lehmanator / nix-configs Goto Github PK

View Code? Open in Web Editor NEW

4.0 3.0 0.0 4.53 MB

Personal Nix / NixOS configs

Nix 93.81% CSS 4.35% JavaScript 1.84%

nix-configs's Introduction

Nix / NixOS Configs

❄️ Welcome! ❄️

What do we have here?

Work-in-progress set of NixOS configs.
Extremely bloated flake.nix stuffed with every input flake repo I have ever come across.
Many NixOS & home-manager profiles having varying degrees of maintainence.
A couple of fully working NixOS configurations.
A living document of my learning process with Nix and the many tragedies overcome.

There's probably a lot of useful stuff here. You'll have to dig through the rest to find it.

Right now, nothing is exported with intent of external use. Eventually, that will change.

I have been going back-and-forth between using several Nix libs to organize my stuff. Still haven't decided. If you have any insight on these, lemme know:

snowfallorg/lib
divnix/std & divnix/hive
GTrunSec/omnibus
numtide/flake-parts

Planned Additions

Near-future

Start adding secrets encrypted with sops-nix.
Disko-ify my existing machines.
Secure Boot on everything via lanzaboote.
Ephemeral configs via impermanence.
Custom NixOS installer with:
- experimental-features enabled by default: nix-command, flakes, repl-flake, recursive-nix, ca-derivations.
- Disko pre-loaded. devShell to select from diskoConfigurations & format disks before install.
- Ready for full-disk-encryption & secure boot with resume from hibernate out of the box.

Configuration Types

robotnixConfigurations
nix-on-droid-Configurations
openwrtConfigurations
nixvimConfigurations
diskoConfigurations

Infrastructure

Kubernetes cluster from various machines.
Migration of my Kubernetes manifests & Helm charts to Nix
Netboot server & config images
Binary cache & remote builders
NUR repo & overlays
Terranix configs

Modules

Flakify NixOS/mobile-nixos
Genericize configuration options between Chromium & Firefox.
LDAP directory trees as Nix config.

Packages

GNOME apps missing from nixpkgs

Ideas n stuff

homeConfigurations as a composition of devShells
nixvimConfigurations but modularized like NixOS.
nixvimConfigurations but for VSCode & Helix. Possibly a conversion util. Abstract away the editor.

nix-configs's People

Contributors

Stargazers

Watchers

nix-configs's Issues

Neovim Virtual Text Changes

See:

Files

hm/profiles/editor/neovim/plugins/gitsigns.nix

Changes

Fix diagnostics moving lines down.

Position Elements

Left

Function arguments?
Diagnostic messages
Auto-completion

Right

Git changes / blame
Deleted lines in VCS

Run Nginx & serve Nix/NixOS docs

`upsd`: Enable service to monitor backup power supplies

Parent option: power.ups

Services:

power.ups.upsd
power.ups.upsmon
power.ups.apcupsd

Figure out which service best meets my needs.

Needs:

Networked UPS

GitHub Actions workflow: Run CI checks

Run on:

Pushes
Pull Requests

Run: nix flake check

Add nix flake checks to test nixosConfigurations: fw, fajita, & installer
Lint with statix
Find dead code with deadnix

Neovim Gutter Changes

Use error/warning glyphs
Git changes don't change line number color
Highlight current line number
Extend cursorline highlights into gutter
Lightbulb either in-line with code or in gutter, but not both.

`nix`: Fix Nix registry.

Problem: Unable to use nix search, nix profile install, ...

error: unable to download 'true': HTTP error 404
   response body:

   <html>
   <head><title>404 Not Found</title></head>
   <body>
   <center><h1>404 Not Found</h1></center>
   <hr><center>nginx</center>
   </body>
   </html>

Possible Causes:

Nix registry set by nixosModules from inputs: (Both enabled = conflicts?)
- flake-utils-plus
- quick-nix-registry
Extra config overriding modules by manually setting one of:
- nix.registry / nix/registry.json ({hm,nixos}/profiles/nix/registry.nix)
- nix.nixPath / ``NIX_PATH`
- environment.etc."nix/inputs"

Working Properly:

flake input dirs: /etc/nix/inputs/*

Broken:

flake input dirs: ~/.config/nix/inputs/*

`devShells`: Create composable `devShells` for environments

`devShells`

Personal

Upstream

handlr
farside
UltimateTrainingModpack

Ideas

flake-parts flakeModules?
organist?
devenvs?

`firefox` Create packages for `userChrome.css` styles.

Automatically write flake dir contents to location on system & users' homedirs.

System: environment.etc."nixos".source = inputs.self;
Home: xdg.configFile."nixos".source = inputs.self;

Also do this on the nixosConfiguration for installer images.

Configure Tailscale auth for Nginx

services.nginx.tailscaleAuth.enable

`fzf`: Fix integration with `tmux` & `zsh`

`fzf`: Create shell snippets

Many found in fzf repo: junegunn/fzf

Implementation

pkgs.writeShellApplication

Example:

fzf-ps = pkgs.writeShellApplication {
  name = "fzf-ps";
  runtimeInputs = [ 
    pkgs.fzf 
    pkgs.ps
   ];
  text = ''
    ps | fzf 
    #curl -s 'https://nixos.org' | w3m -dump -T text/html
  '';
}

`nix.conf`: Handle `access-tokens` expiring.

Problems:

When a token specified in access-tokens in nix.conf expires, updating NixOS configs to use the new token becomes a pain because nixos-rebuild wants to fetch data from the GitHub API using the expired token, which fails.
Tokens stored in secrets, so we can't read as string into Nix configs.
Tokens secrets must be prefixed with access-tokens = github.com=

Possible Solutions:

Set environment variable before running nixos-rebuild
nixos-rebuild CLI flag/option to specify one of:
- new token directly?
- nix.conf option access-tokens
- nix.conf to run command with?

Module: nixosModules.git-tokens

Specify tokens, with their expiration date
Service to periodically test access-tokens for expiration/revocation before expiration date
Command/package to update access-tokens automatically. Terranix?
Activation script to warn user of upcoming expiration

Module: flakeModules.git-repo-self

Specify upstream git repo for flake.
Specify username on git forge.
Add/use repo secrets on GitHub / git forges
Wrap nixosConfigurations with configs to use the tokens/secrets.

`firefox`: Simplify config

Make Firefox config less complex & reduce number of files config is spread across.

Goals

Minimal updating of extension package hashes/versions.
home-manager config works as standalone (on non-NixOS systems)
home-manager inherits/overrides system config.
Profiles: base (to be extended by all other profiles)
Profiles: gnome, kde that use DE-specific settings & styles.
Profiles: default (to match profile of current desktop)
Profiles: hardened (default + hardening settings that might be inconvenient to use in default profile)
Profiles: tor-browser (match Tor browser settings)

Profile Features

Default Profile

Match profile of current desktop environment.
Librewolf-like default config.
Extensions installed by default.
Disable all "Suggestions" & other annoying 3rd-party shit.
Adapt to light/dark mode.
Wayland by default.
Sidebery tree tab sidebar auto-collapse/expand.
Configure default bookmarks, search engines, settings, extensions.

Desktop-specific Profiles

UserChrome theme to match toolkit styles.
UserChrome themes for extensions to match toolkit styles.
UserChrome themes recolor according to desktop wallpaper?
UserContent themes recolor according to desktop wallpaper?
Enable nativeHostExtensions

Extensions

adnauseum | ublock-origin (ad-blocking)
behind-the-overlay-revival (click to dismiss all overlay popups that block content)
bitwarden | browserpass | gopass-bridge | keepassxc-browser | passff (password manager & autofill)
buster-captcha-solver (auto-solve captchas)
bypass-paywalls-clean | unpaywall (bypass paywalls for content)
cliget (allow using FF to login on behalf of CLI programs)
cookies-txt (export cookies for usage in other programs)
copy-selected-tabs-to-clipboard | export-tabs-urls-and-titles (tab link saving)
don-t-fuck-with-paste | re-enable-right-click (prevent sites from blocking copy/paste)
fastforwardteam (skip tracking via URL shorteners)
firemonkey | violentmonkey (userScripts)
fx_cast (Chromecast Web Sender SDK implementation for FF)
hover-zoom-plus | imagus (zoom image thumbnails)
ipfs-companion
link-gopher (Extract all links from webpage, sort, dedup, & display in new tab)
offline-qr-code-generator
omnisearch (Supercharge Firefox with commands, shortcuts, and more)
overbitewx (Open Gopher protocol in FF. Requires Floodgap Public Gopher Proxy)
profile-switcher (Create, manage, switch b/w browser profiles)
search-engines-helper
sidebery (Tree style tab sidebar)
sponsorblock
tab-counter-plus
tab-session-manager | tab-stash
wayback-machine | web-archives

Desktop Integration

ff2mpv (Play audio/video in mpv with native client)
firenvim (FF into Neovim client)
gnome-shell-integration (Use extensions.gnome.org)
gsconnect (GSConnect)
plasma-integration
pywalfox (Dynamic theming using Pywal colors)
textern (Edit text in favorite external text editor)
tridactyl (Vim in browser)
vim-vixen | vimium | vimium-c

Downloading

markdownload (Web clipper in Markdown using Turndown & Readability.js)
video-downloadhelper

Developer

enhanced-github | octotree | refined-github (GitHub QoL improvements)
laboratory-by-mozilla (Generate Content Security Policy (CSP) headers for your sites)
lovely-forks (Show GitHub forks)
penetration-testing-kit
react-devtools
reduxdevtools
rust-search-extension
sourcegraph (add code intelligence to GitHub, GitLab, ...)
vue-js-devtools
wappalyzer
widegithub

Language / Translation

immersive-translate
inkah (Lookup Chinese/Korean words)
lingq-importer2 (Auto import foreign language pages, videos, etc. from web & study w/ LingQ's web/mobile apps)
simple-translate (Translate selected text using DeepL API or Google Translate)
to-deepl

Privacy

consent-o-matic (auto dismiss consent popups & minimal acceptance)
decentraleyes | localcdn (cache CDN assets)
disable-javascript | noscript (disable JS)
libredirect (Redirect shitty services to FOSS frontend proxies)
mullvad (VPN browser extension)
multi-account-containers
open-url-in-container
privacy-pass (privacy-pass anonymous auth protocol support)
privacy-possum (Reduces / falsifies tracking data)
private-relay (Generate email address aliases that forward to your real inbox)
skip-redirect
smart-referer (limit request referer headers)
temporary-containers
terms-of-service-didnt-read
ubo-scope (Measure 3rd-party exposure)
umatrix
user-agent-string-switcher

Syncing

floccus (Bookmark sync via Nextcloud / WebDAV)
wallabagger (sync w/ wallabag)
xbrowsersync

Theming

automatic-dark | dark-mode-webextension | dark-mode-website-switcher | darkreader (dark mode)
aw-watcher-web (provide browser status, history, etc. to ActivityWatch)
stylus (custom userContent CSS styles)

Unpackaged Extensions

Missing from rycee's NUR repo.

Adaptive Tab Bar Colour
CanvasBlocker (block reading fingerprint data from canvas elements)
Privacy.com (generate unique credit card numbers)
Tab Preview on Hover

Options

NixOS Options

programs.firefox.policies
programs.firefox.preferences
programs.firefox.preferencesStatus
programs.firefox.autoConfig

home-manager Options

programs.firefox.policies
programs.firefox.profiles.<name>.extensions
programs.firefox.profiles.<name>.settings (Nix-based user.js attrs)
programs.firefox.profiles.<name>.extraConfig (Raw user.js lines)

`nix-darwin` Options

WSL Options

`README`: Add badges

Badges:

Git Repo
Matrix Chat
Issues
divnix/std
divnix/hive
zhaofengli/colmena
nix-community/nixos-generators
nix-community/disko
nix-community/home-manager
nixos/nixos-hardware
nixos/mobile-nixos
Cachix binary cache: lehmanator.cachix.org
Email
Donation

New Sections:

Contributing
Building / Bootstrap / Installation
Quirks
Security / Vulnerability reporting

Consider using `systemd-repart` & `systemd-sysupdate` to handle provisioning filesystems

May be possible to tackle:

Installer .iso images that can partition themselves.
Mobile NixOS images
Disk partitioning
Growing existing disk partitions
Create auto-expanding VM/container images?

Does mobile-nixos or disko use this on the backend? If not:

Is this work using over nix-community/disko?
Should I re-implement nix-community/disko using these tools?
systemd tool integration is desirable for compatibility.
Likely will be able to more easily adopt other systemd utils (like systemd-homed, systemd-cryptsetup, systemd-cryptenroll, systemd-sysext).
Should I re-implement NixOS/mobile-nixos using this?

Implement "discoverable partitions spec"?

GitHub Actions workflow: Release `.iso` files.

Attributes for NixOS systems: nixosConfigurations.<name>.config

Install .iso: formats.install-iso-hyperv
~~Full System: system.build.top-level~~
Fastboot image: mobile.outputs.android.android-fastboot-images
Raspberry Pi SD card: formats.sd-aarch64 & formats.sd-aarch64-installer

Requirements:

New push to main
All CI checks pass
Enough time since last release
No secrets in Nix store

`neovim`: Create standalone config

To-Do

Remove programs.nixvim prefix from all options in nixvim/neovim profiles
Call top-level nixvim config with makeNixvimConfigWithModules (or whatever the function name is`.
Import standalone config in home-manager config.
Import in devShells.*

Questions

Is it possible to wrap Neovim with Nixvim config, then later apply extra config from devShells, home-manager, or NixOS system?

GitHub Actions: Helm chart build & deploy to chart repository

`ActivityWatch`: Enable

Main server
Wayland window watcher
Vim plugin
Firefox addon

... and more.

`roles.streamer`: Create NixOS & home-manager profiles

Nixvim

Discord Rich Presence:

plugins.neocord.enable = true

home-manager

home.packages = [
  pkgs.gtkcord4
];

NixOS

Setup virtual machine
Passthrough devices (USB, GPU, displays, networks)

`neovim`: Revamp statusline config

Statusline

Using lualine.nvim with winbar & tabbar enabled.

Goals

Match zsh shell prompt.
Match readline prompt.
Match tmux status lines.
Organized similarly to VSCode.
Don't deviate too far from standard Neovim.

Considerations

What can I show in tmux statusline instead
- user@host
- path

Changes

Mode indicator: Abbreviate (only when cramped?)
Mode indicator: Sentence case (when not abbreviated)
Remove one of the top statusbars

Move Segments

VCS changes: Next to VCS branch segment
Progress: Share segment w/ cursor position (line/char x,y)
Filename & path: Top bar OR left of VCS changes / branch (matching shell prompt)

Layout

Top-Left

a:
b:
c:

Top-Middle

Top-Right

x: user@host,
y: path, filename
z: branch, changes

Bottom-Left

a: mode
b:
c:

Bottom-Middle

dianostic-messages
dianostic-count

Bottom-Right

x:
y:
z: progress, position

Convert `flake.nix` layout to use `flake-utils-plus`

gytis-ivaskevicius

Desystematizes inputs
Pass nixpkgs.config options to all nixpkgs channels
Apply overlays to all nixpkgs channels
Apply patches on a selected channel
Provides a package for nix repl on steriods.
Export all modules as attrset: i.e. {a = import ./a.nix; b = import ./b.nix; }
Export all overlays from channels as namespaced attrset instantiated w/ their nixpkgs version.
Export all packages from all overlays.
Automatically generate flake registry from inputs.
Automatically generate NIX_PATH from inputs.
Automatically symlink inputs' flake contents to /etc/nix/inputs
Import flakes inside directories of your flake inputs.
Set hostDefaults:
- system
- channelName (of nixpkgs)
- extraArgs (i.e. specialArgs of nixosSystem)
- modules
- output (flake output config goes to: i.e. nixosConfigurations/darwinConfigurations/homeConfigurations
- builder (e.g. nixos.lib.nixosSystem)

Create new `bat` theme from existing `ansi` theme

The ansi theme is the bat theme that best handles both light/dark mode in the terminal.

Adjustments:

Recolor UI elements: white -> medium-dark gray

Recolor UI Elements:

numbers - Line numbers
rule - File delimiters
grid - Lines separating sidebar & header from content

All Elements:

changes: show Git modification markers.
header: alias for 'header-filename'.
header-filename: show filenames before the content.
header-filesize: show file sizes before the content.
grid: vertical/horizontal lines to separate side bar & the header from the content.
rule: horizontal lines to delimit files.
numbers: show line numbers in the side bar.
snip: draw separation lines between distinct line ranges.

`omnibus`: Restructure config to use `omnibus` `POPs` with `hive`

Big restructure to load many things via POPs (Pure Object Prototypes) using GTrunSec/omnibus & divnix/hive

Why:

Dynamic loading of all types of -Configurations, -Profiles, -Suites, -Modules, etc.
Better isolation of configs.
Usage of cell structure of std/hive.

Goals:

Automatically pickup components by file presence.
Enable paisano TUI.
Remove path dependence of nixosProfiles, homeProfiles, etc.

TODO: Add more info to this issue.

`plymouth` Create theme

Features:

Display OS (NixOS) logo
Display progress bar (if more useful than spinner)
Display status messages (updates, etc.)
Textbox UI for disk decryption
Sexy animation
Flicker-free boot to GDM
HiDPI support
Clean UI icons for unlock, keyboard, etc.

Extra:

Display boot logs inside smaller box (instead of fullscreen without boot animation)
Display Secure Boot status
Prompt for hardware keys or fingerprint
Support mobile-nixos

`neovim`: Fix crash on clipboard paste/yank

Unique `sops-nix` secrets for each host + set of shared secrets

Figure out which secrets can/should be shared between systems.
- SSH public keys?
- SSH host public keys?
Figure out if sops-nix is a good avenue for keeping sensitive, but not secret data private. (i.e. IP addresses, hostnames, port numbers, anonymous usernames/emails, public keys, etc.)
Method to instantiate any missing secrets automatically.
- System activation script?
- Run command to generate missing files, then prompt to add them to sops-nix?
- Script to parse .yaml files for sops key names & create skeleton .yaml file for host/user/etc.
  - Ask to re-use from other host?
Method to insert secrets into strings without adding them to world-readable Nix store & possibly binary caches.
- Scalpel?
- Agenix?
- Something using Hashicorp Vault or similar?

Import `self.homeConfigurations.<name>` in `nixosConfigurations`

Import home-manager configurations by using flake outputs instead of relative paths.

homeConfigurations.<user> = homeManagerConfiguration {
  extraSpecialArgs = { inherit inputs self; user="<user>"; };
  modules = [ ./hm/users/<user> ];
};

nixosConfigurations.<host> = nixosSystem {
  specialArgs = { inherit inputs self; user="<user>";
  modules = [ 
    ({...}: { 
      home-manager.users.<user> = self.homeConfigurations.<user>; 
    }) 
  ];
};

Notes:

Is this possible?
Possible to override homeConfigurations? Would be nice to define:
- homeConfigurations."<user>"
- homeConfigurations."<user>@<host>"
- other extensions of base homeConfigurations

`bash.historyFile` does it change history file location?

Hello I just want to know that does defining the bash history file location to .local/share/bash/bash_history do change the location of the file cuz I have also defined it and and clearly see that no folder under the name "bash" in .local/share has been made and the history only shows up on the current terminal session and gets wiped after closing the terminal. Is this also an issue with you or how are you doing it? cuz I can't figure out what to do.

`flake-parts`: Add to config

Quick-n-dirty method:

Wrap flake.nix current outputs attr with flake-parts.lib.mkFlake
Move current flake outputs attrs inside flake attr of mkFlake arg attrset.
De-systematize various attrs of prior outputs one-by-one.

Use flakeModules:

inputs.devshells.flakeModule (numtide/devshells)
inputs.agenix-shell.flakeModule
inputs.treefmt-nix.flakeModule
inputs.precommit-nix.flakeModule
inputs.hercules-ci.flakeModule

To-Dos:

Migrate GITHUB_TOKEN from per-host sops-nix to agenix-shell
Create devShells.nix for Nix-based repos.
Create devShells.nixos for NixOS config repos.

`xdg`: Wrap binaries that don't follow XDG Base Dirs spec.

Problem: Many programs don't support the XDG Base Directory specification. These programs often pollute a user's $HOME directory or other directories with unwanted files that would be better placed in the appropriate XDG directories.

Solution: Many of these programs can be configured to use alternate files/directories by running the program with CLI options passed, environment variables set, or config files/options set. Wrap these programs with whatever is necessary to get these programs closer to the XDG Base Directory spec.

List of Programs

ArchLinux Wiki: XDG Base Directory: List of programs, XDG Base Directory spec support status, & configuration to make them adhere to the spec.
antidot rules
antidot CSV
xdg-ninja program/*.json files

Possibilities

Create wrapped packages with included env vars, cmdline options, and/or config files.
Overlay original packages w/ wrapped version, so no other NixOS / home-manager config is necessary.
Create new packages and set NixOS / home-manager options like program.<name>.package = pkgs.<name>-xdg-compliant (or whatever name) to use the wrapped versions while keeping the original programs.

Docs

https://nixos.wiki/wiki/Wrappers_vs._Dotfiles
https://nixos.wiki/wiki/Nix_Cookbook#Wrapping_packages
xdg-ninja package / repo / source code
antidot package / repo / source code

Nix Libs / Examples

Trivial Builders

pkgs.wrapShellScriptBin
pkgs.wrapShellScript
pkgs.runCommand
pkgs.writeText
pkgs.writeTextFile

Functions available in `pkgs.stdenv`

Example Snippets

(pkgs.writeScriptBin "htop" ''
  #! ${pkgs.bash}/bin/bash
  export HTOPRC=${pkgs.writeText "htoprc" ...}
  exec ${pkgs.htop}/bin/htop "$@"
'')

writeShellScriptBinAndSymlink = name: text: super.symlinkJoin {
  name = name;
  paths = [
    super."${name}"
    (super.writeShellScriptBin name text)
  ];
};

pkgs.writeShellScriptBin "hello" ''
  # Call hello with a traditional greeting 
  exec ${pkgs.hello}/bin/hello -t
''

pkgs.runCommand "hello" {
  buildInputs = [ pkgs.makeWrapper ];
} ''
  mkdir $out
  # Link every top-level folder from pkgs.hello to our new target
  ln -s ${pkgs.hello}/* $out
  # Except the bin folder
  rm $out/bin
  mkdir $out/bin
  # We create the bin folder ourselves and link every binary in it
  ln -s ${pkgs.hello}/bin/* $out/bin
  # Except the hello binary
  rm $out/bin/hello
  # Because we create this ourself, by creating a wrapper
  makeWrapper ${pkgs.hello}/bin/hello $out/bin/hello \
    --add-flags "-t"
''

pkgs.symlinkJoin {
  name = "hello";
  paths = [ pkgs.hello ];
  buildInputs = [ pkgs.makeWrapper ];
  postBuild = ''
    wrapProgram $out/bin/hello \
      --add-flags "-t"
  '';
}

Enable NetworkManager config to setup network.
Possible to keep SSID's secret?

lehmanator / nix-configs Goto Github PK

nix-configs's Introduction

Nix / NixOS Configs

Planned Additions

Near-future

Configuration Types

Infrastructure

Modules

Packages

Ideas n stuff

nix-configs's People

Contributors

Stargazers

Watchers

nix-configs's Issues

Neovim Virtual Text Changes

Files

Changes

Position Elements

Left

Right

Neovim Gutter Changes

devShells

Personal

Upstream

Ideas

Implementation

Goals

Profile Features

Default Profile

Desktop-specific Profiles

Extensions

Desktop Integration

Downloading

Developer

Language / Translation

Privacy

Syncing

Theming

Unpackaged Extensions

Options

NixOS Options

home-manager Options

nix-darwin Options

WSL Options

To-Do

Questions

Nixvim

home-manager

NixOS

Statusline

Goals

Considerations

Changes

Move Segments

Layout

Top-Left

Top-Middle

Top-Right

Bottom-Left

Bottom-Middle

Bottom-Right

List of Programs

Possibilities

Docs

Nix Libs / Examples

Trivial Builders

Functions available in pkgs.stdenv

Example Snippets

Recommend Projects

Recommend Topics

Recommend Org

`devShells`

`nix-darwin` Options

Functions available in `pkgs.stdenv`