chore: bump lockfile

.git-blame-ignore-revs

@@ -0,0 +1,3 @@
+# nix fmt & statix
+f011c8d71ba09bd94ab04b8d771858b90a03fbf9
+3aff25b4486a143cd6282f8845c16216598e1c7e

.gitattributes

@@ -1 +0,0 @@
-assets/** filter=lfs diff=lfs merge=lfs -text

.pre-commit-config.yaml

@@ -4,3 +4,11 @@ repos:
     hooks:
       - id: nixfmt-nix
         args: [--, --check]
+  - repo: local
+    hooks:
+      - id: statix
+        name: statix
+        entry: statix check
+        language: system
+        files: \.nix$
+        pass_filenames: false

assets/lockscreen.png

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:47098eed6a818a4e6181e2cdd6d1244b2adc46d748da5944a7bf89068eb1c8ad
-size 497830

assets/wallpaper.png

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:0d5ab6c3434f2b1b8ebac566fef17fad16dbb6415d76ab06e6abf483b563bc25
-size 16097396

flake.lock

@@ -1,5 +1,21 @@
 {
   "nodes": {
+    "assets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1771625274,
+        "narHash": "sha256-2wWMWsPnIweJWiojeTXdnsTsKzU9R4igc6p50rEAkpk=",
+        "ref": "refs/heads/main",
+        "rev": "7eceaa56b64490ef15ce651e2376eae553d1d50a",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://git.janezic.dev/janezicmatej/assets.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.janezic.dev/janezicmatej/assets.git"
+      }
+    },
     "base16": {
       "inputs": {
         "fromYaml": "fromYaml"
@@ -239,11 +255,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770260404,
-        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
+        "lastModified": 1771744638,
+        "narHash": "sha256-EDLi+YAsEEAmMeZe1v6GccuGRbCkpSZp/+A6g+pivR8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
+        "rev": "cb6c151f5c9db4df0b69d06894dc8484de1f16a0",
         "type": "github"
       },
       "original": {
@@ -284,11 +300,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1770681890,
-        "narHash": "sha256-ommto8XEvGMYGuvrIjj2VM1tFZkRoLLmSuie+fvTTOk=",
+        "lastModified": 1771891493,
+        "narHash": "sha256-L0OCnG8rsWJYZ3mzHSz0iENtlBXQjjcGgvMgsBqN14U=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "3560c52c15aad8fccd4f62ae794b622969050202",
+        "rev": "7db85d094c68697fc36801bccdf015b4c2bdb274",
         "type": "github"
       },
       "original": {
@@ -300,11 +316,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1770678367,
-        "narHash": "sha256-suvGeMX6UQdyGuSNRLH4zJ25b72XfQBDva7Fxm+PNiA=",
+        "lastModified": 1771885993,
+        "narHash": "sha256-2c4H+5f0qhsp13Vx8pbsGiSRTHBJIfQaRAAUSHGEpgo=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "57fc77ed29ad9005d893a9dc2f37b3ad53aec4e6",
+        "rev": "d9d8c660fd5559d928c8870a21970a375674e310",
         "type": "github"
       },
       "original": {
@@ -313,49 +329,13 @@
         "type": "github"
       }
     },
-    "nixlib": {
-      "locked": {
-        "lastModified": 1736643958,
-        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixos-generators": {
-      "inputs": {
-        "nixlib": "nixlib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769813415,
-        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770537093,
-        "narHash": "sha256-pF1quXG5wsgtyuPOHcLfYg/ft/QMr8NnX0i6tW2187s=",
+        "lastModified": 1771423170,
+        "narHash": "sha256-K7Dg9TQ0mOcAtWTO/FX/FaprtWQ8BmEXTpLIaNRhEwU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fef9403a3e4d31b0a23f0bacebbec52c248fbb51",
+        "rev": "bcc4a9d9533c033d806a46b37dc444f9b0da49dd",
         "type": "github"
       },
       "original": {
@@ -367,11 +347,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1770713048,
-        "narHash": "sha256-YU2SCyrWaoGgpdsHvpX5wZgbRtWnp3FfN1fSWX1aSpc=",
+        "lastModified": 1771932323,
+        "narHash": "sha256-3PadsTzuMJT/x0KmiD/Me1GG6rW8kaHoWVduSs0ue7o=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2123953aa6e9e1045857adac93ce7c9a4a5d81d8",
+        "rev": "89bb5c5da7a857869cc88ef9b856bffdff8af264",
         "type": "github"
       },
       "original": {
@@ -383,11 +363,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1770537093,
-        "narHash": "sha256-pF1quXG5wsgtyuPOHcLfYg/ft/QMr8NnX0i6tW2187s=",
+        "lastModified": 1771482645,
+        "narHash": "sha256-MpAKyXfJRDTgRU33Hja+G+3h9ywLAJJNRq4Pjbb4dQs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "fef9403a3e4d31b0a23f0bacebbec52c248fbb51",
+        "rev": "724cf38d99ba81fbb4a347081db93e2e3a9bc2ae",
         "type": "github"
       },
       "original": {
@@ -399,11 +379,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1770617025,
-        "narHash": "sha256-1jZvgZoAagZZB6NwGRv2T2ezPy+X6EFDsJm+YSlsvEs=",
+        "lastModified": 1771714954,
+        "narHash": "sha256-nhZJPnBavtu40/L2aqpljrfUNb2rxmWTmSjK2c9UKds=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2db38e08fdadcc0ce3232f7279bab59a15b94482",
+        "rev": "afbbf774e2087c3d734266c22f96fca2e78d3620",
         "type": "github"
       },
       "original": {
@@ -463,11 +443,11 @@
     },
     "root": {
       "inputs": {
+        "assets": "assets",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "neovim-nightly-overlay": "neovim-nightly-overlay",
-        "nixos-generators": "nixos-generators",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-master": "nixpkgs-master",
         "nixpkgs-unstable": "nixpkgs-unstable",
@@ -516,11 +496,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1770308890,
-        "narHash": "sha256-7bx8Bn9B2g/loBaz+uLwdKI2rUW+RhDPyP/MqAgvrxU=",
+        "lastModified": 1771788390,
+        "narHash": "sha256-RzBpBwn93GWxLjacTte+ngwwg0L/BVOg4G/sSIeK3Rw=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "7e7fa955abac04a8e118b1cedf930a8fd41c34a6",
+        "rev": "ebb238f14d6f930068be4718472da3105fd5d3bf",
         "type": "github"
       },
       "original": {

flake.nix

@@ -17,11 +17,6 @@
 
     flake-utils.url = "github:numtide/flake-utils";
 
-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     home-manager = {
       url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -40,20 +35,36 @@
       url = "github:nix-community/lanzaboote/v1.0.0";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    assets = {
+      url = "git+https://git.janezic.dev/janezicmatej/assets.git";
+      flake = false;
+    };
   };
 
   outputs =
     inputs@{
       nixpkgs,
       flake-utils,
-      nixos-generators,
       ...
     }:
 
     let
-      my-lib = import ./lib { lib = nixpkgs.lib; };
+      my-lib = import ./lib { inherit (nixpkgs) lib; };
 
-      overlays = [ ];
+      overlays = [
+        (_: prev: {
+          inherit
+            (
+              (import inputs.nixpkgs-unstable {
+                inherit (prev.stdenv.hostPlatform) system;
+                config.allowUnfree = true;
+              })
+            )
+            claude-code
+            ;
+        })
+      ];
 
       mkHost = my-lib.mkHost {
         inherit
@@ -68,15 +79,6 @@
     {
       lib = my-lib;
 
-      # nix build .#iso
-      # dd bs=4M if=result/iso/my-nixos-live.iso of=/dev/sdX status=progress oflag=sync
-      live-iso = nixos-generators.nixosGenerate {
-        system = "x86_64-linux";
-        format = "install-iso";
-        specialArgs = { inherit inputs; };
-        modules = [ ./iso.nix ];
-      };
-
       nixosConfigurations = {
         matej-nixos = mkHost "matej-nixos" {
           system = "x86_64-linux";
@@ -87,11 +89,16 @@
           users = [ "matej" ];
         };
 
+        # nixos-rebuild build-image --image-variant install-iso --flake .#live-iso
+        live-iso = mkHost "live-iso" {
+          system = "x86_64-linux";
+          users = [ ];
+        };
       };
 
       nixosModules = import ./modules/nixos {
         inherit my-lib;
-        lib = nixpkgs.lib;
+        inherit (nixpkgs) lib;
       } { };
     }
     // flake-utils.lib.eachDefaultSystem (
@@ -100,15 +107,25 @@
         pkgs = nixpkgs.legacyPackages.${system};
       in
       {
-        packages = import ./packages {
+        packages =
+          import ./packages
+            {
               inherit my-lib;
-          lib = nixpkgs.lib;
-        } (inputs // { inherit system; });
+              inherit (nixpkgs) lib;
+            }
+            {
+              pkgs = nixpkgs.legacyPackages.${system};
+              pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
+              pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
+            };
 
         formatter = pkgs.nixfmt-tree;
 
         devShells.default = pkgs.mkShell {
-          packages = [ pkgs.pre-commit ];
+          packages = [
+            pkgs.pre-commit
+            pkgs.statix
+          ];
         };
       }
     );

hosts/live-iso/configuration.nix

@@ -1,23 +1,30 @@
-{ pkgs, lib, ... }:
 {
-  # Use zstd instead of xz for compressing the liveUSB image, it's 6x faster and 15% bigger.
+  pkgs,
+  lib,
+  inputs,
+  ...
+}:
+let
+  keys = import ../../users/matej/keys.nix;
+in
+{
+  imports = [
+    inputs.self.nixosModules.openssh
+  ];
+
+  openssh.enable = true;
+
+  image.modules.iso-installer = {
     isoImage.squashfsCompression = "zstd -Xcompression-level 6";
-
-  services.openssh = {
-    enable = true;
-    ports = [ 22 ];
-    settings = {
-      PasswordAuthentication = false;
-      AllowUsers = null;
-      PermitRootLogin = "no";
-      StreamLocalBindUnlink = "yes";
-    };
   };
 
-  networking = {
-    useDHCP = true;
-    firewall.allowedTCPPorts = [ 22 ];
+  fileSystems."/" = lib.mkDefault {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
   };
+  boot.loader.grub.device = lib.mkDefault "/dev/sda";
+
+  networking.firewall.allowedTCPPorts = [ 22 ];
 
   users = {
     groups.matej = {
@@ -34,14 +41,9 @@
         "wheel"
         "users"
       ];
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-      ];
+      openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
     };
   };
 
-  # boot.extraModulePackages = [ pkgs.linuxPackages.r8125 ];
-  # boot.blacklistedKernelModules = [ "r8169" ];
-
   system.stateVersion = "25.05";
 }

hosts/matej-nixos/configuration.nix

@@ -1,7 +1,3 @@
-# Edit this configuration file to define what should be installed on
-# your system. Help is available in the configuration.nix(5) man page, on
-# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
-
 {
   config,
   lib,
@@ -20,279 +16,106 @@ in
     inputs.stylix.nixosModules.stylix
     inputs.self.nixosModules.yubikey
     inputs.self.nixosModules.sway
+    inputs.self.nixosModules.openssh
+    inputs.self.nixosModules.desktop
+    inputs.self.nixosModules.printing
+    inputs.self.nixosModules.zsh
+    inputs.self.nixosModules.gnupg
+    inputs.self.nixosModules.tuigreet
+    inputs.self.nixosModules.workstation
+    inputs.self.nixosModules.nvidia
+    inputs.self.nixosModules.initrd-ssh
   ];
 
   yubikey.enable = true;
-
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  stylix = {
+  openssh.enable = true;
+  desktop.enable = true;
+  printing.enable = true;
+  zsh.enable = true;
+  gnupg.enable = true;
+  workstation.enable = true;
+  tuigreet = {
     enable = true;
-    polarity = "dark";
-    image = "${inputs.self}/assets/wallpaper.png";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
+    command = "sway";
   };
 
-  virtualisation.docker = {
-    enable = true;
-    logDriver = "json-file";
-  };
-
-  # WARN:(matej) probably want to drop this in the future
-  # i added this to get ruff working when installed via pip
-  programs.nix-ld.enable = true;
-  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
-
-  services.blueman.enable = true;
-  security.polkit.enable = true;
-  security.pki.certificateFiles = [ packages.ca-matheo-si ];
-
-  services.gnome.gnome-keyring.enable = true;
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  services.tailscale = {
-    enable = true;
-    useRoutingFeatures = "both";
-  };
-
-  # Set your time zone.
-  time.timeZone = "Europe/Ljubljana";
-  environment.variables.TZ = "America/New_York";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  #console = {
-  #  font = "Lat2-Terminus16";
-  #  keyMap = "us";
-  #  #useXkbConfig = true;
-  #};
-
-  users.defaultUserShell = pkgs.zsh;
-  users.users.matej = {
-    uid = 1000;
-    isNormalUser = true;
-    home = "/home/matej";
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-    ];
-  };
-
-  services.teamviewer.enable = true;
-  users.groups.matej = {
-    gid = 1000;
-    members = [ "matej" ];
-  };
-
-  home-manager.backupFileExtension = "backup";
-  home-manager.users.matej = {
-    home.stateVersion = "24.11";
-    home.packages = [ ];
-  };
-
-  programs.zsh = {
-    enable = true;
-  };
-  environment.etc."zshenv".text = ''
-    export ZDOTDIR=$HOME/.config/zsh
-  '';
-
-  # Wayland, X, etc. support for session vars
-  # systemd.user.sessionVariables = config.home-manager.users.matej.home.sessionVariables; };
-
-  # enable Sway window manager
   sway = {
     enable = true;
     cmdFlags = [ "--unsupported-gpu" ];
   };
 
-  services.greetd = {
+  nvidia.enable = true;
+
+  initrd-ssh = {
     enable = true;
-    settings = {
-      default_session = {
-        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd sway";
-        user = "greeter";
+    networkModule = "r8169";
+    ip = {
+      enable = true;
+      address = "10.222.0.247";
+      gateway = "10.222.0.1";
+      interface = "enp5s0";
     };
   };
+
+  stylix = {
+    enable = true;
+    polarity = "dark";
+    image = "${inputs.assets}/wallpaper.png";
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
   };
-  # users.users.greeter = {
-  #   isSystemUser = true;
-  #   description = "greetd user";
-  #   group = "nogroup";
-  #   home = "/var/lib/greetd";
-  # };
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  time.timeZone = "Europe/Ljubljana";
+  environment.variables.TZ = "America/New_York";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # WARN:(@janezicmatej) nix-ld for running pip-installed binaries outside nix, probably want to drop this
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
+
+  security.pki.certificateFiles = [ packages.ca-matheo-si ];
+  services.gnome.gnome-keyring.enable = true;
+
+  services.teamviewer.enable = true;
 
   programs.thunderbird.enable = true;
   programs._1password.enable = true;
   programs._1password-gui.enable = true;
-
-  services.playerctld.enable = true;
-
-  fonts.packages = with pkgs; [
-    font-awesome
-    nerd-fonts.jetbrains-mono
-    maple-mono.NF
-  ];
-
-  programs.gnupg.agent = {
-    enable = true;
-    enableExtraSocket = true;
-    enableSSHSupport = true;
-  };
-
+  programs.firefox.enable = true;
   programs.steam = {
     enable = true;
-    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
-    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
-    localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+    localNetworkGameTransfers.openFirewall = true;
   };
+
   hardware.keyboard.zsa.enable = true;
   hardware.ledger.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
 
-  environment.systemPackages = with pkgs; [
-    # discord
-    vesktop
-    rocketchat-desktop
-    telegram-desktop
-    slack
-    #
-    ghostty
-    mdbook
-    pass
-    google-chrome
-    # nodejs
-    pavucontrol
-    protonmail-bridge
-    python3
-    zathura
-    smartmontools
-    marksman
-    mdformat
-    jellyfin-media-player
-    cider-2
-    libnotify # need this for runelite
-    bolt-launcher
-    ledger-live-desktop
+  networking = {
+    hostName = "matej-nixos";
+    useDHCP = false;
+    networkmanager.enable = true;
+    interfaces.enp5s0.ipv4.addresses = [
+      {
+        address = "10.222.0.247";
+        prefixLength = 24;
+      }
     ];
-
-  # Enable the X11 windowing system.
-  # services.xserver.enable = true;
-
-  # Configure keymap in X11
-  # services.xserver.xkb.layout = "us";
-  # services.xserver.xkb.options = "eurosign:e,caps:escape";
-
-  # Enable CUPS to print documents.
-  services.printing.enable = true;
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    openFirewall = true;
-  };
-
-  # Enable sound.
-  # hardware.pulseaudio.enable = true;
-  # OR
-  services.pipewire = {
-    enable = true;
-    # alsa.enable = true;
-    # alsa.support32Bit = true;
-    pulse.enable = true;
-    # jack.enable = true;
-  };
-
-  services.dbus.enable = true;
-
-  xdg = {
-    portal = {
-      xdgOpenUsePortal = true;
-      enable = true;
-      extraPortals = [
-        pkgs.xdg-desktop-portal-wlr
-        pkgs.xdg-desktop-portal-gtk
+    firewall.enable = false;
+    defaultGateway = "10.222.0.1";
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
     ];
   };
-    mime.defaultApplications = {
+
+  xdg.mime.defaultApplications = {
     "application/pdf" = "org.pwmt.zathura.desktop";
   };
-  };
-
-  # Enable touchpad support (enabled default in most desktopManager).
-  # services.libinput.enable = true;
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  # users.users.alice = {
-  #   isNormalUser = true;
-  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-  #   packages = with pkgs; [
-  #     tree
-  #   ];
-  # };
-
-  programs.firefox.enable = true;
-
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  # environment.systemPackages = with pkgs; [
-  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
-  #   wget
-  # ];
-
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-  services.openssh = {
-    enable = true;
-    ports = [ 22 ];
-    settings = {
-      PasswordAuthentication = false;
-      AllowUsers = null;
-      PermitRootLogin = "no";
-      StreamLocalBindUnlink = "yes";
-    };
-  };
-
-  # Copy the NixOS configuration file and link it from the resulting system
-  # (/run/current-system/configuration.nix). This is useful in case you
-  # accidentally delete configuration.nix.
-  # system.copySystemConfiguration = true;
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-  #
-  # Most users should NEVER change this value after the initial install, for any reason,
-  # even if you've upgraded your system to a new NixOS release.
-  #
-  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-  # to actually do that.
-  #
-  # This value being lower than the current NixOS release does NOT mean your system is
-  # out of date, out of support, or vulnerable.
-  #
-  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-  # and migrated your data accordingly.
-  #
-  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "24.11"; # Did you read the comment?
 
+  system.stateVersion = "24.11";
 }

hosts/matej-nixos/hardware-configuration.nix

@@ -1,6 +1,4 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
+# autogenerated by 'nixos-generate-config'
 {
   config,
   lib,
@@ -14,45 +12,17 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
+  hardware.firmware = [ pkgs.linux-firmware ];
+
   boot.initrd.availableKernelModules = [
     "nvme"
     "xhci_pci"
     "ahci"
     "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [
-    "dm-snapshot"
-    "r8169"
-  ];
-  boot.kernelModules = [
-    "kvm-amd"
   ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
-  boot.kernelParams = [
-    "ip=10.222.0.247::10.222.0.1:255.255.255.0::enp5s0:none"
-  ];
-
-  boot.initrd.network = {
-    enable = true;
-    ssh = {
-      enable = true;
-      port = 22;
-      hostKeys = [
-        "/etc/secrets/initrd/ssh_host_rsa_key"
-        "/etc/secrets/initrd/ssh_host_ed25519_key"
-      ];
-      authorizedKeys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-      ];
-    };
-    postCommands = ''
-      echo 'cryptsetup-askpass' >> /root/.profile
-    '';
-
-  };
 
   boot.initrd.luks.devices."cryptlvm".device =
     "/dev/disk/by-uuid/af0608c0-67cd-4ae4-b12c-252fa947da40";
@@ -75,76 +45,6 @@
     { device = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540"; }
   ];
 
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-
-  networking = {
-    useDHCP = false;
-    hostName = "matej-nixos";
-    networkmanager.enable = true; # Easiest to use and most distros use this by default.
-    interfaces.enp5s0.ipv4.addresses = [
-      {
-        address = "10.222.0.247";
-        prefixLength = 24;
-      }
-    ];
-    firewall = {
-      enable = false;
-      allowedTCPPorts = lib.range 8800 8900;
-    };
-    defaultGateway = "10.222.0.1";
-    nameservers = [
-      "1.1.1.1"
-      "8.8.8.8"
-    ];
-
-  };
-  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-
-  # TODO: maybe move later
-  hardware.bluetooth.enable = true; # enables support for Bluetooth
-  hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot
-
-  # Enable OpenGL
-  hardware.graphics = {
-    enable = true;
-  };
-
-  # Load nvidia driver for Xorg and Wayland
-  services.xserver.videoDrivers = [ "nvidia" ];
-
-  hardware.nvidia = {
-    # Modesetting is required.
-    modesetting.enable = true;
-
-    # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
-    # Enable this if you have graphical corruption issues or application crashes after waking
-    # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
-    # of just the bare essentials.
-    powerManagement.enable = false;
-
-    # Fine-grained power management. Turns off GPU when not in use.
-    # Experimental and only works on modern Nvidia GPUs (Turing or newer).
-    powerManagement.finegrained = false;
-
-    # Use the NVidia open source kernel module (not to be confused with the
-    # independent third-party "nouveau" open source driver).
-    # Support is limited to the Turing and later architectures. Full list of
-    # supported GPUs is at:
-    # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
-    # Only available from driver 515.43.04+
-    open = true;
-
-    # Enable the Nvidia settings menu,
-    # accessible via `nvidia-settings`.
-    nvidiaSettings = true;
-
-    # Optionally, you may need to select the appropriate driver version for your specific GPU.
-    package = config.boot.kernelPackages.nvidiaPackages.stable;
-  };
 }

hosts/matej-tower/configuration.nix

@@ -1,7 +1,3 @@
-# Edit this configuration file to define what should be installed on
-# your system. Help is available in the configuration.nix(5) man page, on
-# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
-
 {
   config,
   lib,
@@ -11,282 +7,81 @@
   ...
 }:
 
-let
-  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
-in
-
 {
+  networking.hostName = "matej-tower";
   imports = [
     inputs.stylix.nixosModules.stylix
     inputs.lanzaboote.nixosModules.lanzaboote
+
     inputs.self.nixosModules.yubikey
     inputs.self.nixosModules.sway
+    inputs.self.nixosModules.openssh
+    inputs.self.nixosModules.desktop
+    inputs.self.nixosModules.printing
+    inputs.self.nixosModules.zsh
+    inputs.self.nixosModules.gnupg
+    inputs.self.nixosModules.tuigreet
+    inputs.self.nixosModules.workstation
+    inputs.self.nixosModules.initrd-ssh
   ];
 
-  sway.enable = true;
   yubikey.enable = true;
+  openssh.enable = true;
+  desktop.enable = true;
+  printing.enable = true;
+  zsh.enable = true;
+  gnupg.enable = true;
+  workstation.enable = true;
+  tuigreet = {
+    enable = true;
+    command = "sway";
+  };
+  sway.enable = true;
 
-  fonts.packages = with pkgs; [
-    font-awesome
-    nerd-fonts.jetbrains-mono
-    maple-mono.NF
-  ];
+  initrd-ssh = {
+    enable = true;
+    networkModule = "r8169";
+  };
 
   stylix = {
     enable = true;
     polarity = "dark";
-    image = "${inputs.self}/assets/wallpaper.png";
+    image = "${inputs.assets}/wallpaper.png";
     base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
   };
 
-  virtualisation.docker = {
-    enable = true;
-    logDriver = "json-file";
-  };
-
-  # Use the systemd-boot EFI boot loader.
+  # lanzaboote secure boot
+  boot.kernelParams = [ "btusb.reset=1" ];
   boot.loader.efi.canTouchEfiVariables = true;
-
   boot.loader.systemd-boot.enable = lib.mkForce false;
   boot.lanzaboote = {
     enable = true;
     pkiBundle = "/var/lib/sbctl";
   };
 
-  services.udev.packages = with pkgs; [
-    yubikey-personalization
-  ];
-
-  services.tailscale = {
-    enable = true;
-    useRoutingFeatures = "both";
-  };
+  time.timeZone = "Europe/Ljubljana";
+  environment.variables.TZ = "Europe/Ljubljana";
 
   services.udisks2.enable = true;
-  security.polkit.enable = true;
-
-  hardware.bluetooth.enable = true;
-  services.blueman.enable = true;
-
-  users.defaultUserShell = pkgs.zsh;
-  programs.zsh = {
-    enable = true;
-  };
-  environment.etc."zshenv".text = ''
-    export ZDOTDIR=$HOME/.config/zsh
-  '';
 
   programs._1password.enable = true;
   programs._1password-gui.enable = true;
 
-  users.users.matej = {
-    uid = 1000;
-    isNormalUser = true;
-    home = "/home/matej";
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-    ];
-  };
-
-  services.openssh = {
-    enable = true;
-    ports = [ 22 ];
-    settings = {
-      PasswordAuthentication = false;
-      AllowUsers = null;
-      PermitRootLogin = "no";
-      StreamLocalBindUnlink = "yes";
-    };
-  };
-
-  services.greetd = {
-    enable = true;
-    useTextGreeter = true;
-    settings = {
-      default_session = {
-        user = "greeter";
-        command = ''
-          ${pkgs.tuigreet}/bin/tuigreet \
-            --time \
-            --remember \
-            --cmd "sway"
-        '';
-      };
-    };
-  };
-
-  networking.hostName = "matej-tower"; # Define your hostname.
-  # Pick only one of the below networking options.
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
-
-  # Set your time zone.
-  # time.timeZone = "Europe/Amsterdam";
-  time.timeZone = "Europe/Ljubljana";
-  environment.variables.TZ = "Europe/Ljubljana";
-
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-  # Select internationalisation properties.
-  # i18n.defaultLocale = "en_US.UTF-8";
-  # console = {
-  #   font = "Lat2-Terminus16";
-  #   keyMap = "us";
-  #   useXkbConfig = true; # use xkb.options in tty.
-  # };
-
-  # Enable the X11 windowing system.
-  # services.xserver.enable = true;
-
-  # Configure keymap in X11
-  # services.xserver.xkb.layout = "us";
-  # services.xserver.xkb.options = "eurosign:e,caps:escape";
-
-  # Enable CUPS to print documents.
-  # services.printing.enable = true;
-
-  # Enable sound.
-  # services.pulseaudio.enable = true;
-  # OR
-  # services.pipewire = {
-  #   enable = true;
-  #   pulse.enable = true;
-  # };
-
-  # Enable touchpad support (enabled default in most desktopManager).
-  # services.libinput.enable = true;
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  # users.users.alice = {
-  #   isNormalUser = true;
-  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-  #   packages = with pkgs; [
-  #     tree
-  #   ];
-  # };
-
-  # programs.firefox.enable = true;
-
-  services.printing.enable = true;
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    openFirewall = true;
-  };
-
-  services.pipewire = {
-    enable = true;
-    # alsa.enable = true;
-    # alsa.support32Bit = true;
-    pulse.enable = true;
-    # jack.enable = true;
-    extraConfig.pipewire.adjust-sample-rate = {
+  # higher sample rate for audio equipment
+  services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
     "context.properties" = {
       "default.clock.rate" = 192000;
-        #"defautlt.allowed-rates" = [ 192000 48000 44100 ];
-        "defautlt.allowed-rates" = [ 192000 ];
-        # "default.clock.quantum" = 32;
-        # "default.clock.min-quantum" = 32;
-        # "default.clock.max-quantum" = 32;
-      };
-    };
-  };
-
-  services.dbus.enable = true;
-
-  services.playerctld.enable = true;
-
-  xdg = {
-    portal = {
-      xdgOpenUsePortal = true;
-      enable = true;
-      extraPortals = [
-        pkgs.xdg-desktop-portal-wlr
-        pkgs.xdg-desktop-portal-gtk
-      ];
-    };
-    mime.defaultApplications = {
-      "application/pdf" = "org.pwmt.zathura.desktop";
+      "default.allowed-rates" = [ 192000 ];
     };
   };
 
-  # List packages installed in system profile.
-  # You can use https://search.nixos.org/ to find more packages (and options).
   environment.systemPackages = with pkgs; [
-    vim
-    wget
-    ghostty
-    vesktop
-    rocketchat-desktop
-    telegram-desktop
-    slack
-    mdbook
-    google-chrome
-    pavucontrol
-    protonmail-bridge
-    python3
-    zathura
-    smartmontools
-    marksman
-    mdformat
-    jellyfin-media-player
-    cider-2
-    bolt-launcher
     easyeffects
   ];
 
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-  programs.gnupg.agent = {
-    enable = true;
-    enableExtraSocket = true;
-    enableSSHSupport = true;
+  xdg.mime.defaultApplications = {
+    "application/pdf" = "org.pwmt.zathura.desktop";
   };
 
-  # List services that you want to enable:
-
-  # Enable the OpenSSH daemon.
-
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  # Copy the NixOS configuration file and link it from the resulting system
-  # (/run/current-system/configuration.nix). This is useful in case you
-  # accidentally delete configuration.nix.
-  # system.copySystemConfiguration = true;
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-  #
-  # Most users should NEVER change this value after the initial install, for any reason,
-  # even if you've upgraded your system to a new NixOS release.
-  #
-  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-  # to actually do that.
-  #
-  # This value being lower than the current NixOS release does NOT mean your system is
-  # out of date, out of support, or vulnerable.
-  #
-  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-  # and migrated your data accordingly.
-  #
-  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "25.05"; # Did you read the comment?
-
+  system.stateVersion = "25.05";
 }

hosts/matej-tower/hardware-configuration.nix

@@ -1,6 +1,4 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
+# autogenerated by 'nixos-generate-config'
 {
   config,
   lib,
@@ -20,13 +18,9 @@
     "nvme"
     "xhci_pci"
     "ahci"
-    "usb_storage"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [
-    "dm-snapshot"
-    "r8169"
+    "usbhid"
   ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
@@ -51,34 +45,6 @@
     { device = "/dev/disk/by-uuid/e0952ef2-1a9a-4022-bbcf-b2f016384258"; }
   ];
 
-  boot.initrd.network = {
-    enable = true;
-    ssh = {
-      enable = true;
-      port = 22;
-      hostKeys = [
-        "/etc/secrets/initrd/ssh_host_rsa_key"
-        "/etc/secrets/initrd/ssh_host_ed25519_key"
-      ];
-      authorizedKeys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-      ];
-    };
-    postCommands = ''
-      echo 'cryptsetup-askpass' >> /root/.profile
-    '';
-
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp11s0.useDHCP = lib.mkDefault true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

justfile

@@ -0,0 +1,26 @@
+[private]
+default:
+    @just --list
+
+# rebuild and switch
+switch:
+    nixos-rebuild switch --flake . --sudo
+
+# fetch flake inputs
+sync:
+    nix flake prefetch-inputs
+
+# update flake inputs
+update:
+    nix flake update
+
+# update flake inputs, rebuild and switch
+bump: update switch
+
+# build installation iso
+iso:
+    nixos-rebuild build-image --image-variant iso-installer --flake .#live-iso
+
+# garbage collect old generations
+clean:
+    sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)

lib/autoDir.nix

@@ -1,6 +1,6 @@
 lib:
 
-# takes dir as an argument and creates an attribute set by importing all .nix files in that directory
+# import all .nix files in dir as attribute set
 dir:
 let
   readDir = builtins.readDir dir;

lib/mkHost.nix

@@ -13,42 +13,36 @@ name:
 let
   hostConfig = ../hosts/${name}/configuration.nix;
   hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
+  hasHWConfig = builtins.pathExists hostHWConfig;
 
-  userHMConfigs = nixpkgs.lib.genAttrs users (
-    user: import ../users/${user}/home-manager.nix { inherit inputs; }
+  userNixosConfigs = map (user: ../users/${user}/nixos.nix) (
+    builtins.filter (user: builtins.pathExists ../users/${user}/nixos.nix) users
   );
 
-  gib_in_bytes = 1073741824;
-in
+  userHMConfigs = nixpkgs.lib.genAttrs users (user: import ../users/${user}/home-manager.nix);
 
+in
 nixpkgs.lib.nixosSystem {
   inherit system;
   modules = [
-
-    {
-      nix.settings = {
-        download-buffer-size = 1 * gib_in_bytes;
-        experimental-features = [
-          "nix-command"
-          "flakes"
-        ];
-      };
-    }
+    ../nix.nix
 
     { nixpkgs.overlays = overlays; }
     { nixpkgs.config.allowUnfree = true; }
 
     hostConfig
-    hostHWConfig
-
+  ]
+  ++ nixpkgs.lib.optional hasHWConfig hostHWConfig
+  ++ userNixosConfigs
+  ++ [
     inputs.home-manager.nixosModules.home-manager
     {
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
+      home-manager.backupFileExtension = "backup";
       home-manager.users = userHMConfigs;
       home-manager.extraSpecialArgs = { inherit inputs; };
     }
-
   ];
   specialArgs = { inherit inputs; };
 }

modules/nixos/desktop.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  options = {
+    desktop = {
+      enable = lib.mkEnableOption "base desktop environment";
+    };
+  };
+
+  config = lib.mkIf config.desktop.enable {
+    services.pipewire = {
+      enable = true;
+      pulse.enable = true;
+    };
+
+    hardware.bluetooth.enable = true;
+    services.blueman.enable = true;
+
+    security.polkit.enable = true;
+
+    services.dbus.enable = true;
+
+    services.playerctld.enable = true;
+
+    xdg.portal = {
+      enable = true;
+      xdgOpenUsePortal = true;
+      extraPortals = [
+        pkgs.xdg-desktop-portal-wlr
+        pkgs.xdg-desktop-portal-gtk
+      ];
+    };
+
+    fonts.packages = with pkgs; [
+      font-awesome
+      nerd-fonts.jetbrains-mono
+      maple-mono.NF
+    ];
+  };
+}

modules/nixos/gnupg.nix

@@ -0,0 +1,20 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    gnupg = {
+      enable = lib.mkEnableOption "GnuPG agent with SSH support";
+    };
+  };
+
+  config = lib.mkIf config.gnupg.enable {
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      enableExtraSocket = true;
+    };
+  };
+}

modules/nixos/initrd-ssh.nix

@@ -0,0 +1,86 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  # TODO:(@janezicmatej) restructure keys import
+  keys = import ../../users/matej/keys.nix;
+
+  # generate host keys for new machines: ./scripts/initrd-ssh-keygen.sh
+  keyDir = "/etc/secrets/initrd";
+
+  mkIpString =
+    {
+      address,
+      gateway,
+      netmask,
+      interface,
+      ...
+    }:
+    "${address}::${gateway}:${netmask}::${interface}:none";
+in
+{
+  options = {
+    initrd-ssh = {
+      enable = lib.mkEnableOption "SSH in initrd for remote LUKS unlock";
+
+      ip = {
+        enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
+
+        address = lib.mkOption {
+          type = lib.types.str;
+          example = "10.222.0.247";
+        };
+
+        gateway = lib.mkOption {
+          type = lib.types.str;
+          example = "10.222.0.1";
+        };
+
+        netmask = lib.mkOption {
+          type = lib.types.str;
+          default = "255.255.255.0";
+        };
+
+        interface = lib.mkOption {
+          type = lib.types.str;
+          example = "enp5s0";
+        };
+      };
+
+      authorizedKeys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = keys.sshAuthorizedKeys;
+      };
+
+      networkModule = lib.mkOption {
+        type = lib.types.str;
+        example = "r8169";
+      };
+    };
+  };
+
+  config = lib.mkIf config.initrd-ssh.enable {
+    boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
+    boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
+      "ip=${mkIpString config.initrd-ssh.ip}"
+    ];
+
+    boot.initrd.network = {
+      enable = true;
+      ssh = {
+        enable = true;
+        port = 22;
+        hostKeys = [
+          "${keyDir}/ssh_host_rsa_key"
+          "${keyDir}/ssh_host_ed25519_key"
+        ];
+        inherit (config.initrd-ssh) authorizedKeys;
+      };
+      postCommands = ''
+        echo 'cryptsetup-askpass' >> /root/.profile
+      '';
+    };
+  };
+}

modules/nixos/nvidia.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    nvidia.enable = lib.mkEnableOption "NVIDIA GPU support";
+  };
+
+  config = lib.mkIf config.nvidia.enable {
+    hardware.graphics.enable = true;
+
+    services.xserver.videoDrivers = [ "nvidia" ];
+
+    hardware.nvidia = {
+      modesetting.enable = true;
+      open = true;
+      nvidiaSettings = true;
+      package = config.boot.kernelPackages.nvidiaPackages.stable;
+    };
+  };
+}

modules/nixos/openssh.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    openssh = {
+      enable = lib.mkEnableOption "hardened SSH server";
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 22;
+      };
+    };
+  };
+
+  config = lib.mkIf config.openssh.enable {
+    services.openssh = {
+      enable = true;
+      ports = [ config.openssh.port ];
+      settings = {
+        PasswordAuthentication = false;
+        AllowUsers = null;
+        PermitRootLogin = "no";
+        StreamLocalBindUnlink = "yes";
+      };
+    };
+  };
+}

modules/nixos/printing.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    printing = {
+      enable = lib.mkEnableOption "CUPS printing with Avahi discovery";
+    };
+  };
+
+  config = lib.mkIf config.printing.enable {
+    services.printing.enable = true;
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
+  };
+}

modules/nixos/sway.nix

@@ -12,7 +12,6 @@
       cmdFlags = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
-        description = "additional command line flags to pass to sway";
       };
     };
   };
@@ -24,23 +23,20 @@
       wrapperFeatures.gtk = true;
       extraOptions = config.sway.cmdFlags;
       extraSessionCommands = ''
-        # Fix for some Java AWT applications (e.g. Android Studio),
-        # use this if they aren't displayed properly:
+        # fix for java awt apps not rendering
         export _JAVA_AWT_WM_NONREPARENTING=1
       '';
     };
 
     environment.systemPackages = with pkgs; [
-      # default extra packages
       brightnessctl
       foot
       grim
       pulseaudio
       swayidle
-      # swaylock - use swaylock-effects instead
+      # use swaylock-effects instead of swaylock
       swaylock-effects
       wmenu
-      # additional things i like
       slurp
       wofi
       wl-clipboard

modules/nixos/tuigreet.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  options = {
+    tuigreet = {
+      enable = lib.mkEnableOption "greetd with tuigreet";
+
+      command = lib.mkOption {
+        type = lib.types.str;
+      };
+    };
+  };
+
+  config = lib.mkIf config.tuigreet.enable {
+    services.greetd = {
+      enable = true;
+      useTextGreeter = true;
+      settings = {
+        default_session = {
+          command = pkgs.writeShellScript "tuigreet-session" ''
+            ${pkgs.util-linux}/bin/setterm --blank 1 --powersave powerdown --powerdown 1
+            exec ${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd ${config.tuigreet.command}
+          '';
+          user = "greeter";
+        };
+      };
+    };
+  };
+}

modules/nixos/workstation.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  options = {
+    workstation = {
+      enable = lib.mkEnableOption "workstation utilities";
+    };
+  };
+
+  config = lib.mkIf config.workstation.enable {
+    virtualisation.docker = {
+      enable = true;
+      logDriver = "json-file";
+    };
+
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = "both";
+    };
+
+    environment.systemPackages = with pkgs; [
+      smartmontools
+    ];
+  };
+}

modules/nixos/zsh.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    zsh = {
+      enable = lib.mkEnableOption "zsh with ZDOTDIR in ~/.config/zsh";
+    };
+  };
+
+  config = lib.mkIf config.zsh.enable {
+    programs.zsh.enable = true;
+    environment.etc."zshenv".text = ''
+      export ZDOTDIR=$HOME/.config/zsh
+    '';
+  };
+}

nix.nix

@@ -0,0 +1,23 @@
+{
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      download-buffer-size = 2 * 1024 * 1024 * 1024;
+      warn-dirty = false;
+    };
+
+    gc = {
+      automatic = true;
+      dates = "monthly";
+      options = "--delete-older-than 30d";
+    };
+
+    optimise = {
+      automatic = true;
+      dates = [ "monthly" ];
+    };
+  };
+}

packages/ahab.nix

@@ -1,7 +1,6 @@
-{ nixpkgs, system, ... }:
+{ pkgs, ... }:
 
 let
-  pkgs = import nixpkgs { inherit system; };
   version = "v0.3.2";
 in
 pkgs.rustPlatform.buildRustPackage {

packages/ca-matheo-si.nix

@@ -1,13 +1,12 @@
-{ nixpkgs, system, ... }:
+{ pkgs, ... }:
 
 let
-  pkgs = import nixpkgs { inherit system; };
   version = "C6r62em";
 in
 
 pkgs.stdenv.mkDerivation {
   pname = "ca-matheo-si";
-  version = version;
+  inherit version;
 
   src = pkgs.fetchurl {
     url = "http://ipa2.matheo.si/ipa/config/ca.crt";

packages/ggman.nix

@@ -1,8 +1,7 @@
-{ nixpkgs-master, system, ... }:
+{ pkgs-master, ... }:
 
 let
-  nixpkgs = nixpkgs-master;
-  pkgs = import nixpkgs { inherit system; };
+  pkgs = pkgs-master;
   version = "e24855c";
 in
 pkgs.buildGoModule.override

packages/git-linearize.nix

@@ -1,7 +1,6 @@
-{ nixpkgs, system, ... }:
+{ pkgs, ... }:
 
 let
-  pkgs = import nixpkgs { inherit system; };
   version = "main";
 in
 pkgs.stdenv.mkDerivation {

packages/releasectl.nix

@@ -1,28 +0,0 @@
-{ nixpkgs-master, system, ... }:
-
-let
-  nixpkgs = nixpkgs-master;
-  pkgs = import nixpkgs { inherit system; };
-  version = "v1.25.0";
-  python = pkgs.python313;
-in
-
-python.pkgs.buildPythonPackage rec {
-  pname = "releasectl";
-  version = "1.2.0";
-
-  src = pkgs.fetchurl {
-    url = "https://gitlab.com/flarenetwork/infra-public/pipeliner/-/package_files/216813866/download";
-    sha256 = "sha256-ScBG8BoOKDdOAHTFP+zwyk+Kfu31WoKQSRkutOvnJ5E";
-  };
-
-  format = "wheel"; # if it uses poetry/PEP517, otherwise "setuptools"
-  # nativeBuildInputs = [ python.pkgs.setuptools python.pkgs.wheel ];
-  # propagatedBuildInputs = with python.pkgs; [
-  #   # add runtime deps here if needed
-  # ];
-
-  # pyproject = true;
-  # build-system =  [ pkgs.python313Packages.hatchling ];
-
-}

scripts/initrd-ssh-keygen.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+KEY_DIR="/etc/secrets/initrd"
+
+echo "Generating initrd SSH host keys in $KEY_DIR"
+
+sudo mkdir -p "$KEY_DIR"
+
+if [[ ! -f "$KEY_DIR/ssh_host_rsa_key" ]]; then
+  sudo ssh-keygen -t rsa -N "" -f "$KEY_DIR/ssh_host_rsa_key"
+  echo "Generated: $KEY_DIR/ssh_host_rsa_key"
+else
+  echo "Exists: $KEY_DIR/ssh_host_rsa_key"
+fi
+
+if [[ ! -f "$KEY_DIR/ssh_host_ed25519_key" ]]; then
+  sudo ssh-keygen -t ed25519 -N "" -f "$KEY_DIR/ssh_host_ed25519_key"
+  echo "Generated: $KEY_DIR/ssh_host_ed25519_key"
+else
+  echo "Exists: $KEY_DIR/ssh_host_ed25519_key"
+fi
+
+echo "Done. Now run nixos-rebuild."

statix.toml

@@ -0,0 +1 @@
+disabled = ["repeated_keys"]

users/gorazd/home-manager.nix

@@ -1,5 +1,3 @@
-{ inputs, ... }:
-
 {
   config,
   lib,

users/matej/home-manager.nix

@@ -1,5 +1,3 @@
-{ inputs, ... }:
-
 {
   config,
   lib,
@@ -15,18 +13,18 @@ in
 {
   home.stateVersion = "24.11";
 
-  # TODO:(janezicmatej) do i need this here?
+  # TODO:(@janezicmatej) do i need this here?
   services.dunst.enable = true;
 
   home.packages = [
     pkgs.bibata-cursors
-    pkgs.pinentry-curses
 
     pkgs.starship
 
+    pkgs.claude-code
+
     # git and co
     pkgs.git
-    pkgs.git-lfs
     packages.git-linearize
     packages.ggman
 
@@ -53,9 +51,34 @@ in
     # need for gcp stuff
     pkgs.google-cloud-sdk
     pkgs.google-cloud-sql-proxy
+
+    # desktop apps
+    pkgs.vesktop
+    pkgs.rocketchat-desktop
+    pkgs.telegram-desktop
+    pkgs.slack
+    pkgs.ghostty
+    pkgs.google-chrome
+    pkgs.zathura
+    pkgs.pavucontrol
+    pkgs.jellyfin-media-player
+    pkgs.cider-2
+    pkgs.protonmail-bridge
+    pkgs.ledger-live-desktop
+    pkgs.bolt-launcher
+    pkgs.libnotify
+
+    # writing/docs
+    pkgs.mdbook
+    pkgs.marksman
+    pkgs.mdformat
+
+    # security
+    pkgs.gnupg
+    pkgs.pass
   ];
 
-  home.file.".assets".source = "${inputs.self}/assets";
+  home.file.".assets".source = inputs.assets;
 
   programs.direnv = {
     enable = true;
@@ -76,7 +99,6 @@ in
       luajit
       nodejs_22 # copilot
 
-      # treesitter
       tree-sitter
 
       # lua_fzf
@@ -86,7 +108,6 @@ in
       gnumake
       delta
 
-      # language server
       pyright
       typescript-language-server
       lua-language-server
@@ -94,7 +115,6 @@ in
       nil
       nixd
 
-      # formatters
       nixpkgs-fmt
       stylua
     ];

users/matej/keys.nix

@@ -0,0 +1,6 @@
+{
+  sshAuthorizedKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+  ];
+}

users/matej/nixos.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  keys = import ./keys.nix;
+in
+{
+  users.users.matej = {
+    uid = 1000;
+    isNormalUser = true;
+    home = "/home/matej";
+    shell = pkgs.zsh;
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
+  };
+
+  users.groups.matej = {
+    gid = 1000;
+    members = [ "matej" ];
+  };
+}