+      Documentation = [
+        "man:mpd(1)"
+        "man:mpd.conf(5)"
+      ];
+      WantedBy = [ "paths.target" ];
+    };
+    Path = {
+      PathChanged = cfg.musicDirectory;
+      Unit = "mpd-update-library.service";
+      TriggerLimitIntervalSec = "1s";
+      TriggerLimitBurst = "1";
+    };
+  };
+
+  systemd.user.services.mpd-update-library = {
+    Unit = {
+      Description = "Watchdog that updates the mpd library whenever the files are modified";
+      Documentation = [
+        "man:mpd(1)"
+        "man:mpd.conf(5)"
+      ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = "${lib.getExe pkgs.mpc-cli} update --wait";
+
+      PrivateUsers = true;
+      ProtectSystem = true;
+      NoNewPrivileges = true;
+      ProtectKernelTunables = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+    };
+  };
 }
 

home/services/network-manager.nix

@@ -0,0 +1,4 @@
+{ machineVars, ... }:
+{
+  services.network-manager-applet.enable = !machineVars.headless;
+}

home/services/sxhkd.nix

@@ -22,11 +22,11 @@ in
 
       # Volume
 
-      "super + {@F7,@F8}" = "${pkgs.alsaUtils}/bin/amixer set Master 2%{-,+}";
+      "super + {@F7,@F8}" = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%{-,+}";
 
-      "{XF86AudioLowerVolume,XF86AudioRaiseVolume}" = "${pkgs.alsaUtils}/bin/amixer set Master 2%{-,+}";
+      "{XF86AudioLowerVolume,XF86AudioRaiseVolume}" = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%{-,+}";
 
-      "XF86AudioMute" = "${pkgs.pulseaudio}/bin/pactl set-sink-mute @DEFAULT_SINK@ toggle";
+      "XF86AudioMute" = "${pkgs.wireplumber}/bin/wpctl set-mute toggle";
 
       # Music
 

home/shell.nix

@@ -14,6 +14,19 @@
       exe = if pkg.meta ? mainProgram then pkg.meta.mainProgram else name;
     in "${pkg}/bin/${exe}";
 in {
+  sops.secrets."nordicsemi/envvars" = {
+    sopsFile = ../secrets/home.yaml;
+  };
+
+
+  programs.bash.bashrcExtra = ''
+    source "${config.sops.secrets."nordicsemi/envvars".path}"
+  '';
+
+  programs.zsh.envExtra = ''
+    source "${config.sops.secrets."nordicsemi/envvars".path}"
+  '';
+
   local.shell.aliases = {
 
     # ░█▀▄░█▀▀░█▀█░█░░░█▀█░█▀▀░█▀▀░█▄█░█▀▀░█▀█░▀█▀░█▀▀
@@ -290,6 +303,11 @@ in {
       view-latex = "${pkgs.texlive.combined.scheme-full}/bin/latexmk -pdf -pvc main.tex";
 
       reload-tmux = "${p "tmux"} source $HOME/.config/tmux/tmux.conf";
+
+      nordic-vpn = lib.concatStringsSep " | " [
+        "${p "gpauth"} \"$NORDIC_VPN_ENDPOINT\" --gateway --browser default 2>/dev/null"
+        "sudo ${p "gpclient"} connect \"$NORDIC_VPN_ENDPOINT\" --as-gateway --cookie-on-stdin"
+      ];
     };
 
     # ░█▀▀░█▀▀░█▀█░█▀▀░█▀▄░█▀█░▀█▀░█▀▀░█▀▄

hosts/common/default.nix

@@ -12,9 +12,7 @@ in {
     ./programs/ssh.nix
     ./programs/usbtop.nix
 
-    ./services/cups.nix
     ./services/dbus.nix
-    ./services/logrotate.nix
     ./services/openssh.nix
     ./services/pcscd.nix
     ./services/pipewire.nix
@@ -25,6 +23,8 @@ in {
     ./services/xserver.nix
   ];
 
+  systemd.enableStrictShellChecks = true;
+
   sops.defaultSopsFile = ./../.. + "/secrets/${config.networking.hostName}.yaml";
 
   time.timeZone = "Europe/Oslo";

hosts/common/nix-builders/bob.nix

@@ -3,7 +3,6 @@
   sops.secrets."ssh/nix-builders/bob/key" = { sopsFile = ./../../../secrets/common.yaml; };
 
   nix.buildMachines = [{
-    # Login details configured in ssh module in nix-secrets
     hostName = "nix-builder-bob";
     system = "x86_64-linux";
     speedFactor = 5;
@@ -14,8 +13,8 @@
       "big-paralell"
     ];
     mandatoryFeatures = [ ];
-    # sshUser = secrets.ssh.users.pvv.normalUser;
+    sshUser = "oysteikt";
-    # sshKey = config.sops.secrets."ssh/nix-builders/bob/key".path;
+    sshKey = config.sops.secrets."ssh/nix-builders/bob/key".path;
   }];
 
   programs.ssh = {

hosts/common/nix-builders/isvegg.nix

@@ -1,16 +1,15 @@
-{ config, secrets, ... }:
+{ config, ... }:
 {
   sops.secrets."ssh/nix-builders/isvegg/key" = { sopsFile = ./../../../secrets/common.yaml; };
 
   nix.buildMachines = [{
-    # Login details configured in ssh module in nix-secrets
     hostName = "nix-builder-isvegg";
     system = "x86_64-linux";
     speedFactor = 1;
     maxJobs = 8;
     supportedFeatures = [ ];
     mandatoryFeatures = [ ];
-    sshUser = secrets.ssh.users.pvv.normalUser;
+    sshUser = "oysteikt";
     sshKey = config.sops.secrets."ssh/nix-builders/isvegg/key".path;
   }];
 

hosts/common/nix-builders/tsuki.nix

@@ -1,4 +1,4 @@
-{ config, secrets, ... }:
+{ config, ... }:
 {
   # TODO: install public key on tsuki declaratively
   sops.secrets = {
@@ -7,7 +7,6 @@
   };
 
   nix.buildMachines = [{
-    # Login details configured in ssh module in nix-secrets
     hostName = "nix-builder-tsukir";
     system = "x86_64-linux";
     speedFactor = 2;
@@ -26,7 +25,8 @@
     extraConfig = ''
       Host nix-builder-tsukir
         HostName gingakei.loginto.me
-        Port ${toString secrets.ports.ssh.home-in}
+        Port 45497
+        IdentityFile ${config.sops.secrets."ssh/nix-builders/tsuki/key".path}
     '';
 
     # knownHosts.tsukir = {

hosts/common/services/cups.nix

@@ -1,71 +0,0 @@
-{ config, lib, ... }:
-{
-  systemd.services = lib.mkIf config.services.printing.enable {
-    cups.serviceConfig = {
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectClock= true;
-      ProtectControlGroups = true;
-      ProtectHostname = true; 
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      PrivateDevices = true;
-      NoNewPrivileges = true;
-      # User =
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DevicePolicy = "closed";
-      KeyringMode = "private";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      # RestrictAddressFamilies = [ "" ];
-      RestrictNamespaces=true;
-      RestrictRealtime=true;
-      RestrictSUIDSGID=true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0077";
-    };
-    cups-browsed.serviceConfig = {
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ProtectClock= true;
-      ProtectControlGroups = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      PrivateDevices = true;
-      NoNewPrivileges = true;
-      # User =
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DevicePolicy = "closed";
-      KeyringMode = "private";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      PrivateUsers = true;
-      RemoveIPC = true;
-      # RestrictAddressFamilies = [ "" ];
-      RestrictNamespaces=true;
-      RestrictRealtime=true;
-      RestrictSUIDSGID=true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0077";
-    };
-  };
-}

hosts/common/services/logrotate.nix

@@ -1,42 +0,0 @@
-{ ... }:
-{
-  # source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
-  systemd.services.logrotate = {
-    documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
-    unitConfig.RequiresMountsFor = "/var/log";
-    serviceConfig = {
-      Nice = 19;
-      IOSchedulingClass = "best-effort";
-      IOSchedulingPriority = 7;
-
-      ReadWritePaths = [ "/var/log" ];
-
-      AmbientCapabilities = [ "" ];
-      CapabilityBoundingSet = [ "" ];
-      DeviceAllow = [ "" ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true; # disable for third party rotate scripts
-      PrivateDevices = true;
-      PrivateNetwork = true; # disable for mail delivery
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true; # disable for userdir logs
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true; # disable for creating setgid directories
-      SocketBindDeny = [ "any" ];
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-      ];
-    };
-  };
-}

hosts/common/services/printing.nix

@@ -1,4 +1,77 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  cfg = config.services.printing;
+in
 {
-  services.printing.enable = !config.machineVars.headless;
+  # services.printing.enable = !config.machineVars.headless;
+  services.printing.enable = false;
+
+  systemd.services = lib.mkIf cfg.enable {
+    cups.serviceConfig = {
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectClock= true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      PrivateDevices = true;
+      NoNewPrivileges = true;
+      # User =
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+      # RestrictAddressFamilies = [ "" ];
+      RestrictNamespaces=true;
+      RestrictRealtime=true;
+      RestrictSUIDSGID=true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      UMask = "0077";
+    };
+    cups-browsed.serviceConfig = lib.mkIf cfg.enable {
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ProtectClock= true;
+      ProtectControlGroups = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      PrivateDevices = true;
+      NoNewPrivileges = true;
+      # User =
+      AmbientCapabilities = [ "" ];
+      CapabilityBoundingSet = [ "" ];
+      DevicePolicy = "closed";
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateUsers = true;
+      RemoveIPC = true;
+      # RestrictAddressFamilies = [ "" ];
+      RestrictNamespaces=true;
+      RestrictRealtime=true;
+      RestrictSUIDSGID=true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      UMask = "0077";
+    };
+  };
 }

hosts/dosei/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 {
   imports = [
     ./hardware-configuration.nix
@@ -77,14 +77,11 @@
     fstrim.enable = true;
   };
 
+  nix.buildMachines = lib.mkForce [ ];
+
   hardware = {
     bluetooth.enable = true;
     enableRedistributableFirmware = true;
     keyboard.zsa.enable = true;
-    opengl = {
-      enable = true;
-      driSupport = true;
-      driSupport32Bit = true;
-    };
   };
 }

hosts/kasei/configuration.nix

@@ -12,6 +12,8 @@
     ./services/keybase.nix
 
     ./nspawn-containers/arch.nix
+
+    ./testconfig.nix
   ];
 
   system.stateVersion = "22.05";

hosts/kasei/testconfig.nix

@@ -0,0 +1,6 @@
+{ ... }:
+# NOTE: this file is a space where i put new configuration while i'm testing it.
+#       There shouldn't really be anything here, I'm not planning to commit any config here.
+{
+
+}

hosts/tsuki/services/matrix/coturn.nix

@@ -1,16 +1,23 @@
-{ secrets, ... }:
+{ config, lib, secrets, ... }:
+let
+  cfg = config.services.coturn;
+in
 {
-  services.coturn = rec {
+  services.coturn = let
+    # certName = config.services.nginx.virtualHosts.${cfg.realm}.useACMEHost;
+    certName = "nani.wtf";
+    certDir = config.security.acme.certs.${certName}.directory;
+  in rec {
     enable = true;
     no-cli = true;
     no-tcp-relay = true;
-    min-port = secrets.ports.matrix.coturn.min;
+    min-port = 46000;
-    max-port = secrets.ports.matrix.coturn.max;
+    max-port = 47000;
     use-auth-secret = true;
     static-auth-secret = secrets.keys.matrix.static-auth-secret;
     realm = "turn.nani.wtf";
-    cert = "${secrets.keys.certificates.server.crt}";
+    cert = "${certDir}/cert.pem";
-    pkey = "${secrets.keys.certificates.server.key}";
+    pkey = "${certDir}/key.pem";
     extraConfig = ''
       # for debugging
       verbose
@@ -40,4 +47,19 @@
       denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
     '';
   };
+
+  networking.firewall = lib.mkIf cfg.enable {
+    interfaces.enp2s0 = let
+      range = [{
+        from = cfg.min-port;
+        to = cfg.max-port;
+      }];
+    in
+    {
+      allowedUDPPortRanges = range;
+      allowedUDPPorts = [ cfg.listening-port ];
+      allowedTCPPortRanges = range;
+      allowedTCPPorts = [ cfg.listening-port ];
+    };
+  };
 }

hosts/tsuki/services/matrix/default.nix

@@ -25,9 +25,11 @@
 
     settings = {
       turn_uris = let
-        inherit (config.services.coturn) realm;
+        inherit (config.services.coturn) realm listening-port;
-        p = toString secrets.ports.matrix.default;
+      in [
-      in ["turn:${realm}:${p}?transport=udp" "turn:${realm}:${p}?transport=tcp"];
+        "turn:${realm}:${toString listening-port}?transport=udp"
+        "turn:${realm}:${toString listening-port}?transport=tcp"
+      ];
       turn_shared_secret = config.services.coturn.static-auth-secret;
       turn_user_lifetime = "1h";
 
@@ -67,7 +69,7 @@
           user = "matrix-synapse";
           database = "matrix-synapse";
           host = "/var/run/postgresql";
-          port = secrets.ports.postgres;
+          port = config.services.postgresql.settings.port;
         };
       };
 
@@ -92,19 +94,4 @@
   };
 
   services.redis.servers."".enable = true;
-
-  networking.firewall = {
-    interfaces.enp2s0 = let
-      range = with config.services.coturn; [ {
-      from = secrets.ports.matrix.coturn.min;
-      to = secrets.ports.matrix.coturn.max;
-    } ];
-    in
-    {
-      allowedUDPPortRanges = range;
-      allowedUDPPorts = [ secrets.ports.matrix.default ];
-      allowedTCPPortRanges = range;
-      allowedTCPPorts = [ secrets.ports.matrix.default ];
-    };
-  };
 }

hosts/tsuki/services/nginx/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, config, secrets, inputs, ... }:
+{ config, pkgs, lib, inputs, ... }:
 {
   sops.secrets."cloudflare/api-key" = {};
 
@@ -37,19 +37,18 @@
     recommendedZstdSettings = true;
 
     upstreams = let
-      inherit (secrets) ips ports;
       srv = config.services;
       sa = config.local.socketActivation;
     in {
       "atuin".servers."unix:${sa.atuin.newSocketAddress}" = { };
-      "dynmap".servers."localhost:${s ports.minecraft.dynmap}" = { };
+      "dynmap".servers."localhost:8123" = { };
       "grafana".servers."unix:/run/grafana/grafana.sock" = { };
       "headscale".servers."localhost:${s srv.headscale.port}" = { };
       "hedgedoc".servers."unix:${srv.hedgedoc.settings.path}" = { };
-      "idrac".servers."${ips.idrac}" = { };
+      "idrac".servers."10.0.0.201" = { };
       "kanidm".servers."localhost:8300" = { };
-      "osuchan".servers."localhost:${s ports.osuchan}" = { };
+      "osuchan".servers."localhost:${s srv.osuchan.port}" = { };
-      "plex".servers."localhost:${s ports.plex}" = { };
+      "plex".servers."localhost:32400" = { };
       "vaultwarden".servers."unix:${sa.vaultwarden.newSocketAddress}" = { };
       "wstunnel".servers = let
         inherit (config.services.wstunnel.servers."ws-tsuki".listen) host port;
@@ -61,7 +60,7 @@
     virtualHosts = let
       inherit (lib.attrsets) nameValuePair listToAttrs recursiveUpdate;
       inherit (lib.lists) head drop;
-      inherit (secrets) domains keys;
+      domains = [ "nani.wtf" ];
 
       cloudflare-origin-pull-ca = builtins.fetchurl {
         url = "https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem";
@@ -70,7 +69,7 @@
 
       # nonCFHost =
       #   subdomains: extraSettings: let
-      #     settings = with keys.certificates; {
+      #     settings = {
       #       useACMEHost = "nani.wtf";
       #       forceSSL = true;
       #       kTLS = true;
@@ -84,7 +83,7 @@
 
       host =
         subdomains: extraSettings: let
-          settings = with keys.certificates; {
+          settings = {
             serverAliases = drop 1 (generateServerAliases domains subdomains);
             useACMEHost = "nani.wtf";
             forceSSL = true;

hosts/tsuki/services/postgres.nix

@@ -48,32 +48,7 @@ in {
     requires = [ "postgresql.service" ];
   };
 
-  systemd.services.postgresql = {
+  systemd.services.postgresql.serviceConfig.ReadWritePaths = [ cfg.dataDir ];
-    serviceConfig = {
-      Restart = "always";
-      RestartSec = 3;
-      ReadWritePaths = [ cfg.dataDir ];
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      ProtectClock = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      # PrivateMounts = true;
-      RestrictSUIDSGID = true;
-      ProtectHostname = true;
-      LockPersonality = true;
-      ProtectKernelTunables = true;
-      ProtectSystem = "strict";
-      ProtectProc = "invisible";
-      ProtectHome = true;
-      # PrivateNetwork = true;
-      PrivateUsers = true;
-      PrivateTmp = true;
-      UMask = "0077";
-      # RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
-      SystemCallArchitectures = "native";
-    };
-  };
 
   environment.systemPackages = [ config.services.postgresql.package ];
 }

hosts/tsuki/services/samba.nix

@@ -5,26 +5,25 @@
     enable = true;
     # openFirewall = true;
 
-    extraConfig = ''
+    settings = {
-      workgroup = TSUKI
+      global = {
-      server string = smbnix
+        "workgroup" = "TSUKI";
-      netbios name = smbnix
+        "server string" = "smbnix";
+        "netbios name" = "smbnix";
 
-      security = user
+        "security" = "user";
 
-      use sendfile = yes
+        "use sendfile" = "yes";
-      min protocol = SMB2
+        "min protocol" = "SMB2";
-      smb encrypt = desired
+        "smb encrypt" = "desired";
 
-      # note: localhost is the ipv6 localhost ::1
+        # note: localhost is the ipv6 localhost ::1
-      hosts allow = 100.107.69.8 100.100.65.88
+        "hosts allow" = "100.107.69.8 100.100.65.88";
-      hosts deny = 0.0.0.0/0
+        "hosts deny" = "0.0.0.0/0";
 
-      guest ok = no
+        "guest ok" = "no";
-      map to guest = never
+        "map to guest" = "never";
-    '';
+      };
-
-    shares = {
       cirno = {
         path = "/data/cirno";
         browseable = "yes";
@@ -66,15 +65,4 @@
 
   networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 139 445 ];
   networking.firewall.interfaces."tailscale0".allowedUDPPorts = [ 137 138 ];
-
-
-  systemd.slices.system-samba = {
-    description = "Samba slice";
-    after = [ "system.slice" ];
-    requires = [ "system.slice" ];
-  };
-
-  systemd.services.samba-smbd.serviceConfig.Slice = "system-samba.slice";
-  systemd.services.samba-nmbd.serviceConfig.Slice = "system-samba.slice";
-  systemd.services.samba-winbindd.serviceConfig.Slice = "system-samba.slice";
 }

hosts/tsuki/services/vaultwarden.nix

@@ -21,39 +21,6 @@ in {
 
   systemd.services.vaultwarden = lib.mkIf cfg.enable {
     requires = [ "postgresql.service" ];
-
-    serviceConfig = {
-      # Extra hardening
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      NoNewPrivileges = true;
-      # MemoryDenyWriteExecute = true;
-      PrivateMounts = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_UNIX"
-      ];
-      RemoveIPC = true;
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0007";
-    };
   };
 
   services.postgresql = lib.mkIf cfg.enable {

package-overrides/mozc.nix

@@ -102,9 +102,9 @@ buildBazelPackage {
     })
     (fetchurl rec {
       name = "jawiki";
-      url = "https://dumps.wikimedia.org/${name}/20240620/${name}-20240620-all-titles-in-ns0.gz";
+      url = "https://dumps.wikimedia.org/${name}/20241101/${name}-20241101-all-titles-in-ns0.gz";
       recursiveHash = true;
-      hash = "sha256-p1LP8mHYknUPEB9u9CLCP1/uUjCVfb/mdpnOPawGcqQ=";
+      hash = "sha256-gyg6aSsbT7wNvlIu5H5Qmi5O2LBIoZU13U+OgZCEmac=";
       downloadToTemp = true;
       postFetch = ''
         mkdir -p "$out"

secrets/home.yaml

@@ -1,6 +1,8 @@
 git:
     nordicsemi-config: ENC[AES256_GCM,data:ziuM41RTsxkiutxjj8Pl5YuoETkxQNWEbGKd2Y99E0kTV9fL67g+YeGjeVFXErraeB/+jBVpjitK3lSHxlpxZLWckZ0G6A7NAFNagY9cORCFlLb+egyKb44xu8vBt4V5eA==,iv:yG06oluENc038cm5A9tpmSQtaGjd6nYDi/FnBd3A8Rk=,tag:ky6bCsYLOZmWObHnJ816Zw==,type:str]
     nordicsemi-maintenance-repos-config: ENC[AES256_GCM,data:oZ5hgpJj6ENM4S360Zo7SKGbZCDlBZ2NMJ/xRw7MUUvrFcvNSmhSf+WjjJbh+IXr2J82g92guI4Gw/1sOwyfmDfTo0cmKAGY1ZXIjHgSfpdufyl+sGWhpVG+fxmcqQTuiWYkCdLE3Rr+JoTCQ9f8N54uYJHU9X3MeFyrZjaPQA6tFDT8EIq35HifptN1uFEQyKxwaN9iKRyFEI3C9i6mvLYW6XuYYK+oirPgCecaMB3aVZotsMcLnO9C51N2hKKGdkx/JT/jqqAJ4IYUExDNTnBxvgKCrEldaqRGqi9F/3iPVuNSKCUG0uefG3010OhiwnU8WrXblw9jHSHkZ5crIhC2S/y9fzvA+ZuJUctan+GuoIG7VbqdLy0Jz2FXGDs6qNQX6/I0Eud7ajvIHAz+Zp/lVF8U91BwzY2dXLdEKK+KRHtT5gXWXPQHO3HEBlYjxVsMf0V/1WGuUeAQMu46q7YRuRuwuBNVFj2QkRKJo8TX8vXeWrdpzR6qQ4RynioUmI+GLZY=,iv:1wEwje63Ui6aKVq0yNtVsODmWe0kYkBt3pbp/RKqr/s=,tag:Ujhi6tRNphbPtFUL5m8jpw==,type:str]
+nordicsemi:
+    envvars: ENC[AES256_GCM,data:6vx077unPWt6WRy0oZKC3qpVA8BKigYDdhsZ2rmLYFtzW//01CrRgXX420UB,iv:e2hJuRj4A8ZBGG0j2YINdvM3IXzpCnJK0Sm5AXhOTZM=,tag:9SdpNIFSiLhI073dk3cC5g==,type:str]
 ssh:
     secret-config: ""
 sops:
@@ -18,8 +20,8 @@ sops:
             QllyaVlIVEVrSlJDZzlwdFpoRlg3bmsKYBGLYmsfFu6GuRUPGsS0+vkUv1QzJXZl
             D9CFcRQw0Xzti0DvDj7cWrCJ32F1eYRp/9LWyG1CEjfoNEKyUJZ2qQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-05T07:31:00Z"
+    lastmodified: "2024-10-07T23:05:27Z"
-    mac: ENC[AES256_GCM,data:eD+cXSj7xvIY9hyXTwCmV/HJNR1SInXYp0yKCtFTuBzXL5u1nwi0hbN6iHe7xi5otlrddGCwYAIjogAQrE01Y06Y7+ZSdpQNPadz16q4sDa5z71pbzXy/vCZdTlcFL3MMWMhwVmLZtjJO90gQ1iWd1wza12JmbO3KqkFLIuKwnQ=,iv:Qr9k/J+ZU09KruDwrJGaj+5PR0Kv+Gu7zcgDhF/KLOY=,tag:DfspqZZSKTmEOXH2NuVo5Q==,type:str]
+    mac: ENC[AES256_GCM,data:0EgnvPIiDHfE6YYVISwMdYycXUXRkvJLpi5llNF5HMCUMQNFIPemb4OkPbcZhP0HkZCRQC6pFhTXWMU9NbxpTmDWHV0+pNrlkX4PiRKjCJ7Yqq9dNkJzCfq7091ZYYCH9UrgKIyi6+/6jGANI1sq+QuEyZFVPYMnaeSVo+ntqVE=,iv:pJogp+pCfkDaTGh/Qy+GDcELw35Q4Sa8iMKU4JfGCRk=,tag:JGpN4HymcHpJS47fGx6cjg==,type:str]
     pgp:
         - created_at: "2024-07-08T12:27:24Z"
           enc: |-