Compare commits

..
1 Commits
Author SHA1 Message Date
kiri 12e05c42f8 feat: add work repo to trusted codex folders 2026-06-08 10:02:53 +02:00
145 changed files with 4406 additions and 7407 deletions

No files matched your search

-1
View File
@@ -4,4 +4,3 @@
.opencode
result
/nvim.log
+76 -18
View File
@@ -1,20 +1,78 @@
# Working in this repository
# AGENTS.md
Read [the design](docs/design.md) and [current work](docs/current-work.md) for
repository decisions and active work. [README.md](README.md) maps configuration owners
and maintenance entry points. Global instructions remain applicable.
## Purpose
- Preserve unrelated changes. Coherent local commits are allowed for agreed batches.
Do not push or make other remote changes without explicit approval. System
activation remains user-owned.
- Do not read secret values for discovery, source the workbench credential-loading
environment, or access live company systems with write authority. Test writes need
task-specific authority. Moving credentials or synchronizing company content
requires agreement; ordinary repository work does not authorize either.
- Do not write or run tests or perform extensive validation unless explicitly
requested. For routine changes, use a focused review or small manual check.
- Run `just validate` only when explicitly requested. Read its short result first;
inspect saved logs only for failures or a concrete unresolved concern.
- Replace superseded state in `docs/current-work.md`; keep durable rationale in
`docs/design.md` and operational detail beside its owner. Use Git for chronology.
Remove temporary state when it no longer serves a purpose.
This repo uses the Dendritic Pattern with `flake-parts`.
Design and change the configuration as a composition of **features**, not as a host-first tree.
For deeper design rationale and pattern descriptions, refer to `.agents/dendritic-design-with-flake-parts.wiki`.
## Core Terms
- **Feature**: a flake-parts module under `modules/` that defines one coherent concern.
- **Aspect**: a reusable module published at `flake.modules.<module class>.<aspect name>`.
- **Module class**: the configuration context of an aspect. This repo primarily uses `nixos` and `homeManager`.
- **Feature module**: the flake-parts module that defines aspects, flake outputs, options, or shared helpers.
In this repo, `flake.nix` imports `./modules` recursively via `inputs.import-tree`. Any non-private `.nix` file under `modules/` is therefore treated as a feature module.
## Design Principles
- Work bottom-up. Define features first; assemble hosts from features.
- Keep semantic ownership local. A feature should contain the configuration for that concern across all relevant module classes.
- Name aspects semantically. The aspect name should usually match the file or directory name that defines it.
- Prefer small, composable aspects. Build larger configurations with `imports`.
- Import aspects unconditionally and only within the same module class.
- Put conditions inside module content with `lib.mkIf` or `lib.mkMerge`, never around `imports`.
- Avoid importing the same aspect multiple times along one import path.
- Keep private helper files next to the feature that uses them and prefix them with `_` so `import-tree` does not import them as feature modules.
- Put shared schemas and constructors in dedicated shared modules, not ad hoc host files.
## Repo Structure
- `modules/capabilities/`: reusable leaf capability features and most aspect definitions.
- `modules/capabilities/services/`: reusable service capabilities, especially hosted daemons and network services.
- `modules/profiles/`: bundle features that assemble capabilities into larger profiles such as `host-base` and `workstation-base`.
- `modules/hosts/<name>/default.nix`: host features that assemble NixOS aspects into `flake.modules.nixos.<name>`.
- `modules/secrets/`: secret-related features shared by hosts.
- `modules/flake-parts.nix`: flake-parts entrypoint; defines systems, formatter, and `flake.nixosConfigurations`.
- `modules/lib/`: shared schemas, constructors, and helpers exposed through `repo.helpers`, especially `mkHost` and `mkCaddyReverseProxy`.
- `modules/data.nix`: canonical shared repo data, including the single `repo.account`, machine inventory, desktop preferences, services, and theme data.
- `modules/lib/schema.nix`: shared metadata schema for `repo.*` and NixOS `meta.machine`.
## How Features Are Applied Here
- Reusable NixOS concerns are published as `flake.modules.nixos.<name>`.
- Reusable Home Manager concerns are published as `flake.modules.homeManager.<name>`.
- Hosts are aspects too. `orion`, `polaris`, and `zenith` are `nixos` aspects assembled from smaller aspects.
- `flake.nixosConfigurations` instantiates every entry in `repo.machines` with `config.repo.helpers.mkHost`.
- Hosts define machine data under `repo.machines.<name>` and host-specific NixOS composition under `flake.modules.nixos.<name>`.
- `mkHost` wires the single `repo.account` into `users.users.<name>` and `home-manager.users.<name>`.
- NixOS modules may read `config.meta.machine`; Home Manager modules should read host facts through `osConfig.meta.machine` and user facts through `config.home` or `repo.account`.
## Preferred Aspect Patterns
- **Simple Aspect**: use for one self-contained concern in one or more module classes.
- **Multi Context Aspect**: use when one concern must configure both `nixos` and `homeManager`.
- **Inheritance Aspect**: use by importing a parent aspect and extending it.
- **Conditional Aspect**: use `lib.mkMerge` plus `lib.mkIf` for conditional content.
Use **Collector Aspect** only when composition through imports or shared library helpers is insufficient.
## Change Rules
- When adding a reusable leaf feature, add or extend aspects under `modules/capabilities/` and let profiles or hosts opt into them explicitly.
- When adding a hosted service or network daemon feature, prefer `modules/capabilities/services/`.
- When adding a bundle of existing capabilities, put it under `modules/profiles/`.
- When adding a host, create `modules/hosts/<name>/default.nix` and keep host-local generated files private as `_hardware.nix`, `_disk.nix`, or similar.
- When a feature needs local data or helper code, keep it inside that feature directory and prefix non-feature files with `_` when they live under `modules/`.
- Do not place arbitrary non-feature `.nix` files under `modules/` unless they are intentionally private and excluded from recursive import.
- If a concern is shared across hosts, it belongs in a reusable feature, not inline in one host unless it is truly host-specific.
## Practical Heuristics
- If you are about to edit a host because of a reusable concern, that concern probably wants its own feature.
- If a Home Manager module needs host facts, prefer `osConfig.meta.machine`; for user facts, prefer `config.home` or `repo.account` instead of duplicating literals.
- If a concern spans system and user space, keep both aspects in one feature so the behavior stays coherent.
- If imports would need to be conditional, redesign the aspect boundary instead.
+13
View File
@@ -0,0 +1,13 @@
# Notes
## 16-04
- See if pinentry should be a variable and how pure ssh (no gpg anymore) handles pinentry.
- Reconsider placement and existence of system-base.nix
- Implement system-wide theming system
- Do we need separate stateVersions per host?
- pinentry.nix should not set programs consuming it explicitly, should probably be host-level concern or smoething.
- Primary email schema validation should not be located inside aspects like git.nix but somewhere in the schema definition probably
- assertions are defined, not sure if that actually does anything.
Code style related todos:
Consistent rules/guidelines for function or attribute set at root of aspect file.
When to nest sets and when to set directly (podman.nix).
-97
View File
@@ -1,97 +0,0 @@
# NixOS configuration
One shared daily environment on Polaris and Zenith, with shared services on Orion.
NixOS and Home Manager are composed through flake-parts and import-tree.
## Start here
- [Design](docs/design.md): vocabulary, ownership and coding conventions.
- [Agent instructions](AGENTS.md): essential collaboration boundaries.
- [Current work](docs/current-work.md): implementation state, pending decisions and
remaining acceptance checks.
## Configuration map
| Owner | Location | Responsibility |
| --- | --- | --- |
| Hosts | `modules/hosts/<host>/` | Identity, hardware, machine-specific selection |
| Profiles | `modules/profiles/` | Combinations of capabilities |
| Capabilities | `modules/capabilities/` | Behavior and NixOS/Home Manager integration |
| Facts | `modules/facts.nix` | Shared identity/topology; host facts live with hosts |
| Composition | `flake.nix`, `modules/flake-parts.nix` | Inputs, discovery, host construction |
| Secrets | `modules/secrets/` | SOPS declarations and encrypted documents |
Discovery makes named modules available; imports select them. Flat owners use
`name.nix` or `name/default.nix`. Private Nix helpers live under `_support/`, excluded
from discovery. Scripts, assets and operational notes stay beside their owner.
Select shared behavior through profiles; keep machine differences in hosts.
The primary editor is selected in `host-base.nix`, the terminal in
`workstation-base.nix`. `capabilities/theme/default.nix` selects Kanagawa;
application appearance lives in `theme/_support/`, interaction with capabilities.
Both workstations import the provisional `work` profile. See
[workbench setup](modules/capabilities/workbench/README.md) for native devenv,
company credentials and always-available read-only mounts. Only company-root and
workbench environments are migrated; product/personal projects remain user-owned.
Orion's wardrobe service has its own
[setup and operations guide](modules/capabilities/wardrowbe/README.md).
Provision its SOPS secrets and two DNS records before building or activating Orion.
## Maintenance
```console
just validate # format, evaluate, build all hosts and workbench tools
just validate polaris # same workflow, build only the named host(s)
nix flake update # update inputs; selective input updates are also supported
```
Validation copies current tracked and nonignored new files into a temporary snapshot,
respecting deletions and leaving the Git index untouched. It formats included Nix
files in the working tree, refreshes the snapshot, prepares devenv's upstream
evaluation dependencies, evaluates configurations and builds. Avoid concurrent edits:
results describe that snapshot. Ordinary Git-backed flake commands outside the
wrapper still require new source files to be added to Git.
Read the short result first. Full logs live in the printed `/tmp/nixos-validate-*`
directory. Failure stops the command; snapshots are removed on exit. It neither
updates inputs nor creates result links or activates systems. The implementation is
`scripts/validate.py`; `just` and Python are installed on both workstations.
Run targeted host builds or full validation only when explicitly requested. Routine
changes need a focused review or small manual check. Build, activation and
interactive behavior are separate evidence.
User-owned activation:
```console
nh os switch
nixos-rebuild switch --target-host orion --sudo --flake ~/.config/nixos
```
Edit system ciphertext with `sops edit modules/secrets/secrets.yaml`; company
provisioning is documented with workbench. Never put plaintext secrets in Nix.
## First-use acceptance
- **Notes:** Super+N and Walker's Notes open the same picker. Enter opens a note;
Ctrl+E creates one using the search text. Daily-note commands remain available.
- **Orientation:** Super+Shift+N names the focused workspace; submit an empty name
to clear it. Named empty workspaces persist until cleared. Noctalia shows labels;
terminal titles include the working directory and command.
- **Icons/vault:** check Oil from Walker and Nautilus device/symbolic icons. Check
Walker's `?` vault provider; upstream Elephant may query `rbw` during startup.
- **Calendar:** in Noctalia Settings → Services → Calendar, set the Radicale
password through the existing Personal account (GNOME Keyring). Add an ICS account
named Work using Outlook's published URL. Keep this URL in writable Noctalia
settings, outside this repository. Check both agendas; edit work events in Outlook.
- **Tailnet:** run `sudo tailscale up` on each machine and enroll the phone with
the Tailscale app. Keep Tailscale SSH disabled; use ordinary SSH keys. With
MagicDNS enabled, verify `ssh kiri@orion.<tailnet-name>.ts.net` from a workstation.
Existing `ssh orion` still uses the public address until the private route is
accepted. Close public Orion SSH only in the subsequent verified transition.
No systems have been activated as part of this implementation. Old SharePoint
mirror content, experimental AI data and unrelated workspace changes are preserved.
Historical material under `docs/.archive/` is evidence, not current authority.
@@ -1,116 +0,0 @@
# Yookr credential consolidation
Archived: historical credential inventory and migration evidence.
This inventory contains names and provenance only. It intentionally contains no
credential values or value hashes.
## Authority
Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved
this authority and an active-credentials-first migration. The directory is mode
0700 and the encrypted file is mode 0600; it remains outside Git and the Nix
store.
Keep the document hierarchical so operators can inspect and edit everything in
one place while callers extract only their own scalar values or subtree. Do not
load the complete document into every repository environment. Public endpoints,
queue names, bucket names, and other non-secret configuration remain with their
normal owners.
Top-level groups:
- `company_login`
- `databases`
- `leafcloud`
- `rabbitmq`
- `applications`
- `archive`
Active credentials and ten archived credential sources have been migrated.
Archive membership does not imply inactivity, so their source namespaces are
preserved. Delete redundant plaintext only with explicit approval after each
original consumer is verified.
## Active sources
- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and
logger credentials.
- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by
frontend source and is therefore client-visible, not a protectable secret.
- `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
- `~/rabbitmq-creds-test`: test RabbitMQ username and password.
- `~/irristaud-openstack-creds`: Irristaud project EC2 credentials.
- `~/db-creds`: MySQL test/live and MongoDB test/live material.
- `~/dev/work/yookr-api/http-client.private.env.json`: company email and
password used for API logins.
- `~/.local/share/db_ui/connections.json`: existing `traceability` connection.
All credential-bearing active files above are mode 0600 after the audit.
They remain in place pending consumer-by-consumer removal approval. The dashboard
backend's MySQL and MongoDB credentials do not match either named test/live pair,
so they are preserved separately instead of being assigned an environment by
assumption.
## Archived credential sources
- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and
`prediction_mildew_rust`.
- Rules service: RabbitMQ and database credentials in `rules-service-hex`.
- Legacy management: database, logger, and local-login credentials.
- Legacy data science and soil-moisture tools: company login credentials.
- `salemans`: CMI credentials.
These files are now mode 0600 and their selected credentials are preserved under
`archive`. The user is still cleaning the filesystem, so stale status must be
decided per source; stale credentials should be revoked instead of retained
indefinitely.
## Verified consumers
- `yookr-workbench` decrypts once in memory and exports only its API login, four
database connections, Irristaud S3 credential, and test RabbitMQ credential.
- Central test API login and the read-only RabbitMQ overview passed.
- MariaDB test/live example queries and MongoDB test/live example scripts passed.
Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated
certificates from unavailable private CAs without valid host identities, so
only these two URLs disable certificate verification. The MongoDB endpoints
publish SRV rather than direct address records and therefore use `mongodb+srv`
URLs.
- The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
and listed its six root entries. No object content was downloaded and no
rclone configuration was persisted.
Dadbod's four display names are active, both MongoDB connections work, both
MariaDB examples produce results through Dadbod UI, and the workbench environment
supplies successful Kulala response chaining.
## Excluded from migration
- Tracked `.env.example` files and public URL-only frontend environments.
- Tracked Apache Superset/Hive development defaults.
- Empty placeholders, queue names, ports, bucket names, and service URLs.
- NixOS SOPS secrets and personal Vaultwarden entries, which already have their
own authorities.
## Observed services
The scan identified Yookr measurement, authentication, management, aggregation,
rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB,
RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and
Hive integrations. Presence in an archive does not establish that a service or
credential is still active.
## Immediate findings
- The dashboard S3 credential and the Irristaud project credential are distinct;
the latter is now centralized and its read-only pilot passed.
- The generated Yookr OpenAPI document remains malformed, but direct requests use
the reviewed local contract and work independently.
- Management accepts an account-issued JWT only as the raw `Authorization` value,
contrary to its current OpenAPI Bearer declaration.
- The Herdr issue 197 pilot produced local-only frontend and backend planning
commits without touching company GitHub. Both identify the separate account
service, not `yookr-dashboard`, as the implementation owner.
File diff suppressed because it is too large. Load diff
-190
View File
@@ -1,190 +0,0 @@
# Workflow system execution
Archived: historical implementation evidence, not the current iteration plan.
Source: [`../workflow-discovery.md`](../workflow-discovery.md)
Phase one is complete; explicitly deferred pilots remain. This file is the
living handoff for operational constraints and future work; implementation
history is available in Git.
## Activation boundary
Only the user may switch or activate configurations. Agents must not run
`nixos-rebuild switch`, Home Manager activation, or an equivalent command that
changes the active generation. Evaluation and builds are allowed; after a
successful build, provide the exact activation command and wait for the user.
This boundary includes changes described as user-level, harmless, temporary, or
necessary for live verification. A direct Home Manager activation previously
restarted Kitty and closed the user's terminal session.
## Execution discipline
- Advance all safe independent work before asking the user to act.
- Batch declarative changes behind user-controlled activation.
- Consolidate empirical, credential, hardware, and approval gates only after no
autonomous work remains.
- Keep repositories and worktrees outside `~/sync`; synchronize authored
artifacts instead.
- Keep GitHub and other repository remotes strictly read-only.
- Treat Yookr production source as read-only. Dev-tooling changes are allowed;
`yookr-workbench` is the only repository whose own source may be changed for
these pilots.
## Current checkpoint
- State: phase one complete and active; explicitly deferred pilots remain.
- Branch: `chore/workflow-system`.
- Validation: `nix flake check --no-build --quiet`, all three no-link system
builds, generated Zenith and Polaris Niri validation, and all six companion
flake evaluations passed on 2026-09-06. The updated data-science shell exposes
Python 3.14.7 and its full project check passes. The expected dirty-tree and
unknown `modules` warnings were emitted.
- Live state: Walker project and terminal actions, daily notes, stable web apps,
Evolution D-Bus activation, the Zenith VPN, invocation-scoped GitHub and
Context7 credentials, Pinta, and Orion transcription passed their completed
pilots. The corrected Actual, WhatsApp, and Outlook launchers all started
successfully. The labeled RabbitMQ test/live bookmarks are present, and the
invocation-scoped test overview and queue listing passed. Test API login,
Yookr administrator read, rules read, aggregation login, and management health
passed. Account login plus a raw-token management user read also passed.
The approved user-key SOPS authority now contains active credentials and ten
provenance-preserving archive namespaces. Its workbench exports passed a test
API login, RabbitMQ overview, MySQL test/live `SELECT 1`, MongoDB test/live
`ping`, and read-only Irristaud object-storage listing. Dadbod exposes all four
names and the MongoDB connections work. Both MariaDB connections now use the
native client with narrowly scoped certificate-verification exceptions; their
exact example queries passed over TLS 1.3 in both environments. Direct test
login and authenticated reads still return HTTP 200 for Yookr, rules, and
management. Kulala login and response chaining are confirmed in Neovim, and
both MariaDB examples produced results through Dadbod UI.
- Herdr ran the issue 197 planning pilot in two predictable, non-overlapping
dashboard worktrees. Codex produced frontend commit `20f9d0f`; Claude produced
backend commit `bd965ea`. Short, long, done, fallback-agent, and genuinely
approval-blocked states behaved correctly, and dirty worktree removal was
refused. Nothing reached company GitHub. Both plans found that password reset
belongs to the separate account service rather than `yookr-dashboard`.
Documented named-session detach/reattach persistence is accepted without a
redundant live trial; notifications are intentionally disabled after their
live pilot.
## Phase-one closure
- The cross-system investigation and Marimo report pilots move into phase two.
- Bruno and DBeaver remain available; retiring old applications is not part of
phase one.
- Issue 197 planning is complete. Before implementation, route it to the actual
account repositories; leave the two local dashboard planning branches
available as evidence.
Herdr's bounded pilot is complete. If later use exposes a problem, fall back
independently to native agent sessions or native `git worktree add/list/remove`;
do not add a wrapper or Worktrunk without a demonstrated gap.
## Deferred pilots
Revisit these alongside related phase-two ideas rather than as isolated cleanup.
- During a docked Zenith session, capture the external display's stable identity
and test the two-output `Super+A` exchange. The current recorded session exposed
only `eDP-1`.
- Resume Evolution only when the user chooses to configure the personal,
old-personal, university, work, and Radicale accounts. Keep Thunderbird and
Outlook until the daily-use gate passes.
- On Android, complete the DAVx5/Radicale and Tasks.org pilots, including default
accounts, recurrence, reminders, and Microsoft To Do within documented limits.
- Do not replicate the workstation workflow on Polaris until the user resumes
the procedure below.
The Niri pilot is two-output-only. It passes when the active workspaces exchange
physical outputs, both arrivals are active, original names are preserved, and
focus returns to the original physical output. Any temporary names must be
collision-free and restored on success or failure; missing output or workspace
state must leave the session unchanged. Keep the helper only after repeated
reliable swaps with an acceptable visible transition.
## Deferred Polaris replication
Do not access or test Polaris unless the user resumes this deferred replication.
Zenith's result remains representative meanwhile.
1. Activate this NixOS configuration so `networkmanager-openvpn` is installed.
2. Restrict `~/sync/yookr-vpn.ovpn` to mode 0600.
3. Import it with `nmcli connection import type openvpn file ~/sync/yookr-vpn.ovpn`.
4. Rename the connection to `Yookr VPN`, disable autoconnect, and add
`data-ciphers=AES-256-CBC`.
5. Connect with `nmcli connection up "Yookr VPN"`.
6. Create mode-0600 `~/.config/yookr/github-read-only.token` without a trailing
newline, then verify a new shell can run
`gh project list --owner yookrdev`.
7. Create mode-0600 `~/.config/context7/api-key` without a trailing newline,
restart Codex after activation, and run one Context7 lookup.
Replication passes only when the VPN has the expected route and DNS behavior,
reaches a test service, reconnects after disconnect and suspend, and survives a
reboot without autoconnecting. The two credential files must remain mode 0600;
the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
## Durable implementation decisions
- Active work repositories live under `~/dev/work`, archives under `.archive`,
and worktrees under `.worktrees`. Repository trees never enter Syncthing.
- Participating repositories expose non-mutating direnv shells, minimal flake
checks, native commands through `just`, concise `AGENTS.md`, and machine-local
credential inputs.
- `yookr-data-science/conf/local/credentials.yml` is an approved narrow
application-owned exception to the external credential-file default: Kedro's
named credential dataset resolves it from the native ignored `conf/local`
hierarchy. Keep it untracked and mode 0600.
- `yookr-data-science` follows ordinary `nixos-unstable`, like the other
companion repositories; it needs no `devenv-nixpkgs` compatibility input.
- `yookr-workbench` starts with cross-system work only; isolation and additional
tools wait for observed needs. Its one API environment catalogue covers the
Yookr, rules, aggregation, and management APIs; Kulala owns requests and
Dadbod receives the four named database connections from the workbench's
SOPS-derived environment. The two MariaDB routers expose auto-generated
private-CA certificates without a valid host identity, so only those URLs
disable certificate verification while retaining TLS; restore verification
when infrastructure provides usable CA and host certificates.
- The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The
deployed generated document's dangling `ReadParameters` reference is accepted
for now and does not block direct API requests.
- Walker's native Elephant menu scans repository roots and calls one Nix-owned
`open-project` command. Rare menu changes take effect at login.
- Home Manager declares the three stable Vivaldi launcher paths with forced
ownership. Vivaldi's manual `Create shortcuts` action can replace one until a
changed Home Manager generation reclaims it; repeating a no-op activation need
not relink it. This accepted edge case does not justify filtering, immutable
files, or a watcher because that action is not part of normal use.
- Kitty and Neovim are the sole declared terminal and editor. Retired duplicate
applications and global language runtimes stay absent unless a concrete owner
appears.
- The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local
files and are exposed only to their callers. Secrets do not enter Nix or broad
process environments.
- The credential audit and approved central SOPS authority are in
[`credential-consolidation.md`](credential-consolidation.md). The authority is
active, while original plaintext sources remain pending consumer-specific
verification and explicit removal approval.
- `sync/notes` is the single notebook owner. Daily notes, meetings, and raw
transcripts have separate paths, and agents do not create issues or ingest
transcripts automatically.
- Orion is the sole transcription owner. It waits for file settlement, validates
media, archives originals, and publishes an unlabeled transcript when
diarization fails.
- Evolution remains a deferred presentation-layer pilot. Microsoft 365 and
Radicale remain the data authorities; Thunderbird and Outlook remain available.
- GitHub and every other repository remote stay read-only. Local files, commits,
fetches, clones, and worktrees remain available.
- The provisional team chain is Project Overview project → work package → user
requirement → Software Development Backlog ticket → repository issue → one
pull request. Treat it as discovery context, not automation policy, until the
team settles the workflow; company GitHub remains read-only throughout.
- Yookr production source stays read-only during workflow pilots. Changes to
development tooling are allowed, and `yookr-workbench` remains the explicit
source-code exception.
## Next step
Begin phase-two discovery from the user's new workflow ideas.
-70
View File
@@ -1,70 +0,0 @@
# SharePoint reference mirror
Archived: guidance for the existing implementation, not a new design decision.
Superseded: this describes the earlier single-source, environment-file-gated
implementation. The current [working state](../constellation-work.md) records two
fixed library mirrors gated only by the presence of `rclone.conf`. Do not use the
setup procedure below as current operational guidance.
The Zenith user timer mirrors one selected company SharePoint document library
into `~/.local/share/yookr-reference/sharepoint` hourly. SharePoint is
authoritative: remote updates overwrite local files and remote deletions remove
local files. Never author files there; edit them in SharePoint's web UI. The job
stops before more than 100 local deletions and reports the failure in the user
journal. A failed run may leave earlier updates in place and is not evidence of a
complete current snapshot; rclone does not delete destination files when the run
has errors.
The timer remains inert until both `~/.config/rclone/rclone.conf` and
`~/.config/rclone/sharepoint-reference.env` exist and the latter names a source.
Before adding the SharePoint remote or source file, the user must explicitly
start the interactive company sign-in and consent step. Use only delegated,
cloud-read-only scopes:
`Files.Read Files.Read.All Sites.Read.All offline_access`. Do not accept rclone's
broader default scopes or create an application registration. Tenant policy may
require administrator consent or an approved single-tenant application; involve
the administrator only if the consent response requires it.
After approval, run `rclone config`, choose Microsoft OneDrive, set the advanced
`access_scopes` value above, and select one company SharePoint document library
(not a personal account). Before enabling the job, inspect and accept its exact
scope, footprint, and first change set:
```console
rclone config redacted company-sharepoint
rclone lsd company-sharepoint:
rclone size company-sharepoint:
rclone sync company-sharepoint: ~/.local/share/yookr-reference/sharepoint --dry-run --max-delete 100
```
The remote-scoped redacted output confirms the configured requested scopes, not
what the tenant actually granted. Confirm the consent response also contains only
the requested read scopes; stop if it denies them or offers broader authority.
Only after that preview is accepted, create the gate with mode `0600`:
```text
RCLONE_SHAREPOINT_SOURCE=company-sharepoint:
```
Save it as `~/.config/rclone/sharepoint-reference.env`. Home Manager activation
then enables the hourly timer. This is the first bounded library, not a permanent
allowlist or a claim that all accessible SharePoint content is mirrored. Add
another library only after its own size/preview check, using another native unit
and dedicated destination rather than widening this source silently. Refresh and
inspect the current unit with:
```console
systemctl --user start sharepoint-reference-sync.service
systemctl --user status sharepoint-reference-sync.service
journalctl --user -u sharepoint-reference-sync.service
```
For an accepted deletion set larger than 100 files, rerun the dry-run and then a
manual `rclone sync` without `--max-delete`; the scheduled guard stays in place.
The mutable OAuth token remains in rclone's config outside the Nix store. The
local directory is user-writable and its read-only consumer policy is not an OS
permission or credential-isolation boundary. New mirror files are private to the
user by default (`UMask=0077`), but same-user processes can still read and change
them.
-220
View File
@@ -1,220 +0,0 @@
# Workflow system blueprint
Status: phase one implemented and active; explicitly deferred pilots remain.
The operational handoff lives in
[`plans/workflow-system.md`](plans/workflow-system.md).
This document is the durable design for the workstation and surrounding Yookr
workflow. Implementation history belongs in Git.
## Governing intent
Build a quiet, keyboard-first control plane over development, investigation,
operations, agents, and personal knowledge. Keep the system small and give each
intention one canonical owner.
- Standardize vocabulary and entry points without forcing unlike workloads onto
one implementation.
- Put frequent actions on direct keys and less frequent actions on their owning
discovery surface.
- Keep stable packages, services, integration, and durable preferences in Nix.
Keep credentials, sessions, databases, caches, and other mutable state with
their owning application.
- Prefer native file formats and supported application layers. Add wrappers only
for demonstrated gaps.
- Repositories own reproducible development context, executable project
documentation, and code-specific artifacts.
- Select `local`, `test`, or `live` per operation; do not depend on an ambient
production context.
- Make production and destructive actions more deliberate than navigation and
read-only inspection.
- Promote automation only after the manual workflow repeats and can be verified.
- Optimize conceptual complexity and review burden, not package count or line
count in isolation.
The main coordinates are scope (`work`, `own`, `ext`, or `forks`), Yookr domain,
environment (`local`, `test`, or `live`), and intention (develop, inspect, query,
review, operate, or deploy).
## Ownership model
<!-- markdownlint-disable MD013 -->
| Intention | Canonical owner |
| --- | --- |
| Find applications, projects, or windows | Walker/Elephant and direct Niri bindings |
| Search personal passwords | Walker with `rbw`; company Bitwarden stays in its browser extension |
| Navigate browser state | Vivaldi Quick Commands |
| Arrange windows and displays | Niri dynamic workspaces |
| Work in a terminal | Kitty |
| Edit related files and views | Neovim |
| Enter a repository environment | `direnv` with `nix-direnv` |
| Discover project actions | `just --list` |
| Run edited first-party code | Native processes, optionally Process Compose |
| Run a container-only project stack | Rootless Podman Compose |
| Run a persistent containerized user service | Rootless Podman Quadlet |
| Run a durable host service | NixOS modules and systemd |
| Exercise APIs | Kulala and `xh`, with tracked `.http` files |
| Query databases | Dadbod and native driver CLIs |
| Investigate across Yookr systems | `yookr-workbench` |
| Connect the Yookr VPN | NetworkManager/OpenVPN through Noctalia |
| Inspect test Kubernetes | `just k8s test` using Gardenctl and read-only K9s |
| Inspect RabbitMQ | Official management UI; `rabbitmqadmin` for exact terminal operations |
| Browse S3-compatible storage | Native `rclone` commands |
| Capture and find notes | `zk` through Neovim in one synchronized Markdown notebook |
| Present work and personal PIM | Evolution pilot beside Thunderbird and Outlook |
| Present personal PIM on Android | DAVx5, aCalendar+, Google Contacts, and Tasks.org |
| Give agents durable project context | `AGENTS.md` and project commands |
| Run top-level agents | Herdr on demand |
| Maintain conversation state and subagents | Each native agent, primarily Codex |
| Review local changes | LazyGit in the task checkout |
| Review pull requests | `gh`, then a review worktree when local checks are useful |
<!-- markdownlint-enable MD013 -->
## Repository contract
Active work repositories live under `~/dev/work`; inactive repositories live
under `~/dev/work/.archive`, and worktrees under `~/dev/work/.worktrees`.
Repositories and worktrees never live under `~/sync`.
Participating repositories use the following small contract:
- A tracked `.envrc` enters the default flake development shell without starting
services, fetching data, or mutating the checkout.
- `flake.nix` owns reproducible dependencies, checks, packages, and formatting.
- `just --list` indexes non-obvious tasks and delegates to native commands.
- `AGENTS.md` contains concise project facts, invariants, architecture pointers,
and checks without duplicating global guidance.
- Service-owned `.http` and schema-owned `.sql` files stay beside their owner;
generated views, caches, and scratch output do not become durable sources.
- Secrets enter at runtime from an approved source or a user-only file outside
checkouts, initially `~/.config/yookr/<repository>.env`.
- A new worktree behaves like a fresh clone and requires its own explicit
`direnv allow`.
- Branch-derived ports, databases, and container names are added only after a
real collision.
Use Process Compose only when multiple foreground processes benefit from one
visible lifecycle. Use Podman Compose for wholly containerized project stacks,
Quadlet for persistent user containers, and NixOS modules for durable host
services. Do not nest lifecycle tools for another status screen.
`yookr-workbench` owns cross-system API requests, operational queries, the
Garden/Kubernetes entry point, and Marimo investigations. It does not collect
service OpenAPI specifications, schema migrations, deployable model code, or
copied application state.
## Interaction and knowledge boundaries
- Walker scans the four repository roots, excludes `.archive` and `.worktrees`,
and invokes one Nix-owned `open-project` command. The command opens Kitty at
the repository root, starts Neovim, and leaves a shell after Neovim exits.
- Vivaldi remains the bookmark and web-app authority. Home Manager declares
stable launchers for Actual, WhatsApp, and Outlook without duplicating browser
state and reclaims their paths when a changed Home Manager generation is
deployed. Manual shortcut regeneration may replace one meanwhile and is an
accepted unused edge case. Its
`Operations` folder owns visibly labeled test/live RabbitMQ bookmarks; terminal
inspection uses the Nix-provided `rabbitmqadmin-ng` on demand.
- Niri keeps dynamic general-purpose workspaces and a compact navigation and
movement vocabulary. The two-output active-workspace exchange remains a
bounded pilot.
- Codex is primary; Claude Code and Pi are fallbacks. Herdr owns persistence and
attention for top-level sessions, while each agent owns its internal state.
- Use one primary writer per checkout. Subagents may perform bounded independent
read-heavy work, but overlapping changes are sequenced.
- Substantial multi-session work may keep one living
`docs/plans/<task-slug>.md`; lasting knowledge moves to normal documentation
and transient execution history is removed when finished.
- `~/sync/notes` is the Markdown/zk authority. Daily intake uses
`daily/YYYY-MM-DD.md`; planned meetings and raw transcripts use `meetings/`
and `transcripts/` respectively.
- Microsoft 365 remains authoritative for work/university PIM and Radicale for
personal CalDAV, VTODO, and CardDAV. Clients present those authorities without
bridging or copying them.
- Fossify records on Android and Syncthing delivers completed recordings to
Orion. Orion owns event-driven CPU transcription, diarization fallback,
archival, and Markdown publication.
## Safety boundaries
GitHub and all other remotes are read-only. Local commits, clones, fetches, and
worktrees are allowed; remote mutation requires a separate change to policy.
Yookr production source is also read-only during these pilots. Development
tooling may be changed, and `yookr-workbench` is the explicit source-code
exception.
Credentials and `.env` files normally stay outside Git, the Nix store, and broad
synchronization. Machine-local Yookr credentials use the approved user-key SOPS
authority at `~/.config/yookr/credentials.yaml`; callers expose only the fields
they need. Original plaintext sources remain until their consumers are verified
and removal is explicitly approved. The accepted `yookr-vpn.ovpn` is a narrow
exception for Zenith and Polaris: keep it user-restricted and import it into
NetworkManager without printing or committing its contents.
`yookr-data-science/conf/local/credentials.yml` is a separate application-owned
exception: Kedro resolves its named credential dataset through the conventional
ignored `conf/local` hierarchy. Keep the file untracked and mode 0600; do not
generalize the exception to other repositories.
Only the user activates a NixOS or Home Manager generation. Agents may evaluate
and build configurations, then provide an activation command.
## Phase-one closure
- The workbench environment, all four SOPS-derived Dadbod connections, read-only
example-query runs, and Kulala response chaining passed. The cross-system
investigation and Marimo report pilots move into phase two.
- Add another ephemeral read-only rclone remote only when credentials for a new
Leafcloud project become available. Irristaud listing has passed; do not upload.
- Use the reviewed local Yookr OpenAPI contract while the accepted malformed
generated test document remains deployed.
- Herdr's bounded issue 197 pilot is complete. Documented named-session
detach/reattach persistence is accepted without a redundant live trial, and
notifications are intentionally disabled. Codex/Claude fallback, attention
states, local branches, parallel non-overlapping plans, and the dirty-removal
guard passed; the plans show that implementation belongs outside the dashboard
repository.
- Keep Bruno and DBeaver; retiring old applications is outside phase one.
## Deferred pilots
Revisit these alongside related phase-two ideas rather than as isolated cleanup.
- Capture Zenith's external display identity during a docked session and test the
two-output `Super+A` exchange, including name and focus restoration on failure.
- Resume Evolution and Android PIM only when the user chooses to run those daily
use pilots.
- Replicate the proven workstation workflow on Polaris only when the user resumes
its machine-local VPN and credential procedure.
## Deferred work
- Define the team release process and OpenAPI publication policy before encoding
deployment automation.
- Adopt a company-wide infrastructure secret source only after Yookr selects one.
- Publish `yookr-workbench` only when sharing becomes useful.
- Pilot SharePoint browse/download through `rclone` after Microsoft consent.
- Revisit Worktrunk, `codex agents`, Walker-to-agent launching, formal agent
evaluation, remote builders, CI runners, and agent offload only after a concrete
gap appears.
- Add report servers, notebook hubs, groupware, terminal PIM, meeting summaries,
concurrency isolation, OCR, dictation, clipboard remapping, or additional
convenience surfaces only after repeated use establishes an owner.
## Reference baseline
Recheck fast-moving interfaces against their pinned versions before changing
them.
<!-- markdownlint-disable MD013 -->
- Projects: [Nix flake templates](https://nix.dev/manual/nix/latest/command-ref/new-cli/nix3-flake-init), [nix-direnv](https://github.com/nix-community/nix-direnv), [just manual](https://just.systems/man/en/), [Podman Compose](https://docs.podman.io/en/latest/markdown/podman-compose.1.html), [Quadlet](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html), [Marimo](https://docs.marimo.io/).
- APIs/data: [Kulala](https://kulala.app/), [Dadbod](https://github.com/tpope/vim-dadbod), [RabbitMQ management](https://www.rabbitmq.com/docs/management), [rclone S3](https://rclone.org/s3/), [rclone OneDrive/SharePoint](https://rclone.org/onedrive/).
- Desktop: [Walker](https://walkerlauncher.com/docs/providers), [Elephant menus](https://github.com/abenz1267/elephant/tree/master/internal/providers/menus), [Vivaldi web apps](https://help.vivaldi.com/desktop/miscellaneous/progressive-web-apps/), [Niri IPC](https://niri-wm.github.io/niri/IPC.html).
- Agents: [Codex configuration](https://learn.chatgpt.com/docs/config-file/config-basic), [Codex long-running work](https://learn.chatgpt.com/docs/long-running-work), [Herdr](https://herdr.dev/docs/configuration/), [Git worktrees](https://git-scm.com/docs/git-worktree).
- PIM/knowledge: [Evolution account types](https://help.gnome.org/evolution/intro-account-types.html), [Radicale](https://radicale.org/v3.html), [DAVx5](https://manual.davx5.com/introduction.html), [Tasks.org](https://tasks.org/docs/), [`zk` daily journal](https://github.com/zk-org/zk/blob/main/docs/tips/daily-journal.md).
- Infrastructure: [Gardenctl](https://gardener.cloud/docs/gardenctl-v2/), [NetworkManager](https://networkmanager.pages.freedesktop.org/NetworkManager/NetworkManager/nmcli.html), [Syncthing](https://docs.syncthing.net/users/syncing).
<!-- markdownlint-enable MD013 -->
-167
View File
@@ -1,167 +0,0 @@
# Current work
## Phase and working method
Implementation is authorized and underway. Do not restart the broad design pass or
reconfirm accepted choices. `docs/design.md` owns the model, decisions and coding
conventions; README owns navigation/maintenance; operational details live with owners.
Complete independent agreed work and obvious fixes autonomously. Leave consequential
unknowns pending and collect recommendations/alternatives into one substantial review
batch. Ask earlier only to prevent broad rework/blockage. The old 2–4-question quota
is superseded. Keep effort focused; no speculative systems or peripheral research.
Do not write or run tests or perform extensive validation unless explicitly requested.
Do not activate, push, decrypt for discovery or access company systems with write
authority. No subagents unless explicitly authorized by current instructions.
Keep this record current by replacing superseded state. Pass-specific procedures
stay here, not in AGENTS. The user must agree before the overall pass is complete.
The unedited `~/sync/notes/setup-todo.md` remains an idea inbox, not authorization.
## Wardrowbe on Orion: implemented, awaiting provisioning and activation
- Orion selects the Wardrowbe capability at `wardrobe.jelles.net`, with Tinyauth
password access at `wardrobe-auth.jelles.net`. Trusted household members select
their profile through Wardrowbe's development login after the gateway; profile
identity is not independently verified.
- Podman containers use immutable image digests, a dedicated network and persistent
named volumes. Database/queue health gates migrations and API startup; frontend
and workers wait for the API. Caddy protects all application routes; published
container ports are localhost-only. Internal AI is disabled everywhere. No
Codex bridge, Ollama or paid provider is configured.
- Four new system SOPS keys and both DNS records remain user-provisioned. Missing
SOPS keys must be supplied before Orion builds or activates. See
[Wardrowbe setup](../modules/capabilities/wardrowbe/README.md) for provisioning,
activation, operations, upgrade limits and manual acceptance.
- Focused source/configuration review only. No tests, host evaluation/build,
`just validate`, activation or remote changes. No existing secrets were decrypted
or read for discovery.
- A user-run Orion build failed compiling Contour's SIMD code, pulled in by
`enableAllTerminfo`. Orion now selects Kitty terminfo for workstation SSH clients
instead of the complete terminal set. The pinned NixOS module was inspected;
formatting and focused diff review only. No rebuild was run after this fix.
## Implemented, reviewed and validated; awaiting user checkpoint
- Flat capability owners; service category flattened. AI, theme, Handy and
transcription support colocated. Imported Nix helpers moved under `_support/`.
File management owns Nautilus/GVfs/udisks; keyring remains separate.
- Removed Walker project discovery, agent-deck/notify, tmux, Zellij, TeamViewer and
direnv. Removed the uninstalled nixos-maintainer skill source. Retained Herdr,
Ollama/grounded-docs and their data, mail/calendar tools, dictation/transcription.
- Shared notes launcher uses Kitty's explicit directory and native zk note picker;
the picker already supports Ctrl+E creation. Oil's mini.icons provider loads
before initial directory buffers. Manual workspace naming/clearing and visible
Noctalia labels; shell titles include directory/command. Garden shell initialization
now belongs to company integration instead of every host's generic shell.
- Kanagawa declares Adwaita/hicolor icon fallback; modest Limine branding/layout.
Walker uses upstream Elephant without a local vault patch. It may query `rbw` at startup.
- GitHub devenv 2.3.2 installed with native Zsh hook and upstream reload defaults.
CLI dependencies keep upstream pins/cache; workbench tools use this repository's
exact nixpkgs pin. Company tools are also installed through the work profile. Product and
personal environments are untouched. No external loader was sourced or changed.
- Workbench runtime SecretSpec export helper resolves company/live/test independently,
clears stale owned variables, reports value-free status, and supports tools-only
entry/retry. Source mappings/provisioning remain pending below.
- User-run encrypted company migration helper prepared, never run. Company document
absent until user provisioning. Test mapping and login remain deliberately
unimplemented until the concrete context and plugin are known; the loader accepts
only an explicit noninteractive runtime snapshot. No company credential values
have been read.
- Both workstations select persistent read-only OBS/SharePoint user mounts, no content
cache; replaced Zenith-only hourly mirror. Existing data is preserved. Credentials,
old OBS mount handover and runtime acceptance remain user-owned.
- Tailscale enabled on all hosts; ordinary SSH keys retained. Zenith SSH is tailnet-only,
Polaris LAN SSH unchanged, Orion public SSH unchanged pending verification.
- Documentation consolidated; coding conventions in design, short AGENTS retained.
Validation prepares upstream devenv's import-from-derivation dependencies before
read-only flake checking, accepts the repository's declared official cache, and
reports interruption concisely. Full builds still include the tools-only shell.
The devenv cache is now in persistent NixOS Nix settings; the flake cache hint
was removed.
- Noctalia tracks upstream's `cachix` branch with its own nixpkgs pin; persistent
Nix settings include the official cache and signing key. The existing 5.2.1
commit is unchanged. Its resulting x86_64 package has a matching signed cache
entry; the previous package with our nixpkgs pin returned 404. No build or
activation was run. For the first activation, pass the cache URL and key from
`modules/capabilities/nix.nix` as `extra-substituters` and
`extra-trusted-public-keys` options to `nh os switch`; afterward Nix uses the
persistent settings.
## Decisions/provisioning still needed
1. **Company-root activation.** Native devenv suppresses its hook inside an active
devenv shell, including nested projects. No root environment is generated now;
recommend globally installed company tools at root and autoactivation only in
workbench. This avoids custom activation machinery; confirm at the user checkpoint.
2. **Test SecretSpec mapping.** Need the explicit test context and existing application
Secret/namespace/key coordinates (metadata only, no values). Confirm whether
database Secrets hold complete URLs or separate components. Do not invent keys,
silently use the current context or fall back to live/SOPS test credentials.
Test loading reports unavailable until its runtime manifest and login snapshot exist.
3. **Explicit-login mechanism.** Final review removed the generic ExecCredential
interpreter: it duplicated a security-sensitive Kubernetes client protocol before
the actual company plugin was known. Inspect the selected context's exec stanza,
then choose its native/provider-specific cached login flow and prepare a mode-0600
runtime snapshot. Shell entry must not launch authentication.
4. **Live MariaDB certificate verification.** The migration helper preserves the
old `ssl-verify-server-cert=0` behavior. Before running it, either explicitly accept
that legacy risk or identify the correct CA/hostname settings and enable verification.
5. **Manual provisioning/acceptance.** Company SOPS recipients/migration, rclone
OAuth on both hosts, old OBS mount handover, devenv trust/responsiveness, Noctalia
Radicale password and private Outlook ICS URL, tailnet enrollment/private SSH.
See workbench README and root README. Do not close public Orion SSH yet.
6. **Guidelines review.** Design now spells out owner naming, module selection,
helper placement, package reuse/pinning, runtime boundaries and validation. No new
test policy, automation framework or pass-specific repo-wide rules were added.
## Validation state
Final full validation passed before the final review deletions:
`/tmp/nixos-validate-t7zv1zux` (session 88912,
completed exit 0). Formatting, devenv preparation, flake check, all three host
builds (Orion, Polaris, Zenith), and the tools-only workbench build passed.
This includes the final notes startup ordering, FUSE wrapper paths, native Zsh retry
function and SecretSpec package collision fix. The vault patch was removed afterward.
No systems were activated.
Native devenv tools-only startup also passed in an isolated temporary home:
`/tmp/foundation-native/startup.log`. Company/live/test loading was disabled;
SecretSpec 0.20.0 and Python 3.14.7 were available. No company credentials loaded.
Clean-home manual editor checks passed: direct directory startup renders a Lua-file
icon in Oil; opening the note picker after VimEnter reaches TelescopePrompt.
Evidence: `/tmp/foundation-editor-check/{startup,notes}.log`. No real notebook or
credentials loaded. Built Kanagawa index declares `Inherits=Adwaita,hicolor`.
Python source syntax and local documentation links checked; no automated tests added.
The earlier final review removed the unaccepted Kubernetes login wrapper and the
machine-wide devenv cache setting; the flake-scoped cache remains. Full builds were
not repeated for those deletions. The later Walker patch removal has not been built.
Builds do not establish interactive acceptance. The user checkpoint remains; do not
repeat full builds for documentation-only handoff edits.
## Review checkpoint
The final diff was reviewed for correctness, integration and Ponytail complexity.
Desktop/capability moves and repository wiring had no material findings. The review
removed the speculative Kubernetes login interpreter. The devenv cache was later
moved from flake scope to machine-wide Nix settings at the user's request. The
remaining Python has a concrete role: in-memory concurrent secret loading with
completeness checks, one-time encrypted credential reshaping, dynamic OBS rclone
configuration, or pre-existing dictation/transcription behavior.
The user checkpoint is still required before this pass is complete. The implementation
was committed as `5748b34` after the initial foundation commit `f164d8b`. Later
cleanup removed the Walker patch, Handy test and AI capability README.
No activation was recorded during that pass. External workbench analysis/content
changes are unrelated and must not be committed here. Previous external loader
copies remain at `/tmp/workbench-environment-before-6k4dwzuo`; only root/workbench environment documentation and ignore entries were updated.
Backups: `/tmp/foundation-workbench-docs-bvrs1hu9`. Old external loaders remain
until user activation, so the currently running system is not broken. Constellation documents were already
superseded and removed in the prior foundation commit.
Deliberate deferrals remain in design: backups declined, dashboard scrapped,
Zenith Plymouth and extra Noctalia keyboard controls deferred, stronger credential
isolation/new agent workflows/indexing and unrelated editor redesign out of scope.
-141
View File
@@ -1,141 +0,0 @@
# Repository design
Working decisions, open to evidence from implementation and use.
## Model and ownership
Build a quiet, keyboard-driven, text-oriented environment from understandable tools
and standard interfaces. Humans and agents use the same underlying resources.
Graphical applications are deliberate choices where they fit. Streamline existing
workflows rather than requiring a new way of working.
- **Host:** machine identity, hardware and differences in selection.
- **Profile:** a deliberate combination of capabilities.
- **Capability:** behavior and necessary integration, potentially spanning several
applications, NixOS and Home Manager.
- **Facts:** shared identity and topology consumed in multiple places.
- **Theme:** application-specific appearance, including plugins and assets.
Interaction and layout belong to capabilities.
Polaris and Zenith have the same intended daily use. The `work` profile on both is
a provisional ownership boundary, not a different workstation variant. Steam and
LAN SSH on Polaris, and laptop power/firmware management on Zenith, are deliberate.
Orion owns shared services. Tailnet administration supplements existing access;
public Orion SSH closes only after private access is verified. Web services stay public.
Orion installs Kitty terminfo for SSH sessions from the workstations.
Wardrowbe uses a password gateway for trusted household access, followed by profile
selection inside the app; verified individual identity is deferred. Its internal AI
is disabled. Paid API usage, a Codex bridge and local model integration are deferred.
Nix owns reproducible installation, integration and selected settings. Applications
own credentials, sessions, content and deliberately interactive preferences. No
plaintext secrets enter Git, Nix evaluation or store outputs. Company credentials
use a separate encrypted SOPS document in this private Gitea repository and the
existing per-machine age keys. Credential availability is not operational authority.
## Coding and composition conventions
Use a flat set of capability owners: `name.nix` when self-contained, otherwise
`name/default.nix` with its scripts, assets and operational notes beside it. Put
manually imported Nix helpers under that owner's `_support/` so import-tree does
not discover them. Host hardware helpers remain private to their host.
Discovery publishes modules; explicit imports select behavior. Prefer existing
NixOS/Home Manager options and direct module imports. Introduce a shared option or
helper only for actual consumers. Use kebab-case owner/module names that describe
purpose. NixOS and Home Manager modules may share the same capability name. Small
application declarations may remain grouped when they need no substantial integration.
Split independent purposes or shared integrations, not every configured package.
Keep package definitions with their capability and reuse them across installations
and development environments. Flake inputs belong in `flake.nix` and are locked in
`flake.lock`; fixed external sources need a version/revision and hash. Workbench
tools follow the system nixpkgs pin. The GitHub devenv CLI retains its upstream
build dependencies. Product environment definitions and pins remain product-owned.
Use store-qualified executables or `runtimeInputs` in packaged scripts; make runtime
paths and failures explicit. Do not duplicate package lists, generated settings or
binding references in documentation.
These clarify the agreed model; they are not a one-package-per-file rule or a
requirement for additional abstractions.
## Daily environment
Niri owns navigation and frequent shortcuts; Walker owns application/resource search;
Noctalia owns status and system controls. Workspaces remain flexible and optionally
named by the user. Terminal titles provide orientation. No project-based workspace
scheme, heuristic naming or custom Walker project discovery is wanted.
Herdr remains an experiment, not a core dependency. Remove agent-deck, tmux and
Zellij. Keep Ollama and grounded-docs for experimentation and preserve their data.
Ollama's embedding model supports grounded-docs. Keep Handy for local dictation and
Orion transcription. Handy preferences, recordings and models remain application-owned.
Its push-to-talk release listener requires active-user keyboard access; press from
idle, with Super and D on the same keyboard.
Both notes entry points open the existing zk note picker with note creation.
Notes stay in `~/sync/notes`, mostly meeting material; no new taxonomy. HTTP and
database targets remain independently selected and visibly named. Dadbod working
queries and connection state stay outside Git; see the editor's `database.lua`.
Kanagawa remains the theme with Adwaita fallback icons. Walker uses upstream Elephant
without a local vault patch; it may query rbw during startup. Outlook PWA owns work
email/calendar editing. Mailspring owns personal mail; Thunderbird remains a backup. Noctalia
provides the combined read-only Radicale/Outlook agenda. The user accepts published
ICS link access and supplies the URL privately through runtime settings. Personal
calendar editing stays on the phone; keep khal/todoman.
## Company environment
`~/yookr` is the company root; product repositories are in `~/yookr/projects`.
`~/yookr/workbench` is the access point for company services, databases and files.
This repository owns its environment; requests, queries, analysis, findings, Python
lock, content and private context stay writable there. The workbench capability
owns setup and credential/mount instructions.
Native devenv replaces direnv, initially with default reload behavior. Migration is
limited to workbench and company-root integration. Product, personal, archived and
learning projects are user-migrated; do not retain direnv as a transition.
Use SecretSpec with existing test-cluster application Secrets and SOPS-backed live
credentials. There is no live-cluster access. Company login is explicit. Sources
must fail independently, tools remain available, and retries must clear stale values.
Normal human editor startup can receive both targets; per-connection decryption and
a global environment selector are not wanted. Stronger agent credential isolation
is deferred; existing restrictions on company operations remain in force.
OBS and SharePoint are continuously available as read-only mounts under the workbench
on both workstations. User services own lifecycle, independent of shell entry.
No persistent content cache or hourly mirror; memory buffers and metadata are accepted.
Same-user processes, including agents, can read these mounts. Preserve old local data.
## Knowledge and maintenance
README owns navigation and maintenance; AGENTS owns essential durable collaboration
constraints; this document owns rationale/conventions; current-work owns resumable
state. Operational details live beside their owner. Use Git for chronology, replace
superseded state, and remove temporary state when no longer useful.
Keep instructions short and authoritative. Add a rule when it prevents a concrete
mistake, resolves recurring ambiguity or points to its owner. Prefer formatter and
validation feedback to repeated reminders. This applies the useful principle of
progressive disclosure from [OpenAI's harness engineering article](https://openai.com/index/harness-engineering/)
without introducing speculative skills, orchestration or evaluation infrastructure.
`just validate` is available on explicit request. It includes working-tree changes
and new nonignored files without staging, formats, evaluates and builds. Targeted
host builds are supported; a full run also builds workbench tools. Builds do not
prove activation or interactive behavior. Do not write or run tests or perform
extensive validation unless explicitly requested.
Keep native update and activation commands. `nix flake update` is normal; selective
updates (often `llm-agents`) are appropriate while nixpkgs breakage awaits repair.
Activation remains user-owned. No trivial `just` aliases for native commands.
## Deliberately deferred
No backups (user declined), Orion dashboard/monitoring (scrapped), new agent
workflows/persistence/indexing/isolation, or broader editor redesign without friction.
Zenith's Plymouth refresh and extra Noctalia keyboard controls are deferred.
The existing single Syncthing `~/sync` layout is retained. TeamViewer is removed.
Generated
+412 -130
View File
@@ -1,5 +1,30 @@
{
"nodes": {
"blueprint": {
"inputs": {
"nixpkgs": [
"llm-agents",
"nixpkgs"
],
"systems": [
"llm-agents",
"systems"
]
},
"locked": {
"lastModified": 1776249299,
"narHash": "sha256-Dt9t1TGRmJFc0xVYhttNBD6QsAgHOHCArqGa0AyjrJY=",
"owner": "numtide",
"repo": "blueprint",
"rev": "56131e8628f173d24a27f6d27c0215eff57e40dd",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "blueprint",
"type": "github"
}
},
"bun2nix": {
"inputs": {
"flake-parts": [
@@ -20,16 +45,15 @@
]
},
"locked": {
"lastModified": 1790001035,
"narHash": "sha256-1/SLBjSYBzDdDhvLQ83wrzBakyS/xNGgtxHGNuveOEQ=",
"owner": "Mic92",
"lastModified": 1778446047,
"narHash": "sha256-oQvcadh2BCkrog+SGrG6YffKJrveYpjj3TdQJWaKhaM=",
"owner": "nix-community",
"repo": "bun2nix",
"rev": "07a5bfc8ac36c5370199343fa620b69f63186e33",
"rev": "f2bc12af1a6369648aac41041ceeaa0b866599c6",
"type": "github"
},
"original": {
"owner": "Mic92",
"ref": "llm-agents",
"owner": "nix-community",
"repo": "bun2nix",
"type": "github"
}
@@ -53,11 +77,11 @@
]
},
"locked": {
"lastModified": 1788181969,
"narHash": "sha256-OUB6hPlFBB9FRdZgZXSye4lDOg+fbrqKe8ePv2IM7NY=",
"lastModified": 1777487137,
"narHash": "sha256-TuvKVBX60mqyMT6OB5JqVEh1YIWtFMR/igLCaCdC9tw=",
"owner": "cachix",
"repo": "cachix",
"rev": "98093e8eea6c1635ef1337a576fa76f3e8bd4f39",
"rev": "a66a440c321d35f7193472c317f42a55ccd1cb93",
"type": "github"
},
"original": {
@@ -98,11 +122,11 @@
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1791388908,
"narHash": "sha256-eqnGuVYIh6u8XU6UXueceaCi3UfSqbvopeuLYgClEDY=",
"lastModified": 1780630679,
"narHash": "sha256-hhQyVAYmNKziZ0T+T4Gsk0PYmnz4vdzOzpkJAmDASKM=",
"owner": "cachix",
"repo": "devenv",
"rev": "27af3b2029a6d1274db8a570fb57292dae5a2551",
"rev": "90ed6227ab389dd4e874a69a724f25dba312b754",
"type": "github"
},
"original": {
@@ -118,11 +142,11 @@
]
},
"locked": {
"lastModified": 1789770686,
"narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
"lastModified": 1780290312,
"narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
"owner": "nix-community",
"repo": "disko",
"rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
"rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
"type": "github"
},
"original": {
@@ -134,20 +158,16 @@
"elephant": {
"inputs": {
"nixpkgs": [
"walker",
"nixpkgs"
],
"systems": [
"walker",
"systems"
]
"systems": "systems"
},
"locked": {
"lastModified": 1790316550,
"narHash": "sha256-Qr/8JQ8zpmmWmZ7UAjhxVdRbSgwQ0uc2r/wUBMe4NBk=",
"lastModified": 1775706155,
"narHash": "sha256-h7Rw0vlb0n0Jsk21WJPm7H+1T1bG+PEuxE5cJ2TZl8A=",
"owner": "abenz1267",
"repo": "elephant",
"rev": "a0670fb2cf590a3ceed6f799a45947b86a78d5f4",
"rev": "376ee71c66db38683daabd57350bf3f6f086eaf8",
"type": "github"
},
"original": {
@@ -180,11 +200,11 @@
]
},
"locked": {
"lastModified": 1788306937,
"narHash": "sha256-lbrI1UYVpFgKSsyrU9oeF7FHfnu8nLD9ja0ou9f2rxk=",
"lastModified": 1778716662,
"narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "f16b25b8c3d2809b87925d0b76652d7821a75c68",
"rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
"type": "github"
},
"original": {
@@ -195,14 +215,17 @@
},
"flake-parts_2": {
"inputs": {
"nixpkgs-lib": "nixpkgs-lib"
"nixpkgs-lib": [
"llm-agents",
"nixpkgs"
]
},
"locked": {
"lastModified": 1790898470,
"narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
"lastModified": 1778716662,
"narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
"rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
"type": "github"
},
"original": {
@@ -213,17 +236,14 @@
},
"flake-parts_3": {
"inputs": {
"nixpkgs-lib": [
"llm-agents",
"nixpkgs"
]
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1790898470,
"narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
"lastModified": 1769996383,
"narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
"rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
"type": "github"
},
"original": {
@@ -235,17 +255,16 @@
"ghostty": {
"flake": false,
"locked": {
"lastModified": 1786026742,
"narHash": "sha256-tRtgTg/i3w1nFdRHU2IGekfJN8EyP+HARW4MtoUZyqk=",
"lastModified": 1779069789,
"narHash": "sha256-ojo+gso45/6CVSuqfSVnlWpQ4d0QeLgwok+v/g3yu0E=",
"owner": "ghostty-org",
"repo": "ghostty",
"rev": "22d13172cde98a0a4dda05d3d6a3fcb0dd8ed018",
"rev": "4b7bf0b20e3baf9c1ba10c63f2ad1fd853faea8f",
"type": "github"
},
"original": {
"owner": "ghostty-org",
"repo": "ghostty",
"rev": "22d13172cde98a0a4dda05d3d6a3fcb0dd8ed018",
"type": "github"
}
},
@@ -255,17 +274,18 @@
"devenv",
"flake-compat"
],
"gitignore": "gitignore",
"nixpkgs": [
"devenv",
"nixpkgs"
]
},
"locked": {
"lastModified": 1788267358,
"narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
"lastModified": 1778507602,
"narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
"owner": "cachix",
"repo": "git-hooks.nix",
"rev": "27555e2624241fb116b49095df4caaee85a25691",
"rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
"type": "github"
},
"original": {
@@ -274,6 +294,28 @@
"type": "github"
}
},
"gitignore": {
"inputs": {
"nixpkgs": [
"devenv",
"git-hooks",
"nixpkgs"
]
},
"locked": {
"lastModified": 1709087332,
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
"owner": "hercules-ci",
"repo": "gitignore.nix",
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
"type": "github"
},
"original": {
"owner": "hercules-ci",
"repo": "gitignore.nix",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@@ -281,11 +323,11 @@
]
},
"locked": {
"lastModified": 1791306979,
"narHash": "sha256-KuLePuhwJM9NLt/gTLHzXaOoSZKGoB3m7NfXjiQ98HY=",
"lastModified": 1780593650,
"narHash": "sha256-CHo7k65YTL3HY+WQVedDTupji+LMgNlKCdrtRHZFAK4=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "fae6e9e42c3b762ab47635cddcfaf6f52374a61b",
"rev": "447fd9ff62501dae7206dfe180ee89f8de27b7d5",
"type": "github"
},
"original": {
@@ -296,11 +338,11 @@
},
"import-tree": {
"locked": {
"lastModified": 1788467110,
"narHash": "sha256-ljEMTXP/rH0tOvDzc9gzwww6KcHRPRnEHzd9lK48V7s=",
"lastModified": 1778781969,
"narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=",
"owner": "vic",
"repo": "import-tree",
"rev": "eb1b52eaecc57f7c136d07ae8a93e724dfecac46",
"rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274",
"type": "github"
},
"original": {
@@ -311,18 +353,21 @@
},
"llm-agents": {
"inputs": {
"blueprint": "blueprint",
"bun2nix": "bun2nix",
"flake-parts": "flake-parts_3",
"nixpkgs": "nixpkgs_2",
"systems": "systems",
"flake-parts": "flake-parts_2",
"nixpkgs": [
"nixpkgs"
],
"systems": "systems_2",
"treefmt-nix": "treefmt-nix_2"
},
"locked": {
"lastModified": 1791440787,
"narHash": "sha256-nRO1wEJmb4wjz+0Mhpg5VWURTqZRBZq3MvMjtPkKuAI=",
"lastModified": 1780640554,
"narHash": "sha256-dgnL2gTgRoO1D4z6wkARGCO/gimq3/UE/mVFcQcWBn8=",
"owner": "numtide",
"repo": "llm-agents.nix",
"rev": "2109db8971dc18137ff1ac9393627c761609600d",
"rev": "f764eba1fdd162a1f2bc923f7e7034b894a22b4a",
"type": "github"
},
"original": {
@@ -331,6 +376,81 @@
"type": "github"
}
},
"lux-pkgs": {
"inputs": {
"flake-parts": "flake-parts_3",
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1772315038,
"narHash": "sha256-YL6NQd97AiZGe/Q4ZWxZaguKVHL0pfNvP/Cqgl/oh4g=",
"ref": "refs/heads/main",
"rev": "d7660146e70475c096bed703e4dad687a58e13dc",
"revCount": 1,
"type": "git",
"url": "ssh://gitea@orion/kiri/lux-pkgs"
},
"original": {
"type": "git",
"url": "ssh://gitea@orion/kiri/lux-pkgs"
}
},
"niri": {
"inputs": {
"niri-stable": "niri-stable",
"niri-unstable": "niri-unstable",
"nixpkgs": "nixpkgs_3",
"nixpkgs-stable": "nixpkgs-stable",
"xwayland-satellite-stable": "xwayland-satellite-stable",
"xwayland-satellite-unstable": "xwayland-satellite-unstable"
},
"locked": {
"lastModified": 1780639821,
"narHash": "sha256-SOTuKPQ9HptaWKnd6pbiSOC3YyY2tXwCJ5sQwKUDldU=",
"owner": "sodiboo",
"repo": "niri-flake",
"rev": "f92324f4e97776e141dc8a8ce4debc6c91b64038",
"type": "github"
},
"original": {
"owner": "sodiboo",
"repo": "niri-flake",
"type": "github"
}
},
"niri-stable": {
"flake": false,
"locked": {
"lastModified": 1756556321,
"narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
"owner": "YaLTeR",
"repo": "niri",
"rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
"type": "github"
},
"original": {
"owner": "YaLTeR",
"ref": "v25.08",
"repo": "niri",
"type": "github"
}
},
"niri-unstable": {
"flake": false,
"locked": {
"lastModified": 1780637332,
"narHash": "sha256-FeKyLRxLZu2EUnhifijZPDZRl0sVnPVHMtizAINNiN4=",
"owner": "YaLTeR",
"repo": "niri",
"rev": "f717ae030fe56fc52522ebef69f17f3f09064ac4",
"type": "github"
},
"original": {
"owner": "YaLTeR",
"repo": "niri",
"type": "github"
}
},
"nix": {
"inputs": {
"flake-compat": [
@@ -357,16 +477,16 @@
]
},
"locked": {
"lastModified": 1790176416,
"narHash": "sha256-acP7QvsB+dHghUeL9AwSSZ3qS//skpqjv484aveg1EQ=",
"lastModified": 1779748925,
"narHash": "sha256-meIhqGC04O5VXbKSFXSQoOKp+XCq5RMnwAk1Guo0VQo=",
"owner": "cachix",
"repo": "nix",
"rev": "bd10d7f563420c6034b9d1dc75c4168fc01e5afc",
"rev": "0bc443c8ff235c3547d09327b48aaa2ab98b15f2",
"type": "github"
},
"original": {
"owner": "cachix",
"ref": "devenv-2.35",
"ref": "devenv-2.34",
"repo": "nix",
"type": "github"
}
@@ -378,11 +498,11 @@
]
},
"locked": {
"lastModified": 1791105314,
"narHash": "sha256-oTM7QFgRQ+vxBpMBMc7hEYpqBtpXAzXu2xuB/tru84U=",
"lastModified": 1780210899,
"narHash": "sha256-4axz3OBPTKa6LIkXV8n0lc63MQU+et2CB5DGobEAi6k=",
"owner": "nix-community",
"repo": "nix-index-database",
"rev": "e740bc4e9d8918d7819a51486d5099930c65c72e",
"rev": "97df9dc0b7c924344b793a15c1e8e4522ebb854e",
"type": "github"
},
"original": {
@@ -398,11 +518,11 @@
]
},
"locked": {
"lastModified": 1791440872,
"narHash": "sha256-PwiSn1VO3/6BD/Gxw/3Ei2sPB3SccyKyJ7nD72Y+WU4=",
"lastModified": 1780519948,
"narHash": "sha256-+JiqyEa+77HfyiuJcsG5hUc3bGeEflhUG4TD+CaChzQ=",
"owner": "BirdeeHub",
"repo": "nix-wrapper-modules",
"rev": "d82c328c504648fa952f25fac8332319eb425d4c",
"rev": "6d9506b09f8fbe0429153da1cebef2bd61a98848",
"type": "github"
},
"original": {
@@ -424,11 +544,11 @@
"treefmt-nix": "treefmt-nix"
},
"locked": {
"lastModified": 1788165251,
"narHash": "sha256-ITHt6eU6DuwQqlNV1/wehvKYPE6J8sZIlv75CpDjcHI=",
"lastModified": 1778381404,
"narHash": "sha256-FqhdOTA8vyoIpkHhbs2cCT7h6EWM7nsLeOYJc1ifQLE=",
"owner": "nix-community",
"repo": "nixd",
"rev": "e2ca72c353cfbc3d63e942fe9aeae4ec497863bf",
"rev": "e3e45eb76663f522e196b7f0cf34cab201db7779",
"type": "github"
},
"original": {
@@ -439,16 +559,14 @@
},
"nixos-hardware": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1791373788,
"narHash": "sha256-c3oMt0QoE+4yiRk6u1m2L9ogjaUw0uTGn9yk808KkgE=",
"lastModified": 1780310866,
"narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "4bc63156b109ee7b4103e3ec30565c8c92bde435",
"rev": "4ed851c979641e28597a05086332d75cdc9e395f",
"type": "github"
},
"original": {
@@ -463,11 +581,11 @@
"nixpkgs-src": "nixpkgs-src"
},
"locked": {
"lastModified": 1787753358,
"narHash": "sha256-Tl77VbWyAKrOfRNQhL6JbQtb/MLzbYa/1RG1gWWfICk=",
"lastModified": 1778507786,
"narHash": "sha256-HzSQCKMsMr8r55LwM1JuzIOB+8bzk0FEv6sItKvsfoY=",
"owner": "cachix",
"repo": "devenv-nixpkgs",
"rev": "256551e45f6303e142ab4a98be1bf243feb77dc0",
"rev": "8f24a228a782e24576b155d1e39f0d914b380691",
"type": "github"
},
"original": {
@@ -479,11 +597,11 @@
},
"nixpkgs-lib": {
"locked": {
"lastModified": 1790477367,
"narHash": "sha256-oujbxmVKDhci2E4EM3KyAbRUgp5/IsCoiA/LfEF7OOk=",
"lastModified": 1769909678,
"narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "f7cd230690d9fc982d06129f9189b101fddcfa3b",
"rev": "72716169fe93074c333e8d0173151350670b824c",
"type": "github"
},
"original": {
@@ -495,11 +613,11 @@
"nixpkgs-src": {
"flake": false,
"locked": {
"lastModified": 1787394516,
"narHash": "sha256-pRGOQSClnXNI2iLUG6DYpsGvYcuw0drOutVZFTJNw90=",
"lastModified": 1778274207,
"narHash": "sha256-I4puXmX1iovcCHZlRmztO3vW0mAbbRvq4F8wgIMQ1MM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c8f90650c15282fa8656a041bfbbd2403997a9a7",
"rev": "b3da656039dc7a6240f27b2ef8cc6a3ef3bccae7",
"type": "github"
},
"original": {
@@ -509,13 +627,29 @@
"type": "github"
}
},
"nixpkgs_2": {
"nixpkgs-stable": {
"locked": {
"lastModified": 1790600678,
"narHash": "sha256-6k3n7X2UsZ6tAlWTz99RimiZab+17tMUrw9sRUcELiA=",
"lastModified": 1779796641,
"narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "f45c6f04c2f013f004bf94e284e95d72898d9393",
"rev": "25f538306313eae3927264466c70d7001dcea1df",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1772173633,
"narHash": "sha256-MOH58F4AIbCkh6qlQcwMycyk5SWvsqnS/TCfnqDlpj4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c0f3d81a7ddbc2b1332be0d8481a672b4f6004d6",
"type": "github"
},
"original": {
@@ -527,46 +661,101 @@
},
"nixpkgs_3": {
"locked": {
"lastModified": 1791336361,
"narHash": "sha256-7WQwlykef1x8n7aoyw4XP6882i2NRs5F6dVCXZ1NI1g=",
"rev": "7dd199b0e2993e37b4775ed66b1c291699608c9f",
"lastModified": 1780243769,
"narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_4": {
"locked": {
"lastModified": 1767892417,
"narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
"rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
"type": "tarball",
"url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1086972.7dd199b0e299/nixexprs.tar.xz"
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
}
},
"nixpkgs_5": {
"locked": {
"lastModified": 1780365719,
"narHash": "sha256-JX05Ms/dk0c+UoW9IqQriB53HNZFckX9Qd3EJqmcqEw=",
"rev": "ffa10e26ae11d676b2db836259889f1f571cb14f",
"type": "tarball",
"url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1009182.ffa10e26ae11/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
}
},
"nixpkgs_4": {
"nixpkgs_6": {
"locked": {
"lastModified": 1790822859,
"narHash": "sha256-VBA0QerzzmL+4wxgtwiCdiLwLpJg2/9xOxhgO3BRJQA=",
"rev": "c59305bab2065cfecc4944690d9eedbb56f3a9fa",
"type": "tarball",
"url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1083223.c59305bab206/nixexprs.tar.zst"
"lastModified": 1780243769,
"narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
"type": "github"
},
"original": {
"type": "tarball",
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst"
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"noctalia": {
"inputs": {
"nixpkgs": "nixpkgs_4"
"nixpkgs": "nixpkgs_6",
"noctalia-qs": "noctalia-qs"
},
"locked": {
"lastModified": 1791427429,
"narHash": "sha256-FzM3cunGIn8oDC1afUsXzGdfI/tK5HjPOHzHXFIAVx4=",
"lastModified": 1780371321,
"narHash": "sha256-WCaU6npdMdjZSZHe3XATNDFijmzRnsV8V+iR80e5deg=",
"owner": "noctalia-dev",
"repo": "noctalia",
"rev": "3e059de4aec58ba5b81f6c366b2b234a58f5ab0a",
"repo": "noctalia-shell",
"rev": "3aab45a2f34fd47666b05892b95054952e788de1",
"type": "github"
},
"original": {
"owner": "noctalia-dev",
"ref": "cachix",
"repo": "noctalia",
"repo": "noctalia-shell",
"type": "github"
}
},
"noctalia-qs": {
"inputs": {
"nixpkgs": [
"noctalia",
"nixpkgs"
],
"systems": "systems_3",
"treefmt-nix": "treefmt-nix_3"
},
"locked": {
"lastModified": 1780194487,
"narHash": "sha256-M+YtjKCTkHrkplNaKVyaxfa8hAWjRF6wFOUBAZvxQ4U=",
"owner": "noctalia-dev",
"repo": "noctalia-qs",
"rev": "07398e12b54f194e3a2d47c87e3fd10b8eeaa27d",
"type": "github"
},
"original": {
"owner": "noctalia-dev",
"repo": "noctalia-qs",
"type": "github"
}
},
@@ -574,14 +763,20 @@
"inputs": {
"devenv": "devenv",
"disko": "disko",
"flake-parts": "flake-parts_2",
"elephant": "elephant",
"flake-parts": [
"lux-pkgs",
"flake-parts"
],
"home-manager": "home-manager",
"import-tree": "import-tree",
"llm-agents": "llm-agents",
"lux-pkgs": "lux-pkgs",
"niri": "niri",
"nix-index-database": "nix-index-database",
"nix-wrapper-modules": "nix-wrapper-modules",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_3",
"nixpkgs": "nixpkgs_5",
"noctalia": "noctalia",
"sops-nix": "sops-nix",
"walker": "walker"
@@ -595,11 +790,11 @@
]
},
"locked": {
"lastModified": 1788332415,
"narHash": "sha256-BTFrmyh0oaVDsvA9NNw0YpbbeppTwU0t70iVx672Ew8=",
"lastModified": 1779074409,
"narHash": "sha256-6aXy8Ga41iLVM8ibddFU1O5+wYWcBGNEfZzZuL91eIc=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "860d7c835ab91bfc8972b67092f5f2db8e9390a0",
"rev": "2a77b5b1dc952f214e8102acdef1622b68515560",
"type": "github"
},
"original": {
@@ -615,11 +810,11 @@
]
},
"locked": {
"lastModified": 1791103873,
"narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
"lastModified": 1780547341,
"narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
"rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
"type": "github"
},
"original": {
@@ -630,11 +825,26 @@
},
"systems": {
"locked": {
"lastModified": 1791244623,
"narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
"lastModified": 1689347949,
"narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
"owner": "nix-systems",
"repo": "default-linux",
"rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default-linux",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
@@ -643,7 +853,22 @@
"type": "github"
}
},
"systems_2": {
"systems_3": {
"locked": {
"lastModified": 1689347949,
"narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
"owner": "nix-systems",
"repo": "default-linux",
"rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default-linux",
"type": "github"
}
},
"systems_4": {
"locked": {
"lastModified": 1689347949,
"narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -667,11 +892,11 @@
]
},
"locked": {
"lastModified": 1786901030,
"narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
"lastModified": 1775636079,
"narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
"rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
"type": "github"
},
"original": {
@@ -688,11 +913,33 @@
]
},
"locked": {
"lastModified": 1791203292,
"narHash": "sha256-vuzVwvjeucSnwKwMBpyP8r5IzdrMKCHEdwTrRFwUN7I=",
"lastModified": 1780220602,
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "03d8ee1bcbc8f9638907bb79edb9673151d0e22b",
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "treefmt-nix",
"type": "github"
}
},
"treefmt-nix_3": {
"inputs": {
"nixpkgs": [
"noctalia",
"noctalia-qs",
"nixpkgs"
]
},
"locked": {
"lastModified": 1775636079,
"narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
"owner": "numtide",
"repo": "treefmt-nix",
"rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
"type": "github"
},
"original": {
@@ -703,18 +950,20 @@
},
"walker": {
"inputs": {
"elephant": "elephant",
"elephant": [
"elephant"
],
"nixpkgs": [
"nixpkgs"
],
"systems": "systems_2"
"systems": "systems_4"
},
"locked": {
"lastModified": 1791441924,
"narHash": "sha256-2SLAXtgtsZgjK+dyzDAV47oQNoip3dsGX+XXrT/udEk=",
"lastModified": 1777789924,
"narHash": "sha256-fX3ErzTmHRO9z1SzHC2VZUgKOgRfO13X/joC5a3QN7Q=",
"owner": "abenz1267",
"repo": "walker",
"rev": "a515085fd39fae80acc086c8fbfd9b7771a9a11d",
"rev": "93d44d1cb41732e1370e4b949429ae8e34ea05a4",
"type": "github"
},
"original": {
@@ -722,6 +971,39 @@
"repo": "walker",
"type": "github"
}
},
"xwayland-satellite-stable": {
"flake": false,
"locked": {
"lastModified": 1755491097,
"narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
"owner": "Supreeeme",
"repo": "xwayland-satellite",
"rev": "388d291e82ffbc73be18169d39470f340707edaa",
"type": "github"
},
"original": {
"owner": "Supreeeme",
"ref": "v0.7",
"repo": "xwayland-satellite",
"type": "github"
}
},
"xwayland-satellite-unstable": {
"flake": false,
"locked": {
"lastModified": 1779745227,
"narHash": "sha256-yqY7RtEJGJiENzR0GwL6q69tSAy6xAAmAcLuIhLjPf8=",
"owner": "Supreeeme",
"repo": "xwayland-satellite",
"rev": "5d1efbc9dc3ab1c10160b656e0247f3325daf0f2",
"type": "github"
},
"original": {
"owner": "Supreeeme",
"repo": "xwayland-satellite",
"type": "github"
}
}
},
"root": "root",
+18 -13
View File
@@ -2,31 +2,29 @@
description = "NixOS Configuration";
inputs = {
devenv.url = "github:cachix/devenv";
disko = {
url = "github:nix-community/disko";
inputs.nixpkgs.follows = "nixpkgs";
};
flake-parts.url = "github:hercules-ci/flake-parts";
devenv.url = "github:cachix/devenv";
flake-parts.follows = "lux-pkgs/flake-parts";
home-manager = {
url = "github:nix-community/home-manager";
inputs.nixpkgs.follows = "nixpkgs";
};
import-tree.url = "github:vic/import-tree";
llm-agents.url = "github:numtide/llm-agents.nix";
llm-agents = {
url = "github:numtide/llm-agents.nix";
inputs.nixpkgs.follows = "nixpkgs";
};
niri.url = "github:sodiboo/niri-flake";
nix-wrapper-modules = {
url = "github:BirdeeHub/nix-wrapper-modules";
inputs.nixpkgs.follows = "nixpkgs";
};
nixos-hardware = {
url = "github:NixOS/nixos-hardware/master";
inputs.nixpkgs.follows = "nixpkgs";
};
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz";
noctalia = {
url = "github:noctalia-dev/noctalia/cachix";
# Keep upstream's nixpkgs pin to match its cached builds.
};
noctalia.url = "github:noctalia-dev/noctalia-shell";
sops-nix = {
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";
@@ -36,10 +34,17 @@
inputs.nixpkgs.follows = "nixpkgs";
};
walker = {
url = "github:abenz1267/walker";
elephant = {
url = "github:abenz1267/elephant";
inputs.nixpkgs.follows = "nixpkgs";
};
walker = {
url = "github:abenz1267/walker";
inputs.elephant.follows = "elephant";
inputs.nixpkgs.follows = "nixpkgs";
};
lux-pkgs.url = "git+ssh://gitea@orion/kiri/lux-pkgs";
};
outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
-7
View File
@@ -1,7 +0,0 @@
# List repository maintenance commands.
default:
@just --list
# Format, evaluate, and build all hosts and the workbench; optionally name hosts for iteration.
validate *hosts:
@python3 scripts/validate.py {{hosts}}
+69
View File
@@ -0,0 +1,69 @@
{
cursor = {
name = "phinger-cursors-light";
packagePath = [ "phinger-cursors" ];
size = 24;
};
kanagawa = {
displayName = "Kanagawa Wave";
name = "kanagawa-wave";
gtkThemeName = "Kanagawa-BL-LB";
iconThemeName = "Kanagawa";
owner = "Fausto-Korpsvart";
repo = "Kanagawa-GKT-Theme";
rev = "55ca4ba249eba21f861b9866b71ab41bb8930318";
hash = "sha256-UdMoMx2DoovcxSp/zBZ3PRv/Qpj+prd0uPm1gmdak2E=";
version = "unstable-2025-10-23";
palette = {
background = "#1F1F28";
foreground = "#DCD7BA";
secondaryBackground = "#16161D";
border = "#2A2A37";
selectionBackground = "#2D4F67";
selectionForeground = "#C8C093";
url = "#72A7BC";
cursor = "#C8C093";
muted = "#727169";
accents = {
blue = "#7E9CD8";
green = "#98BB6C";
magenta = "#D27E99";
orange = "#FFA066";
purple = "#957FB8";
red = "#E82424";
yellow = "#E6C384";
cyan = "#7AA89F";
};
niri.border = {
active = "#7E9CD8";
inactive = "#54546D";
urgent = "#E82424";
};
terminal = {
color0 = "#16161D";
color1 = "#C34043";
color2 = "#76946A";
color3 = "#C0A36E";
color4 = "#7E9CD8";
color5 = "#957FB8";
color6 = "#6A9589";
color7 = "#C8C093";
color8 = "#727169";
color9 = "#E82424";
color10 = "#98BB6C";
color11 = "#E6C384";
color12 = "#7FB4CA";
color13 = "#938AA9";
color14 = "#7AA89F";
color15 = "#DCD7BA";
color16 = "#FFA066";
color17 = "#FF5D62";
};
};
};
}
-17
View File
@@ -1,17 +0,0 @@
{ config, ... }:
{
flake.modules.nixos.actual = {
imports = [ config.flake.modules.nixos.caddy ];
services.actual = {
enable = true;
settings = {
hostname = "127.0.0.1";
port = 3000;
};
};
services.caddy.virtualHosts.${config.facts.services.actual.domain}.extraConfig =
"reverse_proxy 127.0.0.1:3000";
};
}
-7
View File
@@ -1,7 +0,0 @@
{
flake.modules.nixos.adb =
{ pkgs, ... }:
{
environment.systemPackages = [ pkgs.android-tools ];
};
}
+100
View File
@@ -0,0 +1,100 @@
{ inputs, config, ... }:
let
account = config.repo.account;
hmModules = config.flake.modules.homeManager;
sharedContext = ''
# Global Agent Context
Be a concise technical thought partner. Check the premise before executing, optimize for the user's actual outcome, and make important assumptions or tradeoffs visible.
## Machine Environment
- This machine is Nix/NixOS-based. Standard Linux assumptions may be wrong: software is usually provided by flakes, dev shells, `devenv`, `direnv`, or the user's NixOS/Home Manager config rather than `apt`, `dnf`, or global installs.
- If a repo has `flake.nix`, `devenv.nix`, `shell.nix`, or `.envrc`, prefer entering or invoking its dev environment (`nix develop`, `devenv shell`, or `direnv exec . <cmd>`). `direnv` may not be loaded automatically inside agent shells.
- For NixOS/Home Manager/nixpkgs/packages/options, use the NixOS MCP when available instead of relying on memory.
## User Preferences
- The user values precision, minimalism, and conceptual clarity. Challenge weak premises, but explain why.
- For larger or ambiguous work, interview or plan before broad implementation. For small concrete requests, proceed with the obvious scoped change.
'';
in
{
flake.modules.nixos.ai = {
home-manager.sharedModules = [ hmModules.ai ];
nixpkgs.overlays = [ inputs.llm-agents.overlays.default ];
nix.settings = {
extra-substituters = [ "https://cache.numtide.com" ];
extra-trusted-public-keys = [
"niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
];
};
};
flake.modules.homeManager.ai =
{
config,
lib,
pkgs,
...
}:
{
home.sessionVariables.GEMINI_CONFIG_DIR = "${config.xdg.configHome}/gemini";
programs.mcp = {
enable = true;
servers.nixos = {
command = "${pkgs.uv}/bin/uvx";
args = [ "mcp-nixos" ];
};
};
programs.gemini-cli = {
enable = false;
package = pkgs.llm-agents.gemini-cli;
enableMcpIntegration = true;
context.AGENTS = sharedContext;
settings = {
context = {
fileName = [
"AGENTS.md"
"GEMINI.md"
];
loadMemoryFromIncludeDirectories = true;
};
model.name = "gemini-3.1-pro-preview";
};
};
programs.codex = {
enable = true;
package = pkgs.llm-agents.codex;
enableMcpIntegration = true;
context = sharedContext;
settings = {
model = "gpt-5.5";
model_reasoning_effort = "high";
plan_mode_reasoning_effort = "high";
tui.status_line = [
"model-with-reasoning"
"current-dir"
"git-branch"
"context-remaining"
"five-hour-limit"
];
projects.${account.nixosConfigurationPath}.trust_level = "trusted";
projects."${config.homeDirectory}/work/repos/yookr_data_science".trust_level = "trusted";
sandbox_mode = "workspace-write";
personality = "pragmatic";
features.undo = true;
mcp_servers.nixos = config.programs.mcp.servers.nixos // {
enabled = true;
default_tools_approval_mode = "approve";
};
};
};
};
}
@@ -1,36 +0,0 @@
{ pkgs }:
let
sources = import ./sources.nix { inherit pkgs; };
context7Headers = pkgs.writeShellScript "context7-http-headers" ''
set -euo pipefail
CONTEXT7_KEY_FILE="''${XDG_CONFIG_HOME:-$HOME/.config}/context7/api-key"
CONTEXT7_KEY="$(< "$CONTEXT7_KEY_FILE")"
exec ${pkgs.jq}/bin/jq --null-input --compact-output \
--arg authorization "Bearer $CONTEXT7_KEY" '{ Authorization: $authorization }'
'';
codexHooks = {
SessionStart = [
{
hooks = [
{
type = "command";
command = "${pkgs.bash}/bin/bash ${sources.herdr}/src/integration/assets/codex/herdr-agent-state.sh session";
timeout = 10;
}
];
}
];
};
in
{
inherit context7Headers codexHooks;
skills = {
context7-mcp = ../skills/context7-mcp;
herdr = "${sources.herdr}/skills/herdr";
};
servers = {
context7.url = "https://mcp.context7.com/mcp";
nixos.command = "${pkgs.mcp-nixos}/bin/mcp-nixos";
openaiDeveloperDocs.url = "https://developers.openai.com/mcp";
};
}
@@ -1,4 +0,0 @@
{ pkgs }:
{
herdr = pkgs.llm-agents.herdr.src;
}
-193
View File
@@ -1,193 +0,0 @@
{ inputs, config, ... }:
let
hmModules = config.flake.modules.homeManager;
nixosModules = config.flake.modules.nixos;
in
{
flake.modules.nixos.ai =
{ pkgs, ... }:
let
ai = import ./_support/assets.nix { inherit pkgs; };
codexConfig = (pkgs.formats.toml { }).generate "codex-config.toml" {
model = "gpt-5.6-sol";
model_reasoning_effort = "high";
plan_mode_reasoning_effort = "high";
service_tier = "default";
approvals_reviewer = "auto_review";
features.hooks = true;
tui = {
status_line = [
"model-with-reasoning"
"current-dir"
"context-remaining"
"five-hour-limit"
"weekly-limit"
"git-branch"
];
status_line_use_colors = true;
};
features.plugins = true;
# The Nix package lacks the codex-package.json layout the daemon requires.
features.daemon_auto_start = false;
hooks = ai.codexHooks;
mcp_servers = ai.servers // {
context7 = ai.servers.context7 // {
http_headers_helper = "${ai.context7Headers}";
};
nixos = ai.servers.nixos // {
startup_timeout_sec = 60.0;
tools.nix.approval_mode = "approve";
};
};
};
in
{
imports = [ nixosModules.podman ];
home-manager.sharedModules = [ hmModules.ai ];
environment.etc."codex/config.toml".source = codexConfig;
nixpkgs.overlays = [ inputs.llm-agents.overlays.shared-nixpkgs ];
nix.settings = {
extra-substituters = [ "https://cache.numtide.com" ];
extra-trusted-public-keys = [
"niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
];
};
services.ollama = {
enable = true;
package = pkgs.ollama-vulkan;
loadModels = [ "nomic-embed-text" ];
};
};
flake.modules.homeManager.ai =
{ pkgs, lib, ... }:
let
ai = import ./_support/assets.nix { inherit pkgs; };
in
{
services.podman = {
volumes = {
grounded-docs-config = { };
grounded-docs-data = { };
};
containers.grounded-docs = {
image = "ghcr.io/arabold/docs-mcp-server:2.4.0";
network = "host";
volumes = [
"grounded-docs-config.volume:/config"
"grounded-docs-data.volume:/data"
];
environment = {
DOCS_MCP_APP_TELEMETRY_ENABLED = "false";
DOCS_MCP_EMBEDDING_MODEL = "openai:nomic-embed-text";
DOCS_MCP_EMBEDDINGS_VECTOR_DIMENSION = "768";
OPENAI_API_BASE = "http://127.0.0.1:11434/v1";
OPENAI_API_KEY = "ollama";
};
exec = "--protocol http --host 127.0.0.1 --port 6280";
};
};
home.packages = [
# Node-based Codex plugin hooks and skill scripts need node/npm outside project dev shells.
pkgs.nodejs
pkgs.python3
inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex
pkgs.bubblewrap
inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.chatgpt
inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.pi
inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.claude-code
inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.herdr
pkgs.ctx7
];
xdg.configFile."herdr/config.toml".text = ''
onboarding = false
[ui]
agent_panel_sort = "spaces"
prompt_new_tab_name = false
[ui.toast]
delivery = "off"
[keys]
# Super belongs to Niri; Ctrl navigation belongs to Neovim.
focus_pane_left = ["prefix+h", "ctrl+alt+h"]
focus_pane_down = ["prefix+j", "ctrl+alt+j"]
focus_pane_up = ["prefix+k", "ctrl+alt+k"]
focus_pane_right = ["prefix+l", "ctrl+alt+l"]
next_workspace = "ctrl+alt+u"
previous_workspace = "ctrl+alt+i"
navigate_workspace_down = "u"
navigate_workspace_up = "i"
workspace_picker = ["prefix+w", "ctrl+alt+o"]
goto = ["prefix+g", "ctrl+alt+g"]
previous_agent = "ctrl+alt+p"
next_agent = "ctrl+alt+n"
previous_tab = ["prefix+p", "ctrl+alt+["]
next_tab = ["prefix+n", "ctrl+alt+]"]
new_tab = ["prefix+c", "ctrl+alt+enter"]
split_vertical = ["prefix+v", "ctrl+alt+v"]
split_horizontal = ["prefix+minus", "ctrl+alt+minus"]
zoom = ["prefix+z", "ctrl+alt+f"]
detach = ["prefix+q", "ctrl+alt+q"]
swap_pane_left = ["prefix+shift+h", "ctrl+alt+shift+h"]
swap_pane_down = ["prefix+shift+j", "ctrl+alt+shift+j"]
swap_pane_up = ["prefix+shift+k", "ctrl+alt+shift+k"]
swap_pane_right = ["prefix+shift+l", "ctrl+alt+shift+l"]
resize_pane_left = "ctrl+alt+shift+left"
resize_pane_down = "ctrl+alt+shift+down"
resize_pane_up = "ctrl+alt+shift+up"
resize_pane_right = "ctrl+alt+shift+right"
resize_mode = ["prefix+r", "ctrl+alt+r"]
cycle_pane_next = ["prefix+tab", "ctrl+alt+tab"]
cycle_pane_previous = ["prefix+shift+tab", "ctrl+alt+shift+tab"]
last_pane = "ctrl+alt+backspace"
close_pane = ["prefix+x", "ctrl+alt+x"]
rename_pane = ["prefix+shift+p", "ctrl+alt+shift+p"]
copy_mode = ["prefix+[", "ctrl+alt+y"]
edit_scrollback = ["prefix+e", "ctrl+alt+e"]
close_tab = ["prefix+shift+x", "ctrl+alt+shift+x"]
rename_tab = ["prefix+shift+t", "ctrl+alt+shift+a"]
move_tab_previous = "ctrl+alt+shift+["
move_tab_next = "ctrl+alt+shift+]"
new_workspace = ["prefix+shift+n", "ctrl+alt+shift+enter"]
rename_workspace = ["prefix+shift+w", "ctrl+alt+shift+w"]
close_workspace = ["prefix+shift+d", "ctrl+alt+shift+d"]
open_worktree = "ctrl+alt+w"
new_worktree = ["prefix+shift+g", "ctrl+alt+shift+b"]
toggle_sidebar = ["prefix+b", "ctrl+alt+b"]
help = ["prefix+?", "ctrl+alt+slash"]
settings = ["prefix+s", "ctrl+alt+s"]
reload_config = ["prefix+shift+r", "ctrl+alt+shift+r"]
[[keys.command]]
key = "ctrl+alt+shift+g"
type = "popup"
command = "lazygit"
description = "Lazygit"
width = "90%"
height = "90%"
'';
# Codex owns its writable user config; Nix owns assets and system defaults.
home.file =
lib.mapAttrs' (
name: source: lib.nameValuePair ".agents/skills/${name}" { inherit source; }
) ai.skills
// {
".codex/AGENTS.md".text = builtins.readFile ./instructions/codex.md;
};
};
}
@@ -1,23 +0,0 @@
# Environment
- Use `nix run` for missing commands and `--quiet` for Nix commands.
- Capture large Nix listings in `/tmp`; read targeted excerpts and failure logs. Locate store files before reading them.
- Manage persistent binaries, skills, plugins and MCP definitions in `/home/kiri/.config/nixos`. Keep interactive settings, credentials and session state outside Nix.
# Work
- Complete authorized work without repeated confirmation. Make reasonable assumptions for routine choices; ask about consequential unknowns while continuing independent work.
- Prefer existing capabilities and simple solutions. Add abstractions or compatibility code only for a concrete need; explain required manual steps.
- Verify unfamiliar or consequential APIs against version-appropriate primary documentation; prefer Context7.
- Never push without my explicit approval. Other remote actions must remain within the authorized task.
- User instructions take precedence over skill guidelines, including testing defaults.
# Validation
- Do not write or run tests or perform extensive validation unless explicitly requested.
- For routine changes, use a focused review or small manual check. Report only checks performed.
# Writing
- Lead with the result. Write concisely in plain language, preserving important reasoning, evidence and limitations.
- Omit repetition and stock phrases. Use lists when they improve readability.
@@ -1,56 +0,0 @@
---
name: context7-mcp
description: This skill should be used when the user asks about libraries, frameworks, API references, or needs code examples. Activates for setup questions, code generation involving libraries, or mentions of specific frameworks like React, Vue, Next.js, Prisma, Supabase, etc.
---
When the user asks about libraries, frameworks, or needs code examples, use Context7 to fetch current documentation instead of relying on training data.
## When to Use This Skill
Activate this skill when the user:
- Asks setup or configuration questions ("How do I configure Next.js middleware?")
- Requests code involving libraries ("Write a Prisma query for...")
- Needs API references ("What are the Supabase auth methods?")
- Mentions specific frameworks (React, Vue, Svelte, Express, Tailwind, etc.)
## How to Fetch Documentation
### Step 1: Resolve the Library ID
Call `resolve-library-id` with:
- `libraryName`: The library name extracted from the user's question
- `query`: The user's full question (improves relevance ranking)
### Step 2: Select the Best Match
From the resolution results, choose based on:
- Exact or closest name match to what the user asked for
- Higher benchmark scores indicate better documentation quality
- If the user mentioned a version (e.g., "React 19"), prefer version-specific IDs
### Step 3: Fetch the Documentation
Call `query-docs` with:
- `libraryId`: The selected Context7 library ID (e.g., `/vercel/next.js`)
- `query`: The user's specific question, scoped to a single concept
If the user's question spans multiple distinct concepts (e.g. routing and auth and caching), make a separate `query-docs` call per concept with the same library ID, unless the question is about how the concepts interact — combined queries dilute ranking and return shallow results for each topic.
### Step 4: Use the Documentation
Incorporate the fetched documentation into your response:
- Answer the user's question using current, accurate information
- Include relevant code examples from the docs
- Cite the library version when relevant
## Guidelines
- **Be specific**: Pass the user's full question as the query for better results, but keep each query to a single concept
- **One topic per query**: Split multi-topic questions into separate `query-docs` calls — resolve the library ID once, then query per concept, unless the question is about how the concepts interact
- **Version awareness**: When users mention versions ("Next.js 15", "React 19"), use version-specific library IDs if available from the resolution step
- **Prefer official sources**: When multiple matches exist, prefer official/primary packages over community forks
+1 -9
View File
@@ -6,15 +6,7 @@
alsa.enable = true;
pulse.enable = true;
jack.enable = true;
wireplumber.enable = true;
};
};
flake.modules.homeManager.audio =
{ pkgs, ... }:
{
home.packages = [
pkgs.reaper
pkgs.bitwig-studio
];
};
}
+62 -54
View File
@@ -1,73 +1,76 @@
{ config, ... }:
let
homeModules = config.flake.modules.homeManager;
vivaldiPackage = pkgs: pkgs.vivaldi;
nautilusPackage = pkgs: pkgs.nautilus;
in
{
flake.modules.homeManager.desktop-commands =
{ lib, ... }:
{
options.desktop = {
commands = {
browser = lib.mkOption {
type = lib.types.nonEmptyListOf lib.types.nonEmptyStr;
};
launcher = lib.mkOption {
type = lib.types.nonEmptyListOf lib.types.nonEmptyStr;
};
terminal = lib.mkOption {
type = lib.types.nonEmptyListOf lib.types.nonEmptyStr;
};
};
autostart = lib.mkOption {
type = lib.types.listOf (lib.types.nonEmptyListOf lib.types.nonEmptyStr);
default = [ ];
};
};
};
flake.modules.homeManager.vivaldi =
{ lib, pkgs, ... }:
let
command = lib.getExe pkgs.vivaldi;
in
{
desktop.commands.browser = [ command ];
home = {
packages = [ pkgs.vivaldi ];
sessionVariables.BROWSER = command;
};
xdg.mimeApps.defaultApplicationPackages = [ pkgs.vivaldi ];
};
flake.modules.homeManager.imv =
flake.modules.homeManager.browser-vivaldi =
{ pkgs, ... }:
{
programs.imv.enable = true;
home.packages = [ (vivaldiPackage pkgs) ];
};
flake.modules.homeManager.primary-browser-vivaldi =
{ lib, pkgs, ... }:
{
imports = [ homeModules.browser-vivaldi ];
facts.desktop.browserCommand = lib.getExe (vivaldiPackage pkgs);
home.sessionVariables.BROWSER = lib.getExe (vivaldiPackage pkgs);
xdg.mimeApps.defaultApplicationPackages = [ (vivaldiPackage pkgs) ];
};
flake.modules.homeManager.file-manager-nautilus =
{ pkgs, ... }:
{
home.packages = [ (nautilusPackage pkgs) ];
};
flake.modules.homeManager.primary-file-manager-nautilus =
{ lib, pkgs, ... }:
{
imports = [ homeModules.file-manager-nautilus ];
xdg.mimeApps.defaultApplicationPackages = [ (nautilusPackage pkgs) ];
};
flake.modules.homeManager.image-viewer-imv = {
programs.imv.enable = true;
};
flake.modules.homeManager.default-image-viewer-imv =
{ pkgs, ... }:
{
imports = [ homeModules.image-viewer-imv ];
xdg.mimeApps.defaultApplicationPackages = [ pkgs.imv ];
};
flake.modules.homeManager.sioyek =
flake.modules.homeManager.document-viewer-sioyek = {
programs.sioyek.enable = true;
};
flake.modules.homeManager.default-document-viewer-sioyek =
{ pkgs, ... }:
{
programs.sioyek.enable = true;
imports = [ homeModules.document-viewer-sioyek ];
xdg.mimeApps.defaultApplicationPackages = [ pkgs.sioyek ];
};
flake.modules.homeManager.discord = {
programs.discord = {
enable = true;
settings.SKIP_HOST_UPDATE = true;
};
};
flake.modules.homeManager.workstation-apps =
{ lib, pkgs, ... }:
{ pkgs, ... }:
{
home.packages = with pkgs; [
postman
spotify
calcure
planify
unzip
gimp
dbeaver-bin
onlyoffice-desktopeditors
pinta
audacity
];
xdg.mimeApps.defaultApplicationPackages = lib.mkAfter [ pkgs.onlyoffice-desktopeditors ];
};
flake.modules.homeManager.xdg =
@@ -84,6 +87,9 @@
enable = true;
cacheHome = "${localDir}/cache";
configHome = "${homeDir}/.config";
dataHome = "${localDir}/share";
stateHome = "${localDir}/state";
userDirs = {
enable = true;
@@ -92,7 +98,7 @@
download = "${homeDir}/downloads";
documents = "${homeDir}/documents";
projects = "${homeDir}/projects";
projects = "${homeDir}/dev";
music = "${mediaDir}/music";
pictures = "${mediaDir}/images";
videos = "${mediaDir}/videos";
@@ -101,7 +107,9 @@
templates = "${localDir}/templates";
};
mimeApps.enable = true;
mimeApps = {
enable = true;
};
};
};
}
+29 -16
View File
@@ -1,32 +1,45 @@
{ inputs, ... }:
{
perSystem = { pkgs, ... }: {
packages.devenv = inputs.devenv.packages.${pkgs.stdenv.hostPlatform.system}.devenv;
};
flake.modules.homeManager.dev-tools =
{ config, pkgs, ... }:
{
home.sessionVariables.CARGO_HOME = "${config.xdg.dataHome}/cargo";
home.packages = with pkgs; [
inputs.devenv.packages.${pkgs.stdenv.hostPlatform.system}.devenv
httpie
bruno
kubectl
kubelogin-oidc
rclone
scc
visidata
just
usql
posting
resterm
inputs.devenv.packages.${pkgs.stdenv.hostPlatform.system}.default
];
programs.lazygit.enable = true;
programs.jujutsu.enable = true;
programs.jq.enable = true;
programs.ripgrep.enable = true;
programs.k9s.enable = true;
# programs.direnv = {
# enable = true;
# enableZshIntegration = true;
# nix-direnv.enable = true;
# };
programs.zsh.initContent = ''
eval "$(devenv hook zsh)"
'';
programs.lazygit = {
enable = true;
enableZshIntegration = true;
};
programs.jujutsu.enable = true;
programs.jq.enable = true;
programs.bun.enable = true;
programs.ripgrep.enable = true;
#programs.uv.enable = true;
programs.git.ignores = [
"devenv.*"
".devenv*"
".direnv"
"pre-commit-config.yaml"
".envrc"
];
};
}
-17
View File
@@ -1,17 +0,0 @@
{
flake.modules.nixos.file-management = {
services.gvfs.enable = true;
services.udisks2.enable = true;
};
flake.modules.homeManager.file-management =
{ config, pkgs, ... }:
{
home.packages = [ pkgs.nautilus ];
gtk.gtk3.bookmarks = [
"sftp://${config.facts.topology.server.sshAlias} Orion VPS"
];
xdg.mimeApps.defaultApplicationPackages = [ pkgs.nautilus ];
};
}
+3 -1
View File
@@ -1,3 +1,5 @@
{
flake.modules.nixos.flatpak.services.flatpak.enable = true;
flake.modules.nixos.flatpak = {
services.flatpak.enable = true;
};
}
+22 -15
View File
@@ -5,32 +5,39 @@
fonts = {
enableDefaultPackages = false;
packages = with pkgs; [
fira
fira-code
geist-font
ibm-plex
inter
iosevka
jetbrains-mono
lexend
literata
merriweather
monaspace
montserrat
noto-fonts
noto-fonts-cjk-sans
noto-fonts-color-emoji
quicksand
iosevka
jetbrains-mono
fira-code
roboto
fira
merriweather
ibm-plex
lexend
literata
montserrat
source-sans-pro
source-serif-pro
victor-mono
];
fontconfig = {
enable = true;
antialias = true;
allowBitmaps = false;
useEmbeddedBitmaps = false;
subpixel.lcdfilter = "none";
hinting = {
enable = true;
autohint = false;
style = "slight";
};
subpixel = {
rgba = "none";
lcdfilter = "none";
};
};
};
};
+52 -70
View File
@@ -1,40 +1,49 @@
{ config, lib, ... }:
let
account = config.facts.account;
mkScope =
config: scope:
let
email = account.emails.${scope}.address;
key = config.facts.machine.sshKeys.${scope} or null;
hasSigningKey = key != null;
privateKeyPath =
if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
in
{
allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
git = {
user = {
name = account.realName;
inherit email;
}
// lib.optionalAttrs hasSigningKey {
signingKey = "${privateKeyPath}.pub";
};
}
// lib.optionalAttrs hasSigningKey {
core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
};
};
account = config.repo.account;
in
{
flake.modules.homeManager.git =
{ config, ... }:
{
config,
osConfig,
...
}:
let
personal = mkScope config "personal";
machine = osConfig.facts.machine;
allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
mkScope =
scope:
let
email = account.emails.${scope}.address;
key = lib.attrByPath [ scope ] null machine.sshKeys;
hasSigningKey = key != null;
privateKeyPath = key.privateKeyPath or "~/.ssh/id_${scope}";
in
{
allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
git = {
user = {
name = account.realName;
inherit email;
}
// lib.optionalAttrs hasSigningKey {
signingKey = "${privateKeyPath}.pub";
};
}
// lib.optionalAttrs hasSigningKey {
gpg.ssh.allowedSignersFile = allowedSignersFile;
};
};
personal = mkScope "personal";
work = mkScope "work";
in
{
xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" personal.allowedSigners;
xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" (
personal.allowedSigners ++ work.allowedSigners ++ [ "" ]
);
programs.git = {
enable = true;
@@ -50,18 +59,20 @@ in
email = account.emails.personal.address;
};
};
includes =
map
(path: {
condition = "gitdir:${path}/";
contents = personal.git;
})
[
account.nixosConfigurationPath
"${config.xdg.userDirs.projects}/own"
"${config.xdg.userDirs.projects}/ext"
"${config.xdg.userDirs.projects}/forks"
];
includes = [
{
condition = "gitdir:${account.nixosConfigurationPath}/";
contents = personal.git;
}
{
condition = "gitdir:${config.xdg.userDirs.projects}/";
contents = personal.git;
}
{
condition = "gitdir:${config.home.homeDirectory}/work/";
contents = work.git;
}
];
};
programs.gh = {
@@ -69,33 +80,4 @@ in
settings.git_protocol = "ssh";
};
};
flake.modules.homeManager.work-git =
{ config, pkgs, ... }:
let
work = mkScope config "work";
githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
gh = pkgs.symlinkJoin {
name = "gh-with-read-only-token-${pkgs.gh.version}";
paths = [ pkgs.gh ];
nativeBuildInputs = [ pkgs.makeWrapper ];
meta.mainProgram = "gh";
postBuild = ''
wrapProgram "$out/bin/gh" \
--run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
'';
};
in
{
xdg.configFile."git/allowed_signers".text = lib.mkAfter (
lib.concatStringsSep "\n" work.allowedSigners
);
programs.git.includes = [
{
condition = "gitdir:${config.home.homeDirectory}/yookr/";
contents = work.git;
}
];
programs.gh.package = gh;
};
}
-31
View File
@@ -1,31 +0,0 @@
{ config, ... }:
let
service = config.facts.services.gitea;
nixosModules = config.flake.modules.nixos;
in
{
flake.modules.nixos.gitea = {
imports = [
nixosModules.caddy
nixosModules.openssh
];
services.gitea = {
enable = true;
settings = {
server = {
ROOT_URL = "${service.origin}/";
HTTP_PORT = 3001;
HTTP_ADDR = "127.0.0.1";
};
service.DISABLE_REGISTRATION = true;
};
};
services.openssh.settings.AllowUsers = [ "gitea" ];
services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:3001";
};
}
-40
View File
@@ -1,40 +0,0 @@
{
flake.modules.nixos.handy = { pkgs, ... }: {
services.udev.packages = [
(pkgs.writeTextDir "lib/udev/rules.d/70-handy-keyboard.rules" ''
SUBSYSTEM=="input", KERNEL=="event*", ENV{ID_INPUT_KEYBOARD}=="1", TAG+="uaccess"
'')
];
};
flake.modules.homeManager.handy =
{ pkgs, ... }:
let
python = pkgs.python3.withPackages (ps: [ ps.evdev ]);
in
{
home.packages = [ pkgs.handy ];
systemd.user.services.handy = {
Unit = {
Description = "Handy dictation";
PartOf = [ "graphical-session.target" ];
After = [ "graphical-session.target" ];
};
Install.WantedBy = [ "graphical-session.target" ];
Service = {
ExecStart = "${pkgs.handy}/bin/handy --start-hidden";
};
};
systemd.user.services.handy-ptt = {
Unit = {
Description = "Handy push-to-talk key release listener";
PartOf = [ "graphical-session.target" ];
Requisite = [ "handy.service" ];
After = [ "handy.service" ];
};
Service.ExecStart = "${python}/bin/python ${./push_to_talk.py} ${pkgs.handy}/bin/handy";
};
};
}
@@ -1,48 +0,0 @@
"""Wait for release of the physical Super+D chord that launched this service."""
import signal
import subprocess
import sys
from contextlib import closing
from evdev import InputDevice, ecodes as key, list_devices
def held(keys):
return key.KEY_D in keys and bool({key.KEY_LEFTMETA, key.KEY_RIGHTMETA} & set(keys))
def interrupted(signum, frame):
raise KeyboardInterrupt
def main(handy):
signal.signal(signal.SIGTERM, interrupted)
for path in list_devices():
try:
device = InputDevice(path)
except OSError:
continue # Devices can disappear between enumeration and opening.
with closing(device):
if not held(device.active_keys()):
continue
action = "--cancel"
try:
subprocess.run([handy, "--toggle-transcription"], check=True)
# A quick release may already be queued while the CLI starts.
if held(device.active_keys()):
for event in device.read_loop():
if not held(device.active_keys()):
break
action = "--toggle-transcription"
finally:
# Disconnects, cancellation and service shutdown discard the recording.
subprocess.run([handy, action], check=True)
return
if __name__ == "__main__":
try:
main(sys.argv[1])
except KeyboardInterrupt:
pass
@@ -1,5 +1,5 @@
{
flake.modules.nixos.yunzi-b75-pro = {
flake.modules.nixos.hidraw-access = {
services.udev.extraRules = ''
# ROYUAN YUNZII B75 PRO
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="3151", ATTRS{idProduct}=="4015", MODE="0660", GROUP="users"
-3
View File
@@ -1,3 +0,0 @@
{
flake.modules.homeManager.keyring.services.gnome-keyring.enable = true;
}
+55 -7
View File
@@ -1,13 +1,19 @@
{ ... }:
{ config, lib, ... }:
let
palette = config.repo.theme.kanagawa.palette;
hex = lib.removePrefix "#";
terminalPalette = palette.terminal;
mkPalette = colors: lib.concatStringsSep ";" (map hex colors);
in
{
flake.modules.nixos.limine =
{ config, lib, ... }:
let
primaryDisplay = lib.findFirst (display: display.primary) null (
builtins.attrValues config.facts.machine.displays
);
displayValues = builtins.attrValues (config.facts.machine.displays or { });
primaryDisplays = lib.filter (display: display.primary or false) displayValues;
primaryDisplay = if primaryDisplays == [ ] then null else builtins.head primaryDisplays;
interfaceResolution =
if primaryDisplay != null && primaryDisplay.width != null then
if primaryDisplay != null && primaryDisplay ? width && primaryDisplay ? height then
"${toString primaryDisplay.width}x${toString primaryDisplay.height}"
else
null;
@@ -18,9 +24,51 @@
limine = {
enable = true;
maxGenerations = 10;
resolution = interfaceResolution;
resolution = "2560x1440";
style.interface.resolution = interfaceResolution;
style = {
backdrop = hex palette.secondaryBackground;
graphicalTerminal = {
background = "00${hex palette.background}";
foreground = hex palette.foreground;
brightForeground = hex palette.selectionForeground;
brightBackground = hex palette.selectionBackground;
palette = mkPalette [
terminalPalette.color0
terminalPalette.color1
terminalPalette.color2
terminalPalette.color3
terminalPalette.color4
terminalPalette.color5
terminalPalette.color6
terminalPalette.color7
];
brightPalette = mkPalette [
terminalPalette.color8
terminalPalette.color9
terminalPalette.color10
terminalPalette.color11
terminalPalette.color12
terminalPalette.color13
terminalPalette.color14
terminalPalette.color15
];
font = {
scale = "2x2";
spacing = 1;
};
margin = 64;
marginGradient = 24;
};
interface = {
branding = config.networking.hostName;
brandingColor = hex palette.accents.blue;
helpHidden = false;
resolution = interfaceResolution;
};
};
};
};
};
@@ -1,5 +1,6 @@
{ ... }:
{
flake.modules.nixos.locale = {
flake.modules.nixos.locale-nl = {
time.timeZone = "Europe/Amsterdam";
i18n.defaultLocale = "en_US.UTF-8";
@@ -10,7 +11,7 @@
LC_TELEPHONE = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8";
# Use '.' as decimal point and ',' as thousands separator
# Use '.' as decimal point and ',' as thouands separator
LC_NUMERIC = "en_IE.UTF-8";
LC_MONETARY = "en_IE.UTF-8";
-5
View File
@@ -1,5 +0,0 @@
{
flake.modules.nixos.localsend = {
programs.localsend.enable = true;
};
}
+3 -1
View File
@@ -4,7 +4,9 @@
{
programs.mpv = {
enable = true;
bindings.D = "cycle deband";
bindings = {
D = "cycle deband";
};
config = {
profile = "high-quality";
@@ -0,0 +1,64 @@
{ themeName }:
''
require("kanagawa").setup({
dimInactive = true,
colors = {
theme = {
all = {
ui = {
bg_gutter = "none"
}
}
}
},
overrides = function(colors)
local theme = colors.theme
local makeDiagnosticColor = function(color)
local c = require("kanagawa.lib.color")
return { fg = color, bg = c(color):blend(theme.ui.bg, 0.95):to_hex() }
end
return {
TelescopeTitle = { fg = theme.ui.special, bold = true },
TelescopePromptNormal = { bg = theme.ui.bg_p1 },
TelescopePromptBorder = { fg = theme.ui.bg_p1, bg = theme.ui.bg_p1 },
TelescopeResultsNormal = { fg = theme.ui.fg_dim, bg = theme.ui.bg_m1 },
TelescopeResultsBorder = { fg = theme.ui.bg_m1, bg = theme.ui.bg_m1 },
TelescopePreviewNormal = { bg = theme.ui.bg_dim },
TelescopePreviewBorder = { bg = theme.ui.bg_dim, fg = theme.ui.bg_dim },
Pmenu = { fg = theme.ui.shade0, bg = theme.ui.bg_p1 }, -- add `blend = vim.o.pumblend` to enable transparency
PmenuSel = { fg = "NONE", bg = theme.ui.bg_p2 },
PmenuSbar = { bg = theme.ui.bg_m1 },
PmenuThumb = { bg = theme.ui.bg_p2 },
DiagnosticVirtualTextHint = makeDiagnosticColor(theme.diag.hint),
DiagnosticVirtualTextInfo = makeDiagnosticColor(theme.diag.info),
DiagnosticVirtualTextWarn = makeDiagnosticColor(theme.diag.warning),
DiagnosticVirtualTextError = makeDiagnosticColor(theme.diag.error),
DiagnosticVirtualLinesHint = makeDiagnosticColor(theme.diag.hint),
DiagnosticVirtualLinesInfo = makeDiagnosticColor(theme.diag.info),
DiagnosticVirtualLinesWarn = makeDiagnosticColor(theme.diag.warning),
DiagnosticVirtualLinesError = makeDiagnosticColor(theme.diag.error),
FloatBorder = { fg = theme.ui.float.fg_border, bg = theme.ui.float.bg },
NormalFloat = { fg = theme.ui.float.fg, bg = theme.ui.float.bg },
WinBar = { fg = theme.ui.fg_dim, bg = "NONE" },
WinBarNC = { fg = theme.ui.nontext, bg = theme.ui.bg_dim },
BufferLineFill = { bg = theme.ui.bg_m3 },
BufferLineBackground = { fg = theme.ui.fg_dim, bg = theme.ui.bg_m3 },
BufferLineBufferSelected = { fg = theme.ui.fg, bg = theme.ui.bg, bold = true },
BufferLineModified = { fg = theme.vcs.changed, bg = theme.ui.bg_m3 },
BufferLineModifiedSelected = { fg = theme.vcs.changed, bg = theme.ui.bg },
BufferLineDiagnostic = { fg = theme.ui.nontext, bg = theme.ui.bg_m3 },
BufferLineDiagnosticSelected = { fg = theme.ui.fg_dim, bg = theme.ui.bg },
}
end,
})
vim.cmd.colorscheme("${themeName}")
''
@@ -1,25 +0,0 @@
{ pkgs }:
pkgs.svelte-language-server.overrideAttrs (
finalAttrs: _: {
version = "0.18.3";
src = pkgs.fetchFromGitHub {
owner = "sveltejs";
repo = "language-tools";
tag = "svelte-language-server@${finalAttrs.version}";
hash = "sha256-FTOkJPXbsG6R53yr4n0/IR2lzFCovrdV0+epOi07lBQ=";
};
pnpmDeps = pkgs.fetchPnpmDeps {
inherit (finalAttrs)
pname
version
src
pnpmWorkspaces
;
pnpm = pkgs.pnpm_10;
fetcherVersion = 3;
hash = "sha256-fY3hrCkr/soJk1gp39/jec8lT2ZJI27xRBCZi006oWA=";
};
}
)
+94 -140
View File
@@ -1,8 +1,15 @@
{ config, ... }:
let
account = config.facts.account;
account = config.repo.account;
repoTheme = config.repo.theme.kanagawa;
in
{
flake.modules.homeManager.default-editor-neovim =
{ pkgs, ... }:
{
xdg.mimeApps.defaultApplicationPackages = [ pkgs.neovim ];
};
flake.modules.homeManager.neovim =
{
pkgs,
@@ -11,48 +18,12 @@ in
osConfig,
...
}:
let
nvimTreesitter = pkgs.vimPlugins.nvim-treesitter;
svelteLanguageServer = import ./_support/svelte-language-server.nix { inherit pkgs; };
svelteGrammar = nvimTreesitter.builtGrammars.svelte.overrideAttrs (_: {
version = "0.0.0+rev=c2457b9";
src = pkgs.fetchFromGitHub {
owner = "m4rch3n1ng";
repo = "tree-sitter-svelte";
rev = "c2457b99a5b8ee38e14928dceeb246a61c097b77";
hash = "sha256-RIAe30TTzZhHuXxC2VRVk/X73Qm1u2LWOW3AsnUfRzI=";
};
});
nvimTreesitterWithGrammars = nvimTreesitter.withPlugins (
grammars: with grammars; [
astro
css
html
http
javascript
jsdoc
json
lua
markdown
markdown_inline
nix
python
query
regex
rust
sql
svelteGrammar
toml
tsx
typescript
typst
vim
vimdoc
yaml
]
);
in
{
home.sessionVariables = {
EDITOR = "nvim";
VISUAL = "nvim";
};
imports = [
(inputs.nix-wrapper-modules.lib.getInstallModule {
name = "neovim";
@@ -62,91 +33,56 @@ in
wrappers.neovim = {
enable = true;
# 1. Point to your existing Lua config directory
settings.config_directory = ./lua-config;
# 2. Runtime Dependencies (from lspsAndRuntimeDeps)
# These are added to the PATH of the wrapper
runtimePkgs = with pkgs; [
# Tools
universal-ctags
ripgrep
fd
tree-sitter
wl-clipboard
# LSPs & Formatters
stylua
nixfmt
oxfmt
taplo
yamlfmt
rustfmt
typstyle
ruff
lua-language-server
nixd
vscode-langservers-extracted
yaml-language-server
vtsls
svelteLanguageServer
tailwindcss-language-server
emmet-language-server
oxlint
nix-doc
nixfmt
dafny
typescript
typescript-language-server
rustc
rust-analyzer
rustfmt
astro-language-server
tinymist
typstyle
websocat
# ty
# basedpyright
ty
postgresql
mariadb
mongosh
kulala-core
kulala-fmt
curl
jq
openssl
zk
ruff
];
# 3. Plugins
# Nix provisions plugins; lz.n controls when lazy specs are packadd'd.
specs = {
lz-n.data = pkgs.vimPlugins.lz-n;
editing = {
lazy = true;
data = with pkgs.vimPlugins; [
mini-nvim
guess-indent-nvim
nvimTreesitterWithGrammars
nvim-treesitter-textobjects
rainbow-delimiters-nvim
nvim-ts-autotag
grug-far-nvim
];
lz-n = {
data = pkgs.vimPlugins.lz-n;
};
navigation = {
lazy = true;
support = {
data = with pkgs.vimPlugins; [
plenary-nvim
telescope-nvim
telescope-fzf-native-nvim
telescope-ui-select-nvim
{
data = oil-nvim;
lazy = false;
}
];
};
diagnostics = {
lazy = true;
data = with pkgs.vimPlugins; [ trouble-nvim ];
};
lsp = {
lazy = true;
data = with pkgs.vimPlugins; [
nvim-lspconfig
lazydev-nvim
nvim-navic
SchemaStore-nvim
kanagawa-nvim
nvim-treesitter.withAllGrammars
nvim-treesitter-textobjects
rainbow-delimiters-nvim
];
};
@@ -154,76 +90,94 @@ in
lazy = true;
data = with pkgs.vimPlugins; [
blink-cmp
colorful-menu-nvim
luasnip
friendly-snippets
{
data = blink-compat;
lazy = false;
}
colorful-menu-nvim
];
};
lsp = {
lazy = true;
data = with pkgs.vimPlugins; [
nvim-lspconfig
lazydev-nvim
trouble-nvim
typst-preview-nvim
];
};
formatting = {
lazy = true;
data = with pkgs.vimPlugins; [ conform-nvim ];
data = with pkgs.vimPlugins; [
conform-nvim
];
};
core = {
lazy = true;
data = with pkgs.vimPlugins; [
mini-nvim
guess-indent-nvim
direnv-vim
];
};
ui = {
lazy = true;
data = with pkgs.vimPlugins; [
render-markdown-nvim
lualine-nvim
bufferline-nvim
gitsigns-nvim
diffview-nvim
zen-mode-nvim
which-key-nvim
kulala-nvim
];
};
database = {
project = {
lazy = true;
data = with pkgs.vimPlugins; [
vim-dadbod
vim-dadbod-completion
vim-dadbod-ui
project-nvim
];
};
http = {
telescope = {
lazy = true;
data = with pkgs.vimPlugins; [ kulala-nvim ];
};
notes = {
lazy = true;
data = with pkgs.vimPlugins; [ zk-nvim ];
data = with pkgs.vimPlugins; [
telescope-nvim
telescope-fzf-native-nvim
telescope-ui-select-nvim
];
};
};
env.ZK_NOTEBOOK_DIR = "${config.home.homeDirectory}/sync/notes";
# 4. Values exposed to Lua through require("nix-info").settings.
settings = {
# Hostname/ConfigDir needed for nixd
nixdExtras = {
nixpkgs = "import ${pkgs.path} {}";
nixos_options = ''(builtins.getFlake "path://${account.nixosConfigurationPath}").nixosConfigurations.${osConfig.facts.machine.name}.options'';
home_manager_options = ''(builtins.getFlake "path://${account.nixosConfigurationPath}").nixosConfigurations.${osConfig.facts.machine.name}.options.home-manager.users.type.getSubOptions []'';
};
kulalaCorePath = "${pkgs.kulala-core}/bin/kulala-core";
themeSetup = import ./_kanagawa-theme.nix {
themeName = repoTheme.name;
};
typstPreviewDependencies = {
tinymist = "${pkgs.tinymist}/bin/tinymist";
websocat = "${pkgs.websocat}/bin/websocat";
};
};
};
};
flake.modules.homeManager.primary-editor-neovim =
{ pkgs, ... }:
{
imports = [ config.flake.modules.homeManager.neovim ];
# 5. Wrapper Configuration
# Enable Python/Node providers
hosts.python3.nvim-host.enable = true;
hosts.node.nvim-host.enable = true;
home.sessionVariables = {
EDITOR = "nvim";
VISUAL = "nvim";
# Ensure the bin name matches what you expect
binName = "nvim";
};
xdg.mimeApps.defaultApplicationPackages = [ pkgs.neovim ];
xdg.mimeApps.defaultApplications."text/markdown" = "nvim.desktop";
};
}
@@ -1,13 +0,0 @@
;; extends
(pair
key: [
(property_identifier) @_key
(string
(string_fragment) @_key)
]
value: (template_string) @injection.content
(#eq? @_key "sql")
(#offset! @injection.content 0 1 0 -1)
(#set! injection.include-children)
(#set! injection.language "sql"))
@@ -1,13 +1,8 @@
require("options")
require("keymaps")
require("autocmds")
require("plugins.editing")
require("plugins.navigation")
require("plugins.diagnostics")
require("plugins.lsp")
require("plugins.completion")
require("plugins.formatting")
require("plugins.treesitter")
require("plugins.telescope")
require("plugins.ui")
require("plugins.database")
require("plugins.http")
require("plugins.notes")
require("plugins.core")
@@ -1,13 +0,0 @@
vim.api.nvim_create_autocmd({ "FocusGained", "BufEnter", "TermLeave" }, {
desc = "Reload externally changed files without discarding unsaved edits",
group = vim.api.nvim_create_augroup("lux-checktime", { clear = true }),
command = "checktime",
})
vim.api.nvim_create_autocmd("TextYankPost", {
desc = "Highlight yanked text",
group = vim.api.nvim_create_augroup("lux-highlight-yank", { clear = true }),
callback = function()
vim.hl.on_yank()
end,
})
@@ -1,28 +0,0 @@
vim.g.mapleader = " "
vim.g.maplocalleader = ","
for _, lhs in ipairs({ "grn", "gra", "grx", "grr", "gri", "grt", "gO" }) do
vim.keymap.del("n", lhs)
end
vim.keymap.del("x", "gra")
vim.keymap.del({ "i", "s" }, "<C-S>")
for _, key in ipairs({ "j", "k" }) do
vim.keymap.set({ "n", "x" }, key, function()
return vim.bo.buftype == "" and vim.v.count == 0 and "g" .. key or key
end, { expr = true, desc = "Move by displayed line, or logical line with a count" })
end
vim.keymap.set("n", "<C-h>", "<C-w><C-h>", { desc = "Focus left window" })
vim.keymap.set("n", "<C-j>", "<C-w><C-j>", { desc = "Focus lower window" })
vim.keymap.set("n", "<C-k>", "<C-w><C-k>", { desc = "Focus upper window" })
vim.keymap.set("n", "<C-l>", "<C-w><C-l>", { desc = "Focus right window" })
vim.keymap.set("n", "gl", vim.diagnostic.open_float, { desc = "Show diagnostic details" })
vim.keymap.set("t", "<Esc><Esc>", "<C-\\><C-n>", { desc = "Leave terminal mode" })
vim.keymap.set("n", "<leader>bd", "<cmd>bdelete<cr>", { desc = "Delete current buffer" })
vim.keymap.set("n", "[d", function()
vim.diagnostic.jump({ count = -1 })
end, { desc = "Previous diagnostic" })
vim.keymap.set("n", "]d", function()
vim.diagnostic.jump({ count = 1 })
end, { desc = "Next diagnostic" })
@@ -1,32 +1,74 @@
vim.g.mapleader = " "
vim.g.maplocalleader = " "
vim.o.expandtab = true
vim.o.shiftwidth = 2
vim.o.tabstop = 2
vim.o.softtabstop = 2
vim.o.number = true
vim.o.showmode = false
vim.o.showtabline = 0
vim.o.signcolumn = "yes"
vim.o.cursorline = true
vim.o.scrolloff = 10
-- vim.o.relativenumber = true
vim.o.mouse = "a"
vim.o.clipboard = "unnamedplus"
vim.o.confirm = true
vim.o.timeoutlen = 300
vim.o.updatetime = 250
vim.o.showmode = false
vim.opt.shortmess:append("Wc")
vim.schedule(function()
vim.o.clipboard = "unnamedplus"
end)
vim.o.breakindent = true
vim.o.linebreak = true
vim.o.undofile = true
vim.o.ignorecase = true
vim.o.smartcase = true
vim.o.inccommand = "split"
vim.o.signcolumn = "yes"
vim.o.updatetime = 250
vim.o.timeoutlen = 300
vim.o.splitright = true
vim.o.splitbelow = true
vim.opt.shortmess:append("Wc")
vim.o.list = true
vim.opt.listchars = { tab = "» ", trail = "·", nbsp = "␣" }
vim.o.inccommand = "split"
vim.o.cursorline = true
vim.o.scrolloff = 10
vim.o.confirm = true
vim.keymap.set("n", "<Esc>", "<cmd>nohlsearch<CR>")
vim.keymap.set("n", "<leader>q", vim.diagnostic.setloclist, { desc = "Open diagnostic [Q]uickfix list" })
vim.keymap.set("t", "<Esc><Esc>", "<C-\\><C-n>", { desc = "Exit terminal mode" })
vim.keymap.set("n", "<C-h>", "<C-w><C-h>", { desc = "Move focus to the left window" })
vim.keymap.set("n", "<C-l>", "<C-w><C-l>", { desc = "Move focus to the right window" })
vim.keymap.set("n", "<C-j>", "<C-w><C-j>", { desc = "Move focus to the lower window" })
vim.keymap.set("n", "<C-k>", "<C-w><C-k>", { desc = "Move focus to the upper window" })
vim.keymap.set("n", "j", "gj", { silent = true })
vim.keymap.set("n", "k", "gk", { silent = true })
-- vim.keymap.set("n", "<C-S-h>", "<C-w>H", { desc = "Move window to the left" })
-- vim.keymap.set("n", "<C-S-l>", "<C-w>L", { desc = "Move window to the right" })
-- vim.keymap.set("n", "<C-S-j>", "<C-w>J", { desc = "Move window to the lower" })
-- vim.keymap.set("n", "<C-S-k>", "<C-w>K", { desc = "Move window to the upper" })
vim.api.nvim_create_autocmd("TextYankPost", {
desc = "Highlight when yanking (copying) text",
group = vim.api.nvim_create_augroup("lux-highlight-yank", { clear = true }),
callback = function()
vim.hl.on_yank()
end,
})
@@ -1,7 +1,19 @@
require("blink.compat").setup({})
require("lz.n").load({
{ "friendly-snippets" },
{
"friendly-snippets",
},
{
"luasnip",
event = { "InsertEnter", "CmdlineEnter" },
before = function()
require("lz.n").trigger_load("friendly-snippets")
end,
after = function()
require("luasnip.loaders.from_vscode").lazy_load()
-- Load custom lua snippets
require("luasnip.loaders.from_lua").load({ paths = { vim.fn.stdpath("config") .. "/snippets" } })
end,
},
{
"colorful-menu.nvim",
event = { "InsertEnter", "CmdlineEnter" },
@@ -12,17 +24,41 @@ require("lz.n").load({
{
"blink.cmp",
event = { "InsertEnter", "CmdlineEnter" },
before = function()
-- Trigger lazydev so it's ready for blink source
require("lz.n").trigger_load({ "lazydev.nvim", "luasnip", "colorful-menu.nvim" })
end,
after = function()
require("blink.cmp").setup({
keymap = {
preset = "default",
-- [Up/Down]
["<C-j>"] = { "select_next", "fallback" },
["<C-k>"] = { "select_prev", "fallback" },
["<Tab>"] = { "select_and_accept", "fallback" },
["<C-k>"] = { "select_prev", "fallback" }, -- Overrides Signature Help
-- [Insert Suggestion]
["<tab>"] = { "select_and_accept", "fallback" },
-- [Remap Signature Help]
-- Since we took <C-k>, let's move signature help to <C-g> (optional)
["<C-g>"] = { "show_signature", "hide_signature", "fallback" },
},
appearance = {
nerd_font_variant = "mono",
},
completion = {
documentation = { auto_show = true },
documentation = {
auto_show = true,
auto_show_delay_ms = 500,
window = {
border = "none",
},
},
menu = {
border = "none",
draw = {
columns = { { "kind_icon" }, { "label", gap = 1 } },
components = {
@@ -38,30 +74,38 @@ require("lz.n").load({
},
},
},
cmdline = {
completion = { menu = { auto_show = true } },
completion = {
menu = {
auto_show = true,
},
},
keymap = { preset = "inherit" },
},
sources = {
default = { "lsp", "path", "snippets" },
per_filetype = {
lua = { inherit_defaults = true, "lazydev" },
sql = { inherit_defaults = true, "vim-dadbod-completion" },
mysql = { inherit_defaults = true, "vim-dadbod-completion" },
plsql = { inherit_defaults = true, "vim-dadbod-completion" },
default = {
"lsp",
"path",
"snippets",
"lazydev",
},
providers = {
lazydev = {
module = "lazydev.integrations.blink",
score_offset = 100,
},
["vim-dadbod-completion"] = {
name = "vim-dadbod-completion",
module = "blink.compat.source",
},
lazydev = { module = "lazydev.integrations.blink", score_offset = 100 },
},
},
snippets = { preset = "luasnip" },
fuzzy = { implementation = "prefer_rust_with_warning" },
signature = {
enabled = true,
window = {
border = "none",
},
},
signature = { enabled = true },
})
end,
},
@@ -0,0 +1,57 @@
require("lz.n").load({
{
"mini.nvim",
event = { "BufReadPre", "BufNewFile" },
after = function()
require("mini.ai").setup({ n_lines = 500 })
require("mini.surround").setup()
require("mini.pairs").setup()
local files = require("mini.files")
files.setup()
vim.keymap.set("n", "<leader>e", function()
if not files.close() then
files.open(vim.api.nvim_buf_get_name(0))
end
end, { desc = "File [E]xplorer" })
local icons = require("mini.icons")
icons.setup()
icons.mock_nvim_web_devicons()
local hipatterns = require("mini.hipatterns")
hipatterns.setup({
highlighters = {
hex_color = hipatterns.gen_highlighter.hex_color(),
fixme = { pattern = "%f[%w]()FIXME()%f[%W]", group = "MiniHipatternsFixme" },
hack = { pattern = "%f[%w]()HACK()%f[%W]", group = "MiniHipatternsHack" },
todo = { pattern = "%f[%w]()TODO()%f[%W]", group = "MiniHipatternsTodo" },
note = { pattern = "%f[%w]()NOTE()%f[%W]", group = "MiniHipatternsNote" },
},
})
local indentscope = require("mini.indentscope")
indentscope.setup({
symbol = "│",
})
vim.api.nvim_create_autocmd("FileType", {
pattern = { "help", "Trouble" },
callback = function()
vim.b.miniindentscope_disable = true
end,
})
end,
},
{
"guess-indent.nvim",
event = { "BufReadPre", "BufNewFile" },
after = function()
require("guess-indent").setup({})
end,
},
{
"direnv.vim",
event = "BufEnter",
},
})
@@ -1,103 +0,0 @@
local commands = {
"DBUI",
"DBUIToggle",
"DBUIAddConnection",
"DBUIFindBuffer",
"DBUIRenameBuffer",
"DBUILastQueryInfo",
}
local sql_filetypes = { "sql", "mysql", "plsql" }
local query_filetypes = { "sql", "mysql", "plsql", "javascript" }
require("lz.n").load({
{ "vim-dadbod" },
{ "vim-dadbod-completion", ft = sql_filetypes },
{
"vim-dadbod-ui",
cmd = commands,
ft = query_filetypes,
keys = {
{ "<leader>qo", "<cmd>DBUIToggle<cr>", desc = "Toggle database workspace" },
{
"<localleader>r",
"<Plug>(DBUI_ExecuteQuery)",
mode = { "n", "x" },
ft = query_filetypes,
remap = true,
desc = "Execute database query",
},
{
"<localleader>s",
"<Plug>(DBUI_SaveQuery)",
ft = query_filetypes,
remap = true,
desc = "Save database query",
},
{
"<localleader>p",
"<Plug>(DBUI_EditBindParameters)",
ft = query_filetypes,
remap = true,
desc = "Edit query parameters",
},
{ "<CR>", "<Plug>(DBUI_SelectLine)", ft = "dbui", remap = true, desc = "Open database item" },
{
"<localleader>a",
"<Plug>(DBUI_AddConnection)",
ft = "dbui",
remap = true,
desc = "Add database connection",
},
{
"<localleader>d",
"<Plug>(DBUI_DeleteLine)",
ft = "dbui",
remap = true,
desc = "Delete database item",
},
{
"<localleader>n",
"<Plug>(DBUI_RenameLine)",
ft = "dbui",
remap = true,
desc = "Rename database item",
},
{
"<localleader>r",
"<Plug>(DBUI_Redraw)",
ft = "dbui",
remap = true,
desc = "Refresh database workspace",
},
{
"<localleader>f",
"<Plug>(DBUI_JumpToForeignKey)",
ft = "dbout",
remap = true,
desc = "Follow foreign key",
},
{
"<localleader>l",
"<Plug>(DBUI_ToggleResultLayout)",
ft = "dbout",
remap = true,
desc = "Toggle result layout",
},
},
before = function()
vim.g.db_ui_execute_on_save = 0
vim.g.db_ui_tmp_query_location = vim.fn.stdpath("data") .. "/db_ui/working"
vim.g.db_ui_disable_mappings = 1
vim.g.db_ui_show_help = 0
vim.g.dbs = {
["MySQL — TEST"] = vim.env.YOOKR_MYSQL_TEST_DATABASE_URL,
["MySQL — LIVE"] = vim.env.YOOKR_MYSQL_LIVE_DATABASE_URL,
["MongoDB — TEST"] = vim.env.YOOKR_MONGODB_TEST_DATABASE_URL,
["MongoDB — LIVE"] = vim.env.YOOKR_MONGODB_LIVE_DATABASE_URL,
}
if vim.env.DATABASE_URL and vim.env.DATABASE_URL ~= "" then
vim.g.db = vim.env.DATABASE_URL
end
end,
},
})
@@ -1,35 +0,0 @@
vim.diagnostic.config({
virtual_text = true,
signs = {
text = {
[vim.diagnostic.severity.ERROR] = "",
[vim.diagnostic.severity.WARN] = "",
[vim.diagnostic.severity.INFO] = "",
[vim.diagnostic.severity.HINT] = "󰠠 ",
},
},
severity_sort = true,
float = { source = "if_many" },
})
require("lz.n").load({
{
"trouble.nvim",
cmd = "Trouble",
keys = {
{
"<leader>dd",
"<cmd>Trouble diagnostics toggle<cr>",
desc = "Show workspace diagnostics",
},
{
"<leader>db",
"<cmd>Trouble diagnostics toggle filter.buf=0<cr>",
desc = "Show buffer diagnostics",
},
},
after = function()
require("trouble").setup({})
end,
},
})
@@ -1,141 +0,0 @@
require("lz.n").load({
{
"mini.nvim",
-- Icons must exist before Oil opens an initial directory buffer.
lazy = false,
after = function()
require("mini.ai").setup({ n_lines = 500 })
require("mini.surround").setup()
require("mini.pairs").setup()
local icons = require("mini.icons")
icons.setup()
icons.mock_nvim_web_devicons()
end,
},
{
"guess-indent.nvim",
event = { "BufReadPre", "BufNewFile" },
after = function()
require("guess-indent").setup({})
end,
},
{
"nvim-treesitter",
event = "FileType",
after = function()
require("nvim-treesitter").setup({})
vim.api.nvim_create_autocmd("FileType", {
group = vim.api.nvim_create_augroup("lux-treesitter", { clear = true }),
callback = function(args)
if vim.bo[args.buf].buftype ~= "" then
return
end
if pcall(vim.treesitter.start, args.buf) then
vim.bo[args.buf].indentexpr = "v:lua.require'nvim-treesitter'.indentexpr()"
end
end,
})
end,
},
{
"nvim-treesitter-textobjects",
event = "FileType",
after = function()
require("nvim-treesitter-textobjects").setup({
select = { lookahead = true },
})
local select = require("nvim-treesitter-textobjects.select")
local move = require("nvim-treesitter-textobjects.move")
local objects = {
{ "if", "@function.inner", "Select inner function" },
{ "af", "@function.outer", "Select outer function" },
{ "ic", "@class.inner", "Select inner class" },
{ "ac", "@class.outer", "Select outer class" },
{ "ia", "@parameter.inner", "Select inner parameter" },
{ "aa", "@parameter.outer", "Select outer parameter" },
{ "ii", "@conditional.inner", "Select inner conditional" },
{ "ai", "@conditional.outer", "Select outer conditional" },
{ "il", "@loop.inner", "Select inner loop" },
{ "al", "@loop.outer", "Select outer loop" },
{ "ib", "@block.inner", "Select inner block" },
{ "ab", "@block.outer", "Select outer block" },
}
for _, object in ipairs(objects) do
vim.keymap.set({ "o", "x" }, object[1], function()
select.select_textobject(object[2], "textobjects")
end, { desc = object[3] })
end
local motions = {
{ "[f", move.goto_previous_start, "@function.outer", "Previous function" },
{ "]f", move.goto_next_start, "@function.outer", "Next function" },
{ "[c", move.goto_previous_start, "@class.outer", "Previous class" },
{ "]c", move.goto_next_start, "@class.outer", "Next class" },
{ "[a", move.goto_previous_start, "@parameter.inner", "Previous parameter" },
{ "]a", move.goto_next_start, "@parameter.inner", "Next parameter" },
}
for _, motion in ipairs(motions) do
vim.keymap.set({ "n", "x", "o" }, motion[1], function()
motion[2](motion[3], "textobjects")
end, { desc = motion[4] })
end
end,
},
{
"rainbow-delimiters.nvim",
event = "FileType",
after = function()
require("rainbow-delimiters.setup").setup({})
end,
},
{
"nvim-ts-autotag",
ft = { "svelte", "astro", "html", "javascriptreact", "typescriptreact" },
after = function()
local enabled = { enable_close = true, enable_rename = true }
require("nvim-ts-autotag").setup({
opts = { enable_close = false, enable_rename = false },
per_filetype = {
svelte = enabled,
astro = enabled,
html = enabled,
javascriptreact = enabled,
typescriptreact = enabled,
},
})
end,
},
{
"grug-far.nvim",
cmd = "GrugFar",
keys = {
{
"<leader>cR",
function()
require("grug-far").open({
prefills = {
search = vim.fn.expand("<cword>"),
paths = require("project").root(),
},
})
end,
desc = "Replace across project",
},
{
"<leader>cR",
function()
require("grug-far").with_visual_selection({
prefills = { paths = require("project").root() },
})
end,
mode = "x",
desc = "Replace selection across project",
},
},
},
})
@@ -1,23 +1,3 @@
local formatters_by_ft = {
lua = { "stylua" },
nix = { "nixfmt" },
javascript = { "oxfmt" },
javascriptreact = { "oxfmt" },
typescript = { "oxfmt" },
typescriptreact = { "oxfmt" },
json = { "oxfmt" },
jsonc = { "oxfmt" },
css = { "oxfmt" },
html = { "oxfmt" },
svelte = { "oxfmt" },
astro = { lsp_format = "fallback" },
python = { "ruff_fix", "ruff_format" },
rust = { "rustfmt" },
toml = { "taplo" },
yaml = { "yamlfmt" },
typst = { "typstyle" },
}
require("lz.n").load({
{
"conform.nvim",
@@ -25,22 +5,37 @@ require("lz.n").load({
cmd = "ConformInfo",
keys = {
{
"<leader>cf",
"<leader>f",
function()
require("conform").format({ async = true })
require("conform").format({ async = true, lsp_format = "fallback" })
end,
mode = { "n", "x" },
desc = "Format selection or buffer",
mode = "",
desc = "[F]ormat buffer",
},
},
after = function()
require("conform").setup({
formatters_by_ft = formatters_by_ft,
notify_on_error = true,
format_on_save = function(bufnr)
if formatters_by_ft[vim.bo[bufnr].filetype] then
return { timeout_ms = 500 }
local disable_filetypes = { c = true, cpp = true }
if disable_filetypes[vim.bo[bufnr].filetype] then
return nil
else
return {
timeout_ms = 500,
lsp_format = "fallback",
}
end
end,
formatters_by_ft = {
lua = { "stylua" },
python = { "ruff_fix", "ruff_format", "ruff_organize_imports" },
},
formatters = {
stylua = {
prepend_args = { "--indent-type", "Spaces", "--indent-width", "2" },
},
},
})
end,
},
@@ -1,62 +0,0 @@
require("lz.n").load({
{
"kulala.nvim",
ft = { "http", "rest" },
keys = {
{
"<localleader>r",
function()
require("kulala").run()
end,
mode = { "n", "x" },
ft = { "http", "rest" },
desc = "Execute HTTP request",
},
{
"<localleader>a",
function()
require("kulala").run_all()
end,
ft = { "http", "rest" },
desc = "Execute all HTTP requests",
},
{
"<localleader>e",
function()
require("kulala").set_selected_env()
end,
ft = { "http", "rest" },
desc = "Select HTTP environment",
},
{
"<leader>rr",
function()
require("kulala").scratchpad()
end,
desc = "Open HTTP scratchpad",
},
{
"<leader>rc",
function()
require("kulala").from_curl()
end,
desc = "Import cURL request",
},
{
"<leader>ro",
function()
require("kulala").open()
end,
desc = "Open HTTP request",
},
},
after = function()
require("kulala").setup({
kulala_core = { path = require("nix-info").settings.kulalaCorePath },
treesitter = { enable = false },
session = { restore = false },
ui = { winbar = false },
})
end,
},
})
@@ -1,8 +1,20 @@
require("lz.n").load({
{ "nvim-navic" },
{ "SchemaStore.nvim" },
{
"typst-preview.nvim",
ft = "typst",
after = function()
-- Setup typst-preview
require("typst-preview").setup({
-- Optionally configure things here
dependencies_bin = require("nix-info").settings.typstPreviewDependencies,
})
vim.keymap.set("n", "<leader>tp", "<cmd>TypstPreviewToggle<cr>", { desc = "[T]ypst [P]review Toggle" })
end,
},
{
"lazydev.nvim",
cmd = "LazyDev",
ft = "lua",
after = function()
require("lazydev").setup({
@@ -15,89 +27,163 @@ require("lz.n").load({
{
"nvim-lspconfig",
event = { "BufReadPre", "BufNewFile" },
before = function()
require("lz.n").trigger_load("lazydev.nvim")
end,
after = function()
local highlight_group = vim.api.nvim_create_augroup("lux-lsp-highlight", { clear = true })
local telescope_plugins = {
"project.nvim",
"telescope.nvim",
"telescope-fzf-native.nvim",
"telescope-ui-select.nvim",
}
local telescope_picker = function(picker)
return function()
require("lz.n").trigger_load(telescope_plugins)
require("telescope.builtin")[picker]()
end
end
local lsp_float = { border = "single" }
local navic_excluded_filetypes = {
[""] = true,
help = true,
minifiles = true,
TelescopePrompt = true,
Trouble = true,
}
local function navic_enabled(bufnr)
return vim.bo[bufnr].buftype == "" and not navic_excluded_filetypes[vim.bo[bufnr].filetype]
end
_G.lux_navic_location = function()
local ok, navic = pcall(require, "nvim-navic")
if not ok or not navic.is_available() then
return ""
end
return navic.get_location()
end
local function update_winbar(winid, bufnr)
if not vim.api.nvim_win_is_valid(winid) then
return
end
local is_float = vim.api.nvim_win_get_config(winid).relative ~= ""
local winbar = ""
if not is_float and vim.b[bufnr].lux_navic_attached and navic_enabled(bufnr) then
winbar = "%{%v:lua.lux_navic_location()%}"
end
vim.api.nvim_set_option_value("winbar", winbar, { win = winid })
end
local function update_winbars_for_buffer(bufnr)
for _, winid in ipairs(vim.fn.win_findbuf(bufnr)) do
update_winbar(winid, bufnr)
end
end
vim.api.nvim_create_autocmd({ "BufEnter", "BufWinEnter", "WinEnter" }, {
group = vim.api.nvim_create_augroup("lux-navic-winbar", { clear = true }),
callback = function(args)
update_winbar(vim.api.nvim_get_current_win(), args.buf)
end,
})
vim.api.nvim_create_autocmd("LspAttach", {
group = vim.api.nvim_create_augroup("lux-lsp-attach", { clear = true }),
callback = function(args)
local client = assert(vim.lsp.get_client_by_id(args.data.client_id))
local client = vim.lsp.get_client_by_id(args.data.client_id)
local bufnr = args.buf
local map = function(mode, lhs, rhs, desc)
vim.keymap.set(mode, lhs, rhs, { buffer = bufnr, desc = desc })
local map = function(keys, func, desc, mode)
mode = mode or "n"
vim.keymap.set(mode, keys, func, { buffer = bufnr, desc = "LSP: " .. desc })
end
map("n", "gd", function()
require("telescope.builtin").lsp_definitions()
end, "Go to definition")
map("n", "gD", vim.lsp.buf.declaration, "Go to declaration")
map("n", "gr", function()
require("telescope.builtin").lsp_references()
end, "Find references")
map("n", "gI", function()
require("telescope.builtin").lsp_implementations()
end, "Go to implementation")
map("n", "gy", function()
require("telescope.builtin").lsp_type_definitions()
end, "Go to type definition")
map("n", "K", vim.lsp.buf.hover, "Show hover documentation")
map({ "n", "x" }, "<leader>ca", vim.lsp.buf.code_action, "Apply code action")
map("n", "<leader>cr", vim.lsp.buf.rename, "Rename symbol")
map("<leader>rn", vim.lsp.buf.rename, "[R]e[n]ame")
map("<leader>ca", vim.lsp.buf.code_action, "[C]ode [A]ction", { "n", "x" })
map("gD", vim.lsp.buf.declaration, "[G]oto [D]eclaration")
map("K", function()
vim.lsp.buf.hover(lsp_float)
end, "Hover Documentation")
map("<C-s>", function()
vim.lsp.buf.signature_help(lsp_float)
end, "Signature Help", { "i", "s" })
if client:supports_method("textDocument/documentSymbol", bufnr) then
map("n", "gO", function()
require("telescope.builtin").lsp_document_symbols()
end, "Find document symbols")
require("nvim-navic").attach(client, bufnr)
end
map("gd", telescope_picker("lsp_definitions"), "[G]oto [D]efinition")
map("gr", telescope_picker("lsp_references"), "[G]oto [R]eferences")
map("gI", telescope_picker("lsp_implementations"), "[G]oto [I]mplementation")
map("<leader>D", telescope_picker("lsp_type_definitions"), "Type [D]efinition")
map("<leader>ds", telescope_picker("lsp_document_symbols"), "[D]ocument [S]ymbols")
map("<leader>ws", telescope_picker("lsp_dynamic_workspace_symbols"), "[W]orkspace [S]ymbols")
if client:supports_method("textDocument/documentHighlight", bufnr) then
local autocmds = vim.api.nvim_get_autocmds({ group = highlight_group, buffer = bufnr })
if #autocmds == 0 then
vim.api.nvim_create_autocmd({ "CursorHold", "CursorHoldI" }, {
group = highlight_group,
buffer = bufnr,
callback = vim.lsp.buf.document_highlight,
})
vim.api.nvim_create_autocmd({ "CursorMoved", "CursorMovedI" }, {
group = highlight_group,
buffer = bufnr,
callback = vim.lsp.buf.clear_references,
})
if client and client:supports_method("textDocument/documentSymbol", bufnr) and navic_enabled(bufnr) then
require("lz.n").trigger_load("nvim-navic")
local ok, navic = pcall(require, "nvim-navic")
if ok then
navic.attach(client, bufnr)
vim.b[bufnr].lux_navic_attached = true
update_winbars_for_buffer(bufnr)
end
end
if client:supports_method("textDocument/inlayHint", bufnr) then
map("n", "<leader>uh", function()
vim.lsp.inlay_hint.enable(not vim.lsp.inlay_hint.is_enabled({ bufnr = bufnr }), { bufnr = bufnr })
end, "Toggle inlay hints")
if client and client:supports_method("textDocument/documentHighlight", bufnr) then
local highlight_augroup = vim.api.nvim_create_augroup("lux-lsp-highlight", { clear = false })
vim.api.nvim_create_autocmd({ "CursorHold", "CursorHoldI" }, {
buffer = bufnr,
group = highlight_augroup,
callback = vim.lsp.buf.document_highlight,
})
vim.api.nvim_create_autocmd({ "CursorMoved", "CursorMovedI" }, {
buffer = bufnr,
group = highlight_augroup,
callback = vim.lsp.buf.clear_references,
})
vim.api.nvim_create_autocmd("LspDetach", {
group = vim.api.nvim_create_augroup("lux-lsp-detach", { clear = true }),
callback = function(event)
vim.lsp.buf.clear_references()
vim.api.nvim_clear_autocmds({ group = "lux-lsp-highlight", buffer = event.buf })
end,
})
end
if client.name == "tinymist" then
vim.api.nvim_buf_create_user_command(bufnr, "TinymistPreview", function()
client:exec_cmd({ command = "tinymist.startDefaultPreview" }, { bufnr = bufnr })
end, { desc = "Start Tinymist preview", force = true })
if client and client:supports_method("textDocument/inlayHint", bufnr) then
vim.lsp.inlay_hint.enable(true, { bufnr = bufnr })
map("<leader>th", function()
vim.lsp.inlay_hint.enable(not vim.lsp.inlay_hint.is_enabled({ bufnr = bufnr }))
end, "[T]oggle Inlay [H]ints")
end
end,
})
vim.api.nvim_create_autocmd("LspDetach", {
group = vim.api.nvim_create_augroup("lux-lsp-detach", { clear = true }),
callback = function(args)
local supports_highlights = vim
.iter(vim.lsp.get_clients({
bufnr = args.buf,
method = "textDocument/documentHighlight",
}))
:any(function(client)
return client.id ~= args.data.client_id
end)
if not supports_highlights then
vim.lsp.buf.clear_references()
vim.api.nvim_clear_autocmds({ group = highlight_group, buffer = args.buf })
end
end,
vim.diagnostic.config({
severity_sort = true,
underline = true,
signs = {
text = {
[vim.diagnostic.severity.ERROR] = "",
[vim.diagnostic.severity.WARN] = "",
[vim.diagnostic.severity.INFO] = "",
[vim.diagnostic.severity.HINT] = "󰠠 ",
},
},
virtual_text = false,
virtual_lines = {
current_line = true,
},
float = {
border = "single",
source = "if_many",
},
})
vim.lsp.config("lua_ls", {
@@ -111,8 +197,10 @@ require("lz.n").load({
},
},
})
vim.lsp.enable("lua_ls")
local settings = require("nix-info").settings
vim.lsp.config("nixd", {
settings = {
nixd = {
@@ -121,54 +209,43 @@ require("lz.n").load({
nixos = { expr = settings.nixdExtras.nixos_options },
["home-manager"] = { expr = settings.nixdExtras.home_manager_options },
},
formatting = { command = { "nixfmt" } },
},
},
})
vim.lsp.enable("nixd")
vim.lsp.config("jsonls", {
vim.lsp.enable("dafny")
vim.lsp.enable("ts_ls")
vim.lsp.enable("rust_analyzer")
vim.lsp.enable("ty")
vim.lsp.enable("ruff")
vim.lsp.enable("astro")
vim.lsp.config("tinymist", {
settings = {
json = {
schemas = require("schemastore").json.schemas(),
validate = { enable = true },
format = { enable = false },
tinymist = {
formatterMode = "typstyle",
},
},
})
vim.lsp.config("yamlls", {
settings = {
yaml = {
schemas = require("schemastore").yaml.schemas(),
schemaStore = { enable = false, url = "" },
format = { enable = false },
},
vim.lsp.enable("tinymist")
end,
},
{
"trouble.nvim",
cmd = "Trouble",
keys = {
{ "<leader>xx", "<cmd>Trouble diagnostics toggle<cr>", desc = "Diagnostics (Trouble)" },
{ "<leader>xX", "<cmd>Trouble diagnostics toggle filter.buf=0<cr>", desc = "Buffer Diagnostics (Trouble)" },
},
after = function()
require("trouble").setup({
focus = true,
preview = {
border = "single",
},
})
vim.lsp.config("vtsls", {
settings = {
vtsls = { autoUseWorkspaceTsdk = true },
},
})
vim.lsp.enable({
"lua_ls",
"nixd",
"jsonls",
"yamlls",
"vtsls",
"cssls",
"html",
"emmet_language_server",
"oxlint",
"tailwindcss",
"rust_analyzer",
"ty",
"ruff",
"astro",
"svelte",
"tinymist",
})
end,
},
})
@@ -1,125 +0,0 @@
require("oil").setup({})
vim.keymap.set("n", "<leader>e", function()
local name = vim.api.nvim_buf_get_name(0)
require("oil").open(name == "" and vim.fn.getcwd() or vim.fs.dirname(name))
end, { desc = "Open file directory" })
require("lz.n").load({
{ "plenary.nvim" },
{ "telescope-fzf-native.nvim" },
{ "telescope-ui-select.nvim" },
{
"telescope.nvim",
event = "VimEnter",
keys = {
{
"<leader>sf",
function()
require("telescope.builtin").find_files({ cwd = require("project").root() })
end,
desc = "Find project files",
},
{
"<leader>sg",
function()
require("telescope.builtin").live_grep({ cwd = require("project").root() })
end,
desc = "Search project text",
},
{
"<leader>sw",
function()
require("telescope.builtin").grep_string({ cwd = require("project").root() })
end,
desc = "Search cursor word",
},
{
"<leader>sb",
function()
require("telescope.builtin").current_buffer_fuzzy_find()
end,
desc = "Search current buffer",
},
{
"<leader>so",
function()
require("telescope.builtin").oldfiles()
end,
desc = "Find recent files",
},
{
"<leader>ss",
function()
require("telescope.builtin").lsp_dynamic_workspace_symbols()
end,
desc = "Find workspace symbols",
},
{
"<leader>sd",
function()
require("telescope.builtin").diagnostics()
end,
desc = "Find diagnostics",
},
{
"<leader>sh",
function()
require("telescope.builtin").help_tags()
end,
desc = "Find help",
},
{
"<leader>sc",
function()
require("telescope.builtin").commands()
end,
desc = "Find commands",
},
{
"<leader>sk",
function()
require("telescope.builtin").keymaps()
end,
desc = "Find keymaps",
},
{
"<leader>sr",
function()
require("telescope.builtin").resume()
end,
desc = "Resume last search",
},
{
"<leader>bb",
function()
require("telescope.builtin").buffers()
end,
desc = "Find open buffers",
},
},
after = function()
local actions = require("telescope.actions")
local promote = function(prompt_bufnr)
actions.smart_send_to_qflist(prompt_bufnr)
vim.cmd("Trouble qflist open")
end
local picker_mappings = {
["<C-j>"] = actions.move_selection_next,
["<C-k>"] = actions.move_selection_previous,
["<C-q>"] = promote,
}
require("telescope").setup({
defaults = {
mappings = { i = picker_mappings, n = picker_mappings },
},
extensions = {
["ui-select"] = require("telescope.themes").get_dropdown(),
},
})
require("telescope").load_extension("fzf")
require("telescope").load_extension("ui-select")
end,
},
})
@@ -1,53 +0,0 @@
require("lz.n").load({
{
"zk-nvim",
cmd = { "ZkNew", "ZkNotes", "ZkTags", "ZkInsertLink", "ZkBacklinks", "ZkLinks" },
ft = "markdown",
keys = {
{
"<leader>nn",
function()
local title = vim.trim(vim.fn.input("Title: "))
if title ~= "" then
require("zk").new({ notebook_path = vim.env.ZK_NOTEBOOK_DIR, title = title })
end
end,
desc = "Create note",
},
{
"<leader>nf",
function()
require("zk").edit({ notebook_path = vim.env.ZK_NOTEBOOK_DIR }, { picker = "telescope" })
end,
desc = "Find notes",
},
{
"<leader>nt",
function()
require("zk.commands").get("ZkTags")({ notebook_path = vim.env.ZK_NOTEBOOK_DIR })
end,
desc = "Find note tags",
},
},
after = function()
require("zk").setup({
picker = "telescope",
lsp = { config = { root_dir = vim.env.ZK_NOTEBOOK_DIR } },
})
vim.api.nvim_create_autocmd("FileType", {
group = vim.api.nvim_create_augroup("lux-notes-maps", { clear = true }),
pattern = "markdown",
callback = function(args)
local path = vim.api.nvim_buf_get_name(args.buf)
if require("zk.util").notebook_root(path) then
vim.keymap.set("n", "<leader>ni", "<cmd>ZkInsertLink<cr>", {
buffer = args.buf,
desc = "Insert note link",
})
end
end,
})
end,
},
})
@@ -0,0 +1,111 @@
local telescope_plugins = {
"project.nvim",
"telescope.nvim",
"telescope-fzf-native.nvim",
"telescope-ui-select.nvim",
}
local function load_telescope()
require("lz.n").trigger_load(telescope_plugins)
return require("telescope.builtin")
end
local function map_picker(lhs, picker, desc, opts)
vim.keymap.set("n", lhs, function()
load_telescope()[picker](opts or {})
end, { desc = desc })
end
map_picker("<leader>sh", "help_tags", "[S]earch [H]elp")
map_picker("<leader>sk", "keymaps", "[S]earch [K]eymaps")
map_picker("<leader>sf", "find_files", "[S]earch [F]iles")
map_picker("<leader>ss", "builtin", "[S]earch [S]elect Telescope")
map_picker("<leader>sw", "grep_string", "[S]earch current [W]ord")
map_picker("<leader>sg", "live_grep", "[S]earch by [G]rep")
map_picker("<leader>sd", "diagnostics", "[S]earch [D]iagnostics")
map_picker("<leader>sr", "resume", "[S]earch [R]esume")
map_picker("<leader>s.", "oldfiles", '[S]earch Recent Files ("." for repeat)')
map_picker("<leader><leader>", "buffers", "[ ] Find existing buffers")
map_picker("<leader>sn", "find_files", "[S]earch [N]eovim files", { cwd = vim.fn.stdpath("config") })
vim.keymap.set("n", "<leader>sp", function()
load_telescope()
require("telescope").extensions.projects.projects({})
end, { desc = "[S]earch [P]rojects" })
vim.keymap.set("n", "<leader>/", function()
local builtin = load_telescope()
builtin.current_buffer_fuzzy_find(require("telescope.themes").get_dropdown({
winblend = 10,
previewer = false,
}))
end, { desc = "[/] Fuzzily search in current buffer" })
vim.keymap.set("n", "<leader>s/", function()
load_telescope().live_grep({
grep_open_files = true,
prompt_title = "Live Grep in Open Files",
})
end, { desc = "[S]earch [/] in Open Files" })
require("lz.n").load({
{
"project.nvim",
event = "VimEnter",
after = function()
require("project").setup({
manual_mode = false,
lsp = { enabled = true },
patterns = { ".git", "_darcs", ".hg", ".bzr", ".svn", "Makefile", "package.json", "flake.nix" },
show_hidden = true,
scope_chdir = "global",
})
end,
},
{
"telescope-fzf-native.nvim",
},
{
"telescope-ui-select.nvim",
},
{
"telescope.nvim",
cmd = "Telescope",
before = function()
require("lz.n").trigger_load("project.nvim")
end,
after = function()
local actions = require("telescope.actions")
require("telescope").setup({
defaults = {
path_display = { "truncate" },
border = true,
borderchars = { "─", "│", "─", "│", "┌", "┐", "┘", "└" },
layout_strategy = "horizontal",
layout_config = {
prompt_position = "top",
},
sorting_strategy = "ascending",
mappings = {
i = {
["<C-k>"] = actions.move_selection_previous,
["<C-j>"] = actions.move_selection_next,
["<C-q>"] = actions.send_selected_to_qflist + actions.open_qflist,
},
},
},
extensions = {
["ui-select"] = {
require("telescope.themes").get_dropdown(),
},
},
})
require("lz.n").trigger_load({ "telescope-fzf-native.nvim", "telescope-ui-select.nvim" })
pcall(require("telescope").load_extension, "projects")
pcall(require("telescope").load_extension, "fzf")
pcall(require("telescope").load_extension, "ui-select")
end,
},
})
@@ -0,0 +1,28 @@
local ok, treesitter = pcall(require, "nvim-treesitter")
if not ok then
return
end
treesitter.setup({})
local group = vim.api.nvim_create_augroup("lux-treesitter", { clear = true })
local enableTreesitter = function(bufnr)
vim.schedule(function()
if not vim.api.nvim_buf_is_valid(bufnr) then
return
end
if pcall(vim.treesitter.start, bufnr) then
vim.bo[bufnr].indentexpr = "v:lua.require'nvim-treesitter'.indentexpr()"
end
end)
end
vim.api.nvim_create_autocmd({ "BufEnter", "BufWinEnter", "FileType" }, {
group = group,
pattern = "*",
callback = function(args)
enableTreesitter(args.buf)
end,
})
@@ -1,53 +1,107 @@
require("lz.n").load({
{
"theme-loader",
event = "VimEnter",
load = function()
local settings = require("nix-info").settings
local theme_code = settings.themeSetup
local func, err = loadstring(theme_code)
if func then
func()
else
print("Error loading theme code: " .. err)
end
end,
},
{
"kulala.nvim",
after = function()
require("kulala").setup({
global_keymaps = true,
global_keymaps_prefix = "<leader>R",
})
end,
},
{
"lualine.nvim",
event = "VimEnter",
after = function()
local navic = require("nvim-navic")
local breadcrumb = function()
if not navic.is_available() then
return ""
end
local location = navic.get_location()
if vim.fn.strdisplaywidth(location) <= 60 then
return location
end
while vim.fn.strdisplaywidth(location) > 59 do
location = vim.fn.strcharpart(location, 0, vim.fn.strchars(location) - 1)
end
return location .. "…"
end
local filename = {
"filename",
path = 1,
symbols = {
modified = "●",
readonly = "",
unnamed = "[No Name]",
},
}
require("lualine").setup({
options = {
theme = "auto",
icons_enabled = true,
globalstatus = false,
component_separators = "",
section_separators = "",
globalstatus = true,
theme = "kanagawa",
},
sections = {
lualine_a = { "mode" },
lualine_b = { "branch" },
lualine_c = { { "filename", path = 1 }, breadcrumb },
lualine_x = {
{ "kulala", icon = "HTTP" },
{
"db_ui#statusline",
type = "vim_fun",
cond = function()
return vim.fn.exists("*db_ui#statusline") == 1
end,
},
"diagnostics",
},
lualine_y = { "filetype" },
lualine_b = { "branch", "diff", "diagnostics" },
lualine_c = { filename },
lualine_x = { "lsp_status" },
lualine_y = { "progress" },
lualine_z = { "location" },
},
inactive_sections = {
lualine_a = {},
lualine_b = {},
lualine_c = { filename },
lualine_x = {},
lualine_y = {},
lualine_z = {},
},
})
end,
},
{
"bufferline.nvim",
event = "VimEnter",
before = function()
require("lz.n").trigger_load("mini.nvim")
end,
after = function()
require("bufferline").setup({
options = {
mode = "buffers",
numbers = "none",
diagnostics = "nvim_lsp",
diagnostics_indicator = function(count, level)
local icon = level:match("error") and "" or level:match("warning") and "" or ""
return " " .. icon .. count
end,
always_show_bufferline = true,
show_buffer_close_icons = false,
show_close_icon = false,
separator_style = "thin",
sort_by = "insert_after_current",
offsets = {
{
filetype = "minifiles",
text = "Files",
separator = true,
},
},
},
})
vim.keymap.set("n", "<C-0>", "<cmd>BufferLineCycleNext<cr>", { desc = "[B]uffer [N]ext" })
vim.keymap.set("n", "<C-9>", "<cmd>BufferLineCyclePrev<cr>", { desc = "[B]uffer [P]revious" })
vim.keymap.set("n", "<leader>bb", "<cmd>BufferLinePick<cr>", { desc = "[B]uffer [B]rowse" })
vim.keymap.set("n", "<leader>bd", "<cmd>bdelete<cr>", { desc = "[B]uffer [D]elete" })
end,
},
{
"gitsigns.nvim",
event = { "BufReadPre", "BufNewFile" },
@@ -58,82 +112,88 @@ require("lz.n").load({
change = { text = "│" },
delete = { text = "_" },
topdelete = { text = "‾" },
changedelete = { text = "~" },
untracked = { text = "┆" },
},
signs_staged_enable = true,
on_attach = function(bufnr)
local gs = require("gitsigns")
local map_hunk = function(lhs, direction, desc)
vim.keymap.set("n", lhs, function()
if vim.wo.diff then
return lhs
end
vim.schedule(function()
gs.nav_hunk(direction)
end)
return "<Ignore>"
end, { buffer = bufnr, desc = desc, expr = true })
local gs = package.loaded.gitsigns
local map = function(mode, lhs, rhs, desc, opts)
opts = opts or {}
opts.buffer = bufnr
opts.desc = desc
vim.keymap.set(mode, lhs, rhs, opts)
end
map_hunk("]h", "next", "Next git hunk")
map_hunk("[h", "prev", "Previous git hunk")
vim.keymap.set("n", "<leader>gp", gs.preview_hunk, { buffer = bufnr, desc = "Preview git hunk" })
vim.keymap.set("n", "<leader>gs", gs.stage_hunk, { buffer = bufnr, desc = "Stage git hunk" })
map("n", "]h", function()
if vim.wo.diff then
return "]h"
end
vim.schedule(function()
gs.nav_hunk("next")
end)
return "<Ignore>"
end, "Next git hunk", { expr = true })
map("n", "[h", function()
if vim.wo.diff then
return "[h"
end
vim.schedule(function()
gs.nav_hunk("prev")
end)
return "<Ignore>"
end, "Previous git hunk", { expr = true })
map("n", "<leader>hp", gs.preview_hunk, "Git [H]unk [P]review")
map("n", "<leader>hs", gs.stage_hunk, "Git [H]unk [S]tage")
map("n", "<leader>hr", gs.reset_hunk, "Git [H]unk [R]eset")
map("n", "<leader>hu", gs.undo_stage_hunk, "Git [H]unk [U]ndo stage")
map("n", "<leader>hS", gs.stage_buffer, "Git [H]unk [S]tage buffer")
map("n", "<leader>hR", gs.reset_buffer, "Git [H]unk [R]eset buffer")
map("v", "<leader>hs", function()
gs.stage_hunk({ vim.fn.line("."), vim.fn.line("v") })
end, "Git [H]unk [S]tage")
map("v", "<leader>hr", function()
gs.reset_hunk({ vim.fn.line("."), vim.fn.line("v") })
end, "Git [H]unk [R]eset")
end,
})
end,
},
{
"diffview.nvim",
cmd = { "DiffviewOpen", "DiffviewClose", "DiffviewRefresh", "DiffviewFileHistory" },
keys = {
{
"<leader>gd",
function()
vim.cmd("DiffviewOpen -C" .. vim.fn.fnameescape(require("project").root()))
end,
desc = "Review project changes",
},
{ "<leader>gq", "<cmd>DiffviewClose<cr>", desc = "Close git review" },
{ "<leader>gr", "<cmd>DiffviewRefresh<cr>", desc = "Refresh git review" },
},
after = function()
require("diffview").setup({})
end,
},
{
"zen-mode.nvim",
cmd = "ZenMode",
keys = {
{ "<leader>uz", "<cmd>ZenMode<cr>", desc = "Toggle zen mode" },
},
after = function()
require("zen-mode").setup({})
end,
},
{
"render-markdown.nvim",
ft = "markdown",
keys = {
{ "<leader>um", "<cmd>RenderMarkdown buf_toggle<cr>", desc = "Toggle Markdown rendering" },
},
after = function()
require("render-markdown").setup({})
require("zen-mode").setup({
window = {
options = {
linebreak = true,
},
},
})
end,
},
{
"which-key.nvim",
event = "VimEnter",
before = function()
require("lz.n").trigger_load("mini.nvim")
end,
after = function()
require("which-key").setup({
preset = "helix",
preset = "modern",
delay = 200,
icons = {
mappings = true,
keys = {},
},
spec = {
{ "<leader>b", group = "Buffers" },
{ "<leader>c", group = "Code" },
{ "<leader>d", group = "Diagnostics" },
{ "<leader>g", group = "Git" },
{ "<leader>n", group = "Notes" },
{ "<leader>q", group = "Database" },
{ "<leader>r", group = "HTTP" },
{ "<leader>s", group = "Search" },
{ "<leader>u", group = "UI" },
{ "<leader>b", group = "[B]uffer" },
{ "<leader>s", group = "[S]earch" },
{ "<leader>t", group = "[T]oggle" },
{ "<leader>h", group = "Git [H]unk", mode = { "n", "v" } },
},
})
end,
@@ -1,7 +0,0 @@
local M = {}
function M.root()
return vim.fs.root(0, { ".git" }) or vim.fn.getcwd()
end
return M
@@ -1,3 +0,0 @@
; extends
("attach") @keyword
@@ -1,55 +0,0 @@
{
"Full lux module": {
"prefix": "luxmod",
"description": "Full lux module (NixOS and Home Manager)",
"body": [
"{ inputs, ... }:",
"{",
" lux.${1:moduleName} = {",
" nixos = { config, lib, pkgs, ... }: {",
" $2",
" };",
"",
" homeManager = { config, lib, pkgs, ... }: {",
" $3",
" };",
" };",
"}"
]
},
"Lux NixOS module": {
"prefix": "luxnixos",
"description": "Lux NixOS-only module",
"body": [
"{ inputs, ... }:",
"{",
" lux.${1:moduleName}.nixos = { config, lib, pkgs, ... }: {",
" $0",
" };",
"}"
]
},
"Lux Home Manager module": {
"prefix": "luxhm",
"description": "Lux Home Manager-only module",
"body": [
"{ inputs, ... }:",
"{",
" lux.${1:moduleName}.homeManager = { config, lib, pkgs, ... }: {",
" $0",
" };",
"}"
]
},
"Den inline aspect": {
"prefix": "denaspect",
"description": "Den inline aspect",
"body": [
"(",
" { host, user, ... }: {",
" $0",
" }",
")"
]
}
}
@@ -0,0 +1,91 @@
local ls = require("luasnip")
local s = ls.snippet
local t = ls.text_node
local i = ls.insert_node
return {
-- Full lux module (both nixos and homeManager)
s("luxmod", {
t({
"{ inputs, ... }:",
"{",
" lux."
}),
i(1, "moduleName"),
t({
" = {",
" nixos = { config, lib, pkgs, ... }: {",
" "
}),
i(2),
t({
"",
" };",
"",
" homeManager = { config, lib, pkgs, ... }: {",
" "
}),
i(3),
t({
"",
" };",
" };",
"}",
}),
}),
-- lux nixos only module
s("luxnixos", {
t({
"{ inputs, ... }:",
"{",
" lux."
}),
i(1, "moduleName"),
t({
".nixos = { config, lib, pkgs, ... }: {",
" "
}),
i(0),
t({
"",
" };",
"}",
}),
}),
-- lux homeManager only module
s("luxhm", {
t({
"{ inputs, ... }:",
"{",
" lux."
}),
i(1, "moduleName"),
t({
".homeManager = { config, lib, pkgs, ... }: {",
" "
}),
i(0),
t({
"",
" };",
"}",
}),
}),
-- den inline aspect
s("denaspect", {
t({
"(",
" { host, user, ... }: {",
" "
}),
i(0),
t({
"",
" }",
")"
}),
}),
}
@@ -1,11 +0,0 @@
{
"name": "lux-nix-snippets",
"contributes": {
"snippets": [
{
"language": "nix",
"path": "./nix.json"
}
]
}
}
-7
View File
@@ -11,13 +11,6 @@ in
networking.networkmanager.enable = true;
};
flake.modules.nixos.openvpn =
{ pkgs, ... }:
{
networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ];
services.resolved.enable = true;
};
flake.modules.nixos.server-firewall =
{ ... }:
{
+256
View File
@@ -0,0 +1,256 @@
{
browserCommand,
launcherCommand,
shortcutCommands,
terminalCommand,
}:
{
# Application and utility launchers
"Mod+Return" = {
action.spawn = terminalCommand;
hotkey-overlay.title = "Terminal";
};
"Mod+B" = {
action.spawn = browserCommand;
hotkey-overlay.title = "Browser";
};
"Mod+Space" = {
repeat = false;
action.spawn = launcherCommand;
hotkey-overlay.title = "App Launcher";
};
"Mod+E" = {
repeat = false;
action.spawn = shortcutCommands.neovimProjects;
hotkey-overlay.title = "Neovim Projects";
};
"Mod+Ctrl+Return" = {
repeat = false;
action.spawn = shortcutCommands.nixosTerminal;
hotkey-overlay.title = "NixOS Config Terminal";
};
"Mod+Ctrl+Shift+Return" = {
repeat = false;
action.spawn = shortcutCommands.nixosSwitch;
hotkey-overlay.title = "NixOS Switch";
};
"Mod+Ctrl+E" = {
repeat = false;
action.spawn = shortcutCommands.editSecrets;
hotkey-overlay.title = "Edit Secrets";
};
"Mod+Ctrl+C" = {
repeat = false;
action.spawn = shortcutCommands.pickColor;
hotkey-overlay.title = "Pick Color";
};
# Hardware media, volume, and brightness keys
"XF86AudioPlay" = {
action.spawn-sh = "playerctl play-pause";
allow-when-locked = true;
};
"XF86AudioStop" = {
action.spawn-sh = "playerctl stop";
allow-when-locked = true;
};
"XF86AudioPrev" = {
action.spawn-sh = "playerctl previous";
allow-when-locked = true;
};
"XF86AudioNext" = {
action.spawn-sh = "playerctl next";
allow-when-locked = true;
};
"XF86AudioRaiseVolume" = {
action.spawn-sh = "wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+";
allow-when-locked = true;
};
"XF86AudioLowerVolume" = {
action.spawn-sh = "wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-";
allow-when-locked = true;
};
"XF86AudioMute" = {
action.spawn-sh = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
allow-when-locked = true;
};
"XF86AudioMicMute" = {
action.spawn-sh = "wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle";
allow-when-locked = true;
};
"XF86MonBrightnessUp" = {
action.spawn-sh = "brightnessctl s 5%+";
allow-when-locked = true;
};
"XF86MonBrightnessDown" = {
action.spawn-sh = "brightnessctl s 5%-";
allow-when-locked = true;
};
# Screenshots
"Mod+S".action.screenshot = [ ];
"Mod+Ctrl+S".action.screenshot-screen = [ ];
"Mod+Alt+S".action.screenshot-window = [ ];
# Session and compositor controls
"Mod+Shift+Slash".action.show-hotkey-overlay = [ ];
"Mod+Escape" = {
action.toggle-keyboard-shortcuts-inhibit = [ ];
allow-inhibiting = false;
};
"Mod+Ctrl+L" = {
action.spawn-sh = "loginctl lock-session";
hotkey-overlay.title = "Lock Screen";
};
"Mod+Ctrl+Shift+Q".action.quit = [ ];
"Ctrl+Alt+Delete".action.quit = [ ];
"Mod+Shift+P".action.power-off-monitors = [ ];
# Overview and window close
"Mod+O" = {
action.toggle-overview = [ ];
repeat = false;
};
"Mod+Q" = {
action.close-window = [ ];
repeat = false;
};
# Keyboard focus movement
"Mod+Left".action.focus-column-or-monitor-left = [ ];
"Mod+Down".action.focus-window-down = [ ];
"Mod+Up".action.focus-window-up = [ ];
"Mod+Right".action.focus-column-or-monitor-right = [ ];
"Mod+H".action.focus-column-or-monitor-left = [ ];
"Mod+J".action.focus-window-down = [ ];
"Mod+K".action.focus-window-up = [ ];
"Mod+L".action.focus-column-or-monitor-right = [ ];
# Keyboard window and column movement
"Mod+Alt+Left".action.move-column-left-or-to-monitor-left = [ ];
"Mod+Alt+Down".action.move-window-down-or-to-workspace-down = [ ];
"Mod+Alt+Up".action.move-window-up-or-to-workspace-up = [ ];
"Mod+Alt+Right".action.move-column-right-or-to-monitor-right = [ ];
"Mod+Alt+H".action.move-column-left-or-to-monitor-left = [ ];
"Mod+Alt+J".action.move-window-down-or-to-workspace-down = [ ];
"Mod+Alt+K".action.move-window-up-or-to-workspace-up = [ ];
"Mod+Alt+L".action.move-column-right-or-to-monitor-right = [ ];
# First and last column navigation
"Mod+Home".action.focus-column-first = [ ];
"Mod+End".action.focus-column-last = [ ];
"Mod+Alt+Home".action.move-column-to-first = [ ];
"Mod+Alt+End".action.move-column-to-last = [ ];
# Move focus, columns, and workspaces across monitors
"Mod+Tab".action.focus-monitor-next = [ ];
"Mod+A" = {
repeat = false;
action.spawn = shortcutCommands.swapMonitorWorkspaces;
hotkey-overlay.title = "Swap Monitor Workspaces";
};
"Mod+Alt+Tab".action.move-column-to-monitor-next = [ ];
"Mod+Shift+Tab".action.move-workspace-to-monitor-next = [ ];
"Mod+Shift+Left".action.focus-monitor-left = [ ];
"Mod+Shift+Down".action.focus-monitor-down = [ ];
"Mod+Shift+Up".action.focus-monitor-up = [ ];
"Mod+Shift+Right".action.focus-monitor-right = [ ];
# Linear workspace navigation
"Mod+Page_Down".action.focus-workspace-down = [ ];
"Mod+Page_Up".action.focus-workspace-up = [ ];
"Mod+U".action.focus-workspace-down = [ ];
"Mod+I".action.focus-workspace-up = [ ];
# Move columns between adjacent workspaces
"Mod+Alt+Page_Down".action.move-column-to-workspace-down = [ ];
"Mod+Alt+Page_Up".action.move-column-to-workspace-up = [ ];
"Mod+Alt+U".action.move-column-to-workspace-down = [ ];
"Mod+Alt+I".action.move-column-to-workspace-up = [ ];
# Reorder workspaces
"Mod+Shift+Page_Down".action.move-workspace-down = [ ];
"Mod+Shift+Page_Up".action.move-workspace-up = [ ];
"Mod+Shift+U".action.move-workspace-down = [ ];
"Mod+Shift+I".action.move-workspace-up = [ ];
# Mouse workspace navigation
"Mod+WheelScrollDown" = {
action.focus-workspace-down = [ ];
cooldown-ms = 150;
};
"Mod+WheelScrollUp" = {
action.focus-workspace-up = [ ];
cooldown-ms = 150;
};
"Mod+Alt+WheelScrollDown" = {
action.move-column-to-workspace-down = [ ];
cooldown-ms = 150;
};
"Mod+Alt+WheelScrollUp" = {
action.move-column-to-workspace-up = [ ];
cooldown-ms = 150;
};
# Mouse column navigation and movement
"Mod+WheelScrollRight".action.focus-column-or-monitor-right = [ ];
"Mod+WheelScrollLeft".action.focus-column-or-monitor-left = [ ];
"Mod+Alt+WheelScrollRight".action.move-column-right-or-to-monitor-right = [ ];
"Mod+Alt+WheelScrollLeft".action.move-column-left-or-to-monitor-left = [ ];
"Mod+Shift+WheelScrollDown".action.focus-column-or-monitor-right = [ ];
"Mod+Shift+WheelScrollUp".action.focus-column-or-monitor-left = [ ];
# Direct workspace focus
"Mod+1".action.focus-workspace = 1;
"Mod+2".action.focus-workspace = 2;
"Mod+3".action.focus-workspace = 3;
"Mod+4".action.focus-workspace = 4;
"Mod+5".action.focus-workspace = 5;
"Mod+6".action.focus-workspace = 6;
"Mod+7".action.focus-workspace = 7;
"Mod+8".action.focus-workspace = 8;
"Mod+9".action.focus-workspace = 9;
# Move columns to numbered workspaces
"Mod+Ctrl+1".action.move-column-to-workspace = 1;
"Mod+Ctrl+2".action.move-column-to-workspace = 2;
"Mod+Ctrl+3".action.move-column-to-workspace = 3;
"Mod+Ctrl+4".action.move-column-to-workspace = 4;
"Mod+Ctrl+5".action.move-column-to-workspace = 5;
"Mod+Ctrl+6".action.move-column-to-workspace = 6;
"Mod+Ctrl+7".action.move-column-to-workspace = 7;
"Mod+Ctrl+8".action.move-column-to-workspace = 8;
"Mod+Ctrl+9".action.move-column-to-workspace = 9;
# Add and remove windows from columns
"Mod+BracketLeft".action.consume-or-expel-window-left = [ ];
"Mod+BracketRight".action.consume-or-expel-window-right = [ ];
"Mod+Comma".action.consume-window-into-column = [ ];
"Mod+Period".action.expel-window-from-column = [ ];
# Column and window presentation modes
"Mod+R".action.switch-preset-column-width = [ ];
"Mod+Shift+R".action.switch-preset-column-width-back = [ ];
"Mod+Ctrl+R".action.reset-window-height = [ ];
"Mod+Ctrl+Shift+R".action.switch-preset-window-height = [ ];
"Mod+F".action.maximize-column = [ ];
"Mod+Shift+F".action.fullscreen-window = [ ];
"Mod+M".action.maximize-window-to-edges = [ ];
"Mod+C".action.center-column = [ ];
# Manual column width and window height adjustments
"Mod+Shift+H".action.set-column-width = "-10%";
"Mod+Shift+L".action.set-column-width = "+10%";
"Mod+Shift+J".action.set-window-height = "+10%";
"Mod+Shift+K".action.set-window-height = "-10%";
"Mod+Minus".action.set-column-width = "-10%";
"Mod+Equal".action.set-column-width = "+10%";
"Mod+Shift+Minus".action.set-window-height = "-10%";
"Mod+Shift+Equal".action.set-window-height = "+10%";
# Floating and tabbed layout toggles
"Mod+Alt+V".action.toggle-window-floating = [ ];
"Mod+Shift+V".action.switch-focus-between-floating-and-tiling = [ ];
"Mod+W".action.toggle-column-tabbed-display = [ ];
}
+146
View File
@@ -0,0 +1,146 @@
{
config,
lib,
pkgs,
repo,
}:
let
nixosConfigDir = repo.account.nixosConfigurationPath;
mkTerminalScript =
{
name,
workdir ? nixosConfigDir,
command ? null,
runtimeInputs ? [ ],
}:
let
args = lib.optionals (command != null) [
"--"
"${pkgs.bash}/bin/bash"
"-lc"
command
];
argString = lib.concatMapStringsSep " " lib.escapeShellArg args;
in
pkgs.writeShellApplication {
inherit name runtimeInputs;
checkPhase = "";
text = lib.concatStringsSep "\n" [
"# shellcheck disable=SC2016"
"cd ${lib.escapeShellArg workdir}"
"exec ${lib.escapeShellArg config.facts.desktop.terminalCommand} ${argString}"
];
};
in
rec {
scripts = {
nixosTerminal = mkTerminalScript {
name = "niri-shortcut-nixos-terminal";
};
nixosSwitch = mkTerminalScript {
name = "niri-shortcut-nixos-switch";
runtimeInputs = [
pkgs.coreutils
pkgs.nh
];
command = ''
set -o pipefail
log_dir="''${XDG_STATE_HOME:-$HOME/.local/state}/nixos-switch"
mkdir -p "$log_dir"
log="$log_dir/$(date +%Y%m%d-%H%M%S).log"
status_file="$(mktemp)"
printf 'Running nh os switch in %s\n\n' ${lib.escapeShellArg nixosConfigDir}
(
cd ${lib.escapeShellArg nixosConfigDir}
nh os switch
printf '%s' "$?" > "$status_file"
) 2>&1 | tee "$log"
status="$(cat "$status_file")"
rm -f "$status_file"
printf '\nLog: %s\n' "$log"
if [ "$status" -eq 0 ]; then
printf 'NixOS switch completed successfully.\n'
else
printf 'NixOS switch failed with exit code %s.\n' "$status"
fi
printf 'Press Enter to close...'
read -r _
exit "$status"
'';
};
editSecrets = mkTerminalScript {
name = "niri-shortcut-edit-secrets";
runtimeInputs = [ pkgs.sops ];
command = ''
sops edit ${lib.escapeShellArg "${nixosConfigDir}/modules/secrets/secrets.yaml"}
'';
};
neovimProjects = mkTerminalScript {
name = "niri-shortcut-neovim-projects";
command = ''
nvim -c 'Telescope projects'
'';
};
pickColor = pkgs.writeShellApplication {
name = "niri-shortcut-pick-color";
runtimeInputs = [
pkgs.libnotify
pkgs.niri
pkgs.wl-clipboard
];
text = ''
color="$(niri msg pick-color)"
printf '%s' "$color" | wl-copy
notify-send 'Color picked' "$color"
'';
};
swapMonitorWorkspaces = pkgs.writeShellApplication {
name = "niri-shortcut-swap-monitor-workspaces";
runtimeInputs = [
pkgs.jq
pkgs.niri
];
text = ''
focused_output="$(niri msg --json focused-output | jq -r '.name // empty')"
if [ -z "$focused_output" ]; then
exit 0
fi
niri msg action focus-monitor-next
target_output="$(niri msg --json focused-output | jq -r '.name // empty')"
if [ -z "$target_output" ] || [ "$target_output" = "$focused_output" ]; then
exit 0
fi
target_workspace_idx="$(
niri msg --json workspaces \
| jq -r --arg output "$target_output" '
first(.[] | select(.output == $output and .is_active) | .idx) // empty
'
)"
if [ -z "$target_workspace_idx" ]; then
niri msg action focus-monitor "$focused_output"
exit 0
fi
niri msg action focus-monitor "$focused_output"
niri msg action move-workspace-to-monitor "$target_output"
niri msg action focus-workspace "$target_workspace_idx"
niri msg action move-workspace-to-monitor "$focused_output"
'';
};
};
commands = lib.mapAttrs (_: lib.getExe) scripts;
}
@@ -1,168 +0,0 @@
{
browser,
handy,
launcher,
swapMonitorWorkspaces,
terminal,
}:
let
spawnLocked = command: {
spawn-sh = command;
_props.allow-when-locked = true;
};
withCooldown = action: {
${action} = { };
_props.cooldown-ms = 150;
};
in
{
# Application and utility launchers
"Mod+Return" = {
spawn = terminal;
_props.hotkey-overlay-title = "Terminal";
};
"Mod+B" = {
spawn = browser;
_props.hotkey-overlay-title = "Browser";
};
"Mod+Shift+N" = {
spawn-sh = "rename-workspace";
_props.hotkey-overlay-title = "Name workspace (empty clears)";
};
"Mod+N" = {
spawn-sh = "open-notes";
_props.hotkey-overlay-title = "Find or create notes";
};
"Mod+Space" = {
_props.repeat = false;
spawn = launcher;
_props.hotkey-overlay-title = "App Launcher";
};
# Dictation
"Mod+D" = {
spawn = [
"systemctl"
"--user"
"start"
"handy-ptt.service"
];
_props.repeat = false;
_props.hotkey-overlay-title = "Hold to Dictate";
};
"Mod+Shift+D" = {
spawn-sh = "systemctl --user stop handy-ptt.service && ${handy} --toggle-transcription";
_props.repeat = false;
_props.hotkey-overlay-title = "Toggle Dictation";
};
"Mod+Ctrl+D" = {
spawn-sh = "systemctl --user stop handy-ptt.service && ${handy} --cancel";
_props.repeat = false;
_props.hotkey-overlay-title = "Cancel Dictation";
};
# Hardware media, volume, and brightness keys
"XF86AudioPlay" = spawnLocked "playerctl play-pause";
"XF86AudioStop" = spawnLocked "playerctl stop";
"XF86AudioPrev" = spawnLocked "playerctl previous";
"XF86AudioNext" = spawnLocked "playerctl next";
"XF86AudioRaiseVolume" = spawnLocked "wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+";
"XF86AudioLowerVolume" = spawnLocked "wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-";
"XF86AudioMute" = spawnLocked "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
"XF86AudioMicMute" = spawnLocked "wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle";
"XF86MonBrightnessUp" = spawnLocked "brightnessctl s 5%+";
"XF86MonBrightnessDown" = spawnLocked "brightnessctl s 5%-";
# Screenshots
"Mod+S".screenshot = { };
# Session and compositor controls
"Mod+Escape" = {
toggle-keyboard-shortcuts-inhibit = { };
_props.allow-inhibiting = false;
};
"Mod+Ctrl+L" = {
spawn-sh = "loginctl lock-session";
_props.hotkey-overlay-title = "Lock Screen";
};
# Overview and window close
"Mod+O" = {
toggle-overview = { };
_props.repeat = false;
};
"Mod+Q" = {
close-window = { };
_props.repeat = false;
};
# Keyboard focus movement
"Mod+H".focus-column-or-monitor-left = { };
"Mod+J".focus-window-down = { };
"Mod+K".focus-window-up = { };
"Mod+L".focus-column-or-monitor-right = { };
# Keyboard window and column movement
"Mod+Alt+H".move-column-left-or-to-monitor-left = { };
"Mod+Alt+J".move-window-down-or-to-workspace-down = { };
"Mod+Alt+K".move-window-up-or-to-workspace-up = { };
"Mod+Alt+L".move-column-right-or-to-monitor-right = { };
# Move focus, columns, and workspaces across monitors
"Mod+Tab".focus-monitor-next = { };
"Mod+A" = {
_props.repeat = false;
spawn = swapMonitorWorkspaces;
_props.hotkey-overlay-title = "Swap Monitor Workspaces";
};
"Mod+Alt+Tab".move-column-to-monitor-next = { };
"Mod+Shift+Tab".move-workspace-to-monitor-next = { };
# Linear workspace navigation
"Mod+U".focus-workspace-down = { };
"Mod+I".focus-workspace-up = { };
# Move columns between adjacent workspaces
"Mod+Alt+U".move-column-to-workspace-down = { };
"Mod+Alt+I".move-column-to-workspace-up = { };
# Reorder workspaces
"Mod+Shift+U".move-workspace-down = { };
"Mod+Shift+I".move-workspace-up = { };
# Mouse workspace navigation
"Mod+WheelScrollDown" = withCooldown "focus-workspace-down";
"Mod+WheelScrollUp" = withCooldown "focus-workspace-up";
"Mod+Alt+WheelScrollDown" = withCooldown "move-column-to-workspace-down";
"Mod+Alt+WheelScrollUp" = withCooldown "move-column-to-workspace-up";
# Mouse column navigation and movement
"Mod+WheelScrollRight".focus-column-or-monitor-right = { };
"Mod+WheelScrollLeft".focus-column-or-monitor-left = { };
"Mod+Alt+WheelScrollRight".move-column-right-or-to-monitor-right = { };
"Mod+Alt+WheelScrollLeft".move-column-left-or-to-monitor-left = { };
"Mod+Shift+WheelScrollDown".focus-column-or-monitor-right = { };
"Mod+Shift+WheelScrollUp".focus-column-or-monitor-left = { };
# Add and remove windows from columns
"Mod+BracketLeft".consume-or-expel-window-left = { };
"Mod+BracketRight".consume-or-expel-window-right = { };
"Mod+Comma".consume-window-into-column = { };
"Mod+Period".expel-window-from-column = { };
# Column and window presentation modes
"Mod+R".switch-preset-column-width = { };
"Mod+F".maximize-column = { };
"Mod+Shift+F".fullscreen-window = { };
# Manual column width and window height adjustments
"Mod+Shift+H".set-column-width = "-10%";
"Mod+Shift+L".set-column-width = "+10%";
"Mod+Shift+J".set-window-height = "+10%";
"Mod+Shift+K".set-window-height = "-10%";
# Floating and tabbed layout toggles
"Mod+Alt+V".toggle-window-floating = { };
"Mod+Shift+V".switch-focus-between-floating-and-tiling = { };
"Mod+W".toggle-column-tabbed-display = { };
}
@@ -1,88 +0,0 @@
{ pkgs }:
pkgs.writeScriptBin "niri-shortcut-swap-monitor-workspaces" ''
#!${pkgs.python3}/bin/python3
import fcntl
import json
import os
import socket
import sys
def disposable(workspace):
return workspace["active_window_id"] is None and workspace["name"] is None
def swap(connection):
with connection.makefile("rw", encoding="utf-8") as stream:
def request(message):
stream.write(json.dumps(message) + "\n")
stream.flush()
reply = json.loads(stream.readline())
if "Err" in reply:
raise RuntimeError(reply["Err"])
return reply["Ok"]
def action(name, **arguments):
request({"Action": {name: arguments}})
workspaces = request("Workspaces")["Workspaces"]
source = next((ws for ws in workspaces if ws["is_focused"]), None)
active = {
ws["output"]: ws for ws in workspaces
if ws["output"] is not None and ws["is_active"]
}
if source is None or source["output"] not in active or len(active) < 2:
return
outputs = sorted(active)
target = active[outputs[(outputs.index(source["output"]) + 1) % len(outputs)]]
if source["active_window_id"] is None and target["active_window_id"] is None:
return
# IDs survive moves; numeric workspace positions do not.
moves = ((source, target), (target, source))
for workspace, destination in moves:
action(
"MoveWorkspaceToMonitor",
reference={"Id": workspace["id"]},
output=destination["output"],
)
# Activate the original monitor last to keep keyboard focus there.
for workspace, destination in moves:
current = request("Workspaces")["Workspaces"]
arriving = next((
ws for ws in current
if ws["id"] == workspace["id"] and ws["output"] == destination["output"]
), None)
if arriving is None and disposable(workspace):
# Niri may discard an unnamed empty workspace during the swap.
arriving = max((
ws for ws in current
if ws["output"] == destination["output"] and disposable(ws)
), key=lambda ws: ws["idx"], default=None)
if arriving is None:
raise RuntimeError("workspace or monitor disappeared during swap")
reference = {"Id": arriving["id"]}
# Focus empty workspaces before reordering so Niri retains them.
action("FocusWorkspace", reference=reference)
action("MoveWorkspaceToIndex", reference=reference, index=destination["idx"])
def main():
lock_path = os.path.join(os.environ["XDG_RUNTIME_DIR"], "niri-swap-workspaces.lock")
with open(lock_path, "a") as lock:
try:
fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
except BlockingIOError:
return
with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
connection.settimeout(5)
connection.connect(os.environ["NIRI_SOCKET"])
swap(connection)
try:
main()
except (OSError, ValueError, KeyError, RuntimeError) as error:
sys.exit(f"niri workspace swap: {error}")
''
+129 -105
View File
@@ -1,45 +1,57 @@
{
inputs,
config,
...
}:
let
repo = config.repo;
hmModules = config.flake.modules.homeManager;
in
{
flake.modules.nixos.niri =
{ ... }:
{ pkgs, ... }:
{
imports = [ inputs.niri.nixosModules.niri ];
home-manager.sharedModules = [ hmModules.niri ];
programs.niri.enable = true;
nixpkgs.overlays = [ inputs.niri.overlays.niri ];
programs = {
dconf.enable = true;
niri = {
enable = true;
package = pkgs.niri-unstable;
};
};
services = {
gvfs.enable = true;
udisks2.enable = true;
};
xdg.portal.enable = true;
};
flake.modules.homeManager.niri =
{
config,
lib,
osConfig,
pkgs,
...
}:
let
swapMonitorWorkspaces = import ./_support/shortcuts.nix { inherit pkgs; };
renameWorkspace = pkgs.writeShellApplication {
name = "rename-workspace";
runtimeInputs = [
pkgs.niri
pkgs.zenity
];
text = ''
name=$(zenity --entry --title="Workspace name" --text="Name this workspace (empty clears its name):") || exit 0
if [[ -n "$name" ]]; then
niri msg action set-workspace-name "$name"
else
niri msg action unset-workspace-name
fi
'';
borderPalette = repo.theme.kanagawa.palette.niri.border;
shortcuts = import ./_shortcuts.nix {
inherit
config
lib
pkgs
repo
;
};
machine = config.facts.machine;
machine = osConfig.facts.machine;
in
{
home = {
@@ -49,101 +61,113 @@ in
[
playerctl
brightnessctl
wireplumber
wtype
xwayland-satellite
]
++ [
swapMonitorWorkspaces
renameWorkspace
];
++ lib.attrValues shortcuts.scripts;
};
wayland.windowManager.niri = {
enable = true;
settings = {
_children =
lib.mapAttrsToList (name: display: {
output = {
_args = [ name ];
position._props = {
inherit (display) x y;
};
}
// lib.optionalAttrs display.primary {
"focus-at-startup" = { };
}
// lib.optionalAttrs (display.scale != null) {
inherit (display) scale;
}
// lib.optionalAttrs (display.width != null) {
mode = "${toString display.width}x${toString display.height}@${toString display.refresh}";
};
}) machine.displays
++ map (command: { spawn-at-startup = command; }) config.desktop.autostart
++ [
dconf.settings."org/gnome/desktop/interface".color-scheme = "prefer-dark";
programs.niri.settings = {
outputs = lib.mapAttrs (
_: display:
let
scale = display.scale or null;
width = display.width or null;
height = display.height or null;
refresh = display.refresh or null;
in
{
position = {
x = display.x or 0;
y = display.y or 0;
};
}
// lib.optionalAttrs (display.primary or false) {
"focus-at-startup" = true;
}
// lib.optionalAttrs (scale != null) {
inherit scale;
}
// lib.optionalAttrs (width != null && height != null && refresh != null) {
mode = {
inherit
width
height
refresh
;
};
}
) (machine.displays or { });
environment.DISPLAY = ":0";
spawn-at-startup = [
{ command = [ "xwayland-satellite" ]; }
{ command = [ "noctalia-shell" ]; }
];
prefer-no-csd = true;
hotkey-overlay.skip-at-startup = true;
screenshot-path = "${config.xdg.userDirs.pictures}/screenshots/%Y-%m-%dT%H:%M:%S.png";
animations.slowdown = 0.6;
cursor = {
inherit (config.home.pointerCursor) size;
theme = config.home.pointerCursor.name;
hide-after-inactive-ms = 3000;
hide-when-typing = true;
};
layout = {
always-center-single-column = true;
gaps = 14;
focus-ring.enable = false;
default-column-width.proportion = 1. / 2.;
border = {
enable = true;
width = 3;
active.color = borderPalette.active;
inactive.color = borderPalette.inactive;
urgent.color = borderPalette.urgent;
};
};
window-rules = [
{
geometry-corner-radius =
let
radius = 10.0;
in
{
window-rule = {
geometry-corner-radius = [
10.0
10.0
10.0
10.0
];
clip-to-geometry = true;
};
}
];
bottom-left = radius;
bottom-right = radius;
top-left = radius;
top-right = radius;
};
clip-to-geometry = true;
}
];
environment.DISPLAY = ":0";
prefer-no-csd = { };
hotkey-overlay.skip-at-startup = { };
screenshot-path = "${config.xdg.userDirs.pictures}/screenshots/%Y-%m-%dT%H:%M:%S.png";
debug.honor-xdg-activation-with-invalid-serial = true;
gestures.hot-corners.enable = false;
animations.slowdown = 0.6;
cursor = lib.mkIf config.home.pointerCursor.enable {
xcursor-size = config.home.pointerCursor.size;
xcursor-theme = config.home.pointerCursor.name;
hide-after-inactive-ms = 3000;
hide-when-typing = { };
input = {
focus-follows-mouse.enable = true;
mouse."accel-speed" = 0.4;
keyboard = {
repeat-delay = 300;
repeat-rate = 50;
xkb.options = "caps:escape";
};
touchpad.dwt = true;
};
layout = {
always-center-single-column = { };
gaps = 14;
focus-ring.off = { };
default-column-width.proportion = 1. / 2.;
border.width = 3;
};
debug.honor-xdg-activation-with-invalid-serial = true;
gestures.hot-corners.off = { };
input = {
focus-follows-mouse = { };
mouse."accel-speed" = 0.4;
keyboard = {
repeat-delay = 300;
repeat-rate = 50;
xkb.options = "caps:escape";
};
touchpad = {
tap = { };
dwt = { };
natural-scroll = { };
};
};
binds = import ./_support/bindings.nix {
inherit (config.desktop.commands)
browser
launcher
terminal
;
swapMonitorWorkspaces = lib.getExe swapMonitorWorkspaces;
handy = lib.getExe pkgs.handy;
};
binds = import ./_bindings.nix {
browserCommand = config.facts.desktop.browserCommand;
launcherCommand = config.facts.desktop.launcherCommand;
terminalCommand = config.facts.desktop.terminalCommand;
shortcutCommands = shortcuts.commands;
};
};
};
+19 -23
View File
@@ -1,35 +1,31 @@
{ inputs, config, ... }:
let
account = config.facts.account;
account = config.repo.account;
in
{
flake.modules.nixos.nix = {
nixpkgs.config.allowUnfree = true;
flake.modules.nixos.nix =
{ ... }:
{
nixpkgs.config.allowUnfree = true;
nix = {
gc.automatic = true;
optimise.automatic = true;
channel.enable = false;
nix = {
gc.automatic = true;
optimise.automatic = true;
registry.nixpkgs.flake = inputs.nixpkgs;
channel.enable = false;
settings = {
trusted-users = [ "@wheel" ];
use-xdg-base-directories = true;
extra-substituters = [
"https://devenv.cachix.org"
"https://noctalia.cachix.org"
];
extra-trusted-public-keys = [
"devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
"noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
];
settings = {
trusted-users = [ "@wheel" ];
use-xdg-base-directories = true;
auto-optimise-store = true;
experimental-features = [
"nix-command"
"flakes"
];
experimental-features = [
"nix-command"
"flakes"
];
};
};
};
};
flake.modules.homeManager.nix =
{ pkgs, ... }:
@@ -1,5 +0,0 @@
{
flake.modules.nixos.noctalia-greeter = {
services.displayManager.noctalia-greeter.enable = true;
};
}
-136
View File
@@ -1,136 +0,0 @@
{
flake.modules.homeManager.noctalia =
{
config,
inputs,
lib,
pkgs,
...
}:
let
homeDir = config.home.homeDirectory;
in
{
desktop.autostart = [ [ (lib.getExe config.programs.noctalia.package) ] ];
programs.noctalia = {
enable = true;
package = inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default;
settings = {
audio = {
enable_sounds = true;
sound_volume = 1.0;
};
bar.default = {
center = [
"clock"
"text_separator"
"date"
];
end = [
"tray"
"bluetooth"
"volume"
]
++ lib.optionals (config.facts.machine.name == "zenith") [
"network"
"battery"
]
++ [
"clipboard"
"session"
];
start = [
"control-center"
"workspaces"
];
font_weight = 400;
thickness = 30;
};
calendar = {
enabled = true;
account.radicale = {
name = "Personal";
provider = "custom";
server_url = "${config.facts.services.radicale.origin}/";
type = "caldav";
username = config.facts.account.name;
};
};
desktop_widgets.enabled = false;
location.address = "Meterik, The Netherlands";
lockscreen = {
blur_intensity = 0.8;
blurred_desktop = true;
fingerprint = false;
tint_intensity = 0.5;
};
lockscreen_widgets.enabled = true;
nightlight = {
enabled = true;
temperature_night = 3000;
};
notification = {
layer = "overlay";
position = "bottom_right";
};
shell = {
polkit_agent = true;
# Handy provides recording feedback; omit microphone activity popups/indicators.
privacy.mic_filter_regex = ".*";
screen_time_enabled = true;
animation.speed = 1.5;
screen_corners = {
enabled = true;
size = 50;
};
screenshot.directory = "${homeDir}/media/images/screenshots";
};
theme = {
templates = {
enable_builtin_templates = false;
enable_community_templates = false;
};
};
wallpaper = {
directory = "${homeDir}/media/images/wallpapers";
};
weather.refresh_minutes = 15;
widget = {
bluetooth.hide_when_no_connected_device = true;
media = {
art_size = 90.0;
max_length = 800;
};
text_separator = {
anchor = true;
format = "•";
type = "clock";
};
tray.drawer = true;
volume.show_label = false;
network.show_label = false;
battery.show_label = false;
workspaces = {
show_labels = true;
label_source = "name";
max_label_chars = 16;
};
};
};
};
};
}
@@ -0,0 +1,569 @@
{
homeDirectory,
lib,
terminalCommand,
}:
{
settingsVersion = 53;
bar = {
barType = "simple";
position = "top";
monitors = [ ];
density = "default";
showOutline = false;
showCapsule = false;
capsuleOpacity = 1;
capsuleColorKey = "none";
widgetSpacing = 6;
contentPadding = 2;
fontScale = 1;
backgroundOpacity = 0;
useSeparateOpacity = false;
floating = false;
marginVertical = 6;
marginHorizontal = 8;
frameThickness = 0;
frameRadius = 0;
outerCorners = false;
hideOnOverview = true;
displayMode = "always_visible";
autoHideDelay = 500;
autoShowDelay = 150;
showOnWorkspaceSwitch = true;
widgets = {
left = [
{
colorizeSystemIcon = "none";
customIconPath = "";
enableColorization = false;
icon = "rocket";
iconColor = "none";
id = "Launcher";
useDistroLogo = false;
}
{
characterCount = 2;
colorizeIcons = true;
emptyColor = "secondary";
enableScrollWheel = true;
focusedColor = "primary";
followFocusedScreen = false;
groupedBorderOpacity = 1;
hideUnoccupied = true;
iconScale = 0.75;
id = "Workspace";
labelMode = "none";
occupiedColor = "secondary";
pillSize = 0.6;
showApplications = true;
showBadge = false;
showLabelsOnlyWhenOccupied = true;
unfocusedIconsOpacity = 1;
}
];
center = [
{
clockColor = "none";
customFont = "";
formatHorizontal = "HH:mm ddd, MMM dd";
formatVertical = "HH mm - dd MM";
id = "Clock";
tooltipFormat = "HH:mm ddd, MMM dd";
useCustomFont = false;
}
];
right = [
{
blacklist = [ ];
chevronColor = "none";
colorizeIcons = false;
drawerEnabled = true;
hidePassive = false;
id = "Tray";
pinned = [ ];
}
{
displayMode = "onhover";
iconColor = "none";
id = "Volume";
middleClickCommand = "pwvucontrol || pavucontrol";
textColor = "none";
}
{
colorizeDistroLogo = false;
colorizeSystemIcon = "none";
customIconPath = "";
enableColorization = false;
icon = "noctalia";
id = "ControlCenter";
useDistroLogo = false;
}
];
};
screenOverrides = [ ];
};
general = {
avatarImage = "${homeDirectory}/.face";
dimmerOpacity = 0;
showScreenCorners = false;
forceBlackScreenCorners = false;
scaleRatio = 1;
radiusRatio = 0.5;
iRadiusRatio = 0.5;
boxRadiusRatio = 0;
screenRadiusRatio = 0;
animationSpeed = 2;
animationDisabled = false;
compactLockScreen = false;
lockScreenAnimations = false;
lockOnSuspend = true;
showSessionButtonsOnLockScreen = true;
showHibernateOnLockScreen = false;
enableLockScreenMediaControls = false;
enableShadows = true;
shadowDirection = "bottom_right";
shadowOffsetX = 2;
shadowOffsetY = 3;
language = "";
allowPanelsOnScreenWithoutBar = true;
showChangelogOnStartup = true;
telemetryEnabled = false;
enableLockScreenCountdown = true;
lockScreenCountdownDuration = 10000;
autoStartAuth = false;
allowPasswordWithFprintd = false;
clockStyle = "custom";
clockFormat = "hh\\nmm";
passwordChars = false;
lockScreenMonitors = [ ];
lockScreenBlur = 0;
lockScreenTint = 0;
keybinds = {
keyUp = [
"Up"
"Ctrl+K"
];
keyDown = [
"Down"
"Ctrl+J"
];
keyLeft = [
"Left"
"Ctrl+H"
];
keyRight = [
"Right"
"Ctrl+L"
];
keyEnter = [
"Return"
];
keyEscape = [
"Esc"
];
keyRemove = [
"Del"
];
};
reverseScroll = false;
};
ui = {
fontDefault = "Comfortaa Medium";
fontFixed = "FiraCode Nerd Font";
fontDefaultScale = 1;
fontFixedScale = 1;
tooltipsEnabled = true;
boxBorderEnabled = false;
panelBackgroundOpacity = 1;
panelsAttachedToBar = true;
settingsPanelMode = "attached";
settingsPanelSideBarCardStyle = false;
};
location = {
name = "Meterik, Limburg";
weatherEnabled = true;
weatherShowEffects = true;
useFahrenheit = false;
use12hourFormat = false;
showWeekNumberInCalendar = true;
showCalendarEvents = true;
showCalendarWeather = true;
analogClockInCalendar = false;
firstDayOfWeek = "unknown character to parse: -";
",
" = "unknown character to parse: h";
deWeatherTimezone = false;
hideWeatherCityName = false;
};
calendar = {
cards = [
{
enabled = true;
id = "calendar-header-card";
}
{
enabled = true;
id = "calendar-month-card";
}
{
enabled = true;
id = "weather-card";
}
];
};
wallpaper = {
enabled = true;
overviewEnabled = false;
directory = "${homeDirectory}/media/images/wallpapers";
monitorDirectories = [ ];
enableMultiMonitorDirectories = false;
showHiddenFiles = false;
viewMode = "recursive";
setWallpaperOnAllMonitors = true;
fillMode = "crop";
fillColor = "#000000";
useSolidColor = false;
solidColor = "#1a1a2e";
automationEnabled = false;
wallpaperChangeMode = "random";
randomIntervalSec = 300;
transitionDuration = 1500;
transitionType = "random";
skipStartupTransition = false;
transitionEdgeSmoothness = 5.0e-2;
panelPosition = "follow_bar";
hideWallpaperFilenames = false;
overviewBlur = 0.4;
overviewTint = 0.6;
useWallhaven = false;
wallhavenQuery = "";
wallhavenSorting = "relevance";
wallhavenOrder = "desc";
wallhavenCategories = "111";
wallhavenPurity = "100";
wallhavenRatios = "";
wallhavenApiKey = "";
wallhavenResolutionMode = "atleast";
wallhavenResolutionWidth = "";
wallhavenResolutionHeight = "";
sortOrder = "name";
favorites = [ ];
};
appLauncher = {
enableClipboardHistory = true;
autoPasteClipboard = false;
enableClipPreview = true;
clipboardWrapText = true;
clipboardWatchTextCommand = "wl-paste --type text --watch cliphist store";
clipboardWatchImageCommand = "wl-paste --type image --watch cliphist store";
position = "top_center";
pinnedApps = [ ];
useApp2Unit = false;
sortByMostUsed = true;
inherit terminalCommand;
customLaunchPrefixEnabled = false;
customLaunchPrefix = "";
viewMode = "grid";
showCategories = true;
iconMode = "tabler";
showIconBackground = false;
enableSettingsSearch = true;
enableWindowsSearch = true;
enableSessionSearch = true;
ignoreMouseInput = false;
screenshotAnnotationTool = "";
overviewLayer = false;
density = "default";
};
controlCenter = {
position = "close_to_bar_button";
diskPath = "/";
shortcuts = {
left = [
{
id = "Network";
}
{
id = "Bluetooth";
}
{
id = "WallpaperSelector";
}
{
id = "NoctaliaPerformance";
}
];
right = [
{
id = "Notifications";
}
{
id = "PowerProfile";
}
{
id = "KeepAwake";
}
{
id = "NightLight";
}
];
};
cards = [
{
enabled = true;
id = "profile-card";
}
{
enabled = true;
id = "shortcuts-card";
}
{
enabled = true;
id = "audio-card";
}
{
enabled = false;
id = "brightness-card";
}
{
enabled = true;
id = "weather-card";
}
{
enabled = true;
id = "media-sysmon-card";
}
];
};
systemMonitor = {
cpuWarningThreshold = 80;
cpuCriticalThreshold = 90;
tempWarningThreshold = 80;
tempCriticalThreshold = 90;
gpuWarningThreshold = 80;
gpuCriticalThreshold = 90;
memWarningThreshold = 80;
memCriticalThreshold = 90;
swapWarningThreshold = 80;
swapCriticalThreshold = 90;
diskWarningThreshold = 80;
diskCriticalThreshold = 90;
diskAvailWarningThreshold = 20;
diskAvailCriticalThreshold = 10;
batteryWarningThreshold = 20;
batteryCriticalThreshold = 5;
enableDgpuMonitoring = false;
useCustomColors = false;
warningColor = "";
criticalColor = "";
externalMonitor = "resources || missioncenter || jdsystemmonitor || corestats || system-monitoring-center || gnome-system-monitor || plasma-systemmonitor || mate-system-monitor || ukui-system-monitor || deepin-system-monitor || pantheon-system-monitor";
};
dock = {
enabled = false;
position = "bottom";
displayMode = "exclusive";
dockType = "floating";
backgroundOpacity = 1;
floatingRatio = 1;
size = 1;
onlySameOutput = true;
monitors = [ ];
pinnedApps = [ ];
colorizeIcons = false;
showLauncherIcon = false;
launcherPosition = "end";
launcherIconColor = "none";
pinnedStatic = false;
inactiveIndicators = false;
groupApps = false;
groupContextMenuMode = "extended";
groupClickAction = "cycle";
groupIndicatorStyle = "dots";
deadOpacity = 0.6;
animationSpeed = 1;
sitOnFrame = false;
showFrameIndicator = true;
};
network = {
wifiEnabled = true;
airplaneModeEnabled = false;
bluetoothRssiPollingEnabled = false;
bluetoothRssiPollIntervalMs = 60000;
networkPanelView = "wifi";
wifiDetailsViewMode = "grid";
bluetoothDetailsViewMode = "grid";
bluetoothHideUnnamedDevices = false;
disableDiscoverability = false;
};
sessionMenu = {
enableCountdown = true;
countdownDuration = 10000;
position = "center";
showHeader = true;
showKeybinds = true;
largeButtonsStyle = true;
largeButtonsLayout = "single-row";
powerOptions = [
{
action = "lock";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "1";
}
{
action = "suspend";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "2";
}
{
action = "hibernate";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "3";
}
{
action = "reboot";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "4";
}
{
action = "logout";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "5";
}
{
action = "shutdown";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "6";
}
{
action = "rebootToUefi";
command = "";
countdownEnabled = true;
enabled = true;
keybind = "";
}
];
};
notifications = {
enabled = true;
enableMarkdown = false;
density = "compact";
monitors = [ ];
location = "bottom_right";
overlayLayer = true;
backgroundOpacity = 1;
respectExpireTimeout = false;
lowUrgencyDuration = 3;
normalUrgencyDuration = 8;
criticalUrgencyDuration = 15;
clearDismissed = true;
saveToHistory = {
low = true;
normal = true;
critical = true;
};
sounds = {
enabled = false;
volume = 0.5;
separateSounds = false;
criticalSoundFile = "";
normalSoundFile = "";
lowSoundFile = "";
excludedApps = "discord,firefox,chrome,chromium,edge";
};
enableMediaToast = false;
enableKeyboardLayoutToast = true;
enableBatteryToast = true;
};
osd = {
enabled = true;
location = "top_right";
autoHideMs = 2000;
overlayLayer = true;
backgroundOpacity = 1;
enabledTypes = [
0
1
2
];
monitors = [ ];
};
audio = {
volumeStep = 5;
volumeOverdrive = false;
cavaFrameRate = 30;
visualizerType = "linear";
mprisBlacklist = [ ];
preferredPlayer = "";
volumeFeedback = false;
volumeFeedbackSoundFile = "";
};
brightness = {
brightnessStep = 5;
enforceMinimum = true;
enableDdcSupport = false;
backlightDeviceMappings = [ ];
};
colorSchemes = {
useWallpaperColors = false;
predefinedScheme = "Kanagawa";
darkMode = true;
schedulingMode = "off";
manualSunrise = "06:30";
manualSunset = "18:30";
generationMethod = "tonal-spot";
monitorForColors = "";
};
templates = {
activeTemplates = [ ];
enableUserTheming = false;
};
nightLight = {
enabled = false;
forced = false;
autoSchedule = true;
nightTemp = "4000";
dayTemp = "6500";
manualSunrise = "06:30";
manualSunset = "18:30";
};
hooks = {
enabled = false;
wallpaperChange = "";
darkModeChange = "";
screenLock = "";
screenUnlock = "";
performanceModeEnabled = "";
performanceModeDisabled = "";
startup = "";
session = "";
};
plugins = {
autoUpdate = false;
};
idle = {
enabled = false;
screenOffTimeout = 600;
lockTimeout = 660;
suspendTimeout = 1800;
fadeDuration = 5;
customCommands = "[]";
};
desktopWidgets = {
enabled = false;
overviewEnabled = true;
gridSnap = false;
monitorWidgets = [ ];
};
}
+92
View File
@@ -0,0 +1,92 @@
{
config,
lib,
...
}:
let
mkNoctaliaSettings =
{
homeDirectory,
lib,
terminalCommand,
}:
import ./_noctalia-config.nix {
inherit
homeDirectory
lib
terminalCommand
;
};
mkBaseSettings =
{
homeDirectory,
lib,
terminalCommand,
}:
mkNoctaliaSettings {
inherit
homeDirectory
lib
terminalCommand
;
};
mkPortableSettings =
baseSettings:
lib.recursiveUpdate baseSettings {
bar.widgets.right = lib.concatMap (
widget:
if widget.id == "ControlCenter" then
[
{
id = "Network";
}
{
id = "Battery";
showPowerProfiles = true;
displayMode = "graphic";
}
widget
]
else
[ widget ]
) baseSettings.bar.widgets.right;
};
in
{
flake.modules.homeManager.noctalia =
{
config,
inputs,
lib,
osConfig,
pkgs,
...
}:
let
baseSettings = mkBaseSettings {
inherit lib;
homeDirectory = config.home.homeDirectory;
terminalCommand = lib.getExe pkgs.xdg-terminal-exec;
};
settings =
if baseSettings == { } || !(osConfig.facts.machine.portable or false) then
baseSettings
else
mkPortableSettings baseSettings;
in
{
imports = [ inputs.noctalia.homeModules.default ];
programs.noctalia-shell = {
enable = true;
package = lib.mkForce (
inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default.override {
calendarSupport = true;
}
);
inherit settings;
};
};
}
-85
View File
@@ -1,85 +0,0 @@
{ config, ... }:
let
homeModules = config.flake.modules.homeManager;
in
{
flake.modules.homeManager.notes =
{
config,
lib,
pkgs,
...
}:
let
home = config.home.homeDirectory;
zkConfig = ''
[note]
filename = "{{format-date now 'timestamp'}}-{{slug title}}"
template = "default.md"
[tool]
fzf-preview = "bat --plain --color=always {-1}"
[group.daily]
paths = ["daily"]
[group.daily.note]
filename = "{{format-date now '%Y-%m-%d'}}"
extension = "md"
template = "daily.md"
[alias]
daily = 'nvim + "$(zk new --no-input --print-path "$ZK_NOTEBOOK_DIR/daily")"'
'';
noteTemplate = ''
---
date: {{format-date now}}
---
# {{title}}
'';
openNotes = pkgs.writeShellApplication {
name = "open-notes";
text = ''
exec ${lib.getExe config.programs.kitty.package} --detach \
--directory "${home}/sync/notes" \
nvim '+autocmd VimEnter * ++once ZkNotes'
'';
};
in
{
home.packages = [
openNotes
(pkgs.makeDesktopItem {
name = "notes";
desktopName = "Notes";
icon = "text-editor";
exec = lib.getExe openNotes;
path = "${home}/sync/notes";
terminal = false;
})
pkgs.ripgrep-all
pkgs.zk
];
home.file = {
"sync/notes/.zk/config.toml".text = zkConfig;
"sync/notes/.zk/templates/daily.md".text = "";
"sync/notes/.zk/templates/default.md".text = noteTemplate;
};
home.activation.createNotesLayout = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
${pkgs.coreutils}/bin/mkdir -p \
"${home}/sync/notes/daily" \
"${home}/sync/notes/meetings" \
"${home}/sync/notes/transcripts"
'';
};
flake.modules.nixos.notes =
{ ... }:
{
home-manager.sharedModules = [ homeModules.notes ];
};
}
-28
View File
@@ -1,28 +0,0 @@
{ config, lib, ... }:
let
account = config.facts.account;
personalPublicKeys = map (machine: machine.sshKeys.personal.publicKey) (
lib.filter (machine: machine.sshKeys ? personal) (builtins.attrValues config.facts.machines)
);
in
{
flake.modules.nixos.sudo-ssh-agent-auth = {
security.pam = {
rssh.enable = true;
services.sudo.rssh = true;
};
};
flake.modules.nixos.openssh = {
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
AllowUsers = [ account.name ];
};
};
users.users.${account.name}.openssh.authorizedKeys.keys = personalPublicKeys;
};
}
+8 -5
View File
@@ -3,8 +3,8 @@
...
}:
let
facts = config.facts;
account = facts.account;
repo = config.repo;
account = repo.account;
in
{
flake.modules.homeManager.passwords =
@@ -12,13 +12,16 @@ in
pkgs,
...
}:
let
pinentryPackage = pkgs.pinentry-gnome3;
in
{
programs.rbw = {
enable = true;
settings = {
base_url = facts.services.vaultwarden.origin;
email = account.emails.${account.primaryEmail}.address;
pinentry = pkgs.pinentry-gnome3;
base_url = repo.services.vaultwarden.url;
email = account.primaryEmail.address;
pinentry = pinentryPackage;
};
};
};
+28 -22
View File
@@ -3,29 +3,26 @@
...
}:
let
facts = config.facts;
account = facts.account;
homeModules = config.flake.modules.homeManager;
repo = config.repo;
account = repo.account;
in
{
flake.modules.homeManager.email =
{
config,
lib,
pkgs,
...
}:
let
mailspring = pkgs.mailspring.override {
commandLineArgs = "--password-store=gnome-libsecret";
};
mkOffice365Account =
{
address,
primary ? false,
...
}:
{
inherit address;
enable = true;
inherit address primary;
realName = account.realName;
userName = address;
thunderbird = {
@@ -40,10 +37,12 @@ in
mkMxrouteAccount =
{
address,
primary ? false,
...
}:
{
inherit address;
enable = true;
inherit address primary;
realName = account.realName;
userName = address;
thunderbird.enable = true;
@@ -51,24 +50,25 @@ in
authentication = "plain";
host = "taylor.mxrouting.net";
port = 993;
tls.enable = true;
};
smtp = {
authentication = "plain";
host = "taylor.mxrouting.net";
port = 465;
tls.enable = true;
};
};
mkEmailAccount =
name: email:
(if email.type == "office365" then mkOffice365Account email else mkMxrouteAccount email)
// {
primary = name == account.primaryEmail;
};
email:
if email.type == "office365" then
mkOffice365Account email
else if email.type == "mxrouting" then
mkMxrouteAccount email
else
throw "Unsupported email type `${email.type}` for ${config.home.username}";
in
{
home.packages = [ mailspring ];
xdg.mimeApps.defaultApplicationPackages = [ mailspring ];
programs.thunderbird = {
enable = true;
profiles.${config.home.username} = {
@@ -87,7 +87,7 @@ in
};
};
accounts.email.accounts = lib.mapAttrs mkEmailAccount account.emails;
accounts.email.accounts = lib.mapAttrs (_: mkEmailAccount) account.emails;
};
flake.modules.homeManager.calendar-tasks =
@@ -96,9 +96,10 @@ in
pkgs,
...
}:
let
calendarsPath = "${config.xdg.dataHome}/calendars";
in
{
imports = [ homeModules.sops ];
programs.pimsync.enable = true;
services.pimsync.enable = true;
@@ -126,13 +127,18 @@ in
};
accounts.calendar = {
basePath = "${config.xdg.dataHome}/calendars";
basePath = calendarsPath;
accounts.radicale = {
primary = true;
primaryCollection = "personal";
local = {
type = "filesystem";
fileExt = ".ics";
};
remote = {
url = "${facts.services.radicale.origin}/";
url = repo.services.radicale.url;
type = "caldav";
userName = config.home.username;
passwordCommand = [
+3 -1
View File
@@ -1,7 +1,7 @@
{ ... }:
{
flake.modules.nixos.plymouth =
{ ... }:
{ pkgs, ... }:
{
boot = {
consoleLogLevel = 3;
@@ -16,6 +16,8 @@
plymouth = {
enable = true;
theme = "spinner_alt";
themePackages = [ pkgs.adi1090x-plymouth-themes ];
};
};
};
+5 -21
View File
@@ -1,24 +1,8 @@
{ config, ... }:
{ ... }:
{
flake.modules.nixos.podman =
{ lib, pkgs, ... }:
{
home-manager.sharedModules = [ config.flake.modules.homeManager.podman ];
virtualisation.podman.enable = true;
virtualisation.containers.containersConf.settings.engine.compose_providers = [
(lib.getExe pkgs.podman-compose)
];
};
flake.modules.homeManager.podman =
{ osConfig, pkgs, ... }:
{
services.podman = {
enable = true;
package = osConfig.virtualisation.podman.package;
};
home.packages = [ pkgs.podman-tui ];
flake.modules.homeManager.podman = {
services.podman = {
enable = true;
};
};
}
+7 -12
View File
@@ -2,18 +2,13 @@
flake.modules.nixos.printing =
{ pkgs, ... }:
{
programs.system-config-printer.enable = true;
services = {
printing = {
enable = true;
browsed.enable = true;
drivers = [ pkgs.cnijfilter2 ];
};
avahi = {
enable = true;
nssmdns4 = true;
};
services.printing = {
enable = true;
drivers = with pkgs; [
cups-filters
cups-browsed
cnijfilter2
];
};
};
}
-7
View File
@@ -1,7 +0,0 @@
{
flake.modules.homeManager.qbittorrent =
{ pkgs, ... }:
{
home.packages = [ pkgs.qbittorrent ];
};
}
-26
View File
@@ -1,26 +0,0 @@
{ config, ... }:
{
flake.modules.nixos.radicale = {
imports = [ config.flake.modules.nixos.caddy ];
services.radicale = {
enable = true;
settings = {
server.hosts = [ "127.0.0.1:5232" ];
auth = {
type = "htpasswd";
htpasswd_filename = "/var/lib/radicale/users";
htpasswd_encryption = "bcrypt";
};
};
};
services.caddy.virtualHosts.${config.facts.services.radicale.domain}.extraConfig = ''
reverse_proxy 127.0.0.1:5232 {
header_up X-Script-Name /
header_up X-Remote-User {http.auth.user.id}
}
'';
};
}
+21
View File
@@ -0,0 +1,21 @@
{
flake.modules.nixos.sddm =
{
pkgs,
...
}:
{
services.displayManager.sddm = {
enable = true;
enableHidpi = true;
wayland.enable = true;
wayland.compositor = "kwin";
theme = "${
pkgs.sddm-astronaut.override { embeddedTheme = "purple_leaves"; }
}/share/sddm/themes/sddm-astronaut-theme";
extraPackages = with pkgs; [
kdePackages.qtmultimedia
];
};
};
}
+36
View File
@@ -0,0 +1,36 @@
{ config, ... }:
let
repo = config.repo;
repoHelpers = repo.helpers;
service = repo.services.actual;
in
{
repo.services.actual = {
domain = "finance.jelles.net";
host = "127.0.0.1";
port = 3000;
url = "https://finance.jelles.net";
};
flake.modules.nixos.actual =
{ lib, ... }:
lib.mkMerge [
{
services.actual = {
enable = true;
openFirewall = false;
settings = {
inherit (service) port;
hostname = service.host;
};
};
}
(repoHelpers.mkCaddyReverseProxy {
inherit (service)
domain
port
;
})
];
}
@@ -1,12 +1,12 @@
{ config, ... }:
let
facts = config.facts;
repo = config.repo;
in
{
flake.modules.nixos.caddy = {
services.caddy = {
enable = true;
email = facts.account.emails.${facts.account.primaryEmail}.address;
email = repo.account.primaryEmail.address;
openFirewall = true;
};
};
+49
View File
@@ -0,0 +1,49 @@
{ config, ... }:
let
repo = config.repo;
repoHelpers = repo.helpers;
service = repo.services.gitea;
in
{
repo.services.gitea = {
domain = "git.jelles.net";
host = "127.0.0.1";
port = 3001;
url = "https://git.jelles.net/";
};
flake.modules.nixos.gitea =
{ lib, ... }:
lib.mkMerge [
{
services.gitea = {
enable = true;
settings = {
server = {
DOMAIN = service.domain;
ROOT_URL = service.url;
HTTP_PORT = service.port;
HTTP_ADDR = service.host;
START_SSH_SERVER = false;
SSH_PORT = 22;
};
service.DISABLE_REGISTRATION = true;
};
};
}
{
services.openssh.settings.AllowUsers = [ "gitea" ];
}
(repoHelpers.mkCaddyReverseProxy {
inherit (service)
domain
port
;
})
];
}
+34
View File
@@ -0,0 +1,34 @@
{ config, lib, ... }:
let
account = config.repo.account;
personalPublicKeys =
machines:
map (machine: (machine.sshKeys or { }).personal.publicKey) (
lib.filter (machine: (machine.sshKeys or { }) ? personal) (builtins.attrValues machines)
);
in
{
flake.modules.nixos.sudo-ssh-agent-auth = {
security.pam = {
rssh.enable = true;
services.sudo.rssh = true;
};
};
flake.modules.nixos.openssh =
{ ... }:
{
services.openssh.openFirewall = true;
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
AllowUsers = [ account.name ];
};
};
users.users.${account.name}.openssh.authorizedKeys.keys = personalPublicKeys config.repo.machines;
};
}
@@ -0,0 +1,56 @@
{ config, ... }:
let
repo = config.repo;
repoHelpers = repo.helpers;
service = repo.services.radicale;
in
{
repo.services.radicale = {
domain = "radicale.jelles.net";
host = "127.0.0.1";
port = 5232;
url = "https://radicale.jelles.net/";
};
flake.modules.nixos.radicale =
{ lib, ... }:
lib.mkMerge [
{
services.radicale = {
enable = true;
settings = {
server.hosts = [ "${service.host}:${toString service.port}" ];
auth = {
type = "htpasswd";
htpasswd_filename = "/var/lib/radicale/users";
htpasswd_encryption = "bcrypt";
};
storage.filesystem_folder = "/var/lib/radicale/collections";
};
};
}
(repoHelpers.mkCaddyReverseProxy {
inherit (service)
domain
port
;
extraHeaders = [
{
name = "X-Script-Name";
value = "/";
}
{
name = "X-Forwarded-For";
value = "{remote}";
}
{
name = "X-Remote-User";
value = "{http.auth.user.id}";
}
];
})
];
}
@@ -0,0 +1,28 @@
{ config, ... }:
let
account = config.repo.account;
in
{
flake.modules.nixos.transmission =
{ config, pkgs, ... }:
{
services.transmission = {
enable = true;
package = pkgs.transmission_4;
openPeerPorts = true;
downloadDirPermissions = "775";
settings = {
download-dir = "${account.homeDirectory}/torrents";
incomplete-dir = "${account.homeDirectory}/torrents/.incomplete";
peer-port = 43864;
umask = "002";
};
};
# NOTE: Upstream bug?
systemd.services.transmission-setup.requiredBy = [ "transmission.service" ];
users.users.${account.name}.extraGroups = [ config.services.transmission.group ];
};
}
@@ -0,0 +1,38 @@
{ config, ... }:
let
repo = config.repo;
repoHelpers = repo.helpers;
service = repo.services.vaultwarden;
in
{
repo.services.vaultwarden = {
domain = "vault.jelles.net";
host = "127.0.0.1";
port = 8100;
url = "https://vault.jelles.net";
};
flake.modules.nixos.vaultwarden =
{ lib, ... }:
lib.mkMerge [
{
services.vaultwarden = {
enable = true;
backupDir = "/var/backup/vaultwarden";
config = {
DOMAIN = service.url;
SIGNUPS_ALLOWED = false;
ROCKET_PORT = service.port;
ROCKET_LOG = "critical";
};
};
}
(repoHelpers.mkCaddyReverseProxy {
inherit (service)
domain
port
;
})
];
}
@@ -0,0 +1,215 @@
{ ... }:
{
flake.modules.nixos.vps-insights =
{ config, pkgs, ... }:
let
localAddress = "127.0.0.1";
grafanaDataDir = config.services.grafana.dataDir;
lokiDataDir = config.services.loki.dataDir;
lokiUrl = "http://${localAddress}:3100";
prometheusUrl = "http://${localAddress}:9090";
in
{
environment = {
etc."alloy/config.alloy".text = ''
loki.relabel "journal" {
forward_to = []
rule {
source_labels = ["__journal__systemd_unit"]
target_label = "unit"
}
rule {
source_labels = ["__journal_syslog_identifier"]
target_label = "syslog_identifier"
}
rule {
source_labels = ["__journal_priority_keyword"]
target_label = "level"
}
}
loki.source.journal "system" {
forward_to = [loki.write.local.receiver]
relabel_rules = loki.relabel.journal.rules
max_age = "24h"
labels = {
host = "${config.networking.hostName}",
}
}
loki.write "local" {
endpoint {
url = "${lokiUrl}/loki/api/v1/push"
}
}
'';
systemPackages = with pkgs; [
goaccess
lynis
];
};
services = {
# Keep local system logs available for Loki and manual inspection.
journald.extraConfig = ''
Storage=persistent
SystemMaxUse=1G
MaxRetentionSec=30day
'';
# Detect and block common attacks against SSH and Caddy.
crowdsec = {
enable = true;
hub.collections = [
"crowdsecurity/linux"
"crowdsecurity/caddy"
];
localConfig.acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
filenames = [ "/var/log/caddy/*.log" ];
labels.type = "caddy";
}
];
};
crowdsec-firewall-bouncer = {
enable = true;
registerBouncer.bouncerName = "${config.networking.hostName}-firewall-bouncer";
};
# Grafana defaults to 127.0.0.1:3000; add secrets and datasources only.
grafana = {
enable = true;
settings = {
analytics.reporting_enabled = false;
security = {
admin_password = "$__file{${grafanaDataDir}/admin-password}";
secret_key = "$__file{${grafanaDataDir}/secret-key}";
};
};
provision.datasources.settings = {
prune = true;
datasources = [
{
name = "Prometheus";
type = "prometheus";
uid = "prometheus";
url = prometheusUrl;
isDefault = true;
}
{
name = "Loki";
type = "loki";
uid = "loki";
url = lokiUrl;
}
];
};
};
# Store local logs in Loki and feed them from journald through Alloy.
loki = {
enable = true;
configuration = {
analytics.reporting_enabled = false;
auth_enabled = false;
server = {
http_listen_address = localAddress;
http_listen_port = 3100;
grpc_listen_address = localAddress;
grpc_listen_port = 9096;
};
common = {
path_prefix = lokiDataDir;
replication_factor = 1;
instance_interface_names = [ "lo" ];
ring = {
instance_addr = localAddress;
kvstore.store = "inmemory";
};
};
schema_config.configs = [
{
from = "2025-01-01";
store = "tsdb";
object_store = "filesystem";
schema = "v13";
index = {
prefix = "index_";
period = "24h";
};
}
];
storage_config.filesystem.directory = "${lokiDataDir}/chunks";
compactor = {
working_directory = "${lokiDataDir}/compactor";
retention_enabled = true;
delete_request_store = "filesystem";
};
limits_config.retention_period = "720h";
};
};
alloy = {
enable = true;
extraFlags = [ "--server.http.listen-addr=${localAddress}:12345" ];
};
# Collect basic VPS health metrics for Grafana.
prometheus = {
enable = true;
listenAddress = localAddress;
retentionTime = "30d";
scrapeConfigs = [
{
job_name = "prometheus";
static_configs = [
{
targets = [ "${localAddress}:9090" ];
}
];
}
{
job_name = "node";
static_configs = [
{
targets = [ "${localAddress}:9100" ];
}
];
}
];
exporters.node = {
enable = true;
listenAddress = localAddress;
};
};
};
systemd.services.grafana.preStart = ''
umask 077
if [ ! -s ${grafanaDataDir}/admin-password ]; then
${pkgs.openssl}/bin/openssl rand -base64 32 > ${grafanaDataDir}/admin-password
fi
if [ ! -s ${grafanaDataDir}/secret-key ]; then
${pkgs.openssl}/bin/openssl rand -hex 32 > ${grafanaDataDir}/secret-key
fi
'';
};
}
+33 -18
View File
@@ -22,6 +22,7 @@
enable = true;
dotDir = "${config.xdg.configHome}/zsh";
enableCompletion = true;
completionInit = ''
autoload -U compinit
compinit -C
@@ -49,22 +50,18 @@
historySubstringSearch.enable = true;
history.path = "${config.xdg.dataHome}/zsh_history";
history = {
ignoreDups = true;
save = 10000;
size = 10000;
path = "${config.xdg.dataHome}/zsh_history";
};
profileExtra = lib.optionalString (config.home.sessionPath != [ ]) ''
export PATH="$PATH''${PATH:+:}${lib.concatStringsSep ":" config.home.sessionPath}"
'';
initContent = ''
# Terminal/window switchers show the working directory and active command.
autoload -Uz add-zsh-hook
function terminal-title-precmd() {
print -Pn '\e]2;%m: %~\a'
}
function terminal-title-preexec() {
local command="''${1//[[:cntrl:]]/}"
print -Pn '\e]2;%m: %~ — '
print -rn -- "$command"$'\a'
}
add-zsh-hook precmd terminal-title-precmd
add-zsh-hook preexec terminal-title-preexec
bindkey -v
export KEYTIMEOUT=1
@@ -82,7 +79,6 @@
fi
bindkey "^[[Z" reverse-menu-complete
bindkey -M menuselect "^[[Z" reverse-menu-complete
bindkey -M menuselect "^[" send-break
zstyle ':completion:*' completer _extensions _complete _approximate
zstyle ':completion:*' use-cache on
@@ -119,8 +115,19 @@
programs.starship = {
enable = true;
enableZshIntegration = true;
settings = {
format = "$nix_shell$hostname$directory$git_branch$git_state$line_break$character";
add_newline = true;
format = lib.concatStrings [
"$nix_shell"
"$hostname"
"$directory"
"$git_branch"
"$git_state"
"$line_break"
"$character"
];
directory = {
truncation_length = 99;
@@ -137,6 +144,8 @@
format = "([$state( $progress_current/$progress_total)]($style)) ";
style = "bright-black";
};
line_break.disabled = false;
};
};
@@ -145,9 +154,15 @@
extraOptions = [ "--group-directories-first" ];
};
programs.zoxide.enable = true;
programs.zoxide = {
enable = true;
enableZshIntegration = true;
};
programs.fzf.enable = true;
programs.fzf = {
enable = true;
enableZshIntegration = true;
};
programs.bottom.enable = true;
+5 -14
View File
@@ -1,28 +1,19 @@
{ config, ... }:
let
homeModules = config.flake.modules.homeManager;
in
{
flake.modules.homeManager.ssh-client =
{ config, ... }:
let
server = config.facts.topology.server;
in
{
imports = [ homeModules.sops ];
programs.ssh = {
enable = true;
enableDefaultConfig = false;
includes = [
config.sops.templates."ssh-config-${server.machine}".path
config.sops.templates."ssh-config-orion".path
];
};
sops.secrets."${server.machine}-ip" = { };
sops.templates."ssh-config-${server.machine}".content = ''
Host ${server.sshAlias}
HostName ${config.sops.placeholder."${server.machine}-ip"}
sops.secrets."orion-ip" = { };
sops.templates."ssh-config-orion".content = ''
Host orion
HostName ${config.sops.placeholder."orion-ip"}
ForwardAgent yes
'';
};
+36 -19
View File
@@ -4,28 +4,41 @@
...
}:
let
account = config.facts.account;
syncMachines = lib.mapAttrs' (
machineName: machine:
let
name = "${account.name}@${machineName}";
in
lib.nameValuePair name {
inherit name;
id = machine.syncthingId;
}
) (lib.filterAttrs (_: machine: machine.syncthingId != null) config.facts.machines);
syncMachines = lib.listToAttrs (
lib.concatLists (
lib.mapAttrsToList (
machineName: machine:
let
syncthingId = machine.syncthingId or null;
in
lib.optional (syncthingId != null) (
let
name = "${config.repo.account.name}@${machineName}";
in
{
inherit name;
value = {
inherit name;
id = syncthingId;
};
}
)
) config.repo.machines
)
);
syncExternalDevices = lib.mapAttrs (name: device: {
inherit name;
id = device.syncthingId;
}) (lib.filterAttrs (_: device: device.syncthingId != null) config.facts.externalDevices);
syncPhones = {
"pixel-10" = {
name = "pixel-10";
id = "MTJHEHA-UMZDQZ7-BTMRRLQ-Y7BFPUJ-ZTY6LZX-PDXV3IS-XVJCU7B-EPETBQZ";
};
};
syncDevices = syncMachines // syncExternalDevices;
syncDevices = syncMachines // syncPhones;
in
{
flake.modules.homeManager.syncthing =
{ config, ... }:
{ ... }:
{
services.syncthing = {
enable = true;
@@ -36,10 +49,14 @@ in
settings = {
folders = {
sync = {
path = "${config.home.homeDirectory}/sync";
path = "~/sync";
label = "sync";
devices = builtins.attrNames syncDevices;
ignorePatterns = [ "**/.zk" ];
};
calibre = {
path = "~/calibre";
label = "calibre";
devices = builtins.attrNames syncMachines;
};
};
devices = syncDevices;
+35
View File
@@ -0,0 +1,35 @@
{ ... }:
{
flake.modules.nixos.systemd-boot =
{ config, pkgs, ... }:
{
boot = {
loader = {
efi.canTouchEfiVariables = true;
systemd-boot = {
enable = true;
consoleMode = "auto";
configurationLimit = 5;
extraInstallCommands = ''
ENTRIES="${config.boot.loader.efi.efiSysMountPoint}/loader/entries"
PROFILES="/nix/var/nix/profiles"
for file in "$ENTRIES"/nixos-generation-*.conf; do
generation=$(${pkgs.coreutils}/bin/basename "$file" | ${pkgs.gnugrep}/bin/grep -o -E '[0-9]+')
timestamp=$(${pkgs.coreutils}/bin/stat -c %y "$PROFILES/system-$generation-link" 2>/dev/null | ${pkgs.coreutils}/bin/cut -d. -f1)
if [ -z "$timestamp" ]; then
timestamp="Unknown Date"
fi
${pkgs.gnused}/bin/sed -i "s/^version .*/version Generation $generation - $timestamp/" "$file"
done
'';
};
};
tmp.cleanOnBoot = true;
kernelPackages = pkgs.linuxPackages_latest;
};
};
}
-7
View File
@@ -1,7 +0,0 @@
{
flake.modules.nixos.tailscale = {
services.tailscale.enable = true;
# Keep existing SSH exposure until tailnet enrollment and access are verified.
networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 22 ];
};
}
+153 -18
View File
@@ -1,27 +1,108 @@
{ lib, config, ... }:
let
homeModules = config.flake.modules.homeManager;
repo = config.repo;
kittySingleInstance =
pkgs:
pkgs.symlinkJoin {
name = "kitty-single";
paths = [ pkgs.kitty ];
meta = pkgs.kitty.meta;
buildInputs = [ pkgs.makeWrapper ];
postBuild = ''
# Wrap the binary to always launch as a single instance
wrapProgram $out/bin/kitty --add-flags "-1"
# Patch the .desktop file for strict app launchers like Vicinae
rm $out/share/applications/kitty.desktop
sed 's/Exec=kitty/Exec=kitty -1/g' ${pkgs.kitty}/share/applications/kitty.desktop > $out/share/applications/kitty.desktop
'';
};
in
{
flake.modules.homeManager.terminal-foot =
{
lib,
pkgs,
...
}:
let
repoTheme = repo.theme.kanagawa;
palette = repoTheme.palette;
hex = lib.removePrefix "#";
in
{
programs.foot = {
enable = true;
package = pkgs.foot;
settings = {
main = {
font = "JetBrains Mono:style=Medium:size=11:fontfeatures=-liga:fontfeatures=-calt";
font-bold = "JetBrains Mono:style=Bold:size=11:fontfeatures=-liga:fontfeatures=-calt";
font-italic = "JetBrains Mono:style=Medium Italic:size=11:fontfeatures=-liga:fontfeatures=-calt";
font-bold-italic = "JetBrains Mono:style=Bold Italic:size=11:fontfeatures=-liga:fontfeatures=-calt";
gamma-correct-blending = "yes";
pad = "3x3";
# vertical-letter-offset = -1;
# letter-spacing = -0.2;
};
tweak.box-drawing-base-thickness = 0.1;
bell.system = "no";
scrollback.lines = 10000;
text-bindings."\\x0a" = "Shift+Return Shift+KP_Enter";
colors-dark = {
background = hex palette.background;
foreground = hex palette.foreground;
selection-background = hex palette.selectionBackground;
selection-foreground = hex palette.selectionForeground;
urls = hex palette.url;
cursor = "${hex palette.background} ${hex palette.cursor}";
regular0 = hex palette.terminal.color0;
regular1 = hex palette.terminal.color1;
regular2 = hex palette.terminal.color2;
regular3 = hex palette.terminal.color3;
regular4 = hex palette.terminal.color4;
regular5 = hex palette.terminal.color5;
regular6 = hex palette.terminal.color6;
regular7 = hex palette.terminal.color7;
bright0 = hex palette.terminal.color8;
bright1 = hex palette.terminal.color9;
bright2 = hex palette.terminal.color10;
bright3 = hex palette.terminal.color11;
bright4 = hex palette.terminal.color12;
bright5 = hex palette.terminal.color13;
bright6 = hex palette.terminal.color14;
bright7 = hex palette.terminal.color15;
"16" = hex palette.terminal.color16;
"17" = hex palette.terminal.color17;
};
};
};
};
flake.modules.homeManager.terminal-kitty =
{ pkgs, ... }:
let
kitty = pkgs.symlinkJoin {
name = "kitty-single";
paths = [ pkgs.kitty ];
meta = pkgs.kitty.meta;
buildInputs = [ pkgs.makeWrapper ];
postBuild = ''
wrapProgram $out/bin/kitty --add-flags "-1"
rm $out/share/applications/kitty.desktop
sed 's/^Exec=kitty/Exec=kitty -1/' ${pkgs.kitty}/share/applications/kitty.desktop > $out/share/applications/kitty.desktop
'';
};
repoTheme = repo.theme.kanagawa;
palette = repoTheme.palette;
in
{
programs.kitty = {
enable = true;
package = kitty;
package = kittySingleInstance pkgs;
font = {
name = "JetBrains Mono";
size = 11;
};
settings = {
disable_ligatures = "always";
scrollback_lines = 10000;
@@ -31,6 +112,45 @@ in
update_check_interval = 0;
};
keybindings."shift+enter" = "send_text all \\x0a";
extraConfig = ''
## name: ${repoTheme.displayName}
## license: MIT
## author: Tommaso Laurenzi
## upstream: https://github.com/rebelot/kanagawa.nvim/
background ${palette.background}
foreground ${palette.foreground}
selection_background ${palette.selectionBackground}
selection_foreground ${palette.selectionForeground}
url_color ${palette.url}
cursor ${palette.cursor}
active_tab_background ${palette.background}
active_tab_foreground ${palette.selectionForeground}
inactive_tab_background ${palette.background}
inactive_tab_foreground ${palette.muted}
color0 ${palette.terminal.color0}
color1 ${palette.terminal.color1}
color2 ${palette.terminal.color2}
color3 ${palette.terminal.color3}
color4 ${palette.terminal.color4}
color5 ${palette.terminal.color5}
color6 ${palette.terminal.color6}
color7 ${palette.terminal.color7}
color8 ${palette.terminal.color8}
color9 ${palette.terminal.color9}
color10 ${palette.terminal.color10}
color11 ${palette.terminal.color11}
color12 ${palette.terminal.color12}
color13 ${palette.terminal.color13}
color14 ${palette.terminal.color14}
color15 ${palette.terminal.color15}
color16 ${palette.terminal.color16}
color17 ${palette.terminal.color17}
'';
};
systemd.user.services.kitty-daemon = {
Unit = {
@@ -42,18 +162,33 @@ in
WantedBy = [ "graphical-session.target" ];
};
Service = {
ExecStart = "${lib.getExe kitty} --start-as=hidden ${pkgs.coreutils}/bin/tail -f /dev/null";
# Use the wrapped package (which already includes -1)
# Start it hidden and run an infinite dummy process so the instance stays alive
ExecStart = "${lib.getExe (kittySingleInstance pkgs)} --start-as=hidden ${pkgs.coreutils}/bin/tail -f /dev/null";
Restart = "on-failure";
};
};
};
flake.modules.homeManager.primary-terminal-kitty =
{ config, lib, ... }:
flake.modules.homeManager.primary-terminal-foot =
{ lib, pkgs, ... }:
{
imports = [ homeModules.terminal-kitty ];
imports = [ config.flake.modules.homeManager.terminal-foot ];
desktop.commands.terminal = [ (lib.getExe config.programs.kitty.package) ];
facts.desktop.terminalCommand = lib.getExe pkgs.foot;
xdg.terminal-exec = {
enable = true;
settings.default = [ "foot.desktop" ];
};
};
flake.modules.homeManager.primary-terminal-kitty =
{ lib, pkgs, ... }:
{
imports = [ config.flake.modules.homeManager.terminal-kitty ];
facts.desktop.terminalCommand = lib.getExe (kittySingleInstance pkgs);
xdg.terminal-exec = {
enable = true;
Loaded 100 of 145 files, more files were not shown because too many files have changed in this diff. Show more