merge: host config cleanup

.git-blame-ignore-revs

@@ -1,3 +0,0 @@
-# nix fmt & statix
-f011c8d71ba09bd94ab04b8d771858b90a03fbf9
-3aff25b4486a143cd6282f8845c16216598e1c7e

.pre-commit-config.yaml

@@ -4,11 +4,3 @@ repos:
     hooks:
       - id: nixfmt-nix
         args: [--, --check]
-  - repo: local
-    hooks:
-      - id: statix
-        name: statix
-        entry: statix check
-        language: system
-        files: \.nix$
-        pass_filenames: false

flake.lock

@@ -255,11 +255,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771744638,
-        "narHash": "sha256-EDLi+YAsEEAmMeZe1v6GccuGRbCkpSZp/+A6g+pivR8=",
+        "lastModified": 1770260404,
+        "narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cb6c151f5c9db4df0b69d06894dc8484de1f16a0",
+        "rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1771891493,
-        "narHash": "sha256-L0OCnG8rsWJYZ3mzHSz0iENtlBXQjjcGgvMgsBqN14U=",
+        "lastModified": 1771545891,
+        "narHash": "sha256-aaVUfc/9q2pCsELZmYhf+uvYRMCUlBvccgL1VS27R+o=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "7db85d094c68697fc36801bccdf015b4c2bdb274",
+        "rev": "917b72d5e27bc217440655b81f701d7062bdd198",
         "type": "github"
       },
       "original": {
@@ -316,11 +316,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1771885993,
-        "narHash": "sha256-2c4H+5f0qhsp13Vx8pbsGiSRTHBJIfQaRAAUSHGEpgo=",
+        "lastModified": 1771541613,
+        "narHash": "sha256-1Rpt5B4pNW/MNkWoEamqwCa5I4/9G84dSqp4eHS5zsA=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "d9d8c660fd5559d928c8870a21970a375674e310",
+        "rev": "e3d46a63375c84b7bd409f1f07ef56eb985eae50",
         "type": "github"
       },
       "original": {
@@ -331,11 +331,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771423170,
-        "narHash": "sha256-K7Dg9TQ0mOcAtWTO/FX/FaprtWQ8BmEXTpLIaNRhEwU=",
+        "lastModified": 1771207753,
+        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bcc4a9d9533c033d806a46b37dc444f9b0da49dd",
+        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
         "type": "github"
       },
       "original": {
@@ -347,11 +347,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1771932323,
-        "narHash": "sha256-3PadsTzuMJT/x0KmiD/Me1GG6rW8kaHoWVduSs0ue7o=",
+        "lastModified": 1771612900,
+        "narHash": "sha256-ToJ0wYbphG1ZN7bgGpCJxu69Tt3ij0+T6W4YljLCHak=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "89bb5c5da7a857869cc88ef9b856bffdff8af264",
+        "rev": "f65d4c996f96838b8f50253859cf7b17e956a792",
         "type": "github"
       },
       "original": {
@@ -363,11 +363,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1771482645,
-        "narHash": "sha256-MpAKyXfJRDTgRU33Hja+G+3h9ywLAJJNRq4Pjbb4dQs=",
+        "lastModified": 1771207753,
+        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "724cf38d99ba81fbb4a347081db93e2e3a9bc2ae",
+        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
         "type": "github"
       },
       "original": {
@@ -379,11 +379,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1771714954,
-        "narHash": "sha256-nhZJPnBavtu40/L2aqpljrfUNb2rxmWTmSjK2c9UKds=",
+        "lastModified": 1771419570,
+        "narHash": "sha256-bxAlQgre3pcQcaRUm/8A0v/X8d2nhfraWSFqVmMcBcU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "afbbf774e2087c3d734266c22f96fca2e78d3620",
+        "rev": "6d41bc27aaf7b6a3ba6b169db3bd5d6159cfaa47",
         "type": "github"
       },
       "original": {
@@ -496,11 +496,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1771788390,
-        "narHash": "sha256-RzBpBwn93GWxLjacTte+ngwwg0L/BVOg4G/sSIeK3Rw=",
+        "lastModified": 1771429540,
+        "narHash": "sha256-YKytDx8LOPOvE+dip1ja+1nbIpDVdqTaFbP4MaXwveM=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "ebb238f14d6f930068be4718472da3105fd5d3bf",
+        "rev": "1a5c9d8be82127aeccc929f60b952e8a3df6b63c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -50,21 +50,9 @@
     }:
 
     let
-      my-lib = import ./lib { inherit (nixpkgs) lib; };
+      my-lib = import ./lib { lib = nixpkgs.lib; };
 
-      overlays = [
-        (_: prev: {
-          inherit
-            (
-              (import inputs.nixpkgs-unstable {
-                inherit (prev.stdenv.hostPlatform) system;
-                config.allowUnfree = true;
-              })
-            )
-            claude-code
-            ;
-        })
-      ];
+      overlays = [ ];
 
       mkHost = my-lib.mkHost {
         inherit
@@ -98,7 +86,7 @@
 
       nixosModules = import ./modules/nixos {
         inherit my-lib;
-        inherit (nixpkgs) lib;
+        lib = nixpkgs.lib;
       } { };
     }
     // flake-utils.lib.eachDefaultSystem (
@@ -107,25 +95,15 @@
         pkgs = nixpkgs.legacyPackages.${system};
       in
       {
-        packages =
-          import ./packages
-            {
+        packages = import ./packages {
           inherit my-lib;
-              inherit (nixpkgs) lib;
-            }
-            {
-              pkgs = nixpkgs.legacyPackages.${system};
-              pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
-              pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
-            };
+          lib = nixpkgs.lib;
+        } (inputs // { inherit system; });
 
         formatter = pkgs.nixfmt-tree;
 
         devShells.default = pkgs.mkShell {
-          packages = [
-            pkgs.pre-commit
-            pkgs.statix
-          ];
+          packages = [ pkgs.pre-commit ];
         };
       }
     );

hosts/live-iso/configuration.nix

@@ -1,19 +1,5 @@
+{ pkgs, lib, ... }:
 {
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-let
-  keys = import ../../users/matej/keys.nix;
-in
-{
-  imports = [
-    inputs.self.nixosModules.openssh
-  ];
-
-  openssh.enable = true;
-
   image.modules.iso-installer = {
     isoImage.squashfsCompression = "zstd -Xcompression-level 6";
   };
@@ -24,6 +10,17 @@ in
   };
   boot.loader.grub.device = lib.mkDefault "/dev/sda";
 
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      PermitRootLogin = "no";
+      StreamLocalBindUnlink = "yes";
+    };
+  };
+
   networking.firewall.allowedTCPPorts = [ 22 ];
 
   users = {
@@ -41,9 +38,14 @@ in
         "wheel"
         "users"
       ];
-      openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+      ];
     };
   };
 
+  # boot.extraModulePackages = [ pkgs.linuxPackages.r8125 ];
+  # boot.blacklistedKernelModules = [ "r8169" ];
+
   system.stateVersion = "25.05";
 }

hosts/matej-nixos/configuration.nix

@@ -19,44 +19,20 @@ in
     inputs.self.nixosModules.openssh
     inputs.self.nixosModules.desktop
     inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.nvidia
-    inputs.self.nixosModules.initrd-ssh
   ];
 
+  # Modules
   yubikey.enable = true;
   openssh.enable = true;
   desktop.enable = true;
   printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
 
   sway = {
     enable = true;
     cmdFlags = [ "--unsupported-gpu" ];
   };
 
-  nvidia.enable = true;
-
-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-    ip = {
-      enable = true;
-      address = "10.222.0.247";
-      gateway = "10.222.0.1";
-      interface = "enp5s0";
-    };
-  };
-
+  # Stylix theming
   stylix = {
     enable = true;
     polarity = "dark";
@@ -64,22 +40,49 @@ in
     base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
   };
 
+  # Boot
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
+  # Locale
   time.timeZone = "Europe/Ljubljana";
   environment.variables.TZ = "America/New_York";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  # WARN:(@janezicmatej) nix-ld for running pip-installed binaries outside nix, probably want to drop this
+  # Docker
+  virtualisation.docker = {
+    enable = true;
+    logDriver = "json-file";
+  };
+
+  # nix-ld for pip-installed binaries
+  # WARN:(matej) probably want to drop this in the future
   programs.nix-ld.enable = true;
   programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
 
+  # Security
   security.pki.certificateFiles = [ packages.ca-matheo-si ];
   services.gnome.gnome-keyring.enable = true;
 
+  # Services
   services.teamviewer.enable = true;
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+  };
 
+  # Greetd
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Programs
   programs.thunderbird.enable = true;
   programs._1password.enable = true;
   programs._1password-gui.enable = true;
@@ -91,28 +94,16 @@ in
     localNetworkGameTransfers.openFirewall = true;
   };
 
+  # Hardware
   hardware.keyboard.zsa.enable = true;
   hardware.ledger.enable = true;
-  hardware.bluetooth.powerOnBoot = true;
 
-  networking = {
-    hostName = "matej-nixos";
-    useDHCP = false;
-    networkmanager.enable = true;
-    interfaces.enp5s0.ipv4.addresses = [
-      {
-        address = "10.222.0.247";
-        prefixLength = 24;
-      }
+  # System packages
+  environment.systemPackages = with pkgs; [
+    smartmontools
   ];
-    firewall.enable = false;
-    defaultGateway = "10.222.0.1";
-    nameservers = [
-      "1.1.1.1"
-      "8.8.8.8"
-    ];
-  };
 
+  # XDG
   xdg.mime.defaultApplications = {
     "application/pdf" = "org.pwmt.zathura.desktop";
   };

hosts/matej-nixos/hardware-configuration.nix

@@ -1,4 +1,6 @@
-# autogenerated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
@@ -12,17 +14,45 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  hardware.firmware = [ pkgs.linux-firmware ];
-
   boot.initrd.availableKernelModules = [
     "nvme"
     "xhci_pci"
     "ahci"
     "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "r8169"
+  ];
+  boot.kernelModules = [
+    "kvm-amd"
   ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
+  boot.kernelParams = [
+    "ip=10.222.0.247::10.222.0.1:255.255.255.0::enp5s0:none"
+  ];
+
+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 22;
+      hostKeys = [
+        "/etc/secrets/initrd/ssh_host_rsa_key"
+        "/etc/secrets/initrd/ssh_host_ed25519_key"
+      ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+      ];
+    };
+    postCommands = ''
+      echo 'cryptsetup-askpass' >> /root/.profile
+    '';
+
+  };
 
   boot.initrd.luks.devices."cryptlvm".device =
     "/dev/disk/by-uuid/af0608c0-67cd-4ae4-b12c-252fa947da40";
@@ -45,6 +75,76 @@
     { device = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540"; }
   ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+
+  networking = {
+    useDHCP = false;
+    hostName = "matej-nixos";
+    networkmanager.enable = true; # Easiest to use and most distros use this by default.
+    interfaces.enp5s0.ipv4.addresses = [
+      {
+        address = "10.222.0.247";
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      enable = false;
+      allowedTCPPorts = lib.range 8800 8900;
+    };
+    defaultGateway = "10.222.0.1";
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
+
+  };
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  # TODO: maybe move later
+  hardware.bluetooth.enable = true; # enables support for Bluetooth
+  hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot
+
+  # Enable OpenGL
+  hardware.graphics = {
+    enable = true;
+  };
+
+  # Load nvidia driver for Xorg and Wayland
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  hardware.nvidia = {
+    # Modesetting is required.
+    modesetting.enable = true;
+
+    # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
+    # Enable this if you have graphical corruption issues or application crashes after waking
+    # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
+    # of just the bare essentials.
+    powerManagement.enable = false;
+
+    # Fine-grained power management. Turns off GPU when not in use.
+    # Experimental and only works on modern Nvidia GPUs (Turing or newer).
+    powerManagement.finegrained = false;
+
+    # Use the NVidia open source kernel module (not to be confused with the
+    # independent third-party "nouveau" open source driver).
+    # Support is limited to the Turing and later architectures. Full list of
+    # supported GPUs is at:
+    # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
+    # Only available from driver 515.43.04+
+    open = true;
+
+    # Enable the Nvidia settings menu,
+    # accessible via `nvidia-settings`.
+    nvidiaSettings = true;
+
+    # Optionally, you may need to select the appropriate driver version for your specific GPU.
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
 }

hosts/matej-tower/configuration.nix

@@ -8,41 +8,24 @@
 }:
 
 {
-  networking.hostName = "matej-tower";
   imports = [
     inputs.stylix.nixosModules.stylix
     inputs.lanzaboote.nixosModules.lanzaboote
-
     inputs.self.nixosModules.yubikey
     inputs.self.nixosModules.sway
     inputs.self.nixosModules.openssh
     inputs.self.nixosModules.desktop
     inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.initrd-ssh
   ];
 
+  # Modules
   yubikey.enable = true;
   openssh.enable = true;
   desktop.enable = true;
   printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
   sway.enable = true;
 
-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-  };
-
+  # Stylix theming
   stylix = {
     enable = true;
     polarity = "dark";
@@ -50,8 +33,7 @@
     base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
   };
 
-  # lanzaboote secure boot
-  boot.kernelParams = [ "btusb.reset=1" ];
+  # Boot - Lanzaboote secure boot
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.systemd-boot.enable = lib.mkForce false;
   boot.lanzaboote = {
@@ -59,26 +41,53 @@
     pkiBundle = "/var/lib/sbctl";
   };
 
+  # Locale
   time.timeZone = "Europe/Ljubljana";
   environment.variables.TZ = "Europe/Ljubljana";
 
+  # Docker
+  virtualisation.docker = {
+    enable = true;
+    logDriver = "json-file";
+  };
+
+  # Services
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+  };
   services.udisks2.enable = true;
 
+  # Greetd
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd sway";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Programs
   programs._1password.enable = true;
   programs._1password-gui.enable = true;
 
-  # higher sample rate for audio equipment
+  # Higher sample rate pipewire for audio equipment
   services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
     "context.properties" = {
       "default.clock.rate" = 192000;
-      "default.allowed-rates" = [ 192000 ];
+      "defautlt.allowed-rates" = [ 192000 ];
     };
   };
 
+  # System packages
   environment.systemPackages = with pkgs; [
+    smartmontools
     easyeffects
   ];
 
+  # XDG
   xdg.mime.defaultApplications = {
     "application/pdf" = "org.pwmt.zathura.desktop";
   };

hosts/matej-tower/hardware-configuration.nix

@@ -1,4 +1,6 @@
-# autogenerated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
   config,
   lib,
@@ -18,9 +20,13 @@
     "nvme"
     "xhci_pci"
     "ahci"
-    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "r8169"
   ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
@@ -45,6 +51,34 @@
     { device = "/dev/disk/by-uuid/e0952ef2-1a9a-4022-bbcf-b2f016384258"; }
   ];
 
+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 22;
+      hostKeys = [
+        "/etc/secrets/initrd/ssh_host_rsa_key"
+        "/etc/secrets/initrd/ssh_host_ed25519_key"
+      ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+      ];
+    };
+    postCommands = ''
+      echo 'cryptsetup-askpass' >> /root/.profile
+    '';
+
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp11s0.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

lib/autoDir.nix

@@ -1,6 +1,6 @@
 lib:
 
-# import all .nix files in dir as attribute set
+# takes dir as an argument and creates an attribute set by importing all .nix files in that directory
 dir:
 let
   readDir = builtins.readDir dir;

lib/mkHost.nix

@@ -15,11 +15,15 @@ let
   hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
   hasHWConfig = builtins.pathExists hostHWConfig;
 
+  # Load NixOS-level user config (account, groups, SSH keys)
   userNixosConfigs = map (user: ../users/${user}/nixos.nix) (
     builtins.filter (user: builtins.pathExists ../users/${user}/nixos.nix) users
   );
 
-  userHMConfigs = nixpkgs.lib.genAttrs users (user: import ../users/${user}/home-manager.nix);
+  # Load home-manager user config
+  userHMConfigs = nixpkgs.lib.genAttrs users (
+    user: import ../users/${user}/home-manager.nix
+  );
 
 in
 nixpkgs.lib.nixosSystem {
@@ -39,7 +43,6 @@ nixpkgs.lib.nixosSystem {
     {
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
-      home-manager.backupFileExtension = "backup";
       home-manager.users = userHMConfigs;
       home-manager.extraSpecialArgs = { inherit inputs; };
     }

modules/nixos/desktop.nix

@@ -12,20 +12,26 @@
   };
 
   config = lib.mkIf config.desktop.enable {
+    # Audio
     services.pipewire = {
       enable = true;
       pulse.enable = true;
     };
 
+    # Bluetooth
     hardware.bluetooth.enable = true;
     services.blueman.enable = true;
 
+    # Security
     security.polkit.enable = true;
 
+    # D-Bus
     services.dbus.enable = true;
 
+    # Player control
     services.playerctld.enable = true;
 
+    # XDG Portals
     xdg.portal = {
       enable = true;
       xdgOpenUsePortal = true;
@@ -35,6 +41,7 @@
       ];
     };
 
+    # Fonts
     fonts.packages = with pkgs; [
       font-awesome
       nerd-fonts.jetbrains-mono

modules/nixos/gnupg.nix

@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    gnupg = {
-      enable = lib.mkEnableOption "GnuPG agent with SSH support";
-    };
-  };
-
-  config = lib.mkIf config.gnupg.enable {
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      enableExtraSocket = true;
-    };
-  };
-}

modules/nixos/initrd-ssh.nix

@@ -1,86 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  # TODO:(@janezicmatej) restructure keys import
-  keys = import ../../users/matej/keys.nix;
-
-  # generate host keys for new machines: ./scripts/initrd-ssh-keygen.sh
-  keyDir = "/etc/secrets/initrd";
-
-  mkIpString =
-    {
-      address,
-      gateway,
-      netmask,
-      interface,
-      ...
-    }:
-    "${address}::${gateway}:${netmask}::${interface}:none";
-in
-{
-  options = {
-    initrd-ssh = {
-      enable = lib.mkEnableOption "SSH in initrd for remote LUKS unlock";
-
-      ip = {
-        enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
-
-        address = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.247";
-        };
-
-        gateway = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.1";
-        };
-
-        netmask = lib.mkOption {
-          type = lib.types.str;
-          default = "255.255.255.0";
-        };
-
-        interface = lib.mkOption {
-          type = lib.types.str;
-          example = "enp5s0";
-        };
-      };
-
-      authorizedKeys = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = keys.sshAuthorizedKeys;
-      };
-
-      networkModule = lib.mkOption {
-        type = lib.types.str;
-        example = "r8169";
-      };
-    };
-  };
-
-  config = lib.mkIf config.initrd-ssh.enable {
-    boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
-    boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
-      "ip=${mkIpString config.initrd-ssh.ip}"
-    ];
-
-    boot.initrd.network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 22;
-        hostKeys = [
-          "${keyDir}/ssh_host_rsa_key"
-          "${keyDir}/ssh_host_ed25519_key"
-        ];
-        inherit (config.initrd-ssh) authorizedKeys;
-      };
-      postCommands = ''
-        echo 'cryptsetup-askpass' >> /root/.profile
-      '';
-    };
-  };
-}

modules/nixos/nvidia.nix

@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    nvidia.enable = lib.mkEnableOption "NVIDIA GPU support";
-  };
-
-  config = lib.mkIf config.nvidia.enable {
-    hardware.graphics.enable = true;
-
-    services.xserver.videoDrivers = [ "nvidia" ];
-
-    hardware.nvidia = {
-      modesetting.enable = true;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
-}

modules/nixos/openssh.nix

@@ -10,6 +10,7 @@
       port = lib.mkOption {
         type = lib.types.port;
         default = 22;
+        description = "SSH server port";
       };
     };
   };

modules/nixos/sway.nix

@@ -12,6 +12,7 @@
       cmdFlags = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
+        description = "additional command line flags to pass to sway";
       };
     };
   };
@@ -23,20 +24,23 @@
       wrapperFeatures.gtk = true;
       extraOptions = config.sway.cmdFlags;
       extraSessionCommands = ''
-        # fix for java awt apps not rendering
+        # Fix for some Java AWT applications (e.g. Android Studio),
+        # use this if they aren't displayed properly:
         export _JAVA_AWT_WM_NONREPARENTING=1
       '';
     };
 
     environment.systemPackages = with pkgs; [
+      # default extra packages
       brightnessctl
       foot
       grim
       pulseaudio
       swayidle
-      # use swaylock-effects instead of swaylock
+      # swaylock - use swaylock-effects instead
       swaylock-effects
       wmenu
+      # additional things i like
       slurp
       wofi
       wl-clipboard

modules/nixos/tuigreet.nix

@@ -1,33 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    tuigreet = {
-      enable = lib.mkEnableOption "greetd with tuigreet";
-
-      command = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
-  };
-
-  config = lib.mkIf config.tuigreet.enable {
-    services.greetd = {
-      enable = true;
-      useTextGreeter = true;
-      settings = {
-        default_session = {
-          command = pkgs.writeShellScript "tuigreet-session" ''
-            ${pkgs.util-linux}/bin/setterm --blank 1 --powersave powerdown --powerdown 1
-            exec ${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd ${config.tuigreet.command}
-          '';
-          user = "greeter";
-        };
-      };
-    };
-  };
-}

modules/nixos/workstation.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    workstation = {
-      enable = lib.mkEnableOption "workstation utilities";
-    };
-  };
-
-  config = lib.mkIf config.workstation.enable {
-    virtualisation.docker = {
-      enable = true;
-      logDriver = "json-file";
-    };
-
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
-    };
-
-    environment.systemPackages = with pkgs; [
-      smartmontools
-    ];
-  };
-}

modules/nixos/zsh.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    zsh = {
-      enable = lib.mkEnableOption "zsh with ZDOTDIR in ~/.config/zsh";
-    };
-  };
-
-  config = lib.mkIf config.zsh.enable {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
-}

packages/ahab.nix

@@ -1,6 +1,7 @@
-{ pkgs, ... }:
+{ nixpkgs, system, ... }:
 
 let
+  pkgs = import nixpkgs { inherit system; };
   version = "v0.3.2";
 in
 pkgs.rustPlatform.buildRustPackage {

packages/ca-matheo-si.nix

@@ -1,12 +1,13 @@
-{ pkgs, ... }:
+{ nixpkgs, system, ... }:
 
 let
+  pkgs = import nixpkgs { inherit system; };
   version = "C6r62em";
 in
 
 pkgs.stdenv.mkDerivation {
   pname = "ca-matheo-si";
-  inherit version;
+  version = version;
 
   src = pkgs.fetchurl {
     url = "http://ipa2.matheo.si/ipa/config/ca.crt";

packages/ggman.nix

@@ -1,7 +1,8 @@
-{ pkgs-master, ... }:
+{ nixpkgs-master, system, ... }:
 
 let
-  pkgs = pkgs-master;
+  nixpkgs = nixpkgs-master;
+  pkgs = import nixpkgs { inherit system; };
   version = "e24855c";
 in
 pkgs.buildGoModule.override

packages/git-linearize.nix

@@ -1,6 +1,7 @@
-{ pkgs, ... }:
+{ nixpkgs, system, ... }:
 
 let
+  pkgs = import nixpkgs { inherit system; };
   version = "main";
 in
 pkgs.stdenv.mkDerivation {

packages/releasectl.nix

@@ -0,0 +1,28 @@
+{ nixpkgs-master, system, ... }:
+
+let
+  nixpkgs = nixpkgs-master;
+  pkgs = import nixpkgs { inherit system; };
+  version = "v1.25.0";
+  python = pkgs.python313;
+in
+
+python.pkgs.buildPythonPackage rec {
+  pname = "releasectl";
+  version = "1.2.0";
+
+  src = pkgs.fetchurl {
+    url = "https://gitlab.com/flarenetwork/infra-public/pipeliner/-/package_files/216813866/download";
+    sha256 = "sha256-ScBG8BoOKDdOAHTFP+zwyk+Kfu31WoKQSRkutOvnJ5E";
+  };
+
+  format = "wheel"; # if it uses poetry/PEP517, otherwise "setuptools"
+  # nativeBuildInputs = [ python.pkgs.setuptools python.pkgs.wheel ];
+  # propagatedBuildInputs = with python.pkgs; [
+  #   # add runtime deps here if needed
+  # ];
+
+  # pyproject = true;
+  # build-system =  [ pkgs.python313Packages.hatchling ];
+
+}

scripts/initrd-ssh-keygen.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-KEY_DIR="/etc/secrets/initrd"
-
-echo "Generating initrd SSH host keys in $KEY_DIR"
-
-sudo mkdir -p "$KEY_DIR"
-
-if [[ ! -f "$KEY_DIR/ssh_host_rsa_key" ]]; then
-  sudo ssh-keygen -t rsa -N "" -f "$KEY_DIR/ssh_host_rsa_key"
-  echo "Generated: $KEY_DIR/ssh_host_rsa_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_rsa_key"
-fi
-
-if [[ ! -f "$KEY_DIR/ssh_host_ed25519_key" ]]; then
-  sudo ssh-keygen -t ed25519 -N "" -f "$KEY_DIR/ssh_host_ed25519_key"
-  echo "Generated: $KEY_DIR/ssh_host_ed25519_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_ed25519_key"
-fi
-
-echo "Done. Now run nixos-rebuild."

statix.toml

@@ -1 +0,0 @@
-disabled = ["repeated_keys"]

users/matej/home-manager.nix

@@ -13,7 +13,7 @@ in
 {
   home.stateVersion = "24.11";
 
-  # TODO:(@janezicmatej) do i need this here?
+  # TODO:(janezicmatej) do i need this here?
   services.dunst.enable = true;
 
   home.packages = [
@@ -74,7 +74,6 @@ in
     pkgs.mdformat
 
     # security
-    pkgs.gnupg
     pkgs.pass
   ];
 
@@ -85,6 +84,17 @@ in
     nix-direnv.enable = true;
   };
 
+  programs.zsh = {
+    enable = true;
+    dotDir = "${config.xdg.configHome}/zsh";
+  };
+
+  services.gpg-agent = {
+    enable = true;
+    enableSshSupport = true;
+    enableExtraSocket = true;
+  };
+
   stylix.targets.neovim.enable = false;
   programs.neovim = {
     enable = true;
@@ -99,6 +109,7 @@ in
       luajit
       nodejs_22 # copilot
 
+      # treesitter
       tree-sitter
 
       # lua_fzf
@@ -108,6 +119,7 @@ in
       gnumake
       delta
 
+      # language server
       pyright
       typescript-language-server
       lua-language-server
@@ -115,6 +127,7 @@ in
       nil
       nixd
 
+      # formatters
       nixpkgs-fmt
       stylua
     ];

users/matej/nixos.nix

@@ -1,7 +1,6 @@
 {
   lib,
   config,
-  pkgs,
   ...
 }:
 let
@@ -12,7 +11,6 @@ in
     uid = 1000;
     isNormalUser = true;
     home = "/home/matej";
-    shell = pkgs.zsh;
     extraGroups = [
       "wheel"
       "docker"