Merge pull request 'Update flake inputs' (#258) from main-update-flake-inputs into main

Reviewed-on: #258
Reviewed-by: b12f <hello@benjaminbaedorf.eu>

.drone.yml

@@ -1,7 +1,7 @@
 ---
 kind: pipeline
 type: exec
-name: Check and deploy
+name: Check
 node:
   hosttype: baremetal
 
@@ -17,27 +17,7 @@ steps:
       - nix $$NIX_FLAGS develop --command nix flake show
       - nix $$NIX_FLAGS develop --command treefmt --fail-on-change
       - nix $$NIX_FLAGS develop --command editorconfig-checker
-      - nix $$NIX_FLAGS build ".#nixosConfigurations.pioneer-momo-koeln.config.system.build.toplevel"
+      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
-
-  - name: "Deploy"
-    when:
-      event:
-        - push
-      branch:
-        - momo/main
-    environment:
-      NIX_FLAGS: "--print-build-logs --verbose --accept-flake-config"
-      PRIVATE_SSH_KEY:
-        from_secret: ci_private_ssh_key
-      SSH_HOST_KEY: "80.244.242.4 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFAMFmC8BNq08QLKQLyT139qzh7jIF5yOY32fCHiCMg5"
-    commands:
-      - mkdir $$HOME/.ssh && chmod 700 $$HOME/.ssh
-      - echo "$$PRIVATE_SSH_KEY" > $$HOME/.ssh/id_ed25519 && chmod 600 $$HOME/.ssh/id_ed25519
-      - echo "$$SSH_HOST_KEY" > $$HOME/.ssh/known_hosts
-      # SSH uses HOME from /etc/passwd, not from the environment, so override it
-      - export SSHOPTS="-o UserKnownHostsFile=$$HOME/.ssh/known_hosts -i $$HOME/.ssh/id_ed25519"
-      - "echo DEBUG: Using NIX_FLAGS: $$NIX_FLAGS"
-      - nix $$NIX_FLAGS develop --command deploy --magic-rollback false --skip-checks --targets '.#pioneer-momo-koeln' --ssh-opts="$$SSHOPTS"
 
 ---
 kind: pipeline
@@ -98,6 +78,9 @@ steps:
         from_secret: matrix_password
       template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png"
 
+depends_on:
+  - Tests
+
 trigger:
   ref:
     - refs/tags/v*
@@ -151,6 +134,9 @@ steps:
       unlink_first: true
       strip_components: 3
 
+depends_on:
+  - Check
+
 trigger:
   branch:
     - main
@@ -163,6 +149,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 8648f3838e519e4b493107ed02efafd59670337346db7e198d4058437a9a5622
+hmac: a116f78a0b22188052893bdb46aa40f8de66438826c10ced362ea183d7644d67
 
 ...

flake.lock

@@ -3,22 +3,18 @@
     "agenix": {
       "inputs": {
         "darwin": [
-          "nix-darwin"
+          "darwin"
-        ],
-        "home-manager": [
-          "home-manager"
         ],
         "nixpkgs": [
-          "nixpkgs"
+          "nixos"
-        ],
+        ]
-        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1703433843,
+        "lastModified": 1682101079,
-        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
+        "narHash": "sha256-MdAhtjrLKnk2uiqun1FWABbKpLH090oeqCSiWemtuck=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
+        "rev": "2994d002dcff5353ca1ac48ec584c7f6589fe447",
         "type": "github"
       },
       "original": {
@@ -27,22 +23,42 @@
         "type": "github"
       }
     },
-    "deploy-rs": {
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos"
+        ]
+      },
+      "locked": {
+        "lastModified": 1696360011,
+        "narHash": "sha256-HpPv27qMuPou4acXcZ8Klm7Zt0Elv9dgDvSJaomWb9Y=",
+        "owner": "LnL7",
+        "repo": "nix-darwin",
+        "rev": "8b6ea26d5d2e8359d06278364f41fbc4b903b28a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LnL7",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "deploy": {
       "inputs": {
         "flake-compat": [
           "flake-compat"
         ],
         "nixpkgs": [
-          "nixpkgs"
+          "nixos"
         ],
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1703087360,
+        "lastModified": 1695052866,
-        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
+        "narHash": "sha256-agn7F9Oww4oU6nPiw+YiYI9Xb4vOOE73w8PAoBRP4AA=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
+        "rev": "e3f41832680801d0ee9e2ed33eb63af398b090e9",
         "type": "github"
       },
       "original": {
@@ -53,21 +69,18 @@
     },
     "devshell": {
       "inputs": {
+        "flake-utils": "flake-utils",
         "nixpkgs": [
-          "erpnext",
+          "digga",
           "nixpkgs"
-        ],
-        "systems": [
-          "erpnext",
-          "systems"
         ]
       },
       "locked": {
-        "lastModified": 1701787589,
+        "lastModified": 1671489820,
-        "narHash": "sha256-ce+oQR4Zq9VOsLoh9bZT8Ip9PaMLcjjBUHVPzW5d7Cw=",
+        "narHash": "sha256-qoei5HDJ8psd1YUPD7DhbHdhLIT9L2nadscp4Qk37uk=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "44ddedcbcfc2d52a76b64fb6122f209881bd3e1e",
+        "rev": "5aa3a8039c68b4bf869327446590f4cdf90bb634",
         "type": "github"
       },
       "original": {
@@ -76,40 +89,54 @@
         "type": "github"
       }
     },
-    "erpnext": {
+    "digga": {
       "inputs": {
-        "agenix": [
+        "darwin": [
-          "agenix"
+          "darwin"
+        ],
+        "deploy": [
+          "deploy"
         ],
         "devshell": "devshell",
-        "nixpkgs": [
+        "flake-compat": [
-          "nixpkgs"
+          "flake-compat"
         ],
-        "systems": "systems_3"
+        "flake-utils": "flake-utils_2",
+        "flake-utils-plus": "flake-utils-plus",
+        "home-manager": [
+          "home"
+        ],
+        "nixlib": [
+          "nixos"
+        ],
+        "nixpkgs": [
+          "nixos"
+        ],
+        "nixpkgs-unstable": "nixpkgs-unstable"
       },
       "locked": {
-        "lastModified": 1704557841,
+        "lastModified": 1674947971,
-        "narHash": "sha256-KpAkdJnY1NV21zRRd8Tncw6nBerSv50qmz6pSpjsxLg=",
+        "narHash": "sha256-6gKqegJHs72jnfFP9g2sihl4fIZgtKgKuqU2rCkIdGY=",
-        "ref": "main",
+        "owner": "pub-solar",
-        "rev": "7fc327263630e2f5ce693e8569a1072bd0cea67b",
+        "repo": "digga",
-        "revCount": 49,
+        "rev": "2da608bd8afb48afef82c6b1b6d852a36094a497",
-        "type": "git",
+        "type": "github"
-        "url": "https://git.pub.solar/axeman/erpnext-nix"
       },
       "original": {
-        "ref": "main",
+        "owner": "pub-solar",
-        "type": "git",
+        "ref": "fix/bootstrap-iso",
-        "url": "https://git.pub.solar/axeman/erpnext-nix"
+        "repo": "digga",
+        "type": "github"
       }
     },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1673956053,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
         "type": "github"
       },
       "original": {
@@ -118,88 +145,134 @@
         "type": "github"
       }
     },
-    "flake-parts": {
+    "flake-utils": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
       "locked": {
-        "lastModified": 1704152458,
+        "lastModified": 1642700792,
-        "narHash": "sha256-DS+dGw7SKygIWf9w4eNBUZsK+4Ug27NwEWmn2tnbycg=",
+        "narHash": "sha256-XqHrk7hFb+zBvRg6Ghl+AZDq03ov6OshJLiSWOoX5es=",
-        "owner": "hercules-ci",
+        "owner": "numtide",
-        "repo": "flake-parts",
+        "repo": "flake-utils",
-        "rev": "88a2cd8166694ba0b6cb374700799cec53aef527",
+        "rev": "846b2ae0fc4cc943637d3d1def4454213e203cba",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "numtide",
-        "repo": "flake-parts",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
-    "home-manager": {
+    "flake-utils-plus": {
       "inputs": {
-        "nixpkgs": [
+        "flake-utils": [
-          "nixpkgs"
+          "digga",
+          "flake-utils"
         ]
       },
       "locked": {
-        "lastModified": 1704099619,
+        "lastModified": 1654029967,
-        "narHash": "sha256-QRVMkdxLmv+aKGjcgeEg31xtJEIsYq4i1Kbyw5EPS6g=",
+        "narHash": "sha256-my3GQ3mQIw/1f6GPV1IhUZrcYQSWh0YJAMPNBjhXJDw=",
+        "owner": "gytis-ivaskevicius",
+        "repo": "flake-utils-plus",
+        "rev": "6271cf3842ff9c8a9af9e3508c547f86bc77d199",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gytis-ivaskevicius",
+        "ref": "refs/pull/120/head",
+        "repo": "flake-utils-plus",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "fork": {
+      "locked": {
+        "lastModified": 1692960587,
+        "narHash": "sha256-39SKGdhn8jKKkdqhULbCvQOpdUPE9NNJpy5HTB++Jvg=",
+        "owner": "teutat3s",
+        "repo": "nixpkgs",
+        "rev": "312709dd70684f52496580e533d58645526b1c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "teutat3s",
+        "ref": "nvfetcher-fix",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "home": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos"
+        ]
+      },
+      "locked": {
+        "lastModified": 1695108154,
+        "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7e398b3d76bc1503171b1364c9d4a07ac06f3851",
+        "rev": "07682fff75d41f18327a871088d20af2710d4744",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-23.11",
+        "ref": "release-23.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "nix-darwin": {
+    "latest": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1704277720,
+        "lastModified": 1696604326,
-        "narHash": "sha256-meAKNgmh3goankLGWqqpw73pm9IvXjEENJloF0coskE=",
+        "narHash": "sha256-YXUNI0kLEcI5g8lqGMb0nh67fY9f2YoJsILafh6zlMo=",
-        "owner": "lnl7",
+        "owner": "nixos",
-        "repo": "nix-darwin",
+        "repo": "nixpkgs",
-        "rev": "0dd382b70c351f528561f71a0a7df82c9d2be9a4",
+        "rev": "87828a0e03d1418e848d3dd3f3014a632e4a4f64",
         "type": "github"
       },
       "original": {
-        "owner": "lnl7",
+        "owner": "nixos",
-        "ref": "master",
+        "ref": "nixos-unstable",
-        "repo": "nix-darwin",
+        "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixos-flake": {
+    "nixos": {
       "locked": {
-        "lastModified": 1702145288,
+        "lastModified": 1696697597,
-        "narHash": "sha256-apVeRT0kOnDejwwBwbwNccm+qq1l6+qUOiRKE0vK5qk=",
+        "narHash": "sha256-q26Qv4DQ+h6IeozF2o1secyQG0jt2VUT3V0K58jr3pg=",
-        "owner": "srid",
+        "owner": "nixos",
-        "repo": "nixos-flake",
+        "repo": "nixpkgs",
-        "rev": "4e422edf6b511f8e214b392cf1a0d4707a0399a4",
+        "rev": "5a237aecb57296f67276ac9ab296a41c23981f56",
         "type": "github"
       },
       "original": {
-        "owner": "srid",
+        "owner": "nixos",
-        "repo": "nixos-flake",
+        "ref": "nixos-23.05",
+        "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1704632650,
+        "lastModified": 1696614066,
-        "narHash": "sha256-83J/nd/NoLqo3vj0S0Ppqe8L+ijIFiGL6HNDfCCUD/Q=",
+        "narHash": "sha256-nAyYhO7TCr1tikacP37O9FnGr2USOsVBD3IgvndUYjM=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "c478b3d56969006e015e55aaece4931f3600c1b2",
+        "rev": "bb2db418b616fea536b1be7f6ee72fb45c11afe0",
         "type": "github"
       },
       "original": {
@@ -208,35 +281,17 @@
         "type": "github"
       }
     },
-    "nixpkgs": {
+    "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1704420045,
+        "lastModified": 1672791794,
-        "narHash": "sha256-C36QmoJd5tdQ5R9MC1jM7fBkZW9zBUqbUCsgwS6j4QU=",
+        "narHash": "sha256-mqGPpGmwap0Wfsf3o2b6qHJW1w2kk/I6cGCGIU+3t6o=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c1be43e8e837b8dbee2b3665a007e761680f0c3d",
+        "rev": "9813adc7f7c0edd738c6bdd8431439688bb0cb3d",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib": {
-      "locked": {
-        "dir": "lib",
-        "lastModified": 1703961334,
-        "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9",
-        "type": "github"
-      },
-      "original": {
-        "dir": "lib",
-        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
@@ -245,89 +300,24 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "deploy-rs": "deploy-rs",
+        "darwin": "darwin",
-        "erpnext": "erpnext",
+        "deploy": "deploy",
+        "digga": "digga",
         "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
+        "fork": "fork",
-        "home-manager": "home-manager",
+        "home": "home",
-        "nix-darwin": "nix-darwin",
+        "latest": "latest",
-        "nixos-flake": "nixos-flake",
+        "nixos": "nixos",
-        "nixos-hardware": "nixos-hardware",
+        "nixos-hardware": "nixos-hardware"
-        "nixpkgs": "nixpkgs",
-        "unstable": "unstable"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "unstable": {
-      "locked": {
-        "lastModified": 1704538339,
-        "narHash": "sha256-1734d3mQuux9ySvwf6axRWZRBhtcZA9Q8eftD6EZg6U=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "46ae0210ce163b3cba6c7da08840c1d63de9c701",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
       }
     },
     "utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
       "locked": {
-        "lastModified": 1701680307,
+        "lastModified": 1667395993,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,100 +1,175 @@
 {
-  description = "Momo infra in nix";
+  description = "A highly structured configuration database.";
 
   nixConfig.extra-experimental-features = "nix-command flakes";
 
   inputs = {
     # Track channels with commits tested and built by hydra
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
+    nixos.url = "github:nixos/nixpkgs/nixos-23.05";
-    unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    latest.url = "github:nixos/nixpkgs/nixos-unstable";
+
+    fork.url = "github:teutat3s/nixpkgs/nvfetcher-fix";
 
     flake-compat.url = "github:edolstra/flake-compat";
     flake-compat.flake = false;
 
-    nix-darwin.url = "github:lnl7/nix-darwin/master";
+    digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
+    digga.inputs.nixpkgs.follows = "nixos";
+    digga.inputs.nixlib.follows = "nixos";
+    digga.inputs.home-manager.follows = "home";
+    digga.inputs.deploy.follows = "deploy";
+    digga.inputs.darwin.follows = "darwin";
+    digga.inputs.flake-compat.follows = "flake-compat";
 
-    home-manager.url = "github:nix-community/home-manager/release-23.11";
+    home.url = "github:nix-community/home-manager/release-23.05";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    home.inputs.nixpkgs.follows = "nixos";
 
-    flake-parts.url = "github:hercules-ci/flake-parts";
+    darwin.url = "github:LnL7/nix-darwin";
-    nixos-flake.url = "github:srid/nixos-flake";
+    darwin.inputs.nixpkgs.follows = "nixos";
 
-    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy.url = "github:serokell/deploy-rs";
-    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy.inputs.nixpkgs.follows = "nixos";
-    deploy-rs.inputs.flake-compat.follows = "flake-compat";
+    deploy.inputs.flake-compat.follows = "flake-compat";
 
     agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixpkgs";
+    agenix.inputs.nixpkgs.follows = "nixos";
-    agenix.inputs.darwin.follows = "nix-darwin";
+    agenix.inputs.darwin.follows = "darwin";
-    agenix.inputs.home-manager.follows = "home-manager";
 
     nixos-hardware.url = "github:nixos/nixos-hardware";
-
-    erpnext.url = "git+https://git.pub.solar/axeman/erpnext-nix?ref=main";
-    erpnext.inputs.nixpkgs.follows = "nixpkgs";
-    erpnext.inputs.agenix.follows = "agenix";
   };
 
-  outputs = inputs @ {self, ...}:
+  outputs = {
-    inputs.flake-parts.lib.mkFlake {inherit inputs;} {
+    self,
-      debug = true;
+    digga,
-      systems = [
+    nixos,
-        "x86_64-linux"
+    home,
+    nixos-hardware,
+    agenix,
+    deploy,
+    ...
+  } @ inputs:
+    digga.lib.mkFlake
+    {
+      inherit self inputs;
+
+      channelsConfig = {
+        # allowUnfree = true;
+      };
+
+      supportedSystems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin"];
+
+      channels = {
+        nixos = {
+          imports = [(digga.lib.importOverlays ./overlays)];
+          overlays = [
+            (self: super: {
+              deploy-rs = {
+                inherit (inputs.nixos.legacyPackages.x86_64-linux) deploy-rs;
+                lib = inputs.deploy.lib.x86_64-linux;
+              };
+            })
+          ];
+        };
+        latest = {};
+        fork = {};
+      };
+
+      lib = import ./lib {lib = digga.lib // nixos.lib;};
+
+      sharedOverlays = [
+        (final: prev: {
+          __dontExport = true;
+          lib = prev.lib.extend (lfinal: lprev: {
+            our = self.lib;
+          });
+        })
+        agenix.overlays.default
+
+        (import ./pkgs)
       ];
 
-      imports = [
+      nixos = {
-        inputs.nixos-flake.flakeModule
+        hostDefaults = {
-        ./lib
+          system = "x86_64-linux";
-        ./modules
+          channelName = "nixos";
-        ./hosts
+          imports = [(digga.lib.importExportableModules ./modules)];
-        ./users
+          modules = [
-        ./overlays
+            {lib.our = self.lib;}
-      ];
+            # FIXME: upstream module causes a huge number of unnecessary
-
+            # dependencies to be pulled in for all systems -- many of them are
-      perSystem = args @ {
+            # graphical. should only be imported as needed.
-        system,
+            # digga.nixosModules.bootstrapIso
-        pkgs,
+            digga.nixosModules.nixConfig
-        config,
+            home.nixosModules.home-manager
-        ...
+            agenix.nixosModules.age
-      }: {
+          ];
-        _module.args = {
-          inherit inputs;
-          pkgs = import inputs.nixpkgs {
-            inherit system;
-            overlays = [
-              inputs.agenix.overlays.default
-            ];
-          };
-          unstable = import inputs.unstable {inherit system;};
         };
 
-        devShells.default = pkgs.mkShell {
+        imports = [(digga.lib.importHosts ./hosts)];
-          buildInputs = with pkgs; [
+        hosts = {
-            deploy-rs
+          # Set host-specific properties here
-            drone-cli
+          bootstrap = {
-            nixpkgs-fmt
+            modules = [
-            agenix
+              digga.nixosModules.bootstrapIso
-            cachix
+            ];
-            editorconfig-checker
+          };
-            nodePackages.prettier
+          PubSolarOS = {
-            nvfetcher
+            tests = [
-            shellcheck
+              #(import ./tests/first-test.nix {
-            shfmt
+              #  pkgs = nixos.legacyPackages.x86_64-linux;
-            alejandra
+              #  lib = nixos.lib;
-            treefmt
+              #})
-            nixos-generators
+            ];
-          ];
+          };
+        };
+        importables = rec {
+          profiles =
+            digga.lib.rakeLeaves ./profiles
+            // {
+              users = digga.lib.rakeLeaves ./users;
+            };
+          suites = with profiles; rec {
+            base = [users.pub-solar users.root];
+            iso = base ++ [base-user graphical pub-solar-iso];
+            pubsolaros = [full-install base-user users.root];
+            anonymous = [pubsolaros users.pub-solar];
+          };
         };
       };
 
-      flake = {
+      home = {
-        deploy.nodes = self.lib.deploy.mkDeployNodes self.nixosConfigurations {
+        imports = [(digga.lib.importExportableModules ./users/modules)];
-          pioneer-momo-koeln = {
+        modules = [];
-            hostname = "80.244.242.4";
+        importables = rec {
-            sshUser = "barkeeper";
+          profiles = digga.lib.rakeLeaves ./users/profiles;
+          suites = with profiles; rec {
+            base = [direnv git];
           };
         };
+        users = {
+          pub-solar = {suites, ...}: {
+            imports = suites.base;
+
+            home.stateVersion = "21.03";
+          };
+        }; # digga.lib.importers.rakeLeaves ./users/hm;
+      };
+
+      devshell = ./shell;
+
+      homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
+
+      deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
+        #example = {
+        #  hostname = "example.com:22";
+        #  sshUser = "bartender";
+        #  fastConnect = true;
+        #  profilesOrder = ["system" "direnv"];
+        #  profiles.direnv = {
+        #    user = "bartender";
+        #    path = self.pkgs.x86_64-linux.nixos.deploy-rs.lib.x86_64-linux.activate.home-manager self.homeConfigurationsPortable.x86_64-linux.bartender;
+        #  };
+        #};
       };
     };
 }

hosts/PubSolarOS.nix

@@ -0,0 +1,21 @@
+{suites, ...}: {
+  ### root password is empty by default ###
+  ### default password: pub-solar, optional: add your SSH keys
+  imports =
+    suites.iso;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.networkmanager.enable = true;
+
+  fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+}

hosts/bootstrap.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  pkgs,
+  profiles,
+  ...
+}:
+with lib; let
+  # Gets hostname of host to be bundled inside iso
+  # Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
+  getFqdn = config: let
+    net = config.networking;
+    fqdn =
+      if (net ? domain) && (net.domain != null)
+      then "${net.hostName}.${net.domain}"
+      else net.hostName;
+  in
+    fqdn;
+in {
+  # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
+  imports = [
+    # profiles.networking
+    profiles.users.root # make sure to configure ssh keys
+    profiles.users.pub-solar
+    profiles.base-user
+    profiles.graphical
+    profiles.pub-solar-iso
+  ];
+
+  config = {
+    boot.loader.systemd-boot.enable = true;
+
+    # will be overridden by the bootstrapIso instrumentation
+    fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
+
+    system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
+
+    # mkForce because a similar transformation gets double applied otherwise
+    # https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
+    # https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
+    isoImage = {
+      isoBaseName = mkForce (getFqdn config);
+      isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "21.05"; # Did you read the comment?
+  };
+}

hosts/default.nix

@@ -1,19 +0,0 @@
-{
-  self,
-  inputs,
-  ...
-}: {
-  flake = {
-    nixosConfigurations = {
-      pioneer-momo-koeln = self.nixos-flake.lib.mkLinuxSystem {
-        nixpkgs.hostPlatform = "x86_64-linux";
-        imports = [
-          self.nixosModules.base
-          ./pioneer-momo-koeln
-          self.nixosModules.barkeeper
-          inputs.erpnext.nixosModules.erpnext
-        ];
-      };
-    };
-  };
-}

hosts/pioneer-momo-koeln/caddy.nix

@@ -1,18 +0,0 @@
-{config, ...}: {
-  services.caddy = {
-    enable = true;
-    email = "wg-tooling@list.momo.koeln";
-    virtualHosts = {
-      "auth.momo.koeln" = {
-        logFormat = ''
-          output discard
-        '';
-        extraConfig = ''
-          reverse_proxy :8080
-        '';
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [80 443];
-}

hosts/pioneer-momo-koeln/configuration.nix

@@ -1,37 +0,0 @@
-{
-  config,
-  latestModulesPath,
-  lib,
-  pkgs,
-  ...
-}: {
-  imports = [
-    ./caddy.nix
-    ./keycloak.nix
-    ./erpnext.nix
-  ];
-
-  time.timeZone = "Europe/Berlin";
-
-  networking = {
-    useDHCP = false;
-
-    interfaces.enp1s0.ipv4.addresses = [
-      {
-        address = "80.244.242.4";
-        prefixLength = 29;
-      }
-    ];
-
-    defaultGateway = "80.244.242.1";
-    nameservers = ["95.129.51.51" "80.244.244.244"];
-  };
-
-  # Enable the OpenSSH daemon.
-  services.openssh = {
-    enable = true;
-    openFirewall = true;
-  };
-
-  system.stateVersion = "22.05";
-}

hosts/pioneer-momo-koeln/default.nix

@@ -1,6 +0,0 @@
-{...}: {
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-  ];
-}

hosts/pioneer-momo-koeln/erpnext.nix

@@ -1,38 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  flake,
-  ...
-}: {
-  age.secrets.erpnext-admin-password = {
-    file = "${flake.self}/secrets/erpnext-admin-password.age";
-    mode = "700";
-    owner = "erpnext";
-  };
-  age.secrets.erpnext-db-root-password = {
-    file = "${flake.self}/secrets/erpnext-db-root-password.age";
-    mode = "700";
-    owner = "erpnext";
-  };
-  age.secrets.erpnext-db-user-password = {
-    file = "${flake.self}/secrets/erpnext-db-user-password.age";
-    mode = "700";
-    owner = "erpnext";
-  };
-
-  # erpnext
-  services.erpnext = {
-    enable = true;
-    domain = "erp.momo.koeln";
-
-    # Secrets
-    adminPasswordFile = config.age.secrets.erpnext-admin-password.path;
-    database.rootPasswordFile = config.age.secrets.erpnext-db-root-password.path;
-    database.userPasswordFile = config.age.secrets.erpnext-db-user-password.path;
-
-    # Required to enable caddy
-    caddy = {};
-  };
-}

hosts/pioneer-momo-koeln/hardware-configuration.nix

@@ -1,54 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  boot.loader.systemd-boot.enable = false;
-  boot.loader.grub = {
-    enable = true;
-    devices = ["/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi0-0-0-1"];
-  };
-
-  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
-
-  boot.initrd.luks.devices."cryptroot" = {
-    device = "/dev/disk/by-uuid/bf890962-9f43-4c44-a0df-64cabd303662";
-  };
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/7eb8989a-6ec4-405f-8810-06486f7621c1";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1fd053f8-725b-418d-aed1-aee71dac2b62";
-    fsType = "ext4";
-  };
-
-  swapDevices = [
-    {device = "/dev/disk/by-uuid/2f114633-5b71-46ab-88be-997b27927269";}
-  ];
-
-  networking = {
-    defaultGateway = {
-      address = "80.244.242.1";
-      interface = "enp1s0";
-    };
-    nameservers = ["95.129.51.51" "80.244.244.244"];
-    interfaces.enp1s0 = {
-      useDHCP = false;
-      ipv4.addresses = [
-        {
-          address = "80.244.242.4";
-          prefixLength = 29;
-        }
-      ];
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/pioneer-momo-koeln/keycloak.nix

@@ -1,25 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  flake,
-  ...
-}: {
-  age.secrets.keycloak-database-password = {
-    file = "${flake.self}/secrets/keycloak-database-password.age";
-    mode = "700";
-  };
-
-  # keycloak
-  services.keycloak = {
-    enable = true;
-    database.passwordFile = config.age.secrets.keycloak-database-password.path;
-    settings = {
-      hostname = "auth.momo.koeln";
-      http-host = "127.0.0.1";
-      http-port = 8080;
-      proxy = "edge";
-    };
-  };
-}

lib/add-local-hostname.nix

@@ -1,4 +0,0 @@
-{lib}: hostnames: {
-  "127.0.0.1" = hostnames;
-  "::1" = hostnames;
-}

lib/default.nix

@@ -1,21 +1,10 @@
-{
+{lib}:
-  lib,
+lib.makeExtensible (self: let
-  inputs,
+  callLibs = file: import file {lib = self;};
-  ...
+in rec {
-}: {
+  ## Define your own library functions here!
-  # Configuration common to all Linux systems
+  #id = x: x;
-  flake = {
+  ## Or in files, containing functions that take {lib}
-    lib = let
+  #foo = callLibs ./foo.nix;
-      callLibs = file: import file {inherit lib;};
+  ## In configs, they can be used under "lib.our"
-    in rec {
+})
-      ## Define your own library functions here!
-      #id = x: x;
-      ## Or in files, containing functions that take {lib}
-      #foo = callLibs ./foo.nix;
-      ## In configs, they can be used under "lib.our"
-
-      deploy = import ./deploy.nix {inherit inputs lib;};
-      addLocalHostname = callLibs ./add-local-hostname.nix;
-    };
-  };
-}

lib/deploy.nix

@@ -1,74 +0,0 @@
-/*
-* The contents of this file are adapted from digga
-* https://github.com/divnix/digga
-*
-* Licensed under the MIT license
-*/
-{
-  lib,
-  inputs,
-}: let
-  # https://github.com/serokell/deploy-rs#overall-usage
-  system = "x86_64-linux";
-  pkgs = import inputs.nixpkgs { inherit system; };
-  deployPkgs = import inputs.nixpkgs {
-    inherit system;
-    overlays = [
-      inputs.deploy-rs.overlay
-      (self: super: { deploy-rs = { inherit (pkgs) deploy-rs; lib = super.deploy-rs.lib; }; })
-    ];
-  };
-  getFqdn = c: let
-    net = c.config.networking;
-    fqdn =
-      if (net ? domain) && (net.domain != null)
-      then "${net.hostName}.${net.domain}"
-      else net.hostName;
-  in
-    fqdn;
-in {
-  mkDeployNodes = systemConfigurations: extraConfig:
-  /*
-  *
-  Synopsis: mkNodes _systemConfigurations_ _extraConfig_
-
-  Generate the `nodes` attribute expected by deploy-rs
-  where _systemConfigurations_ are `nodes`.
-
-  _systemConfigurations_ should take the form of a flake's
-  _nixosConfigurations_. Note that deploy-rs does not currently support
-  deploying to darwin hosts.
-
-  _extraConfig_, if specified, will be merged into each of the
-  nodes' configurations.
-
-  Example _systemConfigurations_ input:
-
-  ```
-  {
-  hostname-1 = {
-  fastConnection = true;
-  sshOpts = [ "-p" "25" ];
-  };
-  hostname-2 = {
-  sshOpts = [ "-p" "19999" ];
-  sshUser = "root";
-  };
-  }
-  ```
-  *
-  */
-    lib.recursiveUpdate
-    (lib.mapAttrs
-      (
-        _: c: {
-          hostname = getFqdn c;
-          profiles.system = {
-            user = "root";
-            path = deployPkgs.deploy-rs.lib.activate.nixos c;
-          };
-        }
-      )
-      systemConfigurations)
-    extraConfig;
-}

modules/adb/default.nix

@@ -1,15 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-in {
-  programs.adb.enable = true;
-
-  users.users."${psCfg.user.name}" = {
-    extraGroups = ["adbusers"];
-  };
-}

modules/arduino/default.nix

@@ -6,12 +6,22 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.devops;
 in {
-  users.users."${psCfg.user.name}" = {
+  options.pub-solar.arduino = {
-    extraGroups = ["dialout"];
+    enable = mkEnableOption "Life with home automation";
-    packages = with pkgs; [
+  };
-      arduino
+  config = mkIf cfg.enable {
-      arduino-cli
+    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
-    ];
+      extraGroups = ["dialout"];
+    };
+
+    home-manager = with pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        home.packages = [
+          arduino
+          arduino-cli
+        ];
+      };
   };
 }

modules/audio/default.nix

@@ -6,34 +6,115 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.audio;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 in {
-  users.users."${psCfg.user.name}" = {
+  options.pub-solar.audio = {
-    extraGroups = ["audio"];
+    enable = mkEnableOption "Life in highs and lows";
-    packages = with pkgs; [
+    mopidy.enable = mkEnableOption "Life with mopidy";
-      # easyeffects, e.g. for microphone noise filtering
+    spotify.enable = mkEnableOption "Life in DRM";
-      easyeffects
+    spotify.username = mkOption {
-      mu
+      description = "Spotify login username or email";
-      pavucontrol
+      type = types.str;
-      pa_applet
+      example = "yourname@example.com";
-      playerctl
+      default = "";
-      # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
+    };
-      pulseaudio
+    bluetooth.enable = mkEnableOption "Life with bluetooth";
-      vimpc
-    ];
   };
 
-  home-manager.users."${psCfg.user.name}" = {
+  config = mkIf cfg.enable {
-    xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
+    users.users = pkgs.lib.setAttrByPath [psCfg.user.name] {
-    systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
+      extraGroups = ["audio"];
-  };
+    };
 
-  # rtkit is optional but recommended
+    home-manager = with pkgs;
-  security.rtkit.enable = true;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-  services.pipewire = {
+        home.packages =
-    enable = true;
+          [
-    alsa.enable = true;
+            # easyeffects, e.g. for microphone noise filtering
-    alsa.support32Bit = true;
+            easyeffects
-    pulse.enable = true;
+            mu
+            pavucontrol
+            pa_applet
+            playerctl
+            # Needed for pactl cmd, until pw-cli is more mature (vol up/down hotkeys?)
+            pulseaudio
+            vimpc
+          ]
+          ++ (
+            if cfg.spotify.enable
+            then [pkgs.spotify-tui]
+            else []
+          );
+        xdg.configFile."vimpc/vimpcrc".source = ./.config/vimpc/vimpcrc;
+        systemd.user.services.easyeffects = import ./easyeffects.service.nix pkgs;
+
+        services.spotifyd = mkIf cfg.spotify.enable {
+          enable = true;
+          settings = {
+            global = {
+              username = cfg.spotify.username;
+              password_cmd = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus ${pkgs.libsecret}/bin/secret-tool lookup spotify password";
+              bitrate = 320;
+              volume_normalisation = true;
+              no_audio_cache = false;
+              max_cache_size = 1000000000;
+            };
+          };
+        };
+      };
+
+    # rtkit is optional but recommended
+    security.rtkit.enable = true;
+    # Enable sound using pipewire-pulse, default config:
+    # https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire.conf.in
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+
+    # Make pulseaudio listen on port 4713 for mopidy, extending the default
+    # config: https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/daemon/pipewire-pulse.conf.in
+    environment.etc = mkIf cfg.mopidy.enable {
+      "pipewire/pipewire-pulse.conf.d/99-custom.conf".text = ''
+        {
+          "context.modules": [
+            {
+              "name": "libpipewire-module-protocol-pulse",
+              "args": {
+                "server.address": ["unix:native", "tcp:4713"],
+                "vm.overrides": {
+                  "pulse.min.quantum": "1024/48000"
+                }
+              }
+            }
+          ]
+        }
+      '';
+    };
+
+    # Enable bluetooth
+    hardware.bluetooth = mkIf cfg.bluetooth.enable {
+      enable = true;
+      # Disable bluetooth on startup to save battery
+      powerOnBoot = false;
+      # Disable useless SIM Access Profile plugin
+      disabledPlugins = [
+        "sap"
+      ];
+      settings = {
+        General = {
+          # Enables experimental features and interfaces.
+          # Makes BlueZ Battery Provider available
+          Experimental = true;
+        };
+      };
+    };
+    services.blueman.enable = mkIf cfg.bluetooth.enable true;
+
+    # Enable audio server & client
+    services.mopidy = mkIf cfg.mopidy.enable ((import ./mopidy.nix) pkgs);
   };
 }

modules/audio/mopidy.nix

@@ -0,0 +1,18 @@
+pkgs: {
+  enable = true;
+  extensionPackages = with pkgs; [
+    mopidy-mpd
+    mopidy-soundcloud
+    mopidy-youtube
+    mopidy-local
+    mopidy-jellyfin
+  ];
+
+  configuration = ''
+    [mpd]
+    hostname = ::
+
+    [audio]
+    output = pulsesink server=127.0.0.1:4713
+  '';
+}

modules/bluetooth/default.nix

@@ -1,35 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}: {
-  hardware.bluetooth = {
-    enable = true;
-    # Disable bluetooth on startup to save battery
-    powerOnBoot = false;
-    # Disable useless SIM Access Profile plugin
-    disabledPlugins = [
-      "sap"
-    ];
-    settings = {
-      General = {
-        # Enables experimental features and interfaces.
-        # Makes BlueZ Battery Provider available
-        Experimental = true;
-      };
-    };
-  };
-
-  services.blueman.enable = true;
-  environment.etc."wireplumber/bluetooth.lua.d/51-bluez-config.lua" = {
-    text = ''
-      bluez_monitor.properties = {
-        ["bluez5.enable-sbc-xq"] = true,
-        ["bluez5.enable-msbc"] = true,
-        ["bluez5.enable-hw-volume"] = true,
-        ["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
-      }
-    '';
-  };
-}

modules/ci-runner/default.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  config,
+  pkgs,
+  self,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.ci-runner;
+in {
+  options.pub-solar.ci-runner = {
+    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
+  };
+
+  config = mkIf cfg.enable {
+    systemd.user.services.ci-runner = {
+      enable = true;
+
+      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+      };
+
+      path = [
+        pkgs.git
+        pkgs.nix
+        pkgs.libvirt
+      ];
+
+      wantedBy = ["multi-user.target"];
+      after = ["network.target" "libvirtd.service"];
+
+      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
+    };
+
+    age.secrets."drone-runner-exec-config" = {
+      file = "${self}/secrets/drone-runner-exec-config";
+      mode = "700";
+      owner = psCfg.user.name;
+    };
+  };
+}

modules/core/boot.nix

@@ -7,6 +7,12 @@
 with lib; let
   cfg = config.pub-solar.core;
 in {
+  options.pub-solar.core.iso-options.enable = mkOption {
+    type = types.bool;
+    default = false;
+    description = "Feature flag for iso builds";
+  };
+
   options.pub-solar.core.disk-encryption-active = mkOption {
     type = types.bool;
     default = true;
@@ -15,9 +21,13 @@ in {
 
   config = {
     boot = {
+      # Enable plymouth for better experience of booting
+      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
+
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
-      initrd = mkIf cfg.disk-encryption-active {
+      # The ! makes this enabled by default
+      initrd = mkIf (!cfg.iso-options.enable && cfg.disk-encryption-active) {
         luks.devices."cryptroot" = {
           allowDiscards = true;
         };
@@ -26,7 +36,7 @@ in {
       loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_6;
+      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_1;
 
       # Support ntfs drives
       supportedFilesystems = ["ntfs"];

modules/core/default.nix

@@ -5,34 +5,38 @@
 }:
 with lib; let
   cfg = config.pub-solar.core;
-  psCfg = config.pub-solar;
 in {
   imports = [
     ./boot.nix
     ./hibernation.nix
+    ./fonts.nix
     ./i18n.nix
     ./networking.nix
+    ./nix.nix
     ./packages.nix
+    ./services.nix
   ];
 
-  # Service that makes Out of Memory Killer more effective
+  options.pub-solar.core = {
-  services.earlyoom.enable = true;
+    lite = mkOption {
-
+      description = ''
-  services.logind.lidSwitch = "hibernate";
+        Enable a lite edition of core with less default modules and a reduced package set.
-
+      '';
-  services.tor.settings = {
+      default = false;
-    UseBridges = true;
+      type = types.bool;
+    };
   };
 
-  # The options below are directly taken from or inspired by
+  config = {
-  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
+    pub-solar = {
+      audio.enable = mkIf (!cfg.lite) (mkDefault true);
+      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
+      devops.enable = mkIf (!cfg.lite) (mkDefault true);
 
-  # Limit the use of sudo to the group wheel
+      terminal-life = {
-  security.sudo.execWheelOnly = true;
+        enable = mkDefault true;
-
+        lite = cfg.lite;
-  # Remove the complete default environment of packages like
+      };
-  # nano, perl and rsync
+    };
-  environment.defaultPackages = lib.mkForce [];
+  };
-
-  # fileSystems."/".options = [ "noexec" ];
 }

modules/core/fonts.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  fonts = {
+    fonts = with pkgs; [powerline-fonts dejavu_fonts];
+    fontconfig.defaultFonts = {
+      monospace = ["DejaVu Sans Mono for Powerline"];
+      sansSerif = ["DejaVu Sans"];
+    };
+  };
+}

modules/core/networking.nix

@@ -1,39 +1,85 @@
 {
-  flake,
   config,
   pkgs,
   lib,
   ...
-}: {
+}:
-  # disable NetworkManager and systemd-networkd -wait-online by default
+with lib; let
-  systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
+  cfg = config.pub-solar.core;
-  systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
+in {
+  options.pub-solar.core = {
+    enableCaddy = mkOption {
+      type = types.bool;
+      default = !cfg.lite;
+    };
+    enableHelp = mkOption {
+      type = types.bool;
+      default = !cfg.lite;
+    };
 
-  networking.networkmanager = {
+    binaryCaches = mkOption {
-    # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
+      type = types.listOf types.str;
-    enable = lib.mkDefault true;
+      default = [];
-    # not as stable as wpa_supplicant yet, also more trouble with 5 GHz networks
+      description = "Binary caches to use.";
-    #wifi.backend = "iwd";
+    };
+    publicKeys = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "Public keys of binary caches.";
+    };
   };
+  config = {
+    # disable NetworkManager and systemd-networkd -wait-online by default
+    systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
+    systemd.services.systemd-networkd-wait-online.enable = lib.mkDefault false;
 
-  networking.firewall.enable = true;
+    networking.networkmanager = {
+      # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
+      enable = true;
+      wifi.backend = "iwd";
+    };
 
-  # For rage encryption, all hosts need a ssh key pair
+    networking.firewall.enable = true;
-  services.openssh = {
-    enable = true;
-    allowSFTP = lib.mkDefault false;
 
-    openFirewall = lib.mkDefault false;
+    # Customized binary caches list (with fallback to official binary cache)
+    nix.settings.substituters = cfg.binaryCaches;
+    nix.settings.trusted-public-keys = cfg.publicKeys;
 
-    settings.PasswordAuthentication = lib.mkDefault false;
+    # These entries get added to /etc/hosts
-    settings.KbdInteractiveAuthentication = false;
+    networking.hosts = {
+      "127.0.0.1" =
+        []
+        ++ lib.optionals cfg.enableCaddy ["caddy.local"]
+        ++ lib.optionals config.pub-solar.printing.enable ["cups.local"]
+        ++ lib.optionals cfg.enableHelp ["help.local"];
+    };
 
-    extraConfig = ''
+    # Caddy reverse proxy for local services like cups
-      AllowTcpForwarding yes
+    services.caddy = {
-      X11Forwarding no
+      enable = lib.mkDefault cfg.enableCaddy;
-      AllowAgentForwarding no
+      globalConfig = lib.mkDefault ''
-      AllowStreamLocalForwarding no
+        default_bind 127.0.0.1
-      AuthenticationMethods publickey
+        auto_https off
-    '';
+      '';
+      extraConfig = lib.mkDefault (concatStringsSep "\n" [
+        (lib.optionalString
+          config.pub-solar.printing.enable
+          ''
+            cups.local:80 {
+              request_header Host localhost:631
+              reverse_proxy unix//run/cups/cups.sock
+            }
+          '')
+
+        (lib.optionalString
+          cfg.enableHelp
+          ''
+            help.local:80 {
+              root * ${pkgs.psos-docs}/lib/html
+              file_server
+            }
+          '')
+      ]);
+    };
   };
 }

modules/core/nix.nix

@@ -2,32 +2,14 @@
   config,
   pkgs,
   lib,
-  flake,
+  inputs,
   ...
 }: {
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "1password"
-      "1password-cli"
-      "cups-brother-hl3140cw"
-      "facetimehd-firmware"
-      "slack"
-      "veracrypt"
-      "zoom"
-    ];
-
   nix = {
     # Use default version alias for nix package
     package = pkgs.nix;
     gc.automatic = true;
     optimise.automatic = true;
-
-    registry = {
-      nixpkgs.flake = flake.inputs.nixpkgs;
-      unstable.flake = flake.inputs.unstable;
-      system.flake = flake.self;
-    };
-
     settings = {
       # Improve nix store disk usage
       auto-optimise-store = true;
@@ -37,16 +19,7 @@
       trusted-users = ["root" "@wheel"];
       # Allow only group wheel to connect to the nix daemon
       allowed-users = ["@wheel"];
-
-      substituters = [
-        "https://pub-solar.cachix.org/"
-      ];
-
-      trusted-public-keys = [
-        "pub-solar.cachix.org-1:ZicXIxKgdxMtgSJECWR8iihZxHRvu8ObL4n2cuBmtos="
-      ];
     };
-
     # Generally useful nix option defaults
     extraOptions = lib.mkForce ''
       experimental-features = flakes nix-command
@@ -55,11 +28,5 @@
       keep-derivations = true
       fallback = true
     '';
-
-    nixPath = [
-      "nixpkgs=${flake.inputs.nixpkgs}"
-      "nixos-config=${../../lib/compat/nixos}"
-      "home-manager=${flake.inputs.home-manager}"
-    ];
   };
 }

modules/core/packages.nix

@@ -8,21 +8,72 @@ with lib; let
   psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
 in {
-  environment.systemPackages = with pkgs; [
+  environment = {
-    # Core unix utility packages
+    systemPackages = with pkgs;
-    coreutils-full
+      [
-    dnsutils
+        # Core unix utility packages
-    inetutils
+        coreutils-full
-    progress
+        dnsutils
-    pciutils
+        inetutils
-    usbutils
+        progress
-    diffutils
+        pciutils
-    findutils
+        usbutils
-    exfat
 
-    gitMinimal
+        wget
+        openssl
+        openssh
+        curl
+        htop
+        btop
+        lsof
+        psmisc
+        file
 
-    btop
+        # zippit
-    mtr
+        zip
-  ];
+        unzip
+
+        # Modern modern utilities
+        p7zip
+        croc
+        jq
+      ]
+      ++ lib.optionals (!cfg.lite) [
+        mtr
+
+        gitFull
+        git-lfs
+        git-bug
+
+        xdg-utils
+        sysfsutils
+        renameutils
+        nfs-utils
+        moreutils
+        mailutils
+        keyutils
+        input-utils
+        elfutils
+        binutils
+        dateutils
+        diffutils
+        findutils
+        exfat
+
+        # Nix specific utilities
+        alejandra
+        niv
+        manix
+        nix-index
+        nix-tree
+        nixpkgs-review
+        # Build broken, python2.7-PyJWT-2.0.1.drv' failed
+        #nixops
+        psos
+        nvd
+
+        # Fun
+        neofetch
+      ];
+  };
 }

modules/core/services.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  # For rage encryption, all hosts need a ssh key pair
+  services.openssh = {
+    enable = true;
+    # If you don't want the host to have SSH actually opened up to the net,
+    # set `services.openssh.openFirewall` to false in your config.
+    openFirewall = lib.mkDefault true;
+    settings.PasswordAuthentication = lib.mkDefault false;
+  };
+
+  # Service that makes Out of Memory Killer more effective
+  services.earlyoom.enable = true;
+}

modules/crypto/default.nix

@@ -6,28 +6,40 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.crypto;
 in {
-  services.udev.packages = [pkgs.yubikey-personalization];
+  options.pub-solar.crypto = {
-  services.dbus.packages = [pkgs.gcr];
+    enable = mkEnableOption "Life in private";
-  services.pcscd.enable = true;
+  };
 
-  services.gnome.gnome-keyring.enable = true;
+  config = mkIf cfg.enable {
+    services.udev.packages = [pkgs.yubikey-personalization];
+    services.dbus.packages = [pkgs.gcr];
+    services.pcscd.enable = true;
 
-  users.users."${psCfg.user.name}".packages = with pkgs; [
+    services.gnome.gnome-keyring.enable = true;
-    libsecret
-  ];
 
-  home-manager.users."${psCfg.user.name}" = {
+    home-manager = with pkgs;
-    systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        systemd.user.services.polkit-gnome-authentication-agent = import ./polkit-gnome-authentication-agent.service.nix pkgs;
 
-    services.gpg-agent = {
+        services.gpg-agent = {
-      enable = true;
+          enable = true;
-      pinentryFlavor = "gnome3";
+          pinentryFlavor = "gnome3";
-      verbose = true;
+          verbose = true;
-    };
+        };
 
-    programs.gpg = {
+        programs.gpg = {
-      enable = true;
+          enable = true;
-    };
+        };
+
+        home.packages = [
+          gnome.seahorse
+          keepassxc
+          libsecret
+          qMasterPassword
+          restic
+        ];
+      };
   };
 }

modules/ddclient/default.nix

@@ -1,269 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  cfg = config.services.ddclient;
-  boolToStr = bool:
-    if bool
-    then "yes"
-    else "no";
-  dataDir = "/var/lib/ddclient";
-  StateDirectory = builtins.baseNameOf dataDir;
-  RuntimeDirectory = StateDirectory;
-
-  usev4 =
-    if cfg.usev4 != ""
-    then "usev4=${cfg.usev4}"
-    else "";
-  usev6 =
-    if cfg.usev6 != ""
-    then "usev6=${cfg.usev6}"
-    else "";
-
-  configFile' = pkgs.writeText "ddclient.conf" ''
-    # This file can be used as a template for configFile or is automatically generated by Nix options.
-    use=no
-    ${usev4}
-    ${usev6}
-    cache=${dataDir}/ddclient.cache
-    foreground=yes
-    login=${cfg.username}
-    password=${
-      if cfg.protocol == "nsupdate"
-      then "/run/${RuntimeDirectory}/ddclient.key"
-      else "@password_placeholder@"
-    }
-    protocol=${cfg.protocol}
-    ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
-    ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
-    ${lib.optionalString (cfg.zone != "") "zone=${cfg.zone}"}
-    ssl=${boolToStr cfg.ssl}
-    wildcard=yes
-    quiet=${boolToStr cfg.quiet}
-    verbose=${boolToStr cfg.verbose}
-    ${cfg.extraConfig}
-    ${lib.concatStringsSep "," cfg.domains}
-  '';
-  configFile =
-    if (cfg.configFile != null)
-    then cfg.configFile
-    else configFile';
-
-  preStart = ''
-    install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
-    ${lib.optionalString (cfg.configFile == null) (
-      if (cfg.protocol == "nsupdate")
-      then ''
-        install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
-      ''
-      else if (cfg.passwordFile != null)
-      then ''
-        "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
-      ''
-      else ''
-        sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
-      ''
-    )}
-  '';
-in
-  with lib; {
-    disabledModules = [
-      "services/networking/ddclient.nix"
-    ];
-
-    imports = [
-      (mkChangedOptionModule ["services" "ddclient" "domain"] ["services" "ddclient" "domains"]
-        (config: let
-          value = getAttrFromPath ["services" "ddclient" "domain"] config;
-        in
-          if value != ""
-          then [value]
-          else []))
-      (mkRemovedOptionModule ["services" "ddclient" "homeDir"] "")
-      (mkRemovedOptionModule ["services" "ddclient" "password"] "Use services.ddclient.passwordFile instead.")
-    ];
-
-    ###### interface
-
-    options = {
-      services.ddclient = with lib.types; {
-        enable = mkOption {
-          default = false;
-          type = bool;
-          description = lib.mdDoc ''
-            Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
-          '';
-        };
-
-        package = mkOption {
-          type = package;
-          default = pkgs.ddclient;
-          defaultText = lib.literalExpression "pkgs.ddclient";
-          description = lib.mdDoc ''
-            The ddclient executable package run by the service.
-          '';
-        };
-
-        domains = mkOption {
-          default = [""];
-          type = listOf str;
-          description = lib.mdDoc ''
-            Domain name(s) to synchronize.
-          '';
-        };
-
-        username = mkOption {
-          # For `nsupdate` username contains the path to the nsupdate executable
-          default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
-          defaultText = "";
-          type = str;
-          description = lib.mdDoc ''
-            User name.
-          '';
-        };
-
-        passwordFile = mkOption {
-          default = null;
-          type = nullOr str;
-          description = lib.mdDoc ''
-            A file containing the password or a TSIG key in named format when using the nsupdate protocol.
-          '';
-        };
-
-        interval = mkOption {
-          default = "10min";
-          type = str;
-          description = lib.mdDoc ''
-            The interval at which to run the check and update.
-            See {command}`man 7 systemd.time` for the format.
-          '';
-        };
-
-        configFile = mkOption {
-          default = null;
-          type = nullOr path;
-          description = lib.mdDoc ''
-            Path to configuration file.
-            When set this overrides the generated configuration from module options.
-          '';
-          example = "/root/nixos/secrets/ddclient.conf";
-        };
-
-        protocol = mkOption {
-          default = "dyndns2";
-          type = str;
-          description = lib.mdDoc ''
-            Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
-          '';
-        };
-
-        server = mkOption {
-          default = "";
-          type = str;
-          description = lib.mdDoc ''
-            Server address.
-          '';
-        };
-
-        ssl = mkOption {
-          default = true;
-          type = bool;
-          description = lib.mdDoc ''
-            Whether to use SSL/TLS to connect to dynamic DNS provider.
-          '';
-        };
-
-        quiet = mkOption {
-          default = false;
-          type = bool;
-          description = lib.mdDoc ''
-            Print no messages for unnecessary updates.
-          '';
-        };
-
-        script = mkOption {
-          default = "";
-          type = str;
-          description = lib.mdDoc ''
-            script as required by some providers.
-          '';
-        };
-
-        usev4 = mkOption {
-          default = "webv4, webv4=checkip.dyndns.com/, webv4-skip='Current IP Address: '";
-          type = str;
-          description = lib.mdDoc ''
-            Method to determine the IP address to send to the dynamic DNS provider.
-          '';
-        };
-
-        usev6 = mkOption {
-          default = "";
-          type = str;
-          description = lib.mdDoc ''
-            Method to determine the IP address to send to the dynamic DNS provider.
-          '';
-        };
-
-        verbose = mkOption {
-          default = false;
-          type = bool;
-          description = lib.mdDoc ''
-            Print verbose information.
-          '';
-        };
-
-        zone = mkOption {
-          default = "";
-          type = str;
-          description = lib.mdDoc ''
-            zone as required by some providers.
-          '';
-        };
-
-        extraConfig = mkOption {
-          default = "";
-          type = lines;
-          description = lib.mdDoc ''
-            Extra configuration. Contents will be added verbatim to the configuration file.
-
-            ::: {.note}
-            `daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
-            :::
-          '';
-        };
-      };
-    };
-
-    ###### implementation
-
-    config = mkIf config.services.ddclient.enable {
-      systemd.services.ddclient = {
-        description = "Dynamic DNS Client";
-        wantedBy = ["multi-user.target"];
-        after = ["network.target"];
-        restartTriggers = optional (cfg.configFile != null) cfg.configFile;
-
-        serviceConfig = {
-          DynamicUser = true;
-          RuntimeDirectoryMode = "0700";
-          inherit RuntimeDirectory;
-          inherit StateDirectory;
-          Type = "oneshot";
-          ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
-          ExecStart = "${lib.getBin cfg.package}/bin/ddclient -file /run/${RuntimeDirectory}/ddclient.conf";
-        };
-      };
-
-      systemd.timers.ddclient = {
-        description = "Run ddclient";
-        wantedBy = ["timers.target"];
-        timerConfig = {
-          OnBootSec = cfg.interval;
-          OnUnitInactiveSec = cfg.interval;
-        };
-      };
-    };
-  }

modules/default.nix

@@ -1,42 +0,0 @@
-{
-  self,
-  inputs,
-  ...
-}: {
-  flake = {
-    nixosModules = rec {
-      audio = import ./audio;
-      bluetooth = import ./bluetooth;
-      core = import ./core;
-      crypto = import ./crypto;
-      desktop-extended = import ./desktop-extended;
-      docker = import ./docker;
-      #email = import ./email;
-      #gaming = import ./gaming;
-      graphical = import ./graphical;
-      #invoiceplane = import ./invoiceplane;
-      nix = import ./nix;
-      nextcloud = import ./nextcloud;
-      office = import ./office;
-      printing = import ./printing;
-      terminal-life = import ./terminal-life;
-      user = import ./user;
-      virtualisation = import ./virtualisation;
-      #wireguard-client = import ./wireguard-client;
-
-      base.imports = [
-        self.nixosModules.home-manager
-        inputs.agenix.nixosModules.default
-
-        self.nixosModules.overlays
-        self.nixosModules.core
-        self.nixosModules.crypto
-        self.nixosModules.nix
-        self.nixosModules.terminal-life
-
-        self.nixosModules.root
-        self.nixosModules.user
-      ];
-    };
-  };
-}

modules/desktop-extended/default.nix

@@ -1,49 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-in {
-  users.users."${psCfg.user.name}".packages = with pkgs; [
-    ungoogled-chromium
-    wine
-
-    gimp
-    inkscape
-    tigervnc
-    nodejs
-
-    signal-desktop
-    tdesktop
-    element-desktop
-
-    # Nix specific utilities
-    alejandra
-    manix
-    nix-output-monitor
-    nix-tree
-    nvd
-    nixpkgs-review
-    nix-search-cli
-  ];
-
-  fonts = {
-    packages = with pkgs; [
-      dejavu_fonts
-      fira-code
-      fira-code-symbols
-      #google-fonts
-      lato
-      montserrat
-      nerdfonts
-      noto-fonts
-      noto-fonts-cjk
-      open-sans
-      powerline-fonts
-      source-sans-pro
-    ];
-  };
-}

modules/devops/default.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.devops;
+in {
+  options.pub-solar.devops = {
+    enable = mkEnableOption "Life automated";
+  };
+
+  config = mkIf cfg.enable {
+    home-manager = with pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        home.packages = [
+          drone-cli
+          nmap
+          pgcli
+          ansible
+          ansible-lint
+          restic
+          shellcheck
+          terraform
+        ];
+      };
+  };
+}

modules/docker-ci-runner/default.nix

@@ -0,0 +1,114 @@
+{
+  lib,
+  config,
+  pkgs,
+  self,
+  ...
+}:
+with lib; let
+  bootstrap = pkgs.writeScript "bootstrap.sh" ''
+    #!/usr/bin/env bash
+
+    set -e
+
+    apt update
+    apt install --yes curl git sudo xz-utils
+
+    adduser --system --uid 999 build
+    chown build /nix
+
+    sudo -u build curl -L https://nixos.org/nix/install > install
+    sudo -u build sh install
+
+    echo "export PATH=/nix/var/nix/profiles/per-user/build/profile/bin:''$PATH" >> /etc/profile
+
+    mkdir /etc/nix
+    echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+
+    export nix_user_config_file="/home/build/.local/share/nix/trusted-settings.json"
+    mkdir -p $(dirname \\$nix_user_config_file)
+    echo '{"extra-experimental-features":{"nix-command flakes":true}}' > \\$nix_user_config_file
+    chown -R build /home/build/
+
+    curl -L https://github.com/drone-runners/drone-runner-exec/releases/latest/download/drone_runner_exec_linux_amd64.tar.gz | tar xz
+    sudo install -t /usr/local/bin drone-runner-exec
+
+    if [ ! -f /run/vars ]; then
+      exit 1
+    fi
+
+    cp -a /run/vars /run/runtime-vars
+    env | grep "DRONE" >> /run/runtime-vars
+
+    su - -s /bin/bash build sh -c "/usr/local/bin/drone-runner-exec daemon /run/runtime-vars"
+  '';
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.docker-ci-runner;
+in {
+  options.pub-solar.docker-ci-runner = {
+    enable = lib.mkEnableOption "Enables a docker container running a drone exec runner as unprivileged user.";
+
+    enableKvm = lib.mkOption {
+      description = ''
+        Enable kvm support.
+      '';
+      default = true;
+      type = types.bool;
+    };
+
+    nixCacheLocation = lib.mkOption {
+      description = ''
+        Location of nix cache that is shared between builds
+      '';
+      default = "/var/lib/docker-ci-runner";
+      type = types.path;
+    };
+
+    runnerEnvironment = lib.mkOption {
+      description = ''
+        Additional environment vars added to the vars file on container runtime
+      '';
+      default = {};
+    };
+
+    runnerVarsFile = lib.mkOption {
+      description = ''
+        Location of vars file passed to drone runner
+      '';
+      type = types.path;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation = {
+      docker = {
+        enable = true; # sadly podman is not supported rightnow
+      };
+
+      oci-containers = {
+        backend = "docker";
+        containers."drone-exec-runner" = {
+          image = "debian";
+          autoStart = true;
+          entrypoint = "bash";
+          cmd = ["/bootstrap.sh"];
+
+          volumes = [
+            "${cfg.runnerVarsFile}:/run/vars"
+            "${cfg.nixCacheLocation}:/nix"
+            "${bootstrap}:/bootstrap.sh"
+          ];
+
+          environment = cfg.runnerEnvironment;
+
+          extraOptions = lib.mkIf cfg.enableKvm ["--device=/dev/kvm"];
+        };
+      };
+    };
+    # Fix container not stopping correctly and holding the system 120s upon
+    # shutdown / reboot
+    systemd.services.docker-drone-exec-runner.preStop = ''
+      docker stop drone-exec-runner
+    '';
+  };
+}

modules/docker/default.nix

@@ -6,15 +6,22 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.docker;
 in {
-  virtualisation.docker.enable = true;
+  options.pub-solar.docker = {
-  virtualisation.docker.package = pkgs.docker_24;
+    enable = mkEnableOption "Life in metal boxes";
-
-  users.users."${psCfg.user.name}" = {
-    extraGroups = ["docker"];
   };
 
-  environment.systemPackages = with pkgs; [
+  config = mkIf cfg.enable {
-    docker-compose
+    virtualisation.docker.enable = true;
-  ];
+    virtualisation.docker.package = pkgs.docker_24;
+    users.users = with pkgs;
+      pkgs.lib.setAttrByPath [psCfg.user.name] {
+        extraGroups = ["docker"];
+      };
+
+    environment.systemPackages = with pkgs; [
+      docker-compose
+    ];
+  };
 }

modules/email/default.nix

@@ -6,49 +6,28 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.email;
 in {
-  users.users."${psCfg.user.name}".packages = with pkgs; [
+  options.pub-solar.email = {
-    w3m
+    enable = mkEnableOption "Life in headers";
-    urlscan
+  };
-    neomutt
-    offlineimap
-    msmtp
-    mailto-mutt
-  ];
 
-  home-manager.users."${psCfg.user.name}" = {
+  config = mkIf cfg.enable {
-    programs.offlineimap = {
+    home-manager = with pkgs;
-      enable = true;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-      pythonFile = builtins.readFile ./offlineimap.py;
+        home.packages = [
-    };
+          w3m
+          urlscan
+          neomutt
+          offlineimap
+          msmtp
+          mailto-mutt
+        ];
 
-    xdg.configFile."mutt/muttrc".source = ./.config/mutt/muttrc;
+        programs.offlineimap = {
-    xdg.configFile."mutt/base16.muttrc".source = ./.config/mutt/base16.muttrc;
+          enable = true;
-    xdg.configFile."mutt/mailcap".source = ./.config/mutt/mailcap;
+          pythonFile = builtins.readFile ./offlineimap.py;
-    xdg.configFile."offlineimap/functions.py".source = ./.config/offlineimap/functions.py;
+        };
-
+      };
-    xdg.configFile."mutt/accounts.muttrc".text = ''
-      source ./hello@benjaminbaedorf.eu.muttrc
-
-      macro index <f1> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/hello@benjaminbaedorf.eu.muttrc<enter><change-folder>!<enter>'
-      macro index <f2> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/benjamin.baedorf@rwth-aachen.de.muttrc<enter><change-folder>!<enter>'
-      macro index <f3> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/byb@miom.space.muttrc<enter><change-folder>!<enter>'
-      macro index <f4> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/mail@b12f.io.muttrc<enter><change-folder>!<enter>'
-      macro index <f5> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/admins@pub.solar.muttrc<enter><change-folder>!<enter>'
-      macro index <f6> '<sync-mailbox><enter-command>source $XDG_CONFIG_HOME/mutt/crew@pub.solar.muttrc<enter><change-folder>!<enter>'
-    '';
-    xdg.configFile."mutt/hello@benjaminbaedorf.eu.muttrc".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.muttrc";
-    xdg.configFile."mutt/benjamin.baedorf@rwth-aachen.de.muttrc".source = ./.config/mutt + "/benjamin.baedorf@rwth-aachen.de.muttrc";
-    xdg.configFile."mutt/hello@benjaminbaedorf.eu.signature".source = ./.config/mutt + "/hello@benjaminbaedorf.eu.signature";
-    xdg.configFile."mutt/byb@miom.space.muttrc".source = ./.config/mutt + "/byb@miom.space.muttrc";
-    xdg.configFile."mutt/byb@miom.space.signature".source = ./.config/mutt + "/byb@miom.space.signature";
-    xdg.configFile."mutt/mail@b12f.io.muttrc".source = ./.config/mutt + "/mail@b12f.io.muttrc";
-    xdg.configFile."mutt/mail@b12f.io.signature".source = ./.config/mutt + "/mail@b12f.io.signature";
-    xdg.configFile."mutt/admins@pub.solar.muttrc".source = ./.config/mutt + "/admins@pub.solar.muttrc";
-    xdg.configFile."mutt/admins@pub.solar.signature".source = ./.config/mutt + "/admins@pub.solar.signature";
-    xdg.configFile."mutt/crew@pub.solar.muttrc".source = ./.config/mutt + "/crew@pub.solar.muttrc";
-    xdg.configFile."mutt/crew@pub.solar.signature".source = ./.config/mutt + "/crew@pub.solar.signature";
-    xdg.configFile."offlineimap/config".source = ./.config/offlineimap/config;
-    xdg.configFile."msmtp/config".source = ./.config/msmtp/config;
   };
 }

modules/gaming/default.nix

@@ -6,16 +6,26 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.gaming;
 in {
-  programs.steam.enable = true;
+  options.pub-solar.gaming = {
-  nixpkgs.config.packageOverrides = pkgs: {
+    enable = mkEnableOption "Life in shooters";
-    steam = pkgs.steam.override {};
   };
 
-  users.users."${psCfg.user.name}".packages = with pkgs; [
+  config = mkIf cfg.enable {
-    playonlinux
+    programs.steam.enable = true;
-    godot
+    nixpkgs.config.packageOverrides = pkgs: {
-    obs-studio
+      steam = pkgs.steam.override {};
-    obs-studio-plugins.wlrobs
+    };
-  ];
+
+    home-manager = with pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        home.packages = [
+          playonlinux
+          godot
+          obs-studio
+          obs-studio-plugins.wlrobs
+        ];
+      };
+  };
 }

modules/graphical/.config/libinput-gestures.conf

@@ -1,198 +0,0 @@
-# Configuration file for libinput-gestures.
-# Mark Blakeney, Sep 2015
-#
-# The default configuration file exists at /etc/libinput-gestures.conf
-# but a user can create a personal custom configuration file at
-# ~/.config/libinput-gestures.conf.
-#
-# Lines starting with '#' and blank lines are ignored. Currently
-# "gesture" and "device" configuration keywords are supported as
-# described below. The keyword can optionally be appended with a ":" (to
-# maintain compatibility with original format configuration files).
-#
-# Each gesture line has 3 [or 4] arguments separated by whitespace:
-#
-# action motion [finger_count] command
-#
-# where action and motion is either:
-#     swipe up
-#     swipe down
-#     swipe left
-#     swipe right
-#     swipe left_up
-#     swipe left_down
-#     swipe right_up
-#     swipe right_down
-#     pinch in
-#     pinch out
-#     pinch clockwise
-#     pinch anticlockwise
-#
-# command is the remainder of the line and is any valid shell command +
-# arguments.
-#
-# finger_count is a single numeric digit and is optional (and is
-# typically 3 or 4). If specified then the command is executed when
-# exactly that number of fingers is used in the gesture. If not
-# specified then the command is executed when that gesture is executed
-# with any number of fingers. Gesture lines specified with finger_count
-# have priority over the same gesture specified without any
-# finger_count.
-#
-# Typically command will be xdotool, or wmctrl. See "man xdotool" for
-# the many things you can action with that tool. Note that unfortunately
-# xdotool does not work with native Wayland clients.
-
-###############################################################################
-# SWIPE GESTURES:
-###############################################################################
-
-# Note the default is an "internal" command that uses wmctrl to switch
-# workspaces and, unlike xdotool, works on both Xorg and Wayland (via
-# XWayland). It also can be configured for vertical and horizontal
-# switching over tabular workspaces, as per the example below. You can
-# also add "-w" to the internal command to allow wrapping workspaces.
-
-# Move to next workspace (works for GNOME/KDE/etc on Wayland and Xorg)
-#gesture swipe up	_internal ws_up
-
-# NOTE ABOUT FINGER COUNT:
-# The above command will configure this command for all fingers (i.e. 3
-# for 4) but to configure it for 3 fingers only, change it to:
-# gesture swipe up	3 _internal ws_up
-# Then you can configure something else for 4 fingers or leave 4 fingers
-# unconfigured. You can configure an explicit finger count like this for
-# all example commands in this configuration file.
-#
-gesture swipe up      3	ydotool key Super_L+Down
-gesture swipe up      4	ydotool key Super_L+Ctrl+Right
-
-# Move to prev workspace (works for GNOME/KDE/etc on Wayland and Xorg)
-#gesture swipe down	_internal ws_down
-gesture swipe down    3	ydotool key Super_L+Up
-gesture swipe down    4	ydotool key Super_L+Ctrl+Left
-
-# Browser go forward (works only for Xorg, and Xwayland clients)
-gesture swipe left    3	ydotool key ctrl+]
-
-# Browser go back (works only for Xorg, and Xwayland clients)
-gesture swipe right   3	ydotool key ctrl+[
-
-# NOTE: If you don't use "natural" scrolling direction for your touchpad
-# then you may want to swap the above default left/right and up/down
-# configurations.
-
-# Optional extended swipe gestures, e.g. for browser tab navigation:
-#
-# Jump to next open browser tab
-#gesture swipe right_up xdotool key control+Tab
-#gesture swipe right_up xdotool key control+Next
-gesture swipe right_up ydotool key ctrl+PageDown
-#
-# Jump to previous open browser tab
-#gesture swipe left_up xdotool key control+shift+Tab
-gesture swipe left_up ydotool key ctrl+PageUp
-#
-# Close current browser tab
-# gesture swipe left_down xdotool key control+w
-#
-# Reopen and jump to last closed browser tab
-# gesture swipe right_down xdotool key control+shift+t
-
-# Example of 8 static workspaces, e.g. using KDE virtual-desktops,
-# arranged in 2 rows of 4 columns across using swipe up/down/left/right
-# to navigate in fixed planes. You can also add the "-w/--wrap" option
-# to allow wrapping in any direction. You must configure your virtual
-# desktops with the same column dimension.
-# gesture swipe up	_internal --cols 4 ws_up
-# gesture swipe down	_internal --cols 4 ws_down
-# gesture swipe left	_internal --cols 4 ws_left
-# gesture swipe right	_internal --cols 4 ws_right
-#
-# Example of 16 static workspaces, e.g. using KDE virtual-desktops,
-# arranged in 4 rows of 4 columns across using swipe up/down/left/right
-# to navigate in fixed planes, and also using swipe
-# left_up/left_down/right_up/right_down to navigate diagonally. You can
-# also add the "-w/--wrap" option to allow wrapping in any direction
-# and/or diagonally. You must configure your virtual desktops with the
-# same column dimension.
-# gesture swipe up		_internal --cols 4 ws_up
-# gesture swipe down		_internal --cols 4 ws_down
-# gesture swipe left		_internal --cols 4 ws_left
-# gesture swipe right		_internal --cols 4 ws_right
-# gesture swipe left_up		_internal --cols 4 ws_left_up
-# gesture swipe left_down	_internal --cols 4 ws_left_down
-# gesture swipe right_up	_internal --cols 4 ws_right_up
-# gesture swipe right_down	_internal --cols 4 ws_right_down
-
-# Example virtual desktop switching for Ubuntu Unity/Compiz. The
-# _internal command does not work for Compiz but you can explicitly
-# configure the swipe commands to work for a Compiz virtual 2
-# dimensional desktop as follows:
-# gesture swipe up	xdotool key ctrl+alt+Up
-# gesture swipe down	xdotool key ctrl+alt+Down
-# gesture swipe left	xdotool key ctrl+alt+Left
-# gesture swipe right	xdotool key ctrl+alt+Right
-
-# Example to change audio volume:
-# Note this only works on an Xorg desktop (not Wayland).
-# gesture swipe up   xdotool key XF86AudioRaiseVolume
-# gesture swipe down xdotool key XF86AudioLowerVolume
-
-###############################################################################
-# PINCH GESTURES:
-###############################################################################
-
-# GNOME SHELL open/close overview (works for GNOME on Xorg only)
-gesture pinch in	ydotool key ctrl+-
-gesture pinch out	ydotool key ctrl+shift+=
-
-# KDE Plasma open/close overview
-# gesture pinch in	xdotool key ctrl+F9
-# gesture pinch out	xdotool key ctrl+F9
-
-# GNOME SHELL open/close overview (works for GNOME on Wayland and Xorg)
-# Note since GNOME 3.24 on Wayland this is implemented natively so no
-# real point configuring for Wayland.
-# gesture pinch in dbus-send --session --type=method_call --dest=org.gnome.Shell /org/gnome/Shell org.gnome.Shell.Eval string:'Main.overview.toggle();'
-# gesture pinch out dbus-send --session --type=method_call --dest=org.gnome.Shell /org/gnome/Shell org.gnome.Shell.Eval string:'Main.overview.toggle();'
-
-# Optional extended pinch gestures:
-# gesture pinch clockwise <whatever command>
-# gesture pinch anticlockwise <whatever command>
-
-###############################################################################
-# This application normally determines your touchpad device
-# automatically. Some users may have multiple touchpads but by default
-# we use only the first one found. However, you can choose to specify
-# the explicit device name to use. Run "libinput list-devices" to work
-# out the name of your device (from the "Device:" field). Then add a
-# device line specifying that name, e.g:
-#
-# device DLL0665:01 06CB:76AD Touchpad
-#
-# If the device name starts with a '/' then it is instead considered as
-# the explicit device path although since device paths can change
-# through reboots this is best to be a symlink. E.g. instead of specifying
-# /dev/input/event12, use the corresponding full path link under
-# /dev/input/by-path/ or /dev/input/by-id/.
-#
-# You can choose to use ALL touchpad devices by setting the device name
-# to "all". E.g. Do this if you have multiple touchpads which you want
-# to use in parallel. This reduces performance slightly so only set this
-# if you have to.
-#
-# device all
-
-###############################################################################
-# You can set a minimum travel distance threshold before swipe gestures
-# are actioned using the swipe_threshold configuration command.
-# Specify this value in dots. The default is 0.
-# E.g. set it to 100 dots with "swipe_threshold 100".
-# swipe_threshold 0
-
-###############################################################################
-# You can set a timeout on gestures from start to end. The default is
-# the value commented below. It can be any value in float secs >= 0.
-# 0 = no timeout. E.g. set it to 2 secs with "timeout 2".
-# timeout 1.5

modules/graphical/.config/mako/config

@@ -1,22 +0,0 @@
-padding=10
-margin=5,5,0
-default-timeout=5000
-
-## Base16 Burn
-# Author: Benjamin Bädorf
-#
-# You can use these variables anywhere in the mako configuration file.
-
-background-color=#1a181a
-text-color=#e3e1e4
-border-color=#ff5f5f
-
-[urgency=low]
-background-color=#1a181a
-text-color=#e3e1e4
-border-color=#ff5f5f
-
-[urgency=high]
-background-color=#ff5f5f
-text-color=#1a181a
-border-color=#1a181a

modules/graphical/.config/swaync/config.json

@@ -1,12 +0,0 @@
-{
-  "positionX": "right",
-  "positionY": "top",
-  "timeout": 10,
-  "timeout-low": 5,
-  "timeout-critical": 0,
-  "notification-window-width": 500,
-  "keyboard-shortcuts": true,
-  "image-visibility": "always",
-  "transition-time": 200,
-  "hide-on-clear": false
-}

modules/graphical/.config/swaync/style.css

@@ -1,149 +0,0 @@
-/*
- * vim: ft=less
- */
-
-@define-color border-color rgb(7, 7, 7);
-@define-color bg rgb(58, 58, 58);
-@define-color bg-hover rgb(68, 68, 68);
-@define-color bg-focus rgba(68, 68, 68, 0.6);
-@define-color bg-selected rgb(0, 128, 255);
-
-.notification-row {
-  outline: none;
-}
-.notification-row:focus,
-.notification-row:hover {
-  background: @bg-focus;
-}
-
-.notification {
-  border-radius: 10px;
-  margin: 6px 12px;
-  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
-  padding: 0;
-}
-
-.notification-content {
-  background: transparent;
-  padding: 6px;
-  border-radius: 10px;
-}
-
-.close-button {
-  background: black;
-  color: white;
-  text-shadow: none;
-  padding: 0 2px;
-  box-shadow: 0px 2px 4px 2px rgba(0, 0, 0, 0.3);
-  border-radius: 100%;
-}
-.close-button:hover {
-  background: rgb(30, 30, 30);
-  transition: all 0.15s ease-in-out;
-}
-
-.notification-default-action,
-.notification-action {
-  padding: 4px;
-  margin: 0;
-  box-shadow: none;
-  background: @bg;
-  border: 1px solid @border-color;
-}
-
-.notification-default-action:hover,
-.notification-action:hover {
-  background: @bg-hover;
-}
-
-.notification-default-action {
-  border-radius: 10px;
-}
-
-/* When alternative actions are visible */
-.notification-default-action:not(:only-child) {
-  border-bottom-left-radius: 0px;
-  border-bottom-right-radius: 0px;
-}
-
-.notification-action {
-  border-radius: 0px;
-  border-top: none;
-  border-right: none;
-}
-
-/* add bottom border radius to eliminate clipping */
-.notification-action:first-child {
-  border-bottom-left-radius: 10px;
-}
-.notification-action:last-child {
-  border-bottom-right-radius: 10px;
-  border-right: 1px solid @border-color;
-}
-
-.image {
-}
-
-.body-image {
-  margin-top: 6px;
-  background-color: white;
-  border-radius: 10px;
-}
-
-.summary {
-  color: white;
-  text-shadow: none;
-}
-
-.time {
-  color: white;
-  text-shadow: none;
-}
-
-.body {
-  background: transparent;
-  color: white;
-  text-shadow: none;
-}
-
-.top-action-title {
-  color: white;
-  text-shadow: none;
-}
-
-.control-center-clear-all {
-  color: white;
-  text-shadow: none;
-  background: @bg;
-  border: 1px solid @border-color;
-  box-shadow: none;
-  border-radius: 10px;
-}
-.control-center-clear-all:hover {
-  background: @bg-hover;
-}
-
-.control-center-dnd {
-  border-radius: 10px;
-  background: @bg;
-  border: 1px solid @border-color;
-  box-shadow: none;
-}
-
-.control-center-dnd:checked {
-  background: @bg-selected;
-}
-.control-center-dnd slider {
-  background: @bg-hover;
-}
-
-.control-center {
-  background: rgba(0, 0, 0, 0.7);
-}
-.control-center-list {
-  background: transparent;
-}
-
-.floating-notifications {
-  background: transparent;
-}

modules/graphical/.config/user-dirs.dirs

@@ -1,15 +0,0 @@
-# This file is written by xdg-user-dirs-update
-# If you want to change or add directories, just edit the line you're
-# interested in. All local changes will be retained on the next run.
-# Format is XDG_xxx_DIR="$HOME/yyy", where yyy is a shell-escaped
-# homedir-relative path, or XDG_xxx_DIR="/yyy", where /yyy is an
-# absolute path. No other format is supported.
-
-XDG_DESKTOP_DIR="$HOME/"
-XDG_DOWNLOAD_DIR="$HOME/Downloads"
-XDG_TEMPLATES_DIR="$HOME/Templates"
-XDG_PUBLICSHARE_DIR="$HOME/Public"
-XDG_DOCUMENTS_DIR="$HOME/"
-XDG_MUSIC_DIR="$HOME/"
-XDG_PICTURES_DIR="$HOME/"
-XDG_VIDEOS_DIR="$HOME/"

modules/graphical/.config/user-dirs.locale

@@ -1 +0,0 @@
-en_US

modules/graphical/.config/waybar/colorscheme.css

@@ -1,23 +0,0 @@
-/*
-*
-* Base16 Burn
-* Author: Benjamin Bädorf
-*
-*/
-
-@define-color base00 #1a181a;
-@define-color base01 #2d2a2e;
-@define-color base02 #303030;
-@define-color base03 #949494;
-@define-color base04 #d3d1d4;
-@define-color base05 #e3e1e4;
-@define-color base06 #303030;
-@define-color base07 #ff5f5f;
-@define-color base08 #f85e84;
-@define-color base09 #df5923;
-@define-color base0A #e5c463;
-@define-color base0B #9ecd6f;
-@define-color base0C #ef9062;
-@define-color base0D #7accd7;
-@define-color base0E #ab9df2;
-@define-color base0F #d70000;

modules/graphical/.config/waybar/config

@@ -1,148 +0,0 @@
-{
-  "layer": "top", // Waybar at top layer
-  // "position": "bottom", // Waybar position (top|bottom|left|right)
-
-  "height": 26, // Waybar height
-  "modules-left": ["sway/workspaces", "sway/mode"],
-  "modules-center": ["network"],
-  "modules-right": [
-    "sway/language",
-    "backlight",
-    "custom/notification",
-    "pulseaudio",
-    "idle_inhibitor",
-    "battery",
-    "clock",
-    "tray"
-  ],
-  "sway/workspaces": {
-      "disable-scroll": true
-  },
-  "sway/mode": {
-  "tooltip": false,
-      "format": "{}"
-  },
-  "sway/window": {
-  "tooltip": false,
-      "max-length": 96
-  },
-  "sway/language": {
-  "format": "{}",
-  "max-length": 50
-  },
-  "tray": {
-      "icon-size": 21,
-      "spacing": 10
-  },
-  "clock": {
-      "tooltip-format": "<tt><small>{calendar}</small></tt>",
-      "format": "{:%H:%M} ",
-      "format-alt": "{:%a %d. %h %H:%M} ",
-      //"on-scroll": {
-      //    "calendar": 1
-      //}
-      "smooth-scrolling-threshold": 1.0,
-      "calendar": {
-          "mode-mon-col"  : 3,
-          "on-scroll": -1,
-          "on-click-right": "mode",
-          "format": {
-              "months":     "<span color='#ffead3'><b>{}</b></span>",
-              "days":       "<span color='#ecc6d9'><b>{}</b></span>",
-              "weekdays":   "<span color='#ffcc66'><b>{}</b></span>",
-              "today":      "<span color='#ff6699'><b><u>{}</u></b></span>"
-          },
-      },
-      "actions":  {
-          "on-click-right": "mode",
-          "on-click-forward": "tz_up",
-          "on-click-backward": "tz_down",
-          "on-scroll-up": "shift_up",
-          "on-scroll-down": "shift_down"
-      }
-  },
-  "backlight": {
-      "device": "acpi_video0",
-      "format": "<span font='10'> {percent}%</span> {icon}",
-      "format-icons": ["", ""]
-  },
-  "cpu": {
-      "format": "{}% "
-  },
-  "memory": {
-      "format": "{}% "
-  },
-  "idle_inhibitor": {
-      "format": "{icon} ",
-      "format-icons": {
-          "activated": "",
-          "deactivated": ""
-      }
-  },
-  "battery": {
-      "tooltip": false,
-      "states": {
-          "critical": 25
-      },
-      //"full-at": 84,
-      "format": "{icon}<span font='10'> {capacity}%</span>",
-      "format-full": "{icon}",
-      "format-icons": ["", "", "", "", ""],
-  },
-  "network": {
-      "interval": 3,
-      "tooltip": true,
-      //"interface": "wlp4s0", // (Optional) To force the use of this interface          \uF2E7,
-      "format-wifi": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
-      "format-ethernet": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
-      "format-disconnected": "",
-      "tooltip-format-wifi": "{essid} ({signalStrength}%)  {ipaddr}",
-      "tooltip-format-ethernet": "{ifname}  {ipaddr}"
-  },
-  //\ue04f{volume}%
-  "pulseaudio": {
-      "tooltip": false,
-      "format": "<span font='10'>{volume}%</span> {icon}",
-      "format-bluetooth": "{volume}% <span font='10'>{icon}</span>",
-      "format-muted": "",
-      "on-click": "pavucontrol",
-      "format-alt": "{volume}% <span font='10'>{icon}</span>",
-      "format-icons": {
-          "headphones": "",
-          "handsfree": "",
-          "headset": "",
-          "phone": "",
-          "portable": "",
-          "car": "",
-          "default": ["","", ""]
-      }
-  },
-  "mpd": {
-    "format": "{artist} - {title} <span color=\"#999999\">[<span color=\"#ffffff\">{elapsedTime:%M:%S}</span> / {totalTime:%M:%S}]</span>",
-    "format-disconnected": "",
-    "format-stopped": "",
-    "interval": 1,
-    "state-icons": {
-      "paused": "",
-      "playing": ""
-    },
-    "tooltip-format": "MPD (connected)",
-    "tooltip-format-disconnected": "MPD (disconnected)"
-  },
-  "custom/notification": {
-    "tooltip": false,
-    "format": " {icon}",
-    "format-icons": {
-      "notification": "<span foreground='red'><sup></sup></span>",
-      "none": "",
-      "dnd-notification": "<span foreground='red'><sup></sup></span>",
-      "dnd-none": ""
-    },
-    "return-type": "json",
-    "exec-if": "which swaync-client",
-    "exec": "swaync-client -swb",
-    "on-click": "swaync-client -t -sw",
-    "on-click-right": "swaync-client -d -sw",
-    "escape": true
-  },
-}

modules/graphical/.config/waybar/style.css

@@ -1,80 +0,0 @@
-@import "./colorscheme.css";
-
-window#waybar {
-    font-family: Hack, FontAwesome;
-    font-weight: 500;
-    font-size: 14px;
-    /*background: rgba(11, 12, 13, 0.90);*/
-    background-color: rgba(0, 0, 0, 0);
-    border-bottom: 1px solid  rgba(0, 0, 2, 0.53);
-    color: @base04;
-}
-
-window#waybar.hidden {
-    opacity: 0.2;
-}
-
-#workspaces button {
-    font-size: 14px;
-    box-shadow: none;
-    text-shadow: none;
-    padding: 0px 3px 0px 3px;
-    color: @base04;
-}
-
-#workspaces button.focused {
-    color: #f85e84;
-    color: @base07;
-    /* margin: 2px 0px 2px 0px; */
-}
-
-#workspaces button:hover {
-    background: rgba(255, 255, 255, 0.00);
-    /* margin: 2px 0px 2px 0px; */
-}
-
-#clock, #backlight, #battery, #cpu, #memory, #network, #pulseaudio, #custom-spotify, #tray, #mode {
-    font-size: 14px;
-    margin: 0px 10px 0px 5px;
-}
-
-#pulseaudio {
-    /* border-top: 1px solid transparent; */
-    font-size: 12px;
-    margin-left: 15px;
-}
-
-#battery {
-    font-size: 12px;
-}
-
-#battery.critical {
-    color: @base07;
-}
-
-#battery.charging {
-    color: @base0B;
-}
-
-#battery.full {
-    margin: 0px 0px 0px 0px;
-}
-
-#network {
-    border-top: 1px solid transparent;
-    color: rgba(255,255,255,0.3);
-}
-
-#network.disconnected {
-    margin: 0px 0px 0px 0px;
-    color: rgba(75, 81, 98, 0);
-}
-
-#pulseaudio.muted {
-    margin: 0px 0px 0px 0px;
-    color: rgba(75, 81, 98, 0);
-}
-
-#custom-notification {
-  font-family: "NotoSansMono Nerd Font";
-}

modules/graphical/.config/xmodmap

@@ -1,8 +0,0 @@
-! Swap Caps_Lock and Control_L
-!
-remove Lock = Caps_Lock
-remove Control = Control_L
-!keysym Control_L = Caps_Lock
-keysym Caps_Lock = Control_L
-add Lock = Caps_Lock
-add Control = Control_L

modules/graphical/.config/xsettingsd/xsettingsd.conf

@@ -1,18 +0,0 @@
-Gtk/ButtonImages 1
-Gtk/CanChangeAccels 1
-Gtk/CursorThemeName "default"
-Gtk/CursorThemeSize 0
-Gtk/EnableEventSounds 0
-Gtk/EnableInputFeedbackSounds 0
-Gtk/FontName "Lato"
-Gtk/ThemeName "Matcha-dark-aliz"
-Gtk/IconThemeName "Papirus-Adapta-Nokto-Maia"
-Gtk/MenuBarAccel "F10"
-Gtk/MenuImages 1
-Gtk/ToolbarIconSize 3
-Gtk/ToolbarStyle "icons"
-Xft/Antialias 1
-Xft/DPI 102400
-Xft/Hinting 1
-Xft/HintStyle "hintslight"
-Xft/RGBA "rgb"

modules/graphical/.xinitrc

@@ -1,75 +0,0 @@
-#!/bin/sh
-#
-# ~/.xinitrc
-#
-# Executed by startx (run your window manager from here)
-
-userresources=$HOME/.Xresources
-usermodmap=$HOME/.config/xmodmap
-sysresources=/etc/X11/xinit/.Xresources
-sysmodmap=/etc/X11/xinit/.Xmodmap
-
-DEFAULT_SESSION='i3 --shmlog-size 0'
-
-xset -b
-
-if [ -d $HOME/.fonts ]; then
-    xset +fp $HOME/.fonts
-    xset fp rehash
-fi
-
-# merge in defaults and keymaps
-
-if [ -f $sysresources ]; then
-    xrdb -merge $sysresources
-fi
-
-if [ -f $sysmodmap ]; then
-    xmodmap $sysmodmap
-fi
-
-if [ -f "$userresources" ]; then
-    xrdb -merge "$userresources"
-fi
-
-if [ -f "$usermodmap" ]; then
-    xmodmap "$usermodmap"
-fi
-
-# start some nice programs
-
-if [ -d /etc/X11/xinit/xinitrc.d ] ; then
-    for f in /etc/X11/xinit/xinitrc.d/?*.sh ; do
-        [ -x "$f" ] && . "$f"
-    done
-    unset f
-fi
-
-get_session(){
-  local dbus_args=(--sh-syntax --exit-with-session)
-  case $1 in
-    awesome) dbus_args+=(awesome) ;;
-    bspwm) dbus_args+=(bspwm-session) ;;
-    budgie) dbus_args+=(budgie-desktop) ;;
-    cinnamon) dbus_args+=(cinnamon-session) ;;
-    deepin) dbus_args+=(startdde) ;;
-    enlightenment) dbus_args+=(enlightenment_start) ;;
-    fluxbox) dbus_args+=(startfluxbox) ;;
-    gnome) dbus_args+=(gnome-session) ;;
-    i3|i3wm) dbus_args+=(i3 --shmlog-size 0) ;;
-    jwm) dbus_args+=(jwm) ;;
-    kde) dbus_args+=(startkde) ;;
-    lxde) dbus_args+=(startlxde) ;;
-    lxqt) dbus_args+=(lxqt-session) ;;
-    mate) dbus_args+=(mate-session) ;;
-    xfce) dbus_args+=(xfce4-session) ;;
-    openbox) dbus_args+=(openbox-session) ;;
-    *) dbus_args+=($DEFAULT_SESSION) ;;
-  esac
-
-  echo "dbus-launch ${dbus_args[*]}"
-}
-
-exec $(get_session)
-xset r rate 660 25
-

modules/graphical/alacritty.nix

@@ -55,7 +55,7 @@
       style = "Italic";
     };
 
-    size = 12.0;
+    size = 16.0;
 
     offset = {
       x = 0;
@@ -69,16 +69,6 @@
   };
 
   key_bindings = [
-    {
-      key = "V";
-      mods = "Control|Super";
-      action = "Paste";
-    }
-    {
-      key = "C";
-      mods = "Control|Super";
-      action = "Copy";
-    }
     {
       key = "V";
       mods = "Control|Alt";

modules/graphical/default.nix

@@ -6,22 +6,36 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.graphical;
   yamlFormat = pkgs.formats.yaml {};
-  sessionVariables = {
+  recursiveMerge = attrList: let
-    WLR_RENDERER =
+    f = attrPath:
-      if psCfg.graphical.wayland.software-renderer.enable
+      zipAttrsWith (
-      then "pixman"
+        n: values:
-      else "gles2";
+          if tail values == []
-    # Fix KeepassXC rendering issue
+          then head values
-    # https://github.com/void-linux/void-packages/issues/23517
+          else if all isList values
-    QT_AUTO_SCREEN_SCALE_FACTOR = "0";
+          then unique (concatLists values)
-  };
+          else if all isAttrs values
+          then f (attrPath ++ [n]) values
+          else last values
+      );
+  in
+    f [] attrList;
 in {
-  imports = [
-    ./sway
-  ];
-
   options.pub-solar.graphical = {
+    enable = mkEnableOption "Life in color";
+    alacritty = {
+      settings = mkOption {
+        type = yamlFormat.type;
+        default = {};
+      };
+    };
+    autologin.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Feature flag enabling autologin after boot.";
+    };
     wayland.software-renderer.enable = mkOption {
       type = types.bool;
       default = false;
@@ -29,9 +43,8 @@ in {
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
     hardware.opengl.enable = true;
-
     environment = {
       systemPackages = with pkgs; [
         gtk-engine-murrine
@@ -42,20 +55,16 @@ in {
         papirus-maia-icon-theme
 
         glib
-        xdg-utils
       ];
-
       etc = {
         "xdg/PubSolar.conf".text = ''
           [Qt]
           style=GTK+
         '';
       };
-
-      variables = sessionVariables;
     };
 
-    services.getty.autologinUser = psCfg.user.name;
+    services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}");
 
     qt = {
       enable = true;
@@ -63,104 +72,88 @@ in {
       style = "gtk2";
     };
 
+    # Required for running Gnome apps outside the Gnome DE, see https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
+    programs.dconf.enable = true;
     services.udev.packages = with pkgs; [gnome3.gnome-settings-daemon];
     # Enable Sushi, a quick previewer for nautilus
     services.gnome.sushi.enable = true;
     # Enable GVfs, a userspace virtual filesystem
     services.gvfs.enable = true;
-    services.yubikey-agent.enable = true;
 
-    fonts = {
+    fonts.enableDefaultFonts = true;
-      packages = with pkgs; [
+    fonts.fonts = with pkgs; [
-        dejavu_fonts
+      fira-code
-        powerline-fonts
+      fira-code-symbols
-      ];
+      google-fonts
-      enableDefaultPackages = true;
+      lato
-      fontconfig.enable = true;
+      montserrat
-      fontconfig.defaultFonts = {
+      nerdfonts
-        monospace = ["DejaVu Sans Mono for Powerline"];
+      noto-fonts
-        sansSerif = ["DejaVu Sans"];
+      noto-fonts-cjk
-      };
+      open-sans
-    };
+      powerline-fonts
-
+      source-sans-pro
-    users.users."${psCfg.user.name}".packages = with pkgs; [
-      alacritty
-      firefox-wayland
-      flameshot
-      gnome.adwaita-icon-theme
-      gnome.eog
-      gnome.nautilus
-      gnome.seahorse
-      gnome.yelp
-      hicolor-icon-theme
-      keepassxc
-      qMasterPassword-wayland
-      libnotify
-      vlc
     ];
 
-    home-manager.users."${psCfg.user.name}" = {
+    home-manager = with pkgs;
-      home.file."xinitrc".source = ./.xinitrc;
+      setAttrByPath ["users" psCfg.user.name] {
-      xdg.configFile."alacritty/alacritty.yml".source = yamlFormat.generate "alacritty.yml" (import ./alacritty.nix);
+        home.packages = [
-      xdg.configFile."xmodmap".source = ./.config/xmodmap;
+          alacritty
-      xdg.configFile."user-dirs.dirs".source = ./.config/user-dirs.dirs;
+          foot
-      xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
+          ungoogled-chromium
-      xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
+          firefox-wayland
-      xdg.configFile."mako/config".source = ./.config/mako/config;
-      xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
-      xdg.configFile."swaync/config.json".source = ./.config/swaync/config.json;
-      xdg.configFile."swaync/style.css".source = ./.config/swaync/style.css;
-      xdg.configFile."waybar/config".source = ./.config/waybar/config;
-      xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
-      xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;
-      xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
 
-      # Required for running Gnome apps outside the Gnome DE, see
+          flameshot
-      # https://nixos.wiki/wiki/GNOME#Running_GNOME_programs_outside_of_GNOME
+          libnotify
-      dconf = {
+          gnome.adwaita-icon-theme
-        enable = true;
+          gnome.eog
-        settings = {
+          gnome.nautilus
-          "org/gnome/desktop/interface" = {
+          gnome.yelp
-            color-scheme = "prefer-dark";
+          hicolor-icon-theme
+
+          wine
+
+          toggle-kbd-layout
+
+          wcwd
+
+          vlc
+
+          gimp
+        ];
+
+        xdg.configFile."alacritty/alacritty.yml" = {
+          source = yamlFormat.generate "alacritty.yml" (recursiveMerge [(import ./alacritty.nix) cfg.alacritty.settings]);
+        };
+
+        gtk = {
+          enable = true;
+          font.name = "Lato";
+          iconTheme = {
+            package = pkgs.papirus-icon-theme;
+            name = "Papirus-Adapta-Nokto-Maia";
+          };
+          theme = {
+            package = pkgs.matcha-gtk-theme;
+            name = "Matcha-dark-aliz";
+          };
+
+          gtk3.extraConfig = {
+            gtk-xft-antialias = "1";
+            gtk-xft-hinting = "1";
+            gtk-xft-hintstyle = "hintfull";
+            gtk-xft-rgba = "rgb";
+            gtk-application-prefer-dark-theme = "true";
           };
         };
+
+        # Fix KeepassXC rendering issue
+        # https://github.com/void-linux/void-packages/issues/23517
+        systemd.user.sessionVariables.QT_AUTO_SCREEN_SCALE_FACTOR = "0";
+
+        xresources.extraConfig = builtins.readFile ./.Xdefaults;
+
+        systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
       };
-
-      gtk = {
-        enable = true;
-        font.name = "Lato";
-        iconTheme = {
-          package = pkgs.papirus-icon-theme;
-          name = "Papirus-Adapta-Nokto-Maia";
-        };
-        theme = {
-          package = pkgs.matcha-gtk-theme;
-          name = "Matcha-dark-aliz";
-        };
-
-        gtk3.extraConfig = {
-          gtk-xft-antialias = "1";
-          gtk-xft-hinting = "1";
-          gtk-xft-hintstyle = "hintfull";
-          gtk-xft-rgba = "rgb";
-          gtk-application-prefer-dark-theme = "true";
-        };
-
-        gtk4.extraConfig = {
-          gtk-xft-antialias = "1";
-          gtk-xft-hinting = "1";
-          gtk-xft-hintstyle = "hintfull";
-          gtk-xft-rgba = "rgb";
-          gtk-application-prefer-dark-theme = "true";
-        };
-      };
-
-      xresources.extraConfig = builtins.readFile ./.Xdefaults;
-
-      systemd.user.services.network-manager-applet = import ./network-manager-applet.service.nix pkgs;
-
-      home.sessionVariables = sessionVariables;
-      systemd.user.sessionVariables = sessionVariables;
-    };
   };
 }

modules/graphical/sway/config/wayvnc/config.nix

@@ -1,11 +0,0 @@
-{
-  psCfg,
-  pkgs,
-}: "
-address=0.0.0.0
-enable_auth=true
-username=${psCfg.user.name}
-password=testtest
-private_key_file=/run/agenix/vnc-key.pem
-certificate_file=/run/agenix/vnc-cert.pem
-"

modules/graphical/sway/default.nix

@@ -1,101 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-in {
-  options.pub-solar.graphical = {
-    v4l2loopback.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = "WebCam streaming tool";
-    };
-  };
-
-  config = {
-    boot = mkIf psCfg.graphical.v4l2loopback.enable {
-      extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
-      kernelModules = ["v4l2loopback"];
-      extraModprobeConfig = ''
-        options v4l2loopback exclusive_caps=1 devices=3
-      '';
-    };
-
-    environment.systemPackages = with pkgs;
-      mkIf psCfg.graphical.v4l2loopback.enable [
-        linuxPackages.v4l2loopback
-      ];
-
-    programs.sway.enable = true;
-
-    xdg.portal = {
-      enable = true;
-      wlr = {
-        enable = true;
-        settings = {
-          screencast = {
-            max_fps = 30;
-            chooser_type = "simple";
-            chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
-          };
-        };
-      };
-      extraPortals = with pkgs; [xdg-desktop-portal-gtk];
-    };
-
-    services.pipewire.enable = true;
-
-    users.users."${psCfg.user.name}".packages = with pkgs; [
-      sway
-      grim
-      kanshi
-      slurp
-      swaybg
-      swayidle
-      swaynotificationcenter
-      xwayland
-
-      libappindicator-gtk3
-
-      wl-clipboard
-      wf-recorder
-      brightnessctl
-      gammastep
-      geoclue2
-      xsettingsd
-      ydotool
-
-      sway-launcher
-      record-screen
-      import-gtk-settings
-      # Unused on teutat3s hosts, see custom-keybindings.conf
-      #toggle-kbd-layout
-      s
-      wcwd
-    ];
-
-    home-manager.users."${psCfg.user.name}" = {
-      programs.waybar.enable = true;
-      #programs.waybar.systemd.enable = true;
-
-      systemd.user.services.swaynotificationcenter = import ./swaynotificationcenter.service.nix pkgs;
-      systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
-      systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
-      systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
-      systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
-      systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
-
-      xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
-      xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
-      xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
-      xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
-      xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
-      xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
-      xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
-      xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
-    };
-  };
-}

modules/graphical/sway/swayidle.service.nix

@@ -1,26 +0,0 @@
-{
-  pkgs,
-  psCfg,
-  ...
-}: {
-  Unit = {
-    Description = "Idle manager for Wayland";
-    Documentation = ["man:swayidle(1)"];
-    BindsTo = ["graphical-session.target"];
-    Wants = ["graphical-session-pre.target"];
-    After = ["graphical-session-pre.target"];
-  };
-  Service = {
-    Type = "simple";
-    ExecStart = ''
-      ${pkgs.swayidle}/bin/swayidle -w \
-      timeout 300 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
-      timeout 600 '${pkgs.sway}/bin/swaymsg "output * dpms off"' \
-        resume '${pkgs.sway}/bin/swaymsg "output * dpms on"' \
-      before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg'
-    '';
-  };
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/graphical/sway/swaynotificationcenter.service.nix

@@ -1,21 +0,0 @@
-pkgs: {
-  Unit = {
-    Description = "Swaync notification daemon";
-    Documentation = "https://github.com/ErikReider/SwayNotificationCenter";
-    BindsTo = ["sway-session.target"];
-    After = ["sway-session.target"];
-    Requisite = ["graphical-session.target"];
-    # ConditionEnvironment requires systemd v247 to work correctly
-    ConditionEnvironment = ["WAYLAND_DISPLAY"];
-  };
-  Service = {
-    Type = "dbus";
-    BusName = "org.freedesktop.Notifications";
-    ExecStart = "${pkgs.swaynotificationcenter}/bin/swaync";
-    ExecReload = "${pkgs.swaynotificationcenter}/bin/swaync-client --reload-config ; ${pkgs.swaynotificationcenter}/bin/swaync-client --reload-css";
-    Restart = "on-failure";
-  };
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/invoiceplane/default.nix

@@ -1,377 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.services.invoiceplane;
-  eachSite = cfg.sites;
-  user = "invoiceplane";
-  webserver = config.services.${cfg.webserver};
-
-  invoiceplane-config = hostName: cfg:
-    pkgs.writeText "ipconfig.php" ''
-      IP_URL=http://${hostName}
-      ENABLE_DEBUG=false
-      DISABLE_SETUP=false
-      REMOVE_INDEXPHP=false
-      DB_HOSTNAME=${cfg.database.host}
-      DB_USERNAME=${cfg.database.user}
-      # NOTE: file_get_contents adds newline at the end of returned string
-      DB_PASSWORD=${
-        if cfg.database.passwordFile == null
-        then ""
-        else "trim(file_get_contents('${cfg.database.passwordFile}'),\"\\r\\n\")"
-      }
-      DB_DATABASE=${cfg.database.name}
-      DB_PORT=${toString cfg.database.port}
-      SESS_EXPIRATION=864000
-      ENABLE_INVOICE_DELETION=false
-      DISABLE_READ_ONLY=false
-      ENCRYPTION_KEY=
-      ENCRYPTION_CIPHER=AES-256
-      SETUP_COMPLETED=false
-      REMOVE_INDEXPHP=true
-    '';
-
-  extraConfig = hostName: cfg:
-    pkgs.writeText "extraConfig.php" ''
-      ${toString cfg.extraConfig}
-    '';
-
-  pkg = hostName: cfg:
-    pkgs.stdenv.mkDerivation rec {
-      pname = "invoiceplane-${hostName}";
-      version = src.version;
-      src = pkgs.invoiceplane;
-
-      postPhase = ''
-        # Patch index.php file to load additional config file
-        substituteInPlace index.php \
-          --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = Dotenv\Dotenv::createImmutable(__DIR__, 'extraConfig.php'); \$dotenv->load();";
-      '';
-
-      installPhase = ''
-        mkdir -p $out
-        cp -r * $out/
-
-        # symlink uploads and log directories
-        rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
-        ln -sf ${cfg.stateDir}/uploads $out/
-        ln -sf ${cfg.stateDir}/logs $out/application/
-        ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
-
-        # symlink the InvoicePlane config
-        ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
-
-        # symlink the extraConfig file
-        ln -s ${extraConfig hostName cfg} $out/extraConfig.php
-
-        # symlink additional templates
-        ${concatMapStringsSep "\n" (template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/") cfg.invoiceTemplates}
-      '';
-    };
-
-  siteOpts = {
-    lib,
-    name,
-    ...
-  }: {
-    options = {
-      enable = mkEnableOption (lib.mdDoc "InvoicePlane web application");
-
-      stateDir = mkOption {
-        type = types.path;
-        default = "/var/lib/invoiceplane/${name}";
-        description = lib.mdDoc ''
-          This directory is used for uploads of attachments and cache.
-          The directory passed here is automatically created and permissions
-          adjusted as required.
-        '';
-      };
-
-      database = {
-        host = mkOption {
-          type = types.str;
-          default = "localhost";
-          description = lib.mdDoc "Database host address.";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 3306;
-          description = lib.mdDoc "Database host port.";
-        };
-
-        name = mkOption {
-          type = types.str;
-          default = "invoiceplane";
-          description = lib.mdDoc "Database name.";
-        };
-
-        user = mkOption {
-          type = types.str;
-          default = "invoiceplane";
-          description = lib.mdDoc "Database user.";
-        };
-
-        passwordFile = mkOption {
-          type = types.nullOr types.path;
-          default = null;
-          example = "/run/keys/invoiceplane-dbpassword";
-          description = lib.mdDoc ''
-            A file containing the password corresponding to
-            {option}`database.user`.
-          '';
-        };
-
-        createLocally = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc "Create the database and database user locally.";
-        };
-      };
-
-      invoiceTemplates = mkOption {
-        type = types.listOf types.path;
-        default = [];
-        description = lib.mdDoc ''
-          List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
-
-          ::: {.note}
-          These templates need to be packaged before use, see example.
-          :::
-        '';
-        example = literalExpression ''
-          let
-            # Let's package an example template
-            template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
-              name = "vtdirektmarketing";
-              # Download the template from a public repository
-              src = pkgs.fetchgit {
-                url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
-                sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
-              };
-              sourceRoot = ".";
-              # Installing simply means copying template php file to the output directory
-              installPhase = ""
-                mkdir -p $out
-                cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
-              "";
-            };
-          # And then pass this package to the template list like this:
-          in [ template-vtdirektmarketing ]
-        '';
-      };
-
-      poolConfig = mkOption {
-        type = with types; attrsOf (oneOf [str int bool]);
-        default = {
-          "pm" = "dynamic";
-          "pm.max_children" = 32;
-          "pm.start_servers" = 2;
-          "pm.min_spare_servers" = 2;
-          "pm.max_spare_servers" = 4;
-          "pm.max_requests" = 500;
-        };
-        description = lib.mdDoc ''
-          Options for the InvoicePlane PHP pool. See the documentation on `php-fpm.conf`
-          for details on configuration directives.
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.nullOr types.lines;
-        default = null;
-        example = ''
-          SETUP_COMPLETED=true
-          DISABLE_SETUP=true
-          IP_URL=https://invoice.example.com
-        '';
-        description = lib.mdDoc ''
-          InvoicePlane configuration. Refer to
-          <https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example>
-          for details on supported values.
-        '';
-      };
-
-      cron = {
-        enable = mkOption {
-          type = types.bool;
-          default = false;
-          description = lib.mdDoc ''
-            Enable cron service which periodically runs Invoiceplane tasks.
-            Requires key taken from the administration page. Refer to
-            <https://wiki.invoiceplane.com/en/1.0/modules/recurring-invoices>
-            on how to configure it.
-          '';
-        };
-
-        key = mkOption {
-          type = types.str;
-          description = lib.mdDoc "Cron key taken from the administration page.";
-        };
-      };
-    };
-  };
-in {
-  disabledModules = [
-    "services/web-apps/invoiceplane.nix"
-  ];
-
-  # interface
-  options = {
-    services.invoiceplane = mkOption {
-      type = types.submodule {
-        options.sites = mkOption {
-          type = types.attrsOf (types.submodule siteOpts);
-          default = {};
-          description = lib.mdDoc "Specification of one or more WordPress sites to serve";
-        };
-
-        options.webserver = mkOption {
-          type = types.enum ["caddy"];
-          default = "caddy";
-          description = lib.mdDoc ''
-            Which webserver to use for virtual host management. Currently only
-            caddy is supported.
-          '';
-        };
-      };
-      default = {};
-      description = lib.mdDoc "InvoicePlane configuration.";
-    };
-  };
-
-  # implementation
-  config = mkIf (eachSite != {}) (mkMerge [
-    {
-      assertions = flatten (mapAttrsToList (hostName: cfg: [
-          {
-            assertion = cfg.database.createLocally -> cfg.database.user == user;
-            message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
-          }
-          {
-            assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
-            message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
-          }
-          {
-            assertion = cfg.cron.enable -> cfg.cron.key != null;
-            message = ''services.invoiceplane.sites."${hostName}".cron.key must be set in order to use cron service.'';
-          }
-        ])
-        eachSite);
-
-      services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
-        enable = true;
-        package = mkDefault pkgs.mariadb;
-        ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
-        ensureUsers =
-          mapAttrsToList (
-            hostName: cfg: {
-              name = cfg.database.user;
-              ensurePermissions = {"${cfg.database.name}.*" = "ALL PRIVILEGES";};
-            }
-          )
-          eachSite;
-      };
-
-      services.phpfpm = {
-        phpPackage = pkgs.php81;
-        pools =
-          mapAttrs' (hostName: cfg: (
-            nameValuePair "invoiceplane-${hostName}" {
-              inherit user;
-              group = webserver.group;
-              settings =
-                {
-                  "listen.owner" = webserver.user;
-                  "listen.group" = webserver.group;
-                }
-                // cfg.poolConfig;
-            }
-          ))
-          eachSite;
-      };
-    }
-
-    {
-      systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
-          "d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
-          "f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
-          "d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
-        ])
-        eachSite);
-
-      systemd.services.invoiceplane-config = {
-        serviceConfig.Type = "oneshot";
-        script = concatStrings (mapAttrsToList (hostName: cfg: ''
-            mkdir -p ${cfg.stateDir}/logs \
-                      ${cfg.stateDir}/uploads
-            if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
-              cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
-            fi
-          '')
-          eachSite);
-        wantedBy = ["multi-user.target"];
-      };
-
-      users.users.${user} = {
-        group = webserver.group;
-        isSystemUser = true;
-      };
-    }
-    {
-      # Cron service implementation
-
-      systemd.timers =
-        mapAttrs' (hostName: cfg: (
-          nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
-            wantedBy = ["timers.target"];
-            timerConfig = {
-              OnBootSec = "5m";
-              OnUnitActiveSec = "5m";
-              Unit = "invoiceplane-cron-${hostName}.service";
-            };
-          })
-        ))
-        eachSite;
-
-      systemd.services =
-        mapAttrs' (hostName: cfg: (
-          nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
-            serviceConfig = {
-              Type = "oneshot";
-              User = user;
-              ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
-            };
-          })
-        ))
-        eachSite;
-    }
-
-    (mkIf (cfg.webserver == "caddy") {
-      services.caddy = {
-        enable = true;
-        virtualHosts =
-          mapAttrs' (hostName: cfg: (
-            nameValuePair "http://${hostName}" {
-              extraConfig = ''
-                root * ${pkg hostName cfg}
-                file_server
-                php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
-              '';
-            }
-          ))
-          eachSite;
-      };
-    })
-  ]);
-}

modules/nextcloud/default.nix

@@ -6,8 +6,16 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.nextcloud;
 in {
-  home-manager.users."${psCfg.user.name}" = {
+  options.pub-solar.nextcloud = {
-    systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
+    enable = mkEnableOption "Life in sync";
+  };
+
+  config = mkIf cfg.enable {
+    home-manager = with pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
+      };
   };
 }

modules/nix-path.nix

@@ -0,0 +1,11 @@
+{
+  channel,
+  inputs,
+  ...
+}: {
+  nix.nixPath = [
+    "nixpkgs=${channel.input}"
+    "nixos-config=${../lib/compat/nixos}"
+    "home-manager=${inputs.home}"
+  ];
+}

modules/office/default.nix

@@ -6,15 +6,27 @@
 }:
 with lib; let
   psCfg = config.pub-solar;
+  cfg = config.pub-solar.office;
 in {
-  programs.evince.enable = true;
+  options.pub-solar.office = {
+    enable = mkEnableOption "Install office programs, also enables printing server";
+  };
 
-  users.users."${psCfg.user.name}".packages = with pkgs; [
+  config = mkIf cfg.enable {
-    libreoffice-fresh
+    pub-solar.printing.enable = true;
-    gnome.simple-scan
+
-    # Tools like pdfunite
+    # Gnome PDF viewer
-    poppler_utils
+    programs.evince.enable = true;
-    # tool for annotating PDFs
+    home-manager = with pkgs;
-    xournalpp
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
-  ];
+        home.packages = [
+          libreoffice-fresh
+          gnome.simple-scan
+          # Tools like pdfunite
+          poppler_utils
+          # tool for annotating PDFs
+          xournalpp
+        ];
+      };
+  };
 }

modules/paranoia/default.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.paranoia;
+in {
+  options.pub-solar.paranoia = {
+    enable = mkOption {
+      description = ''
+        Only offer hibernation instead of screen locking and sleeping. This only makes sense
+        if your hard drive is encrypted, and ensures that the contents of your drive are
+        encrypted if you are not actively using the device.
+      '';
+      default = false;
+      type = types.bool;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    pub-solar.core.hibernation.enable = true;
+    services.logind.lidSwitch = "hibernate";
+
+    # The options below are directly taken from or inspired by
+    # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
+
+    # Don't set this if you need sftp
+    services.openssh.allowSFTP = false;
+    services.openssh.openFirewall = false; # Lock yourself out
+
+    # Limit the use of sudo to the group wheel
+    security.sudo.execWheelOnly = true;
+
+    # Remove the complete default environment of packages like
+    # nano, perl and rsync
+    environment.defaultPackages = lib.mkForce [];
+
+    # fileSystems."/".options = [ "noexec" ];
+
+    services.openssh = {
+      kbdInteractiveAuthentication = false;
+      extraConfig = ''
+        AllowTcpForwarding yes
+        X11Forwarding no
+        AllowAgentForwarding no
+        AllowStreamLocalForwarding no
+        AuthenticationMethods publickey
+      '';
+    };
+  };
+}

modules/printing/default.nix

@@ -1,40 +1,33 @@
 {
-  flake,
+  lib,
   config,
   pkgs,
-  lib,
   ...
-}: {
+}:
-  services.avahi.enable = true;
+with lib; let
-  services.avahi.ipv6 = true;
+  psCfg = config.pub-solar;
-  services.avahi.nssmdns = true;
+  cfg = config.pub-solar.printing;
-  services.avahi.publish.enable = true;
+in {
-  services.avahi.publish.userServices = true;
+  options.pub-solar.printing = {
+    enable = mkEnableOption "CUPSSSss";
+  };
 
-  services.printing.enable = true;
+  config = mkIf cfg.enable {
-  services.printing.browsing = true;
+    services.avahi.enable = true;
-  services.printing.listenAddresses = ["localhost:631"];
+    services.avahi.nssmdns = true;
-  services.printing.defaultShared = lib.mkDefault false;
+    services.avahi.publish.enable = true;
-
+    services.avahi.publish.userServices = true;
-  services.printing.drivers =
+    services.printing.enable = true;
-    [
+    services.printing.browsing = true;
+    services.printing.listenAddresses = ["localhost:631"];
+    services.printing.allowFrom = ["all"];
+    services.printing.defaultShared = false;
+    services.printing.drivers = [
       pkgs.gutenprint
-    ]
+    ];
-    ++ (
+    hardware.sane = {
-      if (pkgs.system == "x86_64-linux")
+      enable = true;
-      then [pkgs.cups-brother-hl3140cw]
+      brscan4.enable = true;
-      else []
+    };
-    );
-
-  networking.hosts = flake.self.lib.addLocalHostname ["cups.local"];
-
-  services.caddy = {
-    enable = true;
-    extraConfig = ''
-      cups.local {
-        request_header Host localhost:631
-        reverse_proxy unix//run/cups/cups.sock
-      }
-    '';
   };
 }

modules/social/default.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.social;
+in {
+  options.pub-solar.social = {
+    enable = mkEnableOption "Life with others";
+  };
+
+  config = mkIf cfg.enable {
+    home-manager = with pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        home.packages = [
+          signal-desktop
+          tdesktop
+          element-desktop
+          irssi
+        ];
+      };
+  };
+}

modules/sway/config/config.d/custom-keybindings.conf

@@ -2,7 +2,7 @@
 bindsym $mod+z exec --no-startup-id morc_menu
 
 # switch keyboard input language
-#bindsym $mod+tab exec toggle-kbd-layout
+bindsym $mod+tab exec toggle-kbd-layout
 
 ################################################################################################
 ## sound-section -  ##
@@ -21,10 +21,6 @@ bindsym $mod+F2 exec firefox
 bindsym $mod+F4 exec nautilus -w
 bindsym $mod+Shift+F4 exec signal-desktop --use-tray-icon
 
-# Notifications with swaynotificationcenter
-# Toggle control center
-bindsym $mod+Shift+n exec swaync-client -t -sw
-
 bindsym $mod+Shift+m exec qMasterPassword
 
 # Screenshots and screen recordings
@@ -37,11 +33,3 @@ bindsym $mod+Ctrl+r exec record-screen
 # Launcher
 set $menu exec alacritty --class launcher -e env TERMINAL_COMMAND="alacritty -e" sway-launcher
 bindsym $mod+Space exec $menu
-
-set $mode_vncclient In VNCClient mode. Press $mod+Num_Lock or $mod+Shift+Escape to return.
-bindsym $mod+Num_Lock mode "$mode_vncclient"
-bindsym $mod+Shift+Escape mode "$mode_vncclient"
-mode "$mode_vncclient" {
-    bindsym $mod+Num_Lock mode "default"
-    bindsym $mod+Shift+Escape mode "default"
-}

modules/sway/config/config.d/mode_system.conf.nix

@@ -7,19 +7,22 @@
   # Set shut down, restart and locking features
 ''
 + (
-  if psCfg.core.hibernation.enable
+  if psCfg.core.hibernation.enable && !psCfg.paranoia.enable
   then ''
     set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
   ''
+  else if psCfg.paranoia.enable
+  then ''
+    set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
+  ''
   else ''
     set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
   ''
 )
 + ''
   bindsym $mod+0 mode "$mode_system"
-
   mode "$mode_system" {
-    bindsym e exec swaymsg exit, mode "default"
+      bindsym e exec swaymsg exit, mode "default"
 ''
 + (
   if psCfg.core.hibernation.enable
@@ -28,9 +31,15 @@
   ''
   else ""
 )
++ (
+  if !psCfg.paranoia.enable
+  then ''
+    bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
+    bindsym s exec systemctl suspend, mode "default"
+  ''
+  else ""
+)
 + ''
-      bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
-      bindsym s exec systemctl suspend, mode "default"
       bindsym r exec systemctl reboot, mode "default"
       bindsym Shift+s exec systemctl poweroff, mode "default"
 

modules/sway/config/config.nix

@@ -19,7 +19,7 @@
   set $up i
   set $right l
   # Your preferred terminal emulator
-  set $term ${pkgs.alacritty}/bin/alacritty
+  set $term ${config.pub-solar.sway.terminal}
   # Your preferred application launcher
   # Note: pass the final command to swaymsg so that the resulting window can be opened
   # on the original workspace that the command was run on.

modules/sway/default.nix

@@ -0,0 +1,110 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  options.pub-solar.sway = {
+    enable = mkEnableOption "Life in boxes";
+
+    terminal = mkOption {
+      type = types.nullOr types.str;
+      default = "alacritty";
+      description = "Choose sway's default terminal";
+    };
+
+    v4l2loopback.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = "WebCam streaming tool";
+    };
+  };
+
+  config = mkIf psCfg.sway.enable (mkMerge [
+    (mkIf (psCfg.sway.v4l2loopback.enable) {
+      boot.extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
+      boot.kernelModules = ["v4l2loopback"];
+      boot.extraModprobeConfig = ''
+        options v4l2loopback exclusive_caps=1 devices=3
+      '';
+    })
+
+    {
+      environment.systemPackages = with pkgs; [
+        linuxPackages.v4l2loopback
+      ];
+
+      programs.sway.enable = true;
+
+      xdg.portal = {
+        enable = true;
+        wlr = {
+          enable = true;
+          settings = {
+            screencast = {
+              max_fps = 30;
+              chooser_type = "simple";
+              chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
+            };
+          };
+        };
+        extraPortals = with pkgs; [xdg-desktop-portal-gtk];
+      };
+
+      services.pipewire.enable = true;
+
+      home-manager = with pkgs;
+        pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+          home.packages = with pkgs; [
+            sway
+            grim
+            kanshi
+            mako
+            slurp
+            swayidle
+            swaylock
+            swaybg
+            xwayland
+
+            libappindicator-gtk3
+
+            wl-clipboard
+            wf-recorder
+            brightnessctl
+            gammastep
+            geoclue2
+            xsettingsd
+            ydotool
+
+            sway-launcher
+            record-screen
+            import-gtk-settings
+            s
+            wcwd
+          ];
+
+          programs.waybar.enable = true;
+          #programs.waybar.systemd.enable = true;
+
+          systemd.user.services.mako = import ./mako.service.nix {inherit pkgs psCfg;};
+          systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
+          systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
+          systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
+          systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
+          systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
+
+          xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
+          xdg.configFile."sway/config.d/colorscheme.conf".source = ./config/config.d/colorscheme.conf;
+          xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
+          xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
+          xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
+          xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
+          xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
+          xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
+        };
+    }
+  ]);
+}

modules/sway/swayidle.service.nix

@@ -0,0 +1,35 @@
+{
+  pkgs,
+  psCfg,
+  ...
+}: {
+  Unit = {
+    Description = "Idle manager for Wayland";
+    Documentation = ["man:swayidle(1)"];
+    BindsTo = ["graphical-session.target"];
+    Wants = ["graphical-session-pre.target"];
+    After = ["graphical-session-pre.target"];
+  };
+  Service = {
+    Type = "simple";
+    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
+    ExecStart =
+      ''        swayidle -w \
+                after-resume 'swaymsg "output * dpms on"' \
+                before-sleep 'swaylock-bg' ''
+      + (
+        if psCfg.paranoia.enable
+        then ''          \
+                timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
+                timeout 150 'systemctl hibernate'
+        ''
+        else ''          \
+                timeout 600 'swaylock-bg' \
+                timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
+        ''
+      );
+  };
+  Install = {
+    WantedBy = ["sway-session.target"];
+  };
+}

modules/terminal-life/.config/git/config.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-  user = config.pub-solar.user;
-  xdg = config.home-manager.users."${user.name}".xdg;
-in ''  [user]
-    ${
-    if user.email != null
-    then "email = ${user.email}"
-    else ""
-  }
-    ${
-    if user.fullName != null
-    then "name = ${user.fullName}"
-    else ""
-  }
-    ${
-    if user.gpgKeyId != null
-    then "signingkey = ${user.gpgKeyId}"
-    else ""
-  }
-  [core]
-    editor = /etc/profiles/per-user/${config.pub-solar.user.name}/bin/nvim
-    excludesFile = /home/${config.pub-solar.user.name}/.config/git/global_gitignore
-  [alias]
-    pol = pull
-    ack = -c color.grep.linenumber=\"bold yellow\"\n    -c color.grep.filename=\"bold green\"\n    -c color.grep.match=\"reverse yellow\"\n    grep --break --heading --line-number
-  # define command which will be used when "nvim"is set as a merge tool
-
-  [mergetool]
-    prompt = false
-  [merge]
-    tool = nvim
-  [mergetool "nvim"]
-    cmd = /etc/profiles/per-user/${config.pub-solar.user.name}/bin/nvim -f -c \"Gdiffsplit!\" \"$MERGED\"
-
-  [commit]
-    gpgsign = true
-    template = ${xdg.configHome}/git/gitmessage
-  [tag]
-    gpgsign = true
-  [init]
-    defaultBranch = main
-  [pull]
-    rebase = false''

modules/terminal-life/.config/git/gitmessage.nix

@@ -1,32 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-  user = config.pub-solar.user;
-  xdg = config.home-manager.users."${user.name}".xdg;
-in ''
-# What happened?
-#
-# fix feat build chore ci docs style refactor perf test
-#
-# type!(optional scope): <summary> --------------#
-#
-
-
-# ^\n
-# What exactly was done and why? --------------------------------------#
-#
-
-
-# ^\n
-#
-# Any issue numbers or links?
-#
-# Ref: #123
-
-
-# ^\n
-#
-# Co-authored-by: Example Name <email@example.com>
-''

modules/terminal-life/.config/git/global_gitignore.nix

@@ -1,6 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-in ''tags''

modules/terminal-life/.local/share/scripts/base16.sh

@@ -1,126 +0,0 @@
-#!/bin/sh
-# base16-shell (https://github.com/chriskempson/base16-shell)
-# Base16 Shell template by Chris Kempson (http://chriskempson.com)
-# Burn scheme by Benjamin Bädorf
-
-color00="1a/18/1a"          # Base 00 - Black
-color01="f8/5e/84"          # Base 08 - Red
-color02="9e/cd/6f"          # Base 0B - Green
-color03="e5/c4/63"          # Base 0A - Yellow
-color04="7a/cc/d7"          # Base 0D - Blue
-color05="ab/9d/f2"          # Base 0E - Magenta
-color06="ef/90/62"          # Base 0C - Cyan
-color07="e3/e1/e4"          # Base 05 - White
-color08="94/94/94"          # Base 03 - Bright Black
-color09=$color01            # Base 08 - Bright Red
-color10=$color02            # Base 0B - Bright Green
-color11=$color03            # Base 0A - Bright Yellow
-color12=$color04            # Base 0D - Bright Blue
-color13=$color05            # Base 0E - Bright Magenta
-color14=$color06            # Base 0C - Bright Cyan
-color15="ff/5f/5f"          # Base 07 - Bright White
-color16="df/59/23"          # Base 09
-color17="d7/00/00"          # Base 0F
-color18="2d/2a/2e"          # Base 01
-color19="30/30/30"          # Base 02
-color20="d3/d1/d4"          # Base 04
-color21="30/30/30"          # Base 06
-color_foreground="e3/e1/e4" # Base 05
-color_background="1a/18/1a" # Base 00
-
-if [ -n "$TMUX" ]; then
-  # Tell tmux to pass the escape sequences through
-  # (Source: http://permalink.gmane.org/gmane.comp.terminal-emulators.tmux.user/1324)
-  put_template() { printf '\033Ptmux;\033\033]4;%d;rgb:%s\033\033\\\033\\' $@; }
-  put_template_var() { printf '\033Ptmux;\033\033]%d;rgb:%s\033\033\\\033\\' $@; }
-  put_template_custom() { printf '\033Ptmux;\033\033]%s%s\033\033\\\033\\' $@; }
-elif [ "${TERM%%[-.]*}" = "screen" ]; then
-  # GNU screen (screen, screen-256color, screen-256color-bce)
-  put_template() { printf '\033P\033]4;%d;rgb:%s\007\033\\' $@; }
-  put_template_var() { printf '\033P\033]%d;rgb:%s\007\033\\' $@; }
-  put_template_custom() { printf '\033P\033]%s%s\007\033\\' $@; }
-elif [ "${TERM%%-*}" = "linux" ]; then
-  put_template() { [ $1 -lt 16 ] && printf "\e]P%x%s" $1 $(echo $2 | sed 's/\///g'); }
-  put_template_var() { true; }
-  put_template_custom() { true; }
-else
-  put_template() { printf '\033]4;%d;rgb:%s\033\\' $@; }
-  put_template_var() { printf '\033]%d;rgb:%s\033\\' $@; }
-  put_template_custom() { printf '\033]%s%s\033\\' $@; }
-fi
-
-# 16 color space
-put_template 0 $color00
-put_template 1 $color01
-put_template 2 $color02
-put_template 3 $color03
-put_template 4 $color04
-put_template 5 $color05
-put_template 6 $color06
-put_template 7 $color07
-put_template 8 $color08
-put_template 9 $color09
-put_template 10 $color10
-put_template 11 $color11
-put_template 12 $color12
-put_template 13 $color13
-put_template 14 $color14
-put_template 15 $color15
-
-# 256 color space
-put_template 16 $color16
-put_template 17 $color17
-put_template 18 $color18
-put_template 19 $color19
-put_template 20 $color20
-put_template 21 $color21
-
-# foreground / background / cursor color
-if [ -n "$ITERM_SESSION_ID" ]; then
-  # iTerm2 proprietary escape codes
-  put_template_custom Pg e3e1e4 # foreground
-  put_template_custom Ph 1a181a # background
-  put_template_custom Pi e3e1e4 # bold color
-  put_template_custom Pj 303030 # selection color
-  put_template_custom Pk e3e1e4 # selected text color
-  put_template_custom Pl e3e1e4 # cursor
-  put_template_custom Pm 1a181a # cursor text
-else
-  put_template_var 10 $color_foreground
-  if [ "$BASE16_SHELL_SET_BACKGROUND" != false ]; then
-    put_template_var 11 $color_background
-    if [ "${TERM%%-*}" = "rxvt" ]; then
-      put_template_var 708 $color_background # internal border (rxvt)
-    fi
-  fi
-  put_template_custom 12 ";7" # cursor (reverse video)
-fi
-
-# clean up
-unset -f put_template
-unset -f put_template_var
-unset -f put_template_custom
-unset color00
-unset color01
-unset color02
-unset color03
-unset color04
-unset color05
-unset color06
-unset color07
-unset color08
-unset color09
-unset color10
-unset color11
-unset color12
-unset color13
-unset color14
-unset color15
-unset color16
-unset color17
-unset color18
-unset color19
-unset color20
-unset color21
-unset color_foreground
-unset color_background

modules/terminal-life/bash/default.nix

@@ -1,7 +1,7 @@
 {
   config,
-  flake,
   pkgs,
+  self,
   ...
 }: let
   psCfg = config.pub-solar;
@@ -18,13 +18,11 @@ in {
 
   # Run when initializing an interactive shell
   initExtra = ''
-    # Use fzf's CTRL-R history widget
-    source ${pkgs.fzf}/share/fzf/key-bindings.bash
     # Show current directory at the top in Alacritty
     PROMPT_COMMAND='echo -e -n "\e]2;$(basename "$PWD" | sed "s/${psCfg.user.name}/~/")\e\\"'
 
     # If a command is not found, show me where it is
-    source ${pkgs.nix-index}/etc/profile.d/command-not-found.bash
+    source ${pkgs.nix-index}/etc/profile.d/command-not-found.sh
 
     # Helps you navigate directories faster
     # https://github.com/gsamokovarov/jump
@@ -100,14 +98,14 @@ in {
     vi = "nvim";
     vim = "nvim";
     mutt = "neomutt";
-    ls = "eza";
+    ls = "exa";
-    la = "eza --group-directories-first -lag";
+    la = "exa --group-directories-first -lag";
     wget = "wget --hsts-file=$XDG_CACHE_HOME/wget-hsts";
     irssi = "irssi --config=$XDG_CONFIG_HOME/irssi/config --home=$XDG_DATA_HOME/irssi";
     drone = "DRONE_TOKEN=$(secret-tool lookup drone token) drone";
     no = "manix \"\" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | fzf --preview=\"manix '{}'\" | xargs manix";
     # fix nixos-option
-    nixos-option = "nixos-option -I nixpkgs=${flake.self}/lib/compat";
+    nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
     nnn = "nnn -d -e -H -r";
   };

modules/terminal-life/default.nix

@@ -2,7 +2,7 @@
   lib,
   config,
   pkgs,
-  flake,
+  self,
   ...
 }:
 with lib; let
@@ -10,104 +10,69 @@ with lib; let
   cfg = config.pub-solar.terminal-life;
 in {
   options.pub-solar.terminal-life = {
-    full = mkOption {
+    enable = mkEnableOption "Life in black and white";
+
+    lite = mkOption {
       description = ''
-        Enable a full version, which includes more nvim plugins and lsps.
+        Enable a lite edition of terminal-life with less modules and a reduced package set.
       '';
       default = false;
       type = types.bool;
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
     programs.command-not-found.enable = false;
-    programs.nix-index.enable = true;
-    # We do this manually in modules/terminal-life/bash/default.nix
-    # until https://github.com/nix-community/nix-index/pull/227 is merged
-    programs.nix-index.enableBashIntegration = false;
 
-    users.users."${psCfg.user.name}".packages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-      ack
-      asciinema
-      bat
-      blesh
-      eza
-      fd
-      jump
-      (nnn.overrideAttrs (o: {
-        patches =
-          (o.patches or [])
-          ++ [
-            ./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
-          ];
-      }))
-      powerline
       screen
-      silver-searcher
-      watson
     ];
 
-    home-manager.users."${psCfg.user.name}" = {
+    # Starship is a fast and featureful shell prompt
-      xdg.dataFile."scripts/base16.sh".source = .local/share/scripts/base16.sh;
+    # starship.toml has sane defaults that can be changed there
-
+    programs.starship = {
-      programs.less = {
+      enable = true;
-        enable = true;
+      settings = import ./starship.toml.nix;
-        keys = ''
-          k forw-line
-          i back-line
-          K forw-scroll
-          I back-scroll
-        '';
-      };
-
-      # Starship is a fast and featureful shell prompt
-      # starship.toml has sane defaults that can be changed there
-      programs.starship = {
-        enable = true;
-        settings = import ./starship.toml.nix;
-      };
-
-      programs.bash = import ./bash {
-        inherit config;
-        inherit pkgs;
-        inherit lib;
-        inherit flake;
-      };
-
-      programs.fzf = import ./fzf {
-        inherit config;
-        inherit pkgs;
-      };
-
-      programs.neovim = import ./nvim {
-        inherit config;
-        inherit pkgs;
-        inherit lib;
-      };
-      # Ensure nvim backup directory gets created
-      # Workaround for E510: Can't make backup file (add ! to override)
-      xdg.dataFile."nvim/backup/.keep".text = "";
-      xdg.dataFile."nvim/json-schemas/.keep".text = "";
-      # Generated with:
-      # docker run -it --name caddy-json-schema registry.greenbaum.cloud/gc/caddy-l4:2.5.2 caddy json-schema -output /srv/caddy_schema.json
-      xdg.dataFile."nvim/json-schemas/caddy_schema.json".source = .local/share/nvim/json-schemas/caddy_schema.json;
-      xdg.dataFile."nvim/templates/.keep".text = "";
-
-      programs.git = import ./git {};
-      xdg.configFile."git/config".text = import ./.config/git/config.nix {
-        inherit config;
-        inherit pkgs;
-      };
-      xdg.configFile."git/gitmessage".text = import ./.config/git/gitmessage.nix {
-        inherit config;
-        inherit pkgs;
-      };
-      xdg.configFile."git/global_gitignore".text = import ./.config/git/global_gitignore.nix {
-        inherit config;
-        inherit pkgs;
-      };
-
-      programs.direnv = import ./direnv {};
     };
+
+    home-manager = with pkgs;
+      pkgs.lib.setAttrByPath ["users" psCfg.user.name] {
+        home.packages = [
+          ack
+          asciinema
+          bat
+          blesh
+          exa
+          fd
+          gh
+          glow
+          jump
+          (nnn.overrideAttrs (o: {
+            patches =
+              (o.patches or [])
+              ++ [
+                ./nnn/0001-feat-use-wasd-keybindings-for-jkli.patch
+              ];
+          }))
+          powerline
+          silver-searcher
+          watson
+        ];
+
+        programs.bash = import ./bash {
+          inherit config;
+          inherit pkgs;
+          inherit self;
+        };
+        programs.fzf = import ./fzf {
+          inherit config;
+          inherit pkgs;
+        };
+        programs.neovim = import ./nvim {
+          inherit config;
+          inherit pkgs;
+          inherit lib;
+        };
+      };
   };
 }

modules/terminal-life/direnv/default.nix

@@ -1,6 +0,0 @@
-{...}: {
-  enable = true;
-  nix-direnv = {
-    enable = true;
-  };
-}

modules/terminal-life/fzf/default.nix

@@ -10,8 +10,5 @@
     "--color=fg:#d3d1d4,header:#7accd7,info:#e5c463,pointer:#ef9062"
     "--color=marker:#ef9062,fg+:#303030,prompt:#e5c463,hl+:#7accd7"
   ];
-  # Use ble.sh for completions, see
+  enableBashIntegration = true;
-  # modules/terminal-life/bash/default.nix -> bleopt complete_menu_style=desc
-  # and https://github.com/akinomyoga/ble.sh/wiki/Manual-%C2%A77-Completion
-  enableBashIntegration = false;
 }

modules/terminal-life/git/default.nix

@@ -1,40 +0,0 @@
-{...}: {
-  enable = true;
-
-  extraConfig = {
-    pull.rebase = false;
-  };
-
-  aliases = {
-    a = "add -p";
-    co = "checkout";
-    cob = "checkout -b";
-    f = "fetch -p";
-    c = "commit";
-    p = "push";
-    ba = "branch -a";
-    bd = "branch -d";
-    bD = "branch -D";
-    d = "diff";
-    dc = "diff --cached";
-    ds = "diff --staged";
-    r = "restore";
-    rs = "restore --staged";
-    st = "status -sb";
-
-    # reset
-    soft = "reset --soft";
-    hard = "reset --hard";
-    s1ft = "soft HEAD~1";
-    h1rd = "hard HEAD~1";
-
-    # logging
-    lg = "log --color --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
-    plog = "log --graph --pretty='format:%C(red)%d%C(reset) %C(yellow)%h%C(reset) %ar %C(green)%aN%C(reset) %s'";
-    tlog = "log --stat --since='1 Day Ago' --graph --pretty=oneline --abbrev-commit --date=relative";
-    rank = "shortlog -sn --no-merges";
-
-    # delete merged branches
-    bdm = "!git branch --merged | grep -v '*' | xargs -n 1 git branch -d";
-  };
-}

modules/terminal-life/nvim/default.nix

@@ -21,7 +21,7 @@ in {
   withPython3 = true;
 
   extraPackages = with pkgs;
-    lib.mkIf (cfg.full) [
+    lib.mkIf (!cfg.lite) [
       ansible-language-server
       ccls
       gopls
@@ -45,7 +45,8 @@ in {
     ];
 
   plugins = with pkgs.vimPlugins;
-    lib.mkIf cfg.full [
+    []
+    ++ lib.optionals (!cfg.lite) [
       (pkgs.vimPlugins.nvim-treesitter.withPlugins (p: [
         p.ini
         p.json
@@ -170,9 +171,6 @@ in {
       emmet-vim
       # Caddyfile syntax support for Vim
       vim-caddyfile-nvfetcher
-
-      # Fix TOFU hashes when writing nix derivations without leaving neovim
-      vim-nixhash
     ];
 
   extraConfig = builtins.concatStringsSep "\n" [

modules/terminal-life/nvim/init.vim

@@ -14,8 +14,6 @@ set shiftwidth=2
 set number
 set relativenumber
 set mouse=
-set autoindent
-set smartindent
 
 set undolevels=1000
 set undoreload=10000

modules/terminal-life/nvim/lsp.vim

@@ -74,8 +74,6 @@ lua <<EOF
 
   -- Add additional capabilities supported by nvim-cmp
   local capabilities = require('cmp_nvim_lsp').default_capabilities()
-  -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
-  capabilities.textDocument.completion.completionItem.snippetSupport = true
 
   -- vscode HTML lsp needs this https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md#html
   capabilities.textDocument.completion.completionItem.snippetSupport = true
@@ -174,13 +172,6 @@ lua <<EOF
     end
   end -- ‡
 
-  -- configure floating diagnostics appearance, symbols
-  local signs = { Error = " ", Warn = " ", Hint = " ", Info = " " }
-  for type, icon in pairs(signs) do
-    local hl = "DiagnosticSign" .. type
-    vim.fn.sign_define(hl, { text = icon, texthl = hl, numhl = hl })
-  end
-
   -- Set completeopt to have a better completion experience
   vim.o.completeopt = 'menuone,noselect'
 

modules/terminal-life/nvim/ui.vim

@@ -1,18 +1,18 @@
-"let g:base16_shell_path = $XDG_DATA_HOME . "/scripts/base16.sh"
+let g:base16_shell_path = $XDG_DATA_HOME . "/scripts/base16.sh"
-"let base16colorspace = 256
+let base16colorspace = 256
 set termguicolors
-"let g:sonokai_style = 'shusia'
+let g:sonokai_style = 'shusia'
-"let g:sonokai_enable_italic = 1
+let g:sonokai_enable_italic = 1
-"let g:sonokai_disable_italic_comment = 1
+let g:sonokai_disable_italic_comment = 1
-"let g:sonokai_transparent_background = 1
+let g:sonokai_transparent_background = 1
+colorscheme sonokai
 set background=dark
-colorscheme apprentice
 
 let g:airline#extensions#tabline#enabled = 1 " Enable the list of buffers
 let g:airline#extensions#tabline#fnamemod = ':t' " Show just the filename
 let g:airline#extensions#tabline#formatter = 'unique_tail_improved'
 let g:airline_powerline_fonts = 1 " Use powerline fonts
-let g:airline_theme = 'apprentice'
+let g:airline_theme = 'sonokai'
 
 " Customize fzf colors to match your color scheme
 " - fzf#wrap translates this to a set of `--color` options

modules/uhk/default.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.uhk;
+in {
+  options.pub-solar.uhk = {
+    enable = mkEnableOption "Ultimate Hacking Keyboard";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      uhk-agent
+    ];
+
+    # Ultimate Hacking Keyboard rules
+    # These are the udev rules for accessing the USB interfaces of the UHK as non-root users.
+    services.udev.packages = with pkgs; [
+      uhk-agent
+    ];
+    services.udev.extraRules = ''
+      SUBSYSTEM=="input", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", GROUP="input", MODE="0660"
+      SUBSYSTEMS=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
+      KERNEL=="hidraw*", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="612[0-7]", TAG+="uaccess"
+    '';
+  };
+}

modules/user/.config/dircolors

@@ -1,243 +0,0 @@
-# Configuration file for dircolors, a utility to help you set the
-# LS_COLORS environment variable used by GNU ls with the --color option.
-
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
-# Copying and distribution of this file, with or without modification,
-# are permitted provided the copyright notice and this notice are preserved.
-
-# The keywords COLOR, OPTIONS, and EIGHTBIT (honored by the
-# slackware version of dircolors) are recognized but ignored.
-
-# You can copy this file to .dir_colors in your $HOME directory to override
-# the system defaults.
-
-# Below, there should be one TERM entry for each termtype that is colorizable
-TERM Eterm
-TERM ansi
-TERM color-xterm
-TERM con132x25
-TERM con132x30
-TERM con132x43
-TERM con132x60
-TERM con80x25
-TERM con80x28
-TERM con80x30
-TERM con80x43
-TERM con80x50
-TERM con80x60
-TERM cons25
-TERM console
-TERM cygwin
-TERM dtterm
-TERM eterm-color
-TERM gnome
-TERM gnome-256color
-TERM hurd
-TERM jfbterm
-TERM konsole
-TERM kterm
-TERM linux
-TERM linux-c
-TERM mach-color
-TERM mach-gnu-color
-TERM mlterm
-TERM putty
-TERM putty-256color
-TERM rxvt
-TERM rxvt-256color
-TERM rxvt-cygwin
-TERM rxvt-cygwin-native
-TERM rxvt-unicode
-TERM rxvt-unicode-256color
-TERM rxvt-unicode256
-TERM screen
-TERM screen-256color
-TERM screen-256color-bce
-TERM screen-bce
-TERM screen-w
-TERM screen.Eterm
-TERM screen.rxvt
-TERM screen.linux
-TERM st
-TERM st-256color
-TERM terminator
-TERM vt100
-TERM xterm
-TERM xterm-16color
-TERM xterm-256color
-TERM xterm-88color
-TERM xterm-color
-TERM xterm-debian
-
-# Below are the color init strings for the basic file types. A color init
-# string consists of one or more of the following numeric codes:
-# Attribute codes:
-# 00=none 01=bold 04=underscore 05=blink 07=reverse 08=concealed
-# Text color codes:
-# 30=black 31=red 32=green 33=yellow 34=blue 35=magenta 36=cyan 37=white
-# Background color codes:
-# 40=black 41=red 42=green 43=yellow 44=blue 45=magenta 46=cyan 47=white
-#NORMAL 00	# no color code at all
-#FILE 00	# regular file: use no color at all
-RESET 0		# reset to "normal" color
-DIR 01;34	# directory
-LINK 01;36	# symbolic link.  (If you set this to 'target' instead of a
-                # numerical value, the color is as for the file pointed to.)
-MULTIHARDLINK 00	# regular file with more than one link
-FIFO 40;33	# pipe
-SOCK 01;35	# socket
-DOOR 01;35	# door
-BLK 40;33;01	# block device driver
-CHR 40;33;01	# character device driver
-ORPHAN 01;05;37;41  # orphaned syminks
-MISSING 01;05;37;41 # ... and the files they point to
-SETUID 37;41	# file that is setuid (u+s)
-SETGID 30;43	# file that is setgid (g+s)
-CAPABILITY 30;41	# file with capability
-STICKY_OTHER_WRITABLE 30;42 # dir that is sticky and other-writable (+t,o+w)
-OTHER_WRITABLE 34;42 # dir that is other-writable (o+w) and not sticky
-STICKY 37;44	# dir with the sticky bit set (+t) and not other-writable
-
-# This is for files with execute permission:
-EXEC 01;32
-
-# List any file extensions like '.gz' or '.tar' that you would like ls
-# to colorize below. Put the extension, a space, and the color init string.
-# (and any comments you want to add after a '#')
-
-# If you use DOS-style suffixes, you may want to uncomment the following:
-#.cmd 01;32 # executables (bright green)
-#.exe 01;32
-#.com 01;32
-#.btm 01;32
-#.bat 01;32
-# Or if you want to colorize scripts even if they do not have the
-# executable bit actually set.
-#.sh  01;32
-#.csh 01;32
-
-# archives or compressed (bright red)
-.tar 01;31
-.tgz 01;31
-.arc 01;31
-.arj 01;31
-.taz 01;31
-.lha 01;31
-.lz4 01;31
-.lzh 01;31
-.lzma 01;31
-.tlz 01;31
-.txz 01;31
-.tzo 01;31
-.t7z 01;31
-.zip 01;31
-.z   01;31
-.Z   01;31
-.dz  01;31
-.gz  01;31
-.lrz 01;31
-.lz  01;31
-.lzo 01;31
-.xz  01;31
-.bz2 01;31
-.bz  01;31
-.tbz 01;31
-.tbz2 01;31
-.tz  01;31
-.deb 01;31
-.rpm 01;31
-.jar 01;31
-.war 01;31
-.ear 01;31
-.sar 01;31
-.rar 01;31
-.alz 01;31
-.ace 01;31
-.zoo 01;31
-.cpio 01;31
-.7z  01;31
-.rz  01;31
-.cab 01;31
-
-# image formats
-.jpg 01;35
-.jpeg 01;35
-.gif 01;35
-.bmp 01;35
-.pbm 01;35
-.pgm 01;35
-.ppm 01;35
-.tga 01;35
-.xbm 01;35
-.xpm 01;35
-.tif 01;35
-.tiff 01;35
-.png 01;35
-.svg 01;35
-.svgz 01;35
-.mng 01;35
-.pcx 01;35
-.mov 01;35
-.mpg 01;35
-.mpeg 01;35
-.m2v 01;35
-.mkv 01;35
-.webm 01;35
-.ogm 01;35
-.mp4 01;35
-.m4v 01;35
-.mp4v 01;35
-.vob 01;35
-.qt  01;35
-.nuv 01;35
-.wmv 01;35
-.asf 01;35
-.rm  01;35
-.rmvb 01;35
-.flc 01;35
-.avi 01;35
-.fli 01;35
-.flv 01;35
-.gl 01;35
-.dl 01;35
-.xcf 01;35
-.xwd 01;35
-.yuv 01;35
-.cgm 01;35
-.emf 01;35
-
-# http://wiki.xiph.org/index.php/MIME_Types_and_File_Extensions
-.axv 01;35
-.anx 01;35
-.ogv 01;35
-.ogx 01;35
-
-# Document files
-.pdf 00;32
-.ps 00;32
-.txt 00;32
-.patch 00;32
-.diff 00;32
-.log 00;32
-.tex 00;32
-.doc 00;32
-
-# audio formats
-.aac 00;36
-.au 00;36
-.flac 00;36
-.m4a 00;36
-.mid 00;36
-.midi 00;36
-.mka 00;36
-.mp3 00;36
-.mpc 00;36
-.ogg 00;36
-.ra 00;36
-.wav 00;36
-
-# http://wiki.xiph.org/index.php/MIME_Types_and_File_Extensions
-.axa 00;36
-.oga 00;36
-.spx 00;36
-.xspf 00;36

modules/user/default.nix

@@ -1,101 +1,49 @@
 {
+  lib,
   config,
   pkgs,
-  lib,
   ...
-}: let
+}:
-  psCfg = config.pub-solar;
+with lib; let
-in
+  cfg = config.pub-solar;
-  with lib; {
+in {
-    imports = [
+  options.pub-solar = {
-      ./home.nix
+    user = {
-    ];
+      name = mkOption {
-
+        description = "User login name";
-    options.pub-solar = {
+        type = types.nullOr types.str;
-      user = {
+        default = "nixos";
-        name = mkOption {
+      };
-          description = "User login name";
+      description = mkOption {
-          type = types.nullOr types.str;
+        description = "User description";
-          default = "nixos";
+        type = types.nullOr types.str;
-        };
+        default = "The main PubSolarOS user";
-        description = mkOption {
+      };
-          description = "User description";
+      password = mkOption {
-          type = types.nullOr types.str;
+        description = "User password";
-          default = "The main PubSolarOS user";
+        type = types.nullOr types.str;
-        };
+        default = null;
-        password = mkOption {
+      };
-          description = "User password";
+      publicKeys = mkOption {
-          type = types.nullOr types.str;
+        description = "User SSH public keys";
-          default = null;
+        type = types.listOf types.str;
-        };
+        default = [];
-        passwordlessSudo = mkOption {
+      };
-          description = "Whether this user can use sudo without entering a password";
+      fullName = mkOption {
-          type = types.bool;
+        description = "User full name";
-          default = false;
+        type = types.nullOr types.str;
-        };
+        default = null;
-        publicKeys = mkOption {
+      };
-          description = "User SSH public keys";
+      email = mkOption {
-          type = types.listOf types.str;
+        description = "User email address";
-          default = [];
+        type = types.nullOr types.str;
-        };
+        default = null;
-        fullName = mkOption {
+      };
-          description = "User full name";
+      gpgKeyId = mkOption {
-          type = types.nullOr types.str;
+        description = "GPG Key ID";
-          default = null;
+        type = types.nullOr types.str;
-        };
+        default = null;
-        email = mkOption {
-          description = "User email address";
-          type = types.nullOr types.str;
-          default = null;
-        };
-        gpgKeyId = mkOption {
-          description = "GPG Key ID";
-          type = types.nullOr types.str;
-          default = null;
-        };
       };
     };
-
+  };
-    config = {
+}
-      users = {
-        mutableUsers = false;
-
-        users."${psCfg.user.name}" = {
-          # Indicates whether this is an account for a “real” user.
-          # This automatically sets group to users, createHome to true,
-          # home to /home/username, useDefaultShell to true, and isSystemUser to false.
-          isNormalUser = true;
-          description = psCfg.user.description;
-          extraGroups = [
-            "input"
-            "lp"
-            "networkmanager"
-            "scanner"
-            "video"
-            "wheel"
-          ];
-          shell = pkgs.bash;
-          initialHashedPassword =
-            if psCfg.user.password != null
-            then psCfg.user.password
-            else "";
-          openssh.authorizedKeys.keys =
-            if psCfg.user.publicKeys != null
-            then psCfg.user.publicKeys
-            else [];
-        };
-      };
-
-      security.sudo.extraRules = mkIf psCfg.user.passwordlessSudo [
-        {
-          users = ["${psCfg.user.name}"];
-          commands = [
-            {
-              command = "ALL";
-              options = ["NOPASSWD"];
-            }
-          ];
-        }
-      ];
-    };
-  }