add remote disko and some other things

README.md

@@ -0,0 +1,123 @@
+## usage
+
+### install
+
+note: I have not tested the following verbatim.
+
+It *will* erase the contents of /dev/sdX. Use with caution.
+
+1. create usb with minimal NixOS iso
+
+2. boot from usb
+
+3. create partitions
+
+```console
+$ #modern partition table
+$ #WARNING all data on /dev/sdX will be erased. Make sure it is your target
+$ parted /dev/sdX -- mklabel gpt
+$ #make root partition
+$ parted /dev/sdX -- mkpart ESP fat32 1MiB 512MiB
+$ parted /dev/sdX -- set 1 esp on
+$ #create store partition
+$ parted /dev/sdX -- mkpart nix btrfs 512MiB 100GiB
+$ #if your device is in english, use a period rather than a comma
+$ parted /dev/sdX -- mkpart root btrfs 100GiB 199,5GiB
+```
+
+4. create filesystems
+
+```console
+$ #make sure not to get your subvolumes mixed up
+$ #there should be 3, the first boot and the others 99,5GiB each
+$ fdisk -l
+$ #boot partition
+$ mkfs.fat -F 32 /dev/sdX1
+$ #store partition
+$ mkfs.btrfs /dev/sdX2
+$ #root partition
+$ mkfs.btrfs /dev/sdX3
+$ #create root subvolume
+$ btrfs subvolume create /dev/sdX3/root
+```
+
+5. mount filesystems
+
+```console
+$ #note the uuid of your disks
+$ #they will be symlinked to something recognisable
+$ #don't get them mixed up
+$ ls -l /dev/disk/by-uuid
+total 0
+lrwxrwxrwx 1 root root 15 Dez 30 11:31 0e586651-36f4-42b0-99b3-3f0704a894d6 -> ../../sdX2
+lrwxrwxrwx 1 root root 15 Dez 30 11:31 16c93673-4f0e-4010-a7f4-7ccffb20edb7 -> ../../sdX3
+lrwxrwxrwx 1 root root 15 Dez 30 11:31 F425-55BA -> ../../sdX1
+$ #now mount the appropriate filesystems using your uuids; these are mine
+$ mount -o subvol-root /dev/disk/by-uuid/16c93673-4f0e-4010-a7f4-7ccffb20edb7 /mnt
+$ mkdir -p /mnt/{boot,nix}
+$ mount -o umask=077 /dev/disk/by-uuid/F425-55BA /mnt/boot
+$ mount /dev/disk/by-uuid/0e586651-36f4-42b0-99b3-3f0704a894d6 /mnt/nix
+```
+
+6. prepare for installation
+
+```console
+$ mkdir -p /mnt/etc/nixos
+$ nixos-generate-config --root /mnt
+$ cat /mnt/etc/nixos/hardware-configuration.nix
+$ #note the random flags and stuff in hardware-configuration.nix; you might
+$ #want to keep a copy around for the time being
+$ rm /mnt/etc/nixos/*
+$ #connect to the internet
+$ nmtui
+$ git clone https://git.mtgmonkey.net/andromeda/conf /mnt/etc/nixos
+$ cd /mnt/etc/nixos
+$ nix-shell -p tree --command tree
+.
+├── configuration.nix
+├── flake.lock
+├── flake.nix
+├── machines
+│   └── laptop
+│       ├── hardware-configuration.nix
+│       └── machine.nix
+├── README.md
+└── users
+    └── andromeda
+        ├── home.nix
+        └── stylix.nix
+
+5 directories, 8 files
+$ #copy the `laptop` derivation and change all occurences of `laptop` with
+$ #`your-machine` in `flake.nix`
+$ cp machines/laptop machines/your-machine -r
+$ #modify `machines/your-machine/hardware-configuration.nix` by changing the
+$ #uuids to those of your drives
+$ #also copy the flags and stuff from `hardware-configuration.nix` generated
+$ #earlier
+$ #change the hostname in `machines/your-machine/machine.nix` to your liking.
+$ #If you want to pull request to my repo, `hostname` *must* be "your-machine"
+$ #if you want a different user, edit `machines/your-machine/machine.nix` to
+$ #reflect that. Create the file `users/your-user/home.nix` with your home
+$ #manager configuration. Add your user's `impermanence` information in
+$ #`configuration.nix`
+$ #make sure to give your user an initalPassword, otherwise you won't be able
+$ #to log in! Later, use a secrets scheme to have a real password
+$ git add -A
+```
+
+7. install
+
+```console
+$ cd /mnt/etc/nixos
+$ nix flake check
+$ #resolve any errors. You may have forgotten to add things to git, users,
+$ #machines...
+$ nixos-install --no-root-password --flake .#your-machine
+```
+
+8. reboot
+
+```console
+$ systemctl reboot
+```

configuration.nix

@@ -1,88 +0,0 @@
-{
-  lib,
-  machine,
-  ...
-}: {
-  boot.loader = {
-    efi.canTouchEfiVariables = true;
-    systemd-boot.enable = true;
-  };
-  environment.persistence."/nix/persist" = {
-    enable = true;
-    hideMounts = true;
-    directories = [
-      "/var/log"
-      "/var/lib/bluetooth"
-      "/var/lib/nixos"
-      "/var/lib/systemd/coredump"
-      "/etc/NetworkManager/system-connections"
-    ];
-    files = [
-      "/etc/machine-id"
-      "/etc/ly/save.txt"
-    ];
-    users."andromeda" = {
-      directories = [
-        ".backups"
-        ".local/share/Anki2"
-        ".local/share/chat.fluffy.fluffychat"
-        ".local/share/zoxide"
-        ".ssh"
-        "conf"
-        "Downloads"
-        "pp"
-      ];
-      files = [
-        ".bash_history"
-        ".brush_history"
-      ];
-    };
-  };
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-  };
-  i18n.defaultLocale = "de_DE.UTF-8";
-  networking = {
-    dhcpcd.enable = true;
-    firewall.enable = true;
-    hostName = machine.hostname;
-    networkmanager.enable = true;
-  };
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [
-      "steam"
-      "steam-original"
-      "steam-unwrapped"
-      "steam-run"
-    ];
-  programs = {
-    noshell.enable = true;
-    steam.enable = true;
-    sway.enable = true;
-  };
-  services = {
-    blueman.enable = true;
-    displayManager = {
-      enable = true;
-      ly.enable = true;
-    };
-    libinput.enable = true;
-    printing.enable = true;
-  };
-  system.stateVersion = "26.05";
-  time.timeZone = "Europe/Berlin";
-  users.users."andromeda" = {
-    isNormalUser = true;
-    description = "andromeda";
-    initialPassword = "password";
-    extraGroups = [
-      "networkmanager"
-      "wheel"
-    ];
-  };
-}

flake.lock

@@ -1,5 +1,28 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "base16": {
       "inputs": {
         "fromYaml": "fromYaml"
@@ -68,6 +91,65 @@
         "type": "github"
       }
     },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1746728054,
+        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "ff442f5d1425feb86344c028298548024f21256d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "latest",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
@@ -85,6 +167,22 @@
       }
     },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "flake": false,
       "locked": {
         "lastModified": 1751685974,
@@ -179,6 +277,54 @@
         "type": "github"
       }
     },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixos-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "gnome-shell": {
       "flake": false,
       "locked": {
@@ -199,6 +345,27 @@
       }
     },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -266,6 +433,45 @@
         "type": "github"
       }
     },
+    "nix-zulip": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1764583012,
+        "narHash": "sha256-6ht4dtI1TBDAaB/Tatq+FcPexaZTBWuRiJGnioCDx5c=",
+        "ref": "refs/heads/main",
+        "rev": "a9dd0f80d775745f1d88055f24d944562db97c5e",
+        "revCount": 67,
+        "type": "git",
+        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.afnix.fr/nix-zulip/nix-zulip"
+      }
+    },
+    "nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766321686,
+        "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1766651565,
@@ -366,14 +572,14 @@
     },
     "nvf": {
       "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts_2",
         "mnw": "mnw",
         "ndg": "ndg",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1766596669,
@@ -389,14 +595,39 @@
         "type": "github"
       }
     },
+    "phoenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766543224,
+        "narHash": "sha256-96PBoNqh3sPU9t+IXxcB1OjjuQ8HOv42OOh9UtwFHbU=",
+        "owner": "celenityy",
+        "repo": "Phoenix",
+        "rev": "f09568c8a71af4fe42dd43c6f711c67daf605f1e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "celenityy",
+        "repo": "Phoenix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
-        "home-manager": "home-manager",
+        "agenix": "agenix",
+        "disko": "disko",
+        "home-manager": "home-manager_2",
         "impermanence": "impermanence",
+        "nix-zulip": "nix-zulip",
+        "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
         "noshell": "noshell",
         "nur": "nur",
         "nvf": "nvf",
+        "phoenix": "phoenix",
         "stylix": "stylix"
       }
     },
@@ -413,7 +644,7 @@
           "nixpkgs"
         ],
         "nur": "nur_2",
-        "systems": "systems_2",
+        "systems": "systems_3",
         "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
@@ -464,6 +695,21 @@
         "type": "github"
       }
     },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "tinted-foot": {
       "flake": false,
       "locked": {

flake.nix

@@ -1,11 +1,27 @@
 {
   inputs = {
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    disko = {
+      url = "github:nix-community/disko/latest";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     impermanence.url = "github:nix-community/impermanence";
+    nixos-mailserver = {
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nix-zulip = {
+      url = "git+https://git.afnix.fr/nix-zulip/nix-zulip";
+      flake = false;
+    };
     noshell = {
       url = "github:viperML/noshell";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -18,43 +34,75 @@
       url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    phoenix = {
+      url = "github:celenityy/Phoenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
   outputs = {
+    agenix,
+    disko,
     home-manager,
     impermanence,
+    nixos-mailserver,
     nixpkgs,
+    nix-zulip,
     noshell,
     nur,
     nvf,
+    phoenix,
     stylix,
     ...
   }: let
-    laptop = import ./machines/laptop/machine.nix;
-  in {
-    nixosConfigurations.${laptop.hostname} = nixpkgs.lib.nixosSystem {
-      system = laptop.system;
-      specialArgs = {machine = laptop;};
-      modules = [
+    nix-zulip' = (import "${nix-zulip}/nix/default.nix" {}).output;
+    machines = import ./machines.nix;
+    configuration = machine: modules:
+      nixpkgs.lib.nixosSystem {
+        system = machine.system;
+        specialArgs = {inherit machine;};
+        modules =
+          modules
+          ++ [
+            ./users.nix
+            ./secrets.nix
+            ./modules/nixos/common.nix
+            agenix.nixosModules.default
+            disko.nixosModules.disko
+            impermanence.nixosModules.impermanence
+            nixos-mailserver.nixosModule
+            noshell.nixosModules.default
+            phoenix.nixosModules.default
+            nix-zulip'.nixosModules.zulip
+            {
+              nixpkgs.overlays = [
+                agenix.overlays.default
+                nur.overlays.default
+                nix-zulip'.overlays.default
+              ];
+            }
+          ]
+          ++ machine.modules;
+      };
+    configurationWithHomeManager = machine: (configuration machine
+      [
         home-manager.nixosModules.home-manager
         {
-          nixpkgs.overlays = [nur.overlays.default];
           home-manager.useGlobalPkgs = true;
-          home-manager.extraSpecialArgs = {
-            machine = laptop;
-          };
+          home-manager.extraSpecialArgs = {inherit machine;};
           home-manager.users =
             builtins.mapAttrs
             (name: value: value)
             (
-              nixpkgs.legacyPackages.${laptop.system}.lib.genAttrs
-              laptop.usernames
+              nixpkgs.legacyPackages.${machine.system}.lib.genAttrs
+              machine.users
               (
                 name: {
                   imports = [
+                    agenix.homeManagerModules.default
                     stylix.homeModules.stylix
                     nvf.homeManagerModules.default
                     ./users/${name}/home.nix
@@ -63,11 +111,11 @@
               )
             );
         }
-        impermanence.nixosModules.impermanence
-        noshell.nixosModules.default
-        ./configuration.nix
-        laptop.hardware-configuration
-      ];
-    };
+      ]);
+  in {
+    nixosConfigurations =
+      builtins.mapAttrs
+      (hostname: value: configurationWithHomeManager value)
+      machines;
   };
 }

machines.nix

@@ -0,0 +1,80 @@
+{
+  lenovo = {
+    hostname = "lenovo";
+    system = "x86_64-linux";
+    users = ["andromeda"];
+    modules = [
+      # impermanence
+      ./modules/nixos/impermanence.nix
+      ./modules/nixos/impermanence-ssh.nix
+
+      # hardware configuration
+      # includes `system.stateVersion`
+      ./modules/nixos/machines/lenovo.nix
+
+      # boot process
+      # systemd-boot
+      ./modules/nixos/boot/lenovo.nix
+
+      # networking
+      ./modules/nixos/laptop.nix
+
+      # ly display manager
+      ./modules/nixos/ly.nix
+
+      # sway window manager
+      ./modules/nixos/sway.nix
+
+      # apps
+      ./modules/nixos/steam.nix
+    ];
+  };
+  "109-199-104-83" = {
+    hostname = "109-199-104-83";
+    system = "x86_64-linux";
+    users = [];
+    modules = [
+      # impermanence
+      ./modules/nixos/impermanence.nix
+
+      # hardware configuration
+      # verbatim as `nixos-generate-config` AND `system.stateVersion`
+      ./modules/nixos/machines/109-199-104-83.nix
+      ./modules/nixos/disko/remote.nix
+
+      # boot process
+      # grub boot on /dev/sda
+      ./modules/nixos/boot/109-199-104-83.nix
+
+      # networking
+      ./modules/nixos/networking/domains/galaxious.de.nix
+      # uses cloud-init to network
+      ./modules/nixos/networking/networks/109-199-104-83.nix
+
+      # ssh through port 5522 among other things
+      # andromeda@lenovo is the only user allowed access
+      # ./modules/nixos/networking/hard-ssh.nix
+      #./modules/nixos/networking/ssh-as-root.nix
+      ({config, ...}: {
+        services.openssh.enable = true;
+        users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
+      })
+
+      # TODO add Impermanence to the following services
+
+      # simple-nixos-mailserver email server
+      # mail.domain
+      # ./modules/nixos/mailserver.nix
+
+      # roundcube webmail client
+      # webmail.domain
+      # ./modules/nixos/roundcube.nix
+
+      # zulip chat client
+      # chat.domain
+      # zulip chat server
+      # zulip.domain
+      # ./modules/nixos/zulip.nix
+    ];
+  };
+}

machines/laptop/machine.nix

@@ -1,6 +0,0 @@
-{
-  hostname = "lenovo";
-  usernames = ["andromeda"];
-  system = "x86_64-linux";
-  hardware-configuration = ./hardware-configuration.nix;
-}

modules/nixos/boot/109-199-104-83.nix

@@ -0,0 +1,6 @@
+{
+  boot.loader.grub = {
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+}

modules/nixos/boot/lenovo.nix

@@ -0,0 +1,6 @@
+{
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+  };
+}

modules/nixos/common.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}: {
+  # flakes usage
+  nix.settings.experimental-features = [
+    "flakes"
+    "nix-command"
+  ];
+
+  # allows users to customize shell in `$XDG_CONFIG_HOME/shell` rather than
+  # needing /etc/shells. Useful for home-manager. Falls back.
+  programs.noshell.enable = true;
+
+  # cleans /tmp to maintain a tidy system
+  boot.tmp.cleanOnBoot = true;
+
+  networking.domain = lib.mkDefault config.networking.hostName;
+
+  # disable lecture
+  security.sudo.extraConfig = ''Defaults lecture="never"'';
+
+  # make users immutable
+  users.mutableUsers = false;
+}

modules/nixos/disko/remote.nix

@@ -0,0 +1,64 @@
+{
+  disko.devices = {
+    disk = {
+      disk1 = {
+        device = "/dev/sda";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            # legacy boot
+            boot = {
+              name = "boot";
+              size = "1M";
+              type = "EF02";
+            };
+
+            # efi boot
+            esp = {
+              name = "ESP";
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+
+            # btrfs
+            # root is on nodev
+            root = {
+              size = "100%";
+              content = {
+                extraArgs = ["-f"]; # internet told me to, works
+                type = "btrfs";
+                subvolumes = {
+                  # nix store
+                  "/nix" = {
+                    mountpoint = "/nix";
+                  };
+
+                  # persistant directory
+                  "/persist" = {
+                    mountpoint = "/persist";
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    nodev = {
+      # root
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "mode=755" # stops security complaints
+        ];
+      };
+    };
+  };
+}

modules/nixos/impermanence-ssh.nix

@@ -0,0 +1,4 @@
+{
+  # ONLY include this module AFTER a machine has been provisioned
+  environment.persistence."/persist".directories = ["/etc/ssh"];
+}

modules/nixos/impermanence.nix

@@ -0,0 +1,15 @@
+{
+  fileSystems."/persist".neededForBoot = true;
+  environment.persistence."/persist" = {
+    enable = true;
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/nixos"
+      "/var/lib/systemd/coredump"
+    ];
+    files = [
+      "/etc/machine-id"
+    ];
+  };
+}

modules/nixos/laptop.nix

@@ -0,0 +1,37 @@
+{
+  # bluetooth
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+  };
+  services.blueman.enable = true;
+
+  # locale
+  i18n.defaultLocale = "de_DE.UTF-8";
+  time.timeZone = "Europe/Berlin";
+
+  # networking
+  networking = {
+    firewall.enable = true;
+    networkmanager.enable = true;
+  };
+
+  # misc
+  services = {
+    printing.enable = true;
+
+    # trackpad
+    libinput.enable = true;
+
+    # ssh
+    openssh.enable = true;
+  };
+
+  # impermanence
+  environment.persistence."/persist".directories = [
+    # bluetooth
+    "/var/lib/bluetooth"
+    # wifi connections
+    "/etc/NetworkManager/system-connections"
+  ];
+}

modules/nixos/ly.nix

@@ -0,0 +1,11 @@
+{
+  services.displayManager = {
+    enable = true;
+    ly.enable = true;
+  };
+  # TODO needs to be manually updated when new users added
+  environment.persistence."/persist" = {
+    directories = ["/etc/ly/custom-sessions"];
+    files = ["/etc/ly/save.txt"];
+  };
+}

modules/nixos/machines/109-199-104-83.nix

@@ -0,0 +1,25 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  swapDevices = [];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  system.stateVersion = "26.05";
+}

modules/nixos/machines/lenovo.nix

@@ -1,6 +1,3 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
@@ -8,20 +5,14 @@
   modulesPath,
   ...
 }: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
+  imports = [(modulesPath + "/installer/scan/not-detected.nix")];
   boot.initrd.availableKernelModules = ["xhci_pci" "nvme" "sdhci_pci"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-intel"];
   boot.extraModulePackages = [];
 
   fileSystems."/" = {
-    #device = "none";
-    #fsType = "tmpfs";
-    #options = ["defaults" "size=60%" "mode=755"];
-    device = "/dev/disk/by-uuid/16c93673-4f0e-4010-a7f4-7ccffb20edb7";
+    device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
     fsType = "btrfs";
     options = ["subvol=root"];
   };
@@ -48,6 +39,12 @@
     done
 
     btrfs subvolume create /btrfs_tmp/root
+    mkdir /btrfs_tmp/root/persist
+    mkdir /btrfs_tmp/root/etc
+    mount ${config.fileSystems."/persist".device} /btrfs_tmp/root/persist -o subvol=persist
+    cp /btrfs_tmp/root/persist/etc/ssh /btrfs_tmp/root/etc/ssh -r
+    umount /btrfs_tmp/root/persist
+    rm -r /btrfs_tmp/root/persist
     umount /btrfs_tmp
   '';
 
@@ -56,6 +53,12 @@
     fsType = "btrfs";
   };
 
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-uuid/5455cfb4-0efd-4f55-b496-d2cab3f419b7";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+  };
+
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/F425-55BA";
     fsType = "vfat";
@@ -66,4 +69,5 @@
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  system.stateVersion = "26.05";
 }

modules/nixos/mailserver.nix

@@ -0,0 +1,31 @@
+{config, ...}: {
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.${config.networking.domain}";
+    domains = ["${config.networking.domain}"];
+    x509.useACMEHost = config.mailserver.fqdn;
+    loginAccounts = {
+      "test@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
+      };
+      "admin@${config.networking.domain}" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
+        aliases = ["@${config.networking.domain}"];
+      };
+    };
+  };
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "mail.${config.networking.domain}" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mtgmonket@gmail.com";
+  };
+}

modules/nixos/networking/domains/galaxious.de.nix

@@ -0,0 +1,3 @@
+{
+  networking.domain = "galaxious.de";
+}

modules/nixos/networking/hard-ssh.nix

@@ -0,0 +1,19 @@
+{
+  services.openssh = {
+    enable = true;
+    allowSFTP = false;
+    ports = [5522];
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = true;
+    };
+    extraConfig = ''
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      MaxAuthTries 3
+      MaxSessions 4
+      TCPKeepAlive no
+    '';
+  };
+}

modules/nixos/networking/networks/109-199-104-83.nix

@@ -0,0 +1,15 @@
+{
+  networking = {
+    useDHCP = false;
+    hostName = "109-199-104-83";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [80 443];
+      allowedUDPPorts = [80 443];
+    };
+  };
+  services.cloud-init = {
+    enable = true;
+    network.enable = true;
+  };
+}

modules/nixos/networking/ssh-as-root.nix

@@ -0,0 +1,3 @@
+{lib, ...}: {
+  services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
+}

modules/nixos/roundcube.nix

@@ -0,0 +1,12 @@
+{config, ...}: {
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.${config.networking.domain}";
+    extraConfig = ''
+      $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+      $config['smtp_user'] = "%u";
+      $config['smtp_pass'] = "%p";
+    '';
+  };
+}

modules/nixos/steam.nix

@@ -0,0 +1,10 @@
+{lib, ...}: {
+  nixpkgs.config.allowUnfreePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "steam"
+      "steam-original"
+      "steam-unwrapped"
+      "steam-run"
+    ];
+  programs.steam.enable = true;
+}

modules/nixos/sway.nix

@@ -0,0 +1,3 @@
+{
+  programs.sway.enable = true;
+}

modules/nixos/zulip.nix

@@ -0,0 +1,32 @@
+{config, ...}: {
+  services.zulip = {
+    enable = true;
+
+    # lets it set up my postgresql for me
+    enablePostgresqlLocally = true;
+
+    # host domain
+    host = "chat.${config.networking.domain}";
+
+    # secrets
+    camoKeyFile = builtins.toString config.age.secrets.zulip-camoKey.path;
+    rabbitmqPasswordFile = builtins.toString config.age.secrets.zulip-rabbitmqPassword.path;
+    secretKeyFile = builtins.toString config.age.secrets.zulip-secretKey.path;
+    sharedSecretKeyFile = builtins.toString config.age.secrets.zulip-sharedSecretKey.path;
+    avatarSaltKeyFile = builtins.toString config.age.secrets.zulip-avatarSaltKey.path;
+    extraSecrets = {
+      email_password = builtins.toString config.age.secrets.zulip-extraSecrets-email_password.path;
+    };
+
+    # settings
+    zulipSettings = rec {
+      EMAIL_USE_TLS = true;
+      EMAIL_PORT = 587;
+      ADD_TOKENS_TO_NOREPLY_ADDRESS = false;
+      NOREPLY_EMAIL_ADDRESS = ZULIP_ADMINISTRATOR;
+      OPEN_REALM_CREATION = true;
+      EXTERNAL_HOST = config.services.zulip.host;
+      ZULIP_ADMINISTRATOR = "admin@${config.networking.domain}";
+    };
+  };
+}

modules/template.nix

@@ -0,0 +1,11 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [];
+  options = {};
+  config = {};
+}

pub-keys.nix

@@ -0,0 +1,22 @@
+{
+  age.secrets = {
+    andromeda-pw.file = ./secrets/andromeda-pw.age;
+    mtgmonkey-pw.file = ./secrets/mtgmonkey-pw.age;
+    mailserver-acc-test-pw.file = ./secrets/mailserver-acc-test-pw.age;
+    mailserver-acc-admin-pw.file = ./secrets/mailserver-acc-admin-pw.age;
+    "mailserver-acc-zulip+admin-pw".file = ./secrets + "/mailserver-acc-zulip+admin-pw.age";
+    zulip-avatarSaltKey.file = ./secrets/zulip-avatarSaltKey.age;
+    zulip-camoKey.file = ./secrets/zulip-camoKey.age;
+    zulip-extraSecrets-email_password.file = ./secrets/zulip-extraSecrets-email_password.age;
+    zulip-rabbitmqPassword.file = ./secrets/zulip-rabbitmqPassword.age;
+    zulip-secretKey.file = ./secrets/zulip-secretKey.age;
+    zulip-sharedSecretKey.file = ./secrets/zulip-sharedSecretKey.age;
+  };
+  pub-keys = {
+    ssh = {
+      andromeda = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy2VD362wUcu0lKj2d6OIU8dbAna0Lu/NaAYIj8gdIA andromeda@lenovo";
+      lenovo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG4eqsLTq2os2mxfwhys3BpVnowcJrqt2CbRFzN2pJb root@lenovo";
+      _109-199-104-83 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJe5ol56yC23fivSEKeK4HZQm934ROX46AM7o0aE2hMq root@vmi2998419";
+    };
+  };
+}

secrets.nix

@@ -0,0 +1,10 @@
+{lib, ...}: {
+  imports = [./pub-keys.nix];
+  options = {
+    pub-keys.ssh = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {};
+      description = "set of public keys as `name = key`";
+    };
+  };
+}

secrets/andromeda-pw.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg 4fCTrNibFdjnVfsIbXi6plbd56K8ZDDqtgryXPk2SUA
+vKlbDi+HpyYlSsN39GRh6GRwdHRSjypCEqguOaHPFDM
+-> ssh-ed25519 UHxfvA RqrDa4xJoAy1Gdzvq6Z5eTSNTDtHzUmzRoLC+j+HxiI
++5CohUFSDB9oiLU0T25FKrQrz07DCviVuzZsVcUltOc
+--- SQ5zQx9lL5UdNinOgP6yG5WWiBdhSwFqJVt6u3SNpLA
+<EFBFBD>6<EFBFBD><16><0B><>U<><55><EFBFBD>p<70><EE9087><EFBFBD><EFBFBD>Q<>]<5D>N<EFBFBD>;K;1y<31><79><EFBFBD>

secrets/mailserver-acc-admin-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg Lt6EG5R9iQWuD/eDXM+vsablwqCn7wUBKFuNO3qcq04
+07jSpN+5/CJFCaBAEVB5TYqLEnGj8Fbt6z3qIVSijqU
+-> ssh-ed25519 UHxfvA 8iIyIoZxJUYrvL9DFmleATVYs0TSZvPjSFqxSWYnVFs
+XDQQGlQXJqjjAqslyfJerVATPIO4vCxTPRWOcBuF7f8
+-> ssh-ed25519 Xoin5w tE8Tx9cSJH+4eJoEpG8CVf9+C1WrurERvGG0kOLatG4
+YUUPvg6Ev3+7idthbcUeLeRZ+iE8yp+uirJojSt1gVg
+--- FamPgM9+DjHiHQBkCmPaHe9aLLXIL3ZPCUtmtEtNOAI
+Ց<EFBFBD><EFBFBD>}<7D>_rT6<54>Uwz<77>|<7C><<3C>_<EFBFBD><0F><><EFBFBD><EFBFBD>5<><35><EFBFBD>!~<>N<EFBFBD><18>cǦi<>*<2A>E<10>M?H?<3F>QSb<53><62><EFBFBD><EFBFBD><EFBFBD>\<5C>۝<EFBFBD><DB9D>z<>K	?z<><7A>;<1C><>R<EFBFBD>Jp<4A>Ҷ<><D2B6>ɴs<C9B4>蔈<EFBFBD>y<EFBFBD><79>

secrets/mailserver-acc-test-pw.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0
+E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g
+-> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs
+PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI
+-> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4
+sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys
+--- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA
+'<27>B<EFBFBD><42>(<28><>7Dϓ=<3D><>h<EFBFBD><10><>h	f<>ɮ<13>xT<78><54>!K.<2E><1D><>~س<>,<2C>ߓ<>D|<7C><>+p<><70><EFBFBD>"<22>t<EFBFBD><74>G<EFBFBD>y<EFBFBD>Q<EFBFBD><51>RcP<63>Q<EFBFBD><51>Q<><51>

secrets/mailserver-acc-zulip+admin-pw.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg JsKjySZOoC/xK6HFjgBSYumrg/Ak7EBjYCqa9uszXGo
+daQvoxsqkxA4OClbWm4YHes5zkky8wikEKg94ceeNWw
+-> ssh-ed25519 UHxfvA yDtvX6SqI9HFN3v1teeRfVicMXpS0fYLiyxe391kIHY
+xpYokiMmAlFbZHuOIqxKeGXtgiB9yOvRquI8OY5mdqE
+-> ssh-ed25519 Xoin5w 9ND7dZoaaLXVu7VN3fYF6bZa23QpCr29b4DNIOSRi2Q
+L6oOEQ8XSZZuQyfxPwgGYycMqAKfslEtFRJbBHbomoY
+--- ewcxsNTgXUy+wlZ3MiSC2KYO0BowGOAn/JvvV7x3pBc
+<08>V<EFBFBD>5a<35><61><EFBFBD>.<2E>B'K<><4B>7<EFBFBD><37><17>LR9h`<60><>€<EFBFBD>շ<>I<EFBFBD><18><>
+8c<EFBFBD>%)<29>ۣ<EFBFBD>5<EFBFBD><35><EFBFBD><1C><1E><><EFBFBD><EFBFBD>KLR<4C><52>y<EFBFBD>199Y?<3F>v<EFBFBD><1E><16><><EFBFBD>2<EFBFBD>ЖK<D096>f<02><>ԏ!<21><>{3<>)<29>,

secrets/secrets.nix

@@ -0,0 +1,25 @@
+let
+  pub-keys = (import ../pub-keys.nix).pub-keys;
+  andromeda = pub-keys.ssh.andromeda;
+  lenovo = pub-keys.ssh.lenovo;
+  _109-199-104-83 = pub-keys.ssh._109-199-104-83;
+in {
+  # user passwords
+  "andromeda-pw.age".publicKeys = [andromeda lenovo];
+  "mtgmonkey-pw.age".publicKeys = [andromeda lenovo];
+
+  # mail account passwords
+  "mailserver-acc-test-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mailserver-acc-admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "mailserver-acc-zulip+admin-pw.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip keys
+  "zulip-avatarSaltKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-camoKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-rabbitmqPassword.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-secretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "zulip-sharedSecretKey.age".publicKeys = [andromeda lenovo _109-199-104-83];
+
+  # zulip-secrets.conf values
+  "zulip-extraSecrets-email_password.age".publicKeys = [andromeda lenovo _109-199-104-83];
+}

secrets/zulip-rabbitmqPassword.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg N+K4UqHYGQTzqq5wMhEs5ijh8a8uXarYy2BpWH2GAUY
+7mWlRNsudiBCr34QMXkzwkyRZa9K6pAPLX0phQBIH1A
+-> ssh-ed25519 UHxfvA i5e8E+FMsG+n+jl5ASBYbPvnME7X58sMMAlYelZAm3A
+ARlV+vWRRsFVAsjdk+JgUMgp49muyGFF5g+iyzpyJQY
+-> ssh-ed25519 Xoin5w 0EH6bLW0DwwVi8GMjq4ZjlBak1QQ0cxh/+KK/e1rPTY
+yIpSegzmBeJ86jApt23Kv9vZ2sVLC8dFYa9t43/x8MM
+--- c4PhDnZ271mJc2sc7DSIRqVF503JSsZhBj2ANwcT2po
+PK<EFBFBD>F<0C><0E>!"<22><08><><EFBFBD>Mgo<67>/<2F><><EFBFBD>gF<67><46>0@<19><><EFBFBD>gA<15><>΄<EFBFBD>P<EFBFBD><50><EFBFBD>m+u<><75>Lo<4C>

users.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  machine,
+  ...
+}: let
+  machines = import ./machines.nix;
+in {
+  users.users =
+    builtins.mapAttrs
+    (name: value: lib.mkIf (builtins.elem name machine.users) value)
+    {
+      "andromeda" = {
+        isNormalUser = true;
+        description = "andromeda";
+        hashedPasswordFile = builtins.toString config.age.secrets.andromeda-pw.path;
+        extraGroups = [
+          "networkmanager"
+          "wheel"
+        ];
+      };
+    };
+  environment.persistence."/persist".users = lib.mkIf config.environment.persistence."/persist".enable (
+    builtins.mapAttrs
+    (name: value: lib.mkIf (builtins.elem name machine.users) value)
+    {
+      "andromeda" = {
+        directories = [
+          ".backups"
+          ".local/share/Anki2"
+          ".local/share/chat.fluffy.fluffychat"
+          ".local/share/zoxide"
+          ".ssh"
+          "conf"
+          "Downloads"
+          "pp"
+        ];
+        files = [
+          ".bash_history"
+          ".brush_history"
+        ];
+      };
+    }
+  );
+}

users/andromeda/home.nix

@@ -6,82 +6,16 @@
   ...
 }: let
   background-path = ".config/sway/background.png";
-  sway_config = builtins.toFile "sway_config" ''
-    set $mod Mod4
-    set $left h
-    set $down j
-    set $up k
-    set $right l
-    set $term alacritty
-    set $menu wmenu-run
-    set $screenshot grim -g "$(slurp)"
-    floating_modifier $mod normal
-
-    workspace_layout stacking
-    output * bg ${config.home.homeDirectory}/${background-path} fill
-
-    # launch programs
-    bindsym $mod+Shift+Return exec $term
-    bindsym $mod+Shift+d exec $menu
-    bindsym $mod+Shift+a exec anki
-    bindsym $mod+Shift+q exec librewolf
-    bindsym $mod+Shift+s exec $screenshot
-
-    bindsym $mod+Shift+c kill
-
-    bindsym $mod+Shift+r reload
-
-    bindsym $mod+Shift+Alt+q exit
-
-    bindsym $mod+$left focus left
-    bindsym $mod+$down focus down
-    bindsym $mod+$up focus up
-    bindsym $mod+$right focus right
-
-    bindsym $mod+Shift+$left move left
-    bindsym $mod+Shift+$down move down
-    bindsym $mod+Shift+$up move up
-    bindsym $mod+Shift+$right move right
-
-    bindsym $mod+1 workspace number 1
-    bindsym $mod+2 workspace number 2
-    bindsym $mod+3 workspace number 3
-    bindsym $mod+4 workspace number 4
-    bindsym $mod+5 workspace number 5
-    bindsym $mod+6 workspace number 6
-    bindsym $mod+7 workspace number 7
-    bindsym $mod+8 workspace number 8
-    bindsym $mod+9 workspace number 9
-    bindsym $mod+0 workspace number 0
-
-    bindsym $mod+Shift+1 move container to workspace number 1
-    bindsym $mod+Shift+2 move container to workspace number 2
-    bindsym $mod+Shift+3 move container to workspace number 3
-    bindsym $mod+Shift+4 move container to workspace number 4
-    bindsym $mod+Shift+5 move container to workspace number 5
-    bindsym $mod+Shift+6 move container to workspace number 6
-    bindsym $mod+Shift+7 move container to workspace number 7
-    bindsym $mod+Shift+8 move container to workspace number 8
-    bindsym $mod+Shift+9 move container to workspace number 9
-    bindsym $mod+Shift+0 move container to workspace number 0
-
-    bindsym $mod+f fullscreen
-    bindsym $mod+Shift+space floating toggle
-    bindsym $mod+Shift+minus move scratchpad
-    bindsym $mod+minus scratchpad show
-
-    bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
-    bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
-    bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
-    bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
-    bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
-    bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
-
-    default_border none
-    font pango:monospace 0.001
-    titlebar_border_thickness 0
-    titlebar_padding 0
-  '';
+  sway_config =
+    pkgs.substitute
+    {
+      src = ./sway_config;
+      substitutions = [
+        "--replace"
+        "@backgroundImagePath@"
+        "${config.home.homeDirectory}/${background-path}"
+      ];
+    };
 in {
   imports = [./stylix.nix];
   xdg.configFile."shell".source = lib.getExe pkgs.brush;
@@ -93,6 +27,7 @@ in {
     stateVersion = "26.05";
     packages = [
       pkgs.acpi
+      pkgs.agenix
       pkgs.alacritty
       pkgs.anki
       pkgs.brightnessctl
@@ -168,9 +103,9 @@ in {
     };
     gh.enable = true;
     home-manager.enable = true;
-    librewolf = {
+    firefox = {
       enable = true;
-      package = pkgs.librewolf.override {
+      package = pkgs.firefox.override {
         cfg.enableTridactylNative = true;
       };
       profiles.${config.home.username}.extensions.packages = [

users/andromeda/sway_config

@@ -0,0 +1,73 @@
+set $mod Mod4
+set $left h
+set $down j
+set $up k
+set $right l
+set $term alacritty
+set $menu wmenu-run
+set $screenshot grim -g "$(slurp)"
+floating_modifier $mod normal
+
+workspace_layout stacking
+output * bg @backgroundImagePath@ fill
+
+bindsym $mod+Shift+Return exec $term
+bindsym $mod+Shift+d exec $menu
+bindsym $mod+Shift+a exec anki
+bindsym $mod+Shift+q exec firefox
+bindsym $mod+Shift+s exec $screenshot
+
+bindsym $mod+Shift+c kill
+
+bindsym $mod+Shift+r reload
+
+bindsym $mod+Shift+Alt+q exit
+
+bindsym $mod+$left focus left
+bindsym $mod+$down focus down
+bindsym $mod+$up focus up
+bindsym $mod+$right focus right
+
+bindsym $mod+Shift+$left move left
+bindsym $mod+Shift+$down move down
+bindsym $mod+Shift+$up move up
+bindsym $mod+Shift+$right move right
+
+bindsym $mod+1 workspace number 1
+bindsym $mod+2 workspace number 2
+bindsym $mod+3 workspace number 3
+bindsym $mod+4 workspace number 4
+bindsym $mod+5 workspace number 5
+bindsym $mod+6 workspace number 6
+bindsym $mod+7 workspace number 7
+bindsym $mod+8 workspace number 8
+bindsym $mod+9 workspace number 9
+bindsym $mod+0 workspace number 0
+
+bindsym $mod+Shift+1 move container to workspace number 1
+bindsym $mod+Shift+2 move container to workspace number 2
+bindsym $mod+Shift+3 move container to workspace number 3
+bindsym $mod+Shift+4 move container to workspace number 4
+bindsym $mod+Shift+5 move container to workspace number 5
+bindsym $mod+Shift+6 move container to workspace number 6
+bindsym $mod+Shift+7 move container to workspace number 7
+bindsym $mod+Shift+8 move container to workspace number 8
+bindsym $mod+Shift+9 move container to workspace number 9
+bindsym $mod+Shift+0 move container to workspace number 0
+
+bindsym $mod+f fullscreen
+bindsym $mod+Shift+space floating toggle
+bindsym $mod+Shift+minus move scratchpad
+bindsym $mod+minus scratchpad show
+
+bindsym --locked XF86AudioMute exec pactl set-sink-mute \@DEFAULT_SINK@ toggle
+bindsym --locked XF86AudioLowerVolume exec pactl set-sink-volume \@DEFAULT_SINK@ -5%
+bindsym --locked XF86AudioRaiseVolume exec pactl set-sink-volume \@DEFAULT_SINK@ +5%
+bindsym --locked XF86AudioMicMute exec pact set-source-mute \@DEFAULT_SOURCE@ toggle
+bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
+bindsym --locked XF86MonbrightnessUp exec brightnessctl set 5%+
+
+default_border none
+font pango:monospace 0.001
+titlebar_border_thickness 0
+titlebar_padding 0