0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00

Files

T

ryan4yin | 二花 71fa928254 feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

Use the CanoKey for daily authentication on idols-ai and shoukei, with
the existing passwords, passphrases and per-host SSH keys as fallback.

- sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store
  authfile built from myvars.canokeyU2fKeys; the primary key is
  registered and touch-to-sudo works on idols-ai.
- SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported
  to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key.
- shoukei LUKS: fido2-device=auto with token-timeout=10s. Update
  nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds
  thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock.
- GPG: scdaemon disable-ccid so it uses pcscd.
- docs/security-keys.md: setup, PINs, enrollment, backup key and
  recovery; deduplicate the FIDO notes left by #515.

Assisted-by: Claude Code (claude-opus-5-5)

2026-11-04 01:50:21 -06:00

game

docs: centralize documentation under docs/

2026-11-02 17:48:57 +08:00

apple-silicon.nix

docs: centralize documentation under docs/

2026-11-02 17:48:57 +08:00

default.nix

refactor: replace redundant mkForce with plain values and mkDefault

2026-11-01 10:14:27 -06:00

hardware-configuration.nix

feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

2026-11-04 01:50:21 -06:00

niri-hardware.kdl

feat(niri): reorganize workspaces

2026-08-03 22:42:37 +08:00

README.md

docs: centralize documentation under docs/

2026-11-02 17:48:57 +08:00

README.md

Host - Shoukei

This is NixOS's configuration for my Macbook Pro 2022 M2, 16G RAM.

This laptop joins untrusted networks and uses DHCP by default. On the home Wi-Fi (shadow_light_ryan) run just shoukei-home-wifi to pin 192.168.5.108; the recipe calls scripts/shoukei-home-wifi-static.nu, and vars/networking.nix records the address with homeOnly = true.

x86/x86_64 applications

The M2 uses 16 KiB pages, and FEX does not emulate 4 KiB guest pages, so x86/x86_64 binaries cannot run directly on this kernel. game/ enables programs.x86-on-arm from our fork of rowanG077/nix-x86-on-aarch64, which runs FEX inside a 4 KiB muvm microVM and registers both ELF handlers:

run an x86/x86_64 ELF directly, or use x86-arm run <program>;
nix-shell -p x86pkgs.hello --run hello for the x86 package set;
steam and x86-arm-wine for games and Windows programs.

The microVM is capped at 6 GiB (memoryMiB) on this 16 GiB machine, and needs /dev/kvm plus a running systemd user session. See WORKAROUNDS.md WA-021.

Because the host no longer registers qemu-user binfmt, podman run --platform=linux/amd64, x86 chroots, and local builds of uncached x86 derivations need a remote x86_64 builder (see WORKAROUNDS.md WA-022).