mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
71fa928254
Use the CanoKey for daily authentication on idols-ai and shoukei, with the existing passwords, passphrases and per-host SSH keys as fallback. - sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store authfile built from myvars.canokeyU2fKeys; the primary key is registered and touch-to-sudo works on idols-ai. - SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key. - shoukei LUKS: fido2-device=auto with token-timeout=10s. Update nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock. - GPG: scdaemon disable-ccid so it uses pcscd. - docs/security-keys.md: setup, PINs, enrollment, backup key and recovery; deduplicate the FIDO notes left by #515. Assisted-by: Claude Code (claude-opus-5-5)
48 lines
1.4 KiB
Nix
48 lines
1.4 KiB
Nix
{
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
mkSymlink = config.lib.file.mkOutOfStoreSymlink;
|
|
in
|
|
{
|
|
imports = [
|
|
../../linux/gui.nix
|
|
];
|
|
|
|
modules.desktop.vinput.enable = true;
|
|
|
|
# CanoKey key first (docs/security-keys.md), this host's key as backup.
|
|
programs.ssh.settings."github.com".IdentityFile = [
|
|
"${config.home.homeDirectory}/.ssh/id_ed25519_sk"
|
|
"${config.home.homeDirectory}/.ssh/idols-ai"
|
|
];
|
|
|
|
modules.desktop.gaming.enable = true;
|
|
modules.desktop.niri.enable = true;
|
|
|
|
# PC: keep the screen on longer than on the laptop.
|
|
modules.desktop.hypridle = {
|
|
keyboardBacklightTimeout = 900;
|
|
screenOffTimeout = 1200;
|
|
lockTimeout = 1800;
|
|
};
|
|
|
|
programs.zed-editor.userSettings = {
|
|
ui_font_size = 18.0;
|
|
buffer_font_size = 17.0;
|
|
agent_ui_font_size = 18.0;
|
|
agent_buffer_font_size = 17.0;
|
|
};
|
|
|
|
xdg.configFile."niri/niri-hardware.kdl".source =
|
|
mkSymlink "${config.home.homeDirectory}/nix-config/hosts/idols-ai/niri-hardware.kdl";
|
|
|
|
# Keep Noctalia's network widgets on the physical uplink, not the Mihomo TUN
|
|
# (the interface name is in ./idols-ai/noctalia.toml and `hostsAddr.ai.iface`).
|
|
xdg.configFile."noctalia/host-ai.toml".source = ./idols-ai/noctalia.toml;
|
|
|
|
# The desktop speakers are already loud, so use the broadcast-standard -23 dB.
|
|
services.easyeffects.extraPresets."loudness-normalization".output."autogain#0".target = -23.0;
|
|
}
|