WIP: init drone-exec-runner-in-docker on ryzensun

It seems yubikey-agent still has to be SIGHUP'ed before using agenix:
like so:
killall -HUP yubikey-agent

Read more on how to set this up here:
https://github.com/ryantm/agenix/issues/115

Another related issue:
https://github.com/FiloSottile/yubikey-agent/issues/63

.drone.yml

@@ -1,11 +1,12 @@
 ---
 kind: pipeline
-type: docker
+type: exec
 name: Check
+node:
+  hosttype: baremetal
 
 steps:
   - name: "Check"
-    image: docker.nix-community.org/nixpkgs/nix-flakes:latest
     when:
       event:
         - pull_request
@@ -20,6 +21,8 @@ steps:
 kind: pipeline
 type: exec
 name: Tests
+node:
+  hosttype: baremetal
 
 steps:
   - name: "Tests"
@@ -29,6 +32,7 @@ steps:
       - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
       - nix $$NIX_FLAGS build ".#checks.x86_64-linux.customTestFor-PubSolarOS-firstTest"
       - nix-store --read-log result
+      - if [ ! -e /dev/kvm ]; then exit 1; fi
       - nix $$NIX_FLAGS flake check
       - nix $$NIX_FLAGS develop --command echo OK
 
@@ -50,7 +54,6 @@ steps:
       - cd tritonshell
       - nix develop --command mput -p -f ../result/foot_wayland_info.png ~~/public/$${TARGET_DIR}/foot_wayland_info.png
       - nix develop --command mput -p -f ../result/test-wayland.out ~~/public/$${TARGET_DIR}/test-wayland.out
-
 trigger:
   ref:
     - refs/tags/v*

flake.lock

@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665392861,
-        "narHash": "sha256-bCd8fYJMAb0LzabsiXl4nxECDoz483bJOCa2hjox7N0=",
+        "lastModified": 1666614183,
+        "narHash": "sha256-R5+bCtUquwSfQmRBbCYc6FT6xtCaAebh0KE187e8458=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "ef56fd8979b5f4e800c4716f62076e00600b1172",
+        "rev": "0f90e1c34caedd0bf765ebe47b92dd1ceffafcc8",
         "type": "github"
       },
       "original": {
@@ -120,6 +120,25 @@
         "type": "github"
       }
     },
+    "devshell_2": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1663445644,
+        "narHash": "sha256-+xVlcK60x7VY1vRJbNUEAHi17ZuoQxAIH4S4iUFUGBA=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "e3dc3e21594fe07bdb24bdf1c8657acaa4cb8f66",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
     "digga": {
       "inputs": {
         "blank": "blank",
@@ -157,6 +176,29 @@
         "type": "github"
       }
     },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-autobahn",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1655188051,
+        "narHash": "sha256-Cf/qNGb7Xw84TPPep0iIZLLhSXiFq9h+tt6TnfaQMrE=",
+        "ref": "main",
+        "rev": "522a4e99be1f8fcc94b94666c3a44677d668f539",
+        "revCount": 1067,
+        "type": "git",
+        "url": "https://github.com/nix-community/fenix"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://github.com/nix-community/fenix"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -189,22 +231,6 @@
         "type": "github"
       }
     },
-    "flake-compat_3": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1650374568,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "locked": {
         "lastModified": 1642700792,
@@ -255,6 +281,36 @@
       }
     },
     "flake-utils_3": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "locked": {
+        "lastModified": 1642700792,
+        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_5": {
       "locked": {
         "lastModified": 1659877975,
         "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@@ -308,11 +364,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1665940183,
-        "narHash": "sha256-cPe3F7CtnxU9YbJpc3Adl4d9kX+turqTv5FxM98i8vg=",
+        "lastModified": 1666539104,
+        "narHash": "sha256-jeuC+d375wHHxMOFLgu7etseCQVJuPNKoEc9X9CsErg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "104e8082de1b20f9d0e1f05b1028795ed0e0e4bc",
+        "rev": "0e6df35f39651504249a05191f9a78d251707e22",
         "type": "github"
       },
       "original": {
@@ -322,6 +378,22 @@
         "type": "github"
       }
     },
+    "master": {
+      "locked": {
+        "lastModified": 1666615827,
+        "narHash": "sha256-oAf8l7eMEFjXMVsrQgHnRUeQbSrY/Amjm8xnUioNbJ8=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "f93f9f43c6b3347b2091a8a41421d31e84cb9275",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "naersk": {
       "inputs": {
         "nixpkgs": [
@@ -342,6 +414,31 @@
         "type": "github"
       }
     },
+    "nix-autobahn": {
+      "inputs": {
+        "fenix": "fenix",
+        "naersk": [
+          "naersk"
+        ],
+        "nixpkgs": [
+          "latest"
+        ],
+        "utils": "utils_2"
+      },
+      "locked": {
+        "lastModified": 1655761558,
+        "narHash": "sha256-BGKT0RQGJ1CtTssfPhI4PABV1Gh6Wyq/cf6GN30TUAY=",
+        "owner": "wucke13",
+        "repo": "nix-autobahn",
+        "rev": "85861fdd5cc32b65e75db4e6be478fe2da455dba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "wucke13",
+        "repo": "nix-autobahn",
+        "type": "github"
+      }
+    },
     "nixlib": {
       "locked": {
         "lastModified": 1636849918,
@@ -359,11 +456,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1666014999,
-        "narHash": "sha256-gvKl8xlPJreezNG1NVTJv/HdGC69MSrM+IpCxS+eFvw=",
+        "lastModified": 1666528161,
+        "narHash": "sha256-PFOQSC0x4xPD1p/GZIbpKuoEBu6M8HnEOeNRiBUCELA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1935dd8fdab8e022a9d958419663162fd840014c",
+        "rev": "471d92178b978fcbad8db27c2e8a4e737d4e0e27",
         "type": "github"
       },
       "original": {
@@ -439,6 +536,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1643381941,
+        "narHash": "sha256-pHTwvnN4tTsEKkWlXQ8JMY423epos8wUOhthpwJjtpc=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "5efc8ca954272c4376ac929f4c5ffefcc20551d5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nur": {
       "locked": {
         "lastModified": 0,
@@ -451,28 +564,6 @@
         "type": "indirect"
       }
     },
-    "nvfetcher": {
-      "inputs": {
-        "flake-compat": "flake-compat_3",
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": [
-          "nixos"
-        ]
-      },
-      "locked": {
-        "lastModified": 1664550666,
-        "narHash": "sha256-eXfMRd9uItEp3PsYI31FSVGPG9dVC6yF++65ZrGwW8A=",
-        "owner": "berberman",
-        "repo": "nvfetcher",
-        "rev": "9763ad40d59a044e90726653d9253efaeeb053b2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "berberman",
-        "repo": "nvfetcher",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -481,12 +572,79 @@
         "digga": "digga",
         "home": "home",
         "latest": "latest_2",
+        "master": "master",
         "naersk": "naersk",
+        "nix-autobahn": "nix-autobahn",
         "nixos": "nixos",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
         "nur": "nur",
-        "nvfetcher": "nvfetcher"
+        "triton-vmtools": "triton-vmtools",
+        "tritonshell": "tritonshell"
+      }
+    },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1655114284,
+        "narHash": "sha256-2yz3TexDtxXMMjYKn1SImavH3Zflkxte6/5ESncu5E4=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "7db73875ac0d9280ae93b14232249d9c1496583a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
+    "triton-vmtools": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "latest"
+        ]
+      },
+      "locked": {
+        "dir": "vmtools",
+        "lastModified": 1665580523,
+        "narHash": "sha256-cpe/wE10iXQ7Rnbmpu0i2oUqw306lLs+NKSJ+e+/4Sk=",
+        "ref": "main",
+        "rev": "b6bb5c4f37bf184f2072618b82c51a552eaf8168",
+        "revCount": 26,
+        "type": "git",
+        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
+      },
+      "original": {
+        "dir": "vmtools",
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.b12f.io/pub-solar/infra?dir=vmtools"
+      }
+    },
+    "tritonshell": {
+      "inputs": {
+        "devshell": "devshell_2",
+        "flake-utils": "flake-utils_5",
+        "nixpkgs": [
+          "latest"
+        ]
+      },
+      "locked": {
+        "lastModified": 1665580466,
+        "narHash": "sha256-q8kVIE3XaOSCVl7oqkaKs2LDEbBcZRIzlnSG8PIKRQ0=",
+        "ref": "main",
+        "rev": "70d759b6d8b5e076bee6a28255614ab3d75f6763",
+        "revCount": 49,
+        "type": "git",
+        "url": "https://git.greenbaum.cloud/dev/tritonshell"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.greenbaum.cloud/dev/tritonshell"
       }
     },
     "utils": {
@@ -503,6 +661,21 @@
         "repo": "flake-utils",
         "type": "github"
       }
+    },
+    "utils_2": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "ref": "master",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "revCount": 58,
+        "type": "git",
+        "url": "https://github.com/numtide/flake-utils"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://github.com/numtide/flake-utils"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -10,6 +10,7 @@
       # Track channels with commits tested and built by hydra
       nixos.url = "github:nixos/nixpkgs/nixos-22.05";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
+      master.url = "github:nixos/nixpkgs/master";
 
       digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
       digga.inputs.nixpkgs.follows = "nixos";
@@ -29,15 +30,23 @@
       agenix.url = "github:ryantm/agenix";
       agenix.inputs.nixpkgs.follows = "nixos";
 
-      nvfetcher.url = "github:berberman/nvfetcher";
-      nvfetcher.inputs.nixpkgs.follows = "nixos";
-
       naersk.url = "github:nmattia/naersk";
       naersk.inputs.nixpkgs.follows = "nixos";
 
       nixos-hardware.url = "github:nixos/nixos-hardware";
 
       nixos-generators.url = "github:nix-community/nixos-generators";
+
+      # PubSolarOS additions
+      triton-vmtools.url = "git+https://git.b12f.io/pub-solar/infra?ref=main&dir=vmtools";
+      triton-vmtools.inputs.nixpkgs.follows = "latest";
+
+      tritonshell.url = "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main";
+      tritonshell.inputs.nixpkgs.follows = "latest";
+
+      nix-autobahn.url = "github:wucke13/nix-autobahn";
+      nix-autobahn.inputs.nixpkgs.follows = "latest";
+      nix-autobahn.inputs.naersk.follows = "naersk";
     };
 
   outputs =
@@ -48,8 +57,9 @@
     , nixos-hardware
     , nur
     , agenix
-    , nvfetcher
     , deploy
+    , tritonshell
+    , nix-autobahn
     , ...
     } @ inputs:
     digga.lib.mkFlake
@@ -57,7 +67,7 @@
         inherit self inputs;
 
         channelsConfig = {
-          # allowUnfree = true;
+          allowUnfree = true;
         };
 
         supportedSystems = [ "x86_64-linux" "aarch64-linux" ];
@@ -68,6 +78,7 @@
             overlays = [ ];
           };
           latest = { };
+          master = { };
         };
 
         lib = import ./lib { lib = digga.lib // nixos.lib; };
@@ -115,6 +126,12 @@
                 (import ./tests/first-test.nix { pkgs = nixos.legacyPackages.x86_64-linux; lib = nixos.lib; })
               ];
             };
+            fae = {
+              system = "aarch64-linux";
+            };
+            powder = {
+              system = "x86_64-linux";
+            };
           };
           importables = rec {
             profiles = digga.lib.rakeLeaves ./profiles // {
@@ -125,6 +142,9 @@
               iso = base ++ [ base-user graphical pub-solar-iso ];
               pubsolaros = [ full-install base-user users.root ];
               anonymous = [ pubsolaros users.pub-solar ];
+              teutat3s = pubsolaros ++ [ users.teutat3s ];
+              dumpyourvms = teutat3s ++ [ graphical ];
+              ryzensun = teutat3s ++ [ graphical ];
             };
           };
         };
@@ -135,11 +155,12 @@
           importables = rec {
             profiles = digga.lib.rakeLeaves ./users/profiles;
             suites = with profiles; rec {
-              base = [ direnv git ];
+              base = [ direnv ];
             };
           };
           users = {
             pub-solar = { suites, ... }: { imports = suites.base; };
+            teutat3s = { suites, ... }: { imports = suites.base; };
           }; # digga.lib.importers.rakeLeaves ./users/hm;
         };
 
@@ -147,6 +168,27 @@
 
         homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
 
-        deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations { };
-      };
+        deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
+          fae = {
+            hostname = "fae.fritz.box:22";
+            sshUser = "pub-solar";
+            fastConnect = true;
+            profilesOrder = [ "system" "direnv" ];
+            profiles.direnv = {
+              user = "pub-solar";
+              path = deploy.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.pub-solar;
+            };
+          };
+          powder = {
+            hostname = "80.71.153.194";
+            sshUser = "root";
+            profilesOrder = [ "system" "direnv" ];
+            profiles.direnv = {
+              user = "pub-solar";
+              path = deploy.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.pub-solar;
+            };
+          };
+        };
+      }
+  ;
 }

hosts/dumpyourvms/.config/sway/config.d/applications.conf

@@ -0,0 +1,14 @@
+assign [app_id="firefox"] $ws2
+
+# seahorse
+for_window [title="seahorse"] floating enabled
+
+# NetworkManager
+for_window [app_id="nm-connection-editor"] floating enabled
+
+# thunderbird
+for_window [title="New Task:*"] floating enabled
+for_window [title="Edit Task:*"] floating enabled
+for_window [title="New Event:*"] floating enabled
+for_window [title="Edit Event:*"] floating enabled
+

hosts/dumpyourvms/.config/sway/config.d/autostart.conf

@@ -0,0 +1,6 @@
+# Autostart applications
+#
+# Example:
+# exec swayidle
+
+exec qMasterPassword

hosts/dumpyourvms/.config/sway/config.d/custom-keybindings.conf

@@ -0,0 +1,3 @@
+# switch keyboard input language
+bindsym $mod+tab exec swaymsg input "1452:628:Apple_Inc._Apple_Internal_Keyboard_/_Trackpad" xkb_switch_layout next
+

hosts/dumpyourvms/.config/sway/config.d/input-defaults.conf

@@ -0,0 +1,35 @@
+### Input configuration
+#
+# You can get the names of your inputs by running: swaymsg -t get_inputs
+# Read `man 5 sway-input` for more information about this section.
+
+input "type:keyboard" {
+  xkb_layout us(intl),de
+  xkb_model pc105
+  xkb_options ctrl:nocaps
+}
+
+input "type:touchpad" {
+  tap enabled
+  natural_scroll enabled
+}
+
+# Touchpad controls
+#bindsym XF86TouchpadToggle exec $HOME/Workspace/ben/toggletouchpad.sh # toggle touchpad
+
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec "brightnessctl -d gmux_backlight set +10%"
+bindsym XF86MonBrightnessDown exec "brightnessctl -d gmux_backlight set 10%-"
+
+# Keyboard backlight brightness controls
+bindsym XF86KbdBrightnessDown exec "brightnessctl -d smc::kbd_backlight set 10%-"
+bindsym XF86KbdBrightnessUp exec "brightnessctl -d smc::kbd_backlight set +10%"
+
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec pactl set-sink-volume @DEFAULT_SINK@ +5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #increase sound volume
+bindsym XF86AudioLowerVolume exec pactl set-sink-volume @DEFAULT_SINK@ -5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #decrease sound volume
+bindsym XF86AudioMute exec pactl set-sink-mute @DEFAULT_SINK@ toggle # mute sound
+# Media player controls
+bindsym XF86AudioPlay exec "playerctl play-pause; notify-send 'Play/Pause'"
+bindsym XF86AudioNext exec "playerctl next; notify-send 'Next'"
+bindsym XF86AudioPrev exec "playerctl previous; notify-send 'Prev.'"

hosts/dumpyourvms/.config/sway/config.d/screens.conf

@@ -0,0 +1,41 @@
+### Output configuration
+#
+# Example configuration:
+#
+#   output HDMI-A-1 resolution 1920x1080 position 1920,0
+#
+# You can get the names of your outputs by running: swaymsg -t get_outputs
+
+set $main_screen eDP-1
+set $displayport DP-1
+set $hmdi HDMI-A-1
+
+output $main_screen scale 2
+output $displayport scale 2
+output $hdmi scale 1
+
+output $main_screen pos 0 0
+output $displayport pos 0 -1080
+output $hdmi pos 1440 0
+
+#bindswitch lid:on output $main_screen disable
+#bindswitch lid:off output $main_screen enable
+bindsym $mod+Shift+x output $main_screen toggle
+
+# TODO when using more monitors
+## Manual management of external displays
+# Set the shortcuts and what they do
+#set $mode_display HDMI (i) top, (j) left, (k) bottom, (l) right, (o) off
+#mode "$mode_display" {
+#    bindsym i output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 1080, mode "default"
+#    bindsym j output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 1920 0, mode "default"
+#    bindsym k output HDMI-A-1 enable; output HDMI-A-1 pos 0 900 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym l output HDMI-A-1 enable; output HDMI-A-1 pos 1440 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym o output HDMI-A-1 disable, mode "default"
+#
+#    # back to normal: Enter or Escape
+#    bindsym Return mode "default"
+#    bindsym Escape mode "default"
+#}
+## Declare here the shortcut to bring the display selection menu
+#bindsym $mod+x mode "$mode_display"

hosts/dumpyourvms/consul-agent-ca.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbzCCAxSgAwIBAgIRAMK20/fFF0YVThq8xm/YvBswCgYIKoZIzj0EAwIwgbkx
+CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj
+bzEaMBgGA1UECRMRMTAxIFNlY29uZCBTdHJlZXQxDjAMBgNVBBETBTk0MTA1MRcw
+FQYDVQQKEw5IYXNoaUNvcnAgSW5jLjFAMD4GA1UEAxM3Q29uc3VsIEFnZW50IENB
+IDI1ODgxOTUyODQyOTMwNjIxMjY4NDgwMTUxODE3OTM2NjUxNzc4NzAeFw0xOTEx
+MDYwMDI3MzVaFw0yNDExMDQwMDI3MzVaMIG5MQswCQYDVQQGEwJVUzELMAkGA1UE
+CBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xGjAYBgNVBAkTETEwMSBTZWNv
+bmQgU3RyZWV0MQ4wDAYDVQQREwU5NDEwNTEXMBUGA1UEChMOSGFzaGlDb3JwIElu
+Yy4xQDA+BgNVBAMTN0NvbnN1bCBBZ2VudCBDQSAyNTg4MTk1Mjg0MjkzMDYyMTI2
+ODQ4MDE1MTgxNzkzNjY1MTc3ODcwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQE
+SZ2kc9rKUNX3czze+rFR/bZdLx3JEYrpcSXKkpv1wr68E1Jqhi/8Dm8b62Ei/Bc6
+ZhoJvtB2Shtl+6LbjccUo4H6MIH3MA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8E
+BTADAQH/MGgGA1UdDgRhBF9hZjo4MzoyZTpiOToyZTozMzo5MDplOTpkMjpiNzpj
+NjpjYzpkYToxODoyYTphNzpjMzo5ZTozMTpmNTpkZTo4Mzo4YzozMDo0Mjo3OTo4
+ZDo0ZDpmZDozMjo2NzpiYjBqBgNVHSMEYzBhgF9hZjo4MzoyZTpiOToyZTozMzo5
+MDplOTpkMjpiNzpjNjpjYzpkYToxODoyYTphNzpjMzo5ZTozMTpmNTpkZTo4Mzo4
+YzozMDo0Mjo3OTo4ZDo0ZDpmZDozMjo2NzpiYjAKBggqhkjOPQQDAgNJADBGAiEA
+zKCV25P6HqFEa1iUVQnsNAp/WHUwxNlR0OctZSdiuIkCIQDiRK03ZYSK/hmY9kXV
+42nj6kO8MexfiYN4IE4URmzYnA==
+-----END CERTIFICATE-----

hosts/dumpyourvms/default.nix

@@ -0,0 +1,6 @@
+{ suites, ... }:
+{
+  imports = [
+    ./dumpyourvms.nix
+  ] ++ suites.dumpyourvms;
+}

hosts/dumpyourvms/dumpyourvms.nix

@@ -0,0 +1,153 @@
+{ config, pkgs, lib, self, ... }:
+with lib;
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  config = {
+    age.secrets.environment-secrets = {
+      file = "${self}/secrets/environment-secrets.age";
+      mode = "700";
+      owner = "teutat3s";
+    };
+
+    pub-solar = {
+      audio.mopidy.enable = lib.mkForce false;
+      core.hibernation = {
+        enable = true;
+        resumeDevice = "/dev/mapper/cryptroot";
+        resumeOffset = 47366144;
+      };
+      virtualisation.enable = true;
+    };
+
+    # fix backlight for keyboard and brightness, adjust function key binding,
+    # intel_pstate for cpu schedutil, resume offset for swapfile, disable amdgpu driver
+    boot.kernelParams = [ "acpi_backlight=video" "hid_apple.fnmode=2" "intel_pstate=passive" ];
+    boot.loader.efi.canTouchEfiVariables = true;
+    #boot.resumeDevice = "/dev/mapper/cryptroot";
+
+    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+    systemd.sleep.extraConfig = ''
+      HibernateMode=shutdown
+    '';
+
+    hardware = {
+      cpu.intel.updateMicrocode = true;
+      facetimehd.enable = true;
+    };
+
+    services.resolved = {
+      enable = true;
+      # DNSSEC=false because of random SERVFAIL responses with Greenbaum DNS
+      # when using allow-downgrade, see https://github.com/systemd/systemd/issues/10579
+      extraConfig = ''
+        DNS=5.1.66.255#dot.ffmuc.net 185.150.99.255#dot.ffmuc.net 5.9.164.112#dns3.digitalcourage.de 89.233.43.71#unicast.censurfridns.dk 94.130.110.185#ns1.dnsprivacy.at 145.100.185.15#dnsovertls.sinodun.com 145.100.185.16#dnsovertls1.sinodun.com 185.49.141.37#getdnsapi.net 2001:678:e68:f000::#dot.ffmuc.net 2001:678:ed0:f000::#dot.ffmuc.net 2a01:4f8:251:554::2#dns3.digitalcourage.de 2a01:3a0:53:53::0#unicast.censurfridns.dk 2a01:4f8:c0c:3c03::2#ns1.dnsprivacy.at 2a01:4f8:c0c:3bfc::2#ns2.dnsprivacy.at 2001:610:1:40ba:145:100:185:15#dnsovertls.sinodun.com 2001:610:1:40ba:145:100:185:16#dnsovertls1.sinodun.com 2a04:b900:0:100::38#getdnsapi.net
+        FallbackDNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
+        Domains=~.
+        DNSOverTLS=yes
+        DNSSEC=false
+      '';
+    };
+    services.mozillavpn.enable = true;
+    networking = import ./networking.nix;
+
+    security.pki.certificateFiles = [ ./consul-agent-ca.pem ];
+
+    services.unbound = import ./unbound.nix;
+
+    # Disable dedicated GPU, use integrated Intel GPU to save battery
+    # Set default brightness to 50%
+    # https://ubuntuforums.org/showthread.php?t=2409856
+    services.cron.systemCronJobs = [
+      "@reboot root ${pkgs.util-linux}/bin/rfkill block bluetooth"
+      "@reboot root ${pkgs.coreutils}/bin/sleep 10; ${pkgs.coreutils}/bin/echo OFF > /sys/kernel/debug/vgaswitcheroo/switch"
+      "@reboot root ${pkgs.coreutils}/bin/sleep 11; ${pkgs.coreutils}/bin/echo 510 > /sys/class/backlight/gmux_backlight/brightness"
+    ];
+
+    # Increase console font size for HiDPI display
+    console = {
+      earlySetup = true;
+      font = lib.mkForce "ter-i32b";
+      packages = [ pkgs.terminus_font ];
+    };
+
+    # Thunderbolt tools
+    services.hardware.bolt.enable = true;
+
+    powerManagement = {
+      # Use new schedutil govenor
+      # https://github.com/NixOS/nixpkgs/pull/42330
+      # https://www.kernel.org/doc/html/v5.10/admin-guide/pm/cpufreq.html#schedutil
+      cpuFreqGovernor = lib.mkDefault "schedutil";
+
+      # brcmfmac being loaded during hibernation would inhibit a successful resume
+      # https://bugzilla.kernel.org/show_bug.cgi?id=101681#c116.
+      # Also brcmfmac could randomly crash on resume from sleep.
+      powerUpCommands = lib.mkBefore "${pkgs.kmod}/bin/modprobe brcmfmac";
+      powerDownCommands = lib.mkBefore "${pkgs.kmod}/bin/rmmod brcmfmac";
+    };
+
+    # change lid switch behaviour
+    #services.logind.lidSwitch = "hibernate";
+
+    # TLP for power management
+    services.tlp = {
+      enable = true;
+      settings = {
+        CPU_SCALING_GOVERNOR_ON_AC = "performance";
+        CPU_SCALING_GOVERNOR_ON_BAT = "schedutil";
+        CPU_BOOST_ON_AC = 1;
+        CPU_BOOST_ON_BAT = 0;
+      };
+    };
+
+    services.udev.extraRules =
+      # Disable XHC1 wakeup signal to avoid resume getting triggered some time
+      # after suspend. Reboot required for this to take effect.
+      lib.optionalString
+        (lib.versionAtLeast config.boot.kernelPackages.kernel.version "3.13")
+        ''SUBSYSTEM=="pci", KERNEL=="0000:00:14.0", ATTR{power/wakeup}="disabled"'';
+
+    services.printing.enable = true;
+    services.printing.drivers = [ pkgs.brlaser ];
+
+    home-manager = pkgs.lib.setAttrByPath [ "users" psCfg.user.name ] {
+      # Custom device sway configs
+      xdg.configFile = mkIf psCfg.sway.enable {
+        "sway/config.d/10-applications.conf".source = ./.config/sway/config.d/applications.conf;
+        "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
+        "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
+        "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
+        "sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
+      };
+    };
+
+    users.users.teutat3s = {
+      extraGroups = [ "unbound" ];
+    };
+
+
+    # WLAN frequency compliance (e.g. check for radar with DFS)
+    #
+    # Radeon driver seems to work better than amdgpu with Radeon R9 M370X
+    hardware.firmware = with pkgs; [ wireless-regdb ];
+    boot.extraModprobeConfig = ''
+      options cfg80211 ieee80211_regdom="DE"
+    '';
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
+}

hosts/dumpyourvms/hardware-configuration.nix

@@ -0,0 +1,41 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      #(modulesPath + "/hardware/network/broadcom-43xx.nix")
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/17bbb016-d27c-47da-8805-58c6395891e8";
+      fsType = "ext4";
+    };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/c100b9a7-99d7-44d9-b7c2-3892a5f233c4";
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/06B8-5414";
+      fsType = "vfat";
+    };
+
+  swapDevices = [
+    {
+      device = "/swapfile";
+      size = 18432;
+    }
+  ];
+
+  # high-resolution display
+  hardware.video.hidpi.enable = lib.mkDefault true;
+}

hosts/dumpyourvms/networking.nix

@@ -0,0 +1,88 @@
+{
+  networkmanager.dns = "systemd-resolved";
+  #resolvconf.enable = true;
+
+  hosts = {
+    "10.0.0.42" = [ "nomad.service.consul" "nomad.service.cgn-1.consul" ];
+    "10.0.0.66" = [ "consul.service.cgn-1.consul" ];
+    "10.0.1.9" = [ "consul.service.lev-1.consul" ];
+    "10.0.0.70" = [ "vault.service.consul" "vault.service.cgn-1.consul" ];
+    "10.0.0.200" = [ "headnode.cgn-1" ];
+    "10.0.0.201" = [ "cn01.cgn-1" ];
+    "10.0.0.202" = [ "cn02.cgn-1" ];
+    "10.0.0.205" = [ "cn05.cgn-1" ];
+    "10.0.0.206" = [ "cn06.cgn-1" ];
+    "10.0.0.207" = [ "cn07.cgn-1" ];
+    "10.0.0.208" = [ "cn08.cgn-1" ];
+    "10.0.1.200" = [ "headnode.lev-1" ];
+    "10.0.1.201" = [ "cn01.lev-1" ];
+    "10.0.1.202" = [ "cn02.lev-1" ];
+    "10.0.1.203" = [ "cn03.lev-1" ];
+    "10.0.1.204" = [ "cn04.lev-1" ];
+    "10.0.1.205" = [ "cn05.lev-1" ];
+    "10.0.1.206" = [ "cn00.lev-1" ];
+    "10.0.1.207" = [ "cn06.lev-1" ];
+    "10.0.1.208" = [ "cn07.lev-1" ];
+    "10.101.64.10" = [ "wifi.bahn.de" ];
+  };
+
+  wireguard.enable = true;
+  wg-quick.interfaces = {
+    wg0 = {
+      address = [ "10.8.8.6/32" ];
+      privateKeyFile = "/etc/wireguard/wg0.privatekey";
+
+      peers = [
+        {
+          publicKey = "l0DJLicCrcrixNP6zAWTXNSEaNM2jML253BXEZ1KpiU=";
+          allowedIPs = [ "10.8.8.16/32" "10.0.0.0/24" "10.88.88.0/24" ];
+          endpoint = "85.88.23.16:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+    wg1 = {
+      address = [ "10.13.0.1/32" ];
+      privateKeyFile = "/etc/wireguard/wg1.privatekey";
+      mtu = 1412;
+
+      peers = [
+        {
+          publicKey = "XS3TTIMU7Jp3JJANBpE14RsVDJk6/VUvZgjQgQP8kAs=";
+          allowedIPs = [ "10.13.0.100/32" "192.168.188.0/24" ];
+          endpoint = "[2a00:6020:48ad:dd00:dea6:32ff:fe85:3306]:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+    wg2 = {
+      address = [ "10.6.6.4/32" ];
+      privateKeyFile = "/etc/wireguard/wg2.privatekey";
+
+      peers = [
+        {
+          publicKey = "nYMmaCIW8lZ7SokivN8HXxYDch+SS1G7ab1SC9meDAw=";
+          presharedKeyFile = "/etc/wireguard/wg2.presharedkey";
+          allowedIPs = [ "10.6.6.1/32" "10.1.1.0/24" ];
+          endpoint = "85.88.23.127:51820";
+          persistentKeepalive = 16;
+        }
+      ];
+    };
+    wg3 = {
+      address = [ "10.11.11.2/32" ];
+      privateKeyFile = "/etc/wireguard/wg3.privatekey";
+      mtu = 1300;
+
+      peers = [
+        {
+          publicKey = "7RRgfZSneqAtAHBeI6+aaYLqz9e1jikg/lIK8mhW928=";
+          presharedKeyFile = "/etc/wireguard/wg3.presharedkey";
+          allowedIPs = [ "10.11.11.1/32" "192.168.1.0/24" "10.0.1.0/24" ];
+          endpoint = "80.71.153.1:51820";
+          persistentKeepalive = 16;
+        }
+      ];
+    };
+  };
+}

hosts/dumpyourvms/unbound.nix

@@ -0,0 +1,52 @@
+{
+  enable = false;
+  localControlSocketPath = "/run/unbound/unbound.ctl";
+  settings = {
+    server = {
+      cache-max-ttl = 14400;
+      cache-min-ttl = 1200;
+      aggressive-nsec = true;
+      prefetch = false;
+      rrset-roundrobin = true;
+      use-caps-for-id = true;
+      do-ip6 = false;
+      hide-identity = true;
+      hide-version = true;
+      do-not-query-localhost = false;
+      tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
+    };
+
+    # fritz.box stub zone
+    stub-zone = {
+      name = "fritz.box";
+      stub-addr = "192.168.13.1";
+    };
+
+    # DNS over DLS forwarding
+    forward-zone = {
+      name = ".";
+      forward-tls-upstream = true;
+
+      forward-addr = [
+        "5.1.66.255@853#dot.ffmuc.net"
+        "185.150.99.255@853#dot.ffmuc.net"
+        "89.233.43.71@853#unicast.censurfridns.dk"
+        "94.130.110.185@853#ns1.dnsprivacy.at"
+
+        "2001:678:e68:f000::@853#dot.ffmuc.net"
+        "2001:678:ed0:f000::@853#dot.ffmuc.net"
+        "2a01:3a0:53:53::0@853#unicast.censurfridns.dk"
+        "2a01:4f8:c0c:3c03::2@853#ns1.dnsprivacy.at"
+        "2a01:4f8:c0c:3bfc::2@853#ns2.dnsprivacy.at"
+
+        "2001:610:1:40ba:145:100:185:15@853#dnsovertls.sinodun.com"
+        "2001:610:1:40ba:145:100:185:16@853#dnsovertls1.sinodun.com"
+        "2a04:b900:0:100::38@853#getdnsapi.net"
+
+        "145.100.185.15@853#dnsovertls.sinodun.com"
+        "145.100.185.16@853#dnsovertls1.sinodun.com"
+        "185.49.141.37@853#getdnsapi.net"
+      ];
+    };
+  };
+}

hosts/fae.nix

@@ -0,0 +1,93 @@
+{ config, lib, pkgs, profiles, ... }:
+{
+  imports = [
+    # profiles.networking
+    #profiles.core
+    "${fetchTarball {
+      url = "https://github.com/NixOS/nixos-hardware/archive/8f1bf828d8606fe38a02df312cf14546ae200a72.tar.gz";
+      sha256 = "11milap153g3f63fcrcv4777vd64f7wlfkk9p3kpxi6dqd2sxvh4";
+      }
+    }/raspberry-pi/4"
+    profiles.users.root # make sure to configure ssh keys
+    profiles.users.pub-solar
+    profiles.base-user
+    profiles.pub-solar-iso
+  ];
+
+  config = {
+    pub-solar.core.iso-options.enable = true;
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-label/NIXOS_SD";
+        fsType = "ext4";
+        options = [ "noatime" ];
+      };
+    };
+
+    environment.systemPackages = with pkgs; [
+      (kodi-gbm.withPackages (p: with p; [ jellyfin netflix youtube ]))
+    ];
+
+    services.openssh.enable = true;
+
+    networking.firewall = {
+      allowedTCPPorts = [ 8080 ];
+      allowedUDPPorts = [ 8080 ];
+    };
+
+    security.sudo.extraConfig = lib.mkAfter ''
+      %wheel    ALL=(ALL) NOPASSWD:ALL
+    '';
+
+    nix = {
+      autoOptimiseStore = true;
+
+      gc.automatic = true;
+
+      optimise.automatic = true;
+
+      useSandbox = true;
+
+      allowedUsers = [ "@wheel" ];
+
+      trustedUsers = [ "root" "@wheel" ];
+
+      extraOptions = ''
+        min-free = 536870912
+        keep-outputs = true
+        keep-derivations = true
+        fallback = true
+      '';
+    };
+
+    # Enable GPU acceleration
+    hardware.raspberry-pi."4".fkms-3d.enable = true;
+
+    # Define a user account for kodi
+    users.extraUsers.kodi.isNormalUser = true;
+
+    services.xserver = {
+      enable = true;
+      desktopManager.kodi.enable = true;
+      desktopManager.kodi.package = pkgs.kodi-gbm;
+      displayManager = {
+        autoLogin.enable = true;
+        autoLogin.user = "kodi";
+      };
+    };
+
+    hardware.pulseaudio.enable = true;
+
+    # custom raspi boot loader is already present
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
+}

hosts/powder/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./powder.nix
+  ];
+}

hosts/powder/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/nixos";
+      autoResize = true;
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-label/boot";
+      fsType = "vfat";
+    };
+
+  fileSystems."/data" =
+    { device = "/dev/disk/by-label/ephemeral0";
+      fsType = "ext4";
+      options = [
+        "defaults"
+        "nofail"
+      ];
+    };
+
+  swapDevices = [ ];
+
+  networking.useDHCP = lib.mkDefault false;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/powder/powder.nix

@@ -0,0 +1,83 @@
+{ config, inputs, lib, pkgs, profiles, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    profiles.users.root # make sure to configure ssh keys
+    profiles.users.pub-solar
+    profiles.base-user
+  ];
+
+  config = {
+    pub-solar.core.iso-options.enable = true;
+
+    # Use the systemd-boot EFI boot loader.
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # Force getting the hostname from cloud-init
+    networking.hostName = lib.mkDefault "";
+
+    # Set your time zone.
+    # time.timeZone = "Europe/Amsterdam";
+
+    # Select internationalisation properties.
+    console = {
+      font = "Lat2-Terminus16";
+      keyMap = "us";
+    };
+
+    # List packages installed in system profile. To search, run:
+    # $ nix search wget
+    environment.systemPackages = with pkgs; [
+      git
+      vim
+      wget
+      caddy
+      # triton tools for retrieving metadata inside zones, e.g. mdata-get
+      inputs.triton-vmtools
+    ];
+
+    # Some programs need SUID wrappers, can be configured further or are
+    # started in user sessions.
+    # programs.mtr.enable = true;
+    # programs.gnupg.agent = {
+    #   enable = true;
+    #   enableSSHSupport = true;
+    # };
+
+    # List services that you want to enable:
+    services.cloud-init.enable = true;
+    services.cloud-init.ext4.enable = true;
+    services.cloud-init.network.enable = true;
+    # use the default NixOS cloud-init config, but add some SmartOS customization to it
+    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
+      datasource_list: [ SmartOS ]
+
+      # Do not create the centos/ubuntu/debian user
+      users: [ ]
+
+      # mount second disk with label ephemeral0, gets formated by cloud-init
+      # this will fail to get added to /etc/fstab as it's read-only, but should
+      # mount at boot anyway
+      mounts:
+      - [ vdb, /data, auto, "defaults,nofail" ]
+    '';
+
+    # Enable the OpenSSH daemon.
+    services.openssh.enable = true;
+
+    # Triton manages firewall rules via the triton fwrule subcommand
+    networking.firewall.enable = false;
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "22.05"; # Did you read the comment?
+  };
+}

hosts/ryzensun/.config/sway/config.d/autostart.conf

@@ -0,0 +1,6 @@
+# Autostart applications
+#
+# Example:
+# exec swayidle
+
+exec qMasterPassword

hosts/ryzensun/.config/sway/config.d/custom-keybindings.conf

@@ -0,0 +1,2 @@
+# switch keyboard input language
+bindsym $mod+tab exec swaymsg input "1118:1896:Microsoft_Microsoft___SiderWinderTM_X4_Keyboard_Consumer_Control" xkb_switch_layout next

hosts/ryzensun/.config/sway/config.d/input-defaults.conf

@@ -0,0 +1,33 @@
+### Input configuration
+#
+# You can get the names of your inputs by running: swaymsg -t get_inputs
+# Read `man 5 sway-input` for more information about this section.
+
+input "type:keyboard" {
+  xkb_layout us(intl),de
+  xkb_options ctrl:nocaps
+}
+
+input "type:touchpad" {
+  natural_scroll enabled
+}
+
+# Touchpad controls
+#bindsym XF86TouchpadToggle exec $HOME/Workspace/ben/toggletouchpad.sh # toggle touchpad
+
+# Screen brightness controls
+bindsym XF86MonBrightnessUp exec "brightnessctl -d intel_backlight set +10%"
+bindsym XF86MonBrightnessDown exec "brightnessctl -d intel_backlight set 10%-"
+
+# Keyboard backlight brightness controls
+bindsym XF86KbdBrightnessDown exec "brightnessctl -d smc::kbd_backlight set 10%-"
+bindsym XF86KbdBrightnessUp exec "brightnessctl -d smc::kbd_backlight set +10%"
+
+# Pulse Audio controls
+bindsym XF86AudioRaiseVolume exec pactl set-sink-volume @DEFAULT_SINK@ +5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #increase sound volume
+bindsym XF86AudioLowerVolume exec pactl set-sink-volume @DEFAULT_SINK@ -5%; exec pactl set-sink-mute @DEFAULT_SINK@ 0 #decrease sound volume
+bindsym XF86AudioMute exec pactl set-sink-mute @DEFAULT_SINK@ toggle # mute sound
+# Media player controls
+bindsym XF86AudioPlay exec "playerctl play-pause; notify-send 'Play/Pause'"
+bindsym XF86AudioNext exec "playerctl next; notify-send 'Next'"
+bindsym XF86AudioPrev exec "playerctl previous; notify-send 'Prev.'"

hosts/ryzensun/.config/sway/config.d/screens.conf

@@ -0,0 +1,33 @@
+### Output configuration
+#
+# Example configuration:
+#
+#   output HDMI-A-1 resolution 1920x1080 position 1920,0
+#
+# You can get the names of your outputs by running: swaymsg -t get_outputs
+
+set $main_screen HDMI-A-1
+
+output $main_screen scale 2
+
+#bindswitch lid:on output $main_screen disable
+#bindswitch lid:off output $main_screen enable
+bindsym $mod+Shift+x output $main_screen toggle
+
+# TODO when using more monitors
+## Manual management of external displays
+# Set the shortcuts and what they do
+#set $mode_display HDMI (i) top, (j) left, (k) bottom, (l) right, (o) off
+#mode "$mode_display" {
+#    bindsym i output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 1080, mode "default"
+#    bindsym j output HDMI-A-1 enable; output HDMI-A-1 pos 0 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 1920 0, mode "default"
+#    bindsym k output HDMI-A-1 enable; output HDMI-A-1 pos 0 900 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym l output HDMI-A-1 enable; output HDMI-A-1 pos 1440 0 bg ~/Pictures/wallpapers/active.png fill; output eDP-1 pos 0 0, mode "default"
+#    bindsym o output HDMI-A-1 disable, mode "default"
+#
+#    # back to normal: Enter or Escape
+#    bindsym Return mode "default"
+#    bindsym Escape mode "default"
+#}
+## Declare here the shortcut to bring the display selection menu
+#bindsym $mod+x mode "$mode_display"

hosts/ryzensun/default.nix

@@ -0,0 +1,6 @@
+{ suites, ... }:
+{
+  imports = [
+    ./ryzensun.nix
+  ] ++ suites.ryzensun;
+}

hosts/ryzensun/hardware-configuration.nix

@@ -0,0 +1,35 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/bad2e49e-c8e7-4516-a6f8-77db999d12b0";
+      fsType = "ext4";
+    };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/ef6c5bb0-0bcf-4af4-bbc9-02c849999e54";
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/2C62-C8B5";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # high-resolution display
+  hardware.video.hidpi.enable = lib.mkDefault true;
+}

hosts/ryzensun/ryzensun.nix

@@ -0,0 +1,57 @@
+{ config, pkgs, lib, self, ... }:
+with lib;
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  config = {
+    age.secrets = {
+      environment-secrets = {
+        file = "${self}/secrets/environment-secrets.age";
+        mode = "700";
+        owner = "teutat3s";
+      };
+      drone_exec_runner_config = {
+        file = "${self}/secrets/drone_exec_runner_config";
+        mode = "700";
+        owner = "999";
+      };
+    };
+
+    pub-solar.nextcloud.enable = mkForce false;
+    pub-solar.docker.enable = true;
+    pub-solar.virtualisation.enable = true;
+    pub-solar.docker-ci-runner = {
+      enable = true;
+      enableKvm = true;
+      nixCacheLocation = "/mnt/internal/ci-cache-nix-store/nix";
+
+      runnerEnvironment = {
+        DRONE_RUNNER_CAPACITY = "1";
+        DRONE_RUNNER_LABELS = "hosttype:baremetal";
+      };
+
+      runnerVarsFile = "/run/agenix/drone_exec_runner_config";
+    };
+
+    home-manager.users."${psCfg.user.name}".xdg.configFile = mkIf psCfg.sway.enable {
+      "sway/config.d/10-custom-keybindings.conf".source = ./.config/sway/config.d/custom-keybindings.conf;
+      "sway/config.d/autostart.conf".source = ./.config/sway/config.d/autostart.conf;
+      "sway/config.d/input-defaults.conf".source = ./.config/sway/config.d/input-defaults.conf;
+      "sway/config.d/screens.conf".source = ./.config/sway/config.d/screens.conf;
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
+}

modules/compat/default.nix

@@ -1,6 +0,0 @@
-{ config, pkgs, lib, ... }: with lib; {
-  # Both things below are for
-  # https://github.com/NixOS/nixpkgs/issues/124215
-  documentation.info.enable = lib.mkForce false;
-  nix.sandboxPaths = [ "/bin/sh=${pkgs.bash}/bin/sh" ];
-}

modules/core/networking.nix

@@ -33,7 +33,8 @@ in
     networking.networkmanager = {
       # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
       enable = true;
-      wifi.backend = "iwd";
+      # not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
+      #wifi.backend = "iwd";
     };
 
     networking.firewall.enable = true;

modules/devops/default.nix

@@ -19,7 +19,7 @@ in
         ansible-lint
         restic
         shellcheck
-        terraform_0_15
+        terraform
       ];
     };
   };

modules/docker-ci-runner/default.nix

@@ -0,0 +1,105 @@
+{ lib, config, pkgs, self, ... }:
+
+with lib;
+let
+  bootstrap = pkgs.writeScript "bootstrap.sh" ''
+    #!/usr/bin/env bash
+
+    set -e
+
+    apt update
+    apt install --yes curl git sudo xz-utils
+
+    adduser --system --uid 999 build
+    chown build /nix
+
+    sudo -u build curl -L https://nixos.org/nix/install > install
+    sudo -u build sh install
+
+    echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
+
+    mkdir /etc/nix
+    echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+
+    export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
+    mkdir -p $(dirname \\$nix_user_config_file)
+    echo '{"extra-experimental-features":{"nix-command flakes":true},"extra-substituters":{"https://nix-dram.cachix.org https://dram.cachix.org  https://nrdxp.cachix.org https://nix-community.cachix.org":true},"extra-trusted-public-keys":{"nix-dram.cachix.org-1:CKjZ0L1ZiqH3kzYAZRt8tg8vewAx5yj8Du/+iR8Efpg= dram.cachix.org-1:baoy1SXpwYdKbqdTbfKGTKauDDeDlHhUpC+QuuILEMY= nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=":true}}' > \\$nix_user_config_file
+    chown -R build /home/build/
+
+    curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
+    sudo install -t /usr/local/bin drone-runner-exec
+
+    if [ ! -f /run/vars ]; then
+      exit 1
+    fi
+
+    cp -a /run/vars /run/runtime-vars
+    env | grep "DRONE" >> /run/runtime-vars
+
+    su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
+  '';
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.docker-ci-runner;
+in
+{
+  options.pub-solar.docker-ci-runner = {
+    enable = lib.mkEnableOption "Enables a systemd service that runs drone-ci-runner";
+
+    enableKvm = lib.mkOption {
+      description = ''
+        Enable kvm support.
+      '';
+      default = true;
+      type = types.bool;
+    };
+
+    nixCacheLocation = lib.mkOption {
+      description = ''
+        Location of nix cache that is shared between builds
+      '';
+      type = types.path;
+    };
+
+    runnerEnvironment = lib.mkOption {
+      description = ''
+        Additional environment vars added to the vars file on container runtime
+      '';
+      default = {};
+    };
+
+    runnerVarsFile = lib.mkOption {
+      description = ''
+        Location of vars file passed to drone runner
+      '';
+      type = types.path;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation = {
+      docker = {
+        enable = true; # sadly podman is not supported rightnow
+      };
+
+      oci-containers = {
+        backend = "docker";
+        containers."drone-exec-runner" = {
+          image = "debian";
+          autoStart = true;
+          entrypoint = "bash";
+          cmd = [ "/bootstrap.sh" ];
+          
+          volumes = [
+            "${cfg.runnerVarsFile}:/run/vars"
+            "${cfg.nixCacheLocation}:/nix"
+            "${bootstrap}:/bootstrap.sh"
+          ];
+
+          environment = cfg.runnerEnvironment;
+          
+          extraOptions = lib.mkIf cfg.enableKvm [ "--device=/dev/kvm" ];
+        };
+      };
+    };
+  };
+}

modules/docker/default.nix

@@ -17,6 +17,7 @@ in
 
     environment.systemPackages = with pkgs; [
       docker-compose
+      docker-compose_2
     ];
   };
 }

modules/graphical/default.nix

@@ -96,7 +96,7 @@ in
       home.packages = [
         alacritty
         foot
-        chromium
+        ungoogled-chromium
         firefox-wayland
 
         flameshot

modules/printing/default.nix

@@ -19,8 +19,13 @@ in
     services.printing.listenAddresses = [ "localhost:631" ];
     services.printing.allowFrom = [ "all" ];
     services.printing.defaultShared = false;
-    services.printing.drivers = [
-      pkgs.gutenprint
+    services.printing.drivers = with pkgs; [
+      gutenprint
+      brgenml1lpr
+      brgenml1cupswrapper
+      brlaser
+      cnijfilter2
+      cups-brother-hl3140cw
     ];
     hardware.sane = {
       enable = true;

modules/social/default.nix

@@ -12,6 +12,7 @@ in
   config = mkIf cfg.enable {
     home-manager = with pkgs; pkgs.lib.setAttrByPath [ "users" psCfg.user.name ] {
       home.packages = [
+        gurk-rs
         signal-desktop
         tdesktop
         element-desktop

modules/sway/config/config.d/custom-keybindings.conf

@@ -2,7 +2,7 @@
 bindsym $mod+z exec --no-startup-id morc_menu
 
 # switch keyboard input language
-bindsym $mod+tab exec toggle-kbd-layout
+#bindsym $mod+tab exec toggle-kbd-layout
 
 ################################################################################################
 ## sound-section -  ##
@@ -24,6 +24,10 @@ bindsym $mod+Shift+F3 exec gksu $term -e vifm
 bindsym $mod+F4 exec nautilus -w
 bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon
 
+# Notifications with swaynotificationcenter
+# Toggle control center
+bindsym $mod+Shift+n exec swaync-client -t -sw
+
 bindsym $mod+Shift+m exec qMasterPassword
 
 # Screenshots and screen recordings

modules/sway/default.nix

@@ -61,6 +61,7 @@ in
           kanshi
           mako
           slurp
+          swaynotificationcenter
           swayidle
           swaylock
           swaybg
@@ -86,7 +87,7 @@ in
         programs.waybar.enable = true;
         #programs.waybar.systemd.enable = true;
 
-        systemd.user.services.mako = import ./mako.service.nix { inherit pkgs psCfg; };
+        systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
         systemd.user.services.sway = import ./sway.service.nix { inherit pkgs psCfg; };
         systemd.user.services.swayidle = import ./swayidle.service.nix { inherit pkgs psCfg; };
         systemd.user.services.xsettingsd = import ./xsettingsd.service.nix { inherit pkgs psCfg; };

modules/sway/mako.service.nix

@@ -1,19 +0,0 @@
-{ pkgs, ... }:
-{
-  Unit = {
-    Description = "Lightweight Wayland notification daemon";
-    Documentation = [ "man:mako(1)" ];
-    BindsTo = [ "sway-session.target" ];
-    After = [ "sway-session.target" ];
-    ConditionEnvironment = [ "WAYLAND_DISPLAY" ];
-  };
-  Service = {
-    Type = "dbus";
-    BusName = "org.freedesktop.Notifications";
-    ExecStart = "${pkgs.mako}/bin/mako";
-    ExecReload = "${pkgs.mako}/bin/makoctl reload";
-  };
-  Install = {
-    WantedBy = [ "sway-session.target" ];
-  };
-}

modules/sway/sway.service.nix

@@ -9,10 +9,10 @@
   };
   Service = {
     Type = "simple";
+    ExecStartPre = "${pkgs.systemd}/bin/systemctl --user unset-environment WAYLAND_DISPLAY DISPLAY";
     ExecStart = "${pkgs.sway}/bin/sway";
     Restart = "on-failure";
     RestartSec = "1";
     TimeoutStopSec = "10";
-    ExecStopPost = "${pkgs.systemd}/bin/systemctl --user unset-environment SWAYSOCK DISPLAY I3SOCK WAYLAND_DISPLAY";
   };
 }

modules/sway/swayidle.service.nix

@@ -10,8 +10,9 @@
   Service = {
     Type = "simple";
     Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
-    ExecStart = ''swayidle -w \
+    ExecStart = ''${pkgs.swayidle}/bin/swayidle -w \
         after-resume 'swaymsg "output * dpms on"' \
+        after-resume '${pkgs.brightnessctl}/bin/brightnessctl -d gmux_backlight set 60%' \
         before-sleep 'swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
         timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
         timeout 150 'systemctl hibernate'

modules/sway/swaynotificationcenter.service.nix

@@ -0,0 +1,22 @@
+pkgs:
+{
+  Unit = {
+    Description = "Swaync notification daemon";
+    Documentation = "https://github.com/ErikReider/SwayNotificationCenter";
+    BindsTo = [ "sway-session.target" ];
+    After = [ "sway-session.target" ];
+    Requisite = [ "graphical-session.target" ];
+    # ConditionEnvironment requires systemd v247 to work correctly
+    ConditionEnvironment = [ "WAYLAND_DISPLAY" ];
+  };
+  Service = {
+    Type = "dbus";
+    BusName = "org.freedesktop.Notifications";
+    ExecStart = "${pkgs.swaynotificationcenter}/bin/swaync";
+    ExecReload = "${pkgs.swaynotificationcenter}/bin/swaync-client --reload-config ; ${pkgs.swaynotificationcenter}/bin/swaync-client --reload-css";
+    Restart = "on-failure";
+  };
+  Install = {
+    WantedBy = [ "sway-session.target" ];
+  };
+}

modules/sway/waybar.service.nix

@@ -11,7 +11,7 @@
 
   Service = {
     Type = "dbus";
-    Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin";
+    Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin:${pkgs.swaynotificationcenter}/bin";
     BusName = "fr.arouillard.waybar";
     ExecStart = "${pkgs.waybar}/bin/waybar";
   };

modules/terminal-life/default.nix

@@ -26,7 +26,6 @@ in
     environment.shells = with pkgs; [
       zsh
     ];
-
     environment.systemPackages = with pkgs; [
       screen
     ];
@@ -40,8 +39,11 @@ in
         fd
         gh
         glow
+        mdbook-multilang
         nnn
+        notes
         powerline
+        python-wiki-fetch
         silver-searcher
         vifm
         watson

modules/terminal-life/nvim/default.nix

@@ -5,66 +5,6 @@ let
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 
   preview-file = pkgs.writeShellScriptBin "preview-file" (import ./preview-file.nix pkgs);
-
-  vimagit-master = pkgs.vimUtils.buildVimPlugin {
-    name = "vimagit-master";
-    src = pkgs.fetchFromGitHub {
-      owner = "jreybert";
-      repo = "vimagit";
-      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
-    };
-  };
-
-  instant-nvim = pkgs.vimUtils.buildVimPlugin {
-    name = "instant";
-    src = pkgs.fetchFromGitHub {
-      owner = "jbyuki";
-      repo = "instant.nvim";
-      rev = "c02d72267b12130609b7ad39b76cf7f4a3bc9554";
-      sha256 = "sha256-7Pr2Au/oGKp5kMXuLsQY4BK5Wny9L1EBdXtyS5EaZPI=";
-    };
-  };
-
-  vim-caddyfile = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-caddyfile";
-    src = pkgs.fetchFromGitHub {
-      owner = "isobit";
-      repo = "vim-caddyfile";
-      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
-    };
-  };
-
-  workspace = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-workspace";
-    src = pkgs.fetchFromGitHub {
-      owner = "thaerkh";
-      repo = "vim-workspace";
-      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
-    };
-  };
-
-  beautify = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-beautify";
-    src = pkgs.fetchFromGitHub {
-      owner = "zeekay";
-      repo = "vim-beautify";
-      rev = "e0691483927dc5a0c051433602397419f9628623";
-      sha256 = "QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
-    };
-  };
-
-  apprentice = pkgs.vimUtils.buildVimPlugin {
-    name = "vim-apprentice";
-    src = pkgs.fetchFromGitHub {
-      owner = "romainl";
-      repo = "Apprentice";
-      rev = "ecd41698037f15a58125b349be76dbd2595bfb6d";
-      sha256 = "sha256-9s7Yzn3IEJBjcyUq9NBIQ9wb45Xr7jOkEIoWf0lAYYg=";
-    };
-  };
 in
 {
   enable = true;
@@ -108,7 +48,7 @@ in
     lsp_extensions-nvim
     nvim-lspconfig
 
-    instant-nvim
+    instant-nvim-nvfetcher
 
     ack-vim
     vim-airline
@@ -119,23 +59,23 @@ in
     syntastic
     vim-gutentags
     vim-vinegar
-    workspace
+    vim-workspace-nvfetcher
 
     sonokai
     vim-hybrid-material
     vim-airline-themes
-    apprentice
+    vim-apprentice-nvfetcher
 
     fugitive
     vim-gitgutter
     vim-rhubarb
-    vimagit-master
+    vimagit-nvfetcher
 
     fzf-vim
     fzfWrapper
     vim-highlightedyank
 
-    beautify
+    vim-beautify-nvfetcher
     vim-surround
 
     vim-bufkill
@@ -144,7 +84,7 @@ in
     ansible-vim
     emmet-vim
     rust-vim
-    vim-caddyfile
+    vim-caddyfile-nvfetcher
     vim-go
     vim-javascript
     vim-json

modules/terminal-life/nvim/lsp.vim

@@ -75,6 +75,8 @@ lua <<EOF
   -- Add additional capabilities supported by nvim-cmp
   local capabilities = vim.lsp.protocol.make_client_capabilities()
   capabilities = require('cmp_nvim_lsp').update_capabilities(capabilities)
+  -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
+  capabilities.textDocument.completion.completionItem.snippetSupport = true
 
   -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
   capabilities.textDocument.completion.completionItem.snippetSupport = true

modules/terminal-life/nvim/neovim-0.6.1.patch

@@ -0,0 +1,99 @@
+diff --git a/modules/terminal-life/nvim/default.nix b/modules/terminal-life/nvim/default.nix
+index e46c82e..02102c4 100644
+--- a/modules/terminal-life/nvim/default.nix
++++ b/modules/terminal-life/nvim/default.nix
+@@ -74,9 +74,7 @@ in
+     nodePackages.typescript-language-server
+     nodePackages.vim-language-server
+     nodePackages.vue-language-server
+-    nodePackages.vscode-css-languageserver-bin
+-    nodePackages.vscode-html-languageserver-bin
+-    nodePackages.vscode-json-languageserver-bin
++    nodePackages.vscode-langservers-extracted
+     nodePackages.yaml-language-server
+     python39Packages.python-lsp-server
+     python3Full
+@@ -131,6 +129,7 @@ in
+     vim-go
+     vim-javascript
+     vim-json
++    SchemaStore-nvim
+     vim-markdown
+     vim-nix
+     vim-ruby
+diff --git a/modules/terminal-life/nvim/lsp.vim b/modules/terminal-life/nvim/lsp.vim
+index 1d5bf4d..83e5d8c 100644
+--- a/modules/terminal-life/nvim/lsp.vim
++++ b/modules/terminal-life/nvim/lsp.vim
+@@ -40,10 +40,10 @@ lua <<EOF
+     buf_set_keymap('n', '<space>rn', '<cmd>lua vim.lsp.buf.rename()<CR>', opts)
+     buf_set_keymap('n', '<space>ca', '<cmd>lua vim.lsp.buf.code_action()<CR>', opts)
+     buf_set_keymap('n', 'gr', '<cmd>lua vim.lsp.buf.references()<CR>', opts)
+-    buf_set_keymap('n', '<space>e', '<cmd>lua vim.lsp.diagnostic.show_line_diagnostics()<CR>', opts)
+-    buf_set_keymap('n', '[d', '<cmd>lua vim.lsp.diagnostic.goto_prev()<CR>', opts)
+-    buf_set_keymap('n', ']d', '<cmd>lua vim.lsp.diagnostic.goto_next()<CR>', opts)
+-    buf_set_keymap('n', '<space>q', '<cmd>lua vim.lsp.diagnostic.set_loclist()<CR>', opts)
++    buf_set_keymap('n', '<space>e', '<cmd>lua vim.diagnostic.open_float()<CR>', opts)
++    buf_set_keymap('n', 'g[', '<cmd>lua vim.diagnostic.goto_prev()<CR>', opts)
++    buf_set_keymap('n', 'g]', '<cmd>lua vim.diagnostic.goto_next()<CR>', opts)
++    buf_set_keymap('n', '<space>q', '<cmd>lua vim.diagnostic.setloclist()<CR>', opts)
+     buf_set_keymap('n', '<space>f', '<cmd>lua vim.lsp.buf.formatting()<CR>', opts)
+ 
+   end
+@@ -51,6 +51,8 @@ lua <<EOF
+   -- Add additional capabilities supported by nvim-cmp
+   local capabilities = vim.lsp.protocol.make_client_capabilities()
+   capabilities = require('cmp_nvim_lsp').update_capabilities(capabilities)
++  -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
++  capabilities.textDocument.completion.completionItem.snippetSupport = true
+ 
+   for lsp_key, lsp_settings in pairs({
+         'bashls', ------------------------------- Bash
+@@ -76,10 +78,14 @@ lua <<EOF
+             }
+         },
+         ['jsonls'] = { -------------------------- JSON
+-            ['cmd'] = {"json-languageserver", "--stdio"}
++            ['settings'] = {
++                ['json'] = {
++                    ['schemas' ] = require('schemastore').json.schemas()
++                }
++            }
+         },
+         'phpactor', ----------------------------- PHP
+-        'pylsp', --------------------------------- Python
++        'pylsp', -------------------------------- Python
+         'rnix', --------------------------------- Nix
+         'solargraph', --------------------------- Ruby
+         'rust_analyzer', ------------------------ Rust
+@@ -90,7 +96,6 @@ lua <<EOF
+             ['filetypes'] = { "terraform", "hcl", "tf" }
+         },
+         'tsserver', ----------------------------- Typescript / JavaScript
+-        'angularls', ---------------------------- Angular
+         'vuels', -------------------------------- Vue
+         'svelte', ------------------------------- Svelte
+         ['yamlls'] = { -------------------------- YAML
+@@ -126,6 +131,13 @@ lua <<EOF
+     end
+   end -- ‡
+ 
++  -- configure floating diagnostics appearance, symbols
++  local signs = { Error = " ", Warn = " ", Hint = " ", Info = " " }
++  for type, icon in pairs(signs) do
++    local hl = "DiagnosticSign" .. type
++    vim.fn.sign_define(hl, { text = icon, texthl = hl, numhl = hl })
++  end
++
+   -- Set completeopt to have a better completion experience
+   vim.o.completeopt = 'menuone,noselect'
+ 
+@@ -184,7 +196,7 @@ let g:diagnostic_trimmed_virtual_text = '40'
+ let g:diagnostic_insert_delay = 1
+ 
+ " Show diagnostic popup on cursor hold
+-autocmd CursorHold * lua vim.lsp.diagnostic.show_line_diagnostics({ focusable = false })
++autocmd CursorHold,CursorHoldI * lua vim.diagnostic.open_float(nil, { focus = false, scope = "cursor" })
+ 
+ " Goto previous/next diagnostic warning/error
+ " nnoremap <silent> g[ <cmd>PrevDiagnosticCycle<cr>

modules/terminal-life/nvim/ui.vim

@@ -1,18 +1,18 @@
-let g:base16_shell_path = $XDG_CONFIG_HOME . "/zsh/base16.sh"
-let base16colorspace = 256
+"let g:base16_shell_path = $XDG_CONFIG_HOME . "/zsh/base16.sh"
+"let base16colorspace = 256
 set termguicolors
-let g:sonokai_style = 'shusia'
-let g:sonokai_enable_italic = 1
-let g:sonokai_disable_italic_comment = 1
-let g:sonokai_transparent_background = 1
-colorscheme sonokai
+"let g:sonokai_style = 'shusia'
+"let g:sonokai_enable_italic = 1
+"let g:sonokai_disable_italic_comment = 1
+"let g:sonokai_transparent_background = 1
 set background=dark
+colorscheme apprentice
 
 let g:airline#extensions#tabline#enabled = 1 " Enable the list of buffers
 let g:airline#extensions#tabline#fnamemod = ':t' " Show just the filename
 let g:airline#extensions#tabline#formatter = 'unique_tail_improved'
 let g:airline_powerline_fonts = 1 " Use powerline fonts
-let g:airline_theme = 'sonokai'
+let g:airline_theme = 'apprentice'
 
 " Customize fzf colors to match your color scheme
 " - fzf#wrap translates this to a set of `--color` options

modules/terminal-life/zsh/default.nix

@@ -40,46 +40,27 @@ in
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
   };
   plugins = [
+    # src gets fetched by nvfetcher, see: ./pkgs/sources.toml
     {
       # will source ohmyzsh/plugins/z/
       name = "zsh-plugins-z";
-      file = "plugins/z/z.sh";
-      src = pkgs.fetchFromGitHub {
-        owner = "ohmyzsh";
-        repo = "ohmyzsh";
-        rev = "249c708ed3a4a7a63d16a6e911a46b6fb9623cbd";
-        sha256 = "sha256-NAVotL5RxpS/zKnO+ngMIjv787lqc1dj/c4blQrQcvU=";
-      };
+      file = "plugins/z/z.plugin.zsh";
+      src = pkgs.sources.ohmyzsh.src;
     }
     {
       name = "zsh-powerlevel10k";
       file = "powerlevel10k.zsh-theme";
-      src = pkgs.fetchFromGitHub {
-        owner = "romkatv";
-        repo = "powerlevel10k";
-        rev = "2dd6a29e4d7a33bfef10973d6550e087be37ddee";
-        sha256 = "sha256-9vc4cMBCNOmPOyzGwnPeMrXXyQUq4pC9Du3AWl9+Rys=";
-      };
+      src = pkgs.sources.powerlevel10k.src;
     }
     {
       name = "zsh-fast-syntax-highlighting";
       file = "F-Sy-H.plugin.zsh";
-      src = pkgs.fetchFromGitHub {
-        owner = "z-shell";
-        repo = "F-Sy-H";
-        rev = "c4bdc485b67b58351a24f21fcac92c9e0232b939";
-        sha256 = "sha256-uXBGIdJwubuueNhQRdGxPUi0eJN17cflYAuHTjeQ8FQ=";
-      };
+      src = pkgs.sources.F-Sy-H.src;
     }
     {
       name = "zsh-nix-shell";
       file = "nix-shell.plugin.zsh";
-      src = pkgs.fetchFromGitHub {
-        owner = "chisui";
-        repo = "zsh-nix-shell";
-        rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-        sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
-      };
+      src = pkgs.sources.zsh-nix-shell.src;
     }
   ];
 
@@ -134,6 +115,5 @@ in
     source ${pkgs.fzf}/share/fzf/completion.zsh
     source ${pkgs.git-bug}/share/zsh/site-functions/git-bug
     eval "$(direnv hook zsh)"
-  ''
-  + builtins.readFile ./fzf.zsh;
+  '';
 }

modules/terminal-life/zsh/fzf.zsh

@@ -1,58 +0,0 @@
-# Use ~~ as the trigger sequence instead of the default **
-export FZF_COMPLETION_TRIGGER='~~'
-
-# Options to fzf command
-export FZF_COMPLETION_OPTS='--border --info=inline'
-
-__fzfcmd() {
-  echo "fzf"
-}
-
-# ctrl+r - Paste the selected command from history into the command line
-fzf-history-widget() {
-  local selected num
-  setopt localoptions noglobsubst noposixbuiltins pipefail HIST_FIND_NO_DUPS 2> /dev/null
-
-  selected=( $(fc -rl 1 |
-    FZF_DEFAULT_OPTS="--height ${FZF_TMUX_HEIGHT:-40%} $FZF_DEFAULT_OPTS -n2..,.. --tiebreak=index --bind=ctrl-r:toggle-sort $FZF_CTRL_R_OPTS --query=${(qqq)LBUFFER} +m" $(__fzfcmd)) )
-  local ret=$?
-  if [ -n "$selected" ]; then
-    num=$selected[1]
-    if [ -n "$num" ]; then
-      zle vi-fetch-history -n $num
-    fi
-  fi
-  zle redisplay
-  typeset -f zle-line-init >/dev/null && zle zle-line-init
-  return $ret
-}
-zle     -N   fzf-history-widget
-bindkey '^R' fzf-history-widget
-
-# Use fd (https://github.com/sharkdp/fd) instead of the default find
-# command for listing path candidates.
-# - The first argument to the function ($1) is the base path to start traversal
-# - See the source code (completion.{bash,zsh}) for the details.
-_fzf_compgen_path() {
-  fd --hidden --follow --exclude ".git" . "$1"
-}
-
-# Use fd to generate the list for directory completion
-_fzf_compgen_dir() {
-  fd --type d --hidden --follow --exclude ".git" . "$1"
-}
-
-# (EXPERIMENTAL) Advanced customization of fzf options via _fzf_comprun function
-# - The first argument to the function is the name of the command.
-# - You should make sure to pass the rest of the arguments to fzf.
-_fzf_comprun() {
-  local command=$1
-  shift
-
-  case "$command" in
-    cd)           fzf "$@" --preview 'tree -C {} | head -200' ;;
-    export|unset) fzf "$@" --preview "eval 'echo \$'{}" ;;
-    ssh)          fzf "$@" --preview 'dig {}' ;;
-    *)            fzf "$@" ;;
-  esac
-}

modules/virtualisation/default.nix

@@ -32,8 +32,9 @@ in
       libvirt
       libvirt-glib
       qemu
+      vagrant
       virt-manager
-      python38Packages.libvirt
+      python39Packages.libvirt
       gvfs
       edk2
       OVMF
@@ -50,11 +51,11 @@ in
     systemd.tmpfiles.rules = [
       "f  /dev/shm/looking-glass  0660  ${psCfg.user.name}  kvm"
     ];
-    networking.bridges.virbr1.interfaces = [ ];
-    networking.interfaces.virbr1 = {
-      ipv4.addresses = [
-        { address = "192.168.123.1"; prefixLength = 24; }
-      ];
-    };
+    #networking.bridges.virbr1.interfaces = [ ];
+    #networking.interfaces.virbr1 = {
+    #  ipv4.addresses = [
+    #    { address = "192.168.123.1"; prefixLength = 24; }
+    #  ];
+    #};
   };
 }

overlays/mdbook-multilang.nix

@@ -0,0 +1,20 @@
+final: prev: {
+  mdbook-multilang = prev.mdbook.overrideAttrs (oldAttrs: rec {
+    pname = "mdbook";
+
+    version = "pr1306";
+
+    src = prev.fetchFromGitHub {
+      owner = "Ruin0x11";
+      repo = "mdBook";
+      rev = "9d8147c52dd9d50047ba5b29e4af99f92577806e";
+      sha256 = "sha256-gJnQKHssO2ChiT4d037Lncd7hiOa5uh756p8TzPzbgQ=";
+    };
+
+    cargoDeps = oldAttrs.cargoDeps.overrideAttrs (prev.lib.const {
+      name = "${pname}-vendor.tar.gz";
+      inherit src;
+      outputHash = "sha256-QCEyl5FZqECYYb5eRm8mn+R6owt+CLQwCq/AMMPygE0=";
+    });
+  });
+}

overlays/neovim-plugins.nix

@@ -0,0 +1,22 @@
+final: prev: {
+  vimPlugins = prev.vimPlugins // {
+    instant-nvim-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.instant-nvim-nvfetcher) pname version src;
+    };
+    vimagit-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vimagit-nvfetcher) pname version src;
+    };
+    vim-caddyfile-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-caddyfile-nvfetcher) pname version src;
+    };
+    vim-workspace-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-workspace-nvfetcher) pname version src;
+    };
+    vim-beautify-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-beautify-nvfetcher) pname version src;
+    };
+    vim-apprentice-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
+      inherit (prev.sources.vim-apprentice-nvfetcher) pname version src;
+    };
+  };
+}

overlays/overrides.nix

@@ -19,8 +19,18 @@ channels: final: prev: {
     tdesktop
     arduino
     arduino-cli
+
+    gurk-rs
+    thunderbird
+    swaynotificationcenter
+    yubikey-agent
     ;
 
+  #inherit (channels.master)
+  #  ;
+
+  #inherit (channels.fork)
+  #  ;
 
   haskellPackages = prev.haskellPackages.override
     (old: {
@@ -33,4 +43,7 @@ channels: final: prev: {
             haskell-language-server;
         });
     });
+
+  # Example to override node package
+  # nodePackages = prev.nodePackages // { inherit (channels.latest.nodePackages) manta; };
 }

overlays/python-wik.nix

@@ -0,0 +1,24 @@
+final: prev: with prev.python310Packages; {
+  python-wiki-fetch = buildPythonPackage rec {
+    inherit (prev.sources.wik) pname version src;
+
+    checkPhase = ''
+      cd test
+      ${python.interpreter} test.py
+    '';
+
+    format = "flit";
+
+    propagatedBuildInputs = [
+      beautifulsoup4
+      requests
+    ];
+
+    meta = with prev.lib; {
+      description = "wik is a tool to view wikipedia pages from your terminal";
+      homepage = "https://github.com/yashsinghcodes/wik";
+      license = licenses.mit;
+      maintainers = with maintainers; [ teutat3s ];
+    };
+  };
+}

overlays/rnix-lsp.nix

@@ -1,13 +1,6 @@
 final: prev: {
   rnix-lsp = prev.rnix-lsp.overrideAttrs (oldAttrs: rec {
-    version = "unstable-2022-07-28";
-
-    src = prev.fetchFromGitHub {
-      owner = "nix-community";
-      repo = "rnix-lsp";
-      rev = "ff18e04551a39ccdab0ff9c83926db3807b23478";
-      sha256 = "sha256-4OIpATLdPQvryyhRQPELeqNYC0n6PCyjD6LCPdwOztc=";
-    };
+    inherit (prev.sources.rnix-lsp-nvfetcher) pname version src;
 
     cargoDeps = oldAttrs.cargoDeps.overrideAttrs (prev.lib.const {
       name = "rnix-lsp-vendor.tar.gz";

pkgs/_sources/generated.nix

@@ -1,16 +1,147 @@
 # This file was generated by nvfetcher, please do not modify it manually.
-{ fetchgit, fetchurl }:
+{ fetchgit, fetchurl, fetchFromGitHub }:
 {
+  F-Sy-H = {
+    pname = "F-Sy-H";
+    version = "b935a87a75560f8173dd78deee6717c59d464e06";
+    src = fetchFromGitHub ({
+      owner = "z-shell";
+      repo = "F-Sy-H";
+      rev = "b935a87a75560f8173dd78deee6717c59d464e06";
+      fetchSubmodules = false;
+      sha256 = "sha256-448OlDnrDkUjvaSLDhXsa9bkgYXzj1Ju8CTpJVjH8LM=";
+    });
+  };
+  instant-nvim-nvfetcher = {
+    pname = "instant-nvim-nvfetcher";
+    version = "294b6d08143b3db8f9db7f606829270149e1a786";
+    src = fetchFromGitHub ({
+      owner = "jbyuki";
+      repo = "instant.nvim";
+      rev = "294b6d08143b3db8f9db7f606829270149e1a786";
+      fetchSubmodules = false;
+      sha256 = "sha256-DXJWji/NR8ZCxe014rD51v3EHJHMhRQeOoI3SsY8mR4=";
+    });
+  };
   manix = {
     pname = "manix";
     version = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
-    src = fetchgit {
-      url = "https://github.com/mlvzk/manix";
+    src = fetchFromGitHub ({
+      owner = "mlvzk";
+      repo = "manix";
       rev = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
       fetchSubmodules = false;
-      deepClone = false;
-      leaveDotGit = false;
-      sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
-    };
+      sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
+    });
+  };
+  ohmyzsh = {
+    pname = "ohmyzsh";
+    version = "a7d910c3a61d8599f748a8ddae59ecdd9424022a";
+    src = fetchFromGitHub ({
+      owner = "ohmyzsh";
+      repo = "ohmyzsh";
+      rev = "a7d910c3a61d8599f748a8ddae59ecdd9424022a";
+      fetchSubmodules = false;
+      sha256 = "sha256-BWpvRkUXQhP1VLrlTBqqXvycyPFZaIZmgMfrkqIugSY=";
+    });
+  };
+  powerlevel10k = {
+    pname = "powerlevel10k";
+    version = "8091c8a3a8a845c70046684235a01cd500075def";
+    src = fetchFromGitHub ({
+      owner = "romkatv";
+      repo = "powerlevel10k";
+      rev = "8091c8a3a8a845c70046684235a01cd500075def";
+      fetchSubmodules = false;
+      sha256 = "sha256-I0/tktXCbZ3hMYTNvPoWfOEYWRgmHoXsar/jcUB6bpo=";
+    });
+  };
+  rnix-lsp-nvfetcher = {
+    pname = "rnix-lsp-nvfetcher";
+    version = "6925256babec4307479a4080b44f2be38056f210";
+    src = fetchFromGitHub ({
+      owner = "nix-community";
+      repo = "rnix-lsp";
+      rev = "6925256babec4307479a4080b44f2be38056f210";
+      fetchSubmodules = false;
+      sha256 = "sha256-OKLyIXIXhUnRB3Xw+7zI3u6XkwF7Mrbfz1XaasV6i7Q=";
+    });
+  };
+  vim-apprentice-nvfetcher = {
+    pname = "vim-apprentice-nvfetcher";
+    version = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
+    src = fetchFromGitHub ({
+      owner = "romainl";
+      repo = "Apprentice";
+      rev = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
+      fetchSubmodules = false;
+      sha256 = "sha256-Xs+vTdnihNbBFPOKsW+NB40pqN9eaadqzc0DIeNoOFo=";
+    });
+  };
+  vim-beautify-nvfetcher = {
+    pname = "vim-beautify-nvfetcher";
+    version = "e0691483927dc5a0c051433602397419f9628623";
+    src = fetchFromGitHub ({
+      owner = "zeekay";
+      repo = "vim-beautify";
+      rev = "e0691483927dc5a0c051433602397419f9628623";
+      fetchSubmodules = false;
+      sha256 = "sha256-QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
+    });
+  };
+  vim-caddyfile-nvfetcher = {
+    pname = "vim-caddyfile-nvfetcher";
+    version = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+    src = fetchFromGitHub ({
+      owner = "isobit";
+      repo = "vim-caddyfile";
+      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+      fetchSubmodules = false;
+      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
+    });
+  };
+  vim-workspace-nvfetcher = {
+    pname = "vim-workspace-nvfetcher";
+    version = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+    src = fetchFromGitHub ({
+      owner = "thaerkh";
+      repo = "vim-workspace";
+      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+      fetchSubmodules = false;
+      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
+    });
+  };
+  vimagit-nvfetcher = {
+    pname = "vimagit-nvfetcher";
+    version = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+    src = fetchFromGitHub ({
+      owner = "jreybert";
+      repo = "vimagit";
+      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+      fetchSubmodules = false;
+      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
+    });
+  };
+  wik = {
+    pname = "wik";
+    version = "aca76040770543a55b8fb0574901bf52df099c34";
+    src = fetchFromGitHub ({
+      owner = "yashsinghcodes";
+      repo = "wik";
+      rev = "aca76040770543a55b8fb0574901bf52df099c34";
+      fetchSubmodules = false;
+      sha256 = "sha256-qFNRzgXFyOgIvtNKR+7NG5lvQObjgezfRaloA7VH9Lc=";
+    });
+  };
+  zsh-nix-shell = {
+    pname = "zsh-nix-shell";
+    version = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+    src = fetchFromGitHub ({
+      owner = "chisui";
+      repo = "zsh-nix-shell";
+      rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
+      fetchSubmodules = false;
+      sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
+    });
   };
 }

pkgs/default.nix

@@ -3,11 +3,13 @@ with final; {
   # keep sources this first
   sources = prev.callPackage (import ./_sources/generated.nix) { };
   # then, call packages with `final.callPackage`
+  gpu-switch = writeShellScriptBin "gpu-switch" (import ./gpu-switch.nix final);
   import-gtk-settings = writeShellScriptBin "import-gtk-settings" (import ./import-gtk-settings.nix final);
   lgcl = writeShellScriptBin "lgcl" (import ./lgcl.nix final);
   mailto-mutt = writeShellScriptBin "mailto-mutt" (import ./mailto-mutt.nix final);
   mopidy-jellyfin = import ./mopidy-jellyfin.nix final;
   mu = writeShellScriptBin "mu" (import ./mu.nix final);
+  notes = writeShellScriptBin "notes" (import ./notes.nix final);
   psos = writeShellScriptBin "psos" (import ./psos.nix final);
   psos-docs = import ./psos-docs.nix final;
   s = writeShellScriptBin "s" (import ./s.nix final);

pkgs/gpu-switch.nix

@@ -0,0 +1,69 @@
+self: with self; ''
+  # Copyright (c) 2014-2015 Bruno Bierbaumer, Andreas Heider
+
+  readonly sysfs_efi_vars='/sys/firmware/efi/efivars'
+  readonly efi_gpu='gpu-power-prefs-fa4ce28d-b62f-4c99-9cc3-6815686e30f9'
+
+  usage(){
+    cat <<EOF
+  Usage:
+    $(basename $0) --integrated   # Switch to the integrated GPU
+    $(basename $0) --dedicated    # Switch to the dedicated GPU
+    $(basename $0) --help         # Show this message
+
+  Switches between the integrated and dedicated graphics cards of a dual-GPU
+  MacBook Pro for the next reboot.
+
+  Arguments:
+    -i, --integrated
+    -d, --dedicated
+    -h, --help
+
+  Tested hardware:
+    MacBook Pro 5,2  (Early 2009, Non-Retina)
+    MacBook Pro 5,3  (Mid   2009, Non-Retina)
+    MacBook Pro 8,2  (Late  2011, Non-Retina)
+    MacBook Pro 9,1  (Mid   2012, Non-Retina)
+    MacBook Pro 10,1 (Mid   2012, Retina)
+    MacBook Pro 11,3 (Late  2013, Retina)
+    MacBook Pro 11,5 (Mid   2015, Retina)
+  EOF
+  }
+
+  switch_gpu(){
+    if ! [ -d /sys/firmware/efi ]; then
+      printf "Fatal: $(basename $0) has to be run in EFI mode.\n" 1>&2
+      exit 1
+    fi
+
+    if ! mount | grep -q $sysfs_efi_vars; then
+      if ! mount -t efivarfs none $sysfs_efi_vars; then
+        printf "Fatal: Couldn't mount ''${sysfs_efi_vars}.\n" 1>&2
+        exit 1
+      fi
+    fi
+    chattr -i "''${sysfs_efi_vars}/''${efi_gpu}" 2> /dev/null
+    printf "\x07\x00\x00\x00\x''${1}\x00\x00\x00" > "''${sysfs_efi_vars}/''${efi_gpu}"
+  }
+
+  if [ $# -ne 1 ]; then
+    usage 1>&2
+    exit 1
+  fi
+
+  case "$1" in
+    -i|--integrated)
+      switch_gpu 1
+    ;;
+    -d|--dedicated)
+      switch_gpu 0
+    ;;
+    -h|--help)
+      usage
+    ;;
+    *)
+      usage 1>&2
+      exit 1
+    ;;
+  esac
+''

pkgs/notes.nix

@@ -0,0 +1,19 @@
+self: with self; ''
+  #
+  # ack recursively through notes
+  #
+  # uses ack: https://beyondgrep.com
+
+  NOTESDIR=~/pub.solar-nc/Notes
+  ACK_PREFIX="ack --files-with-matches"
+  cd $NOTESDIR || exit
+  file="$(
+      FZF_DEFAULT_COMMAND="$ACK_PREFIX '$1'" \
+      fzf --sort --preview="[[ ! -z {} ]] && ack --colour --context 5 {q} {}" \
+          --phony -q "$1" \
+          --bind "change:reload:$ACK_PREFIX {q}" \
+          --preview-window="70%:wrap"
+  )" &&
+  echo "opening $file" &&
+  bat --theme=TwoDark "$file"
+''

pkgs/sources.toml

@@ -2,3 +2,51 @@
 [manix]
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
+
+[wik]
+src.git = "https://github.com/yashsinghcodes/wik"
+fetch.github = "yashsinghcodes/wik"
+
+[ohmyzsh]
+src.git = "https://github.com/ohmyzsh/ohmyzsh"
+fetch.github = "ohmyzsh/ohmyzsh"
+
+[powerlevel10k]
+src.git = "https://github.com/romkatv/powerlevel10k"
+fetch.github = "romkatv/powerlevel10k"
+
+[F-Sy-H]
+src.git = "https://github.com/z-shell/F-Sy-H"
+fetch.github = "z-shell/F-Sy-H"
+
+[zsh-nix-shell]
+src.git = "https://github.com/chisui/zsh-nix-shell"
+fetch.github = "chisui/zsh-nix-shell"
+
+[rnix-lsp-nvfetcher]
+src.git = "https://github.com/nix-community/rnix-lsp"
+fetch.github = "nix-community/rnix-lsp"
+
+[vimagit-nvfetcher]
+src.git = "https://github.com/jreybert/vimagit"
+fetch.github = "jreybert/vimagit"
+
+[instant-nvim-nvfetcher]
+src.git = "https://github.com/jbyuki/instant.nvim"
+fetch.github = "jbyuki/instant.nvim"
+
+[vim-caddyfile-nvfetcher]
+src.git = "https://github.com/isobit/vim-caddyfile"
+fetch.github = "isobit/vim-caddyfile"
+
+[vim-workspace-nvfetcher]
+src.git = "https://github.com/thaerkh/vim-workspace"
+fetch.github = "thaerkh/vim-workspace"
+
+[vim-beautify-nvfetcher]
+src.git = "https://github.com/zeekay/vim-beautify"
+fetch.github = "zeekay/vim-beautify"
+
+[vim-apprentice-nvfetcher]
+src.git = "https://github.com/romainl/Apprentice"
+fetch.github = "romainl/Apprentice"

profiles/base-user/.config/git/config.nix

@@ -14,7 +14,6 @@ in
   pol = pull
   ack = -c color.grep.linenumber=\"bold yellow\"\n    -c color.grep.filename=\"bold green\"\n    -c color.grep.match=\"reverse yellow\"\n    grep --break --heading --line-number
 # define command which will be used when "nvim"is set as a merge tool
-
 [mergetool]
   prompt = false
 [merge]

profiles/base-user/.config/swaync/config.json

@@ -0,0 +1,12 @@
+{
+  "positionX": "right",
+  "positionY": "top",
+  "timeout": 10,
+  "timeout-low": 5,
+  "timeout-critical": 0,
+  "notification-window-width": 500,
+  "keyboard-shortcuts": true,
+  "image-visibility": "always",
+  "transition-time": 200,
+  "hide-on-clear": false
+}

profiles/base-user/.config/swaync/style.css

@@ -0,0 +1,149 @@
+/*
+ * vim: ft=less
+ */
+
+@define-color border-color rgb(7, 7, 7);
+@define-color bg rgb(58, 58, 58);
+@define-color bg-hover rgb(68, 68, 68);
+@define-color bg-focus rgba(68, 68, 68, 0.6);
+@define-color bg-selected rgb(0, 128, 255);
+
+.notification-row {
+  outline: none;
+}
+.notification-row:focus,
+.notification-row:hover {
+  background: @bg-focus;
+}
+
+.notification {
+  border-radius: 10px;
+  margin: 6px 12px;
+  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
+  padding: 0;
+}
+
+.notification-content {
+  background: transparent;
+  padding: 6px;
+  border-radius: 10px;
+}
+
+.close-button {
+  background: black;
+  color: white;
+  text-shadow: none;
+  padding: 0 2px;
+  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
+  border-radius: 100%;
+}
+.close-button:hover {
+  background: rgb(30, 30, 30);
+  transition: all 0.15s ease-in-out;
+}
+
+.notification-default-action,
+.notification-action {
+  padding: 4px;
+  margin: 0;
+  box-shadow: none;
+  background: @bg;
+  border: 1px solid @border-color;
+}
+
+.notification-default-action:hover,
+.notification-action:hover {
+  background: @bg-hover;
+}
+
+.notification-default-action {
+  border-radius: 10px;
+}
+
+/* When alternative actions are visible */
+.notification-default-action:not(:only-child) {
+  border-bottom-left-radius: 0px;
+  border-bottom-right-radius: 0px;
+}
+
+.notification-action {
+  border-radius: 0px;
+  border-top: none;
+  border-right: none;
+}
+
+/* add bottom border radius to eliminate clipping */
+.notification-action:first-child {
+  border-bottom-left-radius: 10px;
+}
+.notification-action:last-child {
+  border-bottom-right-radius: 10px;
+  border-right: 1px solid @border-color;
+}
+
+.image {
+}
+
+.body-image {
+  margin-top: 6px;
+  background-color: white;
+  border-radius: 10px;
+}
+
+.summary {
+  color: white;
+  text-shadow: none;
+}
+
+.time {
+  color: white;
+  text-shadow: none;
+}
+
+.body {
+  background: transparent;
+  color: white;
+  text-shadow: none;
+}
+
+.top-action-title {
+  color: white;
+  text-shadow: none;
+}
+
+.control-center-clear-all {
+  color: white;
+  text-shadow: none;
+  background: @bg;
+  border: 1px solid @border-color;
+  box-shadow: none;
+  border-radius: 10px;
+}
+.control-center-clear-all:hover {
+  background: @bg-hover;
+}
+
+.control-center-dnd {
+  border-radius: 10px;
+  background: @bg;
+  border: 1px solid @border-color;
+  box-shadow: none;
+}
+
+.control-center-dnd:checked {
+  background: @bg-selected;
+}
+.control-center-dnd slider {
+  background: @bg-hover;
+}
+
+.control-center {
+  background: rgba(0, 0, 0, 0.7);
+}
+.control-center-list {
+  background: transparent;
+}
+
+.floating-notifications {
+  background: transparent;
+}

profiles/base-user/.config/waybar/config

@@ -5,87 +5,95 @@
   "height": 26, // Waybar height
   "modules-left": ["sway/workspaces", "sway/mode"],
   //"modules-center": ["mpd"],
-  "modules-right": ["sway/language", "pulseaudio", "network", "idle_inhibitor", "battery", "clock", "tray"],
+  "modules-right": [
+    "sway/language",
+    "backlight",
+    "custom/notification",
+    "pulseaudio",
+    "network",
+    "idle_inhibitor",
+    "battery",
+    "clock",
+    "tray"
+  ],
   "sway/workspaces": {
-    "disable-scroll": true
+      "disable-scroll": true
   },
   "sway/mode": {
   "tooltip": false,
-    "format": "{}"
+      "format": "{}"
   },
   "sway/window": {
-    "tooltip": false,
-    "max-length": 96
+  "tooltip": false,
+      "max-length": 96
   },
   "sway/language": {
-    "format": "{}",
-    "max-length": 50
+  "format": "{}",
+  "max-length": 50
   },
   "tray": {
-    "icon-size": 21,
-    "spacing": 10
+      "icon-size": 21,
+      "spacing": 10
   },
   "clock": {
-    "tooltip-format": "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>",
-    "format-alt": "{:%a %d. %h %H:%M}"
+      "tooltip-format": "<big>{:%Y %B}</big>\n<tt><small>{calendar}</small></tt>",
+      "format-alt": "{:%a %d. %h %H:%M}"
   },
   "backlight": {
-    // "device": "acpi_video1",
-    "tooltip": true,
-    "tooltip-format": "Brightness: <big>{percent}%</big>",
-    "format": "<span font='10'>{icon}</span>",
-    "format-icons": ["", ""]
+      "device": "gmux_backlight",
+      "format": "<span font='10'> {percent}%</span> {icon}",
+      "format-icons": ["", ""]
   },
   "cpu": {
-    "format": "{}% "
+      "format": "{}% "
   },
   "memory": {
-    "format": "{}% "
+      "format": "{}% "
   },
   "idle_inhibitor": {
-    "format": "<span font='10'>{icon} </span>",
-    "format-icons": {
-      "activated": "",
-      "deactivated": ""
-    }
+      "format": "{icon} ",
+      "format-icons": {
+          "activated": "",
+          "deactivated": ""
+      }
   },
   "battery": {
-    "tooltip": false,
-    "states": {
-      "critical": 25
-    },
-    "full-at": 84,
-    "format": "<span font='10'>{icon}</span> {capacity}%",
-    "format-full": "<span font='10'>{icon}</span>",
-    "format-icons": ["", "", "", "", ""],
+      "tooltip": false,
+      "states": {
+          "critical": 25
+      },
+      //"full-at": 84,
+      "format": "{icon}<span font='10'> {capacity}%</span>",
+      "format-full": "{icon}",
+      "format-icons": ["", "", "", "", ""],
   },
   "network": {
-    "interval": 3,
-    "tooltip": true,
-    //"interface": "wlp4s0", // (Optional) To force the use of this interface          \uF2E7,
-    "format-wifi": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
-    "format-ethernet": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
-    "format-disconnected": "",
-    "tooltip-format-wifi": "{essid} ({signalStrength}%)  {ipaddr}",
-    "tooltip-format-ethernet": "{ifname}  {ipaddr}"
+      "interval": 3,
+      "tooltip": true,
+      "interface": "wlp4s0", // (Optional) To force the use of this interface          \uF2E7,
+      "format-wifi": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
+      "format-ethernet": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
+      "format-disconnected": "",
+      "tooltip-format-wifi": "{essid} ({signalStrength}%)  {ipaddr}",
+      "tooltip-format-ethernet": "{ifname}  {ipaddr}"
   },
   //\ue04f{volume}%
   "pulseaudio": {
-    "tooltip": false,
-    "format": "{volume}% <span font='10'>{icon}</span>",
-    "format-bluetooth": "{volume}% <span font='10'>{icon}</span>",
-    "format-muted": "",
-    "on-click": "pavucontrol",
-    "format-alt": "{volume}% <span font='10'>{icon}</span>",
-    "format-icons": {
-      "headphones": "",
-      "handsfree": "",
-      "headset": "",
-      "phone": "",
-      "portable": "",
-      "car": "",
-      "default": ["","", ""]
-    }
+      "tooltip": false,
+      "format": "<span font='10'>{volume}%</span> {icon}",
+      "format-bluetooth": "{volume}% <span font='10'>{icon}</span>",
+      "format-muted": "",
+      "on-click": "pavucontrol",
+      "format-alt": "{volume}% <span font='10'>{icon}</span>",
+      "format-icons": {
+          "headphones": "",
+          "handsfree": "",
+          "headset": "",
+          "phone": "",
+          "portable": "",
+          "car": "",
+          "default": ["","", ""]
+      }
   },
   "mpd": {
     "format": "{artist} - {title} <span color=\"#999999\">[<span color=\"#ffffff\">{elapsedTime:%M:%S}</span> / {totalTime:%M:%S}]</span>",
@@ -98,5 +106,21 @@
     },
     "tooltip-format": "MPD (connected)",
     "tooltip-format-disconnected": "MPD (disconnected)"
-  }
+  },
+  "custom/notification": {
+    "tooltip": false,
+    "format": " {icon}",
+    "format-icons": {
+      "notification": "<span foreground='red'><sup></sup></span>",
+      "none": "",
+      "dnd-notification": "<span foreground='red'><sup></sup></span>",
+      "dnd-none": ""
+    },
+    "return-type": "json",
+    "exec-if": "which swaync-client",
+    "exec": "swaync-client -swb",
+    "on-click": "swaync-client -t -sw",
+    "on-click-right": "swaync-client -d -sw",
+    "escape": true
+  },
 }

profiles/base-user/.config/waybar/style.css

@@ -14,7 +14,6 @@ window#waybar {
     color: @base04;
 }
 
-
 #workspaces button {
     font-size: 14px;
     box-shadow: none;
@@ -23,7 +22,6 @@ window#waybar {
     color: @base04;
 }
 
-
 #workspaces button.focused {
     color: #f85e84;
     color: @base07;
@@ -47,32 +45,35 @@ window#waybar {
 }
 
 #battery {
-  font-size: 12px;
+    font-size: 12px;
 }
 
 #battery.critical {
-  color: @base07;
+    color: @base07;
 }
+
 #battery.charging {
     color: @base0B;
 }
+
 #battery.full {
     margin: 0px 0px 0px 0px;
 }
 
-
 #network {
     border-top: 1px solid transparent;
 }
+
 #network.disconnected {
     margin: 0px 0px 0px 0px;
     color: rgba(75, 81, 98, 0);
 }
 
-
 #pulseaudio.muted {
     margin: 0px 0px 0px 0px;
     color: rgba(75, 81, 98, 0);
 }
 
-
+#custom-notification {
+  font-family: "NotoSansMono Nerd Font";
+}

profiles/base-user/.gitignore

@@ -1,111 +0,0 @@
-*
-
-!*.nix
-!/.gitignore
-
-!/.zshrc
-!/.Xdefaults
-!/.Xresources
-!/.xinitrc
-!/.config
-
-!/assets
-!/assets/wallpaper.jpg
-
-!/.config/dircolors
-
-!/.config/xmodmap
-
-!/.config/environment.d
-!/.config/environment.d/profile.conf
-!/.config/environment.d/drone.conf
-!/.config/environment.d/restic.conf
-
-!/.config/user-dirs.dirs
-!/.config/user-dirs.locale
-
-!/.config/gtk-2.0
-!/.config/gtk-2.0/gtkrc
-
-!/.config/gtk-3.0
-!/.config/gtk-3.0/settings.ini
-
-!/.config/xsettingsd
-!/.config/xsettingsd/xsettingsd.conf
-
-!/.config/mako
-!/.config/mako/config
-
-!/.config/alacritty
-!/.config/alacritty/alacritty.yml
-
-!/.config/git
-!/.config/git/config
-
-!/.config/vifm
-!/.config/vifm/vifmrc
-!/.config/vifm/scripts
-!/.config/vifm/colors
-!/.config/vifm/colors/base16.vifm
-
-!/.config/nvim
-!/.config/nvim/init.vim
-!/.config/nvim/clipboard.vim
-!/.config/nvim/lsp.vim
-!/.config/nvim/quickfixopenall.vim
-!/.config/nvim/ui.vim
-
-!/.config/mimeapps.list
-
-!/.config/libinput-gestures.conf
-
-!/.config/sway
-!/.config/sway/config
-!/.config/sway/config.d
-!/.config/sway/config.d/applications.conf
-!/.config/sway/config.d/autostart.conf
-!/.config/sway/config.d/colorscheme.conf
-!/.config/sway/config.d/custom-keybindings.conf
-!/.config/sway/config.d/gaps.conf
-!/.config/sway/config.d/input-defaults.conf
-!/.config/sway/config.d/systemd.conf
-!/.config/sway/config.d/theme.conf
-!/.config/sway/config.d/biolimo
-!/.config/sway/config.d/biolimo/screens.conf
-!/.config/sway/config.d/biolimo/inputs.conf
-!/.config/sway/config.d/chocolatebar
-!/.config/sway/config.d/chocolatebar/screens.conf
-
-!/.config/waybar
-!/.config/waybar/colorscheme.css
-!/.config/waybar/config
-!/.config/waybar/style.css
-
-!/.config/mutt
-!/.config/mutt/muttrc
-!/.config/mutt/base16.muttrc
-!/.config/mutt/mailcap
-
-!/.config/offlineimap
-!/.config/offlineimap/functions.py
-
-!/.local
-!/.local/bin
-!/.local/bin/install-base
-!/.local/bin/swaylock-bg
-!/.local/bin/sway-launcher
-!/.local/bin/sway-service
-!/.local/bin/toggle-kbd-layout
-!/.local/bin/wcwd
-!/.local/bin/vifmrun
-!/.local/bin/vifmimg
-!/.local/bin/s
-!/.local/bin/windows
-!/.local/bin/import-gtk-settings
-!/.local/bin/mailto-mutt
-!/.local/bin/setup-host-conf
-!/.local/bin/steam-xdg
-
-!/.local/share
-!/.local/share/applications
-!/.local/share/applications/userapp-Firefox.desktop

profiles/base-user/default.nix

@@ -17,11 +17,12 @@ in
       isNormalUser = true;
       description = psCfg.user.description;
       extraGroups = [
-        "wheel"
         "input"
-        "networkmanager"
         "lp"
+        "networkmanager"
         "scanner"
+        "video"
+        "wheel"
       ];
       initialHashedPassword = if psCfg.user.password != null then psCfg.user.password else "";
       shell = pkgs.zsh;

profiles/base-user/home.nix

@@ -25,6 +25,16 @@ in
     programs.dircolors.enable = true;
     programs.dircolors.enableZshIntegration = true;
 
+    programs.less = {
+      enable = true;
+      keys = ''
+        k forw-line
+        i back-line
+        K forw-scroll
+        I back-scroll
+      '';
+    };
+
     home.file."xinitrc".source = ./.xinitrc;
 
     xdg.enable = true;
@@ -43,6 +53,8 @@ in
     xdg.configFile."vifm/vifmrc".source = ./.config/vifm/vifmrc;
     xdg.configFile."vifm/colors/base16.vifm".source = ./.config/vifm/colors/base16.vifm;
     xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
+    xdg.configFile."swaync/config.json".source = ./.config/swaync/config.json;
+    xdg.configFile."swaync/style.css".source = ./.config/swaync/style.css;
     xdg.configFile."waybar/config".source = ./.config/waybar/config;
     xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
     xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;

profiles/base-user/mimeapps.nix

@@ -22,6 +22,6 @@
     "x-scheme-handler/https" = [ "firefox.desktop" ];
     "x-scheme-handler/mailto" = [ "userapp-Thunderbird.desktop" ];
     "x-scheme-handler/msteams" = [ "teams.desktop" ];
-    "x-scheme-handler/tg" = [ "userapp-Telegram Desktop-JBKFU0.desktop" ];
+    "x-scheme-handler/tg" = [ "userapp-Telegram Desktop-1RE3J1.desktop" ];
   };
 }

secrets/drone_exec_runner_config

@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 Wp/X/Q cdo0CMxdOqP1MLc3cUbOD1Ha5hW70JYK1E06NwV8SkE
+M9vPqxgeAPh+l7XH6IVPITlI6Vfte5EYgQbs7+csD1A
+-> ssh-ed25519 8U1+ng Ag+IfCUi6yf7tn+Nc+3rySZeGdxx5oPIZ5AyY0EYQ0c
+Vi35krkHDR5ASs+Ia5iWlTsNttJr2W6vts1Ap+skrpw
+-> ssh-ed25519 BVsyTA zBkihyt0U/cKlD3zeHDWchqsNYrGDZUMpdDElQamWjQ
+hqdON//Mi+DMhMvUt4yh+xzW7A0aimA0feVNw8ZUxVA
+-> piv-p256 xGzyzw A0u0D1ELUINR5C+s5CuuD3AlxTNT07gu76Skav/PYswi
+CAd+qtKFJB8GCLJKOhzZbMwrvoIc9+czTcmtSCP50gg
+-> 6j-T-grease vhW, 0O njRFEQ@` F5=qhL!Q
+bccSqKLEZ9j4cjioEHWLgPVhhZUEgnkIvVLIDS0d+Z1bZQhApZNQW/KkSw
+--- /QTl3uBvy9Pi+541vXLEj5SIoZ08KeiNi6lwwsb04ss
+¼FOàïh>¸õfÇ=Ú¥ÎÀШ¸Ï`¥fàÕ!$^½9¦Zœ~PšqgÖRÀÇ©û]ì°
>âBº|»^œˆiÕ´TD;Ó@¢WéTä2aÄÝ#ú@©³ä*/¨ÛDQÃô“¥ýºè뙪v!õö=>ÓŒT“×95ÆòjèChKZ”ŸÏ¢ hâ<68>Ì Ì&´{ü›³pVxCÅW6?÷ɬLF²1U²¯=ƒú€0xƒo²<6F>*±nüË

secrets/environment-secrets.age

@@ -0,0 +1,14 @@
+age-encryption.org/v1
+-> ssh-ed25519 Wp/X/Q 5CsTxMCc2bZg1W17va9ZqrPF73ZG+PZg0ivTOfQSFEA
+S7KYGJF2WJuf0PFLw3K86JT03zcuZeS3IAjXu0LpJ4k
+-> ssh-ed25519 8U1+ng nlNMDe8jh3BVRz9DO02n+cc3Ce5I5nYr+rwcLlBIUDU
+3mKSLEi6h51icjg3tfaXRMklNqdTZ3HDzl3KTpj2nDw
+-> ssh-ed25519 BVsyTA Pv/lJkT2IHRC1/m1loeAM2UyPvtsHCOSxpcisZ6Ttz0
+bQ7Pv+FoRaxWb2eLbg3APC5a7L5k7vL7ja2NkE2QbEY
+-> piv-p256 xGzyzw ApPpON96Th3WnXua8GsGwM5bJbA6wuqLyXlACS9/Vwec
+oixZ1qz7u0lFOKyX3GiSNkOx4omG2FtCFcfQImKzDmc
+-> $wlE_&-grease @R L~p ,tK
+SqB+0A8uuo41O36H6nctONyRRNe8wQ2oC8jnuP5IOa5W815+sXIq2JtqMFB4dzIz
+QcrmkwPOap8HWIGnP+IZxq11b5CZrnrRVxvL/EB+uf5I
+--- 4j5etIXOJvk7n0UDmfbM+hlIvk6I0MwRulrh338EdRE
+²Eú[Ù¿Ã<C2BF>ó·n=Y;åÞâûU»Íúk`
l5Xˆ‹âPC
Þ#B¼Q|׫°õ­cÞ†€´m<C2B4>óˆÆJ¿ÕjGÛ¡ù¦í¡§­žcï.²|xj¿êmkÝEM^á1&S*„VøP¼=å“tê—¸½WÇ7~g¬ˆ÷èÍbâvó"ÐÆ•9áKŸl|qßØð¡o©Ôî7ö!Ñõ7Ý FÏFøúƒ†’¦Po‡_”Чëz¶aIpUñlpRñëŸz8È ÀÓ°cˆ:µzÛ@ñ’>mãº,?a¤ÿ†ð“‹‰G<6ÃÚÃÓXU>ñá"§NÃLmB¶–¤É©”„iýD	z6aœ‹nÌDŸ³ªß

secrets/example-secret.age

@@ -0,0 +1,14 @@
+age-encryption.org/v1
+-> ssh-ed25519 Wp/X/Q rilMAu0gNVmM5kzkfI6LHy8LYpqu6OJ68lnf+/IFuQA
+7VAOcxVWeIfix5Imuz9IACxHSL/Lfpj4xUmGBTrSs+E
+-> ssh-ed25519 8U1+ng yHW9NoLk8yIn7q5jzi4cB2TcOMJMjdr0KX9nmhgsVU4
+mVB5vqHmlyRQwcTil3owI+VZ0gvUqpD3PCh7fdVakmA
+-> ssh-ed25519 BVsyTA oGjMX1pyf0xHml4uZJr4mPfGCCB7TV1iX3bMLmLM+SU
+75mURQZr8mVqgAitknaqIOdgfnHqUUItq4JYYaslidM
+-> piv-p256 xGzyzw AjcLhwpsbCCjjDkdVjLsb7tf3oJe0FoBgkC+jUZzLwcm
+/GqKWJL1qiVwz9E47rSb4rZEZ+P6fvvTgU4DTnpPGAE
+-> _NBk)?2K-grease H
+AntIeBKXk4SPMRdzlsvVp/bdRe6rk0uGHDlECTl8rRoR3/XHDbuYeg8EAyAPc1jQ
+yh2mQYhV3ztro8ermvxuyYvzjaT22Ox/
+--- 3qLt8D2zH6sWWqPToa+NQH35jGrTjbB8BxwExrtkZCo
+]v‚ÍÑÞ¿ëExü¥ìQ<å#¨#Ãì;Q<0E>š—×Í	‘*õõ]w<>,çr

secrets/identities/age-yubikey-identity-c46cf2cf.txt

@@ -0,0 +1,7 @@
+#       Serial: 10593996, Slot: 1
+#         Name: age-id-0
+#      Created: Mon, 24 Oct 2022 14:47:23 +0000
+#   PIN policy: Once   (A PIN is required once per session, if set)
+# Touch policy: Never  (A physical touch is NOT required to decrypt)
+#    Recipient: age1yubikey1qdxpc9qenrkhqxnu2p6sgyfxhnxcvz99jcaq36uqcztuzsy92q596shqxkf
+AGE-PLUGIN-YUBIKEY-1EJN2ZQYZC3K09NCU47TDH

secrets/identities/personal-5-nfc.txt

@@ -0,0 +1 @@
+AGE-PLUGIN-YUBIKEY-1EJN2ZQYZC3K09NCU47TDH

secrets/secrets.nix

@@ -1,9 +1,18 @@
 let
   # set ssh public keys here for your system and user
-  system = "";
-  user = "";
-  allKeys = [ system user ];
+  machines = {
+    dumpyourvms = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILDATEWAgDZFfYs1ZPh33Kg4sqQ9tWMVKyk8XqFu3Koe host@dumpyourvms";
+    ryzensun = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH/l7MfEmt510BMeNjuXNPmZ0brcQidvrrpcea+qJMjX root@ryzensun";
+  };
+  users = {
+    teutat3s = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
+    teutat3s-5-nfc = "age1yubikey1qdxpc9qenrkhqxnu2p6sgyfxhnxcvz99jcaq36uqcztuzsy92q596shqxkf";
+  };
+  allKeys = [ machines.dumpyourvms machines.ryzensun users.teutat3s users.teutat3s-5-nfc ];
 in
 {
-  "secret.age".publicKeys = allKeys;
+  "example-secret.age".publicKeys = allKeys;
+  "environment-secrets.age".publicKeys = allKeys;
+  "drone_exec_runner_config".publicKeys = allKeys;
+  "test-secret.age".publicKeys = [ users.teutat3s-5-nfc ];
 }

secrets/test-secret.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 xGzyzw A/HuCNXXxY5cxn2SSdo8Vxec/fjRtyHs1635LSlX0Jif
+D4JxFia0qmBZ4Tbk930rWyqynlv6gLL2FPAaAHAN9II
+-> :Mvm-grease v] *~hy9uI2
+ukmMu/ex7QHQIImtAi6H7plG2RGy1HbsTRFr5mSn8eZgnRwU2J188VW3PL0T5jul
+BLsY/Q1yhtQ
+--- KtbJqPbJH5uHkxmmuRe0HgawfcSZ6dHwFKKII24kGk8
+ n:êþæ#ÅÇþ
¯I*Î`+Š¢ÈRÇ£3)þÛ|ÊÖÒ‚g<E2809A>[Ïï<C38F>ÔÈ!

shell/hooks/pre-commit.sh

@@ -5,21 +5,32 @@ then
   against=HEAD
 else
   # Initial commit: diff against an empty tree object
-  against=$(${git}/bin/git hash-object -t tree /dev/null)
+  against=$(git hash-object -t tree /dev/null)
 fi
 
 diff="git diff-index --name-only --cached $against --diff-filter d"
 
-nix_files=($($diff -- '*.nix'))
-all_files=($($diff))
+mapfile -t nix_files < <($diff -- '*.nix')
+mapfile -t all_files < <($diff)
 
-# Format staged nix files.
+# Format staged nix files
 if (( ${#nix_files[@]} != 0 )); then
+  # Stash only unstaged changes, keeping staged changes
+  old_stash=$(git rev-parse --quiet --verify refs/stash)
+  git stash push --quiet --keep-index -m 'Unstaged changes before pre-commit hook'
+  new_stash=$(git rev-parse --quiet --verify refs/stash)
+
+  # Format staged changes
   nixpkgs-fmt "${nix_files[@]}" \
   && git add "${nix_files[@]}"
+
+  # If unstaged changes were stashed re-apply to working tree
+  if [ "$old_stash" != "$new_stash" ]; then
+      git stash pop --quiet
+  fi
 fi
 
-# check editorconfig
+# Check editorconfig
 if (( ${#all_files[@]} != 0 )); then
   editorconfig-checker -- "${all_files[@]}"
 fi

tests/first-test.nix

@@ -42,8 +42,8 @@
 
     # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
     virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
-    virtualisation.cores = 4;
-    virtualisation.memorySize = 2048;
+    virtualisation.cores = 2;
+    virtualisation.memorySize = 512;
   };
 
   enableOCR = true;

users/pub-solar/default.nix

@@ -13,7 +13,9 @@
       password = "$6$Kv0BCLU2Jg7GN8Oa$hc2vERKCbZdczFqyHPfgCaleGP.JuOWyd.bfcIsLDNmExGXI6Rnkze.SWzVzVS311KBznN/P4uUYAUADXkVtr.";
       fullName = "Pub Solar";
       email = "iso@pub.solar";
-      publicKeys = [ ];
+      publicKeys = [
+        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a"
+      ];
     };
   };
 }

users/teutat3s/.config/git/config.nix

@@ -0,0 +1,25 @@
+{ config, pkgs, ... }:
+let
+in
+pkgs.lib.mkAfter ''[sendemail]
+  smtpserver = smtp.mailbox.org
+  smtpuser = jhonas@mailbox.org
+  smtpencryption = tls
+  smtpserverport = 587
+
+[lfs]
+	repositoryformatversion = 0
+[filter "lfs"]
+	clean = git-lfs clean -- %f
+	smudge = git-lfs smudge -- %f
+	process = git-lfs filter-process
+	required = true
+
+[safe]
+  directory = /home/teutat3s/CodeRoom/git.b12f.io/pub-solar/os
+
+[includeIf "gitdir:~/CodeRoom/greenbaum.cloud/"]
+  path = ~/.config/git/config_greenbaum.cloud
+
+[includeIf "gitdir:~/CodeRoom/git.b12f.io/"]
+  path = ~/.config/git/config_git.b12f.io''

users/teutat3s/.config/git/config_git.b12f.io.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+let
+in
+''[user]
+  name = teutat3s
+  email = teutates@mailbox.org
+  signingkey = 4FA1D3FA524F22C1''

users/teutat3s/.config/git/config_greenbaum.cloud.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+let
+in
+''[user]
+  name = jhonas
+  email = wernery@greenbaum.cloud
+  signingkey = 924889A86D0B0FEB''

users/teutat3s/.config/watson/config.nix

@@ -0,0 +1,29 @@
+{ config, pkgs, ... }:
+let
+in
+''# Watson configuration
+# showing defaults commented out
+
+# not implemented yet as of 2.0.1
+#[backend]
+#url = https://api.crick.fr
+#token = yourapitoken
+
+[options]
+#options.confirm_new_project = false
+#options.confirm_new_tag = false
+date_format = %d.%m.%Y
+#log_current = false
+pager = false
+#report_current = false
+#reverse_log = true
+stop_on_start = true
+#stop_on_restart = false
+time_format = %H:%M%z
+#week_start = monday
+
+#[default_tags]
+#project-name = tag1 tag2
+#python101 = teaching python
+#voyager2 = nasa 'space mission'
+''

users/teutat3s/default.nix

@@ -0,0 +1,28 @@
+{ config, hmUsers, lib, pkgs, ... }:
+let
+  psCfg = config.pub-solar;
+in
+{
+  imports = [
+    ./home.nix
+  ];
+
+  config = {
+    home-manager.users = { inherit (hmUsers) teutat3s; };
+
+    pub-solar = {
+      # These are your personal settings
+      # The only required settings are `name` and `password`,
+      # The rest is used for programs like git
+      user = {
+        name = "teutat3s";
+        fullName = "teutat3s";
+        email = "10206665+teutat3s@users.noreply.github.com";
+        gpgKeyId = "18DAE600A6BBE705";
+        password = "$6$guLp1v0G0TxGThXX$y7YeEcYjFpN6gutLCbvAkqppOVLYZjfo4DxofrMm6a9MIjVoKKaY20UzityJsHbQU4THIFfj8gLWVOjyjL.P2.";
+      };
+
+      sway.v4l2loopback.enable = false;
+    };
+  };
+}

users/teutat3s/home.nix

@@ -0,0 +1,62 @@
+{ config, home-manager, inputs, lib, pkgs, latestModulesPath, ... }:
+with lib;
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+  tritonshell = inputs.tritonshell;
+  nix-autobahn = inputs.nix-autobahn;
+in
+{
+  imports = [
+    ./session-variables.nix
+    "${latestModulesPath}/services/security/yubikey-agent.nix"
+  ];
+  disabledModules = [
+    "services/security/yubikey-agent.nix"
+  ];
+
+  config = {
+    pub-solar.social.enable = true;
+
+    pub-solar.graphical.alacritty.settings.font.size = 12;
+    pub-solar.graphical.alacritty.settings.key_bindings = [
+      { key = "V"; mods = "Control|Super"; action = "Paste"; }
+      { key = "C"; mods = "Control|Super"; action = "Copy"; }
+    ];
+    services.kbfs.enable = true;
+    services.keybase.enable = true;
+    services.yubikey-agent.enable = true;
+    home-manager = pkgs.lib.setAttrByPath [ "users" psCfg.user.name ] {
+      xdg.configFile."git/config".text = import ./.config/git/config.nix { inherit config; inherit pkgs; };
+      xdg.configFile."git/config_greenbaum.cloud".text = import ./.config/git/config_greenbaum.cloud.nix { inherit config; inherit pkgs; };
+      xdg.configFile."git/config_git.b12f.io".text = import ./.config/git/config_git.b12f.io.nix { inherit config; inherit pkgs; };
+      xdg.configFile."watson/config".text = import ./.config/watson/config.nix { inherit config; inherit pkgs; };
+
+      home.packages = with pkgs; [
+        AusweisApp2
+        consul
+        drone-docker-runner
+        gpu-switch
+        ifmetric
+        ipmitool
+        keybase-gui
+        nomad_1_3
+        thunderbird
+        vault
+        veracrypt
+        waypoint
+        yubikey-agent
+        age-plugin-yubikey
+        nix-autobahn.packages.${pkgs.system}.default
+      ];
+
+      programs.zsh = {
+        initExtra = import ./zshrc.nix { inherit config pkgs tritonshell; };
+      };
+
+      # xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
+    };
+
+    #services.mopidy.configuration = mkIf config.pub-solar.audio.enable (builtins.readFile ../../secrets/mopidy.conf);
+  };
+}

users/teutat3s/session-variables.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }:
+let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in
+{
+  home-manager = pkgs.lib.setAttrByPath [ "users" psCfg.user.name ] {
+    home.sessionVariables = {
+      DRONE_SERVER = "https://ci.b12f.io";
+      GOPATH = "/home/${psCfg.user.name}/CodeRoom/go";
+    };
+  };
+}

users/teutat3s/zshrc.nix

@@ -0,0 +1,101 @@
+{ config, pkgs, tritonshell, ... }:
+''
+  bindkey "^[[1;3D" backward-word
+  bindkey "^[[1;3C" forward-word
+  bindkey "^[p" backward-word
+  bindkey "^[n" forward-word
+
+  # make cursor jump to slash, period, dash, underscore, dollar sign, equals sign
+  # by default: export WORDCHARS='*?_-.[]~=/&;!#$%^(){}<>'
+  export WORDCHARS='*?[]~&;!#$%^(){}'
+
+  # Alt+Backspace stops at /
+  bindkey "^[^?" backward-kill-word
+  backward-kill-dir () {
+      local WORDCHARS=''${WORDCHARS/\/}
+      zle backward-kill-word
+  }
+  zle -N backward-kill-dir
+  bindkey '^[^?' backward-kill-dir
+
+  # git aliases
+  alias ga="git add"
+  alias gau="git add --update"
+  alias gb="git branch"
+  alias gbd="git branch --delete"
+  alias gc="git commit"
+  alias gcm="git commit --message"
+  alias gco="git checkout"
+  alias gcob="git checkout -b"
+  alias gd="git diff"
+  alias gm="git merge"
+  alias gma="git merge --abort"
+  alias gmc="git merge --continue"
+  alias gp="git pull"
+  alias gs="git status"
+
+  # misc aliases
+  alias zshconfig="vim ~/.zshrc"
+  alias zshhistory="vim $XDG_DATA_HOME/zsh/zsh_history"
+  alias zshsource="source ~/.zshrc"
+
+  alias tp="triton profile set"
+  alias tt="triton"
+  alias ttco="triton-compose"
+  alias tf="terraform"
+
+  alias dstart="sudo systemctl start docker"
+  alias dstop="sudo systemctl stop docker"
+  alias lvstart="sudo systemctl start libvirtd"
+  alias lvstop="sudo systemctl stop libvirtd"
+
+
+  alias wg-up="sudo systemctl start wg-quick@wg0.service"
+  alias wg-down="sudo systemctl stop wg-quick@wg0.service"
+
+  # Helper function for docker on triton
+  ttp() {
+    if [[ "$1" == "set" ]]; then
+      if [[ -n "$2" ]]; then
+        source ${tritonshell.packages.${pkgs.system}.triton-utils}/bin/unset-env.sh
+        triton profile set "$2"
+      fi
+      source ${tritonshell.packages.${pkgs.system}.triton-docker-env}/bin/triton-docker-env.sh
+    elif [[ "$1" == "unset" ]]; then
+      source ${tritonshell.packages.${pkgs.system}.triton-utils}/bin/unset-env.sh
+    elif [[ "$1" == "env" ]]; then
+      env | grep "DOCKER\|MANTA\|SDC\|TRITON" | sort
+    else
+      echo "this is a helper function to quickly switch triton profiles"
+      echo "and setup the required environment variables"
+      echo "for triton, manta and the remote docker host (API)"
+      echo
+      echo 'use "ttp set your-profile" to switch to a profile'
+      echo
+      echo 'use "ttp unset" to clear all environment variables used by these CLIs'
+      echo "useful if you'd like to run a docker command against the"
+      echo "local docker host"
+      echo
+      echo 'use "ttp env" to view the currently set environment variables'
+      echo "used by the triton & manta CLIs"
+      echo
+      echo 'use "ttp help" to view this help'
+    fi
+  }
+
+  # remove @machine from prompt
+  DEFAULT_USER=$(whoami)
+
+  # autocomplete cd ..
+  zstyle ':completion:*' special-dirs true
+
+  autoload -U +X bashcompinit && bashcompinit
+  complete -o nospace -C ${pkgs.consul}/bin/consul consul
+  complete -o nospace -C ${pkgs.nomad_1_3}/bin/nomad nomad
+  complete -o nospace -C ${pkgs.vault}/bin/vault vault
+  complete -o nospace -C ${pkgs.terraform_0_15}/bin/terraform terraform
+  complete -o nospace -C ${pkgs.waypoint}/bin/waypoint waypoint
+  complete -C '${pkgs.awscli2}/bin/aws_completer' ${pkgs.awscli2}/bin/aws
+
+  source ${config.age.secrets.environment-secrets.path}
+''