update flake

flake: add nixos-generators for output pianonix-image
pianonix: update commented wireless networking config
2025-10-21 20:04:02 +02:00 · 2025-10-21 20:03:46 +02:00 · 2025-10-21 20:03:25 +02:00 · 2025-10-21 20:03:12 +02:00 · 2025-10-21 20:02:18 +02:00 · 2025-10-20 19:37:44 +02:00
15 changed files with 245 additions and 98 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,7 +1,7 @@
 keys:
  - &primary age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg
  - &aspi-ssh age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4
-  - &pianonix-ssh age1hsmfz8fjxu83sax9lr487h8xr6cyge0apdq4zpge4c8jpcjj2cksj825ct
+  - &pianonix-ssh age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c
  - &builder-ssh age1kw4kmdm45zprvdkrrpvgq966l7585vhusmum083qlwnr0xxgd3uqatcyja
  - &kardorf-ssh age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5

@@ -20,7 +20,7 @@ creation_rules:
      - *primary
      - *builder-ssh

-  - path_regex: hosts/pianonix/secrets.yaml$
+  - path_regex: hosts/pianonix/secrets*
    key_groups:
    - age:
      - *primary
--- a/Readme.org
+++ b/Readme.org
@@ -24,7 +24,7 @@ sops edit secrets/secrets.yaml
 ** Authorize new device
 - Generate public key from ssh -> Private age key generation not needed
 #+begin_src sh
-ssh-to-age < /etc/ssh/ssh_host_ed25519_key
+ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub
 #+end_src
 - Add age public key to file:.sops.yaml
 - Update keys
--- a/flake.lock
+++ b/flake.lock
@@ -58,11 +58,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758287904,
-        "narHash": "sha256-IGmaEf3Do8o5Cwp1kXBN1wQmZwQN3NLfq5t4nHtVtcU=",
+        "lastModified": 1760701190,
+        "narHash": "sha256-y7UhnWlER8r776JsySqsbTUh2Txf7K30smfHlqdaIQw=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "67ff9807dd148e704baadbd4fd783b54282ca627",
+        "rev": "3a9450b26e69dcb6f8de6e2b07b3fc1c288d85f5",
        "type": "github"
      },
      "original": {
@@ -362,13 +362,49 @@
        "type": "gitlab"
      }
    },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1736643958,
+        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-generators": {
+      "inputs": {
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751903740,
+        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "type": "github"
+      }
+    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1759582739,
-        "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
+        "lastModified": 1760958188,
+        "narHash": "sha256-2m1S4jl+GEDtlt2QqeHil8Ny456dcGSKJAM7q3j/BFU=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "3441b5242af7577230a78ffb03542add264179ab",
+        "rev": "d6645c340ef7d821602fd2cd199e8d1eed10afbc",
        "type": "github"
      },
      "original": {
@@ -410,11 +446,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1759381078,
-        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+        "lastModified": 1760878510,
+        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
        "type": "github"
      },
      "original": {
@@ -438,11 +474,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1759580034,
-        "narHash": "sha256-YWo57PL7mGZU7D4WeKFMiW4ex/O6ZolUS6UNBHTZfkI=",
+        "lastModified": 1760862643,
+        "narHash": "sha256-PXwG0TM7Ek87DNx4LbGWuD93PbFeKAJs4FfALtp7Wo0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "3bcc93c5f7a4b30335d31f21e2f1281cba68c318",
+        "rev": "33c6dca0c0cb31d6addcd34e90a63ad61826b28c",
        "type": "github"
      },
      "original": {
@@ -462,11 +498,11 @@
        "systems": "systems_5"
      },
      "locked": {
-        "lastModified": 1758373036,
-        "narHash": "sha256-tm73KNHsGQwAAoFEcAvuXAmHf3KaWLSuf/R9UQ6WMnU=",
+        "lastModified": 1760795571,
+        "narHash": "sha256-gi+tWWAknKuTNso3yMeKsT9nj0jx+tuYF7g7nmLUWT8=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "a30decbd5fc231e84dfefeb75bc7f57d8167726c",
+        "rev": "6c945865ba5de87fa2d0dd8a0e66ca572ddf9043",
        "type": "github"
      },
      "original": {
@@ -486,11 +522,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758662783,
-        "narHash": "sha256-igrxT+/MnmcftPOHEb+XDwAMq3Xg1Xy7kVYQaHhPlAg=",
+        "lastModified": 1760652422,
+        "narHash": "sha256-C88Pgz38QIl9JxQceexqL2G7sw9vodHWx1Uaq+NRJrw=",
        "owner": "NuschtOS",
        "repo": "search",
-        "rev": "7d4c0fc4ffe3bd64e5630417162e9e04e64b27a4",
+        "rev": "3ebeebe8b6a49dfb11f771f761e0310f7c48d726",
        "type": "github"
      },
      "original": {
@@ -509,6 +545,7 @@
        "nix-colors": "nix-colors",
        "nix-gl": "nix-gl",
        "nix-matlab": "nix-matlab",
+        "nixos-generators": "nixos-generators",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_3",
        "nixpkgs-unstable": "nixpkgs-unstable",
@@ -548,11 +585,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759635238,
-        "narHash": "sha256-UvzKi02LMFP74csFfwLPAZ0mrE7k6EiYaKecplyX9Qk=",
+        "lastModified": 1760998189,
+        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "6e5a38e08a2c31ae687504196a230ae00ea95133",
+        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
        "type": "github"
      },
      "original": {
@@ -687,11 +724,11 @@
    "yazi-flavors": {
      "flake": false,
      "locked": {
-        "lastModified": 1758842767,
-        "narHash": "sha256-+awiEG5ep0/6GaW8YXJ7FP0/xrL4lSrJZgr7qjh8iBc=",
+        "lastModified": 1761030755,
+        "narHash": "sha256-0CZrJ1f5lDY75XF5eR6m4hbg973pTZoAxzJKMCv+hag=",
        "owner": "yazi-rs",
        "repo": "flavors",
-        "rev": "2d73b79da7c1a04420c6c5ef0b0974697f947ef6",
+        "rev": "f9ae9f271812628191c67f3f6801c52bce5a96d0",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -10,6 +10,11 @@
    nix-colors.url = "github:misterio77/nix-colors";
    deploy-rs.url = "github:serokell/deploy-rs";

+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    home-manager = {
      url = "github:nix-community/home-manager/release-25.05";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -84,7 +89,7 @@

    packages = forEachSystem (pkgs: import ./pkgs {inherit pkgs;});
    devShells = forEachSystem (pkgs: import ./shell.nix {inherit pkgs;});
-    formatter = forEachSystem (pkgs: pkgs.alejandra);
+    formatter = forEachSystem (pkgs: pkgs.alejandra); # nix fmt *

    nixosConfigurations = {
      # Main laptop
@@ -183,5 +188,15 @@
        };
      };
    };
+
+    # substitutes: nixos-generate --flake .#pianonix -f sd-aarch64 --system aarch64-linux
+    pianonix-image = inputs.nixos-generators.nixosGenerate {
+      system = "aarch64-linux";
+      format = "sd-aarch64";
+      modules = [./hosts/pianonix];
+      specialArgs = {
+        inherit inputs outputs;
+      };
+    };
  };
 }
--- a/homes/julian/pianonix.nix
+++ b/homes/julian/pianonix.nix
@@ -14,8 +14,8 @@
  is-nixos = true;
  terminal = "wezterm";

-  services.syncthing.tray.enable = true;
-  services.syncthing.tray.command = "syncthingtray --wait"; # Wait for tray to become available
+  # services.syncthing.tray.enable = true;
+  # services.syncthing.tray.command = "syncthingtray --wait"; # Wait for tray to become available

  home.packages = with pkgs; [
    music-reader
@@ -27,9 +27,33 @@
    onboard
  ];

+  programs.firefox = {
+    enable = true;
+
+    profiles.default = {
+      isDefault = true;
+
+      settings = {
+        "browser.startup.homepage" = "https://sheets.julian-mutter.de";
+        "browser.startup.page" = 1; # 0=blank, 1=home page, 3=restore previous session
+      };
+    };
+  };
+
+  programs.chromium = {
+    enable = true;
+
+    # commandLineArgs = [
+    #   "--homepage=https://sheets.julian-mutter.de"
+    #   "--no-first-run"
+    # ];
+  };
+
  # Autostart link
  home.file = {
-    ".config/autostart/sheet-organizer.desktop".source = "${pkgs.sheet-organizer}/share/applications/sheet-organizer.desktop";
+    # ".config/autostart/sheet-organizer.desktop".source = "${pkgs.sheet-organizer}/share/applications/sheet-organizer.desktop";
+    # ".config/autostart/firefox.desktop".source = "${pkgs.firefox}/share/applications/firefox.desktop";
+    ".config/autostart/chromium.desktop".source = "${pkgs.chromium}/share/applications/chromium.desktop";
    ".config/sheet-organizer/config.toml".text = ''
      working_directory = "/home/julian/Klavier"
    '';
--- a/hosts/aspi/default.nix
+++ b/hosts/aspi/default.nix
@@ -20,7 +20,7 @@
    ../common/optional/virtualbox.nix

    ../common/optional/podman.nix
-    ../common/optional/wireguard.nix
+    # ../common/optional/wireguard.nix
    ../common/optional/flatpak.nix

    ../common/optional/avahi.nix
--- a/hosts/builder/default.nix
+++ b/hosts/builder/default.nix
@@ -9,12 +9,23 @@
  imports = [
    ./hardware-configuration.nix

-    ../common/global
+    ../common/global/fish.nix # fish for admin
+    ../common/global/locale.nix
+    ../common/global/nix.nix
+    ../common/global/sops.nix
+    ../common/global/root.nix
  ];

  networking.hostName = "builder";
  system.stateVersion = "23.11";

+  networking.networkmanager.enable = true;
+  networking.nameservers = [
+    "192.168.3.252"
+    "172.30.20.10"
+    "1.1.1.1"
+  ];
+
  users.mutableUsers = false;
  users.users.nix = {
    isNormalUser = true;
@@ -54,14 +65,14 @@
    fallback = true;
  };

-  system.autoUpgrade = {
-    enable = true;
-    flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
-    flags = [
-      "--recreate-lock-file" # update lock file
-    ];
-    dates = "02:13";
-  };
+  # system.autoUpgrade = {
+  #   enable = true;
+  #   flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
+  #   flags = [
+  #     "--recreate-lock-file" # update lock file
+  #   ];
+  #   dates = "02:13";
+  # };

  # optimize store by hardlinking store files
  nix.optimise.automatic = true;
--- a/hosts/common/global/default.nix
+++ b/hosts/common/global/default.nix
@@ -3,6 +3,7 @@
  inputs,
  outputs,
  pkgs,
+  lib,
  ...
 }: {
  imports =
@@ -31,7 +32,10 @@
  };
  services.resolved.enable = true;

-  programs.dconf.enable = true;
+  networking.nameservers = lib.mkDefault [
+    "1.1.1.1"
+    "8.8.8.8"
+  ];

  # HM
  home-manager.useGlobalPkgs = true;
--- a/hosts/common/secrets.yaml
+++ b/hosts/common/secrets.yaml
@@ -14,38 +14,38 @@ sops:
        - recipient: age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxV2IzcEZ6eGYxbXAvaEta
-            c3RLbmZubnVEL1EwSlNNY3ZNbkVSUXN5ZDBZClRTYWwzbHhDK1VsMzVVL0VMVzZF
-            SEQ0ZHVMdytrY0xXUEppQkpNZEZ3VFkKLS0tIG95ZkJLWTZBWWpIOEQ4bHpBNWEx
-            QXVpMTNSNzU1dTBPYjlsc1BvNHZ3dDgKMHrT9DCC5W6UwC1Mfq6YCwkvZtDs3I7j
-            vKlnanFp8hMMyYONRVlkvh+vOGQdbgXco4Z5nr02LQDu6Rwm4jSp9g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBualdnWmtBTThhZDFVdDRP
+            WHlMamk1MFhUYUwwa0hyQmpobGNocC9VR0ZVCmc3N1FjcUZCNUdTTm91OVpwZDhP
+            bTNXekp2bDd3Tjh6a2ZVTVNTSW9RTU0KLS0tIGJpcUVHb2ZlODgvelhwQ0JFU3l5
+            WU5VanhYMTUvNklYazJxOXVveXhpM2cKCo+4FhhcbRylASEbQb9rAQUzEO1D+0AR
+            52Jzc9s9rSdypeBRE7SaSOI4eVnkEjPfyhNFvMdxiBzBj7GdocpmCw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTnpqclVmVHR3M1ZvMDZ0
-            eEtrbnhpTW5uZlhOYWFxbktxcTJ3bXZISkhzClpud2tNVzUvT2N2SkRadWk5aVpE
-            S2VkTFlIVUhFclA0WEh5cEp0Qjg3ejgKLS0tIDNXY0lpKys4Q3NBRFcya2RoSG1F
-            YW0raHlNekdWT3p0WHpGMk9xMmgzWFUKCue4GvgmH3nJBa7ny7rqft5MuSWHqAsP
-            5HnaAudL+rh2j1swm635QUrf9UnpUznE5NSOGrQDmA6RCBypNM4rsw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4STZpU0ZnRzVVOFFRUXZG
+            akcwS2Z5V3lmQzRTSGNHT2hDME5JMks2QTNNClpkZzNMc0wyRjVEaVlBRFlyNFhs
+            M1pyeW1XdnZubnRxMzEzMFJoK0lkVVEKLS0tIENhRExzUWRWMUlObmhxazM5cU9y
+            aDFyaDJackFoaEZOYWdTbWt0ODB1bm8Kg1VDAj5/i8ZbYxspIdXrI474YN5YkV4H
+            86maCRDfUxO5lvu4zBa9pOmFtJ2iuJ2MxDnmCSHTl+GOk8yyUT8JhA==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hsmfz8fjxu83sax9lr487h8xr6cyge0apdq4zpge4c8jpcjj2cksj825ct
+        - recipient: age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBESlZOeHY0T01ra0gwMS8z
-            R3c1eW45WVkyeTBuRlFMRngrb2NFL1hkcmhRCitwZ3lweXM0di9EdEdQZmF4ZUZr
-            M1hqNkM3Q1Jrb09Kb2M0ZkhTcFZPYkkKLS0tIHpCTEFCV0JlRzQwK3hndDJ4aHVC
-            S1o0QVlXSVl0dmlpWUQ3ZXdqUU5maTgKY4UJPx37CU5OUgkqYWlz9+0rA+dQkrH9
-            +/kTT/2qZ2Op67WKtlas7arC7BjU8uygM208q+nr48Lic5n1fMtnXA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAveE9NV2JCOW9odlN6Wmkw
+            WFEvU2pka3htV2FTTFlpc05ES2JjbGxTaFJZCjhYdG1sRVBFaEF3YjNkWEw3Ny8x
+            MlYyTjJBMHA2YVpHRkkwWW5hNDdrS1UKLS0tIFZXTFNVbkd6VFExc0dSVU4vd3JF
+            ajlFY2pvWW13VGxOZ0hEc3dMbU9IeUUKNSf7ycj+1XHhsoghmY2iR1BwIySqfIOF
+            zawE+MQcQg0u+fy6Aik26eUGvQG3rya2Fx2+3VlAbKB+rbiP0fwsgg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvYkdwSy9vc0lEWXJIdWRw
-            VmJ2NStaZDVxaG1LNU1NQlErdElPdkQvY3pjCkJyL1BRR2w1dmpqYnk5Tys3eHpX
-            c0FJdzA1bU5GWWhrUWhOK1Jqa2lTaU0KLS0tIDMzMEQwL3I0ckVyYWFubU9VNlAr
-            NlBud3VHczNnMm5wOGhHdEoxTG5CNDgK4s7cFGvUCeztjjIAWtMW7TUqFP+YEQIg
-            So5A7DGxVsUcqarTUPazpIBBlO4n9zj79Qe+eQd6ti0EZG6sYX6+2Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaTNJNkJ0RVJiYlRzcmlX
+            TmEweVdLaGpoVXMxZEFDU3dOZTJCRjdiNENBCkZ3bjJUNm1vcmY1ZUpZcEo4OGxa
+            UWJKSjNKL002UDhmTmJER2M0MjJ3aG8KLS0tIFMvZjBkOS83T3NDUE82M3kweVNw
+            VXhoN0VyWkVxMEJPQ3orVUNDK21rRU0KvnmuFxcCpP+LZg7v5jaStw9F0owVrQl9
+            AkIq7GUJh7xewLxcVZfiBRpXMhw/mM8LYnd2KGP8R/TfYg+v0//+5A==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-04-23T07:00:17Z"
    mac: ENC[AES256_GCM,data:JgaTIRbzD0hs2o86xUlQrPN2cPXvsuTH/zKG5xbQIDaYcEvD/mkuVa3hfnYKrA91kWg2Y1DgEi9583+o6UCl/+ldY4ptu+xpnYfyQFdhM4rB+KoP/pDt8vQKQ3zAX8fpAkugCgTTbuvm3TfQ1nt98V8boyhCn4JHNC1T0j7ZtZI=,iv:G3YJOLeDWDKuANo2mxS2JAdrRaonD87CU9BpCZZrlRs=,tag:mcKIdP5cSQUwNL2tcv/o6g==,type:str]
--- a/hosts/pianonix/default.nix
+++ b/hosts/pianonix/default.nix
@@ -22,21 +22,44 @@
    ../common/optional/pcmanfm.nix
    ../common/optional/redshift.nix
    ../common/optional/authentication.nix
+
+    ../common/optional/avahi.nix
  ];

  # disko.devices.disk.main.device = "/dev/mmcblk1";

-  # networking.wireless.enable = true;
-  # networking.wireless.environmentFile = config.sops.secrets."wifi/pianonix".path;
-  # networking.wireless.networks = {
-  #   "@SSID@".psk = "@PSK@";
+  # enabled by fish, disabling speeds up builds
+  documentation.man.generateCaches = false;
+
+  networking.enableIPv6 = false; # This only leads to issues with avahi
+
+  hardware.bluetooth.enable = true;
+  services.blueman.enable = true; # bluetooth gui
+  # raspberry pi specific
+  # systemd.services.btattach = {
+  #   before = [ "bluetooth.service" ];
+  #   after = [ "dev-ttyAMA0.device" ];
+  #   wantedBy = [ "multi-user.target" ];
+  #   serviceConfig = {
+  #     ExecStart = "${pkgs.bluez}/bin/btattach -B /dev/ttyAMA0 -P bcm -S 3000000";
  #   };
+  # };
+  # networking.wireless.enable = true;
+  # networking.wireless.secretsFile = config.sops.secrets."wifi/pianonix".path;
+  # networking.wireless.networks = {
+  #   "SMARTments".pskRaw = "ext:PSK";
+  # };
+
+  # networking.networkmanager.enable = lib.mkForce false;
+
+  services.gnome.at-spi2-core.enable = true; # for onboard
+
  networking.hostName = "pianonix";
  system.stateVersion = "22.11";

  sops.secrets."vnc-passwd" = {
    owner = config.users.users.julian.name;
-    sopsFile = ./vnc-passwd;
+    sopsFile = ./secrets-vnc-passwd.bin;
    format = "binary";
  };
  sops.secrets."wifi/pianonix" = {};
@@ -45,6 +68,18 @@
  # sops.secrets."syncthing/public-keys/aspi-nix" = { };
  # sops.secrets."syncthing/public-keys/pianonix" = { };

+  sops.secrets."wg-config" = {
+    sopsFile = ./secrets-wg-config.bin;
+    format = "binary";
+  };
+
+  networking.wg-quick.interfaces = {
+    home = {
+      configFile = config.sops.secrets."wg-config".path;
+      autostart = true; # This interface is started on boot
+    };
+  };
+
  modules = {
    syncthing = {
      enable = true;
@@ -54,6 +89,7 @@

  # Enable the Desktop Environment.
  # services.xserver.displayManager.lightdm.enable = true;
+  services.displayManager.defaultSession = "xfce";
  services.displayManager.autoLogin = {
    enable = true;
    user = "julian";
@@ -73,10 +109,11 @@
    };
  };

-  boot.loader.timeout = 1; # Set boot loader timeout to 1s
+  boot.loader.timeout = lib.mkForce 1; # Set boot loader timeout to 1s

  # De-facto disable network manager, which is enabled by gnome
  # networking.networkmanager.unmanaged = [ "*" ];
+  services.xserver.enable = true;
  services.xserver.desktopManager = {
    xfce = {
      enable = true;
--- a/hosts/pianonix/hardware-configuration.nix
+++ b/hosts/pianonix/hardware-configuration.nix
@@ -14,9 +14,15 @@
  boot.initrd.kernelModules = [];
  boot.kernelModules = [];
  boot.extraModulePackages = [];
+  boot.kernelPackages = pkgs.linuxPackages_latest; # use latest linux kernel
+  boot.supportedFilesystems = lib.mkForce [
+    # remove zfs, since its incompatible with latest kernel
+    "vfat"
+    "ext4"
+  ];

  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
+    device = "/dev/disk/by-label/NIXOS_SD";
    fsType = "ext4";
  };

--- a/hosts/pianonix/secrets-vnc-passwd.bin
+++ b/hosts/pianonix/secrets-vnc-passwd.bin
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:13hToequR4A=,iv:U7a6mIOYanQjozPrL92edFrhdyuSJj14pqVa2tGE/zA=,tag:uyeE3dj7NTKPi0jNLkFMLA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWEFYNThYQkpuTW10MjNM\nU3pWYmE5UnBPUzhQSTltc3hXdk9EWkg5czI0CmxnK3FuYitGci9ndnRCZms4a0lD\nOWh4alF1MEtJUis5YVNyYXRLbVppNnMKLS0tIEQ5WVVIMzlIV0pnc2ZWMnc5bjE4\nR3lpbzJiRmljcWI4SWlOS2svZVBSYnMKYIfhDjNZPDxmws3Z3P55K7V/NHiukQ0u\n00Kk603U+1JhgfJBk0Y3tMo//vKCHQj87wtZoqDLEN7Gu+ZtHhkhow==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjSVpBR1NPY0svSWNWYzFC\nZE1uTjZTRm9XM24wcXByajVDYUJ4Y3FmNUc0CkJMMXRtUE5mSjYwU25MYy9xNFlP\ndUNmYmJ5RVF0dG5LYjA4L1NnNEtCMVEKLS0tIFl0Slovd2NiWjg1VXJ1VDJwTWJQ\nTWFZeW1ZYisvenVycWYwZ1lkOXBaVVUKqGu6Q8IbiUAzazLKN95uAtmXJMPzx02u\nr/R8q7ugG8lX5pWX3H3P7vtBz57Oo3rWlRpUhN/4+PpijkJNUyr3XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-12-01T16:14:57Z",
+		"mac": "ENC[AES256_GCM,data:zKz8OX1yi68Qn3X6HwdbgTCr/3ZVBh5Wz4KUACmWG3XhOEVi8uoDEdAxfKMDBqNzXLeDmxxTKj6TMLkk68ozDYJqu0OevVritnZqvBTr9VKGpMPBFN3DuaeqSZ6wjHGbce1iqO0kusnwopRbEWHmr/lZxiXTNgLPdN+p5Aszi54=,iv:resppfGPecKvKwqNwqecDBcXGhcTWSGZis8hf1jT0Us=,tag:V80P25Pr4HD9pUUrQHZSQg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
--- a/hosts/pianonix/secrets-wg-config.bin
+++ b/hosts/pianonix/secrets-wg-config.bin
@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:SFc3K1hvBjeCS6ikLZl3vIPFJqsUrZZi9yO9tVuv14exKhOuK17HN/d+cYMtVxGwqQ/biFdXYdP8/sfTPwwZgd/wRLT2xRDMOg5ru7kj8sEhcOEYmrgYRLo3ImdWANFaxelWOmjEvzphTQ7guvXTo7BACUA9AygYa9Ou9bklYImWhOCsk8e9uz5afLZXscidiqUqqFuJNo3QGMDEAxFI2YC3OpLwEj5zlsI4AXEEHRVUxU1sVtspdolDaeiFIs/JW4jLu/2la6JyGJUluYXAThzL1LO39NA/MSNskMSedatz89vnCd9CP6Q3eT93vrUYAEY=,iv:e+tWIlHm4NH1w8AQAw6tvgCX9XOiroE1XmrSua3Bcg4=,tag:RwGpKtG9JzQ3TgcnzEV5Rg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTYTFjRnpPVDAvQ0ZHZU0v\neEduOTVockFoZGhuMmZNd0w3bVFCVUQzUlI4CmZTaktOQWxrTDNpYXlPTm9SdlZZ\nN0dURmlHVFlHSjZpbkpGb09lTmVzWm8KLS0tIDhMWlFIRWFkQjcya0hjeUdUSklB\nbWlqNlVoR1BnWG9TM0RhWnI4a0J4YUEKGWIX77EVXYFVyA2u6CkF1cGfwd4Gq0Vb\nNqrlMUYEDZ5nO/eLWsAt2kj1/YFjkGw0iI02HLRHdxQ59vFyl3CS1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNlZGdktzSGp0bzIyUjlR\nUU9LSXRrZTgxcEZwczhidWVOdGRnRFYrOVZZCmx3VzM4V2dsWmZpUWxNUG82MzU2\nT3dmQjRwdmRJbTJxVm9vQjJKU3JXSncKLS0tIFlhYy9uQW5aa1E0K3Q1RUFSQkZP\nR29sY3RCYVg5bGdqMU1uc0E3Szhmb0kKFzKHUVNDdHWfycb7xWeAyIVlC4ab7ivR\nVlfmbPAXq2THw/s4zk/ckfE5RP82a1aX4++XRa7fm5KXpI8vExjJ5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-10-14T06:56:31Z",
+		"mac": "ENC[AES256_GCM,data:DrcOET5U6veg0qhcBjQQ5neCdTUufMxhIz4ZQzvzd+YxKfAqaq8R1PW5VVlUjhDBaUH9i3J1Wj6X4E600uhayY0E9I5VqfO84hqlosfZWPiWPO8prK46Y7R3Ybdh9uvWQxiaSxy8KHXsdDgsBFLlmLe/QvsDSUv56rPofkm06vg=,iv:XBFP8ANpsszeXqQIE/v7+GmZGlFtxgE/EtgL/Cc3x+8=,tag:ZJgO+hLuwIatE55wo94RVw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}
--- a/hosts/pianonix/vnc-passwd
+++ b/hosts/pianonix/vnc-passwd
@@ -1,28 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:13hToequR4A=,iv:U7a6mIOYanQjozPrL92edFrhdyuSJj14pqVa2tGE/zA=,tag:uyeE3dj7NTKPi0jNLkFMLA==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWUp5TU9kWTNpa0s5TFRC\nK1hoc0d0K3JQYWN3VVVWM2JvemtieGo2UGpVCit5MUcvZldBZkNNZ3ZWTWRtd0Zx\nT3I4aTdUcitPRmhhV0htZlhEYjhRakUKLS0tIEdmYUI4N1g1Nkp3YzdtaHJybVcz\neFNwUnd0Vyt2MTBpRTZlMzZnNHJGd1EKy/0zXv9CPf5k0ky7TBGY9GbcIeQyPk1L\nKmMCuWMLX0yTGqB3M3/UNdoc4L0q//7keUZH5PlkxJbnu6IN3fE5qg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdy9tZlZtNFJPRFNUUUNI\nUWtPZmZOY1V5SHc5bTZOZVluTUV6N3dlQWprClVqK2tKNFlBWHdyNDF1Q0d2bi9z\naldTTDdWYzZ6WmgrNHlZSDlTSU9SbmsKLS0tIDJZM2Y4ZDVmZk54eTZLOTU4Ui9X\nR3l3WDkwRWUyakFLdGZXeDJxRUJsaHMK6hgZ1KYe9qx4tO7RervEAKGjNHg4mi0E\nxx3I9P8MFzPiCVKG5ZNxRx25y7H4bQSRRtxIlXIhqzf2+5Q6U7/Hrw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hsmfz8fjxu83sax9lr487h8xr6cyge0apdq4zpge4c8jpcjj2cksj825ct",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2cUg4dUlCY0IwS3pPeTF5\nZTVkRTkzaVBYTmh0MmYyaHlOaFRHSnk5dWs4CmhvaTlSOTFDQzZmbHVudXpwQitV\nQjhRQWl3OHNLVGJYMm1ObVEyQmhxS0kKLS0tIDJsZnN4K2pUOEdIYVg4ZlQ5Ujhn\nNlpGL1hMVXd5cWR2YkdIVmJiblMzR1EKJYS51sKQ/tBV7dv88pOxJhzHQGckoF8q\nwIioVjs9sm4JBgQqSIbVhXwnKl05IUkyAgw6LfsbSJz3nKe7lmmRpg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2024-12-01T16:14:57Z",
-		"mac": "ENC[AES256_GCM,data:zKz8OX1yi68Qn3X6HwdbgTCr/3ZVBh5Wz4KUACmWG3XhOEVi8uoDEdAxfKMDBqNzXLeDmxxTKj6TMLkk68ozDYJqu0OevVritnZqvBTr9VKGpMPBFN3DuaeqSZ6wjHGbce1iqO0kusnwopRbEWHmr/lZxiXTNgLPdN+p5Aszi54=,iv:resppfGPecKvKwqNwqecDBcXGhcTWSGZis8hf1jT0Us=,tag:V80P25Pr4HD9pUUrQHZSQg==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.8.1"
-	}
-}
--- a/shell.nix
+++ b/shell.nix
@@ -3,6 +3,9 @@
    NIX_CONFIG = "extra-experimental-features = nix-command flakes ca-derivations";
    nativeBuildInputs = with pkgs; [
      nix
+      deploy-rs # for deploy
+      nixos-generators # for nixos-generate -f iso --flake .#host
+      nh # nix helper for nice interfaces
      home-manager
      git
Author	SHA1	Message	Date
Julian Mutter	c1b2b51d13	update flake Some checks failed Update Nix Flake / update-flake (push) Failing after 2m8s Details	2025-10-21 20:04:02 +02:00
Julian Mutter	28f78bb67e	flake: add nixos-generators for output pianonix-image	2025-10-21 20:03:46 +02:00
Julian Mutter	114647aa96	pianonix: update commented wireless networking config	2025-10-21 20:03:25 +02:00
Julian Mutter	64ae389f27	pianonix: update secrets for new installation	2025-10-21 20:03:12 +02:00
Julian Mutter	fd39dbfcd4	readme: update ssh-to-age command	2025-10-21 20:02:18 +02:00
Julian Mutter	b13cca7173	shell: add nix helper programs Some checks failed Update Nix Flake / update-flake (push) Failing after 20s Details	2025-10-20 19:37:44 +02:00
Julian Mutter	7807091b83	builder: use networkmanager again	2025-10-20 19:37:16 +02:00
Julian Mutter	d3026afb97	update flake	2025-10-20 19:37:05 +02:00
Julian Mutter	152daf1230	pianonix: multiple improvements, improve secrets, add wireguard, use sheetless in browser	2025-10-20 19:36:24 +02:00
Julian Mutter	ffda398f8d	builder: disable autoupgrade Some checks failed Update Nix Flake / update-flake (push) Failing after 13s Details	2025-10-09 21:29:40 +02:00
Julian Mutter	3e179960de	builder: simplify network config by using static dns list	2025-10-09 21:28:34 +02:00
Julian Mutter	93e655ed27	aspi: use wireguard via networkmanager	2025-10-09 21:28:14 +02:00