setup gpg

.sops.yaml

@@ -7,27 +7,17 @@ keys:
     - &rackserv age1zutg3s4nth679a6av9xqw4km0ezmfkxlnusu78demf0rzazqn3pqk9exgj
 
 creation_rules:
-  - path_regex: home/profiles/secrets
+  - path_regex: secrets/nixdesk
-    key_groups:
-      - age:
-        - *xun
-  - path_regex: sys/profiles/secrets/global
     key_groups:
       - age:
         - *xun
         - *nixdesk
-        - *hopper
+  - path_regex: secrets/hopper
-  - path_regex: sys/profiles/secrets/nixdesk
-    key_groups:
-      - age:
-        - *xun
-        - *nixdesk
-  - path_regex: sys/profiles/secrets/hopper
     key_groups:
       - age:
         - *xun
         - *hopper
-  - path_regex: sys/profiles/secrets/rackserv
+  - path_regex: secrets/rackserv
     key_groups:
       - age:
         - *xun

Justfile

@@ -7,13 +7,8 @@ local OPERATION *FLAGS:
   {{FLAGS}} \
   {{OPERATION}}
 
-
-buildiso *FLAGS:
-  nix build .#nixosConfigurations.liveiso.config.system.build.isoImage {{FLAGS}}
-
 updatekeys:
-  fd . sys/profiles/secrets -E '*.nix' -t f -x sops updatekeys -y
+  fd . secrets -E '*.nix' -t f -x sops updatekeys -y
-
 
 remote OPERATION HOST REMOTEHOST *FLAGS:
   nixos-rebuild \

flake.nix

@@ -6,11 +6,13 @@
     haumea,
     ...
   } @ inputs: let
-    systemProfiles = haumea.lib.load {
+    _load = path:
-      src = ./sys/profiles;
+      haumea.lib.load {
-      loader = haumea.lib.loaders.path;
+        src = path;
-    };
+        loader = haumea.lib.loaders.path;
-    homeProfiles = ./home;
+      };
+    systemProfiles = _load ./sys/profiles;
+    homeProfiles = _load ./home;
     vars = import ./vars;
     l = nixpkgs.lib;
     b = builtins;

home/cli/gpg.nix

@@ -0,0 +1,5 @@
+{
+  programs.gpg = {
+    enable = true;
+  };
+}

home/desktop/sway/default.nix

@@ -6,10 +6,10 @@
   ...
 }: {
   imports = [
-    ../common/fuzzel.nix
+    ../__common/fuzzel.nix
-    ../common/wob.nix
+    ../__common/wob.nix
-    ../common/wl-clipboard.nix
+    ../__common/wl-clipboard.nix
-    ./waybar.nix
+    ./__waybar.nix
   ];
 
   # services.gnome-keyring = {

home/programs/firefox/search-engines.nix

@@ -3,9 +3,7 @@
   pkgs,
   ...
 }: {
-  programs.firefox.profiles.xun.search = let
+  programs.firefox.profiles.xun.search = {
-    inherit (lib) attrsToList singleton;
-  in {
     force = true;
     default = "google";
     order = [
@@ -47,6 +45,11 @@
         icon = "https://github.githubassets.com/favicons/favicon-dark.svg";
         definedAliases = ["@ghn"];
       };
+      "nixpkgs github" = {
+        urls = mkUrl "https://github.com/search?type=code&q=repo:NixOS/nixpkgs {searchTerms}";
+        icon = "https://github.githubassets.com/favicons/favicon-dark.svg";
+        definedAliases = ["@nixpkgs"];
+      };
       "Brave" = {
         urls = mkUrl "https://search.brave.com/search?q={searchTerms}";
         icon = "https://brave.com/static-assets/images/brave-favicon.png";
@@ -57,21 +60,19 @@
         icon = "https://www.youtube.com/favicon.ico";
         definedAliases = ["@yt"];
       };
-
       "crates.io" = {
         urls = mkUrl "https://crates.io/search?q={searchTerms}";
         icon = "https://crates.io/favicon.ico";
         definedAliases = ["@cr"];
       };
       "noogle" = {
-        url = mkUrl "https://noogle.dev/q?term={searchTerms}";
+        urls = mkUrl "https://noogle.dev/q?term={searchTerms}";
         icon = "https://noogle.dev/favicon.png";
-        definedAliases = ["@noogle"];
+        definedAliases = ["@nog"];
       };
 
       "google".metaData.alias = "@go";
       "ddb".metaData.alias = "@ddg";
-      "wikipedia".metaData.alias = "@wiki";
       "bing".metaData.alias = "@bi";
     };
   };

hosts/hopper/home.nix

@@ -4,20 +4,20 @@
   pkgs,
   ...
 }: {
-  imports = map (x: homeProfiles + x) [
+  imports = with homeProfiles; [
-    /cli/xdg.nix
+    cli.xdg
-    /cli/comma.nix
+    cli.comma
 
-    /programs/nvim.nix
+    programs.nvim
-    /programs/foot.nix
+    programs.foot
 
-    /desktop/xdg-portals.nix
+    desktop.xdg-portals
-    /desktop/sway/default.nix
+    desktop.sway.default
 
-    /programs/mpv.nix
+    programs.mpv
 
-    /services/playerctl.nix
+    services.playerctl
-    /services/polkit-agent.nix
+    services.polkit-agent
   ];
 
   wayland.windowManager.sway.config.output."HDMI-A-1".scale = "2.0";

hosts/hopper/profiles/lab/caddy.nix

@@ -20,7 +20,12 @@ in {
 
   services.caddy = {
     enable = true;
-    globalConfig = "metrics";
+    globalConfig = ''
+      metrics
+      servers {
+        trusted_proxies static 10.0.0.1
+      }
+    '';
     virtualHosts = let
       mkPublicEntry = name: destination: {
         hostName = "${name}.${domain}:80";
@@ -43,6 +48,7 @@ in {
       navidrome = mkPublicEntry "navidrome" "${bridge}:${toString config.services.navidrome.settings.Port}";
       vaultwarden = mkPublicEntry "vw" "${bridge}:${toString config.services.vaultwarden.config.ROCKET_PORT}";
       abs = mkPublicEntry "abs" "${bridge}:${toString config.services.audiobookshelf.port}";
+      miniflux = mkPublicEntry "rss" "${bridge}:18632";
 
       navidrome2 = mkPrivateEntry "navidrome" "${bridge}:${toString config.services.navidrome.settings.Port}";
       slskd = mkPrivateEntry "slskd" "localhost:${toString config.services.slskd.settings.web.port}";

hosts/hopper/profiles/lab/default.nix

@@ -9,6 +9,7 @@
     ./glances.nix
     ./homepage.nix
     ./minecraft.nix
+    ./miniflux.nix
     ./navidrome
     ./prometheus.nix
     ./restic.nix

hosts/hopper/profiles/lab/homepage.nix

@@ -79,6 +79,12 @@ in {
               icon = "vaultwarden";
             };
           }
+          {
+            "miniflux" = {
+              href = "https://rss.${domain}";
+              icon = "miniflux";
+            };
+          }
         ];
       }
     ];

hosts/hopper/profiles/lab/miniflux.nix

@@ -0,0 +1,14 @@
+{
+  vars,
+  config,
+  ...
+}: {
+  services.miniflux = {
+    enable = true;
+    adminCredentialsFile = config.sops.secrets.miniflux.path;
+    config = {
+      BASE_URL = "https://miniflux.${vars.domain}";
+      LISTEN_ADDR = "${config.vpnNamespaces."wg".bridgeAddress}:18632";
+    };
+  };
+}

hosts/hopper/profiles/lab/vpn-namespace.nix

@@ -11,6 +11,7 @@
       config.services.audiobookshelf.port
       config.services.navidrome.settings.Port
       config.services.glances.port
+      18632
     ];
   in {
     extraCommands = builtins.concatStringsSep "\n" (map

hosts/hopper/profiles/persistent.nix

@@ -8,6 +8,7 @@
       "/var/log"
       "/var/lib/nixos"
       "/var/lib/bluetooth"
+      "/var/lib/postgresql"
     ];
     files = [
       "/etc/machine-id"

hosts/nixdesk/default.nix

@@ -65,6 +65,7 @@
       programs.home-manager
       # programs.qt
       programs.adb
+      programs.gpg
       programs.openrgb
       programs.tools
       programs.thunar

hosts/nixdesk/home.nix

@@ -6,63 +6,64 @@
   homeProfiles,
   ...
 }: {
-  imports = map (x: homeProfiles + x) [
+  imports = with homeProfiles; [
-    /cli/zsh.nix
+    cli.zsh
-    /cli/fish.nix
+    cli.fish
 
-    /cli/xdg.nix
+    cli.xdg
-    /cli/direnv.nix
+    cli.direnv
-    /cli/tmux.nix
+    cli.tmux
-    /cli/comma.nix
+    cli.comma
-    /cli/irssi.nix
+    cli.irssi
-    /cli/git.nix
+    cli.gpg
-    /cli/github.nix
+    cli.git
-    /cli/jujutsu.nix
+    cli.github
+    cli.jujutsu
 
-    /programs/nvim.nix
+    programs.nvim
 
-    /programs/firefox/default.nix
+    programs.firefox.default
-    /programs/tor.nix
+    programs.tor
-    /programs/chromium.nix
+    programs.chromium
 
-    /programs/foot.nix
+    programs.foot
 
-    /themes/dark/default.nix
+    themes.dark.default
 
     # desktop
-    /desktop/xdg-portals.nix
+    desktop.xdg-portals
-    /desktop/sway/default.nix
+    desktop.sway.default
 
     # development
-    /develop/common.nix
+    develop.common
-    /develop/docs.nix
+    develop.docs
 
-    /develop/langs/haskell.nix
+    develop.langs.haskell
-    /develop/langs/go.nix
+    develop.langs.go
-    /develop/langs/js.nix
+    develop.langs.js
-    /develop/langs/rust.nix
+    develop.langs.rust
-    /develop/langs/elixir.nix
+    develop.langs.elixir
-    /develop/langs/nix.nix
+    develop.langs.nix
-    /develop/langs/zig.nix
+    develop.langs.zig
-    /develop/langs/lua.nix
+    develop.langs.lua
-    /develop/langs/c.nix
+    develop.langs.c
-    /develop/langs/csharp.nix
+    develop.langs.csharp
 
     # programs
-    /programs/discord.nix
+    programs.discord
-    /programs/obs.nix
+    programs.obs
 
-    /programs/beets.nix
+    programs.beets
-    /programs/cmus.nix
+    programs.cmus
 
-    /programs/mpv.nix
+    programs.mpv
 
     # gaming
-    /programs/mangohud.nix
+    programs.mangohud
-    /programs/jc141.nix
+    programs.jc141
 
-    /services/playerctl.nix
+    services.playerctl
-    /services/polkit-agent.nix
+    services.polkit-agent
   ];
 
   wayland.windowManager.sway.extraConfig = ''

sys/profiles/programs/gpg.nix

@@ -0,0 +1,5 @@
+{
+  programs.gnupg.agent = {
+    enable = true;
+  };
+}