update con

.sops.yaml

@@ -1,11 +1,10 @@
+---
 keys:
   - &t14 age14e2d2y8e2avzfrsyxg9dudxd36svm24t7skw6e969n0c42znlp3shffdtg
-  - &racknerd age19qx3e78c9f2l7ceccgjf7ksvc873ungjely3nyxyjts2xsz0ldjq6shksm
+  - &consensus age16pdhm238k63uye3rf4cwwe7ddyzds6xj9jv4wpsfggkghyarjqtsjzkxna
-  - &ocx age1xwcz9qtaezjy4kl6xttea0u00j7j2n8xkd297vjz9xrnqx9fksjsg3nhu3
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
       - age:
           - *t14
-        - *racknerd
+          - *consensus
-        - *ocx

flake.lock

@@ -206,16 +206,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1725703823,
+        "lastModified": 1725694918,
-        "narHash": "sha256-tDgM4d8mLK0Hd6YMB2w1BqMto1XBXADOzPEaLl10VI4=",
+        "narHash": "sha256-+HsjshXpqNiJHLaJaK0JnIicJ/a1NquKcfn4YZ3ILgg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "208df2e558b73b6a1f0faec98493cb59a25f62ba",
+        "rev": "aaebdea769a5c10f1c6e50ebdf5924c1a13f0cda",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "master",
         "repo": "home-manager",
         "type": "github"
       }
@@ -404,7 +404,6 @@
         "pre-commit-hooks": "pre-commit-hooks",
         "sops-nix": "sops-nix",
         "systems": "systems_3",
-        "tide": "tide",
         "treefmt-nix": "treefmt-nix"
       }
     },
@@ -473,22 +472,6 @@
         "type": "indirect"
       }
     },
-    "tide": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1710210487,
-        "narHash": "sha256-85iU1QzcZmZYGhK30/ZaKwJNLTsx+j3w6St8bFiQWxc=",
-        "owner": "IlanCosman",
-        "repo": "tide",
-        "rev": "44c521ab292f0eb659a9e2e1b6f83f5f0595fcbd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "IlanCosman",
-        "repo": "tide",
-        "type": "github"
-      }
-    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -2,8 +2,7 @@
   description = "Home Manager && NixOS configuration";
   inputs = {
     nixos-hardware.url = "github:NixOS/nixos-hardware";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
     pre-commit-hooks = {
       url = "github:cachix/pre-commit-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -21,12 +20,16 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nvim = {
       url = "github:iofq/nvim.nix";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    deploy-rs = {
+      url = "github:serokell/deploy-rs";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
   };
   outputs = {
@@ -43,16 +46,12 @@
       inherit system;
       config.allowUnfree = true;
       overlays = [
-        (final: _prev: {
+        (_final: _prev: {
           steam = pkgs.writeShellScriptBin "steam" ''
             flatpak run com.valvesoftware.Steam -pipewire "$@"
           '';
-          unstable = import inputs.nixpkgs-unstable {
-            inherit (final) system;
-            config.allowUnfree = true;
-            overlays = [inputs.nvim.overlays.default];
-          };
         })
+        inputs.nvim.overlays.default
       ];
     };
     eachSystem = f: nixpkgs.lib.genAttrs (import systems) (system: f nixpkgs.legacyPackages.${system});
@@ -69,6 +68,17 @@
         };
       };
     };
+    deploy.nodes = {
+      consensus = {
+        hostname = "consensus";
+        sshUser = "root";
+        remoteBuild = true;
+        profiles.system = {
+          user = "root";
+          path = inputs.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.consensus;
+        };
+      };
+    };
     formatter = eachSystem (pkgs: treefmtEval.${pkgs.system}.config.build.wrapper);
     devShells.${system}.default = pkgs.mkShell {
       inherit (self.checks.pre-commit-check) shellHook;
@@ -79,6 +89,7 @@
         pkgs.ssh-to-age
         pkgs.sops
         pkgs.age
+        pkgs.deploy-rs
         treefmtEval.${system}.config.build.wrapper
       ];
     };

home-manager/shared/programs/dev/default.nix

@@ -5,6 +5,7 @@
   };
   home.packages = with pkgs; [
     ripgrep
+    fd
     k9s
     kubectl
     python3

home-manager/shared/programs/nvim/default.nix

@@ -1,5 +1,5 @@
 {pkgs, ...}: {
-  home.packages = with pkgs.unstable; [
+  home.packages = with pkgs; [
     nvim-pkg
   ];
 }

home-manager/shared/programs/shell/default.nix

@@ -11,8 +11,55 @@
     packages = with pkgs; [
       tree
       eza
+      bat
     ];
   };
+  programs.fish = {
+    enable = true;
+    interactiveShellInit = ''
+      set fish_greeting # Disable greeting
+      set -U tide_right_prompt_items status\x1ecmd_duration\x1etime
+    '';
+    shellInit = "
+        fish_add_path /usr/local/go/bin
+        fish_add_path ~/go/bin
+        fish_add_path ~/.local/bin
+        set -gx MANPAGER 'nvim +Man!'
+        set -gx EDITOR 'nvim'
+        set -gx _JAVA_AWT_WM_NONREPARENTING 1
+        set -gx NIX_FLAKE '/home/e/dev/nix'
+      ";
+    plugins = [
+      { name = "fzf"; src = pkgs.fishPlugins.fzf-fish.src; }
+      { name = "puffer"; src = pkgs.fishPlugins.puffer.src; }
+    ];
+    functions = {
+      nix = {
+        wraps = "nix";
+        body = ''
+              if status is-interactive
+                and test (count $argv) = 1 -a "$argv[1]" = develop
+                  nix develop --command (status fish-path)
+              else
+                command nix $argv
+              end
+        '';
+      };
+    };
+    shellAbbrs = {
+      g = "git";
+      k = "kubectl";
+    };
+    shellAliases = {
+      ":q" = "exit";
+      hms = "home-manager switch --flake $NIX_FLAKE#${host.username}";
+      rbs = "sudo nixos-rebuild switch --flake $NIX_FLAKE#${host.hostName}";
+      nvim-dev = "nix run ~/dev/nvim.nix";
+      mpv = "mpv --no-keepaspect-window";
+      cat = "bat -P";
+      tcd = "cd $(mktemp -d)";
+    };
+  };
   programs.bash = {
     enable = true;
     enableCompletion = true;
@@ -25,13 +72,6 @@
       la = "eza -lahr";
       ll = "la";
       ":q" = "exit";
-      mpv = "mpv --no-keepaspect-window";
-      hms = "home-manager switch --flake $NIX_FLAKE#${host.username}";
-      rbs = "sudo nixos-rebuild switch --flake $NIX_FLAKE#${host.hostName}";
-      update = "nix flake update $NIX_FLAKE && rbs && hms";
-      nvim-dev = "nix run ~/dev/nvim.nix";
-      g = "git";
-      k = "kubectl";
     };
     shellOptions = [
       "cmdhist"
@@ -45,15 +85,8 @@
     bashrcExtra = ''
       export PROMPT_COMMAND="prompt_command;history -a"
       export PATH="/usr/local/go/bin:~/go/bin:~/.bin:~/.local/bin:$PATH"
-      export GPG_2FA="mail@10110110.xyz"
-      export MANPAGER="nvim +Man!"
       export EDITOR="nvim"
-      export _JAVA_AWT_WM_NONREPARENTING=1
-      export NIX_FLAKE="/home/e/dev/nix"
       [[ $- != *i* ]] && return
-      function exists {
-        type $1 >/dev/null 2>&1
-      }
 
       function prompt_command {
         GIT_BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null | cut -c 1-10)
@@ -72,7 +105,13 @@
         cmd="eza"
         builtin cd "$@" && $cmd
       }
-      exists "kubectl" && source <(kubectl completion bash)
+    '';
+    initExtra = ''
+      if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
+      then
+        shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
+        exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
+      fi
     '';
   };
   programs.fzf = {
@@ -82,6 +121,7 @@
   };
   programs.direnv = {
     enable = true;
+    silent = true;
     enableBashIntegration = true;
     nix-direnv.enable = true;
   };

home-manager/shared/wayland/default.nix

@@ -60,4 +60,5 @@
       }
     ];
   };
+  home.file.".icons/default".source = "${pkgs.vanilla-dmz}/share/icons/DMZ-Black";
 }

home-manager/shared/wayland/hyprland/default.nix

@@ -5,6 +5,7 @@
     extraConfig = ''
       monitor=,preferred,auto,1
     '';
+    plugins = [ pkgs.hyprlandPlugins.hyprexpo ];
     settings = {
       "$mod" = "SUPER";
       general = {
@@ -14,6 +15,8 @@
       };
       misc = {
         disable_hyprland_logo = true;
+        new_window_takes_over_fullscreen = 1;
+        exit_window_retains_fullscreen = 1;
       };
       decoration = {
         blur = {
@@ -49,6 +52,7 @@
           natural_scroll = true;
           tap_button_map = "lrm";
           middle_button_emulation = false;
+          drag_lock = true;
         };
         touchdevice = {
           enabled = false;
@@ -61,8 +65,8 @@
       binde = [
         "$mod ALT, h, resizeactive, -50 0"
         "$mod ALT, l, resizeactive, 50 0"
-        "$mod ALT, k, resizeactive, 0 50"
+        "$mod ALT, j, resizeactive, 0 50"
-        "$mod ALT, j, resizeactive, 0 -50"
+        "$mod ALT, k, resizeactive, 0 -50"
       ];
       bind =
         [
@@ -70,12 +74,14 @@
           "$mod, x, killactive"
           "$mod, f, fullscreen"
           "$mod SHIFT, Escape, exit"
-          "$mod SHIFT, f, fakefullscreen"
+          "$mod SHIFT, f, fullscreenstate, 0 3"
+          "$mod, a, hyprexpo:expo, toggle"
           "$mod, Space, exec, ${pkgs.bemenu}/bin/bemenu-run"
           "$mod, t, togglefloating"
           "$mod, bracketleft, exec, grimshot --notify  save area /tmp/scrot-$(date \"+%Y-%m-%d\"T\"%H:%M:%S\").png"
           "$mod, bracketright, exec, grimshot --notify  copy area"
-          "$mod SHIFT, q, exec, loginctl lock-session"
+          "$mod SHIFT, q, exec, swaylock"
+          "$mod SHIFT, BACKSPACE, exit"
           ",XF86MonBrightnessDown, exec,  light -U 10"
           ",XF86MonBrightnessUp, exec, light -A 10"
           ",XF86AudioRaiseVolume, exec, pactl set-sink-volume @DEFAULT_SINK@ +1%"
@@ -95,6 +101,10 @@
           "$mod SHIFT, l, movewindow, r"
           "$mod SHIFT, k, movewindow, u"
           "$mod SHIFT, j, movewindow, d"
+          "$mod, COMMA, focusmonitor, l"
+          "$mod, PERIOD, focusmonitor, r"
+          "$mod SHIFT, COMMA, movewindow, mon:l"
+          "$mod SHIFT, PERIOD, movewindow, mon:r"
         ]
         ++ (
           # workspaces
@@ -106,7 +116,7 @@
                 in
                   builtins.toString (x + 1 - (c * 10));
               in [
-                "$mod, ${ws}, workspace, ${toString (x + 1)}"
+                "$mod, ${ws}, focusworkspaceoncurrentmonitor, ${toString (x + 1)}"
                 "$mod SHIFT, ${ws}, movetoworkspacesilent, ${toString (x + 1)}"
               ]
             )

home-manager/t14/home.nix

@@ -41,18 +41,11 @@
   programs.ssh = {
     enable = true;
     matchBlocks = {
-      "racknerd" = {
+      "consensus" = {
-        hostname = "racknerd.10110110.xyz";
+        port = 2022;
-        identityFile = "/home/e/.ssh/racknerd";
+        hostname = "192.168.1.251";
-      };
-      "htz" = {
-        hostname = "htz.10110110.xyz";
         identityFile = "/home/e/.ssh/id_ed25519";
       };
-      "ocx" = {
-        hostname = "ocx.10110110.xyz";
-        identityFile = "/home/e/.ssh/oracle";
-      };
     };
   };
   fonts.fontconfig.enable = lib.mkForce true;

nixos/configuration.nix

@@ -5,8 +5,10 @@
 }: {
   users.groups.plugdev = {}; # Create plugdev group
   networking.hostName = host.hostName;
+  users.groups.${host.username} = {};
   users.users.${host.username} = {
     isNormalUser = true;
+    group = "${host.username}";
     extraGroups = [
       "wheel"
       "plugdev"

nixos/consensus/configuration.nix

@@ -0,0 +1,67 @@
+{pkgs, ...}: {
+  imports = [
+    ./hardware-configuration.nix
+  ];
+  environment.systemPackages = with pkgs; [
+    git
+    vim
+  ];
+  boot.tmp.cleanOnBoot = true;
+  zramSwap.enable = false;
+  swapDevices = [
+    {
+      device = "/var/swapfile";
+      size = 4 * 1024;
+    }
+  ];
+  networking = {
+    hostName = "consensus";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22
+        2022
+        6443
+        25565
+        30001
+        30303
+      ];
+      allowedUDPPorts = [
+        30001
+        30303
+      ];
+      logRefusedConnections = true;
+    };
+  };
+  services = {
+    k3s = {
+      enable = true;
+      role = "server";
+      extraFlags = toString [
+        "--disable=traefik"
+      ];
+    };
+    openssh = {
+      enable = true;
+      ports = [2022];
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+      };
+    };
+  };
+  users.users = {
+    root = {
+      openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
+    };
+    e = {
+      isNormalUser = true;
+      extraGroups = ["wheel"];
+      home = "/home/e";
+      openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
+    };
+  };
+  security.sudo.wheelNeedsPassword = false;
+  nix.settings.trusted-users = ["e"];
+  system.stateVersion = "23.11";
+}

nixos/consensus/hardware-configuration.nix

@@ -0,0 +1,10 @@
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/nvme0n1";
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = { device = "/dev/mapper/vg-root"; fsType = "btrfs"; };
+  fileSystems."/var" = { device = "/dev/mapper/vg-var"; fsType = "btrfs"; };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/default.nix

@@ -26,4 +26,19 @@ in {
         inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen1
       ];
   };
+  consensus = inputs.nixpkgs.lib.nixosSystem {
+    specialArgs = {
+      inherit inputs system pkgs attrs;
+      host = {
+        hostName = "consensus";
+        inherit (attrs) username;
+      };
+    };
+    modules =
+      defaultModules
+      ++ [
+        ./configuration.nix
+        ./consensus/./configuration.nix
+      ];
+  };
 }

nixos/t14/configuration.nix

@@ -12,7 +12,6 @@ in {
     ./nano.nix
     ./backups.nix
   ];
-
   environment.systemPackages = with pkgs; [
     cryptsetup
     nfs-utils
@@ -116,9 +115,8 @@ in {
     };
   };
 
-  hardware.opengl = {
+  hardware.graphics = {
     enable = true;
-    setLdLibraryPath = true;
     extraPackages = [
       pkgs.mesa.drivers
       pkgs.libGL

secrets/restic.yaml

@@ -18,32 +18,23 @@ sops:
         - recipient: age14e2d2y8e2avzfrsyxg9dudxd36svm24t7skw6e969n0c42znlp3shffdtg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eWJxSjM2NTJ1YUNOdVhl
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVncwYmRudlFYWmhad1Ar
-            YjZobWdiNFRLOGdpMTFPc2RXVkdDNEh3L1d3CnhHYVpZNlVSVEFoVlQ3Rnphcm1l
+            Mm5NWVNmTUszQ2lnMER1aCtvK1pjeHdJT0ZvCm5kYU5PbWQ0cXdId3J6aElHNFcx
-            MU9sQUY4Q296Wk1tanVjUXRYMjQyUGsKLS0tIEZrZTJzSVR4b0lncG53cEVpTXhC
+            Q3JSWXQxQmErMGJUZmdNRktuQm1iQ28KLS0tIGlCZzVydHR0eXY5ZXZLRUxkODBR
-            WHVYMWF1SWlNZE13aVIrVHJKK1NxSUEKRo0F8h/X3/mm/Dhi44wATtMh9j5f//mB
+            ZnU3ZFl1NkZqREJpcnlNMEdwVVljclkKSEmp9QkoMufA4DACbuilm6tZutpTN+ZN
-            YKmb4WnPl2suYBuQvMuFWtugHUqVBhcnVAmyFM2L2vddmtAuvtttYQ==
+            ZHa9B8TDtuSZcAieMOoGxQoC4An96qIemwsMlecqGFWjJqN7wEapDQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age19qx3e78c9f2l7ceccgjf7ksvc873ungjely3nyxyjts2xsz0ldjq6shksm
+        - recipient: age16pdhm238k63uye3rf4cwwe7ddyzds6xj9jv4wpsfggkghyarjqtsjzkxna
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5VFNwYlQ3VmMyd3pJenB0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwU1JwYnVwVFVQSTlqVmZ2
-            bVlGSEZva1pVa1hnQVZ6Q1hhV1VHZ002dG1zCnBaT01MSWU3elZpZEhVZ0FyMVNF
+            djEyL3BjYkNMNldSZGUrdnBITENQMVZVNm1VCjlYd3NoY3NWVVA1UVlyMTIvekVl
-            TllWOEZQakZ4MEZ1ZWlyS1hTTURFOWsKLS0tIDNpWkdMZ0I3LzViYjZsaWhNV1Vv
+            MHhVeGpuV2N3azZGMmJqRERJQjZGVGsKLS0tIFgvOHAxWW5XUVdyRGZGR3I5V3lr
-            NTEvUUlabzdqME1aVytlSkJ3WFJpT0kKYVL0sXLaq9bZ6xXqRKuT3GN1nuuXRiHR
+            MXhYMkl5TTZVcDlNWUs4M3ZieDVRa1kKN3mh6jxui1a8i0VJJQmrAjhAhQkP4VcP
-            Psa1czMlGL40s6vNMndceLgHEKdWHXMu9WT+BRTeTiRKMrQ9CNS+CQ==
+            IpiYzY9IwIZu6VlC7qEuh3eeVq+v3SYcTmCh6/gwpmeDAjnL6hD5sA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xwcz9qtaezjy4kl6xttea0u00j7j2n8xkd297vjz9xrnqx9fksjsg3nhu3
+    lastmodified: "2024-09-05T06:23:15Z"
-          enc: |
+    mac: ENC[AES256_GCM,data:9TcJCbjPLNBckIG2krPMI7EUxLwrRpvN0eXVgpjLqUCewO2dFgAR9abvARnxkEC58bJWw/l9zwGKvztfRFl7vBTzLAAEdsrfpcLVA0dF2kP5o7VEsNJwzaEVWr7jobO/OXU/lPo9In2f1hiPulTwwqG/pHZoiDPnzs+l0fsVsvk=,iv:UCYh6SBMidzwHHZPwyWJupBSTVjDg7TQ1LbyaNzn034=,tag:kQFXik8lQmNJ348K/Fyb5A==,type:str]
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBic0JuMmZpUGZpNEhRdWVN
-            a09hZG1mSEFxUUxWcXBWK0U0N3NueW4rdkgwCmRZaG5pWFNvZlBiS0ZOT1k3emFC
-            akZYQnRFdmQrWU0zTksza3lCaWdUeFkKLS0tICtIanM2c1VvQ21LR0FUQmFQcHhH
-            bTdSb0oxZVJvRGxTWTlpVlAyWEZGQkEKmLN2o4/NXmNUss9Z+j9Q9ywRBx6cx3ru
-            /VqSfRMczno/I3mD6t9fuSQT42X2Dgdexvi4fm5Qr3+avXE/zlMx+Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-14T05:26:47Z"
-    mac: ENC[AES256_GCM,data:gJ5kkzV0RWFEWJYXf5Rva6WLIRoJ3aWm4hNmJrJyanJeV4yMHDXwM3EyvJ60q1MtQVv790tPHC9NDGvVM+/WuwsBj2xiZUdHsYYv/Xio9iYD9tPXpS2bwjLOcn8K+wfOBKgnBi3rr9y00jlg+pmB/gQPPnTZXoFnxr44BROqjg8=,iv:iaQFyjrdK/zsZRYrghanNt8UQ4klu2i6wyLyOD3T3xY=,tag:MwxBUVDgl+L4WXASrC5bjg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1