Commit ac0ef4ee38a5
Changed files (7)
home
common
profiles
systems
home/common/profiles/work-fedora.nix
@@ -0,0 +1,63 @@
+{ pkgs, ... }:
+let
+ jira-wrapped = pkgs.writeShellScriptBin "jira" ''
+ export JIRA_API_TOKEN=$(${pkgs.passage}/bin/passage show redhat/issues/atlassian/token)
+ exec ${pkgs.jira-cli-go}/bin/jira "$@"
+ '';
+in
+{
+ imports = [
+ ../services/usage-metrics.nix
+ ../dev/default.nix
+ ../dev/containers.nix
+ ../dev/gh-news.nix
+ ../dev/github-notif-manager.nix
+ ../dev/lazyworktree.nix
+ ../dev/neovim.nix
+ ../dev/emacs.nix
+ ../dev/tektoncd.nix
+ ../services/goimapnotify.nix
+ ../services/mail-monitor.nix
+ ../services/gcal-to-org.nix
+ ../desktop/passage.nix
+ ../shell/gh.nix
+ ];
+
+ # Emacs daemon
+ services.emacs = {
+ enable = true;
+ client.enable = true;
+ socketActivation.enable = true;
+ };
+
+ # Delay emacs daemon until unscd is ready (system service)
+ # Without this, emacs starts before LDAP user resolution works
+ systemd.user.services.emacs.Unit.After = [ "nss-user-lookup.target" ];
+ systemd.user.services.emacs.Service.ExecStartPre =
+ "-/bin/sh -c 'until test -S /var/run/nscd/socket; do sleep 0.2; done'";
+
+ # Google Calendar sync to org-mode
+ services.gcal-to-org = {
+ enable = true;
+ interval = "hourly";
+ };
+
+ home.packages = with pkgs; [
+ gnumake
+
+ # TPM-backed passage: TPM age identity (primary, machine-bound, no touch)
+ # + YubiKey plugin for recovery and re-encryption fallback
+ age-plugin-tpm
+ age-plugin-yubikey
+
+ go-org-readwise
+ gh-pr
+ lazypr
+ nixpkgs-pr-watch
+ ssh-to-age
+
+ lazygit
+ jira-wrapped
+ daily-plan
+ ];
+}
systems/aomi/home.nix
@@ -1,57 +1,6 @@
-{ pkgs, ... }:
-let
- jira-wrapped = pkgs.writeShellScriptBin "jira" ''
- export JIRA_API_TOKEN=$(${pkgs.passage}/bin/passage show redhat/issues/atlassian/token)
- exec ${pkgs.jira-cli-go}/bin/jira "$@"
- '';
-in
+{ ... }:
{
imports = [
- ../../home/common/services/usage-metrics.nix
- ../../home/common/dev/default.nix
- ../../home/common/dev/gh-news.nix
- ../../home/common/dev/github-notif-manager.nix
- ../../home/common/dev/lazyworktree.nix
- ../../home/common/dev/neovim.nix
- ../../home/common/dev/emacs.nix
- ../../home/common/dev/containers.nix
- ../../home/common/dev/tektoncd.nix
- ../../home/common/services/goimapnotify.nix
- ../../home/common/services/mail-monitor.nix
- ../../home/common/desktop/passage.nix
- ../../home/common/shell/gh.nix
+ ../../home/common/profiles/work-fedora.nix
];
-
- # Enable Emacs daemon
- services.emacs = {
- enable = true;
- client.enable = true;
- socketActivation.enable = true;
- };
-
- # Delay emacs daemon until unscd is ready (system service)
- # Without this, emacs starts before LDAP user resolution works
- systemd.user.services.emacs.Unit.After = [ "nss-user-lookup.target" ];
- systemd.user.services.emacs.Service.ExecStartPre =
- "-/bin/sh -c 'until test -S /var/run/nscd/socket; do sleep 0.2; done'";
-
- home.packages = with pkgs; [
- gnumake
-
- # TPM-backed passage: TPM age identity (primary, machine-bound, no touch)
- # + YubiKey plugin for recovery and re-encryption fallback
- age-plugin-tpm
- age-plugin-yubikey
-
- go-org-readwise
- gh-pr
- lazypr
- nixpkgs-pr-watch
- ssh-to-age
-
- lazygit
- jira-wrapped
- daily-plan
- ];
-
}
systems/aomi/system.nix
@@ -1,102 +1,6 @@
+{ ... }:
{
- lib,
- pkgs,
- globals,
- libx,
- ...
-}:
-let
- machine = globals.machines.aomi;
- vpnServer = globals.machines.carthage;
- hostsEntries = libx.hostConfigs globals.machines;
- hostsFile = lib.concatStringsSep "\n" (
- lib.mapAttrsToList (ip: names: "${ip} ${lib.concatStringsSep " " names}") hostsEntries
- );
-in
-{
- config = {
- # Platform
- nixpkgs.hostPlatform = "x86_64-linux";
-
- # Required for non-NixOS (Fedora CSB)
- system-manager.allowAnyDistro = true;
-
- # Disable userborn — Fedora manages users/groups natively
- # See: https://github.com/numtide/system-manager/issues/350
- services.userborn.enable = false;
-
- # System packages
- environment.systemPackages = with pkgs; [
- wireguard-tools
- syncthing
- vim
- htop
- curl
- git
- ];
-
- # Nix custom config (Determinate installer includes nix.custom.conf)
- environment.etc."nix/nix.custom.conf" = {
- text = ''
- trusted-users = root @wheel
- extra-substituters = http://okinawa.vpn:5000
- extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
- '';
- mode = "0644";
- };
-
- # WireGuard: config managed by system-manager, service by Fedora native wg-quick@wg0
- # Nix-store binaries lack proper SELinux context for network admin ops,
- # so we use Fedora's wg-quick which runs with the correct domain.
- # Enable with: sudo dnf install wireguard-tools && sudo systemctl enable --now wg-quick@wg0
- # Private key is read at runtime from /etc/wireguard/private.key
- environment.etc."wireguard/wg0.conf" = {
- text = ''
- [Interface]
- PostUp = wg set %i private-key /etc/wireguard/private.key
- Address = ${builtins.head machine.net.vpn.ips}/24
-
- [Peer]
- PublicKey = ${vpnServer.net.vpn.pubkey}
- AllowedIPs = 10.100.0.0/24
- Endpoint = ${globals.net.vpn.endpoint}:51820
- PersistentKeepalive = 25
- '';
- mode = "0644";
- };
-
- # NetworkManager dispatcher: preserve WireGuard route when Red Hat VPN connects
- # The VPN pushes 10.0.0.0/8 via tun0 in a higher-priority routing table,
- # which captures our 10.100.0.0/24 WireGuard traffic. This adds a more
- # specific route to keep WireGuard reachable.
- environment.etc."NetworkManager/dispatcher.d/99-wireguard-route" = {
- text = ''
- #!/bin/bash
- INTERFACE="$1"
- ACTION="$2"
- if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
- # Find the VPN routing table (usually 75)
- TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
- if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
- ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
- fi
- fi
- '';
- mode = "0755";
- replaceExisting = true;
- };
-
- # /etc/hosts entries for VPN and home network hosts
- environment.etc.hosts = {
- text = ''
- 127.0.0.1 localhost
- ::1 localhost
- ${hostsFile}
- '';
- mode = "0644";
- replaceExisting = true;
- };
-
- # Syncthing is managed by home-manager (user service with full folder config)
- };
+ imports = [
+ ../common/fedora-work/system.nix
+ ];
}
systems/common/fedora-work/system.nix
@@ -0,0 +1,97 @@
+{
+ lib,
+ pkgs,
+ globals,
+ libx,
+ hostname,
+ ...
+}:
+let
+ machine = globals.machines.${hostname};
+ vpnServer = globals.machines.carthage;
+ hostsEntries = libx.hostConfigs globals.machines;
+ hostsFile = lib.concatStringsSep "\n" (
+ lib.mapAttrsToList (ip: names: "${ip} ${lib.concatStringsSep " " names}") hostsEntries
+ );
+in
+{
+ config = {
+ # Disable userborn — Fedora manages users/groups natively
+ # See: https://github.com/numtide/system-manager/issues/350
+ services.userborn.enable = false;
+
+ # System packages
+ environment.systemPackages = with pkgs; [
+ wireguard-tools
+ syncthing
+ vim
+ htop
+ curl
+ git
+ ];
+
+ # Nix custom config (Determinate installer includes nix.custom.conf)
+ environment.etc."nix/nix.custom.conf" = {
+ text = ''
+ trusted-users = root @wheel
+ extra-substituters = http://okinawa.vpn:5000
+ extra-trusted-public-keys = cache.okinawa.home:gp+IG0OaO4L/J0drL8OwmDtMPmdUq4kfLwg3mR8BkCs=
+ '';
+ mode = "0644";
+ };
+
+ # WireGuard: config managed by system-manager, service by Fedora native wg-quick@wg0
+ # Nix-store binaries lack proper SELinux context for network admin ops,
+ # so we use Fedora's wg-quick which runs with the correct domain.
+ # Enable with: sudo dnf install wireguard-tools && sudo systemctl enable --now wg-quick@wg0
+ # Private key is read at runtime from /etc/wireguard/private.key
+ environment.etc."wireguard/wg0.conf" = {
+ text = ''
+ [Interface]
+ PostUp = wg set %i private-key /etc/wireguard/private.key
+ Address = ${builtins.head machine.net.vpn.ips}/24
+
+ [Peer]
+ PublicKey = ${vpnServer.net.vpn.pubkey}
+ AllowedIPs = 10.100.0.0/24
+ Endpoint = ${globals.net.vpn.endpoint}:51820
+ PersistentKeepalive = 25
+ '';
+ mode = "0644";
+ };
+
+ # NetworkManager dispatcher: preserve WireGuard route when Red Hat VPN connects
+ # The VPN pushes 10.0.0.0/8 via tun0 in a higher-priority routing table,
+ # which captures our 10.100.0.0/24 WireGuard traffic. This adds a more
+ # specific route to keep WireGuard reachable.
+ environment.etc."NetworkManager/dispatcher.d/99-wireguard-route" = {
+ text = ''
+ #!/bin/bash
+ INTERFACE="$1"
+ ACTION="$2"
+ if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
+ # Find the VPN routing table (usually 75)
+ TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
+ if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
+ ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
+ fi
+ fi
+ '';
+ mode = "0755";
+ replaceExisting = true;
+ };
+
+ # /etc/hosts entries for VPN and home network hosts
+ environment.etc.hosts = {
+ text = ''
+ 127.0.0.1 localhost
+ ::1 localhost
+ ${hostsFile}
+ '';
+ mode = "0644";
+ replaceExisting = true;
+ };
+
+ # Syncthing is managed by home-manager (user service with full folder config)
+ };
+}
systems/kyushu/home.nix
@@ -1,147 +1,18 @@
{ pkgs, ... }:
-let
- # Wrapper for jira-cli that injects API token from passage
- jira-wrapped = pkgs.writeShellScriptBin "jira" ''
- export JIRA_API_TOKEN=$(${pkgs.passage}/bin/passage show redhat/issues/atlassian/token)
- exec ${pkgs.jira-cli-go}/bin/jira "$@"
- '';
-in
{
imports = [
- ../../home/common/services/usage-metrics.nix
- ../../home/common/dev/containers.nix
- ../../home/common/dev/gh-news.nix
- ../../home/common/dev/github-notif-manager.nix
- ../../home/common/dev/lazyworktree.nix
- ../../home/common/dev/neovim.nix
- ../../home/common/dev/tektoncd.nix
- ../../home/common/services/color-scheme-timer.nix
- ../../home/common/services/gcal-to-org.nix
- ../../home/common/services/goimapnotify.nix
- ../../home/common/services/mail-monitor.nix
- ../../home/common/services/readwise-sync.nix
- ../../home/common/services/redhat.nix
- ../../home/common/shell/gh.nix
+ ../../home/common/profiles/work-fedora.nix
];
home.file.".gmailctl/config.jsonnet".source = ./config.jsonnet;
home.file.".gmailctl/gmailctl.libsonnet".source = ./gmailctl.libsonnet;
+
home.packages = with pkgs; [
- # easyeffects # Not using it really
-
- nautilus
-
- slack
-
gmailctl
-
- calibre
-
- ntfy-sh
- libnotify
-
- monolith
-
- feishin # navidrome - uses mpv-unwrapped via overlay
-
- lazygit
-
- # Keyboard
- qmk
- qmk_hid
-
- startpaac
- abs-tui
- batzconverter
-
- simple-scan
-
- # transmission_4-gtk # Using remote one for now
-
- # forgejo-cli
- jira-wrapped
-
- # lisp
- # roswell # Disabled: broken in nixpkgs-unstable (register_runtime_options error)
- # sbcl # Not using
-
- go-org-readwise
- radian
- gh-pr
- lazypr
- nixpkgs-pr-watch
- arr
- toggle-color-scheme
- shpool-remote
- cliphist-cleanup
-
- tekton-lsp
- pi-acp
-
- (pkgs.writeShellScriptBin "officemode" ''
- echo "80" > /sys/class/power_supply/BAT0/charge_control_end_threshold
- echo "70" > /sys/class/power_supply/BAT0/charge_control_start_threshold
- echo "Office mode: charging between 70%–80%"
- '')
- (pkgs.writeShellScriptBin "roadmode" ''
- echo "100" > /sys/class/power_supply/BAT0/charge_control_end_threshold
- echo "0" > /sys/class/power_supply/BAT0/charge_control_start_threshold
- echo "Road mode: charging to 100%"
- '')
jayrah
jayrat
- daily-plan
+ tekton-lsp
+ pi-acp
+ shpool-remote
];
-
- # Automatic color scheme switching
- services.color-scheme-timer = {
- enable = true;
- latitude = "48.87"; # Paris coordinates
- longitude = "2.33";
- lightTime = "07:00"; # Switch to light mode at 7am
- darkTime = "19:00"; # Switch to dark mode at 7pm
- };
-
- # Google Calendar sync to org-mode
- services.gcal-to-org = {
- enable = true;
- interval = "hourly";
- };
-
- # Readwise sync to org-mode
- services.readwise-sync = {
- enable = true;
- interval = "daily";
- };
-
- # ntfy notification subscriber
- # disabled: auth token expired, causes fail2ban bans from 401 retry floods
- # systemd.user.services.ntfy-subscriber = {
- # Unit = {
- # Description = "ntfy notification subscriber";
- # Documentation = "https://ntfy.sh";
- # After = [
- # "graphical-session.target"
- # "network-online.target"
- # ];
- # Wants = [ "network-online.target" ];
- # };
- #
- # Service = {
- # Type = "simple";
- # ExecStart = "${pkgs.ntfy-sh}/bin/ntfy subscribe --from-config";
- # Restart = "on-failure";
- # RestartSec = 10;
- # Environment = [
- # "PATH=${pkgs.bash}/bin:${pkgs.coreutils}/bin:${pkgs.libnotify}/bin:${pkgs.ntfy-sh}/bin:${pkgs.xdg-utils}/bin:${pkgs.curl}/bin:${pkgs.passage}/bin"
- # "PASSAGE_DIR=/home/vincent/.local/share/passage"
- # "PASSAGE_IDENTITIES_FILE=/home/vincent/.local/share/passage/identities"
- # ];
- # };
- #
- # Install = {
- # WantedBy = [ "graphical-session.target" ];
- # };
- # };
-
}
systems/kyushu/system.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+ imports = [
+ ../common/fedora-work/system.nix
+ ];
+}
flake.nix
@@ -53,12 +53,17 @@
# Standalone home configurations
# FIXME set this up
homeConfigurations = {
- # Fedora CSB workstation
+ # Fedora CSB workstations
"vdemeest@aomi" = libx.mkHome {
username = "vdemeest";
hostname = "aomi";
desktop = "niri";
};
+ "vdemeest@kyushu" = libx.mkHome {
+ username = "vdemeest";
+ hostname = "kyushu";
+ desktop = "niri";
+ };
# headless machine
"vincent@aion" = libx.mkHome {
username = "vincent";
@@ -143,6 +148,10 @@
hostname = "aomi";
system = "x86_64-linux";
};
+ kyushu = libx.mkSystemManager {
+ hostname = "kyushu";
+ system = "x86_64-linux";
+ };
nagoya = libx.mkSystemManager {
hostname = "nagoya";
system = "aarch64-linux";