README > Roadmap of TODOs
Build up a stable config using grief lab. The focus will be on structure, nix-config automation, and core tty that will be common on all machines.
- Basic utility shell for bootstrapping
- Core host config common to all machines
- garbage collection
- clamav
- msmtp notifier
- ability to import modular options
- Core home-manager config for primary user
- cli configs
- nvim config
- ability to import modular options
- Repository based secrets management for local users, remote host connection, and repository auth
- Ability to consistently add new hosts and users with the core settings
- Basic automation for rebuilds
- Basic CI testing
This stage will add a second host machine, gusto (theatre). To effectively used gusto, we'll need to introduce gui elements such as a desktop, basic QoL tools for using the desktop, and some basic gui applications to play media, including the requisite audio/visual packages to make it all work.
- Add a media user specifically for gusto (autolog that one)
- Document and tweak steps to deploy to new host
- Simple desktop - add visual desktop and a/v elements as common options
- Stable windows manager environment
- Stable audio
- Stable video
- Auto-upgrade
- Better secrets management
- private repo for secrets
- personal documentation for secrets management, i.e. README for nix-secrets private repo
- public documentation for secrets management, i.e. how to use this repo with the private repo
- Review and complete applicable TODO sops, TODO yubi, and TODO stage 2
- Deploy gusto
DEFERRED:
- [>] Potentially yubiauth and u2f for passwordless sudo ## 3. Installation Automation and drive encryption - Completed: 2024.08.08
Introduce declarative partitioning, custom iso generation, install automation, and full drive encryption. This stage was also initially intended to add impermanence and several other improvements aimed at keeping a cleaner environment. However, automation took substantially longer than anticipated and I need to start using NixOS as a daily driver sooner than later. Being spread across two distros and different config paradigms while putting 99% of the effort into the new distro/config is becoming unsustainable. As such, several features have been deferred until later stages.
- nixos-anywhere
- declarative partitioning and formatting via disko
- light-weight bootstrap flake for basic, pre-secrets install
- custom iso generation
- automated bootstrap script
Local decryption only for now. Enabling remote decryption while working entirely from VMs is beyond my current abilities.
- LUKS full drive encryption
- Make use of configLib.scanPaths
- look for better syntax options to shorten just recipes
- Decided to just re-enable nix-fmt
update nix-fmt to nixfmt-rfc-style (including pre-commit) since it will be the standard for nix packages moving forward - update sops to make use of per host age keys for home-manager level secrets
- [-] don't bother
maybe rename pkgs -> custom_pkgs and modules -> custom_modules - Enable git ssh signing in home/ta/common/core/git.nix
DEFERRED:
- [>] Investigate outstanding yubikey FIXMEs
- [>] Potentially yubiauth and u2f for passwordless sudo [>] FidgetingBits still encounter significant issues with this when remoting
- [>] Confirm clamav scan notification
- [>] check email for clamavd notification on ~/clamav-testfile. If yes, remove the file
- [>] check if the two commented out options in hosts/common/options/services/clamav.nix are in stable yet.
Migrate primary box to NixOS
- setup borg module
- hyprland prep
- migrate dotfiles to nix-config
- ghost modules
- change over and recovery plan
- install nixos on Ghost
- verify drives
- verify critical apps and services functionality
- enable backup
- enable mediashare
- setup and enable hyprland basics
- hyprlock
- logout manager
- waypaper
- dunst
- rofi-wayland
- reestablish workflow
- Investigate outstanding yubikey FIXMEs
- yubiauth and u2f for passwordless sudo
- Confirm clamav scan notification
- check email for clamavd notification on ~/clamav-testfile. If yes, remove the file
- check if the two commented out options in hosts/common/options/services/clamav.nix are in stable yet.
- basic themeing via stylix or nix-colors
- hotkey for sleeping monitors (all or non-primary)
- set up copyq clipboard mgr
Some of the original parts of this stage have been split off to later stages because they are more Nice to Have at the moment.
- Refactor nix-config to use more extensive specialArgs and extraSpecial Args for common user and host settings
- Refactor from configVars to modularized hostSpec
- [>] Re-implement modules to make use of options for enablement. Deferred, nice to have
- separate soft and hard secrets
- per-host sops secrets
- create example, public repo for nix-secrets
- Revise bootstrap script and roll in granular secrets hierarchy
- Rewrite install steps
- [>] Re-enable CI pipeline. Deferred for now, dealing with nix-secrets is too much hassle
- Write bats tests for helpers.sh
- Set up separate, stripped-down and simplified nix-config for newcomers
- move Gusto to disko
Add laptop support to the mix to handle stuff like power, lid state, wifi, and the like.
- nixify genoa
- add laptop utils
##### 6.2 Refactor multiuser
- refactor how multiuser works ala fidgetingbits' changes
QoL
- fix nvim/neo-tree default directory
- stop calendar notifications from stealing focus... sort of dealt with using 'noinitialfocus' dispatcher but it happens immediately after focus has already been stolen
- move to niri... hyprland is pissing me off too often
- usable for daily driver
- parity with current state hyprland config
- [/] refactor monitor toggling scripts
- refactor for dynamic host handling. niri unfortunately uses .kdl which doesn't play well with nixos currently so may be SoL for a while could consider using the niri flake but I'd prefer less reliance on someone else
- Monitors Module improvements
- potentially integrate Kanshi (for wayland) and arandr (for x) to handle profiles based on the connected displays.
- Declarative audio output device for gusto if possible
Rice
- [/] ui dev
- ascendancy color set
- colors
- repo
- add to tinted gallery
- host specific colours (terminal in particular) via stylix
- [/] centralize custom color palette: waiting for stylix to catchup to tinted-themes
- ascendancy color set
- eww as a potential replacement to waybar
- ssh-motd
- awww background service and random cycling
- plymouth
- grub - https://www.gnome-look.org/browse?cat=109&ord=latest
- rEFInd - Maybe?
- [-]
p10k- decided on starship - starship cli prompt
- fix the stupid emoji font
- sddm
or greetd- [~] fork silentsddm and add custom screens
- font - decided on FiraMono
- dunst
- lualine
- wlogout
- declare what needs to persist
- Need to sort out how to maintain /etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_ed25519_key.pub
- make sure to include
/luks-secondary-unlock.key(will be handled by modules/nixos/disks)
- enable impermanence
Impermanence - These two are the references to follow and integrate. The primer list below is good review before diving into this:
Impermanence primer info
- impermanence repo - an implementation of the below concept
- blog - erase your darlings
- blog - encrypted btrfs root with opt-in state
- blog - setting up my new laptop nix style
- blog - tmpfs as root
- blog - tmpfs as home
Migrating bash scripts to nix
- https://www.youtube.com/watch?v=diIh0P12arA and https://www.youtube.com/watch?v=qRE6kf30u4g
- Consider also the first comment "writeShellApplication over writeShellScriptBin. writeShellApplication also runs your shell script through shellcheck, great for people like me who write sloppy shell scripts. You can also specify runtime dependencies by doing runtimeInputs = [ cowsay ];, that way you can just write cowsay without having to reference the path to cowsay explicitly within the script"
- network segregated, auto-starting microvm sandboxes for agent sessions
- complete services.per-network-services
- add firewall module
- Per host branch scheme
- Automated machine update on branch release
- Handle general auto updates as well
The following has to happen on bare metal because I can't seem to get the yubikey's to redirect to the VM for use with git-agecrypt.
- Remote LUKS decrypt over ssh for headless hosts
- need to set up age-crypt keys because this happens before sops and therefore we can't use nix-secrets
- add initrd-ssh module that will spawn an ssh service for use during boot
- Automatic scheduled sops rotate
- Disk usage notifier
- Consider nixifying bash scripts (see refs below)
- Overhaul just file
- add {{just.executable()}} to just entries
- revisit scanPaths. Usage in hosts/common/core is doubled up when hosts/common/core/services is imported. Options are: declare services imports individually in services/default.nix, move services modules into parent core directory... or add a recursive variant of scanPaths.
- lanzaboote https://github.com/nix-community/lanzaboote
Some stage 1 with systemd info for reference (not specific to lanzaboote)
- https://github.com/ElvishJerricco/stage1-tpm-tailscale
- https://youtu.be/X-2zfHnHfU0?si=HXCyJ5MpuLhWWwj3
- Nixify floater laptop
README > Roadmap of TODOs