feat: add WeChat(UOS) sandboxed

fix: mkdir - persist qq's config
feat: update kernel params for nvidia

.envrc

@@ -0,0 +1 @@
+use flake

.gitattributes

@@ -0,0 +1,3 @@
+# https://github.com/github-linguist/linguist/blob/master/docs/overrides.md
+
+home/linux/desktop/i3/conf/polybar/** linguist-vendored

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+github: ryan4yin
+patreon: ryan4yin
+custom: ["https://buymeacoffee.com/ryan4yin"]

.github/workflows/flake_evaltests.yml

@@ -0,0 +1,42 @@
+name: Nix Flake Eval Tests
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "scripts/**"
+      - "**.md"
+      - "**.nu"
+      - "Justfile"
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - "scripts/**"
+      - "**.md"
+      - "**.nu"
+      - "Justfile"
+
+jobs:
+  checks:
+    name: Check expressions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install nix
+        uses: cachix/install-nix-action@v24
+        with:
+          install_url: https://nixos.org/nix/install
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            experimental-features = nix-command flakes
+
+      - name: Run Nix Flake Eval Tests
+        run: |
+          echo 'Flake Eval Tests'
+          # stack overflow...
+          # nix eval .#checks --show-trace --print-build-logs --verbose
+          nix eval .#evalTests --show-trace --print-build-logs --verbose

.github/workflows/mirror_to_gitee.yml

@@ -0,0 +1,32 @@
+name: Mirror this repo to Gitee
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "*"
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Mirror repo to Gitee
+        id: mirror-to-gitee
+        shell: bash
+        env:
+          INPUT_SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY_GITEE_MIRROR }}
+          INPUT_TARGET_REPO_URL: git@gitee.com:ryan_yin/nix-config.git
+        run: |
+          set -eu
+
+          mkdir -p ~/.ssh
+          echo "$INPUT_SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+
+          export GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no"
+          git remote add mirror "$INPUT_TARGET_REPO_URL"
+          git push --tags --force --prune mirror "refs/remotes/origin/*:refs/heads/*"

.gitignore

@@ -0,0 +1,9 @@
+result
+result/
+.direnv/
+.DS_Store
+.pre-commit-config.yaml
+logs/
+core*
+!core/
+!core.nix

.prettierignore

@@ -0,0 +1,8 @@
+LICENSE.md
+dist
+pnpm-lock.yaml
+flake.lock
+vercel.json
+cache
+temp
+.temp

.prettierrc.yaml

@@ -0,0 +1,6 @@
+# https://prettier.io/docs/en/options
+semi: false
+singleQuote: false
+printWidth: 100
+proseWrap: always # always change wrapping in markdown text
+trailingComma: es5

.typos.toml

@@ -0,0 +1,34 @@
+[files]
+ignore-dot = true
+ignore-files = true
+extend-exclude = ["themes/", "data/", "static-surprises/", "resources/"]
+
+[default]
+binary = false
+# ignore some special identifiers(sha256, mac address, crypto keys, etc)
+extend-ignore-re = [
+  "iterm2",
+  "iHgEIBYKACAWIQSizQe9ljFEyyclWmtVhZllwnQrSwUCZZ1T9wIdAAAKCRBVhZll", # crypto keys
+  "noice",                                                            # noice.nvim
+  "crypted-nixos",
+  "daed",
+
+  # catppuccin theme colors
+  "11111b",
+  "1e1e2e",
+  "313244",
+  "414356",
+  "45475a",
+  "585b70",
+  "89b4fa",
+  "94e2d5",
+  "a6adc8",
+  "a6e3a1",
+  "bac2de",
+  "cdd6f4",
+  "f38ba8",
+  "f5c2e7",
+  "f5e0dc",
+  "f9e2af",
+  "fab387",
+]

Justfile

@@ -0,0 +1,417 @@
+# just is a command runner, Justfile is very similar to Makefile, but simpler.
+
+# Use nushell for shell commands
+# To usage this justfile, you need to enter a shell with just & nushell installed:
+# 
+#   nix shell nixpkgs#just nixpkgs#nushell
+set shell := ["nu", "-c"]
+
+utils_nu := absolute_path("utils.nu")
+
+############################################################################
+#
+#  Common commands(suitable for all machines)
+#
+############################################################################
+
+# List all the just commands
+default:
+    @just --list
+
+# Run eval tests
+[group('nix')]
+test:
+  nix eval .#evalTests --show-trace --print-build-logs --verbose
+
+# Update all the flake inputs
+[group('nix')]
+up:
+  nix flake update
+
+# Update specific input
+# Usage: just upp nixpkgs
+[group('nix')]
+upp input:
+  nix flake update {{input}}
+
+# List all generations of the system profile
+[group('nix')]
+history:
+  nix profile history --profile /nix/var/nix/profiles/system
+
+# Open a nix shell with the flake
+[group('nix')]
+repl:
+  nix repl -f flake:nixpkgs
+
+# remove all generations older than 7 days
+# on darwin, you may need to switch to root user to run this command
+[group('nix')]
+clean:
+  sudo nix profile wipe-history --profile /nix/var/nix/profiles/system  --older-than 7d
+
+# Garbage collect all unused nix store entries
+[group('nix')]
+gc:
+  # garbage collect all unused nix store entries(system-wide)
+  sudo nix-collect-garbage --delete-older-than 7d
+  # garbage collect all unused nix store entries(for the user - home-manager)
+  # https://github.com/NixOS/nix/issues/8508
+  nix-collect-garbage --delete-older-than 7d
+
+# Enter a shell session which has all the necessary tools for this flake
+[linux]
+[group('nix')]
+shell:
+  nix shell nixpkgs#git nixpkgs#neovim nixpkgs#colmena
+
+# Enter a shell session which has all the necessary tools for this flake
+[macos]
+[group('nix')]
+shell:
+  nix shell nixpkgs#git nixpkgs#neovim
+
+[group('nix')]
+fmt:
+  # format the nix files in this repo
+  nix fmt
+
+# Show all the auto gc roots in the nix store
+[group('nix')]
+gcroot:
+  ls -al /nix/var/nix/gcroots/auto/
+
+# Verify all the store entries
+# Nix Store can contains corrupted entries if the nix store object has been modified unexpectedly.
+# This command will verify all the store entries,
+# and we need to fix the corrupted entries manually via `sudo nix store delete <store-path-1> <store-path-2> ...`
+[group('nix')]
+verify-store:
+  nix store verify --all
+
+# Repair Nix Store Objects
+[group('nix')]
+repair-store *paths:
+  nix store repair {{paths}}
+
+############################################################################
+#
+#  NixOS Desktop related commands
+#
+############################################################################
+
+[linux]
+[group('desktop')]
+hypr mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch ai-hyprland {{mode}}
+
+[linux]
+[group('desktop')]
+s-hypr mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch shoukei-hyprland {{mode}}
+
+############################################################################
+#
+#  Darwin related commands, harmonica is my macbook pro's hostname
+#
+############################################################################
+
+[macos]
+[group('desktop')]
+darwin-set-proxy:
+  sudo python3 scripts/darwin_set_proxy.py
+  sleep 1sec
+
+[macos]
+[group('desktop')]
+darwin-rollback:
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-rollback
+
+# Deploy to harmonica(macOS host)
+[macos]
+[group('desktop')]
+ha mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-build "harmonica" {{mode}};
+  darwin-switch "harmonica" {{mode}}
+
+# Depoly to fern(macOS host)
+[macos]
+[group('desktop')]
+fe mode="default": darwin-set-proxy
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-build "fern" {{mode}};
+  darwin-switch "fern" {{mode}}
+
+# Reset launchpad to force it to reindex Applications
+[macos]
+[group('desktop')]
+reset-launchpad:
+  defaults write com.apple.dock ResetLaunchPad -bool true
+  killall Dock
+
+############################################################################
+#
+#  Homelab - Kubevirt Cluster related commands
+#
+############################################################################
+
+# Remote deployment via colmena
+[linux]
+[group('homelab')]
+col tag:
+  colmena apply --on '@{{tag}}' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+local name mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch {{name}} {{mode}}
+
+# Build and upload a vm image
+[linux]
+[group('homelab')]
+upload-vm name mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  upload-vm {{name}} {{mode}}
+
+# Deploy all the KubeVirt nodes(Physical machines running KubeVirt)
+[linux]
+[group('homelab')]
+lab:
+  colmena apply --on '@virt-*' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+shoryu:
+  colmena apply --on '@kubevirt-shoryu' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+shoryu-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kubevirt-shoryu {{mode}}
+
+[linux]
+[group('homelab')]
+shushou:
+  colmena apply --on '@kubevirt-shushou' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+shushou-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kubevirt-shushou {{mode}}
+
+[linux]
+[group('homelab')]
+youko:
+  colmena apply --on '@kubevirt-youko' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+youko-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kubevirt-youko {{mode}}
+
+############################################################################
+#
+# Commands for other Virtual Machines
+#
+############################################################################
+
+# Build and upload a vm image
+[linux]
+[group('homelab')]
+upload-idols mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  upload-vm aquamarine {{mode}}
+  upload-vm ruby {{mode}}
+  upload-vm kana {{mode}}
+
+[linux]
+[group('homelab')]
+aqua:
+  colmena apply --on '@aqua' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+aqua-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch aquamarine {{mode}}
+
+[linux]
+[group('homelab')]
+ruby:
+  colmena apply --on '@ruby' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+ruby-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch ruby {{mode}}
+
+[linux]
+[group('homelab')]
+kana:
+  colmena apply --on '@kana' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+kana-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kana {{mode}}
+
+############################################################################
+#
+# Kubernetes related commands
+#
+############################################################################
+
+# Build and upload a vm image
+[linux]
+[group('homelab')]
+upload-k3s-prod mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  upload-vm k3s-prod-1-master-1 {{mode}}; 
+  upload-vm k3s-prod-1-master-2 {{mode}}; 
+  upload-vm k3s-prod-1-master-3 {{mode}}; 
+  upload-vm k3s-prod-1-worker-1 {{mode}}; 
+  upload-vm k3s-prod-1-worker-2 {{mode}}; 
+  upload-vm k3s-prod-1-worker-3 {{mode}};
+
+[linux]
+[group('homelab')]
+upload-k3s-test mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  upload-vm k3s-test-1-master-1 {{mode}}; 
+  upload-vm k3s-test-1-master-2 {{mode}}; 
+  upload-vm k3s-test-1-master-3 {{mode}};
+
+[linux]
+[group('homelab')]
+k3s-prod:
+  colmena apply --on '@k3s-prod-*' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+k3s-test:
+  colmena apply --on '@k3s-test-*' --verbose --show-trace
+
+############################################################################
+#
+#  Neovim related commands
+#
+############################################################################
+
+[group('neovim')]
+nvim-test:
+  rm -rf $"($env.HOME)/.config/nvim"
+  rsync -avz --copy-links --chmod=D2755,F744 home/base/tui/editors/neovim/nvim/ $"($env.HOME)/.config/nvim/"
+
+[group('neovim')]
+nvim-clean:
+  rm -rf $"($env.HOME)/.config/nvim"
+
+# =================================================
+# Emacs related commands
+# =================================================
+
+[group('emacs')]
+emacs-test:
+  rm -rf $"($env.HOME)/.config/doom"
+  rsync -avz --copy-links --chmod=D2755,F744 home/base/tui/editors/emacs/doom/ $"($env.HOME)/.config/doom/"
+  doom clean
+  doom sync
+
+[group('emacs')]
+emacs-clean:
+  rm -rf $"($env.HOME)/.config/doom/"
+
+[group('emacs')]
+emacs-purge:
+  doom purge
+  doom clean
+  doom sync
+
+[linux]
+[group('emacs')]
+emacs-reload:
+  doom sync
+  systemctl --user restart emacs.service
+  systemctl --user status emacs.service
+
+
+emacs-plist-path := "~/Library/LaunchAgents/org.nix-community.home.emacs.plist"
+
+[macos]
+[group('emacs')]
+emacs-reload:
+  doom sync
+  launchctl unload {{emacs-plist-path}}
+  launchctl load {{emacs-plist-path}}
+  tail -f ~/Library/Logs/emacs-daemon.stderr.log
+
+# =================================================
+#
+# Other useful commands
+#
+# =================================================
+
+[group('common')]
+path:
+   $env.PATH | split row ":"
+
+[group('common')]
+trace-access app *args:
+  strace -f -t -e trace=file {{app}} {{args}} | complete | $in.stderr | lines | find -v -r "(/nix/store|/newroot|/proc)" | parse --regex '"(/.+)"' | sort | uniq
+
+[linux]
+[group('common')]
+penvof pid:
+  sudo cat $"/proc/($pid)/environ" | tr '\0' '\n'
+
+# Remove all reflog entries and prune unreachable objects
+[group('git')]
+ggc:
+  git reflog expire --expire-unreachable=now --all
+  git gc --prune=now
+
+# Amend the last commit without changing the commit message
+[group('git')]
+game:
+  git commit --amend -a --no-edit
+
+# Delete all failed pods
+[group('k8s')]
+del-failed:
+  kubectl delete pod --all-namespaces --field-selector="status.phase==Failed"
+
+[linux]
+[group('services')]
+list-inactive:
+  systemctl list-units -all --state=inactive
+
+[linux]
+[group('services')]
+list-failed:
+  systemctl list-units -all --state=failed

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Ryan Yin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Nix_Flake_Basics.md

@@ -1,471 +0,0 @@
-# How to Learn Nix & Flake?
-
-Nix Flake is a new feature in Nix, it's the unit for packaging Nix code in a reproducible and discoverable way. 
-They can have dependencies on other flakes, making it possible to have multi-repository Nix projects.
-
-A flake is a filesystem tree (typically fetched from a Git repository or a tarball) that contains a file named flake.nix in the
-root directory. flake.nix specifies some metadata about the flake such as dependencies (called inputs), as well as its outputs
-(the Nix values such as packages or NixOS modules provided by the flake).
-
-Nix Flake is an experimental feature till now (2023-04-23), but it's already very useful and being used by many people.
-
->Because `nix-command` & `flake` are still experimental, many document about nix are stll using old commands such as `nix-env`, `nix-channel` & `nix-shell`, but they are not very reproducible compared with `nix-command` & `flake`, So please forget those old commands, and start with the [New Nix Commands][New Nix Commands] for Nix Flake.
-
-## 一、Nix Flake's Command Line
-
-after enabled `nix-command` & `flake`, you can use `nix help` to get all the info of [New Nix Commands][New Nix Commands], the main commands include:
-
-- `nix build` - build a derivation or fetch a store path, generate a result symlink in the current directory
-- `nix develop` - run a bash shell that provides the build environment of a derivation
-- `nix flake` - provides subcommands for creating, modifying and querying Nix flakes.
-  - `nix flake archive` - copy a flake and all its inputs to a store 
-  - `nix flake check` - check whether the flake evaluates and run its tests 
-  - `nix flake clone` - clone flake repository 
-  - `nix flake info` - show flake metadata 
-  - `nix flake init` - create a flake in the current directory from a template 
-  - `nix flake lock` - create missing lock file entries 
-  - `nix flake metadata` - show flake metadata 
-  - `nix flake new` - create a flake in the specified directory from a template 
-  - `nix flake prefetch` - download the source tree denoted by a flake reference into the Nix store 
-  - `nix flake show` - show the outputs provided by a flake 
-  - `nix flake update` - update flake lock file 
-- `nix profile` - manage Nix profiles. nix profile allows you to create and manage Nix profiles. A Nix profile is a set of packages that can be installed and upgraded independently from each other. Nix profiles are versioned, allowing them to be rolled back easily. its a replacement of `nix-env`.
-    - `nix profile diff-closures` - show the closure difference between each version of a profile 
-    - `nix profile history` - show all versions of a profile 
-    - `nix profile install` - install a package into a profile 
-    - `nix profile list` - list installed packages 
-    - `nix profile remove` - remove packages from a profile 
-    - `nix profile rollback` - roll back to the previous version or a specified version of a profile 
-    - `nix profile upgrade` - upgrade packages using their most recent flake 
-    - `nix profile wipe-history` - delete non-current versions of a profile 
-- `nix repl` - start an interactive environment for evaluating Nix expressions
-- `nix run` - run a Nix application. (use `nix run --help` for detail explanation)
-- `nix search` - search for packages, maybe your woulde prefer the website <https://search.nixos.org> instead of this command.
-- `nix shell` - run a shell in which the specified packages are available
-
-[Zero to Nix - Determinate Systems][Zero to Nix - Determinate Systems] is a brand new guide to get started with Nix & Flake, recommended to read for beginners.
-
-### Flake outpus
-
-Flake outputs are what a flake produces as part of its build. Each flake can have many different outputs simultaneously, including but not limited to:
-
-- Nix packages: named `apps.<system>.<name>`, `packages.<system>.<name>`, or `legacyPackages.<system>.<name>`
-- Nix Helper Functions: named `lib`, which means a library for other flakes.
-- Nix development environments: named `devShell`
-- NixOS configurations: has many different outputs
-- Nix templates: named `templates`
-  - templates can be used by command `nix flake init --template <reference>`
-
-### Flake Command Examples
-
-examples:
-
-```bash
-# `nixpkgs#ponysay` means `ponysay` from `nixpkgs` flake.
-# [nixpkgs](https://github.com/NixOS/nixpkgs) contains `flake.nix` file, so it's a flake.
-# `nixpkgs` is a falkeregistry id for `github:NixOS/nixpkgs/nixos-unstable`.
-# you can find all the falkeregistry ids at <https://github.com/NixOS/flake-registry/blob/master/flake-registry.json>
-# so this command means install and run package `ponysay` in `nixpkgs` flake.
-echo "Hello Nix" | nix run "nixpkgs#ponysay"
-
-# this command is the same as above, but use a full flake URI instead of falkeregistry id.
-echo "Hello Nix" | nix run "github:NixOS/nixpkgs/nixos-unstable#ponysay"
-
-# instead of treat flake package as an application, 
-# this command use the example package in zero-to-nix flake to setup the development environment,
-# and then open a bash shell in that environment.
-nix develop "github:DeterminateSystems/zero-to-nix#example"
-
-# instead of using a remote flake, you can open a bash shell using the flake located in the current directory.
-mkdir my-flake && cd my-flake
-## init a flake with template
-nix flake init --template "github:DeterminateSystems/zero-to-nix#javascript-dev"
-# open a bash shell using the flake in current directory
-nix develop
-# or if your flake has multiple devShell outputs, you can specify which one to use.
-nix develop .#example
-
-# build package `bat` from flake `nixpkgs`, and put a symlink `result` in the current directory.
-mkdir build-nix-package && cd build-nix-package
-nix build "nixpkgs#bat"
-# build a local flake is the same as nix develop, skip it
-```
-
-### Nix Flakes Repo
-
-除了官方的 Nixpkgs 之外，nix flake 还可以从任何第三方仓库中获取 flake，这个前面已经演示过许多了。
-
-第三方仓库虽然多，不过有几个比较常用的，官方也给它们提供了别名，列表保存在 [NixOS/flake-registry](ttps://github.com/NixOS/flake-registry/blob/master/flake-registry.json)，可供参考。
-
-比较知名的有：
-
-- [NUR](https://github.com/nix-community/NUR): 它类似 Arch Linux 的 AUR，是一个第三方 packages/flakes 的集合
-- [home-manager](https://github.com/nix-community/home-manager): home-manager 的 flake 版本
-
-## Basics of Nix Language
-
->https://nix.dev/tutorials/nix-language
-
-主要包含如下内容：
-
-1. 数据类型
-2. 函数的声明与调用语法
-3. 内置函数与库函数
-4. inputs 的不纯性
-5. 用于描述 build task 的 derivation
-
-### 1. 基础数据类型一览
-
-```nix
-{
-  string = "hello";
-  integer = 1;
-  float = 3.141;
-  bool = true;
-  null = null;
-  list = [ 1 "two" false ];
-  attribute-set = {
-    a = "hello";
-    b = 2;
-    c = 2.718;
-    d = false;
-  }; # comments are supported
-}
-```
-
-以及一些基础操作符，普通的算术运算、布尔运算就跳过了：
-
-```nix
-# List concatenation
-[ 1 2 3 ] ++ [ 4 5 6 ] # [ 1 2 3 4 5 6 ]
-
-# Update attribute set attrset1 with names and values from attrset2.
-{ a = 1; b = 2; } // { b = 3; c = 4; } # { a = 1; b = 3; c = 4; }
-
-# 逻辑隐含，等同于 !b1 || b2.
-bool -> bool
-```
-
-### 2. attribute set 说明
-
-花括号 `{}` 用于创建 attribute set，也就是 key-value 对的集合，类似于 JSON 中的对象。
-
-attribute set 默认不支持递归引用，如下内容会报错：
-
-```nix
-{
-  a = 1;
-  b = a + 1; # error: undefined variable 'a'
-}
-```
-
-不过 nix 提供了 `rec` 关键字（recursive attribute set），可用于创建递归引用的 attribute set：
-
-```nix
-rec {
-  a = 1;
-  b = a + 1; # ok
-}
-```
-
-在递归引用的情况下，nix 会按照声明的顺序进行求值，所以如果 `a` 在 `b` 之后声明，那么 `b` 会报错。
-
-可以使用 `.` 操作符来访问 attribute set 的成员：
-
-```nix
-let
-  a = {
-    b = {
-      c = 1;
-    };
-  };
-in
-a.b.c # result is 1
-```
-
-`.` 操作符也可直接用于赋值：
-
-```nix
-{ a.b.c = 1; }
-```
-
-### 3. let ... in ...
-
-nix 的 `let ... in ...` 语法被称作「let 表达式」或者「let 绑定」，它用于创建临时使用的局部变量：
-
-```nix
-let
-  a = 1;
-in
-a + a  # result is 2
-```
-
-let 表达式中的变量只能在 `in` 之后的表达式中使用，理解成临时变量就行。
-
-### 4. with 语句
-
-
-with 语句的语法如下：
-
-```nix
-with <attribute-set> ; <expression>
-```
-
-`with` 语句会将 `<attribute-set>` 中的所有成员添加到当前作用域中，这样在 `<expression>` 中就可以直接使用 `<attribute-set>` 中的成员了，简化 attribute set 的访问语法，比如：
-
-```nix
-let
-  a = {
-    x = 1;
-    y = 2;
-    z = 3;
-  };
-in
-with a; [ x y z ]  # result is [ 1 2 3 ], equavlent to [ a.x a.y a.z ]
-```
-
-### 5. 继承 inherit ...
-
-`inherit` 语句用于从 attribute set 中继承成员，同样是一个简化代码的语法糖，比如：
-
-```nix
-let
-  x = 1;
-  y = 2;
-in
-{
-  inherit x y;
-}  # result is { x = 1; y = 2; }
-```
-
-inherit 还能直接从某个 attribute set 中继承成员，语法为 `inherit (<attribute-set>) <member-name>;`，比如：
-
-```nix
-let
-  a = {
-    x = 1;
-    y = 2;
-    z = 3;
-  };
-in
-{
-  inherit (a) x y;
-}  # result is { x = 1; y = 2; }
-```
-
-### 6. ${ ... } 字符串插值
-
-`${ ... }` 用于字符串插值，懂点编程的应该都很容易理解这个，比如：
-
-```nix
-let
-  a = 1;
-in
-"the value of a is ${a}"  # result is "the value of a is 1"
-```
-
-### 7. 文件系统路径
-
-Nix 中不带引号的字符串会被解析为文件系统路径，路径的语法与 Unix 系统相同。
-
-### 8. 搜索路径
-
->请不要使用这个功能，搜索路径不是 pure 的，会导致不可预期的行为。
-
-Nix 会在看到 `<nixpkgs>` 这类三角括号语法时，会在 `NIX_PATH` 环境变量中指定的路径中搜索该路径。
-
-因为环境变量 `NIX_PATH` 是可变更的值，所以这个功能是不纯的，会导致不可预期的行为。
-
-### 9. 多行字符串
-
-多行字符串的语法为 `''`，比如：
-
-```nix
-''
-  this is a
-  multi-line
-  string
-''
-```
-
-### 10. 函数
-
-函数的声明语法为：
-
-```nix
-<arg1>:
-  <body>;
-```
-
-举几个常见的例子：
-
-```nix
-# function with one argument
-a: a + a
-
-# 嵌套函数
-a: b: a + b
-
-# function with two arguments
-{ a, b }: a + b
-
-# function with two arguments and default values
-{ a ? 1, b ? 2 }: a + b
-
-# 带有命名 attribute set 作为参数的函数，并且使用　... 收集其他可选参数
-# 命名　args 与　... 可选参数通常被一起作为函数的参数定义使用
-args@{ a, b, ... }: a + b + args.c
-# 如下内容等价于上面的内容
-{ a, b, ... }@args: a + b + args.c
-
-# 但是要注意命名参数仅绑定了输入的 attribute set，默认参数不在其中，举例
-let 
-  f = { a ? 1, b ? 2, ... }@args: args  # this will cause an error
-in
-  f {}  # result is {}
-
-# 函数的调用方式就是把参数放在后面，比如下面的 2 就是前面这个函数的参数
-a: a + a 2  # result is 4
-
-# 还可以给函数命名，不过必须使用 let 表达式
-let
-  f = a: a + a;
-in
-f 2  # result is 4
-```
-
-#### 内置函数
-
-Nix 内置了一些函数，可通过 `builtins.<function-name>` 来调用，比如：
-
-```nix
-builtins.add 1 2  # result is 3
-```
-
-详细的内置函数列表参见 [Built-in Functions - Nix Reference Mannual](https://nixos.org/manual/nix/stable/language/builtins.html)
-
-#### import 表达式
-
-`import` 表达式以其他 nix 文件的路径作为参数，返回该 nix 文件的执行结果。
-
-`import` 的参数如果为文件夹路径，那么会返回该文件夹下的 `default.nix` 文件的执行结果。
-
-举个例子，首先创建一个 `file.nix` 文件：
-
-```shell
-$ echo "x: x + 1" > file.nix
-```
-
-然后使用 import 执行它：
-
-```nix
-import ./file.nix 1  # result is 2
-```
-
-#### pkgs.lib 函数包
-
-除了 builtins 之外，Nix 的 nixpkgs 仓库还提供了一个名为 `lib` 的 attribute set，它包含了一些常用的函数，它通常被以如下的形式被使用：
-
-```nix
-let
-  pkgs = import <nixpkgs> {};
-in
-pkgs.lib.strings.toUpper "search paths considered harmful"  # result is "SEARCH PATHS CONSIDERED HARMFUL"
-```
-
-
-可以通过 [Nixpkgs Library Functions - Nixpkgs Manual](https://nixos.org/manual/nixpkgs/stable/#sec-functions-library) 查看 lib 函数包的详细内容。
-
-### 不纯
-
-Nix 语言本身是纯函数式的，是纯的，也就是说它就跟数学中的函数一样，同样的输入永远得到同样的输出。
-
-**Nix 唯一的不纯之处在这里：从文件系统路径或者其他输入源中读取文件作为构建任务的输入**。
-
-nix 的构建输入只有两种，一种是从文件系统路径等输入源中读取文件，另一种是将其他函数作为输入。
-
->nix 中的搜索路径与 `builtins.currentSystem` 也是不纯的，但是这两个功能都不建议使用，所以这里略过了。
-
-### Fetchers
-
-构建输入除了直接来自文件系统路径之外，还可以通过 Fetchers 来获取，Fetcher 是一种特殊的函数，它的输入是一个 attribute set，输出是 nix store 中的一个系统路径。
-
-Nix 提供了四个内置的 Fetcher，分别是：
-
-- `builtins.fetchurl`：从 url 中下载文件
-- `builtins.fetchTarball`：从 url 中下载 tarball 文件
-- `builtins.fetchGit`：从 git 仓库中下载文件
-- `builtins.fetchClosure`：从 Nix store 中获取 derivation
-
-
-举例：
-
-```nix
-builtins.fetchurl "https://github.com/NixOS/nix/archive/7c3ab5751568a0bc63430b33a5169c5e4784a0ff.tar.gz"
-# result example => "/nix/store/7dhgs330clj36384akg86140fqkgh8zf-7c3ab5751568a0bc63430b33a5169c5e4784a0ff.tar.gz"
-
-builtins.fetchTarball "https://github.com/NixOS/nix/archive/7c3ab5751568a0bc63430b33a5169c5e4784a0ff.tar.gz"
-# result example(auto unzip the tarball) => "/nix/store/d59llm96vgis5fy231x6m7nrijs0ww36-source"
-```
-
-
-### Derivations
-
-一个构建动作的 nix 语言描述被称做一个 Derivation，它描述了如何构建一个软件包，它的执行结果是一个 store object
-
-在 Nix 语言的最底层，一个构建任务就是使用 builtins 中的不纯函数 `derivation` 创建的，我们实际使用的 `stdenv.mkDerivation` 就是它的一个 wrapper，屏蔽了底层的细节，简化了用法。
-
-### stdenv.mkDerivation
-
-stdenv，顾名思义即标准构建环境，它是一个 attribute set，提供了构建 Unix 程序所需的标准环境，比如 gcc、glibc、binutils 等等。
-它可以完全取代我们在其他操作系统上常用的构建工具链，比如 `./configure`; `make`; `make install` 等等。
-
-即使 stdenv 提供的环境不能满足你的要求，你也可以通过 `stdenv.mkDerivation` 来创建一个自定义的构建环境。
-
-举个例子：
-
-```nix
-{ lib, stdenv }:
-
-stdenv.mkDerivation rec {
-  pname = "libfoo";
-  version = "1.2.3";
-  # 源码
-  src = fetchurl {
-    url = "http://example.org/libfoo-source-${version}.tar.bz2";
-    sha256 = "0x2g1jqygyr5wiwg4ma1nd7w4ydpy82z9gkcv8vh2v8dn3y58v5m";
-  };
-
-  # 构建依赖
-  buildInputs = [libbar perl ncurses];
-
-  # Nix 默认将构建拆分为一系列 phases，这里仅用到其中两个
-  # https://nixos.org/manual/nixpkgs/stable/#ssec-controlling-phases
-  buildPhase = ''
-    gcc foo.c -o foo
-  '';
-  installPhase = ''
-    mkdir -p $out/bin
-    cp foo $out/bin
-  '';
-}
-```
-
-
-## Override 与 Overlays
-
-TODO
-
-## Usfeful Flakes
-
-those flakes are useful for flake development, but require more knowledge about nix modules, profiles, overlays, etc.
-
-- [flake-parts](https://github.com/hercules-ci/flake-parts): Simplify Nix Flakes with the module system, useful to hold multiple system configurations in a single flake.
-- [flake-utils-plus](https://github.com/gytis-ivaskevicius/flake-utils-plus): an more powerful utils for flake development.
-- [github](https://github.com/divnix/digga): a powerful nix flake template to hold multiple host's configurations in a single flake.
-
-
-[digga]: https://github.com/divnix/digga
-[sway-nvidia]: https://github.com/crispyricepc/sway-nvidia
-[New Nix Commands]: https://nixos.org/manual/nix/stable/command-ref/new-cli/nix.html
-[Zero to Nix - Determinate Systems]: https://github.com/DeterminateSystems/zero-to-nix

README.md

@@ -1,33 +1,223 @@
-# Nix Configuration
+<h2 align="center">:snowflake: Ryan4Yin's Nix Config :snowflake:</h2>
 
-This repository is home to the nix code that builds my systems.
+<p align="center">
+  <img src="https://raw.githubusercontent.com/catppuccin/catppuccin/main/assets/palette/macchiato.png" width="400" />
+</p>
 
+<p align="center">
+	<a href="https://github.com/ryan4yin/nix-config/stargazers">
+		<img alt="Stargazers" src="https://img.shields.io/github/stars/ryan4yin/nix-config?style=for-the-badge&logo=starship&color=C9CBFF&logoColor=D9E0EE&labelColor=302D41"></a>
+    <a href="https://nixos.org/">
+        <img src="https://img.shields.io/badge/NixOS-24.05-informational.svg?style=for-the-badge&logo=nixos&color=F2CDCD&logoColor=D9E0EE&labelColor=302D41"></a>
+    <a href="https://github.com/ryan4yin/nixos-and-flakes-book">
+        <img src="https://img.shields.io/static/v1?label=Nix Flakes&message=learning&style=for-the-badge&logo=nixos&color=DDB6F2&logoColor=D9E0EE&labelColor=302D41"></a>
+  </a>
+</p>
 
-## TODO
+> My configuration is becoming more and more complex, and **it will be difficult for beginners to
+> read**. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a
+> look at the [ryan4yin/nix-config/releases](https://github.com/ryan4yin/nix-config/releases) first,
+> **checkout to some simpler older versions, such as
+> [i3-kickstarter](https://github.com/ryan4yin/nix-config/tree/i3-kickstarter), which will be much
+> easier to understand**.
 
-- vscode extensions
+This repository is home to the nix code that builds my systems:
-- secret management
 
-## How to install Nix and Deploy this Flake?
+1. NixOS Desktops: NixOS with home-manager, hyprland, agenix, etc.
+2. macOS Desktops: nix-darwin with home-manager, share the same home-manager configuration with
+   NixOS Desktops.
+3. NixOS Servers: virtual machines running on Proxmox/KubeVirt, with various services, such as
+   kubernetes, homepage, prometheus, grafana, etc.
 
-Nix can be used on Linux and MacOS, we have to method to install Nix:
+See [./hosts](./hosts) for details of each host.
 
-1. [Official Way to Install Nix](https://nixos.org/download.html): writen in bash script, `nix-command` & `flake` are disabled by default till now (2023-04-23).
+See [./Virtual-Machine.md](./Virtual-Machine.md) for details of how to create & manage KubeVirt's
-   1. you need to follow [Enable flakes - NixOS Wiki](https://nixos.wiki/wiki/Flakes) to enable `flake` feature.
+Virtual Machine from this flake.
-   2. and it provide no method to uninstall nix automatically, you need to delte all resources & users & group(`nixbld`) manually.
-2. [The Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer): writen mainly in Rust, enable `nix-command` & `flake` by default, and offer an easy way to uninstall Nix.
 
-After installed Nix with `nix-command` & `flake` enabled, you can deploy this flake with the following command:
+## Why NixOS & Flakes?
+
+Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once
+something is setup and configured once, it works (almost) forever. If someone else shares their
+configuration, anyone else can just use it (if you really understand what you're copying/refering
+now).
+
+As for Flakes, refer to
+[Introduction to Flakes - NixOS & Nix Flakes Book](https://nixos-and-flakes.thiscute.world/nixos-with-flakes/introduction-to-flakes)
+
+**Want to know NixOS & Flaks in detail? Looking for a beginner-friendly tutorial or best practices?
+You don't have to go through the pain I've experienced again! Check out my
+[NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated :book: for beginners](https://github.com/ryan4yin/nixos-and-flakes-book)!**
+
+> If you're using macOS, check out
+> [ryan4yin/nix-darwin-kickstarter](https://github.com/ryan4yin/nix-darwin-kickstarter) for a quick
+> start.
+
+## Components
+
+|                             | NixOS(Wayland)                                                                                                      |
+| --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| **Window Manager**          | [Hyprland][Hyprland]                                                                                                |
+| **Terminal Emulator**       | [Zellij][Zellij] + [Kitty][Kitty]                                                                                   |
+| **Bar**                     | [Waybar][Waybar]                                                                                                    |
+| **Application Launcher**    | [anyrun][anyrun]                                                                                                    |
+| **Notification Daemon**     | [Mako][Mako]                                                                                                        |
+| **Display Manager**         | [GDM][GDM]                                                                                                          |
+| **Color Scheme**            | [Catppuccin][Catppuccin]                                                                                            |
+| **network management tool** | [NetworkManager][NetworkManager]                                                                                    |
+| **Input method framework**  | [Fcitx5][Fcitx5]                                                                                                    |
+| **System resource monitor** | [Btop][Btop]                                                                                                        |
+| **File Manager**            | [Yazi][Yazi] + [thunar][thunar]                                                                                     |
+| **Shell**                   | [Nushell][Nushell] + [Starship][Starship]                                                                           |
+| **Music Player**            | [mpd][mpd], [ncmpcpp][ncmpcpp], [mpc][mpc]                                                                          |
+| **Media Player**            | [mpv][mpv]                                                                                                          |
+| **Text Editor**             | [Neovim][Neovim] + [DoomEmacs][DoomEmacs]                                                                           |
+| **Fonts**                   | [Nerd fonts][Nerd fonts]                                                                                            |
+| **Image Viewer**            | [imv][imv]                                                                                                          |
+| **Screenshot Software**     | [flameshot][flameshot] + [grim][grim]                                                                               |
+| **Screen Recording**        | [OBS][OBS]                                                                                                          |
+| **Filesystem & Encryption** | tmpfs on `/`, [Btrfs][Btrfs] subvolumes on a [LUKS][LUKS] encrypted partition for persistent, unlock via passphrase |
+| **Secure Boot**             | [lanzaboote][lanzaboote]                                                                                            |
+
+Wallpapers: https://github.com/ryan4yin/wallpapers
+
+## Hyprland + AstroNvim + DoomEmacs
+
+![](./_img/hyprland_2023-07-29_1.webp)
+
+![](./_img/hyprland_2023-07-29_2.webp)
+
+![](./_img/emacs-2024-01-07.webp)
+
+## Neovim
+
+See [./home/base/tui/editors/neovim/](./home/base/tui/editors/neovim/) for details.
+
+## Emacs
+
+See [./home/base/tui/editors/emacs/](./home/base/tui/editors/emacs/) for details.
+
+## Secrets Management
+
+See [./secrets](./secrets) for details.
+
+## How to Deploy this Flake?
+
+<!-- prettier-ignore -->
+> :red_circle: **IMPORTANT**: **You should NOT deploy this flake directly on your machine :exclamation:
+> It will not succeed.** This flake contains my hardware configuration(such as
+> [hardware-configuration.nix](hosts/idols-ai/hardware-configuration.nix),
+> [Nvidia Support](https://github.com/ryan4yin/nix-config/blob/v0.1.1/hosts/idols-ai/default.nix#L77-L91),
+> etc.) which is not suitable for your hardwares, and requires my private secrets repository
+> [ryan4yin/nix-secrets](https://github.com/ryan4yin/nix-config/tree/main/secrets) to deploy. You
+> may use this repo as a reference to build your own configuration.
+
+For NixOS:
+
+> To deploy this flake from NixOS's official ISO image(purest installation method), please refer to
+> [./nixos-installer/](./nixos-installer/)
+
+> Need to restart the machine when switching between `wayland` and `xorg`.
 
 ```bash
-sudo nixos-rebuild switch .#nixos
+# deploy one of the configuration based on the hostname
+sudo nixos-rebuild switch --flake .#ai-hyprland
+
+# deploy via `just`(a command runner with similar syntax to make) & Justfile
+just hypr  # deploy my pc with hyprland compositor
+
+# or we can deploy with details
+just hypr debug
 ```
 
-## Why Nix?
+For macOS:
 
-Nix allows for easy to manage, collaborative, reproducible deployments. This means that once something is setup and configured once, it works forever. If someone else shares their configuration, anyone can make use of it.
+```bash
+# If you are deploying for the first time,
+# 1. install nix & homebrew manually.
+# 2. prepare the deployment environment with essential packages available
+nix-shell -p just nushell
+# 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deplyment.
+# 4. comment out the proxy settings in scripts/darwin_set_proxy.py if the proxy is not ready yet.
 
+# 4. deploy harmonica's configuration(macOS Intel)
+just ha
+
+# deploy fern's configuration(Apple Silicon)
+just fe
+
+# deploy with details
+just ha debug
+# just fe debug
+```
+
+> [What y'all will need when Nix drives you to drink.](https://www.youtube.com/watch?v=Eni9PPPPBpg)
+> (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...)
 
 ## References
 
-- [Nix Flake Basics](./Nix_Flake_Basics.md)
+Other dotfiles that inspired me:
+
+- Nix Flakes
+  - [NixOS-CN/NixOS-CN-telegram](https://github.com/NixOS-CN/NixOS-CN-telegram)
+  - [notusknot/dotfiles-nix](https://github.com/notusknot/dotfiles-nix)
+  - [xddxdd/nixos-config](https://github.com/xddxdd/nixos-config)
+  - [bobbbay/dotfiles](https://github.com/bobbbay/dotfiles)
+  - [gytis-ivaskevicius/nixfiles](https://github.com/gytis-ivaskevicius/nixfiles)
+  - [davidtwco/veritas](https://github.com/davidtwco/veritas)
+  - [gvolpe/nix-config](https://github.com/gvolpe/nix-config)
+  - [Ruixi-rebirth/flakes](https://github.com/Ruixi-rebirth/flakes)
+  - [fufexan/dotfiles](https://github.com/fufexan/dotfiles): gtk theme, xdg, git, media, anyrun,
+    etc.
+  - [nix-community/srvos](https://github.com/nix-community/srvos): a collection of opinionated and
+    sharable NixOS configurations for servers
+- Modularized NixOS Configuration
+  - [hlissner/dotfiles](https://github.com/hlissner/dotfiles)
+  - [viperML/dotfiles](https://github.com/viperML/dotfiles)
+- Hyprland(wayland)
+  - [notwidow/hyprland](https://github.com/notwidow/hyprland): This is where I start my hyprland
+    journey.
+  - [HeinzDev/Hyprland-dotfiles](https://github.com/HeinzDev/Hyprland-dotfiles): Refer to the waybar
+    configuration here.
+  - [linuxmobile/kaku](https://github.com/linuxmobile/kaku)
+- Neovim/AstroNvim
+  - [maxbrunet/dotfiles](https://github.com/maxbrunet/dotfiles): astronvim with nix flakes.
+- Misc
+  - [1amSimp1e/dots](https://github.com/1amSimp1e/dots)
+
+[Hyprland]: https://github.com/hyprwm/Hyprland
+[Kitty]: https://github.com/kovidgoyal/kitty
+[Nushell]: https://github.com/nushell/nushell
+[Starship]: https://github.com/starship/starship
+[Waybar]: https://github.com/Alexays/Waybar
+[polybar]: https://github.com/polybar/polybar
+[rofi]: https://github.com/davatorium/rofi
+[anyrun]: https://github.com/Kirottu/anyrun
+[Dunst]: https://github.com/dunst-project/dunst
+[Fcitx5]: https://github.com/fcitx/fcitx5
+[Btop]: https://github.com/aristocratos/btop
+[mpv]: https://github.com/mpv-player/mpv
+[Zellij]: https://github.com/zellij-org/zellij
+[Neovim]: https://github.com/neovim/neovim
+[AstroNvim]: https://github.com/AstroNvim/AstroNvim
+[DoomEmacs]: https://github.com/doomemacs/doomemacs
+[flameshot]: https://github.com/flameshot-org/flameshot
+[grim]: https://github.com/emersion/grim
+[flameshot]: https://github.com/flameshot-org/flameshot
+[imv]: https://sr.ht/~exec64/imv/
+[OBS]: https://obsproject.com
+[Mako]: https://github.com/emersion/mako
+[Nerd fonts]: https://github.com/ryanoasis/nerd-fonts
+[catppuccin]: https://github.com/catppuccin/catppuccin
+[mpd]: https://github.com/MusicPlayerDaemon/MPD
+[ncmpcpp]: https://github.com/ncmpcpp/ncmpcpp
+[mpc]: https://github.com/MusicPlayerDaemon/mpc
+[Netease-cloud-music-gtk]: https://github.com/gmg137/netease-cloud-music-gtk
+[NetworkManager]: https://wiki.gnome.org/Projects/NetworkManager
+[wl-clipboard]: https://github.com/bugaevc/wl-clipboard
+[GDM]: https://wiki.archlinux.org/title/GDM
+[thunar]: https://gitlab.xfce.org/xfce/thunar
+[Yazi]: https://github.com/sxyazi/yazi
+[Catppuccin]: https://github.com/catppuccin/catppuccin
+[Btrfs]: https://btrfs.readthedocs.io
+[LUKS]: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system
+[lanzaboote]: https://github.com/nix-community/lanzaboote

Virtual-Machine.md

@@ -0,0 +1,26 @@
+## How to create & managage KubeVirt's Virtual Machine from this flake?
+
+Use `aquamarine` as an example, first build and upload the virtual machine's qcow2 image to the file
+server:
+
+```shell
+just upload-vm aquamarine
+```
+
+Then create the virtual machine by creating a yaml file at
+[ryan4yin/k8s-gitops](https://github.com/ryan4yin/k8s-gitops/tree/main/vms), set the
+`spec.dataVolumeTemplates[0].source.http.url` to the uploaded file's URL, and fluxcd will
+automatically apply the changes, then a virtual machine named `aquamarine` will be created in the
+KubeVirt cluster.
+
+Once the virtual machine `aquamarine` is created, we can deploy updates to it with the following
+commands:
+
+```shell
+just col aquamarine
+just col kubevirt-shoryu
+just col k3s-test-1-master-1
+```
+
+If you're not familiar with remote deployment, please read this tutorial first:
+[Remote Deployment - NixOS & Flakes Book](https://nixos-and-flakes.thiscute.world/best-practices/remote-deployment)

certs/.gitignore

@@ -0,0 +1,2 @@
+*.key
+*.csr

certs/README.md

@@ -0,0 +1,7 @@
+# My Private PKI / CA
+
+This is my private Private Key Infrastructure (PKI) / Certificate Authority (CA) for my personal
+use. It is used to issue certificates for my own servers and services.
+
+All the private keys are ignored by git, and will be stored in my private secrets repo
+[../secrets](../secrets/)

certs/ecc-ca.crt

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBajCB8QIJAIwL98is2nQPMAoGCCqGSM49BAMEMB8xHTAbBgNVBAMMFFJ5YW40
+WWluJ3MgUm9vdCBDQSAxMB4XDTI0MDQwMzA4NDgzM1oXDTM0MDQwMTA4NDgzM1ow
+HzEdMBsGA1UEAwwUUnlhbjRZaW4ncyBSb290IENBIDEwdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQ6ixMbsGZ/u/ZnwzOZ49naVL7rQxm9C74SboGytKcYBH03JjC7tgZ3
+DylirxSLcTYHHtCz9ajdamP6+sgiGVpUODtfGSO+WmS+gAbLjCS37T41bkUhkx88
+JU4NsGhjPXcwCgYIKoZIzj0EAwQDaAAwZQIwDrGLSdO+p/1uywkzqzdM/OnZs8bp
+n60uBhUI7EZzDmrouOFeGx+dXYI5yy5AD/qDAjEA7fTQx+jccyOj4dimq1iU9+71
+e/gWYg0rexfy/+9dQY6kvwMzv8Lnm6URaRMbE1Q/
+-----END CERTIFICATE-----

certs/ecc-ca.srl

@@ -0,0 +1 @@
+C050420A8E5A3C1E

certs/ecc-csr.conf

@@ -0,0 +1,22 @@
+[ req ]
+prompt = no
+req_extensions = v3_ext
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+countryName            = US
+stateOrProvinceName    = NYK
+localityName           = NYK
+organizationName       = Ryan4Yin
+organizationalUnitName = Ryan4Yin
+commonName             = writefor.fun # deprecated, use subjectAltName(SAN) instead
+emailAddress           = rayn4yin@linux.com
+
+[ alt_names ]
+DNS.1 = writefor.fun
+DNS.2 = *.writefor.fun
+
+[ v3_ext ]
+subjectAltName=@alt_names
+basicConstraints       = CA:false
+extendedKeyUsage       = serverAuth

certs/ecc-server.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICKTCCAa6gAwIBAgIJAMBQQgqOWjweMAoGCCqGSM49BAMEMB8xHTAbBgNVBAMM
+FFJ5YW40WWluJ3MgUm9vdCBDQSAxMB4XDTI0MDQwMzA4NDgzM1oXDTM0MDQwMTA4
+NDgzM1owgYkxCzAJBgNVBAYTAlVTMQwwCgYDVQQIDANOWUsxDDAKBgNVBAcMA05Z
+SzERMA8GA1UECgwIUnlhbjRZaW4xETAPBgNVBAsMCFJ5YW40WWluMRUwEwYDVQQD
+DAx3cml0ZWZvci5mdW4xITAfBgkqhkiG9w0BCQEWEnJheW40eWluQGxpbnV4LmNv
+bTB2MBAGByqGSM49AgEGBSuBBAAiA2IABCNTYKDq/I99NltQR5eKrrovQXp9BbLV
+iuUdYmzFrAh+NC9ikiIqTfDwP+c+7QvDyI3KXu3KI2qPSPdxktZKDUPHK4p2Y2kZ
+xKOI2IFTgTqV3uBciyx7ayWPTwBYxsTDmqNLMEkwJwYDVR0RBCAwHoIMd3JpdGVm
+b3IuZnVugg4qLndyaXRlZm9yLmZ1bjAJBgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMAoGCCqGSM49BAMEA2kAMGYCMQCHw9YkDo15P9mqEObvxSUak8tQmhBB
+9wB81Qg4c+JsMCZA1rMUB7GkNJj1Dr9rWLoCMQDSituLzmo/yPLEOrbNV83bj3/I
+ikKgobSie3pMXm5ZG7krOXaunyFRR/bIkih2V2Q=
+-----END CERTIFICATE-----

certs/gen-certs.sh

@@ -0,0 +1,22 @@
+# 1. Generate the private key for Root CA
+openssl ecparam -genkey -name secp384r1 -out ecc-ca.key
+# 2. Generate the certificate for Root CA with the validity period of 10 years
+# using the private key and some basic information
+# NOTE: we specify sha512 as the signature algorithm, which is the key point
+openssl req -x509 -new -SHA512 -key ecc-ca.key -subj "/CN=Ryan4Yin's Root CA 1" -days 3650 -out ecc-ca.crt
+
+# 3. Generate the private key for web server
+openssl ecparam -genkey -name secp384r1 -out ecc-server.key
+# 4. Generate the certificate signing request (CSR) for the server certificate
+# using the private key and the configuration file ecc-csr.conf
+openssl req -new -SHA512 -key ecc-server.key -out ecc-server.csr -config ecc-csr.conf
+# 5. Sign the server certificate with the Root CA's certificate and private key
+# NOTE: we specify sha512 as the signature algorithm, which is the key point
+openssl x509 -req -SHA512 -in ecc-server.csr -CA ecc-ca.crt -CAkey ecc-ca.key \
+  -CAcreateserial -out ecc-server.crt -days 3650 \
+  -extensions v3_ext -extfile ecc-csr.conf
+
+# 6. Display the information of the certificates
+openssl x509 -noout -text -in ecc-ca.crt
+openssl x509 -noout -text -in ecc-server.crt
+

flake.nix

@@ -1,93 +1,145 @@
 {
-  description = "NixOS configuration of Ryan Yin";
+  description = "Ryan Yin's nix configuration for both NixOS & macOS";
 
-  # flake 为了确保够纯，它不依赖系统自身的 /etc/nix/nix.conf，而是在 flake.nix 中通过 nixConfig 设置
+  ##################################################################################################################
-  # 但是为了确保安全性，flake 默认仅允许直接设置少数 nixConfig 参数，其他参数都需要在执行 nix 命令时指定 `--accept-flake-config`，否则会被忽略
+  #
-  # <https://nixos.org/manual/nix/stable/command-ref/conf-file.html>
+  # Want to know Nix in details? Looking for a beginner-friendly tutorial?
-  # 如果有些包国内镜像下载不到，它仍然会走国外，这时候就得靠旁路由来解决了。
+  # Check out https://github.com/ryan4yin/nixos-and-flakes-book !
-  # 临时修改默认网关为旁路由:  sudo ip route add default via 192.168.5.201
+  #
-  #                        sudo ip route del default via 192.168.5.201
+  ##################################################################################################################
+
+  outputs = inputs: import ./outputs inputs;
+
+  # the nixConfig here only affects the flake itself, not the system configuration!
+  # for more information, see:
+  #     https://nixos-and-flakes.thiscute.world/nix-store/add-binary-cache-servers
   nixConfig = {
-    experimental-features = [ "nix-command" "flakes" ];
+    # substituers will be appended to the default substituters when fetching packages
-    substituters = [
-      # replace official cache with a mirror located in China
-      "https://mirrors.bfsu.edu.cn/nix-channels/store"
-      "https://cache.nixos.org/"
-    ];
-
-    # nix community's cache server
     extra-substituters = [
-      "https://nix-community.cachix.org"
+      "https://anyrun.cachix.org"
+      # "https://nix-gaming.cachix.org"
+      # "https://nixpkgs-wayland.cachix.org"
     ];
     extra-trusted-public-keys = [
-      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s="
+      # "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
+      # "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
     ];
   };
 
-  # 这是 flake.nix 的标准格式，inputs 是 flake 的依赖，outputs 是 flake 的输出
+  # This is the standard format for flake.nix. `inputs` are the dependencies of the flake,
-  # inputs 中的每一项都被拉取、构建后，被作为参数传递给 outputs 函数 
+  # Each item in `inputs` will be passed as a parameter to the `outputs` function after being pulled and built.
   inputs = {
-    # 以 url 的形式指定依赖，flake 会自动拉取、构建
+    # There are many ways to reference flake inputs. The most widely used is github:owner/name/reference,
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";      # 使用 nixos-unstable 分支
+    # which represents the GitHub repository URL + branch/commit-id/tag.
-    home-manager.url = "github:nix-community/home-manager";
-    #　follows 是　inputs 中的继承语法
-    # 这里使　home-manager 的　nixpkgs 这个 inputs 与当前　flake 的　inputs.nixpkgs 保持一致，避免依赖的　nixpkgs 版本不一致导致问题
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    # vscode 插件库
+    # Official NixOS package source, using nixos's unstable branch by default
-    nix-vscode-extensions.url = "github:nix-community/nix-vscode-extensions";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
+
+    # for macos
+    nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-24.05-darwin";
+    nix-darwin = {
+      url = "github:lnl7/nix-darwin";
+      inputs.nixpkgs.follows = "nixpkgs-darwin";
+    };
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+
+    # home-manager, used for managing user configuration
+    home-manager = {
+      url = "github:nix-community/home-manager/master";
+      # url = "github:nix-community/home-manager/release-24.05";
+
+      # The `follows` keyword in inputs is used for inheritance.
+      # Here, `inputs.nixpkgs` of home-manager is kept consistent with the `inputs.nixpkgs` of the current flake,
+      # to avoid problems caused by different versions of nixpkgs dependencies.
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
-  # outputs 的参数都是 inputs 中定义的依赖项，可以通过它们的名称来引用。
+    lanzaboote = {
-  # 不过 self 是个例外，这个特殊参数指向 outputs 自身（自引用），以及 flake 根目录
+      url = "github:nix-community/lanzaboote/v0.4.1";
-  # 这里的 @ 语法将函数的参数 attribute set 取了个别名，方便在内部使用
+      inputs.nixpkgs.follows = "nixpkgs";
-  outputs = inputs@{ 
-      self,
-      nixpkgs,
-      home-manager,
-      nix-vscode-extensions,
-      ... 
-  }: {
-    # 名为 nixosConfigurations 的 outputs 会在执行 `nixos-rebuild switch --flake .` 时被使用
-    # 默认情况下会使用与主机 hostname 同名的 nixosConfigurations，但是也可以通过 `--flake .#<name>` 来指定
-    nixosConfigurations = {
-      # hostname 为 nixos 的主机会使用这个配置
-      # 这里使用了 nixpkgs.lib.nixosSystem 函数来构建配置，后面的 attributes set 是它的参数
-      # 在 nixos 上使用此命令部署配置：`nixos-rebuild switch --flake .#nixos-test`
-      nixos-test = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-
-        # modules 中每个参数，都是一个 NixOS Module <https://nixos.org/manual/nixos/stable/index.html#sec-modularity>
-        # NixOS Module 可以是一个 attribute set，也可以是一个返回 attribute set 的函数
-        # 如果是函数，那么它的参数就是当前的 NixOS Module 的参数.
-        # 根据 Nix Wiki 对 NixOS modules 的描述，NixOS modules 函数的参数可以有这四个（详见本仓库中的 modules 文件）：
-        # 
-        #  config: The configuration of the entire system
-        #  options: All option declarations refined with all definition and declaration references.
-        #  pkgs: The attribute set extracted from the Nix package collection and enhanced with the nixpkgs.config option.
-        #  modulesPath: The location of the module directory of NixOS.
-        #
-        # nix flake 的 modules 系统可将配置模块化，提升配置的可维护性
-        # 默认只能传上面这四个参数，如果需要传其他参数，必须使用 specialArgs
-        modules = [
-          ./hosts
-
-          # home-manager 作为 nixos 的一个 module
-          # 这样在 nixos-rebuild switch 时，home-manager 也会被自动部署，不需要额外执行 home-manager switch 命令
-          home-manager.nixosModules.home-manager
-          {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-
-            # 使用 home-manager.extraSpecialArgs 自定义传递给 ./home 的参数
-            home-manager.extraSpecialArgs = inputs;
-            home-manager.users.ryan = import ./home;
-          }
-        ];
     };
 
-      # 如果你在 x86_64-linux 平台上执行 nix build，那么默认会使用这个配置，或者也能通过 `.#<name>` 参数来指定非 default 的配置
+    impermanence.url = "github:nix-community/impermanence";
-      # packages.x86_64-linux.default = 
+
+    # community wayland nixpkgs
+    # nixpkgs-wayland.url = "github:nix-community/nixpkgs-wayland";
+    # anyrun - a wayland launcher
+    anyrun = {
+      url = "github:Kirottu/anyrun";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    # generate iso/qcow2/docker/... image from nixos configuration
+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    # secrets management
+    agenix = {
+      # lock with git commit at 0.15.0
+      # url = "github:ryantm/agenix/564595d0ad4be7277e07fa63b5a991b3c645655d";
+      # replaced with a type-safe reimplementation to get a better error message and less bugs.
+      url = "github:ryan4yin/ragenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nix-gaming.url = "github:fufexan/nix-gaming";
+
+    disko = {
+      url = "github:nix-community/disko/v1.6.1";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # add git hooks to format nix code before commit
+    pre-commit-hooks = {
+      url = "github:cachix/pre-commit-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nuenv.url = "github:DeterminateSystems/nuenv";
+
+    haumea = {
+      url = "github:nix-community/haumea/v0.2.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixpak = {
+      url = "github:nixpak/nixpak";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    ########################  Some non-flake repositories  #########################################
+
+    # doom-emacs is a configuration framework for GNU Emacs.
+    doomemacs = {
+      url = "github:doomemacs/doomemacs";
+      flake = false;
+    };
+
+    polybar-themes = {
+      url = "github:adi1090x/polybar-themes";
+      flake = false;
+    };
+
+    ########################  My own repositories  #########################################
+
+    # my private secrets, it's a private repository, you need to replace it with your own.
+    # use ssh protocol to authenticate via ssh-agent/ssh-key, and shallow clone to save time
+    mysecrets = {
+      url = "git+ssh://git@github.com/ryan4yin/nix-secrets.git?shallow=1";
+      flake = false;
+    };
+
+    # my wallpapers
+    wallpapers = {
+      url = "github:ryan4yin/wallpapers";
+      flake = false;
+    };
+
+    nur-ryan4yin.url = "github:ryan4yin/nur-packages";
+    nur-ataraxiasjel.url = "github:AtaraxiaSjel/nur";
   };
 }

hardening/README.md

@@ -0,0 +1,87 @@
+# Linux Hardening
+
+> Work in progress.
+
+## Goal
+
+- **System Level**: Protect critical files from being accessed by untrusted applications.
+  1. Such as browser cookies, SSH keys, etc.
+- **Per-App Level**: Prevent untrusted applications(such as closed-source apps) from:
+  1.  Accessing files they shouldn't.
+      - Such as a malicious application accessing your browser's cookies, SSH Keys, etc.
+  1.  Accessing the network when they don't need to.
+  1.  Accessing hardware devices they don't need.
+
+## Current Status
+
+1. **System Level**:
+   - [ ] AppArmor
+   - [ ] Kernel & System Hardening
+1. **Per-App Level**:
+   - Nixpak (Bubblewrap)
+     - [x] QQ
+     - [x] Firefox
+   - [ ] Firejail (risk? not enabled yet)
+
+## Kernel Hardening
+
+- NixOS Kernel Config:
+  https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/kernel/hardened/config.nix
+
+## System Hardening
+
+- NixOS Profile:
+  https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/profiles/hardened.nix
+- Apparmor: [roddhjav/apparmor.d)](https://github.com/roddhjav/apparmor.d)
+  - https://gitlab.com/apparmor/apparmor/-/wikis/Documentation
+  - AppArmor.d is a set of over 1500 AppArmor profiles whose aim is to confine most Linux based
+    applications and processes.
+  - Nix Package:
+    [roddhjav-apparmor-rules](https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix#L33)
+  - https://github.com/NixOS/nixpkgs/issues/331645
+  - https://github.com/LordGrimmauld/aa-alias-manager
+- SELinux: too complex, not recommended for personal use.
+
+## Application Sandboxing
+
+- [Firejail](https://github.com/netblue30/firejail/tree/master/etc): A SUID security sandbox with
+  hundreds of security profiles for many common applications in the default installation.
+  - https://wiki.nixos.org/wiki/Firejail
+  - Firejail needs SUID to work, which is considered a security risk -
+    [Does firejail improve the security of my system?](https://github.com/netblue30/firejail/discussions/4601)
+- [Bubblewrap](https://github.com/containers/bubblewrap):
+  [nixpak](https://github.com/nixpak/nixpak), more secure than firejail, but no batteries included.
+  - NixOS's FHSEnv is implemented using bubblewrap by default.
+- [Systemd/Hardening](https://wiki.nixos.org/wiki/Systemd/Hardening): Systemd also provides some
+  sandboxing features.
+
+## NOTE
+
+**Running untrusted code is never safe, kernel hardening & sandboxing cannot change this**.
+
+If you want to run untrusted code, please use a VM & an isolated network environment, which will
+provide a much higher level of security.
+
+## References
+
+- [Harden your NixOS workstation - dataswamp](https://dataswamp.org/~solene/2022-01-13-nixos-hardened.html)
+- [Linux Insecurities - Madaidans](https://madaidans-insecurities.github.io/linux.html)
+- [Sandboxing all programs by default - NixOS Discourse](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792)
+- [在 Firejail 中运行 Steam](https://imbearchild.cyou/archives/2021/11/steam-in-firejail/)
+- [Firejail - Arch Linux Wiki](https://wiki.archlinux.org/title/Firejail)
+- [Paranoid NixOS Setup - xeiaso](https://xeiaso.net/blog/paranoid-nixos-2021-07-18/)
+- [nix-mineral](https://github.com/cynicsketch/nix-mineral): NixOS module for convenient system
+  hardening.
+- nixpak configs:
+  - https://github.com/pokon548/OysterOS/tree/b97604d89953373d6316286b96f6a964af2c398d/desktop/application
+  - https://github.com/segment-tree/my-nixos/tree/ceb6041f73bd9edcb78a8818b27a28f7c629193b/hm/me/apps/nixpak
+  - https://github.com/Keksgesicht/nixos-config/tree/91cc77d8d6b598da7c4dbed143e0009c2dea6940/packages/nixpak
+  - https://github.com/bluskript/nix-config/blob/7ecb6a7254c1ac4969072f4c4febdc19f8b83b30/pkgs/nixpak/default.nix
+- firejail configs:
+  - https://github.com/stelcodes/nixos-config/blob/f8967c82a5e5f3d128eb1aaf7498b5f918f719ec/packages/overlay.nix#L261
+- apparmor configs:
+  - https://github.com/sukhmancs/nixos-configs/blob/7fcf737c506ad843113cd5b94796b49d4d4dfad2/modules/shared/security/apparmor/default.nix#L8
+  - https://github.com/zramctl/dotfiles/blob/4fe177f6984154960942bb47d5a375098ec6ed6a/modules/nixos/security/apparmor.nix#L4
+- Others:
+  - Directly via `buildFHSUserEnvBubblewrap`:
+    https://github.com/xddxdd/nur-packages/blob/master/pkgs/uncategorized/wechat-uos/default.nix

hardening/apparmor/default.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.dbus.apparmor = "enabled";
+  security.apparmor = {
+    enable = true;
+
+    # kill process that are not confined but have apparmor profiles enabled
+    killUnconfinedConfinables = true;
+    packages = with pkgs; [
+      apparmor-utils
+      apparmor-profiles
+    ];
+
+    # apparmor policies
+    policies = {
+      "default_deny" = {
+        enforce = false;
+        enable = false;
+        profile = ''
+          profile default_deny /** { }
+        '';
+      };
+
+      "sudo" = {
+        enforce = false;
+        enable = false;
+        profile = ''
+          ${pkgs.sudo}/bin/sudo {
+            file /** rwlkUx,
+          }
+        '';
+      };
+
+      "nix" = {
+        enforce = false;
+        enable = false;
+        profile = ''
+          ${config.nix.package}/bin/nix {
+            unconfined,
+          }
+        '';
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    apparmor-bin-utils
+    apparmor-profiles
+    apparmor-parser
+    libapparmor
+    apparmor-kernel-patches
+    apparmor-pam
+    apparmor-utils
+  ];
+}

hardening/firejail/default.nix

@@ -0,0 +1,71 @@
+{pkgs, ...}: let
+  firejailWrapper = import ./firejailWrapper.nix pkgs;
+in {
+  programs.firejail.enable = true;
+
+  # Add firejailed Apps into nixsuper, and reference them in home-manager or other nixos modules
+  nixpkgs.overlays = [
+    (_: super: {
+      firejailed = {
+        steam = firejailWrapper {
+          name = "steam-firejailed";
+          executable = "${super.steam}/bin/steam";
+          profile = "${super.firejail}/etc/firejail/steam.profile";
+        };
+        steam-run = firejailWrapper {
+          name = "steam-run-firejailed";
+          executable = "${super.steam}/bin/steam-run";
+          profile = "${super.firejail}/etc/firejail/steam.profile";
+        };
+
+        # firefox = firejailWrapper {
+        #   name = "firefox-firejailed";
+        #   executable = "${super.lib.getBin super.firefox-wayland}/bin/firefox";
+        #   profile = "${super.firejail}/etc/firejail/firefox.profile";
+        # };
+        # chromium = firejailWrapper {
+        #   name = "chromium-firejailed";
+        #   executable = "${super.lib.getBin super.ungoogled-chromium}/bin/chromium";
+        #   profile = "${super.firejail}/etc/firejail/chromium.profile";
+        # };
+
+        mpv = firejailWrapper {
+          executable = "${super.lib.getBin super.mpv}/bin/mpv";
+          profile = "${super.firejail}/etc/firejail/mpv.profile";
+        };
+        imv = firejailWrapper {
+          executable = "${super.lib.getBin super.imv}/bin/imv";
+          profile = "${super.firejail}/etc/firejail/imv.profile";
+        };
+        zathura = firejailWrapper {
+          executable = "${super.lib.getBin super.zathura}/bin/zathura";
+          profile = "${super.firejail}/etc/firejail/zathura.profile";
+        };
+        slack = firejailWrapper {
+          executable = "${super.lib.getBin super.slack}/bin/slack";
+          profile = "${super.firejail}/etc/firejail/slack.profile";
+        };
+        telegram-desktop = firejailWrapper {
+          executable = "${super.lib.getBin super.tdesktop}/bin/telegram-desktop";
+          profile = "${super.firejail}/etc/firejail/telegram-desktop.profile";
+        };
+        brave = firejailWrapper {
+          executable = "${super.lib.getBin super.brave}/bin/brave";
+          profile = "${super.firejail}/etc/firejail/brave.profile";
+        };
+        qutebrowser = firejailWrapper {
+          executable = "${super.lib.getBin super.qutebrowser}/bin/qutebrowser";
+          profile = "${super.firejail}/etc/firejail/qutebrowser.profile";
+        };
+        thunar = firejailWrapper {
+          executable = "${super.lib.getBin super.xfce.thunar}/bin/thunar";
+          profile = "${super.firejail}/etc/firejail/thunar.profile";
+        };
+        vscodium = firejailWrapper {
+          executable = "${super.lib.getBin super.vscodium}/bin/vscodium";
+          profile = "${super.firejail}/etc/firejail/vscodium.profile";
+        };
+      };
+    })
+  ];
+}

hardening/firejail/firejailWrapper.nix

@@ -0,0 +1,35 @@
+# https://www.reddit.com/r/NixOS/comments/1b56jdx/simple_nix_function_for_wrapping_executables_with/
+pkgs: {
+  name ? "firejail-wrapper",
+  executable,
+  desktop ? null,
+  profile ? null,
+  extraArgs ? [],
+}:
+pkgs.runCommand name
+{
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+  meta.priority = -1; # take precedence over non-firejailed versions
+}
+(
+  let
+    firejailArgs = pkgs.lib.concatStringsSep " " (
+      extraArgs ++ (pkgs.lib.optional (profile != null) "--profile=${toString profile}")
+    );
+  in
+    ''
+      command_path="$out/bin/$(basename ${executable})-jailed"
+      mkdir -p $out/bin
+      mkdir -p $out/share/applications
+      cat <<'_EOF' >"$command_path"
+      #! ${pkgs.runtimeShell} -e
+      exec /run/wrappers/bin/firejail ${firejailArgs} -- ${toString executable} "\$@"
+      _EOF
+      chmod 0755 "$command_path"
+    ''
+    + pkgs.lib.optionalString (desktop != null) ''
+      substitute ${desktop} $out/share/applications/$(basename ${desktop}) \
+        --replace ${executable} "$command_path"
+    ''
+)

hardening/nixpaks/default.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  nixpak,
+  ...
+}: let
+  callArgs = {
+    mkNixPak = nixpak.lib.nixpak {
+      inherit (pkgs) lib;
+      inherit pkgs;
+    };
+    safeBind = sloth: realdir: mapdir: [
+      (sloth.mkdir (sloth.concat' sloth.appDataDir realdir))
+      (sloth.concat' sloth.homeDir mapdir)
+    ];
+  };
+  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs).config.script;
+in {
+  # Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
+  nixpkgs.overlays = [
+    (_: super: {
+      nixpaks = {
+        qq = wrapper super ./qq.nix;
+        qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
+
+        wechat-uos = wrapper super ./wechat-uos.nix;
+        wechat-uos-desktop-item = super.callPackage ./wechat-uos-desktop-item.nix {};
+
+        firefox = wrapper super ./firefox.nix;
+        firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
+      };
+    })
+  ];
+}

hardening/nixpaks/firefox-desktop-item.nix

@@ -0,0 +1,11 @@
+{makeDesktopItem}:
+makeDesktopItem {
+  name = "firefox";
+  desktopName = "firefox";
+  exec = "firefox %U";
+  terminal = false;
+  icon = "firefox";
+  type = "Application";
+  categories = ["Network"];
+  comment = "firefox boxed";
+}

hardening/nixpaks/firefox.nix

@@ -0,0 +1,75 @@
+# Refer:
+# - Flatpak manifest's docs:
+#   - https://docs.flatpak.org/en/latest/manifests.html
+#   - https://docs.flatpak.org/en/latest/sandbox-permissions.html
+# - Firefox's flatpak manifest: https://hg.mozilla.org/mozilla-central/file/tip/taskcluster/docker/firefox-flatpak/runme.sh#l151
+{
+  lib,
+  pkgs,
+  mkNixPak,
+  ...
+}:
+mkNixPak {
+  config = {
+    config,
+    sloth,
+    ...
+  }: {
+    app = {
+      package = pkgs.firefox-wayland;
+      binPath = "bin/firefox";
+    };
+    flatpak.appId = "org.mozilla.firefox";
+
+    imports = [
+      ./modules/gui-base.nix
+      ./modules/network.nix
+    ];
+
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus.policies = {
+      "org.mozilla.firefox.*" = "own"; # firefox
+      "org.mozilla.firefox_beta.*" = "own"; # firefox beta
+      "org.mpris.MediaPlayer2.firefox.*" = "own";
+      "org.freedesktop.NetworkManager" = "talk";
+    };
+
+    bubblewrap = {
+      # To trace all the home files QQ accesses, you can use the following nushell command:
+      #   just trace-access firefox
+      # See the Justfile in the root of this repository for more information.
+      bind.rw = [
+        # given the read write permission to the following directories.
+        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+        (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
+
+        sloth.xdgDownloadDir
+        # ================ for externsions ===============================
+        # required by https://github.com/browserpass/browserpass-extension
+        (sloth.concat' sloth.homeDir "/.local/share/password-store") # pass
+      ];
+      bind.ro = [
+        # To actually make Firefox run
+        "/sys/bus/pci"
+        ["${config.app.package}/lib/firefox" "/app/etc/firefox"]
+
+        # Unsure
+        (sloth.concat' sloth.xdgConfigHome "/dconf")
+      ];
+
+      sockets = {
+        x11 = false;
+        wayland = true;
+        pipewire = true;
+      };
+      bind.dev = [
+        "/dev/shm" # Shared Memory
+      ];
+      tmpfs = [
+        "/tmp"
+      ];
+    };
+  };
+}

hardening/nixpaks/modules/gui-base.nix

@@ -0,0 +1,95 @@
+# https://github.com/nixpak/pkgs/blob/master/pkgs/modules/gui-base.nix
+{
+  config,
+  lib,
+  pkgs,
+  sloth,
+  ...
+}: let
+  envSuffix = envKey: suffix: sloth.concat' (sloth.env envKey) suffix;
+  # cursor & icon's theme should be the same as the host's one.
+  cursorTheme = pkgs.bibata-cursors;
+  iconTheme = pkgs.papirus-icon-theme;
+in {
+  config = {
+    dbus.policies = {
+      "${config.flatpak.appId}" = "own";
+      "org.freedesktop.DBus" = "talk";
+      "org.gtk.vfs.*" = "talk";
+      "org.gtk.vfs" = "talk";
+      "ca.desrt.dconf" = "talk";
+      "org.freedesktop.portal.*" = "talk";
+      "org.a11y.Bus" = "talk";
+    };
+    # https://github.com/nixpak/nixpak/blob/master/modules/gpu.nix
+    # 1. bind readonly - /run/opengl-driver
+    # 2. bind device   - /dev/dri
+    gpu = {
+      enable = lib.mkDefault true;
+      provider = "nixos";
+      bundlePackage = pkgs.mesa.drivers; # for amd & intel
+    };
+    # https://github.com/nixpak/nixpak/blob/master/modules/gui/fonts.nix
+    # it works not well, bind system's /etc/fonts directly instead
+    fonts.enable = false;
+    # https://github.com/nixpak/nixpak/blob/master/modules/locale.nix
+    locale.enable = true;
+    bubblewrap = {
+      network = lib.mkDefault false;
+      bind.rw = [
+        [
+          (envSuffix "HOME" "/.var/app/${config.flatpak.appId}/cache")
+          sloth.xdgCacheHome
+        ]
+        (sloth.concat' sloth.xdgCacheHome "/fontconfig")
+        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache")
+
+        (sloth.concat [
+          (sloth.env "XDG_RUNTIME_DIR")
+          "/"
+          (sloth.envOr "WAYLAND_DISPLAY" "no")
+        ])
+
+        (envSuffix "XDG_RUNTIME_DIR" "/at-spi/bus")
+        (envSuffix "XDG_RUNTIME_DIR" "/gvfsd")
+        (envSuffix "XDG_RUNTIME_DIR" "/pulse")
+
+        "/run/dbus"
+      ];
+      bind.ro = [
+        (envSuffix "XDG_RUNTIME_DIR" "/doc")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
+        (sloth.concat' sloth.xdgConfigHome "/fontconfig")
+
+        "/etc/fonts" # for fontconfig
+        "/etc/machine-id"
+        "/etc/localtime"
+
+        # Fix: libEGL warning: egl: failed to create dri2 screen
+        "/etc/egl"
+        "/etc/static/egl"
+      ];
+      bind.dev = [
+        # seems required when using nvidia as primary gpu
+        "/dev/nvidia0"
+        "/dev/nvidiactl"
+        "/dev/nvidia-modeset"
+        "/dev/nvidia-uvm"
+      ];
+
+      env = {
+        XDG_DATA_DIRS = lib.mkForce (lib.makeSearchPath "share" [
+          iconTheme
+          cursorTheme
+          pkgs.shared-mime-info
+        ]);
+        XCURSOR_PATH = lib.mkForce (lib.concatStringsSep ":" [
+          "${cursorTheme}/share/icons"
+          "${cursorTheme}/share/pixmaps"
+        ]);
+      };
+    };
+  };
+}

hardening/nixpaks/modules/network.nix

@@ -0,0 +1,8 @@
+# https://github.com/nixpak/pkgs/blob/master/pkgs/modules/network.nix
+{
+  etc.sslCertificates.enable = true;
+  bubblewrap = {
+    bind.ro = ["/etc/resolv.conf"];
+    network = true;
+  };
+}

hardening/nixpaks/qq-desktop-item.nix

@@ -0,0 +1,17 @@
+{
+  makeDesktopItem,
+  qq,
+}:
+makeDesktopItem {
+  name = "qq";
+  desktopName = "QQ";
+  exec = "qq %U";
+  terminal = false;
+  # To find the icon name(nushell):
+  #   let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"'
+  #   tree $"($p)/share/icons"
+  icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
+  type = "Application";
+  categories = ["Network"];
+  comment = "QQ boxed";
+}

hardening/nixpaks/qq.nix

@@ -0,0 +1,59 @@
+# Refer:
+# - Flatpak manifest's docs:
+#   - https://docs.flatpak.org/en/latest/manifests.html
+#   - https://docs.flatpak.org/en/latest/sandbox-permissions.html
+# - QQ's flatpak manifest: https://github.com/flathub/com.qq.QQ/blob/master/com.qq.QQ.yaml
+{
+  lib,
+  pkgs,
+  mkNixPak,
+  ...
+}:
+mkNixPak {
+  config = {sloth, ...}: {
+    app = {
+      package = pkgs.qq.override {
+        # fix fcitx5 input method
+        commandLineArgs = lib.concatStringsSep " " ["--enable-wayland-ime"];
+      };
+      binPath = "bin/qq";
+    };
+    flatpak.appId = "com.tencent.qq";
+
+    imports = [
+      ./modules/gui-base.nix
+      ./modules/network.nix
+    ];
+
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus.policies = {
+      "org.gnome.Shell.Screencast" = "talk";
+      "org.freedesktop.Notifications" = "talk";
+      "org.kde.StatusNotifierWatcher" = "talk";
+    };
+    bubblewrap = {
+      # To trace all the home files QQ accesses, you can use the following nushell command:
+      #   just trace-access qq
+      # See the Justfile in the root of this repository for more information.
+      bind.rw = [
+        # given the read write permission to the following directories.
+        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+        (sloth.mkdir (sloth.concat [sloth.xdgConfigHome "/QQ"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDownloadDir "/QQ"]))
+      ];
+      sockets = {
+        x11 = false;
+        wayland = true;
+        pipewire = true;
+      };
+      bind.dev = [
+        "/dev/shm" # Shared Memory
+      ];
+      tmpfs = [
+        "/tmp"
+      ];
+    };
+  };
+}

hardening/nixpaks/wechat-uos-desktop-item.nix

@@ -0,0 +1,17 @@
+{
+  makeDesktopItem,
+  wechat-uos,
+}:
+makeDesktopItem {
+  name = "wechat";
+  desktopName = "WeChat";
+  exec = "wechat-uos %U";
+  terminal = false;
+  # To find the icon name(nushell):
+  #   let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#wechat-uos.outPath | str trim --char '"'
+  #   tree $"($p)/share/icons"
+  icon = "${wechat-uos}/share/icons/hicolor/256x256/apps/com.tencent.wechat.png";
+  type = "Application";
+  categories = ["Network"];
+  comment = "Wechat boxed";
+}

hardening/nixpaks/wechat-uos.nix

@@ -0,0 +1,73 @@
+# TODO: wechat-uos is running in FHS sandbox by default, it's problematic
+#   to wrap it again via flatpak. We need to find a way to fix it.
+#   https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat-uos/package.nix
+# Refer:
+# - Flatpak manifest's docs:
+#   - https://docs.flatpak.org/en/latest/manifests.html
+#   - https://docs.flatpak.org/en/latest/sandbox-permissions.html
+# - wechat-uos's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml
+{
+  lib,
+  pkgs,
+  mkNixPak,
+  ...
+}:
+mkNixPak {
+  config = {sloth, ...}: {
+    app = {
+      package = pkgs.wechat-uos;
+      binPath = "bin/wechat-uos";
+    };
+    flatpak.appId = "com.tencent.WeChat";
+
+    imports = [
+      ./modules/gui-base.nix
+      ./modules/network.nix
+    ];
+
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus.policies = {
+      "org.gnome.Shell.Screencast" = "talk";
+      # System tray icon
+      "org.freedesktop.Notifications" = "talk";
+      "org.kde.StatusNotifierWatcher" = "talk";
+      # File Manager
+      "org.freedesktop.FileManager1" = "talk";
+      # Uses legacy StatusNotifier implementation
+      "org.kde.*" = "own";
+    };
+    bubblewrap = {
+      # To trace all the home files QQ accesses, you can use the following nushell command:
+      #   just trace-access wechat-uos
+      # See the Justfile in the root of this repository for more information.
+      bind.rw = [
+        # given the read write permission to the following directories.
+        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+        (sloth.mkdir (sloth.concat [sloth.homeDir "/.xwechat"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/xwechat_files"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/WeChat_Data/"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDownloadDir "/WeChat"]))
+      ];
+      sockets = {
+        x11 = false;
+        wayland = true;
+        pipewire = true;
+      };
+      bind.dev = [
+        "/dev/shm" # Shared Memory
+      ];
+      tmpfs = [
+        "/tmp"
+      ];
+
+      env = {
+        # Hidpi scale
+        "QT_AUTO_SCREEN_SCALE_FACTOR" = "1";
+        # Only supports xcb
+        "QT_QPA_PLATFORM" = "kcb";
+      };
+    };
+  };
+}

hardening/profiles/default.nix

@@ -0,0 +1,9 @@
+{modulesPath, ...}: {
+  imports = [
+    (modulesPath + "/profiles/hardened.nix")
+  ];
+
+  # disable coredump that could be exploited later
+  # and also slow down the system when something crash
+  systemd.coredump.enable = false;
+}

home/README.md

@@ -0,0 +1,5 @@
+# Home Manager's Submodules
+
+1. `base`: The base module that is suitable for both Linux and macOS.
+2. `linux`: Linux-specific configuration.
+3. `darwin`: macOS-specific configuration.

home/base/README.md

@@ -0,0 +1,5 @@
+# Home Manager's Base Submodules
+
+1. `server`: Configuration which is suitable for both servers and desktops.
+1. `desktop`: Configuration for desktop environments, such as Hyprland, I3, etc.
+1. `core.nix`: Minimal home-manager's config

home/base/core/btop.nix

@@ -0,0 +1,17 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  # https://github.com/catppuccin/btop/blob/main/themes/catppuccin_mocha.theme
+  xdg.configFile."btop/themes".source = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-btop}/themes";
+
+  # replacement of htop/nmon
+  programs.btop = {
+    enable = true;
+    settings = {
+      color_theme = "catppuccin_mocha";
+      theme_background = false; # make btop transparent
+    };
+  };
+}

home/base/core/container.nix

@@ -0,0 +1,51 @@
+{
+  pkgs,
+  pkgs-unstable,
+  nur-ryan4yin,
+  ...
+}: {
+  home.packages = with pkgs; [
+    docker-compose
+    dive # explore docker layers
+    lazydocker # Docker terminal UI.
+    skopeo # copy/sync images between registries and local storage
+    go-containerregistry # provides `crane` & `gcrane`, it's similar to skopeo
+
+    kubectl
+    kubectx
+    kubebuilder
+    istioctl
+    clusterctl # for kubernetes cluster-api
+    kubevirt # virtctl
+    kubernetes-helm
+    fluxcd
+    argocd
+
+    ko # build go project to container image
+  ];
+
+  programs = {
+    k9s = {
+      enable = true;
+      # https://k9scli.io/topics/aliases/
+      # aliases = {};
+      settings = {
+        skin = "catppuccino-mocha";
+      };
+      skins.catppuccin-mocha = let
+        skin_file = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-k9s}/dist/mocha.yml"; # theme - catppuccin mocha
+        skin_attr = builtins.fromJSON (
+          builtins.readFile
+          # replace 'base: &base "#1e1e2e"' with 'base: &base "default"'
+          # to make fg/bg color transparent. "default" means transparent in k9s skin.
+          (pkgs.runCommandNoCC "get-skin-json" {} ''
+            cat ${skin_file} \
+              |  sed -E 's@(base: &base ).+@\1 "default"@g' \
+              | ${pkgs.yj}/bin/yj > $out
+          '')
+        );
+      in
+        skin_attr;
+    };
+  };
+}

home/base/core/core.nix

@@ -0,0 +1,140 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  home.packages = with pkgs; [
+    # Misc
+    tldr
+    cowsay
+    gnupg
+    gnumake
+
+    # Modern cli tools, replacement of grep/sed/...
+
+    # Interactively filter its input using fuzzy searching, not limit to filenames.
+    fzf
+    # search for files by name, faster than find
+    fd
+    # search for files by its content, replacement of grep
+    (ripgrep.override {withPCRE2 = true;})
+
+    # A fast and polyglot tool for code searching, linting, rewriting at large scale
+    # supported languages: only some mainstream languages currently(do not support nix/nginx/yaml/toml/...)
+    ast-grep
+
+    sad # CLI search and replace, just like sed, but with diff preview.
+    yq-go # yaml processor https://github.com/mikefarah/yq
+    just # a command runner like make, but simpler
+    delta # A viewer for git and diff output
+    lazygit # Git terminal UI.
+    hyperfine # command-line benchmarking tool
+    gping # ping, but with a graph(TUI)
+    doggo # DNS client for humans
+    duf # Disk Usage/Free Utility - a better 'df' alternative
+    du-dust # A more intuitive version of `du` in rust
+    gdu # disk usage analyzer(replacement of `du`)
+
+    # nix related
+    #
+    # it provides the command `nom` works just like `nix
+    # with more details log output
+    nix-output-monitor
+    hydra-check # check hydra(nix's build farm) for the build status of a package
+    nix-index # A small utility to index nix store paths
+    nix-init # generate nix derivation from url
+    # https://github.com/nix-community/nix-melt
+    nix-melt # A TUI flake.lock viewer
+    # https://github.com/utdemir/nix-tree
+    nix-tree # A TUI to visualize the dependency graph of a nix derivation
+
+    # productivity
+    caddy # A webserver with automatic HTTPS via Let's Encrypt(replacement of nginx)
+    croc # File transfer between computers securely and easily
+    ncdu # analyzer your disk usage Interactively, via TUI(replacement of `du`)
+  ];
+
+  programs = {
+    # A modern replacement for ‘ls’
+    # useful in bash/zsh prompt, not in nushell.
+    eza = {
+      enable = true;
+      # do not enable aliases in nushell!
+      enableNushellIntegration = false;
+      git = true;
+      icons = "auto";
+    };
+
+    # a cat(1) clone with syntax highlighting and Git integration.
+    bat = {
+      enable = true;
+      config = {
+        pager = "less -FR";
+        theme = "catppuccin-mocha";
+      };
+      themes = {
+        # https://raw.githubusercontent.com/catppuccin/bat/main/Catppuccin-mocha.tmTheme
+        catppuccin-mocha = {
+          src = nur-ryan4yin.packages.${pkgs.system}.catppuccin-bat;
+          file = "Catppuccin-mocha.tmTheme";
+        };
+      };
+    };
+
+    # A command-line fuzzy finder
+    fzf = {
+      enable = true;
+      # https://github.com/catppuccin/fzf
+      # catppuccin-mocha
+      colors = {
+        "bg+" = "#313244";
+        "bg" = "#1e1e2e";
+        "spinner" = "#f5e0dc";
+        "hl" = "#f38ba8";
+        "fg" = "#cdd6f4";
+        "header" = "#f38ba8";
+        "info" = "#cba6f7";
+        "pointer" = "#f5e0dc";
+        "marker" = "#f5e0dc";
+        "fg+" = "#cdd6f4";
+        "prompt" = "#cba6f7";
+        "hl+" = "#f38ba8";
+      };
+    };
+
+    # zoxide is a smarter cd command, inspired by z and autojump.
+    # It remembers which directories you use most frequently,
+    # so you can "jump" to them in just a few keystrokes.
+    # zoxide works on all major shells.
+    #
+    #   z foo              # cd into highest ranked directory matching foo
+    #   z foo bar          # cd into highest ranked directory matching foo and bar
+    #   z foo /            # cd into a subdirectory starting with foo
+    #
+    #   z ~/foo            # z also works like a regular cd command
+    #   z foo/             # cd into relative path
+    #   z ..               # cd one level up
+    #   z -                # cd into previous directory
+    #
+    #   zi foo             # cd with interactive selection (using fzf)
+    #
+    #   z foo<SPACE><TAB>  # show interactive completions (zoxide v0.8.0+, bash 4.4+/fish/zsh only)
+    zoxide = {
+      enable = true;
+      enableBashIntegration = true;
+      enableZshIntegration = true;
+      enableNushellIntegration = true;
+    };
+
+    # Atuin replaces your existing shell history with a SQLite database,
+    # and records additional context for your commands.
+    # Additionally, it provides optional and fully encrypted
+    # synchronisation of your history between machines, via an Atuin server.
+    atuin = {
+      enable = true;
+      enableBashIntegration = true;
+      enableZshIntegration = true;
+      enableNushellIntegration = true;
+    };
+  };
+}

home/base/core/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/core/editors/README.md

@@ -0,0 +1,3 @@
+# Editors
+
+See [desktop/editors/](../../desktop/editors/) for more details.

home/base/core/editors/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/core/editors/helix/default.nix

@@ -0,0 +1,5 @@
+{pkgs, ...}: {
+  programs.helix = {
+    enable = true;
+  };
+}

home/base/core/editors/neovim/default.nix

@@ -0,0 +1,11 @@
+{pkgs, ...}: {
+  programs = {
+    neovim = {
+      enable = true;
+
+      defaultEditor = true;
+      viAlias = true;
+      vimAlias = true;
+    };
+  };
+}

home/base/core/git.nix

@@ -0,0 +1,99 @@
+{
+  config,
+  lib,
+  pkgs,
+  myvars,
+  ...
+}: {
+  # `programs.git` will generate the config file: ~/.config/git/config
+  # to make git use this config file, `~/.gitconfig` should not exist!
+  #
+  #    https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
+  home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
+    rm -f ${config.home.homeDirectory}/.gitconfig
+  '';
+
+  home.packages = with pkgs; [
+  ];
+
+  programs.git = {
+    enable = true;
+    lfs.enable = true;
+
+    userName = myvars.userfullname;
+    userEmail = myvars.useremail;
+
+    includes = [
+      {
+        # use different email & name for work
+        path = "~/work/.gitconfig";
+        condition = "gitdir:~/work/";
+      }
+    ];
+
+    extraConfig = {
+      init.defaultBranch = "main";
+      trim.bases = "develop,master,main"; # for git-trim
+      push.autoSetupRemote = true;
+      pull.rebase = true;
+
+      # replace https with ssh
+      url = {
+        "ssh://git@github.com/ryan4yin" = {
+          insteadOf = "https://github.com/ryan4yin";
+        };
+        # "ssh://git@gitlab.com/" = {
+        #   insteadOf = "https://gitlab.com/";
+        # };
+        # "ssh://git@bitbucket.com/" = {
+        #   insteadOf = "https://bitbucket.com/";
+        # };
+      };
+    };
+
+    # signing = {
+    #   key = "xxx";
+    #   signByDefault = true;
+    # };
+
+    # A syntax-highlighting pager in Rust(2019 ~ Now)
+    delta = {
+      enable = true;
+      options = {
+        diff-so-fancy = true;
+        line-numbers = true;
+        true-color = "always";
+        # features => named groups of settings, used to keep related settings organized
+        # features = "";
+      };
+    };
+
+    aliases = {
+      # common aliases
+      br = "branch";
+      co = "checkout";
+      st = "status";
+      ls = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate";
+      ll = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate --numstat";
+      cm = "commit -m"; # commit via `git cm <message>`
+      ca = "commit -am"; # commit all changes via `git ca <message>`
+      dc = "diff --cached";
+
+      amend = "commit --amend -m"; # amend commit message via `git amend <message>`
+      unstage = "reset HEAD --"; # unstage file via `git unstage <file>`
+      merged = "branch --merged"; # list merged(into HEAD) branches via `git merged`
+      unmerged = "branch --no-merged"; # list unmerged(into HEAD) branches via `git unmerged`
+      nonexist = "remote prune origin --dry-run"; # list non-exist(remote) branches via `git nonexist`
+
+      # delete merged branches except master & dev & staging
+      #  `!` indicates it's a shell script, not a git subcommand
+      delmerged = ''! git branch --merged | egrep -v "(^\*|main|master|dev|staging)" | xargs git branch -d'';
+      # delete non-exist(remote) branches
+      delnonexist = "remote prune origin";
+
+      # aliases for submodule
+      update = "submodule update --init --recursive";
+      foreach = "submodule foreach";
+    };
+  };
+}

home/base/core/pip.nix

@@ -0,0 +1,13 @@
+_: {
+  # use mirror for pip install
+  xdg.configFile."pip/pip.conf".text = ''
+    [global]
+    index-url = https://mirrors.ustc.edu.cn/pypi/web/simple
+    format = columns
+  '';
+
+  # xdg.configFile."pip/pip.conf".text = ''
+  #   [global]
+  #   index-url = https://mirrors.bfsu.edu.cn/pypi/web/simple
+  # '';
+}

home/base/core/shells/config.nu

@@ -0,0 +1,146 @@
+# Nushell Config File
+#
+# version = 0.81.1
+
+# let's define some colors
+
+# https://github.com/catppuccin/i3/blob/main/themes/catppuccin-mocha
+let rosewater = "#f5e0dc"
+let flamingo  = "#f2cdcd"
+let pink      = "#f5c2e7"
+let mauve     = "#cba6f7"
+let red       = "#f38ba8"
+let maroon    = "#eba0ac"
+let peach     = "#fab387"
+let green     = "#a6e3a1"
+let teal      = "#94e2d5"
+let sky       = "#89dceb"
+let sapphire  = "#74c7ec"
+let blue      = "#89b4fa"
+let lavender  = "#b4befe"
+let text      = "#cdd6f4"
+let subtext1  = "#bac2de"
+let subtext0  = "#a6adc8"
+let overlay2  = "#9399b2"
+let overlay1  = "#7f849c"
+let overlay0  = "#6c7086"
+let surface2  = "#585b70"
+let surface1  = "#45475a"
+let surface0  = "#313244"
+let base      = "#1e1e2e"
+let mantle    = "#181825"
+let crust     = "#11111b"
+
+# we're creating a theme here that uses the colors we defined above.
+
+let catppuccin_theme = {
+    separator: $overlay2
+    leading_trailing_space_bg: $surface2
+    header: $red
+    date: $pink
+    filesize: $green
+    row_index: $text
+    bool: $peach
+    int: $red
+    duration: $sky
+    range: $sapphire
+    float: $lavender
+    string: $text
+    nothing: $overlay1
+    binary: $subtext1
+    cellpath: $subtext0
+    hints: dark_gray
+
+    shape_garbage: { fg: $overlay2 bg: $red attr: b}
+    shape_bool: $maroon
+    shape_int: { fg: $pink attr: b}
+    shape_float: { fg: $pink attr: b}
+    shape_range: { fg: $overlay0 attr: b}
+    shape_internalcall: { fg: $maroon attr: b}
+    shape_external: $mauve
+    shape_externalarg: { fg: $red attr: b}
+    shape_literal: $flamingo
+    shape_operator: $rosewater
+    shape_signature: { fg: $red attr: b}
+    shape_string: $red
+    shape_filepath: $peach
+    shape_globpattern: { fg: $teal attr: b}
+    shape_variable: $pink
+    shape_flag: { fg: $mauve attr: b}
+    shape_custom: {attr: b}
+}
+
+# The default config record. This is where much of your global configuration is setup.
+$env.config = {
+  color_config: $catppuccin_theme  # <-- this is the theme
+  use_ansi_coloring: true
+
+  # true or false to enable or disable the welcome banner at startup
+  show_banner: false
+  
+  table: {
+    mode: rounded # basic, compact, compact_double, light, thin, with_love, rounded, reinforced, heavy, none, other
+    index_mode: always # "always" show indexes, "never" show indexes, "auto" = show indexes when a table has "index" column
+    show_empty: true # show 'empty list' and 'empty record' placeholders for command output
+    trim: {
+      methodology: wrapping # wrapping or truncating
+      wrapping_try_keep_words: true # A strategy used by the 'wrapping' methodology
+      truncating_suffix: "..." # A suffix used by the 'truncating' methodology
+    }
+  }
+
+  completions: {
+    case_sensitive: false # set to true to enable case-sensitive completions
+    quick: true  # set this to false to prevent auto-selecting completions when only one remains
+    partial: true  # set this to false to prevent partial filling of the prompt
+    algorithm: "prefix"  # prefix or fuzzy
+    external: {
+      enable: true # set to false to prevent nushell looking into $env.PATH to find more suggestions, `false` recommended for WSL users as this look up may be very slow
+      max_results: 100 # setting it lower can improve completion performance at the cost of omitting some options
+      completer: null # check 'carapace_completer' above as an example
+    }
+  }
+  filesize: {
+    metric: true # true => KB, MB, GB (ISO standard), false => KiB, MiB, GiB (Windows standard)
+    format: "auto" # b, kb, kib, mb, mib, gb, gib, tb, tib, pb, pib, eb, eib, zb, zib, auto
+  }
+  cursor_shape: {
+    emacs: line # block, underscore, line, blink_block, blink_underscore, blink_line (line is the default)
+    vi_insert: block # block, underscore, line , blink_block, blink_underscore, blink_line (block is the default)
+    vi_normal: underscore # block, underscore, line, blink_block, blink_underscore, blink_line (underscore is the default)
+  }
+  footer_mode: "auto" # always, never, number_of_rows, auto
+  float_precision: 2 # the precision for displaying floats in tables
+  # buffer_editor: "emacs" # command that will be used to edit the current line buffer with ctrl+o, if unset fallback to $env.EDITOR and $env.VISUAL
+  bracketed_paste: true # enable bracketed paste, currently useless on windows
+  edit_mode: emacs # emacs, vi
+  shell_integration: {
+        # osc2 abbreviates the path if in the home_dir, sets the tab/window title, shows the running command in the tab/window title
+        osc2: true
+        # osc7 is a way to communicate the path to the terminal, this is helpful for spawning new tabs in the same directory
+        osc7: true
+        # osc8 is also implemented as the deprecated setting ls.show_clickable_links, it shows clickable links in ls output if your terminal supports it. show_clickable_links is deprecated in favor of osc8
+        osc8: true
+        # osc9_9 is from ConEmu and is starting to get wider support. It's similar to osc7 in that it communicates the path to the terminal
+        osc9_9: false
+        # osc133 is several escapes invented by Final Term which include the supported ones below.
+        # 133;A - Mark prompt start
+        # 133;B - Mark prompt end
+        # 133;C - Mark pre-execution
+        # 133;D;exit - Mark execution finished with exit code
+        # This is used to enable terminals to know where the prompt is, the command is, where the command finishes, and where the output of the command is
+        osc133: true
+        # osc633 is closely related to osc133 but only exists in visual studio code (vscode) and supports their shell integration features
+        # 633;A - Mark prompt start
+        # 633;B - Mark prompt end
+        # 633;C - Mark pre-execution
+        # 633;D;exit - Mark execution finished with exit code
+        # 633;E - NOT IMPLEMENTED - Explicitly set the command line with an optional nonce
+        # 633;P;Cwd=<path> - Mark the current working directory and communicate it to the terminal
+        # and also helps with the run recent menu in vscode
+        osc633: true
+        # reset_application_mode is escape \x1b[?1l and was added to help ssh work better
+        reset_application_mode: true
+    }
+  render_right_prompt_on_last_line: false # true or false to enable or disable right prompt to be rendered on last line of the prompt.
+}

home/base/core/shells/default.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  pkgs-unstable,
+  ...
+}: let
+  shellAliases = {
+    k = "kubectl";
+
+    urldecode = "python3 -c 'import sys, urllib.parse as ul; print(ul.unquote_plus(sys.stdin.read()))'";
+    urlencode = "python3 -c 'import sys, urllib.parse as ul; print(ul.quote_plus(sys.stdin.read()))'";
+  };
+
+  localBin = "${config.home.homeDirectory}/.local/bin";
+  goBin = "${config.home.homeDirectory}/go/bin";
+  rustBin = "${config.home.homeDirectory}/.cargo/bin";
+in {
+  # only works in bash/zsh, not nushell
+  home.shellAliases = shellAliases;
+
+  programs.nushell = {
+    enable = true;
+    package = pkgs-unstable.nushell;
+    configFile.source = ./config.nu;
+    inherit shellAliases;
+  };
+
+  programs.bash = {
+    enable = true;
+    enableCompletion = true;
+    bashrcExtra = ''
+      export PATH="$PATH:${localBin}:${goBin}:${rustBin}"
+    '';
+  };
+}

home/base/core/starship.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  programs.starship = {
+    enable = true;
+
+    enableBashIntegration = true;
+    enableZshIntegration = true;
+    enableNushellIntegration = true;
+
+    settings =
+      {
+        character = {
+          success_symbol = "[›](bold green)";
+          error_symbol = "[›](bold red)";
+        };
+        aws = {
+          symbol = "🅰 ";
+        };
+        gcloud = {
+          # do not show the account/project's info
+          # to avoid the leak of sensitive information when sharing the terminal
+          format = "on [$symbol$active(\($region\))]($style) ";
+          symbol = "🅶 ️";
+        };
+
+        palette = "catppuccin_mocha";
+      }
+      // builtins.fromTOML (builtins.readFile "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-starship}/palettes/mocha.toml");
+  };
+}

home/base/core/yazi.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  pkgs-unstable,
+  nur-ryan4yin,
+  ...
+}: {
+  # terminal file manager
+  programs.yazi = {
+    enable = true;
+    package = pkgs-unstable.yazi;
+    # Changing working directory when exiting Yazi
+    enableBashIntegration = true;
+    enableNushellIntegration = true;
+    settings = {
+      manager = {
+        show_hidden = true;
+        sort_dir_first = true;
+      };
+    };
+  };
+
+  xdg.configFile."yazi/theme.toml".source = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-yazi}/mocha.toml";
+}

home/base/core/zellij/default.nix

@@ -0,0 +1,12 @@
+let
+  shellAliases = {
+    "zj" = "zellij";
+  };
+in {
+  programs.zellij = {
+    enable = true;
+  };
+  # only works in bash/zsh, not nushell
+  home.shellAliases = shellAliases;
+  programs.nushell.shellAliases = shellAliases;
+}

home/base/gui/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/gui/dev-tools.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  home.packages = with pkgs; [
+    mitmproxy # http/https proxy tool
+    insomnia # REST client
+    wireshark # network analyzer
+
+    # IDEs
+    jetbrains.idea-community
+  ];
+}

home/base/gui/media.nix

@@ -0,0 +1,16 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+# processing audio/video
+{
+  home.packages = with pkgs; [
+    ffmpeg-full
+
+    # images
+    viu # Terminal image viewer with native support for iTerm and Kitty
+    imagemagick
+    graphviz
+  ];
+}

home/base/gui/terminal/README.md

@@ -0,0 +1,84 @@
+# Terminal Emulators
+
+I used to spend a lot of time on terminal emulators, to make them match my taste, but now I found
+that it's not worth it, **Zellij can provide a user-friendly and unified user experience for all
+terminal emulators! without any pain**!
+
+Currently, I only use the most basic features of terminal emulators, such as true color, graphics
+protocol, etc. Other features such as tabs, scrollback buffer, select/search/copy, etc, are all
+provided by zellij!
+
+My current terminal emulators are:
+
+1. kitty: My main terminal emulator.
+   1. to select/copy a large mount of text, We should do some tricks via kitty's `scrollback_pager`
+      with neovim, it's really painful: <https://github.com/kovidgoyal/kitty/issues/719>
+2. foot: A fast, lightweight and minimalistic Wayland terminal emulator.
+   1. foot only do the things a terminal emulator should do, no more, no less.
+   1. It's really suitable for tiling window manager or zellij users!
+3. alacritty: A cross-platform, GPU-accelerated terminal emulator.
+   1. alacritty is really fast, I use it as a backup terminal emulator on all my desktops.
+
+## 'xterm-kitty': unknown terminal type when `ssh` into a remote host or `sudo xxx`
+
+> https://sw.kovidgoyal.net/kitty/faq/#i-get-errors-about-the-terminal-being-unknown-or-opening-the-terminal-failing-or-functional-keys-like-arrow-keys-don-t-work
+
+> https://wezfurlong.org/wezterm/config/lua/config/term.html
+
+kitty set `TERM` to `xterm-kitty` by default, and TUI apps like `viu`, `yazi`, `curses` will try to
+search in the host's [terminfo(terminal capability data base)](https://linux.die.net/man/5/terminfo)
+for value of `TERM` to determine the capabilities of the terminal.
+
+But when you `ssh` into a remote host, the remote host is very likely to not have `xterm-kitty` in
+its terminfo, so you will get this error:
+
+```
+'xterm-kitty': unknown terminal type
+```
+
+Or when you `sudo xxx`, `sudo` won't preserve the `TERM` variable, it will be reset to root's
+default `TERM` value, which is `xterm` or `xterm-256color` in most linux distributions, so you will
+get this error:
+
+```
+'xterm-256color': unknown terminal type
+```
+
+or
+
+```
+Error opening terminal: xterm-kitty.
+```
+
+NixOS preserve the `TERMINFO` and `TERMINFO_DIRS` environment variables, for `root` and the `wheel`
+group:
+[nixpkgs/nixos/modules/config/terminfo.nix](https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/config/terminfo.nix#L18)
+
+For nix-darwin, take a look at <https://github.com/LnL7/nix-darwin/wiki/Terminfo-issues>
+
+### Solutions
+
+Simplest solution, it will automatically copy over the terminfo files and also magically enable
+shell integration on the remote machine:
+
+```
+kitten ssh user@host
+```
+
+Or if you do not care about kitty's features(such as true color & graphics protocol), you can simply
+set `TERM` to `xterm-256color`, which is built-in in most linux distributions:
+
+```
+export TERM=xterm-256color
+```
+
+If you need kitty's features, but do not like the magic of `kitten`, you can manually install
+kitty's terminfo on the remote host:
+
+```bash
+# install on ubuntu / debian
+sudo apt-get install kitty-terminfo
+
+# or copy from local machine
+infocmp -a xterm-kitty | ssh myserver tic -x -o \~/.terminfo /dev/stdin
+```

home/base/gui/terminal/alacritty/catppuccin-mocha.toml

@@ -0,0 +1,65 @@
+[colors.primary]
+background = "#1e1e2e"
+foreground = "#cdd6f4"
+dim_foreground = "#7f849c"
+bright_foreground = "#cdd6f4"
+
+[colors.cursor]
+text = "#1e1e2e"
+cursor = "#f5e0dc"
+
+[colors.vi_mode_cursor]
+text = "#1e1e2e"
+cursor = "#b4befe"
+
+[colors.search.matches]
+foreground = "#1e1e2e"
+background = "#a6adc8"
+
+[colors.search.focused_match]
+foreground = "#1e1e2e"
+background = "#a6e3a1"
+
+[colors.footer_bar]
+foreground = "#1e1e2e"
+background = "#a6adc8"
+
+[colors.hints.start]
+foreground = "#1e1e2e"
+background = "#f9e2af"
+
+[colors.hints.end]
+foreground = "#1e1e2e"
+background = "#a6adc8"
+
+[colors.selection]
+text = "#1e1e2e"
+background = "#f5e0dc"
+
+[colors.normal]
+black = "#45475a"
+red = "#f38ba8"
+green = "#a6e3a1"
+yellow = "#f9e2af"
+blue = "#89b4fa"
+magenta = "#f5c2e7"
+cyan = "#94e2d5"
+white = "#bac2de"
+
+[colors.bright]
+black = "#585b70"
+red = "#f38ba8"
+green = "#a6e3a1"
+yellow = "#f9e2af"
+blue = "#89b4fa"
+magenta = "#f5c2e7"
+cyan = "#94e2d5"
+white = "#a6adc8"
+
+[[colors.indexed_colors]]
+index = 16
+color = "#fab387"
+
+[[colors.indexed_colors]]
+index = 17
+color = "#f5e0dc"

home/base/gui/terminal/alacritty/default.nix

@@ -0,0 +1,66 @@
+{
+  pkgs,
+  pkgs-unstable,
+  ...
+}:
+###########################################################
+#
+# Alacritty Configuration
+#
+# Useful Hot Keys for macOS:
+#   1. Multi-Window: `command + N`
+#   2. Increase Font Size: `command + =` | `command + +`
+#   3. Decrease Font Size: `command + -` | `command + _`
+#   4. Search Text: `command + F`
+#   5. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
+#
+# Useful Hot Keys for Linux:
+#   1. Increase Font Size: `ctrl + shift + =` | `ctrl + shift + +`
+#   2. Decrease Font Size: `ctrl + shift + -` | `ctrl + shift + _`
+#   3. Search Text: `ctrl + shift + N`
+#   4. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
+#
+# Note: Alacritty do not have support for Tabs, and any graphic protocol.
+#
+###########################################################
+{
+  programs.alacritty = {
+    enable = true;
+    package = pkgs-unstable.alacritty;
+    # https://alacritty.org/config-alacritty.html
+    settings = {
+      general.import = [
+        ./catppuccin-mocha.toml
+      ];
+      window = {
+        opacity = 0.93;
+        startup_mode = "Maximized"; # Maximized window
+        dynamic_title = true;
+        option_as_alt = "Both"; # Option key acts as Alt on macOS
+      };
+      scrolling = {
+        history = 10000;
+      };
+      font = {
+        bold = {family = "JetBrainsMono Nerd Font";};
+        italic = {family = "JetBrainsMono Nerd Font";};
+        normal = {family = "JetBrainsMono Nerd Font";};
+        bold_italic = {family = "JetBrainsMono Nerd Font";};
+        size =
+          if pkgs.stdenv.isDarwin
+          then 14
+          else 13;
+      };
+      terminal = {
+        # Spawn a nushell in login mode via `bash`
+        shell = {
+          program = "${pkgs.bash}/bin/bash";
+          args = ["--login" "-c" "nu --login --interactive"];
+        };
+        # Controls the ability to write to the system clipboard with the OSC 52 escape sequence.
+        # It's used by zellij to copy text to the system clipboard.
+        osc52 = "CopyPaste";
+      };
+    };
+  };
+}

home/base/gui/terminal/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/gui/terminal/foot.nix

@@ -0,0 +1,62 @@
+{pkgs, ...}: {
+  programs.foot = {
+    # foot is designed only for Linux
+    enable = pkgs.stdenv.isLinux;
+    # https://man.archlinux.org/man/foot.ini.5
+    settings = {
+      main = {
+        term = "foot"; # or "xterm-256color" for maximum compatibility
+        font = "JetBrainsMono Nerd Font:size=14";
+        dpi-aware = "yes";
+
+        # Spawn a nushell in login mode via `bash`
+        shell = "${pkgs.bash}/bin/bash --login -c 'nu --login --interactive'";
+      };
+
+      mouse = {
+        hide-when-typing = "yes";
+      };
+
+      # https://github.com/catppuccin/foot/blob/main/themes/catppuccin-mocha.ini
+      cursor = {
+        color = "11111b f5e0dc";
+      };
+      colors = {
+        alpha = "0.93"; # background opacity
+
+        foreground = "cdd6f4";
+        background = "1e1e2e";
+
+        regular0 = "45475a";
+        regular1 = "f38ba8";
+        regular2 = "a6e3a1";
+        regular3 = "f9e2af";
+        regular4 = "89b4fa";
+        regular5 = "f5c2e7";
+        regular6 = "94e2d5";
+        regular7 = "bac2de";
+
+        bright0 = "585b70";
+        bright1 = "f38ba8";
+        bright2 = "a6e3a1";
+        bright3 = "f9e2af";
+        bright4 = "89b4fa";
+        bright5 = "f5c2e7";
+        bright6 = "94e2d5";
+        bright7 = "a6adc8";
+
+        "16" = "fab387";
+        "17" = "f5e0dc";
+
+        "selection-foreground" = "cdd6f4";
+        "selection-background" = "414356";
+
+        "search-box-no-match" = "11111b f38ba8";
+        "search-box-match" = "cdd6f4 313244";
+
+        "jump-labels" = "11111b fab387";
+        urls = "89b4fa";
+      };
+    };
+  };
+}

home/base/gui/terminal/kitty.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+###########################################################
+#
+# Kitty Configuration
+#
+# Useful Hot Keys for Linux(replace `ctrl + shift` with `cmd` on macOS)):
+#   1. Increase Font Size: `ctrl + shift + =` | `ctrl + shift + +`
+#   2. Decrease Font Size: `ctrl + shift + -` | `ctrl + shift + _`
+#   3. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
+#
+###########################################################
+{
+  programs.kitty = {
+    enable = true;
+    # kitty has catppuccin theme built-in,
+    # all the built-in themes are packaged into an extra package named `kitty-themes`
+    # and it's installed by home-manager if `theme` is specified.
+    themeFile = "Catppuccin-Mocha";
+    font = {
+      name = "JetBrainsMono Nerd Font";
+      # use different font size on macOS
+      size =
+        if pkgs.stdenv.isDarwin
+        then 14
+        else 13;
+    };
+
+    # consistent with other terminal emulators
+    keybindings = {
+      "ctrl+shift+m" = "toggle_maximized";
+      "ctrl+shift+f" = "show_scrollback"; # search in the current window
+    };
+
+    settings = {
+      background_opacity = "0.93";
+      macos_option_as_alt = true; # Option key acts as Alt on macOS
+      enable_audio_bell = false;
+      tab_bar_edge = "top"; # tab bar on top
+      #  To resolve issues:
+      #    1. https://github.com/ryan4yin/nix-config/issues/26
+      #    2. https://github.com/ryan4yin/nix-config/issues/8
+      #  Spawn a nushell in login mode via `bash`
+      shell = "${pkgs.bash}/bin/bash --login -c 'nu --login --interactive'";
+    };
+
+    # macOS specific settings
+    darwinLaunchOptions = ["--start-as=maximized"];
+  };
+}

home/base/home.nix

@@ -1,20 +1,8 @@
-{ config, pkgs, ... }:
+{myvars, ...}: {
-
-{
-
-  imports = [
-    ./fcitx5
-    ./i3
-    ./programs
-    ./rofi
-    ./shell
-  ];
-
   # Home Manager needs a bit of information about you and the
   # paths it should manage.
   home = {
-    username = "ryan";
+    inherit (myvars) username;
-    homeDirectory = "/home/ryan";
 
     # This value determines the Home Manager release that your
     # configuration is compatible with. This helps avoid breakage
@@ -24,7 +12,7 @@
     # You can update Home Manager without changing this value. See
     # the Home Manager release notes for a list of state version
     # changes in each release.
-    stateVersion = "22.11";
+    stateVersion = "24.05";
   };
 
   # Let Home Manager install and manage itself.

home/base/tui/cloud/default.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  home.packages = with pkgs; [
+    # infrastructure as code
+    # pulumi
+    # pulumictl
+    # tf2pulumi
+    # crd2pulumi
+    # pulumiPackages.pulumi-random
+    # pulumiPackages.pulumi-command
+    # pulumiPackages.pulumi-aws-native
+    # pulumiPackages.pulumi-language-go
+    # pulumiPackages.pulumi-language-python
+    # pulumiPackages.pulumi-language-nodejs
+
+    # aws
+    awscli2
+    ssm-session-manager-plugin # Amazon SSM Session Manager Plugin
+    aws-iam-authenticator
+    eksctl
+
+    # aliyun
+    aliyun-cli
+    # digitalocean
+    doctl
+    # google cloud
+    google-cloud-sdk
+
+    # cloud tools that nix do not have cache for.
+    terraform
+    terraformer # generate terraform configs from existing cloud resources
+    packer # machine image builder
+  ];
+}

home/base/tui/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/tui/dev-tools.nix

@@ -0,0 +1,62 @@
+{
+  pkgs,
+  pkgs-unstable,
+  ...
+}: {
+  #############################################################
+  #
+  #  Basic settings for development environment
+  #
+  #  Please avoid to install language specific packages here(globally),
+  #  instead, install them:
+  #     1. per IDE, such as `programs.neovim.extraPackages`
+  #     2. per-project, using https://github.com/the-nix-way/dev-templates
+  #
+  #############################################################
+
+  home.packages = with pkgs; [
+    colmena # nixos's remote deployment tool
+
+    # db related
+    pkgs-unstable.mycli
+    pkgs-unstable.pgcli
+    mongosh
+    sqlite
+
+    # embedded development
+    minicom
+
+    # ai related
+    pkgs-unstable.python312Packages.huggingface-hub # huggingface-cli
+
+    # misc
+    pkgs-unstable.devbox
+    bfg-repo-cleaner # remove large files from git history
+    k6 # load testing tool
+    protobuf # protocol buffer compiler
+
+    # solve coding extercises - learn by doing
+    exercism
+
+    # Automatically trims your branches whose tracking remote refs are merged or gone
+    # It's really useful when you work on a project for a long time.
+    git-trim
+    gitleaks
+
+    # need to run `conda-install` before using it
+    # need to run `conda-shell` before using command `conda`
+    # conda is not available for MacOS
+    conda
+  ];
+
+  programs = {
+    direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+
+      enableZshIntegration = true;
+      enableBashIntegration = true;
+      enableNushellIntegration = true;
+    };
+  };
+}

home/base/tui/editors/Glossary.md

@@ -0,0 +1,75 @@
+# Editors Glossary
+
+### LSP - Language Server Protocol
+
+> https://en.wikipedia.org/wiki/Language_Server_Protocol
+
+> https://langserver.org/
+
+The Language Server Protocol (LSP) is an open, JSON-RPC-based protocol for use between source code
+editors or integrated development environments (IDEs) and servers that provide programming
+language-specific features like:
+
+- motions such as go-to-definition, find-references, hover.
+- **code completion**
+- **marking of warnings and errors**
+- **refactoring routines**
+- syntax highlighting (use Tree-sitter instead)
+- code formatting (use a dedicated formatter instead)
+
+The goal of the protocol is to allow programming language support to be implemented and distributed
+independently of any given editor or IDE.
+
+LSP was originally developed for Microsoft Visual Studio Code and is now an open standard. In the
+early 2020s LSP quickly became a "norm" for language intelligence tools providers.
+
+### Tree-sitter
+
+> https://tree-sitter.github.io/tree-sitter/
+
+> https://www.reddit.com/r/neovim/comments/1109wgr/treesitter_vs_lsp_differences_ans_overlap/
+
+Tree-sitter is a parser generator tool and an **incremental parsing** library. It can build a
+concrete syntax tree for a source file and efficiently update the syntax tree as the source file is
+edited.
+
+It is used by many editors and IDEs to provide:
+
+- **syntax highlighting**
+- **indentation**
+- **creating foldable code regions**
+- **Incremental selection**
+- **simple refactoring in a single file**
+  - such as join/split lines, structural editing, cursor motion, etc.
+
+**Treesitter process each file independently**, and it is not aware of the semantics of your code.
+For example, it does not know does a function/variable really exist, or what is the type/return-type
+of a variable. This is where LSP comes in.
+
+The LSP server parses the code much more deeply and it **not only parses a single file but your
+whole project**. So, the LSP server will know whether a function/variable does exist with the same
+type/return-type. If it does not, it will mark it as an error.
+
+**LSP does understand the code semantically, while Treesitter only cares about correct syntax**.
+
+#### LSP vs Tree-sitter
+
+- Tree-sitter: lightweight, fast, but limited knowledge of your code. mainly used for **syntax
+  highlighting, indentation, and folding/refactoring in a single file**.
+- LSP: heavy and slow on large projects, but it has a deep understanding of your code. mainly used
+  for **code completion, refactoring in the projects, errors/warnings, and other semantic-aware
+  features**.
+
+### Formatter vs Linter
+
+Linting is distinct from Formatting because:
+
+1. **formatting** only restructures how code appears.
+   1. `prettier` is a popular formatter.
+1. **linting** analyzes how the code runs and detects errors, it may also suggest improvements such
+   as replace `var` with `let` or `const`.
+
+Formatters and Linters process each file independently, they do not need to know about other files
+in the project.
+
+- [ ]

home/base/tui/editors/README.md

@@ -0,0 +1,215 @@
+# Editors
+
+My editors:
+
+1. Neovim
+2. Emacs
+3. Helix
+
+And `Zellij` for a smooth and stable terminal experience.
+
+## Tips
+
+1. Many useful keys are already provided by vim, check vim/neovim's docs before you install a new
+   plugin / reinvent the wheel.
+1. After using Emacs/Neovim more skillfully, I strongly recommend that you read the official
+   documentation of Neovim/vim:
+   1. <https://vimhelp.org/>: The official vim documentation.
+   1. <https://neovim.io/doc/user/>: Neovim's official user documentation.
+1. Use Zellij for terminal related operations, and use Neovim/Helix for editing.
+1. As for Emacs, Use its GUI version & terminal emulator `vterm` for terminal related operations.
+1. Two powerful file search & jump tools:
+1. Tree-view plugins are beginner-friendly and intuitive, but they're not very efficient.
+1. **Search by the file path**: Useful when you're familiar with the project structure, especially
+   on a large project.
+1. **Search by the content**: Useful when you're familiar with the code.
+
+## Tutorial
+
+Type `:tutor`(`:Tutor` in Neovim) to learn the basics usage of vim/neovim.
+
+## VIM's Cheetsheet
+
+> Here only record my commonly used keys, to see **a more comprehensive cheetsheet**:
+> <https://vimhelp.org/quickref.txt.html>
+
+Both Emacs-Evil & Neovim are compatible with vim, sothe key-bindings described here are common in
+both Emacs-Evil, Neovim & vim.
+
+### Terminal Related
+
+I mainly use Zellij for terminal related operations, here is its terminal shortcuts I use frequently
+now:
+
+| Action                    | Zellij's Shortcut |
+| ------------------------- | ----------------- |
+| Floating Terminal         | `Ctrl + p + w`    |
+| Horizontal Split Terminal | `Ctrl + p + d`    |
+| Vertical Split Terminal   | `Ctrl + p + n`    |
+| Execute a command         | `!xxx`            |
+
+### File Management
+
+> <https://neovim.io/doc/user/usr_22.html>
+
+> <https://vimhelp.org/editing.txt.html>
+
+| Action                              |                                                  |
+| ----------------------------------- | ------------------------------------------------ |
+| Save selected text to a file        | `:w filename` (Will show `:'<,'>w filename`)     |
+| Save and close the current buffer   | `:wq`                                            |
+| Save all buffers                    | `:wa`                                            |
+| Save and close all buffers          | `:wqa`                                           |
+| Edit a file                         | `:e filename`(or `:e <TAB>` to show a file list) |
+| Browse the file list                | `:Ex` or `:e .`                                  |
+| Discard changes and reread the file | `:e!`                                            |
+
+### Motion
+
+> https://vimhelp.org/motion.txt.html
+
+| Action                                              | Command                                            |
+| --------------------------------------------------- | -------------------------------------------------- |
+| Move to the start/end of the buffer                 | `gg`/`G`                                           |
+| Move the line number 5                              | `5gg` / `5G`                                       |
+| Move left/down/up/right                             | h/j/k/l or `5h`/`5j`/`5k`/`5l` or `Ctr-n`/`Ctrl-p` |
+| Move to the matchpairs, default to `()`, `{}`, `[]` | `%`                                                |
+| Move to the start/end of the line                   | `0` / `$`                                          |
+| Move a sentence forward/backward                    | `(` / `)`                                          |
+| Move a paragraph forward/backward                   | `{` / `}`                                          |
+| Move a section forward/backward                     | `[[` / `]]`                                        |
+| Jump to various positions                           | `'` + some other keys(neovim has prompt)           |
+
+Text Objects:
+
+- **sentence**: text ending at a '.', '!' or '?' followed by either the end of a line, or by a space
+  or tab.
+- **paragraph**: text ending at a blank line.
+- **section**: text starting with a section header and ending at the start of the next section
+  header (or at the end of the file). - The "`]]`" and "`[[`" commands stop at the '`{`' in the
+  first column. This is useful to find the start of a function in a C/Go/Java/... program.
+
+### Text Manipulation
+
+Basics:
+
+| Action                                  |                            |
+| --------------------------------------- | -------------------------- |
+| Delete the current character            | `x`                        |
+| Paste the copied text                   | `p`                        |
+| Delete the selection                    | `d`                        |
+| Undo the last word                      | `CTRL-w`(in insert mode)   |
+| Undo the last line                      | `CTRL-u`(in insert mode)   |
+| Undo the last change                    | `u`                        |
+| Redo the last change                    | `Ctrl + r`                 |
+| Inserts the text of the previous insert | `Ctrl + a`                 |
+| Repeat the last command                 | `.`                        |
+| Toggle text's case                      | `~`                        |
+| Convert to uppercase                    | `U` (visual mode)          |
+| Convert to lowercase                    | `u` (visual mode)          |
+| Align the selected content              | `:center`/`:left`/`:right` |
+
+Misc:
+
+| Action                        | Shortcut                                 |
+| ----------------------------- | ---------------------------------------- |
+| Toggle visual mode            | `v` (lower case v)                       |
+| Select the current line       | `V` (upper case v)                       |
+| Toggle visual block mode      | `<Ctrl> + v` (select a block vertically) |
+| Fold the current code block   | `zc`                                     |
+| Unfold the current code block | `zo`                                     |
+| Jump to Definition            | `gd`                                     |
+| Jump to References            | `gD`                                     |
+| (Un)Comment the current line  | `gcc`                                    |
+
+| Action                                                                    |                |
+| ------------------------------------------------------------------------- | -------------- |
+| Sort the selected lines                                                   | `:sort`        |
+| Join Selection of Lines With Space                                        | `:join` or `J` |
+| Join without spaces                                                       | `:join!`       |
+| Enter Insert mode at the start/end of the line                            | `I` / `A`      |
+| Delete from the cursor to the end of the line                             | `D`            |
+| Delete from the cursor to the end of the line, and then enter insert mode | `C`            |
+
+Advance Techs:
+
+- Add at the end of multiple lines: `:normal A<text>`
+
+  - Execublock: `:A<text>`
+  - visual block mode(ctrl + v)
+  - Append text at the end of each line in the selected block
+  - If position exceeds line end, neovim adds spaces automatically
+
+- Delete the last char of multivle lines: `:normal $x`
+
+  - Execute `$x` on each line
+  - visual mode(v)
+  - `$` moves cursor to the end of line
+  - `x` deletes the character under the cursor
+
+- Delete the last word of multiple lines: `:normal $bD`
+  - Execute `$bD` on each line
+  - visual mode(v)
+  - `$` moves cursor to the end of line
+  - `b` moves cursor to the beginning of the last word
+
+### Search
+
+| Action                                                | Command   |
+| ----------------------------------------------------- | --------- |
+| Search forward/backword for a pattern                 | `/` / `?` |
+| Repeat the last search in the same/opposite direction | `n` / `N` |
+
+### Find and Replace
+
+| Action                           | Command                             |
+| -------------------------------- | ----------------------------------- |
+| Replace in selected area         | `:s/old/new/g`                      |
+| Replace in current line          | Same as above                       |
+| Replace all the lines            | `:% s/old/new/g`                    |
+| Replace all the lines with regex | `:% s@\vhttp://(\w+)@https://\1@gc` |
+
+1. `\v` means means that in the regex pattern after it can be used without backslash
+   escaping(similar to python's raw string).
+2. `\1` means the first matched group in the pattern.
+
+### Replace in the specific lines
+
+| Action                                    | Command                                |
+| ----------------------------------------- | -------------------------------------- |
+| From the 10th line to the end of the file | `:10,$ s/old/new/g` or `:10,$ s@^@#@g` |
+| From the 10th line to the 20th line       | `:10,20 s/old/new/g`                   |
+| Remove the trailing spaces                | `:% s/\s\+$//g`                        |
+
+The postfix(flags) in the above commands:
+
+1. `g` means replace all the matched strings in the current line/file.
+2. `c` means ask for confirmation before replacing.
+3. `i` means ignore case.
+
+### Buffers, Windows and Tabs
+
+> <https://neovim.io/doc/user/usr_08.html>
+
+> <https://vimhelp.org/windows.txt.html>
+
+- A buffer is the in-memory text of a file.
+- A window is a viewport on a buffer.
+- A tab page is a collection of windows.
+
+| Action                              | Command                             |
+| ----------------------------------- | ----------------------------------- |
+| Split the window horizontally       | `:sp[lit]` or `:sp filename`        |
+| Split the window horizontally       | `:vs[plit]` or `:vs filename`       |
+| Switch to the next/previous window  | `Ctrl-w + w` or `Ctrl-w + h/j/k/l`  |
+| Show all buffers                    | `:ls`                               |
+| show next/previous buffer           | `]b`/`[b` or `:bn[ext]` / `bp[rev]` |
+| New Tab(New Workspace in DoomEmacs) | `:tabnew`                           |
+| Next/Previews Tab                   | `gt`/`gy`                           |
+
+### History
+
+| Action                   | Command |
+| ------------------------ | ------- |
+| Show the command history | `q:`    |
+| Show the search history  | `q/`    |

home/base/tui/editors/Structured-Editing.md

@@ -0,0 +1,25 @@
+# Structured Editing
+
+## S-expression data(Lisp)
+
+- paredit/[lispy](https://github.com/doomemacs/doomemacs/tree/master/modules/editor/lispy): too
+  complex.
+- [evil-cleverparens](https://github.com/emacs-evil/evil-cleverparens): simple and useful.
+- [parinfer(par-in-fer)](https://shaunlebron.github.io/parinfer/): modern, simple, elegant and
+  useful, but works not well with some other completion plugins...
+  - to make parinfer works, you should disable sexp & smartparens in any lisp mode.
+
+Some plugins:
+
+- Emacs
+  - [parinfer-rusT-mode](https://github.com/justinbarclay/parinfer-rust-mode)
+- Neovim
+  - [parinfer-rust](https://github.com/eraserhd/parinfer-rust)
+  - <https://github.com/Olical/conjure>
+- Helix
+  - [parinfer #4090 - Helix](https://github.com/helix-editor/helix/discussions/4090)
+
+## Other Languages
+
+1. treesitter
+1. ...

home/base/tui/editors/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/tui/editors/emacs/README.md

@@ -0,0 +1,230 @@
+# Emacs Editor
+
+## Why emacs?
+
+1. Explore the unknown, just for fun!
+2. Org Mode
+3. Lisp Coding
+4. A top-level tutorial for Emacs(Chinese): <https://nyk.ma/tags/emacs/>
+5. A Beginner's Guide to Emacs(Chinese):
+   <https://github.com/emacs-tw/emacs-101-beginner-survival-guide>
+
+## Screenshot
+
+![](/_img/emacs-2024-01-07.webp)
+
+## Useful Links
+
+- Framework: <https://github.com/doomemacs/doomemacs>
+  - key bindings:
+    - source code:
+      <https://github.com/doomemacs/doomemacs/blob/master/modules/config/default/%2Bevil-bindings.el>
+    - docs: <https://github.com/doomemacs/doomemacs/blob/master/modules/editor/evil/README.org>
+  - module index: <https://github.com/doomemacs/doomemacs/blob/master/docs/modules.org>
+- LSP Client: <https://github.com/manateelazycat/lsp-bridge>
+- Emacs Wiki: <https://www.emacswiki.org/emacs/SiteMap>
+- Awesome Emacs: <https://github.com/emacs-tw/awesome-emacs#lsp-client>
+- Chinese(rime) support: <https://github.com/DogLooksGood/emacs-rime>
+- modal editing:
+  - <https://github.com/emacs-evil/evil>: evil mode, enabled by default in doom-emacs.
+  - <https://github.com/meow-edit/meow>
+
+## Install or Update
+
+After deploying this nix flake, run the following command to install or update emacs:
+
+```bash
+doom sync
+```
+
+when in doubt, run `doom sync`!
+
+## Testing
+
+> via `Justfile` located at the root of this repo.
+
+```bash
+# testing
+just emacs-test
+just emacs-purge
+just emacs-reload
+
+# clear test data
+just emacs-clean
+```
+
+## Limits
+
+- It's too slow to start up and install(compile/build) packages.
+  - I have to use emacs in daemon/client mode to avoid this issue.
+- It's too large in size, not suitable for servers.
+  - So vim/neovim is still the best choice for servers.
+- Emacs's markdown-mode works not well with tables, see:
+  - https://github.com/jrblevin/markdown-mode/issues/380
+- I use git command frequently, but doomemacs only autoupdates status of git diff / treemacs when
+  using magit.
+  - I have to learn magit to avoid this issue...
+- GitHub's orgmode support is not well, Markdown is better for GitHub.
+  - Use markdown for repo's README.md, and use orgmode for my personal notes and docs only.
+
+## Cheetsheet
+
+Here is the cheetsheet related to my DoomEmacs configs. Please read vim's common cheetsheet at
+[../README.md](../README.md) before reading the following.
+
+### Basics
+
+> Terminal(vterm) is useful in GUI mode, I use Zellij instead in terminal mode.
+
+| Action                 | Shortcut                                          |
+| ---------------------- | ------------------------------------------------- |
+| Popup Terminal(vterm)  | `SPC + o + t`                                     |
+| Open Terminal          | `SPC + o + T`                                     |
+| Open file tree sidebar | `SPC + o + p`                                     |
+| Frame fullscreen       | `SPC + t + F`                                     |
+| Exit                   | `M-x C-c`                                         |
+| Execute Command        | `M-x`(hold on `Alt`/`option`, and then press `x`) |
+| Eval Lisp Code         | `M-:`(hold on `Alt`/`option`, and then press `:`) |
+
+### Window Navigation
+
+| Action                                     | Shortcut                                                              |
+| ------------------------------------------ | --------------------------------------------------------------------- |
+| Split a window vertically and horizontally | `SPC w v/s`                                                           |
+| Move to a window in a specific direction   | `Ctrl-w + h/j/k/l`                                                    |
+| Move a window to a specific direction      | `Ctrl-w + H/J/K/L`                                                    |
+| Move to the next window                    | `SPC w w`                                                             |
+| Close the current window                   | `SPC w q`                                                             |
+| Rebalance all windows                      | `SPC w =`                                                             |
+| Set window's width(columns)                | `80 SPC w \|` (the Vertical line is escaped due to markdown's limits) |
+| Set window's height                        | `30 SPC w _ `                                                         |
+
+### File Tree
+
+- treemacs: <https://github.com/Alexander-Miller/treemacs/blob/master/src/elisp/treemacs-mode.el>
+- treemacs-evil:
+  <https://github.com/Alexander-Miller/treemacs/blob/master/src/extra/treemacs-evil.el>
+
+| Action                                | Shortcut  |
+| ------------------------------------- | --------- |
+| Resize Treemacs's window              | `>` & `<` |
+| Extra Wide Window                     | `W`       |
+| Rename                                | `R`       |
+| Delete File/Direcoty                  | `d`       |
+| New File                              | `cf`      |
+| New Directory                         | `cd`      |
+| Go to parent                          | `u`       |
+| Run shell command in for current node | `!`       |
+| Refresh file tree                     | `gr`      |
+| Copy project-path into pasteboard     | `yp`      |
+| Copy absolute-path into pasteboard    | `ya`      |
+| Copy relative-path into pasteboard    | `yr`      |
+| Copy file to another location         | `yf`      |
+| Move file to another location         | `m`       |
+| quit                                  | `q`       |
+
+And bookmarks:
+
+- Add bookmarks in treemacs: `b`
+- Show Bookmark List: `SPC s m`
+
+### Splitting and Buffers
+
+| Action                  | Shortcut          |
+| ----------------------- | ----------------- |
+| Buffer List             | `<Space> + ,`     |
+| Save all buffers(Tab)   | `<Space> + b + S` |
+| Kill the current buffer | `<Space> + b + k` |
+| Kill all buffers        | `<Space> + b + K` |
+
+### Editing and Formatting
+
+| Action                                     | Shortcut            |
+| ------------------------------------------ | ------------------- |
+| Format Document                            | `<Space> + cf`      |
+| Code Actions                               | `<Space> + ca`      |
+| Rename                                     | `<Space> + cr`      |
+| Opening LSP symbols                        | `<Space> + cS`      |
+| Show all LSP Errors                        | `<Space> + c + x/X` |
+| Show infinite undo history(really useful!) | `<Space> + s + u`   |
+| Open filepath/URL at cursor                | `gf`                |
+| Find files by keyword in path              | `<Space> + <Space>` |
+| Grep string in files (vertico + ripgrep)   | `<Space> + sd`      |
+
+### Image Preview(GUI mode only)
+
+Use `-`, `+` to resize the image, `r` to rotate the image.
+
+### Search & replace
+
+```bash
+SPC s p foo C-; E C-c C-p :%s/foo/bar/g RET Z Z
+```
+
+1. `SPC s p`: search in project
+1. `foo`: the keyword to search
+1. `C-; E`: exports what you’re looking at into a new buffer in grep-mode
+1. `C-c C-p` to run wgrep-change-to-wgrep-mode to make the search results writable.
+1. `:%s/foo/bar/g RET`: replace in the current buffer(just like neovim/vim)
+1. `Z Z`: to write all the changes to their respective files
+
+### Projects
+
+> easily switch between projects without exit emacs!
+
+| Action                     | Shortcut      |
+| -------------------------- | ------------- |
+| Switch between projects    | `SPC + p + p` |
+| Browse the current project | `SPC + p + .` |
+| Add new project            | `SPC + p + a` |
+
+### Workspaces
+
+> Very useful when run emacs in daemon/client modes
+
+| Action                      | Shortcut                    |
+| --------------------------- | --------------------------- |
+| Switch between workspaces   | `M-1/2/3/...`(Alt-1/2/3/..) |
+| New Workspace               | `SPC + TAB + n`             |
+| New Named Workspace         | `SPC + TAB + N`             |
+| Delete Workspace            | `SPC + TAB + d`             |
+| Display Workspaces bar blow | `SPC + TAB + TAB`           |
+
+### Magit
+
+> https://github.com/magit/magit
+
+Magit is a powerful tool that make git operations easy and intuitive.
+
+| Action                   | Shortcut                 |
+| ------------------------ | ------------------------ |
+| Open Magit               | `C-x g` or `SPC + g + g` |
+| Switch branch            | `SPC + g + b`            |
+| Show buffer's commit log | `SPC + g + L`            |
+
+Shortcuts in magit's pane:
+
+> When run `git commit` / `git add` / `git push` /... via magit, multiple Arguments can be set. Set
+> arguments won't trigger a git command immediately. Magit will try to run a git command only after
+> an Action key is pressed.
+
+| Action                                             | Shortcut                                      |
+| -------------------------------------------------- | --------------------------------------------- |
+| Quit the current Magit pane                        | `q`                                           |
+| Show log                                           | `l`                                           |
+| Show current branch's log                          | `l + l`                                       |
+| Show current reflog                                | `l + r`                                       |
+| Commit                                             | `c`                                           |
+| Stage                                              | `s`                                           |
+| Unstage                                            | `u`                                           |
+| Push                                               | `p`                                           |
+| Pull                                               | `f`                                           |
+| Rebase                                             | `r`                                           |
+| Rebase Interactively                               | `r + i`, select on a commit, then `C-c + C-c` |
+| Stash                                              | `z`                                           |
+| Merge                                              | `m`                                           |
+| Fold/Unfold                                        | `TAB`                                         |
+| Show details of the current unit(commit/stage/...) | `<ENTER>`                                     |
+
+KeyBinding full list:
+<https://github.com/emacs-evil/evil-collection/tree/master/modes/magit#key-bindings>

home/base/tui/editors/emacs/default.nix

@@ -0,0 +1,132 @@
+# ==============================================
+# Based on doomemacs's author's config:
+#   https://github.com/hlissner/dotfiles/blob/master/modules/editors/emacs.nix
+#
+# Emacs Tutorials:
+#  1. Official: <https://www.gnu.org/software/emacs/tour/index.html>
+#  2. Doom Emacs: <https://github.com/doomemacs/doomemacs/blob/master/docs/index.org>
+#
+{
+  config,
+  lib,
+  pkgs,
+  doomemacs,
+  ...
+}:
+with lib; let
+  cfg = config.modules.editors.emacs;
+  envExtra = lib.mkAfter ''
+    export PATH="${config.xdg.configHome}/emacs/bin:$PATH"
+  '';
+  shellAliases = {
+    e = "emacsclient --create-frame"; # gui
+    et = "emacsclient --create-frame --tty"; # terminal
+  };
+  librime-dir = "${config.xdg.dataHome}/emacs/librime";
+  parinfer-rust-lib-dir = "${config.xdg.dataHome}/emacs/parinfer-rust";
+  myEmacsPackagesFor = emacs: ((pkgs.emacsPackagesFor emacs).emacsWithPackages (epkgs: [
+    epkgs.vterm
+  ]));
+in {
+  options.modules.editors.emacs = {
+    enable = mkEnableOption "Emacs Editor";
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      home.packages = with pkgs; [
+        ## Doom dependencies
+        git
+        (ripgrep.override {withPCRE2 = true;})
+        gnutls # for TLS connectivity
+
+        ## Optional dependencies
+        fd # faster projectile indexing
+        imagemagick # for image-dired
+        fd # faster projectile indexing
+        zstd # for undo-fu-session/undo-tree compression
+
+        # go-mode
+        # gocode # project archived, use gopls instead
+
+        ## Module dependencies
+        # :checkers spell
+        (aspellWithDicts (ds: with ds; [en en-computers en-science]))
+        # :tools editorconfig
+        editorconfig-core-c # per-project style config
+        # :tools lookup & :lang org +roam
+        sqlite
+        # :lang latex & :lang org (latex previews)
+        # texlive.combined.scheme-medium
+      ];
+
+      programs.bash.bashrcExtra = envExtra;
+      programs.zsh.envExtra = envExtra;
+      home.shellAliases = shellAliases;
+      programs.nushell.shellAliases = shellAliases;
+
+      xdg.configFile."doom" = {
+        source = ./doom;
+        force = true;
+      };
+
+      home.activation.installDoomEmacs = lib.hm.dag.entryAfter ["writeBoundary"] ''
+        ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F744 ${doomemacs}/ ${config.xdg.configHome}/emacs/
+
+        # librime for emacs-rime
+        mkdir -p ${librime-dir}
+        ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F744 ${pkgs.librime}/ ${librime-dir}/
+
+        # libparinfer_rust for emacs' parinfer-rust-mode
+        mkdir -p ${parinfer-rust-lib-dir}
+        ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F744  ${pkgs.vimPlugins.parinfer-rust}/lib/libparinfer_rust.* ${parinfer-rust-lib-dir}/parinfer-rust.so
+      '';
+    }
+
+    (mkIf pkgs.stdenv.isLinux (
+      let
+        # Do not use emacs-nox here, which makes the mouse wheel work abnormally in terminal mode.
+        # pgtk (pure gtk) build add native support for wayland.
+        # https://www.gnu.org/savannah-checkouts/gnu/emacs/emacs.html#Releases
+        emacsPkg = myEmacsPackagesFor pkgs.emacs29-pgtk;
+      in {
+        home.packages = [emacsPkg];
+        services.emacs = {
+          enable = true;
+          package = emacsPkg;
+          client = {
+            enable = true;
+            arguments = [" --create-frame"];
+          };
+          startWithUserSession = true;
+        };
+      }
+    ))
+
+    (mkIf pkgs.stdenv.isDarwin (
+      let
+        # macport adds some native features based on GNU Emacs 29
+        # https://bitbucket.org/mituharu/emacs-mac/src/master/README-mac
+        emacsPkg = myEmacsPackagesFor pkgs.emacs29;
+      in {
+        home.packages = [emacsPkg];
+        launchd.enable = true;
+        launchd.agents.emacs = {
+          enable = true;
+          config = {
+            ProgramArguments = [
+              "${pkgs.bash}/bin/bash"
+              "-l"
+              "-c"
+              "${emacsPkg}/bin/emacs --fg-daemon"
+            ];
+            StandardErrorPath = "${config.home.homeDirectory}/Library/Logs/emacs-daemon.stderr.log";
+            StandardOutPath = "${config.home.homeDirectory}/Library/Logs/emacs-daemon.stdout.log";
+            RunAtLoad = true;
+            KeepAlive = true;
+          };
+        };
+      }
+    ))
+  ]);
+}

home/base/tui/editors/emacs/doom/config.el

@@ -0,0 +1,175 @@
+;;; $DOOMDIR/config.el -*- lexical-binding: t; -*-
+
+;; Place your private configuration here! Remember, you do not need to run 'doom
+;; sync' after modifying this file!
+
+
+;; Some functionality uses this to identify you, e.g. GPG configuration, email
+;; clients, file templates and snippets. It is optional.
+;; (setq user-full-name "John Doe"
+;;       user-mail-address "john@doe.com")
+
+;; Doom exposes five (optional) variables for controlling fonts in Doom:
+;;
+;; - `doom-font' -- the primary font to use
+;; - `doom-variable-pitch-font' -- a non-monospace font (where applicable)
+;; - `doom-big-font' -- used for `doom-big-font-mode'; use this for
+;;   presentations or streaming.
+;; - `doom-symbol-font' -- for symbols
+;; - `doom-serif-font' -- for the `fixed-pitch-serif' face
+;;
+;; See 'C-h v doom-font' for documentation and more examples of what they
+;; accept. For example:
+;;
+(setq doom-font (font-spec :family "JetBrainsMono Nerd Font" :size 18)
+      doom-variable-pitch-font (font-spec :family "DejaVu Sans")
+      doom-symbol-font (font-spec :family "Symbols Nerd Font Mono")
+      doom-big-font (font-spec :family "JetBrainsMono Nerd Font" :size 28))
+
+;; Users should inject their own font logic in `after-setting-font-hook'
+;; Add font for CJK charset
+(defun init-cjk-fonts()
+  (dolist (charset '(kana han cjk-misc bopomofo))
+    (set-fontset-font (frame-parameter nil 'font)
+                      charset (font-spec :family "Source Han Sans SC"))))
+(add-hook 'after-setting-font-hook 'init-cjk-fonts)
+
+
+;; If you or Emacs can't find your font, use 'M-x describe-font' to look them
+;; up, `M-x eval-region' to execute elisp code, and 'M-x doom/reload-font' to
+;; refresh your font settings. If Emacs still can't find your font, it likely
+;; wasn't installed correctly. Font issues are rarely Doom issues!
+
+;; There are two ways to load a theme. Both assume the theme is installed and
+;; available. You can either set `doom-theme' or manually load a theme with the
+;; `load-theme' function. This is the default:
+;; other doom's official themes:
+;;   https://github.com/doomemacs/themes
+(setq doom-theme 'doom-dracula) ;; doom-one doom-dracula doom-nord
+(if (eq system-type 'darwin)
+    ;; Transparent Backgroud - for macOS
+    ;;(set-frame-parameter (selected-frame) 'alpha '(<active> . <inactive>))
+    ;;(set-frame-parameter (selected-frame) 'alpha <both>)
+    (progn
+      (set-frame-parameter (selected-frame) 'alpha '(85 . 70))
+      (add-to-list 'default-frame-alist '(alpha . (85 . 70))))
+  ;; Transparent Background - for Linux Xorg/Wayland
+  (set-frame-parameter nil 'alpha-background 93) ; For current frame
+  (add-to-list 'default-frame-alist '(alpha-background . 93))); For all new frames henceforth
+
+;; This determines the style of line numbers in effect. If set to `nil', line
+;; numbers are disabled. For relative line numbers, set this to `relative'.
+(setq display-line-numbers-type t)
+(setq warning-minimum-level :error)
+;; If you use `org' and don't want your org files in the default location below,
+;; change `org-directory'. It must be set before org loads!
+(setq org-directory "~/org/")
+;; Whenever you reconfigure a package, make sure to wrap your config in an
+;; `after!' block, otherwise Doom's defaults may override your settings. E.g.
+;;
+;;   (after! PACKAGE
+;;     (setq x y))
+;;
+;; The exceptions to this rule:
+;;
+;;   - Setting file/directory variables (like `org-directory')
+;;   - Setting variables which explicitly tell you to set them before their
+;;     package is loaded (see 'C-h v VARIABLE' to look up their documentation).
+;;   - Setting doom variables (which start with 'doom-' or '+').
+;;
+;; Here are some additional functions/macros that will help you configure Doom.
+;;
+;; - `load!' for loading external *.el files relative to this one
+;; - `use-package!' for configuring packages
+;; - `after!' for running code after a package has loaded
+;; - `add-load-path!' for adding directories to the `load-path', relative to
+;;   this file. Emacs searches the `load-path' when you load packages with
+;;   `require' or `use-package'.
+;; - `map!' for binding new keys
+;;
+;; To get information about any of these functions/macros, move the cursor over
+;; the highlighted symbol at press 'K' (non-evil users must press 'C-c c k').
+;; This will open documentation for it, including demos of how they are used.
+;; Alternatively, use `C-h o' to look up a symbol (functions, variables, faces,
+;; etc).
+;;
+;; You can also try 'gd' (or 'C-c c d') to jump to their definition and see how
+;; they are implemented.
+
+;; use alejandra to format nix files
+(use-package! lsp-nix
+  :ensure lsp-mode
+  :after
+  (lsp-mode)
+  :demand t
+  :custom
+  (lsp-nix-nil-formatter
+   ["alejandra"]))
+
+(use-package! nushell-mode
+  :config
+  (setq nushell-enable-auto-indent 1))
+(after! vterm
+  (setq vterm-shell "nu")) ; use nushell by defualt
+
+;; emacs-rime
+(use-package! rime
+  :custom
+  (default-input-method "rime")
+  (rime-librime-root "~/.local/share/emacs/librime"))
+
+;; use parinfer for lisp editing
+(use-package! parinfer-rust-mode
+  :hook ((emacs-lisp-mode
+          clojure-mode
+          scheme-mode
+          lisp-mode
+          racket-mode
+          fennel-mode
+          hy-mode) . parinfer-rust-mode)
+  :init
+  ;; parinfer-rust library do not provide a apple silicon binary.
+  ;; fix: https://github.com/doomemacs/doomemacs/issues/6163
+  (setq parinfer-rust-auto-download 0)
+  ;; we need to download it manually and put it in this path
+  (setq parinfer-rust-library "~/.local/share/emacs/parinfer-rust/parinfer-rust.so")
+  :config
+  (map! :map parinfer-rust-mode-map
+        :localleader
+        "p" #'parinfer-rust-switch-mode
+        "P" #'parinfer-rust-toggle-disable))
+
+;; disable smatparens-mode here to void conflict with parinfer
+;; https://discourse.doomemacs.org/t/disable-smartparens-or-parenthesis-completion/134
+(add-hook 'clojure-mode-hook        #'turn-off-smartparens-mode)
+(add-hook 'scheme-mode-hook         #'turn-off-smartparens-mode)
+(add-hook 'lisp-mode-hook           #'turn-off-smartparens-mode)
+(add-hook 'racket-mode-hook         #'turn-off-smartparens-mode)
+(add-hook 'fennel-mode-hook         #'turn-off-smartparens-mode)
+(add-hook 'hy-mode-hook             #'turn-off-smartparens-mode)
+
+;; auto-save
+(use-package super-save
+  :ensure t
+  :config
+  (super-save-mode +1)
+  (setq super-save-auto-save-when-idle t)
+  (setq auto-save-default nil))
+
+;; save on find-file
+(add-to-list 'super-save-hook-triggers 'find-file-hook)
+
+(use-package! copilot
+  :hook
+  (prog-mode . copilot-mode)
+  :bind
+  (:map copilot-completion-map
+        ("<tab>" . 'copilot-accept-completion)
+        ("TAB" . 'copilot-accept-completion)
+        ("C-TAB" . 'copilot-accept-completion-by-word)
+        ("C-<tab>" . 'copilot-accept-completion-by-word))
+  :config
+  (copilot-mode +1))
+
+(use-package! wakatime-mode :ensure t)
+

home/base/tui/editors/emacs/doom/init.el

@@ -0,0 +1,211 @@
+;;; init.el -*- lexical-binding: t; -*-
+
+;; This file controls what Doom modules are enabled and what order they load
+;; in. Remember to run 'doom sync' after modifying it!
+
+;; NOTE Press 'SPC h d h' (or 'C-h d h' for non-vim users) to access Doom's
+;;      documentation. There you'll find a link to Doom's Module Index where all
+;;      of our modules are listed, including what flags they support.
+
+;; NOTE Move your cursor over a module's name (or its flags) and press 'K' (or
+;;      'C-c c k' for non-vim users) to view its documentation. This works on
+;;      flags as well (those symbols that start with a plus).
+;;
+;;      Alternatively, press 'gd' (or 'C-c c d') on a module to browse its
+;;      directory (for easy access to its source code).
+
+
+(doom! :input
+       ;;bidi              ; (tfel ot) thgir etirw uoy gnipleh
+       chinese
+       ;;japanese
+       ;;layout            ; auie,ctsrnm is the superior home row
+
+       :completion
+       ;; (company +childframe)  ; conflict with lsp-bridge
+                                        ; the ultimate code completion backend
+       ;;helm              ; the *other* search engine for love and life
+       ;;ido               ; the other *other* search engine...
+       ;;ivy               ; a search engine for love and life
+       vertico                          ; the search engine of the future
+
+       :ui
+       ;;deft              ; notational velocity for Emacs
+       doom                             ; what makes DOOM look the way it does
+       doom-dashboard                   ; a nifty splash screen for Emacs
+       ;;doom-quit         ; DOOM quit-message prompts when you quit Emacs
+       ;; (emoji +unicode) ; Emacs 29 provides native support for inserting Unicode emojis.
+                                        ; 🙂
+       hl-todo            ; highlight TODO/FIXME/NOTE/DEPRECATED/HACK/REVIEW
+       indent-guides      ; highlighted indent columns
+       ligatures          ; ligatures and symbols to make your code pretty again
+       modeline           ; snazzy, Atom-inspired modeline, plus API
+       ophints            ; highlight the region an operation acts on
+       (popup +defaults)
+                                        ; tame sudden yet inevitable temporary windows
+       tabs                             ; a tab bar for Emacs
+       treemacs                 ; a project drawer, like neotree but cooler
+       unicode                  ; extended unicode support for various languages
+       (vc-gutter +pretty)
+                                        ; vcs diff in the fringe
+       vi-tilde-fringe                  ; fringe tildes to mark beyond EOB
+       ;;window-select     ; visually switch windows
+       workspaces       ; tab emulation, persistence & separate workspaces
+       ;;zen               ; distraction-free coding or writing
+
+       :editor
+       (evil +everywhere)
+                                        ; come to the dark side, we have cookies
+       file-templates                   ; auto-snippets for empty files
+       fold                             ; (nigh) universal code folding
+       (format +onsave)
+                                        ; automated prettiness
+       ;; multiple-cursors  ; editing in many places at once
+       ;; objed             ; text object editing for the innocent, conflict with parinfer
+       parinfer          ; turn lisp into python, sort of, conflict with copilot/objed/smartparens
+       ;;rotate-text       ; cycle region at point between text candidates
+       snippets   ; my elves. They type so I don't have to
+       word-wrap         ; soft wrapping with language-aware indent
+
+       :emacs
+       dired             ; making dired pretty [functional]
+       electric          ; smarter, keyword-based electric-indent
+       ibuffer         ; interactive buffer management
+       undo              ; persistent, smarter undo for your inevitable mistakes
+       vc                ; version-control and Emacs, sitting in a tree
+
+       :term
+       ;;eshell            ; the elisp shell that works everywhere
+       ;;shell             ; simple shell REPL for Emacs
+       ;;term              ; basic terminal emulator for Emacs
+       vterm                            ; the best terminal emulation in Emacs
+
+       :checkers
+       syntax                        ; tasing you for every semicolon you forget
+       (spell +flyspell)
+                                        ; tasing you for misspelling mispelling
+       grammar                          ; tasing grammar mistake every you make
+
+       :tools
+       ;;ansible
+       ;;biblio            ; Writes a PhD for you (citation needed)
+       ;;collab            ; buffers with friends
+       ;;debugger          ; FIXME stepping through code, to help you add bugs
+       ;;direnv
+       (docker)
+       editorconfig      ; let someone else argue about tabs vs spaces
+       ;;ein               ; tame Jupyter notebooks with emacs
+       (eval +overlay)
+                                        ; run code, run (also, repls)
+       lookup                   ; navigate your code and its documentation
+       lsp    ; lsp-mode, conflict with lsp-bridge
+       magit                    ; a git porcelain for Emacs
+       ;;make              ; run make tasks from Emacs
+       ;;pass              ; password manager for nerds
+       pdf                              ; pdf enhancements
+       ;;prodigy           ; FIXME managing external services & code builders
+       (terraform)
+                                        ; infrastructure as code
+       tree-sitter                    ; syntax and parsing, sitting in a tree...
+       ;;upload            ; map local to remote projects via ssh/ftp
+
+       :os
+       (:if IS-MAC macos)
+                                        ; improve compatibility with macOS
+       tty                              ; improve the terminal Emacs experience
+
+       :lang
+       ;;agda              ; types of types of types of types...
+       ;;beancount         ; mind the GAAP
+       (cc +lsp +tree-sitter)
+                                        ; C > C++ == 1
+       ;;clojure           ; java with a lisp
+       ;;common-lisp       ; if you've seen one lisp, you've seen them all
+       ;;coq               ; proofs-as-programs
+       ;;crystal           ; ruby at the speed of c
+       ;;csharp            ; unity, .NET, and mono shenanigans
+       data                     ; config/data formats
+       ;;(dart +flutter)   ; paint ui and not much else
+       ;;dhall
+       ;;elixir            ; erlang done right
+       ;;elm               ; care for a cup of TEA?
+       emacs-lisp                       ; drown in parentheses
+       ;;erlang            ; an elegant language for a more civilized age
+       ;;ess               ; emacs speaks statistics
+       ;;factor
+       ;;faust             ; dsp, but you get to keep your soul
+       ;;fortran           ; in FORTRAN, GOD is REAL (unless declared INTEGER)
+       ;;fsharp            ; ML stands for Microsoft's Language
+       ;;fstar             ; (dependent) types and (monadic) effects and Z3
+       ;;gdscript          ; the language you waited for
+       (go +lsp +tree-sitter)  ;; disable go-mode, use lsp-bridge instead
+                                        ; the hipster dialect
+       ;;(graphql)    ; Give queries a REST
+       ;;(haskell)    ; a language that's lazier than I am
+       ;;hy                ; readability of scheme w/ speed of python
+       ;;idris             ; a language you can depend on
+       (json +lsp +tree-sitter)
+                                        ; At least it ain't XML
+       (java +lsp +tree-sitter)
+                                        ; the poster child for carpal tunnel syndrome
+       (javascript +lsp +tree-sitter)
+                                        ; all(hope(abandon(ye(who(enter(here))))))
+       ;;julia             ; a better, faster MATLAB
+       ;;kotlin            ; a better, slicker Java(Script)
+       (latex)
+                                        ; writing papers in Emacs has never been so fun
+       ;;lean              ; for folks with too much to prove
+       ;;ledger            ; be audit you can be
+       (lua +lsp +tree-sitter)
+                                        ; one-based indices? one-based indices
+       (markdown +grip)
+                                        ; writing docs for people to ignore
+       ;;nim               ; python + lisp at the speed of c
+       (nix +lsp +tree-sitter)
+                                        ; I hereby declare "nix geht mehr!"
+       ;;ocaml             ; an objective camel
+       (org +pandoc +hugo +jupyter)  ; organize your plain life in plain text
+       ;;php               ; perl's insecure younger brother
+       ;;plantuml          ; diagrams for confusing people more
+       ;;purescript        ; javascript, but functional
+       (python +lsp +tree-sitter +pyright)
+                                        ; beautiful is better than ugly
+       ;;qt                ; the 'cutest' gui framework ever
+       racket           ; a DSL for DSLs
+       ;;raku              ; the artist formerly known as perl6
+       ;;rest              ; Emacs as a REST client
+       ;;rst               ; ReST in peace
+       ;;(ruby +rails)     ; 1.step {|i| p "Ruby is #{i.even? ? 'love' : 'life'}"}
+       (rust +lsp +tree-sitter)
+                                        ; Fe2O3.unwrap().unwrap().unwrap().unwrap()
+       ;;scala             ; java, but good
+       (scheme +guile)
+                                        ; a fully conniving family of lisps
+       (sh +lsp +tree-sitter)
+                                        ; she sells {ba,z,fi}sh shells on the C xor
+       ;;sml
+       ;;solidity          ; do you need a blockchain? No.
+       ;;swift             ; who asked for emoji variables?
+       ;;terra             ; Earth and Moon in alignment for performance.
+       (web +lsp +tree-sitter)
+                                        ; support for various web languages, including HTML5, CSS, SASS/SCSS, Pug/Jade/Slim, and more
+       (yaml +lsp +tree-sitter)
+                                        ; JSON, but readable
+       ;;zig               ; C, but simpler
+
+       :email
+       ;;(mu4e +org +gmail)
+       ;;notmuch
+       ;;(wanderlust +gmail)
+
+       :app
+       ;;calendar
+       ;;emms
+       ;;everywhere        ; *leave* Emacs!? You must be joking
+       ;;irc               ; how neckbeards socialize
+       ;;(rss +org)        ; emacs as an RSS reader
+       ;;twitter           ; twitter client https://twitter.com/vnought
+
+       :config
+       ;;literate
+       (default +bindings +smartparens))

home/base/tui/editors/emacs/doom/packages.el

@@ -0,0 +1,64 @@
+;; -*- no-byte-compile: t; -*-
+;;; $DOOMDIR/packages.el
+
+;; To install a package with Doom you must declare them here and run 'doom sync'
+;; on the command line, then restart Emacs for the changes to take effect -- or
+;; use 'M-x doom/reload'.
+
+(package! super-save)
+(package! rime)
+(package! wakatime-mode
+  :recipe
+  (:host github :repo "wakatime/wakatime-mode" :files
+         ("*.el" "dist")))
+
+(package! nushell-mode :recipe
+  (:host github :repo "mrkkrp/nushell-mode"))
+
+(package! copilot
+  :recipe
+  (:host github :repo "copilot-emacs/copilot.el" :files
+         ("*.el" "dist")))
+
+;; To install SOME-PACKAGE from MELPA, ELPA or emacsmirror:
+;; (package! some-package)
+
+;; To install a package directly from a remote git repo, you must specify a
+;; `:recipe'. You'll find documentation on what `:recipe' accepts here:
+;; https://github.com/radian-software/straight.el#the-recipe-format
+;; (package! another-package
+;;   :recipe (:host github :repo "username/repo"))
+
+;; If the package you are trying to install does not contain a PACKAGENAME.el
+;; file, or is located in a subdirectory of the repo, you'll need to specify
+;; `:files' in the `:recipe':
+;; (package! this-package
+;;   :recipe (:host github :repo "username/repo"
+;;            :files ("some-file.el" "src/lisp/*.el")))
+
+;; If you'd like to disable a package included with Doom, you can do so here
+;; with the `:disable' property:
+;; (package! builtin-package :disable t)
+
+;; You can override the recipe of a built in package without having to specify
+;; all the properties for `:recipe'. These will inherit the rest of its recipe
+;; from Doom or MELPA/ELPA/Emacsmirror:
+;; (package! builtin-package :recipe (:nonrecursive t))
+;; (package! builtin-package-2 :recipe (:repo "myfork/package"))
+
+;; Specify a `:branch' to install a package from a particular branch or tag.
+;; This is required for some packages whose default branch isn't 'master' (which
+;; our package manager can't deal with; see radian-software/straight.el#279)
+;; (package! builtin-package :recipe (:branch "develop"))
+
+;; Use `:pin' to specify a particular commit to install.
+;; (package! builtin-package :pin "1a2b3c4d5e")
+
+
+;; Doom's packages are pinned to a specific commit and updated from release to
+;; release. The `unpin!' macro allows you to unpin single packages...
+;; (unpin! pinned-package)
+;; ...or multiple packages
+;; (unpin! pinned-package another-pinned-package)
+;; ...Or *all* packages (NOT RECOMMENDED; will likely break things)
+;; (unpin! t)

home/base/tui/editors/helix/README.md

@@ -0,0 +1,64 @@
+# Helix Editor
+
+Neovim is really powerful, and have a very active community. I use it as my main editor, and I'm
+very happy with it. I use it for everything, from writing code to writing this document.
+
+But its configuration is a bit complex, and finding the right plugins, writing configurations, and
+keeping everything up to date is not easy.
+
+That's why I'm interested in Helix, Helix is similar to Neovim, but it's more opinionated, and it's
+batteries included. Whether I'll switch my main editor to Helix or not, it gives me a lot of ideas
+on how to improve my Neovim workflow.
+
+## Tutorial
+
+Use `:tutor` in helix to start the tutorial.
+
+## Differences between Neovim and Helixer
+
+1. Selecting first, then action.
+   1. Helix: delete 2 word: `2w` then `x`. You can always see what you're selecting before you apply
+      the action.
+   2. Neovim: delete 2 word: `d`. then `2w`. No visual feedback before you apply the action.
+1. Helix - Modern builtin features: LSP, tree-sitter, fuzzy finder, multi cursors, surround and
+   more.
+   1. They're all available in Neovim too, but you need to find and use the right plugins manually,
+      which takes time and effort.
+1. Helix is built in Rust from scratch. The result is a much smaller codebase and a modern set of
+   defaults. No VimScript. No Lua.
+   1. Neovim contains a lot of VimScript, and lua is too dynamic, it's hard to debug.
+   1. Personally I'm glad to take a look at a Rust codebase, but not a VimScript/Lua codebase.
+1. Neovim have a very activate plugin ecosystem, and it's easy to find plugins for almost
+   everything.
+   1. Helix is still new, and it even don't have a stable plugin system yet. A PR to add a plugin
+      system is still envolving: <https://github.com/helix-editor/helix/pull/8675>
+1. Neovim has integrated terminal, and it's very powerful. It's quite similar to VSCode's integrated
+   terminal. I use it a lot.
+   1. Helix doesn't have a integrated terminal yet, as it's complicated to implement. Users are
+      recommended to use tmux/Zellij or Wezterm/Kitty to implement this feature instead.
+   1. <https://github.com/helix-editor/helix/issues/1976#issuecomment-1091074719>
+   1. <https://github.com/helix-editor/helix/pull/4649>
+   1. **My Neovim often gets stuck when I switch to
+      [toggleterm.nvim](https://github.com/akinsho/toggleterm.nvim), this Helix issue made me
+      consider to switch from this Neovim plugin to Zellij**.
+1. Helix do not have a tree-view panel, it's recommended to use Yazi/ranger/Broot instead, and open
+   Helix in them.
+   1. a tree-view plugin may be added after the plugin system is stable, but no one knows when it
+      will be.
+   2. and some Helix users stated that they don't need a tree-view plugin, Helix's file picker is
+      useful and good enough.
+1. It seems Helix lacks a global substitution command, you should run it in another window(via wm or
+   Zellij).
+   1. <https://github.com/helix-editor/helix/issues/196>
+   1. Neovim's substitution command allow you to preview the changes before you apply it, and it's
+      very useful. if I switch to Helix, I'll need to find some other tools with similar
+      feature(such as https://github.com/ms-jpq/sad).
+1. Complexity and Maintenance Costs vs Batteries Included:
+   <https://github.com/helix-editor/helix/discussions/6356>
+
+I think Use Helix/Neovim within a terminal file manager(Yazi/ranger/Broot) and Zellij is a good
+idea. It's quite different from the workflow I migrated from VSCode/JetBrains before, I'm very
+interested in it.
+
+In Neovim I can make the workflow similar to VSCode/JetBrains by using some plugins, but Helix
+forces me to get out of my comfort zone, and try something new.

home/base/tui/editors/helix/default.nix

@@ -0,0 +1,36 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  # https://github.com/catppuccin/helix
+  xdg.configFile."helix/themes".source = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-helix}/themes/default";
+
+  programs.helix = {
+    enable = true;
+    package = pkgs.helix;
+    settings = {
+      theme = "catppuccin_mocha";
+      editor = {
+        line-number = "relative";
+        cursorline = true;
+        color-modes = true;
+        lsp.display-messages = true;
+        cursor-shape = {
+          insert = "bar";
+          normal = "block";
+          select = "underline";
+        };
+        indent-guides.render = true;
+      };
+      keys.normal = {
+        space = {
+          space = "file_picker";
+          w = ":w";
+          q = ":q";
+        };
+        esc = ["collapse_selection" "keep_primary_selection"];
+      };
+    };
+  };
+}

home/base/tui/editors/neovim/README.md

@@ -0,0 +1,190 @@
+# Neovim Editor
+
+My Neovim config based on [AstroNvim](https://github.com/AstroNvim/AstroNvim). For more details,
+visit the [AstroNvim website](https://astronvim.com/).
+
+This document outlines neovim's configuration structure and various shortcuts/commands for efficient
+usage.
+
+## Screenshots
+
+![](/_img/astronvim_2023-07-13_00-39.webp) ![](/_img/hyprland_2023-07-29_2.webp)
+
+## Configuration Structure
+
+| Description                                       | Standard Location                           | My Location                                                               |
+| ------------------------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------- |
+| Neovim's config                                   | `~/.config/nvim`                            | AstroNvim's github repository, referenced as a flake input in this flake. |
+| AstroNvim's user configuration                    | `$XDG_CONFIG_HOME/astronvim/lua/user`       | [./astronvim_user/](./astronvim_user/)                                    |
+| Plugins installation directory (lazy.nvim)        | `~/.local/share/nvim/`                      | The same as standard location, generated and managed by lazy.nvim.        |
+| LSP servers, DAP servers, linters, and formatters | `~/.local/share/nvim/mason/`(by mason.nvim) | [./default.nix](./default.nix), installed by nix.                         |
+
+## Update/Clean Plugins
+
+Note that lazy.nvim will not automatically update plugins, so you need to update them manually.
+
+```bash
+:Lazy update
+```
+
+Remove all unused plugins:
+
+```bash
+:Lazy clean
+```
+
+## Testing
+
+> via `Justfile` located at the root of this repo.
+
+```bash
+# testing
+just nvim-test
+
+# clear test data
+just nvim-clear
+```
+
+## Cheetsheet
+
+Here is the cheetsheet related to my Neovim configs. Please read vim's common cheetsheet at
+[../README.md](../README.md) before reading the following.
+
+### Incremental Selection
+
+Provided by nvim-treesitter.
+
+| Action            | Shortcut       |
+| ----------------- | -------------- |
+| init selection    | `<Ctrl-space>` |
+| node incremental  | `<Ctrl-space>` |
+| scope incremental | `<Alt-Space>`  |
+| node decremental  | `Backspace`    |
+
+### Search and Jump
+
+Provided by [flash.nvim](https://github.com/folke/flash.nvim), it's a intelligent search and jump
+plugin.
+
+1. It enhances the default search and jump behavior of neovim.(search with prefix `/`)
+
+| Action            | Shortcut                                                                                                     |
+| ----------------- | ------------------------------------------------------------------------------------------------------------ |
+| Search            | `/`(normal search), `s`(disable all code highlight, only highlight matches)                                  |
+| Treesitter Search | `yR`,`dR`, `cR`, `vR`, `ctrl+v+R`(around your matches, all the surrounding Treesitter nodes will be labeled) |
+| Remote Flash      | `yr`, `dr`, `cr`, (around your matches, all the surrounding Treesitter nodes will be labeled)                |
+
+### Commands & Shortcuts
+
+| Action                        | Shortcut       |
+| ----------------------------- | -------------- |
+| Open file explorer            | `<Space> + e`  |
+| Focus Neotree to current file | `<Space> + o`  |
+| Toggle line wrap              | `<Space> + uw` |
+| Show line diagnostics         | `gl`           |
+| Show function/variable info   | `K`            |
+| References of a symbol        | `gr`           |
+| Next tab                      | `]b`           |
+| Previous tab                  | `[b`           |
+
+### Window Navigation
+
+- Switch between windows: `<Ctrl> + h/j/k/l`
+- Resize windows: `<Ctrl> + Up/Down/Left/Right` (`<Ctrl-w> + -/+/</>`)
+  - Note: On macOS, conflicts with system shortcuts
+  - Disable in System Preferences -> Keyboard -> Shortcuts -> Mission Control
+
+### Splitting and Buffers
+
+| Action           | Shortcut      |
+| ---------------- | ------------- |
+| Horizontal Split | `\`           |
+| Vertical Split   | `\|`          |
+| Close Buffer     | `<Space> + c` |
+
+### Editing and Formatting
+
+| Action                                                | Shortcut       |
+| ----------------------------------------------------- | -------------- |
+| Toggle buffer auto formatting                         | `<Space> + uf` |
+| Format Document                                       | `<Space> + lf` |
+| Code Actions                                          | `<Space> + la` |
+| Rename                                                | `<Space> + lr` |
+| Opening LSP symbols                                   | `<Space> + lS` |
+| Comment Line(support multiple lines)                  | `<Space> + /`  |
+| Open filepath/URL at cursor(neovim's builtin command) | `gx`           |
+| Find files by name (fzf)                              | `<Space> + ff` |
+| Find files by name (include hidden files)             | `<Space> + fF` |
+| Grep string in files (ripgrep)                        | `<Space> + fw` |
+| Grep string in files (include hidden files)           | `<Space> + fW` |
+
+### Git
+
+| Action                     | Shortcut        |
+| -------------------------- | --------------- |
+| Git Commits (repository)   | `:<Space> + gc` |
+| Git Commits (current file) | `:<Space> + gC` |
+| Git Branches               | `:<Space> + gb` |
+| Git Status                 | `:<Space> + gt` |
+
+### Sessions
+
+| Action                         | Shortcut       |
+| ------------------------------ | -------------- |
+| Save Session                   | `<Space> + Ss` |
+| Last Session                   | `<Space> + Sl` |
+| Delete Session                 | `<Space> + Sd` |
+| Search Session                 | `<Space> + Sf` |
+| Load Current Directory Session | `<Space> + S.` |
+
+### Debugging
+
+Press `<Space> + D` to view available bindings and options.
+
+### Search and Replace Globally
+
+| Description                                | Shortcut       |
+| ------------------------------------------ | -------------- |
+| Open spectre.nvim search and replace panel | `<Space> + ss` |
+
+Search and replace via cli(fd + sad + delta):
+
+```bash
+fd "\\.nix$" . | sad '<pattern>' '<replacement>' | delta
+```
+
+### Surrounding Characters
+
+Provided by mini.surround plugin.
+
+- Prefix `gz`
+
+| Action                         | Shortcut | Description                                     |
+| ------------------------------ | -------- | ----------------------------------------------- |
+| Add surrounding characters     | `gzaiw'` | Add `'` around the word under cursor            |
+| Delete surrounding characters  | `gzd'`   | Delete `'` around the word under cursor         |
+| Replace surrounding characters | `gzr'"`  | Replace `'` by `"` around the word under cursor |
+| Highlight surrounding          | `gzh'`   | Highlight `'` around the word under cursor      |
+
+### Text Manipulation
+
+| Action                                 |               |
+| -------------------------------------- | ------------- |
+| Join with LSP intelligence(treesj)     | `<Space> + j` |
+| Split Line into Multiple Lines(treesj) | `<Space> + s` |
+
+### Miscellaneous
+
+| Action                            |                 |
+| --------------------------------- | --------------- |
+| Show all Yank History             | `:<Space> + yh` |
+| Show undo history                 | `:<Space> + uh` |
+| Show the path of the current file | `:!echo $%`     |
+
+## Additional Resources
+
+For more detailed information and advanced usage, refer to:
+
+1. [AstroNvim walkthrough](https://astronvim.com/Basic%20Usage/walkthrough)
+2. [./astronvim_user/mapping.lua](./astronvim_user/mappings.lua)
+3. All the plugins' documentations

home/base/tui/editors/neovim/default.nix

@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  pkgs-unstable,
+  ...
+}:
+###############################################################################
+#
+#  AstroNvim's configuration and all its dependencies(lsp, formatter, etc.)
+#
+#e#############################################################################
+let
+  shellAliases = {
+    v = "nvim";
+    vdiff = "nvim -d";
+  };
+in {
+  home.activation.installAstroNvim = lib.hm.dag.entryAfter ["writeBoundary"] ''
+    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F744 ${./nvim}/ ${config.xdg.configHome}/nvim/
+  '';
+
+  home.shellAliases = shellAliases;
+  programs.nushell.shellAliases = shellAliases;
+
+  programs = {
+    neovim = {
+      enable = true;
+      package = pkgs-unstable.neovim-unwrapped;
+
+      defaultEditor = true;
+      viAlias = true;
+      vimAlias = true;
+
+      # These environment variables are needed to build and run binaries
+      # with external package managers like mason.nvim.
+      #
+      # LD_LIBRARY_PATH is also needed to run the non-FHS binaries downloaded by mason.nvim.
+      # it will be set by nix-ld, so we do not need to set it here again.
+      extraWrapperArgs = with pkgs; [
+        # LIBRARY_PATH is used by gcc before compilation to search directories
+        # containing static and shared libraries that need to be linked to your program.
+        "--suffix"
+        "LIBRARY_PATH"
+        ":"
+        "${lib.makeLibraryPath [stdenv.cc.cc zlib]}"
+
+        # PKG_CONFIG_PATH is used by pkg-config before compilation to search directories
+        # containing .pc files that describe the libraries that need to be linked to your program.
+        "--suffix"
+        "PKG_CONFIG_PATH"
+        ":"
+        "${lib.makeSearchPathOutput "dev" "lib/pkgconfig" [stdenv.cc.cc zlib]}"
+      ];
+
+      # Currently we use lazy.nvim as neovim's package manager, so comment this one.
+      #
+      # NOTE: These plugins will not be used by astronvim by default!
+      # We should install packages that will compile locally or download FHS binaries via Nix!
+      # and use lazy.nvim's `dir` option to specify the package directory in nix store.
+      # so that these plugins can work on NixOS.
+      #
+      # related project:
+      #  https://github.com/b-src/lazy-nix-helper.nvim
+      plugins = with pkgs.vimPlugins; [
+        # search all the plugins using https://search.nixos.org/packages
+        telescope-fzf-native-nvim
+
+        nvim-treesitter.withAllGrammars
+      ];
+    };
+  };
+}