mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
71fa928254
Use the CanoKey for daily authentication on idols-ai and shoukei, with the existing passwords, passphrases and per-host SSH keys as fallback. - sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store authfile built from myvars.canokeyU2fKeys; the primary key is registered and touch-to-sudo works on idols-ai. - SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key. - shoukei LUKS: fido2-device=auto with token-timeout=10s. Update nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock. - GPG: scdaemon disable-ccid so it uses pcscd. - docs/security-keys.md: setup, PINs, enrollment, backup key and recovery; deduplicate the FIDO notes left by #515. Assisted-by: Claude Code (claude-opus-5-5)
5.0 KiB
5.0 KiB
Documentation
Canonical index for this repository. Standalone reference material lives in this directory. Component runbooks stay next to the code they describe so they remain visible during maintenance; every human-facing document is linked here.
README.md and AGENTS.md remain at the repository root because GitHub and coding agents require
those entry points.
Repository
- Repository overview — systems, components, deployment and validation quick start.
- Agent guide — repository conventions, command hazards and validation rules.
- NixOS modernization options — design options and decisions.
Operations and policy
- Security — threat model, trust boundaries, implemented controls and audits.
- Backups — backup layers, password model, retention and restore procedure.
- Hardware security keys — CanoKey/YubiKey setup, backup keys and recovery.
- Workarounds and known gaps — pins, temporary workarounds and removal conditions.
- BIOS settings — firmware settings for the physical hosts.
- Wake-on-LAN — firmware prerequisites, NixOS setup and wake commands.
- Runtime hardening validation.
Hosts and services
- Host inventory and deployment notes.
- AI desktop: host runbook and VR notes.
- Akane: host runbook.
- Aquamarine: host runbook, iGPU notes and ROCm notes.
- Kana: host runbook.
- Ruby: host runbook.
- Shoukei: host runbook.
- Youko homelab: services overview, Immich, monitoring, alert rules, recording rules and Grafana dashboards.
- Kubernetes cluster: k8s host notes and disko configuration.
- Infrastructure: infra overview, RustFS, Loki storage and Terraform S3 backend.
- NixOS installation: installer guide and Shoukei notes.
- Certificates: certificate setup.
Configuration structure
- NixOS and nix-darwin modules, including Darwin modules, Mihomo networking and Sunshine.
- Home Manager modules.
- Flake outputs and tests.
- Secrets management.
- Overlays, shared library helpers and shared variables.
- Hardening wrappers and policy.
Desktop and Home Manager details
- Darwin, per-host Home Manager profiles and Linux.
- Linux desktop stack: base GUI, Fcitx5, hypridle, vinput and i3.
- Base Home Manager profile: editors, editor glossary, Helix, Neovim, Rime and terminal.
- Terminal tools: agents and dsh notes, editors, encryption, GPG and password store.