Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 m3tm3re
|
037df324fd | ||
|
m3tm3re
|
80a58c9df8 |
@@ -1,3 +0,0 @@
|
|||||||
node_modules/
|
|
||||||
runs/
|
|
||||||
*.log
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
{
|
|
||||||
"projectRoot": "/home/m3tam3re/p/NIX/nixos-config",
|
|
||||||
"isNewProject": false,
|
|
||||||
"additionalContext": "Install and configure babysitter for this existing NixOS flake configuration repository. Respect AGENTS.md instructions, Beads workflow, Nix conventions, and avoid interactive/destructive operations unless explicitly approved."
|
|
||||||
}
|
|
||||||
Generated
-4570
File diff suppressed because it is too large
Load Diff
@@ -1,9 +0,0 @@
|
|||||||
{
|
|
||||||
"name": "nixos-config-a5c",
|
|
||||||
"version": "1.0.0",
|
|
||||||
"private": true,
|
|
||||||
"type": "module",
|
|
||||||
"dependencies": {
|
|
||||||
"@a5c-ai/babysitter-sdk": "latest"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,596 +0,0 @@
|
|||||||
{
|
|
||||||
"projectName": "nixos-config",
|
|
||||||
"description": "A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.",
|
|
||||||
"goals": [
|
|
||||||
{
|
|
||||||
"id": "goal-reliability-1",
|
|
||||||
"description": "Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment.",
|
|
||||||
"category": "reliability",
|
|
||||||
"priority": "high",
|
|
||||||
"status": "active"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "goal-architecture-1",
|
|
||||||
"description": "Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules.",
|
|
||||||
"category": "architecture",
|
|
||||||
"priority": "high",
|
|
||||||
"status": "active"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "goal-modularization-1",
|
|
||||||
"description": "Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate.",
|
|
||||||
"category": "modularization",
|
|
||||||
"priority": "high",
|
|
||||||
"status": "active"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "goal-cicd-1",
|
|
||||||
"description": "CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks.",
|
|
||||||
"category": "automation",
|
|
||||||
"priority": "medium",
|
|
||||||
"status": "deferred"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"techStack": {
|
|
||||||
"languages": [
|
|
||||||
{
|
|
||||||
"name": "Nix",
|
|
||||||
"role": "primary system, module, overlay, and package configuration language"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Markdown",
|
|
||||||
"role": "project, agent, and workflow documentation"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "JSON/YAML",
|
|
||||||
"role": "tool configuration and metadata"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"frameworks": [
|
|
||||||
{
|
|
||||||
"name": "Nix flakes",
|
|
||||||
"category": "reproducible dependency and output model"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "NixOS modules",
|
|
||||||
"category": "host and service configuration"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Home Manager",
|
|
||||||
"category": "user environment management"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Agenix",
|
|
||||||
"category": "encrypted secret management"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Disko",
|
|
||||||
"category": "server disk provisioning"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "NUR",
|
|
||||||
"category": "community package access"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "llm-agents.nix",
|
|
||||||
"category": "LLM agent packages overlay"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3ta-home",
|
|
||||||
"category": "external reusable Home Manager profiles"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3ta-nixpkgs",
|
|
||||||
"category": "external custom packages/modules/overlays"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"databases": [],
|
|
||||||
"infrastructure": [
|
|
||||||
{
|
|
||||||
"name": "m3-ares",
|
|
||||||
"category": "desktop NixOS host"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3-kratos",
|
|
||||||
"category": "desktop NixOS host"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3-daedalus",
|
|
||||||
"category": "portable laptop/Home Manager configuration"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3-atlas",
|
|
||||||
"category": "primary server NixOS host"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3-helios",
|
|
||||||
"category": "minimal server/AdGuard host"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3-hermes",
|
|
||||||
"category": "secondary server/Hermes host"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3-aether",
|
|
||||||
"category": "cloud VM/minimal server host"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"buildTools": [
|
|
||||||
"nix",
|
|
||||||
"nixos-rebuild",
|
|
||||||
"nix build",
|
|
||||||
"nix flake show",
|
|
||||||
"alejandra",
|
|
||||||
"statix",
|
|
||||||
"deadnix"
|
|
||||||
],
|
|
||||||
"packageManagers": [
|
|
||||||
"nix flakes"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"architecture": {
|
|
||||||
"pattern": "Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.",
|
|
||||||
"modules": [
|
|
||||||
{
|
|
||||||
"name": "flake.nix",
|
|
||||||
"path": "flake.nix",
|
|
||||||
"description": "Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "hosts/common",
|
|
||||||
"path": "hosts/common",
|
|
||||||
"description": "Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "hosts",
|
|
||||||
"path": "hosts",
|
|
||||||
"description": "Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "modules/nixos",
|
|
||||||
"path": "modules/nixos",
|
|
||||||
"description": "Reusable NixOS modules."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "modules/home-manager",
|
|
||||||
"path": "modules/home-manager",
|
|
||||||
"description": "Reusable Home Manager module exports."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "overlays",
|
|
||||||
"path": "overlays",
|
|
||||||
"description": "Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "pkgs",
|
|
||||||
"path": "pkgs",
|
|
||||||
"description": "Custom package export set."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "secrets",
|
|
||||||
"path": "secrets",
|
|
||||||
"description": "Encrypted agenix secret files and registry."
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"entryPoints": [
|
|
||||||
"flake.nix",
|
|
||||||
"hosts/<host>/default.nix",
|
|
||||||
"hosts/<host>/configuration.nix",
|
|
||||||
"hosts/common/default.nix",
|
|
||||||
"hosts/common/users/m3tam3re.nix",
|
|
||||||
"overlays/default.nix",
|
|
||||||
"pkgs/default.nix",
|
|
||||||
"secrets.nix"
|
|
||||||
],
|
|
||||||
"dataFlow": "flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules."
|
|
||||||
},
|
|
||||||
"team": [
|
|
||||||
{
|
|
||||||
"name": "m3tam3re",
|
|
||||||
"role": "solo developer and operator",
|
|
||||||
"responsibilities": [
|
|
||||||
"architecture",
|
|
||||||
"implementation",
|
|
||||||
"host maintenance",
|
|
||||||
"deployments",
|
|
||||||
"review"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3ta-chiron",
|
|
||||||
"role": "agent contributor",
|
|
||||||
"responsibilities": [
|
|
||||||
"semi-autonomous implementation",
|
|
||||||
"validation",
|
|
||||||
"documentation updates",
|
|
||||||
"conventional commits"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"workflows": [
|
|
||||||
{
|
|
||||||
"name": "development",
|
|
||||||
"description": "Default feature-branch workflow for solo development with conventional commits and validation before push.",
|
|
||||||
"steps": [
|
|
||||||
"review Beads issues with bd ready --json",
|
|
||||||
"claim work with bd update <id> --claim when applicable",
|
|
||||||
"edit Nix modules or project files",
|
|
||||||
"run alejandra .",
|
|
||||||
"run statix check .",
|
|
||||||
"run targeted nix flake or host dry-run checks",
|
|
||||||
"commit with conventional commit format",
|
|
||||||
"pull --rebase and push"
|
|
||||||
],
|
|
||||||
"triggers": [
|
|
||||||
"new feature",
|
|
||||||
"bug fix",
|
|
||||||
"refactor",
|
|
||||||
"agent task"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "nix validation",
|
|
||||||
"description": "Quality gate for Nix configuration changes.",
|
|
||||||
"steps": [
|
|
||||||
"alejandra .",
|
|
||||||
"statix check .",
|
|
||||||
"deadnix check or deadnix -w when appropriate",
|
|
||||||
"nix flake show",
|
|
||||||
"sudo nixos-rebuild dry-run --flake .#<host> for affected hosts"
|
|
||||||
],
|
|
||||||
"triggers": [
|
|
||||||
"Nix code changes",
|
|
||||||
"before deployment",
|
|
||||||
"before commit"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "host deployment",
|
|
||||||
"description": "Manual deployment after successful dry-run validation.",
|
|
||||||
"steps": [
|
|
||||||
"sudo nixos-rebuild dry-run --flake .#<host>",
|
|
||||||
"sudo nixos-rebuild switch --flake .#<host>"
|
|
||||||
],
|
|
||||||
"triggers": [
|
|
||||||
"manual host update"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "dependency/input update",
|
|
||||||
"description": "Controlled flake input updates without manually editing flake.lock.",
|
|
||||||
"steps": [
|
|
||||||
"use nix flake update or nixos-rebuild --update-input <input>",
|
|
||||||
"validate affected outputs",
|
|
||||||
"commit flake.nix/flake.lock changes"
|
|
||||||
],
|
|
||||||
"triggers": [
|
|
||||||
"planned dependency update",
|
|
||||||
"security update"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "beads issue tracking",
|
|
||||||
"description": "Persistent issue tracking and session handoff workflow.",
|
|
||||||
"steps": [
|
|
||||||
"bd ready --json",
|
|
||||||
"bd show <id>",
|
|
||||||
"bd update <id> --claim",
|
|
||||||
"bd close <id> --reason <summary>",
|
|
||||||
"bd dolt push"
|
|
||||||
],
|
|
||||||
"triggers": [
|
|
||||||
"start of tracked work",
|
|
||||||
"completion of tracked work"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"processes": [
|
|
||||||
{
|
|
||||||
"id": "cradle/project-install",
|
|
||||||
"name": "Babysitter project install",
|
|
||||||
"status": "installing",
|
|
||||||
"purpose": "Create and save a Babysitter project profile and setup recommendations."
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"tools": {
|
|
||||||
"formatting": [
|
|
||||||
{
|
|
||||||
"name": "alejandra",
|
|
||||||
"purpose": "Nix formatting",
|
|
||||||
"configPaths": [
|
|
||||||
"flake.nix devShells.default"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"linting": [
|
|
||||||
{
|
|
||||||
"name": "statix",
|
|
||||||
"purpose": "Nix anti-pattern linting",
|
|
||||||
"configPaths": [
|
|
||||||
"flake.nix devShells.default"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "deadnix",
|
|
||||||
"purpose": "Detect unused Nix code",
|
|
||||||
"configPaths": [
|
|
||||||
"flake.nix devShells.default"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"testing": [
|
|
||||||
{
|
|
||||||
"name": "nix flake show",
|
|
||||||
"purpose": "Evaluate flake outputs",
|
|
||||||
"configPaths": [
|
|
||||||
"flake.nix"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "nixos-rebuild dry-run",
|
|
||||||
"purpose": "Validate host configurations without applying changes",
|
|
||||||
"configPaths": [
|
|
||||||
"flake.nix",
|
|
||||||
"hosts/*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "nix build",
|
|
||||||
"purpose": "Build selected outputs such as host toplevels or ISOs",
|
|
||||||
"configPaths": [
|
|
||||||
"flake.nix"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"issueTracking": [
|
|
||||||
{
|
|
||||||
"name": "Beads",
|
|
||||||
"command": "bd",
|
|
||||||
"purpose": "Persistent task tracking"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"services": [
|
|
||||||
{
|
|
||||||
"name": "code.m3ta.dev",
|
|
||||||
"type": "git hosting",
|
|
||||||
"url": "git+ssh://gitea@code.m3ta.dev"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "GitHub",
|
|
||||||
"type": "flake input hosting",
|
|
||||||
"url": "github:* flake inputs"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Agenix",
|
|
||||||
"type": "secret encryption",
|
|
||||||
"url": "github:ryantm/agenix"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Hermes Agent",
|
|
||||||
"type": "NixOS module/agent service",
|
|
||||||
"url": "github:NousResearch/hermes-agent"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "RustFS",
|
|
||||||
"type": "NixOS server service flake",
|
|
||||||
"url": "github:rustfs/rustfs-flake"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"externalIntegrations": [
|
|
||||||
{
|
|
||||||
"service": "Beads",
|
|
||||||
"category": "issue tracking",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "Dolt",
|
|
||||||
"category": "Beads storage/sync",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "Agenix",
|
|
||||||
"category": "secrets",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "Home Manager",
|
|
||||||
"category": "user environment",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "m3ta-home",
|
|
||||||
"category": "external home profiles",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "m3ta-nixpkgs",
|
|
||||||
"category": "external Nix modules/packages",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "NUR",
|
|
||||||
"category": "Nix packages",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "Disko",
|
|
||||||
"category": "disk provisioning",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"service": "Hermes Agent",
|
|
||||||
"category": "LLM/agent service",
|
|
||||||
"enabled": true
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"cicd": {
|
|
||||||
"provider": null,
|
|
||||||
"enabled": false,
|
|
||||||
"configPaths": [],
|
|
||||||
"pipelines": [],
|
|
||||||
"notes": "CI/CD is intentionally disabled for now. If re-enabled later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.",
|
|
||||||
"babysitterIntegration": {
|
|
||||||
"enabled": false,
|
|
||||||
"triggerOn": [],
|
|
||||||
"processIds": []
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"painPoints": [
|
|
||||||
{
|
|
||||||
"id": "pp-architecture-1",
|
|
||||||
"description": "The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.",
|
|
||||||
"severity": "high",
|
|
||||||
"category": "architecture",
|
|
||||||
"discoveredVia": "user interview",
|
|
||||||
"suggestedRemediation": "Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "pp-validation-1",
|
|
||||||
"description": "A single shared Nix change can require validating several hosts to be confident.",
|
|
||||||
"severity": "medium",
|
|
||||||
"category": "validation",
|
|
||||||
"discoveredVia": "repo structure and AGENTS workflow",
|
|
||||||
"suggestedRemediation": "Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "pp-dependency-1",
|
|
||||||
"description": "Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.",
|
|
||||||
"severity": "medium",
|
|
||||||
"category": "dependency management",
|
|
||||||
"discoveredVia": "flake and history analysis",
|
|
||||||
"suggestedRemediation": "Update inputs intentionally, group related updates, and validate affected host outputs."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "pp-operations-1",
|
|
||||||
"description": "Service additions often need synchronized module, secret, and network/TLS changes.",
|
|
||||||
"severity": "medium",
|
|
||||||
"category": "operations",
|
|
||||||
"discoveredVia": "git history and tree structure",
|
|
||||||
"suggestedRemediation": "Use checklist-style issue templates or Babysitter processes for service changes."
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"bottlenecks": [
|
|
||||||
{
|
|
||||||
"id": "bn-flake-1",
|
|
||||||
"description": "flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once.",
|
|
||||||
"impact": "High; evaluation failures can block all hosts.",
|
|
||||||
"location": "flake.nix, flake.lock",
|
|
||||||
"frequency": "very frequent"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "bn-secrets-1",
|
|
||||||
"description": "Secret registry and host secret modules must stay aligned with encrypted .age files.",
|
|
||||||
"impact": "Medium to high; missing or mismatched secrets break host deployment.",
|
|
||||||
"location": "secrets.nix, hosts/*/secrets.nix, secrets/*.age",
|
|
||||||
"frequency": "recurring"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "bn-services-1",
|
|
||||||
"description": "Server service changes can span service modules, secrets, Traefik/networking, and flake inputs.",
|
|
||||||
"impact": "High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.",
|
|
||||||
"location": "hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common",
|
|
||||||
"frequency": "frequent"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "bn-home-1",
|
|
||||||
"description": "Home Manager behavior depends on both the external m3ta-home input and local host flags.",
|
|
||||||
"impact": "Medium; may require coordinated updates across repositories.",
|
|
||||||
"location": "flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input",
|
|
||||||
"frequency": "frequent after migration"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"conventions": {
|
|
||||||
"naming": {
|
|
||||||
"files": "hyphen-case for Nix/docs where practical; host directories use m3-* names",
|
|
||||||
"hosts": "m3-<greek-name>",
|
|
||||||
"modules": "one module per file/directory where possible",
|
|
||||||
"nixVariables": "camelCase"
|
|
||||||
},
|
|
||||||
"git": {
|
|
||||||
"branchStrategy": "default feature branches for non-trivial work; master as integration branch",
|
|
||||||
"commits": "conventional commits for agent work",
|
|
||||||
"reviews": "optional for solo development",
|
|
||||||
"releaseCadence": "continuous/manual as needed",
|
|
||||||
"remote": "code.m3ta.dev over SSH for private inputs and repo access"
|
|
||||||
},
|
|
||||||
"codeStyle": {
|
|
||||||
"formatter": "alejandra",
|
|
||||||
"indentation": "2 spaces",
|
|
||||||
"nixStyle": "explicit pkgs references preferred; avoid with pkgs, builtins.fetchTarball, import <nixpkgs>, builtins.getAttr/hasAttr"
|
|
||||||
},
|
|
||||||
"importOrder": [
|
|
||||||
"module function arguments",
|
|
||||||
"imports",
|
|
||||||
"let bindings",
|
|
||||||
"options/config"
|
|
||||||
],
|
|
||||||
"errorHandling": "Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.",
|
|
||||||
"testingConventions": "Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.",
|
|
||||||
"additionalRules": [
|
|
||||||
"Use Beads for persistent task tracking.",
|
|
||||||
"Use non-interactive flags for shell file operations.",
|
|
||||||
"Do not modify flake.lock directly; use nix flake update.",
|
|
||||||
"Do not commit plaintext secrets.",
|
|
||||||
"Use SSH URLs for code.m3ta.dev flake inputs.",
|
|
||||||
"Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions."
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"repositories": [
|
|
||||||
{
|
|
||||||
"name": "nixos-config",
|
|
||||||
"path": "/home/m3tam3re/p/NIX/nixos-config",
|
|
||||||
"role": "primary multi-host NixOS configuration"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3ta-home",
|
|
||||||
"url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home",
|
|
||||||
"role": "external Home Manager profiles"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "m3ta-nixpkgs",
|
|
||||||
"url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs",
|
|
||||||
"role": "external custom packages/modules/overlays"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"claudeMdInstructions": [
|
|
||||||
"Respect AGENTS.md as the source of project workflow rules.",
|
|
||||||
"Resolve the active Babysitter process library before using library processes.",
|
|
||||||
"Use cradle/project-install for project setup or profile refresh.",
|
|
||||||
"Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.",
|
|
||||||
"Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.",
|
|
||||||
"Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.",
|
|
||||||
"Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.",
|
|
||||||
"Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions."
|
|
||||||
],
|
|
||||||
"installedSkills": [
|
|
||||||
"project-install",
|
|
||||||
"babysit",
|
|
||||||
"specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md",
|
|
||||||
"specializations/devops-sre-platform/skills/gitops/SKILL.md",
|
|
||||||
"specializations/devops-sre-platform/skills/secrets-management/SKILL.md"
|
|
||||||
],
|
|
||||||
"installedAgents": [
|
|
||||||
"general-purpose",
|
|
||||||
"specializations/devops-sre-platform/agents/platform-engineer/AGENT.md",
|
|
||||||
"specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md"
|
|
||||||
],
|
|
||||||
"installedProcesses": [
|
|
||||||
"cradle/project-install",
|
|
||||||
"methodologies/gsd/quick.js",
|
|
||||||
"methodologies/gsd/verify-work.js",
|
|
||||||
"methodologies/gsd/iterative-convergence.js",
|
|
||||||
"methodologies/evolutionary.js",
|
|
||||||
"specializations/devops-sre-platform/iac-testing.js"
|
|
||||||
],
|
|
||||||
"preferences": {
|
|
||||||
"babysitterAutonomy": "semi-autonomous",
|
|
||||||
"breakpointTolerance": "moderate",
|
|
||||||
"externalIntegrationsRequested": false,
|
|
||||||
"cicdDesired": false,
|
|
||||||
"cicdNote": "Deferred for now; Gitea Actions is the preferred provider if CI/CD is added later."
|
|
||||||
},
|
|
||||||
"createdAt": "2026-05-29T15:50:48.754Z",
|
|
||||||
"updatedAt": "2026-05-29T16:07:19.245463Z",
|
|
||||||
"version": 1
|
|
||||||
}
|
|
||||||
@@ -1,238 +0,0 @@
|
|||||||
# Project Profile: nixos-config
|
|
||||||
|
|
||||||
A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.
|
|
||||||
|
|
||||||
> Last updated: 2026-05-29T16:02:11.092188Z | Version: 1
|
|
||||||
|
|
||||||
## Goals
|
|
||||||
|
|
||||||
- **reliability** [high]: Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment. (active)
|
|
||||||
- **architecture** [high]: Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules. (active)
|
|
||||||
- **modularization** [high]: Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate. (active)
|
|
||||||
- **automation** [medium]: CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks. (deferred)
|
|
||||||
|
|
||||||
## Tech Stack
|
|
||||||
|
|
||||||
### Languages
|
|
||||||
|
|
||||||
- Nix (primary system, module, overlay, and package configuration language)
|
|
||||||
- Markdown (project, agent, and workflow documentation)
|
|
||||||
- JSON/YAML (tool configuration and metadata)
|
|
||||||
|
|
||||||
### Frameworks
|
|
||||||
|
|
||||||
- Nix flakes [reproducible dependency and output model]
|
|
||||||
- NixOS modules [host and service configuration]
|
|
||||||
- Home Manager [user environment management]
|
|
||||||
- Agenix [encrypted secret management]
|
|
||||||
- Disko [server disk provisioning]
|
|
||||||
- NUR [community package access]
|
|
||||||
- llm-agents.nix [LLM agent packages overlay]
|
|
||||||
- m3ta-home [external reusable Home Manager profiles]
|
|
||||||
- m3ta-nixpkgs [external custom packages/modules/overlays]
|
|
||||||
|
|
||||||
### Infrastructure
|
|
||||||
|
|
||||||
- m3-ares [desktop NixOS host]
|
|
||||||
- m3-kratos [desktop NixOS host]
|
|
||||||
- m3-daedalus [portable laptop/Home Manager configuration]
|
|
||||||
- m3-atlas [primary server NixOS host]
|
|
||||||
- m3-helios [minimal server/AdGuard host]
|
|
||||||
- m3-hermes [secondary server/Hermes host]
|
|
||||||
- m3-aether [cloud VM/minimal server host]
|
|
||||||
|
|
||||||
**Build tools:** nix, nixos-rebuild, nix build, nix flake show, alejandra, statix, deadnix
|
|
||||||
|
|
||||||
**Package managers:** nix flakes
|
|
||||||
|
|
||||||
## Architecture
|
|
||||||
|
|
||||||
**Pattern:** Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.
|
|
||||||
**Data flow:** flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules.
|
|
||||||
|
|
||||||
### Modules
|
|
||||||
|
|
||||||
| Module | Path | Description |
|
|
||||||
|--------|------|-------------|
|
|
||||||
| flake.nix | `flake.nix` | Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells. |
|
|
||||||
| hosts/common | `hosts/common` | Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users. |
|
|
||||||
| hosts | `hosts` | Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM. |
|
|
||||||
| modules/nixos | `modules/nixos` | Reusable NixOS modules. |
|
|
||||||
| modules/home-manager | `modules/home-manager` | Reusable Home Manager module exports. |
|
|
||||||
| overlays | `overlays` | Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages. |
|
|
||||||
| pkgs | `pkgs` | Custom package export set. |
|
|
||||||
| secrets | `secrets` | Encrypted agenix secret files and registry. |
|
|
||||||
|
|
||||||
**Entry points:** `flake.nix`, `hosts/<host>/default.nix`, `hosts/<host>/configuration.nix`, `hosts/common/default.nix`, `hosts/common/users/m3tam3re.nix`, `overlays/default.nix`, `pkgs/default.nix`, `secrets.nix`
|
|
||||||
|
|
||||||
## Team
|
|
||||||
|
|
||||||
- **m3tam3re** (solo developer and operator): architecture, implementation, host maintenance, deployments, review
|
|
||||||
- **m3ta-chiron** (agent contributor): semi-autonomous implementation, validation, documentation updates, conventional commits
|
|
||||||
|
|
||||||
## Workflows
|
|
||||||
|
|
||||||
### development
|
|
||||||
|
|
||||||
Default feature-branch workflow for solo development with conventional commits and validation before push.
|
|
||||||
**Triggers:** new feature, bug fix, refactor, agent task
|
|
||||||
|
|
||||||
1. review Beads issues with bd ready --json
|
|
||||||
2. claim work with bd update <id> --claim when applicable
|
|
||||||
3. edit Nix modules or project files
|
|
||||||
4. run alejandra .
|
|
||||||
5. run statix check .
|
|
||||||
6. run targeted nix flake or host dry-run checks
|
|
||||||
7. commit with conventional commit format
|
|
||||||
8. pull --rebase and push
|
|
||||||
|
|
||||||
### nix validation
|
|
||||||
|
|
||||||
Quality gate for Nix configuration changes.
|
|
||||||
**Triggers:** Nix code changes, before deployment, before commit
|
|
||||||
|
|
||||||
1. alejandra .
|
|
||||||
2. statix check .
|
|
||||||
3. deadnix check or deadnix -w when appropriate
|
|
||||||
4. nix flake show
|
|
||||||
5. sudo nixos-rebuild dry-run --flake .#<host> for affected hosts
|
|
||||||
|
|
||||||
### host deployment
|
|
||||||
|
|
||||||
Manual deployment after successful dry-run validation.
|
|
||||||
**Triggers:** manual host update
|
|
||||||
|
|
||||||
1. sudo nixos-rebuild dry-run --flake .#<host>
|
|
||||||
2. sudo nixos-rebuild switch --flake .#<host>
|
|
||||||
|
|
||||||
### dependency/input update
|
|
||||||
|
|
||||||
Controlled flake input updates without manually editing flake.lock.
|
|
||||||
**Triggers:** planned dependency update, security update
|
|
||||||
|
|
||||||
1. use nix flake update or nixos-rebuild --update-input <input>
|
|
||||||
2. validate affected outputs
|
|
||||||
3. commit flake.nix/flake.lock changes
|
|
||||||
|
|
||||||
### beads issue tracking
|
|
||||||
|
|
||||||
Persistent issue tracking and session handoff workflow.
|
|
||||||
**Triggers:** start of tracked work, completion of tracked work
|
|
||||||
|
|
||||||
1. bd ready --json
|
|
||||||
2. bd show <id>
|
|
||||||
3. bd update <id> --claim
|
|
||||||
4. bd close <id> --reason <summary>
|
|
||||||
5. bd dolt push
|
|
||||||
|
|
||||||
## Processes
|
|
||||||
|
|
||||||
- **Babysitter project install** (`cradle/project-install`, undefined)
|
|
||||||
|
|
||||||
## Tools
|
|
||||||
|
|
||||||
### Linting
|
|
||||||
|
|
||||||
- statix
|
|
||||||
- deadnix
|
|
||||||
|
|
||||||
### Testing
|
|
||||||
|
|
||||||
- nix flake show
|
|
||||||
- nixos-rebuild dry-run
|
|
||||||
- nix build
|
|
||||||
|
|
||||||
### Formatting
|
|
||||||
|
|
||||||
- alejandra
|
|
||||||
|
|
||||||
## Services
|
|
||||||
|
|
||||||
- **code.m3ta.dev** (git hosting) - git+ssh://gitea@code.m3ta.dev
|
|
||||||
- **GitHub** (flake input hosting) - github:* flake inputs
|
|
||||||
- **Agenix** (secret encryption) - github:ryantm/agenix
|
|
||||||
- **Hermes Agent** (NixOS module/agent service) - github:NousResearch/hermes-agent
|
|
||||||
- **RustFS** (NixOS server service flake) - github:rustfs/rustfs-flake
|
|
||||||
|
|
||||||
## CI/CD
|
|
||||||
|
|
||||||
**Status:** Not configured/enabled for now.
|
|
||||||
|
|
||||||
No Babysitter CI/CD workflow is currently installed. If CI/CD is added later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.
|
|
||||||
|
|
||||||
## Pain Points
|
|
||||||
|
|
||||||
- **high** [architecture]: The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.
|
|
||||||
- Remediation: Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs.
|
|
||||||
- **medium** [validation]: A single shared Nix change can require validating several hosts to be confident.
|
|
||||||
- Remediation: Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled.
|
|
||||||
- **medium** [dependency management]: Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.
|
|
||||||
- Remediation: Update inputs intentionally, group related updates, and validate affected host outputs.
|
|
||||||
- **medium** [operations]: Service additions often need synchronized module, secret, and network/TLS changes.
|
|
||||||
- Remediation: Use checklist-style issue templates or Babysitter processes for service changes.
|
|
||||||
|
|
||||||
## Bottlenecks
|
|
||||||
|
|
||||||
- flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once. at flake.nix, flake.lock (very frequent)
|
|
||||||
Impact: High; evaluation failures can block all hosts.
|
|
||||||
- Secret registry and host secret modules must stay aligned with encrypted .age files. at secrets.nix, hosts/*/secrets.nix, secrets/*.age (recurring)
|
|
||||||
Impact: Medium to high; missing or mismatched secrets break host deployment.
|
|
||||||
- Server service changes can span service modules, secrets, Traefik/networking, and flake inputs. at hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common (frequent)
|
|
||||||
Impact: High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.
|
|
||||||
- Home Manager behavior depends on both the external m3ta-home input and local host flags. at flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input (frequent after migration)
|
|
||||||
Impact: Medium; may require coordinated updates across repositories.
|
|
||||||
|
|
||||||
## Conventions
|
|
||||||
|
|
||||||
### Naming
|
|
||||||
|
|
||||||
- **files:** hyphen-case for Nix/docs where practical; host directories use m3-* names
|
|
||||||
- **hosts:** m3-<greek-name>
|
|
||||||
- **modules:** one module per file/directory where possible
|
|
||||||
- **nixVariables:** camelCase
|
|
||||||
|
|
||||||
### Git
|
|
||||||
|
|
||||||
- **branchStrategy:** default feature branches for non-trivial work; master as integration branch
|
|
||||||
- **commits:** conventional commits for agent work
|
|
||||||
- **reviews:** optional for solo development
|
|
||||||
- **releaseCadence:** continuous/manual as needed
|
|
||||||
- **remote:** code.m3ta.dev over SSH for private inputs and repo access
|
|
||||||
|
|
||||||
**Import order:** module function arguments > imports > let bindings > options/config
|
|
||||||
|
|
||||||
**Error handling:** Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.
|
|
||||||
|
|
||||||
**Testing:** Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.
|
|
||||||
|
|
||||||
### Additional Rules
|
|
||||||
|
|
||||||
- Use Beads for persistent task tracking.
|
|
||||||
- Use non-interactive flags for shell file operations.
|
|
||||||
- Do not modify flake.lock directly; use nix flake update.
|
|
||||||
- Do not commit plaintext secrets.
|
|
||||||
- Use SSH URLs for code.m3ta.dev flake inputs.
|
|
||||||
- Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions.
|
|
||||||
|
|
||||||
## Repositories
|
|
||||||
|
|
||||||
- **nixos-config** [`/home/m3tam3re/p/NIX/nixos-config`]
|
|
||||||
- **m3ta-home** - git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home
|
|
||||||
- **m3ta-nixpkgs** - git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs
|
|
||||||
|
|
||||||
## CLAUDE.md Instructions
|
|
||||||
|
|
||||||
- Respect AGENTS.md as the source of project workflow rules.
|
|
||||||
- Resolve the active Babysitter process library before using library processes.
|
|
||||||
- Use cradle/project-install for project setup or profile refresh.
|
|
||||||
- Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.
|
|
||||||
- Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.
|
|
||||||
- Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.
|
|
||||||
- Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.
|
|
||||||
- Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions.
|
|
||||||
|
|
||||||
## Installed Extensions
|
|
||||||
|
|
||||||
- Skills: project-install, babysit, specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md, specializations/devops-sre-platform/skills/gitops/SKILL.md, specializations/devops-sre-platform/skills/secrets-management/SKILL.md
|
|
||||||
- Agents: general-purpose, specializations/devops-sre-platform/agents/platform-engineer/AGENT.md, specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md
|
|
||||||
- Processes: cradle/project-install, methodologies/gsd/quick.js, methodologies/gsd/verify-work.js, methodologies/gsd/iterative-convergence.js, methodologies/evolutionary.js, specializations/devops-sre-platform/iac-testing.js
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
{
|
|
||||||
"qualityThreshold": 80,
|
|
||||||
"testCoverage": {
|
|
||||||
"minimum": 0,
|
|
||||||
"rationale": "NixOS configuration repository without a coverage-producing test suite."
|
|
||||||
},
|
|
||||||
"formatting": [
|
|
||||||
{
|
|
||||||
"name": "alejandra",
|
|
||||||
"command": "alejandra .",
|
|
||||||
"ciCommand": "alejandra --check ."
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"linting": [
|
|
||||||
{
|
|
||||||
"name": "statix",
|
|
||||||
"command": "statix check ."
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "deadnix",
|
|
||||||
"command": "deadnix . --fail"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"evaluation": [
|
|
||||||
{
|
|
||||||
"name": "flake outputs",
|
|
||||||
"command": "nix flake show"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "affected host dry-run",
|
|
||||||
"command": "sudo nixos-rebuild dry-run --flake .#<host>",
|
|
||||||
"when": "Run for affected hosts when practical and safe."
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"commitChecks": [
|
|
||||||
"alejandra .",
|
|
||||||
"statix check .",
|
|
||||||
"deadnix . --fail",
|
|
||||||
"nix flake show"
|
|
||||||
],
|
|
||||||
"deployGates": [
|
|
||||||
"formatting passes",
|
|
||||||
"linting passes",
|
|
||||||
"flake outputs evaluate",
|
|
||||||
"affected host dry-run succeeds",
|
|
||||||
"secrets are encrypted and host secret modules remain aligned"
|
|
||||||
],
|
|
||||||
"cicdIntegrationPoints": [],
|
|
||||||
"cicd": {
|
|
||||||
"enabled": false,
|
|
||||||
"notes": "No CI/CD integration is currently configured. Add Gitea Actions later if automated Babysitter or Nix validation is desired."
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+32
-66
@@ -1,73 +1,39 @@
|
|||||||
# Dolt database (managed by Dolt, not git)
|
# SQLite databases
|
||||||
dolt/
|
|
||||||
embeddeddolt/
|
|
||||||
|
|
||||||
# Runtime files
|
|
||||||
bd.sock
|
|
||||||
bd.sock.startlock
|
|
||||||
sync-state.json
|
|
||||||
last-touched
|
|
||||||
.exclusive-lock
|
|
||||||
|
|
||||||
# Daemon runtime (lock, log, pid)
|
|
||||||
daemon.*
|
|
||||||
|
|
||||||
# Interactions log (runtime, not versioned)
|
|
||||||
interactions.jsonl
|
|
||||||
|
|
||||||
# Push state (runtime, per-machine)
|
|
||||||
push-state.json
|
|
||||||
|
|
||||||
# Lock files (various runtime locks)
|
|
||||||
*.lock
|
|
||||||
|
|
||||||
# Credential key (encryption key for federation peer auth — never commit)
|
|
||||||
.beads-credential-key
|
|
||||||
|
|
||||||
# Local version tracking (prevents upgrade notification spam after git ops)
|
|
||||||
.local_version
|
|
||||||
|
|
||||||
# Worktree redirect file (contains relative path to main repo's .beads/)
|
|
||||||
# Must not be committed as paths would be wrong in other clones
|
|
||||||
redirect
|
|
||||||
|
|
||||||
# Sync state (local-only, per-machine)
|
|
||||||
# These files are machine-specific and should not be shared across clones
|
|
||||||
.sync.lock
|
|
||||||
export-state/
|
|
||||||
export-state.json
|
|
||||||
|
|
||||||
# Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
|
|
||||||
ephemeral.sqlite3
|
|
||||||
ephemeral.sqlite3-journal
|
|
||||||
ephemeral.sqlite3-wal
|
|
||||||
ephemeral.sqlite3-shm
|
|
||||||
|
|
||||||
# Dolt server management (auto-started by bd)
|
|
||||||
dolt-server.pid
|
|
||||||
dolt-server.log
|
|
||||||
dolt-server.lock
|
|
||||||
dolt-server.port
|
|
||||||
dolt-server.activity
|
|
||||||
|
|
||||||
# Corrupt backup directories (created by bd doctor --fix recovery)
|
|
||||||
*.corrupt.backup/
|
|
||||||
|
|
||||||
# Backup data (auto-exported JSONL, local-only)
|
|
||||||
backup/
|
|
||||||
|
|
||||||
# Per-project environment file (Dolt connection config, GH#2520)
|
|
||||||
.env
|
|
||||||
|
|
||||||
# Legacy files (from pre-Dolt versions)
|
|
||||||
*.db
|
*.db
|
||||||
*.db?*
|
*.db?*
|
||||||
*.db-journal
|
*.db-journal
|
||||||
*.db-wal
|
*.db-wal
|
||||||
*.db-shm
|
*.db-shm
|
||||||
|
|
||||||
|
# Daemon runtime files
|
||||||
|
daemon.lock
|
||||||
|
daemon.log
|
||||||
|
daemon.pid
|
||||||
|
bd.sock
|
||||||
|
sync-state.json
|
||||||
|
last-touched
|
||||||
|
|
||||||
|
# Local version tracking (prevents upgrade notification spam after git ops)
|
||||||
|
.local_version
|
||||||
|
|
||||||
|
# Legacy database files
|
||||||
db.sqlite
|
db.sqlite
|
||||||
bd.db
|
bd.db
|
||||||
# NOTE: Do NOT add negation patterns here.
|
|
||||||
# They would override fork protection in .git/info/exclude.
|
# Worktree redirect file (contains relative path to main repo's .beads/)
|
||||||
# Config files (metadata.json, config.yaml) are tracked by git by default
|
# Must not be committed as paths would be wrong in other clones
|
||||||
# since no pattern above ignores them.
|
redirect
|
||||||
|
|
||||||
|
# Merge artifacts (temporary files from 3-way merge)
|
||||||
|
beads.base.jsonl
|
||||||
|
beads.base.meta.json
|
||||||
|
beads.left.jsonl
|
||||||
|
beads.left.meta.json
|
||||||
|
beads.right.jsonl
|
||||||
|
beads.right.meta.json
|
||||||
|
|
||||||
|
# NOTE: Do NOT add negation patterns (e.g., !issues.jsonl) here.
|
||||||
|
# They would override fork protection in .git/info/exclude, allowing
|
||||||
|
# contributors to accidentally commit upstream issue databases.
|
||||||
|
# The JSONL files (issues.jsonl, interactions.jsonl) and config files
|
||||||
|
# are tracked by git by default since no pattern above ignores them.
|
||||||
|
|||||||
+5
-5
@@ -23,17 +23,17 @@ bd list
|
|||||||
bd show <issue-id>
|
bd show <issue-id>
|
||||||
|
|
||||||
# Update issue status
|
# Update issue status
|
||||||
bd update <issue-id> --claim
|
bd update <issue-id> --status in_progress
|
||||||
bd update <issue-id> --status done
|
bd update <issue-id> --status done
|
||||||
|
|
||||||
# Sync with Dolt remote
|
# Sync with git remote
|
||||||
bd dolt push
|
bd sync
|
||||||
```
|
```
|
||||||
|
|
||||||
### Working with Issues
|
### Working with Issues
|
||||||
|
|
||||||
Issues in Beads are:
|
Issues in Beads are:
|
||||||
- **Git-native**: Stored in Dolt database with version control and branching
|
- **Git-native**: Stored in `.beads/issues.jsonl` and synced like code
|
||||||
- **AI-friendly**: CLI-first design works perfectly with AI coding agents
|
- **AI-friendly**: CLI-first design works perfectly with AI coding agents
|
||||||
- **Branch-aware**: Issues can follow your branch workflow
|
- **Branch-aware**: Issues can follow your branch workflow
|
||||||
- **Always in sync**: Auto-syncs with your commits
|
- **Always in sync**: Auto-syncs with your commits
|
||||||
@@ -53,7 +53,7 @@ Issues in Beads are:
|
|||||||
🔧 **Git Integration**
|
🔧 **Git Integration**
|
||||||
- Automatic sync with git commits
|
- Automatic sync with git commits
|
||||||
- Branch-aware issue tracking
|
- Branch-aware issue tracking
|
||||||
- Dolt-native three-way merge resolution
|
- Intelligent JSONL merge resolution
|
||||||
|
|
||||||
## Get Started with Beads
|
## Get Started with Beads
|
||||||
|
|
||||||
|
|||||||
@@ -1,56 +0,0 @@
|
|||||||
# Beads Configuration File
|
|
||||||
# This file configures default behavior for all bd commands in this repository
|
|
||||||
# All settings can also be set via environment variables (BD_* prefix)
|
|
||||||
# or overridden with command-line flags
|
|
||||||
|
|
||||||
# Issue prefix for this repository (used by bd init)
|
|
||||||
# If not set, bd init will auto-detect from directory name
|
|
||||||
# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
|
|
||||||
# issue-prefix: ""
|
|
||||||
|
|
||||||
# Use no-db mode: JSONL-only, no Dolt database
|
|
||||||
# When true, bd will use .beads/issues.jsonl as the source of truth
|
|
||||||
# no-db: false
|
|
||||||
|
|
||||||
# Enable JSON output by default
|
|
||||||
# json: false
|
|
||||||
|
|
||||||
# Feedback title formatting for mutating commands (create/update/close/dep/edit)
|
|
||||||
# 0 = hide titles, N > 0 = truncate to N characters
|
|
||||||
# output:
|
|
||||||
# title-length: 255
|
|
||||||
|
|
||||||
# Default actor for audit trails (overridden by BEADS_ACTOR or --actor)
|
|
||||||
# actor: ""
|
|
||||||
|
|
||||||
# Export events (audit trail) to .beads/events.jsonl on each flush/sync
|
|
||||||
# When enabled, new events are appended incrementally using a high-water mark.
|
|
||||||
# Use 'bd export --events' to trigger manually regardless of this setting.
|
|
||||||
# events-export: false
|
|
||||||
|
|
||||||
# Multi-repo configuration (experimental - bd-307)
|
|
||||||
# Allows hydrating from multiple repositories and routing writes to the correct database
|
|
||||||
# repos:
|
|
||||||
# primary: "." # Primary repo (where this database lives)
|
|
||||||
# additional: # Additional repos to hydrate from (read-only)
|
|
||||||
# - ~/beads-planning # Personal planning repo
|
|
||||||
# - ~/work-planning # Work planning repo
|
|
||||||
|
|
||||||
# JSONL backup (periodic export for off-machine recovery)
|
|
||||||
# Auto-enabled when a git remote exists. Override explicitly:
|
|
||||||
# backup:
|
|
||||||
# enabled: false # Disable auto-backup entirely
|
|
||||||
# interval: 15m # Minimum time between auto-exports
|
|
||||||
# git-push: false # Disable git push (export locally only)
|
|
||||||
# git-repo: "" # Separate git repo for backups (default: project repo)
|
|
||||||
|
|
||||||
# Integration settings (access with 'bd config get/set')
|
|
||||||
# These are stored in the database, not in this file:
|
|
||||||
# - jira.url
|
|
||||||
# - jira.project
|
|
||||||
# - linear.url
|
|
||||||
# - linear.api-key
|
|
||||||
# - github.org
|
|
||||||
# - github.repo
|
|
||||||
|
|
||||||
sync.remote: "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixos-config.git"
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
|
|
||||||
# This section is managed by beads. Do not remove these markers.
|
|
||||||
if command -v bd >/dev/null 2>&1; then
|
|
||||||
export BD_GIT_HOOK=1
|
|
||||||
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
|
|
||||||
if command -v timeout >/dev/null 2>&1; then
|
|
||||||
timeout "$_bd_timeout" bd hooks run post-checkout "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
if [ $_bd_exit -eq 124 ]; then
|
|
||||||
echo >&2 "beads: hook 'post-checkout' timed out after ${_bd_timeout}s — continuing without beads"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
bd hooks run post-checkout "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -eq 3 ]; then
|
|
||||||
echo >&2 "beads: database not initialized — skipping hook 'post-checkout'"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
|
|
||||||
fi
|
|
||||||
# --- END BEADS INTEGRATION v1.0.3 ---
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
|
|
||||||
# This section is managed by beads. Do not remove these markers.
|
|
||||||
if command -v bd >/dev/null 2>&1; then
|
|
||||||
export BD_GIT_HOOK=1
|
|
||||||
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
|
|
||||||
if command -v timeout >/dev/null 2>&1; then
|
|
||||||
timeout "$_bd_timeout" bd hooks run post-merge "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
if [ $_bd_exit -eq 124 ]; then
|
|
||||||
echo >&2 "beads: hook 'post-merge' timed out after ${_bd_timeout}s — continuing without beads"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
bd hooks run post-merge "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -eq 3 ]; then
|
|
||||||
echo >&2 "beads: database not initialized — skipping hook 'post-merge'"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
|
|
||||||
fi
|
|
||||||
# --- END BEADS INTEGRATION v1.0.3 ---
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
|
|
||||||
# This section is managed by beads. Do not remove these markers.
|
|
||||||
if command -v bd >/dev/null 2>&1; then
|
|
||||||
export BD_GIT_HOOK=1
|
|
||||||
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
|
|
||||||
if command -v timeout >/dev/null 2>&1; then
|
|
||||||
timeout "$_bd_timeout" bd hooks run pre-commit "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
if [ $_bd_exit -eq 124 ]; then
|
|
||||||
echo >&2 "beads: hook 'pre-commit' timed out after ${_bd_timeout}s — continuing without beads"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
bd hooks run pre-commit "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -eq 3 ]; then
|
|
||||||
echo >&2 "beads: database not initialized — skipping hook 'pre-commit'"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
|
|
||||||
fi
|
|
||||||
# --- END BEADS INTEGRATION v1.0.3 ---
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
|
|
||||||
# This section is managed by beads. Do not remove these markers.
|
|
||||||
if command -v bd >/dev/null 2>&1; then
|
|
||||||
export BD_GIT_HOOK=1
|
|
||||||
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
|
|
||||||
if command -v timeout >/dev/null 2>&1; then
|
|
||||||
timeout "$_bd_timeout" bd hooks run pre-push "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
if [ $_bd_exit -eq 124 ]; then
|
|
||||||
echo >&2 "beads: hook 'pre-push' timed out after ${_bd_timeout}s — continuing without beads"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
bd hooks run pre-push "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -eq 3 ]; then
|
|
||||||
echo >&2 "beads: database not initialized — skipping hook 'pre-push'"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
|
|
||||||
fi
|
|
||||||
# --- END BEADS INTEGRATION v1.0.3 ---
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env sh
|
|
||||||
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
|
|
||||||
# This section is managed by beads. Do not remove these markers.
|
|
||||||
if command -v bd >/dev/null 2>&1; then
|
|
||||||
export BD_GIT_HOOK=1
|
|
||||||
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
|
|
||||||
if command -v timeout >/dev/null 2>&1; then
|
|
||||||
timeout "$_bd_timeout" bd hooks run prepare-commit-msg "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
if [ $_bd_exit -eq 124 ]; then
|
|
||||||
echo >&2 "beads: hook 'prepare-commit-msg' timed out after ${_bd_timeout}s — continuing without beads"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
bd hooks run prepare-commit-msg "$@"
|
|
||||||
_bd_exit=$?
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -eq 3 ]; then
|
|
||||||
echo >&2 "beads: database not initialized — skipping hook 'prepare-commit-msg'"
|
|
||||||
_bd_exit=0
|
|
||||||
fi
|
|
||||||
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
|
|
||||||
fi
|
|
||||||
# --- END BEADS INTEGRATION v1.0.3 ---
|
|
||||||
+1
-3
@@ -1,3 +1 @@
|
|||||||
{"_type":"issue","id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
|
{"id":"nixos-config-gx2","title":"form","status":"tombstone","priority":2,"issue_type":"task","created_at":"2026-01-11T11:49:21.688289476+01:00","created_by":"m3tam3re","updated_at":"2026-01-11T11:51:36.426124223+01:00","deleted_at":"2026-01-11T11:51:36.426124223+01:00","deleted_by":"daemon","delete_reason":"delete","original_type":"task"}
|
||||||
{"_type":"issue","id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
|
|
||||||
{"_type":"issue","id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
|
||||||
|
|||||||
@@ -1,7 +1,4 @@
|
|||||||
{
|
{
|
||||||
"database": "dolt",
|
"database": "beads.db",
|
||||||
"backend": "dolt",
|
"jsonl_export": "issues.jsonl"
|
||||||
"dolt_mode": "embedded",
|
|
||||||
"dolt_database": "home_profile_restructuring",
|
|
||||||
"project_id": "664fc7e3-94eb-4874-aab6-e47835abe9d8"
|
|
||||||
}
|
}
|
||||||
-55
@@ -1,55 +0,0 @@
|
|||||||
# Sisyphus work session data
|
|
||||||
.sisyphus/
|
|
||||||
|
|
||||||
# Editor files
|
|
||||||
*~
|
|
||||||
.*.swp
|
|
||||||
.*.swo
|
|
||||||
.*.swx
|
|
||||||
|
|
||||||
# Build artifacts
|
|
||||||
result
|
|
||||||
result-*
|
|
||||||
.direnv/
|
|
||||||
|
|
||||||
# IDE
|
|
||||||
.vscode/
|
|
||||||
.idea/
|
|
||||||
*.iml
|
|
||||||
|
|
||||||
# OS
|
|
||||||
.DS_Store
|
|
||||||
Thumbs.db
|
|
||||||
|
|
||||||
# Opencode rules
|
|
||||||
.opencode-rules
|
|
||||||
opencode.json
|
|
||||||
|
|
||||||
# AI agent state
|
|
||||||
.claude/
|
|
||||||
.sidecar/
|
|
||||||
.sidecar-*
|
|
||||||
.sisyphus/
|
|
||||||
.sidecar-agent
|
|
||||||
.sidecar-task
|
|
||||||
.sidecar-pr
|
|
||||||
.sidecar-start.sh
|
|
||||||
.sidecar-base
|
|
||||||
.td-root
|
|
||||||
.cache
|
|
||||||
.pi*
|
|
||||||
.worktrees/
|
|
||||||
docs/plans/
|
|
||||||
CLAUDE.md
|
|
||||||
|
|
||||||
# Beads / Dolt files (added by bd init)
|
|
||||||
.dolt/
|
|
||||||
*.db
|
|
||||||
.beads-credential-key
|
|
||||||
|
|
||||||
# --- babysitter managed ---
|
|
||||||
.a5c/creds.env
|
|
||||||
.a5c/creds.env.tmp.*
|
|
||||||
.a5c/logs/
|
|
||||||
.a5c/runs/
|
|
||||||
# --- end babysitter managed ---
|
|
||||||
@@ -1,445 +1,157 @@
|
|||||||
# Agent Instructions
|
# NIXOS CONFIGURATION KNOWLEDGE BASE
|
||||||
|
|
||||||
This project uses **bd** (beads) for issue tracking. Run `bd prime` for full workflow context.
|
**Generated:** 2025-12-31 16:13:40 UTC
|
||||||
|
**Commit:** ebc8291
|
||||||
|
**Branch:** HEAD
|
||||||
|
|
||||||
## Quick Reference
|
## OVERVIEW
|
||||||
|
Personal NixOS configuration managing 6 hosts (4 servers, 2 desktops) using flakes, agenix secrets, and feature-based home-manager setup.
|
||||||
|
|
||||||
|
## STRUCTURE
|
||||||
|
```
|
||||||
|
./
|
||||||
|
├── flake.nix # Main entry: host definitions, inputs, outputs
|
||||||
|
├── secrets.nix # Agenix public key mappings
|
||||||
|
├── hosts/
|
||||||
|
│ ├── common/ # Shared: base config, users, extraServices, ports
|
||||||
|
│ ├── m3-atlas/ # Server: 20+ containerized services with Traefik
|
||||||
|
│ ├── m3-helios/ # Server: AdGuard, internal routing
|
||||||
|
│ ├── m3-ares/ # Desktop: NVIDIA GPU, Btrfs
|
||||||
|
│ ├── m3-kratos/ # Desktop: AMD GPU, ZFS
|
||||||
|
│ └── m3-aether/ # Cloud VM
|
||||||
|
├── home/
|
||||||
|
│ ├── common/ # Home-manager base config
|
||||||
|
│ ├── features/ # Modular feature toggles (cli, desktop, coding)
|
||||||
|
│ └── m3tam3re/ # Per-host user configs
|
||||||
|
├── modules/ # Custom NixOS/home-manager modules
|
||||||
|
├── overlays/ # Package overlays (stable, locked, pinned, master)
|
||||||
|
├── pkgs/ # Custom package definitions
|
||||||
|
└── secrets/ # Agenix encrypted .age files (19 secrets)
|
||||||
|
```
|
||||||
|
|
||||||
|
## WHERE TO LOOK
|
||||||
|
|
||||||
|
| Task | Location | Notes |
|
||||||
|
|------|----------|-------|
|
||||||
|
| Add new host | `flake.nix` + `hosts/<name>/` | Copy template from m3-atlas (server) or m3-ares (desktop) |
|
||||||
|
| Add service to m3-atlas | `hosts/m3-atlas/services/` | See containers/ for Podman + Traefik pattern |
|
||||||
|
| Configure desktop features | `home/features/desktop/` | Feature toggles with mkEnableOption |
|
||||||
|
| Add CLI tool | `home/features/cli/` | Fish + Nushell integration expected |
|
||||||
|
| Manage secrets | `secrets.nix` + `agenix -e` | SSH keys defined in secrets.nix |
|
||||||
|
| Define ports | `hosts/common/ports.nix` | Centralized port registry |
|
||||||
|
| Add user | `hosts/common/users/` | Shared across all hosts |
|
||||||
|
| Custom packages | `pkgs/default.nix` | Exposed via flake outputs |
|
||||||
|
|
||||||
|
## CONVENTIONS
|
||||||
|
|
||||||
|
### Secrets (agenix)
|
||||||
|
- **Create**: `agenix -e secrets/<name>.age` after adding keys to `secrets.nix`
|
||||||
|
- **Reference**: `config.age.secrets.<name>.path` in service configs
|
||||||
|
- **Pattern**: Service env files use `environmentFiles = [config.age.secrets.<service>-env.path]`
|
||||||
|
|
||||||
|
### Service Organization
|
||||||
|
- **Native services**: `hosts/<host>/services/<service>.nix`
|
||||||
|
- **Containers**: `hosts/<host>/services/containers/<service>.nix`
|
||||||
|
- **Traefik integration**: All m3-atlas services include dynamic config for SSL + routing
|
||||||
|
- **Networking**: Containers use dedicated `web` network (10.89.0.0/24) with static IPs
|
||||||
|
|
||||||
|
### Port Management
|
||||||
|
- **Registry**: All ports defined in `hosts/common/ports.nix`
|
||||||
|
- **Access**: `config.m3ta.ports.get "service-name"`
|
||||||
|
- **Convention**: Internal services use 3000-3020 range
|
||||||
|
|
||||||
|
### Home-Manager Features
|
||||||
|
- **Enable**: `features.<category>.<feature>.enable = true` in user config
|
||||||
|
- **Categories**: `cli`, `desktop`, `coding`
|
||||||
|
- **Pattern**: Features are opt-in modules with default.nix aggregators
|
||||||
|
|
||||||
|
### Multiple nixpkgs Inputs
|
||||||
|
- **stable**: 25.11 release
|
||||||
|
- **locked/pinned**: Specific commits for compatibility
|
||||||
|
- **master**: Bleeding edge
|
||||||
|
- **m3ta-nixpkgs**: Custom local overlay at `path:/home/m3tam3re/p/nix/nixpkgs`
|
||||||
|
|
||||||
|
## COMMANDS
|
||||||
```bash
|
```bash
|
||||||
bd ready # Find available work
|
# Build/deploy specific host
|
||||||
bd show <id> # View issue details
|
sudo nixos-rebuild switch --flake .#m3-ares
|
||||||
bd update <id> --claim # Claim work atomically
|
|
||||||
bd close <id> # Complete work
|
# Build/deploy current host
|
||||||
bd dolt push # Push beads data to remote
|
sudo nixos-rebuild switch --flake .#$(uname -n)
|
||||||
|
|
||||||
|
# Home-manager update
|
||||||
|
home-manager --flake . switch
|
||||||
|
|
||||||
|
# Update all flake inputs
|
||||||
|
nix flake update
|
||||||
|
|
||||||
|
# Add/edit secret
|
||||||
|
agenix -e secrets/<name>.age
|
||||||
|
|
||||||
|
# Infrastructure shell (OpenTofu)
|
||||||
|
nix develop .#infraShell
|
||||||
|
|
||||||
|
# Check configuration (no activation)
|
||||||
|
nixos-rebuild dry-build --flake .#<hostname>
|
||||||
```
|
```
|
||||||
|
|
||||||
## Non-Interactive Shell Commands
|
## TRAEFIK PATTERNS (m3-atlas only)
|
||||||
|
|
||||||
**ALWAYS use non-interactive flags** with file operations to avoid hanging on confirmation prompts.
|
### SSL Termination
|
||||||
|
- **Provider**: Godaddy DNS challenge
|
||||||
Shell commands like `cp`, `mv`, and `rm` may be aliased to include `-i` (interactive) mode on some systems, causing the agent to hang indefinitely waiting for y/n input.
|
- **Cert storage**: `/var/lib/traefik/acme.json`
|
||||||
|
- **Config**: `hosts/m3-atlas/services/traefik.nix`
|
||||||
**Use these forms instead:**
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Force overwrite without prompting
|
|
||||||
cp -f source dest # NOT: cp source dest
|
|
||||||
mv -f source dest # NOT: mv source dest
|
|
||||||
rm -f file # NOT: rm file
|
|
||||||
|
|
||||||
# For recursive operations
|
|
||||||
rm -rf directory # NOT: rm -r directory
|
|
||||||
cp -rf source dest # NOT: cp -r source dest
|
|
||||||
```
|
|
||||||
|
|
||||||
**Other commands that may prompt:**
|
|
||||||
|
|
||||||
- `scp` - use `-o BatchMode=yes` for non-interactive
|
|
||||||
- `ssh` - use `-o BatchMode=yes` to fail instead of prompting
|
|
||||||
- `apt-get` - use `-y` flag
|
|
||||||
- `brew` - use `HOMEBREW_NO_AUTO_UPDATE=1` env var
|
|
||||||
|
|
||||||
<!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
|
|
||||||
|
|
||||||
## Beads Issue Tracker
|
|
||||||
|
|
||||||
This project uses **bd (beads)** for persistent task tracking. Run `bd prime` for full workflow context.
|
|
||||||
|
|
||||||
### Why Beads?
|
|
||||||
|
|
||||||
- **Prefer Beads over ad-hoc markdown TODO lists** — Beads provides structured, queryable, shareable issue tracking with dependency management
|
|
||||||
- **Never use `bd edit`** — it opens an interactive editor which blocks agent workflows
|
|
||||||
- **Use flags and stdin instead** — `bd update <id> --claim`, `bd create --title "..." --estimate 2`
|
|
||||||
|
|
||||||
### Slash Commands (Agent Workflow)
|
|
||||||
|
|
||||||
| Command | Purpose |
|
|
||||||
|---------|---------|
|
|
||||||
| `/beads:ready` | Find unblocked issues |
|
|
||||||
| `/beads:create` | Create a new issue |
|
|
||||||
| `/beads:update` | Update an issue (claim, status) |
|
|
||||||
| `/beads:close` | Close completed work |
|
|
||||||
| `/beads:stats` | Project-level snapshot |
|
|
||||||
|
|
||||||
### Core Workflow (6 Steps)
|
|
||||||
|
|
||||||
#### 1. Find Unblocked Work
|
|
||||||
```bash
|
|
||||||
bd ready --json
|
|
||||||
```
|
|
||||||
Lists issues with no blocking dependencies that are ready to work on.
|
|
||||||
|
|
||||||
#### 2. Claim Work
|
|
||||||
```bash
|
|
||||||
bd update <id> --claim
|
|
||||||
```
|
|
||||||
Atomically assigns the issue to you (sets status to "in-progress").
|
|
||||||
|
|
||||||
#### 3. Inspect Details
|
|
||||||
```bash
|
|
||||||
bd show <id>
|
|
||||||
```
|
|
||||||
View full issue details including:
|
|
||||||
- Description and acceptance criteria
|
|
||||||
- Blocking/blocked-by dependencies
|
|
||||||
- Time estimates
|
|
||||||
- Status history
|
|
||||||
|
|
||||||
#### 4. Create Newly Discovered Work
|
|
||||||
```bash
|
|
||||||
# Create a new issue
|
|
||||||
bd create \
|
|
||||||
--title "Fix audio on m3-helios" \
|
|
||||||
--estimate 2 \
|
|
||||||
--priority high \
|
|
||||||
--labels nixos,audio
|
|
||||||
|
|
||||||
# Link dependencies
|
|
||||||
bd dep <id> --blocks <blocked-id> # This issue blocks another
|
|
||||||
bd dep <id> --after <after-id> # This issue after another completes
|
|
||||||
bd dep <id> --requires <requires-id> # This issue requires another
|
|
||||||
```
|
|
||||||
|
|
||||||
#### 5. Complete Work
|
|
||||||
```bash
|
|
||||||
bd close <id> --reason "Added PulseAudio fallback to configuration.nix"
|
|
||||||
```
|
|
||||||
Provide a concise summary of what was done. The `--reason` is mandatory.
|
|
||||||
|
|
||||||
#### 6. Project Snapshot
|
|
||||||
```bash
|
|
||||||
bd status --json # Current state of all issues
|
|
||||||
bd stats # Metrics: velocity, cycle time, bottlenecks
|
|
||||||
```
|
|
||||||
|
|
||||||
### Example Complete Workflow
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Start session - find work
|
|
||||||
bd ready --json
|
|
||||||
|
|
||||||
# Claim available issue
|
|
||||||
bd update 42 --claim
|
|
||||||
|
|
||||||
# Do the work...
|
|
||||||
|
|
||||||
# Discover something else needed
|
|
||||||
bd create --title "Document hermes-agent setup" --estimate 1
|
|
||||||
# Link as related
|
|
||||||
bd dep 43 --after 42
|
|
||||||
|
|
||||||
# Complete original
|
|
||||||
bd close 42 --reason "Added Hyprland idle timeout config"
|
|
||||||
|
|
||||||
# Close related
|
|
||||||
bd close 43 --reason "Added setup docs to AGENTS.md"
|
|
||||||
|
|
||||||
# Push state to remote
|
|
||||||
bd dolt push
|
|
||||||
```
|
|
||||||
|
|
||||||
### Rules
|
|
||||||
|
|
||||||
- Use `bd` for ALL task tracking — do NOT use TodoWrite, TaskCreate, or markdown TODO lists
|
|
||||||
- Run `bd prime` for detailed command reference and session close protocol
|
|
||||||
- Use `bd remember` for persistent knowledge — do NOT use MEMORY.md files
|
|
||||||
|
|
||||||
## Session Completion
|
|
||||||
|
|
||||||
**When ending a work session**, you MUST complete ALL steps below. Work is NOT complete until `git push` succeeds.
|
|
||||||
|
|
||||||
**MANDATORY WORKFLOW:**
|
|
||||||
|
|
||||||
1. **File issues for remaining work** - Create issues for anything that needs follow-up
|
|
||||||
2. **Run quality gates** (if code changed) - Tests, linters, builds
|
|
||||||
3. **Update issue status** - Close finished work, update in-progress items
|
|
||||||
4. **PUSH TO REMOTE** - This is MANDATORY:
|
|
||||||
```bash
|
|
||||||
git pull --rebase
|
|
||||||
bd dolt push
|
|
||||||
git push
|
|
||||||
git status # MUST show "up to date with origin"
|
|
||||||
```
|
|
||||||
5. **Clean up** - Clear stashes, prune remote branches
|
|
||||||
6. **Verify** - All changes committed AND pushed
|
|
||||||
7. **Hand off** - Provide context for next session
|
|
||||||
|
|
||||||
**CRITICAL RULES:**
|
|
||||||
|
|
||||||
- Work is NOT complete until `git push` succeeds
|
|
||||||
- NEVER stop before pushing - that leaves work stranded locally
|
|
||||||
- NEVER say "ready to push when you are" - YOU must push
|
|
||||||
- If push fails, resolve and retry until it succeeds
|
|
||||||
<!-- END BEADS INTEGRATION -->
|
|
||||||
|
|
||||||
# Project Agent
|
|
||||||
|
|
||||||
**Workspace Path:** `/home/m3tam3re/p/NIX/nixos-config`
|
|
||||||
_(Note to Pi: Your file write/edit tools run in a different directory by default. You MUST use absolute paths starting with the Workspace Path above for ALL file operations!)_
|
|
||||||
|
|
||||||
**Generated:** 2026-04-26
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Stack
|
|
||||||
|
|
||||||
| Component | Version/Source |
|
|
||||||
| ---------------- | --------------------------------- |
|
|
||||||
| **Nixpkgs** | nixos-unstable + 25.05 stable |
|
|
||||||
| **Home Manager** | github:nix-community/home-manager |
|
|
||||||
| **m3ta-home** | code.m3ta.dev/m3tam3re/m3ta-home |
|
|
||||||
| **m3ta-nixpkgs** | code.m3ta.dev/m3tam3re/nixpkgs |
|
|
||||||
| **Agenix** | github:ryantm/agenix |
|
|
||||||
| **Disko** | github:nix-community/disko |
|
|
||||||
| **NUR** | github:nix-community/NUR |
|
|
||||||
| **Formatter** | alejandra |
|
|
||||||
| **Linters** | statix, deadnix |
|
|
||||||
| **IDE** | nixd |
|
|
||||||
| **Hermes Agent** | NousResearch/hermes-agent |
|
|
||||||
| **LLM Agents** | numtide/llm-agents.nix |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Structure
|
|
||||||
|
|
||||||
```
|
|
||||||
nixos-config/
|
|
||||||
├── flake.nix # Entry point: hosts, overlays, dev shells, m3ta-home input
|
|
||||||
├── coding-rules.json # Opencode rules configuration
|
|
||||||
│
|
|
||||||
├── hosts/ # Per-host NixOS configurations
|
|
||||||
│ ├── common/ # Shared across all hosts
|
|
||||||
│ │ ├── users/
|
|
||||||
│ │ │ └── m3tam3re.nix # ← Central user + m3ta-home integration
|
|
||||||
│ │ ├── default.nix # Shared NixOS settings, overlays, home-manager setup
|
|
||||||
│ │ ├── ports.nix # Network ports config
|
|
||||||
│ │ └── extraServices/ # Common service toggles
|
|
||||||
│ ├── m3-ares/ # TUXEDO laptop (desktop)
|
|
||||||
│ │ └── home.nix # Hyprland: eDP-1 + HDMI, XDG/MIME
|
|
||||||
│ ├── m3-kratos/ # AMD desktop (desktop)
|
|
||||||
│ │ └── home.nix # Hyprland: dual DP, XDG/MIME
|
|
||||||
│ ├── m3-daedalus/ # Portable laptop (desktop, no Hyprland)
|
|
||||||
│ │ └── home.nix # XDG/MIME only
|
|
||||||
│ ├── m3-atlas/ # Primary server (server + coding)
|
|
||||||
│ ├── m3-helios/ # AdGuard DNS server (minimal server)
|
|
||||||
│ ├── m3-hermes/ # Secondary server (minimal server)
|
|
||||||
│ └── m3-aether/ # Cloud VM (minimal server)
|
|
||||||
│
|
|
||||||
├── modules/ # Reusable NixOS modules
|
|
||||||
│ └── nixos/ # NixOS-specific modules
|
|
||||||
│
|
|
||||||
├── overlays/ # Package overlays (stable/locked/master/pinned)
|
|
||||||
│ ├── default.nix
|
|
||||||
│ └── mods/
|
|
||||||
│
|
|
||||||
├── pkgs/ # Custom packages
|
|
||||||
│
|
|
||||||
├── secrets/ # Encrypted secrets (agenix)
|
|
||||||
│ └── secrets.nix
|
|
||||||
│
|
|
||||||
├── .opencode-rules/ # Opencode AI rules
|
|
||||||
│ ├── concerns/
|
|
||||||
│ ├── languages/nix.md
|
|
||||||
│ └── USAGE.md
|
|
||||||
│
|
|
||||||
└── .pi/ # Agent configuration
|
|
||||||
```
|
|
||||||
|
|
||||||
### Home-Manager Integration
|
|
||||||
|
|
||||||
Home-Manager configs are managed centrally in the **`m3ta-home`** repository:
|
|
||||||
- **Repo**: `code.m3ta.dev/m3tam3re/m3ta-home`
|
|
||||||
- **Docs**: See m3ta-home README for full documentation
|
|
||||||
|
|
||||||
What lives where:
|
|
||||||
|
|
||||||
| Concern | Location | Why |
|
|
||||||
|---------|----------|-----|
|
|
||||||
| Shell, CLI tools, editors, apps | `m3ta-home/profiles/` | Portable across all hosts |
|
|
||||||
| User identity (git, SSH, JJ) | `m3ta-home/users/` | Switchable: private vs work |
|
|
||||||
| Feature flags (enable/disable) | `nixos-config/hosts/common/users/m3tam3re.nix` | Per-host decisions |
|
|
||||||
| Monitor layouts, window rules | `nixos-config/hosts/<name>/home.nix` | Hardware-specific |
|
|
||||||
| XDG/MIME defaults | `nixos-config/hosts/<name>/home.nix` | Host-specific preferences |
|
|
||||||
| NixOS overlays | `nixos-config/overlays/` | System-level package management |
|
|
||||||
|
|
||||||
#### Host → Profile Mapping
|
|
||||||
|
|
||||||
Defined in `hosts/common/users/m3tam3re.nix`:
|
|
||||||
|
|
||||||
|
### Service Integration Template
|
||||||
```nix
|
```nix
|
||||||
hostProfiles = {
|
services.traefik.dynamicConfigOptions.http = {
|
||||||
# Desktop hosts
|
services.<name>.loadBalancer.servers = [{ url = "http://127.0.0.1:<port>"; }];
|
||||||
m3-ares = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
|
routers.<name> = {
|
||||||
m3-kratos = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
|
rule = "Host(`<subdomain>.m3ta.dev`)";
|
||||||
m3-daedalus = { context = "desktop"; sets = ["coding" "media"]; };
|
service = "<name>";
|
||||||
# Server hosts
|
tls.certResolver = "godaddy";
|
||||||
m3-atlas = { context = "server"; sets = ["coding"]; };
|
};
|
||||||
m3-helios = { context = "server"; sets = []; };
|
|
||||||
m3-hermes = { context = "server"; sets = []; };
|
|
||||||
m3-aether = { context = "server"; sets = []; };
|
|
||||||
};
|
};
|
||||||
```
|
```
|
||||||
|
|
||||||
#### Work Identity Use Case
|
### Container Pattern
|
||||||
|
- **Network**: `--network=web --ip=10.89.0.<sequential>`
|
||||||
|
- **Ports**: Bind localhost only (`127.0.0.1:<external>:<internal>`)
|
||||||
|
- **Database access**: `--add-host=mysql:10.89.0.1` (gateway IP)
|
||||||
|
|
||||||
The same `m3ta-home` repo supports a **work identity** for company machines:
|
## HOST ROLES
|
||||||
|
|
||||||
```nix
|
| Host | Type | Hardware | Purpose |
|
||||||
# On a work NixOS machine:
|
|------|------|----------|---------|
|
||||||
(m3ta-lib.mkHome {
|
| m3-atlas | Server | x86_64, disko | 20+ services, Traefik hub, PostgreSQL, MySQL |
|
||||||
user = "m3tam3re";
|
| m3-helios | Server | x86_64, disko | AdGuard DNS, internal routing |
|
||||||
identity = "work"; # ← switches git to sascha.koenig, SSH to AZ hosts
|
| m3-ares | Desktop | NVIDIA, Btrfs | Personal workstation, n8n, PostgreSQL |
|
||||||
context = "desktop";
|
| m3-kratos | Desktop | AMD, ZFS | Workstation, mem0, PostgreSQL |
|
||||||
sets = ["coding"];
|
| m3-aether | Cloud | QEMU | General purpose VM |
|
||||||
})
|
| m3-daedalus | Laptop | home-only | Portable (no full NixOS config) |
|
||||||
```
|
|
||||||
|
|
||||||
This provides the familiar shell/editor/CLI setup but with work git credentials and SSH configuration.
|
## ANTI-PATTERNS (THIS PROJECT)
|
||||||
|
|
||||||
---
|
- **DON'T** add secrets to `secrets/` without updating `secrets.nix` public keys
|
||||||
|
- **DON'T** hardcode ports - use `config.m3ta.ports.get` or add to registry
|
||||||
|
- **DON'T** create containers outside the `web` network on m3-atlas
|
||||||
|
- **DON'T** skip Traefik config for public-facing services on m3-atlas
|
||||||
|
- **DON'T** bypass extraServices flags - use `hosts/common/extraServices/` pattern
|
||||||
|
- **DON'T** commit unencrypted secrets or test with real credentials
|
||||||
|
|
||||||
## Commands
|
## UNIQUE TO THIS CONFIG
|
||||||
|
|
||||||
| Action | Command | Notes |
|
- **Custom m3ta-nixpkgs**: Local overlay for unreleased/patched packages
|
||||||
| -------------------- | ---------------------------------------------------------------------- | ------------------------------------------------- |
|
- **extraServices abstraction**: Boolean flags to toggle Podman, Ollama, virtualisation per host
|
||||||
| **Enter dev shell** | `nix develop` | Includes alejandra, nixd, agenix, statix, deadnix |
|
- **Mythological naming**: All hosts named after Greek mythology
|
||||||
| **Build host** | `sudo nixos-rebuild switch --flake .#m3-ares` | Replace hostname as needed |
|
- **Dual domain strategy**: New services on `m3ta.dev`, legacy redirects from `m3tam3re.com`
|
||||||
| **Dry run build** | `sudo nixos-rebuild dry-run --flake .#m3-ares` | Validate without applying |
|
- **Per-host nixpkgs versions**: Different hosts can use different nixpkgs commits via specialArgs
|
||||||
| **List hosts** | `nix flake show` | Shows all NixOS configurations |
|
- **Container IP registry**: Static IP assignments in 10.89.0.0/24 subnet for predictable networking
|
||||||
| **Update flake** | `sudo nixos-rebuild switch --flake .#m3-ares --update-input nixpkgs` | Update specific input |
|
|
||||||
| **Format code** | `alejandra .` | Run before committing |
|
|
||||||
| **Check lint** | `statix check .` | Run statix for antipatterns |
|
|
||||||
| **Remove dead code** | `deadnix -w .` | Clean up unused let bindings |
|
|
||||||
| **Build ISO** | `nix build .#nixosConfigurations.m3-ares.config.system.build.isoImage` | Generate install ISO |
|
|
||||||
|
|
||||||
---
|
## NOTES
|
||||||
|
|
||||||
## Conventions
|
- m3-atlas is the service hub - most complex configuration
|
||||||
|
- Secrets require host SSH keys defined in `secrets.nix` before `agenix -e` works
|
||||||
### Formatting & Style
|
- Fish and Nushell both configured - choose per-user with shell aliases
|
||||||
|
- Color scheme (Dracula) applied via nix-colors across all visual tools
|
||||||
- **Formatter:** `alejandra` (mandatory, run before commits)
|
- See subdirectory AGENTS.md for deep dives on containers, desktop features, CLI tools
|
||||||
- **Indentation:** 2 spaces (alejandra default)
|
|
||||||
- **Variables:** camelCase (e.g., `maxRetryAttempts`)
|
|
||||||
- **Types/Modules:** PascalCase (e.g., `MyService`)
|
|
||||||
- **Constants:** UPPER_SNAKE_CASE (e.g., `MAX_RETRIES`)
|
|
||||||
- **Files:** hyphen-case (e.g., `my-file.nix`)
|
|
||||||
|
|
||||||
### Nix Module Patterns
|
|
||||||
|
|
||||||
```nix
|
|
||||||
{ config, lib, pkgs, ... }:
|
|
||||||
{
|
|
||||||
options.myService.enable = lib.mkEnableOption "my service";
|
|
||||||
config = lib.mkIf config.myService.enable {
|
|
||||||
services.myService.enable = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### Conditionals
|
|
||||||
|
|
||||||
```nix
|
|
||||||
config = lib.mkMerge [
|
|
||||||
(lib.mkIf cfg.enable { ... })
|
|
||||||
(lib.mkIf cfg.extraConfig { ... })
|
|
||||||
];
|
|
||||||
```
|
|
||||||
|
|
||||||
### Anti-Patterns (AVOID)
|
|
||||||
|
|
||||||
- **Never use `with pkgs;`** — always use explicit package references
|
|
||||||
- **Never use `builtins.fetchTarball`** — use flake inputs instead
|
|
||||||
- **Never use `import <nixpkgs>`** — always use inputs
|
|
||||||
- **Never use `builtins.getAttr/hasAttr`** — use `lib.attrByPath` or `lib.optionalAttrs`
|
|
||||||
- **Avoid anonymous functions in config** — extract to named lets
|
|
||||||
|
|
||||||
### Imports
|
|
||||||
|
|
||||||
- Use flake inputs for dependencies (e.g., `inputs.home-manager.nixosModules.home-manager`)
|
|
||||||
- Import relative paths with `./` or `../`
|
|
||||||
- Never use absolute paths in imports
|
|
||||||
|
|
||||||
### Secrets
|
|
||||||
|
|
||||||
- Secrets managed via **agenix** in `secrets/` directory
|
|
||||||
- Never commit plaintext secrets
|
|
||||||
- Use `.nix` extension for secret files
|
|
||||||
|
|
||||||
### Flake Input URLs
|
|
||||||
|
|
||||||
All `code.m3ta.dev` inputs use **SSH** URLs:
|
|
||||||
```nix
|
|
||||||
url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/<repo>";
|
|
||||||
```
|
|
||||||
Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with configured keys.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Key Files
|
|
||||||
|
|
||||||
| File | Purpose |
|
|
||||||
| ---------------------------------- | ------------------------------------------------------------------------------------------ |
|
|
||||||
| `flake.nix` | Central entry point defining all hosts, overlays, packages, dev shells, and nixpkgs config |
|
|
||||||
| `hosts/common/default.nix` | Shared Nix settings, nixpkgs overlays, home-manager setup (`useGlobalPkgs = true`) |
|
|
||||||
| `hosts/common/users/m3tam3re.nix` | User definition + m3ta-home mkHome integration + per-host feature flags |
|
|
||||||
| `hosts/<name>/home.nix` | Host-specific overrides: monitors, workspaces, window rules, XDG/MIME |
|
|
||||||
| `overlays/default.nix` | Package version overrides (stable/locked/master branches) |
|
|
||||||
| `.opencode-rules/languages/nix.md` | Nix-specific conventions and patterns |
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## What to Avoid
|
|
||||||
|
|
||||||
1. **Don't modify `flake.lock`** directly — use `nix flake update`
|
|
||||||
2. **Don't use impure operations** — this is a pure flake-based config
|
|
||||||
3. **Don't commit without formatting** — always run `alejandra .` first
|
|
||||||
4. **Don't add packages to hosts directly** — prefer adding to overlays or using NUR
|
|
||||||
5. **Don't hardcode paths** — use `inputs` and relative imports
|
|
||||||
6. **Don't create monolithic modules** — keep functions under 20 lines
|
|
||||||
7. **Don't skip the dry-run** — always test with `--dry-run` before switching
|
|
||||||
8. **Don't use lib.mkDefault lightly** — understand the precedence implications
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Notes
|
|
||||||
|
|
||||||
### Adding a New Host
|
|
||||||
|
|
||||||
1. Add entry to `flake.nix` → `nixosConfigurations`
|
|
||||||
2. Create directory in `hosts/` with:
|
|
||||||
- `default.nix` — imports common + specific configs
|
|
||||||
- `configuration.nix` — host-specific system config
|
|
||||||
- `hardware-configuration.nix` — from `nixos-generate-config`
|
|
||||||
- `programs.nix`, `services/`, `secrets.nix` as needed
|
|
||||||
3. Add entry to `hostProfiles` in `hosts/common/users/m3tam3re.nix`
|
|
||||||
4. Add feature flags in the `hostFlags` section
|
|
||||||
5. Create `hosts/<name>/home.nix` if the host needs monitor/XDG overrides
|
|
||||||
6. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
|
|
||||||
|
|
||||||
### Adding a New Package
|
|
||||||
|
|
||||||
1. For simple packages: add to appropriate overlay in `overlays/default.nix`
|
|
||||||
2. For complex packages: create in `pkgs/` directory
|
|
||||||
3. For upstream packages: use NUR or add as flake input
|
|
||||||
|
|
||||||
### Adding a New Home-Manager Feature
|
|
||||||
|
|
||||||
1. Create the module in `m3ta-home` under the appropriate profile directory
|
|
||||||
2. Add the import to the parent `default.nix` in m3ta-home
|
|
||||||
3. Enable it per-host via feature flags in `hosts/common/users/m3tam3re.nix`
|
|
||||||
|
|
||||||
### Development Workflow
|
|
||||||
|
|
||||||
1. Edit config files
|
|
||||||
2. Run `alejandra .` to format
|
|
||||||
3. Run `statix check .` for linting
|
|
||||||
4. Run `sudo nixos-rebuild dry-run --flake .#m3-ares`
|
|
||||||
5. If successful: `sudo nixos-rebuild switch --flake .#m3-ares`
|
|
||||||
|
|
||||||
### Remote Building
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Build on remote machine
|
|
||||||
nix copy --to ssh://user@host .#nixosConfigurations.m3-ares.config.system.build.toplevel
|
|
||||||
ssh user@host 'sudo nixos-rebuild switch --flake /nix/store/...-closure'
|
|
||||||
```
|
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@@ -1 +0,0 @@
|
|||||||
{"$schema":"https://opencode.ai/config.json","instructions":[".opencode-rules/concerns/coding-style.md",".opencode-rules/concerns/naming.md",".opencode-rules/concerns/documentation.md",".opencode-rules/concerns/testing.md",".opencode-rules/concerns/git-workflow.md",".opencode-rules/concerns/project-structure.md",".opencode-rules/languages/nix.md"]}
|
|
||||||
Generated
+96
-963
File diff suppressed because it is too large
Load Diff
@@ -15,16 +15,15 @@
|
|||||||
url = "github:nix-community/home-manager";
|
url = "github:nix-community/home-manager";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||||
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
|
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
|
||||||
nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
|
nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
|
||||||
nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
|
nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
|
||||||
nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
|
nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
|
||||||
nixpkgs-master.url = "github:nixos/nixpkgs/master";
|
nixpkgs-master.url = "github:nixos/nixpkgs/master";
|
||||||
|
|
||||||
m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
|
m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
|
||||||
llm-agents.url = "github:numtide/llm-agents.nix";
|
# m3ta-nixpkgs.url = "path:/home/m3tam3re/p/NIX/nixpkgs";
|
||||||
|
|
||||||
#
|
#
|
||||||
nur = {
|
nur = {
|
||||||
url = "github:nix-community/NUR";
|
url = "github:nix-community/NUR";
|
||||||
@@ -37,27 +36,18 @@
|
|||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
nixos-generators = {url = "github:nix-community/nixos-generators";};
|
nixos-generators = {
|
||||||
|
url = "github:nix-community/nixos-generators";
|
||||||
|
};
|
||||||
|
|
||||||
|
hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
|
||||||
rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
|
rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
|
||||||
nix-colors.url = "github:misterio77/nix-colors";
|
nix-colors.url = "github:misterio77/nix-colors";
|
||||||
|
|
||||||
m3ta-home = {
|
agents = {
|
||||||
url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
|
# url = "path:/home/m3tam3re/p/MISC/AGENTS";
|
||||||
# url = "path:/home/m3tam3re/p/NIX/m3ta-home";
|
url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
flake = false;
|
||||||
};
|
|
||||||
|
|
||||||
agent-lib = {
|
|
||||||
url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib";
|
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
|
||||||
|
|
||||||
hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.29.2";
|
|
||||||
|
|
||||||
rustfs = {
|
|
||||||
url = "github:rustfs/rustfs-flake";
|
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
@@ -79,45 +69,37 @@
|
|||||||
"x86_64-darwin"
|
"x86_64-darwin"
|
||||||
];
|
];
|
||||||
forAllSystems = nixpkgs.lib.genAttrs systems;
|
forAllSystems = nixpkgs.lib.genAttrs systems;
|
||||||
allOverlays = import ./overlays {inherit inputs outputs;};
|
|
||||||
in {
|
in {
|
||||||
packages =
|
packages =
|
||||||
forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
|
forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
|
||||||
overlays = removeAttrs allOverlays ["mkLlmAgentsOverlay"];
|
overlays = import ./overlays {inherit inputs outputs;};
|
||||||
lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
|
|
||||||
homeManagerModules = import ./modules/home-manager;
|
homeManagerModules = import ./modules/home-manager;
|
||||||
|
|
||||||
nixosConfigurations = {
|
nixosConfigurations = {
|
||||||
m3-ares = nixpkgs.lib.nixosSystem {
|
m3-ares = nixpkgs.lib.nixosSystem {
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit inputs outputs;
|
inherit inputs outputs;
|
||||||
system = "x86_64-linux";
|
|
||||||
hostname = "m3-ares";
|
hostname = "m3-ares";
|
||||||
};
|
};
|
||||||
modules = [
|
modules = [
|
||||||
./hosts/m3-ares
|
./hosts/m3-ares
|
||||||
agenix.nixosModules.default
|
agenix.nixosModules.default
|
||||||
m3ta-nixpkgs.nixosModules.default
|
m3ta-nixpkgs.nixosModules.default
|
||||||
inputs.hermes-agent.nixosModules.default
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
m3-atlas = nixpkgs.lib.nixosSystem {
|
m3-atlas = nixpkgs.lib.nixosSystem {
|
||||||
specialArgs = {
|
specialArgs = {inherit inputs outputs;};
|
||||||
inherit inputs outputs;
|
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
};
|
|
||||||
modules = [
|
modules = [
|
||||||
./hosts/m3-atlas
|
./hosts/m3-atlas
|
||||||
inputs.disko.nixosModules.disko
|
inputs.disko.nixosModules.disko
|
||||||
agenix.nixosModules.default
|
agenix.nixosModules.default
|
||||||
m3ta-nixpkgs.nixosModules.default
|
m3ta-nixpkgs.nixosModules.default
|
||||||
inputs.rustfs.nixosModules.rustfs
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
m3-kratos = nixpkgs.lib.nixosSystem {
|
m3-kratos = nixpkgs.lib.nixosSystem {
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit inputs outputs;
|
inherit inputs outputs;
|
||||||
system = "x86_64-linux";
|
|
||||||
hostname = "m3-kratos";
|
hostname = "m3-kratos";
|
||||||
};
|
};
|
||||||
modules = [
|
modules = [
|
||||||
@@ -125,14 +107,11 @@
|
|||||||
agenix.nixosModules.default
|
agenix.nixosModules.default
|
||||||
nur.modules.nixos.default
|
nur.modules.nixos.default
|
||||||
m3ta-nixpkgs.nixosModules.default
|
m3ta-nixpkgs.nixosModules.default
|
||||||
inputs.hermes-agent.nixosModules.default
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
m3-helios = nixpkgs.lib.nixosSystem {
|
m3-helios = nixpkgs.lib.nixosSystem {
|
||||||
specialArgs = {
|
specialArgs = {inherit inputs outputs;};
|
||||||
inherit inputs outputs;
|
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
};
|
|
||||||
modules = [
|
modules = [
|
||||||
./hosts/m3-helios
|
./hosts/m3-helios
|
||||||
inputs.disko.nixosModules.disko
|
inputs.disko.nixosModules.disko
|
||||||
@@ -140,47 +119,32 @@
|
|||||||
m3ta-nixpkgs.nixosModules.default
|
m3ta-nixpkgs.nixosModules.default
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
m3-hermes = nixpkgs.lib.nixosSystem {
|
|
||||||
specialArgs = {
|
|
||||||
inherit inputs outputs;
|
|
||||||
system = "x86_64-linux";
|
|
||||||
};
|
|
||||||
modules = [
|
|
||||||
./hosts/m3-hermes
|
|
||||||
inputs.disko.nixosModules.disko
|
|
||||||
agenix.nixosModules.default
|
|
||||||
m3ta-nixpkgs.nixosModules.default
|
|
||||||
inputs.hermes-agent.nixosModules.default
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
homeConfigurations = {
|
homeConfigurations = {
|
||||||
"m3tam3re@m3-daedalus" = home-manager.lib.homeManagerConfiguration {
|
"m3tam3re@m3-daedalus" = home-manager.lib.homeManagerConfiguration {
|
||||||
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
pkgs = nixpkgs.legacyPackages."x86_64-linux";
|
||||||
extraSpecialArgs = {
|
extraSpecialArgs = {
|
||||||
inherit inputs outputs;
|
inherit inputs outputs;
|
||||||
system = "x86_64-linux";
|
|
||||||
hostname = "m3-daedalus";
|
hostname = "m3-daedalus";
|
||||||
};
|
};
|
||||||
modules = [./home/m3tam3re/m3-daedalus.nix];
|
modules = [./home/m3tam3re/m3-daedalus.nix];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
devShells = forAllSystems (system: let
|
devShells.x86_64-linux.infraShell = let
|
||||||
pkgs = import nixpkgs {
|
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
||||||
inherit system;
|
in
|
||||||
config.allowUnfree = true; # Allow unfree packages in devShell
|
pkgs.mkShell {
|
||||||
};
|
|
||||||
in {
|
|
||||||
default = pkgs.mkShell {
|
|
||||||
buildInputs = with pkgs; [
|
buildInputs = with pkgs; [
|
||||||
alejandra
|
opentofu
|
||||||
nixd
|
nixos-anywhere
|
||||||
openssh
|
|
||||||
agenix.packages.${system}.default
|
|
||||||
statix
|
|
||||||
deadnix
|
|
||||||
];
|
];
|
||||||
|
shellHook = ''
|
||||||
|
echo "Infrastructure Management Shell"
|
||||||
|
echo "Commands:"
|
||||||
|
echo " - cd infra/proxmox && tofu init"
|
||||||
|
echo " - tofu plan"
|
||||||
|
echo " - tofu apply"
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
});
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
inputs,
|
||||||
|
lib,
|
||||||
|
outputs,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
inputs.nix-colors.homeManagerModules.default
|
||||||
|
inputs.m3ta-nixpkgs.homeManagerModules.default
|
||||||
|
]; #imports = builtins.attrValues outputs.homeManagerModules;
|
||||||
|
nixpkgs = {
|
||||||
|
# You can add overlays here
|
||||||
|
overlays = [
|
||||||
|
# Add overlays your own flake exports (from overlays and pkgs dir):
|
||||||
|
#outputs.overlays.additions
|
||||||
|
#outputs.overlays.modifications
|
||||||
|
outputs.overlays.temp-packages
|
||||||
|
outputs.overlays.stable-packages
|
||||||
|
outputs.overlays.locked-packages
|
||||||
|
outputs.overlays.pinned-packages
|
||||||
|
outputs.overlays.master-packages
|
||||||
|
|
||||||
|
inputs.nur.overlays.default
|
||||||
|
inputs.m3ta-nixpkgs.overlays.default
|
||||||
|
inputs.m3ta-nixpkgs.overlays.modifications
|
||||||
|
|
||||||
|
# You can also add overlays exported from other flakes:
|
||||||
|
# neovim-nightly-overlay.overlays.default
|
||||||
|
|
||||||
|
# Or define it inline, for example:
|
||||||
|
# (final: prev: {
|
||||||
|
# hi = final.hello.overrideAttrs (oldAttrs: {
|
||||||
|
# patches = [ ./change-hello-to-hi.patch ];
|
||||||
|
# });
|
||||||
|
# })
|
||||||
|
];
|
||||||
|
# Configure your nixpkgs instance
|
||||||
|
config = {
|
||||||
|
# Disable if you don't want unfree packages
|
||||||
|
allowUnfree = true;
|
||||||
|
# Workaround for https://github.com/nix-community/home-manager/issues/2942
|
||||||
|
allowUnfreePredicate = _: true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
nix = {
|
||||||
|
package = lib.mkDefault pkgs.nix;
|
||||||
|
settings = {
|
||||||
|
experimental-features = ["nix-command" "flakes"];
|
||||||
|
warn-dirty = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
colorScheme = inputs.nix-colors.colorSchemes.dracula;
|
||||||
|
}
|
||||||
@@ -0,0 +1,65 @@
|
|||||||
|
# CLI FEATURES (home-manager)
|
||||||
|
|
||||||
|
**Shell and terminal tooling with Fish + Nushell dual configuration**
|
||||||
|
|
||||||
|
## OVERVIEW
|
||||||
|
8 CLI modules with integrated tooling across Fish and Nushell shells.
|
||||||
|
|
||||||
|
## STRUCTURE
|
||||||
|
```
|
||||||
|
cli/
|
||||||
|
├── default.nix # Imports + shared tools (bat, eza, direnv)
|
||||||
|
├── fish.nix # Fish shell + aliases
|
||||||
|
├── fzf.nix # Fuzzy finder
|
||||||
|
├── nitch.nix # System info tool
|
||||||
|
├── nushell.nix # Nushell + aliases
|
||||||
|
├── secrets.nix # Password-store integration
|
||||||
|
├── starship.nix # Shell prompt
|
||||||
|
└── zellij.nix # Terminal multiplexer
|
||||||
|
```
|
||||||
|
|
||||||
|
## WHERE TO LOOK
|
||||||
|
|
||||||
|
| Task | Location | Notes |
|
||||||
|
|------|----------|-------|
|
||||||
|
| Add CLI tool | default.nix home.packages | Check if shell integration needed |
|
||||||
|
| Shell aliases | fish.nix or nushell.nix | Kept in sync between shells |
|
||||||
|
| Prompt config | starship.nix | Uses nerd-fonts symbols |
|
||||||
|
| Secret access | secrets.nix | Agenix integration |
|
||||||
|
|
||||||
|
## CONVENTIONS
|
||||||
|
|
||||||
|
### Shell Integration Pattern
|
||||||
|
Tools with shell hooks enabled in both Fish and Nushell:
|
||||||
|
- **carapace**: Completions
|
||||||
|
- **zoxide**: Smart cd
|
||||||
|
- **eza**: ls replacement
|
||||||
|
- **direnv**: Directory environments
|
||||||
|
- **fzf**: Fuzzy finding
|
||||||
|
|
||||||
|
### NixOS Rebuild Aliases (both shells)
|
||||||
|
```
|
||||||
|
nr/nrs - nixos-rebuild [switch]
|
||||||
|
snr/snrs - sudo nixos-rebuild [switch]
|
||||||
|
hms - home-manager switch
|
||||||
|
```
|
||||||
|
|
||||||
|
### Bat Theme
|
||||||
|
Custom `universal` theme generated from nix-colors palette in default.nix (lines 34-157).
|
||||||
|
|
||||||
|
### Secrets Integration
|
||||||
|
Fish/Nushell source `$HOME/.secrets` if `secrets.enable = true` (CLI secrets feature).
|
||||||
|
|
||||||
|
## ANTI-PATTERNS
|
||||||
|
|
||||||
|
- **DON'T** add aliases to only one shell - keep Fish/Nushell in sync
|
||||||
|
- **DON'T** use `programs.bash` - Nushell is default shell
|
||||||
|
- **DON'T** bypass carapace for completions - integrated by default
|
||||||
|
|
||||||
|
## NOTES
|
||||||
|
|
||||||
|
- zellij-ps custom package for project session management
|
||||||
|
- Default shell set to Nushell in hosts/common/default.nix
|
||||||
|
- Bat theme dynamically generated (no external theme files)
|
||||||
|
- lf file manager uses bat for previews
|
||||||
|
- Agenix CLI (agenix-cli) included for secret management
|
||||||
@@ -0,0 +1,237 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
videoDrivers,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
./fish.nix
|
||||||
|
./fzf.nix
|
||||||
|
./nitch.nix
|
||||||
|
./nushell.nix
|
||||||
|
./secrets.nix
|
||||||
|
./starship.nix
|
||||||
|
./zellij.nix
|
||||||
|
];
|
||||||
|
cli.stt-ptt = {
|
||||||
|
enable = true;
|
||||||
|
whisperPackage =
|
||||||
|
if videoDrivers == ["nvidia"]
|
||||||
|
then pkgs.whisper-cpp.override {cudaSupport = true;}
|
||||||
|
else if videoDrivers == ["amdgpu"]
|
||||||
|
then pkgs.whisper-cpp-vulkan
|
||||||
|
else pkgs.whisper-cpp;
|
||||||
|
model = "ggml-large-v3-turbo";
|
||||||
|
notifyTimeout = 2000;
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.carapace = {
|
||||||
|
enable = true;
|
||||||
|
enableFishIntegration = true;
|
||||||
|
enableNushellIntegration = true;
|
||||||
|
enableBashIntegration = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.zoxide = {
|
||||||
|
enable = true;
|
||||||
|
enableFishIntegration = true;
|
||||||
|
enableNushellIntegration = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.bat = {
|
||||||
|
enable = true;
|
||||||
|
config = {theme = "universal";};
|
||||||
|
themes = {
|
||||||
|
universal = {
|
||||||
|
src = pkgs.writeText "universal.tmTheme" ''
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||||
|
<plist version="1.0">
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Universal (nix-colors)</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<array>
|
||||||
|
<dict>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>background</key>
|
||||||
|
<string>#${config.colorScheme.palette.base00}</string>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base05}</string>
|
||||||
|
<key>caret</key>
|
||||||
|
<string>#${config.colorScheme.palette.base05}</string>
|
||||||
|
<key>selection</key>
|
||||||
|
<string>#${config.colorScheme.palette.base02}</string>
|
||||||
|
<key>selectionForeground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base05}</string>
|
||||||
|
<key>lineHighlight</key>
|
||||||
|
<string>#${config.colorScheme.palette.base01}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Comment</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>comment</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base03}</string>
|
||||||
|
<key>fontStyle</key>
|
||||||
|
<string>italic</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>String</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>string</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base0A}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Number</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>constant.numeric</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base0E}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Keyword</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>keyword</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base08}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Function</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>entity.name.function</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base0B}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Type</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>entity.name.type, storage.type</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base0D}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Variable</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>variable</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base05}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
<dict>
|
||||||
|
<key>name</key>
|
||||||
|
<string>Constant</string>
|
||||||
|
<key>scope</key>
|
||||||
|
<string>constant</string>
|
||||||
|
<key>settings</key>
|
||||||
|
<dict>
|
||||||
|
<key>foreground</key>
|
||||||
|
<string>#${config.colorScheme.palette.base0E}</string>
|
||||||
|
</dict>
|
||||||
|
</dict>
|
||||||
|
</array>
|
||||||
|
</dict>
|
||||||
|
</plist>
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.direnv = {
|
||||||
|
enable = true;
|
||||||
|
enableNushellIntegration = true;
|
||||||
|
nix-direnv.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.eza = {
|
||||||
|
enable = true;
|
||||||
|
enableFishIntegration = true;
|
||||||
|
enableBashIntegration = true;
|
||||||
|
extraOptions = ["-l" "--icons" "--git" "-a"];
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.lf = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
preview = true;
|
||||||
|
drawbox = true;
|
||||||
|
hidden = true;
|
||||||
|
icons = true;
|
||||||
|
theme = "Dracula";
|
||||||
|
previewer = "bat";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
cli.zellij-ps = {
|
||||||
|
enable = true;
|
||||||
|
projectFolders = ["/home/m3tam3re/p"];
|
||||||
|
};
|
||||||
|
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
comma
|
||||||
|
coreutils
|
||||||
|
devenv
|
||||||
|
fabric-ai
|
||||||
|
fd
|
||||||
|
gcc
|
||||||
|
go
|
||||||
|
htop
|
||||||
|
httpie
|
||||||
|
hyprpaper-random
|
||||||
|
jq
|
||||||
|
just
|
||||||
|
lazygit
|
||||||
|
llm
|
||||||
|
lf
|
||||||
|
nix-index
|
||||||
|
nix-update
|
||||||
|
libnotify
|
||||||
|
nushellPlugins.skim
|
||||||
|
progress
|
||||||
|
ripgrep
|
||||||
|
rocmPackages.rocm-smi
|
||||||
|
rocmPackages.rocminfo
|
||||||
|
rocmPackages.rocm-runtime
|
||||||
|
tldr
|
||||||
|
pomodoro-timer
|
||||||
|
trash-cli
|
||||||
|
unimatrix
|
||||||
|
unzip
|
||||||
|
vulkan-tools
|
||||||
|
wttrbar
|
||||||
|
wireguard-tools
|
||||||
|
yazi
|
||||||
|
zellij-ps
|
||||||
|
zip
|
||||||
|
];
|
||||||
|
}
|
||||||
@@ -0,0 +1,116 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.fish;
|
||||||
|
in {
|
||||||
|
options.features.cli.fish.enable = mkEnableOption "enable fish shell";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.fish = {
|
||||||
|
enable = true;
|
||||||
|
interactiveShellInit = ''
|
||||||
|
# Fish colors using universal nix-colors palette
|
||||||
|
# Text colors
|
||||||
|
set -g fish_color_normal ${config.colorScheme.palette.base05} # text
|
||||||
|
set -g fish_color_param ${config.colorScheme.palette.base05} # text
|
||||||
|
set -g fish_color_comment ${config.colorScheme.palette.base03} # muted
|
||||||
|
set -g fish_color_autosuggestion ${config.colorScheme.palette.base03} # muted
|
||||||
|
|
||||||
|
# Command colors
|
||||||
|
set -g fish_color_command ${config.colorScheme.palette.base0D} # accent6 (blue)
|
||||||
|
set -g fish_color_quote ${config.colorScheme.palette.base0A} # accent3 (yellow)
|
||||||
|
set -g fish_color_redirection ${config.colorScheme.palette.base0E} # accent7 (purple)
|
||||||
|
set -g fish_color_end ${config.colorScheme.palette.base08} # accent1 (red)
|
||||||
|
set -g fish_color_error ${config.colorScheme.palette.base08} # accent1 (red)
|
||||||
|
set -g fish_color_operator ${config.colorScheme.palette.base0C} # accent5 (cyan)
|
||||||
|
set -g fish_color_escape ${config.colorScheme.palette.base09} # accent2 (orange)
|
||||||
|
|
||||||
|
# Path colors
|
||||||
|
set -g fish_color_cwd ${config.colorScheme.palette.base0B} # accent4 (green)
|
||||||
|
set -g fish_color_cwd_root ${config.colorScheme.palette.base08} # accent1 (red)
|
||||||
|
set -g fish_color_valid_path --underline
|
||||||
|
|
||||||
|
# Interactive colors
|
||||||
|
set -g fish_color_match ${config.colorScheme.palette.base0B} # accent4 (green)
|
||||||
|
set -g fish_color_selection --background=${config.colorScheme.palette.base02} # overlay
|
||||||
|
set -g fish_color_search_match --background=${config.colorScheme.palette.base02} # overlay
|
||||||
|
set -g fish_color_history_current --bold
|
||||||
|
set -g fish_color_user ${config.colorScheme.palette.base0B} # accent4 (green)
|
||||||
|
set -g fish_color_host ${config.colorScheme.palette.base0D} # accent6 (blue)
|
||||||
|
set -g fish_color_cancel -r
|
||||||
|
|
||||||
|
# Pager colors
|
||||||
|
set -g fish_pager_color_completion normal
|
||||||
|
set -g fish_pager_color_description ${config.colorScheme.palette.base03} # muted
|
||||||
|
set -g fish_pager_color_prefix ${config.colorScheme.palette.base0E} # accent7 (purple)
|
||||||
|
set -g fish_pager_color_progress ${config.colorScheme.palette.base0B} # accent4 (green)
|
||||||
|
'';
|
||||||
|
loginShellInit = ''
|
||||||
|
set -x NIX_PATH nixpkgs=channel:nixos-unstable
|
||||||
|
set -x NIX_LOG info
|
||||||
|
set -x WEBKIT_DISABLE_COMPOSITING_MODE 1
|
||||||
|
set -x TERMINAL kitty
|
||||||
|
set -x EDITOR nvim
|
||||||
|
set -x VISUAL zed
|
||||||
|
set -x XDG_DATA_HOME $HOME/.local/share
|
||||||
|
set -x FZF_CTRL_R_OPTS "
|
||||||
|
--preview='bat --color=always -n {}'
|
||||||
|
--preview-window up:3:hidden:wrap
|
||||||
|
--bind 'ctrl-/:toggle-preview'
|
||||||
|
--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'
|
||||||
|
--color header:bold
|
||||||
|
--header 'Press CTRL-Y to copy command into clipboard'"
|
||||||
|
set -x FZF_DEFAULT_COMMAND fd --type f --exclude .git --follow --hidden
|
||||||
|
set -x FZF_CTRL_T_COMMAND "$FZF_DEFAULT_COMMAND"
|
||||||
|
set -x FLAKE $HOME/p/nixos/nixos-config
|
||||||
|
source /run/agenix/${config.home.username}-secrets
|
||||||
|
|
||||||
|
if test (tty) = "/dev/tty1"
|
||||||
|
exec uwsm start -F /run/current-system/sw/bin/Hyprland
|
||||||
|
end
|
||||||
|
if test (tty) = "/dev/tty2"
|
||||||
|
exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
|
||||||
|
end
|
||||||
|
'';
|
||||||
|
shellAbbrs = {
|
||||||
|
".." = "cd ..";
|
||||||
|
"..." = "cd ../..";
|
||||||
|
b = "yazi";
|
||||||
|
ls = "eza";
|
||||||
|
l = "eza -l --icons --git -a";
|
||||||
|
lt = "eza --tree --level=2 --long --icons --git";
|
||||||
|
grep = "rg";
|
||||||
|
ps = "procs";
|
||||||
|
just = "just --unstable";
|
||||||
|
node = "bun";
|
||||||
|
npx = "bunx";
|
||||||
|
fs = "du -ah . | sort -hr | head -n 10";
|
||||||
|
|
||||||
|
n = "nix";
|
||||||
|
nd = "nix develop -c $SHELL";
|
||||||
|
ns = "nix shell";
|
||||||
|
nsn = "nix shell nixpkgs#";
|
||||||
|
nb = "nix build";
|
||||||
|
nbn = "nix build nixpkgs#";
|
||||||
|
nf = "nix flake";
|
||||||
|
|
||||||
|
nr = "sudo nixos-rebuild --flake .";
|
||||||
|
nrs = "sudo nixos-rebuild switch --flake .#(uname -n)";
|
||||||
|
snr = "sudo nixos-rebuild --flake .";
|
||||||
|
snrs = "sudo nixos-rebuild --flake . switch";
|
||||||
|
hm = "home-manager --flake .";
|
||||||
|
hms = "home-manager --flake . switch";
|
||||||
|
hmr = "cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch";
|
||||||
|
|
||||||
|
tsu = "sudo tailscale up";
|
||||||
|
tsd = "sudo tailscale down";
|
||||||
|
|
||||||
|
vi = "nvim";
|
||||||
|
vim = "nvim";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.fzf;
|
||||||
|
in {
|
||||||
|
options.features.cli.fzf.enable = mkEnableOption "enable fuzzy finder";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.fzf = {
|
||||||
|
enable = true;
|
||||||
|
enableFishIntegration = true;
|
||||||
|
colors = {
|
||||||
|
"fg" = "#${config.colorScheme.palette.base05}";
|
||||||
|
"bg" = "#${config.colorScheme.palette.base00}";
|
||||||
|
"hl" = "#${config.colorScheme.palette.base0E}";
|
||||||
|
"fg+" = "#${config.colorScheme.palette.base05}";
|
||||||
|
"bg+" = "#${config.colorScheme.palette.base02}";
|
||||||
|
"hl+" = "#${config.colorScheme.palette.base0E}";
|
||||||
|
"info" = "#${config.colorScheme.palette.base09}";
|
||||||
|
"prompt" = "#${config.colorScheme.palette.base0B}";
|
||||||
|
"pointer" = "#${config.colorScheme.palette.base08}";
|
||||||
|
"marker" = "#${config.colorScheme.palette.base08}";
|
||||||
|
"spinner" = "#${config.colorScheme.palette.base09}";
|
||||||
|
"header" = "#${config.colorScheme.palette.base03}";
|
||||||
|
};
|
||||||
|
defaultOptions = [
|
||||||
|
"--preview='bat --color=always -n {}'"
|
||||||
|
"--bind 'ctrl-/:toggle-preview'"
|
||||||
|
"--header 'Press CTRL-Y to copy command into clipboard'"
|
||||||
|
"--bind 'ctrl-/:toggle-preview'"
|
||||||
|
"--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'"
|
||||||
|
];
|
||||||
|
defaultCommand = "fd --type f --exclude .git --follow --hidden";
|
||||||
|
changeDirWidgetCommand = "fd --type d --exclude .git --follow --hidden";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.nitch;
|
||||||
|
in {
|
||||||
|
options.features.cli.nitch.enable = mkEnableOption "enable nitch";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [nitch];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,181 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.nushell;
|
||||||
|
in {
|
||||||
|
options.features.cli.nushell.enable = mkEnableOption "enable nushell";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.nushell = {
|
||||||
|
enable = true;
|
||||||
|
envFile.text = ''
|
||||||
|
$env.config.show_banner = false
|
||||||
|
$env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
|
||||||
|
$env.NIX_LOG = "iunfo"
|
||||||
|
$env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
|
||||||
|
$env.TERMINAL = "kitty"
|
||||||
|
$env.EDITOR = "nvim"
|
||||||
|
$env.VISUAL = "zed"
|
||||||
|
$env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
|
||||||
|
$env.FZF_DEFAULT_OPTS = "--preview='bat --color=always --style=numbers --line-range=:500 {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy to clipboard' --bind 'ctrl-y:execute-silent(echo {} | wl-copy)' --color bg:#${config.colorScheme.palette.base00},bg+:#${config.colorScheme.palette.base02},fg:#${config.colorScheme.palette.base05},fg+:#${config.colorScheme.palette.base05},header:#${config.colorScheme.palette.base03},hl:#${config.colorScheme.palette.base0E},hl+:#${config.colorScheme.palette.base0E},info:#${config.colorScheme.palette.base09},marker:#${config.colorScheme.palette.base08},pointer:#${config.colorScheme.palette.base08},prompt:#${config.colorScheme.palette.base0B},spinner:#${config.colorScheme.palette.base09}"
|
||||||
|
$env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
|
||||||
|
$env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
|
||||||
|
$env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
|
||||||
|
$env.FLAKE = $"($env.HOME)/p/nixos/nixos-config"
|
||||||
|
$env.PATH = ($env.PATH | split row (char esep) | append "/home/m3tam3re/.cache/.bun/bin" | uniq)
|
||||||
|
source /run/agenix/${config.home.username}-secrets
|
||||||
|
'';
|
||||||
|
configFile.text = ''
|
||||||
|
# FZF integration functions for nushell
|
||||||
|
def fzf-file [] {
|
||||||
|
fd --type f --exclude .git --follow --hidden | fzf --preview 'bat --color=always --style=numbers --line-range=:500 {}' --bind 'ctrl-y:execute-silent(echo {} | wl-copy)'
|
||||||
|
}
|
||||||
|
|
||||||
|
def fzf-dir [] {
|
||||||
|
fd --type d --exclude .git --follow --hidden | fzf --preview 'ls -la {}'
|
||||||
|
}
|
||||||
|
|
||||||
|
def fzf-history [] {
|
||||||
|
history | get command | reverse | fzf --bind 'ctrl-y:execute-silent(echo {} | wl-copy)'
|
||||||
|
}
|
||||||
|
|
||||||
|
# Key bindings for FZF
|
||||||
|
$env.config = {
|
||||||
|
keybindings: [
|
||||||
|
{
|
||||||
|
name: fzf_file
|
||||||
|
modifier: control
|
||||||
|
keycode: char_t
|
||||||
|
mode: [emacs, vi_normal, vi_insert]
|
||||||
|
event: {
|
||||||
|
send: executehostcommand
|
||||||
|
cmd: "commandline edit --insert (fzf-file)"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name: fzf_history
|
||||||
|
modifier: control
|
||||||
|
keycode: char_r
|
||||||
|
mode: [emacs, vi_normal, vi_insert]
|
||||||
|
event: {
|
||||||
|
send: executehostcommand
|
||||||
|
cmd: "commandline edit --replace (fzf-history)"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
alias .. = cd ..
|
||||||
|
alias ... = cd ...
|
||||||
|
alias h = cd $env.HOME
|
||||||
|
alias b = yazi
|
||||||
|
alias lt = eza --tree --level=2 --long --icons --git
|
||||||
|
alias grep = rg
|
||||||
|
alias just = just --unstable
|
||||||
|
alias node = bun
|
||||||
|
alias npx = bunx
|
||||||
|
|
||||||
|
alias n = nix
|
||||||
|
alias nd = nix develop -c $nu.current-shell
|
||||||
|
alias ns = nix shell
|
||||||
|
alias nsn = nix shell nixpkgs#
|
||||||
|
alias nb = nix build
|
||||||
|
alias nbn = nix build nixpkgs#
|
||||||
|
alias nf = nix flake
|
||||||
|
|
||||||
|
alias nr = sudo nixos-rebuild --flake .
|
||||||
|
alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
|
||||||
|
alias snr = sudo nixos-rebuild --flake .
|
||||||
|
alias snrs = sudo nixos-rebuild --flake . switch
|
||||||
|
alias hm = home-manager --flake .
|
||||||
|
alias hms = home-manager --flake . switch
|
||||||
|
alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
|
||||||
|
|
||||||
|
alias tsu = sudo tailscale up
|
||||||
|
alias tsd = sudo tailscale down
|
||||||
|
|
||||||
|
alias vi = nvim
|
||||||
|
alias vim = nvim
|
||||||
|
|
||||||
|
def history_fuzzy [] {
|
||||||
|
let selected = (
|
||||||
|
history
|
||||||
|
| reverse
|
||||||
|
| get command
|
||||||
|
| uniq
|
||||||
|
| to text
|
||||||
|
| ^fzf
|
||||||
|
)
|
||||||
|
if ($selected | is-not-empty) {
|
||||||
|
commandline edit ($selected)
|
||||||
|
} else {
|
||||||
|
null
|
||||||
|
}
|
||||||
|
}
|
||||||
|
def --env dir_fuzzy [] {
|
||||||
|
let selected = (
|
||||||
|
fd --type directory
|
||||||
|
| ^fzf
|
||||||
|
)
|
||||||
|
cd $selected
|
||||||
|
}
|
||||||
|
def find_fuzzy [] {
|
||||||
|
# Find non-hidden text files with matches for any content and select one via fuzzy search
|
||||||
|
let selected = (
|
||||||
|
^fd --type file --no-hidden -X rg -l --files-with-matches .
|
||||||
|
| lines
|
||||||
|
| to text
|
||||||
|
| ^fzf
|
||||||
|
)
|
||||||
|
if ($selected | is-not-empty) {
|
||||||
|
^$env.EDITOR $selected
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$env.config = {
|
||||||
|
keybindings: [
|
||||||
|
{
|
||||||
|
name: history_fuzzy
|
||||||
|
modifier: control
|
||||||
|
keycode: char_r
|
||||||
|
mode: [emacs, vi_insert, vi_normal]
|
||||||
|
event: [
|
||||||
|
{
|
||||||
|
send: executehostcommand
|
||||||
|
cmd: "history_fuzzy"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name: dir_fuzzy
|
||||||
|
modifier: alt
|
||||||
|
keycode: char_c
|
||||||
|
mode: [emacs, vi_insert, vi_normal]
|
||||||
|
event: [
|
||||||
|
{
|
||||||
|
send: executehostcommand
|
||||||
|
cmd: "dir_fuzzy"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name: history_fuzzy
|
||||||
|
modifier: control
|
||||||
|
keycode: char_t
|
||||||
|
mode: [emacs, vi_insert, vi_normal]
|
||||||
|
event: [
|
||||||
|
{
|
||||||
|
send: executehostcommand
|
||||||
|
cmd: "find_fuzzy"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.secrets;
|
||||||
|
in {
|
||||||
|
options.features.cli.secrets.enable = mkEnableOption "enable secrets";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.password-store = {
|
||||||
|
enable = true;
|
||||||
|
package =
|
||||||
|
pkgs.pass-wayland.withExtensions
|
||||||
|
(exts: [exts.pass-otp exts.pass-import]);
|
||||||
|
};
|
||||||
|
home.packages = with pkgs; [pinentry-gnome3];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,68 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.starship;
|
||||||
|
in {
|
||||||
|
options.features.cli.starship.enable = mkEnableOption "enable starship prompt";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.starship = {
|
||||||
|
enable = true;
|
||||||
|
enableFishIntegration = true;
|
||||||
|
enableNushellIntegration = true;
|
||||||
|
settings = {
|
||||||
|
format = "$all$character";
|
||||||
|
palette = "universal";
|
||||||
|
|
||||||
|
palettes.universal = {
|
||||||
|
background = "#${config.colorScheme.palette.base00}";
|
||||||
|
surface = "#${config.colorScheme.palette.base01}";
|
||||||
|
muted = "#${config.colorScheme.palette.base03}";
|
||||||
|
text = "#${config.colorScheme.palette.base05}";
|
||||||
|
bright = "#${config.colorScheme.palette.base07}";
|
||||||
|
accent1 = "#${config.colorScheme.palette.base08}";
|
||||||
|
accent2 = "#${config.colorScheme.palette.base09}";
|
||||||
|
accent3 = "#${config.colorScheme.palette.base0A}";
|
||||||
|
accent4 = "#${config.colorScheme.palette.base0B}";
|
||||||
|
accent5 = "#${config.colorScheme.palette.base0C}";
|
||||||
|
accent6 = "#${config.colorScheme.palette.base0D}";
|
||||||
|
accent7 = "#${config.colorScheme.palette.base0E}";
|
||||||
|
};
|
||||||
|
|
||||||
|
character = {
|
||||||
|
success_symbol = "[❯](accent7)";
|
||||||
|
error_symbol = "[❯](accent1)";
|
||||||
|
};
|
||||||
|
|
||||||
|
directory = {
|
||||||
|
style = "accent6";
|
||||||
|
truncation_length = 3;
|
||||||
|
truncate_to_repo = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
git_branch = {
|
||||||
|
style = "accent7";
|
||||||
|
};
|
||||||
|
|
||||||
|
git_status = {
|
||||||
|
style = "accent5";
|
||||||
|
};
|
||||||
|
|
||||||
|
cmd_duration = {
|
||||||
|
style = "accent3";
|
||||||
|
};
|
||||||
|
|
||||||
|
hostname = {
|
||||||
|
style = "accent4";
|
||||||
|
};
|
||||||
|
|
||||||
|
username = {
|
||||||
|
style_user = "accent2";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.cli.zellij;
|
||||||
|
in {
|
||||||
|
options.features.cli.zellij.enable = mkEnableOption "enable tmux";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.zellij = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
theme = "universal";
|
||||||
|
themes.universal = {
|
||||||
|
bg = "#${config.colorScheme.palette.base00}";
|
||||||
|
fg = "#${config.colorScheme.palette.base05}";
|
||||||
|
black = "#${config.colorScheme.palette.base01}";
|
||||||
|
red = "#${config.colorScheme.palette.base08}";
|
||||||
|
green = "#${config.colorScheme.palette.base0B}";
|
||||||
|
yellow = "#${config.colorScheme.palette.base0A}";
|
||||||
|
blue = "#${config.colorScheme.palette.base0D}";
|
||||||
|
magenta = "#${config.colorScheme.palette.base0E}";
|
||||||
|
cyan = "#${config.colorScheme.palette.base0C}";
|
||||||
|
white = "#${config.colorScheme.palette.base07}";
|
||||||
|
orange = "#${config.colorScheme.palette.base09}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
{pkgs, ...}: {
|
||||||
|
imports = [
|
||||||
|
./opencode.nix
|
||||||
|
];
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
agenix-cli
|
||||||
|
alejandra
|
||||||
|
beads
|
||||||
|
bc
|
||||||
|
bun
|
||||||
|
claude-code
|
||||||
|
devpod
|
||||||
|
#devpod-desktop
|
||||||
|
code2prompt
|
||||||
|
nur.repos.charmbracelet.crush
|
||||||
|
(python3.withPackages (ps:
|
||||||
|
with ps; [
|
||||||
|
pip
|
||||||
|
uv
|
||||||
|
# Scientific packages
|
||||||
|
numba
|
||||||
|
numpy
|
||||||
|
torch
|
||||||
|
srt
|
||||||
|
]))
|
||||||
|
pyrefly
|
||||||
|
nixd
|
||||||
|
alejandra
|
||||||
|
tailwindcss
|
||||||
|
tailwindcss-language-server
|
||||||
|
];
|
||||||
|
}
|
||||||
@@ -0,0 +1,319 @@
|
|||||||
|
{ inputs, ... }: {
|
||||||
|
imports =
|
||||||
|
[ "${inputs.m3ta-nixpkgs}/modules/home-manager/coding/basecamp-mcp.nix" ];
|
||||||
|
|
||||||
|
xdg.configFile = {
|
||||||
|
"opencode/command" = {
|
||||||
|
source = "${inputs.agents}/command";
|
||||||
|
recursive = true;
|
||||||
|
};
|
||||||
|
"opencode/context" = {
|
||||||
|
source = "${inputs.agents}/context";
|
||||||
|
recursive = true;
|
||||||
|
};
|
||||||
|
"opencode/prompts" = {
|
||||||
|
source = "${inputs.agents}/prompts";
|
||||||
|
recursive = true;
|
||||||
|
};
|
||||||
|
"opencode/skill" = {
|
||||||
|
source = "${inputs.agents}/skill";
|
||||||
|
recursive = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
m3ta.coding.opencode.mcp.basecamp = {
|
||||||
|
enable = true;
|
||||||
|
envFile = "/run/agenix/basecamp-env";
|
||||||
|
};
|
||||||
|
programs.opencode = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
theme = "opencode";
|
||||||
|
plugin =
|
||||||
|
[ "oh-my-opencode" "opencode-beads" "opencode-antigravity-auth@beta" ];
|
||||||
|
agent = builtins.fromJSON
|
||||||
|
(builtins.readFile "${inputs.agents}/agent/agents.json");
|
||||||
|
formatter = {
|
||||||
|
alejandra = {
|
||||||
|
command = [ "alejandra" "-q" "-" ];
|
||||||
|
extensions = [ ".nix" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
mcp = {
|
||||||
|
Ref = {
|
||||||
|
type = "local";
|
||||||
|
command = [
|
||||||
|
"sh"
|
||||||
|
"-c"
|
||||||
|
"REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"
|
||||||
|
];
|
||||||
|
enabled = true;
|
||||||
|
};
|
||||||
|
Anytype = {
|
||||||
|
type = "local";
|
||||||
|
command = [
|
||||||
|
"sh"
|
||||||
|
"-c"
|
||||||
|
"OPENAPI_MCP_HEADERS=$(cat /run/agenix/anytype-key) exec bunx @anyproto/anytype-mcp"
|
||||||
|
];
|
||||||
|
enabled = false;
|
||||||
|
};
|
||||||
|
Exa = {
|
||||||
|
type = "local";
|
||||||
|
command = [
|
||||||
|
"sh"
|
||||||
|
"-c"
|
||||||
|
"EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"
|
||||||
|
];
|
||||||
|
enabled = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
provider = {
|
||||||
|
google = {
|
||||||
|
models = {
|
||||||
|
"antigravity-gemini-3-pro" = {
|
||||||
|
name = "Gemini 3 Pro (Antigravity)";
|
||||||
|
limit = {
|
||||||
|
context = 1048576;
|
||||||
|
output = 65535;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
variants = {
|
||||||
|
low = { thinkingLevel = "low"; };
|
||||||
|
high = { thinkingLevel = "high"; };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"antigravity-gemini-3-flash" = {
|
||||||
|
name = "Gemini 3 Flash (Antigravity)";
|
||||||
|
limit = {
|
||||||
|
context = 1048576;
|
||||||
|
output = 65536;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
variants = {
|
||||||
|
minimal = { thinkingLevel = "minimal"; };
|
||||||
|
low = { thinkingLevel = "low"; };
|
||||||
|
medium = { thinkingLevel = "medium"; };
|
||||||
|
high = { thinkingLevel = "high"; };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"antigravity-claude-sonnet-4-5" = {
|
||||||
|
name = "Claude Sonnet 4.5 (no thinking) (Antigravity)";
|
||||||
|
limit = {
|
||||||
|
context = 200000;
|
||||||
|
output = 64000;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"antigravity-claude-sonnet-4-5-thinking" = {
|
||||||
|
name = "Claude Sonnet 4.5 Thinking (Antigravity)";
|
||||||
|
limit = {
|
||||||
|
context = 200000;
|
||||||
|
output = 64000;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
variants = {
|
||||||
|
low = { thinkingConfig = { thinkingBudget = 8192; }; };
|
||||||
|
max = { thinkingConfig = { thinkingBudget = 32768; }; };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"antigravity-claude-opus-4-5-thinking" = {
|
||||||
|
name = "Claude Opus 4.5 Thinking (Antigravity)";
|
||||||
|
limit = {
|
||||||
|
context = 200000;
|
||||||
|
output = 64000;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
variants = {
|
||||||
|
low = { thinkingConfig = { thinkingBudget = 8192; }; };
|
||||||
|
max = { thinkingConfig = { thinkingBudget = 32768; }; };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"gemini-2.5-flash" = {
|
||||||
|
name = "Gemini 2.5 Flash (Gemini CLI)";
|
||||||
|
limit = {
|
||||||
|
context = 1048576;
|
||||||
|
output = 65536;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"gemini-2.5-pro" = {
|
||||||
|
name = "Gemini 2.5 Pro (Gemini CLI)";
|
||||||
|
limit = {
|
||||||
|
context = 1048576;
|
||||||
|
output = 65536;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"gemini-3-flash-preview" = {
|
||||||
|
name = "Gemini 3 Flash Preview (Gemini CLI)";
|
||||||
|
limit = {
|
||||||
|
context = 1048576;
|
||||||
|
output = 65536;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"gemini-3-pro-preview" = {
|
||||||
|
name = "Gemini 3 Pro Preview (Gemini CLI)";
|
||||||
|
limit = {
|
||||||
|
context = 1048576;
|
||||||
|
output = 65535;
|
||||||
|
};
|
||||||
|
modalities = {
|
||||||
|
input = [ "text" "image" "pdf" ];
|
||||||
|
output = [ "text" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON {
|
||||||
|
"$schema" =
|
||||||
|
"https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";
|
||||||
|
agents = {
|
||||||
|
Sisyphus = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "allow";
|
||||||
|
bash = {
|
||||||
|
"*" = "allow";
|
||||||
|
"rm *" = "ask";
|
||||||
|
"rmdir *" = "ask";
|
||||||
|
"mv *" = "ask";
|
||||||
|
"chmod *" = "ask";
|
||||||
|
"chown *" = "ask";
|
||||||
|
"git *" = "ask";
|
||||||
|
"git status*" = "allow";
|
||||||
|
"git log*" = "allow";
|
||||||
|
"git diff*" = "allow";
|
||||||
|
"git branch*" = "allow";
|
||||||
|
"git show*" = "allow";
|
||||||
|
"git stash list*" = "allow";
|
||||||
|
"git remote -v" = "allow";
|
||||||
|
"git add *" = "allow";
|
||||||
|
"git commit *" = "allow";
|
||||||
|
"jj *" = "ask";
|
||||||
|
"jj status" = "allow";
|
||||||
|
"jj log*" = "allow";
|
||||||
|
"jj diff*" = "allow";
|
||||||
|
"jj show*" = "allow";
|
||||||
|
"npm *" = "ask";
|
||||||
|
"npx *" = "ask";
|
||||||
|
"bun *" = "ask";
|
||||||
|
"bunx *" = "ask";
|
||||||
|
"uv *" = "ask";
|
||||||
|
"pip *" = "ask";
|
||||||
|
"pip3 *" = "ask";
|
||||||
|
"yarn *" = "ask";
|
||||||
|
"pnpm *" = "ask";
|
||||||
|
"cargo *" = "ask";
|
||||||
|
"go *" = "ask";
|
||||||
|
"make *" = "ask";
|
||||||
|
"dd *" = "deny";
|
||||||
|
"mkfs*" = "deny";
|
||||||
|
"fdisk *" = "deny";
|
||||||
|
"parted *" = "deny";
|
||||||
|
"eval *" = "deny";
|
||||||
|
"source *" = "deny";
|
||||||
|
"curl *|*sh" = "deny";
|
||||||
|
"wget *|*sh" = "deny";
|
||||||
|
"sudo *" = "deny";
|
||||||
|
"su *" = "deny";
|
||||||
|
"systemctl *" = "deny";
|
||||||
|
"service *" = "deny";
|
||||||
|
"shutdown *" = "deny";
|
||||||
|
"reboot*" = "deny";
|
||||||
|
"init *" = "deny";
|
||||||
|
"> /dev/*" = "deny";
|
||||||
|
"cat * > /dev/*" = "deny";
|
||||||
|
};
|
||||||
|
external_directory = "ask";
|
||||||
|
doom_loop = "ask";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
librarian = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "deny";
|
||||||
|
bash = "deny";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
explore = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "deny";
|
||||||
|
bash = "deny";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
oracle = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "deny";
|
||||||
|
bash = "deny";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
frontend-ui-ux-engineer = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "allow";
|
||||||
|
bash = {
|
||||||
|
"*" = "ask";
|
||||||
|
"npm *" = "ask";
|
||||||
|
"npx *" = "ask";
|
||||||
|
"bun *" = "ask";
|
||||||
|
"bunx *" = "ask";
|
||||||
|
"rm *" = "ask";
|
||||||
|
"mv *" = "ask";
|
||||||
|
"dd *" = "deny";
|
||||||
|
"mkfs*" = "deny";
|
||||||
|
"sudo *" = "deny";
|
||||||
|
"curl *|*sh" = "deny";
|
||||||
|
"wget *|*sh" = "deny";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
document-writer = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "allow";
|
||||||
|
bash = "deny";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
multimodal-looker = {
|
||||||
|
model = "opencode/glm-4.7-free";
|
||||||
|
permission = {
|
||||||
|
edit = "deny";
|
||||||
|
bash = "deny";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
disabled_mcps = [ "context7" "websearch" ];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,79 @@
|
|||||||
|
# DESKTOP FEATURES (home-manager)
|
||||||
|
|
||||||
|
**Wayland/Hyprland environment with color-coordinated tooling**
|
||||||
|
|
||||||
|
## OVERVIEW
|
||||||
|
12 modular desktop features with nix-colors (Dracula) integration across all components.
|
||||||
|
|
||||||
|
## STRUCTURE
|
||||||
|
```
|
||||||
|
desktop/
|
||||||
|
├── default.nix # Imports + XDG + Kitty config
|
||||||
|
├── coding.nix # Development tools (VSCode, etc.)
|
||||||
|
├── crypto.nix # Crypto wallets/tools
|
||||||
|
├── fonts.nix # Font packages
|
||||||
|
├── gaming.nix # Gaming tools/Steam
|
||||||
|
├── hyprland.nix # Hyprland WM configuration
|
||||||
|
├── media.nix # Media players/editors
|
||||||
|
├── office.nix # LibreOffice, document tools
|
||||||
|
├── rofi.nix # Application launcher
|
||||||
|
├── theme.nix # GTK/Qt theming
|
||||||
|
├── wayland.nix # Wayland utilities
|
||||||
|
└── webapps.nix # Browser-based apps
|
||||||
|
```
|
||||||
|
|
||||||
|
## WHERE TO LOOK
|
||||||
|
|
||||||
|
| Task | Location | Notes |
|
||||||
|
|------|----------|-------|
|
||||||
|
| Add desktop app | Relevant feature .nix | Update home.packages |
|
||||||
|
| Configure Hyprland | hyprland.nix | Window manager settings |
|
||||||
|
| Fix colors | Check colorScheme references | Uses config.colorScheme.palette.base* |
|
||||||
|
| Add font | fonts.nix | Increases system closure size |
|
||||||
|
|
||||||
|
## CONVENTIONS
|
||||||
|
|
||||||
|
### Color Scheme Integration
|
||||||
|
All color-aware tools reference `config.colorScheme.palette.base00` through `base0F`:
|
||||||
|
- **base00-07**: Grayscale (dark to light)
|
||||||
|
- **base08**: Red/errors
|
||||||
|
- **base09**: Orange
|
||||||
|
- **base0A**: Yellow/strings
|
||||||
|
- **base0B**: Green/functions
|
||||||
|
- **base0C**: Cyan
|
||||||
|
- **base0D**: Blue/types
|
||||||
|
- **base0E**: Purple/constants
|
||||||
|
- **base0F**: Brown
|
||||||
|
|
||||||
|
Template:
|
||||||
|
```nix
|
||||||
|
foreground = "#${config.colorScheme.palette.base05}";
|
||||||
|
background = "#${config.colorScheme.palette.base00}";
|
||||||
|
```
|
||||||
|
|
||||||
|
### Session Variables
|
||||||
|
Set in default.nix for Wayland/Hyprland:
|
||||||
|
```nix
|
||||||
|
NIXOS_OZONE_WL = "1";
|
||||||
|
QT_QPA_PLATFORM = "wayland";
|
||||||
|
XDG_CURRENT_DESKTOP = "Hyprland";
|
||||||
|
```
|
||||||
|
|
||||||
|
### XDG Defaults
|
||||||
|
- **PDF**: okular
|
||||||
|
- **Text**: nvim
|
||||||
|
- **Browser**: Zen (io.github.zen_browser.zen)
|
||||||
|
- **Archive**: file-roller
|
||||||
|
|
||||||
|
## ANTI-PATTERNS
|
||||||
|
|
||||||
|
- **DON'T** hardcode hex colors - use colorScheme palette
|
||||||
|
- **DON'T** install fonts globally - keep in user packages
|
||||||
|
- **DON'T** bypass XDG defaults - set in mimeApps
|
||||||
|
|
||||||
|
## NOTES
|
||||||
|
|
||||||
|
- Kitty terminal configured in default.nix (not separate file)
|
||||||
|
- Bibata-Modern-Ice cursor theme hardcoded
|
||||||
|
- Session path includes cargo, npm-global, bun
|
||||||
|
- Desktop features are always-enabled (no feature flags in this dir)
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.coding;
|
||||||
|
in {
|
||||||
|
options.features.desktop.coding.enable =
|
||||||
|
mkEnableOption "install coding related stuff";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
bruno
|
||||||
|
insomnia
|
||||||
|
];
|
||||||
|
coding.editors = {
|
||||||
|
neovim.enable = true;
|
||||||
|
zed.enable = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.crypto;
|
||||||
|
in {
|
||||||
|
options.features.desktop.crypto.enable = mkEnableOption "Enable Crypto";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,177 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
imports = [
|
||||||
|
./coding.nix
|
||||||
|
./crypto.nix
|
||||||
|
./fonts.nix
|
||||||
|
./gaming.nix
|
||||||
|
./hyprland.nix
|
||||||
|
./media.nix
|
||||||
|
./office.nix
|
||||||
|
./rofi.nix
|
||||||
|
./theme.nix
|
||||||
|
./wallpapers.nix
|
||||||
|
./wayland.nix
|
||||||
|
./webapps.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
xdg = {
|
||||||
|
enable = true;
|
||||||
|
configFile."mimeapps.list".force = true;
|
||||||
|
mimeApps = {
|
||||||
|
enable = true;
|
||||||
|
associations.added = {
|
||||||
|
"application/zip" = ["org.gnome.FileRoller.desktop"];
|
||||||
|
"application/csv" = ["calc.desktop"];
|
||||||
|
"application/pdf" = ["okularApplication_pdf.desktop"];
|
||||||
|
};
|
||||||
|
defaultApplications = {
|
||||||
|
"application/zip" = ["org.gnome.FileRoller.desktop"];
|
||||||
|
"application/csv" = ["calc.desktop"];
|
||||||
|
"application/pdf" = ["okularApplication_pdf.desktop"];
|
||||||
|
"application/md" = ["nvim.desktop"];
|
||||||
|
"application/text" = ["nvim.desktop"];
|
||||||
|
"x-scheme-handler/http" = ["io.github.zen_browser.zen"];
|
||||||
|
"x-scheme-handler/https" = ["io.github.zen_browser.zen"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
userDirs = {
|
||||||
|
enable = true;
|
||||||
|
createDirectories = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
home.sessionVariables = {
|
||||||
|
WEBKIT_DISABLE_COMPOSITING_MODE = "1";
|
||||||
|
NIXOS_OZONE_WL = "1";
|
||||||
|
TERMINAL = "kitty";
|
||||||
|
QT_QPA_PLATFORM = "wayland";
|
||||||
|
XDG_CURRENT_DESKTOP = "Hyprland";
|
||||||
|
XDG_SESSION_TYPE = "wayland";
|
||||||
|
XDG_SESSION_DESKTOP = "Hyprland";
|
||||||
|
};
|
||||||
|
home.sessionPath = ["\${XDG_BIN_HOME}" "\${HOME}/.cargo/bin" "$HOME/.npm-global/bin" "$HOME/.cache/.bun/bin"];
|
||||||
|
|
||||||
|
fonts.fontconfig.enable = true;
|
||||||
|
|
||||||
|
programs.kitty = {
|
||||||
|
enable = true;
|
||||||
|
shellIntegration = {
|
||||||
|
enableFishIntegration = true;
|
||||||
|
enableBashIntegration = true;
|
||||||
|
};
|
||||||
|
font = {name = "Fira Code";};
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
copy_on_select = "yes";
|
||||||
|
|
||||||
|
# Base colors
|
||||||
|
foreground = "#${config.colorScheme.palette.base05}";
|
||||||
|
background = "#${config.colorScheme.palette.base00}";
|
||||||
|
selection_foreground = "#${config.colorScheme.palette.base07}";
|
||||||
|
selection_background = "#${config.colorScheme.palette.base02}";
|
||||||
|
|
||||||
|
# URL color
|
||||||
|
url_color = "#${config.colorScheme.palette.base08}";
|
||||||
|
|
||||||
|
# Cursor
|
||||||
|
cursor = "#${config.colorScheme.palette.base05}";
|
||||||
|
cursor_text_color = "#${config.colorScheme.palette.base00}";
|
||||||
|
|
||||||
|
# Colors 0-15
|
||||||
|
color0 = "#${config.colorScheme.palette.base01}";
|
||||||
|
color8 = "#${config.colorScheme.palette.base03}";
|
||||||
|
|
||||||
|
color1 = "#${config.colorScheme.palette.base08}";
|
||||||
|
color9 = "#${config.colorScheme.palette.base08}";
|
||||||
|
|
||||||
|
color2 = "#${config.colorScheme.palette.base0B}";
|
||||||
|
color10 = "#${config.colorScheme.palette.base0B}";
|
||||||
|
|
||||||
|
color3 = "#${config.colorScheme.palette.base0A}";
|
||||||
|
color11 = "#${config.colorScheme.palette.base0A}";
|
||||||
|
|
||||||
|
color4 = "#${config.colorScheme.palette.base0D}";
|
||||||
|
color12 = "#${config.colorScheme.palette.base0D}";
|
||||||
|
|
||||||
|
color5 = "#${config.colorScheme.palette.base0E}";
|
||||||
|
color13 = "#${config.colorScheme.palette.base0E}";
|
||||||
|
|
||||||
|
color6 = "#${config.colorScheme.palette.base0C}";
|
||||||
|
color14 = "#${config.colorScheme.palette.base0C}";
|
||||||
|
|
||||||
|
color7 = "#${config.colorScheme.palette.base05}";
|
||||||
|
color15 = "#${config.colorScheme.palette.base07}";
|
||||||
|
|
||||||
|
# Tab colors
|
||||||
|
active_tab_foreground = "#${config.colorScheme.palette.base00}";
|
||||||
|
active_tab_background = "#${config.colorScheme.palette.base05}";
|
||||||
|
inactive_tab_foreground = "#${config.colorScheme.palette.base05}";
|
||||||
|
inactive_tab_background = "#${config.colorScheme.palette.base01}";
|
||||||
|
|
||||||
|
# Mark colors
|
||||||
|
mark1_foreground = "#${config.colorScheme.palette.base00}";
|
||||||
|
mark1_background = "#${config.colorScheme.palette.base08}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
home.pointerCursor = {
|
||||||
|
gtk.enable = true;
|
||||||
|
package = pkgs.bibata-cursors;
|
||||||
|
name = "Bibata-Modern-Ice";
|
||||||
|
size = 20;
|
||||||
|
};
|
||||||
|
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
appimage-run
|
||||||
|
stable.anytype
|
||||||
|
# blueberry
|
||||||
|
bemoji
|
||||||
|
brave
|
||||||
|
# brightnessctl
|
||||||
|
# clipman
|
||||||
|
distrobox
|
||||||
|
launch-webapp
|
||||||
|
# eww
|
||||||
|
# firefox-devedition
|
||||||
|
file-roller
|
||||||
|
hyprpanel
|
||||||
|
seahorse
|
||||||
|
sushi
|
||||||
|
# glib
|
||||||
|
# google-chrome
|
||||||
|
# gsettings-desktop-schemas
|
||||||
|
# graphviz
|
||||||
|
ksnip
|
||||||
|
msty-studio
|
||||||
|
nwg-look
|
||||||
|
# pamixer
|
||||||
|
# pavucontrol
|
||||||
|
# libsForQt5.qtstyleplugins
|
||||||
|
# stable.nyxt
|
||||||
|
# pcmanfm
|
||||||
|
rose-pine-hyprcursor
|
||||||
|
# qt5ct
|
||||||
|
# qt6.qtwayland
|
||||||
|
#rustdesk
|
||||||
|
# socat
|
||||||
|
# unrar
|
||||||
|
# unzip
|
||||||
|
# usbutils
|
||||||
|
# v4l-utils
|
||||||
|
remmina
|
||||||
|
slack
|
||||||
|
telegram-desktop
|
||||||
|
vivaldi
|
||||||
|
vivaldi-ffmpeg-codecs
|
||||||
|
# wl-clipboard
|
||||||
|
# wlogout
|
||||||
|
# wtype
|
||||||
|
# xdg-utils
|
||||||
|
# ydotool
|
||||||
|
# zip
|
||||||
|
];
|
||||||
|
}
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.fonts;
|
||||||
|
in {
|
||||||
|
options.features.desktop.fonts.enable =
|
||||||
|
mkEnableOption "install additional fonts for desktop apps";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
fira-code
|
||||||
|
fira-code-symbols
|
||||||
|
nerd-fonts.fira-code
|
||||||
|
nerd-fonts.jetbrains-mono
|
||||||
|
font-manager
|
||||||
|
font-awesome_5
|
||||||
|
noto-fonts
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.gaming;
|
||||||
|
in {
|
||||||
|
options.features.desktop.gaming.enable =
|
||||||
|
mkEnableOption "install gaming related stuff";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
gamescope
|
||||||
|
gamemode
|
||||||
|
goverlay
|
||||||
|
mangohud
|
||||||
|
protonplus
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,315 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.hyprland;
|
||||||
|
in {
|
||||||
|
options.features.desktop.hyprland.enable =
|
||||||
|
mkEnableOption "Hyprland related stuff";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
wayland.windowManager.hyprland = {
|
||||||
|
settings = {
|
||||||
|
xwayland = {
|
||||||
|
force_zero_scaling = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
exec-once = [
|
||||||
|
"hyprpanel"
|
||||||
|
"while ! hyprpaper-random; do sleep 0.5; done"
|
||||||
|
"wl-paste --type text --watch cliphist store" # Stores only text data
|
||||||
|
"wl-paste --type image --watch cliphist store" # Stores only image data "wl-paste -p -t text --watch clipman store -P --histpath=\"~/.local/share/clipman-primary.json\""
|
||||||
|
];
|
||||||
|
|
||||||
|
env = [
|
||||||
|
"XCURSOR_SIZE,32"
|
||||||
|
"HYPRCURSOR_THEME,Bibata-Modern-Ice"
|
||||||
|
"WLR_NO_HARDWARE_CURSORS,1"
|
||||||
|
"GTK_THEME,Dracula"
|
||||||
|
"XDG_CURRENT_DESKTOP,Hyprland"
|
||||||
|
"XDG_SESSION_TYPE,wayland"
|
||||||
|
"XDG_SESSION_DESKTOP,Hyprland"
|
||||||
|
];
|
||||||
|
|
||||||
|
input = {
|
||||||
|
kb_layout = "de,us";
|
||||||
|
kb_variant = "";
|
||||||
|
kb_model = "";
|
||||||
|
kb_rules = "";
|
||||||
|
kb_options = "ctrl:nocaps";
|
||||||
|
follow_mouse = 1;
|
||||||
|
};
|
||||||
|
|
||||||
|
general = {
|
||||||
|
gaps_in = 5;
|
||||||
|
gaps_out = 5;
|
||||||
|
border_size = 1;
|
||||||
|
# Keeping the existing active border as requested
|
||||||
|
"col.active_border" = "rgba(9742b5ee) rgba(9742b5ee) 45deg";
|
||||||
|
"col.inactive_border" = "rgba(${config.colorScheme.palette.base03}aa)";
|
||||||
|
layout = "dwindle";
|
||||||
|
};
|
||||||
|
|
||||||
|
decoration = {
|
||||||
|
shadow = {
|
||||||
|
enabled = true;
|
||||||
|
range = 60;
|
||||||
|
render_power = 3;
|
||||||
|
color = "rgba(${config.colorScheme.palette.base00}66)";
|
||||||
|
offset = "1 2";
|
||||||
|
scale = 0.97;
|
||||||
|
};
|
||||||
|
rounding = 8;
|
||||||
|
blur = {
|
||||||
|
enabled = true;
|
||||||
|
size = 3;
|
||||||
|
passes = 3;
|
||||||
|
};
|
||||||
|
active_opacity = 0.9;
|
||||||
|
inactive_opacity = 0.5;
|
||||||
|
};
|
||||||
|
|
||||||
|
animations = {
|
||||||
|
enabled = true;
|
||||||
|
bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
|
||||||
|
animation = [
|
||||||
|
"windows, 1, 7, myBezier"
|
||||||
|
"windowsOut, 1, 7, default, popin 80%"
|
||||||
|
"border, 1, 10, default"
|
||||||
|
"borderangle, 1, 8, default"
|
||||||
|
"fade, 1, 7, default"
|
||||||
|
"workspaces, 1, 6, default"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
dwindle = {
|
||||||
|
pseudotile = true;
|
||||||
|
preserve_split = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
master = {
|
||||||
|
new_status = "master";
|
||||||
|
};
|
||||||
|
|
||||||
|
device = [
|
||||||
|
{
|
||||||
|
name = "epic-mouse-v1";
|
||||||
|
sensitivity = -0.5;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name = "zsa-technology-labs-moonlander-mark-i";
|
||||||
|
kb_layout = "us";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
name = "keychron-keychron-k7";
|
||||||
|
kb_layout = "us";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
windowrule = [
|
||||||
|
# Floating dialogs
|
||||||
|
"match:class file_progress, float on"
|
||||||
|
"match:class confirm, float on"
|
||||||
|
"match:class dialog, float on"
|
||||||
|
"match:class download, float on"
|
||||||
|
"match:class notification, float on"
|
||||||
|
"match:class error, float on"
|
||||||
|
"match:class splash, float on"
|
||||||
|
"match:class confirmreset, float on"
|
||||||
|
"match:title Open File, float on"
|
||||||
|
"match:title branchdialog, float on"
|
||||||
|
"match:class pavucontrol-qt, float on"
|
||||||
|
"match:class pavucontrol, float on"
|
||||||
|
# wlogout
|
||||||
|
"match:class wlogout, fullscreen on"
|
||||||
|
"match:title wlogout, float on"
|
||||||
|
"match:title wlogout, fullscreen on"
|
||||||
|
# mpv
|
||||||
|
"match:class mpv, float on"
|
||||||
|
"match:class mpv, idle_inhibit focus"
|
||||||
|
"match:class mpv, opacity 1.0 override"
|
||||||
|
# Media/Volume/PiP
|
||||||
|
"match:title ^(Media viewer)$, float on"
|
||||||
|
"match:title ^(Volume Control)$, float on"
|
||||||
|
"match:title ^(Picture-in-Picture)$, float on"
|
||||||
|
# Pomodoro timer
|
||||||
|
"match:title ^(floating-pomodoro)$, float on"
|
||||||
|
"match:title ^(floating-pomodoro)$, size 250 50"
|
||||||
|
"match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
|
||||||
|
"match:title ^(floating-pomodoro)$, pin on"
|
||||||
|
# Streamlabs overlays
|
||||||
|
"match:initial_title .*streamlabs.com.*, float on"
|
||||||
|
"match:initial_title .*streamlabs.com.*, pin on"
|
||||||
|
"match:initial_title .*streamlabs.com.*, size 800 400"
|
||||||
|
"match:initial_title .*alert-box.*, move 100%-820 102"
|
||||||
|
"match:initial_title .*chat-box.*, move 100%-820 512"
|
||||||
|
"match:initial_title .*streamlabs.com.*, opacity 0.5 override"
|
||||||
|
"match:initial_title .*streamlabs.com.*, idle_inhibit focus"
|
||||||
|
"match:initial_title .*streamlabs.com.*, no_anim on"
|
||||||
|
"match:initial_title .*streamlabs.com.*, decorate off"
|
||||||
|
"match:initial_title .*streamlabs.com.*, no_shadow on"
|
||||||
|
"match:initial_title .*streamlabs.com.*, no_blur on"
|
||||||
|
"border_color rgb(ffffff), match:xwayland 1"
|
||||||
|
];
|
||||||
|
"$mainMod" = "SUPER";
|
||||||
|
"$terminal" = "kitty";
|
||||||
|
|
||||||
|
bind = [
|
||||||
|
"$mainMod, return, exec, $terminal nu -c zellij-ps"
|
||||||
|
# "$mainMod, t, exec, warp-terminal"
|
||||||
|
"$mainMod, t, exec, $terminal -e nu -c 'nitch; exec nu'"
|
||||||
|
"$mainMod SHIFT, t, exec, launch-timer"
|
||||||
|
"$mainMod, n, exec, $terminal -e nvim"
|
||||||
|
"$mainMod, z, exec, uwsm app -- zeditor"
|
||||||
|
"$mainMod, o, exec, hyprctl setprop activewindow opaque toggle"
|
||||||
|
"$mainMod, r, exec, hyprctl dispatch focuswindow \"initialtitle:.*alert-box.*\" && hyprctl dispatch moveactive exact 4300 102 && hyprctl dispatch focuswindow \"initialtitle:.*chat-box.*\" && hyprctl dispatch moveactive exact 4300 512"
|
||||||
|
"$mainMod, b, exec, uwsm app -- thunar"
|
||||||
|
"$mainMod SHIFT, B, exec, uwsm app -- vivaldi"
|
||||||
|
"$mainMod, Escape, exec, uwsm app -- wlogout -p layer-shell"
|
||||||
|
"$mainMod, Space, togglefloating"
|
||||||
|
"$mainMod, q, killactive"
|
||||||
|
"$mainMod, M, exit"
|
||||||
|
"$mainMod, F, fullscreen"
|
||||||
|
"$mainMod SHIFT, V, togglefloating"
|
||||||
|
"$mainMod, D, exec, uwsm app -- rofi -show drun -run-command \"uwsm app -- {cmd}\""
|
||||||
|
"$mainMod, V, exec, uwsm app -- cliphist list | rofi -dmenu | cliphist decode | wl-copy"
|
||||||
|
"$mainMod, C, exec, bash -c 'FILE=/tmp/screenshot_$(date +%s).png; grim -g \"$(slurp)\" \"$FILE\" && ksnip \"$FILE\"'"
|
||||||
|
"$mainMod SHIFT, S, exec, uwsm app -- rofi -show emoji"
|
||||||
|
"$mainMod, P, exec, uwsm app -- rofi-pass"
|
||||||
|
"$mainMod SHIFT, P, pseudo"
|
||||||
|
"$mainMod, R, exec, stt-ptt start"
|
||||||
|
"$mainMod, J, togglesplit"
|
||||||
|
"$mainMod, h, movefocus, l"
|
||||||
|
"$mainMod, l, movefocus, r"
|
||||||
|
"$mainMod, k, movefocus, u"
|
||||||
|
"$mainMod, j, movefocus, d"
|
||||||
|
"$mainMod, 1, workspace, 1"
|
||||||
|
"$mainMod, 2, workspace, 2"
|
||||||
|
"$mainMod, 3, workspace, 3"
|
||||||
|
"$mainMod, 4, workspace, 4"
|
||||||
|
"$mainMod, 5, workspace, 5"
|
||||||
|
"$mainMod, 6, workspace, 6"
|
||||||
|
"$mainMod, 7, workspace, 7"
|
||||||
|
"$mainMod, 8, workspace, 8"
|
||||||
|
"$mainMod, 9, workspace, 9"
|
||||||
|
"$mainMod, 0, workspace, 10"
|
||||||
|
"$mainMod SHIFT, 1, movetoworkspace, 1"
|
||||||
|
"$mainMod SHIFT, 2, movetoworkspace, 2"
|
||||||
|
"$mainMod SHIFT, 3, movetoworkspace, 3"
|
||||||
|
"$mainMod SHIFT, 4, movetoworkspace, 4"
|
||||||
|
"$mainMod SHIFT, 5, movetoworkspace, 5"
|
||||||
|
"$mainMod SHIFT, 6, movetoworkspace, 6"
|
||||||
|
"$mainMod SHIFT, 7, movetoworkspace, 7"
|
||||||
|
"$mainMod SHIFT, 8, movetoworkspace, 8"
|
||||||
|
"$mainMod SHIFT, 9, movetoworkspace, 9"
|
||||||
|
"$mainMod SHIFT, 0, movetoworkspace, 10"
|
||||||
|
"$mainMod, mouse_down, workspace, e+1"
|
||||||
|
"$mainMod, mouse_up, workspace, e-1"
|
||||||
|
];
|
||||||
|
bindr = [
|
||||||
|
"$mainMod, R, exec, stt-ptt stop"
|
||||||
|
];
|
||||||
|
bindm = [
|
||||||
|
"$mainMod, mouse:272, movewindow"
|
||||||
|
"$mainMod, mouse:273, resizewindow"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.hypridle = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
general = {
|
||||||
|
before_sleep_cmd = "hyprlock";
|
||||||
|
after_sleep_cmd = "hyprctl dispatch dpms on";
|
||||||
|
inhibit_sleep = 3;
|
||||||
|
};
|
||||||
|
|
||||||
|
listener = [
|
||||||
|
{
|
||||||
|
timeout = 300; # 5 min
|
||||||
|
on-timeout = "hyprlock";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
timeout = 420; # 5.5 min
|
||||||
|
on-timeout = "hyprctl dispatch dpms off";
|
||||||
|
on-resume = "hyprctl dispatch dpms on";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.hyprpaper.enable = true;
|
||||||
|
|
||||||
|
programs.hyprlock = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
"$font" = "JetBrainsMono Nerd Font";
|
||||||
|
"$base" = "rgb(${config.colorScheme.palette.base00})";
|
||||||
|
"$text" = "rgb(${config.colorScheme.palette.base05})";
|
||||||
|
"$textAlpha" = "${config.colorScheme.palette.base05}";
|
||||||
|
"$accentAlpha" = "${config.colorScheme.palette.base0D}";
|
||||||
|
"$red" = "rgb(${config.colorScheme.palette.base08})";
|
||||||
|
"$yellow" = "rgb(${config.colorScheme.palette.base0A})";
|
||||||
|
|
||||||
|
general = {
|
||||||
|
hide_cursor = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
background = {
|
||||||
|
monitor = "";
|
||||||
|
path = "${config.home.homeDirectory}/.config/hypr/wallpapers/wallhaven-lmmo8r.jpg";
|
||||||
|
blur_passes = 0;
|
||||||
|
color = "rgb(${config.colorScheme.palette.base00})";
|
||||||
|
};
|
||||||
|
|
||||||
|
label = [
|
||||||
|
{
|
||||||
|
monitor = "";
|
||||||
|
text = "$TIME";
|
||||||
|
color = "$text";
|
||||||
|
font_size = 90;
|
||||||
|
font_family = "$font";
|
||||||
|
position = "30, 0";
|
||||||
|
halign = "left";
|
||||||
|
valign = "top";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
monitor = "";
|
||||||
|
text = ''cmd[update:43200000] echo "$(date +"%A, %d %B %Y")"'';
|
||||||
|
color = "$text";
|
||||||
|
font_size = 25;
|
||||||
|
font_family = "$font";
|
||||||
|
position = "30, -150";
|
||||||
|
halign = "left";
|
||||||
|
valign = "top";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
input-field = [
|
||||||
|
{
|
||||||
|
monitor = "";
|
||||||
|
size = "300, 60";
|
||||||
|
outline_thickness = 4;
|
||||||
|
dots_size = 0.2;
|
||||||
|
dots_spacing = 0.2;
|
||||||
|
dots_center = true;
|
||||||
|
outer_color = "rgb(${config.colorScheme.palette.base0D})";
|
||||||
|
inner_color = "rgb(${config.colorScheme.palette.base00})";
|
||||||
|
font_color = "rgb(${config.colorScheme.palette.base05})";
|
||||||
|
fade_on_empty = false;
|
||||||
|
placeholder_text = ''<span foreground="##${config.colorScheme.palette.base05}"> Logged in as <span foreground="##${config.colorScheme.palette.base0D}">$USER</span></span>'';
|
||||||
|
hide_input = false;
|
||||||
|
check_color = "rgb(${config.colorScheme.palette.base0D})";
|
||||||
|
fail_color = "rgb(${config.colorScheme.palette.base08})";
|
||||||
|
fail_text = ''<i>$FAIL <b>($ATTEMPTS)</b></i>'';
|
||||||
|
capslock_color = "rgb(${config.colorScheme.palette.base0A})";
|
||||||
|
position = "0, -35";
|
||||||
|
halign = "center";
|
||||||
|
valign = "center";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,56 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.media;
|
||||||
|
in {
|
||||||
|
options.features.desktop.media.enable =
|
||||||
|
mkEnableOption "enable media features";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
# handbrake
|
||||||
|
# kdePackages.kdenlive
|
||||||
|
# makemkv
|
||||||
|
# mediainfo
|
||||||
|
amf
|
||||||
|
blueberry
|
||||||
|
ffmpeg_6-full
|
||||||
|
gst_all_1.gstreamer
|
||||||
|
gst_all_1.gst-vaapi
|
||||||
|
handbrake
|
||||||
|
inkscape
|
||||||
|
kdePackages.kdenlive
|
||||||
|
krita
|
||||||
|
libation
|
||||||
|
#makemkv
|
||||||
|
pamixer
|
||||||
|
pavucontrol
|
||||||
|
qpwgraph
|
||||||
|
v4l-utils
|
||||||
|
#plexamp
|
||||||
|
# uxplay
|
||||||
|
# vlc
|
||||||
|
# webcord
|
||||||
|
# yt-dlp
|
||||||
|
unimatrix
|
||||||
|
];
|
||||||
|
|
||||||
|
programs = {
|
||||||
|
mpv = {
|
||||||
|
enable = true;
|
||||||
|
bindings = {
|
||||||
|
WHEEL_UP = "seek 10";
|
||||||
|
WHEEL_DOWN = "seek -10";
|
||||||
|
};
|
||||||
|
config = {
|
||||||
|
profile = "gpu-hq";
|
||||||
|
ytdl-format = "bestvideo+bestaudio";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.office;
|
||||||
|
in {
|
||||||
|
options.features.desktop.office.enable =
|
||||||
|
mkEnableOption "install office and paperwork stuff";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
libreoffice-fresh
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,206 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.rofi;
|
||||||
|
in {
|
||||||
|
options.features.desktop.rofi.enable = mkEnableOption "enable rofi";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
programs.rofi = with pkgs; {
|
||||||
|
enable = true;
|
||||||
|
package = rofi.override {
|
||||||
|
plugins = [
|
||||||
|
rofi-calc
|
||||||
|
rofi-emoji
|
||||||
|
stable.rofi-file-browser
|
||||||
|
];
|
||||||
|
};
|
||||||
|
pass = {
|
||||||
|
enable = true;
|
||||||
|
package = rofi-pass-wayland;
|
||||||
|
};
|
||||||
|
terminal = "\${pkgs.kitty}/bin/kitty";
|
||||||
|
font = "Fira Code";
|
||||||
|
extraConfig = {
|
||||||
|
show-icons = true;
|
||||||
|
disable-history = false;
|
||||||
|
modi = "drun,calc,emoji,filebrowser";
|
||||||
|
kb-primary-paste = "Control+V,Shift+Insert";
|
||||||
|
kb-secondary-paste = "Control+v,Insert";
|
||||||
|
};
|
||||||
|
theme = let
|
||||||
|
inherit (config.colorScheme) palette;
|
||||||
|
in
|
||||||
|
builtins.toString (pkgs.writeText "rofi-universal-theme.rasi" ''
|
||||||
|
* {
|
||||||
|
/* Universal theme colors from nix-colors */
|
||||||
|
background: #${palette.base00};
|
||||||
|
surface: #${palette.base01};
|
||||||
|
overlay: #${palette.base02};
|
||||||
|
muted: #${palette.base03};
|
||||||
|
subtle: #${palette.base04};
|
||||||
|
text: #${palette.base05};
|
||||||
|
bright-text: #${palette.base06};
|
||||||
|
highlight: #${palette.base07};
|
||||||
|
accent1: #${palette.base08};
|
||||||
|
accent2: #${palette.base09};
|
||||||
|
accent3: #${palette.base0A};
|
||||||
|
accent4: #${palette.base0B};
|
||||||
|
accent5: #${palette.base0C};
|
||||||
|
accent6: #${palette.base0D};
|
||||||
|
accent7: #${palette.base0E};
|
||||||
|
accent8: #${palette.base0F};
|
||||||
|
|
||||||
|
/* Global properties */
|
||||||
|
background-color: @background;
|
||||||
|
text-color: @text;
|
||||||
|
font: "Fira Code 12";
|
||||||
|
border: 0;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
spacing: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
window {
|
||||||
|
background-color: @background;
|
||||||
|
border: 1px;
|
||||||
|
border-color: @accent7;
|
||||||
|
border-radius: 6px;
|
||||||
|
width: 40%;
|
||||||
|
padding: 16px;
|
||||||
|
}
|
||||||
|
|
||||||
|
inputbar {
|
||||||
|
children: [ prompt, entry ];
|
||||||
|
spacing: 12px;
|
||||||
|
padding: 8px;
|
||||||
|
border-radius: 4px;
|
||||||
|
background-color: @surface;
|
||||||
|
}
|
||||||
|
|
||||||
|
prompt {
|
||||||
|
text-color: @accent7;
|
||||||
|
background-color: transparent;
|
||||||
|
}
|
||||||
|
|
||||||
|
entry {
|
||||||
|
placeholder: "Search...";
|
||||||
|
placeholder-color: @subtle;
|
||||||
|
text-color: @text;
|
||||||
|
background-color: transparent;
|
||||||
|
cursor-color: @accent7;
|
||||||
|
}
|
||||||
|
|
||||||
|
message {
|
||||||
|
background-color: @surface;
|
||||||
|
border-radius: 4px;
|
||||||
|
padding: 8px;
|
||||||
|
margin: 8px 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
textbox {
|
||||||
|
text-color: @text;
|
||||||
|
background-color: transparent;
|
||||||
|
}
|
||||||
|
|
||||||
|
listview {
|
||||||
|
background-color: transparent;
|
||||||
|
margin: 8px 0 0;
|
||||||
|
lines: 10;
|
||||||
|
columns: 1;
|
||||||
|
fixed-height: true;
|
||||||
|
scrollbar: false;
|
||||||
|
}
|
||||||
|
|
||||||
|
element {
|
||||||
|
background-color: transparent;
|
||||||
|
text-color: @text;
|
||||||
|
padding: 8px;
|
||||||
|
border-radius: 4px;
|
||||||
|
spacing: 8px;
|
||||||
|
}
|
||||||
|
|
||||||
|
element normal.normal {
|
||||||
|
background-color: transparent;
|
||||||
|
text-color: @text;
|
||||||
|
}
|
||||||
|
|
||||||
|
element selected.normal {
|
||||||
|
background-color: @accent7;
|
||||||
|
text-color: @background;
|
||||||
|
}
|
||||||
|
|
||||||
|
element alternate.normal {
|
||||||
|
background-color: transparent;
|
||||||
|
text-color: @text;
|
||||||
|
}
|
||||||
|
|
||||||
|
element-icon {
|
||||||
|
background-color: transparent;
|
||||||
|
size: 24px;
|
||||||
|
}
|
||||||
|
|
||||||
|
element-text {
|
||||||
|
background-color: transparent;
|
||||||
|
text-color: inherit;
|
||||||
|
vertical-align: 0.5;
|
||||||
|
}
|
||||||
|
|
||||||
|
mode-switcher {
|
||||||
|
spacing: 0;
|
||||||
|
background-color: @surface;
|
||||||
|
border-radius: 4px;
|
||||||
|
margin: 8px 0 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
button {
|
||||||
|
padding: 8px 16px;
|
||||||
|
background-color: transparent;
|
||||||
|
text-color: @text;
|
||||||
|
border-radius: 4px;
|
||||||
|
}
|
||||||
|
|
||||||
|
button selected {
|
||||||
|
background-color: @accent7;
|
||||||
|
text-color: @background;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Scrollbar */
|
||||||
|
scrollbar {
|
||||||
|
width: 4px;
|
||||||
|
border: 0;
|
||||||
|
handle-color: @accent7;
|
||||||
|
handle-width: 4px;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
'');
|
||||||
|
};
|
||||||
|
cli.rofi-project-opener = {
|
||||||
|
enable = true;
|
||||||
|
projectDirs = {
|
||||||
|
AI = {
|
||||||
|
path = "~/p/AI";
|
||||||
|
args = "";
|
||||||
|
};
|
||||||
|
CHAT = {
|
||||||
|
path = "~/p/CHAT";
|
||||||
|
args = "--agent chiron";
|
||||||
|
};
|
||||||
|
MISC = {
|
||||||
|
path = "~/p/MISC";
|
||||||
|
args = "--agent chiron-forge";
|
||||||
|
};
|
||||||
|
NIX = {
|
||||||
|
path = "~/p/NIX";
|
||||||
|
args = "";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
terminal = pkgs.kitty;
|
||||||
|
terminalCommand = "opencode %a";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
qt = {
|
||||||
|
enable = true;
|
||||||
|
platformTheme.name = "gtk";
|
||||||
|
};
|
||||||
|
gtk = {
|
||||||
|
enable = true;
|
||||||
|
theme = {
|
||||||
|
name = "Dracula";
|
||||||
|
package = pkgs.dracula-theme;
|
||||||
|
};
|
||||||
|
iconTheme = {
|
||||||
|
name = "Dracula";
|
||||||
|
package = pkgs.dracula-icon-theme;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.wallpapers;
|
||||||
|
in {
|
||||||
|
options.features.desktop.wallpapers = mkEnableOption "Wallpapers for Hyprland";
|
||||||
|
|
||||||
|
config = mkIf cfg {
|
||||||
|
xdg.configFile."hypr/wallpapers" = {
|
||||||
|
source = ../../m3tam3re/wallpapers;
|
||||||
|
recursive = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,29 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.wayland;
|
||||||
|
in {
|
||||||
|
options.features.desktop.wayland.enable = mkEnableOption "wayland extra tools and config";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
grim
|
||||||
|
hyprcursor
|
||||||
|
hyprlock
|
||||||
|
hyprpaper
|
||||||
|
qt6.qtwayland
|
||||||
|
slurp
|
||||||
|
waypipe
|
||||||
|
wl-clipboard
|
||||||
|
wf-recorder
|
||||||
|
wl-mirror
|
||||||
|
wlogout
|
||||||
|
wtype
|
||||||
|
ydotool
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
icons = {
|
||||||
|
teams = pkgs.fetchurl {
|
||||||
|
url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-teams.svg";
|
||||||
|
sha256 = "sha256-Pr9QS8nnXJq97r4/G3c6JXi34zxHl0ps9gcyI8cN/s8=";
|
||||||
|
};
|
||||||
|
outlook = pkgs.fetchurl {
|
||||||
|
url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-outlook.svg";
|
||||||
|
sha256 = "sha256-3u8t5QNHFZvrAegxBiGicO4PjtMWhEaQSCv7MSSfLLc=";
|
||||||
|
};
|
||||||
|
opencode = pkgs.fetchurl {
|
||||||
|
url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/opencode-dark.svg";
|
||||||
|
sha256 = "1lms4f8habamvdh2qqqz9psx4py9wx23mmlkkds44pvrbq3bkj3n";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
in {
|
||||||
|
xdg.desktopEntries = {
|
||||||
|
teams = {
|
||||||
|
name = "Microsoft Teams";
|
||||||
|
exec = "launch-webapp https://teams.microsoft.com";
|
||||||
|
comment = "Open Microsoft Teams as a Desktop App";
|
||||||
|
categories = ["Application" "Network" "Chat"];
|
||||||
|
terminal = false;
|
||||||
|
icon = icons.teams;
|
||||||
|
};
|
||||||
|
outlook = {
|
||||||
|
name = "Microsoft Outlook";
|
||||||
|
exec = "launch-webapp https://outlook.office.com/mail/";
|
||||||
|
comment = "Open Microsoft Outlook as a Desktop App";
|
||||||
|
categories = ["Application" "Network"];
|
||||||
|
terminal = false;
|
||||||
|
icon = icons.outlook;
|
||||||
|
};
|
||||||
|
basecamp = {
|
||||||
|
name = "Basecamp";
|
||||||
|
exec = "launch-webapp https://3.basecamp.com/5996442/";
|
||||||
|
comment = "Open Basecamp as a Desktop App";
|
||||||
|
categories = ["Application" "Network"];
|
||||||
|
terminal = false;
|
||||||
|
icon = "/home/sascha.koenig/.local/share/icons/basecamp-logo.png";
|
||||||
|
};
|
||||||
|
opencode = {
|
||||||
|
name = "Opencode";
|
||||||
|
exec = "rofi-project-opener";
|
||||||
|
comment = "Open Opencode Terminal App";
|
||||||
|
categories = ["Application" "Development"];
|
||||||
|
terminal = false;
|
||||||
|
icon = icons.opencode;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,120 @@
|
|||||||
|
# This is a default home.nix generated by the follwing hone-manager command
|
||||||
|
#
|
||||||
|
# home-manager init ./
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
# Home Manager needs a bit of information about you and the paths it should
|
||||||
|
# manage.
|
||||||
|
home.username = lib.mkDefault "your-name";
|
||||||
|
home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
|
||||||
|
|
||||||
|
# This value determines the Home Manager release that your configuration is
|
||||||
|
# compatible with. This helps avoid breakage when a new Home Manager release
|
||||||
|
# introduces backwards incompatible changes.
|
||||||
|
#
|
||||||
|
# You should not change this value, even if you update Home Manager. If you do
|
||||||
|
# want to update the value, then make sure to first check the Home Manager
|
||||||
|
# release notes.
|
||||||
|
home.stateVersion = "24.11"; # Please read the comment before changing.
|
||||||
|
|
||||||
|
# The home.packages option allows you to install Nix packages into your
|
||||||
|
# environment.
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
# # Adds the 'hello' command to your environment. It prints a friendly
|
||||||
|
# # "Hello, world!" when run.
|
||||||
|
# pkgs.hello
|
||||||
|
|
||||||
|
# # It is sometimes useful to fine-tune packages, for example, by applying
|
||||||
|
# # overrides. You can do that directly here, just don't forget the
|
||||||
|
# # parentheses. Maybe you want to install Nerd Fonts with a limited number of
|
||||||
|
# # fonts?
|
||||||
|
# (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
|
||||||
|
|
||||||
|
# # You can also create simple shell scripts directly inside your
|
||||||
|
# # configuration. For example, this adds a command 'my-hello' to your
|
||||||
|
# # environment:
|
||||||
|
# (pkgs.writeShellScriptBin "my-hello" ''
|
||||||
|
# echo "Hello, ${config.home.username}!"
|
||||||
|
# '')
|
||||||
|
];
|
||||||
|
|
||||||
|
# Home Manager is pretty good at managing dotfiles. The primary way to manage
|
||||||
|
# plain files is through 'home.file'.
|
||||||
|
home.file = {
|
||||||
|
# # Building this configuration will create a copy of 'dotfiles/screenrc' in
|
||||||
|
# # the Nix store. Activating the configuration will then make '~/.screenrc' a
|
||||||
|
# # symlink to the Nix store copy.
|
||||||
|
# ".screenrc".source = dotfiles/screenrc;
|
||||||
|
|
||||||
|
# # You can also set the file content immediately.
|
||||||
|
# ".gradle/gradle.properties".text = ''
|
||||||
|
# org.gradle.console=verbose
|
||||||
|
# org.gradle.daemon.idletimeout=3600000
|
||||||
|
# '';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Home Manager can also manage your environment variables through
|
||||||
|
# 'home.sessionVariables'. If you don't want to manage your shell through Home
|
||||||
|
# Manager then you have to manually source 'hm-session-vars.sh' located at
|
||||||
|
# either
|
||||||
|
#
|
||||||
|
# ~/.nix-profile/etc/profile.d/hm-session-vars.sh
|
||||||
|
#
|
||||||
|
# or
|
||||||
|
#
|
||||||
|
# ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
|
||||||
|
#
|
||||||
|
# or
|
||||||
|
#
|
||||||
|
# /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
|
||||||
|
#
|
||||||
|
home.sessionVariables = {
|
||||||
|
# EDITOR = "emacs";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Let Home Manager install and manage itself.
|
||||||
|
programs.home-manager.enable = true;
|
||||||
|
|
||||||
|
programs.git = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
user = {
|
||||||
|
name = "m3tm3re";
|
||||||
|
email = "p@m3ta.dev";
|
||||||
|
};
|
||||||
|
core.excludesfile = "~/.gitignore_global";
|
||||||
|
init.defaultBranch = "master";
|
||||||
|
alias = {
|
||||||
|
st = "status";
|
||||||
|
logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# programs.zellij-ps = {
|
||||||
|
# enable = true;
|
||||||
|
# projectFolders = [
|
||||||
|
# "${config.home.homeDirectory}/p/c"
|
||||||
|
# "${config.home.homeDirectory}/p"
|
||||||
|
# "${config.home.homeDirectory}/.config"
|
||||||
|
# ];
|
||||||
|
# layout = ''
|
||||||
|
# layout {
|
||||||
|
# pane size=1 borderless=true {
|
||||||
|
# plugin location="zellij:tab-bar"
|
||||||
|
# }
|
||||||
|
# pane size="70%" command="nvim"
|
||||||
|
# pane split_direction="vertical" {
|
||||||
|
# pane
|
||||||
|
# pane command="unimatrix"
|
||||||
|
# }
|
||||||
|
# pane size=1 borderless=true {
|
||||||
|
# plugin location="zellij:status-bar"
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
}
|
||||||
@@ -0,0 +1,250 @@
|
|||||||
|
# This is a default home.nix generated by the follwing hone-manager command
|
||||||
|
#
|
||||||
|
# home-manager init ./
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
# Home Manager needs a bit of information about you and the paths it should
|
||||||
|
# manage.
|
||||||
|
home.username = lib.mkDefault "your-name";
|
||||||
|
home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
|
||||||
|
|
||||||
|
# This value determines the Home Manager release that your configuration is
|
||||||
|
# compatible with. This helps avoid breakage when a new Home Manager release
|
||||||
|
# introduces backwards incompatible changes.
|
||||||
|
#
|
||||||
|
# You should not change this value, even if you update Home Manager. If you do
|
||||||
|
# want to update the value, then make sure to first check the Home Manager
|
||||||
|
# release notes.
|
||||||
|
home.stateVersion = "24.11"; # Please read the comment before changing.
|
||||||
|
|
||||||
|
# The home.packages option allows you to install Nix packages into your
|
||||||
|
# environment.
|
||||||
|
home.packages = with pkgs; [
|
||||||
|
libgtop
|
||||||
|
# # Adds the 'hello' command to your environment. It prints a friendly
|
||||||
|
# # "Hello, world!" when run.
|
||||||
|
# pkgs.hello
|
||||||
|
|
||||||
|
# # It is sometimes useful to fine-tune packages, for example, by applying
|
||||||
|
# # overrides. You can do that directly here, just don't forget the
|
||||||
|
# # parentheses. Maybe you want to install Nerd Fonts with a limited number of
|
||||||
|
# # fonts?
|
||||||
|
# (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
|
||||||
|
|
||||||
|
# # You can also create simple shell scripts directly inside your
|
||||||
|
# # configuration. For example, this adds a command 'my-hello' to your
|
||||||
|
# # environment:
|
||||||
|
# (pkgs.writeShellScriptBin "my-hello" ''
|
||||||
|
# echo "Hello, ${config.home.username}!"
|
||||||
|
# '')
|
||||||
|
];
|
||||||
|
|
||||||
|
# Home Manager is pretty good at managing dotfiles. The primary way to manage
|
||||||
|
# plain files is through 'home.file'.
|
||||||
|
home.file = {
|
||||||
|
# # Building this configuration will create a copy of 'dotfiles/screenrc' in
|
||||||
|
# # the Nix store. Activating the configuration will then make '~/.screenrc' a
|
||||||
|
# # symlink to the Nix store copy.
|
||||||
|
# ".screenrc".source = dotfiles/screenrc;
|
||||||
|
|
||||||
|
# # You can also set the file content immediately.
|
||||||
|
# ".gradle/gradle.properties".text = ''
|
||||||
|
# org.gradle.console=verbose
|
||||||
|
# org.gradle.daemon.idletimeout=3600000
|
||||||
|
# '';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Home Manager can also manage your environment variables through
|
||||||
|
# 'home.sessionVariables'. If you don't want to manage your shell through Home
|
||||||
|
# Manager then you have to manually source 'hm-session-vars.sh' located at
|
||||||
|
# either
|
||||||
|
#
|
||||||
|
# ~/.nix-profile/etc/profile.d/hm-session-vars.sh
|
||||||
|
#
|
||||||
|
# or
|
||||||
|
#
|
||||||
|
# ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
|
||||||
|
#
|
||||||
|
# or
|
||||||
|
#
|
||||||
|
# /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
|
||||||
|
#
|
||||||
|
home.sessionVariables = {
|
||||||
|
# EDITOR = "emacs";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Let Home Manager install and manage itself.
|
||||||
|
programs.home-manager.enable = true;
|
||||||
|
|
||||||
|
services.cliphist = {
|
||||||
|
enable = true;
|
||||||
|
allowImages = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.git = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
user = {
|
||||||
|
name = "m3tm3re";
|
||||||
|
email = "p@m3ta.dev";
|
||||||
|
};
|
||||||
|
core.excludesfile = "~/.gitignore_global";
|
||||||
|
init.defaultBranch = "master";
|
||||||
|
alias = {
|
||||||
|
st = "status";
|
||||||
|
logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.difftastic.enable = true;
|
||||||
|
|
||||||
|
programs.jujutsu = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
user = {
|
||||||
|
email = "m@m3tam3re.com";
|
||||||
|
name = "Sascha Koenig";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.ssh = {
|
||||||
|
enable = true;
|
||||||
|
enableDefaultConfig = false;
|
||||||
|
matchBlocks = {
|
||||||
|
"AZ-CLD-1" = {
|
||||||
|
hostname = "152.53.186.119";
|
||||||
|
user = "sascha.koenig";
|
||||||
|
port = 2022;
|
||||||
|
identityFile = "~/.ssh/sascha.koenig";
|
||||||
|
};
|
||||||
|
"github.com" = {
|
||||||
|
hostname = "github.com";
|
||||||
|
user = "m3tam3re";
|
||||||
|
port = 22;
|
||||||
|
identityFile = "~/.ssh/github";
|
||||||
|
};
|
||||||
|
"nikhil" = {
|
||||||
|
hostname = "91.99.176.80";
|
||||||
|
user = "nikhilmaddirala";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"code.m3ta.dev" = {
|
||||||
|
hostname = "code.m3ta.dev";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/gitea";
|
||||||
|
};
|
||||||
|
"git.az-gruppe.com" = {
|
||||||
|
hostname = "git.az-gruppe.com";
|
||||||
|
port = 2022;
|
||||||
|
user = "sascha.koenig";
|
||||||
|
identityFile = "~/.ssh/sascha.koenig";
|
||||||
|
};
|
||||||
|
"lkk-nix-1" = {
|
||||||
|
hostname = "89.58.10.189";
|
||||||
|
user = "lkk-admin";
|
||||||
|
identityFile = "~/.ssh/lkk-admin";
|
||||||
|
};
|
||||||
|
"m3-r1" = {
|
||||||
|
hostname = "202.61.226.110";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"lkk-prod-test" = {
|
||||||
|
hostname = "192.168.122.215";
|
||||||
|
user = "root";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"lkk-prod-1" = {
|
||||||
|
hostname = "192.168.0.24";
|
||||||
|
user = "root";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"lkk-prod-2" = {
|
||||||
|
hostname = "192.168.0.20";
|
||||||
|
user = "root";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-deck" = {
|
||||||
|
hostname = "192.168.178.193";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-kratos-vm" = {
|
||||||
|
hostname = "192.168.122.43";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-helios" = {
|
||||||
|
hostname = "192.168.178.210";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-ares" = {
|
||||||
|
hostname = "192.168.1.30";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-atlas" = {
|
||||||
|
hostname = "152.53.85.162";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-zelda" = {
|
||||||
|
hostname = "95.217.189.186";
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-skynet" = {
|
||||||
|
hostname = "m3-skynet";
|
||||||
|
user = "admin";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"m3-prox-1" = {
|
||||||
|
hostname = "192.168.1.110";
|
||||||
|
user = "root";
|
||||||
|
identityFile = "~/.ssh/m3tam3re";
|
||||||
|
};
|
||||||
|
"shp-old" = {
|
||||||
|
hostname = "95.217.3.250";
|
||||||
|
port = 2222;
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/self-host-playbook";
|
||||||
|
};
|
||||||
|
"shp-1" = {
|
||||||
|
hostname = "95.217.189.186";
|
||||||
|
port = 2222;
|
||||||
|
user = "m3tam3re";
|
||||||
|
identityFile = "~/.ssh/self-host-playbook";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# programs.zellij-ps = {
|
||||||
|
# enable = true;
|
||||||
|
# projectFolders = [
|
||||||
|
# "${config.home.homeDirectory}/p/c"
|
||||||
|
# "${config.home.homeDirectory}/p"
|
||||||
|
# "${config.home.homeDirectory}/.config"
|
||||||
|
# ];
|
||||||
|
# layout = ''
|
||||||
|
# layout {
|
||||||
|
# pane size=1 borderless=true {
|
||||||
|
# plugin location="zellij:tab-bar"
|
||||||
|
# }
|
||||||
|
# pane size="70%" command="nvim"
|
||||||
|
# pane split_direction="vertical" {
|
||||||
|
# pane
|
||||||
|
# pane command="unimatrix"
|
||||||
|
# }
|
||||||
|
# pane size=1 borderless=true {
|
||||||
|
# plugin location="zellij:status-bar"
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
}
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{
|
||||||
|
imports = [
|
||||||
|
../common
|
||||||
|
../features/cli
|
||||||
|
./home-server.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
features = {
|
||||||
|
cli = {
|
||||||
|
fish.enable = true;
|
||||||
|
fzf.enable = true;
|
||||||
|
nitch.enable = true;
|
||||||
|
secrets.enable = false;
|
||||||
|
starship.enable = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,17 +1,21 @@
|
|||||||
# hosts/m3-ares/home.nix — Host-specific home-manager overrides.
|
|
||||||
# TUXEDO laptop: eDP-1 + HDMI-A-1 external monitor.
|
|
||||||
# Everything else (shell, editors, gaming, media, theme, etc.) comes from
|
|
||||||
# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
|
|
||||||
{
|
{
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
with lib; {
|
with lib; {
|
||||||
|
imports = [
|
||||||
|
../common
|
||||||
|
./home.nix
|
||||||
|
../features/cli
|
||||||
|
../features/coding
|
||||||
|
../features/desktop
|
||||||
|
];
|
||||||
|
|
||||||
config = mkMerge [
|
config = mkMerge [
|
||||||
# ── XDG / MIME defaults ──
|
|
||||||
{
|
{
|
||||||
xdg = {
|
xdg = {
|
||||||
|
# TODO: better structure
|
||||||
enable = true;
|
enable = true;
|
||||||
configFile."mimeapps.list".force = true;
|
configFile."mimeapps.list".force = true;
|
||||||
mimeApps = {
|
mimeApps = {
|
||||||
@@ -34,10 +38,31 @@ with lib; {
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
features = {
|
||||||
|
cli = {
|
||||||
|
fish.enable = true;
|
||||||
|
nushell.enable = true;
|
||||||
|
fzf.enable = true;
|
||||||
|
nitch.enable = true;
|
||||||
|
secrets.enable = true;
|
||||||
|
starship.enable = true;
|
||||||
|
};
|
||||||
|
desktop = {
|
||||||
|
coding.enable = true;
|
||||||
|
crypto.enable = true;
|
||||||
|
gaming.enable = true;
|
||||||
|
hyprland.enable = true;
|
||||||
|
media.enable = true;
|
||||||
|
office.enable = true;
|
||||||
|
rofi.enable = true;
|
||||||
|
fonts.enable = true;
|
||||||
|
wayland.enable = true;
|
||||||
|
wallpapers = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
# ── Hyprland monitor layout ──
|
(mkIf config.features.desktop.hyprland.enable {
|
||||||
(mkIf config.desktop.wm.hyprland.enable {
|
|
||||||
wayland.windowManager.hyprland = {
|
wayland.windowManager.hyprland = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
@@ -50,7 +75,7 @@ with lib; {
|
|||||||
"1, monitor:eDP-1, default:true"
|
"1, monitor:eDP-1, default:true"
|
||||||
"2, monitor:eDP-1"
|
"2, monitor:eDP-1"
|
||||||
"3, monitor:eDP-1"
|
"3, monitor:eDP-1"
|
||||||
"4, monitor:HDMI-A-1"
|
"4, monitor:HDMI-A-1,"
|
||||||
"5, monitor:HDMI-A-1,border:false,rounding:false"
|
"5, monitor:HDMI-A-1,border:false,rounding:false"
|
||||||
"6, monitor:HDMI-A-1"
|
"6, monitor:HDMI-A-1"
|
||||||
];
|
];
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{
|
||||||
|
imports = [
|
||||||
|
../common
|
||||||
|
../features/cli
|
||||||
|
./home-server.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
features = {
|
||||||
|
cli = {
|
||||||
|
nushell.enable = true;
|
||||||
|
fzf.enable = true;
|
||||||
|
nitch.enable = true;
|
||||||
|
secrets.enable = false;
|
||||||
|
starship.enable = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,101 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
with lib; let
|
||||||
|
cfg = config.features.desktop.hyprland;
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
../common
|
||||||
|
./home.nix
|
||||||
|
../features/cli
|
||||||
|
../features/coding
|
||||||
|
../features/desktop
|
||||||
|
#./services/librechat.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
options.features.desktop.hyprland.enable =
|
||||||
|
mkEnableOption "enable Hyprland";
|
||||||
|
|
||||||
|
config = mkMerge [
|
||||||
|
# Base configuration
|
||||||
|
{
|
||||||
|
xdg = {
|
||||||
|
# TODO: better structure
|
||||||
|
enable = true;
|
||||||
|
configFile."mimeapps.list".force = true;
|
||||||
|
mimeApps = {
|
||||||
|
enable = true;
|
||||||
|
associations.added = {
|
||||||
|
"application/zip" = ["org.gnome.FileRoller.desktop"];
|
||||||
|
"application/csv" = ["calc.desktop"];
|
||||||
|
"application/pdf" = ["vivaldi-stable.desktop"];
|
||||||
|
"x-scheme-handler/http" = ["vivaldi-stable.desktop"];
|
||||||
|
"x-scheme-handler/https" = ["vivaldi-stable.desktop"];
|
||||||
|
};
|
||||||
|
defaultApplications = {
|
||||||
|
"application/zip" = ["org.gnome.FileRoller.desktop"];
|
||||||
|
"application/csv" = ["calc.desktop"];
|
||||||
|
"application/pdf" = ["vivaldi-stable.desktop"];
|
||||||
|
"application/md" = ["dev.zed.Zed.desktop"];
|
||||||
|
"application/text" = ["dev.zed.Zed.desktop"];
|
||||||
|
"x-scheme-handler/http" = ["vivaldi-stable.desktop"];
|
||||||
|
"x-scheme-handler/https" = ["vivaldi-stable.desktop"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
features = {
|
||||||
|
cli = {
|
||||||
|
fish.enable = true;
|
||||||
|
nushell.enable = true;
|
||||||
|
fzf.enable = true;
|
||||||
|
nitch.enable = true;
|
||||||
|
secrets.enable = true;
|
||||||
|
starship.enable = true;
|
||||||
|
};
|
||||||
|
desktop = {
|
||||||
|
coding.enable = true;
|
||||||
|
crypto.enable = false;
|
||||||
|
gaming.enable = false;
|
||||||
|
hyprland.enable = false;
|
||||||
|
media.enable = true;
|
||||||
|
office.enable = false;
|
||||||
|
rofi.enable = true;
|
||||||
|
fonts.enable = true;
|
||||||
|
wayland.enable = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
(mkIf cfg.enable {
|
||||||
|
wayland.windowManager.hyprland = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
monitor = [
|
||||||
|
"eDP-1,preferred,0x0,1.25"
|
||||||
|
"HDMI-A-1,preferred,2560x0,1"
|
||||||
|
];
|
||||||
|
workspace = [
|
||||||
|
"1, monitor:eDP-1, default:true"
|
||||||
|
"2, monitor:eDP-1"
|
||||||
|
"3, monitor:eDP-1"
|
||||||
|
"4, monitor:HDMI-A-1"
|
||||||
|
"5, monitor:HDMI-A-1,border:false,rounding:false"
|
||||||
|
"6, monitor:HDMI-A-1"
|
||||||
|
];
|
||||||
|
windowrule = [
|
||||||
|
"match:class dev.zed.Zed, workspace 1"
|
||||||
|
"match:class Msty, workspace 1"
|
||||||
|
"match:class ^(com.obsproject.Studio)$, workspace 2"
|
||||||
|
"match:class ^(brave-browser)$, workspace 4, opacity 1.0"
|
||||||
|
"match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
|
||||||
|
"match:class ^steam_app_\\d+$, fullscreen on"
|
||||||
|
"match:class ^steam_app_\\d+$, workspace 5"
|
||||||
|
"match:class ^steam_app_\\d+$, idle_inhibit focus"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
})
|
||||||
|
];
|
||||||
|
}
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
{
|
||||||
|
imports = [
|
||||||
|
../common
|
||||||
|
../features/cli
|
||||||
|
./home-server.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
features = {
|
||||||
|
cli = {
|
||||||
|
fish.enable = true;
|
||||||
|
fzf.enable = true;
|
||||||
|
nitch.enable = true;
|
||||||
|
secrets.enable = false;
|
||||||
|
starship.enable = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,21 +1,21 @@
|
|||||||
# hosts/m3-kratos/home.nix — Host-specific home-manager overrides.
|
|
||||||
# AMD desktop: dual 2560x1440@144 via DisplayPort.
|
|
||||||
# Everything else (shell, editors, gaming, media, theme, etc.) comes from
|
|
||||||
# m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
|
|
||||||
{
|
{
|
||||||
config,
|
config,
|
||||||
inputs,
|
|
||||||
lib,
|
lib,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
with lib; {
|
with lib; {
|
||||||
imports = [
|
imports = [
|
||||||
|
../common
|
||||||
|
./home.nix
|
||||||
|
../features/cli
|
||||||
|
../features/coding
|
||||||
|
../features/desktop
|
||||||
];
|
];
|
||||||
|
|
||||||
config = mkMerge [
|
config = mkMerge [
|
||||||
# ── XDG / MIME defaults ──
|
|
||||||
{
|
{
|
||||||
xdg = {
|
xdg = {
|
||||||
|
# TODO: better structure
|
||||||
enable = true;
|
enable = true;
|
||||||
configFile."mimeapps.list".force = true;
|
configFile."mimeapps.list".force = true;
|
||||||
mimeApps = {
|
mimeApps = {
|
||||||
@@ -38,10 +38,30 @@ with lib; {
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
features = {
|
||||||
|
cli = {
|
||||||
|
nushell.enable = true;
|
||||||
|
fzf.enable = true;
|
||||||
|
nitch.enable = true;
|
||||||
|
secrets.enable = true;
|
||||||
|
starship.enable = true;
|
||||||
|
};
|
||||||
|
desktop = {
|
||||||
|
crypto.enable = true;
|
||||||
|
coding.enable = true;
|
||||||
|
gaming.enable = true;
|
||||||
|
hyprland.enable = true;
|
||||||
|
media.enable = true;
|
||||||
|
office.enable = true;
|
||||||
|
rofi.enable = true;
|
||||||
|
fonts.enable = true;
|
||||||
|
wayland.enable = true;
|
||||||
|
wallpapers = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
# ── Hyprland monitor layout ──
|
(mkIf config.features.desktop.hyprland.enable {
|
||||||
(mkIf config.desktop.wm.hyprland.enable {
|
|
||||||
wayland.windowManager.hyprland = {
|
wayland.windowManager.hyprland = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = {
|
settings = {
|
||||||
@@ -58,8 +78,10 @@ with lib; {
|
|||||||
"6, monitor:DP-2"
|
"6, monitor:DP-2"
|
||||||
"7, monitor:DP-2"
|
"7, monitor:DP-2"
|
||||||
];
|
];
|
||||||
|
|
||||||
windowrule = [
|
windowrule = [
|
||||||
"match:class dev.zed.Zed, workspace 1"
|
"match:class dev.zed.Zed, workspace 1"
|
||||||
|
"match:class Msty, workspace 1"
|
||||||
"match:class ^(com.obsproject.Studio)$, workspace 2"
|
"match:class ^(com.obsproject.Studio)$, workspace 2"
|
||||||
"match:class ^(brave-browser)$, workspace 4, opacity 1.0"
|
"match:class ^(brave-browser)$, workspace 4, opacity 1.0"
|
||||||
"match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
|
"match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
|
||||||
Binary file not shown.
|
After Width: | Height: | Size: 3.3 MiB |
Binary file not shown.
|
After Width: | Height: | Size: 5.4 MiB |
Binary file not shown.
|
After Width: | Height: | Size: 6.7 MiB |
Binary file not shown.
|
After Width: | Height: | Size: 4.5 MiB |
Binary file not shown.
|
After Width: | Height: | Size: 4.3 MiB |
@@ -1,13 +1,5 @@
|
|||||||
# Common configuration for all hosts
|
# Common configuration for all hosts
|
||||||
{
|
{ config, pkgs, lib, inputs, outputs, ... }: {
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
lib,
|
|
||||||
inputs,
|
|
||||||
outputs,
|
|
||||||
system,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
imports = [
|
imports = [
|
||||||
./extraServices
|
./extraServices
|
||||||
./ports.nix
|
./ports.nix
|
||||||
@@ -15,14 +7,13 @@
|
|||||||
inputs.home-manager.nixosModules.home-manager
|
inputs.home-manager.nixosModules.home-manager
|
||||||
];
|
];
|
||||||
|
|
||||||
environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
|
environment.pathsToLink =
|
||||||
|
[ "/share/xdg-desktop-portal" "/share/applications" ];
|
||||||
|
|
||||||
home-manager = {
|
home-manager = {
|
||||||
useGlobalPkgs = true;
|
|
||||||
useUserPackages = true;
|
useUserPackages = true;
|
||||||
extraSpecialArgs = {
|
extraSpecialArgs = {
|
||||||
inputs = inputs // {agents = null;};
|
inherit inputs outputs;
|
||||||
inherit outputs system;
|
|
||||||
videoDrivers = config.services.xserver.videoDrivers or [ ];
|
videoDrivers = config.services.xserver.videoDrivers or [ ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
@@ -40,7 +31,7 @@
|
|||||||
|
|
||||||
inputs.m3ta-nixpkgs.overlays.default
|
inputs.m3ta-nixpkgs.overlays.default
|
||||||
inputs.m3ta-nixpkgs.overlays.modifications
|
inputs.m3ta-nixpkgs.overlays.modifications
|
||||||
(outputs.lib.mkLlmAgentsOverlay system)
|
|
||||||
# You can also add overlays exported from other flakes:
|
# You can also add overlays exported from other flakes:
|
||||||
# neovim-nightly-overlay.overlays.default
|
# neovim-nightly-overlay.overlays.default
|
||||||
|
|
||||||
@@ -74,8 +65,7 @@
|
|||||||
options = "--delete-older-than 30d";
|
options = "--delete-older-than 30d";
|
||||||
};
|
};
|
||||||
optimise.automatic = true;
|
optimise.automatic = true;
|
||||||
registry =
|
registry = (lib.mapAttrs (_: flake: { inherit flake; }))
|
||||||
(lib.mapAttrs (_: flake: {inherit flake;}))
|
|
||||||
((lib.filterAttrs (_: lib.isType "flake")) inputs);
|
((lib.filterAttrs (_: lib.isType "flake")) inputs);
|
||||||
nixPath = [ "/etc/nix/path" ];
|
nixPath = [ "/etc/nix/path" ];
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -14,6 +14,7 @@ in {
|
|||||||
xdg.portal = {
|
xdg.portal = {
|
||||||
# xdg desktop intergration (required for flatpak)
|
# xdg desktop intergration (required for flatpak)
|
||||||
enable = true;
|
enable = true;
|
||||||
|
wlr.enable = true;
|
||||||
extraPortals = with pkgs; [
|
extraPortals = with pkgs; [
|
||||||
xdg-desktop-portal-hyprland
|
xdg-desktop-portal-hyprland
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -21,7 +21,6 @@ in {
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
programs.virt-manager.enable = true;
|
programs.virt-manager.enable = true;
|
||||||
systemd.services.virt-secret-init-encryption.enable = false;
|
|
||||||
environment = {
|
environment = {
|
||||||
systemPackages = [pkgs.qemu];
|
systemPackages = [pkgs.qemu];
|
||||||
};
|
};
|
||||||
|
|||||||
+3
-11
@@ -18,10 +18,6 @@
|
|||||||
wireguard = 51820;
|
wireguard = 51820;
|
||||||
tailscale = 41641;
|
tailscale = 41641;
|
||||||
headscale = 3009;
|
headscale = 3009;
|
||||||
netbird-stun = 3478;
|
|
||||||
netbird-proxy = 8443;
|
|
||||||
netbird-metrics = 9090;
|
|
||||||
netbird-health = 9000;
|
|
||||||
|
|
||||||
# Containers & web apps
|
# Containers & web apps
|
||||||
gitea = 3030;
|
gitea = 3030;
|
||||||
@@ -37,13 +33,9 @@
|
|||||||
slash-nemoti = 3016;
|
slash-nemoti = 3016;
|
||||||
kestra = 3018;
|
kestra = 3018;
|
||||||
outline = 3019;
|
outline = 3019;
|
||||||
authentik = 3023;
|
pangolin = 3020;
|
||||||
tuwunel = 3024;
|
pangolin-api = 3021;
|
||||||
honcho = 3025;
|
pangolin-ws = 3022;
|
||||||
|
|
||||||
# Agent infrastructure
|
|
||||||
hermes-api = 8642;
|
|
||||||
hermes-dashboard = 9119;
|
|
||||||
|
|
||||||
# Home automation
|
# Home automation
|
||||||
homarr = 7575;
|
homarr = 7575;
|
||||||
|
|||||||
@@ -1,215 +1,11 @@
|
|||||||
# hosts/common/users/m3tam3re.nix — Central user definition with m3ta-home integration.
|
|
||||||
#
|
|
||||||
# This module:
|
|
||||||
# 1. Creates the m3tam3re NixOS user
|
|
||||||
# 2. Loads the m3ta-home profile system via mkHome
|
|
||||||
# 3. Sets per-host feature flags based on a host profile mapping
|
|
||||||
# 4. Imports per-host home.nix overrides (monitors, HW-specific config)
|
|
||||||
#
|
|
||||||
# To add a new host:
|
|
||||||
# 1. Add entry to hostProfiles below
|
|
||||||
# 2. Add feature flags in the hostFlags section
|
|
||||||
# 3. Create hosts/<hostname>/home.nix if the host needs overrides (monitors, etc.)
|
|
||||||
{
|
{
|
||||||
config,
|
config,
|
||||||
pkgs,
|
pkgs,
|
||||||
inputs,
|
inputs,
|
||||||
...
|
...
|
||||||
}: let
|
}: {
|
||||||
hostname = config.networking.hostName;
|
|
||||||
|
|
||||||
# ── Per-host profile mapping ──
|
|
||||||
# Determines which m3ta-home context and sets each host gets.
|
|
||||||
hostProfiles = {
|
|
||||||
# ── Desktop hosts ──
|
|
||||||
m3-ares = {
|
|
||||||
context = "desktop";
|
|
||||||
sets = ["coding" "gaming" "media"];
|
|
||||||
};
|
|
||||||
m3-kratos = {
|
|
||||||
context = "desktop";
|
|
||||||
sets = ["coding" "gaming" "media"];
|
|
||||||
};
|
|
||||||
m3-daedalus = {
|
|
||||||
context = "desktop";
|
|
||||||
sets = ["coding" "media"];
|
|
||||||
};
|
|
||||||
# ── Server hosts ──
|
|
||||||
m3-atlas = {
|
|
||||||
context = "server";
|
|
||||||
sets = [];
|
|
||||||
};
|
|
||||||
m3-helios = {
|
|
||||||
context = "server";
|
|
||||||
sets = [];
|
|
||||||
};
|
|
||||||
m3-hermes = {
|
|
||||||
context = "server";
|
|
||||||
sets = [];
|
|
||||||
};
|
|
||||||
m3-aether = {
|
|
||||||
context = "server";
|
|
||||||
sets = [];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
profile =
|
|
||||||
hostProfiles.${
|
|
||||||
hostname
|
|
||||||
} or {
|
|
||||||
context = "server";
|
|
||||||
sets = [];
|
|
||||||
};
|
|
||||||
m3ta-lib = inputs.m3ta-home.lib;
|
|
||||||
|
|
||||||
# Check if a per-host home.nix exists
|
|
||||||
hostHomeFile = ./../../${hostname}/home.nix;
|
|
||||||
hostHomeExists = builtins.pathExists hostHomeFile;
|
|
||||||
|
|
||||||
# ── Per-host feature flags ──
|
|
||||||
# These enable/disable specific m3ta-home modules per host.
|
|
||||||
hostFlags =
|
|
||||||
if hostname == "m3-ares" || hostname == "m3-kratos"
|
|
||||||
then {
|
|
||||||
# Full desktop workstation
|
|
||||||
base = {
|
|
||||||
shell = {
|
|
||||||
fish.enable = true;
|
|
||||||
nushell.enable = true;
|
|
||||||
starship.enable = true;
|
|
||||||
};
|
|
||||||
cliTools = {
|
|
||||||
fzf.enable = true;
|
|
||||||
nitch.enable = true;
|
|
||||||
television.enable = true;
|
|
||||||
};
|
|
||||||
secrets.enable = true;
|
|
||||||
};
|
|
||||||
desktop = {
|
|
||||||
wm = {
|
|
||||||
hyprland.enable = true;
|
|
||||||
rofi.enable = true;
|
|
||||||
wayland.enable = true;
|
|
||||||
dms.enable = true;
|
|
||||||
};
|
|
||||||
apps = {
|
|
||||||
crypto.enable = true;
|
|
||||||
obsidian.enable = true;
|
|
||||||
office.enable = true;
|
|
||||||
};
|
|
||||||
theme = {
|
|
||||||
fonts.enable = true;
|
|
||||||
wallpapers.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
coding = {
|
|
||||||
editors = {
|
|
||||||
neovim.enable = true;
|
|
||||||
zed.enable = true;
|
|
||||||
};
|
|
||||||
lsp.enable = true;
|
|
||||||
packages.enable = true;
|
|
||||||
languages = {
|
|
||||||
python.enable = true;
|
|
||||||
javascript.enable = true;
|
|
||||||
rustToolchain.enable = true;
|
|
||||||
go.enable = true;
|
|
||||||
typescript.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
profiles.gaming = {
|
|
||||||
steam.enable = true;
|
|
||||||
gamescope.enable = true;
|
|
||||||
};
|
|
||||||
profiles.media = {
|
|
||||||
obs.enable = true;
|
|
||||||
ffmpeg.enable = true;
|
|
||||||
kdenlive.enable = true;
|
|
||||||
ytDlp.enable = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
else if hostname == "m3-daedalus"
|
|
||||||
then {
|
|
||||||
# Portable laptop — desktop without gaming, no Hyprland
|
|
||||||
base = {
|
|
||||||
shell = {
|
|
||||||
fish.enable = true;
|
|
||||||
nushell.enable = true;
|
|
||||||
starship.enable = true;
|
|
||||||
};
|
|
||||||
cliTools = {
|
|
||||||
fzf.enable = true;
|
|
||||||
nitch.enable = true;
|
|
||||||
television.enable = true;
|
|
||||||
};
|
|
||||||
secrets.enable = true;
|
|
||||||
};
|
|
||||||
desktop = {
|
|
||||||
wm = {
|
|
||||||
hyprland.enable = false;
|
|
||||||
wayland.enable = false;
|
|
||||||
};
|
|
||||||
apps = {
|
|
||||||
crypto.enable = false;
|
|
||||||
obsidian.enable = true;
|
|
||||||
office.enable = false;
|
|
||||||
};
|
|
||||||
theme = {
|
|
||||||
fonts.enable = true;
|
|
||||||
wallpapers.enable = false;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
coding = {
|
|
||||||
editors = {
|
|
||||||
neovim.enable = true;
|
|
||||||
zed.enable = true;
|
|
||||||
};
|
|
||||||
lsp.enable = true;
|
|
||||||
packages.enable = true;
|
|
||||||
languages = {
|
|
||||||
python.enable = true;
|
|
||||||
javascript.enable = true;
|
|
||||||
rustToolchain.enable = true;
|
|
||||||
go.enable = true;
|
|
||||||
typescript.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
profiles.media = {
|
|
||||||
ytDlp.enable = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
else if hostname == "m3-atlas"
|
|
||||||
then {
|
|
||||||
# Primary server — coding capable
|
|
||||||
base = {
|
|
||||||
shell = {
|
|
||||||
nushell.enable = true;
|
|
||||||
starship.enable = true;
|
|
||||||
};
|
|
||||||
cliTools = {
|
|
||||||
fzf.enable = true;
|
|
||||||
nitch.enable = true;
|
|
||||||
zellij.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
coding.editors.neovim.enable = true;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
# m3-helios, m3-hermes, m3-aether — minimal server
|
|
||||||
base = {
|
|
||||||
shell = {
|
|
||||||
fish.enable = true;
|
|
||||||
starship.enable = true;
|
|
||||||
};
|
|
||||||
cliTools = {
|
|
||||||
fzf.enable = true;
|
|
||||||
nitch.enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in {
|
|
||||||
# ── NixOS user definition ──
|
|
||||||
users.users.m3tam3re = {
|
users.users.m3tam3re = {
|
||||||
|
#initialHashedPassword = "$y$j9T$IoChbWGYRh.rKfmm0G86X0$bYgsWqDRkvX.EBzJTX.Z0RsTlwspADpvEF3QErNyCMC";
|
||||||
password = "12345";
|
password = "12345";
|
||||||
isNormalUser = true;
|
isNormalUser = true;
|
||||||
description = "m3tam3re";
|
description = "m3tam3re";
|
||||||
@@ -228,30 +24,9 @@ in {
|
|||||||
];
|
];
|
||||||
openssh.authorizedKeys.keys = [
|
openssh.authorizedKeys.keys = [
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@m3-nix"
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@m3-nix"
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZcjCKl0DRuOUOMXbM0GKY5JjvmyFpVZ/tRlTKWu/zp razr"
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml sascha.koenig@azintec.com"
|
|
||||||
];
|
];
|
||||||
packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
|
packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
|
||||||
};
|
};
|
||||||
|
home-manager.users.m3tam3re =
|
||||||
# ── Home-Manager configuration via m3ta-home ──
|
import ../../../home/m3tam3re/${config.networking.hostName}.nix;
|
||||||
home-manager.users.m3tam3re = {
|
|
||||||
imports =
|
|
||||||
[
|
|
||||||
# Load m3ta-home composition engine
|
|
||||||
(m3ta-lib.mkHome {
|
|
||||||
user = "m3tam3re";
|
|
||||||
identity = "private";
|
|
||||||
inherit (profile) context sets;
|
|
||||||
})
|
|
||||||
# Per-host feature flags
|
|
||||||
hostFlags
|
|
||||||
]
|
|
||||||
# Per-host home.nix (Hyprland monitors, XDG/MIME, HW-specific overrides)
|
|
||||||
++ (
|
|
||||||
if hostHomeExists
|
|
||||||
then [hostHomeFile]
|
|
||||||
else []
|
|
||||||
);
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,15 +1,11 @@
|
|||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
# and may be overwritten by future invocations. Please make changes
|
# and may be overwritten by future invocations. Please make changes
|
||||||
# to /etc/nixos/configuration.nix instead.
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
config,
|
imports =
|
||||||
lib,
|
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||||
pkgs,
|
|
||||||
modulesPath,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
imports = [
|
|
||||||
(modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||||
|
|||||||
@@ -2,4 +2,10 @@
|
|||||||
imports = [
|
imports = [
|
||||||
./cloud-init.nix
|
./cloud-init.nix
|
||||||
];
|
];
|
||||||
|
systemd.sleep.extraConfig = ''
|
||||||
|
AllowSuspend=no
|
||||||
|
AllowHibernation=no
|
||||||
|
AllowHybridSleep=no
|
||||||
|
AllowSuspendThenHibernate=no
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -44,7 +44,7 @@
|
|||||||
|
|
||||||
extraServices = {
|
extraServices = {
|
||||||
flatpak.enable = true;
|
flatpak.enable = true;
|
||||||
ollama.enable = false;
|
ollama.enable = true;
|
||||||
podman.enable = true;
|
podman.enable = true;
|
||||||
virtualisation.enable = true;
|
virtualisation.enable = true;
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -1,15 +1,8 @@
|
|||||||
{
|
{
|
||||||
config,
|
config,
|
||||||
pkgs,
|
pkgs,
|
||||||
inputs,
|
|
||||||
...
|
...
|
||||||
}: {
|
}: {
|
||||||
# Workaround for tuxedo-drivers module bug in unstable (nixpkgs#480391)
|
|
||||||
# The unstable module has a type error - use stable module until fix propagates
|
|
||||||
# disabledModules = [ "hardware/tuxedo-drivers.nix" ];
|
|
||||||
# imports =
|
|
||||||
# [ "${inputs.nixpkgs-stable}/nixos/modules/hardware/tuxedo-drivers.nix" ];
|
|
||||||
|
|
||||||
hardware.nvidia = {
|
hardware.nvidia = {
|
||||||
prime = {
|
prime = {
|
||||||
offload.enable = false;
|
offload.enable = false;
|
||||||
@@ -43,7 +36,9 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [tuxedo-backlight];
|
environment.systemPackages = with pkgs; [
|
||||||
|
tuxedo-backlight
|
||||||
|
];
|
||||||
security.sudo.extraRules = [
|
security.sudo.extraRules = [
|
||||||
{
|
{
|
||||||
users = ["@wheel"];
|
users = ["@wheel"];
|
||||||
|
|||||||
@@ -33,27 +33,11 @@
|
|||||||
file = ../../secrets/exa-key.age;
|
file = ../../secrets/exa-key.age;
|
||||||
owner = "m3tam3re";
|
owner = "m3tam3re";
|
||||||
};
|
};
|
||||||
outline-key = {
|
|
||||||
file = ../../secrets/outline-key.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
basecamp-client-id = {
|
|
||||||
file = ../../secrets/basecamp-client-id.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
basecamp-client-secret = {
|
|
||||||
file = ../../secrets/basecamp-client-secret.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
tailscale-key.file = ../../secrets/tailscale-key.age;
|
tailscale-key.file = ../../secrets/tailscale-key.age;
|
||||||
m3tam3re-secrets = {
|
m3tam3re-secrets = {
|
||||||
file = ../../secrets/m3tam3re-secrets.age;
|
file = ../../secrets/m3tam3re-secrets.age;
|
||||||
owner = "m3tam3re";
|
owner = "m3tam3re";
|
||||||
};
|
};
|
||||||
hermes-env = {
|
|
||||||
file = ../../secrets/hermes-env.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,36 +1,20 @@
|
|||||||
{pkgs, ...}: {
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./containers
|
./containers
|
||||||
./greetd.nix
|
|
||||||
./hermes-agent.nix
|
|
||||||
./netbird.nix
|
|
||||||
#./n8n.nix
|
#./n8n.nix
|
||||||
./mem0.nix
|
|
||||||
./postgres.nix
|
./postgres.nix
|
||||||
./restic.nix
|
./restic.nix
|
||||||
./sound.nix
|
./sound.nix
|
||||||
|
./tailscale.nix
|
||||||
./udev.nix
|
./udev.nix
|
||||||
./wireguard.nix
|
./wireguard.nix
|
||||||
];
|
];
|
||||||
# console.useXkbConfig = true;
|
|
||||||
|
|
||||||
# services.xserver.xkb = {
|
|
||||||
# layout = "de,us";
|
|
||||||
# options = "ctrl:nocaps";
|
|
||||||
# };
|
|
||||||
|
|
||||||
# optional, falls du auch die TTY-Konsole deutsch willst:
|
|
||||||
services = {
|
services = {
|
||||||
hypridle.enable = true;
|
hypridle.enable = true;
|
||||||
espanso = {
|
|
||||||
enable = true;
|
|
||||||
package = pkgs.espanso-wayland;
|
|
||||||
};
|
|
||||||
printing.enable = true;
|
printing.enable = true;
|
||||||
gvfs.enable = true;
|
gvfs.enable = true;
|
||||||
trezord.enable = true;
|
trezord.enable = true;
|
||||||
gnome.gnome-keyring.enable = true;
|
gnome.gnome-keyring.enable = true;
|
||||||
qdrant.enable = true;
|
|
||||||
# qdrant = {
|
# qdrant = {
|
||||||
# enable = true;
|
# enable = true;
|
||||||
# settings = {
|
# settings = {
|
||||||
@@ -51,4 +35,10 @@
|
|||||||
};
|
};
|
||||||
displayManager.gdm.enable = true;
|
displayManager.gdm.enable = true;
|
||||||
};
|
};
|
||||||
|
systemd.sleep.extraConfig = ''
|
||||||
|
AllowSuspend=no
|
||||||
|
AllowHibernation=no
|
||||||
|
AllowHybridSleep=no
|
||||||
|
AllowSuspendThenHibernate=no
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,38 +0,0 @@
|
|||||||
# greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
|
|
||||||
# Uses tuigreet as the greeter, launching Hyprland after authentication.
|
|
||||||
{
|
|
||||||
pkgs,
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
tuigreet = "${lib.getExe pkgs.tuigreet}";
|
|
||||||
# Use start-hyprland wrapper to avoid Hyprland startup warnings
|
|
||||||
# withUWSM=true is set in programs.nix; start-hyprland handles this correctly
|
|
||||||
hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
|
|
||||||
in {
|
|
||||||
services.greetd = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
default_session = {
|
|
||||||
user = "greeter";
|
|
||||||
# Minimal config: verified supported flags only
|
|
||||||
# The --time and --remember are tested; power commands omitted
|
|
||||||
# to avoid potential quoting/parsing issues
|
|
||||||
command = builtins.concatStringsSep " " [
|
|
||||||
tuigreet
|
|
||||||
"--time"
|
|
||||||
"--remember"
|
|
||||||
"--asterisks"
|
|
||||||
"--cmd ${hyprlandCmd}"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Required for --remember to persist username between logins
|
|
||||||
systemd.tmpfiles.rules = [
|
|
||||||
"d /var/cache/tuigreet 0755 greeter greeter - -"
|
|
||||||
];
|
|
||||||
}
|
|
||||||
@@ -1,195 +0,0 @@
|
|||||||
{config, ...}: let
|
|
||||||
# Default ElevenLabs voice: Bella (German-capable female)
|
|
||||||
elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
|
|
||||||
in {
|
|
||||||
services.hermes-agent = {
|
|
||||||
enable = true;
|
|
||||||
addToSystemPackages = true;
|
|
||||||
|
|
||||||
# Secrets via agenix
|
|
||||||
environmentFiles = [config.age.secrets."hermes-env".path];
|
|
||||||
|
|
||||||
# Non-secret environment variables
|
|
||||||
environment = {
|
|
||||||
GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
# ── Model ──────────────────────────────────────────────────────────
|
|
||||||
model = {
|
|
||||||
default = "gpt-5.5";
|
|
||||||
provider = "openai-codex";
|
|
||||||
};
|
|
||||||
|
|
||||||
fallback_providers = [
|
|
||||||
{
|
|
||||||
provider = "zai";
|
|
||||||
model = "glm-5.1";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
provider = "minimax";
|
|
||||||
model = "MiniMax-M2.7";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
credential_pool_strategies = {
|
|
||||||
zai = "fill_first";
|
|
||||||
};
|
|
||||||
|
|
||||||
toolsets = ["all"];
|
|
||||||
|
|
||||||
# ── Agent ──────────────────────────────────────────────────────────
|
|
||||||
agent = {
|
|
||||||
max_turns = 90;
|
|
||||||
gateway_timeout = 1800;
|
|
||||||
tool_use_enforcement = "auto";
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Terminal ───────────────────────────────────────────────────────
|
|
||||||
terminal = {
|
|
||||||
backend = "ssh";
|
|
||||||
modal_mode = "auto";
|
|
||||||
cwd = ".";
|
|
||||||
timeout = 180;
|
|
||||||
persistent_shell = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Browser ────────────────────────────────────────────────────────
|
|
||||||
browser = {
|
|
||||||
inactivity_timeout = 120;
|
|
||||||
command_timeout = 30;
|
|
||||||
cloud_provider = "local";
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Checkpoints / Compression ──────────────────────────────────────
|
|
||||||
checkpoints = {
|
|
||||||
enabled = true;
|
|
||||||
max_snapshots = 50;
|
|
||||||
};
|
|
||||||
|
|
||||||
file_read_max_chars = 100000;
|
|
||||||
|
|
||||||
compression = {
|
|
||||||
enabled = true;
|
|
||||||
threshold = 0.5;
|
|
||||||
target_ratio = 0.2;
|
|
||||||
protect_last_n = 20;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Display ────────────────────────────────────────────────────────
|
|
||||||
display = {
|
|
||||||
compact = false;
|
|
||||||
personality = "kawaii";
|
|
||||||
resume_display = "full";
|
|
||||||
busy_input_mode = "interrupt";
|
|
||||||
inline_diffs = true;
|
|
||||||
skin = "default";
|
|
||||||
tool_progress = "all";
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── TTS / STT / Voice ──────────────────────────────────────────────
|
|
||||||
tts = {
|
|
||||||
provider = "elevenlabs";
|
|
||||||
elevenlabs = {
|
|
||||||
voice_id = elevenlabsVoiceId;
|
|
||||||
model_id = "eleven_multilingual_v2";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
stt = {
|
|
||||||
enabled = true;
|
|
||||||
provider = "local";
|
|
||||||
local = {model = "base";};
|
|
||||||
};
|
|
||||||
|
|
||||||
voice = {
|
|
||||||
record_key = "ctrl+b";
|
|
||||||
max_recording_seconds = 120;
|
|
||||||
silence_threshold = 200;
|
|
||||||
silence_duration = 3.0;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Memory ─────────────────────────────────────────────────────────
|
|
||||||
memory = {
|
|
||||||
memory_enabled = true;
|
|
||||||
user_profile_enabled = true;
|
|
||||||
memory_char_limit = 2200;
|
|
||||||
user_char_limit = 1375;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Delegation ─────────────────────────────────────────────────────
|
|
||||||
delegation = {
|
|
||||||
max_iterations = 50;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Discord ────────────────────────────────────────────────────────
|
|
||||||
discord = {
|
|
||||||
require_mention = true;
|
|
||||||
auto_thread = true;
|
|
||||||
reactions = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Approvals / Security ───────────────────────────────────────────
|
|
||||||
approvals = {
|
|
||||||
mode = "manual";
|
|
||||||
timeout = 60;
|
|
||||||
};
|
|
||||||
|
|
||||||
security = {
|
|
||||||
redact_secrets = true;
|
|
||||||
tirith_enabled = true;
|
|
||||||
tirith_fail_open = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Cron / Session ─────────────────────────────────────────────────
|
|
||||||
cron = {wrap_response = true;};
|
|
||||||
|
|
||||||
session_reset = {
|
|
||||||
mode = "both";
|
|
||||||
idle_minutes = 1440;
|
|
||||||
at_hour = 4;
|
|
||||||
};
|
|
||||||
|
|
||||||
# ── Web ────────────────────────────────────────────────────────────
|
|
||||||
web = {backend = "exa";};
|
|
||||||
|
|
||||||
# ── Platform Toolsets ──────────────────────────────────────────────
|
|
||||||
platform_toolsets = {
|
|
||||||
cli = [
|
|
||||||
"browser"
|
|
||||||
"clarify"
|
|
||||||
"code_execution"
|
|
||||||
"cronjob"
|
|
||||||
"delegation"
|
|
||||||
"file"
|
|
||||||
"image_gen"
|
|
||||||
"memory"
|
|
||||||
"session_search"
|
|
||||||
"skills"
|
|
||||||
"terminal"
|
|
||||||
"todo"
|
|
||||||
"tts"
|
|
||||||
"vision"
|
|
||||||
"web"
|
|
||||||
];
|
|
||||||
telegram = [
|
|
||||||
"browser"
|
|
||||||
"clarify"
|
|
||||||
"code_execution"
|
|
||||||
"cronjob"
|
|
||||||
"delegation"
|
|
||||||
"file"
|
|
||||||
"image_gen"
|
|
||||||
"memory"
|
|
||||||
"session_search"
|
|
||||||
"skills"
|
|
||||||
"terminal"
|
|
||||||
"todo"
|
|
||||||
"tts"
|
|
||||||
"vision"
|
|
||||||
"web"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
{
|
|
||||||
m3ta.mem0 = {
|
|
||||||
enable = true;
|
|
||||||
port = 8000;
|
|
||||||
host = "127.0.0.1";
|
|
||||||
|
|
||||||
# LLM Configuration
|
|
||||||
llm = {
|
|
||||||
provider = "openai";
|
|
||||||
apiKeyFile = "/var/lib/mem0/openai-api-key-1"; # Use agenix or sops-nix
|
|
||||||
};
|
|
||||||
|
|
||||||
# Vector Storage Configuration
|
|
||||||
vectorStore = {
|
|
||||||
provider = "qdrant"; # or "chroma", "pinecone", etc.
|
|
||||||
config = {
|
|
||||||
host = "localhost";
|
|
||||||
port = 6333;
|
|
||||||
collection_name = "mem0_alice";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
{pkgs, ...}: {
|
|
||||||
services.netbird.enable = true;
|
|
||||||
environment.systemPackages = with pkgs; [netbird-ui];
|
|
||||||
|
|
||||||
systemd.services.netbird = {
|
|
||||||
environment = {
|
|
||||||
NB_DISABLE_SSH_CONFIG = "true";
|
|
||||||
};
|
|
||||||
path = [
|
|
||||||
pkgs.shadow
|
|
||||||
pkgs.util-linux
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
programs.ssh.extraConfig = ''
|
|
||||||
Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
|
|
||||||
PreferredAuthentications password,publickey,keyboard-interactive
|
|
||||||
PasswordAuthentication yes
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
BatchMode no
|
|
||||||
ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
|
|
||||||
StrictHostKeyChecking no
|
|
||||||
UserKnownHostsFile /dev/null
|
|
||||||
CheckHostIP no
|
|
||||||
LogLevel ERROR
|
|
||||||
'';
|
|
||||||
|
|
||||||
networking.firewall.checkReversePath = "loose";
|
|
||||||
}
|
|
||||||
@@ -1,4 +1,7 @@
|
|||||||
{pkgs, ...}: {
|
{
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.postgresql_17;
|
package = pkgs.postgresql_17;
|
||||||
|
|||||||
@@ -0,0 +1,11 @@
|
|||||||
|
{config, ...}: {
|
||||||
|
services.tailscale = {
|
||||||
|
enable = false;
|
||||||
|
authKeyFile = config.age.secrets.tailscale-key.path;
|
||||||
|
useRoutingFeatures = "both";
|
||||||
|
extraUpFlags = [
|
||||||
|
"--login-server=https://va.m3tam3re.com"
|
||||||
|
"--accept-routes"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -2,8 +2,7 @@
|
|||||||
services.udev.extraRules = ''
|
services.udev.extraRules = ''
|
||||||
SUBSYSTEM=="usb", MODE="0666"
|
SUBSYSTEM=="usb", MODE="0666"
|
||||||
SUBSYSTEM=="leds", KERNEL=="rgb:kbd_backlight*", ACTION=="add", RUN+="${pkgs.coreutils}/bin/chmod a+w /sys/class/leds/%k/multi_intensity"
|
SUBSYSTEM=="leds", KERNEL=="rgb:kbd_backlight*", ACTION=="add", RUN+="${pkgs.coreutils}/bin/chmod a+w /sys/class/leds/%k/multi_intensity"
|
||||||
KERNEL=="uinput", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput"
|
'';
|
||||||
KERNEL=="event*", SUBSYSTEM=="input", MODE="0660", GROUP="input" '';
|
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
zsa-udev-rules
|
zsa-udev-rules
|
||||||
];
|
];
|
||||||
|
|||||||
@@ -59,11 +59,7 @@
|
|||||||
|
|
||||||
# List packages installed in system profile. To search, run:
|
# List packages installed in system profile. To search, run:
|
||||||
# $ nix search wget
|
# $ nix search wget
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [neovim git];
|
||||||
neovim
|
|
||||||
git
|
|
||||||
ghostty.terminfo
|
|
||||||
];
|
|
||||||
|
|
||||||
# Some programs need SUID wrappers, can be configured further or are
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
# started in user sessions.
|
# started in user sessions.
|
||||||
|
|||||||
+25
-58
@@ -1,84 +1,51 @@
|
|||||||
{
|
{
|
||||||
age = {
|
age = {
|
||||||
secrets = {
|
secrets = {
|
||||||
baserow-env = {file = ../../secrets/baserow-env.age;};
|
baserow-env = {
|
||||||
ghost-env = {file = ../../secrets/ghost-env.age;};
|
file = ../../secrets/baserow-env.age;
|
||||||
honcho-selfhost-db-password = {
|
};
|
||||||
file = ../../secrets/honcho-selfhost-db-password.age;
|
ghost-env = {
|
||||||
owner = "postgres";
|
file = ../../secrets/ghost-env.age;
|
||||||
group = "postgres";
|
|
||||||
mode = "400";
|
|
||||||
};
|
};
|
||||||
honcho-selfhost-env = {file = ../../secrets/honcho-selfhost-env.age;};
|
|
||||||
honcho-selfhost-jwt-secret = {file = ../../secrets/honcho-selfhost-jwt-secret.age;};
|
|
||||||
kestra-config = {
|
kestra-config = {
|
||||||
file = ../../secrets/kestra-config.age;
|
file = ../../secrets/kestra-config.age;
|
||||||
mode = "644";
|
mode = "644";
|
||||||
};
|
};
|
||||||
kestra-env = {file = ../../secrets/kestra-env.age;};
|
kestra-env = {
|
||||||
littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
|
file = ../../secrets/kestra-env.age;
|
||||||
minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
|
|
||||||
rustfs-access-key = {file = ../../secrets/rustfs-access-key.age;};
|
|
||||||
rustfs-secret-key = {file = ../../secrets/rustfs-secret-key.age;};
|
|
||||||
n8n-env = {file = ../../secrets/n8n-env.age;};
|
|
||||||
netbird-auth-secret = {
|
|
||||||
file = ../../secrets/netbird-auth-secret.age;
|
|
||||||
};
|
};
|
||||||
netbird-db-password = {
|
littlelink-m3tam3re = {
|
||||||
file = ../../secrets/netbird-db-password.age;
|
file = ../../secrets/littlelink-m3tam3re.age;
|
||||||
};
|
};
|
||||||
netbird-encryption-key = {
|
minio-root-cred = {
|
||||||
file = ../../secrets/netbird-encryption-key.age;
|
file = ../../secrets/minio-root-cred.age;
|
||||||
};
|
};
|
||||||
netbird-dashboard-env = {
|
n8n-env = {
|
||||||
file = ../../secrets/netbird-dashboard-env.age;
|
file = ../../secrets/n8n-env.age;
|
||||||
};
|
};
|
||||||
netbird-server-env = {
|
paperless-key = {
|
||||||
file = ../../secrets/netbird-server-env.age;
|
file = ../../secrets/paperless-key.age;
|
||||||
};
|
};
|
||||||
netbird-proxy-env = {
|
restreamer-env = {
|
||||||
file = ../../secrets/netbird-proxy-env.age;
|
file = ../../secrets/restreamer-env.age;
|
||||||
};
|
};
|
||||||
paperless-key = {file = ../../secrets/paperless-key.age;};
|
searx = {
|
||||||
restreamer-env = {file = ../../secrets/restreamer-env.age;};
|
file = ../../secrets/searx.age;
|
||||||
searx = {file = ../../secrets/searx.age;};
|
};
|
||||||
tailscale-key = {file = ../../secrets/tailscale-key.age;};
|
tailscale-key = {
|
||||||
tuwunel-registration-token = {
|
file = ../../secrets/tailscale-key.age;
|
||||||
file = ../../secrets/tuwunel-registration-token.age;
|
|
||||||
owner = "tuwunel";
|
|
||||||
};
|
};
|
||||||
traefik = {
|
traefik = {
|
||||||
file = ../../secrets/traefik.age;
|
file = ../../secrets/traefik.age;
|
||||||
owner = "traefik";
|
owner = "traefik";
|
||||||
};
|
};
|
||||||
vaultwarden-env = {file = ../../secrets/vaultwarden-env.age;};
|
vaultwarden-env = {
|
||||||
|
file = ../../secrets/vaultwarden-env.age;
|
||||||
|
};
|
||||||
m3tam3re-secrets = {
|
m3tam3re-secrets = {
|
||||||
file = ../../secrets/m3tam3re-secrets.age;
|
file = ../../secrets/m3tam3re-secrets.age;
|
||||||
owner = "m3tam3re";
|
owner = "m3tam3re";
|
||||||
};
|
};
|
||||||
gitea-runner-token = {
|
|
||||||
file = ../../secrets/gitea-runner-token.age;
|
|
||||||
mode = "600";
|
|
||||||
owner = "gitea-runner";
|
|
||||||
group = "gitea-runner";
|
|
||||||
};
|
|
||||||
ref-key = {
|
|
||||||
file = ../../secrets/ref-key.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
exa-key = {
|
|
||||||
file = ../../secrets/exa-key.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
basecamp-client-id = {
|
|
||||||
file = ../../secrets/basecamp-client-id.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
basecamp-client-secret = {
|
|
||||||
file = ../../secrets/basecamp-client-secret.age;
|
|
||||||
owner = "m3tam3re";
|
|
||||||
};
|
|
||||||
authentik-env = {file = ../../secrets/authentik-env.age;};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,67 +0,0 @@
|
|||||||
{config, ...}: let
|
|
||||||
image = "ghcr.io/goauthentik/server:2026.2.0";
|
|
||||||
|
|
||||||
serverIp = "10.89.0.22";
|
|
||||||
workerIp = "10.89.0.23";
|
|
||||||
|
|
||||||
postgresHost = "10.89.0.1";
|
|
||||||
postgresPort = config.m3ta.ports.get "postgres";
|
|
||||||
authentikPort = config.m3ta.ports.get "authentik";
|
|
||||||
|
|
||||||
sharedEnv = {
|
|
||||||
AUTHENTIK_POSTGRESQL__HOST = postgresHost;
|
|
||||||
AUTHENTIK_POSTGRESQL__PORT = toString postgresPort;
|
|
||||||
AUTHENTIK_POSTGRESQL__USER = "authentik";
|
|
||||||
AUTHENTIK_POSTGRESQL__NAME = "authentik";
|
|
||||||
};
|
|
||||||
in {
|
|
||||||
virtualisation.oci-containers.containers = {
|
|
||||||
"authentik-server" = {
|
|
||||||
inherit image;
|
|
||||||
cmd = ["server"];
|
|
||||||
environment = sharedEnv;
|
|
||||||
environmentFiles = [config.age.secrets.authentik-env.path];
|
|
||||||
ports = ["127.0.0.1:${toString authentikPort}:9000"];
|
|
||||||
volumes = [
|
|
||||||
"authentik_media:/media"
|
|
||||||
"authentik_templates:/templates"
|
|
||||||
];
|
|
||||||
extraOptions = [
|
|
||||||
"--add-host=postgres:${postgresHost}"
|
|
||||||
"--ip=${serverIp}"
|
|
||||||
"--network=web"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
"authentik-worker" = {
|
|
||||||
inherit image;
|
|
||||||
cmd = ["worker"];
|
|
||||||
user = "root";
|
|
||||||
environment = sharedEnv;
|
|
||||||
environmentFiles = [config.age.secrets.authentik-env.path];
|
|
||||||
volumes = [
|
|
||||||
"authentik_media:/media"
|
|
||||||
"authentik_certs:/certs"
|
|
||||||
"authentik_templates:/templates"
|
|
||||||
];
|
|
||||||
extraOptions = [
|
|
||||||
"--add-host=postgres:${postgresHost}"
|
|
||||||
"--ip=${workerIp}"
|
|
||||||
"--network=web"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.traefik.dynamicConfigOptions.http = {
|
|
||||||
services.authentik.loadBalancer.servers = [
|
|
||||||
{url = "http://localhost:${toString authentikPort}/";}
|
|
||||||
];
|
|
||||||
|
|
||||||
routers.authentik = {
|
|
||||||
rule = "Host(`auth.m3ta.dev`)";
|
|
||||||
tls = {certResolver = "godaddy";};
|
|
||||||
service = "authentik";
|
|
||||||
entrypoints = "websecure";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -2,17 +2,14 @@
|
|||||||
imports = [
|
imports = [
|
||||||
./baserow.nix
|
./baserow.nix
|
||||||
./ghost.nix
|
./ghost.nix
|
||||||
./honcho.nix
|
|
||||||
./kestra.nix
|
./kestra.nix
|
||||||
./littlelink.nix
|
./littlelink.nix
|
||||||
./matomo.nix
|
./matomo.nix
|
||||||
./netbird.nix
|
|
||||||
# ./n8n.nix
|
# ./n8n.nix
|
||||||
# ./pangolin.nix
|
# ./pangolin.nix
|
||||||
./restreamer.nix
|
./restreamer.nix
|
||||||
./slash.nix
|
./slash.nix
|
||||||
./slash-nemoti.nix
|
./slash-nemoti.nix
|
||||||
./authentik.nix
|
|
||||||
];
|
];
|
||||||
system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
|
system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
|
||||||
if ! /run/current-system/sw/bin/podman network exists web; then
|
if ! /run/current-system/sw/bin/podman network exists web; then
|
||||||
|
|||||||
@@ -1,209 +0,0 @@
|
|||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
serviceName = "honcho";
|
|
||||||
image = "ghcr.io/plastic-labs/honcho:v3.0.6";
|
|
||||||
|
|
||||||
apiIp = "10.89.0.24";
|
|
||||||
deriverIp = "10.89.0.25";
|
|
||||||
redisIp = "10.89.0.26";
|
|
||||||
|
|
||||||
postgresHost = "10.89.0.1";
|
|
||||||
postgresPort = config.m3ta.ports.get "postgres";
|
|
||||||
honchoPort = config.m3ta.ports.get "honcho";
|
|
||||||
|
|
||||||
# m3-atlas Netbird mesh address, discovered from `netbird status -d`.
|
|
||||||
# Binding the host port here keeps self-hosted Honcho off public interfaces.
|
|
||||||
netbirdBindAddress = "100.81.142.56";
|
|
||||||
netbirdRange = "100.64.0.0/16";
|
|
||||||
|
|
||||||
dbName = "honcho";
|
|
||||||
dbUser = "honcho";
|
|
||||||
redisName = "${serviceName}-redis";
|
|
||||||
runtimeDirectory = "/run/${serviceName}";
|
|
||||||
runtimeEnvFile = "${runtimeDirectory}/env";
|
|
||||||
|
|
||||||
# Keep auth disabled for the first deployment because Honcho clients need
|
|
||||||
# generated JWTs. The JWT secret is still provisioned so enabling auth later is
|
|
||||||
# a one-line change here plus client token generation.
|
|
||||||
authUseAuth = false;
|
|
||||||
|
|
||||||
sharedEnvironment = {
|
|
||||||
CACHE_ENABLED = "true";
|
|
||||||
CACHE_URL = "redis://${redisName}:6379/0?suppress=true";
|
|
||||||
LOG_LEVEL = "INFO";
|
|
||||||
TELEMETRY_ENABLED = "false";
|
|
||||||
VECTOR_STORE_MIGRATED = "false";
|
|
||||||
VECTOR_STORE_TYPE = "pgvector";
|
|
||||||
AUTH_USE_AUTH = lib.boolToString authUseAuth;
|
|
||||||
};
|
|
||||||
|
|
||||||
sharedEnvironmentFiles = [
|
|
||||||
runtimeEnvFile
|
|
||||||
config.age.secrets."${serviceName}-selfhost-env".path
|
|
||||||
];
|
|
||||||
|
|
||||||
webNetwork = ip: [
|
|
||||||
"--add-host=postgres:${postgresHost}"
|
|
||||||
"--network=web:ip=${ip}"
|
|
||||||
];
|
|
||||||
|
|
||||||
# The shared web network is intentionally internal. API and deriver also join
|
|
||||||
# this egress-only network so LLM provider calls can leave the host without
|
|
||||||
# exposing any extra inbound ports.
|
|
||||||
networksWithEgress = ip:
|
|
||||||
(webNetwork ip)
|
|
||||||
++ [
|
|
||||||
"--network=${serviceName}-egress"
|
|
||||||
];
|
|
||||||
|
|
||||||
apiHealthCmd = ''/app/.venv/bin/python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=2).read()"'';
|
|
||||||
in {
|
|
||||||
system.activationScripts.createPodmanNetworkHonchoEgress = lib.mkAfter ''
|
|
||||||
if ! /run/current-system/sw/bin/podman network exists ${serviceName}-egress; then
|
|
||||||
/run/current-system/sw/bin/podman network create ${serviceName}-egress
|
|
||||||
fi
|
|
||||||
'';
|
|
||||||
|
|
||||||
virtualisation.oci-containers.containers = {
|
|
||||||
"${serviceName}-redis" = {
|
|
||||||
image = "docker.io/redis:8.2";
|
|
||||||
autoStart = true;
|
|
||||||
volumes = ["${serviceName}_redis_data:/data"];
|
|
||||||
extraOptions =
|
|
||||||
(webNetwork redisIp)
|
|
||||||
++ [
|
|
||||||
"--health-cmd=redis-cli ping"
|
|
||||||
"--health-interval=5s"
|
|
||||||
"--health-timeout=5s"
|
|
||||||
"--health-retries=5"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
"${serviceName}-api" = {
|
|
||||||
inherit image;
|
|
||||||
autoStart = true;
|
|
||||||
entrypoint = "sh";
|
|
||||||
cmd = ["docker/entrypoint.sh"];
|
|
||||||
environment = sharedEnvironment;
|
|
||||||
environmentFiles = sharedEnvironmentFiles;
|
|
||||||
ports = ["${netbirdBindAddress}:${toString honchoPort}:8000"];
|
|
||||||
dependsOn = [redisName];
|
|
||||||
extraOptions =
|
|
||||||
(networksWithEgress apiIp)
|
|
||||||
++ [
|
|
||||||
"--health-cmd=${apiHealthCmd}"
|
|
||||||
"--health-interval=5s"
|
|
||||||
"--health-timeout=5s"
|
|
||||||
"--health-retries=5"
|
|
||||||
"--health-start-period=10s"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
"${serviceName}-deriver" = {
|
|
||||||
inherit image;
|
|
||||||
autoStart = true;
|
|
||||||
entrypoint = "/app/.venv/bin/python";
|
|
||||||
cmd = ["-m" "src.deriver"];
|
|
||||||
environment = sharedEnvironment;
|
|
||||||
environmentFiles = sharedEnvironmentFiles;
|
|
||||||
dependsOn = ["${serviceName}-api" redisName];
|
|
||||||
extraOptions = networksWithEgress deriverIp;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services = {
|
|
||||||
"${serviceName}-postgres-bootstrap" = {
|
|
||||||
description = "Bootstrap Honcho PostgreSQL role, database, password, and pgvector";
|
|
||||||
after = ["postgresql.service" "agenix.service"];
|
|
||||||
requires = ["postgresql.service" "agenix.service"];
|
|
||||||
before = ["${serviceName}-env.service" "podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
|
|
||||||
requiredBy = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
|
|
||||||
path = [
|
|
||||||
config.services.postgresql.package
|
|
||||||
pkgs.coreutils
|
|
||||||
];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
User = "postgres";
|
|
||||||
Group = "postgres";
|
|
||||||
};
|
|
||||||
script = ''
|
|
||||||
set -euo pipefail
|
|
||||||
test -s ${config.age.secrets."${serviceName}-selfhost-db-password".path}
|
|
||||||
|
|
||||||
psql -v ON_ERROR_STOP=1 --dbname=postgres <<'SQL'
|
|
||||||
DO $$
|
|
||||||
BEGIN
|
|
||||||
CREATE ROLE ${dbUser} LOGIN;
|
|
||||||
EXCEPTION WHEN duplicate_object THEN
|
|
||||||
NULL;
|
|
||||||
END
|
|
||||||
$$;
|
|
||||||
|
|
||||||
SELECT 'CREATE DATABASE ${dbName} OWNER ${dbUser}'
|
|
||||||
WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${dbName}')\gexec
|
|
||||||
|
|
||||||
ALTER DATABASE ${dbName} OWNER TO ${dbUser};
|
|
||||||
\set honcho_password `cat ${config.age.secrets."${serviceName}-selfhost-db-password".path}`
|
|
||||||
ALTER ROLE ${dbUser} WITH LOGIN PASSWORD :'honcho_password';
|
|
||||||
SQL
|
|
||||||
|
|
||||||
psql -v ON_ERROR_STOP=1 --dbname=${dbName} <<'SQL'
|
|
||||||
CREATE EXTENSION IF NOT EXISTS vector;
|
|
||||||
GRANT ALL PRIVILEGES ON DATABASE ${dbName} TO ${dbUser};
|
|
||||||
SQL
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
"${serviceName}-env" = {
|
|
||||||
description = "Generate Honcho runtime environment file with agenix secrets";
|
|
||||||
after = ["agenix.service" "${serviceName}-postgres-bootstrap.service"];
|
|
||||||
requires = ["agenix.service" "${serviceName}-postgres-bootstrap.service"];
|
|
||||||
before = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
|
|
||||||
requiredBy = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
|
|
||||||
path = [
|
|
||||||
pkgs.coreutils
|
|
||||||
pkgs.python3
|
|
||||||
];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
RemainAfterExit = true;
|
|
||||||
};
|
|
||||||
script = ''
|
|
||||||
set -euo pipefail
|
|
||||||
install -d -m 0750 ${runtimeDirectory}
|
|
||||||
|
|
||||||
db_password_encoded=$(
|
|
||||||
python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=""))' \
|
|
||||||
< ${config.age.secrets."${serviceName}-selfhost-db-password".path}
|
|
||||||
)
|
|
||||||
jwt_secret=$(tr -d '\r\n' < ${config.age.secrets."${serviceName}-selfhost-jwt-secret".path})
|
|
||||||
|
|
||||||
umask 077
|
|
||||||
cat > ${runtimeEnvFile} <<ENV
|
|
||||||
DB_CONNECTION_URI=postgresql+psycopg://${dbUser}:$db_password_encoded@postgres:${toString postgresPort}/${dbName}
|
|
||||||
AUTH_JWT_SECRET=$jwt_secret
|
|
||||||
ENV
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
"podman-${serviceName}-api" = {
|
|
||||||
after = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
|
|
||||||
requires = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
|
|
||||||
};
|
|
||||||
|
|
||||||
"podman-${serviceName}-deriver" = {
|
|
||||||
after = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
|
|
||||||
requires = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.extraCommands = ''
|
|
||||||
# Self-hosted Honcho API: only Netbird mesh peers may reach ${netbirdBindAddress}:${toString honchoPort}.
|
|
||||||
ip46tables -A nixos-fw -p tcp --dport ${toString honchoPort} -s ${netbirdRange} -j nixos-fw-accept
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
@@ -11,7 +11,8 @@
|
|||||||
"kestra_data:/app/storage"
|
"kestra_data:/app/storage"
|
||||||
"/tmp/kestra-wd:/tmp/kestra-wd"
|
"/tmp/kestra-wd:/tmp/kestra-wd"
|
||||||
];
|
];
|
||||||
extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web"];
|
extraOptions =
|
||||||
|
[ "--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.tmpfiles.rules = [
|
systemd.tmpfiles.rules = [
|
||||||
@@ -20,7 +21,8 @@
|
|||||||
|
|
||||||
# Traefik configuration specific to littlelink
|
# Traefik configuration specific to littlelink
|
||||||
services.traefik.dynamicConfigOptions.http = {
|
services.traefik.dynamicConfigOptions.http = {
|
||||||
services.kestra.loadBalancer.servers = [{url = "http://localhost:3018/";}];
|
services.kestra.loadBalancer.servers =
|
||||||
|
[{ url = "http://localhost:3018/"; }];
|
||||||
|
|
||||||
routers.kestra = {
|
routers.kestra = {
|
||||||
rule = "Host(`k.m3ta.dev`)";
|
rule = "Host(`k.m3ta.dev`)";
|
||||||
|
|||||||
@@ -1,244 +0,0 @@
|
|||||||
{
|
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: let
|
|
||||||
serviceName = "netbird";
|
|
||||||
|
|
||||||
stunPort = config.m3ta.ports.get "netbird-stun";
|
|
||||||
proxyTlsPort = config.m3ta.ports.get "netbird-proxy";
|
|
||||||
metricsPort = config.m3ta.ports.get "netbird-metrics";
|
|
||||||
healthPort = config.m3ta.ports.get "netbird-health";
|
|
||||||
postgresPort = config.m3ta.ports.get "postgres";
|
|
||||||
wireguardPort = config.m3ta.ports.get "wireguard";
|
|
||||||
|
|
||||||
domain = "v.m3ta.dev";
|
|
||||||
proxyDomain = "p.m3ta.dev";
|
|
||||||
|
|
||||||
ipBase = "10.89.0";
|
|
||||||
ipOffset = 50;
|
|
||||||
|
|
||||||
dashboardIp = "${ipBase}.${toString ipOffset}";
|
|
||||||
serverIp = "${ipBase}.${toString (ipOffset + 1)}";
|
|
||||||
proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
|
|
||||||
|
|
||||||
# Database configuration
|
|
||||||
dbName = "netbird";
|
|
||||||
dbUser = "netbird";
|
|
||||||
dbHost = "${ipBase}.1";
|
|
||||||
|
|
||||||
# NetBird config as Nix attribute set
|
|
||||||
netbirdConfig = {
|
|
||||||
server = {
|
|
||||||
listenAddress = ":80";
|
|
||||||
exposedAddress = "https://${domain}:443";
|
|
||||||
stunPorts = [stunPort];
|
|
||||||
metricsPort = metricsPort;
|
|
||||||
healthcheckAddress = ":${toString healthPort}";
|
|
||||||
logLevel = "info";
|
|
||||||
logFile = "console";
|
|
||||||
dataDir = "/var/lib/netbird";
|
|
||||||
|
|
||||||
auth = {
|
|
||||||
issuer = "https://${domain}/oauth2";
|
|
||||||
localAuthDisabled = true;
|
|
||||||
signKeyRefreshEnabled = true;
|
|
||||||
dashboardRedirectURIs = [
|
|
||||||
"https://${domain}/nb-auth"
|
|
||||||
"https://${domain}/nb-silent-auth"
|
|
||||||
];
|
|
||||||
cliRedirectURIs = ["http://localhost:53000/"];
|
|
||||||
};
|
|
||||||
|
|
||||||
reverseProxy = {
|
|
||||||
trustedHTTPProxies = ["${ipBase}.1/32"];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Proxy feature
|
|
||||||
proxy = {
|
|
||||||
enabled = true;
|
|
||||||
domain = proxyDomain;
|
|
||||||
};
|
|
||||||
|
|
||||||
store = {
|
|
||||||
engine = "postgres";
|
|
||||||
postgres = {
|
|
||||||
host = dbHost;
|
|
||||||
port = postgresPort;
|
|
||||||
database = dbName;
|
|
||||||
username = dbUser;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Generate YAML from Nix attribute set
|
|
||||||
yamlFormat = pkgs.formats.yaml {};
|
|
||||||
configYamlBase = yamlFormat.generate "netbird-config-base.yaml" netbirdConfig;
|
|
||||||
|
|
||||||
# Script that injects secrets at runtime
|
|
||||||
configGenScript = pkgs.writeShellScript "netbird-gen-config" ''
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
AUTH_SECRET=$(cat "$1")
|
|
||||||
DB_PASSWORD=$(cat "$2")
|
|
||||||
ENCRYPTION_KEY=$(cat "$3")
|
|
||||||
|
|
||||||
${pkgs.yq-go}/bin/yq eval "
|
|
||||||
.server.authSecret = \"$AUTH_SECRET\" |
|
|
||||||
.server.store.encryptionKey = \"$ENCRYPTION_KEY\" |
|
|
||||||
.server.store.postgres.password = \"$DB_PASSWORD\"
|
|
||||||
" ${configYamlBase}
|
|
||||||
'';
|
|
||||||
in {
|
|
||||||
age.secrets."${serviceName}-auth-secret".file = ../../../../secrets/${serviceName}-auth-secret.age;
|
|
||||||
age.secrets."${serviceName}-db-password".file = ../../../../secrets/${serviceName}-db-password.age;
|
|
||||||
age.secrets."${serviceName}-encryption-key".file = ../../../../secrets/${serviceName}-encryption-key.age;
|
|
||||||
age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
|
|
||||||
age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
|
|
||||||
age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
|
|
||||||
# Oneshot systemd service that generates the config with injected secrets
|
|
||||||
systemd.services."${serviceName}-config" = {
|
|
||||||
description = "Generate NetBird config with secrets";
|
|
||||||
wantedBy = ["multi-user.target"];
|
|
||||||
before = ["podman-${serviceName}-server.service"];
|
|
||||||
requiredBy = ["podman-${serviceName}-server.service"];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
RemainAfterExit = true;
|
|
||||||
ExecStart = pkgs.writeShellScript "netbird-write-config" ''
|
|
||||||
mkdir -p /var/lib/${serviceName}
|
|
||||||
${configGenScript} \
|
|
||||||
${config.age.secrets."${serviceName}-auth-secret".path} \
|
|
||||||
${config.age.secrets."${serviceName}-db-password".path} \
|
|
||||||
${config.age.secrets."${serviceName}-encryption-key".path} \
|
|
||||||
> /var/lib/${serviceName}/config.yaml
|
|
||||||
chmod 600 /var/lib/${serviceName}/config.yaml
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
virtualisation.oci-containers.containers = {
|
|
||||||
"${serviceName}-dashboard" = {
|
|
||||||
image = "netbirdio/dashboard:latest";
|
|
||||||
autoStart = true;
|
|
||||||
environmentFiles = [config.age.secrets."${serviceName}-dashboard-env".path];
|
|
||||||
extraOptions = [
|
|
||||||
"--ip=${dashboardIp}"
|
|
||||||
"--network=web"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
"${serviceName}-server" = {
|
|
||||||
image = "netbirdio/netbird-server:latest";
|
|
||||||
autoStart = true;
|
|
||||||
ports = ["${toString stunPort}:${toString stunPort}/udp"];
|
|
||||||
environmentFiles = [config.age.secrets."${serviceName}-server-env".path];
|
|
||||||
volumes = [
|
|
||||||
"${serviceName}_data:/var/lib/netbird"
|
|
||||||
"/var/lib/${serviceName}/config.yaml:/etc/netbird/config.yaml:ro"
|
|
||||||
];
|
|
||||||
cmd = ["--config" "/etc/netbird/config.yaml"];
|
|
||||||
extraOptions = [
|
|
||||||
"--ip=${serverIp}"
|
|
||||||
"--network=web"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
"${serviceName}-proxy" = {
|
|
||||||
image = "netbirdio/reverse-proxy:latest";
|
|
||||||
autoStart = true;
|
|
||||||
ports = ["${toString wireguardPort}:${toString wireguardPort}/udp"];
|
|
||||||
volumes = [
|
|
||||||
"${serviceName}_proxy_certs:/certs"
|
|
||||||
];
|
|
||||||
environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
|
|
||||||
cmd = [
|
|
||||||
"--domain=${proxyDomain}"
|
|
||||||
"--mgmt=https://${domain}:443"
|
|
||||||
"--addr=:${toString proxyTlsPort}"
|
|
||||||
"--cert-dir=/certs"
|
|
||||||
"--acme-certs"
|
|
||||||
"--trusted-proxies=${ipBase}.1/32"
|
|
||||||
];
|
|
||||||
dependsOn = ["${serviceName}-server"];
|
|
||||||
extraOptions = [
|
|
||||||
"--ip=${proxyIp}"
|
|
||||||
"--network=web"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.traefik.dynamicConfigOptions = {
|
|
||||||
# HTTP services and routers
|
|
||||||
http = {
|
|
||||||
services = {
|
|
||||||
"${serviceName}-dashboard".loadBalancer.servers = [
|
|
||||||
{url = "http://${dashboardIp}:80/";}
|
|
||||||
];
|
|
||||||
|
|
||||||
"${serviceName}-server".loadBalancer.servers = [
|
|
||||||
{url = "http://${serverIp}:80/";}
|
|
||||||
];
|
|
||||||
|
|
||||||
"${serviceName}-server-h2c".loadBalancer.servers = [
|
|
||||||
{url = "h2c://${serverIp}:80";}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
routers = {
|
|
||||||
# gRPC (Signal + Management)
|
|
||||||
"${serviceName}-grpc" = {
|
|
||||||
rule = "Host(`${domain}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))";
|
|
||||||
entrypoints = "websecure";
|
|
||||||
tls.certResolver = "godaddy";
|
|
||||||
service = "${serviceName}-server-h2c";
|
|
||||||
priority = 100;
|
|
||||||
};
|
|
||||||
# Backend (relay, WebSocket, API, OAuth2)
|
|
||||||
"${serviceName}-backend" = {
|
|
||||||
rule = "Host(`${domain}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))";
|
|
||||||
entrypoints = "websecure";
|
|
||||||
tls.certResolver = "godaddy";
|
|
||||||
service = "${serviceName}-server";
|
|
||||||
priority = 100;
|
|
||||||
};
|
|
||||||
|
|
||||||
# Dashboard (catch-all, lowest priority)
|
|
||||||
"${serviceName}-dashboard" = {
|
|
||||||
rule = "Host(`${domain}`)";
|
|
||||||
entrypoints = "websecure";
|
|
||||||
tls.certResolver = "godaddy";
|
|
||||||
service = "${serviceName}-dashboard";
|
|
||||||
priority = 1;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# TCP for proxy TLS passthrough
|
|
||||||
tcp = {
|
|
||||||
services."${serviceName}-proxy-tls".loadBalancer.servers = [
|
|
||||||
{address = "${proxyIp}:${toString proxyTlsPort}";}
|
|
||||||
];
|
|
||||||
|
|
||||||
routers."${serviceName}-proxy-passthrough" = {
|
|
||||||
entryPoints = ["websecure"];
|
|
||||||
rule = "HostSNI(`*`)";
|
|
||||||
service = "${serviceName}-proxy-tls";
|
|
||||||
priority = 1;
|
|
||||||
tls.passthrough = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# ServersTransport for Proxy Protocol v2 (optional)
|
|
||||||
serversTransports."pp-v2" = {
|
|
||||||
proxyProtocol.version = 2;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedUDPPorts = [
|
|
||||||
stunPort # STUN
|
|
||||||
wireguardPort # WireGuard for proxy
|
|
||||||
];
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,211 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
# Define the Pangolin configuration as a Nix attribute set
|
||||||
|
pangolinConfig = {
|
||||||
|
app = {
|
||||||
|
dashboard_url = "https://vpn.m3tam3re.com";
|
||||||
|
log_level = "info";
|
||||||
|
save_logs = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
domains = {
|
||||||
|
vpn = {
|
||||||
|
base_domain = "m3tam3re.com";
|
||||||
|
cert_resolver = "godaddy";
|
||||||
|
prefer_wildcard_cert = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
server = {
|
||||||
|
external_port = 3000;
|
||||||
|
internal_port = 3001;
|
||||||
|
next_port = 3002;
|
||||||
|
internal_hostname = "pangolin";
|
||||||
|
session_cookie_name = "p_session_token";
|
||||||
|
resource_access_token_param = "p_token";
|
||||||
|
resource_session_request_param = "p_session_request";
|
||||||
|
};
|
||||||
|
|
||||||
|
traefik = {
|
||||||
|
cert_resolver = "godaddy";
|
||||||
|
http_entrypoint = "web";
|
||||||
|
https_entrypoint = "websecure";
|
||||||
|
};
|
||||||
|
|
||||||
|
gerbil = {
|
||||||
|
start_port = 51820;
|
||||||
|
base_endpoint = "vpn.m3tam3re.com";
|
||||||
|
use_subdomain = false;
|
||||||
|
block_size = 24;
|
||||||
|
site_block_size = 30;
|
||||||
|
subnet_group = "100.89.137.0/20";
|
||||||
|
};
|
||||||
|
|
||||||
|
rate_limits = {
|
||||||
|
global = {
|
||||||
|
window_minutes = 1;
|
||||||
|
max_requests = 100;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
email = {
|
||||||
|
smtp_host = config.age.secrets.smtp-host.path;
|
||||||
|
smtp_port = 587;
|
||||||
|
smtp_user = config.age.secrets.smtp-user.path;
|
||||||
|
smtp_pass = config.age.secrets.smtp-pass.path;
|
||||||
|
no_reply = config.age.secrets.smtp-user.path;
|
||||||
|
};
|
||||||
|
|
||||||
|
users = {
|
||||||
|
server_admin = {
|
||||||
|
email = "admin@m3tam3re.com";
|
||||||
|
password = config.age.secrets.pangolin-admin-password.path;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
flags = {
|
||||||
|
require_email_verification = true;
|
||||||
|
disable_signup_without_invite = true;
|
||||||
|
disable_user_create_org = true;
|
||||||
|
allow_raw_resources = true;
|
||||||
|
allow_base_domain_resources = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Convert Nix attribute set to YAML using a simpler approach
|
||||||
|
pangolinConfigYaml = pkgs.writeTextFile {
|
||||||
|
name = "config.yml";
|
||||||
|
text = lib.generators.toYAML {} pangolinConfig;
|
||||||
|
};
|
||||||
|
in {
|
||||||
|
# Define the containers
|
||||||
|
virtualisation.oci-containers.containers = {
|
||||||
|
"pangolin" = {
|
||||||
|
image = "fosrl/pangolin:1.1.0";
|
||||||
|
autoStart = true;
|
||||||
|
volumes = [
|
||||||
|
"${pangolinConfigYaml}:/app/config/config.yml:ro" # Mount the config file directly
|
||||||
|
"pangolin_config:/app/config/data" # Volume for persistent data
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"127.0.0.1:3020:3001" # API server
|
||||||
|
"127.0.0.1:3021:3002" # Next.js server
|
||||||
|
"127.0.0.1:3022:3000" # API/WebSocket server
|
||||||
|
];
|
||||||
|
extraOptions = ["--ip=10.89.0.20" "--network=web"];
|
||||||
|
};
|
||||||
|
|
||||||
|
"gerbil" = {
|
||||||
|
image = "fosrl/gerbil:1.0.0";
|
||||||
|
autoStart = true;
|
||||||
|
volumes = [
|
||||||
|
"pangolin_config:/var/config" # Share the volume for persistent data
|
||||||
|
];
|
||||||
|
cmd = [
|
||||||
|
"--reachableAt=http://gerbil:3003"
|
||||||
|
"--generateAndSaveKeyTo=/var/config/key"
|
||||||
|
"--remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config"
|
||||||
|
"--reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth"
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"51820:51820/udp" # WireGuard port
|
||||||
|
];
|
||||||
|
extraOptions = [
|
||||||
|
"--ip=10.89.0.21"
|
||||||
|
"--network=web"
|
||||||
|
"--cap-add=NET_ADMIN"
|
||||||
|
"--cap-add=SYS_MODULE"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Secrets for Pangolin
|
||||||
|
# age.secrets = {
|
||||||
|
# "smtp-host" = {
|
||||||
|
# file = ../secrets/smtp-host.age;
|
||||||
|
# owner = "root";
|
||||||
|
# group = "root";
|
||||||
|
# mode = "0400";
|
||||||
|
# };
|
||||||
|
# "smtp-user" = {
|
||||||
|
# file = ../secrets/smtp-user.age;
|
||||||
|
# owner = "root";
|
||||||
|
# group = "root";
|
||||||
|
# mode = "0400";
|
||||||
|
# };
|
||||||
|
# "smtp-pass" = {
|
||||||
|
# file = ../secrets/smtp-pass.age;
|
||||||
|
# owner = "root";
|
||||||
|
# group = "root";
|
||||||
|
# mode = "0400";
|
||||||
|
# };
|
||||||
|
# "pangolin-admin-password" = {
|
||||||
|
# file = ../secrets/pangolin-admin-password.age;
|
||||||
|
# owner = "root";
|
||||||
|
# group = "root";
|
||||||
|
# mode = "0400";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
|
||||||
|
# Traefik configuration for Pangolin
|
||||||
|
services.traefik.dynamicConfigOptions = {
|
||||||
|
http = {
|
||||||
|
# Next.js service (front-end)
|
||||||
|
services.pangolin-next-service.loadBalancer.servers = [
|
||||||
|
{url = "http://localhost:3021";}
|
||||||
|
];
|
||||||
|
|
||||||
|
# API service
|
||||||
|
services.pangolin-api-service.loadBalancer.servers = [
|
||||||
|
{url = "http://localhost:3022";}
|
||||||
|
];
|
||||||
|
|
||||||
|
# Routers
|
||||||
|
routers = {
|
||||||
|
# Next.js router (handles everything except API paths)
|
||||||
|
"pangolin-next" = {
|
||||||
|
rule = "Host(`vpn.m3tam3re.com`) && !PathPrefix(`/api/v1`)";
|
||||||
|
service = "pangolin-next-service";
|
||||||
|
entrypoints = ["websecure"];
|
||||||
|
tls = {
|
||||||
|
certResolver = "godaddy";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# API router
|
||||||
|
"pangolin-api" = {
|
||||||
|
rule = "Host(`vpn.m3tam3re.com`) && PathPrefix(`/api/v1`)";
|
||||||
|
service = "pangolin-api-service";
|
||||||
|
entrypoints = ["websecure"];
|
||||||
|
tls = {
|
||||||
|
certResolver = "godaddy";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Add HTTP provider to Traefik for dynamic configuration from Pangolin
|
||||||
|
services.traefik.staticConfigOptions.providers.http = {
|
||||||
|
endpoint = "http://localhost:3020/api/v1/traefik-config";
|
||||||
|
pollInterval = "5s";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Add experimental section for Badger plugin
|
||||||
|
services.traefik.staticConfigOptions.experimental = {
|
||||||
|
plugins = {
|
||||||
|
#TODO create an overlay for the plugin
|
||||||
|
badger = {
|
||||||
|
moduleName = "github.com/fosrl/badger";
|
||||||
|
version = "v1.0.0";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Firewall configuration for WireGuard
|
||||||
|
networking.firewall.allowedUDPPorts = [51820]; # WireGuard port
|
||||||
|
}
|
||||||
@@ -1,16 +1,16 @@
|
|||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./tuwunel.nix
|
|
||||||
./containers
|
./containers
|
||||||
./gitea.nix
|
./gitea.nix
|
||||||
./gitea-actions-runner.nix
|
./headscale.nix
|
||||||
./rustfs.nix
|
./minio.nix
|
||||||
./mysql.nix
|
./mysql.nix
|
||||||
./netbird.nix
|
|
||||||
./n8n.nix
|
./n8n.nix
|
||||||
|
./outline.nix
|
||||||
./paperless.nix
|
./paperless.nix
|
||||||
./postgres.nix
|
./postgres.nix
|
||||||
./searx.nix
|
./searx.nix
|
||||||
|
./tailscale.nix
|
||||||
./traefik.nix
|
./traefik.nix
|
||||||
./vaultwarden.nix
|
./vaultwarden.nix
|
||||||
./wastebin.nix
|
./wastebin.nix
|
||||||
|
|||||||
@@ -1,57 +0,0 @@
|
|||||||
{
|
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
services.gitea-actions-runner = {
|
|
||||||
instances.default = {
|
|
||||||
enable = true;
|
|
||||||
name = "${config.networking.hostName}-runner";
|
|
||||||
url = "https://code.m3ta.dev";
|
|
||||||
tokenFile = config.age.secrets.gitea-runner-token.path;
|
|
||||||
|
|
||||||
# nixos:host is primary, ubuntu is fallback
|
|
||||||
labels = [
|
|
||||||
"nixos:host"
|
|
||||||
];
|
|
||||||
|
|
||||||
# Host execution packages
|
|
||||||
hostPackages = with pkgs; [
|
|
||||||
bash
|
|
||||||
curl
|
|
||||||
coreutils
|
|
||||||
git
|
|
||||||
jq
|
|
||||||
nix
|
|
||||||
nix-update
|
|
||||||
nodejs
|
|
||||||
# Add any other tools you need for nix-update workflows
|
|
||||||
];
|
|
||||||
|
|
||||||
# Advanced settings
|
|
||||||
settings = {
|
|
||||||
runner = {
|
|
||||||
capacity = 4; # One job at a time (increase if you have resources)
|
|
||||||
timeout = "4h"; # Nix builds can take a while
|
|
||||||
};
|
|
||||||
cache = {enabled = true;};
|
|
||||||
container = {
|
|
||||||
enable_ipv6 = true;
|
|
||||||
privileged = false;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# User management (auto-created by module, but ensuring proper setup)
|
|
||||||
users.users.gitea-runner = {
|
|
||||||
home = "/var/lib/gitea-runner";
|
|
||||||
group = "gitea-runner";
|
|
||||||
isSystemUser = true;
|
|
||||||
createHome = true;
|
|
||||||
};
|
|
||||||
users.groups.gitea-runner = {};
|
|
||||||
|
|
||||||
# Firewall: Allow Podman bridge networks for cache actions
|
|
||||||
networking.firewall.trustedInterfaces = ["br-+"];
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,119 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
# Define a new option for the admin user
|
||||||
|
options.services.headscale = {
|
||||||
|
adminUser = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "m3tam3re";
|
||||||
|
description = "Username for the headscale admin user";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = let
|
||||||
|
adminUser = config.services.headscale.adminUser;
|
||||||
|
|
||||||
|
aclConfig = {
|
||||||
|
# Groups definition
|
||||||
|
groups = {
|
||||||
|
"group:admins" = ["${adminUser}"];
|
||||||
|
};
|
||||||
|
|
||||||
|
acls = [
|
||||||
|
# Allow all connections within the tailnet
|
||||||
|
{
|
||||||
|
action = "accept";
|
||||||
|
src = ["*"];
|
||||||
|
dst = ["*:*"];
|
||||||
|
}
|
||||||
|
# Allow admin to connect to their own services
|
||||||
|
{
|
||||||
|
action = "accept";
|
||||||
|
src = ["${adminUser}"];
|
||||||
|
dst = ["${adminUser}:*"];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
# Auto-approvers section for routes
|
||||||
|
autoApprovers = {
|
||||||
|
routes = {
|
||||||
|
"0.0.0.0/0" = ["${adminUser}"];
|
||||||
|
"10.0.0.0/8" = ["${adminUser}"];
|
||||||
|
"192.168.0.0/16" = ["${adminUser}"];
|
||||||
|
};
|
||||||
|
|
||||||
|
exitNode = ["${adminUser}"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
# Convert to HuJSON format with comments
|
||||||
|
aclHuJson = ''
|
||||||
|
// Headscale ACL Policy - Generated by NixOS
|
||||||
|
// Admin user: ${adminUser}
|
||||||
|
|
||||||
|
${builtins.toJSON aclConfig}
|
||||||
|
'';
|
||||||
|
aclFile = pkgs.writeText "acl-policy.hujson" aclHuJson;
|
||||||
|
in {
|
||||||
|
services = {
|
||||||
|
headscale = {
|
||||||
|
enable = true;
|
||||||
|
adminUser = "m3tam3re@m3ta.loc";
|
||||||
|
port = 3009;
|
||||||
|
settings = {
|
||||||
|
server_url = "https://va.m3tam3re.com";
|
||||||
|
dns = {
|
||||||
|
base_domain = "m3ta.loc";
|
||||||
|
nameservers.global = ["8.8.8.8"];
|
||||||
|
};
|
||||||
|
logtail.enabled = false;
|
||||||
|
policy.path = "${aclFile}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Create a systemd service to ensure the admin user exists
|
||||||
|
systemd.services.headscale-ensure-admin = lib.mkIf config.services.headscale.enable {
|
||||||
|
description = "Ensure Headscale admin user exists";
|
||||||
|
after = ["headscale.service"];
|
||||||
|
requires = ["headscale.service"];
|
||||||
|
wantedBy = ["multi-user.target"];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
User = "headscale";
|
||||||
|
Group = "headscale";
|
||||||
|
};
|
||||||
|
|
||||||
|
script = ''
|
||||||
|
# Check if user exists and create if needed
|
||||||
|
if ! ${pkgs.headscale}/bin/headscale users list | grep -q "${adminUser}"; then
|
||||||
|
echo "Creating headscale admin user: ${adminUser}"
|
||||||
|
${pkgs.headscale}/bin/headscale users create "${adminUser}"
|
||||||
|
else
|
||||||
|
echo "Headscale admin user ${adminUser} already exists"
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# Traefik configuration for headscale
|
||||||
|
services.traefik.dynamicConfigOptions.http = {
|
||||||
|
services.headscale.loadBalancer.servers = [
|
||||||
|
{
|
||||||
|
url = "http://localhost:3009/";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
routers.headscale = {
|
||||||
|
rule = "Host(`va.m3tam3re.com`)";
|
||||||
|
tls = {
|
||||||
|
certResolver = "godaddy";
|
||||||
|
};
|
||||||
|
service = "headscale";
|
||||||
|
entrypoints = "websecure";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -1,29 +1,14 @@
|
|||||||
{
|
{config, ...}: {
|
||||||
config,
|
services.minio = {
|
||||||
inputs,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
services.rustfs = {
|
|
||||||
enable = true;
|
enable = true;
|
||||||
package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
region = "eu-central-1";
|
||||||
|
|
||||||
# Reuse existing MinIO data directory
|
|
||||||
volumes = "/var/storage/s3";
|
|
||||||
|
|
||||||
# Keep same ports as MinIO to avoid changing Traefik and client configs
|
|
||||||
address = ":3008";
|
|
||||||
consoleEnable = true;
|
|
||||||
consoleAddress = ":3007";
|
consoleAddress = ":3007";
|
||||||
|
listenAddress = ":3008";
|
||||||
# Credentials via agenix
|
browser = true;
|
||||||
accessKeyFile = config.age.secrets.rustfs-access-key.path;
|
rootCredentialsFile = config.age.secrets.minio-root-cred.path;
|
||||||
secretKeyFile = config.age.secrets.rustfs-secret-key.path;
|
dataDir = ["/var/storage/s3"];
|
||||||
|
|
||||||
logLevel = "info";
|
|
||||||
};
|
};
|
||||||
|
# Traefik configuration specific to minio
|
||||||
# Traefik configuration — same routes as before
|
|
||||||
services.traefik.dynamicConfigOptions.http = {
|
services.traefik.dynamicConfigOptions.http = {
|
||||||
services.minio-console.loadBalancer.servers = [
|
services.minio-console.loadBalancer.servers = [
|
||||||
{
|
{
|
||||||
@@ -1,16 +1,8 @@
|
|||||||
{
|
{config, ...}: {
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
...
|
|
||||||
}: {
|
|
||||||
services.n8n = {
|
services.n8n = {
|
||||||
enable = true;
|
enable = true;
|
||||||
environment.WEBHOOK_URL = "https://wf.m3tam3re.com";
|
environment.WEBHOOK_URL = "https://wf.m3tam3re.com";
|
||||||
};
|
};
|
||||||
# Temporary fix for upstream module
|
|
||||||
systemd.services.n8n.serviceConfig.LoadCredential = lib.mkForce [];
|
|
||||||
systemd.services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkForce null;
|
|
||||||
|
|
||||||
systemd.services.n8n.serviceConfig = {
|
systemd.services.n8n.serviceConfig = {
|
||||||
EnvironmentFile = ["${config.age.secrets.n8n-env.path}"];
|
EnvironmentFile = ["${config.age.secrets.n8n-env.path}"];
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -1,28 +0,0 @@
|
|||||||
{pkgs, ...}: {
|
|
||||||
services.netbird.enable = true;
|
|
||||||
|
|
||||||
systemd.services.netbird = {
|
|
||||||
environment = {
|
|
||||||
NB_DISABLE_SSH_CONFIG = "true";
|
|
||||||
};
|
|
||||||
path = [
|
|
||||||
pkgs.shadow
|
|
||||||
pkgs.util-linux
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
programs.ssh.extraConfig = ''
|
|
||||||
Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
|
|
||||||
PreferredAuthentications password,publickey,keyboard-interactive
|
|
||||||
PasswordAuthentication yes
|
|
||||||
PubkeyAuthentication yes
|
|
||||||
BatchMode no
|
|
||||||
ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
|
|
||||||
StrictHostKeyChecking no
|
|
||||||
UserKnownHostsFile /dev/null
|
|
||||||
CheckHostIP no
|
|
||||||
LogLevel ERROR
|
|
||||||
'';
|
|
||||||
|
|
||||||
networking.firewall.checkReversePath = "loose";
|
|
||||||
}
|
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
{
|
||||||
|
services.outline = {
|
||||||
|
enable = true;
|
||||||
|
port = 3019;
|
||||||
|
publicUrl = "https://ol.m3ta.dev";
|
||||||
|
databaseUrl = "postgresql://outline:outline@127.0.0.1:5432/outline";
|
||||||
|
storage = {
|
||||||
|
storageType = "local";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
systemd.services.outline.serviceConfig = {
|
||||||
|
Environment = [
|
||||||
|
"PGSSLMODE=disable"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
# Traefik configuration specific to littlelink
|
||||||
|
services.traefik.dynamicConfigOptions.http = {
|
||||||
|
services.outline.loadBalancer.servers = [
|
||||||
|
{
|
||||||
|
url = "http://localhost:3019/";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
routers.outline = {
|
||||||
|
rule = "Host(`ol.m3ta.dev`)";
|
||||||
|
tls = {
|
||||||
|
certResolver = "godaddy";
|
||||||
|
};
|
||||||
|
service = "outline";
|
||||||
|
entrypoints = "websecure";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -26,9 +26,6 @@
|
|||||||
# Podman network connections for Baserow
|
# Podman network connections for Baserow
|
||||||
host baserow baserow 10.89.0.0/24 scram-sha-256
|
host baserow baserow 10.89.0.0/24 scram-sha-256
|
||||||
host kestra kestra 10.89.0.0/24 scram-sha-256
|
host kestra kestra 10.89.0.0/24 scram-sha-256
|
||||||
host netbird netbird 10.89.0.0/24 scram-sha-256
|
|
||||||
host authentik authentik 10.89.0.0/24 scram-sha-256
|
|
||||||
host honcho honcho 10.89.0.0/24 scram-sha-256
|
|
||||||
|
|
||||||
# Deny all other connections
|
# Deny all other connections
|
||||||
local all all reject
|
local all all reject
|
||||||
@@ -39,7 +36,7 @@
|
|||||||
services.postgresqlBackup = {
|
services.postgresqlBackup = {
|
||||||
enable = true;
|
enable = true;
|
||||||
startAt = "03:10:00";
|
startAt = "03:10:00";
|
||||||
databases = ["baserow" "paperless" "kestra" "authentik" "netbird" "honcho"];
|
databases = ["baserow" "paperless" "kestra"];
|
||||||
};
|
};
|
||||||
networking.firewall = {
|
networking.firewall = {
|
||||||
extraCommands = ''
|
extraCommands = ''
|
||||||
|
|||||||
@@ -0,0 +1,27 @@
|
|||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
|
services.tailscale = {
|
||||||
|
enable = true;
|
||||||
|
authKeyFile = config.age.secrets.tailscale-key.path;
|
||||||
|
useRoutingFeatures = "both";
|
||||||
|
extraUpFlags = [
|
||||||
|
"--login-server=${config.services.headscale.settings.server_url}"
|
||||||
|
"--advertise-exit-node"
|
||||||
|
"--accept-routes"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
services.networkd-dispatcher = lib.mkIf config.services.tailscale.enable {
|
||||||
|
enable = true;
|
||||||
|
rules."50-tailscale" = {
|
||||||
|
onState = ["routable"];
|
||||||
|
script = ''
|
||||||
|
NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
|
||||||
|
${pkgs.ethtool}/bin/ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -43,12 +43,6 @@
|
|||||||
dynamicConfigOptions = {
|
dynamicConfigOptions = {
|
||||||
http = {
|
http = {
|
||||||
services = {
|
services = {
|
||||||
# ── Hermes Dashboard (m3-hermes over Netbird) ────────────────
|
|
||||||
hermes-dashboard = {
|
|
||||||
loadBalancer.servers = [
|
|
||||||
{url = "http://100.81.231.152:9119";}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
dummy = {
|
dummy = {
|
||||||
loadBalancer.servers = [
|
loadBalancer.servers = [
|
||||||
{url = "http://192.168.0.1";} # Diese URL wird nie verwendet
|
{url = "http://192.168.0.1";} # Diese URL wird nie verwendet
|
||||||
@@ -85,15 +79,6 @@
|
|||||||
};
|
};
|
||||||
|
|
||||||
routers = {
|
routers = {
|
||||||
# ── Hermes Dashboard — Netbird mesh only ─────────────────────
|
|
||||||
hermes-dashboard = {
|
|
||||||
rule = "Host(`dash.m3ta.dev`)";
|
|
||||||
service = "hermes-dashboard";
|
|
||||||
entrypoints = ["websecure"];
|
|
||||||
tls = {
|
|
||||||
certResolver = "godaddy";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
api = {
|
api = {
|
||||||
rule = "Host(`r.m3tam3re.com`)";
|
rule = "Host(`r.m3tam3re.com`)";
|
||||||
service = "api@internal";
|
service = "api@internal";
|
||||||
|
|||||||
@@ -1,50 +0,0 @@
|
|||||||
{config, ...}: let
|
|
||||||
# Tuwunel uses a list for ports
|
|
||||||
tuwunel-port = config.m3ta.ports.get "tuwunel";
|
|
||||||
in {
|
|
||||||
services.matrix-tuwunel = {
|
|
||||||
enable = true;
|
|
||||||
settings.global = {
|
|
||||||
server_name = "m3ta.dev";
|
|
||||||
address = ["127.0.0.1"];
|
|
||||||
port = [tuwunel-port];
|
|
||||||
max_request_size = 20000000;
|
|
||||||
allow_registration = true;
|
|
||||||
registration_token_file = config.age.secrets."tuwunel-registration-token".path;
|
|
||||||
allow_encryption = true;
|
|
||||||
allow_federation = true;
|
|
||||||
trusted_servers = ["matrix.org"];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Traefik configuration for Tuwunel
|
|
||||||
services.traefik.dynamicConfigOptions.http = {
|
|
||||||
services.tuwunel.loadBalancer.servers = [
|
|
||||||
{
|
|
||||||
url = "http://localhost:${toString tuwunel-port}/";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
routers.tuwunel = {
|
|
||||||
rule = "Host(`matrix.m3ta.dev`)";
|
|
||||||
tls = {
|
|
||||||
certResolver = "godaddy";
|
|
||||||
};
|
|
||||||
service = "tuwunel";
|
|
||||||
entrypoints = "websecure";
|
|
||||||
};
|
|
||||||
|
|
||||||
# Federation endpoint on base domain
|
|
||||||
routers.tuwunel-federation = {
|
|
||||||
rule = "Host(`m3ta.dev`) && PathPrefix(`/_matrix`)";
|
|
||||||
tls = {
|
|
||||||
certResolver = "godaddy";
|
|
||||||
};
|
|
||||||
service = "tuwunel";
|
|
||||||
entrypoints = "websecure";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Open federation port
|
|
||||||
networking.firewall.allowedTCPPorts = [8448];
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user