fix(secrets): default to non-user secrets

README.md

@@ -1,5 +1,8 @@
 # ❄️ NixOS flake
 
+![nix](https://img.shields.io/badge/nix-blue?logo=nixos&logoColor=%234d6fb7&labelColor=%23fff&color=%234d6fb7&link=https%3A%2F%2Fnixos.org%2F)
+![neovim](https://img.shields.io/badge/neovim-flat?logo=neovim&logoColor=%23408040&labelColor=%23fff&color=%2380C040)
+
 ## hosts
 
 ### NixOS

deploy/colmena.nix

@@ -6,17 +6,26 @@
 let
   inherit (inputs.nixpkgs) lib;
   utils = import ../utils { inherit lib; };
-  hostDirNames = utils.dirNames ../hosts;
+  hostnames = utils.dirNames ../hosts;
 
-  mkNode = hostname: meta: {
-    imports = [ ../hosts/${hostname} ];
-    deployment = {
-      inherit (meta.deployment) targetHost targetUser tags;
-      buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.deployment.tags;
+  mkNode =
+    hostname:
+    let
+      meta = utils.hostMeta ../hosts/${hostname};
+      isLocal = builtins.elem "local" meta.tags;
+    in
+    {
+      imports = [ ../hosts/${hostname} ];
+      host.name = hostname;
+      deployment = {
+        inherit (meta) tags;
+        targetUser = meta.host.username;
+        targetHost = if isLocal then "" else hostname;
+        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
+      };
     };
-  };
 
-  nodes = lib.genAttrs hostDirNames (hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}));
+  nodes = lib.genAttrs hostnames mkNode;
 in
 inputs.colmena.lib.makeHive (
   {

dots/.bashrc

@@ -60,7 +60,7 @@ export XDG_DATA_HOME=$HOME/.local/share
 if [ -f "/usr/bin/fzf" ]; then
   # Fuzzy finder setup
   export FZF_COMPLETION_TRIGGER='**'
-  export FZF_DEFAULT_COMMAND='ag -g ""'
+  export FZF_DEFAULT_COMMAND='rg --files ""'
   export FZF_DEFAULT_OPTS="
   --pointer='❭'
   --height 10%

dots/.bin/taskdeps

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 
 import argparse
 import json

dots/.config/nvim/after/plugin/image.nvim.lua

@@ -1,3 +1,5 @@
+if not vim.env.KITTY_WINDOW_ID then return end
+
 require("image").setup({
   backend = "kitty",
   kitty_method = "normal",

dots/.config/nvim/after/plugin/nvim-cmp.lua

@@ -64,7 +64,7 @@ cmp.setup({
   sources = {
     { name = "copilot",  group_index = 2 },
     { name = "zk" },
-    { name = "nvim_lsp", keyword_length = 8 },
+    { name = "nvim_lsp" },
     { name = "luasnip",  max_item_count = 16 },
     { name = "path" },
     { name = "buffer",   max_item_count = 8 },

dots/.config/nvim/after/plugin/nvim-ts-context-commentstring.lua

@@ -0,0 +1,8 @@
+require("ts_context_commentstring").setup({ enable_autocmd = false })
+
+-- https://github.com/JoosepAlviste/nvim-ts-context-commentstring/issues/109
+local get_option = vim.filetype.get_option
+vim.filetype.get_option = function(filetype, option)
+  return option == "commentstring" and require("ts_context_commentstring.internal").calculate_commentstring()
+    or get_option(filetype, option)
+end

dots/.config/nvim/after/plugin/treesitter.lua

@@ -123,7 +123,7 @@ treesitter.setup({
 })
 
 opt.foldmethod = "expr"
-opt.foldexpr = "nvim_treesitter#foldexpr()"
+opt.foldexpr = "v:lua.vim.treesitter.foldexpr()"
 opt.foldenable = false
 
 -- TreeSJ

dots/.config/nvim/flake.nix

@@ -174,6 +174,7 @@
               nvim-treesitter-textobjects
               # nvim-treesitter-context
               nvim-ts-context-commentstring
+              # theHamsta/crazy-node-movement
               treesj
               sniprun
               gitsigns-nvim

dots/.config/nvim/init.lua

@@ -8,11 +8,9 @@ require("cursor")
 require("fold")
 require("netrw")
 require("ftdetect")
-require("plug")
 require("pandoc")
 require("keymaps")
 require("highlight")
-require("paq-setup")
 require("statusline")
 require("diagnostic")
 require("utils")
@@ -20,4 +18,3 @@ require("zk")
 require("reload")
 
 vim.opt.background = "dark"
-vim.opt.laststatus = 3

dots/.config/nvim/lua/nixCatsUtils/catPacker.lua

@@ -1,53 +0,0 @@
--- Source: https://github.com/BirdeeHub/nixCats-nvim/blob/main/templates/example/lua/nixCatsUtils/catPacker.lua
---[[
-  This directory is the luaUtils template.
-  You can choose what things from it that you would like to use.
-  And then delete the rest.
-  Everything in this directory is optional.
---]]
-
-local M = {}
--- NOTE: This function is for defining a paq.nvim fallback method of downloading plugins
--- when nixCats was not used to install your config.
--- If you only ever load your config using nixCats, you don't need this file.
-
--- it literally just only runs it when not on nixCats
--- all neovim package managers that use the regular plugin loading scheme
--- can be used this way, just do whatever the plugin manager needs to put it in the
--- opt directory for lazy loading, and add the build steps so that when theres no nix the steps are ran
-function M.setup(v)
-  if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
-    local function clone_paq()
-      local path = vim.fn.stdpath("data") .. "/site/pack/paqs/start/paq-nvim"
-      local is_installed = vim.fn.empty(vim.fn.glob(path)) == 0
-      if not is_installed then
-        vim.fn.system({ "git", "clone", "--depth=1", "https://github.com/savq/paq-nvim.git", path })
-        return true
-      end
-    end
-    local function bootstrap_paq(packages)
-      local first_install = clone_paq()
-      vim.cmd.packadd("paq-nvim")
-      local paq = require("paq")
-      if first_install then
-        vim.notify("Installing plugins... If prompted, hit Enter to continue.")
-      end
-      paq(packages)
-      paq.install()
-    end
-
-    vim.api.nvim_create_autocmd("VimEnter", {
-      once = true,
-      callback = function()
-        local pkgs_count = #require("paq").query("to_install")
-        if pkgs_count < 1 then
-          return
-        end
-        vim.notify(string.format("There are %d to install", pkgs_count))
-      end,
-    })
-
-    bootstrap_paq(vim.list_extend({ "savq/paq-nvim" }, v))
-  end
-end
-return M

dots/.config/nvim/lua/paq-setup.lua

@@ -1,47 +0,0 @@
-require("nixCatsUtils.catPacker").setup({
-  { "savq/paq-nvim" },
-  { "jinh0/eyeliner.nvim" },
-  { "ibhagwan/fzf-lua" },
-  { "barreiroleo/ltex_extra.nvim" },
-  { "neovim/nvim-lspconfig" },
-  { "https://git.sr.ht/~whynothugo/lsp_lines.nvim" },
-  { "linrongbin16/lsp-progress.nvim" },
-  { "folke/neodev.nvim" }, -- Nvim
-  { "b0o/schemastore.nvim" }, -- JSON Schemas
-  { "mfussenegger/nvim-lint" },
-  { "stevearc/conform.nvim" },
-  { "L3MON4D3/LuaSnip" },
-  { "saadparwaiz1/cmp_luasnip" },
-  { "hrsh7th/nvim-cmp" },
-  { "hrsh7th/cmp-nvim-lsp" },
-  { "hrsh7th/cmp-buffer" },
-  { "hrsh7th/cmp-path" },
-  { "nvim-lua/plenary.nvim" },
-  { "MunifTanjim/nui.nvim" },
-  { "folke/trouble.nvim" },
-  { "rktjmp/shipwright.nvim" }, -- For building themes based on lush (e.g. terminal)
-  { "rktjmp/lush.nvim" },
-  { "mcchrish/zenbones.nvim" }, -- Zenbones themes (contains zenwritten)
-  { "theHamsta/crazy-node-movement" },
-  { "nvim-treesitter/nvim-treesitter", build = ":TSUpdate" },
-  { "nvim-treesitter/nvim-treesitter-textobjects" },
-  -- { "nvim-treesitter/nvim-treesitter-context" },
-  { "JoosepAlviste/nvim-ts-context-commentstring" }, -- commentstring based on cursor position (e.g. for Svelte)
-  { "Wansmer/treesj" },
-  { "michaelb/sniprun", build = "sh install.sh" },
-  { "lewis6991/gitsigns.nvim" },
-  { "brenoprata10/nvim-highlight-colors" },
-  { "razak17/tailwind-fold.nvim" },
-  { "rmagatti/auto-session" },
-  { "kndndrj/nvim-dbee" },
-  { "3rd/image.nvim", build = false },
-  { "polarmutex/beancount.nvim" },
-  { "jamesblckwell/nvimkit.nvim" },
-  { 'olimorris/codecompanion.nvim' },
-  { "ravitemer/mcphub.nvim",                       build = "pnpm install -g mcp-hub@latest" },
-  { "zbirenbaum/copilot.lua" },
-  { "zbirenbaum/copilot-cmp" },
-  { "qvalentin/helm-ls.nvim", ft = "helm" },
-  { "mikesmithgh/kitty-scrollback.nvim" },
-  { "greggh/claude-code.nvim" },
-})

dots/.config/nvim/lua/plug.lua

@@ -1,35 +0,0 @@
-if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
-  local vim = vim
-  local Plug = vim.fn["plug#"]
-
-  vim.call("plug#begin")
-
-  Plug("machakann/vim-sandwich")
-  Plug("Shougo/context_filetype.vim")
-  Plug("editorconfig/editorconfig-vim")
-  Plug("honza/vim-snippets")
-  Plug("chrisbra/unicode.vim")
-  Plug("ap/vim-css-color")
-  -- Jupyter
-  Plug("quarto-dev/quarto-vim")
-  -- LaTeX
-  Plug("lervag/vimtex")
-  -- Wiki
-  Plug("lervag/wiki.vim")
-  -- Markdown
-  Plug("vim-pandoc/vim-pandoc")
-  Plug("vim-pandoc/vim-pandoc-syntax")
-  Plug("ferrine/md-img-paste.vim")
-  -- TidalCycles
-  Plug("supercollider/scvim")
-  Plug("tidalcycles/vim-tidal")
-  -- GLSL
-  Plug("tikhomirov/vim-glsl")
-  Plug("timtro/glslView-nvim")
-  -- Jupyter notebooks
-  Plug("goerz/jupytext.vim")
-  -- OpenSCAD
-  Plug("sirtaj/vim-openscad")
-
-  vim.call("plug#end")
-end

dots/.config/nvim/lua/statusline.lua

@@ -1,5 +1,6 @@
+vim.opt.laststatus = 3
+
 vim.cmd([[
-se ls=2
 se stl=\ %0*%n
 se stl+=\ %m
 se stl+=\ %y%0*

dots/.config/task/taskrc

@@ -9,5 +9,5 @@ search.case.sensitive=no
 
 rc.json.array=on
 rc.verbose=nothing
-news.version=3.1.0
+news.version=3.4.2
 

dots/.zotero/bbt.json

@@ -1,11 +1,11 @@
 {
   "config": {
+    "options": {},
     "preferences": {
       "ascii": "",
       "asciiBibLaTeX": false,
       "asciiBibTeX": true,
       "autoAbbrev": false,
-      "autoAbbrevStyle": "",
       "autoExport": "immediate",
       "autoExportDelay": 5,
       "autoExportIdleWait": 10,
@@ -13,18 +13,22 @@
       "autoExportPathReplaceDirSep": "-",
       "autoExportPathReplaceSpace": " ",
       "automaticTags": true,
-      "autoPinDelay": 0,
       "auxImport": false,
       "baseAttachmentPath": "/home/h/doc/books",
       "biblatexExtendedDateFormat": true,
       "biblatexExtendedNameFormat": true,
       "biblatexExtractEprint": true,
+      "biblatexUsePrefix": true,
+      "bibtexEditionOrdinal": false,
       "bibtexParticleNoOp": false,
       "bibtexURL": "off",
       "cache": true,
-      "cacheFlushInterval": 5,
+      "cacheDelete": false,
       "charmap": "",
+      "chinese": false,
+      "chineseSplitName": true,
       "citeCommand": "cite",
+      "citekeyCaseInsensitive": true,
       "citekeyFold": true,
       "citekeyFormat": "zotero.clean",
       "citekeyFormatEditing": "zotero.clean",
@@ -34,32 +38,35 @@
       "DOIandURL": "both",
       "exportBibTeXStrings": "off",
       "exportBraceProtection": true,
+      "exportSort": "citekey",
       "exportTitleCase": true,
       "extraMergeCitekeys": false,
       "extraMergeCSL": false,
       "extraMergeTeX": false,
+      "fillKeyAfter": 1,
       "git": "config",
       "import": true,
       "importBibTeXStrings": true,
       "importCaseProtection": "as-needed",
       "importCitationKey": true,
+      "importDetectURLs": true,
       "importExtra": true,
       "importJabRefAbbreviations": true,
       "importJabRefStrings": true,
       "importNoteToExtra": "",
+      "importPlaceEvent": "inproceedings,conference,presentation,talk",
       "importSentenceCase": "on+guess",
+      "importSentenceCaseQuoted": true,
       "importUnknownTexCommand": "ignore",
       "itemObserverDelay": 5,
       "jabrefFormat": 0,
-      "jieba": false,
-      "keyConflictPolicy": "keep",
+      "japanese": false,
       "keyScope": "global",
-      "kuroshiro": false,
       "language": "langid",
       "logEvents": false,
       "mapMath": "",
       "mapText": "",
-      "mapUnicode": "conservative",
+      "packages": "",
       "parseParticles": true,
       "patchDates": "dateadded=dateAdded, date-added=dateAdded, datemodified=dateModified, date-modified=dateModified",
       "platform": "lin",
@@ -75,7 +82,8 @@
       "rawImports": false,
       "rawLaTag": "#LaTeX",
       "relativeFilePaths": false,
-      "retainCache": false,
+      "remigrate": false,
+      "resetKeyOnChange": false,
       "scrubDatabase": false,
       "separatorList": "and",
       "separatorNames": "and",
@@ -90,5 +98,4 @@
       "warnTitleCased": false
     }
   }
-}
-
+}

flake.lock

@@ -92,6 +92,28 @@
         "type": "github"
       }
     },
+    "comin": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1780200954,
+        "narHash": "sha256-3476T026t+XSpOvgBGzKSG6J4swuRLnPO9dR+OATtq8=",
+        "owner": "nlewo",
+        "repo": "comin",
+        "rev": "4f14d338d755239c27131cbf6b466be4bbb20f91",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nlewo",
+        "repo": "comin",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -121,11 +143,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1779595358,
-        "narHash": "sha256-wYTO3i1Xe1oh9lWP8cAcgtD4tJyWFQRcN1uxYpdcL1Q=",
+        "lastModified": 1780200155,
+        "narHash": "sha256-cKpqEvRqxnCbp/2ZVczMHws31Qh4D/HTEuanWuJmySk=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "3028f7f65d02928083359f8701507a8b35d8bf42",
+        "rev": "d29c0c2692ced897777eca19c9bab1b34be0e0d6",
         "type": "gitlab"
       },
       "original": {
@@ -138,11 +160,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1776136500,
-        "narHash": "sha256-r0gN2brVWA351zwMV0Flmlcd6SGMvYqFbvC3DfKFM8Y=",
+        "lastModified": 1779670703,
+        "narHash": "sha256-UdfMivNMwCCqQsYDg5pSz8X2IOaOrIZLIIy+Bg3CO2o=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "0f8ba203d475587f477e7ae12661bd8459e225b7",
+        "rev": "942159e73e40bf785816f7f1f5feed9ef3d7c8f9",
         "type": "github"
       },
       "original": {
@@ -168,6 +190,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1765121682,
+        "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -213,11 +251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -277,7 +315,7 @@
     },
     "git-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
@@ -342,11 +380,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779627636,
-        "narHash": "sha256-J6JGf42zNzLo/CrRdKb5dNznpLI+eGxN/5KTLG1Mo5s=",
+        "lastModified": 1780099287,
+        "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "044c30c19550c0557997dece4ce9e54d2fa77ba1",
+        "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d",
         "type": "github"
       },
       "original": {
@@ -358,7 +396,7 @@
     "mcp-hub": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
         "lastModified": 1755841689,
@@ -450,12 +488,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1779258371,
-        "narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
+        "lastModified": 1780065812,
+        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
+        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
         "type": "github"
       },
       "original": {
@@ -467,11 +508,40 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1779508470,
-        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "29916453413845e54a65b8a1cf996842300cd299",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1779560665,
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
         "type": "github"
       },
       "original": {
@@ -481,7 +551,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1743689281,
         "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
@@ -509,11 +579,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777598946,
-        "narHash": "sha256-X239dAGaU1+gfDj8jKH8GzlqKMcxaVfXOio+uzBOkeE=",
+        "lastModified": 1779766384,
+        "narHash": "sha256-P7Ohnlq8b8b2fU+Sgkrej7LBTM60LBTkHleLuYzmLmU=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "5d55af01c0f86be583931fe99207fc56c14134b3",
+        "rev": "57800b7ab648725ccd33551d01484ee14952ad3f",
         "type": "github"
       },
       "original": {
@@ -645,6 +715,7 @@
     "root": {
       "inputs": {
         "colmena": "colmena",
+        "comin": "comin",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
@@ -652,7 +723,7 @@
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3",
         "nvim": "nvim",
         "sops-nix": "sops-nix",
         "stylix": "stylix"
@@ -714,11 +785,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1779378391,
-        "narHash": "sha256-IsDb9erotvx9npI94UDosvMeYQK17p7/vmU2v9batrY=",
+        "lastModified": 1780079634,
+        "narHash": "sha256-VVyCrzwLitvxZGx48FgzvlbLYGQU99GsaQnZmwqZoUo=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "c1456cc4ba3c9485e7b4158c909eeca5a752cd59",
+        "rev": "ca07e0644716a7c13e91c6d92d169fc81889c589",
         "type": "github"
       },
       "original": {
@@ -776,11 +847,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1777041405,
-        "narHash": "sha256-BAGZ7ObFV/9Z61OJZun7ifPyhkuHqNuW1QIhQ8LuzCo=",
+        "lastModified": 1777806186,
+        "narHash": "sha256-PDF0/wObw4nIsSBeXVYLsloXOiphXCgIdsrNcVXguKs=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "5f868b3a338b6904c47f3833b9c411be641983a8",
+        "rev": "0c94645546f4f3ddac77a1a5fce54eb95bf50795",
         "type": "github"
       },
       "original": {
@@ -792,11 +863,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1777169200,
-        "narHash": "sha256-h7dDbIzP5hDr9v97w9PL6jdAgXawmj6krcH+959rqpU=",
+        "lastModified": 1778379944,
+        "narHash": "sha256-wPDFzMGSlARlw0Sfsn48Q2+jPSfk6N0Ng6BC/d+7Q24=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "f798c2dce44ef815bb6b8f05a82135c7942d35ac",
+        "rev": "fe0203a198690e71a5ff11e08812a4673de3678d",
         "type": "github"
       },
       "original": {
@@ -808,11 +879,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1777463218,
-        "narHash": "sha256-Bhkozqtq3BKLqWTlmKm8uAptfX4aRGI8QX3eEL54Vpc=",
+        "lastModified": 1778378178,
+        "narHash": "sha256-OXPXRIQgGwV77HjYRryOHguh4ALX96jkg+tseLkGgHA=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "5768d08ed2e7944a26a958868cdb073cb8856dae",
+        "rev": "9cd816033ff969415b190722cddf134e78a5665f",
         "type": "github"
       },
       "original": {
@@ -820,6 +891,24 @@
         "repo": "base16-zed",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1770228511,
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,10 +3,6 @@
     nixpkgs = {
       url = "github:nixos/nixpkgs/nixos-unstable";
     };
-    stylix = {
-      url = "github:danth/stylix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
     };
@@ -22,6 +18,22 @@
       url = "git+ssh://git@github.com/hektor/nix-secrets?shallow=1&ref=main";
       flake = false;
     };
+    colmena = {
+      url = "github:zhaofengli/colmena";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    comin = {
+      url = "github:nlewo/comin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    stylix = {
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -38,23 +50,15 @@
       url = "path:./dots/.config/nvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    colmena = {
-      url = "github:zhaofengli/colmena";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    git-hooks = {
-      url = "github:cachix/git-hooks.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
+      git-hooks,
       home-manager,
       nixgl,
-      git-hooks,
       ...
     }@inputs:
     let

home/hosts/astyanax/default.nix

@@ -52,6 +52,7 @@
   ssh.enable = true;
   taskwarrior.enable = true;
   terminal.enable = true;
+  reference-manager.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/packages.nix

@@ -15,7 +15,6 @@ with pkgs;
   parallel
   pass
   ripgrep
-  silver-searcher
   sops
   tldr
   tree

home/modules/anki/default.nix

@@ -18,7 +18,7 @@ in
 
   config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
-      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
         anki = [
           "sync-user"
           "sync-key"
@@ -34,7 +34,17 @@ in
         enable = true;
         package = config.nixgl.wrap pkgs.anki;
         addons = with pkgs.ankiAddons; [
-          anki-connect
+          (anki-connect.withConfig {
+            # https://git.sr.ht/~foosoft/anki-connect/tree/master/item/plugin/config.json
+            config = {
+              apiKey = null;
+              apiLogPath = null;
+              webBindAddress = "127.0.0.1";
+              webBindPort = 8765;
+              webCorsOriginList = [ "http://localhost" ];
+              ignoreOriginList = [ ];
+            };
+          })
           puppy-reinforcement
           review-heatmap
         ];

home/modules/desktop/niri/default.nix

@@ -27,7 +27,7 @@
       file.".config/niri/config.kdl".source = ./config.kdl;
       packages = with pkgs; [
         brightnessctl
-        xwayland-satellite
+        wlsunset
       ];
     };
 

home/modules/reference-manager/default.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.reference-manager;
+
+  hasBrowser =
+    name:
+    lib.elem name [
+      config.browser.primary
+      config.browser.secondary
+    ];
+
+  zoteroConnector =
+    inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}.zotero-connector;
+  zoteroAddonId = "zotero@chnm.gmu.edu";
+
+  connectorExtension = {
+    profiles.default.extensions.packages = [ zoteroConnector ];
+    policies.ExtensionSettings.${zoteroAddonId}.default_area = "navbar";
+  };
+in
+{
+  options.reference-manager.enable = lib.mkEnableOption "reference manager (Zotero)";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ pkgs.zotero ];
+
+    programs.firefox = lib.mkIf (hasBrowser "firefox") connectorExtension;
+    programs.librewolf = lib.mkIf (hasBrowser "librewolf") connectorExtension;
+  };
+}

home/modules/shell/prompt.nix

@@ -6,6 +6,13 @@
 
 {
   config = lib.mkIf config.shell.enable {
-    programs.starship.enable = true;
+    programs.starship = {
+      enable = true;
+      settings = {
+        git_status = {
+          ahead = "⇡$\{count\}";
+        };
+      };
+    };
   };
 }

home/modules/shikane/default.nix

@@ -11,57 +11,60 @@
   config = lib.mkIf config.shikane.enable {
     home.packages = with pkgs; [ (config.nixgl.wrap wdisplays) ];
     services.shikane.enable = true;
-    home.file.".config/shikane/config.toml".text = ''
-      [[profile]]
-      name = "work"
+    home.file.".config/shikane/config.toml" = {
+      force = true;
+      text = ''
+        [[profile]]
+        name = "work"
 
-      [[profile.output]]
-      enable = true
-      search = ["m=Unknown", "s=", "v=Unknown"]
-      mode = "2880x1800@120Hz"
-      position = "288,3240"
-      scale = 1.5
-      transform = "normal"
-      adaptive_sync = false
+        [[profile.output]]
+        enable = true
+        search = ["m=Unknown", "s=", "v=Unknown"]
+        mode = "2880x1800@120Hz"
+        position = "288,3240"
+        scale = 1.5
+        transform = "normal"
+        adaptive_sync = false
 
-      [[profile.output]]
-      enable = true
-      search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
-      mode = "2560x1440@59.951Hz"
-      position = "116,1800"
-      scale = 1.0
-      transform = "normal"
-      adaptive_sync = false
+        [[profile.output]]
+        enable = true
+        search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
+        mode = "2560x1440@59.951Hz"
+        position = "116,1800"
+        scale = 1.0
+        transform = "normal"
+        adaptive_sync = false
 
-      [[profile.output]]
-      enable = true
-      search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
-      mode = "1920x1080@60Hz"
-      position = "2676,1800"
-      scale = 1.0
-      transform = "270"
-      adaptive_sync = false
+        [[profile.output]]
+        enable = true
+        search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
+        mode = "1920x1080@60Hz"
+        position = "2676,1800"
+        scale = 1.0
+        transform = "270"
+        adaptive_sync = false
 
-      [[profile]]
-      name = "home"
+        [[profile]]
+        name = "home"
 
-      [[profile.output]]
-      enable = true
-      search = ["m=Unknown", "s=Unknown", "v=Unknown"]
-      mode = "2880x1800@60.001Hz"
-      position = "185,1440"
-      scale = 1.75
-      transform = "normal"
-      adaptive_sync = false
+        [[profile.output]]
+        enable = true
+        search = ["m=Unknown", "s=Unknown", "v=Unknown"]
+        mode = "2880x1800@60.001Hz"
+        position = "185,1440"
+        scale = 1.75
+        transform = "normal"
+        adaptive_sync = false
 
-      [[profile.output]]
-      enable = true
-      search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
-      mode = "3840x2160@59.996Hz"
-      position = "1500,0"
-      scale = 1.5
-      transform = "normal"
-      adaptive_sync = false
-    '';
+        [[profile.output]]
+        enable = true
+        search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
+        mode = "3840x2160@59.996Hz"
+        position = "1500,0"
+        scale = 1.5
+        transform = "normal"
+        adaptive_sync = false
+      '';
+    };
   };
 }

home/modules/ssh/README.md

@@ -47,15 +47,6 @@ backup key (`id_ed25519_sk_bak.pub`) if needed.
 | backup key file lost | regenerate from backup YubiKey resident key (use `ssh-keygen -K`) |
 | backup YubiKey lost | generate resident backup key, distribute across hosts, re-register (use primary key) |
 
-## notes / to do
-
-TODO: automate distributing `id_ed25519_sk_bak`, `id_ed25519_sk_bak.pub` to all devices
-TODO: declare setup scripts (use e.g. `$HOSTNAME`)
-TODO: register backup key with hosts (add to authorized hosts for each host)
-TODO: register backup key with services (e.g. Gitea)
-TODO: make sure to fall back to backup key when host-specific primary key is not present
-TODO: see if / how `-O application=ssh:<name>` could be used
-
 ## references
 
 * <https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html>

home/modules/ssh/default.nix

@@ -29,18 +29,23 @@ in
           hostname:
           let
             meta = myUtils.hostMeta (hostDir + "/${hostname}");
+            isLocal = builtins.elem "local" meta.tags;
           in
           {
-            User = meta.deployment.targetUser;
+            User = meta.host.username;
           }
-          // lib.optionalAttrs (meta.deployment.targetHost != "") {
-            HostName = meta.deployment.targetHost;
+          // lib.optionalAttrs (!isLocal) {
+            HostName = hostname;
           }
         )
         // {
           "*" = {
             AddKeysToAgent = "yes";
             ForwardAgent = false;
+            identityFile = [
+              "~/.ssh/id_ed25519_sk"
+              "~/.ssh/id_ed25519_sk_bak"
+            ];
           };
         };
     };

home/modules/taskwarrior/default.nix

@@ -20,7 +20,7 @@ in
   config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
       sops = {
-        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
           taskwarrior = [
             "sync-server-url"
             "sync-server-client-id"

hosts/andromache/default.nix

@@ -7,13 +7,12 @@
 }:
 
 let
+  meta = import ./meta.nix;
   wolInterfaces = import ./wol-interfaces.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
@@ -24,6 +23,9 @@ in
     })
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   "ai-tools".enable = true;
@@ -52,7 +54,11 @@ in
   desktop.ly.enable = true;
   docker.enable = true;
   hcloud.enable = true;
-  networking.enable = true;
+  networking = {
+    enable = true;
+    hostId = "80eef97e";
+    useDHCP = lib.mkDefault true;
+  };
   nvidia.enable = true;
   restic-backup.enable = true;
   secrets = {
@@ -101,6 +107,4 @@ in
     enable = true;
     package = pkgs.plocate;
   };
-
-  networking.hostId = "80eef97e";
 }

hosts/andromache/hard.nix

@@ -1,42 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "vmd"
-      "xhci_pci"
-      "ahci"
-      "nvme"
-      "usbhid"
-      "usb_storage"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/andromache/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/andromache/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "desktop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/astyanax/default.nix

@@ -6,11 +6,12 @@
   ...
 }:
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
@@ -21,6 +22,9 @@
     })
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   "ai-tools".enable = true;
@@ -90,6 +94,13 @@
 
   networking = {
     hostId = "80eef97e";
+    useDHCP = false;
+    useNetworkd = true;
+  };
+
+  systemd.network.networks."40-wlan0" = {
+    matchConfig.Name = "wlan0";
+    networkConfig.DHCP = "yes";
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

hosts/astyanax/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "thunderbolt"
-      "nvme"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/astyanax/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/astyanax/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "laptop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/eetion-02/default.nix

@@ -3,13 +3,17 @@
 # Raspberry Pi 3
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
   ssh.enable = true;
 
   boot = {

hosts/eetion-02/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion-02/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion-02";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/eetion/default.nix

@@ -3,13 +3,17 @@
 # Orange Pi Zero2 H616
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Orange_Pi_Zero2_H616>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
   ssh.enable = true;
   tailscale.enable = true;
 

hosts/eetion/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/hecuba/default.nix

@@ -5,18 +5,26 @@
   ...
 }:
 
-# Also see <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
+# also see <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
+    inputs.comin.nixosModules.comin
     ../../modules
   ];
 
-  ssh.enable = true;
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
+
   docker.enable = true;
+  ssh.enable = true;
+  tailscale.enable = true;
 
   networking.hostName = config.host.name;
 
@@ -61,8 +69,21 @@
     kitty.terminfo
   ];
 
-  services.fail2ban = {
-    enable = true;
-    maxretry = 5;
+  services = {
+    comin = {
+      enable = false;
+      machineId = "4c0a7f7726a845859ce9375e88b87642";
+      remotes = [
+        {
+          name = "origin";
+          url = "https://git.hektormisplon.xyz/hektor/nix";
+          branches.main.name = "main";
+        }
+      ];
+    };
+    fail2ban = {
+      enable = true;
+      maxretry = 5;
+    };
   };
 }

hosts/hecuba/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/hecuba/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "username";
-  };
-}

hosts/hecuba/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "cloud" ];
-    targetHost = "server.hektormisplon.xyz";
-    targetUser = "username";
-  };
   role = "server";
+  tags = [ "cloud" ];
+  host = {
+    username = "username";
+  };
 }

hosts/vm/default.nix

@@ -3,15 +3,20 @@
   config,
   ...
 }:
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
     ./disk.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/vm;
 
   "ai-tools".enable = true;

hosts/vm/hard.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "sr_mod"
-        "virtio_blk"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/vm/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/vm/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "vm";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+  };
 }

modules/ai-tools/default.nix

@@ -10,7 +10,7 @@ in
 
   config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [ "claude-code" ];
-    secrets.groups.opencode = [ "api-key" ];
+    secrets.opencode = [ "api-key" ];
 
     sops.templates."opencode/auth.json" = {
       inherit owner;

modules/anki/default.nix

@@ -7,7 +7,7 @@ in
   options.anki.enable = lib.mkEnableOption "anki";
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.anki = [
+    secrets.user.anki = [
       "sync-user"
       "sync-key"
     ];

modules/backups/default.nix

@@ -24,7 +24,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    secrets.groups = {
+    secrets = {
       restic = [ "password" ];
       backblaze-b2 = [
         "bucket-name"

modules/common/host.nix

@@ -10,6 +10,11 @@
       type = lib.types.str;
     };
 
+    tags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
     timezone = lib.mkOption {
       type = lib.types.str;
       default = "Europe/Brussels";

modules/hcloud/default.nix

@@ -15,7 +15,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.hcloud = [ "api-token" ];
+    secrets.hcloud = [ "api-token" ];
 
     sops.templates."hcloud/cli.toml" = {
       inherit owner;

modules/networking/default.nix

@@ -11,5 +11,7 @@
       nftables.enable = true;
       firewall.enable = true;
     };
+
+    services.resolved.enable = true;
   };
 }

modules/secrets/default.nix

@@ -12,53 +12,56 @@ let
   inherit (config.host) username;
   inherit (cfg) sopsDir;
   owner = config.users.users.${username}.name;
+
+  system = {
+    email = [
+      "personal"
+      "work"
+    ];
+    nix = lib.optional cfg.nixSigningKey.enable "signing-key";
+  }
+  // lib.filterAttrs (_: lib.isList) cfg;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options = {
-    secrets = {
-      enable = lib.mkEnableOption "secrets management";
+  options.secrets = lib.mkOption {
+    default = { };
+    type = lib.types.submodule {
+      freeformType = lib.types.attrsOf (lib.types.listOf lib.types.str);
 
-      sopsDir = lib.mkOption {
-        type = lib.types.str;
-        default = "${toString inputs.nix-secrets}/secrets";
-      };
+      options = {
+        enable = lib.mkEnableOption "secrets management";
 
-      groups = lib.mkOption {
-        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-        default = { };
-      };
+        sopsDir = lib.mkOption {
+          type = lib.types.str;
+          default = "${toString inputs.nix-secrets}/secrets";
+        };
 
-      owner = lib.mkOption {
-        type = lib.types.unspecified;
-      };
+        user = lib.mkOption {
+          type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+          default = { };
+        };
 
-      nixSigningKey = {
-        enable = lib.mkEnableOption "nix signing key configuration";
-      };
+        owner = lib.mkOption {
+          type = lib.types.unspecified;
+          default = owner;
+        };
 
-      yubikey = {
-        enable = lib.mkEnableOption "set up Yubikey";
+        nixSigningKey = {
+          enable = lib.mkEnableOption "nix signing key configuration";
+        };
+
+        yubikey = {
+          enable = lib.mkEnableOption "set up Yubikey";
+        };
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    secrets = {
-      inherit owner;
-      groups = {
-        email = [
-          "personal"
-          "work"
-        ];
-        nix = lib.optional cfg.nixSigningKey.enable "signing-key";
-      };
-    };
-
     sops = {
-      age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
-      secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
+      secrets = myUtils.mkSopsSecrets sopsDir system // myUtils.mkSopsUserSecrets sopsDir owner cfg.user;
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [

modules/tailscale/default.nix

@@ -1,8 +1,5 @@
-{
-  lib,
-  config,
-  ...
-}:
+{ lib, config, ... }:
+
 {
   options.tailscale = {
     enable = lib.mkEnableOption "tailscale";

modules/taskwarrior/default.nix

@@ -8,7 +8,7 @@ in
   options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.taskwarrior = [
+    secrets.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"

utils/hosts.nix

@@ -9,11 +9,11 @@ in
     if builtins.pathExists (hostDir + "/meta.nix") then
       import (hostDir + "/meta.nix")
     else
-      throw "meta.nix required in ${hostDir}";
+      throw "meta.nix required in ${toString hostDir}";
 
   adminHosts =
     hostsPath:
-    builtins.filter (host: ((import (hostsPath + "/${host}/host.nix")).host.admin or false)) (
+    builtins.filter (host: ((import (hostsPath + "/${host}/meta.nix")).host.admin or false)) (
       fs.dirNames hostsPath
     );
 }

utils/secrets.nix

@@ -1,7 +1,7 @@
 { lib }:
 
-{
-  mkSopsSecrets =
+let
+  mkSecrets =
     sopsDir: owner: groups:
     let
       opts = lib.optionalAttrs (owner != null) { inherit owner; };
@@ -21,6 +21,11 @@
         );
     in
     lib.foldl' lib.mergeAttrs { } (lib.mapAttrsToList mkGroup groups);
+in
+{
+  mkSopsSecrets = sopsDir: mkSecrets sopsDir null;
+
+  mkSopsUserSecrets = mkSecrets;
 
   sopsAvailability =
     config: osConfig: