mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
7cfda39c2c
The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo. Risks to weigh: - Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first. - Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch. ### Verification - `just test` exits 0; CI passed on the first commit. - Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`. - Not yet verified on a running host. ### Manual step after merge Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH. AI assistance: DeepSeek Harness (claude-opus-5-5). Assisted-by: DeepSeek Harness (claude-opus-5-5)
Home Manager's Base Submodules
This directory contains cross-platform base configurations that are shared between Linux and Darwin systems.
Configuration Structure
Core System
- core/: Essential cross-platform configurations
- core.nix: Minimal home-manager configuration
- shells/: Shell configurations (bash, Nushell; zsh is Darwin-only under
home/darwin/) - editors/: Helix + Neovim (Home Manager) and usage docs (
README.mdper editor) - btop.nix: System monitoring tools
- git.nix: Git configuration and aliases
- npm.nix: Node.js package management
- pip.nix: Python package management
- privacy.nix: Cross-app telemetry opt-out (
DO_NOT_TRACK) - starship.nix: Cross-shell prompt configuration
- theme.nix: Color schemes and theming
- xdg.nix: XDG base-directory configuration
- yazi.nix: Terminal file manager configuration
Desktop Environment
- gui/: Cross-platform GUI applications and configurations
- dev-tools.nix: Misc development and network tools (mitmproxy, wireshark)
- media.nix: Media players and utilities
- zed-editor.nix: Zed editor configuration (primary GUI editor)
- rime/: Rime (flypy) customisation shared by fcitx5-rime (Linux) and Squirrel (macOS)
- terminal/: Terminal emulator configurations
- ghostty.nix: Ghostty terminal (default)
- kitty.nix: Kitty terminal
- work-gitconfig.nix: Work git identity for repositories under
~/work, linked from agenix
Terminal Interface
- tui/: Terminal-based interface configurations
- agents/: AI coding agents — global rules and skills deployment, CLIs, and telemetry/auto-update opt-outs
- cloud/: Cloud development tools (Terraform, etc.)
- container.nix: Container tools (Docker, Podman)
- dev-tools.nix: Terminal-based development tools
- editors/: Extra terminal editor Nix (see
core/editors/for docs and baseline enables) - encryption/: Encryption and security tools
- gpg/: GPG key management
- password-store/: Password management with pass
- shell/: Shell environment configurations
- ssh.nix: SSH configuration and management
- tuios/: Terminal window manager / multiplexer (config + nushell auto-start)
System Management
- home.nix: Main home manager configuration file
Platform Compatibility
All configurations in this directory are designed to work across:
- Linux: All distributions with Nix and Home Manager
- macOS: Darwin systems with Home Manager
Usage
These base configurations provide the foundation for both Linux and Darwin systems while allowing for platform-specific customizations.