feat: move nix settings to nix.nix

fix: import module for live-iso
feat: add direnv and direnv setup
2026-02-20 19:43:02 +01:00 · 2026-02-20 18:24:40 +01:00 · 2026-02-20 18:06:31 +01:00 · 2026-02-20 18:00:58 +01:00 · 2026-02-20 16:53:37 +01:00
39 changed files with 803 additions and 933 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -1,3 +0,0 @@
-# nix fmt & statix
-f011c8d71ba09bd94ab04b8d771858b90a03fbf9
-3aff25b4486a143cd6282f8845c16216598e1c7e
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1 @@
+assets/** filter=lfs diff=lfs merge=lfs -text
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,11 +4,3 @@ repos:
    hooks:
      - id: nixfmt-nix
        args: [--, --check]
-  - repo: local
-    hooks:
-      - id: statix
-        name: statix
-        entry: statix check
-        language: system
-        files: \.nix$
-        pass_filenames: false
--- a/assets/lockscreen.png
+++ b/assets/lockscreen.png
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:47098eed6a818a4e6181e2cdd6d1244b2adc46d748da5944a7bf89068eb1c8ad
+size 497830
--- a/assets/wallpaper.png
+++ b/assets/wallpaper.png
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0d5ab6c3434f2b1b8ebac566fef17fad16dbb6415d76ab06e6abf483b563bc25
+size 16097396
--- a/flake.lock
+++ b/flake.lock
@@ -1,21 +1,5 @@
 {
  "nodes": {
-    "assets": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1771625274,
-        "narHash": "sha256-2wWMWsPnIweJWiojeTXdnsTsKzU9R4igc6p50rEAkpk=",
-        "ref": "refs/heads/main",
-        "rev": "7eceaa56b64490ef15ce651e2376eae553d1d50a",
-        "revCount": 1,
-        "type": "git",
-        "url": "https://git.janezic.dev/janezicmatej/assets.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.janezic.dev/janezicmatej/assets.git"
-      }
-    },
    "base16": {
      "inputs": {
        "fromYaml": "fromYaml"
@@ -300,11 +284,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1771545891,
-        "narHash": "sha256-aaVUfc/9q2pCsELZmYhf+uvYRMCUlBvccgL1VS27R+o=",
+        "lastModified": 1770681890,
+        "narHash": "sha256-ommto8XEvGMYGuvrIjj2VM1tFZkRoLLmSuie+fvTTOk=",
        "owner": "nix-community",
        "repo": "neovim-nightly-overlay",
-        "rev": "917b72d5e27bc217440655b81f701d7062bdd198",
+        "rev": "3560c52c15aad8fccd4f62ae794b622969050202",
        "type": "github"
      },
      "original": {
@@ -316,11 +300,11 @@
    "neovim-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1771541613,
-        "narHash": "sha256-1Rpt5B4pNW/MNkWoEamqwCa5I4/9G84dSqp4eHS5zsA=",
+        "lastModified": 1770678367,
+        "narHash": "sha256-suvGeMX6UQdyGuSNRLH4zJ25b72XfQBDva7Fxm+PNiA=",
        "owner": "neovim",
        "repo": "neovim",
-        "rev": "e3d46a63375c84b7bd409f1f07ef56eb985eae50",
+        "rev": "57fc77ed29ad9005d893a9dc2f37b3ad53aec4e6",
        "type": "github"
      },
      "original": {
@@ -329,13 +313,49 @@
        "type": "github"
      }
    },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1736643958,
+        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-generators": {
+      "inputs": {
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769813415,
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1771207753,
-        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
+        "lastModified": 1770537093,
+        "narHash": "sha256-pF1quXG5wsgtyuPOHcLfYg/ft/QMr8NnX0i6tW2187s=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
+        "rev": "fef9403a3e4d31b0a23f0bacebbec52c248fbb51",
        "type": "github"
      },
      "original": {
@@ -347,11 +367,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1771612900,
-        "narHash": "sha256-ToJ0wYbphG1ZN7bgGpCJxu69Tt3ij0+T6W4YljLCHak=",
+        "lastModified": 1770713048,
+        "narHash": "sha256-YU2SCyrWaoGgpdsHvpX5wZgbRtWnp3FfN1fSWX1aSpc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "f65d4c996f96838b8f50253859cf7b17e956a792",
+        "rev": "2123953aa6e9e1045857adac93ce7c9a4a5d81d8",
        "type": "github"
      },
      "original": {
@@ -363,11 +383,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1771207753,
-        "narHash": "sha256-b9uG8yN50DRQ6A7JdZBfzq718ryYrlmGgqkRm9OOwCE=",
+        "lastModified": 1770537093,
+        "narHash": "sha256-pF1quXG5wsgtyuPOHcLfYg/ft/QMr8NnX0i6tW2187s=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d1c15b7d5806069da59e819999d70e1cec0760bf",
+        "rev": "fef9403a3e4d31b0a23f0bacebbec52c248fbb51",
        "type": "github"
      },
      "original": {
@@ -379,11 +399,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1771419570,
-        "narHash": "sha256-bxAlQgre3pcQcaRUm/8A0v/X8d2nhfraWSFqVmMcBcU=",
+        "lastModified": 1770617025,
+        "narHash": "sha256-1jZvgZoAagZZB6NwGRv2T2ezPy+X6EFDsJm+YSlsvEs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "6d41bc27aaf7b6a3ba6b169db3bd5d6159cfaa47",
+        "rev": "2db38e08fdadcc0ce3232f7279bab59a15b94482",
        "type": "github"
      },
      "original": {
@@ -443,11 +463,11 @@
    },
    "root": {
      "inputs": {
-        "assets": "assets",
        "flake-utils": "flake-utils",
        "home-manager": "home-manager",
        "lanzaboote": "lanzaboote",
        "neovim-nightly-overlay": "neovim-nightly-overlay",
+        "nixos-generators": "nixos-generators",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-master": "nixpkgs-master",
        "nixpkgs-unstable": "nixpkgs-unstable",
@@ -496,11 +516,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1771429540,
-        "narHash": "sha256-YKytDx8LOPOvE+dip1ja+1nbIpDVdqTaFbP4MaXwveM=",
+        "lastModified": 1770308890,
+        "narHash": "sha256-7bx8Bn9B2g/loBaz+uLwdKI2rUW+RhDPyP/MqAgvrxU=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "1a5c9d8be82127aeccc929f60b952e8a3df6b63c",
+        "rev": "7e7fa955abac04a8e118b1cedf930a8fd41c34a6",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -17,6 +17,11 @@

    flake-utils.url = "github:numtide/flake-utils";

+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    home-manager = {
      url = "github:nix-community/home-manager/release-25.11";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -35,36 +40,20 @@
      url = "github:nix-community/lanzaboote/v1.0.0";
      inputs.nixpkgs.follows = "nixpkgs";
    };
-
-    assets = {
-      url = "git+https://git.janezic.dev/janezicmatej/assets.git";
-      flake = false;
-    };
  };

  outputs =
    inputs@{
      nixpkgs,
      flake-utils,
+      nixos-generators,
      ...
    }:

    let
-      my-lib = import ./lib { inherit (nixpkgs) lib; };
+      my-lib = import ./lib { lib = nixpkgs.lib; };

-      overlays = [
-        (_: prev: {
-          inherit
-            (
-              (import inputs.nixpkgs-unstable {
-                inherit (prev.stdenv.hostPlatform) system;
-                config.allowUnfree = true;
-              })
-            )
-            claude-code
-            ;
-        })
-      ];
+      overlays = [ ];

      mkHost = my-lib.mkHost {
        inherit
@@ -79,6 +68,15 @@
    {
      lib = my-lib;

+      # nix build .#iso
+      # dd bs=4M if=result/iso/my-nixos-live.iso of=/dev/sdX status=progress oflag=sync
+      live-iso = nixos-generators.nixosGenerate {
+        system = "x86_64-linux";
+        format = "install-iso";
+        specialArgs = { inherit inputs; };
+        modules = [ ./hosts/live-iso/configuration.nix ];
+      };
+
      nixosConfigurations = {
        matej-nixos = mkHost "matej-nixos" {
          system = "x86_64-linux";
@@ -89,22 +87,11 @@
          users = [ "matej" ];
        };

-        # nixos-rebuild build-image --image-variant install-iso --flake .#live-iso
-        live-iso = mkHost "live-iso" {
-          system = "x86_64-linux";
-          users = [ ];
-        };
-
-        # nixos-rebuild build-image --image-variant qemu --flake .#sandbox
-        sandbox = mkHost "sandbox" {
-          system = "x86_64-linux";
-          users = [ "gorazd" ];
-        };
      };

      nixosModules = import ./modules/nixos {
        inherit my-lib;
-        inherit (nixpkgs) lib;
+        lib = nixpkgs.lib;
      } { };
    }
    // flake-utils.lib.eachDefaultSystem (
@@ -113,25 +100,15 @@
        pkgs = nixpkgs.legacyPackages.${system};
      in
      {
-        packages =
-          import ./packages
-            {
+        packages = import ./packages {
          inherit my-lib;
-              inherit (nixpkgs) lib;
-            }
-            {
-              pkgs = nixpkgs.legacyPackages.${system};
-              pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.${system};
-              pkgs-master = inputs.nixpkgs-master.legacyPackages.${system};
-            };
+          lib = nixpkgs.lib;
+        } (inputs // { inherit system; });

        formatter = pkgs.nixfmt-tree;

        devShells.default = pkgs.mkShell {
-          packages = [
-            pkgs.pre-commit
-            pkgs.statix
-          ];
+          packages = [ pkgs.pre-commit ];
        };
      }
    );
--- a/hosts/live-iso/configuration.nix
+++ b/hosts/live-iso/configuration.nix
@@ -1,30 +1,23 @@
+{ pkgs, lib, ... }:
 {
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-let
-  keys = import ../../users/matej/keys.nix;
-in
-{
-  imports = [
-    inputs.self.nixosModules.openssh
-  ];
-
-  openssh.enable = true;
-
-  image.modules.iso-installer = {
+  # Use zstd instead of xz for compressing the liveUSB image, it's 6x faster and 15% bigger.
  isoImage.squashfsCompression = "zstd -Xcompression-level 6";
+
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      PermitRootLogin = "no";
+      StreamLocalBindUnlink = "yes";
+    };
  };

-  fileSystems."/" = lib.mkDefault {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
+  networking = {
+    useDHCP = true;
+    firewall.allowedTCPPorts = [ 22 ];
  };
-  boot.loader.grub.device = lib.mkDefault "/dev/sda";
-
-  networking.firewall.allowedTCPPorts = [ 22 ];

  users = {
    groups.matej = {
@@ -41,9 +34,14 @@ in
        "wheel"
        "users"
      ];
-      openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+      ];
    };
  };

+  # boot.extraModulePackages = [ pkgs.linuxPackages.r8125 ];
+  # boot.blacklistedKernelModules = [ "r8169" ];
+
  system.stateVersion = "25.05";
 }
--- a/hosts/matej-nixos/configuration.nix
+++ b/hosts/matej-nixos/configuration.nix
@@ -1,3 +1,7 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
 {
  config,
  lib,
@@ -16,106 +20,274 @@ in
    inputs.stylix.nixosModules.stylix
    inputs.self.nixosModules.yubikey
    inputs.self.nixosModules.sway
-    inputs.self.nixosModules.openssh
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.nvidia
-    inputs.self.nixosModules.initrd-ssh
  ];

  yubikey.enable = true;
-  openssh.enable = true;
-  desktop.enable = true;
-  printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
+
+  stylix = {
    enable = true;
-    command = "sway";
+    polarity = "dark";
+    image = "${inputs.self}/assets/wallpaper.png";
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
  };

+  virtualisation.docker = {
+    enable = true;
+    logDriver = "json-file";
+  };
+
+  # WARN:(matej) probably want to drop this in the future
+  # i added this to get ruff working when installed via pip
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
+
+  services.blueman.enable = true;
+  security.polkit.enable = true;
+  security.pki.certificateFiles = [ packages.ca-matheo-si ];
+
+  services.gnome.gnome-keyring.enable = true;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Ljubljana";
+  environment.variables.TZ = "America/New_York";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  #console = {
+  #  font = "Lat2-Terminus16";
+  #  keyMap = "us";
+  #  #useXkbConfig = true;
+  #};
+
+  users.defaultUserShell = pkgs.zsh;
+  users.users.matej = {
+    uid = 1000;
+    isNormalUser = true;
+    home = "/home/matej";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+    ];
+  };
+
+  services.teamviewer.enable = true;
+  users.groups.matej = {
+    gid = 1000;
+    members = [ "matej" ];
+  };
+
+  home-manager.backupFileExtension = "backup";
+  home-manager.users.matej = {
+    home.stateVersion = "24.11";
+    home.packages = [ ];
+  };
+
+  programs.zsh = {
+    enable = true;
+  };
+  environment.etc."zshenv".text = ''
+    export ZDOTDIR=$HOME/.config/zsh
+  '';
+
+  # Wayland, X, etc. support for session vars
+  # systemd.user.sessionVariables = config.home-manager.users.matej.home.sessionVariables; };
+
+  # enable Sway window manager
  sway = {
    enable = true;
    cmdFlags = [ "--unsupported-gpu" ];
  };

-  nvidia.enable = true;
-
-  initrd-ssh = {
+  services.greetd = {
    enable = true;
-    networkModule = "r8169";
-    ip = {
-      enable = true;
-      address = "10.222.0.247";
-      gateway = "10.222.0.1";
-      interface = "enp5s0";
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd sway";
+        user = "greeter";
      };
    };
-
-  stylix = {
-    enable = true;
-    polarity = "dark";
-    image = "${inputs.assets}/wallpaper.png";
-    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
  };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  time.timeZone = "Europe/Ljubljana";
-  environment.variables.TZ = "America/New_York";
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  # WARN:(@janezicmatej) nix-ld for running pip-installed binaries outside nix, probably want to drop this
-  programs.nix-ld.enable = true;
-  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
-
-  security.pki.certificateFiles = [ packages.ca-matheo-si ];
-  services.gnome.gnome-keyring.enable = true;
-
-  services.teamviewer.enable = true;
+  # users.users.greeter = {
+  #   isSystemUser = true;
+  #   description = "greetd user";
+  #   group = "nogroup";
+  #   home = "/var/lib/greetd";
+  # };

  programs.thunderbird.enable = true;
  programs._1password.enable = true;
  programs._1password-gui.enable = true;
-  programs.firefox.enable = true;
+
+  services.playerctld.enable = true;
+
+  fonts.packages = with pkgs; [
+    font-awesome
+    nerd-fonts.jetbrains-mono
+    maple-mono.NF
+  ];
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableExtraSocket = true;
+    enableSSHSupport = true;
+  };
+
  programs.steam = {
    enable = true;
-    remotePlay.openFirewall = true;
-    dedicatedServer.openFirewall = true;
-    localNetworkGameTransfers.openFirewall = true;
+    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+    localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
  };
-
  hardware.keyboard.zsa.enable = true;
  hardware.ledger.enable = true;
-  hardware.bluetooth.powerOnBoot = true;

-  networking = {
-    hostName = "matej-nixos";
-    useDHCP = false;
-    networkmanager.enable = true;
-    interfaces.enp5s0.ipv4.addresses = [
-      {
-        address = "10.222.0.247";
-        prefixLength = 24;
-      }
-    ];
-    firewall.enable = false;
-    defaultGateway = "10.222.0.1";
-    nameservers = [
-      "1.1.1.1"
-      "8.8.8.8"
+  environment.systemPackages = with pkgs; [
+    # discord
+    vesktop
+    rocketchat-desktop
+    telegram-desktop
+    slack
+    #
+    ghostty
+    mdbook
+    pass
+    google-chrome
+    # nodejs
+    pavucontrol
+    protonmail-bridge
+    python3
+    zathura
+    smartmontools
+    marksman
+    mdformat
+    jellyfin-media-player
+    cider-2
+    libnotify # need this for runelite
+    bolt-launcher
+    ledger-live-desktop
  ];
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
  };

-  xdg.mime.defaultApplications = {
+  # Enable sound.
+  # hardware.pulseaudio.enable = true;
+  # OR
+  services.pipewire = {
+    enable = true;
+    # alsa.enable = true;
+    # alsa.support32Bit = true;
+    pulse.enable = true;
+    # jack.enable = true;
+  };
+
+  services.dbus.enable = true;
+
+  xdg = {
+    portal = {
+      xdgOpenUsePortal = true;
+      enable = true;
+      extraPortals = [
+        pkgs.xdg-desktop-portal-wlr
+        pkgs.xdg-desktop-portal-gtk
+      ];
+    };
+    mime.defaultApplications = {
      "application/pdf" = "org.pwmt.zathura.desktop";
    };
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.alice = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  #   packages = with pkgs; [
+  #     tree
+  #   ];
+  # };
+
+  programs.firefox.enable = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      PermitRootLogin = "no";
+      StreamLocalBindUnlink = "yes";
+    };
+  };
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.11"; # Did you read the comment?

-  system.stateVersion = "24.11";
 }
--- a/hosts/matej-nixos/hardware-configuration.nix
+++ b/hosts/matej-nixos/hardware-configuration.nix
@@ -1,4 +1,6 @@
-# autogenerated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
  config,
  lib,
@@ -12,17 +14,45 @@
    (modulesPath + "/installer/scan/not-detected.nix")
  ];

-  hardware.firmware = [ pkgs.linux-firmware ];
-
  boot.initrd.availableKernelModules = [
    "nvme"
    "xhci_pci"
    "ahci"
    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "r8169"
+  ];
+  boot.kernelModules = [
+    "kvm-amd"
  ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];
+  boot.kernelParams = [
+    "ip=10.222.0.247::10.222.0.1:255.255.255.0::enp5s0:none"
+  ];
+
+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 22;
+      hostKeys = [
+        "/etc/secrets/initrd/ssh_host_rsa_key"
+        "/etc/secrets/initrd/ssh_host_ed25519_key"
+      ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+      ];
+    };
+    postCommands = ''
+      echo 'cryptsetup-askpass' >> /root/.profile
+    '';
+
+  };

  boot.initrd.luks.devices."cryptlvm".device =
    "/dev/disk/by-uuid/af0608c0-67cd-4ae4-b12c-252fa947da40";
@@ -45,6 +75,76 @@
    { device = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540"; }
  ];

+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+
+  networking = {
+    useDHCP = false;
+    hostName = "matej-nixos";
+    networkmanager.enable = true; # Easiest to use and most distros use this by default.
+    interfaces.enp5s0.ipv4.addresses = [
+      {
+        address = "10.222.0.247";
+        prefixLength = 24;
+      }
+    ];
+    firewall = {
+      enable = false;
+      allowedTCPPorts = lib.range 8800 8900;
+    };
+    defaultGateway = "10.222.0.1";
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
+
+  };
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  # TODO: maybe move later
+  hardware.bluetooth.enable = true; # enables support for Bluetooth
+  hardware.bluetooth.powerOnBoot = true; # powers up the default Bluetooth controller on boot
+
+  # Enable OpenGL
+  hardware.graphics = {
+    enable = true;
+  };
+
+  # Load nvidia driver for Xorg and Wayland
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  hardware.nvidia = {
+    # Modesetting is required.
+    modesetting.enable = true;
+
+    # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
+    # Enable this if you have graphical corruption issues or application crashes after waking
+    # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
+    # of just the bare essentials.
+    powerManagement.enable = false;
+
+    # Fine-grained power management. Turns off GPU when not in use.
+    # Experimental and only works on modern Nvidia GPUs (Turing or newer).
+    powerManagement.finegrained = false;
+
+    # Use the NVidia open source kernel module (not to be confused with the
+    # independent third-party "nouveau" open source driver).
+    # Support is limited to the Turing and later architectures. Full list of
+    # supported GPUs is at:
+    # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
+    # Only available from driver 515.43.04+
+    open = true;
+
+    # Enable the Nvidia settings menu,
+    # accessible via `nvidia-settings`.
+    nvidiaSettings = true;
+
+    # Optionally, you may need to select the appropriate driver version for your specific GPU.
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
 }
--- a/hosts/matej-tower/configuration.nix
+++ b/hosts/matej-tower/configuration.nix
@@ -1,3 +1,7 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
 {
  config,
  lib,
@@ -7,81 +11,282 @@
  ...
 }:

+let
+  packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+in
+
 {
-  networking.hostName = "matej-tower";
  imports = [
    inputs.stylix.nixosModules.stylix
    inputs.lanzaboote.nixosModules.lanzaboote
-
    inputs.self.nixosModules.yubikey
    inputs.self.nixosModules.sway
-    inputs.self.nixosModules.openssh
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.printing
-    inputs.self.nixosModules.zsh
-    inputs.self.nixosModules.gnupg
-    inputs.self.nixosModules.tuigreet
-    inputs.self.nixosModules.workstation
-    inputs.self.nixosModules.initrd-ssh
  ];

-  yubikey.enable = true;
-  openssh.enable = true;
-  desktop.enable = true;
-  printing.enable = true;
-  zsh.enable = true;
-  gnupg.enable = true;
-  workstation.enable = true;
-  tuigreet = {
-    enable = true;
-    command = "sway";
-  };
  sway.enable = true;
+  yubikey.enable = true;

-  initrd-ssh = {
-    enable = true;
-    networkModule = "r8169";
-  };
+  fonts.packages = with pkgs; [
+    font-awesome
+    nerd-fonts.jetbrains-mono
+    maple-mono.NF
+  ];

  stylix = {
    enable = true;
    polarity = "dark";
-    image = "${inputs.assets}/wallpaper.png";
+    image = "${inputs.self}/assets/wallpaper.png";
    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
  };

-  # lanzaboote secure boot
-  boot.kernelParams = [ "btusb.reset=1" ];
+  virtualisation.docker = {
+    enable = true;
+    logDriver = "json-file";
+  };
+
+  # Use the systemd-boot EFI boot loader.
  boot.loader.efi.canTouchEfiVariables = true;
+
  boot.loader.systemd-boot.enable = lib.mkForce false;
  boot.lanzaboote = {
    enable = true;
    pkiBundle = "/var/lib/sbctl";
  };

-  time.timeZone = "Europe/Ljubljana";
-  environment.variables.TZ = "Europe/Ljubljana";
+  services.udev.packages = with pkgs; [
+    yubikey-personalization
+  ];
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+  };

  services.udisks2.enable = true;
+  security.polkit.enable = true;
+
+  hardware.bluetooth.enable = true;
+  services.blueman.enable = true;
+
+  users.defaultUserShell = pkgs.zsh;
+  programs.zsh = {
+    enable = true;
+  };
+  environment.etc."zshenv".text = ''
+    export ZDOTDIR=$HOME/.config/zsh
+  '';

  programs._1password.enable = true;
  programs._1password-gui.enable = true;

-  # higher sample rate for audio equipment
-  services.pipewire.extraConfig.pipewire.adjust-sample-rate = {
-    "context.properties" = {
-      "default.clock.rate" = 192000;
-      "default.allowed-rates" = [ 192000 ];
+  users.users.matej = {
+    uid = 1000;
+    isNormalUser = true;
+    home = "/home/matej";
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+    ];
+  };
+
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = null;
+      PermitRootLogin = "no";
+      StreamLocalBindUnlink = "yes";
    };
  };

+  services.greetd = {
+    enable = true;
+    useTextGreeter = true;
+    settings = {
+      default_session = {
+        user = "greeter";
+        command = ''
+          ${pkgs.tuigreet}/bin/tuigreet \
+            --time \
+            --remember \
+            --cmd "sway"
+        '';
+      };
+    };
+  };
+
+  networking.hostName = "matej-tower"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+  time.timeZone = "Europe/Ljubljana";
+  environment.variables.TZ = "Europe/Ljubljana";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # services.pulseaudio.enable = true;
+  # OR
+  # services.pipewire = {
+  #   enable = true;
+  #   pulse.enable = true;
+  # };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.alice = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  #   packages = with pkgs; [
+  #     tree
+  #   ];
+  # };
+
+  # programs.firefox.enable = true;
+
+  services.printing.enable = true;
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+  };
+
+  services.pipewire = {
+    enable = true;
+    # alsa.enable = true;
+    # alsa.support32Bit = true;
+    pulse.enable = true;
+    # jack.enable = true;
+    extraConfig.pipewire.adjust-sample-rate = {
+      "context.properties" = {
+        "default.clock.rate" = 192000;
+        #"defautlt.allowed-rates" = [ 192000 48000 44100 ];
+        "defautlt.allowed-rates" = [ 192000 ];
+        # "default.clock.quantum" = 32;
+        # "default.clock.min-quantum" = 32;
+        # "default.clock.max-quantum" = 32;
+      };
+    };
+  };
+
+  services.dbus.enable = true;
+
+  services.playerctld.enable = true;
+
+  xdg = {
+    portal = {
+      xdgOpenUsePortal = true;
+      enable = true;
+      extraPortals = [
+        pkgs.xdg-desktop-portal-wlr
+        pkgs.xdg-desktop-portal-gtk
+      ];
+    };
+    mime.defaultApplications = {
+      "application/pdf" = "org.pwmt.zathura.desktop";
+    };
+  };
+
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
  environment.systemPackages = with pkgs; [
+    vim
+    wget
+    ghostty
+    vesktop
+    rocketchat-desktop
+    telegram-desktop
+    slack
+    mdbook
+    google-chrome
+    pavucontrol
+    protonmail-bridge
+    python3
+    zathura
+    smartmontools
+    marksman
+    mdformat
+    jellyfin-media-player
+    cider-2
+    bolt-launcher
    easyeffects
  ];

-  xdg.mime.defaultApplications = {
-    "application/pdf" = "org.pwmt.zathura.desktop";
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+  programs.gnupg.agent = {
+    enable = true;
+    enableExtraSocket = true;
+    enableSSHSupport = true;
  };

-  system.stateVersion = "25.05";
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+
 }
--- a/hosts/matej-tower/hardware-configuration.nix
+++ b/hosts/matej-tower/hardware-configuration.nix
@@ -1,4 +1,6 @@
-# autogenerated by 'nixos-generate-config'
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 {
  config,
  lib,
@@ -18,9 +20,13 @@
    "nvme"
    "xhci_pci"
    "ahci"
-    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "r8169"
  ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
  boot.kernelModules = [ "kvm-amd" ];
  boot.extraModulePackages = [ ];

@@ -45,6 +51,34 @@
    { device = "/dev/disk/by-uuid/e0952ef2-1a9a-4022-bbcf-b2f016384258"; }
  ];

+  boot.initrd.network = {
+    enable = true;
+    ssh = {
+      enable = true;
+      port = 22;
+      hostKeys = [
+        "/etc/secrets/initrd/ssh_host_rsa_key"
+        "/etc/secrets/initrd/ssh_host_ed25519_key"
+      ];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
+      ];
+    };
+    postCommands = ''
+      echo 'cryptsetup-askpass' >> /root/.profile
+    '';
+
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp11s0.useDHCP = lib.mkDefault true;
+
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/sandbox/configuration.nix
+++ b/hosts/sandbox/configuration.nix
@@ -1,132 +0,0 @@
-{
-  pkgs,
-  lib,
-  inputs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    inputs.self.nixosModules.vm-guest
-    inputs.self.nixosModules.desktop
-    inputs.self.nixosModules.zsh
-  ];
-
-  vm-guest.enable = true;
-  desktop.enable = true;
-  zsh.enable = true;
-
-  programs.labwc.enable = true;
-
-  # labwc stacking compositor with auto-login
-  services.greetd =
-    let
-      labwc-session = pkgs.writeShellScript "labwc-session" ''
-        export XDG_SESSION_TYPE=wayland
-        export XDG_CURRENT_DESKTOP=labwc:wlroots
-        # software renderer for qemu virtio-vga
-        export WLR_RENDERER=pixman
-        export WLR_DRM_NO_ATOMIC=1
-        exec ${pkgs.labwc}/bin/labwc
-      '';
-    in
-    {
-      enable = true;
-      settings = {
-        default_session = {
-          command = labwc-session;
-          user = "gorazd";
-        };
-        initial_session = {
-          command = labwc-session;
-          user = "gorazd";
-        };
-      };
-    };
-
-  users = {
-    groups.gorazd = {
-      gid = 1000;
-    };
-    users.gorazd = {
-      group = "gorazd";
-      uid = 1000;
-      isNormalUser = true;
-      home = "/home/gorazd";
-      createHome = true;
-      password = "sandbox";
-      extraGroups = [
-        "wheel"
-        "users"
-      ];
-    };
-  };
-
-  # 9p mounts for host files
-  fileSystems."/home/gorazd/projects" = {
-    device = "projects";
-    fsType = "9p";
-    options = [
-      "trans=virtio"
-      "version=9p2000.L"
-      "msize=65536"
-      "nofail"
-    ];
-  };
-
-  fileSystems."/mnt/host-claude" = {
-    device = "hostclaude";
-    fsType = "9p";
-    options = [
-      "trans=virtio"
-      "version=9p2000.L"
-      "msize=65536"
-      "nofail"
-    ];
-  };
-
-  fileSystems."/mnt/host-home" = {
-    device = "hosthome";
-    fsType = "9p";
-    options = [
-      "trans=virtio"
-      "version=9p2000.L"
-      "msize=65536"
-      "nofail"
-      "ro"
-    ];
-  };
-
-  # pre-auth claude-code from host config
-  systemd.services.claude-auth = {
-    description = "Copy claude-code credentials from host mount";
-    after = [
-      "mnt-host\\x2dclaude.mount"
-      "mnt-host\\x2dhome.mount"
-    ];
-    requires = [
-      "mnt-host\\x2dclaude.mount"
-      "mnt-host\\x2dhome.mount"
-    ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.writeShellScript "claude-auth" ''
-        mkdir -p /home/gorazd/.claude
-        cp -a /mnt/host-claude/. /home/gorazd/.claude/
-        cp /mnt/host-home/.claude.json /home/gorazd/.claude.json || true
-        chown -R gorazd:gorazd /home/gorazd/.claude /home/gorazd/.claude.json
-      '';
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    claude-code
-    labwc
-    sfwbar
-    foot
-    firefox
-  ];
-
-  system.stateVersion = "25.11";
-}
--- a/hosts/sandbox/hardware-configuration.nix
+++ b/hosts/sandbox/hardware-configuration.nix
@@ -1,18 +0,0 @@
-{
-  lib,
-  modulesPath,
-  ...
-}:
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    autoResize = true;
-    fsType = "ext4";
-  };
-
-  boot.loader.grub.device = lib.mkDefault "/dev/vda";
-}
--- a/60
+++ b/60
@@ -1,60 +0,0 @@
-[private]
-default:
-    @just --list
-
-# rebuild and switch
-switch:
-    nixos-rebuild switch --flake . --sudo
-
-# fetch flake inputs
-sync:
-    nix flake prefetch-inputs
-
-# update flake inputs
-update:
-    nix flake update
-
-# update flake inputs, rebuild and switch
-bump: update switch
-
-# build installation iso
-iso:
-    nixos-rebuild build-image --image-variant iso-installer --flake .#live-iso
-
-# garbage collect old generations
-clean:
-    sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
-
-# build sandbox VM image
-sandbox-build:
-    nixos-rebuild build-image --image-variant qemu --flake .#sandbox
-
-# run sandbox with GUI (ephemeral, changes discarded)
-sandbox-run:
-    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
-      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
-      -vga virtio -display gtk,zoom-to-fit=false \
-      -device virtio-serial-pci \
-      -chardev qemu-vdagent,id=ch1,name=vdagent,clipboard=on \
-      -device virtserialport,chardev=ch1,id=ch1,name=com.redhat.spice.0 \
-      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
-      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
-      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
-      -nic user,hostfwd=tcp::2222-:22
-
-# run sandbox headless (ephemeral, changes discarded)
-sandbox-run-headless:
-    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
-      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
-      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
-      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
-      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
-      -nic user,hostfwd=tcp::2222-:22 -nographic
-
-# ssh into running sandbox
-sandbox-ssh:
-    ssh -A -p 2222 gorazd@localhost
-
-# hot-mount a host directory into the running sandbox
-sandbox-mount path:
-    ssh -p 2222 gorazd@localhost "mkdir -p ~/mnt/$(basename {{path}}) && sshfs matej@10.0.2.2:{{path}} ~/mnt/$(basename {{path}})"
--- a/lib/autoDir.nix
+++ b/lib/autoDir.nix
@@ -1,6 +1,6 @@
 lib:

-# import all .nix files in dir as attribute set
+# takes dir as an argument and creates an attribute set by importing all .nix files in that directory
 dir:
 let
  readDir = builtins.readDir dir;
--- a/lib/mkHost.nix
+++ b/lib/mkHost.nix
@@ -13,36 +13,33 @@ name:
 let
  hostConfig = ../hosts/${name}/configuration.nix;
  hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
-  hasHWConfig = builtins.pathExists hostHWConfig;

-  userNixosConfigs = map (user: ../users/${user}/nixos.nix) (
-    builtins.filter (user: builtins.pathExists ../users/${user}/nixos.nix) users
+  userHMConfigs = nixpkgs.lib.genAttrs users (
+    user: import ../users/${user}/home-manager.nix { inherit inputs; }
  );

-  userHMConfigs = nixpkgs.lib.genAttrs users (user: import ../users/${user}/home-manager.nix);
-
 in
+
 nixpkgs.lib.nixosSystem {
  inherit system;
  modules = [
+
    ../nix.nix

    { nixpkgs.overlays = overlays; }
    { nixpkgs.config.allowUnfree = true; }

    hostConfig
-  ]
-  ++ nixpkgs.lib.optional hasHWConfig hostHWConfig
-  ++ userNixosConfigs
-  ++ [
+    hostHWConfig
+
    inputs.home-manager.nixosModules.home-manager
    {
      home-manager.useGlobalPkgs = true;
      home-manager.useUserPackages = true;
-      home-manager.backupFileExtension = "backup";
      home-manager.users = userHMConfigs;
      home-manager.extraSpecialArgs = { inherit inputs; };
    }
+
  ];
  specialArgs = { inherit inputs; };
 }
--- a/modules/nixos/desktop.nix
+++ b/modules/nixos/desktop.nix
@@ -1,44 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    desktop = {
-      enable = lib.mkEnableOption "base desktop environment";
-    };
-  };
-
-  config = lib.mkIf config.desktop.enable {
-    services.pipewire = {
-      enable = true;
-      pulse.enable = true;
-    };
-
-    hardware.bluetooth.enable = true;
-    services.blueman.enable = true;
-
-    security.polkit.enable = true;
-
-    services.dbus.enable = true;
-
-    services.playerctld.enable = true;
-
-    xdg.portal = {
-      enable = true;
-      xdgOpenUsePortal = true;
-      extraPortals = [
-        pkgs.xdg-desktop-portal-wlr
-        pkgs.xdg-desktop-portal-gtk
-      ];
-    };
-
-    fonts.packages = with pkgs; [
-      font-awesome
-      nerd-fonts.jetbrains-mono
-      maple-mono.NF
-    ];
-  };
-}
--- a/modules/nixos/gnupg.nix
+++ b/modules/nixos/gnupg.nix
@@ -1,20 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    gnupg = {
-      enable = lib.mkEnableOption "GnuPG agent with SSH support";
-    };
-  };
-
-  config = lib.mkIf config.gnupg.enable {
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      enableExtraSocket = true;
-    };
-  };
-}
--- a/modules/nixos/initrd-ssh.nix
+++ b/modules/nixos/initrd-ssh.nix
@@ -1,86 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  # TODO:(@janezicmatej) restructure keys import
-  keys = import ../../users/matej/keys.nix;
-
-  # generate host keys for new machines: ./scripts/initrd-ssh-keygen.sh
-  keyDir = "/etc/secrets/initrd";
-
-  mkIpString =
-    {
-      address,
-      gateway,
-      netmask,
-      interface,
-      ...
-    }:
-    "${address}::${gateway}:${netmask}::${interface}:none";
-in
-{
-  options = {
-    initrd-ssh = {
-      enable = lib.mkEnableOption "SSH in initrd for remote LUKS unlock";
-
-      ip = {
-        enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
-
-        address = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.247";
-        };
-
-        gateway = lib.mkOption {
-          type = lib.types.str;
-          example = "10.222.0.1";
-        };
-
-        netmask = lib.mkOption {
-          type = lib.types.str;
-          default = "255.255.255.0";
-        };
-
-        interface = lib.mkOption {
-          type = lib.types.str;
-          example = "enp5s0";
-        };
-      };
-
-      authorizedKeys = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = keys.sshAuthorizedKeys;
-      };
-
-      networkModule = lib.mkOption {
-        type = lib.types.str;
-        example = "r8169";
-      };
-    };
-  };
-
-  config = lib.mkIf config.initrd-ssh.enable {
-    boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
-    boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
-      "ip=${mkIpString config.initrd-ssh.ip}"
-    ];
-
-    boot.initrd.network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 22;
-        hostKeys = [
-          "${keyDir}/ssh_host_rsa_key"
-          "${keyDir}/ssh_host_ed25519_key"
-        ];
-        inherit (config.initrd-ssh) authorizedKeys;
-      };
-      postCommands = ''
-        echo 'cryptsetup-askpass' >> /root/.profile
-      '';
-    };
-  };
-}
--- a/modules/nixos/nvidia.nix
+++ b/modules/nixos/nvidia.nix
@@ -1,23 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    nvidia.enable = lib.mkEnableOption "NVIDIA GPU support";
-  };
-
-  config = lib.mkIf config.nvidia.enable {
-    hardware.graphics.enable = true;
-
-    services.xserver.videoDrivers = [ "nvidia" ];
-
-    hardware.nvidia = {
-      modesetting.enable = true;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
-}
--- a/modules/nixos/openssh.nix
+++ b/modules/nixos/openssh.nix
@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    openssh = {
-      enable = lib.mkEnableOption "hardened SSH server";
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 22;
-      };
-    };
-  };
-
-  config = lib.mkIf config.openssh.enable {
-    services.openssh = {
-      enable = true;
-      ports = [ config.openssh.port ];
-      settings = {
-        PasswordAuthentication = false;
-        AllowUsers = null;
-        PermitRootLogin = "no";
-        StreamLocalBindUnlink = "yes";
-      };
-    };
-  };
-}
--- a/modules/nixos/printing.nix
+++ b/modules/nixos/printing.nix
@@ -1,21 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    printing = {
-      enable = lib.mkEnableOption "CUPS printing with Avahi discovery";
-    };
-  };
-
-  config = lib.mkIf config.printing.enable {
-    services.printing.enable = true;
-    services.avahi = {
-      enable = true;
-      nssmdns4 = true;
-      openFirewall = true;
-    };
-  };
-}
--- a/modules/nixos/sway.nix
+++ b/modules/nixos/sway.nix
@@ -12,6 +12,7 @@
      cmdFlags = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
+        description = "additional command line flags to pass to sway";
      };
    };
  };
@@ -23,20 +24,23 @@
      wrapperFeatures.gtk = true;
      extraOptions = config.sway.cmdFlags;
      extraSessionCommands = ''
-        # fix for java awt apps not rendering
+        # Fix for some Java AWT applications (e.g. Android Studio),
+        # use this if they aren't displayed properly:
        export _JAVA_AWT_WM_NONREPARENTING=1
      '';
    };

    environment.systemPackages = with pkgs; [
+      # default extra packages
      brightnessctl
      foot
      grim
      pulseaudio
      swayidle
-      # use swaylock-effects instead of swaylock
+      # swaylock - use swaylock-effects instead
      swaylock-effects
      wmenu
+      # additional things i like
      slurp
      wofi
      wl-clipboard
--- a/modules/nixos/tuigreet.nix
+++ b/modules/nixos/tuigreet.nix
@@ -1,33 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    tuigreet = {
-      enable = lib.mkEnableOption "greetd with tuigreet";
-
-      command = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
-  };
-
-  config = lib.mkIf config.tuigreet.enable {
-    services.greetd = {
-      enable = true;
-      useTextGreeter = true;
-      settings = {
-        default_session = {
-          command = pkgs.writeShellScript "tuigreet-session" ''
-            ${pkgs.util-linux}/bin/setterm --blank 1 --powersave powerdown --powerdown 1
-            exec ${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd ${config.tuigreet.command}
-          '';
-          user = "greeter";
-        };
-      };
-    };
-  };
-}
--- a/modules/nixos/vm-guest.nix
+++ b/modules/nixos/vm-guest.nix
@@ -1,55 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-
-  options = {
-    vm-guest = {
-      enable = lib.mkEnableOption "VM guest configuration";
-    };
-  };
-
-  config = lib.mkIf config.vm-guest.enable {
-    services.qemuGuest.enable = true;
-    services.spice-vdagentd.enable = true;
-
-    # 9p for host file mounting
-    boot.initrd.availableKernelModules = [
-      "9p"
-      "9pnet_virtio"
-    ];
-    boot.kernelModules = [
-      "9p"
-      "9pnet_virtio"
-    ];
-
-    # ssh with agent forwarding for git and hot-mount
-    services.openssh = {
-      enable = true;
-      ports = [ 22 ];
-      settings = {
-        PasswordAuthentication = true;
-        PermitRootLogin = "no";
-        AllowAgentForwarding = true;
-        StreamLocalBindUnlink = "yes";
-      };
-    };
-
-    networking = {
-      useDHCP = true;
-      firewall.allowedTCPPorts = [ 22 ];
-    };
-
-    security.sudo.wheelNeedsPassword = false;
-
-    environment.systemPackages = with pkgs; [
-      curl
-      wget
-      htop
-      sshfs
-    ];
-  };
-}
--- a/modules/nixos/workstation.nix
+++ b/modules/nixos/workstation.nix
@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options = {
-    workstation = {
-      enable = lib.mkEnableOption "workstation utilities";
-    };
-  };
-
-  config = lib.mkIf config.workstation.enable {
-    virtualisation.docker = {
-      enable = true;
-      logDriver = "json-file";
-    };
-
-    services.tailscale = {
-      enable = true;
-      useRoutingFeatures = "both";
-    };
-
-    environment.systemPackages = with pkgs; [
-      smartmontools
-    ];
-  };
-}
--- a/modules/nixos/zsh.nix
+++ b/modules/nixos/zsh.nix
@@ -1,19 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options = {
-    zsh = {
-      enable = lib.mkEnableOption "zsh with ZDOTDIR in ~/.config/zsh";
-    };
-  };
-
-  config = lib.mkIf config.zsh.enable {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
-}
--- a/packages/ahab.nix
+++ b/packages/ahab.nix
@@ -1,6 +1,7 @@
-{ pkgs, ... }:
+{ nixpkgs, system, ... }:

 let
+  pkgs = import nixpkgs { inherit system; };
  version = "v0.3.2";
 in
 pkgs.rustPlatform.buildRustPackage {
--- a/packages/ca-matheo-si.nix
+++ b/packages/ca-matheo-si.nix
@@ -1,12 +1,13 @@
-{ pkgs, ... }:
+{ nixpkgs, system, ... }:

 let
+  pkgs = import nixpkgs { inherit system; };
  version = "C6r62em";
 in

 pkgs.stdenv.mkDerivation {
  pname = "ca-matheo-si";
-  inherit version;
+  version = version;

  src = pkgs.fetchurl {
    url = "http://ipa2.matheo.si/ipa/config/ca.crt";
--- a/packages/ggman.nix
+++ b/packages/ggman.nix
@@ -1,7 +1,8 @@
-{ pkgs-master, ... }:
+{ nixpkgs-master, system, ... }:

 let
-  pkgs = pkgs-master;
+  nixpkgs = nixpkgs-master;
+  pkgs = import nixpkgs { inherit system; };
  version = "e24855c";
 in
 pkgs.buildGoModule.override
--- a/packages/git-linearize.nix
+++ b/packages/git-linearize.nix
@@ -1,6 +1,7 @@
-{ pkgs, ... }:
+{ nixpkgs, system, ... }:

 let
+  pkgs = import nixpkgs { inherit system; };
  version = "main";
 in
 pkgs.stdenv.mkDerivation {
--- a/packages/releasectl.nix
+++ b/packages/releasectl.nix
@@ -0,0 +1,28 @@
+{ nixpkgs-master, system, ... }:
+
+let
+  nixpkgs = nixpkgs-master;
+  pkgs = import nixpkgs { inherit system; };
+  version = "v1.25.0";
+  python = pkgs.python313;
+in
+
+python.pkgs.buildPythonPackage rec {
+  pname = "releasectl";
+  version = "1.2.0";
+
+  src = pkgs.fetchurl {
+    url = "https://gitlab.com/flarenetwork/infra-public/pipeliner/-/package_files/216813866/download";
+    sha256 = "sha256-ScBG8BoOKDdOAHTFP+zwyk+Kfu31WoKQSRkutOvnJ5E";
+  };
+
+  format = "wheel"; # if it uses poetry/PEP517, otherwise "setuptools"
+  # nativeBuildInputs = [ python.pkgs.setuptools python.pkgs.wheel ];
+  # propagatedBuildInputs = with python.pkgs; [
+  #   # add runtime deps here if needed
+  # ];
+
+  # pyproject = true;
+  # build-system =  [ pkgs.python313Packages.hatchling ];
+
+}
--- a/scripts/initrd-ssh-keygen.sh
+++ b/scripts/initrd-ssh-keygen.sh
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-KEY_DIR="/etc/secrets/initrd"
-
-echo "Generating initrd SSH host keys in $KEY_DIR"
-
-sudo mkdir -p "$KEY_DIR"
-
-if [[ ! -f "$KEY_DIR/ssh_host_rsa_key" ]]; then
-  sudo ssh-keygen -t rsa -N "" -f "$KEY_DIR/ssh_host_rsa_key"
-  echo "Generated: $KEY_DIR/ssh_host_rsa_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_rsa_key"
-fi
-
-if [[ ! -f "$KEY_DIR/ssh_host_ed25519_key" ]]; then
-  sudo ssh-keygen -t ed25519 -N "" -f "$KEY_DIR/ssh_host_ed25519_key"
-  echo "Generated: $KEY_DIR/ssh_host_ed25519_key"
-else
-  echo "Exists: $KEY_DIR/ssh_host_ed25519_key"
-fi
-
-echo "Done. Now run nixos-rebuild."
--- a/statix.toml
+++ b/statix.toml
@@ -1 +0,0 @@
-disabled = ["repeated_keys"]
--- a/users/gorazd/home-manager.nix
+++ b/users/gorazd/home-manager.nix
@@ -1,3 +1,5 @@
+{ inputs, ... }:
+
 {
  config,
  lib,
@@ -17,26 +19,6 @@ in
    pkgs.git
  ];

-  # labwc desktop menu (right-click)
-  xdg.configFile."labwc/menu.xml".text = ''
-    <?xml version="1.0" encoding="UTF-8"?>
-    <openbox_menu>
-      <menu id="root-menu" label="">
-        <item label="Terminal"><action name="Execute"><command>foot</command></action></item>
-        <item label="Firefox"><action name="Execute"><command>firefox</command></action></item>
-        <item label="Files"><action name="Execute"><command>foot -e ranger</command></action></item>
-        <separator />
-        <item label="Reconfigure"><action name="Reconfigure" /></item>
-        <item label="Exit"><action name="Exit" /></item>
-      </menu>
-    </openbox_menu>
-  '';
-
-  # labwc autostart panel
-  xdg.configFile."labwc/autostart".text = ''
-    sfwbar &
-  '';
-
  programs.neovim = {
    enable = true;
    vimAlias = true;
--- a/users/matej/home-manager.nix
+++ b/users/matej/home-manager.nix
@@ -1,3 +1,5 @@
+{ inputs, ... }:
+
 {
  config,
  lib,
@@ -13,18 +15,18 @@ in
 {
  home.stateVersion = "24.11";

-  # TODO:(@janezicmatej) do i need this here?
+  # TODO:(janezicmatej) do i need this here?
  services.dunst.enable = true;

  home.packages = [
    pkgs.bibata-cursors
+    pkgs.pinentry-curses

    pkgs.starship

-    pkgs.claude-code
-
    # git and co
    pkgs.git
+    pkgs.git-lfs
    packages.git-linearize
    packages.ggman

@@ -51,34 +53,9 @@ in
    # need for gcp stuff
    pkgs.google-cloud-sdk
    pkgs.google-cloud-sql-proxy
-
-    # desktop apps
-    pkgs.vesktop
-    pkgs.rocketchat-desktop
-    pkgs.telegram-desktop
-    pkgs.slack
-    pkgs.ghostty
-    pkgs.google-chrome
-    pkgs.zathura
-    pkgs.pavucontrol
-    pkgs.jellyfin-media-player
-    pkgs.cider-2
-    pkgs.protonmail-bridge
-    pkgs.ledger-live-desktop
-    pkgs.bolt-launcher
-    pkgs.libnotify
-
-    # writing/docs
-    pkgs.mdbook
-    pkgs.marksman
-    pkgs.mdformat
-
-    # security
-    pkgs.gnupg
-    pkgs.pass
  ];

-  home.file.".assets".source = inputs.assets;
+  home.file.".assets".source = "${inputs.self}/assets";

  programs.direnv = {
    enable = true;
@@ -99,6 +76,7 @@ in
      luajit
      nodejs_22 # copilot

+      # treesitter
      tree-sitter

      # lua_fzf
@@ -108,6 +86,7 @@ in
      gnumake
      delta

+      # language server
      pyright
      typescript-language-server
      lua-language-server
@@ -115,6 +94,7 @@ in
      nil
      nixd

+      # formatters
      nixpkgs-fmt
      stylua
    ];
--- a/users/matej/keys.nix
+++ b/users/matej/keys.nix
@@ -1,6 +0,0 @@
-{
-  sshAuthorizedKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
-}
--- a/users/matej/nixos.nix
+++ b/users/matej/nixos.nix
@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  keys = import ./keys.nix;
-in
-{
-  users.users.matej = {
-    uid = 1000;
-    isNormalUser = true;
-    home = "/home/matej";
-    shell = pkgs.zsh;
-    extraGroups = [
-      "wheel"
-      "docker"
-    ];
-    openssh.authorizedKeys.keys = keys.sshAuthorizedKeys;
-  };
-
-  users.groups.matej = {
-    gid = 1000;
-    members = [ "matej" ];
-  };
-}
Author	SHA1	Message	Date
Matej Janežič	5289cb0054	feat: move nix settings to nix.nix	2026-02-20 19:43:02 +01:00
Matej Janežič	a7a60826bb	fix: import module for live-iso	2026-02-20 18:24:40 +01:00
Matej Janežič	19452a8557	feat: add direnv and direnv setup	2026-02-20 18:06:31 +01:00
Matej Janežič	fb515d205b	feat: switch to nixfmt and add pre-commit hook	2026-02-20 18:00:58 +01:00
Matej Janežič	3dd048ebe3	feat: add assets via git-lfs	2026-02-20 16:53:37 +01:00
				`@@ -0,0 +1 @@`
				`assets/** filter=lfs diff=lfs merge=lfs -text`