feat: add support for canokeys

chore: update zed-editor settings, remove unused packages(java,zig,etc)
fix: shoukei - noctalia - adjust brightness
2026-07-07 13:25:11 +02:00 · 2026-06-14 11:38:56 +08:00 · 2026-06-12 22:30:04 +08:00 · 2026-06-12 15:55:51 +08:00 · 2026-06-12 14:10:20 +08:00 · 2026-06-12 14:07:37 +08:00
42 changed files with 416 additions and 331 deletions
@@ -141,6 +141,11 @@ niri mode="default":
 #
 ############################################################################

+[macos]
+[group('desktop')]
+brew-upgrade:
+  brew upgrade --cask --greedy
+
 [macos]
 [group('desktop')]
 darwin-set-proxy:
@@ -555,11 +555,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1780275889,
-        "narHash": "sha256-srcKWB7mBO+mNWsDUmODs5CDDdQ0XjP1NX4iUM45eZo=",
+        "lastModified": 1781228339,
+        "narHash": "sha256-gYIQvLpoGLH34tw3lZp11IrK82mkttLcw5sPErGe3+k=",
        "owner": "numtide",
        "repo": "llm-agents.nix",
-        "rev": "468bacd83af1b3bf36bceb0366967928b98c9e60",
+        "rev": "27d586e930f255a425ec2f9f238f078880333d09",
        "type": "github"
      },
      "original": {
@@ -588,10 +588,10 @@
    "mysecrets": {
      "flake": false,
      "locked": {
-        "lastModified": 1773927262,
-        "narHash": "sha256-nxx7jAiHGTYU6hXdjHYjdR1SJNgFcVPokiFlR8MZwTc=",
+        "lastModified": 1781242064,
+        "narHash": "sha256-Bn9mOj7CkdnepiwkiGiHPpvZs0HYrQsjB4Z+EJE+v+s=",
        "ref": "refs/heads/main",
-        "rev": "c388ca33beb5c099bf4603e6ab25a2e94af00b80",
+        "rev": "490e3aca901fa703083822ee64a65f0a1f4529af",
        "shallow": true,
        "type": "git",
        "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"
@@ -725,11 +725,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1780030872,
-        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
+        "lastModified": 1780930886,
+        "narHash": "sha256-rppURzHviaQN131F+nLiLdGfcb0uCd9gGP0E5+iw9MI=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
+        "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e",
        "type": "github"
      },
      "original": {
@@ -788,11 +788,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1780278297,
-        "narHash": "sha256-ZR9YfHXIBOCDYWEKvGaLdYqwm5lwQPSMVPjg7Hb7uHE=",
+        "lastModified": 1781229721,
+        "narHash": "sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c2a4e65eaf219d52ec3bf3a04e69a1e5631500d4",
+        "rev": "173d0ad7a974f8543a9ab01d2271b2e290341b33",
        "type": "github"
      },
      "original": {
@@ -804,11 +804,11 @@
    },
    "nixpkgs-patched": {
      "locked": {
-        "lastModified": 1774012337,
-        "narHash": "sha256-75W3YfzkkKvpE3/wtHMihlT9kOnQZxWpLoshw1xu0T8=",
+        "lastModified": 1780458942,
+        "narHash": "sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4=",
        "owner": "ryan4yin",
        "repo": "nixpkgs",
-        "rev": "d373b16187b32770d99f6ff54a133d9543e68702",
+        "rev": "4425024452e93ce3d10e11bcd9b47f1dfa78593b",
        "type": "github"
      },
      "original": {
@@ -1,6 +1,6 @@
 {
  pkgs,
-  pkgs-master,
+  pkgs-patched,
  nixpak,
  ...
 }:
@@ -22,7 +22,7 @@ in
  nixpkgs.overlays = [
    (_: super: {
      nixpaks = {
-        qq = wrapper super ./qq.nix;
+        qq = wrapper pkgs-patched ./qq.nix;
        telegram-desktop = wrapper super ./telegram-desktop.nix;
        firefox = wrapper super ./firefox.nix;
      };
@@ -51,8 +51,7 @@ In Helix, `|` / `!` and variants pipe or insert shell output on selections (see

 This flake’s Helix Home Manager module keeps **almost all default keys**; the only remap is
 **`Ctrl+Shift+o`** → jump backward, because Zellij uses **`Ctrl+o`** for Session (see
-`home/base/core/editors/helix/default.nix`). For other Zellij clashes, use **locked mode**
-(`Ctrl+g`), **`:`** commands, or the built-in **`Space`** menu.
+`home/base/core/editors/helix/default.nix`).

 ### Command mode (`:`)

@@ -64,6 +63,7 @@ This flake’s Helix Home Manager module keeps **almost all default keys**; the
 | Quit view / quit all   | `:q` / `:qa` — add `!` to discard changes                            |
 | Write and quit         | `:wq`, `:x`                                                          |
 | Write all and quit all | `:wqa`, `:xa`                                                        |
+| Save to path           | `:w path`                                                            |
 | Open file              | `:open path`, `:e path`                                              |
 | Next / previous buffer | `:bn` / `:bp` (also `gn` / `gp` in normal)                           |
 | Close buffer           | `:bc` (add `!` to force)                                             |
@@ -73,37 +73,51 @@ This flake’s Helix Home Manager module keeps **almost all default keys**; the

 ### Movement (normal mode)

-| Action                | Keys / notes                                        |
-| --------------------- | --------------------------------------------------- |
-| Arrow keys            | `h` `j` `k` `l`                                     |
-| Words                 | `w` `b` `e` — `W` `B` `E` for WORD-style            |
-| Find char / till char | `f` `F` `t` `T` (not limited to current line)       |
-| Line / file           | `Home` / `End`; `gg` start or goto line; `G` line   |
-| Half / full page      | `Ctrl-u` / `Ctrl-d`; `Ctrl-b` / `Ctrl-f`            |
-| Jumplist              | `Ctrl-o` back, `Ctrl-i` forward; `Ctrl-s` save spot |
+| Action                | Keys / notes                                                         |
+| --------------------- | -------------------------------------------------------------------- |
+| Arrow keys            | `h` `j` `k` `l`                                                      |
+| Words                 | `w` `b` `e` — `W` `B` `E` for WORD-style                             |
+| Counts                | Prefix motions with a count: `2w`, `3e`, `2b`, `2x`                  |
+| Find char / till char | `f` `F` `t` `T` (not limited to current line)                        |
+| Repeat find / till    | `Alt-.` repeats the last `f` / `t` selection                         |
+| Word-label jump       | `gw` shows two-character labels; type a label to jump, `Esc` cancels |
+| Line / file           | `Home` / `End`; `gg` start or goto line; `G` line                    |
+| Half / full page      | `Ctrl-u` / `Ctrl-d`; `Ctrl-b` / `Ctrl-f`                             |
+| Jumplist              | `Ctrl-o` back, `Ctrl-i` forward; `Ctrl-s` save spot                  |

 ### Selection & changes

-| Action                 | Keys / notes                                                      |
-| ---------------------- | ----------------------------------------------------------------- |
-| Extend selections      | `v` select mode; motions extend instead of moving                 |
-| Line selection         | `x` extend line; `X` line bounds                                  |
-| Select all / regex     | `%`; `s` regex in selections; `S` split on regex                  |
-| Undo / redo            | `u` / `U`                                                         |
-| Delete / change / yank | `d` / `c` / `y` — acts on selection                               |
-| Paste                  | `p` / `P`; registers `"` …                                        |
-| Insert                 | `i` `a` `I` `A` `o` `O`                                           |
-| Indent / format        | `>` / `<`; `=` format (LSP)                                       |
-| Case                   | `~` toggle; lower/upper case via grave / `Alt-grave` (see keymap) |
-| Join lines             | `J`; `Alt-J` join keeping space                                   |
+| Action                 | Keys / notes                                                                |
+| ---------------------- | --------------------------------------------------------------------------- |
+| Extend selections      | `v` select mode; motions extend instead of moving; `v` or `Esc` leaves mode |
+| Line selection         | `x` extend line; `X` line bounds; repeat or use a count for more lines      |
+| Collapse selections    | `;` collapse selections back to cursors                                     |
+| Select all / regex     | `%`; `s` regex in selections; `S` split on regex                            |
+| Multiple cursors       | `C` duplicate to next suitable line; `Alt-C` above; `,` remove one cursor   |
+| Align selections       | `&` align selection contents                                                |
+| Undo / redo            | `u` / `U`                                                                   |
+| Delete / change / yank | `d` / `c` / `y` — acts on selection                                         |
+| Replace with yank      | `R` replace selection with yanked text                                      |
+| Paste                  | `p` / `P`; registers `"` …                                                  |
+| Register prefix        | `"<char>` selects a register for yank/paste/macro operations                |
+| Insert                 | `i` `a` `I` `A` `o` `O`                                                     |
+| Repeat insert          | `.` repeat the last insertion                                               |
+| Replace selected chars | `r<char>`                                                                   |
+| Indent / format        | `>` / `<`; `=` format (LSP)                                                 |
+| Increment / decrement  | `Ctrl-a` / `Ctrl-x` on selected numbers                                     |
+| Case                   | `~` toggle; lower/upper case via grave / `Alt-grave` (see Alt caveat above) |
+| Join lines             | `J`; `Alt-J` join keeping space (see Alt caveat above)                      |
+| Toggle line comment    | `Ctrl-c`                                                                    |
+| Macro record / replay  | `Q` start/stop recording; `q` replay from the default `@` register          |

 ### Search

-| Action               | Keys                                     |
-| -------------------- | ---------------------------------------- |
-| Search / reverse     | `/` / `?`                                |
-| Next / prev match    | `n` / `N`                                |
-| Selection as pattern | `*` (word bounds); `Alt-*` raw selection |
+| Action               | Keys                                                            |
+| -------------------- | --------------------------------------------------------------- |
+| Search / reverse     | `/` / `?`                                                       |
+| Next / prev match    | `n` / `N`                                                       |
+| Selection as pattern | `*` (word bounds); `Alt-*` raw selection (see Alt caveat above) |
+| Split on newlines    | `Alt-s`                                                         |

 Use **extend mode** (`v`) with `n` / `N` to add matches to multi-cursors
 ([keymap](https://docs.helix-editor.com/keymap.html#select--extend-mode)).
@@ -1,7 +1,15 @@
-{ config, nixvim, ... }:
+{
+  config,
+  nixpkgs,
+  nixvim,
+  pkgs,
+  ...
+}:
 {

  imports = [ nixvim.homeModules.nixvim ];
+
+  programs.nixvim.nixpkgs.source = nixpkgs;
  home.shellAliases = {

    vi = "nvim";
@@ -11,7 +19,7 @@
  programs.nixvim = {
    enable = true;

-    clipboard.providers.wl-copy.enable = true;
+    clipboard.providers.wl-copy.enable = pkgs.stdenv.isLinux;

    opts = {
      number = true;
@@ -1,9 +1,14 @@
 { config, ... }:
 {
-  # 1. make `npm install -g <pkg>` happey
-  # 2. set min-release-age for security
+  # make `npm install -g <pkg>` happey
+  # npm - set min-release-age(in days) for supply-chain security
  home.file.".npmrc".text = ''
    prefix=${config.home.homeDirectory}/.npm
-    min-release-age=7
+    min-release-age=2
+  '';
+
+  # npm - set min release age (in minutes) for supply-chain security
+  xdg.configFile."pnpm/config.yaml".text = ''
+    minimumReleaseAge: 2880
  '';
 }
@@ -1,7 +1,14 @@
 _: {
-  # use mirror for pip install
+  # use pypi mirror
+  # filter packages via upload time for supply-chain security
  xdg.configFile."pip/pip.conf".text = ''
    [global]
    index-url = https://mirrors.bfsu.edu.cn/pypi/web/simple
+
+    [install]
+    uploaded-prior-to = P2D
+  '';
+  xdg.configFile."uv/uv.toml".text = ''
+    exclude-newer = "2 days"
  '';
 }
@@ -12,9 +12,9 @@
    enable = true;
    package =
      if pkgs.stdenv.isDarwin then
-        pkgs.hello # pkgs.ghostty is currently broken on darwin
+        null # installed via Homebrew cask on darwin
      else
-        pkgs.ghostty; # the stable version
+        pkgs.ghostty;
    enableBashIntegration = false;
    installBatSyntax = false;
    # installVimSyntax = true;
@@ -0,0 +1,137 @@
+{ lib, ... }:
+{
+  catppuccin.zed.enable = true;
+
+  programs.zed-editor = {
+    enable = true;
+    mutableUserSettings = true;
+
+    userSettings = {
+      # Language-specific settings
+      languages = {
+        Python = {
+          formatter.language_server.name = "ruff";
+          language_servers = [
+            "ty"
+            "ruff"
+            "!basedpyright"
+            "!pyrefly"
+            "!pyright"
+            "!pylsp"
+          ];
+        };
+        Rust = {
+          hard_tabs = false;
+          formatter.language_server.name = "rust-analyzer";
+          language_servers = [
+            "rust-analyzer"
+            "!rustc"
+          ];
+        };
+        Go = {
+          formatter.language_server.name = "gopls";
+          language_servers = [
+            "gopls"
+            "!goimports"
+          ];
+        };
+      };
+
+      # Terminal
+      terminal.shell.with_arguments = {
+        program = "bash";
+        args = [
+          "--login"
+          "-c"
+          "nu --login --interactive"
+        ];
+      };
+
+      # Editor behavior
+      auto_signature_help = true;
+      autosave = "on_focus_change";
+      code_lens = "on";
+      completion_menu_item_kind = "symbol";
+      completions.lsp_fetch_timeout_ms = 2000;
+      diagnostics.inline.enabled = true;
+      document_folding_ranges = "off";
+      inlay_hints.enabled = true;
+      minimap.show = "auto";
+      relative_line_numbers = "enabled";
+      semantic_tokens = "combined";
+      soft_wrap = "editor_width";
+      vertical_scroll_margin = 5.0;
+      which_key.enabled = true;
+      indent_guides = {
+        background_coloring = "indent_aware";
+        coloring = "indent_aware";
+      };
+
+      # Search
+      search.regex = true;
+      use_smartcase_search = true;
+
+      # Formatting
+      prettier.allowed = true;
+
+      # UI chrome
+      tabs = {
+        file_icons = true;
+        git_status = true;
+      };
+      title_bar = {
+        show_branch_status_icon = true;
+        show_menus = false;
+        show_user_menu = true;
+      };
+
+      # Git
+      git.inline_blame.show_commit_summary = true;
+
+      # Modal editing
+      helix_mode = true;
+      vim = {
+        use_smartcase_find = true;
+        toggle_relative_line_numbers = true;
+      };
+
+      # Fonts
+      ui_font_family = lib.mkDefault "LXGW WenKai Screen";
+      ui_font_size = lib.mkDefault 16.0;
+      buffer_font_family = lib.mkDefault "Maple Mono NF CN";
+      buffer_font_size = lib.mkDefault 14.0;
+      agent_ui_font_size = lib.mkDefault 16.0;
+      agent_buffer_font_size = lib.mkDefault 15.0;
+
+      # App behavior
+      auto_update = false;
+      cli_default_open_behavior = "existing_window";
+
+      # AI/editor integrations
+      agent.play_sound_when_agent_done = "when_hidden";
+      agent_servers = {
+        opencode.type = "registry";
+        cursor.type = "registry";
+        codex-acp.type = "registry";
+        claude-acp.type = "registry";
+      };
+
+      # Privacy
+      edit_predictions.allow_data_collection = "no";
+      telemetry = {
+        diagnostics = false;
+        metrics = false;
+      };
+    };
+
+    extensions = [
+      "catppuccin"
+      "dockerfile"
+      "just"
+      "nix"
+      "nu"
+      "terraform"
+      "toml"
+    ];
+  };
+}
@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    pcsc-tools
+  ];
+}
@@ -21,16 +21,14 @@
    # pulumiPackages.pulumi-language-python
    # pulumiPackages.pulumi-language-nodejs

+    # doctl # digitalocean
+    aliyun-cli
    # aws
    awscli2
    ssm-session-manager-plugin # Amazon SSM Session Manager Plugin
    aws-iam-authenticator
    eksctl

-    # aliyun
-    aliyun-cli
-    # digitalocean
-    doctl
    # google cloud
    (pkgs-stable.google-cloud-sdk.withExtraComponents (
      with pkgs-stable.google-cloud-sdk.components;
@@ -38,6 +36,8 @@
        gke-gcloud-auth-plugin
      ]
    ))
+    google-cloud-sql-proxy
+    google-alloydb-auth-proxy

    # cloud tools that nix do not have cache for.
    terraform
@@ -16,11 +16,7 @@
        deadnix # Find and remove unused code in .nix source files
        nixfmt # Nix Code Formatter

-        #-- nickel lang
-        nickel
-
        #-- json like
-        # terraform  # install via brew on macOS
        terraform-ls
        jsonnet
        jsonnet-language-server
@@ -66,23 +62,18 @@
          (python313.withPackages (
            ps: with ps; [
              # python language server
-              pyright
+              ty
              ruff

-              black # python formatter
-
              # my commonly used python packages
              jupyter
              ipython
              pandas
+              numpy
              requests
              pyquery
              pyyaml
-              boto3
-
-              # misc
              protobuf # protocol buffer compiler
-              numpy
            ]
          ))

@@ -104,14 +95,11 @@
          delve # go debugger

          # -- java
-          jdk17
-          gradle
-          maven
-          spring-boot-cli
-          jdt-language-server
-
-          #-- zig
-          zls
+          # jdk25
+          # gradle
+          # maven
+          # spring-boot-cli
+          # jdt-language-server

          #-- lua
          stylua
@@ -134,23 +122,9 @@
        tailwindcss-language-server
        emmet-ls
      ]
-      # -*- Lisp like Languages -*-#
-      # ++ [
-      #   guile
-      #   racket-minimal
-      #   fnlfmt # fennel
-      #   (
-      #     if pkgs.stdenv.isLinux && pkgs.stdenv.isx86
-      #     then pkgs-master.akkuPackages.scheme-langserver
-      #     else pkgs.emptyDirectory
-      #   )
-      # ]
      ++ [
        proselint # English prose linter

-        #-- verilog / systemverilog
-        verible
-
        #-- Optional Requirements:
        prettier # common code formatter
        fzf
@@ -14,13 +14,10 @@

      $env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1"
      $env.CLAUDE_CODE_ATTRIBUTION_HEADER = "0"
-      # using claude-code with kimi llm
-      # https://platform.moonshot.cn/docs/guide/agent-support
-      # $env.ANTHROPIC_BASE_URL = "https://api.moonshot.cn/anthropic/"
-      # $env.ANTHROPIC_AUTH_TOKEN = $env.MOONSHOT_API_KEY
-      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "kimi-k2.5"
-      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "kimi-k2.5"
-      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "kimi-k2.5"
+
+      # for work
+      $env.ANTHROPIC_BASE_URL = $env.WORK_ANTHROPIC_BASE_URL
+      $env.ANTHROPIC_AUTH_TOKEN = $env.WORK_ANTHROPIC_AUTH_TOKEN

      # using claude-code with glm llm
      # https://docs.bigmodel.cn/cn/coding-plan/tool/claude
@@ -30,16 +27,6 @@
      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "glm-5-turbo"
      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "glm-4.5-air"

-      # using claude-code with minimax llm
-      # https://platform.minimax.io/docs/token-plan/claude-code
-      # $env.ANTHROPIC_BASE_URL = "https://api.minimax.io/anthropic"
-      # $env.ANTHROPIC_AUTH_TOKEN = $env.MINIMAX_API_KEY
-      # $env.ANTHROPIC_MODEL = "MiniMax-M2.7"
-      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "MiniMax-M2.7"
-      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "MiniMax-M2.7"
-      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "MiniMax-M2.7"
-
-
      # Directories in this constant are searched by the
      # `use` and `source` commands.
      const NU_LIB_DIRS = $NU_LIB_DIRS ++ ['${nu_scripts}']
@@ -9,42 +9,32 @@
  programs.ssh = {
    enable = true;

-    # default config
    enableDefaultConfig = false;
-    matchBlocks."*" = {
-      forwardAgent = false;
-      # "a private key that is used during authentication will be added to ssh-agent if it is running"
-      addKeysToAgent = "yes";
-      compression = true;
-      serverAliveInterval = 0;
-      serverAliveCountMax = 3;
-      hashKnownHosts = false;
-      userKnownHostsFile = "~/.ssh/known_hosts";
-      controlMaster = "no";
-      controlPath = "~/.ssh/master-%r@%n:%p";
-      controlPersist = "no";
+    settings."*" = {
+      ForwardAgent = false;
+      AddKeysToAgent = "yes";
+      Compression = true;
+      ServerAliveInterval = 0;
+      ServerAliveCountMax = 3;
+      HashKnownHosts = false;
+      UserKnownHostsFile = "~/.ssh/known_hosts";
+      ControlMaster = "no";
+      ControlPath = "~/.ssh/master-%r@%n:%p";
+      ControlPersist = "no";
    };

-    matchBlocks = {
+    settings = {
      "github.com" = {
-        # "Using SSH over the HTTPS port for GitHub"
-        # "(port 22 is banned by some proxies / firewalls)"
-        hostname = "ssh.github.com";
-        port = 443;
-        user = "git";
-
-        # Specifies that ssh should only use the identity file explicitly configured above
-        # required to prevent sending default identity files first.
-        identitiesOnly = true;
+        HostName = "ssh.github.com";
+        Port = 443;
+        User = "git";
+        IdentitiesOnly = true;
      };

      "192.168.*" = {
-        # "allow to securely use local SSH agent to authenticate on the remote machine."
-        # "It has the same effect as adding cli option `ssh -A user@host`"
-        forwardAgent = true;
-        # "romantic holds my homelab~"
-        identityFile = "/etc/agenix/ssh-key-romantic";
-        identitiesOnly = true;
+        ForwardAgent = true;
+        IdentityFile = "/etc/agenix/ssh-key-romantic";
+        IdentitiesOnly = true;
      };
    };
  };
@@ -280,10 +280,6 @@ run = ['layout floating', 'move-node-to-workspace 9File']
 if.app-id = 'com.apple.Preview'
 run = ['layout floating', 'move-node-to-workspace 9File']

-[[on-window-detected]]
-if.app-id = 'com.microsoft.VSCode'
-run = ['layout floating', 'move-node-to-workspace 9File']
-
 [[on-window-detected]]
 if.app-id = 'com.todesktop.230313mzl4w4u92' # Cursor AI Editor
 run = ['layout floating', 'move-node-to-workspace 9File']
@@ -5,6 +5,5 @@ in
 {
  imports = [ ../../darwin ];

-  programs.ssh.matchBlocks."github.com".identityFile =
-    "${config.home.homeDirectory}/.ssh/${hostName}";
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
 }
@@ -5,6 +5,5 @@ in
 {
  imports = [ ../../darwin ];

-  programs.ssh.matchBlocks."github.com".identityFile =
-    "${config.home.homeDirectory}/.ssh/${hostName}";
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
 }
@@ -6,8 +6,7 @@ in
 {
  imports = [ ../../linux/gui.nix ];

-  programs.ssh.matchBlocks."github.com".identityFile =
-    "${config.home.homeDirectory}/.ssh/${hostName}";
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";

  modules.desktop.gaming.enable = false;
  modules.desktop.niri.enable = true;
@@ -5,12 +5,19 @@ in
 {
  imports = [ ../../linux/gui.nix ];

-  programs.ssh.matchBlocks."github.com".identityFile = "${config.home.homeDirectory}/.ssh/idols-ai";
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/idols-ai";

  modules.desktop.gaming.enable = true;
  modules.desktop.niri.enable = true;
  modules.desktop.nvidia.enable = true;

+  programs.zed-editor.userSettings = {
+    ui_font_size = 18.0;
+    buffer_font_size = 17.0;
+    agent_ui_font_size = 18.0;
+    agent_buffer_font_size = 17.0;
+  };
+
  xdg.configFile."niri/niri-hardware.kdl".source =
    mkSymlink "${config.home.homeDirectory}/nix-config/hosts/idols-ai/niri-hardware.kdl";
 }
@@ -1,21 +1,3 @@
 {
-  programs.gh.enable = true;
-  programs.git.enable = true;
-
-  programs.zellij.enable = true;
-  programs.bash.enable = true;
-  programs.nushell.enable = true;
-
-  programs.starship = {
-    enable = true;
-    enableBashIntegration = true;
-    enableNushellIntegration = true;
-  };
-  programs.neovim = {
-    enable = true;
-    viAlias = true;
-    vimAlias = true;
-  };
-
-  home.stateVersion = "25.11";
+  imports = [ ../../linux/core.nix ];
 }
@@ -1,3 +1,3 @@
 {
-  imports = [ ./idols-aquamarine.nix ];
+  imports = [ ../../linux/core.nix ];
 }
@@ -1,3 +1,3 @@
 {
-  imports = [ ./idols-aquamarine.nix ];
+  imports = [ ../../linux/core.nix ];
 }
@@ -5,13 +5,5 @@
    # misc
    libnotify
    wireguard-tools # manage wireguard vpn manually, via wg-quick
-
-    virt-viewer # vnc connect to VM, used by kubevirt
  ];
-
-  # auto mount usb drives
-  services = {
-    udiskie.enable = true;
-    # syncthing.enable = true;
-  };
 }
@@ -1,12 +1,13 @@
 {
  lib,
  pkgs,
+  pkgs-stable,
  blender-bin,
  ...
 }:
 {
  home.packages =
-    with pkgs;
+    with pkgs-stable;
    [
      # creative
      # gimp      # image editing, I prefer using figma in browser instead of this one
@@ -27,6 +27,8 @@
    flameshot
    hyprshot # screen shot
    wf-recorder # screen recording
+
+    virt-viewer # vnc connect to VM, used by kubevirt
  ];

  # screen locker
@@ -34,4 +36,10 @@

  # Logout Menu
  programs.wlogout.enable = true;
+
+  # auto mount usb drives
+  services = {
+    udiskie.enable = true;
+    # syncthing.enable = true;
+  };
 }
@@ -1,19 +0,0 @@
-{
-  lib,
-  pkgs-master,
-  ...
-}:
-
-{
-  programs.vscode = {
-    enable = true;
-    package = pkgs-master.vscode.override {
-      commandLineArgs = [
-        # https://code.visualstudio.com/docs/configure/settings-sync#_recommended-configure-the-keyring-to-use-with-vs-code
-        # For use with any package that implements the Secret Service API
-        # (for example gnome-keyring, kwallet5, KeepassXC)
-        "--password-store=gnome-libsecret"
-      ];
-    };
-  };
-}
@@ -24,4 +24,5 @@
  # allow fontconfig to discover fonts and configurations installed through home.packages
  # Install fonts at system-level, not user-level
  fonts.fontconfig.enable = false;
+
 }
@@ -176,8 +176,8 @@
          "unreadBadgeColor": "primary"
        },
        {
-          "deviceNativePath": "",
-          "displayMode": "alwaysShow",
+          "deviceNativePath": "__default__",
+          "displayMode": "icon-always",
          "hideIfIdle": false,
          "hideIfNotDetected": true,
          "id": "Battery",
@@ -221,7 +221,12 @@
    }
  },
  "brightness": {
-    "backlightDeviceMappings": [],
+    "backlightDeviceMappings": [
+      {
+        "device": "/sys/class/backlight/apple-panel-bl",
+        "output": "eDP-1"
+      }
+    ],
    "brightnessStep": 3,
    "enableDdcSupport": false,
    "enforceMinimum": true
@@ -18,10 +18,9 @@
          "firefox.desktop"
        ];
        editor = [
+          "dev.zed.Zed.desktop"
          "nvim.desktop"
          "Helix.desktop"
-          "code.desktop"
-          "code-insiders.desktop"
        ];
      in
      {
@@ -48,9 +47,6 @@
        "x-scheme-handler/ftp" = browser; # open `ftp:` url with `browser`
        "x-scheme-handler/http" = browser;
        "x-scheme-handler/https" = browser;
-        # https://github.com/microsoft/vscode/issues/146408
-        "x-scheme-handler/vscode" = [ "code-url-handler.desktop" ]; # open `vscode://` url with `code-url-handler.desktop`
-        "x-scheme-handler/vscode-insiders" = [ "code-insiders-url-handler.desktop" ]; # open `vscode-insiders://` url with `code-insiders-url-handler.desktop`
        "x-scheme-handler/zoommtg" = [ "Zoom.desktop" ];

        # all other unknown schemes will be opened by this default application.
@@ -82,7 +82,6 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.zoom
                                            /home/ryan/Documents
                                            /home/ryan/.wakatime
-                                            /home/ryan/.vscode
                                            /home/ryan/.var
                                            /home/ryan/.terraform.d/plugin-cache
                                            /home/ryan/.steam
@@ -106,6 +105,7 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.local/share/password-store
                                            /home/ryan/.local/share/opencode
                                            /home/ryan/.local/share/nvim
+                                            /home/ryan/.local/share/zed
                                            /home/ryan/.local/share/nix
                                            /home/ryan/.local/share/krita
                                            /home/ryan/.local/share/lutris
@@ -140,6 +140,7 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.config/obs-studio
                                            /home/ryan/.config/mozc
                                            /home/ryan/.config/nushell
+                                            /home/ryan/.config/zed
                                            /home/ryan/.config/lutris
                                            /home/ryan/.config/joplin
                                            /home/ryan/.config/heroic
@@ -151,7 +152,6 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.config/LDtk
                                            /home/ryan/.config/Joplin
                                            /home/ryan/.config/Cursor
-                                            /home/ryan/.config/Code
                                            /home/ryan/.conda
                                            /home/ryan/.cargo
                                            /home/ryan/.codex
@@ -133,9 +133,9 @@ in
        # neovim plugins
        ".wakatime"

-        # vscode
-        ".vscode"
-        ".config/Code"
+        # zed
+        ".config/zed"
+        ".local/share/zed"

        # cursor ai editor / cli
        ".cursor"
@@ -15,6 +15,9 @@ in
 {
  imports = (mylib.scanPaths ./.) ++ [
    disko.nixosModules.default
+
+    ../idols-ruby/packages.nix
+    ../idols-ruby/oci-containers
  ];

  # supported file systems, so we can mount any removable disks with these filesystems
@@ -1,54 +0,0 @@
-{ pkgs, ... }:
-{
-  # https://github.com/Mic92/nix-ld
-  #
-  # nix-ld will install itself at `/lib64/ld-linux-x86-64.so.2` so that
-  # it can be used as the dynamic linker for non-NixOS binaries.
-  #
-  # nix-ld works like a middleware between the actual link loader located at `/nix/store/.../ld-linux-x86-64.so.2`
-  # and the non-NixOS binaries. It will:
-  #
-  #   1. read the `NIX_LD` environment variable and use it to find the actual link loader.
-  #   2. read the `NIX_LD_LIBRARY_PATH` environment variable and use it to set the `LD_LIBRARY_PATH` environment variable
-  #      for the actual link loader.
-  #
-  # nix-ld's nixos module will set default values for `NIX_LD` and `NIX_LD_LIBRARY_PATH` environment variables, so
-  # it can work out of the box:
-  #
-  #  - https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/programs/nix-ld.nix#L42-L45
-  #
-  # You can overwrite `NIX_LD_LIBRARY_PATH` in the environment where you run the non-NixOS binaries to customize the
-  # search path for shared libraries.
-  programs.nix-ld = {
-    enable = true;
-    libraries = with pkgs; [
-      stdenv.cc.cc
-    ];
-  };
-
-  environment.systemPackages = with pkgs; [
-    nodejs_24
-    pnpm
-
-    #-- python
-    conda
-    uv # python project package manager
-    (python313.withPackages (
-      ps: with ps; [
-        pandas
-        requests
-        pyquery
-        pyyaml
-        numpy
-
-        # model downloaders
-        huggingface-hub
-        modelscope
-      ]
-    ))
-
-    rustc
-    cargo # rust package manager
-    go
-  ];
-}
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, llm-agents, ... }:
 {
  # https://github.com/Mic92/nix-ld
  #
@@ -26,55 +26,68 @@
    ];
  };

-  environment.systemPackages = with pkgs; [
-    nodejs_24
-    pnpm
+  environment.systemPackages =
+    with pkgs;
+    [
+      nodejs_24
+      pnpm

-    #-- python
-    conda
-    uv # python project package manager
-    (python313.withPackages (
-      ps: with ps; [
-        pandas
-        requests
-        pyquery
-        pyyaml
-        numpy
+      #-- python
+      conda
+      uv # python project package manager
+      (python313.withPackages (
+        ps: with ps; [
+          pandas
+          requests
+          pyquery
+          pyyaml
+          numpy

-        # model downloaders
-        huggingface-hub
-        modelscope
-      ]
-    ))
+          # model downloaders
+          huggingface-hub
+          modelscope
+        ]
+      ))

-    rustc
-    cargo # rust package manager
-    go
+      rustc
+      cargo # rust package manager
+      go

-    # cryptography
-    age
-    sops
-    rclone
-    gnupg
+      # cryptography
+      age
+      sops
+      rclone
+      gnupg

-    # cloud-native
-    kubectl
-    istioctl
-    kubevirt # virtctl
-    kubernetes-helm
-    fluxcd
-    terraform
+      # cloud-native
+      kubectl
+      istioctl
+      kubevirt # virtctl
+      kubernetes-helm
+      fluxcd
+      terraform

-    # db related
-    pgcli
-    mongosh
-    sqlite
+      # db related
+      pgcli
+      mongosh
+      sqlite

-    yt-dlp # youtube/bilibili/soundcloud/... video/music downloader
+      yt-dlp # youtube/bilibili/soundcloud/... video/music downloader

-    # need to run `conda-install` before using it
-    # need to run `conda-shell` before using command `conda`
-    # conda is not available for MacOS
-    conda
-  ];
+      # need to run `conda-install` before using it
+      # need to run `conda-shell` before using command `conda`
+      # conda is not available for MacOS
+      conda
+    ]
+    # AI Agent Tools
+    ++ (with llm-agents.packages.${pkgs.stdenv.hostPlatform.system}; [
+      # Agents
+      codex
+      cursor-cli
+      claude-code
+      opencode
+
+      # Utilities
+      rtk # CLI proxy that reduces LLM token consumption
+    ]);
 }
@@ -70,6 +70,8 @@ in
    nushell # my custom shell
    gnugrep # replacee macos's grep
    gnutar # replacee macos's tar
+    pcsclite
+    pcsc-tools
  ];
  environment.variables = {
    # Fix https://github.com/LnL7/nix-darwin/wiki/Terminfo-issues
@@ -101,7 +103,7 @@ in

    onActivation = {
      autoUpdate = true; # Fetch the newest stable branch of Homebrew's git repo
-      upgrade = true; # Upgrade outdated casks, formulae, and App Store apps
+      upgrade = false; # Upgrade outdated casks, formulae, and App Store apps
      # 'zap': uninstalls all formulae(and related files) not listed in the generated Brewfile
      cleanup = "zap";
    };
@@ -111,6 +113,9 @@ in
    # otherwise Apple Store will refuse to install them.
    # For details, see https://github.com/mas-cli/mas
    masApps = {
+      Keynote = 409183694;
+      Slack = 803453959;
+      WireGuard = 1451685025;
      # Xcode = 497799835;
      Wechat = 836500024;
    };
@@ -136,11 +141,6 @@ in
      # commands like `gsed` `gtar` are required by some tools
      "gnu-sed"
      "gnu-tar"
-
-      # misc that nix do not have cache for.
-      "git-trim"
-      "hashicorp/tap/terraform"
-      "terraformer"
    ];

    taps = [
@@ -153,10 +153,7 @@ in
      "firefox"
      "google-chrome"

-      # code editor
-      "visual-studio-code"
-
-      "nikitabobko/tap/aerospace" # an i3-like tiling window manager for macOS
+      # "nikitabobko/tap/aerospace" # an i3-like tiling window manager for macOS
      "ghostty" # terminal emulator

      # container & vm
@@ -168,9 +165,6 @@ in
      "tailscale-app" # tailscale macos app (with gui)
      # "netbirdio/tap/netbird-ui" # netbird gui app

-      # AI
-      "lm-studio"
-
      # IM & audio & remote desktop & meeting
      "telegram"
      "qq"
@@ -194,7 +188,6 @@ in

      # Development
      "mitmproxy" # HTTP/HTTPS traffic inspector
-      "insomnia" # REST client
      "wireshark-app" # network analyzer
      # "google-cloud-sdk" # Google Cloud SDK
      "miniforge" # Miniconda's community-driven distribution
@@ -4,20 +4,10 @@
 # ===================================================================
 let
  brokenPackages = [
-    "terraform"
-    "terraformer"
-    "packer"
-    "git-trim"
    "conda"
    "mitmproxy"
-    "insomnia"
    "wireshark"
-    "jsonnet"
-    "zls"
    "verible"
-    "gdb"
-    "ncdu"
-    "racket-minimal"
  ];
 in
 {
@@ -39,6 +39,7 @@
      "wireshark"
      "adbusers" # android debugging
      "libvirtd" # virt-viewer / qemu
+      "plugdev" # canokey / openocd udev
      "fileshare"
    ];
  };
@@ -0,0 +1,37 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.desktop.canokey;
+in
+{
+  options.modules.desktop.canokey = {
+    enable = lib.mkEnableOption "CanoKey hardware security key support";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.pcscd.enable = true;
+
+    services.udev.extraRules = ''
+      # CanoKey - GnuPG/pcsclite
+      SUBSYSTEM!="usb", GOTO="canokey_rules_end"
+      ACTION!="add|change", GOTO="canokey_rules_end"
+      ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", ENV{ID_SMARTCARD_READER}="1"
+      LABEL="canokey_rules_end"
+
+      # CanoKey - FIDO2
+      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", TAG+="uaccess", GROUP="plugdev", MODE="0660"
+
+      # CanoKey - WebUSB
+      SUBSYSTEMS=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="42d4", MODE:="0666"
+    '';
+
+    environment.systemPackages = with pkgs; [
+      ccid
+      pcsc-tools
+    ];
+  };
+}
@@ -48,7 +48,6 @@
    # which resolves bugs involving programs opening inside FHS envs or with unexpected env vars set from wrappers.
    # xdg-open is used by almost all programs to open a unknown file/uri
    # alacritty as an example, it use xdg-open as default, but you can also custom this behavior
-    # and vscode has open like `External Uri Openers`
    xdgOpenUsePortal = true;

    # ls /run/current-system/sw/share/xdg-desktop-portal/portals/
@@ -34,6 +34,7 @@ let
          modules.secrets.preservation.enable = true;
          # not supported yet
          modules.desktop.gaming.enable = false;
+          modules.desktop.canokey.enable = true;
        }
      ];
    home-modules = map mylib.relativeToRoot [
@@ -34,6 +34,7 @@ let
          modules.secrets.desktop.enable = true;
          modules.secrets.preservation.enable = true;
          modules.desktop.gaming.enable = true;
+          modules.desktop.canokey.enable = true;
        }
      ];
    home-modules = map mylib.relativeToRoot [
@@ -14,6 +14,8 @@ export def nixos-switch [
        # show details via nix-output-monitor
        nom build $".#nixosConfigurations.($name).config.system.build.toplevel" --show-trace --verbose
        nixos-rebuild switch --sudo --flake $".#($name)" --show-trace --verbose
+    } else if "boot" == $mode {
+        nixos-rebuild boot --sudo --flake $".#($name)"
    } else {
        nixos-rebuild switch --sudo --flake $".#($name)"
    }
Author	SHA1	Message	Date
Ryan Yin	d837f961f2	feat: add support for canokeys	2026-06-14 11:38:56 +08:00
Ryan Yin	eaacb0f9e7	chore: update zed-editor settings, remove unused packages(java,zig,etc)	2026-06-12 22:30:04 +08:00
Ryan Yin	86f316cfdb	fix: shoukei - noctalia - adjust brightness	2026-06-12 15:55:51 +08:00
Ryan Yin	e18f94dca1	chore: claude-code: use work credentials	2026-06-12 14:10:20 +08:00
Ryan Yin	b142f1acb7	flake.lock: Update Flake lock file updates: • Updated input 'mysecrets': 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=0e2b90e6d57dfa70c0527c3a4d399bde82998f78&shallow=1' (2026-06-03) → 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=490e3aca901fa703083822ee64a65f0a1f4529af&shallow=1' (2026-06-12)	2026-06-12 14:07:37 +08:00
Ryan Yin	e6245cad17	chore(darwin): install some packages via nix instead of brew	2026-06-12 14:04:13 +08:00
Ryan Yin	582c643f2e	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs-master': 'github:nixos/nixpkgs/c2a4e65' (2026-06-01) → 'github:nixos/nixpkgs/173d0ad' (2026-06-12)	2026-06-12 13:21:01 +08:00
Ryan Yin	d5c1177ef4	flake.lock: Update Flake lock file updates: • Updated input 'llm-agents': 'github:numtide/llm-agents.nix/468bacd' (2026-06-01) → 'github:numtide/llm-agents.nix/27d586e' (2026-06-12) • Updated input 'llm-agents/nixpkgs': 'github:NixOS/nixpkgs/e9a7635' (2026-05-29) → 'github:NixOS/nixpkgs/8c3cede' (2026-06-08)	2026-06-12 13:20:37 +08:00
Ryan Yin	8e14bc3c28	chore(darwin): remove lm-studio, we use omlx instead	2026-06-11 13:37:30 +08:00
Ryan Yin	6116278251	chore: brew upgrade casks greedy	2026-06-11 11:54:30 +08:00
Ryan Yin	fc1abca4f0	feat: gcp - add plugins	2026-06-10 16:27:57 +08:00
Ryan Yin	c546358888	chore: zed-editor - adjust fonts for idols-ai	2026-06-05 17:17:02 +08:00
Ryan Yin	4e2bf491a0	chore(zed): sync editor settings	2026-06-04 23:48:45 +08:00
Ryan Yin	cfc192afc4	feat: replace vscode with zed-editor (#263 ) * feat: replace vscode with zed-editor * docs: helix	2026-06-04 23:20:59 +08:00
Ryan Yin	008bc8857b	fix(darwin): brew packages	2026-06-04 21:26:19 +08:00
Ryan Yin	839bd3c330	chore: adjust pnpm/pip/uv min-release-age https://cooldowns.dev/	2026-06-03 18:28:35 +08:00
Ryan Yin	92aca13c40	chore: adjust npm min-release-age	2026-06-03 18:07:14 +08:00
Ryan Yin	bea4f7cf06	chore: add llm agents & helix for ruby/kana/akane Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>	2026-06-03 15:48:03 +08:00
Ryan Yin	2a26d51eaa	feat(linux) - avoid compiling creative tools, update noctalia & utils.nu	2026-06-03 14:07:35 +08:00
Ryan Yin	af0ef6d154	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs-patched': 'github:ryan4yin/nixpkgs/d373b16187b32770d99f6ff54a133d9543e68702?narHash=sha256-75W3YfzkkKvpE3/wtHMihlT9kOnQZxWpLoshw1xu0T8%3D' (2026-03-20) → 'github:ryan4yin/nixpkgs/4425024452e93ce3d10e11bcd9b47f1dfa78593b?narHash=sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4%3D' (2026-06-03) fix: qq	2026-06-03 11:56:48 +08:00
Ryan Yin	fe4923f8cb	fix: suppress nixvim nixpkgs.source and ssh matchBlocks deprecation warnings (#262 ) Explicitly set programs.nixvim.nixpkgs.source to suppress the follows warning, and migrate all programs.ssh.matchBlocks to programs.ssh.settings using upstream PascalCase directive names.	2026-06-03 11:23:30 +08:00
Ryan Yin	44b0258129	fix(darwin): ghostty	2026-06-03 11:08:16 +08:00
Ryan Yin	685af3fa2c	fix(darwin): depends on wayland	2026-06-03 11:08:16 +08:00
Ryan Yin	67eb9934ab	flake.lock: Update Flake lock file updates: • Updated input 'mysecrets': 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=c388ca33beb5c099bf4603e6ab25a2e94af00b80&shallow=1' (2026-03-19) → 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=0e2b90e6d57dfa70c0527c3a4d399bde82998f78&shallow=1' (2026-06-03)	2026-06-03 10:25:24 +08:00