add flake-parts

flake.lock

@@ -91,6 +91,22 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -130,6 +146,22 @@
       }
     },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1751685974,
@@ -148,58 +180,15 @@
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
-          "nur",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1765835352,
+        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1760948891,
-        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "stylix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1763759067,
-        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
+        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
         "type": "github"
       },
       "original": {
@@ -224,6 +213,54 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixos-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "gnome-shell": {
       "flake": false,
       "locked": {
@@ -332,6 +369,29 @@
         "type": "github"
       }
     },
+    "nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766321686,
+        "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1766651565,
@@ -386,7 +446,9 @@
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": [
+          "flake-parts"
+        ],
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -432,8 +494,10 @@
     },
     "nvf": {
       "inputs": {
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts_2",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": [
+          "flake-parts"
+        ],
         "mnw": "mnw",
         "ndg": "ndg",
         "nixpkgs": [
@@ -455,15 +519,38 @@
         "type": "github"
       }
     },
+    "phoenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766543224,
+        "narHash": "sha256-96PBoNqh3sPU9t+IXxcB1OjjuQ8HOv42OOh9UtwFHbU=",
+        "owner": "celenityy",
+        "repo": "Phoenix",
+        "rev": "f09568c8a71af4fe42dd43c6f711c67daf605f1e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "celenityy",
+        "repo": "Phoenix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "flake-parts": "flake-parts",
         "home-manager": "home-manager_2",
         "impermanence": "impermanence",
+        "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
         "noshell": "noshell",
         "nur": "nur",
         "nvf": "nvf",
+        "phoenix": "phoenix",
         "stylix": "stylix"
       }
     },
@@ -474,7 +561,9 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": [
+          "flake-parts"
+        ],
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"

flake.nix

@@ -4,11 +4,19 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    flake-parts = {
+      url = "github:hercules-ci/flake-parts";
+      inputs.nixpkgs-lib.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     impermanence.url = "github:nix-community/impermanence";
+    nixos-mailserver = {
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     noshell = {
       url = "github:viperML/noshell";
@@ -17,29 +25,38 @@
     nur = {
       url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
     };
     nvf = {
       url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
+    };
+    phoenix = {
+      url = "github:celenityy/Phoenix";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
     };
   };
-  outputs = {
+  outputs = inputs @ {
     agenix,
+    flake-parts,
     home-manager,
     impermanence,
+    nixos-mailserver,
     nixpkgs,
     noshell,
     nur,
     nvf,
+    phoenix,
     stylix,
     ...
   }: let
-    laptop = import ./machines/laptop/machine.nix;
-    _173-249-5-230 = import ./machines/173-249-5-230/machine.nix;
+    machines = import ./machines.nix;
     configuration = machine: modules:
       nixpkgs.lib.nixosSystem {
         system = machine.system;
@@ -47,13 +64,17 @@
         modules =
           modules
           ++ [
-            machine.configuration
-            machine.hardware-configuration
+            ./machines/${machine.hostname}/configuration.nix
+            ./users.nix
+            ./secrets.nix
+            impermanence.nixosModules.impermanence
+            agenix.nixosModules.default
+            nixos-mailserver.nixosModule
+            phoenix.nixosModules.default
           ];
       };
     configurationWithHomeManager = machine: (configuration machine
       [
-        agenix.nixosModules.default
         home-manager.nixosModules.home-manager
         {
           nixpkgs.overlays = [
@@ -67,7 +88,7 @@
             (name: value: value)
             (
               nixpkgs.legacyPackages.${machine.system}.lib.genAttrs
-              machine.usernames
+              machine.users
               (
                 name: {
                   imports = [
@@ -80,11 +101,19 @@
               )
             );
         }
-        impermanence.nixosModules.impermanence
         noshell.nixosModules.default
       ]);
-  in {
-    nixosConfigurations.${laptop.hostname} = configurationWithHomeManager laptop;
-    nixosConfigurations.${_173-249-5-230.hostname} = configurationWithHomeManager _173-249-5-230;
-  };
+  in
+    flake-parts.lib.mkFlake {inherit inputs;} (top @ {
+      config,
+      withSystem,
+      moduleWithSystem,
+      ...
+    }: {
+      systems = ["x86_64-linux"];
+      flake.nixosConfigurations =
+        builtins.mapAttrs
+        (hostname: value: configurationWithHomeManager value)
+        machines;
+    });
 }

machines.nix

@@ -0,0 +1,15 @@
+{
+  lenovo = {
+    hostname = "lenovo";
+    system = "x86_64-linux";
+    users = [
+      "andromeda"
+      "mtgmonkey"
+    ];
+  };
+  "109-199-104-83" = {
+    hostname = "109-199-104-83";
+    system = "x86_64-linux";
+    users = [];
+  };
+}

machines/109-199-104-83/configuration.nix

@@ -0,0 +1,90 @@
+{
+  config,
+  modulesPath,
+  machine,
+  ...
+}: {
+  # roundcube config
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.${config.networking.domain}";
+    extraConfig = ''
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+
+  # mailserver config
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.${config.networking.domain}";
+    domains = ["${config.networking.domain}"];
+    x509.useACMEHost = config.mailserver.fqdn;
+    loginAccounts = {
+      "test@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
+      };
+    };
+  };
+
+  # cert config
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mtgmonket@gmail.com";
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts."mail.${config.networking.domain}" = {
+      forceSSL = true;
+      enableACME = true;
+    };
+  };
+
+  # system config
+  system.stateVersion = "25.11";
+  nix.settings.experimental-features = ["flakes" "nix-command"];
+  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+  boot.loader.grub.device = "/dev/sda";
+  boot.loader.timeout = 30;
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
+  boot.initrd.kernelModules = ["nvme"];
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = true;
+  networking = {
+    useNetworkd = true;
+    usePredictableInterfaceNames = true;
+    hostName = machine.hostname;
+    domain = "galaxious.de";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443];
+      allowedUDPPorts = [80 443];
+    };
+  };
+  systemd.network = {
+    enable = true;
+    networks."40-wan" = {
+      matchConfig.Name = "enx0050565f4fff";
+      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
+      routes = [
+        {
+          Gateway = "109.199.96.1";
+          GatewayOnLink = true;
+        }
+        {Gateway = "fe80::1";}
+      ];
+      dns = ["2620:fe::fe" "9.9.9.9"];
+    };
+  };
+  services.openssh.enable = true;
+  users.mutableUsers = false;
+  users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
+  programs.noshell.enable = true;
+}

machines/173-249-5-230/configuration.nix

@@ -1,78 +0,0 @@
-{
-  config,
-  machine,
-  ...
-}: {
-  age.secrets.secret2.file = ../../secrets/secret2.age;
-  boot.tmp.cleanOnBoot = true;
-  boot.loader.grub.devices = ["nodev"];
-  environment.persistence."/nix/persist" = {
-    enable = true;
-    hideMounts = true;
-    directories = [
-      "/var/log"
-      "/var/lib/nixos"
-      "/var/lib/systemd/coredump"
-      "/etc/NetworkManager/system-connections"
-    ];
-    files = [
-      "/etc/machine-id"
-      "/etc/ly/save.txt"
-    ];
-    users."mtgmonkey" = {
-      directories = [
-        ".local/share/zoxide"
-        ".ssh"
-      ];
-      files = [
-        ".bash_history"
-        ".brush_history"
-      ];
-    };
-  };
-  i18n.defaultLocale = "de_DE.UTF-8";
-  networking = {
-    dhcpcd.enable = true;
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [80 443];
-      allowedUDPPorts = [80 443];
-    };
-    hostName = machine.hostname;
-    domain = "";
-  };
-  nix.settings = {
-    experimental-features = [
-      "nix-command"
-      "flakes"
-    ];
-    allow-import-from-derivation = true;
-  };
-  programs.noshell.enable = true;
-  services.openssh = {
-    enable = true;
-    allowSFTP = false;
-    ports = [5522];
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = true;
-    };
-    extraConfig = ''
-      AllowTcpForwarding no
-      AllowAgentForwarding no
-      MaxAuthTries 3
-      MaxSessions 4
-      TCPKeepAlive no
-    '';
-  };
-  system.stateVersion = "26.05";
-  time.timeZone = "Europe/Berlin";
-  users.users."mtgmonkey" = {
-    isNormalUser = true;
-    description = "mtgmonkey";
-    hashedPasswordFile = builtins.toString config.age.secrets.secret2.path;
-    extraGroups = ["wheel"];
-    openssh.authorizedKeys.keys = machine.pub-keys.ssh;
-  };
-}

machines/173-249-5-230/hardware-configuration.nix

@@ -1,69 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    #device = "none";
-    #fsType = "tmpfs";
-    #options = ["defaults" "size=60%" "mode=755"];
-    device = "/dev/disk/by-uuid/16c93673-4f0e-4010-a7f4-7ccffb20edb7";
-    fsType = "btrfs";
-    options = ["subvol=root"];
-  };
-
-  boot.initrd.postResumeCommands = lib.mkAfter ''
-    mkdir /btrfs_tmp
-    mount ${config.fileSystems."/".device} /btrfs_tmp
-    if [[ -e /btrfs_tmp/root ]]; then
-      mkdir -p /btrfs_tmp/old_roots
-      timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:$M:%S")
-      mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
-    fi
-
-    delete_subvolume_recursively() {
-      IFS=$'\n'
-      for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
-        delete_subvolume_recursively "/btrfs_tmp/$i"
-      done
-      btrfs subvolume delete "$1"
-    }
-
-    for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
-      delete_subvolume_recursively "$i"
-    done
-
-    btrfs subvolume create /btrfs_tmp/root
-    umount /btrfs_tmp
-  '';
-
-  fileSystems."/nix" = {
-    device = "/dev/disk/by-uuid/0e586651-36f4-42b0-99b3-3f0704a894d6";
-    fsType = "btrfs";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/F425-55BA";
-    fsType = "vfat";
-    options = ["fmask=0022" "dmask=0022"];
-  };
-
-  swapDevices = [];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

machines/173-249-5-230/machine.nix

@@ -1,10 +0,0 @@
-{
-  hostname = "173-249-5-230";
-  usernames = ["mtgmonkey"];
-  system = "x86_64-linux";
-  configuration = ./configuration.nix;
-  hardware-configuration = ./hardware-configuration.nix;
-  pub-keys = {
-    ssh = [];
-  };
-}

machines/laptop/configuration.nix

@@ -1,114 +0,0 @@
-{
-  config,
-  lib,
-  machine,
-  ...
-}: {
-  age.secrets = {
-    secret0.file = ../../secrets/secret0.age;
-    secret1.file = ../../secrets/secret1.age;
-  };
-  boot.loader = {
-    efi.canTouchEfiVariables = true;
-    systemd-boot.enable = true;
-  };
-  environment.persistence."/nix/persist" = {
-    enable = true;
-    hideMounts = true;
-    directories = [
-      "/var/log"
-      "/var/lib/bluetooth"
-      "/var/lib/nixos"
-      "/var/lib/systemd/coredump"
-      "/etc/NetworkManager/system-connections"
-      "/etc/ssh"
-    ];
-    files = [
-      "/etc/machine-id"
-      "/etc/ly/save.txt"
-    ];
-    users."andromeda" = {
-      directories = [
-        ".backups"
-        ".local/share/Anki2"
-        ".local/share/chat.fluffy.fluffychat"
-        ".local/share/zoxide"
-        ".ssh"
-        "conf"
-        "Downloads"
-        "pp"
-      ];
-      files = [
-        ".bash_history"
-        ".brush_history"
-      ];
-    };
-    users."mtgmonkey" = {
-      directories = [
-        ".local/share/zoxide"
-        ".ssh"
-      ];
-      files = [
-        ".bash_history"
-        ".brush_history"
-      ];
-    };
-  };
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-  i18n.defaultLocale = "de_DE.UTF-8";
-  networking = {
-    dhcpcd.enable = true;
-    firewall.enable = true;
-    hostName = machine.hostname;
-    networkmanager.enable = true;
-  };
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "steam"
-      "steam-original"
-      "steam-unwrapped"
-      "steam-run"
-    ];
-  programs = {
-    noshell.enable = true;
-    steam.enable = true;
-    sway.enable = true;
-  };
-  services = {
-    blueman.enable = true;
-    displayManager = {
-      enable = true;
-      ly.enable = true;
-    };
-    libinput.enable = true;
-    openssh.enable = true;
-    printing.enable = true;
-  };
-  system.stateVersion = "26.05";
-  time.timeZone = "Europe/Berlin";
-  users.users."andromeda" = {
-    isNormalUser = true;
-    description = "andromeda";
-    hashedPasswordFile = builtins.toString config.age.secrets.secret0.path;
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-  };
-  users.users."mtgmonkey" = {
-    isNormalUser = true;
-    description = "mtgmonkey";
-    hashedPasswordFile = builtins.toString config.age.secrets.secret1.path;
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-  };
-}

machines/laptop/machine.nix

@@ -1,8 +0,0 @@
-{
-  hostname = "lenovo";
-  usernames = ["andromeda" "mtgmonkey"];
-  system = "x86_64-linux";
-  configuration = ./configuration.nix;
-  hardware-configuration = ./hardware-configuration.nix;
-  pub-keys.ssh = [];
-}

machines/lenovo/configuration.nix

@@ -1,17 +1,61 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
-  pkgs,
   modulesPath,
+  machine,
   ...
 }: {
   imports = [
+    ./impermanence.nix
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
-
+  age.secrets = {
+    secret0.file = ../../secrets/secret0.age;
+    secret1.file = ../../secrets/secret1.age;
+  };
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+  };
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+  i18n.defaultLocale = "de_DE.UTF-8";
+  networking = {
+    dhcpcd.enable = true;
+    firewall.enable = true;
+    hostName = machine.hostname;
+    networkmanager.enable = true;
+  };
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nixpkgs.config.allowUnfreePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "steam"
+      "steam-original"
+      "steam-unwrapped"
+      "steam-run"
+    ];
+  programs = {
+    noshell.enable = true;
+    steam.enable = true;
+    sway.enable = true;
+  };
+  services = {
+    blueman.enable = true;
+    displayManager = {
+      enable = true;
+      ly.enable = true;
+    };
+    libinput.enable = true;
+    openssh.enable = true;
+    printing.enable = true;
+  };
+  system.stateVersion = "26.05";
+  time.timeZone = "Europe/Berlin";
   boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-intel"];

machines/lenovo/impermanence.nix

@@ -0,0 +1,19 @@
+{
+  environment.persistence."/nix/persist" = {
+    enable = true;
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/bluetooth"
+      "/var/lib/nixos"
+      "/var/lib/systemd/coredump"
+      "/etc/NetworkManager/system-connections"
+      "/etc/ssh"
+      "/etc/ly/custom-sessions"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ly/save.txt"
+    ];
+  };
+}

pub-keys.nix

@@ -0,0 +1,15 @@
+{
+  age.secrets = {
+    secret0.file = ./secrets/secret0.age;
+    secret1.file = ./secrets/secret1.age;
+    secret2.file = ./secrets/secret2.age;
+    secret3.file = ./secrets/secret3.age;
+  };
+  pub-keys = {
+    ssh = {
+      andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
+      lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
+      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJe5ol56yC23fivSEKeK4HZQm934ROX46AM7o0aE2hMq root@vmi2998419";
+    };
+  };
+}

secrets.nix

@@ -0,0 +1,10 @@
+{lib, ...}: {
+  imports = [./pub-keys.nix];
+  options = {
+    pub-keys.ssh = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {};
+      description = "set of public keys as `name = key`";
+    };
+  };
+}

secrets/secret3.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
+E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
+-> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
+PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
+-> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
+sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
+--- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
+'<27>B<EFBFBD><42>(<28><>7Dϓ=<3D><>h<EFBFBD><10><>h	f<>ɮ<13>xT<78><54>!K.<2E><1D><>~س<>,<2C>ߓ<>D|<7C><>+p<><70><EFBFBD>"<22>t<EFBFBD><74>G<EFBFBD>y<EFBFBD>Q<EFBFBD><51>RcP<63>Q<EFBFBD><51>Q<><51>

secrets/secrets.nix

@@ -1,8 +1,11 @@
 let
-  andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
-  lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
+  pub-keys = (import ../pub-keys.nix).pub-keys;
+  andromeda = pub-keys.ssh.andromeda;
+  lenovo = pub-keys.ssh.lenovo;
+  _109-199-104-83 = pub-keys.ssh._109-199-104-83;
 in {
   "secret0.age".publicKeys = [andromeda lenovo];
   "secret1.age".publicKeys = [andromeda lenovo];
-  "secret2.age".publicKeys = [andromeda lenovo];
+  "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
 }

users.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  machine,
+  ...
+}: let
+  machines = import ./machines.nix;
+in {
+  users.users =
+    builtins.mapAttrs
+    (name: value: lib.mkIf (builtins.elem name machine.users) value)
+    {
+      "andromeda" = {
+        isNormalUser = true;
+        description = "andromeda";
+        hashedPasswordFile = builtins.toString config.age.secrets.secret0.path;
+        extraGroups = [
+          "networkmanager"
+          "wheel"
+        ];
+      };
+      "mtgmonkey" = {
+        isNormalUser = true;
+        description = "mtgmonkey";
+        hashedPasswordFile = builtins.toString config.age.secrets.secret1.path;
+        extraGroups = [
+          (lib.mkIf
+            (machine == machines.lenovo)
+            "networkmanager")
+          "wheel"
+        ];
+        openssh.authorizedKeys.keys = [
+          (lib.mkIf
+            (machine == machines."109-199-104-83")
+            config.pub-keys.ssh.andromeda)
+        ];
+      };
+    };
+  environment.persistence."/nix/persist".users = lib.mkIf config.environment.persistence."/nix/persist".enable (
+    builtins.mapAttrs
+    (name: value: lib.mkIf (builtins.elem name machine.users) value)
+    {
+      "andromeda" = {
+        directories = [
+          ".backups"
+          ".local/share/Anki2"
+          ".local/share/chat.fluffy.fluffychat"
+          ".local/share.zoxide"
+          ".ssh"
+          "conf"
+          "Downloads"
+          "pp"
+        ];
+        files = [
+          ".bash_history"
+          ".brush_history"
+        ];
+      };
+      "mtgmonkey" = {
+        directories = [
+          ".local/share/zoxide"
+          ".ssh"
+        ];
+        files = [
+          ".bash_history"
+          ".brush_history"
+        ];
+      };
+    }
+  );
+}

users/andromeda/home.nix

@@ -6,7 +6,17 @@
   ...
 }: let
   background-path = ".config/sway/background.png";
-  sway_config = builtins.toFile "sway_config" ''
+  sway_config =
+    pkgs.substitute
+    {
+      src = ./sway_config;
+      substitutions = [
+        "--replace"
+        "@backgroundImagePath@"
+        "${config.home.homeDirectory}/${background-path}"
+      ];
+    };
+  sway_config' = builtins.toFile "sway_config" ''
     set $mod Mod4
     set $left h
     set $down j
@@ -169,9 +179,9 @@ in {
     };
     gh.enable = true;
     home-manager.enable = true;
-    librewolf = {
+    firefox = {
       enable = true;
-      package = pkgs.librewolf.override {
+      package = pkgs.firefox.override {
         cfg.enableTridactylNative = true;
       };
       profiles.${config.home.username}.extensions.packages = [

users/andromeda/sway_config

@@ -0,0 +1,73 @@
+set $mod Mod4
+set $left h
+set $down j
+set $up k
+set $right l
+set $term alacritty
+set $menu wmenu-run
+set $screenshot grim -g "$(slurp)"
+floating_modifier $mod normal
+
+workspace_layout stacking
+output * bg @backgroundImagePath@ fill
+
+bindsym $mod+Shift+Return exec $term
+bindsym $mod+Shift+d exec $menu
+bindsym $mod+Shift+a exec anki
+bindsym $mod+Shift+q exec firefox
+bindsym $mod+Shift+s exec $screenshot
+
+bindsym $mod+Shift+c kill
+
+bindsym $mod+Shift+r reload
+
+bindsym $mod+Shift+Alt+q exit
+
+bindsym $mod+$left focus left
+bindsym $mod+$down focus down
+bindsym $mod+$up focus up
+bindsym $mod+$right focus right
+
+bindsym $mod+Shift+$left move left
+bindsym $mod+Shift+$down move down
+bindsym $mod+Shift+$up move up
+bindsym $mod+Shift+$right move right
+
+bindsym $mod+1 workspace number 1
+bindsym $mod+2 workspace number 2
+bindsym $mod+3 workspace number 3
+bindsym $mod+4 workspace number 4
+bindsym $mod+5 workspace number 5
+bindsym $mod+6 workspace number 6
+bindsym $mod+7 workspace number 7
+bindsym $mod+8 workspace number 8
+bindsym $mod+9 workspace number 9
+bindsym $mod+0 workspace number 0
+
+bindsym $mod+Shift+1 move container to workspace number 1
+bindsym $mod+Shift+2 move container to workspace number 2
+bindsym $mod+Shift+3 move container to workspace number 3
+bindsym $mod+Shift+4 move container to workspace number 4
+bindsym $mod+Shift+5 move container to workspace number 5
+bindsym $mod+Shift+6 move container to workspace number 6
+bindsym $mod+Shift+7 move container to workspace number 7
+bindsym $mod+Shift+8 move container to workspace number 8
+bindsym $mod+Shift+9 move container to workspace number 9
+bindsym $mod+Shift+0 move container to workspace number 0
+
+bindsym $mod+f fullscreen
+bindsym $mod+Shift+space floating toggle
+bindsym $mod+Shift+minus move scratchpad
+bindsym $mod+minus scratchpad show
+
+bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
+bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
+bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
+bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
+bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
+bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
+
+default_border none
+font pango:monospace 0.001
+titlebar_border_thickness 0
+titlebar_padding 0