0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00

Files

T

ryan4yin | 二花 71fa928254 feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

Use the CanoKey for daily authentication on idols-ai and shoukei, with
the existing passwords, passphrases and per-host SSH keys as fallback.

- sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store
  authfile built from myvars.canokeyU2fKeys; the primary key is
  registered and touch-to-sudo works on idols-ai.
- SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported
  to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key.
- shoukei LUKS: fido2-device=auto with token-timeout=10s. Update
  nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds
  thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock.
- GPG: scdaemon disable-ccid so it uses pcscd.
- docs/security-keys.md: setup, PINs, enrollment, backup key and
  recovery; deduplicate the FIDO notes left by #515.

Assisted-by: Claude Code (claude-opus-5-5)

2026-11-04 01:50:21 -06:00

base

fonts: prefer Noto CJK family names

2026-11-02 11:45:12 +08:00

darwin

fix(darwin): pass the Homebrew mirror env through onActivation.extraEnv

2026-11-01 10:14:27 -06:00

nixos

feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

2026-11-04 01:50:21 -06:00

README.md

refactor: host profiles; give ruby, kana and aquamarine the TUI home (#512 )

2026-11-03 04:57:06 -06:00

README.md

NixOS / Nix-Darwin's Submodules

This directory contains modular NixOS and Nix-Darwin configurations organized by platform and functionality.

Current Structure

modules/
├── README.md
├── base/                    # Common configuration for all platforms
│   ├── default.nix
│   ├── fonts.nix           # System font configuration
│   ├── nix.nix            # Nix package manager settings
│   ├── overlays.nix       # Package overlays
│   ├── packages.nix       # Essential system packages
│   ├── security.nix       # Basic security settings
│   └── users.nix          # User management
├── darwin/                  # macOS-specific modules
│   ├── README.md
│   ├── apps.nix           # macOS applications
│   ├── default.nix
│   ├── nix-core.nix       # Core Nix configuration
│   ├── security.nix       # macOS security settings
│   ├── ssh.nix           # SSH configuration
│   ├── system.nix        # System-level settings
│   └── users.nix         # macOS user management
└── nixos/                   # NixOS-specific modules
    ├── base/               # Base NixOS configuration
    │   ├── auditd.nix     # Audit trail for root sessions and credentials
    │   ├── btop.nix       # System resource monitor
    │   ├── btrbk.nix      # Local btrfs snapshots
    │   ├── core.nix       # Core system settings
    │   ├── default.nix
    │   ├── i18n.nix       # Internationalization
    │   ├── locate.nix     # locate/updatedb file search
    │   ├── monitoring.nix # System monitoring
    │   ├── networking/    # Network configuration
    │   ├── nix.nix        # Nix settings
    │   ├── packages.nix   # System packages
    │   ├── restic-backup.nix # Encrypted off-host backups (see ../docs/BACKUP.md)
    │   ├── ssh.nix        # SSH daemon configuration
    │   ├── trash.nix      # Trash retention cleanup
    │   ├── user-group.nix # User and group management
    │   └── zram.nix       # ZRAM swap configuration
    ├── agent.nix           # `agent` profile: headless host with the TUI home role
    ├── desktop.nix         # Desktop environment configuration
    ├── desktop/            # Desktop-specific modules
    │   ├── canokey.nix    # CanoKey hardware token
    │   ├── computer-use.nix # Headless X11/i3 session for AI agents
    │   ├── default.nix
    │   ├── fhs.nix        # FHS environment
    │   ├── fonts.nix      # Desktop fonts
    │   ├── gaming.nix     # Gaming support
    │   ├── misc.nix       # Miscellaneous desktop settings
    │   ├── networking/    # Network-related desktop configs
    │   ├── nix.nix        # Desktop Nix settings
    │   ├── peripherals.nix # Peripheral device configuration
    │   ├── power.nix      # Power management
    │   ├── security.nix   # Desktop security settings
    │   ├── ssh.nix        # Desktop SSH configuration
    │   ├── containers.nix # Container engines (podman/docker)
    │   └── xdg.nix       # XDG base directory settings
    └── server/             # Server-specific modules
        ├── qemu-guest-hardware-configuration.nix
        ├── qemu-guest.nix  # VM guest base module (libvirt/QEMU guests)
        ├── server-aarch64.nix
        └── server.nix

System hardening modules (kernel baseline, AppArmor, app sandboxes) live under ../hardening/.

Module Categories

1. Base Modules (`base/`)

Common configuration shared between NixOS and macOS:

System fonts and localization
Essential packages and tools
Basic security settings
User management
Package overlays

2. macOS Modules (`darwin/`)

macOS-specific configuration:

macOS applications and system settings
Security configurations tailored for macOS
SSH and system-level settings
Package compatibility fixes

3. NixOS Modules (`nixos/`)

Platform-specific NixOS configuration:

Base: Core system settings and services
Desktop: Desktop environment and GUI applications
Server: Server-specific optimizations and services

Usage

There is no automatic platform detection. Each host's entry under outputs/<system>/src/ lists its imports explicitly:

NixOS Systems: import nixos/ modules
macOS Systems: import darwin/ modules
Both: import base/ modules for shared configuration

README.md

NixOS / Nix-Darwin's Submodules

Current Structure

Module Categories

1. Base Modules (base/)

2. macOS Modules (darwin/)

3. NixOS Modules (nixos/)

Usage

1. Base Modules (`base/`)

2. macOS Modules (`darwin/`)

3. NixOS Modules (`nixos/`)