ryan4yin | 二花
2cf3a58028
* feat(nixpak): pass FIDO2 keys to Firefox, Chromium and Chrome Assisted-by: DeepSeek Harness (deepseek-flash) * feat(nixpak): support FIDO2 hotplug via udev-maintained node directory Replace launch-time hidraw discovery with host udev rules that hard-link FIDO-tagged hidraw nodes into /dev/fido-hidraw and remove them on unplug. The sandbox dev-binds that directory and gets static /dev/hidrawN symlinks into it, so keys plugged in after launch work and no stale node survives a reused hidraw minor. Narrow the extra mounts from whole /sys and /run/udev to /sys/class/hidraw, /run/udev/data and /run/udev/control; the policy suite now forbids the broad mounts and checks the wrapper and bind follow the fido2 option. Assisted-by: Claude Code (claude-opus-5-5) * refactor(nixpak): rewrite FIDO2 bwrap wrapper in Python The bash argument loop was hard to follow. Python inserts the /dev/hidrawN symlinks before "--" with a single list splice, and the header now explains the whole host-udev -> bind -> symlink chain step by step. Assisted-by: Claude Code (claude-opus-5-5) * docs(canokey): document phone-only management policy PCs only use the CanoKey; CanoKey Console management stays in the phone app and the Admin PIN is never typed on a PC. Record what the config enforces (sandboxed browsers get no raw USB/CCID, no vendor WebUSB udev rule) and what it does not (uaccess on the raw USB node, PC/SC access to the Admin applet, CTAP management from browsers). Assisted-by: Claude Code (claude-opus-5-5) * docs(canokey): separate management from use, link CanoKey docs Assisted-by: Claude Code (claude-opus-5-5) * fix(nixpak): create /dev/fido-hidraw from the udev rule NixOS applies /dev tmpfiles entries only at boot; switch-to-configuration runs systemd-tmpfiles-resetup with --exclude-prefix=/dev. After a switch without reboot the directory was missing and every `ln` failed with exit code 1, so no browser saw the key. The add rule now runs `mkdir -p` first. Also fix the documented trigger command: `udevadm trigger` defaults to `change`, which the add-only rule ignores. Assisted-by: Claude Code (claude-opus-5-5) * refactor(nixpak): keep tmpfiles as the only creator of /dev/fido-hidraw The /dev tmpfiles units run before systemd-udevd on every boot, so the directory always exists before coldplug. The mkdir in the udev rule only covered the first switch without reboot and duplicated the tmpfiles rule; drop it and document the one-time `systemd-tmpfiles --prefix` command. Assisted-by: Claude Code (claude-opus-5-5) * docs(nixpak): record FIDO2 hardware validation in Firefox and Chrome After a reboot on ai with the CanoKey present at boot, udev linked only the FIDO interface and WebAuthn works in Firefox and Chrome. Chromium and plugging the key in after launch remain pending. Assisted-by: Claude Code (claude-opus-5-5)
❄️ Ryan4Yin's Nix Config ❄️
My configuration is becoming more and more complex, and it will be difficult for beginners to read. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a look at the ryan4yin/nix-config/releases first, check out to some simpler older versions, such as i3-kickstarter, which will be much easier to understand.
This repository is home to the Nix code that builds all of my systems:
- NixOS desktops — Home Manager, Niri (Wayland), the Noctalia shell, agenix.
- macOS desktops — nix-darwin + Home Manager, sharing the same
home/configuration with the NixOS desktops. - NixOS servers — three physical mini PCs running the VMs (libvirt and microVMs), the K3s test cluster and the self-hosted services.
See ./docs for the documentation index, ./hosts for the host inventory, ./outputs for how the flake outputs are composed, BACKUP.md for the backup design, and ./AGENTS.md for the repository conventions.
Why NixOS & Flakes?
Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once something is setup and configured once, it works (almost) forever. If someone else shares their configuration, anyone else can just use it (if you really understand what you're copying/referring now).
As for Flakes, refer to Introduction to Flakes - NixOS & Nix Flakes Book
Want to know NixOS & Flakes in detail? Looking for a beginner-friendly tutorial or best practices? You don't have to go through the pain I've experienced again! Check out my NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated 📖 for beginners!
If you're using macOS, check out ryan4yin/nix-darwin-kickstarter for a quick start.
Components
| NixOS (Wayland) | |
|---|---|
| Display Manager | greetd + tuigreet |
| Window Manager | Niri |
| Desktop Shell | Noctalia — bar/notifications/launcher/lock screen/control center/power menu/screenshots, one native shell |
| Terminal Emulators | Kitty, Ghostty |
| Terminal Multiplexer | tuios |
| Shell | Nushell + Starship |
| Editors / IDE | Zed (GUI, primary), VS Code (GUI); Helix (TUI, primary), Neovim (TUI, backup) |
| Color Scheme | catppuccin-nix |
| Networking | systemd-networkd / NetworkManager |
| Input Method | Fcitx5 + rime + 小鹤音形 flypy |
| System Monitor | Btop (+ Noctalia's built-in sysmon widgets) |
| File Manager | Yazi (TUI) + thunar (GUI) |
| Media Player | mpv |
| Image Viewer | imv |
| Screenshots | Native Noctalia capture: region / fullscreen / display picker, with a built-in annotation editor |
| Screen Recording | OBS, gpu-screen-recorder, wf-recorder |
| Fonts | Nerd fonts |
| Filesystem & Encryption | tmpfs as /, Btrfs subvolumes on a LUKS encrypted partition for persistent data; unlock via passphrase |
| Secure Boot | lanzaboote |
Wallpapers: https://github.com/ryan4yin/wallpapers
Screenshots
Editors / IDE
- Terminal editors: ./home/base/core/editors/ — Helix / Neovim,
$EDITOR, docs. - GUI editor: Zed.
- LLM coding agents: ./agents — rules, installers, CLI snippets; see ./agents/README.md.
Secrets Management
See ./secrets for details.
Security & Hardening
See SECURITY.md for the threat model, security architecture, controls and audit status, ./hardening/README.md for application sandboxing and Linux hardening, and WORKAROUNDS.md for temporary exceptions and known gaps.
How to Deploy this Flake?
🔴 IMPORTANT: You should NOT deploy this flake directly on your machine ❗ It will not succeed. This flake contains my hardware configuration (such as hardware-configuration.nix, Nvidia support, etc.) which is not suitable for your hardware, and requires my private secrets repository ryan4yin/nix-secrets to deploy. You may use this repo as a reference to build your own configuration.
Updating flake inputs and rolling the result out safely is a procedure, not a single command. Follow
.agents/skills/nix-config-update/SKILL.md.
For NixOS:
To deploy this flake from NixOS's official ISO image (purest installation method), please refer to ./nixos-installer/
# Desktops: deploy the <hostname>-niri nixosConfiguration (e.g. ai-niri, shoukei-niri)
just niri # equals `sudo nixos-rebuild switch --flake .#<hostname>-niri`
just niri boot # set as the next boot configuration without switching
just niri switch debug # detailed output
# Other hosts (servers, VMs): deploy the nixosConfiguration matching the bare hostname
just local
just local boot
just local switch debug
For macOS (nix-darwin):
# If you are deploying for the first time,
# 1. install nix & homebrew manually.
# 2. prepare the deployment environment with essential packages available
nix shell nixpkgs#just nixpkgs#nushell
# 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deployment.
# Deploy the darwinConfiguration by hostname match (fern, frieren)
just local
just local debug # detailed output (macOS has no switch/boot mode)
Remote / cluster hosts are deployed with Colmena on top
of the same flake, e.g. just col <tag>, just k3s-test, just lab.
What y'all will need when Nix drives you to drink. (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...)
Validation & Development
nix develop provides the formatters and linters used by the repository. The most useful commands:
just test # eval tests across Linux & Darwin (fails unless the result is `true`)
just fmt # format all Nix files with nixfmt
just --list # all recipes
nix flake check # broader flake checks
For Nix changes, run just test and inspect just fmt's diff before committing. Non-Nix files are
formatted with prettier; spelling is checked with typos.
References
Other dotfiles that inspired me:
- Nix Flakes
- NixOS-CN/NixOS-CN-telegram
- notusknot/dotfiles-nix
- xddxdd/nixos-config
- bobbbay/dotfiles
- gytis-ivaskevicius/nixfiles
- davidtwco/veritas
- gvolpe/nix-config
- Ruixi-rebirth/flakes
- fufexan/dotfiles: gtk theme, xdg, git, media, etc.
- nix-community/srvos: a collection of opinionated and sharable NixOS configurations for servers
- Modularized NixOS Configuration
- Neovim / AstroNvim
- maxbrunet/dotfiles: astronvim with nix flakes.
- Misc