docs: IPv6AcceptRA

feat(nixos): desktop - Add xdg-terminal-exec #185

.envrc

@@ -0,0 +1 @@
+use flake

.gitattributes

@@ -0,0 +1,3 @@
+# https://github.com/github-linguist/linguist/blob/master/docs/overrides.md
+
+home/linux/desktop/i3/conf/polybar/** linguist-vendored

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+github: ryan4yin
+patreon: ryan4yin
+custom: ["https://buymeacoffee.com/ryan4yin"]

.github/workflows/flake_evaltests.yml

@@ -0,0 +1,42 @@
+name: Nix Flake Eval Tests
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "scripts/**"
+      - "**.md"
+      - "**.nu"
+      - "Justfile"
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - "scripts/**"
+      - "**.md"
+      - "**.nu"
+      - "Justfile"
+
+jobs:
+  checks:
+    name: Check expressions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install nix
+        uses: cachix/install-nix-action@v24
+        with:
+          install_url: https://nixos.org/nix/install
+          extra_nix_config: |
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            experimental-features = nix-command flakes
+
+      - name: Run Nix Flake Eval Tests
+        run: |
+          echo 'Flake Eval Tests'
+          # stack overflow...
+          # nix eval .#checks --show-trace --print-build-logs --verbose
+          nix eval .#evalTests --show-trace --print-build-logs --verbose

.github/workflows/mirror_to_gitee.yml

@@ -0,0 +1,32 @@
+name: Mirror this repo to Gitee
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "*"
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Mirror repo to Gitee
+        id: mirror-to-gitee
+        shell: bash
+        env:
+          INPUT_SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY_GITEE_MIRROR }}
+          INPUT_TARGET_REPO_URL: git@gitee.com:ryan_yin/nix-config.git
+        run: |
+          set -eu
+
+          mkdir -p ~/.ssh
+          echo "$INPUT_SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+
+          export GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no"
+          git remote add mirror "$INPUT_TARGET_REPO_URL"
+          git push --tags --force --prune mirror "refs/remotes/origin/*:refs/heads/*"

.gitignore

@@ -1,3 +1,9 @@
 result
 result/
+.direnv/
 .DS_Store
+.pre-commit-config.yaml
+logs/
+core*
+!core/
+!core.nix

.prettierignore

@@ -0,0 +1,8 @@
+LICENSE.md
+dist
+pnpm-lock.yaml
+flake.lock
+vercel.json
+cache
+temp
+.temp

.prettierrc.yaml

@@ -0,0 +1,6 @@
+# https://prettier.io/docs/en/options
+semi: false
+singleQuote: false
+printWidth: 100
+proseWrap: always # always change wrapping in markdown text
+trailingComma: es5

.typos.toml

@@ -0,0 +1,34 @@
+[files]
+ignore-dot = true
+ignore-files = true
+extend-exclude = ["themes/", "data/", "static-surprises/", "resources/"]
+
+[default]
+binary = false
+# ignore some special identifiers(sha256, mac address, crypto keys, etc)
+extend-ignore-re = [
+  "iterm2",
+  "iHgEIBYKACAWIQSizQe9ljFEyyclWmtVhZllwnQrSwUCZZ1T9wIdAAAKCRBVhZll", # crypto keys
+  "noice",                                                            # noice.nvim
+  "crypted-nixos",
+  "daed",
+
+  # catppuccin theme colors
+  "11111b",
+  "1e1e2e",
+  "313244",
+  "414356",
+  "45475a",
+  "585b70",
+  "89b4fa",
+  "94e2d5",
+  "a6adc8",
+  "a6e3a1",
+  "bac2de",
+  "cdd6f4",
+  "f38ba8",
+  "f5c2e7",
+  "f5e0dc",
+  "f9e2af",
+  "fab387",
+]

Justfile

@@ -0,0 +1,377 @@
+# just is a command runner, Justfile is very similar to Makefile, but simpler.
+
+# Use nushell for shell commands
+# To use this justfile, you need to enter a shell with just & nushell installed:
+# 
+#   nix shell nixpkgs#just nixpkgs#nushell
+set shell := ["nu", "-c"]
+
+utils_nu := absolute_path("utils.nu")
+
+############################################################################
+#
+#  Common commands(suitable for all machines)
+#
+############################################################################
+
+# List all the just commands
+default:
+    @just --list
+
+# Run eval tests
+[group('nix')]
+test:
+  nix eval .#evalTests --show-trace --print-build-logs --verbose
+
+# Update all the flake inputs
+[group('nix')]
+up:
+  nix flake update
+
+# Update specific input
+# Usage: just upp nixpkgs
+[group('nix')]
+upp input:
+  nix flake update {{input}}
+
+# List all generations of the system profile
+[group('nix')]
+history:
+  nix profile history --profile /nix/var/nix/profiles/system
+
+# Open a nix shell with the flake
+[group('nix')]
+repl:
+  nix repl -f flake:nixpkgs
+
+# remove all generations older than 7 days
+# on darwin, you may need to switch to root user to run this command
+[group('nix')]
+clean:
+  sudo nix profile wipe-history --profile /nix/var/nix/profiles/system  --older-than 7d
+
+# Garbage collect all unused nix store entries
+[group('nix')]
+gc:
+  # garbage collect all unused nix store entries(system-wide)
+  sudo nix-collect-garbage --delete-older-than 7d
+  # garbage collect all unused nix store entries(for the user - home-manager)
+  # https://github.com/NixOS/nix/issues/8508
+  nix-collect-garbage --delete-older-than 7d
+
+# Enter a shell session which has all the necessary tools for this flake
+[linux]
+[group('nix')]
+shell:
+  nix shell nixpkgs#git nixpkgs#neovim nixpkgs#colmena
+
+# Enter a shell session which has all the necessary tools for this flake
+[macos]
+[group('nix')]
+shell:
+  nix shell nixpkgs#git nixpkgs#neovim
+
+[group('nix')]
+fmt:
+  # format the nix files in this repo
+  nix fmt
+
+# Show all the auto gc roots in the nix store
+[group('nix')]
+gcroot:
+  ls -al /nix/var/nix/gcroots/auto/
+
+# Verify all the store entries
+# Nix Store can contains corrupted entries if the nix store object has been modified unexpectedly.
+# This command will verify all the store entries,
+# and we need to fix the corrupted entries manually via `sudo nix store delete <store-path-1> <store-path-2> ...`
+[group('nix')]
+verify-store:
+  nix store verify --all
+
+# Repair Nix Store Objects
+[group('nix')]
+repair-store *paths:
+  nix store repair {{paths}}
+
+############################################################################
+#
+#  NixOS Desktop related commands
+#
+############################################################################
+
+[linux]
+[group('desktop')]
+hypr mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch ai-hyprland {{mode}}
+
+[linux]
+[group('desktop')]
+s-hypr mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch shoukei-hyprland {{mode}}
+
+############################################################################
+#
+#  Darwin related commands, harmonica is my macbook pro's hostname
+#
+############################################################################
+
+[macos]
+[group('desktop')]
+darwin-set-proxy:
+  sudo python3 scripts/darwin_set_proxy.py
+  sleep 1sec
+
+[macos]
+[group('desktop')]
+darwin-rollback:
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-rollback
+
+# Deploy to harmonica(macOS host)
+[macos]
+[group('desktop')]
+ha mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-build "harmonica" {{mode}};
+  darwin-switch "harmonica" {{mode}}
+
+# Depoly to fern(macOS host)
+[macos]
+[group('desktop')]
+fe mode="default": 
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-build "fern" {{mode}};
+  darwin-switch "fern" {{mode}}
+
+# Depoly to frieren(macOS host)
+[macos]
+[group('desktop')]
+fr mode="default": 
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  darwin-build "frieren" {{mode}};
+  darwin-switch "frieren" {{mode}}
+
+# Reset launchpad to force it to reindex Applications
+[macos]
+[group('desktop')]
+reset-launchpad:
+  defaults write com.apple.dock ResetLaunchPad -bool true
+  killall Dock
+
+############################################################################
+#
+#  Homelab - Kubevirt Cluster related commands
+#
+############################################################################
+
+# Remote deployment via colmena
+[linux]
+[group('homelab')]
+col tag:
+  colmena apply --on '@{{tag}}' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+local name mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch {{name}} {{mode}}
+
+# Build and upload a vm image
+[linux]
+[group('homelab')]
+upload-vm name mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  upload-vm {{name}} {{mode}}
+
+# Deploy all the KubeVirt nodes(Physical machines running KubeVirt)
+[linux]
+[group('homelab')]
+lab:
+  colmena apply --on '@virt-*' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+shoryu:
+  colmena apply --on '@kubevirt-shoryu' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+shoryu-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kubevirt-shoryu {{mode}}
+
+[linux]
+[group('homelab')]
+shushou:
+  colmena apply --on '@kubevirt-shushou' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+shushou-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kubevirt-shushou {{mode}}
+
+[linux]
+[group('homelab')]
+youko:
+  colmena apply --on '@kubevirt-youko' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+youko-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kubevirt-youko {{mode}}
+
+############################################################################
+#
+# Commands for other Virtual Machines
+#
+############################################################################
+
+# Build and upload a vm image
+[linux]
+[group('homelab')]
+upload-idols mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  upload-vm aquamarine {{mode}}
+  upload-vm ruby {{mode}}
+  upload-vm kana {{mode}}
+
+[linux]
+[group('homelab')]
+aqua:
+  colmena apply --on '@aqua' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+aqua-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch aquamarine {{mode}}
+
+[linux]
+[group('homelab')]
+ruby:
+  colmena apply --on '@ruby' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+ruby-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch ruby {{mode}}
+
+[linux]
+[group('homelab')]
+kana:
+  colmena apply --on '@kana' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+kana-local mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  nixos-switch kana {{mode}}
+
+############################################################################
+#
+# Kubernetes related commands
+#
+############################################################################
+
+# Build and upload a vm image
+[linux]
+[group('homelab')]
+upload-k3s-prod mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  upload-vm k3s-prod-1-master-1 {{mode}}; 
+  upload-vm k3s-prod-1-master-2 {{mode}}; 
+  upload-vm k3s-prod-1-master-3 {{mode}}; 
+  upload-vm k3s-prod-1-worker-1 {{mode}}; 
+  upload-vm k3s-prod-1-worker-2 {{mode}}; 
+  upload-vm k3s-prod-1-worker-3 {{mode}};
+
+[linux]
+[group('homelab')]
+upload-k3s-test mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
+  upload-vm k3s-test-1-master-1 {{mode}}; 
+  upload-vm k3s-test-1-master-2 {{mode}}; 
+  upload-vm k3s-test-1-master-3 {{mode}};
+
+[linux]
+[group('homelab')]
+k3s-prod:
+  colmena apply --on '@k3s-prod-*' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+k3s-test:
+  colmena apply --on '@k3s-test-*' --verbose --show-trace
+
+# =================================================
+#
+# Other useful commands
+#
+# =================================================
+
+[group('common')]
+path:
+   $env.PATH | split row ":"
+
+[group('common')]
+trace-access app *args:
+  strace -f -t -e trace=file {{app}} {{args}} | complete | $in.stderr | lines | find -v -r "(/nix/store|/newroot|/proc)" | parse --regex '"(/.+)"' | sort | uniq
+
+[linux]
+[group('common')]
+penvof pid:
+  sudo cat $"/proc/($pid)/environ" | tr '\0' '\n'
+
+# Remove all reflog entries and prune unreachable objects
+[group('git')]
+ggc:
+  git reflog expire --expire-unreachable=now --all
+  git gc --prune=now
+
+# Amend the last commit without changing the commit message
+[group('git')]
+game:
+  git commit --amend -a --no-edit
+
+# Delete all failed pods
+[group('k8s')]
+del-failed:
+  kubectl delete pod --all-namespaces --field-selector="status.phase==Failed"
+
+[linux]
+[group('services')]
+list-inactive:
+  systemctl list-units -all --state=inactive
+
+[linux]
+[group('services')]
+list-failed:
+  systemctl list-units -all --state=failed
+
+[linux]
+[group('services')]
+list-systemd:
+  systemctl list-units systemd-*

Makefile

@@ -1,118 +0,0 @@
-#
-#  NOTE: Makefile's target name should not be the same as one of the file or directory in the current directory, 
-#    otherwise the target will not be executed!
-#
-
-
-############################################################################
-#
-#  Nix commands related to the local machine
-#
-############################################################################
-
-i3: 
-	nixos-rebuild switch --flake .#ai_i3 --use-remote-sudo
-
-hypr:
-	nixos-rebuild switch --flake .#ai_hyprland --use-remote-sudo
-
-i3-debug:
-	nixos-rebuild switch --flake .#ai_i3 --use-remote-sudo --show-trace --verbose
-
-hypr-debug:
-	nixos-rebuild switch --flake .#ai_hyprland --use-remote-sudo --show-trace --verbose
-
-update:
-	nix flake update
-
-history:
-	nix profile history --profile /nix/var/nix/profiles/system
-
-gc:
-	# remove all generations older than 7 days
-	sudo nix profile wipe-history --profile /nix/var/nix/profiles/system  --older-than 7d
-
-	# garbage collect all unused nix store entries
-	sudo nix store gc --debug
-
-# adjust brightness(x11)
-# usage: make bright b=0.9
-bright:
-	xrandr --output DP-2 --brightness $(b)
-
-############################################################################
-#
-#  Darwin related commands, harmonica is my macbook pro's hostname
-#
-############################################################################
-
-darwin-set-proxy:
-	sudo python3 scripts/darwin_set_proxy.py
-
-ha: darwin-set-proxy
-	nix build .#darwinConfigurations.harmonica.system
-	./result/sw/bin/darwin-rebuild switch --flake .
-
-ha-debug: darwin-set-proxy
-	nix build .#darwinConfigurations.harmonica.system --show-trace --verbose
-	./result/sw/bin/darwin-rebuild switch --flake .#harmonica --show-trace --verbose
-
-
-############################################################################
-#
-#  Idols, Commands related to my remote distributed building cluster
-#
-############################################################################
-
-
-add-idols-ssh-key:
-	ssh-add ~/.ssh/ai-idols
-
-aqua: add-idols-ssh-key
-	nixos-rebuild --flake .#aquamarine --target-host aquamarine --build-host aquamarine switch --use-remote-sudo
-
-aqua-debug: add-idols-ssh-key
-	nixos-rebuild --flake .#aquamarine --target-host aquamarine --build-host aquamarine switch --use-remote-sudo --show-trace --verbose
-
-ruby: add-idols-ssh-key
-	nixos-rebuild --flake .#ruby --target-host ruby --build-host ruby switch --use-remote-sudo
-
-ruby-debug: add-idols-ssh-key
-	nixos-rebuild --flake .#ruby --target-host ruby --build-host ruby switch --use-remote-sudo --show-trace --verbose
-
-kana: add-idols-ssh-key
-	nixos-rebuild --flake .#kana --target-host kana --build-host kana switch --use-remote-sudo
-
-kana-debug: add-idols-ssh-key
-	nixos-rebuild --flake .#kana --target-host kana --build-host kana switch --use-remote-sudo --show-trace --verbose
-
-idols: aqua ruby kana
-
-idols-debug: aqua-debug ruby-debug kana-debug
-
-# only used once to setup the virtual machines
-idols-image:
-	# take image for idols, and upload the image to proxmox nodes.
-	nom build .#aquamarine
-	scp result/vzdump-qemu-*.vma.zst root@gtr5:/var/lib/vz/dump
-
-	nom build .#ruby
-	scp result/vzdump-qemu-*.vma.zst root@s500plus:/var/lib/vz/dump
-
-	nom build .#kana
-	scp result/vzdump-qemu-*.vma.zst root@um560:/var/lib/vz/dump
-
-
-############################################################################
-#
-#  Misc, other useful commands
-#
-############################################################################
-
-fmt:
-	# format the nix files in this repo
-	nix fmt
-
-.PHONY: clean  
-clean:  
-	rm -rf result

README.md

@@ -8,146 +8,143 @@
 	<a href="https://github.com/ryan4yin/nix-config/stargazers">
 		<img alt="Stargazers" src="https://img.shields.io/github/stars/ryan4yin/nix-config?style=for-the-badge&logo=starship&color=C9CBFF&logoColor=D9E0EE&labelColor=302D41"></a>
     <a href="https://nixos.org/">
-        <img src="https://img.shields.io/badge/NixOS-23.05-informational.svg?style=for-the-badge&logo=nixos&color=F2CDCD&logoColor=D9E0EE&labelColor=302D41"></a>
+        <img src="https://img.shields.io/badge/NixOS-25.05-informational.svg?style=for-the-badge&logo=nixos&color=F2CDCD&logoColor=D9E0EE&labelColor=302D41"></a>
     <a href="https://github.com/ryan4yin/nixos-and-flakes-book">
         <img src="https://img.shields.io/static/v1?label=Nix Flakes&message=learning&style=for-the-badge&logo=nixos&color=DDB6F2&logoColor=D9E0EE&labelColor=302D41"></a>
   </a>
 </p>
 
-This repository is home to the nix code that builds my systems.
+> My configuration is becoming more and more complex, and **it will be difficult for beginners to
+> read**. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a
+> look at the [ryan4yin/nix-config/releases](https://github.com/ryan4yin/nix-config/releases) first,
+> **check out to some simpler older versions, such as
+> [i3-kickstarter](https://github.com/ryan4yin/nix-config/tree/i3-kickstarter), which will be much
+> easier to understand**.
 
-## Why Nix?
+This repository is home to the nix code that builds my systems:
 
-Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once something is setup and configured once, it works forever. If someone else shares their configuration, anyone can make use of it.
+1. NixOS Desktops: NixOS with home-manager, hyprland, agenix, etc.
+2. macOS Desktops: nix-darwin with home-manager, share the same home-manager configuration with
+   NixOS Desktops.
+3. NixOS Servers: virtual machines running on Proxmox/KubeVirt, with various services, such as
+   kubernetes, homepage, prometheus, grafana, etc.
 
-**Want to know Nix in detail? Looking for a beginner-friendly tutorial or best practices? Check out [NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated :book: for beginners](https://github.com/ryan4yin/nixos-and-flakes-book)!**
+See [./hosts](./hosts) for details of each host.
 
-> If you're using macOS, you can also check out [ryan4yin/nix-darwin-kickstarter](https://github.com/ryan4yin/nix-darwin-kickstarter) for a quick start.
+See [./Virtual-Machine.md](./Virtual-Machine.md) for details of how to create & manage KubeVirt's
+Virtual Machine from this flake.
+
+## Why NixOS & Flakes?
+
+Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once
+something is setup and configured once, it works (almost) forever. If someone else shares their
+configuration, anyone else can just use it (if you really understand what you're copying/referring
+now).
+
+As for Flakes, refer to
+[Introduction to Flakes - NixOS & Nix Flakes Book](https://nixos-and-flakes.thiscute.world/nixos-with-flakes/introduction-to-flakes)
+
+**Want to know NixOS & Flakes in detail? Looking for a beginner-friendly tutorial or best practices?
+You don't have to go through the pain I've experienced again! Check out my
+[NixOS & Nix Flakes Book - 🛠️ ❤️ An unofficial & opinionated :book: for beginners](https://github.com/ryan4yin/nixos-and-flakes-book)!**
+
+> If you're using macOS, check out
+> [ryan4yin/nix-darwin-kickstarter](https://github.com/ryan4yin/nix-darwin-kickstarter) for a quick
+> start.
 
 ## Components
 
-| | NixOS(Wayland) | NixOS(Xorg) |
+|                             | NixOS(Wayland)                                                                                                      |
-| --------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |
+| --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| **Window Manager** | [Hyprland][Hyprland] | [i3][i3] |
+| **Window Manager**          | [Hyprland][Hyprland]                                                                                                |
-| **Terminal Emulator** | [Kitty][Kitty] | [Kitty][Kitty] |
+| **Terminal Emulator**       | [Zellij][Zellij] + [Kitty][Kitty]                                                                                   |
-| **Bar** | [Waybar][Waybar] | [i3block][i3block] |
+| **Bar**                     | [Waybar][Waybar]                                                                                                    |
-| **Application Launcher** | [wofi][wofi] | [rofi][rofi] |
+| **Application Launcher**    | [anyrun][anyrun]                                                                                                    |
-| **Notification Daemon** | [Mako][Mako] | [Dunst][Dunst] |
+| **Notification Daemon**     | [Mako][Mako]                                                                                                        |
-| **Display Manager** | [GDM][GDM] | [GDM][GDM] |
+| **Display Manager**         | [GDM][GDM]                                                                                                          |
-| **network management tool** | [NetworkManager][NetworkManager] | [NetworkManager][NetworkManager] |
+| **Color Scheme**            | [Catppuccin][Catppuccin]                                                                                            |
-| **Input method framework** | [Fcitx5][Fcitx5] | [Fcitx5][Fcitx5] |
+| **network management tool** | [NetworkManager][NetworkManager]                                                                                    |
-| **System resource monitor** | [Btop][Btop] | [Btop][Btop] |
+| **Input method framework**  | [Fcitx5][Fcitx5]                                                                                                    |
-| **File Manager** | [thunar][thunar] | [thunar][thunar] |
+| **System resource monitor** | [Btop][Btop]                                                                                                        |
-| **Shell** | [Nushell][Nushell] | [Nushell][Nushell] |
+| **File Manager**            | [Yazi][Yazi] + [thunar][thunar]                                                                                     |
-| **Music Player** | [mpd][mpd], [ncmpcpp][ncmpcpp], [mpc][mpc], [Netease-cloud-music-gtk][netease-cloud-music-gtk] | [Netease-cloud-music-gtk][netease-cloud-music-gtk] |
+| **Shell**                   | [Nushell][Nushell] + [Starship][Starship]                                                                           |
-| **Media Player** | [mpv][mpv] | [mpv][mpv] |
+| **Media Player**            | [mpv][mpv]                                                                                                          |
-| **Text Editor** | [Neovim][Neovim] | [Neovim][Neovim] |
+| **Text Editor**             | [Neovim][Neovim]                                                                                                    |
-| **Fonts** | [Nerd fonts][Nerd fonts] | [Nerd fonts][Nerd fonts] |
+| **Fonts**                   | [Nerd fonts][Nerd fonts]                                                                                            |
-| **Image Viewer** | [imv][imv] | [feh][feh] |
+| **Image Viewer**            | [imv][imv]                                                                                                          |
-| **Screenshot Software** | [grim][grim] | [flameshot](https://github.com/flameshot-org/flameshot) |
+| **Screenshot Software**     | [hyprshot][hyprshot]                                                                               |
-| **Screen Recording** | [OBS][OBS] | [OBS][OBS] |
+| **Screen Recording**        | [OBS][OBS]                                                                                                          |
+| **Filesystem & Encryption** | tmpfs on `/`, [Btrfs][Btrfs] subvolumes on a [LUKS][LUKS] encrypted partition for persistent, unlock via passphrase |
+| **Secure Boot**             | [lanzaboote][lanzaboote]                                                                                            |
+
+Wallpapers: https://github.com/ryan4yin/wallpapers
 
 ## Hyprland + AstroNvim
 
-![](./_img/hyprland_2023-07-26.webp)
+![](./_img/hyprland_2023-07-29_1.webp)
 
-![](./_img/hyprland_2023-07-27.webp)
+![](./_img/hyprland_2023-07-29_2.webp)
 
-## I3 + AstroNvim
+## Neovim
 
-![](/_img/astronvim_2023-07-13_00-39.webp)
+See [./home/base/tui/editors/neovim/](./home/base/tui/editors/neovim/) for details.
 
-## Hosts
+## Secrets Management
 
-```shell
+See [./secrets](./secrets) for details.
-› tree hosts
-hosts
-├── harmonica  # my MacBook Pro 2020 13-inch, for work.
-└── idols
-    ├── ai         # my main computer, with NixOS + I5-13600KF + RTX 4090 GPU, for gaming & daily use.
-    ├── aquamarine # my NixOS virtual machine with R9-5900HX(8C16T), for distributed building & testing.
-    ├── kana       # yet another NixOS vm on another physical machine with R5-5625U(6C12T).
-    └── ruby       # another NixOS vm on another physical machine with R7-5825U(8C16T).
-```
 
 ## How to Deploy this Flake?
 
-> Note: you should NOT deploy this flake directly on your machine, it contains my hardware information and personal information which is not suitable for you. You may use this repo as a reference to build your own configuration.
+<!-- prettier-ignore -->
+> :red_circle: **IMPORTANT**: **You should NOT deploy this flake directly on your machine :exclamation:
+> It will not succeed.** This flake contains my hardware configuration(such as
+> [hardware-configuration.nix](hosts/idols-ai/hardware-configuration.nix),
+> [Nvidia Support](https://github.com/ryan4yin/nix-config/blob/v0.1.1/hosts/idols-ai/default.nix#L77-L91),
+> etc.) which is not suitable for your hardware, and requires my private secrets repository
+> [ryan4yin/nix-secrets](https://github.com/ryan4yin/nix-config/tree/main/secrets) to deploy. You
+> may use this repo as a reference to build your own configuration.
 
-After installing NixOS with `nix-command` & `flake` enabled, follow the steps below to deploy this flake.
+For NixOS:
 
-For NixOS, use the following commands:
+> To deploy this flake from NixOS's official ISO image (purest installation method), please refer to
+> [./nixos-installer/](./nixos-installer/)
+
+> Need to restart the machine when switching between `wayland` and `xorg`.
 
 ```bash
 # deploy one of the configuration based on the hostname
-sudo nixos-rebuild switch --flake .#ai_i3
+sudo nixos-rebuild switch --flake .#ai-hyprland
 
-# we can also deploy using `make`, which is defined in Makefile
+# deploy via `just`(a command runner with similar syntax to make) & Justfile
-make i3
+just hypr  # deploy my pc with hyprland compositor
 
 # or we can deploy with details
-make i3-debug
+just hypr debug
 ```
 
-For MacOS, use the following commands:
+For macOS:
 
 ```bash
-# deploy the darwin configuration(harmonicia)
+# If you are deploying for the first time,
-make ha
+# 1. install nix & homebrew manually.
+# 2. prepare the deployment environment with essential packages available
+nix-shell -p just nushell
+# 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deployment.
+# 4. comment out the proxy settings in scripts/darwin_set_proxy.py if the proxy is not ready yet.
+
+# 4. deploy harmonica's configuration(macOS Intel)
+just ha
+
+# deploy fern's configuration(Apple Silicon)
+just fe
 
 # deploy with details
-make ha-debug
+just ha debug
+# just fe debug
 ```
 
-## Install Apps from Flatpak
+> [What y'all will need when Nix drives you to drink.](https://www.youtube.com/watch?v=Eni9PPPPBpg)
-
+> (copy from hlissner's dotfiles, it really matches my feelings when I first started using NixOS...)
-We can install apps from flathub, which has a lot of apps that are not supported well in nixpkgs.
-
-```bash
-# Add the Flathub repository
-flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-
-# install apps from flathub
-flatpak install netease-cloud-music-gtk
-
-# install 3d printer slicer - cura
-flatpak install flathub com.ultimaker.cura
-
-# or you can search apps from flathub
-flatpak search <keyword>
-# search on website is also supported: https://flathub.org/
-```
-
-## How to create & managage VM from this flake?
-
-use `aquamarine` as an example, we can create a virtual machine with the following command:
-
-```shell
-# 1. generate a proxmox vma image file
-nom build .#aquamarine  # `nom`(nix-output-monitor) can be replaced by the standard command `nix`
-
-# 2. upload the genereated image to proxmox server's backup directory `/var/lib/vz/dump`
-#    please replace the vma file name with the one you generated in step 1.
-scp result/vzdump-qemu-aquamarine-nixos-23.11.20230603.dd49825.vma.zst root@192.168.5.174:/var/lib/vz/dump
-
-# 3. the image we uploaded will be listed in proxmox web ui's this page: [storage 'local'] -> [backups], we can restore a vm from it via the web ui now.
-```
-
-Once the virtual machine `aquamarine` is created, we can deploy updates to it with the following commands:
-
-```shell
-# 1. add the ssh key to ssh-agent
-ssh-add ~/.ssh/ai-idols
-
-# 2. deploy the configuration to the remote host, using the ssh key we added in step 1
-#    and the username defaults to `$USER`, it's `ryan` in my case.
-nixos-rebuild --flake .#aquamarine --target-host aquamarine --build-host aquamarine switch --use-remote-sudo --verbose
-
-# or we can replace the command above with the following command, which is defined in Makefile
-make aqua
-```
-
-The commands above will build & deploy the configuration to `aquamarine`, the build process will be executed on `aquamarine` too, and the `--use-remote-sudo` option indicates that we will use `sudo` on the remote host.
 
 ## References
 
@@ -159,47 +156,55 @@ Other dotfiles that inspired me:
   - [xddxdd/nixos-config](https://github.com/xddxdd/nixos-config)
   - [bobbbay/dotfiles](https://github.com/bobbbay/dotfiles)
   - [gytis-ivaskevicius/nixfiles](https://github.com/gytis-ivaskevicius/nixfiles)
-  - [fufexan/dotfiles](https://github.com/fufexan/dotfiles)
   - [davidtwco/veritas](https://github.com/davidtwco/veritas)
   - [gvolpe/nix-config](https://github.com/gvolpe/nix-config)
   - [Ruixi-rebirth/flakes](https://github.com/Ruixi-rebirth/flakes)
-- Hyprland
+  - [fufexan/dotfiles](https://github.com/fufexan/dotfiles): gtk theme, xdg, git, media, anyrun,
-  - [HeinzDev/Hyprland-dotfiles](https://github.com/HeinzDev/Hyprland-dotfiles)
+    etc.
-  - [notwidow/hyprland](https://github.com/notwidow/hyprland)
+  - [nix-community/srvos](https://github.com/nix-community/srvos): a collection of opinionated and
-- I3 Window Manager
+    sharable NixOS configurations for servers
-  - [denisse-dev/dotfiles](https://github.com/denisse-dev/dotfiles)
+- Modularized NixOS Configuration
+  - [hlissner/dotfiles](https://github.com/hlissner/dotfiles)
+  - [viperML/dotfiles](https://github.com/viperML/dotfiles)
+- Hyprland(wayland)
+  - [notwidow/hyprland](https://github.com/notwidow/hyprland): This is where I start my hyprland
+    journey.
+  - [HeinzDev/Hyprland-dotfiles](https://github.com/HeinzDev/Hyprland-dotfiles): Refer to the waybar
+    configuration here.
+  - [Zeioth/zeioth-hyprland-config](https://github.com/Zeioth/zeioth-hyprland-config)
+  - [linuxmobile/kaku](https://github.com/linuxmobile/kaku)
 - Neovim/AstroNvim
   - [maxbrunet/dotfiles](https://github.com/maxbrunet/dotfiles): astronvim with nix flakes.
 - Misc
   - [1amSimp1e/dots](https://github.com/1amSimp1e/dots)
 
 [Hyprland]: https://github.com/hyprwm/Hyprland
-[i3]: https://github.com/i3/i3
 [Kitty]: https://github.com/kovidgoyal/kitty
 [Nushell]: https://github.com/nushell/nushell
+[Starship]: https://github.com/starship/starship
 [Waybar]: https://github.com/Alexays/Waybar
-[i3block]: https://github.com/vivien/i3blocks
+[polybar]: https://github.com/polybar/polybar
 [rofi]: https://github.com/davatorium/rofi
-[wofi]: https://hg.sr.ht/~scoopta/wofi
+[anyrun]: https://github.com/Kirottu/anyrun
 [Dunst]: https://github.com/dunst-project/dunst
 [Fcitx5]: https://github.com/fcitx/fcitx5
 [Btop]: https://github.com/aristocratos/btop
 [mpv]: https://github.com/mpv-player/mpv
+[Zellij]: https://github.com/zellij-org/zellij
 [Neovim]: https://github.com/neovim/neovim
 [AstroNvim]: https://github.com/AstroNvim/AstroNvim
-[flameshot]: https://github.com/flameshot-org/flameshot
+[Hyprshot]: https://github.com/Gustash/Hyprshot
-[grim]: https://github.com/emersion/grim
-[feh]: https://github.com/derf/feh
 [imv]: https://sr.ht/~exec64/imv/
 [OBS]: https://obsproject.com
 [Mako]: https://github.com/emersion/mako
 [Nerd fonts]: https://github.com/ryanoasis/nerd-fonts
 [catppuccin]: https://github.com/catppuccin/catppuccin
-[mpd]: https://github.com/MusicPlayerDaemon/MPD
-[ncmpcpp]: https://github.com/ncmpcpp/ncmpcpp
-[mpc]: https://github.com/MusicPlayerDaemon/mpc
-[Netease-cloud-music-gtk]: https://github.com/gmg137/netease-cloud-music-gtk
 [NetworkManager]: https://wiki.gnome.org/Projects/NetworkManager
 [wl-clipboard]: https://github.com/bugaevc/wl-clipboard
 [GDM]: https://wiki.archlinux.org/title/GDM
 [thunar]: https://gitlab.xfce.org/xfce/thunar
+[Yazi]: https://github.com/sxyazi/yazi
+[Catppuccin]: https://github.com/catppuccin/catppuccin
+[Btrfs]: https://btrfs.readthedocs.io
+[LUKS]: https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system
+[lanzaboote]: https://github.com/nix-community/lanzaboote

Virtual-Machine.md

@@ -0,0 +1,26 @@
+## How to create & managage KubeVirt's Virtual Machine from this flake?
+
+Use `aquamarine` as an example, first build and upload the virtual machine's qcow2 image to the file
+server:
+
+```shell
+just upload-vm aquamarine
+```
+
+Then create the virtual machine by creating a yaml file at
+[ryan4yin/k8s-gitops](https://github.com/ryan4yin/k8s-gitops/tree/main/vms), set the
+`spec.dataVolumeTemplates[0].source.http.url` to the uploaded file's URL, and fluxcd will
+automatically apply the changes, then a virtual machine named `aquamarine` will be created in the
+KubeVirt cluster.
+
+Once the virtual machine `aquamarine` is created, we can deploy updates to it with the following
+commands:
+
+```shell
+just col aquamarine
+just col kubevirt-shoryu
+just col k3s-test-1-master-1
+```
+
+If you're not familiar with remote deployment, please read this tutorial first:
+[Remote Deployment - NixOS & Flakes Book](https://nixos-and-flakes.thiscute.world/best-practices/remote-deployment)

certs/.gitignore

@@ -0,0 +1,2 @@
+*.key
+*.csr

certs/README.md

@@ -0,0 +1,7 @@
+# My Private PKI / CA
+
+This is my private Private Key Infrastructure (PKI) / Certificate Authority (CA) for my personal
+use. It is used to issue certificates for my own servers and services.
+
+All the private keys are ignored by git, and will be stored in my private secrets repo
+[../secrets](../secrets/)

certs/ecc-ca.crt

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBajCB8QIJAIwL98is2nQPMAoGCCqGSM49BAMEMB8xHTAbBgNVBAMMFFJ5YW40
+WWluJ3MgUm9vdCBDQSAxMB4XDTI0MDQwMzA4NDgzM1oXDTM0MDQwMTA4NDgzM1ow
+HzEdMBsGA1UEAwwUUnlhbjRZaW4ncyBSb290IENBIDEwdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQ6ixMbsGZ/u/ZnwzOZ49naVL7rQxm9C74SboGytKcYBH03JjC7tgZ3
+DylirxSLcTYHHtCz9ajdamP6+sgiGVpUODtfGSO+WmS+gAbLjCS37T41bkUhkx88
+JU4NsGhjPXcwCgYIKoZIzj0EAwQDaAAwZQIwDrGLSdO+p/1uywkzqzdM/OnZs8bp
+n60uBhUI7EZzDmrouOFeGx+dXYI5yy5AD/qDAjEA7fTQx+jccyOj4dimq1iU9+71
+e/gWYg0rexfy/+9dQY6kvwMzv8Lnm6URaRMbE1Q/
+-----END CERTIFICATE-----

certs/ecc-ca.srl

@@ -0,0 +1 @@
+C050420A8E5A3C1E

certs/ecc-csr.conf

@@ -0,0 +1,22 @@
+[ req ]
+prompt = no
+req_extensions = v3_ext
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+countryName            = US
+stateOrProvinceName    = NYK
+localityName           = NYK
+organizationName       = Ryan4Yin
+organizationalUnitName = Ryan4Yin
+commonName             = writefor.fun # deprecated, use subjectAltName(SAN) instead
+emailAddress           = rayn4yin@linux.com
+
+[ alt_names ]
+DNS.1 = writefor.fun
+DNS.2 = *.writefor.fun
+
+[ v3_ext ]
+subjectAltName=@alt_names
+basicConstraints       = CA:false
+extendedKeyUsage       = serverAuth

certs/ecc-server.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICKTCCAa6gAwIBAgIJAMBQQgqOWjweMAoGCCqGSM49BAMEMB8xHTAbBgNVBAMM
+FFJ5YW40WWluJ3MgUm9vdCBDQSAxMB4XDTI0MDQwMzA4NDgzM1oXDTM0MDQwMTA4
+NDgzM1owgYkxCzAJBgNVBAYTAlVTMQwwCgYDVQQIDANOWUsxDDAKBgNVBAcMA05Z
+SzERMA8GA1UECgwIUnlhbjRZaW4xETAPBgNVBAsMCFJ5YW40WWluMRUwEwYDVQQD
+DAx3cml0ZWZvci5mdW4xITAfBgkqhkiG9w0BCQEWEnJheW40eWluQGxpbnV4LmNv
+bTB2MBAGByqGSM49AgEGBSuBBAAiA2IABCNTYKDq/I99NltQR5eKrrovQXp9BbLV
+iuUdYmzFrAh+NC9ikiIqTfDwP+c+7QvDyI3KXu3KI2qPSPdxktZKDUPHK4p2Y2kZ
+xKOI2IFTgTqV3uBciyx7ayWPTwBYxsTDmqNLMEkwJwYDVR0RBCAwHoIMd3JpdGVm
+b3IuZnVugg4qLndyaXRlZm9yLmZ1bjAJBgNVHRMEAjAAMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMAoGCCqGSM49BAMEA2kAMGYCMQCHw9YkDo15P9mqEObvxSUak8tQmhBB
+9wB81Qg4c+JsMCZA1rMUB7GkNJj1Dr9rWLoCMQDSituLzmo/yPLEOrbNV83bj3/I
+ikKgobSie3pMXm5ZG7krOXaunyFRR/bIkih2V2Q=
+-----END CERTIFICATE-----

certs/gen-certs.sh

@@ -0,0 +1,22 @@
+# 1. Generate the private key for Root CA
+openssl ecparam -genkey -name secp384r1 -out ecc-ca.key
+# 2. Generate the certificate for Root CA with the validity period of 10 years
+# using the private key and some basic information
+# NOTE: we specify sha512 as the signature algorithm, which is the key point
+openssl req -x509 -new -SHA512 -key ecc-ca.key -subj "/CN=Ryan4Yin's Root CA 1" -days 3650 -out ecc-ca.crt
+
+# 3. Generate the private key for web server
+openssl ecparam -genkey -name secp384r1 -out ecc-server.key
+# 4. Generate the certificate signing request (CSR) for the server certificate
+# using the private key and the configuration file ecc-csr.conf
+openssl req -new -SHA512 -key ecc-server.key -out ecc-server.csr -config ecc-csr.conf
+# 5. Sign the server certificate with the Root CA's certificate and private key
+# NOTE: we specify sha512 as the signature algorithm, which is the key point
+openssl x509 -req -SHA512 -in ecc-server.csr -CA ecc-ca.crt -CAkey ecc-ca.key \
+  -CAcreateserial -out ecc-server.crt -days 3650 \
+  -extensions v3_ext -extfile ecc-csr.conf
+
+# 6. Display the information of the certificates
+openssl x509 -noout -text -in ecc-ca.crt
+openssl x509 -noout -text -in ecc-server.crt
+

flake.nix

@@ -1,5 +1,5 @@
 {
-  description = "NixOS & macOS configuration of Ryan Yin";
+  description = "Ryan Yin's nix configuration for both NixOS & macOS";
 
   ##################################################################################################################
   #
@@ -8,25 +8,22 @@
   #
   ##################################################################################################################
 
+  outputs = inputs: import ./outputs inputs;
+
   # the nixConfig here only affects the flake itself, not the system configuration!
+  # for more information, see:
+  #     https://nixos-and-flakes.thiscute.world/nix-store/add-binary-cache-servers
   nixConfig = {
-    experimental-features = ["nix-command" "flakes"];
+    # substituers will be appended to the default substituters when fetching packages
-
-    substituters = [
-      # replace official cache with a mirror located in China
-      "https://mirrors.ustc.edu.cn/nix-channels/store"
-      "https://cache.nixos.org"
-    ];
-
-    # nix community's cache server
     extra-substituters = [
-      "https://nix-community.cachix.org"
+      "https://anyrun.cachix.org"
-      "https://nixpkgs-wayland.cachix.org"
+      # "https://nix-gaming.cachix.org"
+      # "https://nixpkgs-wayland.cachix.org"
     ];
     extra-trusted-public-keys = [
-      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s="
-      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      # "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
-      "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
+      # "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
     ];
   };
 
@@ -36,199 +33,119 @@
     # There are many ways to reference flake inputs. The most widely used is github:owner/name/reference,
     # which represents the GitHub repository URL + branch/commit-id/tag.
 
-    # Official NixOS package source, using nixos's stable branch by default
+    # Official NixOS package source, using nixos's unstable branch by default
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    # nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+
+    nixpkgs-ollama.url = "github:nixos/nixpkgs/nixos-unstable";
 
     # for macos
-    nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-23.05-darwin";
+    # nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-25.05-darwin";
+    nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nix-darwin = {
       url = "github:lnl7/nix-darwin";
       inputs.nixpkgs.follows = "nixpkgs-darwin";
     };
+    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
     # home-manager, used for managing user configuration
     home-manager = {
-      url = "github:nix-community/home-manager/release-23.05";
+      url = "github:nix-community/home-manager/master";
+      # url = "github:nix-community/home-manager/release-25.05";
+
       # The `follows` keyword in inputs is used for inheritance.
       # Here, `inputs.nixpkgs` of home-manager is kept consistent with the `inputs.nixpkgs` of the current flake,
       # to avoid problems caused by different versions of nixpkgs dependencies.
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    # modern window compositor
+    lanzaboote = {
-    hyprland.url = "github:hyprwm/Hyprland/v0.27.2";
+      url = "github:nix-community/lanzaboote/v0.4.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    impermanence.url = "github:nix-community/impermanence";
+
     # community wayland nixpkgs
-    nixpkgs-wayland.url = "github:nix-community/nixpkgs-wayland";
+    # nixpkgs-wayland.url = "github:nix-community/nixpkgs-wayland";
+    # anyrun - a wayland launcher
+    anyrun = {
+      url = "github:Kirottu/anyrun";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     # generate iso/qcow2/docker/... image from nixos configuration
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # secrets management
+    agenix = {
+      # lock with git commit at May 18, 2025
+      url = "github:ryantm/agenix/4835b1dc898959d8547a871ef484930675cb47f1";
+      # replaced with a type-safe reimplementation to get a better error message and less bugs.
+      # url = "github:ryan4yin/ragenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
-    # secrets management, lock with git commit at 2023/7/15
+    nix-gaming.url = "github:fufexan/nix-gaming";
-    agenix.url = "github:ryantm/agenix/0d8c5325fc81daf00532e3e26c6752f7bcde1143";
 
-    # AstroNvim is an aesthetic and feature-rich neovim config.
+    disko = {
-    astronvim = {
+      url = "github:nix-community/disko/v1.11.0";
-      url = "github:AstroNvim/AstroNvim/v3.33.3";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # add git hooks to format nix code before commit
+    pre-commit-hooks = {
+      url = "github:cachix/pre-commit-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nuenv.url = "github:DeterminateSystems/nuenv";
+
+    haumea = {
+      url = "github:nix-community/haumea/v0.2.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nixpak = {
+      url = "github:nixpak/nixpak";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    ghostty = {
+      url = "github:ghostty-org/ghostty";
+    };
+
+    blender-bin.url = "github:edolstra/nix-warez?dir=blender";
+
+    ########################  Some non-flake repositories  #########################################
+
+    polybar-themes = {
+      url = "github:adi1090x/polybar-themes";
       flake = false;
     };
 
+    ########################  My own repositories  #########################################
+
     # my private secrets, it's a private repository, you need to replace it with your own.
     # use ssh protocol to authenticate via ssh-agent/ssh-key, and shallow clone to save time
     mysecrets = {
       url = "git+ssh://git@github.com/ryan4yin/nix-secrets.git?shallow=1";
       flake = false;
     };
-  };
 
-  # The `outputs` function will return all the build results of the flake.
+    # my wallpapers
-  # A flake can have many use cases and different types of outputs,
+    wallpapers = {
-  # parameters in `outputs` are defined in `inputs` and can be referenced by their names.
+      url = "github:ryan4yin/wallpapers";
-  # However, `self` is an exception, this special parameter points to the `outputs` itself (self-reference)
+      flake = false;
-  # The `@` syntax here is used to alias the attribute set of the inputs's parameter, making it convenient to use inside the function.
-  outputs = inputs @ {
-    self,
-    nixpkgs,
-    nixpkgs-unstable,
-    nix-darwin,
-    home-manager,
-    nixos-generators,
-    ...
-  }: let
-    username = "ryan";
-    userfullname = "Ryan Yin";
-    useremail = "xiaoyin_c@qq.com";
-
-    x64_system = "x86_64-linux";
-    x64_darwin = "x86_64-darwin";
-    allSystems = [x64_system x64_darwin];
-
-    nixosSystem = import ./lib/nixosSystem.nix;
-    macosSystem = import ./lib/macosSystem.nix;
-  in {
-    nixosConfigurations = let
-      # 星野 アイ, Hoshino Ai
-      idol_ai_modules_i3 = {
-        nixos-modules = [
-          ./hosts/idols/ai
-          ./modules/nixos/i3.nix
-        ];
-        home-module = import ./home/linux/desktop-i3.nix;
-      };
-      idol_ai_modules_hyprland = {
-        nixos-modules = [
-          ./hosts/idols/ai
-          ./modules/nixos/hyprland.nix
-        ];
-        home-module = import ./home/linux/desktop-hyprland.nix;
-      };
-
-      # 星野 愛久愛海, Hoshino Akuamarin
-      idol_aquamarine_modules = {
-        nixos-modules = [
-          ./hosts/idols/aquamarine
-        ];
-        home-module = import ./home/linux/server.nix;
-      };
-
-      # 星野 瑠美衣, Hoshino Rubii
-      idol_ruby_modules = {
-        nixos-modules = [
-          ./hosts/idols/ruby
-        ];
-        home-module = import ./home/linux/server.nix;
-      };
-
-      # 有馬 かな, Arima Kana
-      idol_kana_modules = {
-        nixos-modules = [
-          ./hosts/idols/kana
-        ];
-        home-module = import ./home/linux/server.nix;
-      };
-
-      system = x64_system;
-      specialArgs =
-        {
-          inherit username userfullname useremail;
-          # use unstable branch for some packages to get the latest updates
-          pkgs-unstable = import nixpkgs-unstable {
-            system = x64_system; # refer the `system` parameter form outer scope recursively
-            # To use chrome, we need to allow the installation of non-free software
-            config.allowUnfree = true;
-          };
-        }
-        // inputs;
-      base_args = {
-        inherit home-manager nixos-generators system specialArgs;
-      };
-      stable_args = base_args // {inherit nixpkgs;};
-      unstable_args = base_args // {nixpkgs = nixpkgs-unstable;};
-    in {
-      # ai with i3 window manager
-      ai_i3 = nixosSystem (idol_ai_modules_i3 // stable_args);
-      # ai with hyprland compositor
-      ai_hyprland = nixosSystem (idol_ai_modules_hyprland // stable_args);
-
-      aquamarine = nixosSystem (idol_aquamarine_modules // stable_args);
-      ruby = nixosSystem (idol_ruby_modules // stable_args);
-      kana = nixosSystem (idol_kana_modules // stable_args);
     };
 
-    # take system images for idols
+    nur-ryan4yin.url = "github:ryan4yin/nur-packages";
-    # https://github.com/nix-community/nixos-generators
-    packages."${x64_system}" =
-      # genAttrs returns an attribute set with the given keys and values(host => image).
-      nixpkgs.lib.genAttrs [
-        "ai_i3"
-        "ai_hyprland"
-      ] (
-        host:
-          self.nixosConfigurations.${host}.config.formats.iso
-      )
-      // nixpkgs.lib.genAttrs [
-        "aquamarine"
-        "ruby"
-        "kana"
-      ] (
-        host:
-          self.nixosConfigurations.${host}.config.formats.proxmox
-      );
 
-    # macOS's configuration, for work.
+    # for waydroid
-    darwinConfigurations = let
+    # nur-ataraxiasjel.url = "github:AtaraxiaSjel/nur";
-      system = x64_darwin;
-      specialArgs =
-        {
-          inherit username userfullname useremail;
-          # use unstable branch for some packages to get the latest updates
-          pkgs-unstable = import nixpkgs-unstable {
-            inherit system; # refer the `system` parameter form outer scope recursively
-            # To use chrome, we need to allow the installation of non-free software
-            config.allowUnfree = true;
-          };
-        }
-        // inputs;
-      base_args = {
-        inherit nix-darwin home-manager system specialArgs;
-      };
-    in {
-      harmonica = macosSystem (base_args // {
-        darwin-modules = [
-          ./hosts/harmonica
-        ];
-        home-module = import ./home/darwin;
-      });
-    };
-
-    # format the nix code in this flake
-    # alejandra is a nix formatter with a beautiful output
-    formatter = nixpkgs.lib.genAttrs allSystems (
-      system:
-        nixpkgs.legacyPackages.${system}.alejandra
-    );
   };
 }

fonts/icomoon-feather-icon-font.nix

@@ -1,42 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  fetchgit,
-}:
-stdenvNoCC.mkDerivation rec {
-  pname = "icomoon-feather-font";
-  version = "2023-05-06";
-
-  # 参考 https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=ttf-icomoon-feather
-  src = fetchgit {
-    url = "https://github.com/adi1090x/polybar-themes.git";
-    rev = "47b66337a92a1afd2240ed7094ffcb039cc686cf"; # git commit id
-    sparseCheckout = ["fonts/feather.ttf"]; # only fetch the feather.ttf file
-
-    # the sha256 is used to verify the integrity of the downloaded source, and alse cache the build result.
-    # so if you copy other package src's sha256, you will get a cached build result of that package, and all configs in this file will be ignored.
-    # specify sha256 to empty and build it, then an error will indicate the correct sha256
-    sha256 = "sha256-R+UpUFkXDrxKcX7ljLara+1B1rOMdKGZiLQq1/ojgP4=";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 fonts/feather.ttf -t $out/share/fonts/truetype/
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/feathericons/feather";
-    description = "Icomoon feather font";
-    version = version;
-    longDescription = ''
-      Feather is a collection of simply beautiful open source icons.
-      Each icon is designed on a 24x24 grid with an emphasis on simplicity, consistency, and flexibility.
-    '';
-    license = licenses.mit;
-    maintainers = [maintainers.ryan4yin];
-    platforms = platforms.all;
-  };
-}

hardening/README.md

@@ -0,0 +1,87 @@
+# Linux Hardening
+
+> Work in progress.
+
+## Goal
+
+- **System Level**: Protect critical files from being accessed by untrusted applications.
+  1. Such as browser cookies, SSH keys, etc.
+- **Per-App Level**: Prevent untrusted applications(such as closed-source apps) from:
+  1.  Accessing files they shouldn't.
+      - Such as a malicious application accessing your browser's cookies, SSH Keys, etc.
+  1.  Accessing the network when they don't need to.
+  1.  Accessing hardware devices they don't need.
+
+## Current Status
+
+1. **System Level**:
+   - [ ] AppArmor
+   - [ ] Kernel & System Hardening
+1. **Per-App Level**:
+   - Nixpak (Bubblewrap)
+     - [x] QQ
+     - [x] Firefox
+   - [ ] Firejail (risk? not enabled yet)
+
+## Kernel Hardening
+
+- NixOS Kernel Config:
+  https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/kernel/hardened/config.nix
+
+## System Hardening
+
+- NixOS Profile:
+  https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/profiles/hardened.nix
+- Apparmor: [roddhjav/apparmor.d)](https://github.com/roddhjav/apparmor.d)
+  - https://gitlab.com/apparmor/apparmor/-/wikis/Documentation
+  - AppArmor.d is a set of over 1500 AppArmor profiles whose aim is to confine most Linux based
+    applications and processes.
+  - Nix Package:
+    [roddhjav-apparmor-rules](https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/ro/roddhjav-apparmor-rules/package.nix#L33)
+  - https://github.com/NixOS/nixpkgs/issues/331645
+  - https://github.com/LordGrimmauld/aa-alias-manager
+- SELinux: too complex, not recommended for personal use.
+
+## Application Sandboxing
+
+- [Firejail](https://github.com/netblue30/firejail/tree/master/etc): A SUID security sandbox with
+  hundreds of security profiles for many common applications in the default installation.
+  - https://wiki.nixos.org/wiki/Firejail
+  - Firejail needs SUID to work, which is considered a security risk -
+    [Does firejail improve the security of my system?](https://github.com/netblue30/firejail/discussions/4601)
+- [Bubblewrap](https://github.com/containers/bubblewrap):
+  [nixpak](https://github.com/nixpak/nixpak), more secure than firejail, but no batteries included.
+  - NixOS's FHSEnv is implemented using bubblewrap by default.
+- [Systemd/Hardening](https://wiki.nixos.org/wiki/Systemd/Hardening): Systemd also provides some
+  sandboxing features.
+
+## NOTE
+
+**Running untrusted code is never safe, kernel hardening & sandboxing cannot change this**.
+
+If you want to run untrusted code, please use a VM & an isolated network environment, which will
+provide a much higher level of security.
+
+## References
+
+- [Harden your NixOS workstation - dataswamp](https://dataswamp.org/~solene/2022-01-13-nixos-hardened.html)
+- [Linux Insecurities - Madaidans](https://madaidans-insecurities.github.io/linux.html)
+- [Sandboxing all programs by default - NixOS Discourse](https://discourse.nixos.org/t/sandboxing-all-programs-by-default/7792)
+- [在 Firejail 中运行 Steam](https://imbearchild.cyou/archives/2021/11/steam-in-firejail/)
+- [Firejail - Arch Linux Wiki](https://wiki.archlinux.org/title/Firejail)
+- [Paranoid NixOS Setup - xeiaso](https://xeiaso.net/blog/paranoid-nixos-2021-07-18/)
+- [nix-mineral](https://github.com/cynicsketch/nix-mineral): NixOS module for convenient system
+  hardening.
+- nixpak configs:
+  - https://github.com/pokon548/OysterOS/tree/b97604d89953373d6316286b96f6a964af2c398d/desktop/application
+  - https://github.com/segment-tree/my-nixos/tree/ceb6041f73bd9edcb78a8818b27a28f7c629193b/hm/me/apps/nixpak
+  - https://github.com/Keksgesicht/nixos-config/tree/91cc77d8d6b598da7c4dbed143e0009c2dea6940/packages/nixpak
+  - https://github.com/bluskript/nix-config/blob/7ecb6a7254c1ac4969072f4c4febdc19f8b83b30/pkgs/nixpak/default.nix
+- firejail configs:
+  - https://github.com/stelcodes/nixos-config/blob/f8967c82a5e5f3d128eb1aaf7498b5f918f719ec/packages/overlay.nix#L261
+- apparmor configs:
+  - https://github.com/sukhmancs/nixos-configs/blob/7fcf737c506ad843113cd5b94796b49d4d4dfad2/modules/shared/security/apparmor/default.nix#L8
+  - https://github.com/zramctl/dotfiles/blob/4fe177f6984154960942bb47d5a375098ec6ed6a/modules/nixos/security/apparmor.nix#L4
+- Others:
+  - Directly via `buildFHSUserEnvBubblewrap`:
+    https://github.com/xddxdd/nur-packages/blob/master/pkgs/uncategorized/wechat-uos/default.nix

hardening/apparmor/default.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.dbus.apparmor = "enabled";
+  security.apparmor = {
+    enable = true;
+
+    # kill process that are not confined but have apparmor profiles enabled
+    killUnconfinedConfinables = true;
+    packages = with pkgs; [
+      apparmor-utils
+      apparmor-profiles
+    ];
+
+    # apparmor policies
+    policies = {
+      "default_deny" = {
+        enforce = false;
+        enable = false;
+        profile = ''
+          profile default_deny /** { }
+        '';
+      };
+
+      "sudo" = {
+        enforce = false;
+        enable = false;
+        profile = ''
+          ${pkgs.sudo}/bin/sudo {
+            file /** rwlkUx,
+          }
+        '';
+      };
+
+      "nix" = {
+        enforce = false;
+        enable = false;
+        profile = ''
+          ${config.nix.package}/bin/nix {
+            unconfined,
+          }
+        '';
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    apparmor-bin-utils
+    apparmor-profiles
+    apparmor-parser
+    libapparmor
+    apparmor-kernel-patches
+    apparmor-pam
+    apparmor-utils
+  ];
+}

hardening/firejail/default.nix

@@ -0,0 +1,71 @@
+{pkgs, ...}: let
+  firejailWrapper = import ./firejailWrapper.nix pkgs;
+in {
+  programs.firejail.enable = true;
+
+  # Add firejailed Apps into nixsuper, and reference them in home-manager or other nixos modules
+  nixpkgs.overlays = [
+    (_: super: {
+      firejailed = {
+        steam = firejailWrapper {
+          name = "steam-firejailed";
+          executable = "${super.steam}/bin/steam";
+          profile = "${super.firejail}/etc/firejail/steam.profile";
+        };
+        steam-run = firejailWrapper {
+          name = "steam-run-firejailed";
+          executable = "${super.steam}/bin/steam-run";
+          profile = "${super.firejail}/etc/firejail/steam.profile";
+        };
+
+        # firefox = firejailWrapper {
+        #   name = "firefox-firejailed";
+        #   executable = "${super.lib.getBin super.firefox-wayland}/bin/firefox";
+        #   profile = "${super.firejail}/etc/firejail/firefox.profile";
+        # };
+        # chromium = firejailWrapper {
+        #   name = "chromium-firejailed";
+        #   executable = "${super.lib.getBin super.ungoogled-chromium}/bin/chromium";
+        #   profile = "${super.firejail}/etc/firejail/chromium.profile";
+        # };
+
+        mpv = firejailWrapper {
+          executable = "${super.lib.getBin super.mpv}/bin/mpv";
+          profile = "${super.firejail}/etc/firejail/mpv.profile";
+        };
+        imv = firejailWrapper {
+          executable = "${super.lib.getBin super.imv}/bin/imv";
+          profile = "${super.firejail}/etc/firejail/imv.profile";
+        };
+        zathura = firejailWrapper {
+          executable = "${super.lib.getBin super.zathura}/bin/zathura";
+          profile = "${super.firejail}/etc/firejail/zathura.profile";
+        };
+        slack = firejailWrapper {
+          executable = "${super.lib.getBin super.slack}/bin/slack";
+          profile = "${super.firejail}/etc/firejail/slack.profile";
+        };
+        telegram-desktop = firejailWrapper {
+          executable = "${super.lib.getBin super.tdesktop}/bin/telegram-desktop";
+          profile = "${super.firejail}/etc/firejail/telegram-desktop.profile";
+        };
+        brave = firejailWrapper {
+          executable = "${super.lib.getBin super.brave}/bin/brave";
+          profile = "${super.firejail}/etc/firejail/brave.profile";
+        };
+        qutebrowser = firejailWrapper {
+          executable = "${super.lib.getBin super.qutebrowser}/bin/qutebrowser";
+          profile = "${super.firejail}/etc/firejail/qutebrowser.profile";
+        };
+        thunar = firejailWrapper {
+          executable = "${super.lib.getBin super.xfce.thunar}/bin/thunar";
+          profile = "${super.firejail}/etc/firejail/thunar.profile";
+        };
+        vscodium = firejailWrapper {
+          executable = "${super.lib.getBin super.vscodium}/bin/vscodium";
+          profile = "${super.firejail}/etc/firejail/vscodium.profile";
+        };
+      };
+    })
+  ];
+}

hardening/firejail/firejailWrapper.nix

@@ -0,0 +1,35 @@
+# https://www.reddit.com/r/NixOS/comments/1b56jdx/simple_nix_function_for_wrapping_executables_with/
+pkgs: {
+  name ? "firejail-wrapper",
+  executable,
+  desktop ? null,
+  profile ? null,
+  extraArgs ? [],
+}:
+pkgs.runCommand name
+{
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+  meta.priority = -1; # take precedence over non-firejailed versions
+}
+(
+  let
+    firejailArgs = pkgs.lib.concatStringsSep " " (
+      extraArgs ++ (pkgs.lib.optional (profile != null) "--profile=${toString profile}")
+    );
+  in
+    ''
+      command_path="$out/bin/$(basename ${executable})-jailed"
+      mkdir -p $out/bin
+      mkdir -p $out/share/applications
+      cat <<'_EOF' >"$command_path"
+      #! ${pkgs.runtimeShell} -e
+      exec /run/wrappers/bin/firejail ${firejailArgs} -- ${toString executable} "\$@"
+      _EOF
+      chmod 0755 "$command_path"
+    ''
+    + pkgs.lib.optionalString (desktop != null) ''
+      substitute ${desktop} $out/share/applications/$(basename ${desktop}) \
+        --replace ${executable} "$command_path"
+    ''
+)

hardening/nixpaks/default.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  nixpak,
+  ...
+}: let
+  callArgs = {
+    mkNixPak = nixpak.lib.nixpak {
+      inherit (pkgs) lib;
+      inherit pkgs;
+    };
+    safeBind = sloth: realdir: mapdir: [
+      (sloth.mkdir (sloth.concat' sloth.appDataDir realdir))
+      (sloth.concat' sloth.homeDir mapdir)
+    ];
+  };
+  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs).config.script;
+in {
+  # Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
+  nixpkgs.overlays = [
+    (_: super: {
+      nixpaks = {
+        qq = wrapper super ./qq.nix;
+        qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
+
+        wechat-uos = wrapper super ./wechat-uos.nix;
+        wechat-uos-desktop-item = super.callPackage ./wechat-uos-desktop-item.nix {};
+
+        firefox = wrapper super ./firefox.nix;
+        firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
+      };
+    })
+  ];
+}

hardening/nixpaks/firefox-desktop-item.nix

@@ -0,0 +1,11 @@
+{makeDesktopItem}:
+makeDesktopItem {
+  name = "firefox";
+  desktopName = "firefox";
+  exec = "firefox %U";
+  terminal = false;
+  icon = "firefox";
+  type = "Application";
+  categories = ["Network"];
+  comment = "firefox boxed";
+}

hardening/nixpaks/firefox.nix

@@ -0,0 +1,76 @@
+# Refer:
+# - Flatpak manifest's docs:
+#   - https://docs.flatpak.org/en/latest/manifests.html
+#   - https://docs.flatpak.org/en/latest/sandbox-permissions.html
+# - Firefox's flatpak manifest: https://hg.mozilla.org/mozilla-central/file/tip/taskcluster/docker/firefox-flatpak/runme.sh#l151
+{
+  lib,
+  pkgs,
+  mkNixPak,
+  ...
+}:
+mkNixPak {
+  config = {
+    config,
+    sloth,
+    ...
+  }: {
+    app = {
+      package = pkgs.firefox-wayland;
+      binPath = "bin/firefox";
+    };
+    flatpak.appId = "org.mozilla.firefox";
+
+    imports = [
+      ./modules/gui-base.nix
+      ./modules/network.nix
+    ];
+
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus.policies = {
+      "org.mozilla.firefox.*" = "own"; # firefox
+      "org.mozilla.firefox_beta.*" = "own"; # firefox beta
+      "org.mpris.MediaPlayer2.firefox.*" = "own";
+      "org.freedesktop.NetworkManager" = "talk";
+    };
+
+    bubblewrap = {
+      # To trace all the home files QQ accesses, you can use the following nushell command:
+      #   just trace-access firefox
+      # See the Justfile in the root of this repository for more information.
+      bind.rw = [
+        # given the read write permission to the following directories.
+        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+        (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
+
+        # ================ for externsions ===============================
+        # required by https://github.com/browserpass/browserpass-extension
+        (sloth.concat' sloth.homeDir "/.local/share/password-store") # pass
+        sloth.xdgDownloadDir
+        sloth.xdgDocumentsDir
+      ];
+      bind.ro = [
+        # To actually make Firefox run
+        "/sys/bus/pci"
+        ["${config.app.package}/lib/firefox" "/app/etc/firefox"]
+
+        # Unsure
+        (sloth.concat' sloth.xdgConfigHome "/dconf")
+      ];
+
+      sockets = {
+        x11 = false;
+        wayland = true;
+        pipewire = true;
+      };
+      bind.dev = [
+        "/dev/shm" # Shared Memory
+      ];
+      tmpfs = [
+        "/tmp"
+      ];
+    };
+  };
+}

hardening/nixpaks/modules/gui-base.nix

@@ -0,0 +1,95 @@
+# https://github.com/nixpak/pkgs/blob/master/pkgs/modules/gui-base.nix
+{
+  config,
+  lib,
+  pkgs,
+  sloth,
+  ...
+}: let
+  envSuffix = envKey: suffix: sloth.concat' (sloth.env envKey) suffix;
+  # cursor & icon's theme should be the same as the host's one.
+  cursorTheme = pkgs.bibata-cursors;
+  iconTheme = pkgs.papirus-icon-theme;
+in {
+  config = {
+    dbus.policies = {
+      "${config.flatpak.appId}" = "own";
+      "org.freedesktop.DBus" = "talk";
+      "org.gtk.vfs.*" = "talk";
+      "org.gtk.vfs" = "talk";
+      "ca.desrt.dconf" = "talk";
+      "org.freedesktop.portal.*" = "talk";
+      "org.a11y.Bus" = "talk";
+    };
+    # https://github.com/nixpak/nixpak/blob/master/modules/gpu.nix
+    # 1. bind readonly - /run/opengl-driver
+    # 2. bind device   - /dev/dri
+    gpu = {
+      enable = lib.mkDefault true;
+      provider = "nixos";
+      bundlePackage = pkgs.mesa.drivers; # for amd & intel
+    };
+    # https://github.com/nixpak/nixpak/blob/master/modules/gui/fonts.nix
+    # it works not well, bind system's /etc/fonts directly instead
+    fonts.enable = false;
+    # https://github.com/nixpak/nixpak/blob/master/modules/locale.nix
+    locale.enable = true;
+    bubblewrap = {
+      network = lib.mkDefault false;
+      bind.rw = [
+        [
+          (envSuffix "HOME" "/.var/app/${config.flatpak.appId}/cache")
+          sloth.xdgCacheHome
+        ]
+        (sloth.concat' sloth.xdgCacheHome "/fontconfig")
+        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache")
+
+        (sloth.concat [
+          (sloth.env "XDG_RUNTIME_DIR")
+          "/"
+          (sloth.envOr "WAYLAND_DISPLAY" "no")
+        ])
+
+        (envSuffix "XDG_RUNTIME_DIR" "/at-spi/bus")
+        (envSuffix "XDG_RUNTIME_DIR" "/gvfsd")
+        (envSuffix "XDG_RUNTIME_DIR" "/pulse")
+
+        "/run/dbus"
+      ];
+      bind.ro = [
+        (envSuffix "XDG_RUNTIME_DIR" "/doc")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
+        (sloth.concat' sloth.xdgConfigHome "/fontconfig")
+
+        "/etc/fonts" # for fontconfig
+        "/etc/machine-id"
+        "/etc/localtime"
+
+        # Fix: libEGL warning: egl: failed to create dri2 screen
+        "/etc/egl"
+        "/etc/static/egl"
+      ];
+      bind.dev = [
+        # seems required when using nvidia as primary gpu
+        "/dev/nvidia0"
+        "/dev/nvidiactl"
+        "/dev/nvidia-modeset"
+        "/dev/nvidia-uvm"
+      ];
+
+      env = {
+        XDG_DATA_DIRS = lib.mkForce (lib.makeSearchPath "share" [
+          iconTheme
+          cursorTheme
+          pkgs.shared-mime-info
+        ]);
+        XCURSOR_PATH = lib.mkForce (lib.concatStringsSep ":" [
+          "${cursorTheme}/share/icons"
+          "${cursorTheme}/share/pixmaps"
+        ]);
+      };
+    };
+  };
+}

hardening/nixpaks/modules/network.nix

@@ -0,0 +1,8 @@
+# https://github.com/nixpak/pkgs/blob/master/pkgs/modules/network.nix
+{
+  etc.sslCertificates.enable = true;
+  bubblewrap = {
+    bind.ro = ["/etc/resolv.conf"];
+    network = true;
+  };
+}

hardening/nixpaks/qq-desktop-item.nix

@@ -0,0 +1,17 @@
+{
+  makeDesktopItem,
+  qq,
+}:
+makeDesktopItem {
+  name = "qq";
+  desktopName = "QQ";
+  exec = "qq %U";
+  terminal = false;
+  # To find the icon name(nushell):
+  #   let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"'
+  #   tree $"($p)/share/icons"
+  icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
+  type = "Application";
+  categories = ["Network"];
+  comment = "QQ boxed";
+}

hardening/nixpaks/qq.nix

@@ -0,0 +1,60 @@
+# Refer:
+# - Flatpak manifest's docs:
+#   - https://docs.flatpak.org/en/latest/manifests.html
+#   - https://docs.flatpak.org/en/latest/sandbox-permissions.html
+# - QQ's flatpak manifest: https://github.com/flathub/com.qq.QQ/blob/master/com.qq.QQ.yaml
+{
+  lib,
+  pkgs,
+  mkNixPak,
+  ...
+}:
+mkNixPak {
+  config = {sloth, ...}: {
+    app = {
+      package = pkgs.qq.override {
+        # fix fcitx5 input method
+        commandLineArgs = lib.concatStringsSep " " ["--enable-wayland-ime"];
+      };
+      binPath = "bin/qq";
+    };
+    flatpak.appId = "com.tencent.qq";
+
+    imports = [
+      ./modules/gui-base.nix
+      ./modules/network.nix
+    ];
+
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus.policies = {
+      "org.gnome.Shell.Screencast" = "talk";
+      "org.freedesktop.Notifications" = "talk";
+      "org.kde.StatusNotifierWatcher" = "talk";
+    };
+    bubblewrap = {
+      # To trace all the home files QQ accesses, you can use the following nushell command:
+      #   just trace-access qq
+      # See the Justfile in the root of this repository for more information.
+      bind.rw = [
+        # given the read write permission to the following directories.
+        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+        (sloth.mkdir (sloth.concat [sloth.xdgConfigHome "/QQ"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/QQ"]))
+        sloth.xdgDownloadDir
+      ];
+      sockets = {
+        x11 = false;
+        wayland = true;
+        pipewire = true;
+      };
+      bind.dev = [
+        "/dev/shm" # Shared Memory
+      ];
+      tmpfs = [
+        "/tmp"
+      ];
+    };
+  };
+}

hardening/nixpaks/wechat-uos-desktop-item.nix

@@ -0,0 +1,17 @@
+{
+  makeDesktopItem,
+  wechat-uos,
+}:
+makeDesktopItem {
+  name = "wechat";
+  desktopName = "WeChat";
+  exec = "wechat-uos %U";
+  terminal = false;
+  # To find the icon name(nushell):
+  #   let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#wechat-uos.outPath | str trim --char '"'
+  #   tree $"($p)/share/icons"
+  icon = "${wechat-uos}/share/icons/hicolor/256x256/apps/com.tencent.wechat.png";
+  type = "Application";
+  categories = ["Network"];
+  comment = "Wechat boxed";
+}

hardening/nixpaks/wechat-uos.nix

@@ -0,0 +1,73 @@
+# TODO: wechat-uos is running in FHS sandbox by default, it's problematic
+#   to wrap it again via flatpak. We need to find a way to fix it.
+#   https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat-uos/package.nix
+# Refer:
+# - Flatpak manifest's docs:
+#   - https://docs.flatpak.org/en/latest/manifests.html
+#   - https://docs.flatpak.org/en/latest/sandbox-permissions.html
+# - wechat-uos's flatpak manifest: https://github.com/flathub/com.tencent.WeChat/blob/master/com.tencent.WeChat.yaml
+{
+  lib,
+  pkgs,
+  mkNixPak,
+  ...
+}:
+mkNixPak {
+  config = {sloth, ...}: {
+    app = {
+      package = pkgs.wechat-uos;
+      binPath = "bin/wechat-uos";
+    };
+    flatpak.appId = "com.tencent.WeChat";
+
+    imports = [
+      ./modules/gui-base.nix
+      ./modules/network.nix
+    ];
+
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus.policies = {
+      "org.gnome.Shell.Screencast" = "talk";
+      # System tray icon
+      "org.freedesktop.Notifications" = "talk";
+      "org.kde.StatusNotifierWatcher" = "talk";
+      # File Manager
+      "org.freedesktop.FileManager1" = "talk";
+      # Uses legacy StatusNotifier implementation
+      "org.kde.*" = "own";
+    };
+    bubblewrap = {
+      # To trace all the home files QQ accesses, you can use the following nushell command:
+      #   just trace-access wechat-uos
+      # See the Justfile in the root of this repository for more information.
+      bind.rw = [
+        # given the read write permission to the following directories.
+        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+        (sloth.mkdir (sloth.concat [sloth.homeDir "/.xwechat"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/xwechat_files"]))
+        (sloth.mkdir (sloth.concat [sloth.xdgDocumentsDir "/WeChat_Data/"]))
+        sloth.xdgDownloadDir
+      ];
+      sockets = {
+        x11 = false;
+        wayland = true;
+        pipewire = true;
+      };
+      bind.dev = [
+        "/dev/shm" # Shared Memory
+      ];
+      tmpfs = [
+        "/tmp"
+      ];
+
+      env = {
+        # Hidpi scale
+        "QT_AUTO_SCREEN_SCALE_FACTOR" = "1";
+        # Only supports xcb
+        "QT_QPA_PLATFORM" = "kcb";
+      };
+    };
+  };
+}

hardening/profiles/default.nix

@@ -0,0 +1,9 @@
+{modulesPath, ...}: {
+  imports = [
+    (modulesPath + "/profiles/hardened.nix")
+  ];
+
+  # disable coredump that could be exploited later
+  # and also slow down the system when something crash
+  systemd.coredump.enable = false;
+}

home/README.md

@@ -0,0 +1,5 @@
+# Home Manager's Submodules
+
+1. `base`: The base module that is suitable for both Linux and macOS.
+2. `linux`: Linux-specific configuration.
+3. `darwin`: macOS-specific configuration.

home/base/README.md

@@ -0,0 +1,5 @@
+# Home Manager's Base Submodules
+
+1. `server`: Configuration which is suitable for both servers and desktops.
+1. `desktop`: Configuration for desktop environments, such as Hyprland, I3, etc.
+1. `core.nix`: Minimal home-manager's config

home/base/core/btop.nix

@@ -0,0 +1,17 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  # https://github.com/catppuccin/btop/blob/main/themes/catppuccin_mocha.theme
+  xdg.configFile."btop/themes".source = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-btop}/themes";
+
+  # replacement of htop/nmon
+  programs.btop = {
+    enable = true;
+    settings = {
+      color_theme = "catppuccin_mocha";
+      theme_background = false; # make btop transparent
+    };
+  };
+}

home/base/core/core.nix

@@ -0,0 +1,155 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  home.packages = with pkgs; [
+    # Misc
+    cowsay
+    gnupg
+    gnumake
+
+    # Modern cli tools, replacement of grep/sed/...
+
+    # Interactively filter its input using fuzzy searching, not limit to filenames.
+    fzf
+    # search for files by name, faster than find
+    fd
+    # search for files by its content, replacement of grep
+    (ripgrep.override {withPCRE2 = true;})
+
+    # A fast and polyglot tool for code searching, linting, rewriting at large scale
+    # supported languages: only some mainstream languages currently(do not support nix/nginx/yaml/toml/...)
+    ast-grep
+
+    sad # CLI search and replace, just like sed, but with diff preview.
+    yq-go # yaml processor https://github.com/mikefarah/yq
+    just # a command runner like make, but simpler
+    delta # A viewer for git and diff output
+    lazygit # Git terminal UI.
+    hyperfine # command-line benchmarking tool
+    gping # ping, but with a graph(TUI)
+    doggo # DNS client for humans
+    duf # Disk Usage/Free Utility - a better 'df' alternative
+    du-dust # A more intuitive version of `du` in rust
+    gdu # disk usage analyzer(replacement of `du`)
+
+    # nix related
+    #
+    # it provides the command `nom` works just like `nix
+    # with more details log output
+    nix-output-monitor
+    hydra-check # check hydra(nix's build farm) for the build status of a package
+    nix-index # A small utility to index nix store paths
+    nix-init # generate nix derivation from url
+    # https://github.com/nix-community/nix-melt
+    nix-melt # A TUI flake.lock viewer
+    # https://github.com/utdemir/nix-tree
+    nix-tree # A TUI to visualize the dependency graph of a nix derivation
+
+    # productivity
+    caddy # A webserver with automatic HTTPS via Let's Encrypt(replacement of nginx)
+    croc # File transfer between computers securely and easily
+    ncdu # analyzer your disk usage Interactively, via TUI(replacement of `du`)
+  ];
+
+  programs = {
+    # A modern replacement for ‘ls’
+    # useful in bash/zsh prompt, not in nushell.
+    eza = {
+      enable = true;
+      # do not enable aliases in nushell!
+      enableNushellIntegration = false;
+      git = true;
+      icons = "auto";
+    };
+
+    # a cat(1) clone with syntax highlighting and Git integration.
+    bat = {
+      enable = true;
+      config = {
+        pager = "less -FR";
+        theme = "catppuccin-mocha";
+      };
+      themes = {
+        # https://raw.githubusercontent.com/catppuccin/bat/main/Catppuccin-mocha.tmTheme
+        catppuccin-mocha = {
+          src = nur-ryan4yin.packages.${pkgs.system}.catppuccin-bat;
+          file = "Catppuccin-mocha.tmTheme";
+        };
+      };
+    };
+
+    # A command-line fuzzy finder
+    fzf = {
+      enable = true;
+      # https://github.com/catppuccin/fzf
+      # catppuccin-mocha
+      colors = {
+        "bg+" = "#313244";
+        "bg" = "#1e1e2e";
+        "spinner" = "#f5e0dc";
+        "hl" = "#f38ba8";
+        "fg" = "#cdd6f4";
+        "header" = "#f38ba8";
+        "info" = "#cba6f7";
+        "pointer" = "#f5e0dc";
+        "marker" = "#f5e0dc";
+        "fg+" = "#cdd6f4";
+        "prompt" = "#cba6f7";
+        "hl+" = "#f38ba8";
+      };
+    };
+
+    # very fast version of tldr in Rust
+    tealdeer = {
+      enable = true;
+      enableAutoUpdates = true;
+      settings = {
+        display = {
+          compact = false;
+          use_pager = true;
+        };
+        updates = {
+          auto_update = false;
+          auto_update_interval_hours = 720;
+        };
+      };
+    };
+
+    # zoxide is a smarter cd command, inspired by z and autojump.
+    # It remembers which directories you use most frequently,
+    # so you can "jump" to them in just a few keystrokes.
+    # zoxide works on all major shells.
+    #
+    #   z foo              # cd into highest ranked directory matching foo
+    #   z foo bar          # cd into highest ranked directory matching foo and bar
+    #   z foo /            # cd into a subdirectory starting with foo
+    #
+    #   z ~/foo            # z also works like a regular cd command
+    #   z foo/             # cd into relative path
+    #   z ..               # cd one level up
+    #   z -                # cd into previous directory
+    #
+    #   zi foo             # cd with interactive selection (using fzf)
+    #
+    #   z foo<SPACE><TAB>  # show interactive completions (zoxide v0.8.0+, bash 4.4+/fish/zsh only)
+    zoxide = {
+      enable = true;
+      enableBashIntegration = true;
+      enableZshIntegration = true;
+      enableNushellIntegration = true;
+    };
+
+    # Atuin replaces your existing shell history with a SQLite database,
+    # and records additional context for your commands.
+    # Additionally, it provides optional and fully encrypted
+    # synchronisation of your history between machines, via an Atuin server.
+    atuin = {
+      enable = true;
+      enableBashIntegration = true;
+      enableZshIntegration = true;
+      enableNushellIntegration = true;
+    };
+  };
+}

home/base/core/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/core/editors/README.md

@@ -0,0 +1,3 @@
+# Editors
+
+See [desktop/editors/](../../desktop/editors/) for more details.

home/base/core/editors/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/core/editors/helix/default.nix

@@ -0,0 +1,5 @@
+{pkgs, ...}: {
+  programs.helix = {
+    enable = true;
+  };
+}

home/base/core/editors/neovim/default.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  programs = {
+    neovim = {
+      enable = true;
+
+      viAlias = true;
+      vimAlias = true;
+    };
+  };
+}

home/base/core/git.nix

@@ -0,0 +1,99 @@
+{
+  config,
+  lib,
+  pkgs,
+  myvars,
+  ...
+}: {
+  # `programs.git` will generate the config file: ~/.config/git/config
+  # to make git use this config file, `~/.gitconfig` should not exist!
+  #
+  #    https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
+  home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
+    rm -f ${config.home.homeDirectory}/.gitconfig
+  '';
+
+  home.packages = with pkgs; [
+  ];
+
+  programs.git = {
+    enable = true;
+    lfs.enable = true;
+
+    userName = myvars.userfullname;
+    userEmail = myvars.useremail;
+
+    includes = [
+      {
+        # use different email & name for work
+        path = "~/work/.gitconfig";
+        condition = "gitdir:~/work/";
+      }
+    ];
+
+    extraConfig = {
+      init.defaultBranch = "main";
+      trim.bases = "develop,master,main"; # for git-trim
+      push.autoSetupRemote = true;
+      pull.rebase = true;
+
+      # replace https with ssh
+      url = {
+        "ssh://git@github.com/ryan4yin" = {
+          insteadOf = "https://github.com/ryan4yin";
+        };
+        # "ssh://git@gitlab.com/" = {
+        #   insteadOf = "https://gitlab.com/";
+        # };
+        # "ssh://git@bitbucket.com/" = {
+        #   insteadOf = "https://bitbucket.com/";
+        # };
+      };
+    };
+
+    # signing = {
+    #   key = "xxx";
+    #   signByDefault = true;
+    # };
+
+    # A syntax-highlighting pager in Rust(2019 ~ Now)
+    delta = {
+      enable = true;
+      options = {
+        diff-so-fancy = true;
+        line-numbers = true;
+        true-color = "always";
+        # features => named groups of settings, used to keep related settings organized
+        # features = "";
+      };
+    };
+
+    aliases = {
+      # common aliases
+      br = "branch";
+      co = "checkout";
+      st = "status";
+      ls = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate";
+      ll = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate --numstat";
+      cm = "commit -m"; # commit via `git cm <message>`
+      ca = "commit -am"; # commit all changes via `git ca <message>`
+      dc = "diff --cached";
+
+      amend = "commit --amend -m"; # amend commit message via `git amend <message>`
+      unstage = "reset HEAD --"; # unstage file via `git unstage <file>`
+      merged = "branch --merged"; # list merged(into HEAD) branches via `git merged`
+      unmerged = "branch --no-merged"; # list unmerged(into HEAD) branches via `git unmerged`
+      nonexist = "remote prune origin --dry-run"; # list non-exist(remote) branches via `git nonexist`
+
+      # delete merged branches except master & dev & staging
+      #  `!` indicates it's a shell script, not a git subcommand
+      delmerged = ''! git branch --merged | egrep -v "(^\*|main|master|dev|staging)" | xargs git branch -d'';
+      # delete non-exist(remote) branches
+      delnonexist = "remote prune origin";
+
+      # aliases for submodule
+      update = "submodule update --init --recursive";
+      foreach = "submodule foreach";
+    };
+  };
+}

home/base/core/pip.nix

@@ -0,0 +1,19 @@
+_: {
+  # use mirror for pip install
+  xdg.configFile."pip/pip.conf".text = ''
+    [global]
+    index-url = https://mirror.nju.edu.cn/pypi/web/simple
+    format = columns
+  '';
+
+  # xdg.configFile."pip/pip.conf".text = ''
+  #   [global]
+  #   index-url = https://mirror.nju.edu.cn/pypi/web/simple
+  #   format = columns
+  # '';
+
+  # xdg.configFile."pip/pip.conf".text = ''
+  #   [global]
+  #   index-url = https://mirrors.bfsu.edu.cn/pypi/web/simple
+  # '';
+}

home/base/core/shells/config.nu

@@ -0,0 +1,170 @@
+# Nushell Config File Documentation
+#
+# Warning: This file is intended for documentation purposes only and
+# is not intended to be used as an actual configuration file as-is.
+#
+# version = "0.103.0"
+#
+# A `config.nu` file is used to override default Nushell settings,
+# define (or import) custom commands, or run any other startup tasks.
+# See https://www.nushell.sh/book/configuration.html
+#
+# Nushell sets "sensible defaults" for most configuration settings, so
+# the user's `config.nu` only needs to override these defaults if
+# desired.
+#
+# This file serves as simple "in-shell" documentation for these
+# settings, or you can view a more complete discussion online at:
+# https://nushell.sh/book/configuration
+#
+# You can pretty-print and page this file using:
+# config nu --doc | nu-highlight | less -R
+
+# $env.config
+# -----------
+# The $env.config environment variable is a record containing most Nushell
+# configuration settings. Keep in mind that, as a record, setting it to a
+# new record will remove any keys which aren't in the new record. Nushell
+# will then automatically merge in the internal defaults for missing keys.
+#
+# The same holds true for keys in the $env.config which are also records
+# or lists.
+#
+# For this reason, settings are typically changed by updating the value of
+# a particular key. Merging a new config record is also possible. See the
+# Configuration chapter of the book for more information.
+
+
+$env.config.history.file_format = "sqlite"
+$env.config.history.max_size = 5_000_000
+
+# isolation (bool):
+# `true`: New history from other currently-open Nushell sessions is not
+# seen when scrolling through the history using PrevHistory (typically
+# the Up key) or NextHistory (Down key)
+# `false`: All commands entered in other Nushell sessions will be mixed with
+# those from the current shell.
+# Note: Older history items (from before the current shell was started) are
+# always shown.
+# This setting only applies to SQLite-backed history
+$env.config.history.isolation = true
+
+# ----------------------
+# Miscellaneous Settings
+# ----------------------
+
+# show_banner (bool): Enable or disable the welcome banner at startup
+$env.config.show_banner = false
+
+# rm.always_trash (bool):
+# true: rm behaves as if the --trash/-t option is specified
+# false: rm behaves as if the --permanent/-p option is specified (default)
+$env.config.rm.always_trash = true
+
+# recursion_limit (int): how many times a command can call itself recursively
+# before an error will be generated.
+$env.config.recursion_limit = 50
+
+# ---------------------------
+# Commandline Editor Settings
+# ---------------------------
+
+# edit_mode (string) "vi" or "emacs" sets the editing behavior of Reedline
+$env.config.edit_mode = "vi"
+
+# Command that will be used to edit the current line buffer with Ctrl+O.
+# If unset, uses $env.VISUAL and then $env.EDITOR
+#
+$env.config.buffer_editor = ["nvim", "--clean"]
+
+# cursor_shape_* (string)
+# -----------------------
+# The following variables accept a string from the following selections:
+# "block", "underscore", "line", "blink_block", "blink_underscore", "blink_line", or "inherit"
+# "inherit" skips setting cursor shape and uses the current terminal setting.
+$env.config.cursor_shape.emacs = "inherit"         # Cursor shape in emacs mode
+$env.config.cursor_shape.vi_insert = "block"       # Cursor shape in vi-insert mode
+$env.config.cursor_shape.vi_normal = "underscore"  # Cursor shape in normal vi mode
+
+# --------------------
+# Terminal Integration
+# --------------------
+# Nushell can output a number of escape codes to enable advanced features in Terminal Emulators
+# that support them. Settings in this section enable or disable these features in Nushell.
+# Features aren't supported by your Terminal can be disabled. Features can also be disabled,
+#  of course, if there is a conflict between the Nushell and Terminal's implementation.
+
+# use_kitty_protocol (bool):
+# A keyboard enhancement protocol supported by the Kitty Terminal. Additional keybindings are
+# available when using this protocol in a supported terminal. For example, without this protocol,
+# Ctrl+I is interpreted as the Tab Key. With this protocol, Ctrl+I and Tab can be mapped separately.
+$env.config.use_kitty_protocol = false
+
+# osc2 (bool):
+# When true, the current directory and running command are shown in the terminal tab/window title.
+# Also abbreviates the directory name by prepending ~ to the home directory and its subdirectories.
+$env.config.shell_integration.osc2 = true
+
+# osc7 (bool):
+# Nushell will report the current directory to the terminal using OSC 7. This is useful when
+# spawning new tabs in the same directory.
+$env.config.shell_integration.osc7 = true
+
+# osc9_9 (bool):
+# Enables/Disables OSC 9;9 support, originally a ConEmu terminal feature. This is an
+# alternative to OSC 7 which also communicates the current path to the terminal.
+$env.config.shell_integration.osc9_9 = false
+
+# osc8 (bool):
+# When true, the `ls` command will generate clickable links that can be launched in another
+# application by the terminal.
+# Note: This setting replaces the now deprecated `ls.clickable_links`
+$env.config.shell_integration.osc8 = true
+
+# osc133 (bool):
+# true/false to enable/disable OSC 133 support, a set of several escape sequences which
+# report the (1) starting location of the prompt, (2) ending location of the prompt,
+# (3) starting location of the command output, and (4) the exit code of the command.
+
+# originating with Final Term. These sequences report information regarding the prompt
+# location as well as command status to the terminal. This enables advanced features in
+# some terminals, including the ability to provide separate background colors for the
+# command vs. the output, collapsible output, or keybindings to scroll between prompts.
+$env.config.shell_integration.osc133 = true
+
+# osc633 (bool):
+# true/false to enable/disable OSC 633, an extension to OSC 133 for Visual Studio Code
+$env.config.shell_integration.osc633 = true
+
+# NU_LIB_DIRS
+# -----------
+# Directories in this constant are searched by the
+# `use` and `source` commands.
+#
+# By default, the `scripts` subdirectory of the default configuration
+# directory is included:
+const NU_LIB_DIRS = [
+    ($nu.default-config-dir | path join 'scripts') # add <nushell-config-dir>/scripts
+    ($nu.data-dir | path join 'completions') # default home for nushell completions
+]
+
+# NU_PLUGIN_DIRS
+# --------------
+# Directories to search for plugin binaries when calling add.
+
+# By default, the `plugins` subdirectory of the default configuration
+# directory is included:
+const NU_PLUGIN_DIRS = [
+    ($nu.default-config-dir | path join 'plugins') # add <nushell-config-dir>/plugins
+]
+
+# As with NU_LIB_DIRS, an $env.NU_PLUGIN_DIRS is searched after the constant version
+
+# The `path add` function from the Standard Library also provides
+# a convenience method for prepending to the path:
+use std/util "path add"
+path add "~/.local/bin"
+
+# You can remove duplicate directories from the path using:
+$env.PATH = ($env.PATH | uniq)
+

home/base/core/shells/default.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  pkgs-unstable,
+  ...
+}: let
+  shellAliases = {
+    k = "kubectl";
+
+    urldecode = "python3 -c 'import sys, urllib.parse as ul; print(ul.unquote_plus(sys.stdin.read()))'";
+    urlencode = "python3 -c 'import sys, urllib.parse as ul; print(ul.quote_plus(sys.stdin.read()))'";
+  };
+
+  localBin = "${config.home.homeDirectory}/.local/bin";
+  goBin = "${config.home.homeDirectory}/go/bin";
+  rustBin = "${config.home.homeDirectory}/.cargo/bin";
+in {
+  # only works in bash/zsh, not nushell
+  home.shellAliases = shellAliases;
+
+  programs.nushell = {
+    enable = true;
+    package = pkgs-unstable.nushell;
+    configFile.source = ./config.nu;
+    inherit shellAliases;
+  };
+
+  programs.bash = {
+    enable = true;
+    enableCompletion = true;
+    bashrcExtra = ''
+      export PATH="$PATH:${localBin}:${goBin}:${rustBin}"
+    '';
+  };
+}

home/base/core/starship.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  nur-ryan4yin,
+  ...
+}: {
+  programs.starship = {
+    enable = true;
+
+    enableBashIntegration = true;
+    enableZshIntegration = true;
+    enableNushellIntegration = true;
+
+    settings =
+      {
+        character = {
+          success_symbol = "[›](bold green)";
+          error_symbol = "[›](bold red)";
+        };
+        aws = {
+          symbol = "🅰 ";
+        };
+        gcloud = {
+          # do not show the account/project's info
+          # to avoid the leak of sensitive information when sharing the terminal
+          format = "on [$symbol$active(\($region\))]($style) ";
+          symbol = "🅶 ️";
+        };
+
+        palette = "catppuccin_mocha";
+      }
+      // builtins.fromTOML (builtins.readFile "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-starship}/palettes/mocha.toml");
+  };
+}

home/base/core/yazi.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  pkgs-unstable,
+  nur-ryan4yin,
+  ...
+}: {
+  # terminal file manager
+  programs.yazi = {
+    enable = true;
+    package = pkgs-unstable.yazi;
+    # Changing working directory when exiting Yazi
+    enableBashIntegration = true;
+    enableNushellIntegration = true;
+    settings = {
+      manager = {
+        show_hidden = true;
+        sort_dir_first = true;
+      };
+    };
+  };
+
+  xdg.configFile."yazi/theme.toml".source = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-yazi}/mocha.toml";
+}

home/base/core/zellij/default.nix

@@ -0,0 +1,12 @@
+let
+  shellAliases = {
+    "zj" = "zellij";
+  };
+in {
+  programs.zellij = {
+    enable = true;
+  };
+  # only works in bash/zsh, not nushell
+  home.shellAliases = shellAliases;
+  programs.nushell.shellAliases = shellAliases;
+}

home/base/desktop/alacritty/default.nix

@@ -1,100 +0,0 @@
-{pkgs, ...}:
-###########################################################
-#
-# Alacritty Configuration
-#
-# Useful Hot Keys for macOS:
-#   1. Multi-Window: `command + N`
-#   2. Increase Font Size: `command + =` | `command + +`
-#   3. Decrease Font Size: `command + -` | `command + _`
-#   4. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
-#
-# Useful Hot Keys for Linux:
-#   1. Increase Font Size: `ctrl + shift + =` | `ctrl + shift + +`
-#   2. Decrease Font Size: `ctrl + shift + -` | `ctrl + shift + _`
-#   3. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
-#
-# Note: Alacritty do not have support for Tabs, and any graphic protocol.
-#
-###########################################################
-{
-  programs.alacritty = {
-    enable = true;
-  };
-
-  xdg.configFile."alacritty/alacritty.yml".text =
-    ''
-      import:
-        # all alacritty themes can be found at
-        #    https://github.com/alacritty/alacritty-theme
-        - ~/.config/alacritty/theme_catppuccino.yml
-
-      window:
-        # Background opacity
-        #
-        # Window opacity as a floating point number from `0.0` to `1.0`.
-        # The value `0.0` is completely transparent and `1.0` is opaque.
-        opacity: 0.95
-
-        # Startup Mode (changes require restart)
-        #
-        # Values for `startup_mode`:
-        #   - Windowed
-        #   - Maximized
-        #   - Fullscreen
-        #
-        # Values for `startup_mode` (macOS only):
-        #   - SimpleFullscreen
-        startup_mode: Windowed
-
-        # Allow terminal applications to change Alacritty's window title.
-        dynamic_title: true
-
-        # Make `Option` key behave as `Alt` (macOS only):
-        #   - OnlyLeft
-        #   - OnlyRight
-        #   - Both
-        #   - None (default)
-        option_as_alt: Both
-
-      scrolling:
-        # Maximum number of lines in the scrollback buffer.
-        # Specifying '0' will disable scrolling.
-        history: 10000
-
-        # Scrolling distance multiplier.
-        #multiplier: 3
-
-      # Font configuration
-      font:
-        # Normal (roman) font face
-        bold:
-          family: JetBrainsMono Nerd Font
-        italic:
-          family: JetBrainsMono Nerd Font
-        normal:
-          family: JetBrainsMono Nerd Font
-        bold_italic:
-          # Font family
-          #
-          # If the bold italic family is not specified, it will fall back to the
-          # value specified for the normal font.
-          family: JetBrainsMono Nerd Font
-    ''
-    + (
-      if pkgs.stdenv.isDarwin
-      then ''
-          # Point size
-          size: 14
-        shell:  # force nushell as default shell on macOS
-          program:  /run/current-system/sw/bin/nu
-      ''
-      else ''
-        # holder identation
-          # Point size
-          size: 13
-      ''
-    );
-
-  xdg.configFile."alacritty/theme_catppuccino.yml".source = ./theme_catppuccino.yml;
-}

home/base/desktop/alacritty/theme_catppuccino.yml

@@ -1,40 +0,0 @@
-# Catppuccino theme scheme for Alacritty
-
-colors:
-  primary:
-    background: '#1E1E2E'
-    foreground: '0xd6d6d6'
-
-  cursor:
-    text: '#CDD6F4'
-    cursor: '#D9D9D9'
-
-  normal:
-    black: '#181A1F'
-    red: '#E86671'
-    green: '#98C379'
-    yellow: '#E5C07B'
-    blue: '#61AFEF'
-    magenta: '#C678DD'
-    cyan: '#54AFBC'
-    white: '#ABB2BF'
-
-  bright:
-    black: '#5C6370'
-    red: '#E86671'
-    green: '#98C379'
-    yellow: '#E5C07B'
-    blue: '#61AFEF'
-    magenta: '#C678DD'
-    cyan: '#54AFBC'
-    white: '0xf7f7f7'
-
-  dim:
-    black: '#5C6370'
-    red: '0x74423f'
-    green: '#98C379'
-    yellow: '#E5C07B'
-    blue: '#61AFEF'
-    magenta: '0x6e4962'
-    cyan: '0x5c8482'
-    white: '0x828282'

home/base/desktop/default.nix

@@ -1,12 +0,0 @@
-{...}: {
-  imports = [
-    ./alacritty
-    ../server
-    ./neovim
-
-    ./development.nix
-    ./kitty.nix
-    ./media.nix
-    ./shell.nix
-  ];
-}

home/base/desktop/development.nix

@@ -1,76 +0,0 @@
-{
-  pkgs,
-  pkgs-unstable,
-  ...
-}: {
-  #############################################################
-  #
-  #  Basic settings for development environment
-  #
-  #  Please avoid to install language specific packages here(globally),
-  #  instead, install them independently using dev-templates:
-  #     https://github.com/the-nix-way/dev-templates
-  #
-  #############################################################
-
-  home.packages = with pkgs; [
-    pkgs-unstable.devbox
-
-    # cloud native
-    skopeo
-    docker-compose
-    dive # explore docker layers
-    kubectl
-    kubernetes-helm
-    terraform
-    # terraformer # generate terraform configs from existing cloud resources
-    pulumi
-    pulumictl
-    k9s
-    # istioctl
-
-    # cloud provider
-    awscli2
-    aws-iam-authenticator
-    eksctl
-
-    # DO NOT install build tools for C/C++, set it per project by devShell instead
-    gnumake # used by this repo, to simplify the deployment
-
-    # python
-    (python311.withPackages (ps:
-      with ps; [
-        ipython
-        pandas
-        requests
-        pyquery
-        pyyaml
-      ]))
-
-    # db related
-    dbeaver
-    mycli
-    pgcli
-    mongosh
-    sqlite
-
-    # embedded development
-    minicom
-
-    # other tools
-    k6 # load testing tool
-    mitmproxy # http/https proxy tool
-    protobuf # protocol buffer compiler
-  ];
-
-  programs = {
-    direnv = {
-      enable = true;
-      nix-direnv.enable = true;
-
-      enableZshIntegration = true;
-      enableBashIntegration = true;
-      enableNushellIntegration = true;
-    };
-  };
-}

home/base/desktop/kitty.nix

@@ -1,59 +0,0 @@
-{
-  lib,
-  pkgs,
-  ...
-}:
-###########################################################
-#
-# Kitty Configuration
-#
-# Useful Hot Keys for macOS:
-#   1. New Tab: `command + t`
-#   2. Close Tab: `command + w`
-#   3. Switch Tab: `shift + command + [` | `shift + command + ]`
-#   4. Increase Font Size: `command + =` | `command + +`
-#   5. Decrease Font Size: `command + -` | `command + _`
-#   6. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
-#
-# Useful Hot Keys for Linux:
-#   1. New Tab: `ctrl + shift + t`
-#   2. Close Tab: `ctrl + shift + q`
-#   3. Switch Tab: `ctrl + shift + right` | `ctrl + shift + left`
-#   4. Increase Font Size: `ctrl + shift + =` | `ctrl + shift + +`
-#   5. Decrease Font Size: `ctrl + shift + -` | `ctrl + shift + _`
-#   6. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
-#
-###########################################################
-{
-  programs.kitty = {
-    enable = true;
-    theme = "Catppuccin-Mocha";
-    font = {
-      name = "JetBrainsMono Nerd Font";
-      # use different font size on macOS
-      size =
-        if pkgs.stdenv.isDarwin
-        then 14
-        else 13;
-    };
-
-    settings =
-      {
-        background_opacity = "0.95";
-        macos_option_as_alt = true; # Option key acts as Alt on macOS
-        scrollback_lines = 10000;
-        enable_audio_bell = false;
-      }
-      // (
-        if pkgs.stdenv.isDarwin
-        then {
-          # macOS specific settings, force kitty to use nushell as default shell
-          shell = "/run/current-system/sw/bin/nu";
-        }
-        else {}
-      );
-
-    # macOS specific settings
-    darwinLaunchOptions = ["--start-as=fullscreen"];
-  };
-}

home/base/desktop/neovim/README.md

@@ -1,7 +0,0 @@
-# AstroNvim
-
-My Neovim config based on [AstroNvim](https://github.com/AstroNvim/AstroNvim).
-
-## Screenshots
-
-![](/_img/astronvim_2023-07-13_00-39.webp)

home/base/desktop/neovim/astronvim_user/init.lua

@@ -1,288 +0,0 @@
-return {
-  colorscheme = "catppuccin",
-
-  options = {
-    opt = {
-      relativenumber = true, -- Show relative numberline
-      signcolumn = "auto", -- Show sign column when used only
-      spell = false, -- Spell checking
-      swapfile = false, -- Swapfile
-      smartindent = false; -- fix https://github.com/ryan4yin/nix-config/issues/4
-    },
-  },
-
-  plugins = {
-    "AstroNvim/astrocommunity",
-    -- colorscheme - catppuccin
-    { import = "astrocommunity.colorscheme.catppuccin" },
-    -- Highly experimental plugin that completely replaces
-    -- the UI for messages, cmdline and the popupmenu.
-    { import = "astrocommunity.utility.noice-nvim" },
-    -- Fully featured & enhanced replacement for copilot.vim
-    -- <Tab> work with both auto completion in cmp and copilot
-    { import = "astrocommunity.media.vim-wakatime" },
-    { import = "astrocommunity.motion.leap-nvim" },
-    { import = "astrocommunity.motion.flit-nvim" },
-    { import = "astrocommunity.scrolling.nvim-scrollbar" },
-    { import = "astrocommunity.editing-support.auto-save-nvim" },
-    { import = "astrocommunity.editing-support.todo-comments-nvim" },
-    -- Language Support
-    ---- Frontend & NodeJS
-    { import = "astrocommunity.pack.typescript-all-in-one" },
-    { import = "astrocommunity.pack.tailwindcss" },
-    { import = "astrocommunity.pack.html-css" },
-    { import = "astrocommunity.pack.prisma" },
-    { import = "astrocommunity.pack.vue" },
-    ---- Configuration Language
-    { import = "astrocommunity.pack.markdown" },
-    { import = "astrocommunity.markdown-and-latex.glow-nvim" },
-    { import = "astrocommunity.pack.json" },
-    { import = "astrocommunity.pack.yaml" },
-    { import = "astrocommunity.pack.toml" },
-    ---- Backend
-    { import = "astrocommunity.pack.lua" },
-    { import = "astrocommunity.pack.go" },
-    { import = "astrocommunity.pack.rust" },
-    { import = "astrocommunity.pack.python" },
-    { import = "astrocommunity.pack.java" },
-    -- { import = "astrocommunity.pack.nix" },  -- manually add config for nix, comment this one.
-    { import = "astrocommunity.pack.proto" },
-    ---- Operation & Cloud Native
-    { import = "astrocommunity.pack.terraform" },
-    { import = "astrocommunity.pack.bash" },
-    { import = "astrocommunity.pack.cmake" },
-    { import = "astrocommunity.pack.cpp" },
-    { import = "astrocommunity.pack.docker" },
-    -- AI Assistant
-    { import = "astrocommunity.completion.copilot-lua-cmp" },
-    -- Custom copilot-lua to enable filtypes: markdown
-    {
-      "zbirenbaum/copilot.lua",
-      opts = function(_, opts)
-        opts.filetypes = {
-          yaml = true;
-          markdown = true,
-        }
-      end,
-    },
-
-    ---- Nushell
-    {
-      "LhKipp/nvim-nu",
-      config = function()
-        require'nu'.setup({
-          use_lsp_features = true, -- requires https://github.com/jose-elias-alvarez/null-ls.nvim
-          -- lsp_feature: all_cmd_names is the source for the cmd name completion.
-          -- It can be
-          --  * a string, which is interpreted as a shell command and the returned list is the source for completions (requires plenary.nvim)
-          --  * a list, which is the direct source for completions (e.G. all_cmd_names = {"echo", "to csv", ...})
-          --  * a function, returning a list of strings and the return value is used as the source for completions
-          all_cmd_names = [[nu -c 'help commands | get name | str join "\n"']]
-        })
-      end,
-      dependencies = {
-        {"nvim-treesitter/nvim-treesitter"},
-        { "jose-elias-alvarez/null-ls.nvim"},
-      }
-    },
-
-    -- File explorer(Custom configs)
-    {
-      "nvim-neo-tree/neo-tree.nvim",
-      opts = {
-        filesystem = {
-          filtered_items = {
-            visible = true,   -- visible by default
-            hide_dotfiles = false,
-            hide_gitignored = false,
-          },
-        },
-      }
-    },
-    -- The plugin offers the `:Refactor` command to refactor code.
-    -- TODO not work yet
-    {
-      "ThePrimeagen/refactoring.nvim",
-      dependencies = {
-        {"nvim-lua/plenary.nvim"},
-        {"nvim-treesitter/nvim-treesitter"}
-      }
-    },
-    -- The plugin offers the `:Spectre` command to search and replace.
-    -- TODO not work yet
-    {
-      "nvim-pack/nvim-spectre",
-      dependencies = {
-        {"nvim-lua/plenary.nvim"},
-      }
-    },
-    -- Language Parser for syntax highlighting / indentation / folding / Incremental selection
-    {
-      "nvim-treesitter/nvim-treesitter",
-      opts = function(_, opts)
-        local utils = require "astronvim.utils";
-        opts.indent.enable = false;
-        opts.ensure_installed = utils.list_insert_unique(opts.ensure_installed, {
-          -- neovim
-          "vim",
-          "lua",
-          -- operation & cloud native
-          "dockerfile",
-          "hcl",
-          "jsonnet",
-          "regex",
-          "terraform",
-          "nix",
-        })
-      end,
-    },
-
-    -- Install lsp, formmatter and others via home manager instead of Mason.nvim
-    -- LSP installations
-    {
-      "williamboman/mason-lspconfig.nvim",
-      -- overwrite ensure_installed to install lsp via home manager(except emmet_ls)
-      opts = function(_, opts)
-        opts.ensure_installed = {
-          "emmet_ls", -- not exist in nixpkgs, so install it via mason
-        }
-      end,
-    },
-    -- Formatters/Linter installation
-    {
-      "jay-babu/mason-null-ls.nvim",
-      -- ensure_installed nothing
-      opts = function(_, opts)
-        opts.ensure_installed = nil
-        opts.automatic_installation = false
-      end,
-    },
-    {
-      "jose-elias-alvarez/null-ls.nvim",
-      opts = function(_, opts)
-        local null_ls = require "null-ls"
-        local code_actions = null_ls.builtins.code_actions
-        local diagnostics = null_ls.builtins.diagnostics
-        local formatting = null_ls.builtins.formatting
-        local hover = null_ls.builtins.hover
-        local completion = null_ls.builtins.completion
-        -- https://github.com/jose-elias-alvarez/null-ls.nvim/blob/main/doc/BUILTINS.md
-        if type(opts.sources) == "table" then
-          vim.list_extend(opts.sources, {
-            -- Common Code Actions
-            code_actions.gitsigns,
-            -- common refactoring actions based off the Refactoring book by Martin Fowler
-            code_actions.refactoring,
-            code_actions.gomodifytags,  -- Go - modify struct field tags
-            code_actions.impl,        -- Go - generate interface method stubs
-            code_actions.shellcheck,
-            code_actions.proselint,   -- English prose linter
-            code_actions.statix,      -- Lints and suggestions for Nix.
-
-            -- Completion
-            completion.luasnip,
-
-            -- Diagnostic
-            diagnostics.actionlint,  -- GitHub Actions workflow syntax checking
-            diagnostics.buf,         -- check text in current buffer
-            diagnostics.checkmake,   -- check Makefiles
-            diagnostics.deadnix,     -- Scan Nix files for dead code.
-
-            -- Formatting
-            formatting.prettier, -- js/ts/vue/css/html/json/... formatter
-            diagnostics.hadolint, -- Dockerfile linter
-            formatting.black,     -- Python formatter
-            formatting.ruff,      -- extremely fast Python linter
-            formatting.goimports,  -- Go formatter
-            formatting.shfmt,     -- Shell formatter
-            formatting.rustfmt,   -- Rust formatter
-            formatting.taplo,   -- TOML formatteautoindentr
-            formatting.terraform_fmt, -- Terraform formatter
-            formatting.stylua,    -- Lua formatter
-            formatting.alejandra, -- Nix formatter
-            formatting.sqlfluff.with({  -- SQL formatter
-              extra_args = { "--dialect", "postgres" }, -- change to your dialect
-            }),
-            formatting.nginx_beautifier,  -- Nginx formatter
-          })
-        end
-      end,
-    },
-    -- Debugger installation 
-    {
-      "jay-babu/mason-nvim-dap.nvim",
-      -- overrides `require("mason-nvim-dap").setup(...)`
-      opts = function(_, opts)
-        opts.ensure_installed = nil
-        opts.automatic_installation = false
-      end,
-    },
-  },
-
-  -- Configure require("lazy").setup() options
-  lazy = {
-    defaults = { lazy = true },
-    performance = {
-      rtp = {
-        -- customize default disabled vim plugins
-        disabled_plugins = { };
-      },
-    },
-  },
-
-  lsp = {
-    config = {
-      -- the offset_enconding of clangd will confilicts whit null-ls
-      -- so we need to manually set it to utf-8
-      clangd = {
-        capabilities = {
-          offsetEncoding = "utf-8",
-        },
-      },
-    },
-    -- enable servers that installed by home-manager instead of mason
-    servers = {
-      ---- Frontend & NodeJS
-      "tsserver",     -- typescript/javascript language server
-      "tailwindcss",  -- tailwindcss language server
-      "html",         -- html language server
-      "cssls",        -- css language server
-      "prismals",     -- prisma language server
-      "volar",        -- vue language server
-      ---- Configuration Language
-      "marksman",     -- markdown ls
-      "jsonls",      -- json language server
-      "yamlls",       -- yaml language server
-      "taplo",         -- toml language server
-      ---- Backend
-      "lua_ls",         -- lua
-      "gopls",          -- go
-      "rust_analyzer",  -- rust
-      "pyright",        -- python
-      "ruff_lsp",       -- extremely fast Python linter and code transformation
-      "jdtls",          -- java
-      "nil_ls",         -- nix language server
-      "bufls",          -- protocol buffer language server
-      "zls",            -- zig language server
-      ---- Operation & Cloud Nativautoindente
-      "bashls",       -- bash
-      "cmake",        -- cmake language server
-      "clangd",       -- c/c++
-      "dockerls",     -- dockerfile
-      "jsonnet_ls",   -- jsonnet language server
-      "terraformls",  -- terraform hcl
-    },
-    formatting = {
-      disabled = {},
-      format_on_save = {
-        enabled = true,
-        allow_filetypes = {
-          "go",
-          "jsonnet",
-          "rust",
-          "terraform",
-        },
-      },
-    },
-  },
-}

home/base/desktop/neovim/astronvim_user/mappings.lua

@@ -1,21 +0,0 @@
--- Mapping data with "desc" stored directly by vim.keymap.set().
---
--- Please use this mappings table to set keyboard mapping since this is the
--- lower level configuration and more robust one. (which-key will
--- automatically pick-up stored data by this setting.)
-local utils = require "astronvim.utils"
-return {
-  -- first key is the mode
-  n = {
-    -- second key is the lefthand side of the map
-    -- mappings seen under group name "Buffer"
-    ["<leader>bn"] = { "<cmd>tabnew<cr>", desc = "New tab" },
-    -- quick save
-    ["<C-s>"] = { ":w!<cr>", desc = "Save File" },  -- change description but the same command
-    ["<leader>tp"] = { function() utils.toggle_term_cmd("ipython") end, desc = "ToggleTerm python" },
-  },
-  t = {
-    -- setting a mapping to false will disable it
-    -- ["<esc>"] = false,
-  },
-}

home/base/desktop/neovim/default.nix

@@ -1,223 +0,0 @@
-{
-  pkgs,
-  astronvim,
-  ...
-}:
-###############################################################################
-#
-#  AstroNvim's configuration and all its dependencies
-#
-#  Related folders:
-#    nvim's config: `~/.config/nvim`
-#    astronvim's user configuration: `$XDG_CONFIG_HOME/astronvim/lua/user`
-#    all plugins will be installed into(by lazy.nvim): `~/.local/share/nvim/`
-#
-#  For details: https://astronvim.com/
-#
-#  Toggle visual mode:              `v`
-#  Toggle visual block mode:        `<Ctrl> + v`  (select a block(vertically) of text)
-#
-#  Commands & shortcuts in AstroNvim
-#    Learn Neovim's Basics:         `:Tutor`
-#    Opening file explorer:         `<Space> + e`
-#    Focus Neotree to current file: `<Space> + o`
-#    Floating Terminal:	            `<Space> + tf`
-#    Horizontal Split Terminal:	    `<Space> + th`
-#    Vertical Split Terminal:	      `<Space> + tv`
-#    Open IPython REPL:             `<Space> + tp`
-#    Opening LSP symbols:           `<Space> + lS`
-#    Show line diagnostics:         `gl`
-#    Go to definition:              `gd`
-#
-#    Switching between windows:     `<Ctrl> + h/j/k/l`
-#    Resizing windows:              `<Ctrl> + Up/Down/Left/Right`
-#        Note that on macOS, this is conflict with system's default shortcuts.
-#        You need disable them in System Preferences -> Keyboard -> Shortcuts -> Mission Control.
-#    Horizontal Split:              `\`
-#    Vertical Split:                `|`
-#    Next Buffer(Tab):              `]b`
-#    Previous Buffer(Tab):          `[b`
-#    Close Buffer:                  `<Space> + c`
-#
-#    Toggle buffer auto formatting: `<Space> + uf`
-#    Format Document:               `<Space> + lf`
-#    Comment Line:                  `<Space> + /`
-#        Can be used in visual mode
-#    Code Actions:                  `<Space> + la`
-#    Rename:                        `<Space> + lr`
-#    Open filepath/URL at cursor:   `gx`
-#        This is a neovim builtin command
-#    Find files by name(fzf):       `<Space> + ff`
-#    Grep string in files(repgrep): `<Space> + fw`
-#
-#    Save Session:                  `<Space> + Ss`
-#    Last Session:                  `<Space> + Sl`
-#    Delete Session:                `<Space> + Sd`
-#    Search Session:                `<Space> + Sf`
-#    Load Current Directory Session:`<Space> + S.`
-#
-#    Debugging: press `<Space> + D` to see the available bindings and options.
-#
-#    Replace in the selected area:  `:s/old/new/g`  (will show `:'<,'>s/old/new/g`)
-#    Replace in the current line:   The same as above
-#    Replace in the whole file:     `:% s/old/new/g`
-#    Replace with regex:            `:% s@\vhttp://(\w+)@https://\1@gc`
-#        1. `\v` means means that in the regex pattern after it can be used without backslash escaping(similar to python's raw string).
-#        2. `\1` means the first matched group in the pattern.
-#    Replace in the specific lines:
-#        1. From the 10th line to the end of the file:     `:10,$ s/old/new/g`
-#                                                       or `:10,$ s@^@#@g`
-#        2. From the 10th line to the 20th line:           `:10,20 s/old/new/g`
-#
-#    The postfix(flgas) in the above commands:
-#        1. `g` means replace all the matched strings in the current line/file.
-#        2. `c` means ask for confirmation before replacing.
-#        3. `i` means ignore case.
-#
-#    Joining a Selection of Lines With Space:  `:join`
-#    Joining without spaces:                   `:join!`
-#
-#    Toggle text's case:                       `~`
-#    Convert to uppercase:                     `U`
-#    Convert to lowercase:                     `u`
-#
-#    Save the selected text to a file:         `:w filename`  (will show `:'<,'>w filename`)
-#
-#    Search key pattern and Replace in Multiple Files:
-#        sed -ri "s/pattern_str/replace_str/g" $(grep "key_pattern" 'path_pattern' -rl)
-#
-#    Search file name pattern and Replace in Multiple Files:
-#        sed -ri "s/pattern_str/replace_str/g" $(find . -name "pattern")
-#
-#    ......
-#    See https://astronvim.com/Basic%20Usage/walkthrough
-#
-#e#############################################################################
-{
-  xdg.configFile = {
-    # base config
-    "nvim" = {
-      # update AstroNvim
-      onChange = "${pkgs.neovim}/bin/nvim --headless +quitall";
-      source = astronvim;
-    };
-    # my cusotom astronvim config, astronvim will load it after base config
-    # https://github.com/AstroNvim/AstroNvim/blob/v3.32.0/lua/astronvim/bootstrap.lua#L15-L16
-    "astronvim/lua/user" = {
-      # update AstroNvim
-      onChange = "${pkgs.neovim}/bin/nvim --headless +quitall";
-      source = ./astronvim_user;
-    };
-  };
-
-  nixpkgs.config = {
-    programs.npm.npmrc = ''
-      prefix = ''${HOME}/.npm-global
-    '';
-  };
-
-  programs = {
-    neovim = {
-      enable = true;
-      defaultEditor = true;
-
-      viAlias = false;
-      vimAlias = true;
-
-      withPython3 = true;
-      withNodeJs = true;
-      extraPackages = [];
-
-      # currently we use lazy.nvim as neovim's package manager, so comment this one.
-      plugins = with pkgs.vimPlugins; [
-        # search all the plugins using https://search.nixos.org/packages
-        luasnip
-      ];
-    };
-  };
-  home = {
-    packages = with pkgs; [
-      #-- c/c++
-      cmake
-      cmake-language-server
-      gnumake
-      checkmake
-      gcc # c/c++ compiler, required by nvim-treesitter!
-      llvmPackages.clang-unwrapped # c/c++ tools with clang-tools such as clangd
-      gdb
-      lldb
-
-      #-- python
-      nodePackages.pyright # python language server
-      python311Packages.black # python formatter
-      python311Packages.ruff-lsp
-
-      #-- rust
-      rust-analyzer
-      cargo # rust package manager
-      rustfmt
-
-      #-- zig
-      zls
-
-      #-- nix
-      nil
-      rnix-lsp
-      # nixd
-      statix # Lints and suggestions for the nix programming language
-      deadnix # Find and remove unused code in .nix source files
-      alejandra # Nix Code Formatter
-
-      #-- golang
-      go
-      gomodifytags
-      iferr # generate error handling code for go
-      impl # generate function implementation for go
-      gotools # contains tools like: godoc, goimports, etc.
-      gopls # go language server
-      delve # go debugger
-
-      #-- lua
-      stylua
-      lua-language-server
-
-      #-- bash
-      nodePackages.bash-language-server
-      shellcheck
-      shfmt
-
-      #-- javascript/typescript --#
-      nodePackages.typescript
-      nodePackages.typescript-language-server
-      # HTML/CSS/JSON/ESLint language servers extracted from vscode
-      nodePackages.vscode-langservers-extracted
-      nodePackages."@tailwindcss/language-server"
-
-      #-- CloudNative
-      nodePackages.dockerfile-language-server-nodejs
-      terraform
-      terraform-ls
-      jsonnet
-      jsonnet-language-server
-      hadolint # Dockerfile linter
-
-      #-- Others
-      taplo # TOML language server / formatter / validator
-      nodePackages.yaml-language-server
-      sqlfluff # SQL linter
-      actionlint # GitHub Actions linter
-      buf # protoc plugin for linting and formatting
-      proselint # English prose linter
-
-      #-- Misc
-      tree-sitter # common language parser/highlighter
-      nodePackages.prettier # common code formatter
-      marksman # language server for markdown
-      glow # markdown previewer
-
-      #-- Optional Requirements:
-      gdu # disk usage analyzer, required by AstroNvim
-      ripgrep # fast search tool, required by AstroNvim's '<leader>fw'(<leader> is space key)
-    ];
-  };
-}

home/base/desktop/shell.nix

@@ -1,24 +0,0 @@
-{...}: {
-  programs.bash = {
-    # load the alias file for work
-    bashrcExtra = ''
-      alias_for_work=/etc/agenix/alias-for-work.bash
-      if [ -f $alias_for_work ]; then
-        . $alias_for_work
-      else
-        echo "No alias file found for work"
-      fi
-    '';
-  };
-
-  programs.nushell = {
-    # load the alias file for work
-    # the file must exist, otherwise nushell will complain about it!
-    #
-    # currently, nushell does not support conditional sourcing of files
-    # https://github.com/nushell/nushell/issues/8214
-    extraConfig = ''
-      source /etc/agenix/alias-for-work.nushell
-    '';
-  };
-}

home/base/gui/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/gui/dev-tools.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  home.packages = with pkgs; [
+    mitmproxy # http/https proxy tool
+    insomnia # REST client
+    wireshark # network analyzer
+
+    # IDEs
+    # jetbrains.idea-community
+  ];
+}

home/base/gui/terminal/README.md

@@ -0,0 +1,84 @@
+# Terminal Emulators
+
+I used to spend a lot of time on terminal emulators, to make them match my taste, but now I found
+that it's not worth it, **Zellij can provide a user-friendly and unified user experience for all
+terminal emulators! without any pain**!
+
+Currently, I only use the most basic features of terminal emulators, such as true color, graphics
+protocol, etc. Other features such as tabs, scrollback buffer, select/search/copy, etc, are all
+provided by zellij!
+
+My current terminal emulators are:
+
+1. kitty: My main terminal emulator.
+   1. to select/copy a large mount of text, We should do some tricks via kitty's `scrollback_pager`
+      with neovim, it's really painful: <https://github.com/kovidgoyal/kitty/issues/719>
+2. foot: A fast, lightweight and minimalistic Wayland terminal emulator.
+   1. foot only do the things a terminal emulator should do, no more, no less.
+   1. It's really suitable for tiling window manager or zellij users!
+3. alacritty: A cross-platform, GPU-accelerated terminal emulator.
+   1. alacritty is really fast, I use it as a backup terminal emulator on all my desktops.
+
+## 'xterm-kitty': unknown terminal type when `ssh` into a remote host or `sudo xxx`
+
+> https://sw.kovidgoyal.net/kitty/faq/#i-get-errors-about-the-terminal-being-unknown-or-opening-the-terminal-failing-or-functional-keys-like-arrow-keys-don-t-work
+
+> https://wezfurlong.org/wezterm/config/lua/config/term.html
+
+kitty set `TERM` to `xterm-kitty` by default, and TUI apps like `viu`, `yazi`, `curses` will try to
+search in the host's [terminfo(terminal capability data base)](https://linux.die.net/man/5/terminfo)
+for value of `TERM` to determine the capabilities of the terminal.
+
+But when you `ssh` into a remote host, the remote host is very likely to not have `xterm-kitty` in
+its terminfo, so you will get this error:
+
+```
+'xterm-kitty': unknown terminal type
+```
+
+Or when you `sudo xxx`, `sudo` won't preserve the `TERM` variable, it will be reset to root's
+default `TERM` value, which is `xterm` or `xterm-256color` in most linux distributions, so you will
+get this error:
+
+```
+'xterm-256color': unknown terminal type
+```
+
+or
+
+```
+Error opening terminal: xterm-kitty.
+```
+
+NixOS preserve the `TERMINFO` and `TERMINFO_DIRS` environment variables, for `root` and the `wheel`
+group:
+[nixpkgs/nixos/modules/config/terminfo.nix](https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/config/terminfo.nix#L18)
+
+For nix-darwin, take a look at <https://github.com/LnL7/nix-darwin/wiki/Terminfo-issues>
+
+### Solutions
+
+Simplest solution, it will automatically copy over the terminfo files and also magically enable
+shell integration on the remote machine:
+
+```
+kitten ssh user@host
+```
+
+Or if you do not care about kitty's features(such as true color & graphics protocol), you can simply
+set `TERM` to `xterm-256color`, which is built-in in most linux distributions:
+
+```
+export TERM=xterm-256color
+```
+
+If you need kitty's features, but do not like the magic of `kitten`, you can manually install
+kitty's terminfo on the remote host:
+
+```bash
+# install on ubuntu / debian
+sudo apt-get install kitty-terminfo
+
+# or copy from local machine
+infocmp -a xterm-kitty | ssh myserver tic -x -o \~/.terminfo /dev/stdin
+```

home/base/gui/terminal/alacritty/catppuccin-mocha.toml

@@ -0,0 +1,65 @@
+[colors.primary]
+background = "#1e1e2e"
+foreground = "#cdd6f4"
+dim_foreground = "#7f849c"
+bright_foreground = "#cdd6f4"
+
+[colors.cursor]
+text = "#1e1e2e"
+cursor = "#f5e0dc"
+
+[colors.vi_mode_cursor]
+text = "#1e1e2e"
+cursor = "#b4befe"
+
+[colors.search.matches]
+foreground = "#1e1e2e"
+background = "#a6adc8"
+
+[colors.search.focused_match]
+foreground = "#1e1e2e"
+background = "#a6e3a1"
+
+[colors.footer_bar]
+foreground = "#1e1e2e"
+background = "#a6adc8"
+
+[colors.hints.start]
+foreground = "#1e1e2e"
+background = "#f9e2af"
+
+[colors.hints.end]
+foreground = "#1e1e2e"
+background = "#a6adc8"
+
+[colors.selection]
+text = "#1e1e2e"
+background = "#f5e0dc"
+
+[colors.normal]
+black = "#45475a"
+red = "#f38ba8"
+green = "#a6e3a1"
+yellow = "#f9e2af"
+blue = "#89b4fa"
+magenta = "#f5c2e7"
+cyan = "#94e2d5"
+white = "#bac2de"
+
+[colors.bright]
+black = "#585b70"
+red = "#f38ba8"
+green = "#a6e3a1"
+yellow = "#f9e2af"
+blue = "#89b4fa"
+magenta = "#f5c2e7"
+cyan = "#94e2d5"
+white = "#a6adc8"
+
+[[colors.indexed_colors]]
+index = 16
+color = "#fab387"
+
+[[colors.indexed_colors]]
+index = 17
+color = "#f5e0dc"

home/base/gui/terminal/alacritty/default.nix

@@ -0,0 +1,66 @@
+{
+  pkgs,
+  pkgs-unstable,
+  ...
+}:
+###########################################################
+#
+# Alacritty Configuration
+#
+# Useful Hot Keys for macOS:
+#   1. Multi-Window: `command + N`
+#   2. Increase Font Size: `command + =` | `command + +`
+#   3. Decrease Font Size: `command + -` | `command + _`
+#   4. Search Text: `command + F`
+#   5. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
+#
+# Useful Hot Keys for Linux:
+#   1. Increase Font Size: `ctrl + shift + =` | `ctrl + shift + +`
+#   2. Decrease Font Size: `ctrl + shift + -` | `ctrl + shift + _`
+#   3. Search Text: `ctrl + shift + N`
+#   4. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
+#
+# Note: Alacritty do not have support for Tabs, and any graphic protocol.
+#
+###########################################################
+{
+  programs.alacritty = {
+    enable = true;
+    package = pkgs-unstable.alacritty;
+    # https://alacritty.org/config-alacritty.html
+    settings = {
+      general.import = [
+        ./catppuccin-mocha.toml
+      ];
+      window = {
+        opacity = 0.93;
+        startup_mode = "Maximized"; # Maximized window
+        dynamic_title = true;
+        option_as_alt = "Both"; # Option key acts as Alt on macOS
+      };
+      scrolling = {
+        history = 10000;
+      };
+      font = {
+        bold = {family = "JetBrainsMono Nerd Font";};
+        italic = {family = "JetBrainsMono Nerd Font";};
+        normal = {family = "JetBrainsMono Nerd Font";};
+        bold_italic = {family = "JetBrainsMono Nerd Font";};
+        size =
+          if pkgs.stdenv.isDarwin
+          then 14
+          else 13;
+      };
+      terminal = {
+        # Spawn a nushell in login mode via `bash`
+        shell = {
+          program = "${pkgs.bash}/bin/bash";
+          args = ["--login" "-c" "nu --login --interactive"];
+        };
+        # Controls the ability to write to the system clipboard with the OSC 52 escape sequence.
+        # It's used by zellij to copy text to the system clipboard.
+        osc52 = "CopyPaste";
+      };
+    };
+  };
+}

home/base/gui/terminal/default.nix

@@ -0,0 +1,3 @@
+{mylib, ...}: {
+  imports = mylib.scanPaths ./.;
+}

home/base/gui/terminal/foot.nix

@@ -0,0 +1,72 @@
+{pkgs, ...}: {
+  programs.foot = {
+    # foot is designed only for Linux
+    enable = pkgs.stdenv.isLinux;
+
+    # foot can also be run in a server mode. In this mode, one process hosts multiple windows.
+    # All Wayland communication, VT parsing and rendering is done in the server process.
+    # New windows are opened by running footclient, which remains running until the terminal window is closed.
+    #
+    # Advantages to run foot in server mode including reduced memory footprint and startup time.
+    # The downside is a performance penalty. If one window is very busy with, for example, producing output,
+    # then other windows will suffer. Also, should the server process crash, all windows will be gone.
+    server.enable = true;
+
+    # https://man.archlinux.org/man/foot.ini.5
+    settings = {
+      main = {
+        term = "foot"; # or "xterm-256color" for maximum compatibility
+        font = "JetBrainsMono Nerd Font:size=14";
+        dpi-aware = "yes";
+
+        # Spawn a nushell in login mode via `bash`
+        shell = "${pkgs.bash}/bin/bash --login -c 'nu --login --interactive'";
+      };
+
+      mouse = {
+        hide-when-typing = "yes";
+      };
+
+      # https://github.com/catppuccin/foot/blob/main/themes/catppuccin-mocha.ini
+      cursor = {
+        color = "11111b f5e0dc";
+      };
+      colors = {
+        alpha = "0.93"; # background opacity
+
+        foreground = "cdd6f4";
+        background = "1e1e2e";
+
+        regular0 = "45475a";
+        regular1 = "f38ba8";
+        regular2 = "a6e3a1";
+        regular3 = "f9e2af";
+        regular4 = "89b4fa";
+        regular5 = "f5c2e7";
+        regular6 = "94e2d5";
+        regular7 = "bac2de";
+
+        bright0 = "585b70";
+        bright1 = "f38ba8";
+        bright2 = "a6e3a1";
+        bright3 = "f9e2af";
+        bright4 = "89b4fa";
+        bright5 = "f5c2e7";
+        bright6 = "94e2d5";
+        bright7 = "a6adc8";
+
+        "16" = "fab387";
+        "17" = "f5e0dc";
+
+        "selection-foreground" = "cdd6f4";
+        "selection-background" = "414356";
+
+        "search-box-no-match" = "11111b f38ba8";
+        "search-box-match" = "cdd6f4 313244";
+
+        "jump-labels" = "11111b fab387";
+        urls = "89b4fa";
+      };
+    };
+  };
+}

home/base/gui/terminal/ghostty.nix

@@ -0,0 +1,41 @@
+{
+  pkgs,
+  ghostty,
+  ...
+}:
+###########################################################
+#
+# Ghostty Configuration
+#
+###########################################################
+{
+  programs.ghostty = {
+    enable = true;
+    package =
+      if pkgs.stdenv.isDarwin
+      then pkgs.hello # pkgs.ghostty is currently broken on darwin
+      else pkgs.ghostty; # the stable version
+    # package = ghostty.packages.${pkgs.system}.default; # the latest version
+    enableBashIntegration = false;
+    installBatSyntax = false;
+    # installVimSyntax = true;
+    settings = {
+      theme = "catppuccin-mocha";
+
+      font-family = "JetBrains Mono";
+      font-size = 13;
+
+      background-opacity = 0.93;
+      # only supported on macOS;
+      background-blur-radius = 10;
+      scrollback-limit = 20000;
+
+      # https://ghostty.org/docs/config/reference#command
+      #  To resolve issues:
+      #    1. https://github.com/ryan4yin/nix-config/issues/26
+      #    2. https://github.com/ryan4yin/nix-config/issues/8
+      #  Spawn a nushell in login mode via `bash`
+      command = "${pkgs.bash}/bin/bash --login -c 'nu --login --interactive'";
+    };
+  };
+}

home/base/gui/terminal/kitty.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+###########################################################
+#
+# Kitty Configuration
+#
+# Useful Hot Keys for Linux(replace `ctrl + shift` with `cmd` on macOS)):
+#   1. Increase Font Size: `ctrl + shift + =` | `ctrl + shift + +`
+#   2. Decrease Font Size: `ctrl + shift + -` | `ctrl + shift + _`
+#   3. And Other common shortcuts such as Copy, Paste, Cursor Move, etc.
+#
+###########################################################
+{
+  programs.kitty = {
+    enable = true;
+    # kitty has catppuccin theme built-in,
+    # all the built-in themes are packaged into an extra package named `kitty-themes`
+    # and it's installed by home-manager if `theme` is specified.
+    themeFile = "Catppuccin-Mocha";
+    font = {
+      name = "JetBrainsMono Nerd Font";
+      # use different font size on macOS
+      size =
+        if pkgs.stdenv.isDarwin
+        then 14
+        else 13;
+    };
+
+    # consistent with other terminal emulators
+    keybindings = {
+      "ctrl+shift+m" = "toggle_maximized";
+      "ctrl+shift+f" = "show_scrollback"; # search in the current window
+    };
+
+    settings = {
+      background_opacity = "0.93";
+      macos_option_as_alt = true; # Option key acts as Alt on macOS
+      enable_audio_bell = false;
+      tab_bar_edge = "top"; # tab bar on top
+      #  To resolve issues:
+      #    1. https://github.com/ryan4yin/nix-config/issues/26
+      #    2. https://github.com/ryan4yin/nix-config/issues/8
+      #  Spawn a nushell in login mode via `bash`
+      shell = "${pkgs.bash}/bin/bash --login -c 'nu --login --interactive'";
+    };
+
+    # macOS specific settings
+    darwinLaunchOptions = ["--start-as=maximized"];
+  };
+}

home/base/home.nix

@@ -1,15 +1,8 @@
-{ username, ... }: {
+{myvars, ...}: {
-  imports = [
-    ../base/server
-
-    ./base
-  ];
-
   # Home Manager needs a bit of information about you and the
   # paths it should manage.
   home = {
-    username = username;
+    inherit (myvars) username;
-    homeDirectory = "/home/${username}";
 
     # This value determines the Home Manager release that your
     # configuration is compatible with. This helps avoid breakage
@@ -19,9 +12,6 @@
     # You can update Home Manager without changing this value. See
     # the Home Manager release notes for a list of state version
     # changes in each release.
-    stateVersion = "22.11";
+    stateVersion = "24.11";
   };
-
-  # Let Home Manager install and manage itself.
-  programs.home-manager.enable = true;
 }

home/base/server/bash.nix

@@ -1,16 +0,0 @@
-{...}: {
-  programs.bash = {
-    enable = true;
-    enableCompletion = true;
-    bashrcExtra = ''
-      export PATH="$PATH:$HOME/bin:$HOME/.local/bin:$HOME/go/bin"
-    '';
-
-    shellAliases = {
-      k = "kubectl";
-
-      urldecode = "python3 -c 'import sys, urllib.parse as ul; print(ul.unquote_plus(sys.stdin.read()))'";
-      urlencode = "python3 -c 'import sys, urllib.parse as ul; print(ul.quote_plus(sys.stdin.read()))'";
-    };
-  };
-}

home/base/server/bat/Catppuccin-mocha.tmTheme

@@ -1,959 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-  <dict>
-    <key>name</key>
-    <string>Catppuccin</string>
-    <key>settings</key>
-    <array>
-      <dict>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cdd6f4</string>
-          <key>background</key>
-          <string>#1e1e2e</string>
-          <key>caret</key>
-          <string>#bac2de</string>
-          <key>invisibles</key>
-          <string>#a6adc8</string>
-          <key>gutterForeground</key>
-          <string>#9399b2</string>
-          <key>gutterForegroundHighlight</key>
-          <string>#a6e3a1</string>
-          <key>lineHighlight</key>
-          <string>#585b70</string>
-          <key>selection</key>
-          <string>#6c7086</string>
-          <key>selectionBorder</key>
-          <string>#1e1e2e</string>
-          <key>activeGuide</key>
-          <string>#fab387</string>
-          <key>findHighlightForeground</key>
-          <string>#181825</string>
-          <key>findHighlight</key>
-          <string>#f9e2af</string>
-          <key>bracketsForeground</key>
-          <string>#9399b2</string>
-          <key>bracketContentsForeground</key>
-          <string>#9399b2</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Comment</string>
-        <key>scope</key>
-        <string>comment</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#6c7086</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>String</string>
-        <key>scope</key>
-        <string>string</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#a6e3a1</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>String regex</string>
-        <key>scope</key>
-        <string>string.regexp</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Number</string>
-        <key>scope</key>
-        <string>constant.numeric</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Boolean</string>
-        <key>scope</key>
-        <string>constant.language.boolean</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string>bold italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Built-in constant</string>
-        <key>scope</key>
-        <string>constant.language</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#b4befe</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Built-in function</string>
-        <key>scope</key>
-        <string>support.function.builtin</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>User-defined constant</string>
-        <key>scope</key>
-        <string>variable.other.constant</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Variable</string>
-        <key>scope</key>
-        <string>variable</string>
-        <key>settings</key>
-        <dict></dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Keyword</string>
-        <key>scope</key>
-        <string>keyword</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Conditional/loop</string>
-        <key>scope</key>
-        <string>keyword.control.loop, keyword.control.conditional, keyword.control.c++</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cba6f7</string>
-          <key>fontStyle</key>
-          <string>bold</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Return</string>
-        <key>scope</key>
-        <string>keyword.control.return, keyword.control.flow.return</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5c2e7</string>
-          <key>fontStyle</key>
-          <string>bold</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Exception</string>
-        <key>scope</key>
-        <string>support.type.exception</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Operator</string>
-        <key>scope</key>
-        <string>keyword.operator, punctuation.accessor</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89dceb</string>
-          <key>fontStyle</key>
-          <string>bold</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Punctuation separator</string>
-        <key>scope</key>
-        <string>punctuation.separator</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Punctuation terminator</string>
-        <key>scope</key>
-        <string>punctuation.terminator</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Punctuation bracket</string>
-        <key>scope</key>
-        <string>punctuation.section</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#9399b2</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Include</string>
-        <key>scope</key>
-        <string>keyword.control.import.include</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Storage</string>
-        <key>scope</key>
-        <string>storage</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Storage type</string>
-        <key>scope</key>
-        <string>storage.type</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f9e2af</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Storage modifier</string>
-        <key>scope</key>
-        <string>storage.modifier</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Storage type namespace</string>
-        <key>scope</key>
-        <string>entity.name.namespace, meta.path</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5e0dc</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Storage type class</string>
-        <key>scope</key>
-        <string>storage.type.class</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5e0dc</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Label</string>
-        <key>scope</key>
-        <string>entity.name.label</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89b4fa</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Keyword class</string>
-        <key>scope</key>
-        <string>keyword.declaration.class</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Class name</string>
-        <key>scope</key>
-        <string>entity.name.class, meta.toc-list.full-identifier</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89dceb</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Inherited class</string>
-        <key>scope</key>
-        <string>entity.other.inherited-class</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89dceb</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Function name</string>
-        <key>scope</key>
-        <string>entity.name.function, variable.function</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89b4fa</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Function macro</string>
-        <key>scope</key>
-        <string>entity.name.function.preprocessor</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Macro directive - ifdef</string>
-        <key>scope</key>
-        <string>keyword.control.import</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Constructor</string>
-        <key>scope</key>
-        <string>entity.name.function.constructor, entity.name.function.destructor</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#b4befe</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Function argument</string>
-        <key>scope</key>
-        <string>variable.parameter.function</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5e0dc</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Function declaration</string>
-        <key>scope</key>
-        <string>keyword.declaration.function</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#eba0ac</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Library function</string>
-        <key>scope</key>
-        <string>support.function</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89dceb</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Library constant</string>
-        <key>scope</key>
-        <string>support.constant</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89b4fa</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Library class/type</string>
-        <key>scope</key>
-        <string>support.type, support.class</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89b4fa</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Library variable</string>
-        <key>scope</key>
-        <string>support.other.variable</string>
-        <key>settings</key>
-        <dict>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Variable function</string>
-        <key>scope</key>
-        <string>variable.function</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89b4fa</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Variable parameter</string>
-        <key>scope</key>
-        <string>variable.parameter</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5e0dc</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Variable other</string>
-        <key>scope</key>
-        <string>variable.other</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cdd6f4</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Variable field</string>
-        <key>scope</key>
-        <string>variable.other.member</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5e0dc</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Variable language</string>
-        <key>scope</key>
-        <string>variable.language</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Tag name</string>
-        <key>scope</key>
-        <string>entity.name.tag</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#fab387</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Tag attribute</string>
-        <key>scope</key>
-        <string>entity.other.attribute-name</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cba6f7</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Tag delimiter</string>
-        <key>scope</key>
-        <string>punctuation.definition.tag</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#eba0ac</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Markdown URL</string>
-        <key>scope</key>
-        <string>markup.underline.link.markdown</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5e0dc</string>
-          <key>fontStyle</key>
-          <string>italic underline</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Markdown reference</string>
-        <key>scope</key>
-        <string>meta.link.inline.description</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#b4befe</string>
-          <key>fontStyle</key>
-          <string>bold</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Markdown literal</string>
-        <key>scope</key>
-        <string>comment.block.markdown, meta.code-fence, markup.raw.code-fence, markup.raw.inline</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Markdown title</string>
-        <key>scope</key>
-        <string>punctuation.definition.heading, entity.name.section</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#89b4fa</string>
-          <key>fontStyle</key>
-          <string>bold</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Markdown emphasis</string>
-        <key>scope</key>
-        <string>markup.italic</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#eba0ac</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Markdown strong</string>
-        <key>scope</key>
-        <string>markup.bold</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#eba0ac</string>
-          <key>fontStyle</key>
-          <string>bold</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Escape</string>
-        <key>scope</key>
-        <string>constant.character.escape</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5c2e7</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Bash built-in function</string>
-        <key>scope</key>
-        <string>source.shell.bash meta.function.shell meta.compound.shell meta.function-call.identifier.shell</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f5c2e7</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Bash parameter</string>
-        <key>scope</key>
-        <string>variable.language.shell</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Lua field</string>
-        <key>scope</key>
-        <string>source.lua meta.function.lua meta.block.lua meta.mapping.value.lua meta.mapping.key.lua string.unquoted.key.lua</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#b4befe</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Lua constructor</string>
-        <key>scope</key>
-        <string>source.lua meta.function.lua meta.block.lua meta.mapping.key.lua string.unquoted.key.lua</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f2cdcd</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Java constant</string>
-        <key>scope</key>
-        <string>entity.name.constant.java</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>CSS property</string>
-        <key>scope</key>
-        <string>support.type.property-name.css</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f2cdcd</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>CSS constant</string>
-        <key>scope</key>
-        <string>support.constant.property-value.css</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cdd6f4</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>CSS suffix</string>
-        <key>scope</key>
-        <string>constant.numeric.suffix.css, keyword.other.unit.css</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string>italic</string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>CSS variable property</string>
-        <key>scope</key>
-        <string>variable.other.custom-property.name.css, support.type.custom-property.name.css, punctuation.definition.custom-property.css</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>SCSS tag</string>
-        <key>scope</key>
-        <string>entity.name.tag.css</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#b4befe</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>SASS variable</string>
-        <key>scope</key>
-        <string>variable.other.sass</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#94e2d5</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Invalid</string>
-        <key>scope</key>
-        <string>invalid</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cdd6f4</string>
-          <key>background</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Invalid deprecated</string>
-        <key>scope</key>
-        <string>invalid.deprecated</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#cdd6f4</string>
-          <key>background</key>
-          <string>#cba6f7</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Diff header</string>
-        <key>scope</key>
-        <string>meta.diff, meta.diff.header</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#6c7086</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Diff deleted</string>
-        <key>scope</key>
-        <string>markup.deleted</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Diff inserted</string>
-        <key>scope</key>
-        <string>markup.inserted</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#a6e3a1</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Diff changed</string>
-        <key>scope</key>
-        <string>markup.changed</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f9e2af</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-      <dict>
-        <key>name</key>
-        <string>Message error</string>
-        <key>scope</key>
-        <string>message.error</string>
-        <key>settings</key>
-        <dict>
-          <key>foreground</key>
-          <string>#f38ba8</string>
-          <key>fontStyle</key>
-          <string></string>
-        </dict>
-      </dict>
-    </array>
-    <key>uuid</key>
-    <string>4d0379b5-ef82-467b-b8b8-365889420646</string>
-    <key>colorSpaceName</key>
-    <string>sRGB</string>
-    <key>semanticClass</key>
-    <string>theme.dark.Catppuccin</string>
-    <key>author</key>
-    <string>BrunDerSchwarzmagier</string>
-  </dict>
-</plist>

home/base/server/bat/default.nix

@@ -1,14 +0,0 @@
-{...}: {
-  # a cat(1) clone with syntax highlighting and Git integration.
-  programs.bat = {
-    enable = true;
-    config = {
-      pager = "less -FR";
-      theme = "Catppuccin-mocha";
-    };
-    themes = {
-      # https://raw.githubusercontent.com/catppuccin/bat/main/Catppuccin-mocha.tmTheme
-      Catppuccin-mocha = builtins.readFile ./Catppuccin-mocha.tmTheme;
-    };
-  };
-}

home/base/server/core.nix

@@ -1,76 +0,0 @@
-{pkgs, ...}: {
-  home.packages = with pkgs; [
-    neofetch
-    nnn # terminal file manager
-
-    # archives
-    zip
-    xz
-    unzip
-    p7zip
-
-    # utils
-    ripgrep # recursively searches directories for a regex pattern
-    jq # A lightweight and flexible command-line JSON processor
-    yq-go # yaml processer https://github.com/mikefarah/yq
-    fzf # A command-line fuzzy finder
-
-    # networking tools
-    mtr # A network diagnostic tool
-    iperf3
-    dnsutils # `dig` + `nslookup`
-    ldns # replacement of `dig`, it provide the command `drill`
-    aria2 # A lightweight multi-protocol & multi-source command-line download utility
-    socat # replacement of openbsd-netcat
-    nmap # A utility for network discovery and security auditing
-    ipcalc # it is a calculator for the IPv4/v6 addresses
-
-    # misc
-    cowsay
-    file
-    which
-    tree
-    gnused
-    gnutar
-    gawk
-    zstd
-    caddy
-    gnupg
-
-    # nix related
-    #
-    # it provides the command `nom` works just like `nix
-    # with more details log output
-    nix-output-monitor
-    nodePackages.node2nix
-
-    # productivity
-    hugo # static site generator
-    glow # markdown previewer in terminal
-  ];
-
-  programs = {
-    # modern vim
-    neovim = {
-      enable = true;
-      defaultEditor = true;
-      vimAlias = true;
-    };
-
-    # A modern replacement for ‘ls’
-    # useful in bash/zsh prompt, not in nushell.
-    exa = {
-      enable = true;
-      enableAliases = true;
-      git = true;
-      icons = true;
-    };
-
-    # skim provides a single executable: sk.
-    # Basically anywhere you would want to use grep, try sk instead.
-    skim = {
-      enable = true;
-      enableBashIntegration = true;
-    };
-  };
-}

home/base/server/default.nix

@@ -1,13 +0,0 @@
-{...}: {
-  imports = [
-    ./bat
-    ./nushell
-    ./tmux
-    ./zellij
-
-    ./bash.nix
-    ./core.nix
-    ./git.nix
-    ./starship.nix
-  ];
-}

home/base/server/git.nix

@@ -1,81 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-
-  userfullname,
-  useremail,
-  ...
-}: {
-  # `programs.git` will generate the config file: ~/.config/git/config
-  # to make git use this config file, `~/.gitconfig` should not exist!
-  #
-  #    https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
-  home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
-    rm -f ~/.gitconfig
-  '';
-
-  programs.git = {
-    enable = true;
-    lfs.enable = true;
-
-    userName = userfullname;
-    userEmail = useremail;
-
-    includes = [
-      {
-        # use diffrent email & name for work
-        path = "~/work/.gitconfig";
-        condition = "gitdir:~/work/";
-      }
-    ];
-
-    extraConfig = {
-      init.defaultBranch = "main";
-      push.autoSetupRemote = true;
-      pull.rebase = true;
-
-      # replace https with ssh
-      url = {
-        "ssh://git@github.com/" = {
-          insteadOf = "https://github.com/";
-        };
-        "ssh://git@gitlab.com/" = {
-          insteadOf = "https://gitlab.com/";
-        };
-        "ssh://git@bitbucket.com/" = {
-          insteadOf = "https://bitbucket.com/";
-        };
-      };
-    };
-
-    # signing = {
-    #   key = "xxx";
-    #   signByDefault = true;
-    # };
-
-    delta = {
-      enable = true;
-      options = {
-        features = "side-by-side";
-      };
-    };
-
-    aliases = {
-      # common aliases
-      br = "branch";
-      co = "checkout";
-      st = "status";
-      ls = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate";
-      ll = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate --numstat";
-      cm = "commit -m";
-      ca = "commit -am";
-      dc = "diff --cached";
-      amend = "commit --amend -m";
-
-      # aliases for submodule
-      update = "submodule update --init --recursive";
-      foreach = "submodule foreach";
-    };
-  };
-}

home/base/server/nushell/config.nu

@@ -1,50 +0,0 @@
-# Nushell Config File
-#
-# version = 0.81.1
-
-# The default config record. This is where much of your global configuration is setup.
-let-env config = {
-  # true or false to enable or disable the welcome banner at startup
-  show_banner: false
-  
-  table: {
-    mode: rounded # basic, compact, compact_double, light, thin, with_love, rounded, reinforced, heavy, none, other
-    index_mode: always # "always" show indexes, "never" show indexes, "auto" = show indexes when a table has "index" column
-    show_empty: true # show 'empty list' and 'empty record' placeholders for command output
-    trim: {
-      methodology: wrapping # wrapping or truncating
-      wrapping_try_keep_words: true # A strategy used by the 'wrapping' methodology
-      truncating_suffix: "..." # A suffix used by the 'truncating' methodology
-    }
-  }
-
-  completions: {
-    case_sensitive: false # set to true to enable case-sensitive completions
-    quick: true  # set this to false to prevent auto-selecting completions when only one remains
-    partial: true  # set this to false to prevent partial filling of the prompt
-    algorithm: "prefix"  # prefix or fuzzy
-    external: {
-      enable: true # set to false to prevent nushell looking into $env.PATH to find more suggestions, `false` recommended for WSL users as this look up may be very slow
-      max_results: 100 # setting it lower can improve completion performance at the cost of omitting some options
-      completer: null # check 'carapace_completer' above as an example
-    }
-  }
-  filesize: {
-    metric: true # true => KB, MB, GB (ISO standard), false => KiB, MiB, GiB (Windows standard)
-    format: "auto" # b, kb, kib, mb, mib, gb, gib, tb, tib, pb, pib, eb, eib, zb, zib, auto
-  }
-  cursor_shape: {
-    emacs: line # block, underscore, line, blink_block, blink_underscore, blink_line (line is the default)
-    vi_insert: block # block, underscore, line , blink_block, blink_underscore, blink_line (block is the default)
-    vi_normal: underscore # block, underscore, line, blink_block, blink_underscore, blink_line (underscore is the default)
-  }
-  use_grid_icons: true
-  footer_mode: "25" # always, never, number_of_rows, auto
-  float_precision: 2 # the precision for displaying floats in tables
-  # buffer_editor: "emacs" # command that will be used to edit the current line buffer with ctrl+o, if unset fallback to $env.EDITOR and $env.VISUAL
-  use_ansi_coloring: true
-  bracketed_paste: true # enable bracketed paste, currently useless on windows
-  edit_mode: emacs # emacs, vi
-  shell_integration: true # enables terminal markers and a workaround to arrow keys stop working issue
-  render_right_prompt_on_last_line: false # true or false to enable or disable right prompt to be rendered on last line of the prompt.
-}

home/base/server/nushell/default.nix

@@ -1,19 +0,0 @@
-{...}: {
-  programs.nushell = {
-    enable = true;
-    configFile.source = ./config.nu;
-
-    # home-manager will merge the cotent in `environmentVariables` with the `envFile.source`
-    # but basically, I set all environment variables via the shell-independent way, so I don't need to use those two options
-    #
-    # envFile.source = ./env.nu;
-    # environmentVariables = { FOO="bar"; };
-
-    shellAliases = {
-      k = "kubectl";
-
-      urldecode = "python3 -c 'import sys, urllib.parse as ul; print(ul.unquote_plus(sys.stdin.read()))'";
-      urlencode = "python3 -c 'import sys, urllib.parse as ul; print(ul.quote_plus(sys.stdin.read()))'";
-    };
-  };
-}

home/base/server/starship.nix

@@ -1,25 +0,0 @@
-{...}: {
-  programs.starship = {
-    enable = true;
-
-    enableBashIntegration = true;
-    enableZshIntegration = true;
-    enableNushellIntegration = true;
-
-    settings = {
-      character = {
-        success_symbol = "[›](bold green)";
-        error_symbol = "[›](bold red)";
-      };
-      aws = {
-        symbol = "🅰 ";
-      };
-      gcloud = {
-        # do not show the account/project's info
-        # to avoid the leak of sensitive information when sharing the terminal
-        format = "on [$symbol$active(\($region\))]($style) ";
-        symbol = "🅶 ️";
-      };
-    };
-  };
-}

home/base/server/tmux/custom-plugins.nix

@@ -1,13 +0,0 @@
-{pkgs, ...}: let
-  buildTmuxPlugin = pkgs.tmuxPlugins.mkTmuxPlugin;
-in {
-  draculaTheme = buildTmuxPlugin {
-    pluginName = "dracula";
-    version = "v2.2.0";
-    src = builtins.fetchTarball {
-      name = "dracula-tmux-v2.2.0";
-      url = "https://github.com/dracula/tmux/archive/refs/tags/v2.2.0.tar.gz";
-      sha256 = "sha256:0v2k994yy4xx2iw8qxg7qphw46gq2qmg496i3a3h9b6jgwxqm7zn";
-    };
-  };
-}