From c71aba5f6405262eccf1c563e782a86639129603 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sascha=20K=C3=B6nig?= Date: Mon, 3 Aug 2026 08:09:38 +0200 Subject: [PATCH] hyprland LUA config --- CONTEXT.md | 47 +++++ flake.lock | 284 +++++++++++++++++++------------ hosts/AZ-LT-NIX/home.nix | 125 ++++++++++---- hosts/AZ-TC-01/default.nix | 2 +- overlays/default.nix | 21 ++- secrets.nix | 24 +-- secrets/AZ-TC-01-krb5-keytab.age | 42 +++++ 7 files changed, 387 insertions(+), 158 deletions(-) create mode 100644 CONTEXT.md diff --git a/CONTEXT.md b/CONTEXT.md new file mode 100644 index 0000000..c2d4574 --- /dev/null +++ b/CONTEXT.md @@ -0,0 +1,47 @@ +# AZ-NIX-CLIENTS + +A NixOS flake that manages AzIntec client hosts. Two host species live in this +repo: developer workstations (e.g. `AZ-LT-NIX`) and the thin-client fleet +(`AZ-TC-NN`). + +## Language + +**Thin Client**: +A NixOS client host in the `AZ-TC-NN` fleet — a mini-PC running KDE Plasma that +authenticates against Active Directory, provides a pre-configured RDP shortcut +to a terminal server, and runs a pinned browser for one web app. Replaces a +Windows 11 workstation. +_Avoid_: kiosk, terminal, workstation + +**Workstation**: +A NixOS host used for interactive development work (e.g. `AZ-LT-NIX`). Not a +Thin Client — these hosts use the m3ta-home profile system and are not in the +production fleet. +_Avoid_: desktop, laptop, client + +**Terminal Server**: +The remote Windows RDS host (or farm) that Thin Clients connect to via RDP. +Kerberos SSO is expected to flow from the client login to this server. +_Avoid_: RDP server, remote desktop, RD server + +**Web App**: +The single browser-based application that Thin Clients open at session start. +Kerberos SSO is expected for this app. +_Avoid_: portal, intranet, app + +**Domain User**: +An identity provided by Active Directory via `sssd`. Logs into the Thin Client +at the SDDM login screen; credentials flow to RDP and the web app via Kerberos. +_Avoid_: AD user, network user, SSO user + +**Hardware Class**: +One of the 2–3 mini-PC SKUs the fleet is composed of (e.g. Dell OptiPlex Micro, +Lenovo ThinkCentre Tiny). Each class has its own hardware module under the +thin-client role. +_Avoid_: SKU, model, hardware type + +**Fleet Host**: +A single physical Thin Client, identified by `AZ-TC-NN` (two-digit number). +Each fleet host has a tiny `default.nix` that imports the thin-client role and +declares its hardware class and hostname. +_Avoid_: node, device, machine diff --git a/flake.lock b/flake.lock index 3929116..bb0902b 100644 --- a/flake.lock +++ b/flake.lock @@ -56,11 +56,11 @@ "rev": "75a2ed2533b4d6d8e4a34acd37e83d98d81a5fb0", "revCount": 30, "type": "git", - "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib" + "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy" }, "original": { "type": "git", - "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib" + "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib-legacy" } }, "agents": { @@ -102,11 +102,11 @@ "agents_3": { "flake": false, "locked": { - "lastModified": 1780133320, - "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=", + "lastModified": 1783016143, + "narHash": "sha256-3qejDAo4g2XfzTyWCaX8RVKH17JXnw/fujsbXQA+Mzc=", "ref": "refs/heads/master", - "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb", - "revCount": 88, + "rev": "83284d752d2ac325d4bf3ab7b38acad1c2fffe3a", + "revCount": 98, "type": "git", "url": "https://code.m3ta.dev/m3tam3re/AGENTS" }, @@ -118,11 +118,11 @@ "agents_4": { "flake": false, "locked": { - "lastModified": 1780133320, - "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=", + "lastModified": 1783016143, + "narHash": "sha256-3qejDAo4g2XfzTyWCaX8RVKH17JXnw/fujsbXQA+Mzc=", "ref": "refs/heads/master", - "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb", - "revCount": 88, + "rev": "83284d752d2ac325d4bf3ab7b38acad1c2fffe3a", + "revCount": 98, "type": "git", "url": "https://code.m3ta.dev/m3tam3re/AGENTS" }, @@ -172,16 +172,16 @@ ] }, "locked": { - "lastModified": 1774505501, - "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=", + "lastModified": 1785348116, + "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=", "owner": "basecamp", "repo": "basecamp-cli", - "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e", + "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6", "type": "github" }, "original": { "owner": "basecamp", - "ref": "v0.7.2", + "ref": "v0.8.0-rc.1", "repo": "basecamp-cli", "type": "github" } @@ -194,16 +194,16 @@ ] }, "locked": { - "lastModified": 1774505501, - "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=", + "lastModified": 1785348116, + "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=", "owner": "basecamp", "repo": "basecamp-cli", - "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e", + "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6", "type": "github" }, "original": { "owner": "basecamp", - "ref": "v0.7.2", + "ref": "v0.8.0-rc.1", "repo": "basecamp-cli", "type": "github" } @@ -228,11 +228,11 @@ ] }, "locked": { - "lastModified": 1782772816, - "narHash": "sha256-s9BuFv0mRuZx9C1MF8qPHRdcAK14ONi0A5m6E2wqOoM=", + "lastModified": 1784665499, + "narHash": "sha256-9BMxlTxCCDAeoNLtb1a/st7udtTIJep+wpUzquA29VU=", "owner": "nix-community", "repo": "bun2nix", - "rev": "5a39d717029e94163ac223aee8d5c9946cafed1c", + "rev": "0f2a1f0b6f42cebe3b149bf62d38754c5e0e9729", "type": "github" }, "original": { @@ -337,11 +337,11 @@ ] }, "locked": { - "lastModified": 1783529634, - "narHash": "sha256-zdHsPGPE5MVi/y+uIt548XScTfZjQzdF21dME7ISEJM=", + "lastModified": 1785111455, + "narHash": "sha256-aTNuC9NDBnYAeEtFsleeUwmGX3AZlKOutbl+LQRPkmQ=", "owner": "AvengeMedia", "repo": "DankMaterialShell", - "rev": "bdfd565b72cbb416441a9ab828efcac4fd516c70", + "rev": "069ddab041c738236a8910e4c39b65d9628d3018", "type": "github" }, "original": { @@ -359,11 +359,11 @@ ] }, "locked": { - "lastModified": 1783591397, - "narHash": "sha256-e4DDmVAas6IPwwY+gfSDKh3PMzW/FXLCbjyWXOnnnbM=", + "lastModified": 1785375021, + "narHash": "sha256-SV24PP3ctDSAuQjg0LdYAvzN7GEustIrtZfciiSrgRI=", "owner": "AvengeMedia", "repo": "dms-plugin-registry", - "rev": "8b61e8fca730986e673737529fa56802dc9326bb", + "rev": "672e213a1e20b980708d81bd82df9bf85c15a590", "type": "github" }, "original": { @@ -396,11 +396,11 @@ ] }, "locked": { - "lastModified": 1782949081, - "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", + "lastModified": 1785627969, + "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", + "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a", "type": "github" }, "original": { @@ -529,11 +529,11 @@ ] }, "locked": { - "lastModified": 1784129366, - "narHash": "sha256-N5JiyICSeQF14x+OQebNyPpYowOT9Rs1iKyeCylSzOA=", + "lastModified": 1785531816, + "narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=", "owner": "nix-community", "repo": "home-manager", - "rev": "165228b0efefc3e635e5174020c40ea64271dc25", + "rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe", "type": "github" }, "original": { @@ -572,11 +572,11 @@ ] }, "locked": { - "lastModified": 1783550008, - "narHash": "sha256-qbbZUk9IG9dLNwCPwdPBs6I5clxwugRpP+1YU+GPK20=", + "lastModified": 1785306346, + "narHash": "sha256-DScBkW0fOgpGPK2trNoX3ryLTlaC14+gglFo/BhGJ4g=", "owner": "nix-community", "repo": "home-manager", - "rev": "f4d01c1d87c7c2ec909549165d5a8338f1bd3315", + "rev": "e705714e918c3b11affcdd15db2cbe3a070420a0", "type": "github" }, "original": { @@ -594,11 +594,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1784258713, - "narHash": "sha256-Fxltsmg9SHOTRJuc4x8J/MB6/cEIjKcMGN/9GyKYQcY=", + "lastModified": 1785726199, + "narHash": "sha256-crxbm7LsuRiUqriEBRMazOrw+HlfsUufXOKrVKeXfTw=", "owner": "numtide", "repo": "llm-agents.nix", - "rev": "31405cadaf364d17d2d736e9002efb91558bf07d", + "rev": "7b99fc4bbb8a7c2fff82c2708d8636c1cbc65661", "type": "github" }, "original": { @@ -624,11 +624,11 @@ "nur": "nur" }, "locked": { - "lastModified": 1784265695, - "narHash": "sha256-75SSM3j5wCxmQ4Zv2IVufpdpBcdR+yPQGydtIvtiEfw=", + "lastModified": 1785731515, + "narHash": "sha256-uFLNOscQy/jQe3HMePEWD/65SnXNlxR15nkehr5l0Cw=", "ref": "refs/heads/master", - "rev": "5e26e13aa70fb079d665f9a64bc4e8eea4c1328f", - "revCount": 91, + "rev": "b01084482f04657e78313a43d9f39dec3957ade0", + "revCount": 107, "type": "git", "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home" }, @@ -646,14 +646,15 @@ "nixpkgs" ], "nixpkgs-master": "nixpkgs-master", + "opencode": "opencode", "openspec": "openspec" }, "locked": { - "lastModified": 1783269665, - "narHash": "sha256-bA4PooGV1x3vtmhs6NEprZbWErwaEJdgxoKfAWaH0do=", + "lastModified": 1785670526, + "narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=", "ref": "refs/heads/master", - "rev": "f279ae9c89d59f3e0deb0fd6307800f4cb993815", - "revCount": 356, + "rev": "69fce234a8607cd3e71233831564b8ceeba70626", + "revCount": 374, "type": "git", "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs" }, @@ -666,16 +667,17 @@ "inputs": { "agents": "agents_4", "basecamp": "basecamp_2", - "nixpkgs": "nixpkgs_7", + "nixpkgs": "nixpkgs_8", "nixpkgs-master": "nixpkgs-master_2", + "opencode": "opencode_2", "openspec": "openspec_2" }, "locked": { - "lastModified": 1784214341, - "narHash": "sha256-Wd/0CxfT7G1pJwh+pb9BQUGxYdbyOQ+ADl7QM3KtHNw=", + "lastModified": 1785670526, + "narHash": "sha256-tC1CW+Kxh9ZZxJC0y472i0KoieMqNwNi+AiCmS4n7To=", "ref": "refs/heads/master", - "rev": "d932db10c49d85e2f58c65f0cacaa678eec16452", - "revCount": 359, + "rev": "69fce234a8607cd3e71233831564b8ceeba70626", + "revCount": 374, "type": "git", "url": "https://code.m3ta.dev/m3tam3re/nixpkgs" }, @@ -755,11 +757,11 @@ "treefmt-nix": "treefmt-nix_2" }, "locked": { - "lastModified": 1784099966, - "narHash": "sha256-h+q9j0ivHhll0sXIPCuJJ+Ivcqh7QDL8eulVUl+CqTQ=", + "lastModified": 1785356851, + "narHash": "sha256-UYKTcayxYPE3yIruCv525WMbcYDLlkv79bRfkOuFNLs=", "owner": "nix-community", "repo": "nixos-anywhere", - "rev": "7239104f1a38546b999cd817658407d80f56e7db", + "rev": "5887f1c72fbf0e88000716237194de414d2299ee", "type": "github" }, "original": { @@ -780,11 +782,11 @@ ] }, "locked": { - "lastModified": 1783593136, - "narHash": "sha256-zy5an02BdZ65OgVKdRkz2TpbdBrsW+uQD7AA2wLuiTM=", + "lastModified": 1784802994, + "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=", "owner": "nix-community", "repo": "nixos-images", - "rev": "803f28511c7d5f39f2537c342122fd94b8e1d519", + "rev": "6ece16b0c97986fe085122e796044add4cc3ff64", "type": "github" }, "original": { @@ -795,11 +797,11 @@ }, "nixos-stable": { "locked": { - "lastModified": 1784011430, - "narHash": "sha256-lDebytrYdd47IBLwvNOD+6AGeoqZ78CIKlp70hzW280=", + "lastModified": 1785133411, + "narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "8eeec934ae0dbeca3d7868c059568a65c08b2fc3", + "rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3", "type": "github" }, "original": { @@ -857,11 +859,11 @@ }, "nixpkgs-master": { "locked": { - "lastModified": 1782540244, - "narHash": "sha256-3skOZJEfAUG7LSB/Ok2AQUiqeagYLSq+8wKjtS1hOyc=", + "lastModified": 1785386845, + "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a65184fc373636356fcaf460dc09655a919c66ea", + "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4", "type": "github" }, "original": { @@ -873,11 +875,11 @@ }, "nixpkgs-master_2": { "locked": { - "lastModified": 1782540244, - "narHash": "sha256-3skOZJEfAUG7LSB/Ok2AQUiqeagYLSq+8wKjtS1hOyc=", + "lastModified": 1785386845, + "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a65184fc373636356fcaf460dc09655a919c66ea", + "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4", "type": "github" }, "original": { @@ -903,6 +905,22 @@ "type": "github" } }, + "nixpkgs_10": { + "locked": { + "lastModified": 1785602060, + "narHash": "sha256-z7D96eESRM4CPV/XtwpwFn8IDdfLAmxz6lVWrGYXvR4=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "a5cbcfe954791221bfffe2307f7d1a1bf61a871e", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs_2": { "locked": { "lastModified": 1772479524, @@ -921,11 +939,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1784176690, - "narHash": "sha256-RUXu+GHGkY+eShsqx8hp0BIIo51K3V1Q8AY4pPAUcDw=", + "lastModified": 1785542685, + "narHash": "sha256-sjfvXMbG5pCFgpvw2OZAFcZiTvrppCWvnB6cuGrSY08=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "6368bc923cec55a5f78960ade0cb4dd99580e087", + "rev": "f8e81fc7eb063db454f563cdd596fb96a5ad1497", "type": "github" }, "original": { @@ -969,31 +987,31 @@ }, "nixpkgs_6": { "locked": { - "lastModified": 1783224372, - "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=", - "owner": "nixos", + "lastModified": 1776683584, + "narHash": "sha256-NuTLMrr10Tng72hurYG8jYQ4XKK8wnpJmOGcPiis96g=", + "owner": "NixOS", "repo": "nixpkgs", - "rev": "d407951447dcd00442e97087bf374aad70c04cea", + "rev": "9dd5558b06dbdacbf635a3dd36dce1b1a7ee3a89", "type": "github" }, "original": { - "owner": "nixos", - "ref": "nixos-unstable", + "owner": "NixOS", + "ref": "nixpkgs-unstable", "repo": "nixpkgs", "type": "github" } }, "nixpkgs_7": { "locked": { - "lastModified": 1782467914, - "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=", - "owner": "NixOS", + "lastModified": 1785318670, + "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=", + "owner": "nixos", "repo": "nixpkgs", - "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4", + "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5", "type": "github" }, "original": { - "owner": "NixOS", + "owner": "nixos", "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" @@ -1001,15 +1019,31 @@ }, "nixpkgs_8": { "locked": { - "lastModified": 1784115452, - "narHash": "sha256-BoYPdqk6jlKXy+DyUzyGV/CtRGfAhk2MmIgBhsemTGI=", - "owner": "nixos", + "lastModified": 1785318670, + "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=", + "owner": "NixOS", "repo": "nixpkgs", - "rev": "35d3407a3816f3b341d8cf1d60abaf2b7b8166ac", + "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5", "type": "github" }, "original": { - "owner": "nixos", + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_9": { + "locked": { + "lastModified": 1776683584, + "narHash": "sha256-NuTLMrr10Tng72hurYG8jYQ4XKK8wnpJmOGcPiis96g=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "9dd5558b06dbdacbf635a3dd36dce1b1a7ee3a89", + "type": "github" + }, + "original": { + "owner": "NixOS", "ref": "nixpkgs-unstable", "repo": "nixpkgs", "type": "github" @@ -1040,14 +1074,14 @@ "nur": { "inputs": { "flake-parts": "flake-parts_3", - "nixpkgs": "nixpkgs_6" + "nixpkgs": "nixpkgs_7" }, "locked": { - "lastModified": 1783593872, - "narHash": "sha256-KvFRxsi81gBoK7JOTHD2LoR1y2sWobHkrHGPhM3v/NY=", + "lastModified": 1785395064, + "narHash": "sha256-ZZoXKpTETeIU93xQOxleE27JWT1FcpF9pe1nSPrFbuw=", "owner": "nix-community", "repo": "NUR", - "rev": "73078fa6f0d34686ad26808f90cc74e81039ba9f", + "rev": "cce2408845d0298ae0dcc42582c1d8b390de105c", "type": "github" }, "original": { @@ -1064,11 +1098,11 @@ ] }, "locked": { - "lastModified": 1784213785, - "narHash": "sha256-VAR4eIzcnkOcJ/pt6RFw7Vp4rcF8nyZr4cMMVQrJG7o=", + "lastModified": 1785733230, + "narHash": "sha256-o4mTy4z8VFrcGO2DazzfnmhvYHEMAqyqONsxL1S9EKg=", "owner": "nix-community", "repo": "NUR", - "rev": "bc59262a699f013fed75a6c6affc903ff755edfa", + "rev": "8d57d3ae4895f825a5c8a995d619987befa4a005", "type": "github" }, "original": { @@ -1077,6 +1111,44 @@ "type": "github" } }, + "opencode": { + "inputs": { + "nixpkgs": "nixpkgs_6" + }, + "locked": { + "lastModified": 1785386452, + "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=", + "owner": "anomalyco", + "repo": "opencode", + "rev": "f7204902192624481e526b1852cdedaadb914e24", + "type": "github" + }, + "original": { + "owner": "anomalyco", + "ref": "dev", + "repo": "opencode", + "type": "github" + } + }, + "opencode_2": { + "inputs": { + "nixpkgs": "nixpkgs_9" + }, + "locked": { + "lastModified": 1785386452, + "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=", + "owner": "anomalyco", + "repo": "opencode", + "rev": "f7204902192624481e526b1852cdedaadb914e24", + "type": "github" + }, + "original": { + "owner": "anomalyco", + "ref": "dev", + "repo": "opencode", + "type": "github" + } + }, "openspec": { "inputs": { "nixpkgs": [ @@ -1086,11 +1158,11 @@ ] }, "locked": { - "lastModified": 1782291243, - "narHash": "sha256-0pVn5pDqlKpqSgzf4eG9TFCjkjzOtnmGTpbILso7GwI=", + "lastModified": 1785371113, + "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=", "owner": "Fission-AI", "repo": "OpenSpec", - "rev": "737518b36fe4b6fdb09c83eeaf8d873a428c92e6", + "rev": "2b3d368539132be6311e55db58899abbf5306b81", "type": "github" }, "original": { @@ -1107,11 +1179,11 @@ ] }, "locked": { - "lastModified": 1782291243, - "narHash": "sha256-0pVn5pDqlKpqSgzf4eG9TFCjkjzOtnmGTpbILso7GwI=", + "lastModified": 1785371113, + "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=", "owner": "Fission-AI", "repo": "OpenSpec", - "rev": "737518b36fe4b6fdb09c83eeaf8d873a428c92e6", + "rev": "2b3d368539132be6311e55db58899abbf5306b81", "type": "github" }, "original": { @@ -1223,7 +1295,7 @@ "m3ta-nixpkgs": "m3ta-nixpkgs_2", "nix-colors": "nix-colors_2", "nixos-anywhere": "nixos-anywhere", - "nixpkgs": "nixpkgs_8", + "nixpkgs": "nixpkgs_10", "nixpkgs-stable": "nixpkgs-stable", "nur": "nur_2" } @@ -1281,11 +1353,11 @@ ] }, "locked": { - "lastModified": 1780220602, - "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=", + "lastModified": 1785360170, + "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "db947814a175b7ca6ded66e21383d938df01c227", + "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0", "type": "github" }, "original": { @@ -1302,11 +1374,11 @@ ] }, "locked": { - "lastModified": 1780220602, - "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=", + "lastModified": 1784369104, + "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "db947814a175b7ca6ded66e21383d938df01c227", + "rev": "df3c0640565d04a0261253cdd89fce78ec50168a", "type": "github" }, "original": { diff --git a/hosts/AZ-LT-NIX/home.nix b/hosts/AZ-LT-NIX/home.nix index dd201f3..bc3dfdd 100644 --- a/hosts/AZ-LT-NIX/home.nix +++ b/hosts/AZ-LT-NIX/home.nix @@ -7,7 +7,16 @@ lib, ... }: -with lib; { +with lib; let + mkEnvVar = name: value: { + _args = [ + name + value + ]; + }; +in { + imports = [ + ]; config = mkMerge [ # ── XDG / MIME defaults ── { @@ -35,16 +44,6 @@ with lib; { }; }; }; - - services.hyprpaper.settings = { - ipc = "on"; - preload = ["/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png"]; - wallpaper = [ - "eDP-1,/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png" - "DP-8,/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png" - "DP-10,/home/sascha.koenig/.config/hypr/wallpapers/wallhaven-lmmo8r_2560x1600.png" - ]; - }; } # ── Hyprland monitor layout ── @@ -52,37 +51,89 @@ with lib; { wayland.windowManager.hyprland = { enable = true; settings = { - workspace = [ - "1, monitor:eDP-1, default:true" - "2, monitor:eDP-1" - "3, monitor:DP-8" - "4, monitor:DP-8" - "5, monitor:DP-10" - "6, monitor:DP-10" - ]; - windowrule = [ - "match:class com.obsproject.Studio, workspace 1" - "match:class dev.zed.Zed, workspace 3" - "match:class vivaldi-stable, workspace 4, opacity 1.0" - "match:initial_title 3.basecamp.com_/5996442/, workspace 5, opacity 1.0" - "match:initial_title 3.basecamp.com_/5996442/, tile on" - "match:initial_title teams.microsoft.com_/, workspace 6, opacity 1.0" - "match:initial_title teams.microsoft.com_/, tile on" - "match:initial_title outlook.office.com_/mail/, workspace 6, opacity 1.0" - "match:initial_title outlook.office.com_/mail/, tile on" - ]; - device = lib.mkForce [ + workspace_rule = [ { - name = "keychron-keychron-k7"; - kb_layout = "us"; + workspace = "1"; + monitor = "eDP-1"; + default = true; } { - name = "keychron-keychron-k7-1"; - kb_layout = "us"; + workspace = "2"; + monitor = "eDP-1"; } { - name = "keychron-keychron-k7-2"; - kb_layout = "us"; + workspace = "3"; + monitor = "DP-8"; + } + { + workspace = "4"; + monitor = "DP-8"; + } + { + workspace = "5"; + monitor = "DP-10"; + } + { + workspace = "6"; + monitor = "DP-10"; + } + { + workspace = "7"; + monitor = "DP-10"; + } + ]; + # m3ta-home sets QT_QPA_PLATFORMTHEME to gtk3 globally for Hyprland. + # ksnip crashes with duplicate GDK type registration under that Qt GTK + # platform theme, so use qtct for Qt apps on this host instead. + "env" = mkForce [ + (mkEnvVar "XCURSOR_SIZE" "32") + (mkEnvVar "HYPRCURSOR_THEME" "Bibata-Modern-Ice") + (mkEnvVar "WLR_NO_HARDWARE_CURSORS" "1") + (mkEnvVar "XDG_CURRENT_DESKTOP" "Hyprland") + (mkEnvVar "XDG_SESSION_TYPE" "wayland") + (mkEnvVar "XDG_SESSION_DESKTOP" "Hyprland") + (mkEnvVar "XKB_DEFAULT_LAYOUT" "de") + (mkEnvVar "NIXOS_OZONE_WL" "1") + (mkEnvVar "QT_QPA_PLATFORM" "wayland;xcb") + (mkEnvVar "QT_QPA_PLATFORMTHEME" "qt5ct") + (mkEnvVar "QT_QPA_PLATFORMTHEME_QT6" "qt6ct") + ]; + window_rule = [ + { + match.class = "dev.zed.Zed"; + workspace = "3"; + } + { + match.class = "^(com.obsproject.Studio)$"; + workspace = "1"; + } + { + match.class = "^(brave-browse)$"; + workspace = "4"; + opacity = "1.0"; + } + { + match.class = "^(vivaldi-stable)$"; + workspace = "4"; + opacity = "1.0"; + } + { + match.initial_title = "3.basecamp.com_/5996442/"; + workspace = "5"; + opacity = "1.0"; + tile = true; + } + { + match.initial_title = "teams.microsoft.com_/"; + workspace = "6"; + opacity = "1.0"; + tile = true; + } + { + match.initial_title = "outlook.office.com_/mail/"; + workspace = "6"; + opacity = "1.0"; + tile = true; } ]; }; diff --git a/hosts/AZ-TC-01/default.nix b/hosts/AZ-TC-01/default.nix index 37e56aa..659b1ad 100644 --- a/hosts/AZ-TC-01/default.nix +++ b/hosts/AZ-TC-01/default.nix @@ -20,7 +20,7 @@ # Disk device override for this specific box (Dell OptiPlex 3040 Micro # with a 256GB SATA SSD). - az.tc.deployment.diskDevice = "/dev/sda"; + az.tc.deployment.diskDevice = "/dev/nvme0n1"; system.stateVersion = "25.05"; } diff --git a/overlays/default.nix b/overlays/default.nix index 67b840a..7324081 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -25,7 +25,24 @@ config.allowUnfree = true; }; }; - # Flatten llm-agents packages into top-level pkgs namespace. mkLlmAgentsOverlay = system: _final: _prev: - inputs.llm-agents.packages.${system} or {}; + removeAttrs (inputs.llm-agents.packages.${system} or {}) [ + # Internal helpers from packages/* marked hideFromDocs upstream: + "antigravity" + "auto-claude" + "buildNpmPackage" # ← the culprit; breaks webcord's `buildNpmPackage.override { nodejs = ...; }` + "bun2nix" + "darwinOpenptyHook" + "default" # fzf launcher; collides with nothing in nixpkgs but kept out for hygiene + "dolt" # collides with nixpkgs.dolt (Dolt database); not used in this config + "flake-inputs" + "forge" + "formatelf" + "formatter" # collides conceptually with pkgs.formatter; not used here + "go-bin" + "unpinCargoMsrvHook" + "unpinGoModVersionHook" + "versionCheckHomeHook" + "wrapBuddy" + ]; } diff --git a/secrets.nix b/secrets.nix index 0e9a620..a1ebc92 100644 --- a/secrets.nix +++ b/secrets.nix @@ -9,9 +9,9 @@ let # After first boot, retrieve via: ssh-keyscan -t ed25519 AZ-TC-NN.netbird # and paste the public key here. Until then, the corresponding .age # secrets can't be decrypted by the host. - AZ-TC-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-01"; - AZ-TC-02 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-02"; - AZ-TC-03 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-03"; + AZ-TC-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHfDCRFvGkduqaxKMQkCN0hiJ+096WBBSvJBf5TprNgE"; + # AZ-TC-02 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-02"; + # AZ-TC-03 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-03"; #USERS sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml"; @@ -19,7 +19,7 @@ let users = [sascha.koenig jannik.mueller]; systems = [AZ-CLD-1 AZ-LT-NIX AZ-PRM-1]; - thinClients = [AZ-TC-01 AZ-TC-02 AZ-TC-03]; + thinClients = [AZ-TC-01]; in { "secrets/elevenlabs-key.age".publicKeys = systems ++ users; "secrets/exa-key.age".publicKeys = systems ++ users; @@ -52,13 +52,13 @@ in { "secrets/AZ-TC-01-wifi-client-cert.age".publicKeys = [AZ-TC-01] ++ users; "secrets/AZ-TC-01-rustdesk-password.age".publicKeys = [AZ-TC-01] ++ users; - "secrets/AZ-TC-02-krb5-keytab.age".publicKeys = [AZ-TC-02] ++ users; - "secrets/AZ-TC-02-netbird-setupkey.age".publicKeys = [AZ-TC-02] ++ users; - "secrets/AZ-TC-02-wifi-client-cert.age".publicKeys = [AZ-TC-02] ++ users; - "secrets/AZ-TC-02-rustdesk-password.age".publicKeys = [AZ-TC-02] ++ users; + # "secrets/AZ-TC-02-krb5-keytab.age".publicKeys = [AZ-TC-02] ++ users; + # "secrets/AZ-TC-02-netbird-setupkey.age".publicKeys = [AZ-TC-02] ++ users; + # "secrets/AZ-TC-02-wifi-client-cert.age".publicKeys = [AZ-TC-02] ++ users; + # "secrets/AZ-TC-02-rustdesk-password.age".publicKeys = [AZ-TC-02] ++ users; - "secrets/AZ-TC-03-krb5-keytab.age".publicKeys = [AZ-TC-03] ++ users; - "secrets/AZ-TC-03-netbird-setupkey.age".publicKeys = [AZ-TC-03] ++ users; - "secrets/AZ-TC-03-wifi-client-cert.age".publicKeys = [AZ-TC-03] ++ users; - "secrets/AZ-TC-03-rustdesk-password.age".publicKeys = [AZ-TC-03] ++ users; + # "secrets/AZ-TC-03-krb5-keytab.age".publicKeys = [AZ-TC-03] ++ users; + # "secrets/AZ-TC-03-netbird-setupkey.age".publicKeys = [AZ-TC-03] ++ users; + # "secrets/AZ-TC-03-wifi-client-cert.age".publicKeys = [AZ-TC-03] ++ users; + # "secrets/AZ-TC-03-rustdesk-password.age".publicKeys = [AZ-TC-03] ++ users; } diff --git a/secrets/AZ-TC-01-krb5-keytab.age b/secrets/AZ-TC-01-krb5-keytab.age index e69de29..a9ee89b 100644 --- a/secrets/AZ-TC-01-krb5-keytab.age +++ b/secrets/AZ-TC-01-krb5-keytab.age @@ -0,0 +1,42 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZWN05LdyBpSGs5 +amgyV0tCZkEyUHd3MUNEVzc4SERiTWdpMDM4amtsMEl5VXNOZUQ4CklXMmJNWEw3 +V2ovc1JPaktPdWs2NDlFYWxJelZnZk9PV0FtNUJOMG8yYmMKLT4gc3NoLWVkMjU1 +MTkgQ1NNeWhnIHIvelYvaFF5TXVoaTRHSVg5ZTNmb1pZMTNON1RPOUlGZ0I4TlBt +SjJ1ZzAKREp5dnZmVEdoSmpJTVNOb2RhWFR1MlVSbTNOOE5XZFNyWjlFdkcwTVE3 +NAotPiBzc2gtZWQyNTUxOSBvWUxjRncgbzZiaDFmOXZKNkp2Snd3eGRDS1ZKdk8r +aDhvUVhMSU9odFBpUXpYNDF6YwpjTmJjYkJna0tIdkRsdHFNaThYaU9XQ0RyVjJD +RGFTM3hVMEFQU0V2azFvCi0+IC1+MEB8LFM5LWdyZWFzZSBQRlN8bSBfcCBbWiB2 +UwpiY05OcE5jaE93bThwTGxraXFRaW1RdUUrQTd2Ymgyd3NxMU9IamxiWUlFSWMx +MGZLNEVzZDBrMEVmanlzSVR5CkNWQlFlZjlGL2N2ZHFJSVNQZHNpR05CT3pDTG5D +TEEKLS0tIDRZSVVKRWVqUG1uUHpXUUV6ZWpTbWpZNVF5MWF4dFR5OEliWm9KSnpQ +WTQKWklnQ9B/Ig4adbUCM+oE7kIVH5MBoiZjdiXmNj4FukIRpDmgEvzddINntdG8 +B/GUs7wWVIh1j9u4DL1/8Vok7Vp7nKKDrGVcwONVdPusIn0z1pR+0MXRy4puDthr +SnI79KN/rZotMTM60zfPbPKmw51rGsA1WofsudXhNo3HgCLgM1n9DZCeuXTOWWzr +vULWJRuFkbEL5XLwDBUz0xI7QFJmGOnMvHh7HLjyQX7akuPOSzqN8R1FIm+Ol5uY +4BL3t7Xfj9Iun3Jzb7phahFHZADs4oA+YguoP4yF99+TOwBVw7eV16sNjM/caEyt +3Rul28jP6VhoglLYUkYrDYRPNpQsQU7ZkB9MuW/96RIoA7XL6YqlM/YuhfGlA8VO +CvKcfaYNMMyZT8r8gR40MEK15JpComGOvhJu8JHSvvinpqvwbeYOAU7f/gj4oorQ +IFEGfEewBRe94vhHnkR9GJqznHRVTQiOENiBJi33cz3ZWXCZGwF1zsziMLy8/HaQ +/wCyDeRbAUo+zaUeESPIV3k346cmrn90tMA7ChU5Amgh0Dr34ry4jqW9m99p9viY +KlgAD1Fe3nQ+LRR3lyQOdSe2HiHN4zq3JP/zu6Kvb3FoNMpCrRVJ7ZkjHog+8lAA +fauw7cRK1ebUKvEVJU3FHqqRLSLre8eEgYoG1jOlee2Et2Oa9euHxwUJuMV9MaiP +hT0g1eLyW5TDllKSVYYDt4yv3Hd+p33nhHi6wz8gVBpgNTaqPtl76MvrpuWDzSeZ +VZSXj4mTT2hos8JIwnlqmM5wTm/U1RzEEcT1FoqOzDYzya9Cq8O5dG1AjomzOKpv +bmfBV+uLqtUTO80sTPPtUeOd7t7AUekXk25Hh8wk7k8Vbjx1PlW9rT1w4KziGvqb +ni2VxzhawmujsY/EFxu7pDYRJ1bDBv4Lus4aM2ZEIGDbIKcvatgaKvtdLmPYq0dC +UkLmiNoulEQmF38GMZ1UgVW67RPUFMRMAp5ZfIl+5KrorcmKqmxmmIClftIgwBkR +nV1BQgdMFr5tnLSLqQePahRyEormv7TRUIrHnGWMoTjHEsZNT5Oc/vn66UnmIY5D +S+YO1ayEmWCRaZ63+ITnc1aKLEQR9BRS6qIN7ZG4EB1X61D4v2M5lFvo/dCHFclC +EWWE0ncVBsHXqDedxDnWK+7ceybo8KbLl+uAZDX+RLDtJVibc/CSdhfcaqSAIleI +Ss+D2amcqp37s5SScI7sPqhmilWmJSHRP7y0sGMkRu9qyoRrA31H1pXCk/9yWyXT +iakjlXd3Dz1YLsAx3VLkvsD4m5zShIiprBA1nuiHSOBPcmQoS5ZljhpKKZT2OPG+ +zcWObJso5ndjoW/Qnkr1FGxIjFPkXDt0buVZ6B7Q3JbJvBg66TzA5iSIkX78Fad2 +zB3OtVBfpq81V6XZLe825/3osV0HQBQ84xTDMU2wXlaaV6IKUBcqQBcBeDyZL6xH +299Wg5E1z/HXTG3uYfbe3vV+HAzgzPvB5qI1usMPj0Bvud8iSjflEMSPLAZOkufl +dRcKp6wKLDT6+8S8Wpty0n0pNL43cl3RSVzxD4PaLiss72HlmjUmGjPK3bdxm0rz +6/WpB9VEzbv8WcRJSZl7FE1vP2h32qCh3+0w4dUqIa/A1am7RMgilbi/EvEdREVc +gsL4sOj/gPi6hqkYJxhBsZ7RrIuhyQvXEfcUj/57NlOrWTiFaTM4JqkIAIxmACCK +S8VNIjQEN9QADNOGxjxXXzkUKmp0GmMn53vzO02zRBdX3Lrqzgt4N7TNePH/XIb7 +ncy2WsNR41UUXiJByEKlHUZzvdhSaQb7cY3WtabfyGF3MF4= +-----END AGE ENCRYPTED FILE-----