diff options
Diffstat (limited to 'nix/host.nix')
| -rw-r--r-- | nix/host.nix | 128 |
1 files changed, 32 insertions, 96 deletions
diff --git a/nix/host.nix b/nix/host.nix index 5a3d8a9..c44319e 100644 --- a/nix/host.nix +++ b/nix/host.nix @@ -1,28 +1,14 @@ -{ config, pkgs, lib, dotfilesRoot, ... }: +{ + config, + pkgs, + lib, + dotfilesRoot, + ... +}: -# Arch host Home-Manager profile. Layered on top of `common.nix`; adds -# only host-specific concerns that don't make sense on the VM (wayland -# session tools, Yubikey, host-only CLIs / GUIs). -# -# Dotfile deployment on the host is owned entirely by **chezmoi** (run -# via `just apply` / `just sync`). Home-Manager here only installs -# binaries and writes the host-only smartcard config below. -# -# Migration policy: a tool lives here iff nixpkgs ships a working -# equivalent AND it has no tight system coupling (no setuid, no -# /usr/lib/systemd/system unit, no udev rule, no system D-Bus -# activation, no /usr/share/wayland-sessions entry, no shared lib that -# other pacman pkgs link, no system fontconfig path, no PAM, no Qt -# plugin search path, no kernel/firmware/initramfs touchpoint). -# User-scope systemd units are NOT system coupling — nix drops them in -# ~/.nix-profile/share/systemd/user/ and systemd picks them up. +# Arch host Home-Manager package profile. let - # Whisper.cpp base model — packaged inline because nixpkgs doesn't - # ship the .bin blobs. Sourced from the upstream huggingface mirror - # (same URL the AUR `whisper.cpp-model-base` uses). The dictate script - # at dot_local/bin/executable_dictate defaults to - # ~/.nix-profile/share/whisper-cpp-models/ggml-base.bin. whisper-cpp-model-base = pkgs.stdenvNoCC.mkDerivation rec { pname = "whisper-cpp-model-base"; version = "1.0"; @@ -70,10 +56,12 @@ let mainProgram = "pass-secret-service"; }; }; - arkenfox-userjs-profile = pkgs.runCommand "arkenfox-userjs-profile-${pkgs.arkenfox-userjs.version}" { } '' - install -Dm644 ${pkgs.arkenfox-userjs}/user.js $out/share/arkenfox-userjs/user.js - install -Dm644 ${pkgs.arkenfox-userjs}/user.cfg $out/share/arkenfox-userjs/user.cfg - ''; + arkenfox-userjs-profile = + pkgs.runCommand "arkenfox-userjs-profile-${pkgs.arkenfox-userjs.version}" { } + '' + install -Dm644 ${pkgs.arkenfox-userjs}/user.js $out/share/arkenfox-userjs/user.js + install -Dm644 ${pkgs.arkenfox-userjs}/user.cfg $out/share/arkenfox-userjs/user.cfg + ''; in { imports = [ ./common.nix ]; @@ -81,58 +69,29 @@ in home.username = builtins.getEnv "USER"; home.homeDirectory = builtins.getEnv "HOME"; - # Keep Nix's compiler out of PATH, but make it available to host Neovim for - # nvim-treesitter parser builds. The Nix-provided Neovim loads these parser - # .so files, so using the Nix compiler wrapper is the coherent ABI choice. + # Used by nvim-treesitter parser builds without adding a compiler to PATH. home.sessionVariables.NVIM_TREESITTER_CC = "${pkgs.stdenv.cc}/bin/cc"; home.packages = with pkgs; [ # ── Thunderbird helpers ─────────────────────────────────────────────────── - # external-editor-revived is the native-messaging host that lets the - # Thunderbird addon hand a composing draft to $EDITOR. We run TB as the - # org.mozilla.thunderbird flatpak; the AUR package would drag in system - # `thunderbird` as a hard dep, so we take it from nixpkgs here instead - # (the nix derivation has no mailer dep). The bridge wiring lives in - # run_onchange_after_deploy-tb-eer.sh.tmpl; it auto-detects the binary - # under ~/.nix-profile and the manifest gets relocated into the TB - # flatpak sandbox. external-editor-revived # ── Mail: ProtonMail Bridge ─────────────────────────────────────────────── - # Headless IMAP/SMTP gateway (127.0.0.1:1143/1025) consumed by the - # Thunderbird flatpak and `git send-email`. No system coupling: it's a - # pure user daemon with a repo-owned user unit at - # dot_config/systemd/user/protonmail-bridge.service (run --noninteractive, - # pass-backed vault via PASSWORD_STORE_DIR). Replaces the AUR - # `protonmail-bridge-core`. protonmail-bridge # ── Secrets portal ──────────────────────────────────────────────────────── - # Grimsteel's Rust org.freedesktop.secrets provider backed by pass. This is - # not nixpkgs' Python `pass-secret-service`; the repo-owned user unit at - # dot_config/systemd/user/pass-secret-service.service uses the Rust binary - # name and the PASSWORD_STORE_DIR drop-in. pass-secret-service-rust # ── Wayland session: bars, launchers, notifiers, daemons ────────────────── - # Pure user-session GUIs/daemons — no system unit, no D-Bus activation - # file under /usr/share/dbus-1, no login-manager session entry. The - # corresponding user-scope systemd units live under - # dot_config/systemd/user/ and reference these binaries by an absolute - # %h/.nix-profile/bin/<name> path. (Bare names do NOT work: systemd's - # ExecStart binary resolution does not use the imported/environment.d - # PATH of the --user manager, so a bare name fails with 203/EXEC even - # though `systemctl --user show-environment` shows the nix profile on - # PATH. The %h specifier expands to $HOME at unit-load time.) waybar mako fuzzel - wofi # used by bemoji + mako-history.sh + wofi # used by bemoji + mako-history.sh swayidle - swayr # auto-tiling + window switcher - inhibridge # browser idle-inhibit bridge → systemd-inhibit - bemoji # emoji picker (wofi backend) - wob # volume/brightness OSD + swayr # auto-tiling + window switcher + inhibridge # browser idle-inhibit bridge → systemd-inhibit + bemoji # emoji picker (wofi backend) + wob # volume/brightness OSD poweralertd # ── Wayland: capture + clipboard + image viewing ───────────────────────── @@ -140,70 +99,47 @@ in slurp wf-recorder wtype - wl-clipboard # wl-copy + wl-paste - cliphist # clipboard history (used by cliphist-{text,image} units) + wl-clipboard # wl-copy + wl-paste + cliphist # clipboard history (used by cliphist-{text,image} units) # ── Media control ──────────────────────────────────────────────────────── - playerctl # MPRIS over session bus - pulsemixer # TUI for PipeWire/PulseAudio - - # NOTE: GPU/OpenGL & EGL apps (ghostty, imv, wl-mirror) are - # intentionally NOT here — they stay on pacman/AUR. Nix-built GL apps on - # a non-NixOS host can't locate the system Mesa/DRI driver (the FHS - # /usr/lib drivers don't match nix's search paths) and fail at startup - # with "missing OpenGL context". On pacman they link against system Mesa. - # ghostty/imv/wl-mirror live in meta/base.txt. Sparrow is JavaFX-based and - # runs correctly from nix on the host. + playerctl # MPRIS over session bus + pulsemixer # TUI for PipeWire/PulseAudio - # ── General CLIs migrated off pacman ────────────────────────────────────── + # ── General CLIs ───────────────────────────────────────────────────────── qrencode torsocks lshw yt-dlp streamlink - xdg-utils # xdg-open, used by yazi/linkhandler/OPENER + xdg-utils # xdg-open, used by yazi/linkhandler/OPENER # ── File sync ─────────────────────────────────────────────────────────────── - # Package-only migration from pacman. The boot-time system service is the - # repo-owned syncthing@sommerfeld.service tracked in systemd-units/system.txt - # and backed by etc/systemd/system/syncthing@.service. syncthing # ── Work VPN ────────────────────────────────────────────────────────────── - # Check Point VPN client. The command-mode system service is repo-owned at - # etc/systemd/system/snx-rs.service and exposes the daemon that snxctl uses. snx-rs # ── Bitcoin wallet ─────────────────────────────────────────────────────── - # Replaces the former AUR wallet package after host GUI + BitBox smoke - # testing. sparrow # ── Browser hardening ──────────────────────────────────────────────────── - # Upstream Arkenfox user.js from nixpkgs, re-exposed under share/ so the - # chezmoi Firefox/LibreWolf deploy hook can render it with - # firefox/user-overrides.js into the Flatpak profile. arkenfox-userjs-profile # ── OCR ────────────────────────────────────────────────────────────────── - # Override merges eng + por language data into a single derivation, - # replacing three pacman packages (tesseract, tesseract-data-eng, - # tesseract-data-por). - (tesseract.override { enableLanguages = [ "eng" "por" ]; }) + (tesseract.override { + enableLanguages = [ + "eng" + "por" + ]; + }) # ── Speech-to-text (dictate script) ────────────────────────────────────── - # whisper.cpp with Vulkan acceleration. `mainProgram = "whisper-cli"` - # matches the binary the dictate script invokes. The base model below - # is a separate derivation so we can drop the AUR `whisper.cpp-model-base`. (whisper-cpp.override { vulkanSupport = true; }) whisper-cpp-model-base ]; # ── Smartcard (Yubikey) ──────────────────────────────────────────────────── - # Nix's gnupg ships its own scdaemon. Delegate to the system pcscd - # service instead of letting nix's scdaemon open the USB device - # directly (which would race with pcscd). `pcsclite` provides the - # shared library at the path below and stays in `meta/base.txt`. home.file.".gnupg/scdaemon.conf".text = '' disable-ccid pcsc-driver /usr/lib/libpcsclite.so.1 |