nixos: gen 14 @ lavender — 2026-08-06 23:08 26.05.20260724.597283a (Yarara) -----

26.05.20260724.597283a (Yarara)

.gitignore

@@ -1,3 +1,4 @@
 nix-pad.qcow2
 result
 ports.registry
+.env

.sops.yaml

@@ -0,0 +1,9 @@
+keys:
+  - &lavender age1az6l56h4m38jw2hm7t7a99wp9f88s845sg29grtmdpz72lrkc5cq66kmcv
+  - &violet age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
+creation_rules:
+  - path_regex: secrets/[^/]+\.yaml$
+    key_groups:
+      - age:
+          - *lavender
+          - *violet

flake.lock

@@ -228,9 +228,30 @@
         "niri": "niri",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix",
         "wvkbd-src": "wvkbd-src"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "wvkbd-src": {
       "flake": false,
       "locked": {

flake.nix

@@ -9,6 +9,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Desktop/Shell/UI
     niri.url = "github:sodiboo/niri-flake";
 
     wvkbd-src = {
@@ -32,17 +38,18 @@
     };
   };
   
-  outputs = { nixpkgs, home-manager, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
+  outputs = { nixpkgs, home-manager, sops-nix, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
     nixosConfigurations = {
-      thinkpad = nixpkgs.lib.nixosSystem {
+      violet = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         specialArgs = { inherit inputs; };
 
         modules = [
-          ./hosts/thinkpad/default.nix
+          ./hosts/violet/default.nix
 
           niri.nixosModules.niri
           dms-plugin-registry.nixosModules.default
+          sops-nix.nixosModules.sops
 
           home-manager.nixosModules.home-manager
           {
@@ -60,6 +67,31 @@
         ];
       };
 
+      lavender = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
+
+        modules = [
+          ./hosts/lavender/default.nix
+
+          niri.nixosModules.niri
+          dms-plugin-registry.nixosModules.default
+          sops-nix.nixosModules.sops
+
+          home-manager.nixosModules.home-manager {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = { inherit inputs; };
+
+            home-manager.users.jashton = {
+              imports = [
+                ./home/jashton.nix
+                danksearch.homeModules.default
+              ];
+            };
+          }
+        ];
+      };
     };
   };
 }

home/desktop/niri.nix

@@ -72,7 +72,7 @@ in
       layout = {
         gaps = 8;
         center-focused-column = "never";
-        default-column-width.proportion = 0.985;
+        default-column-width.proportion = 1.0;
         border.enable = false;
         #tab-indicator.corner-radius = 18.0;
         focus-ring = {
@@ -95,22 +95,6 @@ in
           draw-border-with-background = true;
           clip-to-geometry = true;
         }
-        {
-          matches = [
-            {
-              app-id = "google-chrome";
-              title = "^Picture-in-Picture$";
-            }
-          ];
-          open-floating = true;
-          default-column-width = { fixed = 480; };
-          default-window-height = { fixed = 270; };
-          default-floating-position = {
-            x = 32;
-            y = 32;
-            relative-to = "bottom-left";
-          };
-        }
       ];
 
       # Vim Keybindings & Built-in Features

home/jashton.nix

@@ -32,6 +32,7 @@ in
   '';
 
   home.sessionVariables = {
+    EDITOR = "nvim";
     NIXOS_OZONE_WL = "1";                    # Forces Electron/Chromium apps to use Wayland natively
     GTK_IM_MODULE = "wayland";               # Forces GTK apps to use Wayland text-input protocols
     QT_IM_MODULE = "wayland";                # Forces Qt apps to use Wayland text-input protocols
@@ -39,22 +40,16 @@ in
   };
   
   home.packages = with pkgs; [
-    aider-chat
-    animdl
     antigravity
     asciinema
     discord
     ffmpeg
-    freetube
     gemini-cli
-    intelli-shell
-    jrnl
     libreoffice
     mc
     opencode
     pdftk
     scrot
-    steam
     spotify
     vlc
     wtype
@@ -112,6 +107,22 @@ in
       $DRY_RUN_CMD mkdir -p $HOME/school
     '';
   };
+
+  programs.ssh = {
+    enable = true;
+    matchBlocks = {
+      "heliotrope" = {
+        hostname = "100.77.235.110";
+      };
+      "lavender" = {
+        hostname = "100.99.189.49";
+      };
+      "violet" = {
+        hostname = "100.101.100.84";
+      };
+    };
+  };
+
   home.stateVersion = "26.05"; # DO NOT CHANGE
 }
 

hosts/lavender/default.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware.nix
+    ../../system
+  ];
+
+  networking.hostName = "lavender";
+
+  system.stateVersion = "26.05";
+}

hosts/lavender/hardware.nix

@@ -0,0 +1,37 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/2fc352b4-3b86-4282-9eb8-0bcaf6d48cd1";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/0CB6-7449";
+    fsType = "vfat";
+    options = [ "fmask=0022" "dmask=0022" ];
+  };
+
+  fileSystems."/games" = {
+    device = "/dev/disk/by-uuid/35b81a4f-c392-49b2-89a6-0a4c1820b1d8";
+    fsType = "ext4";
+    options = [ "defaults" "nofail" ];
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/8f8fdc73-d963-4665-b7e4-28eb43958ebe"; } ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/violet/default.nix

@@ -7,7 +7,7 @@
     ../../system/security/thinkpad.nix
   ];
 
-  networking.hostName = "nix-pad";
+  networking.hostName = "violet";
 
   services.power-profiles-daemon.enable = false;
 

secrets/secrets.yaml

@@ -0,0 +1,26 @@
+vaultwarden_clientid: ENC[AES256_GCM,data:JYjzfEf96nbtMWenTiu0XoPDu/GeIkKaFArczjK85Xv2Xr5qMRQ0TU0=,iv:KmjFmVDwRtaV3IXiBgSBWNqtvRFvmXhhT8fqnktw/7E=,tag:5fDkvjZpRQpz0QAFQ54IHA==,type:str]
+vaultwarden_clientsecret: ENC[AES256_GCM,data:Gljzsaq5lcnQBpltDebQsFP6qpUmVpVQqqi7I8he,iv:M09cRJlrafNxstfEGHSAd1AtLi56hUiZSchsX3U8GQE=,tag:0Tknj26xQehBiMMEWYMSHw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyNjkvMzI5MUtPZEVua0U1
+            TkxIREI3MnNNbytGTStXWWxwdm9XbEYwTmlZCnhMcGZGNnU2RTVtRzVUWWxzRzFw
+            NTRVT1ZSUFZOY29JNWZacjdoMjE1S3MKLS0tIFVoZk5Ea3pMUUYvYVgvUzdTN2Yx
+            V3VITk1wc05DK0tvRnBNZ1ptSldWUGsKT3fSHkqsjkvtRgbPpvIz0ufGPf4pZh6G
+            iibDAgCCrsHk0GViDIBlnwOHgwCM4io3j565M+jS6cjV2YKsOHz2Ng==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1az6l56h4m38jw2hm7t7a99wp9f88s845sg29grtmdpz72lrkc5cq66kmcv
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQelp5Y2E2WFM1TFhIb1gz
+            eS9lWTAydUYrQlYxZkY5akt3MkI5TGlXSVhRCktTV0tFcmFwaS9VVTdwZTRlWkFF
+            alNQYW83TTcycytWVHVZUVhmOU5ETU0KLS0tIGJmSWZRaW5tM3R6a3ZlaitSb3d3
+            a0JFN3NORTBFYVpsMjJkUHdtbFh4c1EK7lRQR/qO3rpctSDC6Mvy6eAA6zj70MDD
+            cmUiMcIDn2FyX5d9r2jk5EZtx2rZPB4ti4pp4Lox3zuEMMCksaFXmw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
+    lastmodified: "2026-08-05T02:52:44Z"
+    mac: ENC[AES256_GCM,data:69aZI03tg5IakwK80lx/eVrFq84WB2dk3DFKc5X5Idc2irrz2AodqsmlBNkrDDC6bnv1kUAW8dQlOscbHxKNtOq+lzEtuVI88A2sO1JT06ILFMMfj3R2BEZPtuidl/iytovUKmZrL9JzlNKTd/74htsBvC3cLoIk7r/WfyfoU4w=,iv:r2Jzq9IqL+ssKo13tpJ4OrgnPxxNaNaYbAa0+DnLt54=,tag:GL5AEZPDudVB+IQZtbmwvg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

system/core/boot.nix

@@ -3,8 +3,8 @@
 {
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelPackages = pkgs.linuxPackages;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.kernelModules = [ "uinput" ];
-  system.nixos.label = "niri-v.1.1";
+  system.nixos.label = "niri-v.1.2";
   environment.pathsToLink = [ "/libexec" ];
 }

system/core/env.nix

@@ -33,7 +33,6 @@
       ehome = "nvim $HOME/.dotfiles/home/jashton.nix";
       l = "ls -la";
       ports = "cat $HOME/.dotfiles/ports.registry";
-      accentum = "bluetoothctl connect 80:C3:BA:50:43:DF";
     };
 
     ohMyZsh = {
@@ -43,5 +42,12 @@
         "git"
       ];
     };
+
+    interactiveShellInit = ''
+    if [ -f "/run/secrets/vaultwarden_clientid" ]; then
+      export BW_CLIENTID=$(cat /run/secrets/vaultwarden_clientid)
+      export BW_CLIENTSECRET=$(cat /run/secrets/vaultwarden_clientsecret)
+    fi
+  '';
   };
 }

system/packages.nix

@@ -5,7 +5,9 @@
 
   environment.systemPackages = with pkgs; [
     acpi
+    age
     alacritty
+    bitwarden-cli
     btop
     dconf
     fastfetch
@@ -20,16 +22,18 @@
     google-chrome
     gnupg
     jq
+    keepassxc
     libnotify
     mypy
     networkmanagerapplet
     nitrogen
     ollama
-    (pass.withExtensions (exts: [ exts.pass-import ]))
     pasystray
-    picom
     pulseaudioFull
+    rclone
     rnote
+    sops
+    ssh-to-age
     tldr
     tmux
     unrar
@@ -47,10 +51,11 @@
 
       DOTFILES="$HOME/.dotfiles"
       ERRFILE=$(mktemp)
+      HOST=$(cat /etc/hostname)
       trap "rm -f '$ERRFILE'" EXIT
 
       echo "Building NixOS..."
-      sudo nixos-rebuild switch --flake "$DOTFILES#thinkpad" 2>&1 | tee "$ERRFILE"
+      sudo nixos-rebuild switch --flake "$DOTFILES#$HOST" 2>&1 | tee "$ERRFILE"
       STATUS=''${PIPESTATUS[0]}
 
       if [ "$STATUS" -ne 0 ]; then
@@ -77,14 +82,23 @@
       read -r msg_to_append
 
       ${pkgs.git}/bin/git add -A
-      ${pkgs.git}/bin/git commit -m "nixos: gen $GEN @ $(hostname) — $TIMESTAMP
-$VER
-
-$msg_to_append"
+      ${pkgs.git}/bin/git commit -m "nixos: gen $GEN @ $(hostname) — $TIMESTAMP $VER ----- $msg_to_append"
       ${pkgs.git}/bin/git push
     '')
   ];
 
   programs.firefox.enable = true;
   programs.thunar.enable = true;
+
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+    localNetworkGameTransfers.openFirewall = true;
+  };
 }

system/security/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./sops.nix
     ./sudo.nix
     ./systemd.nix
     ./users.nix

system/security/sops.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."vaultwarden_clientid".owner = config.users.users.jashton.name;
+  sops.secrets."vaultwarden_clientsecret".owner = config.users.users.jashton.name;
+}

system/security/users.nix

@@ -3,6 +3,8 @@
 {
   users.groups.jashton = {};
   users.groups.greetd = {};
+  users.groups.heliotrope-backups = {};
+
   users.users.jashton = {
     isNormalUser = true;
     description = "Josh Ashton";
@@ -12,6 +14,14 @@
     shell = pkgs.zsh;
   };
 
+  users.users.heliotrope-backups = {
+    isNormalUser = true;
+    description = "heliotrope remote server backups.";
+    group = "heliotrope-backups";
+
+    shell = pkgs.bash;
+  };
+
   users.users.root = {
     shell = pkgs.zsh;
   };

system/services/default.nix

@@ -52,13 +52,22 @@ in
     };
   };
 
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
   services = {
     libinput = {
       enable = true;
     };
 
     openssh = {
-      enable = false;
+      enable = true;
+    };
+
+    tailscale = {
+      enable = true;
     };
 
     upower.enable = true;