Update flake.lock 2025-04-28

.sops.yaml

@@ -1,7 +1,7 @@
 keys:
   - &primary age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg
   - &aspi-ssh age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4
-  - &builder-ssh age1kw4kmdm45zprvdkrrpvgq966l7585vhusmum083qlwnr0xxgd3uqatcyja
+  - &builder-ssh age1vwanu6jm80jzwe78jzz7z9vuzlg94tl7rpdg34vjmxcrnhddxu9q5zaf49
   - &kardorf-ssh age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5
 
 creation_rules:

Readme.org

@@ -36,3 +36,11 @@ ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub
 #+begin_src sh
 sops updatekeys secrets/*
 #+end_src
+
+* Installation of builder
+- Start recent nixos installer in VM
+- Set password for root
+  
+#+begin_src sh
+nix run github:nix-community/nixos-anywhere -- --flake git+https://gitlab.julian-mutter.de/julian/dotfiles.git#builder --target-host root@<ip>
+#+end_src

features-nixos/global/locale.nix

@@ -1,4 +1,4 @@
-{
+{pkgs, ...}: {
   # Select internationalisation properties.
   i18n.defaultLocale = "en_US.UTF-8";
 
@@ -23,4 +23,18 @@
   console.keyMap = "de";
 
   time.timeZone = "Europe/Berlin";
+
+  ## Japanese input, env vars and servic start are configured in hyprland config
+  ## Configure via program fcitx5-configuration
+  ## There, add the mozc input for japanese
+  ## This could also be done declaratively in this config, see: https://wiki.nixos.org/wiki/Fcitx5
+  i18n.inputMethod = {
+    enable = true;
+    type = "fcitx5";
+    fcitx5.addons = with pkgs; [
+      fcitx5-mozc
+      fcitx5-gtk # Ensures IME works in GTK applications
+    ];
+    fcitx5.waylandFrontend = true; # compability with wayland
+  };
 }

features-nixos/global/stylix.nix

@@ -2,11 +2,13 @@
   pkgs,
   inputs,
   ...
-}: {
-  imports = [inputs.stylix.nixosModules.stylix];
+}:
+{
+  imports = [ inputs.stylix.nixosModules.stylix ];
 
   stylix.enable = true;
   stylix.base16Scheme = "${pkgs.base16-schemes}/share/themes/catppuccin-mocha.yaml";
+  stylix.targets.gtksourceview.enable = false; # otherwise inkspace is recompiled every time
 
   stylix.fonts = {
     serif = {

features-nixos/optional/binarycaches.nix

@@ -18,7 +18,7 @@
     trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-      "binarycache.julian-mutter.de:oJ67uRFwRhNPKL58CHzy3QQLv38Kx7OA1K+6xlEPu7E="
+      "binarycache.julian-mutter.de:7RB4Sif4WQU76XWIsRJ2KtKa45zg1QOTHEkUhi/JBe8="
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
       "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="

features-nixos/optional/hydra.nix

@@ -0,0 +1,49 @@
+# Host hydra
+{...}: {
+  services.hydra = {
+    enable = true;
+    hydraURL = "http://hydra.julian-mutter.de"; # externally visible URL
+    port = 3000;
+    notificationSender = "hydra@julian-mutter.de"; # e-mail of hydra service
+    # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+    # buildMachinesFiles = [ ];
+    # you will probably also want, otherwise *everything* will be built from scratch
+    useSubstitutes = true;
+
+    minimumDiskFree = 5; # in GB
+    minimumDiskFreeEvaluator = 4; # in GB
+  };
+
+  # Uris allowed as flake inputs, otherwise hydra does not fetch them
+  nix.settings.allowed-uris = [
+    "github:"
+    "gitlab:"
+    "git+https://github.com/hyprwm/Hyprland"
+    "https://github.com/hyprwm/Hyprland"
+    "https://github"
+    "https://gitlab"
+    "https://gitlab.julian-mutter.de"
+    "git+https://gitlab.julian-mutter.de"
+  ];
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    # recommendedTlsSettings = true;
+    # other Nginx options
+    virtualHosts."hydra.julian-mutter.de" = {
+      # enableACME = true;
+      # forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3000";
+        # proxyWebsockets = true; # needed if you need to use WebSocket
+        # extraConfig =
+        #   # required when the target is also TLS server with multiple hosts
+        #   "proxy_ssl_server_name on;" +
+        #   # required when the server wants to use HTTP Authentication
+        #   "proxy_pass_header Authorization;"
+        #   ;
+      };
+    };
+  };
+}

features-nixos/optional/jenkins-agent.nix

@@ -0,0 +1,52 @@
+# Setup the device as a jenkins agent
+{pkgs, ...}: {
+  services.openssh = {
+    enable = true;
+    # require public key authentication for better security
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+    settings.PermitRootLogin = "yes";
+    # Add older algorithms for jenkins ssh-agents-plugin to be compatible
+    settings.Macs = [
+      "hmac-sha2-512-etm@openssh.com"
+      "hmac-sha2-256-etm@openssh.com"
+      "umac-128-etm@openssh.com"
+      "hmac-sha2-512"
+      "hmac-sha2-256"
+      "umac-128@openssh.com"
+    ];
+    settings.KexAlgorithms = [
+      "diffie-hellman-group-exchange-sha1"
+      "diffie-hellman-group14-sha1"
+      "mlkem768x25519-sha256"
+      "sntrup761x25519-sha512"
+      "sntrup761x25519-sha512@openssh.com"
+      "curve25519-sha256"
+      "curve25519-sha256@libssh.org"
+      "diffie-hellman-group-exchange-sha256"
+    ];
+  };
+
+  users.users.jenkins = {
+    createHome = true;
+    home = "/var/lib/jenkins";
+    group = "jenkins";
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ36sQhVz3kUEi8754G7r3rboihhG4iqFK/UvQm6SING jenkins@home"
+    ];
+    packages = with pkgs; [
+      git
+      devenv
+    ];
+    extraGroups = [
+      "docker"
+    ];
+  };
+
+  users.groups.jenkins = {};
+  programs.java = {
+    enable = true;
+    package = pkgs.jdk21; # Same as jenkins version on home
+  };
+}

features-nixos/optional/solokey.nix

@@ -0,0 +1,7 @@
+# config to make solokey1 work for ssh
+{...}: {
+  # services.pcscd.enable = true;
+
+  services.gnome.gcr-ssh-agent.enable = false;
+  programs.ssh.startAgent = true;
+}

flake.nix

@@ -25,6 +25,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    vortix = {
+      url = "github:Harry-kp/vortix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     home-manager = {
       url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";

homes/julian/features/emacs/default.nix

@@ -67,7 +67,7 @@ in {
       # neocmakelsp # cmake
 
       emacs-all-the-icons-fonts
-      frajul.typst-languagetool
+      # frajul.typst-languagetool
       ltex-ls-plus
 
       (texlive.combine {

homes/julian/features/fish/default.nix

@@ -32,6 +32,30 @@ with lib; {
     enableFishIntegration = true;
   };
 
+  programs.atuin = {
+    enable = true;
+    enableFishIntegration = true;
+    daemon.enable = true;
+    settings = {
+      auto_sync = false;
+      enter_accept = true; # execute directly on enter
+      ai = {
+        enabled = true;
+        capabilites = {
+          enable_file_tools = false;
+          enable_command_execution = false;
+          enable_history_output = false;
+          enable_history_search = true;
+        };
+        opening = {
+          # The context sent to the ai
+          send_cwd = false;
+          send_last_command = false;
+        };
+      };
+    };
+  };
+
   programs.fish = {
     enable = true;
 
@@ -43,14 +67,28 @@ with lib; {
         cd $argv
       '';
       run = ''
-        nix run --impure nixpkgs#"$argv[1]" -- $argv[2..-1]
+        set -l channel nixpkgs
+
+        if test "$argv[1]" = -u; or test "$argv[1]" = --unstable
+            set channel github:NixOS/nixpkgs/nixpkgs-unstable
+            set -e argv[1]
+        end
+        nix run --impure $channel#"$argv[1]" -- $argv[2..-1]
       '';
       shell = ''
-        set args
-        for arg in $argv
-            set args $args nixpkgs#$arg
+        set -l channel nixpkgs
+
+        if test "$argv[1]" = -u; or test "$argv[1]" = --unstable
+            set channel github:NixOS/nixpkgs/nixpkgs-unstable
+            set -e argv[1]
         end
-        nix shell --impure $args
+
+        set -l packages
+        for arg in $argv
+            set -a packages $channel#$arg
+        end
+
+        nix shell --impure $packages
       '';
       fish_user_key_bindings = ''
         bind ctrl-space 'zi; commandline -f repaint'

homes/julian/features/hyprland/default.nix

@@ -19,7 +19,7 @@
     ./waypipe.nix
 
     # ./hyprbars.nix
-    # inputs.noctalia.homeModules.default # Use for latest version from inputs
+    inputs.noctalia.homeModules.default # Use for latest version from inputs
   ];
 
   xdg.portal = {
@@ -40,16 +40,15 @@
   };
 
   # noctalia-shell ipc call state all | jq .settings | xclip
-  xdg.configFile."noctalia/settings.json".source = ./noctalia.json;
+  # xdg.configFile."noctalia/settings.json".source = ./noctalia.json;
 
-  # programs.noctalia = {
-  #   enable = true;
-  #   # noctalia config export full > noctalia.toml
-  #   settings = ./noctalia.toml;
-  # };
+  programs.noctalia = {
+    enable = true;
+    # noctalia config export full > noctalia.toml
+    settings = ./noctalia.toml;
+  };
 
   home.packages = with pkgs; [
-    unstable.noctalia-shell # Use for stable version instead of latest from the input
     hyprpicker
     hyprcursor
     brightnessctl
@@ -60,9 +59,13 @@
     wf-recorder
     wl-clipboard
 
-    (pkgs.writeShellScriptBin "toggle-screen-mirroring" (
-      builtins.readFile ./toggle-screen-mirroring.sh
-    ))
+    (pkgs.writeShellScriptBin "toggle-screen-mirroring"
+      (
+        builtins.replaceStrings
+        ["@INTERNAL_MONITOR@" "@EXTERNAL_MONITOR@"]
+        [(builtins.elemAt config.monitors 0).name (builtins.elemAt config.monitors 1).name]
+        (builtins.readFile ./toggle-screen-mirroring.sh)
+      ))
 
     (pkgs.writeShellScriptBin "correct-workspace-locations" (
       lib.concatStringsSep "\n" (
@@ -85,6 +88,7 @@
     MOZ_ENABLE_WAYLAND = 1;
     QT_QPA_PLATFORM = "wayland";
     LIBSEAT_BACKEND = "logind";
+    NIXOS_OZONE_WL = 1;
   };
 
   services.network-manager-applet.enable = true;
@@ -100,14 +104,22 @@
         local terminal = "${config.terminal}"
         local fileManager = "pcmanfm"
         -- local menu = "wofi --show drun,run"
-        -- local menu = "noctalia msg panel-toggle launcher"
-        local menu = "noctalia-shell ipc call launcher toggle"
+        local menu = "noctalia msg panel-toggle launcher"
         local calculator = "qalculate-gtk"
         local browser = "firefox"
         local editor = "emacs"
       ''
       + "-- Main config from `hyprland.lua`\n"
       + builtins.readFile ./hyprland.lua
+      + "-- Monitor config\n"
+      + lib.concatStringsSep "\n" (
+        map (
+          monitor: "hl.monitor({ output = \"${monitor.name}\", mode = \"${toString monitor.width}x${toString monitor.height}@${toString monitor.refreshRate}\", position = \"${monitor.position}\", scale = \"auto\", mirror = \"\"})"
+        )
+        config.monitors
+      )
+      + "\n-- For plugging in random monitors\n"
+      + "hl.monitor({ output = \"\", mode = \"preferred\", position = \"auto\", scale = \"auto\", mirror = \"\"})\n"
       + "-- Assign workspaces to monitors\n"
       + lib.concatStringsSep "\n" (
         builtins.concatLists (

homes/julian/features/hyprland/hyprland.lua

@@ -1,16 +1,3 @@
-------------------
----- MONITORS ----
-------------------
-
--- See https://wiki.hypr.land/Configuring/Basics/Monitors/
-hl.monitor({
-	output = "",
-	mode = "preferred",
-	position = "auto",
-	scale = "auto",
-	mirror = "",
-})
-
 -------------------
 ---- AUTOSTART ----
 -------------------
@@ -18,8 +5,9 @@ hl.monitor({
 -- See https://wiki.hypr.land/Configuring/Basics/Autostart/
 hl.on("hyprland.start", function()
 	-- hl.exec_cmd("waybar")
-	hl.exec_cmd("noctalia-shell")
+	hl.exec_cmd("env QT_QPA_PLATFORMTHEME=qt5ct noctalia") -- env ensures noctalia works alongside kde
 	hl.exec_cmd("firefox")
+	hl.exec_cmd("fcitx5 -d -r")
 end)
 hl.on("config.reloaded", function()
 	hl.exec_cmd("correct-workspace-locations")
@@ -31,6 +19,10 @@ end)
 
 -- See https://wiki.hypr.land/Configuring/Advanced-and-Cool/Environment-variables/
 hl.env("TERMINAL", terminal) -- e.g. for emacs
+-- Use fcitx for optional japanese input
+hl.env("XMODIFIERS", "@im=fcitx")
+hl.env("QT_IM_MODULE", "fcitx")
+hl.env("SDL_IM_MODULE", "fcitx")
 
 -----------------------
 ----- PERMISSIONS -----
@@ -158,6 +150,13 @@ hl.bind(mainMod .. " + SHIFT + R", hl.dsp.exec_cmd("hyprctl reload"))
 hl.bind(mainMod .. " + PRINT", hl.dsp.exec_cmd("hyprshot-gui"))
 hl.bind("PRINT", hl.dsp.exec_cmd("hyprshot-gui"))
 hl.bind(mainMod .. " + P", hl.dsp.exec_cmd("toggle-screen-mirroring; correct-workspace-locations"))
+hl.bind(mainMod .. " + SHIFT + P", function()
+    hl.device({
+        name = "wacom-one-by-wacom-m-pen",
+        output = hl.get_active_monitor().name
+    })
+end)
+-- hyprctl eval 'hl.device({ name = "wacom-one-by-wacom-m-pen", output = hl.get_active_monitor().name })' 
 hl.bind(mainMod .. " + TAB", hl.dsp.exec_cmd("swaylock --daemonize"))
 hl.bind(mainMod .. " + W", hl.dsp.exec_cmd("makoctl dismiss"))
 hl.bind(mainMod .. " + SHIFT + W", hl.dsp.exec_cmd("makoctl restore"))

homes/julian/features/hyprland/noctalia.json

@@ -1,646 +0,0 @@
-{
-  "settingsVersion": 59,
-  "bar": {
-    "barType": "simple",
-    "position": "bottom",
-    "monitors": [],
-    "density": "default",
-    "showOutline": false,
-    "showCapsule": false,
-    "capsuleOpacity": 1,
-    "capsuleColorKey": "none",
-    "widgetSpacing": 6,
-    "contentPadding": 2,
-    "fontScale": 1,
-    "enableExclusionZoneInset": false,
-    "backgroundOpacity": 1,
-    "useSeparateOpacity": false,
-    "marginVertical": 4,
-    "marginHorizontal": 4,
-    "frameThickness": 8,
-    "frameRadius": 12,
-    "outerCorners": false,
-    "hideOnOverview": false,
-    "displayMode": "always_visible",
-    "autoHideDelay": 500,
-    "autoShowDelay": 150,
-    "showOnWorkspaceSwitch": true,
-    "widgets": {
-      "left": [
-        {
-          "characterCount": 2,
-          "colorizeIcons": false,
-          "emptyColor": "secondary",
-          "enableScrollWheel": true,
-          "focusedColor": "primary",
-          "followFocusedScreen": false,
-          "fontWeight": "bold",
-          "groupedBorderOpacity": 1,
-          "hideUnoccupied": false,
-          "iconScale": 0.8,
-          "id": "Workspace",
-          "labelMode": "index",
-          "occupiedColor": "secondary",
-          "pillSize": 0.8,
-          "showApplications": false,
-          "showApplicationsHover": false,
-          "showBadge": true,
-          "showLabelsOnlyWhenOccupied": false,
-          "unfocusedIconsOpacity": 1
-        }
-      ],
-      "center": [],
-      "right": [
-        {
-          "compactMode": false,
-          "diskPath": "/",
-          "iconColor": "none",
-          "id": "SystemMonitor",
-          "showCpuCores": false,
-          "showCpuFreq": false,
-          "showCpuTemp": false,
-          "showCpuUsage": true,
-          "showDiskAvailable": true,
-          "showDiskUsage": true,
-          "showDiskUsageAsPercent": false,
-          "showGpuTemp": false,
-          "showLoadAverage": false,
-          "showMemoryAsPercent": true,
-          "showMemoryUsage": true,
-          "showNetworkStats": false,
-          "showSwapUsage": false,
-          "textColor": "none",
-          "useMonospaceFont": true,
-          "usePadding": false
-        },
-        {
-          "compactMode": false,
-          "diskPath": "/",
-          "iconColor": "none",
-          "id": "SystemMonitor",
-          "showCpuCores": false,
-          "showCpuFreq": false,
-          "showCpuTemp": false,
-          "showCpuUsage": false,
-          "showDiskAvailable": false,
-          "showDiskUsage": false,
-          "showDiskUsageAsPercent": false,
-          "showGpuTemp": false,
-          "showLoadAverage": false,
-          "showMemoryAsPercent": false,
-          "showMemoryUsage": false,
-          "showNetworkStats": true,
-          "showSwapUsage": false,
-          "textColor": "none",
-          "useMonospaceFont": true,
-          "usePadding": false
-        },
-        {
-          "displayMode": "alwaysShow",
-          "iconColor": "none",
-          "id": "Volume",
-          "middleClickCommand": "pwvucontrol || pavucontrol",
-          "textColor": "none"
-        },
-        {
-          "deviceNativePath": "__default__",
-          "displayMode": "graphic-clean",
-          "hideIfIdle": false,
-          "hideIfNotDetected": true,
-          "id": "Battery",
-          "showNoctaliaPerformance": false,
-          "showPowerProfiles": false
-        },
-        {
-          "clockColor": "none",
-          "customFont": "",
-          "formatHorizontal": "ddd, dd.MM. HH:mm:ss",
-          "formatVertical": "HH mm - dd MM",
-          "id": "Clock",
-          "tooltipFormat": "HH:mm ddd, MMM dd",
-          "useCustomFont": false
-        },
-        {
-          "blacklist": [],
-          "chevronColor": "none",
-          "colorizeIcons": false,
-          "drawerEnabled": false,
-          "hidePassive": false,
-          "id": "Tray",
-          "pinned": []
-        }
-      ]
-    },
-    "mouseWheelAction": "workspace",
-    "reverseScroll": false,
-    "mouseWheelWrap": true,
-    "middleClickAction": "launcherPanel",
-    "middleClickFollowMouse": false,
-    "middleClickCommand": "",
-    "rightClickAction": "controlCenter",
-    "rightClickFollowMouse": true,
-    "rightClickCommand": "",
-    "screenOverrides": []
-  },
-  "general": {
-    "avatarImage": "/home/julian/.face",
-    "dimmerOpacity": 0.2,
-    "showScreenCorners": false,
-    "forceBlackScreenCorners": false,
-    "scaleRatio": 1,
-    "radiusRatio": 1,
-    "iRadiusRatio": 1,
-    "boxRadiusRatio": 1,
-    "screenRadiusRatio": 1,
-    "animationSpeed": 1,
-    "animationDisabled": false,
-    "compactLockScreen": false,
-    "lockScreenAnimations": false,
-    "lockOnSuspend": true,
-    "showSessionButtonsOnLockScreen": true,
-    "showHibernateOnLockScreen": false,
-    "enableLockScreenMediaControls": false,
-    "enableShadows": true,
-    "enableBlurBehind": true,
-    "shadowDirection": "bottom_right",
-    "shadowOffsetX": 2,
-    "shadowOffsetY": 3,
-    "language": "",
-    "allowPanelsOnScreenWithoutBar": true,
-    "showChangelogOnStartup": true,
-    "telemetryEnabled": false,
-    "enableLockScreenCountdown": false,
-    "lockScreenCountdownDuration": 10000,
-    "autoStartAuth": false,
-    "allowPasswordWithFprintd": false,
-    "clockStyle": "custom",
-    "clockFormat": "hh\\nmm",
-    "passwordChars": false,
-    "lockScreenMonitors": [],
-    "lockScreenBlur": 0,
-    "lockScreenTint": 0,
-    "keybinds": {
-      "keyUp": [
-        "Up"
-      ],
-      "keyDown": [
-        "Down"
-      ],
-      "keyLeft": [
-        "Left"
-      ],
-      "keyRight": [
-        "Right"
-      ],
-      "keyEnter": [
-        "Return",
-        "Enter"
-      ],
-      "keyEscape": [
-        "Esc"
-      ],
-      "keyRemove": [
-        "Del"
-      ]
-    },
-    "reverseScroll": false,
-    "smoothScrollEnabled": true
-  },
-  "ui": {
-    "fontDefault": "DejaVu Sans",
-    "fontFixed": "DejaVu Sans Mono",
-    "fontDefaultScale": 1,
-    "fontFixedScale": 1,
-    "tooltipsEnabled": true,
-    "scrollbarAlwaysVisible": true,
-    "boxBorderEnabled": false,
-    "panelBackgroundOpacity": 1,
-    "translucentWidgets": false,
-    "panelsAttachedToBar": true,
-    "settingsPanelMode": "attached",
-    "settingsPanelSideBarCardStyle": false
-  },
-  "location": {
-    "name": "",
-    "weatherEnabled": true,
-    "weatherShowEffects": true,
-    "weatherTaliaMascotAlways": false,
-    "useFahrenheit": false,
-    "use12hourFormat": false,
-    "showWeekNumberInCalendar": false,
-    "showCalendarEvents": true,
-    "showCalendarWeather": true,
-    "analogClockInCalendar": false,
-    "firstDayOfWeek": -1,
-    "hideWeatherTimezone": false,
-    "hideWeatherCityName": false,
-    "autoLocate": false
-  },
-  "calendar": {
-    "cards": [
-      {
-        "enabled": true,
-        "id": "calendar-header-card"
-      },
-      {
-        "enabled": true,
-        "id": "calendar-month-card"
-      },
-      {
-        "enabled": true,
-        "id": "weather-card"
-      }
-    ]
-  },
-  "wallpaper": {
-    "enabled": false,
-    "overviewEnabled": false,
-    "directory": "/home/julian/Pictures/Wallpapers",
-    "monitorDirectories": [],
-    "enableMultiMonitorDirectories": false,
-    "showHiddenFiles": false,
-    "viewMode": "single",
-    "setWallpaperOnAllMonitors": true,
-    "linkLightAndDarkWallpapers": true,
-    "fillMode": "crop",
-    "fillColor": "#000000",
-    "useSolidColor": false,
-    "solidColor": "#1a1a2e",
-    "automationEnabled": false,
-    "wallpaperChangeMode": "random",
-    "randomIntervalSec": 300,
-    "transitionDuration": 1500,
-    "transitionType": [
-      "fade",
-      "disc",
-      "stripes",
-      "wipe",
-      "pixelate",
-      "honeycomb"
-    ],
-    "skipStartupTransition": false,
-    "transitionEdgeSmoothness": 0.05,
-    "panelPosition": "follow_bar",
-    "hideWallpaperFilenames": false,
-    "useOriginalImages": false,
-    "overviewBlur": 0.4,
-    "overviewTint": 0.6,
-    "useWallhaven": false,
-    "wallhavenQuery": "",
-    "wallhavenSorting": "relevance",
-    "wallhavenOrder": "desc",
-    "wallhavenCategories": "111",
-    "wallhavenPurity": "100",
-    "wallhavenRatios": "",
-    "wallhavenApiKey": "",
-    "wallhavenResolutionMode": "atleast",
-    "wallhavenResolutionWidth": "",
-    "wallhavenResolutionHeight": "",
-    "sortOrder": "name",
-    "favorites": []
-  },
-  "appLauncher": {
-    "enableClipboardHistory": false,
-    "autoPasteClipboard": false,
-    "enableClipPreview": true,
-    "clipboardWrapText": true,
-    "enableClipboardSmartIcons": true,
-    "enableClipboardChips": true,
-    "clipboardWatchTextCommand": "wl-paste --type text --watch cliphist store",
-    "clipboardWatchImageCommand": "wl-paste --type image --watch cliphist store",
-    "position": "center",
-    "pinnedApps": [],
-    "sortByMostUsed": true,
-    "terminalCommand": "alacritty -e",
-    "customLaunchPrefixEnabled": false,
-    "customLaunchPrefix": "",
-    "viewMode": "list",
-    "showCategories": true,
-    "iconMode": "tabler",
-    "showIconBackground": false,
-    "enableSettingsSearch": true,
-    "enableWindowsSearch": true,
-    "enableSessionSearch": true,
-    "ignoreMouseInput": false,
-    "screenshotAnnotationTool": "",
-    "overviewLayer": false,
-    "density": "default"
-  },
-  "controlCenter": {
-    "position": "close_to_bar_button",
-    "diskPath": "/",
-    "shortcuts": {
-      "left": [
-        {
-          "id": "Network"
-        },
-        {
-          "id": "Bluetooth"
-        },
-        {
-          "id": "WallpaperSelector"
-        },
-        {
-          "id": "NoctaliaPerformance"
-        }
-      ],
-      "right": [
-        {
-          "id": "Notifications"
-        },
-        {
-          "id": "PowerProfile"
-        },
-        {
-          "id": "KeepAwake"
-        },
-        {
-          "id": "NightLight"
-        }
-      ]
-    },
-    "cards": [
-      {
-        "enabled": true,
-        "id": "profile-card"
-      },
-      {
-        "enabled": true,
-        "id": "shortcuts-card"
-      },
-      {
-        "enabled": true,
-        "id": "audio-card"
-      },
-      {
-        "enabled": false,
-        "id": "brightness-card"
-      },
-      {
-        "enabled": true,
-        "id": "weather-card"
-      },
-      {
-        "enabled": false,
-        "id": "media-sysmon-card"
-      }
-    ]
-  },
-  "systemMonitor": {
-    "cpuWarningThreshold": 80,
-    "cpuCriticalThreshold": 90,
-    "tempWarningThreshold": 80,
-    "tempCriticalThreshold": 90,
-    "gpuWarningThreshold": 80,
-    "gpuCriticalThreshold": 90,
-    "memWarningThreshold": 80,
-    "memCriticalThreshold": 90,
-    "swapWarningThreshold": 80,
-    "swapCriticalThreshold": 90,
-    "diskWarningThreshold": 80,
-    "diskCriticalThreshold": 90,
-    "diskAvailWarningThreshold": 20,
-    "diskAvailCriticalThreshold": 10,
-    "batteryWarningThreshold": 20,
-    "batteryCriticalThreshold": 5,
-    "enableDgpuMonitoring": false,
-    "useCustomColors": false,
-    "warningColor": "",
-    "criticalColor": "",
-    "externalMonitor": "resources || missioncenter || jdsystemmonitor || corestats || system-monitoring-center || gnome-system-monitor || plasma-systemmonitor || mate-system-monitor || ukui-system-monitor || deepin-system-monitor || pantheon-system-monitor"
-  },
-  "noctaliaPerformance": {
-    "disableWallpaper": true,
-    "disableDesktopWidgets": true
-  },
-  "dock": {
-    "enabled": false,
-    "position": "bottom",
-    "displayMode": "auto_hide",
-    "dockType": "floating",
-    "backgroundOpacity": 1,
-    "floatingRatio": 1,
-    "size": 1,
-    "onlySameOutput": true,
-    "monitors": [],
-    "pinnedApps": [],
-    "colorizeIcons": false,
-    "showLauncherIcon": false,
-    "launcherPosition": "end",
-    "launcherUseDistroLogo": false,
-    "launcherIcon": "",
-    "launcherIconColor": "none",
-    "pinnedStatic": false,
-    "inactiveIndicators": false,
-    "groupApps": false,
-    "groupContextMenuMode": "extended",
-    "groupClickAction": "cycle",
-    "groupIndicatorStyle": "dots",
-    "deadOpacity": 0.6,
-    "animationSpeed": 1,
-    "sitOnFrame": false,
-    "showDockIndicator": false,
-    "indicatorThickness": 3,
-    "indicatorColor": "primary",
-    "indicatorOpacity": 0.6
-  },
-  "network": {
-    "bluetoothRssiPollingEnabled": false,
-    "bluetoothRssiPollIntervalMs": 60000,
-    "networkPanelView": "wifi",
-    "wifiDetailsViewMode": "grid",
-    "bluetoothDetailsViewMode": "grid",
-    "bluetoothHideUnnamedDevices": false,
-    "disableDiscoverability": false,
-    "bluetoothAutoConnect": true
-  },
-  "sessionMenu": {
-    "enableCountdown": false,
-    "countdownDuration": 10000,
-    "position": "center",
-    "showHeader": true,
-    "showKeybinds": true,
-    "largeButtonsStyle": false,
-    "largeButtonsLayout": "single-row",
-    "powerOptions": [
-      {
-        "action": "lock",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": true,
-        "keybind": "1"
-      },
-      {
-        "action": "suspend",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": false,
-        "keybind": ""
-      },
-      {
-        "action": "hibernate",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": false,
-        "keybind": ""
-      },
-      {
-        "action": "reboot",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": true,
-        "keybind": "2"
-      },
-      {
-        "action": "logout",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": true,
-        "keybind": "3"
-      },
-      {
-        "action": "shutdown",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": true,
-        "keybind": "4"
-      },
-      {
-        "action": "rebootToUefi",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": false,
-        "keybind": ""
-      },
-      {
-        "action": "userspaceReboot",
-        "command": "",
-        "countdownEnabled": true,
-        "enabled": false,
-        "keybind": ""
-      }
-    ]
-  },
-  "notifications": {
-    "enabled": false,
-    "enableMarkdown": false,
-    "density": "default",
-    "monitors": [],
-    "location": "top_right",
-    "overlayLayer": true,
-    "backgroundOpacity": 1,
-    "respectExpireTimeout": false,
-    "lowUrgencyDuration": 3,
-    "normalUrgencyDuration": 8,
-    "criticalUrgencyDuration": 15,
-    "clearDismissed": true,
-    "saveToHistory": {
-      "low": true,
-      "normal": true,
-      "critical": true
-    },
-    "sounds": {
-      "enabled": false,
-      "volume": 0.5,
-      "separateSounds": false,
-      "criticalSoundFile": "",
-      "normalSoundFile": "",
-      "lowSoundFile": "",
-      "excludedApps": "discord,firefox,chrome,chromium,edge"
-    },
-    "enableMediaToast": false,
-    "enableKeyboardLayoutToast": true,
-    "enableBatteryToast": true
-  },
-  "osd": {
-    "enabled": true,
-    "location": "top_right",
-    "autoHideMs": 2000,
-    "overlayLayer": true,
-    "backgroundOpacity": 1,
-    "enabledTypes": [
-      0,
-      1,
-      2
-    ],
-    "monitors": []
-  },
-  "audio": {
-    "volumeStep": 5,
-    "volumeOverdrive": false,
-    "spectrumFrameRate": 30,
-    "visualizerType": "linear",
-    "spectrumMirrored": true,
-    "mprisBlacklist": [],
-    "preferredPlayer": "",
-    "volumeFeedback": false,
-    "volumeFeedbackSoundFile": ""
-  },
-  "brightness": {
-    "brightnessStep": 5,
-    "enforceMinimum": true,
-    "enableDdcSupport": false,
-    "backlightDeviceMappings": []
-  },
-  "colorSchemes": {
-    "useWallpaperColors": false,
-    "predefinedScheme": "Noctalia (default)",
-    "darkMode": true,
-    "schedulingMode": "off",
-    "manualSunrise": "06:30",
-    "manualSunset": "18:30",
-    "generationMethod": "tonal-spot",
-    "monitorForColors": "",
-    "syncGsettings": true
-  },
-  "templates": {
-    "activeTemplates": [],
-    "enableUserTheming": false
-  },
-  "nightLight": {
-    "enabled": true,
-    "forced": false,
-    "autoSchedule": true,
-    "nightTemp": "4000",
-    "dayTemp": "6500",
-    "manualSunrise": "06:30",
-    "manualSunset": "18:30"
-  },
-  "hooks": {
-    "enabled": false,
-    "wallpaperChange": "",
-    "darkModeChange": "",
-    "screenLock": "",
-    "screenUnlock": "",
-    "performanceModeEnabled": "",
-    "performanceModeDisabled": "",
-    "startup": "",
-    "session": "",
-    "colorGeneration": ""
-  },
-  "plugins": {
-    "autoUpdate": false,
-    "notifyUpdates": true
-  },
-  "idle": {
-    "enabled": false,
-    "screenOffTimeout": 600,
-    "lockTimeout": 660,
-    "suspendTimeout": 1800,
-    "fadeDuration": 5,
-    "screenOffCommand": "",
-    "lockCommand": "",
-    "suspendCommand": "",
-    "resumeScreenOffCommand": "",
-    "resumeLockCommand": "",
-    "resumeSuspendCommand": "",
-    "customCommands": "[]"
-  },
-  "desktopWidgets": {
-    "enabled": false,
-    "overviewEnabled": true,
-    "gridSnap": false,
-    "gridSnapScale": false,
-    "monitorWidgets": []
-  }
-}

homes/julian/features/hyprland/toggle-screen-mirroring.sh

@@ -2,18 +2,17 @@
 
 # A hyprland script for a laptop-external-monitor setup, toggling between which is in use
 
-# TODO: Detect these instead of hardcoding them
-INTERNAL_MONITOR="eDP-1"
-EXTERNAL_MONITOR="HDMI-A-1"
+INTERNAL_MONITOR="@INTERNAL_MONITOR@"
+EXTERNAL_MONITOR="@EXTERNAL_MONITOR@"
 
-MIRROR_SETTING=$(hyprctl monitors all -j | jq -r '.[] | select(.name == "HDMI-A-1") | .mirrorOf')
+MIRROR_SETTING=$(hyprctl monitors all -j | jq -r --arg EXTERNAL "$EXTERNAL_MONITOR" '.[] | select(.name == $EXTERNAL) | .mirrorOf')
 
 echo "current setting: "
 echo $MIRROR_SETTING
 if [ "$MIRROR_SETTING" = "none" ]; then
-    echo "mirroring..."
-    hyprctl eval "hl.monitor({output=\"$EXTERNAL_MONITOR\", mode=\"preferred\", position=\"auto\", scale=\"auto\", mirror=\"$INTERNAL_MONITOR\"})"
+	echo "mirroring..."
+	hyprctl eval "hl.monitor({output=\"$EXTERNAL_MONITOR\", mode=\"preferred\", position=\"auto\", scale=\"auto\", mirror=\"$INTERNAL_MONITOR\"})"
 else
-    # hyprctl keyword monitor "$EXTERNAL_MONITOR, disable" # shortly disable monitor so waybar recognizes the new monitor again # TODO: find better solution
-    hyprctl eval "hl.monitor({output=\"$EXTERNAL_MONITOR\", mode=\"preferred\", position=\"auto\", scale=\"auto\", mirror=\"\"})"
+	# hyprctl keyword monitor "$EXTERNAL_MONITOR, disable" # shortly disable monitor so waybar recognizes the new monitor again # TODO: find better solution
+	hyprctl eval "hl.monitor({output=\"$EXTERNAL_MONITOR\", mode=\"preferred\", position=\"auto\", scale=\"auto\", mirror=\"\"})"
 fi

homes/julian/features/suites/desktop/default.nix

@@ -18,6 +18,11 @@
   };
 
   home.packages = with pkgs; [
+    (anki.withAddons [
+      ankiAddons.anki-connect
+      ankiAddons.passfail2
+      ankiAddons.review-heatmap
+    ])
     arandr
     calibre # ebook manager and viewer
     # digikam
@@ -48,7 +53,7 @@
     qpdfview
     # qutebrowser
     # realvnc-vnc-viewer
-    # rpi-imager # make isos
+    rpi-imager # make isos
     # rustdesk
     tor-browser
     rusty-path-of-building # Path of Building for poe1 and poe2
@@ -65,6 +70,9 @@
     networkmanager-openvpn
     keepassxc
 
+    unstable.joplin-desktop
+    unstable.libation
+
     ## My scripts
     frajul.open-messaging
     frajul.xwacomcalibrate

homes/julian/features/suites/development/default.nix

@@ -1,10 +1,18 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  inputs,
+  ...
+}: {
   programs.opencode = {
     enable = true;
     package = pkgs.unstable.opencode;
   };
 
   home.packages = with pkgs; [
+    inputs.vortix.packages.${pkgs.system}.default # tui for wireguard
+
+    worktrunk # interface for git worktrees
+
     watchexec # Run command when any file in current dir changes
     android-tools # adb
     # shellcheck # Check bash scripts for common errors

homes/julian/kardorf.nix

@@ -26,34 +26,44 @@
   is-nixos = true;
   terminal = "alacritty";
 
-  #  ---------   ---------
-  # | DVI-D-1 | | DVI-D-2 |
-  #  ---------   ---------
+  #  ----------   --------   ---------
+  # | HDMI-A-1 | |  DP-1  | | DVI-D-1 |
+  #  ----------   --------   ---------
   monitors = [
     {
-      name = "DVI-D-1";
-      width = 1680;
-      height = 1050;
+      name = "HDMI-A-1";
+      width = 1920;
+      height = 1080;
+      position = "0x0";
       workspaces = [
-        "1"
-        "2"
-        "3"
-        "4"
-        "5"
-      ];
-      primary = true;
-    }
-    {
-      name = "DVI-D-2";
-      width = 1680;
-      height = 1050;
-      workspaces = [
-        "6"
-        "7"
         "8"
         "9"
         "10"
       ];
     }
+    {
+      name = "DP-1";
+      width = 1680;
+      height = 1050;
+      position = "1920x0";
+      workspaces = [
+        "1"
+        "2"
+        "3"
+        "4"
+      ];
+      primary = true;
+    }
+    {
+      name = "DVI-D-1";
+      width = 1680;
+      height = 1050;
+      position = "3600x0";
+      workspaces = [
+        "5"
+        "6"
+        "7"
+      ];
+    }
   ];
 }

hosts/aspi/default.nix

@@ -24,6 +24,7 @@
     "${pwd}/features-nixos/optional/k9s"
 
     "${pwd}/features-nixos/optional/avahi.nix"
+    "${pwd}/features-nixos/optional/solokey.nix"
   ];
 
   networking.hostName = "aspi";
@@ -31,6 +32,9 @@
 
   # networking.firewall.checkReversePath = false; # Makes wg interface with all ips work
 
+  programs.ausweisapp.enable = true;
+  programs.ausweisapp.openFirewall = true; # for pairing with smartphone
+
   modules = {
     syncthing = {
       enable = true;

hosts/builder/default.nix

@@ -4,18 +4,37 @@
 {
   pwd,
   config,
-  pkgs,
+  inputs,
+  outputs,
+  lib,
   ...
 }: {
-  imports = [
-    ./hardware-configuration.nix
+  imports =
+    [
+      inputs.disko.nixosModules.disko
 
-    "${pwd}/features-nixos/global/fish.nix" # fish for admin
-    "${pwd}/features-nixos/global/locale.nix"
-    "${pwd}/features-nixos/global/nix.nix"
-    "${pwd}/features-nixos/global/sops.nix"
-    "${pwd}/features-nixos/global/root.nix"
-  ];
+      ./disko.nix
+      ./hardware-configuration.nix
+
+      "${pwd}/features-nixos/global/fish.nix" # fish for admin
+      "${pwd}/features-nixos/global/locale.nix"
+      "${pwd}/features-nixos/global/nix.nix"
+      "${pwd}/features-nixos/global/sops.nix"
+      "${pwd}/features-nixos/global/root.nix"
+
+      # "${pwd}/features-nixos/optional/hydra.nix"
+      # "${pwd}/features-nixos/optional/jenkins-agent.nix"
+    ]
+    ++ (builtins.attrValues outputs.nixosModules);
+
+  frajul.gitlab-runner = {
+    enable = false;
+    secretsFile = ./secrets.yaml;
+  };
+  frajul.gitea-runner = {
+    enable = true;
+    secretsFile = ./secrets.yaml;
+  };
 
   networking.hostName = "builder";
   system.stateVersion = "23.11";
@@ -66,22 +85,22 @@
     fallback = true;
   };
 
-  # system.autoUpgrade = {
-  #   enable = true;
-  #   flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
-  #   flags = [
-  #     "--recreate-lock-file" # update lock file
-  #   ];
-  #   dates = "02:13";
-  # };
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
+    flags = [
+      "--recreate-lock-file" # update lock file
+    ];
+    dates = "02:13";
+  };
 
   # optimize store by hardlinking store files
-  nix.optimise.automatic = true;
-  nix.optimise.dates = ["03:15"];
+  nix.optimise.automatic = lib.mkForce true;
+  nix.optimise.dates = lib.mkForce ["03:15"];
 
-  # nix.gc.automatic = true;
-  # nix.gc.dates = "daily";
-  # nix.gc.options = "--delete-old";
+  nix.gc.automatic = lib.mkForce true;
+  nix.gc.dates = lib.mkForce "daily";
+  nix.gc.options = lib.mkForce "--delete-old";
 
   # nix.settings.keep-derivations = false;
   # nix.settings.keep-outputs = true;
@@ -101,55 +120,12 @@
     OOMScoreAdjust = 500;
   };
 
-  # Ollama used by open-webui as llm backend
-  # services.ollama = {
-  #   enable = true;
-  #   # acceleration = "rocm";
-  #   openFirewall = true;
-  # };
-
-  # services.nextjs-ollama-llm-ui = {
-  #   enable = true;
-  #   hostname = "192.168.3.118";
-  #   port = 3001;
-  # };
-  # services.open-webui = {
-  #   enable = true;
-  #   port = 8080;
-  #   openFirewall = true;
-  #   host = "builder.julian-mutter.de";
-  # };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    3001 # ollama-ui
-  ];
-
   services.openssh = {
     enable = true;
     # require public key authentication for better security
     settings.PasswordAuthentication = false;
     settings.KbdInteractiveAuthentication = false;
     settings.PermitRootLogin = "yes";
-    # Add older algorithms for jenkins ssh-agents-plugin to be compatible
-    settings.Macs = [
-      "hmac-sha2-512-etm@openssh.com"
-      "hmac-sha2-256-etm@openssh.com"
-      "umac-128-etm@openssh.com"
-      "hmac-sha2-512"
-      "hmac-sha2-256"
-      "umac-128@openssh.com"
-    ];
-    settings.KexAlgorithms = [
-      "diffie-hellman-group-exchange-sha1"
-      "diffie-hellman-group14-sha1"
-      "mlkem768x25519-sha256"
-      "sntrup761x25519-sha512"
-      "sntrup761x25519-sha512@openssh.com"
-      "curve25519-sha256"
-      "curve25519-sha256@libssh.org"
-      "diffie-hellman-group-exchange-sha256"
-    ];
   };
   users.users."root".openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
@@ -163,20 +139,6 @@
 
   # security.pam.sshAgentAuth.enable = true; # enable sudo via ssh
 
-  services.hydra = {
-    enable = true;
-    hydraURL = "http://hydra.julian-mutter.de"; # externally visible URL
-    port = 3000;
-    notificationSender = "hydra@julian-mutter.de"; # e-mail of hydra service
-    # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
-    # buildMachinesFiles = [ ];
-    # you will probably also want, otherwise *everything* will be built from scratch
-    useSubstitutes = true;
-
-    minimumDiskFree = 5; # in GB
-    minimumDiskFreeEvaluator = 4; # in GB
-  };
-
   # add builder itpwd as build machine so system emulation is properly supported
   # nix.distributedBuilds = true;
   nix.buildMachines = [
@@ -199,97 +161,30 @@
     }
   ];
 
-  # Uris allowed as flake inputs, otherwise hydra does not fetch them
-  nix.settings.allowed-uris = [
-    "github:"
-    "gitlab:"
-    "git+https://github.com/hyprwm/Hyprland"
-    "https://github.com/hyprwm/Hyprland"
-    "https://github"
-    "https://gitlab"
-    "https://gitlab.julian-mutter.de"
-    "git+https://gitlab.julian-mutter.de"
+  networking.firewall.allowedTCPPorts = [
+    80
   ];
-
   services.nginx = {
     enable = true;
     recommendedProxySettings = true;
-    # recommendedTlsSettings = true;
-    # other Nginx options
-    virtualHosts."hydra.julian-mutter.de" = {
-      # enableACME = true;
-      # forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:3000";
-        # proxyWebsockets = true; # needed if you need to use WebSocket
-        # extraConfig =
-        #   # required when the target is also TLS server with multiple hosts
-        #   "proxy_ssl_server_name on;" +
-        #   # required when the server wants to use HTTP Authentication
-        #   "proxy_pass_header Authorization;"
-        #   ;
-      };
-    };
 
+    # nix-serve
     virtualHosts."binarycache.julian-mutter.de" = {
       locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
     };
 
+    # attic
     clientMaxBodySize = "2G";
     virtualHosts."cache.julian-mutter.de" = {
       locations."/".proxyPass = "http://127.0.0.1:8080";
     };
   };
 
-  # =========== Gitea actions ==========
-  services.gitea-actions-runner.instances."builder" = {
-    enable = true;
-    url = "https://gitlab.julian-mutter.de";
-    name = "builder";
-    tokenFile = config.sops.secrets."gitea_token".path;
-    labels = [
-      # fake the ubuntu name, because node provides no ubuntu builds
-      "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-      # my custom nix+devenv ci container
-      "nix-ci:docker://gitlab.julian-mutter.de/julian/nix-ci-container:latest"
-      # devenv
-      "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
-      # provide native execution on the host
-      "nixos:host"
-    ];
-    # Packages are intjected into PATH for "nixos:host"
-    hostPackages = with pkgs; [
-      bash
-      coreutils
-      curl
-      gawk
-      gitMinimal
-      nodejs # Required by many standard actions (like actions/checkout)
-      docker
-      devenv
-      wget
-      nix
-    ];
-  };
-
-  virtualisation.docker.enable = true;
-
-  # TODO: podman fails with: "cannot resolve hostname"
-  # virtualisation.podman = {
-  #   enable = true;
-  #   dockerCompat = true;
-  #   defaultNetwork.settings.dns_enabled = true;
-  # };
-
-  sops.secrets."gitea_token" = {
-    owner = config.users.users.nix.name;
-    sopsFile = ./secrets.yaml;
-  };
-
   # =========== Binary Cache ==========
+  sops.secrets."nix_serve_key".sopsFile = ./secrets.yaml;
   services.nix-serve = {
     enable = true;
-    secretKeyFile = "/var/cache-priv-key.pem";
+    secretKeyFile = config.sops.secrets."nix_serve_key".path;
   };
 
   # =========== Binary Cache with attic ==========
@@ -327,41 +222,4 @@
       };
     };
   };
-
-  services.gitlab-runner.enable = true;
-  # runner for everything else
-  #
-  sops.secrets."gitlab_runner_token".sopsFile = ./secrets.yaml;
-  services.gitlab-runner.services.default = {
-    # File should contain at least these two variables:
-    authenticationTokenConfigFile = config.sops.secrets."gitlab_runner_token".path;
-    dockerImage = "alpine:latest";
-    dockerVolumes = [
-      "/var/run/docker.sock:/var/run/docker.sock"
-    ];
-  };
-
-  ### Jenkins node
-  users.users.jenkins = {
-    createHome = true;
-    home = "/var/lib/jenkins";
-    group = "jenkins";
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ36sQhVz3kUEi8754G7r3rboihhG4iqFK/UvQm6SING jenkins@home"
-    ];
-    packages = with pkgs; [
-      git
-      devenv
-    ];
-    extraGroups = [
-      "docker"
-    ];
-  };
-
-  users.groups.jenkins = {};
-  programs.java = {
-    enable = true;
-    package = pkgs.jdk21; # Same as jenkins version on home
-  };
 }

hosts/builder/disko.nix

@@ -0,0 +1,56 @@
+# Example to create a bios compatible gpt partition
+{ lib, ... }:
+{
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [
+                "defaults"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/builder/hardware-configuration.nix

@@ -7,43 +7,13 @@
     "sd_mod"
     "sr_mod"
   ];
-  # boot.initrd.kernelModules = [ "amdgpu" ]; # GPU support
   boot.kernelModules = [];
   boot.extraModulePackages = [];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/f088fe8e-bf3d-4a89-98bd-ead9852d381f";
-    fsType = "ext4";
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
   networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
-  # hardware.graphics = {
-  #   enable = true;
-  #   extraPackages = with pkgs; [
-  #     rocmPackages.clr.icd
-  #     linuxPackages.amdgpu-pro
-  #   ];
-  # };
-
-  # boot.kernelParams = [
-  #   "radeon.si_support=0"
-  #   "radeon.cik_support=1"
-  #   "amdgpu.si_support=0"
-  #   "amdgpu.cik_support=1"
-  # ];
-  # boot.extraModulePackages = with config.boot.kernelPackages; [ amdgpu-pro ];
-  # boot.blacklistedKernelModules = [ "radeon" ];
-
   boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sda";
 
   # Emulated systems used as alternative to cross-compiling
   boot.binfmt.emulatedSystems = ["aarch64-linux"];

hosts/builder/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINgH+4xJMk4K5uBIq4hKwar4wt6GYCRE3Z2S4HETc4TK root@builder

hosts/kardorf/default.nix

@@ -11,7 +11,7 @@
     "${pwd}/features-nixos/users/wolfi"
     "${pwd}/features-nixos/optional/binarycaches.nix"
 
-    "${pwd}/features-nixos/optional/remote-builder.nix"
+    # "${pwd}/features-nixos/optional/remote-builder.nix"
     "${pwd}/features-nixos/optional/boot-efi.nix"
 
     "${pwd}/features-nixos/optional/greetd.nix"
@@ -26,15 +26,22 @@
     "${pwd}/features-nixos/optional/podman.nix"
     "${pwd}/features-nixos/optional/wireshark.nix"
     "${pwd}/features-nixos/optional/flatpak.nix"
+    "${pwd}/features-nixos/optional/k9s"
+    "${pwd}/features-nixos/optional/solokey.nix"
   ];
 
   networking.hostName = "kardorf";
   system.stateVersion = "22.11";
 
-  # Not using the drivers leads to way better results
-  # services.xserver.videoDrivers = [ "nvidia" ];
+  programs.ausweisapp.enable = true;
+  programs.ausweisapp.openFirewall = true; # for pairing with smartphone
 
-  networking.networkmanager.insertNameservers = ["192.168.3.252"];
+  modules = {
+    syncthing = {
+      enable = true;
+      overrideSettings = false;
+    };
+  };
 
   programs.kdeconnect.enable = true;
   programs.steam.enable = true;

hosts/kardorf/hardware-configuration.nix

@@ -1,89 +1,59 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
+  modulesPath,
   ...
 }: {
-  boot.initrd.availableKernelModules = [
-    "ehci_pci"
-    "ahci"
-    "xhci_pci"
-    "usbhid"
-    "uas"
-    "usb_storage"
-    "sd_mod"
-    "sr_mod"
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
+
+  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "sd_mod"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-intel"];
   boot.extraModulePackages = [];
+
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/97a9342e-0be0-4193-9a25-03400fc7da94";
     fsType = "btrfs";
-    options = [
-      "subvol=root"
-      "compress=zstd"
-    ];
-  };
-
-  fileSystems."/home" = {
-    device = "/dev/disk/by-uuid/97a9342e-0be0-4193-9a25-03400fc7da94";
-    fsType = "btrfs";
-    options = [
-      "subvol=home"
-      "compress=zstd"
-    ];
+    options = ["subvol=root"];
   };
 
   fileSystems."/nix" = {
     device = "/dev/disk/by-uuid/97a9342e-0be0-4193-9a25-03400fc7da94";
     fsType = "btrfs";
-    options = [
-      "subvol=nix"
-      "compress=zstd"
-      "noatime"
-    ];
+    options = ["subvol=nix"];
   };
 
   fileSystems."/swap" = {
     device = "/dev/disk/by-uuid/97a9342e-0be0-4193-9a25-03400fc7da94";
     fsType = "btrfs";
-    options = [
-      "subvol=swap"
-      "noatime"
-    ];
+    options = ["subvol=swap"];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/97a9342e-0be0-4193-9a25-03400fc7da94";
+    fsType = "btrfs";
+    options = ["subvol=home"];
   };
 
   fileSystems."/boot/efi" = {
     device = "/dev/disk/by-uuid/7D48-A59C";
     fsType = "vfat";
+    options = ["fmask=0022" "dmask=0022"];
   };
 
-  swapDevices = [
-    {
-      device = "/swap/swapfile";
-      size = 16 * 1024;
-    }
-  ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.docker0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+  swapDevices = [];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  # Use latest version of driver
-  # hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.legacy_470;
-  hardware.nvidia.modesetting.enable = true; # produces errors, display manager fails to start
 
-  hardware.nvidia.nvidiaSettings = true;
-  hardware.nvidia.open = false;
+  services.xserver.videoDrivers = ["nvidia"];
+
+  hardware.nvidia = {
+    modesetting.enable = true;
+    open = false;
+  };
 }

modules/nixos/default.nix

@@ -3,4 +3,6 @@
   syncthing = import ./syncthing.nix;
   frajulAutoUpgrade = import ./frajul-auto-upgrade.nix;
   pianoLEDVisualizer = import ./piano-led-visualizer.nix;
+  gitea-runner = import ./gitea-runner.nix;
+  gitlab-runner = import ./gitlab-runner.nix;
 }

modules/nixos/gitea-runner.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.frajul.gitea-runner;
+in {
+  options = {
+    frajul.gitea-runner = {
+      enable = lib.mkEnableOption "gitea-runner";
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
+        description = "A sops encrpyted file containing a 'gitea_token' secret";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker.enable = true;
+
+    sops.secrets."gitea_token" = {
+      owner = config.users.users.nix.name;
+      sopsFile = cfg.secretsFile;
+    };
+
+    services.gitea-actions-runner.instances."builder" = {
+      enable = true;
+      url = "https://gitlab.julian-mutter.de";
+      name = "builder";
+      tokenFile = config.sops.secrets."gitea_token".path;
+      labels = [
+        # fake the ubuntu name, because node provides no ubuntu builds
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        # my custom nix+devenv ci container
+        "nix-ci:docker://gitlab.julian-mutter.de/julian/nix-ci-container:latest"
+        # devenv
+        "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
+        # provide native execution on the host
+        "nixos:host"
+      ];
+      # Packages are intjected into PATH for "nixos:host"
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        nodejs # Required by many standard actions (like actions/checkout)
+        docker
+        devenv
+        wget
+        nix
+      ];
+    };
+  };
+}

modules/nixos/gitlab-runner.nix

@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.frajul.gitlab-runner;
+in {
+  options = {
+    frajul.gitlab-runner = {
+      enable = lib.mkEnableOption "gitlab-runner";
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
+        description = "A sops encrpyted file containing a 'gitlab_runner_token' secret";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.gitlab-runner.enable = true;
+
+    sops.secrets."gitlab_runner_token".sopsFile = cfg.secretsFile;
+    services.gitlab-runner.services.default = {
+      # File should contain at least these two variables:
+      authenticationTokenConfigFile = config.sops.secrets."gitlab_runner_token".path;
+      dockerImage = "alpine:latest";
+      dockerVolumes = [
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ];
+    };
+  };
+}

packages/smath-studio.nix

@@ -1,17 +1,19 @@
 {
+  lib,
   appimageTools,
   fetchurl,
   libgdiplus,
 }: let
   pname = "smath-studio";
-  version = "1.3.0.9126";
+  version = "1.5.0.9678";
 
   src = fetchurl {
-    url = "https://smath.com/en-US/files/Download/cqSek/SMathStudioDesktop.1_3_0_9126.x86_64.ubuntu-22_04.glibc2.35.AppImage";
-    hash = "sha256-4FpdFGPFaPDK6WWSJHVtxcC8auaNkGmHyUtbegij6cQ=";
+    # The code after /Download/ changes per release
+    url = "https://smath.com/en-US/files/Download/c4zCE/SMathStudioDesktop.1_5_0_9678.x86_64.ubuntu-22_04.glibc2.35.AppImage";
+    hash = "sha256-6lnuRnhoH6E+jIZXSgb/Pz9wE9nVAbduDHrkKCKKH+Y=";
   };
 
-  appimageContents = appimageTools.extractType2 {
+  appimageContents = appimageTools.extract {
     inherit pname version src;
   };
 in
@@ -30,6 +32,22 @@ in
     extraInstallCommands = ''
       install -m 444 -D ${appimageContents}/*.desktop -t $out/share/applications
       sed -i "s|^Exec=.*|Exec=smath-studio %U|" $out/share/applications/*.desktop
-      cp -r ${appimageContents}/usr/share/icons $out/share
+
+      # Package icons into /apps directory
+      for icon in ${appimageContents}/usr/share/icons/hicolor/*/*.png; do
+        if [ -f "$icon" ]; then
+          size=$(basename $(dirname "$icon"))
+          install -m 444 -D "$icon" "$out/share/icons/hicolor/$size/apps/smath.png"
+        fi
+      done
     '';
+
+    meta = with lib; {
+      description = "Tiny, powerful, free mathematical program with WYSIWYG editor and complete units of measurements support";
+      homepage = "https://smath.com/";
+      license = licenses.unfree; # SMath is freeware, but closed source
+      # maintainers = with maintainers; [frajul];
+      mainProgram = "smath-studio";
+      platforms = ["x86_64-linux"];
+    };
   }