storopoli / flakes Goto Github PK

NixOS/MacOS Nix Minimalist-Hardened-Privacy-oriented Configs

License: MIT License

Nix 83.19% Shell 7.64% CSS 2.53% Vim Script 6.64%

flakes's Introduction

I am a software developer with a PhD and background in Computational Statistics. I am interested in performant and reliable software. In other words, I make computers go brrr faster.

In hope of a better future, I dedicate my free time to Bitcoin-related projects. I contribute to the Rust Bitcoin ecosystem, particularly Bitcoin Dev Kit (BDK) and rust-bitcoin. I also work full-time at Portal on Bitcoin-backed smart contracts.

I am a faculty member at the Department of Computer Science at Universidade Nove de Julho (UNINOVE). I am also an ardent Bayesian.

I like Rust, Julia, Nix, and Vim.

I practice Stoic Philosophy daily.

I hate bloatware and the soydev phenomenon.

Everything that I do is either open source or has a permissive Creative Commons license.

I don't have social media, since I think they are overrated and "they sell your data". If you want to contact me, please send an email.

If you want to find out what's recently on my mind, check out my blog.

flakes's People

Contributors

Stargazers

Watchers

Forkers

jaoleal oleonardolima codeskin-r

flakes's Issues

feat(nixos): wireguard add config with agenix

Use agenix to create a wireguard kill switch config:

Encode secrets with agenix

environment.etc = {
  # wireguard config used with `wg-quick up wg-example`
  "wireguard/wg-example.conf" = {
    source = config.age.secrets."wg-example.conf".path;
};

Create the config file wg-something.conf with systemd-networkd
Replace in-place strings in wg-something.conf with secrets
Setup the systemd autostart

feat(gitui): add `gitui` to replace `lazygit`

gitui now supports PGP-signed commits (see extrawurst/gitui#97).
gitui is written in Rust, and fast AF.
It beats lazygit in all benchmarks.

So let's add it.
However, we need to wait for a new version (>0.25.2) to land in nixpkgs.

Something like:

{ ... }:

{
  xdg.configFile = {
    # catppucin theme
    "gitui/theme.ron".source = builtins.fetchurl {
      url = "https://github.com/catppuccin/gitui/raw/ce0d073676dc96d005f7b91368e5cd565d840104/theme/mocha.ron";
      sha256 = lib.fakeSha256;
    };

    # vim keybindings
    "gitui/key_bindings.ron".source = builtins.fetchurl {
      url = "https://github.com/extrawurst/gitui/raw/8876c1d0f616d55a0c0957683781fd32af815ae3/vim_style_key_config.ron";
      sha256 = lib.fakeSha256;
    };
  };

  programs.gitui = {
    enable = true
  };
}

Also change the lazygit.nvim to nvim-gitui (or remove it altogether?)

feat(waybar): Mullvad VPN detector

Add a custom waybar module that detects if you are connected using the Mullvad VPN.

Something like:

"custom/mullvad": {
    "exec": "waybar-mullvad",
    "return-type": "json"
}

And the script:

#!/bin/sh

vpn() {
    if curl -Ls am.i.mullvad.net/json | jq .mullvad_exit_ip; then
        icon=""
        class=on
    else
        icon=""
        class=off
    fi
    printf '{"text": " %s ", "class": "%s"}\n' "$icon" "$class"
}

if grep '^home-' /etc/hostname > /dev/null; then
    while true; do
        vpn
        sleep 5m
    done
fi

spotube

Add spotube to apps:

wait for nixpkgs, see NixOS/nixpkgs#200120

make your own derivation, see NixOS/nixpkgs#200120 (comment):

{ stdenv, fetchurl, lib, makeWrapper, undmg }:

  stdenv.mkDerivation rec {
    pname = "spotube";
    version = "3.4.0";
    appname = "Spotube";
    filename = "Spotube-macos-universal";
    meta = with lib; {
      description =
        "An open source, cross-platform Spotify client compatible across multiple platforms
          utilizing Spotify's data API and YouTube (or Piped.video or JioSaavn) as an audio source,
          eliminating the need for Spotify Premium";
      homepage = "https://github.com/KRTirtho/spotube";
      downloadPage = "https://github.com/KRTirtho/spotube/releases";
      license = licenses.bsd3;
    };

    src = fetchurl {
      url =
        "https://github.com/KRTirtho/spotube/releases/download/v${version}/${filename}.dmg";
      hash = "sha256-dif2ec37QL9FVPGgqqvtB2zRX6P3NCth5FFnpASR/As=";
    };

    icon = fetchurl {
      url = "https://raw.githubusercontent.com/KRTirtho/spotube/nightly/assets/spotube-logo.png";
      hash = "sha256-gyzP3ynzuZFN0osmEAjwGfYmbfVxE9Nm2fLJ8q8G6BE=";
    };
  
    sourceRoot = "${appname}.app";
    nativeBuildInputs = [ makeWrapper undmg ];
    installPhase = ''
      runHook preInstall
      mkdir -p $out/{Applications/${appname}.app,bin}
      cp -R . $out/Applications/${appname}.app
      makeWrapper $out/Applications/${appname}.app/Contents/MacOS/${appname} $out/bin/${pname}
      runHook postInstall
    '';
  }

Migrate NeoVim configs to `nix-community/nixvim`

Maybe a standalone flake in storopoli/neovix(?)¹.
storopoli/flakes then calls in that flake as a package?

Source: nix-community/nixvim

you can run anywhere with nix run github:storopoli/neovix ↩

Cannot login

Hello, is me.
9. Username modification: edit user in /mnt/etc/nixos/flakes/flake.nix, /mnt/etc/nixos/flakes/linux/default.nix, and /mnt/etc/nixos/flakes/linux/wayland.nix; hostname modification: edit /mnt/etc/nixos/flakes/common/default.nix to modify the hostName value in the networking property group
In this step I don't know how to edit so I leave them as default.

10. Use the hash password generated by the mkpasswd {PASSWORD} -m sha-512 command to replace the value of users.users.<name>.hashedPassword in /mnt/etc/nixos/flakes/linux/default.nix (there are two places to be edited)
This step, i use:

$ mkpasswd 1 -m sha-512 ( Set password to 1 )
$ $6$4lwj3AGq8M9CQE2.$q8cNPghWHTl/dfE0dMPm2vsh0cMpY2gWxw ( example )

Then i paste it into

{ config, ... }:

{
  imports = [
    ./system.nix
    ./filesystem.nix
    ./networking.nix
    ./packages.nix
    ./bluetooth.nix
    ./fonts.nix
    ./wayland.nix
    ./hyprland.nix
    ./impermanence.nix
  ];
  users = {
    mutableUsers = false;
    users = {
      root.hashedPassword = "$6$4lwj3AGq8M9CQE2.$q8cNPghWHTl/dfE0dMPm2vsh0cMpY2gWxw";
      // I modify  root.hashedPasswordFile to  root.hashedPassword

      user = {
        hashedPassword = "$6$4lwj3AGq8M9CQE2.$q8cNPghWHTl/dfE0dMPm2vsh0cMpY2gWxw";
      // hashedPasswordFile to  hashedPassword
        isNormalUser = true;
        extraGroups =
          [ "wheel" "docker" "libvirtd" "video" "audio" "networkmanager" ];
      };
    };
  };
}

2nd test I tried

{ config, ... }:

{
  imports = [
    ./system.nix
    ./filesystem.nix
    ./networking.nix
    ./packages.nix
    ./bluetooth.nix
    ./fonts.nix
    ./wayland.nix
    ./hyprland.nix
    ./impermanence.nix
  ];
  users = {
    mutableUsers = false;
    users.users,root = {      // change users to users.users,root 
      root.hashedPassword = "$6$4lwj3AGq8M9CQE2.$q8cNPghWHTl/dfE0dMPm2vsh0cMpY2gWxw";
      // I modify  root.hashedPasswordFile to  root.hashedPassword

      user = {
        hashedPassword = "$6$4lwj3AGq8M9CQE2.$q8cNPghWHTl/dfE0dMPm2vsh0cMpY2gWxw";
      // hashedPasswordFile to  hashedPassword
        isNormalUser = true;
        extraGroups =
          [ "wheel" "docker" "libvirtd" "video" "audio" "networkmanager" ];
      };
    };
  };
}

But login still incorrect.
Look forward your help.

`gh` and `gh-dash`

Move gh to home-manager
add gh-dash
- vim keybindings
- catppuccin theme

Use home-manager

Linux: Support Secure Boot

nix-community/lanzaboote:

Check the QUICK_START.md
Ensure that all dirs/files are white listed in impermanence:
```
"/etc/secureboot" # lanzaboote - secure boot
```

feat(darwin): wireguard configs

Minimize Darwin's attack surface with wireguard-tools brew cli.
Remove Proton/Mullvad app
Use the wireguard CLI app
Set up launchd init scripts

Android

nix-community/nix-on-droid:

host pixel
README.md

Imports:

common/system.nix

Cherry pick stuff:

gnupg
ssh
fish
git
helix/neovim
zellij
zoxide
yazi
fzf/fd/rg/sd
bottom
bat
lazygit

packages

curl
rsync
jq
gh
rust (with wasm targets)
python

tmux: CPU in Catppuccin theme

Use the fork catppuccin/tmux#89 into a patch.

Something like this:

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs }: {
    # Replace `system` with your configuration's system if necessary, e.g. "x86_64-linux".
    packages.x86_64-linux.my-package = nixpkgs.legacyPackages.x86_64-linux.stdenv.mkDerivation rec {
      name = "my-package";

      # Replace `src` and `version` with the appropriate values for the package you are modifying
      src = nixpkgs.legacyPackages.x86_64-linux.my-package.src;
      version = nixpkgs.legacyPackages.x86_64-linux.my-package.version;

      patches = [
        # Path to your custom patch
        ./my-custom.patch
      ];

      # Ensure patch is included during the build process
      prePatch = ''
        patches+=(
           ${self.inputs.someInput.somePackage}/some-patch.patch
        )
      '';
    };
  };
}

feat: add `desktop` derivation

ci: run macOS `aarch64` tests in Apple Silicon CI runner

Waiting for GitHub to make it available for public repos.
Then uncomment the job in .github/workflows/Nix.yml.

zellij

This might be a good Rust-powertool replacement for tmux closes #37.

Config

Home-manager: https://mipmip.github.io/home-manager-option-search/?query=zellij
Plugin: zjstatus:
- Load command on status bar:
  - MacOS: awk '/CPU usage/ {printf "CPU: %.2f%% ", 100 - $7} /PhysMem/ {print "RAM: " $2}' <<< "$(top -l 1 -n 0)"
  - Linux; echo "CPU LC_ALL=C top -bn1 | grep "Cpu(s)" | sed "s/., ([0-9.])% id./\1/" | awk '{print 100 - $1}'% RAM free -m | awk '/Mem:/ { printf("%3.1f%%", $3/$2100) }'"

let ... in block for the copy_command in Linux/MacOS:

copy_command "wl-copy" // wayland
copy_command "pbcopy"  // osx

keybindings
Alacritty/Foot autolaunch: zellij options --default-shell fish
Remove tmux
Update README

So far I have this:

theme "catppuccin-mocha"

// If you'd like to override the default keybindings completely, be sure to change "keybinds" to "keybinds clear-defaults=true"
keybinds clear-defaults=true {
    normal {
        bind "Alt m" { SwitchToMode "Move"; }
    }
    locked {
        bind "Alt g" { SwitchToMode "Normal"; }
    }
    resize {
        bind "Alt n" { SwitchToMode "Normal"; }
        bind "h" "Left" { Resize "Increase Left"; }
        bind "j" "Down" { Resize "Increase Down"; }
        bind "k" "Up" { Resize "Increase Up"; }
        bind "l" "Right" { Resize "Increase Right"; }
        bind "H" { Resize "Decrease Left"; }
        bind "J" { Resize "Decrease Down"; }
        bind "K" { Resize "Decrease Up"; }
        bind "L" { Resize "Decrease Right"; }
        bind "=" "+" { Resize "Increase"; }
        bind "-" { Resize "Decrease"; }
    }
    pane {
        bind "Alt p" { SwitchToMode "Normal"; }
        bind "h" "Left" { MoveFocus "Left"; }
        bind "l" "Right" { MoveFocus "Right"; }
        bind "j" "Down" { MoveFocus "Down"; }
        bind "k" "Up" { MoveFocus "Up"; }
        bind "p" { SwitchFocus; }
        bind "n" { NewPane; SwitchToMode "Normal"; }
        bind "d" { NewPane "Down"; SwitchToMode "Normal"; }
        bind "r" { NewPane "Right"; SwitchToMode "Normal"; }
        bind "x" { CloseFocus; SwitchToMode "Normal"; }
        bind "f" { ToggleFocusFullscreen; SwitchToMode "Normal"; }
        bind "z" { TogglePaneFrames; SwitchToMode "Normal"; }
        bind "w" { ToggleFloatingPanes; SwitchToMode "Normal"; }
        bind "e" { TogglePaneEmbedOrFloating; SwitchToMode "Normal"; }
        bind "c" { SwitchToMode "RenamePane"; PaneNameInput 0;}
    }
    move {
        bind "Alt m" { SwitchToMode "Normal"; }
        bind "n" "Tab" { MovePane; }
        bind "p" { MovePaneBackwards; }
        bind "h" "Left" { MovePane "Left"; }
        bind "j" "Down" { MovePane "Down"; }
        bind "k" "Up" { MovePane "Up"; }
        bind "l" "Right" { MovePane "Right"; }
    }
    tab {
        bind "Alt t" { SwitchToMode "Normal"; }
        bind "r" { SwitchToMode "RenameTab"; TabNameInput 0; }
        bind "h" "Left" "Up" "k" { GoToPreviousTab; }
        bind "l" "Right" "Down" "j" { GoToNextTab; }
        bind "n" { NewTab; SwitchToMode "Normal"; }
        bind "x" { CloseTab; SwitchToMode "Normal"; }
        bind "s" { ToggleActiveSyncTab; SwitchToMode "Normal"; }
        bind "b" { BreakPane; SwitchToMode "Normal"; }
        bind "]" { BreakPaneRight; SwitchToMode "Normal"; }
        bind "[" { BreakPaneLeft; SwitchToMode "Normal"; }
        bind "1" { GoToTab 1; SwitchToMode "Normal"; }
        bind "2" { GoToTab 2; SwitchToMode "Normal"; }
        bind "3" { GoToTab 3; SwitchToMode "Normal"; }
        bind "4" { GoToTab 4; SwitchToMode "Normal"; }
        bind "5" { GoToTab 5; SwitchToMode "Normal"; }
        bind "6" { GoToTab 6; SwitchToMode "Normal"; }
        bind "7" { GoToTab 7; SwitchToMode "Normal"; }
        bind "8" { GoToTab 8; SwitchToMode "Normal"; }
        bind "9" { GoToTab 9; SwitchToMode "Normal"; }
        bind "Tab" { ToggleTab; }
    }
    scroll {
        bind "Alt s" { SwitchToMode "Normal"; }
        bind "e" { EditScrollback; SwitchToMode "Normal"; }
        bind "s" { SwitchToMode "EnterSearch"; SearchInput 0; }
        bind "Alt c" { ScrollToBottom; SwitchToMode "Normal"; }
        bind "j" "Down" { ScrollDown; }
        bind "k" "Up" { ScrollUp; }
        bind "Alt f" "PageDown" "Right" "l" { PageScrollDown; }
        bind "Alt b" "PageUp" "Left" "h" { PageScrollUp; }
        bind "d" { HalfPageScrollDown; }
        bind "u" { HalfPageScrollUp; }
        // uncomment this and adjust key if using copy_on_select=false
        // bind "Alt c" { Copy; }
    }
    search {
        bind "Alt s" { SwitchToMode "Normal"; }
        bind "Alt c" { ScrollToBottom; SwitchToMode "Normal"; }
        bind "j" "Down" { ScrollDown; }
        bind "k" "Up" { ScrollUp; }
        bind "Alt f" "PageDown" "Right" "l" { PageScrollDown; }
        bind "Alt b" "PageUp" "Left" "h" { PageScrollUp; }
        bind "d" { HalfPageScrollDown; }
        bind "u" { HalfPageScrollUp; }
        bind "n" { Search "down"; }
        bind "p" { Search "up"; }
        bind "c" { SearchToggleOption "CaseSensitivity"; }
        bind "w" { SearchToggleOption "Wrap"; }
        bind "o" { SearchToggleOption "WholeWord"; }
    }
    entersearch {
        bind "Alt c" "Esc" { SwitchToMode "Scroll"; }
        bind "Enter" { SwitchToMode "Search"; }
    }
    renametab {
        bind "Alt c" { SwitchToMode "Normal"; }
        bind "Esc" { UndoRenameTab; SwitchToMode "Tab"; }
    }
    renamepane {
        bind "Alt c" { SwitchToMode "Normal"; }
        bind "Esc" { UndoRenamePane; SwitchToMode "Pane"; }
    }
    session {
        bind "Alt o" { SwitchToMode "Normal"; }
        bind "Alt s" { SwitchToMode "Scroll"; }
        bind "d" { Detach; }
        bind "w" {
            LaunchOrFocusPlugin "zellij:session-manager" {
                floating true
                move_to_focused_tab true
            };
            SwitchToMode "Normal"
        }
    }
    tmux {
        bind "[" { SwitchToMode "Scroll"; }
        bind "Alt b" { Write 2; SwitchToMode "Normal"; }
        bind "\"" { NewPane "Down"; SwitchToMode "Normal"; }
        bind "%" { NewPane "Right"; SwitchToMode "Normal"; }
        bind "z" { ToggleFocusFullscreen; SwitchToMode "Normal"; }
        bind "c" { NewTab; SwitchToMode "Normal"; }
        bind "," { SwitchToMode "RenameTab"; }
        bind "p" { GoToPreviousTab; SwitchToMode "Normal"; }
        bind "n" { GoToNextTab; SwitchToMode "Normal"; }
        bind "Left" { MoveFocus "Left"; SwitchToMode "Normal"; }
        bind "Right" { MoveFocus "Right"; SwitchToMode "Normal"; }
        bind "Down" { MoveFocus "Down"; SwitchToMode "Normal"; }
        bind "Up" { MoveFocus "Up"; SwitchToMode "Normal"; }
        bind "h" { MoveFocus "Left"; SwitchToMode "Normal"; }
        bind "l" { MoveFocus "Right"; SwitchToMode "Normal"; }
        bind "j" { MoveFocus "Down"; SwitchToMode "Normal"; }
        bind "k" { MoveFocus "Up"; SwitchToMode "Normal"; }
        bind "o" { FocusNextPane; }
        bind "d" { Detach; }
        bind "Space" { NextSwapLayout; }
        bind "x" { CloseFocus; SwitchToMode "Normal"; }
    }
    shared_except "locked" {
        bind "Alt g" { SwitchToMode "Locked"; }
        bind "Alt q" { Quit; }
        bind "Alt n" { NewPane; }
        bind "Alt h" "Alt Left" { MoveFocusOrTab "Left"; }
        bind "Alt l" "Alt Right" { MoveFocusOrTab "Right"; }
        bind "Alt j" "Alt Down" { MoveFocus "Down"; }
        bind "Alt k" "Alt Up" { MoveFocus "Up"; }
        bind "Alt =" "Alt +" { Resize "Increase"; }
        bind "Alt -" { Resize "Decrease"; }
        bind "Alt [" { PreviousSwapLayout; }
        bind "Alt ]" { NextSwapLayout; }
    }
    shared_except "normal" "locked" {
        bind "Enter" "Esc" { SwitchToMode "Normal"; }
    }
    shared_except "pane" "locked" {
        bind "Alt p" { SwitchToMode "Pane"; }
    }
    shared_except "resize" "locked" {
        bind "Alt n" { SwitchToMode "Resize"; }
    }
    shared_except "scroll" "locked" {
        bind "Alt s" { SwitchToMode "Scroll"; }
    }
    shared_except "session" "locked" {
        bind "Alt o" { SwitchToMode "Session"; }
    }
    shared_except "tab" "locked" {
        bind "Alt t" { SwitchToMode "Tab"; }
    }
    shared_except "move" "locked" {
        bind "Alt m" { SwitchToMode "Move"; }
    }
    shared_except "tmux" "locked" {
        bind "Alt b" { SwitchToMode "Tmux"; }
    }
}
plugins {
    tab-bar { path "tab-bar"; }
    status-bar { path "status-bar"; }
    strider { path "strider"; }
    compact-bar { path "compact-bar"; }
    session-manager { path "session-manager"; }
}
//  Send a request for a simplified ui (without arrow fonts) to plugins
//  Options:
//    - true
//    - false (Default)
//
simplified_ui true // ?

// Toggle between having pane frames around the panes
// Options:
//   - true (default)
//   - false
//
pane_frames false  // ?

Error flake does not provide attribute

Hello, It's me again. i quite confused in this step: 7. Migrate all the custom hardware-configuration.nix from /mnt/etc/nixos into /mnt/etc/nixos/flakes/linux/system.nix and /mnt/etc/nixos/flakes/linux/filesystem.nix

Following this step, I did cp /mnt/etc/nixos/hardware-configuration.nix to /mnt/etc/nixos/flakes/linux/system.nix and /mnt/etc/nixos/flakes/linux/filesystem.nix

in the photo at /mnt/etc/nixos there is

After using nixos-install --no-root-passwd --flake .#laptop ( After the error, I tried .#linux But it's still like that ).

Looking forward to your help,

feat: migrate from `cmus` to `termusic`

termusic is written in Rust, and has a lower memory footprint than cmus.

don"t have file laptop

i have clone
git clone --recursive https://github.com/storopoli/flakes.git /mnt/etc/nixos/flakes

but i don't have this file
/mnt/etc/nixos/flakes/hosts/laptop/wayland/default.nix

Can i install it after installing nixos minial ?
Sorry if I bother you. Looking forward to your and everyone's help.

feat(nixos): multiple keyboard configs

add a hypr keybind to change keyboard between "xkbVariant = "altgr-intl" and xkbVariant = "colemak".

feat(waybar): Yubikey touch detector

Add a custom waybar module that will flash if the Yubikey is asking to be touched.

Something like:

"custom/yubikey": {
    "exec": "waybar-yubikey",
    "return-type": "json"
}

using waybar-yubikey:

#!/bin/bash

socket="${XDG_RUNTIME_DIR:-/run/user/$UID}/yubikey-touch-detector.socket"

while true; do
    touch_reasons=()

    if [ ! -e "$socket" ]; then
        printf '{"text": "Waiting for YubiKey socket"}\n'
        while [ ! -e "$socket" ]; do sleep 1; done
    fi
    printf '{"text": ""}\n'

    while read -n5 cmd; do
        reason="${cmd:0:3}"

        if [ "${cmd:4:1}" = "1" ]; then
            touch_reasons+=("$reason")
        else
            for i in "${!touch_reasons[@]}"; do
                if [ "${touch_reasons[i]}" = "$reason" ]; then
                    unset 'touch_reasons[i]'
                    break
                fi
            done
        fi

        if [ "${#touch_reasons[@]}" -eq 0 ]; then
            printf '{"text": ""}\n'
        else
            tooltip="YubiKey is waiting for a touch, reasons: ${touch_reasons[@]}"
            printf '{"text": "  ", "tooltip": "%s"}\n' "$tooltip"
        fi
    done < <(nc -U "$socket")

    sleep 1
done

This depends on pkgs.yubikey-touch-detector.

Abount username and password

H-Hello, it's me again.
I've built it finished but, it's still the console.

,

And I've accessed
Use the hashed password generated by the mkpasswd {PASSWORD} -m sha-512 command to replace the value of users.users. <name>.hashedPassword in /mnt/etc/nixos/flakes/linux/default.nix (there are two places to edit)
But I don't know how to set it up ?

{ config, ... }:

{
  imports = [
    ./system.nix
    ./filesystem.nix
    ./networking.nix
    ./packages.nix
    ./bluetooth.nix
    ./fonts.nix
    ./wayland.nix
    ./hyprland.nix
    ./impermanence.nix
  ];
  users = {
    mutableUsers = false;
    users = {
      root.hashedPasswordFile = config.age.secrets.root.path;
      user = {
        hashedPasswordFile = config.age.secrets.password.path;
        isNormalUser = true;
        extraGroups =
          [ "wheel" "docker" "libvirtd" "video" "audio" "networkmanager" ];
      };
    };
  };
}

Result is i don't know user name and password.
I'm really sorry for bothering you, still looking forward to your help.
Sorry if my english is not good.

storopoli / flakes Goto Github PK

flakes's Introduction

flakes's People

Contributors

Stargazers

Watchers

Forkers

flakes's Issues

Footnotes

Imports:

packages

Config

Recommend Projects

Recommend Topics

Recommend Org