Switched to cosmic desktop

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1754433428,
+        "lastModified": 1761656077,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "narHash": "sha256-lsNWuj4Z+pE7s0bd2OKicOFq9bK86JE0ZGeKJbNqb94=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "9ba0d85de3eaa7afeab493fed622008b6e4924f5",
         "type": "github"
       },
       "original": {
@@ -23,6 +23,24 @@
         "type": "github"
       }
     },
+    "catppuccin": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1761553912,
+        "narHash": "sha256-3UOEQPBlZo9OixT9L1zoD67QheopTG8/EfRPGKyP9bg=",
+        "owner": "catppuccin",
+        "repo": "nix",
+        "rev": "7b42c91911c143ae3ea32a79cc8582b5920f24e3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "catppuccin",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -90,11 +108,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756770412,
+        "lastModified": 1759362264,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
         "type": "github"
       },
       "original": {
@@ -131,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757698511,
+        "lastModified": 1761666354,
-        "narHash": "sha256-UqHHGydF/q3jfYXCpvYLA0TWtvByOp1NwOKCUjhYmPs=",
+        "narHash": "sha256-fHr+tIYBJccNF8QWqgowfRmEAtAMSt1deZIRNKL8A7c=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a3fcc92180c7462082cd849498369591dfb20855",
+        "rev": "ca2ab1d877a24d5a437dad62f56b8b2c02e964e9",
         "type": "github"
       },
       "original": {
@@ -146,11 +164,11 @@
     },
     "mnw": {
       "locked": {
-        "lastModified": 1756659871,
+        "lastModified": 1758834834,
-        "narHash": "sha256-v6Rh4aQ6RKjM2N02kK9Usn0Ix7+OY66vNpeklc1MnGE=",
+        "narHash": "sha256-Y7IvY4F8vajZyp3WGf+KaiIVwondEkMFkt92Cr9NZmg=",
         "owner": "Gerg-L",
         "repo": "mnw",
-        "rev": "ed6cc3e48557ba18266e598a5ebb6602499ada16",
+        "rev": "cfbc7d1cc832e318d0863a5fc91d940a96034001",
         "type": "github"
       },
       "original": {
@@ -161,11 +179,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1757103352,
+        "lastModified": 1761669189,
-        "narHash": "sha256-PtT7ix43ss8PONJ1VJw3f6t2yAoGH+q462Sn8lrmWmk=",
+        "narHash": "sha256-INBZnPA9JzyDn+Fnni2250PbRzKx7Eafz0T2c7NhXiQ=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "11b2a10c7be726321bb854403fdeec391e798bf0",
+        "rev": "9c0ee5dfa186e10efe9b53505b65d22c81860fde",
         "type": "github"
       },
       "original": {
@@ -176,11 +194,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1757487488,
+        "lastModified": 1760524057,
-        "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=",
+        "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0",
+        "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1761373498,
+        "narHash": "sha256-Q/uhWNvd7V7k1H1ZPMy/vkx3F8C13ZcdrKjO7Jv7v0c=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6a08e6bb4e46ff7fcbb53d409b253f6bad8a28ce",
         "type": "github"
       },
       "original": {
@@ -198,11 +232,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1757705205,
+        "lastModified": 1761708580,
-        "narHash": "sha256-8xB4M6tCmaSaAAb72plJK3H8EH/yfOMnUWzIWKg521g=",
+        "narHash": "sha256-ZaB7Pc6Sjwm3uKewaI3H/CzWyZ+X50ZM0GgWPoyd04I=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "338f8cc3d30bb635459c5198e676eb123b1ff4fe",
+        "rev": "437ebfd3a33ec52228900e73e24ca4a8234ae267",
         "type": "github"
       },
       "original": {
@@ -222,11 +256,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1757397598,
+        "lastModified": 1761486540,
-        "narHash": "sha256-v/FANUOWyeWlWCD61HDLSNO9nHnQALAtvLf2VtE1+WU=",
+        "narHash": "sha256-O0VNqERaZ1H+4P3XwHNd8wVCqUcGtMPJT1z4cJodRFc=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "c7944a48a3c61cb3ca08ac2dc8b8de124d15dcb8",
+        "rev": "4b904de36157035fa3dddf0312a4242e5d0d9bd0",
         "type": "github"
       },
       "original": {
@@ -245,11 +279,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756632588,
+        "lastModified": 1761078382,
-        "narHash": "sha256-ydam6eggXf3ZwRutyCABwSbMAlX+5lW6w1SVZQ+kfSo=",
+        "narHash": "sha256-JNJesbe9MMN1Brq41BHEpuH+Z+Zg74y/nI5AFZX84Vw=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "d47428e5390d6a5a8f764808a4db15929347cd77",
+        "rev": "27dfa61b64d0cdb8e4ba6f3aaa4d4e067d64cb5c",
         "type": "github"
       },
       "original": {
@@ -261,9 +295,10 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "catppuccin": "catppuccin",
         "home-manager": "home-manager_2",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
         "nvf": "nvf",
         "plasma-manager": "plasma-manager"

flake.nix

@@ -4,6 +4,8 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
+
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -14,6 +16,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nvf = {
       url = "github:notashelf/nvf";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -24,21 +31,22 @@
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.home-manager.follows = "home-manager";
     };
+
+    catppuccin.url = "github:catppuccin/nix";
   };
 
   outputs =
     { nixpkgs, ... }@inputs:
-    let
-      system = "x86_64-linux";
-      host = "demo";
-    in
     {
-      nixosConfigurations.${host} = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.vanta = nixpkgs.lib.nixosSystem {
-        inherit system;
+        system = "x86_64-linux";
-        specialArgs = { inherit inputs host; };
+        specialArgs = {
+          inherit inputs;
+          host = "vanta";
+        };
         modules = [
           ./modules/system
-          ./hosts/${host}
+          ./hosts/vanta
         ];
       };
     };

hosts/demo/placeholder.txt

@@ -1 +0,0 @@
-Put host config here!

hosts/vanta/default.nix

@@ -0,0 +1,10 @@
+{
+  inputs,
+  ...
+}:
+{
+  imports = [
+    inputs.nixos-hardware.nixosModules.framework-12th-gen-intel
+    ./hardware-configuration.nix
+  ];
+}

hosts/vanta/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/1df00fd1-f531-49b9-9dc6-6d17ca39b67a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/EE0E-CAE4";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/fbacd982-b161-447c-a34a-7b44bc063a08"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp166s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

modules/home/alacritty.nix

@@ -0,0 +1,17 @@
+{
+  ...
+}:
+{
+  programs.alacritty = {
+    enable = true;
+    theme = "catppuccin_mocha";
+    settings = {
+      font = {
+        normal = {
+          family = "FiraCode Nerd Font";
+          style = "Regular";
+        };
+      };
+    };
+  };
+}

modules/home/catppuccin.nix

@@ -0,0 +1,14 @@
+{
+  inputs,
+  ...
+}:
+{
+  imports = [
+    inputs.catppuccin.homeModules.catppuccin
+  ];
+
+  catppuccin = {
+    accent = "flamingo";
+    flavor = "mocha";
+  };
+}

modules/home/default.nix

@@ -3,12 +3,16 @@
 }:
 {
   imports = [
+    ./alacritty.nix
+    # ./catppuccin.nix
     ./firefox.nix
     ./git.nix
     ./nvf.nix
     ./packages.nix
-    ./plasma.nix
+    # ./plasma.nix
+    ./ssh.nix
     ./vscode.nix
+    ./xdg.nix
     ./zsh.nix
   ];
 }

modules/home/firefox.nix

@@ -85,6 +85,7 @@
       };
       search = {
         default = "google";
+        force = true;
         engines = {
           nix-packages = {
             name = "Nix Packages";

modules/home/git.nix

@@ -1,18 +1,40 @@
 {
   pkgs,
+  config,
   ...
 }:
+let
+  name = "Eclypsed";
+  email = "Ec1ypsed@proton.me";
+  signingKey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB2h6y1Al2OVotYIpwPZMjiBLAncAI2pAPgES2+gVbJqAAAABHNzaDo= ssh:";
+in
 {
-  programs.git = {
+  home.packages = with pkgs; [ git-ignore ];
+
+  xdg.configFile."git/allowed_signers".text = ''
+    ${email} namespaces="git" ${signingKey}
+  '';
+
+  programs = {
+    git = {
       enable = true;
-    userName = "Eclypsed";
+      settings = {
-    userEmail = "Ec1ypsed@proton.me";
+        user = { inherit name email; };
-    extraConfig = {
         init = {
           defaultBranch = "main";
         };
+        gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
+      };
+      signing = {
+        format = "ssh";
+        key = "${config.home.homeDirectory}/.ssh/id_ed25519_sk_rk.pub";
+        signByDefault = true;
+      };
+    };
+    lazygit = {
+      enable = true;
+      enableZshIntegration = true;
+      shellWrapperName = "lg";
     };
   };
-
-  home.packages = with pkgs; [ git-ignore ];
 }

modules/home/nvf.nix

@@ -61,9 +61,6 @@
         # Formatting files
         formatter.conform-nvim = {
           enable = true;
-          setupOpts = {
-
-          };
         };
 
         binds = {
@@ -221,6 +218,17 @@
             treesitter.enable = true;
           };
 
+          rust = {
+            enable = true;
+            # crates = {
+            #   enable = true;
+            # };
+            dap.enable = true;
+            format.enable = true;
+            lsp.enable = true;
+            treesitter.enable = true;
+          };
+
           tailwind = {
             enable = true;
             lsp.enable = true;

modules/home/packages.nix

@@ -9,7 +9,6 @@
     discord
     sqlitebrowser
     drawio
-    bitwarden-desktop
 
     # Libre Office
     libreoffice-qt

modules/home/ssh.nix

@@ -0,0 +1,30 @@
+{
+  ...
+}:
+{
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+    matchBlocks = {
+      "*" = {
+        addKeysToAgent = "yes";
+        identityFile = [ "~/.ssh/id_ed25519_sk_rk" ];
+      };
+      "stu" = {
+        hostname = "stu.cs.jmu.edu";
+        user = "tamassno";
+        localForwards = [
+          {
+            bind.port = 5432;
+            host = {
+              address = "data.cs.jmu.edu";
+              port = 5432;
+            };
+          }
+        ];
+        serverAliveCountMax = 5;
+        serverAliveInterval = 60;
+      };
+    };
+  };
+}

modules/home/vscode.nix

@@ -17,6 +17,7 @@
           aaron-bond.better-comments
           yzane.markdown-pdf
           mechatroner.rainbow-csv
+          catppuccin.catppuccin-vsc
 
           # Remote development
           ms-vscode-remote.remote-ssh
@@ -46,6 +47,14 @@
           # General
           "editor.formatOnSave" = true;
           "workbench.iconTheme" = "material-icon-theme";
+          "workbench.colorTheme" = "Catppuccin Mocha";
+          "catppuccin.accentColor" = "flamingo";
+
+          # Remote SSH
+          # VSCode attempts to write to ~/.ssh/config for remote ssh connections.
+          # Because ~/.ssh/config is managed with home-manager, it is not writeable.
+          # So we specify a custom ssh config path
+          "remote.SSH.configFile" = "/home/eclypse/.ssh/vscode-config";
 
           # Prettier
           "editor.defaultFormatter" = "esbenp.prettier-vscode";

modules/home/xdg.nix

@@ -0,0 +1,16 @@
+{
+  config,
+  ...
+}:
+{
+  xdg = {
+    enable = true;
+    userDirs = {
+      enable = true;
+      createDirectories = true;
+      extraConfig = {
+        XDG_DEV_DIR = "${config.home.homeDirectory}/Dev";
+      };
+    };
+  };
+}

modules/home/zsh.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   ...
 }:
 {
@@ -7,13 +8,79 @@
       enable = true;
       enableZshIntegration = true;
     };
+    starship = {
+      enable = true;
+      enableZshIntegration = true;
+      settings = {
+        add_newline = true;
+        format = pkgs.lib.concatStrings [
+          "[░▒▓](#f38ba8)"
+          "[ 󱄅 ](fg:#1e1e2e bg:#f38ba8)"
+          "[](fg:#f38ba8 bg:#fab387)"
+          "$directory"
+          "[](fg:#fab387 bg:#f9e2af)"
+          "$git_branch"
+          "$git_status"
+          "[](fg:#f9e2af bg:#a6e3a1)"
+          "$nodejs"
+          "$rust"
+          "$golang"
+          "$php"
+          "[](fg:#a6e3a1)"
+          "$line_break"
+          "$character"
+        ];
+        directory = {
+          style = "fg:#1e1e2e bg:#fab387";
+          format = "[ $path ]($style)";
+          truncation_length = 3;
+          truncation_symbol = "…/";
+          substitutions = {
+            "Documents" = "󰈙 ";
+            "Downloads" = " ";
+            "Music" = " ";
+            "Pictures" = " ";
+          };
+        };
+        git_branch = {
+          symbol = "";
+          style = "bg:#f9e2af";
+          format = "[[ $symbol $branch ](fg:#1e1e2e bg:#f9e2af)]($style)";
+        };
+        git_status = {
+          style = "bg:#f9e2af";
+          format = "[[($all_status$ahead_behind )](fg:#1e1e2e bg:#f9e2af)]($style)";
+        };
+        nodejs = {
+          symbol = "";
+          style = "bg:#a6e3a1";
+          format = "[[ $symbol ($version) ](fg:#1e1e2e bg:#a6e3a1)]($style)";
+        };
+        rust = {
+          symbol = "";
+          style = "bg:#a6e3a1";
+          format = ''[[ $symbol ($version) ](fg:#1e1e2e bg:#a6e3a1)]($style)'';
+        };
+        golang = {
+          symbol = "";
+          style = "bg:#a6e3a1";
+          format = "[[ $symbol ($version) ](fg:#1e1e2e bg#a6e3a1)]($style)";
+        };
+        php = {
+          symbol = "";
+          style = "bg:#a6e3a1";
+          format = "[[ $symbol ($version) ](fg:#1e1e2e bg:#a6e3a1)]($style)";
+        };
+        scan_timeout = 100;
+      };
+    };
     zsh = {
       enable = true;
       enableCompletion = true;
       autosuggestion.enable = true;
       syntaxHighlighting.enable = true;
-      sessionVariables = {
+      shellAliases = {
-        SSH_AUTH_SOCK = "/home/eclypse/.bitwarden-ssh-agent.sock";
+        stu = "ssh stu";
       };
     };
   };

modules/system/agenix.nix

@@ -0,0 +1,20 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    inputs.agenix.nixosModules.default
+  ];
+
+  environment.systemPackages = [
+    inputs.agenix.packages.${pkgs.system}.default # CLI Tool
+  ];
+
+  age.secrets = {
+    tailscale-auth.file = ../../secrets/tailscale-auth.age;
+    eclypsecloud-eclypse.file = ../../secrets/eclypsecloud-eclypse.age;
+    eclypse-password.file = ../../secrets/eclypse-password.age;
+  };
+}

modules/system/boot.nix

@@ -1,8 +1,10 @@
 {
+  config,
   ...
 }:
 {
   boot = {
+    extraModulePackages = with config.boot.kernelPackages; [ virtualbox ];
     loader = {
       systemd-boot = {
         enable = true;
@@ -10,5 +12,6 @@
       };
       efi.canTouchEfiVariables = true;
     };
+    kernelParams = [ "kvm.enable_virt_at_load=0" ];
   };
 }

modules/system/default.nix

@@ -3,6 +3,7 @@
 }:
 {
   imports = [
+    ./agenix.nix
     ./boot.nix
     ./fileSystems.nix
     ./fonts.nix
@@ -11,6 +12,8 @@
     ./security.nix
     ./services.nix
     ./system.nix
+    ./tailscale.nix
     ./user.nix
+    # ./virtualisation.nix
   ];
 }

modules/system/fileSystems.nix

@@ -0,0 +1,45 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  automount_opts = [
+    "x-systemd.automount"
+    "x-systemd.idle-timeout=60"
+    "x-systemd.device-timeout=5s"
+    "x-systemd.mount-timeout=5s"
+    "noauto"
+    "user"
+    "users"
+  ];
+in
+{
+  fileSystems = {
+    "/mnt/EclypseCloud" = {
+      device = "//100.78.212.35/EclypseCloud";
+      fsType = "cifs";
+      options = [
+        "credentials=${config.age.secrets.eclypsecloud-eclypse.path}"
+        "uid=${toString config.users.users.eclypse.uid}"
+        "rw"
+      ]
+      ++ automount_opts;
+    };
+    "/mnt/Music" = {
+      device = "//100.78.212.35/music";
+      fsType = "cifs";
+      options = [
+        "credentials=${config.age.secrets.eclypsecloud-eclypse.path}"
+        "uid=${toString config.users.users.eclypse.uid}"
+        "rw"
+      ]
+      ++ automount_opts;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    cifs-utils
+    # rclone
+  ];
+}

modules/system/packages.nix

@@ -6,6 +6,7 @@
 {
   imports = [
     inputs.nur.modules.nixos.default # Adds the NUR overlay
+    inputs.catppuccin.nixosModules.catppuccin
     ../overlays
   ];
 

modules/system/security.nix

@@ -2,6 +2,15 @@
   ...
 }:
 {
+  programs = {
+    yubikey-manager.enable = true;
+    yubikey-touch-detector.enable = true;
+  };
+
+  services = {
+    yubikey-agent.enable = true;
+  };
+
   security = {
     rtkit.enable = true;
   };

modules/system/services.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   ...
 }:
 {
@@ -19,11 +20,29 @@
     };
 
     # Enable the KDE Plasma Desktop Environment.
-    displayManager.sddm.enable = true;
+    # displayManager.sddm.enable = true;
-    desktopManager.plasma6.enable = true;
+    # desktopManager.plasma6.enable = true;
+
+    displayManager.cosmic-greeter.enable = true;
+    desktopManager.cosmic = {
+      enable = true;
+      xwayland.enable = true;
+    };
 
     # Enable CUPS to print documents.
-    printing.enable = true;
+    printing = {
+      enable = true;
+      drivers = with pkgs; [
+        gutenprint
+        cnijfilter2
+      ];
+    };
+
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
 
     # Enable sound with pipewire.
     pulseaudio.enable = false;
@@ -50,4 +69,14 @@
       };
     };
   };
+
+  hardware = {
+    bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+    };
+    sane = {
+      enable = true;
+    };
+  };
 }

modules/system/tailscale.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+    authKeyFile = config.age.secrets.tailscale-auth.path;
+
+    # * Only applied if `authKeyFile` is specified
+    extraUpFlags = [
+      "--ssh"
+      "--accept-routes=true"
+    ];
+    extraSetFlags = [
+      "--operator=eclypse"
+    ];
+  };
+
+  # Taildrop
+  systemd.user.services.taildrop = {
+    description = "Taildrop File Receiver Service";
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.tailscale}/bin/tailscale file get --verbose --loop %h/Downloads/";
+    };
+  };
+}

modules/system/user.nix

@@ -2,6 +2,7 @@
   inputs,
   pkgs,
   host,
+  config,
   ...
 }:
 {
@@ -21,6 +22,8 @@
       };
       programs.home-manager.enable = true;
     };
+
+    backupFileExtension = "backup";
   };
 
   users.mutableUsers = false;
@@ -31,8 +34,10 @@
     extraGroups = [
       "networkmanager"
       "wheel"
+      "scanner"
+      "lp"
     ];
-    hashedPassword = "$6$33qMKGMsdYC//e/s$Z2mQCqDOwbP185OVOLsE63hg.orMrBbxR8WHIiZ9dAnNk3jgEsEU218qtgsQsyATvjsyHUPBQjsa/3JmNLoMM0";
+    hashedPasswordFile = config.age.secrets.eclypse-password.path;
     shell = pkgs.zsh;
   };
 }

modules/system/virtualisation.nix

@@ -0,0 +1,8 @@
+{
+  ...
+}:
+{
+  virtualisation.virtualbox.host.enable = true;
+  virtualisation.virtualbox.host.enableExtensionPack = true;
+  users.extraGroups.vboxusers.members = [ "eclypse" ];
+}

secrets/eclypse-password.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 7p4RPw wZdiee1a8rqdaNA8EVLUJIEue1ldgrk3HgVGhmHpnTQ
+8VLt5rSvqN+HAHS9JL6hYSj7xVrTtZAcrn5C12it+Fw
+--- 9oiyRlMDS7PrUyP4SmkgcMZz+/BENDBn9XN+3216OXY
+<EFBFBD>%<25>v*|<7C>M<EFBFBD>3<EFBFBD>g<EFBFBD>g<EFBFBD>%;F"s<15><><0B> <20>7<EFBFBD>Uj<55>_H<5F><48><1F><>D<EFBFBD>^*B<>nK'
+v<EFBFBD><EFBFBD>~<7E>`<60>

secrets/eclypsecloud-eclypse.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 7p4RPw dVTohhNu/jjHSNyhw7irzffqzJJFvW0TbkhSmKKrhS8
+zTc4HaFO3hSYVLM35KwEGUcu2R+JGHIN758FpKKxL5U
+--- EhTyT6CYdKjAC9yN0kCxx5yW4o27DJteu8YCbVF2Ln4
+<EFBFBD>ܬ<EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>P<EFBFBD><50>l<EFBFBD><6C>'<27><>,QLג5P<13>SMs<4D><0C><₼<><E282BC>z<EFBFBD><7A><EFBFBD><EFBFBD><EFBFBD>yQ<0C>o<EFBFBD> t[a0<0F><>U<EFBFBD><12>z?R<>"&ߨC<DFA8><43><EFBFBD>l<EFBFBD>

secrets/secrets.nix

@@ -0,0 +1,19 @@
+# This file is NOT imported into the nix configuration, it is just for the agenix CLI
+let
+  # System public ssh keys (/etc/ssh/)
+  vanta = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaDVBJdMDFL8r9NQCbaLe+DPHGhGzRv2N7+7m1/U8DP";
+in
+{
+  # Tailscale auth key need to be up to date with a valid auth key in the tailscale
+  # dashboard. Single-use keys expire after a single machine connects, and even
+  # reusable keys expire after 90 days.
+  # Update tailscale-auth.age with `agenix -e tailscale-auth.age -i /path/to/private-ssh-key`
+  # Note: Only devices with the below public keys are allowed to edit tailscale-auth.age
+  "tailscale-auth.age".publicKeys = [ vanta ]; # Devices allowed to join the tailnet;
+
+  # Devices that can connect to EclypseCloud with the eclypse user.
+  "eclypsecloud-eclypse.age".publicKeys = [ vanta ];
+
+  # Devices that have the eclypse user
+  "eclypse-password.age".publicKeys = [ vanta ];
+}

secrets/tailscale-auth.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 7p4RPw 7GuZj43+NoyPXf//ZLM99vossbJXOpDQSkBi3w51Wl8
+FTMjlyml+T87LQffffY2AJL5IhTAJF2QlfFvhvZpvOs
+--- iONf8B3bUxXtCiv0EAv5QO0ZyhE5A6YfRbcxUr/awFg
+<EFBFBD><0E><><EFBFBD>Tw<54><77>J`<60>~B
+<EFBFBD><11>;<3B>lOh<4F><68>{2<>?<3F><>P<EFBFBD><50>F>@m<>
o<><6F>c<EFBFBD><1C>~X<>3<EFBFBD>@.g<0E>ھ<EFBFBD>eK<65><18>V7zphS<68><53>د6<D8AF><36>.W<><57>O@F