nixos: gen 222 @ nix-pad — 2026-08-03 07:35

26.05.20260724.597283a (Yarara)

.gitignore

@@ -1,3 +1,4 @@
 nix-pad.qcow2
 result
 ports.registry
+.env

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &thinkpad age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
+creation_rules:
+  - path_regex: secrets/[^/]+\.yaml$
+    key_groups:
+      - age:
+          - *thinkpad

flake.lock

@@ -228,9 +228,30 @@
         "niri": "niri",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix",
         "wvkbd-src": "wvkbd-src"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "wvkbd-src": {
       "flake": false,
       "locked": {

flake.nix

@@ -9,6 +9,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Desktop/Shell/UI
     niri.url = "github:sodiboo/niri-flake";
 
     wvkbd-src = {
@@ -32,7 +38,7 @@
     };
   };
   
-  outputs = { nixpkgs, home-manager, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
+  outputs = { nixpkgs, home-manager, sops-nix, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
     nixosConfigurations = {
       thinkpad = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
@@ -43,6 +49,7 @@
 
           niri.nixosModules.niri
           dms-plugin-registry.nixosModules.default
+          sops-nix.nixosModules.sops
 
           home-manager.nixosModules.home-manager
           {

home/jashton.nix

@@ -32,6 +32,7 @@ in
   '';
 
   home.sessionVariables = {
+    EDITOR = "nvim";
     NIXOS_OZONE_WL = "1";                    # Forces Electron/Chromium apps to use Wayland natively
     GTK_IM_MODULE = "wayland";               # Forces GTK apps to use Wayland text-input protocols
     QT_IM_MODULE = "wayland";                # Forces Qt apps to use Wayland text-input protocols
@@ -112,6 +113,7 @@ in
       $DRY_RUN_CMD mkdir -p $HOME/school
     '';
   };
+
   home.stateVersion = "26.05"; # DO NOT CHANGE
 }
 

secrets/secrets.yaml

@@ -0,0 +1,17 @@
+vaultwarden_clientid: ENC[AES256_GCM,data:MpSoam3ioiN0EaXjReSOjbKTSUwDfw2UoYldGd4GuU3+Mj3ZakzsQlw=,iv:VlgZg67Bia2IkuKtf8gPEx0rodZZ/3l9PKGEt26ihoA=,tag:yoC7AQoAa7TMJTaPObtN8A==,type:str]
+vaultwarden_clientsecret: ENC[AES256_GCM,data:RXxgt4N2bv74quQgLQ1hQsk03DwpZ9MNMZVyL3n8,iv:jBSREKIY9CraTLtwEltN2Cj2otwwWwpu4aanymWNYJA=,tag:6+z/PmGaf088urBq3TPgWg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUzZKTk1jSmpjYjhhQVJt
+            RVo3WCtqem5HWk5XdlF6YSt2czNoRVZ5VWhFCkV5ZExYVHNsZUpkcjlqQWg3K2Zx
+            dnpRYUFDdUtzd3Y5bHFFOVM4WmJRancKLS0tIEhuc0dyTFFGdThmQlozL0JYeWt0
+            Q0FvNkQwZGV2TmlQK1dTRXF4cWRZVW8K+QYGO6qJjzQKsaogR7OkUPLFVvKNMOc9
+            +KnFObbq/Axz3wfRBqFKWFnSeJ+L4j1UWpzAuwXqaPFoBrLlcRWNbw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
+    lastmodified: "2026-08-03T13:12:18Z"
+    mac: ENC[AES256_GCM,data:Rn5ihTmZg2nc7kBXUcaKg5Tlv0OgxadxL1Xh2FGI+FjZEBlhxBIPGGAXL8AlPZRoTIWofl3uUaeiP79p1TrAzaOxssM53cL39wpF2Zmk5YtdMM0Qks1Vtk7S+0QW97JoKESMFuzlBi7xmuhGKgCb8RHmleVa5WSvP2bcjOHpy8M=,iv:jKwVkaRwppHYoHSmeU8jE4NanNsirRqE1FWoCn+hLEE=,tag:L8aRqgkv56T4qA0h/JEjKg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

system/core/boot.nix

@@ -3,7 +3,7 @@
 {
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelPackages = pkgs.linuxPackages;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.kernelModules = [ "uinput" ];
   system.nixos.label = "niri-v.1.1";
   environment.pathsToLink = [ "/libexec" ];

system/core/env.nix

@@ -43,5 +43,12 @@
         "git"
       ];
     };
+
+    interactiveShellInit = ''
+      if [ -f "/run/secrets/vaultwarden_clientid" ]; then
+        export BW_CLIENTID=$(cat /run/secrets/vaultwarden_clientid)
+        export BW_CLIENTSECRET=$(cat /run/secrets/vaultwarden_clientsecret)
+      fi
+    '';
   };
 }

system/packages.nix

@@ -5,7 +5,9 @@
 
   environment.systemPackages = with pkgs; [
     acpi
+    age
     alacritty
+    bitwarden-cli
     btop
     dconf
     fastfetch
@@ -20,6 +22,7 @@
     google-chrome
     gnupg
     jq
+    keepassxc
     libnotify
     mypy
     networkmanagerapplet
@@ -30,6 +33,8 @@
     picom
     pulseaudioFull
     rnote
+    sops
+    ssh-to-age
     tldr
     tmux
     unrar

system/security/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./sops.nix
     ./sudo.nix
     ./systemd.nix
     ./users.nix

system/security/sops.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."vaultwarden_clientid".owner = config.users.users.jashton.name;
+  sops.secrets."vaultwarden_clientsecret".owner = config.users.users.jashton.name;
+}

system/services/default.nix

@@ -52,13 +52,18 @@ in
     };
   };
 
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
   services = {
     libinput = {
       enable = true;
     };
 
     openssh = {
-      enable = false;
+      enable = true;
     };
 
     upower.enable = true;