switch: gen 101 @ 2026-04-09T18:34:41-07:00

configuration.nix

@@ -6,7 +6,7 @@
 	    ];
 
 
-  #### Bootloader (EFI + GRUB with OS prober + theme)
+  # Bootloader Grub + Hyperfluent
   boot.loader = {
     efi.canTouchEfiVariables = true;
     grub = {
@@ -29,7 +29,7 @@
   
   boot.initrd.systemd.enable = true;
   boot.kernelParams = [ "quiet" "splash" ];
-  #### Host & networking
+  # Host & Networking
   networking.hostName = "nixos";
   networking.networkmanager.enable = true;
   networking.firewall.enable = true;
@@ -37,7 +37,7 @@
     networkmanager-openvpn
   ];
   services.tailscale.enable = true;
-  #### Enabiling Tuxedo
+  # Enabiling Tuxedo
   hardware.tuxedo-rs = {
     enable = false;
     tailor-gui.enable = true;
@@ -45,14 +45,14 @@
   
   hardware.uinput.enable = true;
 
-  #### Locale & time
+  # Locale & time
   time.timeZone = "America/Los_Angeles";
-  i18n.defaultLocale = "en_US.UTF-8"; # extraLocaleSettings dropped (defaults are fine)
+  i18n.defaultLocale = "en_US.UTF-8";
 
   programs.mtr.enable = true;
   
-  #### Display (Plasma 6 with SDDM)
-  services.xserver.enable = true;         # keep Xorg for compatibility; Wayland works via Plasma 6
+  # Display
+  services.xserver.enable = true;
   services.displayManager.sddm = {
       enable = true;
       wayland.enable = true;
@@ -60,7 +60,7 @@
   services.desktopManager.plasma6.enable = true;
   services.xserver.xkb.layout = "us";
 
-  #### Desktop niceties
+  # Misc QOL Addons
   boot.plymouth = {
       enable = true;
       theme = "blahaj"; 
@@ -69,7 +69,7 @@
   services.printing.enable = true;
   hardware.bluetooth.enable = true;
 
-  #### Audio (PipeWire)
+  # Audio (PipeWire)
   services.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {
@@ -77,35 +77,34 @@
     alsa.enable = true;
     alsa.support32Bit = true;
     pulse.enable = true;
-    # jack.enable = true; # uncomment if you need JACK apps
   };
   
 
   programs.nix-ld.enable = true;
-  #### Users (let Home Manager own user apps)
+  # Users
   users.users.system32 = {
     isNormalUser = true;
     description = "System32";
     extraGroups = [ "networkmanager" "wheel" "wireshark" "docker" "uinput" "video" ];
   };
 
-  #### System-wide programs and features
-  programs.firefox.enable = true;     # keep at system level (optional)
-  programs.wireshark.enable = true;   # requires group + capabilities
-  nixpkgs.config.allowUnfree = true;  # needed for some packages (e.g., vmware, spotify, zoom)
+  # System-wide programs and features
+  programs.firefox.enable = true;
+  programs.wireshark.enable = true;
+  nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nixpkgs.overlays = [
     (import ./overlays/bambu.nix)
   ];
 
-  #### Fonts (example minimal set)
+  # Fonts
   fonts.packages = with pkgs; [
     noto-fonts
     noto-fonts-cjk-sans
     noto-fonts-color-emoji
   ];
 
-  #### Packages that truly need to be system-wide (drivers, VPN plugins, kernel hooks, etc.)
+  # Mandatory systemwide packages
   environment.systemPackages = with pkgs; [
     networkmanager-openvpn
     plymouth
@@ -117,19 +116,16 @@
     plymouth-blahaj-theme
   ];
 
-  #### VMware host modules
+  # VMware Settings
   virtualisation.vmware.host.enable = true;
   virtualisation.docker.enable = true;
 
   
-  #### sops-nix (secrets management)
+  # sops-nix
   sops = {
-    # Use an existing system age key
-    age.keyFile = "/var/lib/sops-nix/key";  # adjust to keys.txt if that's your filename
-    age.sshKeyPaths = [ ];                         # avoid mixing with host ssh keys
-
-    # Optional: centralize secrets in one file (uncomment when created with `sops`)
-    # defaultSopsFile = ./secrets/secrets.yaml;
+    age.keyFile = "/var/lib/sops-nix/key";
+    age.sshKeyPaths = [ ];
+    defaultSopsFile = ./secrets/secrets.yaml;
 
     # Example secret (uncomment and add to your secrets.yaml when ready)
     # secrets."example.env" = {
@@ -139,7 +135,7 @@
   };
 
 
-  #### (User-requested) Restore OPENSSL_CONF override for wpa_supplicant
+  # OPENSSL_CONF override for wpa_supplicant
    systemd.services.wpa_supplicant.environment.OPENSSL_CONF = pkgs.writeText"openssl.cnf""
    openssl_conf = openssl_init
    [openssl_init]
@@ -169,6 +165,6 @@
   };
 
 
-  #### NixOS state version
+  # NixOS state version
   system.stateVersion = "25.05";
 }

flake.nix

@@ -1,7 +1,7 @@
 {
-  # 1. Inputs: Define where we get our packages and modules
+  # Inputs
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; # or nixos-unstable
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     
     home-manager = {
@@ -14,18 +14,16 @@
     vicinae.url = "github:vicinaehq/vicinae";
   };
 
-  # 2. Outputs: Use the inputs (captured as @inputs) to build the system
+  # Outputs
   outputs = { self, nixpkgs, nixpkgs-unstable, home-manager, sops-nix, vicinae, spicetify-nix, ... } @ inputs: 
   let
     system = "x86_64-linux";
 
-    # Global unfree config for stable
     pkgs = import nixpkgs {
       inherit system;
       config.allowUnfree = true;
     };
 
-    # Global unfree config for unstable
     pkgsUnstable = import nixpkgs-unstable {
       inherit system;
       config.allowUnfree = true;
@@ -34,7 +32,6 @@
     nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
       inherit system;
 
-      # Pass our custom variables and all inputs to our sub-modules
       specialArgs = {
         inherit pkgsUnstable inputs;
       };
@@ -60,7 +57,7 @@
             vicinae.homeManagerModules.default
           ];
 
-          # Your JetBrains configuration
+          # JetBrains configuration
           programs.jetbrainsUnstable = {
             enable = true;
             ides = [

home.nix

@@ -4,7 +4,7 @@
   home.homeDirectory = "/home/system32";
   home.stateVersion = "24.11";
 
-  ##### User applications and CLIs (moved here from systemPackages)
+  # Applications
   home.packages = with pkgs; [
     kdePackages.kate
     git
@@ -49,7 +49,7 @@
     chatterino7
   ];
 
-  ##### Git config
+  # Git Config
   programs.git = {
     enable = true;
     signing.format = "openpgp";
@@ -61,7 +61,19 @@
     };
   };
 
-  ##### Shell + prompt
+  # SSH Config
+  programs.ssh = {
+    enable = true;
+    matchBlocks = {
+      "gitea.sys64.dev" = {
+	hostname = "gitea.sys64.dev";
+	user = "git";
+	identityFile = "~/.ssh/id_ed25519_gitea";
+      };
+    };
+  };
+
+  # Oh My Posh
   programs.bash.enable = true;
   programs.oh-my-posh = {
     enable = true;
@@ -69,40 +81,24 @@
     enableBashIntegration = true;
   };
 
-  ##### Qt / Kvantum theming
-  qt = {
-    enable = false;            # was false; enable so platformTheme/style apply
-    platformTheme = "qtct";
-    style.name = "kvantum";
-  };
-
-  xdg.configFile = {
-    "Kvantum/kvantum.kvconfig".text = ''
-      [General]
-      theme=Nordic-Darker
-    '';
-    "Kvantum/Nordic-Darker".source = "${pkgs.nordic}/kde/kvantum/Nordic-Darker";
-  };
-
+  # Vicinae
   services.vicinae = {
-    enable = true; # default: false
+    enable = true;
     systemd = {
-      enable = true; # default: false
-      autoStart = true; # default: false
+      enable = true;
+      autoStart = true;
       environment = {
         USE_LAYER_SHELL = 1;
       };
     };
   };
 
-  ##### Session variables (add as needed)
+  # Session Variables
   home.sessionVariables = { };
 
-  ##### Optional: KDE Connect as a user service
+  # KDE Connect
   services.kdeconnect.enable = true;
-
   programs.direnv.enable = true;
   programs.direnv.nix-direnv.enable = true;
-
   programs.home-manager.enable = true;
 }

modules/auto-push.nix

@@ -1,9 +1,8 @@
-# modules/auto-push.nix (robust push + logs + explicit gitdir)
 { config, pkgs, lib, ... }:
 
 let
-  flakeRepo = "/etc/nixos";   # change if your flake lives elsewhere
-  branch    = "main";         # change if your GitHub default branch isn't main
+  flakeRepo = "/etc/nixos";
+  branch    = "main";
 
   autoPushOnSwitch = pkgs.writeShellScript "nixos-flake-auto-push-on-switch.sh" ''
     set -euo pipefail
@@ -13,7 +12,6 @@ let
     pwd
     ls -ld .git || true
 
-    # Build a git command that always works, even if .git is a redirection file
     GIT="git"
     if [ -f .git ]; then
       gitdir="$(sed -n 's/^gitdir:[[:space:]]*//p' .git)"
@@ -24,22 +22,17 @@ let
       GIT="git --work-tree=${flakeRepo} --git-dir=${flakeRepo}/.git"
     fi
 
-    # Sanity: are we in a repo? Show diagnostics and continue anyway
     if ! $GIT rev-parse --is-inside-work-tree >/dev/null 2>&1; then
       echo "Repo check failed; attempting with explicit gitdir/worktree anyway" >&2
     fi
 
-    # Commit identity
     $GIT config user.name  "nixos" || true
     $GIT config user.email "nixos@$(hostname)" || true
 
-    # Non-interactive SSH for pushes
     export GIT_SSH_COMMAND='ssh -i /root/.ssh/id_ed25519 -o BatchMode=yes -o StrictHostKeyChecking=accept-new'
 
-    # Remote must exist
     $GIT remote get-url origin || { echo "No origin remote set" >&2; exit 0; }
 
-    # Ensure local branch exists & has upstream; create and set upstream if needed
     current_branch="$($GIT symbolic-ref --quiet --short HEAD || echo detached)"
     if [ "$current_branch" = "detached" ]; then
       if ! $GIT show-ref --verify --quiet refs/heads/${branch}; then
@@ -50,25 +43,20 @@ let
       current_branch="${branch}"
     fi
 
-    # Make sure upstream exists
     $GIT fetch origin || true
     $GIT rev-parse --verify --quiet "origin/${branch}" || true
     $GIT branch --set-upstream-to="origin/${branch}" "''${current_branch}" 2>/dev/null || true
 
-    # Pull latest to reduce push conflicts
     $GIT pull --rebase --autostash origin ${branch} || true
 
-    # Current system generation for commit message
     gen="$(nix-env -p /nix/var/nix/profiles/system --list-generations 2>/dev/null | tail -1 | awk '{print $1}')"
     gen="''${gen:-unknown}"
 
-    # Stage & commit if there are changes
     if [ -n "$($GIT status --porcelain)" ]; then
       $GIT add -A
       $GIT commit -m "switch: gen ''$gen @ $(date -Is)" || true
     fi
 
-    # Push if we are ahead or if no upstream tracking is set
     ahead=$($GIT rev-list --count @{u}..HEAD 2>/dev/null || echo 0)
     if [ "$ahead" -gt 0 ]; then
       $GIT push -u origin HEAD:${branch}
@@ -87,9 +75,8 @@ in
     serviceConfig = {
       Type = "oneshot";
       ExecStart = "${autoPushOnSwitch}";
-      WorkingDirectory = flakeRepo; # keep in sync with flakeRepo above
+      WorkingDirectory = flakeRepo;
       User = "root";
-      # Ensure common tools are on PATH (git, hostname, ssh)
       Environment = "PATH=/run/current-system/sw/bin:/nix/var/nix/profiles/default/bin";
       StandardOutput = "journal";
       StandardError = "journal";
@@ -103,7 +90,6 @@ in
   };
   system.activationScripts.autoPushAfterSwitch = {
      text = ''
-       # fire-and-forget after a successful switch
        /run/current-system/sw/bin/systemctl start nixos-flake-auto-push-on-switch.service || true
      '';
   };

modules/jetbrains-unstable.nix

@@ -1,7 +1,7 @@
 { lib
 , config
-, pkgs           # your primary (stable/regular) nixpkgs
-, pkgsUnstable   # provided by flake's specialArgs (see flake below)
+, pkgs
+, pkgsUnstable
 , ...
 }:
 
@@ -54,7 +54,6 @@ in
   };
 
   config = mkIf cfg.enable {
-    # JetBrains binaries are unfree
     nixpkgs.config.allowUnfree = true;
 
     environment.systemPackages =

modules/spotify.nix

@@ -7,15 +7,15 @@ let
     mkdir -p $out
     cp ${pkgs.fetchurl {
       url = "https://spicetify-lucid.sanooj.uk/spice/user.css";
-      hash = "sha256-X7WVWgRrqXs1dqFwWVBRsW063QwAeHZWhdiXRx6cpTg="; # Replace with real hash
+      hash = "sha256-X7WVWgRrqXs1dqFwWVBRsW063QwAeHZWhdiXRx6cpTg=";
     }} $out/user.css
     cp ${pkgs.fetchurl {
       url = "https://spicetify-lucid.sanooj.uk/spice/color.ini";
-      hash = "sha256-iVxVBO1HvI0trHsw7GC3sEGvyOzHHTdkRvpqyfqlcVk="; # Replace with real hash
+      hash = "sha256-iVxVBO1HvI0trHsw7GC3sEGvyOzHHTdkRvpqyfqlcVk=";
     }} $out/color.ini
     cp ${pkgs.fetchurl {
       url = "https://spicetify-lucid.sanooj.uk/spice/theme.js";
-      hash = "sha256-q4UIx/2nJ54P9qTikowQrzp3RUiBK9f/YlAvh1LFMGs="; # Replace with real hash
+      hash = "sha256-q4UIx/2nJ54P9qTikowQrzp3RUiBK9f/YlAvh1LFMGs=";
     }} $out/theme.js
   '';
 in
@@ -25,12 +25,10 @@ in
   programs.spicetify = {
     enable = true;
 
-    # Use our manually constructed theme folder
     theme = {
       name = "Lucid";
       src = lucidTheme;
       appendName = false;
-      # This ensures the theme.js (external JS) is injected correctly
       injectExtraJs = true;
     };
 

sddm-wallpaper.nix

@@ -1,9 +1,8 @@
 { config, lib, pkgs, inputs, ... }:
 let
-  # Define the custom background package with the correct relative path
   background-package = pkgs.stdenvNoCC.mkDerivation {
     name = "background-image";
-    src = ./wallpaper.png;  # Place wallpaper.jpg in the same directory as this config file
+    src = ./wallpaper.png;
     dontUnpack = true;
     installPhase = ''
       cp $src $out
@@ -11,7 +10,6 @@ let
   };
   
 in {
-# X11 and KDE Plasma configuration
   services.xserver.enable = true;
   services.displayManager.sddm = {
     enable = lib.mkDefault true;