sam/nixos-4screen
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden NixOS config and strip secrets from generated_home.nix

Browse Source 
Co-authored-by: aider (openrouter/openai/gpt-5.2) <aider@aider.chat>
This commit is contained in:
sam rolfe
2026-02-08 13:58:05 +11:00
parent 45f457156a
commit 73bae4f9b9
2 changed files with 44 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
hosts/sam-4screen-desktop/configuration.nix
View File

@@ -1,10 +1,15 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
{ {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
]; ];
# ---
# Nix (enable flakes on the installed system)
# ---
nix.settings.experimental-features = [ "nix-command" "flakes" ];
# --- # ---
# Bootloader / kernel # Bootloader / kernel
# --- # ---
@@ -30,7 +35,7 @@
id = "Wired connection 1"; id = "Wired connection 1";
type = "802-3-ethernet"; type = "802-3-ethernet";
interface-name = "enp0s31f6"; interface-name = "enp0s31f6";
autoconnect = true; autoconnect = "true";
}; };
ethernet = { }; ethernet = { };
@@ -40,8 +45,8 @@
addresses = [ "192.168.20.27/24" ]; addresses = [ "192.168.20.27/24" ];
gateway = "192.168.20.1"; gateway = "192.168.20.1";
dns = "192.168.20.35;192.168.20.13;"; dns = "192.168.20.35;192.168.20.13;";
ignore-auto-dns = true; ignore-auto-dns = "true";
never-default = false; never-default = "false";
}; };
ipv6 = { ipv6 = {
@@ -52,10 +57,13 @@
# --- # ---
# Users # Users
# --- # ---
programs.zsh.enable = true;
users.users.sam = { users.users.sam = {
isNormalUser = true; isNormalUser = true;
description = "Sam"; description = "Sam";
extraGroups = [ "wheel" "networkmanager" "docker" "video" "render" ]; extraGroups = [ "wheel" "networkmanager" "docker" "video" "render" ];
shell = pkgs.zsh;
}; };
# --- # ---
@@ -67,6 +75,20 @@
# flip this to true. # flip this to true.
services.openssh.settings.PasswordAuthentication = false; services.openssh.settings.PasswordAuthentication = false;
# ---
# dconf (helps portals/GTK apps)
# ---
programs.dconf.enable = true;
# ---
# OpenGL (important for NVIDIA Wayland apps)
# ---
hardware.opengl = {
enable = true;
driSupport = true;
driSupport32Bit = true;
};
# --- # ---
# Audio (PipeWire) # Audio (PipeWire)
# --- # ---
@@ -76,6 +98,7 @@
pulse.enable = true; pulse.enable = true;
alsa.enable = true; alsa.enable = true;
alsa.support32Bit = true; alsa.support32Bit = true;
wireplumber.enable = true;
}; };
# --- # ---
@@ -100,7 +123,10 @@
settings = { settings = {
default_session = { default_session = {
user = "greeter"; user = "greeter";
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --cmd 'niri --session'"; command =
"${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --cmd ${
lib.escapeShellArg "${pkgs.niri}/bin/niri --session"
}";
}; };
}; };
}; };
@@ -126,6 +152,7 @@
# --- # ---
services.xserver.videoDrivers = [ "nvidia" ]; services.xserver.videoDrivers = [ "nvidia" ];
hardware.nvidia.modesetting.enable = true; hardware.nvidia.modesetting.enable = true;
hardware.nvidia.nvidiaSettings = true;
# --- # ---
# NixOS release compatibility # NixOS release compatibility

21
results/generated_home.nix
View File

@@ -90,14 +90,18 @@
# --- # ---
# 5. ENVIRONMENT & API KEYS # 5. ENVIRONMENT & API KEYS
# --- # ---
# WARNING: Storing secrets in plain text is a security risk. # SECURITY: Do NOT store secrets in git-tracked Nix files.
# Consider using a tool like sops-nix for production environments. # Use a local-only file such as:
home.sessionVariables = { # ~/.config/environment.d/10-secrets.conf
OPENAI_API_KEY = "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"; # or adopt sops-nix / agenix later.
TAVILY_API_KEY = "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"; #
DEEPSEEK_API_KEY = "sk-26c66e4dd5b34017bd66f7aef748c625"; # Example (DO NOT COMMIT):
}; # home.sessionVariables = {
# OPENAI_API_KEY = "…";
# TAVILY_API_KEY = "…";
# DEEPSEEK_API_KEY = "…";
# };
# Add custom binary paths to your environment # Add custom binary paths to your environment
home.sessionPath = [ home.sessionPath = [
# For the 'opencode' CLI tool # For the 'opencode' CLI tool
@@ -117,4 +121,3 @@
# This section is a placeholder for linking config files from a Git repo. # This section is a placeholder for linking config files from a Git repo.
# e.g., home.file.".config/nvim/init.vim".source = ./config/nvim/init.vim; # e.g., home.file.".config/nvim/init.vim".source = ./config/nvim/init.vim;
} }