From 5c14cf053920fef273b8228938f0625a2fa553e2 Mon Sep 17 00:00:00 2001 From: mikl Date: Sun, 28 Jun 2026 23:54:14 +0300 Subject: [PATCH 01/77] refactor: use michaotic username throughout, add cli/kitty/zsh configs and docs --- README.md | 27 ++++++++++++++--- docs/cheatsheet.md | 57 ++++++++++++++++++++++++++++++++++ docs/muscari.md | 39 ++++++++++++++++++++++++ docs/poppy.md | 34 +++++++++++++++++++++ docs/shell.md | 41 +++++++++++++++++++++++++ docs/structure.md | 63 ++++++++++++++++++++++++++++++++++++++ docs/terminal.md | 36 ++++++++++++++++++++++ flake.lock | 14 ++++----- flake.nix | 8 ++--- garden.md | 16 ++++++++-- home/cli.nix | 53 ++++++++++++++++++++++++++++++++ home/default.nix | 14 ++++----- home/kitty.nix | 46 ++++++++++++++++++++++++++++ home/zsh.nix | 64 +++++++++++++++++++++++++++++++++++++++ hosts/common/default.nix | 7 +++-- hosts/muscari/default.nix | 4 +-- hosts/poppy/default.nix | 22 ++++++++++---- 17 files changed, 509 insertions(+), 36 deletions(-) create mode 100644 docs/cheatsheet.md create mode 100644 docs/muscari.md create mode 100644 docs/poppy.md create mode 100644 docs/shell.md create mode 100644 docs/structure.md create mode 100644 docs/terminal.md create mode 100644 home/cli.nix create mode 100644 home/kitty.nix create mode 100644 home/zsh.nix diff --git a/README.md b/README.md index 9019a1d..1cdb366 100644 --- a/README.md +++ b/README.md @@ -2,14 +2,31 @@ Nix configurations for iscg infra hosts. -Hosts and naming scheme: see [garden.md](./garden.md). +## hosts -## rebuild +- **poppy** - MacBook Air M1 (nix-darwin) +- **muscari** - NixOS server with k3s +- **rosemary** - backup VM (planned) + +See `docs/` for detailed documentation. + +## quick rebuild ```bash # poppy (macOS) darwin-rebuild switch --flake .#poppy -# muscari, rosemary (NixOS) -sudo nixos-rebuild switch --flake .# -``` \ No newline at end of file +# muscari (NixOS) +sudo nixos-rebuild switch --flake .#muscari +``` + +## documentation + +- [docs/structure.md](docs/structure.md) - how the config is organized +- [docs/poppy.md](docs/poppy.md) - MacBook specific +- [docs/muscari.md](docs/muscari.md) - server + k3s +- [docs/shell.md](docs/shell.md) - zsh, prompt, aliases +- [docs/terminal.md](docs/terminal.md) - kitty + themes +- [docs/cheatsheet.md](docs/cheatsheet.md) - quick commands + +See also [garden.md](garden.md) for host naming scheme. diff --git a/docs/cheatsheet.md b/docs/cheatsheet.md new file mode 100644 index 0000000..71030e7 --- /dev/null +++ b/docs/cheatsheet.md @@ -0,0 +1,57 @@ +# cheatsheet + +quick commands for daily use. + +## rebuild + +```bash +# poppy (macbook) +darwin-rebuild switch --flake .#poppy + +# muscari (server) +sudo nixos-rebuild switch --flake .#muscari +``` + +## update + +```bash +# update flakes then rebuild +nix flake update && darwin-rebuild switch --flake .#poppy +``` + +## check + +```bash +# validate before applying +nix flake check + +# dry run (see what would change) +darwin-rebuild switch --flake .#poppy --dry-run +``` + +## cleanup + +```bash +# remove old generations +nix-collect-garbage -d + +# or with sudo on nixos +sudo nix-collect-garbage -d +``` + +## shell + +```bash +ll # detailed list with icons +cd # actually zoxide - remembers frequent paths +ff # fastfetch system info +``` + +## navigation + +```bash +cd # zoxide - jump to frequent dir +cd .. # parent directory +ctrl+r # fzf history search +ctrl+t # fzf file finder +``` diff --git a/docs/muscari.md b/docs/muscari.md new file mode 100644 index 0000000..fd0215b --- /dev/null +++ b/docs/muscari.md @@ -0,0 +1,39 @@ +# muscari + +NixOS server on Yandex Cloud. k3s single-node cluster. + +## specs + +- VM: 2 vCPU / 8 GB RAM / 64 GB SSD +- IP: 158.160.166.30 +- Network: Legacy BIOS (no EFI) + +## quick rebuild + +```bash +sudo nixos-rebuild switch --flake .#muscari +``` + +## imports + +- `disk-config.nix` - disko partitioning +- `k3s.nix` - kubernetes cluster setup +- `hosts/common/` - shared nixos settings + +## networking + +open ports: +- 22 - ssh +- 80 - http (traefik ingress) +- 443 - https (traefik ingress) + +6443 is closed - kubectl via ssh tunnel only. + +## ssh keys + +fetched from `https://git.iscg.dev/mikl.keys` with sha256 pinning. + +## TODO + +- [ ] k8s aliases (k, kx, kl, kd, etc) +- [ ] add nix-specific aliases (switch, update, cleanup with sudo) diff --git a/docs/poppy.md b/docs/poppy.md new file mode 100644 index 0000000..bf3ca82 --- /dev/null +++ b/docs/poppy.md @@ -0,0 +1,34 @@ +# poppy + +MacBook Air M1 - daily driver. + +## quick rebuild + +```bash +darwin-rebuild switch --flake .#poppy +``` + +## what's specific here + +### darwin system + +- `nixpkgs.config.allowUnfree = true` - needed for some macos tools +- `services.nix-daemon.enable = true` - multi-user install +- home path: `/Users/mikl` (not `/home/mikl`) + +### home-manager imports + +- `home/kitty.nix` - terminal with catppuccin theme + +### aliases + +| alias | command | +|-------|---------| +| `switch` | `darwin-rebuild switch --flake .#poppy` | +| `update` | `nix flake update && darwin-rebuild switch --flake .#poppy` | +| `cleanup` | `nix-collect-garbage -d` | + +## TODO + +- [ ] telegram mcp aliases (tg-login, tg-reset) +- [ ] apple music tools (gamdl) diff --git a/docs/shell.md b/docs/shell.md new file mode 100644 index 0000000..a2e0f74 --- /dev/null +++ b/docs/shell.md @@ -0,0 +1,41 @@ +# shell + +zsh configuration across all hosts. + +## prompt + +**pure** - minimal, fast, shows git status. +- green `>` on success +- red `>` on error +- right prompt: current time in gray + +## plugins + +| plugin | source | purpose | +|--------|--------|---------| +| pure | github (v1.23.0) | prompt theme | +| zsh-syntax-highlighting | nixpkgs | command coloring | +| zsh-autosuggestions | nixpkgs | gray command hints | + +## history + +- size: 10000 +- shared between sessions +- ignores duplicates +- stored in `~/.local/share/zsh/history` (xdg) + +## universal aliases + +| alias | what | +|-------|------| +| `ll` | `eza -l --icons --git` | +| `la` | `eza -la --icons --git` | +| `ff` | `fastfetch` | + +## startup + +fastfetch runs automatically when opening new shell. + +## host-specific + +see `docs/poppy.md` and `docs/muscari.md` for per-host aliases (nix rebuild commands differ). diff --git a/docs/structure.md b/docs/structure.md new file mode 100644 index 0000000..679f18c --- /dev/null +++ b/docs/structure.md @@ -0,0 +1,63 @@ +# structure + +how the config is organized. + +## top-level + +``` +nix-config/ +├── flake.nix # entry point - dispatches to hosts +├── home/ # home-manager (user space) +├── hosts/ # system-level configs +├── secrets/ # sops-nix encrypted files +└── docs/ # this folder +``` + +## flake.nix flow + +``` +flake.nix +├── nixosConfigurations +│ ├── muscari → hosts/muscari/ + home/ +│ └── rosemary → hosts/rosemary/ + home/ +└── darwinConfigurations + └── poppy → hosts/poppy/ + home/ +``` + +## home/ vs hosts/ + +| what | where | why | +|------|-------|-----| +| shell config | `home/` | same on all machines | +| terminal emulator | `home/` | gui apps belong here | +| system packages | `hosts//` | os-specific | +| networking | `hosts//` | per-host | +| hostname | `hosts//` | obviously | + +## adding things + +**new package for all hosts:** +→ add to `home/cli.nix` in `home.packages` + +**new package for one host:** +→ add to `hosts//default.nix` in `environment.systemPackages` + +**new alias for all hosts:** +→ add to `home/zsh.nix` in `programs.zsh.shellAliases` + +**new alias for one host:** +→ add to `hosts//default.nix` in `home-manager.users.mikl.programs.zsh.shellAliases` + +## host-specific imports + +poppy imports `home/kitty.nix` because it has a screen. muscari doesn't. + +```nix +# hosts/poppy/default.nix +home-manager.users.mikl = { + imports = [ ../../home/kitty.nix ]; + programs.zsh.shellAliases = { + switch = "darwin-rebuild switch --flake .#poppy"; + }; +}; +``` diff --git a/docs/terminal.md b/docs/terminal.md new file mode 100644 index 0000000..5e570ae --- /dev/null +++ b/docs/terminal.md @@ -0,0 +1,36 @@ +# terminal + +kitty configuration for gui hosts. + +## where + +`home/kitty.nix` - imported only by poppy (macbook). + +## theme + +**Catppuccin-Mocha** - dark, soft colors. + +## font + +JetBrainsMono Nerd Font, size 12. + +## features + +- **tabs**: powerline style, at bottom, slanted separators +- **transparency**: background blur 16 +- **cursor**: beam shape +- **scrollback**: 10000 lines +- **cyrillic shortcuts**: cmd+м = paste, cmd+с = copy + +## cyrillic config + +loads `~/.config/kitty/cyrillic-shortcuts.conf` for additional layout fixes. + +## applying changes + +kitty reloads config automatically. if not: + +```bash +killall kitty +# or ctrl+shift+f5 inside kitty +``` diff --git a/flake.lock b/flake.lock index 1753b05..eff8e51 100644 --- a/flake.lock +++ b/flake.lock @@ -27,11 +27,11 @@ ] }, "locked": { - "lastModified": 1782423922, - "narHash": "sha256-qPNd6lUohHP5gcJhqQ7rLV87RwIx0xYR2A4Frb9Zjc4=", + "lastModified": 1782657028, + "narHash": "sha256-PHTCpYZCMzJYS3phhywqRAZphKVr2zjvlGYa+H20ZZ4=", "owner": "nix-community", "repo": "home-manager", - "rev": "5d320ab301cfaaca7d32514f13815d19d109f5f4", + "rev": "4ad9aaae70c9aaab504127f926c0fa9cfbc2b365", "type": "github" }, "original": { @@ -62,16 +62,16 @@ }, "nixpkgs": { "locked": { - "lastModified": 1782335603, - "narHash": "sha256-sZkQH1CkiZtdvcaLx4sGQD9Q9h+A8qB04DRpqQCN530=", + "lastModified": 1782545840, + "narHash": "sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY+/mwUI=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "03c72920da828594fae523aaef96f33dff10b340", + "rev": "3d46470bb3030020f7e1361f33514854f5bfa86d", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-25.11", + "ref": "nixpkgs-unstable", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index 8289a3c..ee27839 100644 --- a/flake.nix +++ b/flake.nix @@ -2,7 +2,7 @@ description = "nix-config — multi-host Nix configurations"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; + nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; nix-darwin = { url = "github:LnL7/nix-darwin"; @@ -41,7 +41,7 @@ home-manager = { useGlobalPkgs = true; useUserPackages = true; - users.mikl = import ./home; + users.michaotic = import ./home; }; } ]; @@ -57,7 +57,7 @@ home-manager = { useGlobalPkgs = true; useUserPackages = true; - users.mikl = import ./home; + users.michaotic = import ./home; }; } ]; @@ -66,7 +66,7 @@ { nixosConfigurations = { muscari = mkNixos "muscari"; - rosemary = mkNixos "rosemary"; + # rosemary = mkNixos "rosemary"; # TODO: add disk config }; darwinConfigurations = { diff --git a/garden.md b/garden.md index 07d9b06..a2f3e9b 100644 --- a/garden.md +++ b/garden.md @@ -24,9 +24,21 @@ Hosts in this repo are named after plants and flowers. - `hosts//default.nix` — per-host config - `hosts/common/default.nix` — shared NixOS config - `hosts/common-darwin/default.nix` — shared darwin config -- `home/default.nix` — shared home-manager config for user `mikl` +- `home/default.nix` — shared home-manager config for user `michaotic` (plan to migrate to `mikl` later) - `secrets/` — sops-encrypted secrets per host ## migrations -- `nix-config-legacy/` — previous muscari-only config (preserved for reference) \ No newline at end of file +- `nix-config-legacy/` — previous muscari-only config (preserved for reference) + +## future plans + +### username migration + +currently using `michaotic` as username (historical). plan to migrate to `mikl` across all hosts for consistency. + +**why not now:** +- macOS: changing username requires careful handling of home folder, keychain, permissions +- linux: easier, but better to do in one coordinated change + +**when:** after setting up proper backups and testing migration procedure \ No newline at end of file diff --git a/home/cli.nix b/home/cli.nix new file mode 100644 index 0000000..bc91d81 --- /dev/null +++ b/home/cli.nix @@ -0,0 +1,53 @@ +{ pkgs, ... }: +{ + # Universal CLI tools for all hosts + home.packages = with pkgs; [ + eza + bat + ripgrep + fd + fzf + tree + htop + tldr + ]; + + # FZF fuzzy finder + programs.fzf = { + enable = true; + enableZshIntegration = true; + defaultCommand = "fd --type f --hidden --exclude .git"; + defaultOptions = [ + "--height 40%" + "--layout=reverse" + "--border" + ]; + }; + + # Zoxide - smarter cd + programs.zoxide = { + enable = true; + enableZshIntegration = true; + options = [ "--cmd cd" ]; + }; + + # Bat - cat with syntax highlighting + programs.bat = { + enable = true; + config = { + theme = "Catppuccin-mocha"; + italic-text = "always"; + style = "numbers,changes,header"; + }; + }; + + # Eza - modern ls replacement + programs.eza = { + enable = true; + icons = "auto"; + git = true; + }; + + # Fastfetch - system info (using package only, no home-manager module) + # Config is in ~/.config/fastfetch/config.jsonc manually for now +} diff --git a/home/default.nix b/home/default.nix index 8dd75fe..58e9575 100644 --- a/home/default.nix +++ b/home/default.nix @@ -1,13 +1,11 @@ { pkgs, ... }: { - home.stateVersion = "25.11"; + imports = [ + ./cli.nix + ./zsh.nix + ]; - programs.zsh.enable = true; + home.stateVersion = "24.11"; programs.git.enable = true; - - home.packages = [ - pkgs.ripgrep - pkgs.fd - ]; -} \ No newline at end of file +} diff --git a/home/kitty.nix b/home/kitty.nix new file mode 100644 index 0000000..eadc072 --- /dev/null +++ b/home/kitty.nix @@ -0,0 +1,46 @@ +{ pkgs, ... }: +{ + programs.kitty = { + enable = true; + + font = { + name = "JetBrainsMono Nerd Font"; + size = 12; + }; + + themeFile = "Catppuccin-Mocha"; + + settings = { + background_opacity = "1"; + dynamic_background_opacity = "yes"; + background_blur = 16; + cursor_shape = "beam"; + modify_font = "cell_height 110%"; + bold_font = "auto"; + disable_ligatures = "never"; + adjust_line_height = "0"; + adjust_column_width = "0"; + + tab_bar_min_tabs = 1; + tab_bar_edge = "bottom"; + tab_bar_style = "powerline"; + tab_powerline_style = "slanted"; + + tab_title_template = "{title}{' :{}:'.format(num_windows) if num_windows > 1 else ''}"; + + scrollback_lines = 10000; + + # Copy/paste with non-latin layouts + map_cmd_v = "paste_from_clipboard"; + map_cmd_c = "copy_to_clipboard"; + + # Russian layout aliases (Cmd) + "map cmd+м" = "paste_from_clipboard"; + "map cmd+с" = "copy_to_clipboard"; + }; + + extraConfig = '' + include ~/.config/kitty/cyrillic-shortcuts.conf + ''; + }; +} diff --git a/home/zsh.nix b/home/zsh.nix new file mode 100644 index 0000000..368980e --- /dev/null +++ b/home/zsh.nix @@ -0,0 +1,64 @@ +{ pkgs, ... }: +{ + programs.zsh = { + enable = true; + enableCompletion = true; + + autosuggestion.enable = true; + syntaxHighlighting.enable = true; + + # History + history = { + size = 10000; + save = 10000; + ignoreDups = true; + share = true; + extended = true; + }; + + # Pure prompt + plugins = [ + { + name = "pure"; + src = pkgs.fetchFromGitHub { + owner = "sindresorhus"; + repo = "pure"; + rev = "v1.23.0"; + sha256 = "sha256-BmQO4xqd/3QnpLUitD2obVxL0UulpboT8jGNEh4ri8k="; + }; + } + { + name = "zsh-syntax-highlighting"; + file = "share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"; + src = pkgs.zsh-syntax-highlighting; + } + { + name = "zsh-autosuggestions"; + file = "share/zsh-autosuggestions/zsh-autosuggestions.zsh"; + src = pkgs.zsh-autosuggestions; + } + ]; + + # Base aliases (universal) + shellAliases = { + ll = "eza -l --icons --git"; + la = "eza -la --icons --git"; + }; + + # Init content - runs on shell start + initContent = '' + # Load pure prompt + autoload -U promptinit; promptinit + prompt pure + + # Right prompt - time in gray + RPROMPT='%F{240}%D{%H:%M:%S}%f' + + # Pure prompt customization + zstyle ':prompt:pure:prompt:success' color green + zstyle ':prompt:pure:prompt:success' symbol ">" + zstyle ':prompt:pure:prompt:error' color red + zstyle ':prompt:pure:prompt:error' symbol ">" + ''; + }; +} diff --git a/hosts/common/default.nix b/hosts/common/default.nix index d3862f2..2e570d2 100644 --- a/hosts/common/default.nix +++ b/hosts/common/default.nix @@ -6,10 +6,13 @@ "flakes" ]; - users.users.mikl = { + # Required when using zsh as user shell + programs.zsh.enable = true; + + users.users.michaotic = { isNormalUser = true; shell = pkgs.zsh; - home = "/home/mikl"; + home = "/home/michaotic"; }; environment.systemPackages = [ diff --git a/hosts/muscari/default.nix b/hosts/muscari/default.nix index 342905b..56cb3b0 100644 --- a/hosts/muscari/default.nix +++ b/hosts/muscari/default.nix @@ -31,9 +31,9 @@ boot.loader.systemd-boot.enable = lib.mkForce false; boot.loader.efi.canTouchEfiVariables = lib.mkForce false; - # SSH ключи для mikl: forgejo .keys endpoint с sha256-pinning + # SSH ключи для michaotic: forgejo .keys endpoint с sha256-pinning # + hardcoded fallback ключ для восстановления - users.users.mikl.openssh.authorizedKeys.keyFiles = [ + users.users.michaotic.openssh.authorizedKeys.keyFiles = [ (pkgs.fetchurl { url = "https://git.iscg.dev/mikl.keys"; sha256 = "sha256-4n6QLUPozdhHOmsRCuFn7HR9BU3nF0/GR2E7s5Lpz+Q="; diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index 0bc6467..8ba1668 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -13,15 +13,25 @@ "flakes" ]; - # nix daemon (multi-user install) - services.nix-daemon.enable = true; - - users.users.mikl = { - home = "/Users/mikl"; + users.users.michaotic = { + home = "/Users/michaotic"; shell = pkgs.zsh; }; environment.systemPackages = [ pkgs.vim ]; -} \ No newline at end of file + + system.stateVersion = 7; + + # Home-manager configuration specific to poppy + home-manager.users.michaotic = { + imports = [ ../../home/kitty.nix ]; + + programs.zsh.shellAliases = { + switch = "darwin-rebuild switch --flake .#poppy"; + update = "nix flake update && darwin-rebuild switch --flake .#poppy"; + cleanup = "nix-collect-garbage -d"; + }; + }; +} From cecb47ceb9ea3b3eea502211247fd47fd0d988b8 Mon Sep 17 00:00:00 2001 From: mikl Date: Mon, 29 Jun 2026 00:43:51 +0300 Subject: [PATCH 02/77] fix: add homebrew config to prevent cask deletion --- hosts/poppy/default.nix | 173 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 170 insertions(+), 3 deletions(-) diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index 8ba1668..17e0f33 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -1,11 +1,10 @@ -{ pkgs, ... }: -{ +{ pkgs, ... }: { networking.hostName = "poppy"; # Allow unfree packages (some macOS-ported tools need it) nixpkgs.config.allowUnfree = true; - system.primaryUser = "mikl"; + system.primaryUser = "michaotic"; # nix settings nix.settings.experimental-features = [ @@ -22,6 +21,174 @@ pkgs.vim ]; + # Homebrew - CRITICAL: cleanup = "zap" means unused casks get removed! + homebrew.enable = true; + homebrew.onActivation.cleanup = "zap"; + + homebrew.taps = [ + "tw93/tap" + "typewhisper/tap" + ]; + + homebrew.brews = [ + "kew" + "mole" + ]; + + homebrew.casks = [ + "google-chrome" + "google-drive" + "krishkrosh/apps/trackweight" + "bitwarden" + "marta" + "vscodium" + "github" + "docker-desktop" + "ollama-app" + "opencode-desktop" + "microsoft-word" + "microsoft-excel" + "microsoft-powerpoint" + "obsidian" + "anki" + "calibre" + "telegram" + "maccy" + "mos" + "caffeine" + "typewhisper/tap/typewhisper" + "lunacy" + "skim" + ]; + + # System defaults + system.defaults = { + NSGlobalDomain.AppleInterfaceStyle = "Dark"; + NSGlobalDomain._HIHideMenuBar = false; + + CustomUserPreferences = { + "com.apple.HIToolbox" = { + AppleEnabledInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + { + "Bundle ID" = "com.apple.CharacterPaletteIM"; + InputSourceKind = "Non Keyboard Input Method"; + } + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 19456; + "KeyboardLayout Name" = "Russian"; + } + ]; + AppleSelectedInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + ]; + }; + + "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { + "28" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1441792 ]; + }; + }; + "29" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1179648 ]; + }; + }; + "30" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1441792 ]; + }; + }; + "31" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1179648 ]; + }; + }; + }; + + "NSGlobalDomain" = { + "AppleMenuBarVisibleInFullscreen" = true; + }; + }; + + controlcenter = { + BatteryShowPercentage = true; + }; + + trackpad = { + Clicking = true; + TrackpadThreeFingerDrag = false; + TrackpadRightClick = true; + }; + + finder = { + AppleShowAllExtensions = true; + ShowPathbar = true; + ShowStatusBar = true; + FXPreferredViewStyle = "clmv"; + NewWindowTarget = "Home"; + ShowExternalHardDrivesOnDesktop = false; + ShowHardDrivesOnDesktop = false; + FXEnableExtensionChangeWarning = false; + _FXShowPosixPathInTitle = true; + }; + + dock = { + tilesize = 48; + largesize = 64; + magnification = true; + orientation = "bottom"; + mineffect = "scale"; + autohide = true; + autohide-time-modifier = 0.8; + show-recents = false; + show-process-indicators = true; + static-only = false; + wvous-tl-corner = 1; + wvous-tr-corner = 4; + wvous-bl-corner = 1; + wvous-br-corner = 1; + persistent-apps = [ + "/System/Applications/System Settings.app" + "/Applications/Google Chrome.app" + "/System/Applications/Mail.app" + "/Applications/Telegram.app" + "/System/Applications/Calendar.app" + "/Applications/Obsidian.app" + "/Applications/VSCodium.app" + "/Users/michaotic/Applications/Home Manager Apps/kitty.app" + "/System/Applications/Books.app" + "/System/Applications/QuickTime Player.app" + ]; + }; + }; + + system.activationScripts.postActivation.text = '' + echo "Restarting Dock..." + sudo -u michaotic /usr/bin/killall Dock + ''; + + # Touch ID for sudo + security.pam.services.sudo_local.touchIdAuth = true; + system.stateVersion = 7; # Home-manager configuration specific to poppy From e358c2cb157c23a1799be2d6e91ca4dbbb345a4a Mon Sep 17 00:00:00 2001 From: mikl Date: Mon, 29 Jun 2026 16:33:53 +0300 Subject: [PATCH 03/77] refactor: split poppy config into homebrew.nix, system.nix, default.nix --- hosts/poppy/default.nix | 190 ++------------------------------------- hosts/poppy/homebrew.nix | 37 ++++++++ hosts/poppy/system.nix | 127 ++++++++++++++++++++++++++ 3 files changed, 170 insertions(+), 184 deletions(-) create mode 100644 hosts/poppy/homebrew.nix create mode 100644 hosts/poppy/system.nix diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index 17e0f33..72d9191 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -1,200 +1,22 @@ { pkgs, ... }: { + imports = [ ./homebrew.nix ./system.nix ]; + networking.hostName = "poppy"; - - # Allow unfree packages (some macOS-ported tools need it) - nixpkgs.config.allowUnfree = true; - system.primaryUser = "michaotic"; + system.stateVersion = 7; - # nix settings - nix.settings.experimental-features = [ - "nix-command" - "flakes" - ]; + nixpkgs.config.allowUnfree = true; + nix.settings.experimental-features = [ "nix-command" "flakes" ]; users.users.michaotic = { home = "/Users/michaotic"; shell = pkgs.zsh; }; - environment.systemPackages = [ - pkgs.vim - ]; + environment.systemPackages = [ pkgs.vim ]; - # Homebrew - CRITICAL: cleanup = "zap" means unused casks get removed! - homebrew.enable = true; - homebrew.onActivation.cleanup = "zap"; - - homebrew.taps = [ - "tw93/tap" - "typewhisper/tap" - ]; - - homebrew.brews = [ - "kew" - "mole" - ]; - - homebrew.casks = [ - "google-chrome" - "google-drive" - "krishkrosh/apps/trackweight" - "bitwarden" - "marta" - "vscodium" - "github" - "docker-desktop" - "ollama-app" - "opencode-desktop" - "microsoft-word" - "microsoft-excel" - "microsoft-powerpoint" - "obsidian" - "anki" - "calibre" - "telegram" - "maccy" - "mos" - "caffeine" - "typewhisper/tap/typewhisper" - "lunacy" - "skim" - ]; - - # System defaults - system.defaults = { - NSGlobalDomain.AppleInterfaceStyle = "Dark"; - NSGlobalDomain._HIHideMenuBar = false; - - CustomUserPreferences = { - "com.apple.HIToolbox" = { - AppleEnabledInputSources = [ - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 0; - "KeyboardLayout Name" = "U.S."; - } - { - "Bundle ID" = "com.apple.CharacterPaletteIM"; - InputSourceKind = "Non Keyboard Input Method"; - } - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 19456; - "KeyboardLayout Name" = "Russian"; - } - ]; - AppleSelectedInputSources = [ - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 0; - "KeyboardLayout Name" = "U.S."; - } - ]; - }; - - "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { - "28" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 51 20 1441792 ]; - }; - }; - "29" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 51 20 1179648 ]; - }; - }; - "30" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 52 21 1441792 ]; - }; - }; - "31" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 52 21 1179648 ]; - }; - }; - }; - - "NSGlobalDomain" = { - "AppleMenuBarVisibleInFullscreen" = true; - }; - }; - - controlcenter = { - BatteryShowPercentage = true; - }; - - trackpad = { - Clicking = true; - TrackpadThreeFingerDrag = false; - TrackpadRightClick = true; - }; - - finder = { - AppleShowAllExtensions = true; - ShowPathbar = true; - ShowStatusBar = true; - FXPreferredViewStyle = "clmv"; - NewWindowTarget = "Home"; - ShowExternalHardDrivesOnDesktop = false; - ShowHardDrivesOnDesktop = false; - FXEnableExtensionChangeWarning = false; - _FXShowPosixPathInTitle = true; - }; - - dock = { - tilesize = 48; - largesize = 64; - magnification = true; - orientation = "bottom"; - mineffect = "scale"; - autohide = true; - autohide-time-modifier = 0.8; - show-recents = false; - show-process-indicators = true; - static-only = false; - wvous-tl-corner = 1; - wvous-tr-corner = 4; - wvous-bl-corner = 1; - wvous-br-corner = 1; - persistent-apps = [ - "/System/Applications/System Settings.app" - "/Applications/Google Chrome.app" - "/System/Applications/Mail.app" - "/Applications/Telegram.app" - "/System/Applications/Calendar.app" - "/Applications/Obsidian.app" - "/Applications/VSCodium.app" - "/Users/michaotic/Applications/Home Manager Apps/kitty.app" - "/System/Applications/Books.app" - "/System/Applications/QuickTime Player.app" - ]; - }; - }; - - system.activationScripts.postActivation.text = '' - echo "Restarting Dock..." - sudo -u michaotic /usr/bin/killall Dock - ''; - - # Touch ID for sudo - security.pam.services.sudo_local.touchIdAuth = true; - - system.stateVersion = 7; - - # Home-manager configuration specific to poppy home-manager.users.michaotic = { imports = [ ../../home/kitty.nix ]; - programs.zsh.shellAliases = { switch = "darwin-rebuild switch --flake .#poppy"; update = "nix flake update && darwin-rebuild switch --flake .#poppy"; diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix new file mode 100644 index 0000000..3d446a3 --- /dev/null +++ b/hosts/poppy/homebrew.nix @@ -0,0 +1,37 @@ +{ + homebrew.enable = true; + homebrew.onActivation.cleanup = "zap"; + + homebrew.taps = [ + "tw93/tap" + "typewhisper/tap" + ]; + + homebrew.brews = [ + "kew" + "mole" + ]; + + homebrew.casks = [ + "google-chrome" + "google-drive" + "bitwarden" + "marta" + "vscodium" + "github" + "docker-desktop" + "ollama-app" + "microsoft-word" + "microsoft-excel" + "microsoft-powerpoint" + "obsidian" + "anki" + "calibre" + "telegram" + "maccy" + "mos" + "caffeine" + "lunacy" + "skim" + ]; +} diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix new file mode 100644 index 0000000..0cb3bb4 --- /dev/null +++ b/hosts/poppy/system.nix @@ -0,0 +1,127 @@ +{ pkgs, ... }: { + system.defaults = { + NSGlobalDomain.AppleInterfaceStyle = "Dark"; + NSGlobalDomain._HIHideMenuBar = false; + + CustomUserPreferences = { + "com.apple.HIToolbox" = { + AppleEnabledInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + { + "Bundle ID" = "com.apple.CharacterPaletteIM"; + InputSourceKind = "Non Keyboard Input Method"; + } + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 19456; + "KeyboardLayout Name" = "Russian"; + } + ]; + AppleSelectedInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + ]; + }; + + "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { + "28" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1441792 ]; + }; + }; + "29" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1179648 ]; + }; + }; + "30" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1441792 ]; + }; + }; + "31" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1179648 ]; + }; + }; + }; + + "NSGlobalDomain" = { + "AppleMenuBarVisibleInFullscreen" = true; + }; + }; + + controlcenter = { + BatteryShowPercentage = true; + }; + + trackpad = { + Clicking = true; + TrackpadThreeFingerDrag = false; + TrackpadRightClick = true; + }; + + finder = { + AppleShowAllExtensions = true; + ShowPathbar = true; + ShowStatusBar = true; + FXPreferredViewStyle = "clmv"; + NewWindowTarget = "Home"; + ShowExternalHardDrivesOnDesktop = false; + ShowHardDrivesOnDesktop = false; + FXEnableExtensionChangeWarning = false; + _FXShowPosixPathInTitle = true; + }; + + dock = { + tilesize = 48; + largesize = 64; + magnification = true; + orientation = "bottom"; + mineffect = "scale"; + autohide = true; + autohide-time-modifier = 0.8; + show-recents = false; + show-process-indicators = true; + static-only = false; + wvous-tl-corner = 1; + wvous-tr-corner = 4; + wvous-bl-corner = 1; + wvous-br-corner = 1; + persistent-apps = [ + "/System/Applications/System Settings.app" + "/Applications/Google Chrome.app" + "/System/Applications/Mail.app" + "/Applications/Telegram.app" + "/System/Applications/Calendar.app" + "/Applications/Obsidian.app" + "/Applications/VSCodium.app" + "/Users/michaotic/Applications/Home Manager Apps/kitty.app" + "/System/Applications/Books.app" + "/System/Applications/QuickTime Player.app" + ]; + }; + }; + + system.activationScripts.postActivation.text = '' + echo "Restarting Dock..." + sudo -u michaotic /usr/bin/killall Dock + ''; + + security.pam.services.sudo_local.touchIdAuth = true; +} From 176508bc7453498f84aafab71978002ca0e503a3 Mon Sep 17 00:00:00 2001 From: mikl Date: Mon, 29 Jun 2026 19:19:30 +0300 Subject: [PATCH 04/77] fix: add backupFileExtension, remove typewhisper from taps --- flake.nix | 2 ++ hosts/poppy/default.nix | 2 +- hosts/poppy/homebrew.nix | 1 - 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index ee27839..e11eb5f 100644 --- a/flake.nix +++ b/flake.nix @@ -41,6 +41,7 @@ home-manager = { useGlobalPkgs = true; useUserPackages = true; + backupFileExtension = "backup"; users.michaotic = import ./home; }; } @@ -57,6 +58,7 @@ home-manager = { useGlobalPkgs = true; useUserPackages = true; + backupFileExtension = "backup"; users.michaotic = import ./home; }; } diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index 72d9191..8b2e46c 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -6,7 +6,7 @@ system.stateVersion = 7; nixpkgs.config.allowUnfree = true; - nix.settings.experimental-features = [ "nix-command" "flakes" ]; + nix.enable = false; users.users.michaotic = { home = "/Users/michaotic"; diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix index 3d446a3..1551df1 100644 --- a/hosts/poppy/homebrew.nix +++ b/hosts/poppy/homebrew.nix @@ -4,7 +4,6 @@ homebrew.taps = [ "tw93/tap" - "typewhisper/tap" ]; homebrew.brews = [ From 65f8b012879b1fc0b6986fa4e2daa9fd41fe5094 Mon Sep 17 00:00:00 2001 From: mikl Date: Mon, 29 Jun 2026 19:29:39 +0300 Subject: [PATCH 05/77] fix: add sessionVariables, PATH with pi-node, fastfetch alias --- home/cli.nix | 1 + home/default.nix | 10 ++++++++++ home/zsh.nix | 4 ++++ 3 files changed, 15 insertions(+) diff --git a/home/cli.nix b/home/cli.nix index bc91d81..4d824d9 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -10,6 +10,7 @@ tree htop tldr + fastfetch ]; # FZF fuzzy finder diff --git a/home/default.nix b/home/default.nix index 58e9575..737b6cb 100644 --- a/home/default.nix +++ b/home/default.nix @@ -8,4 +8,14 @@ home.stateVersion = "24.11"; programs.git.enable = true; + + home.sessionVariables = { + SEARXNG_URL = "https://search.iscg.dev"; + PATH = "/etc/profiles/per-user/michaotic/bin:$HOME/.nix-profile/bin:$HOME/bin:$HOME/.local/bin:$HOME/.npm-global/bin:/Users/michaotic/.opencode/bin:/Users/michaotic/.local/share/pi-node/node-v22.23.1-darwin-arm64/bin"; + # OPENROUTER_API_KEY = ""; # TODO: move to sops-nix secrets + SOPS_AGE_KEY_FILE = "$HOME/.config/sops/age/keys.txt"; + EDITOR = "micro"; + VISUAL = "micro"; + KUBECONFIG = "$HOME/.kube/config-jul11"; + }; } diff --git a/home/zsh.nix b/home/zsh.nix index 368980e..a2e3fb4 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -43,10 +43,14 @@ shellAliases = { ll = "eza -l --icons --git"; la = "eza -la --icons --git"; + ff = "fastfetch"; }; # Init content - runs on shell start initContent = '' + # Show fastfetch on shell start + fastfetch + # Load pure prompt autoload -U promptinit; promptinit prompt pure From c0d4a0df417fed92b86f00ea45541a568d1a6ce1 Mon Sep 17 00:00:00 2001 From: mikl Date: Mon, 29 Jun 2026 19:35:51 +0300 Subject: [PATCH 06/77] fix: move brew shellenv to envExtra for PATH, use initExtra for prompt --- home/zsh.nix | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/home/zsh.nix b/home/zsh.nix index a2e3fb4..ea34979 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -46,10 +46,19 @@ ff = "fastfetch"; }; - # Init content - runs on shell start - initContent = '' + # Environment setup BEFORE everything else (fixes PATH issues) + envExtra = '' + if [ -x "/opt/homebrew/bin/brew" ]; then + eval "$(/opt/homebrew/bin/brew shellenv)" + fi + ''; + + # Init content - runs on shell start (after PATH is set) + initExtra = '' # Show fastfetch on shell start + echo fastfetch + echo # Load pure prompt autoload -U promptinit; promptinit From af14e5d38e64ecd01fc8d17055af1f76f247d69f Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 00:30:00 +0300 Subject: [PATCH 07/77] fix: add initExtraFirst with basic PATH for brew and system binaries --- home/zsh.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/home/zsh.nix b/home/zsh.nix index ea34979..d3519b3 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -46,7 +46,12 @@ ff = "fastfetch"; }; - # Environment setup BEFORE everything else (fixes PATH issues) + # Fix PATH at the very beginning of .zshrc + initExtraFirst = '' + export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH" + ''; + + # Environment setup (zshenv) envExtra = '' if [ -x "/opt/homebrew/bin/brew" ]; then eval "$(/opt/homebrew/bin/brew shellenv)" From f1a8c729d17c20ba313dbbb7ab9776782e1ce8fc Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 00:33:36 +0300 Subject: [PATCH 08/77] refactor: use modern initContent with lib.mkBefore --- home/zsh.nix | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/home/zsh.nix b/home/zsh.nix index d3519b3..447faee 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ pkgs, lib, ... }: { programs.zsh = { enable = true; @@ -46,11 +46,6 @@ ff = "fastfetch"; }; - # Fix PATH at the very beginning of .zshrc - initExtraFirst = '' - export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH" - ''; - # Environment setup (zshenv) envExtra = '' if [ -x "/opt/homebrew/bin/brew" ]; then @@ -58,8 +53,11 @@ fi ''; - # Init content - runs on shell start (after PATH is set) - initExtra = '' + # Init content - uses lib.mkBefore to run before home-manager generated code + initContent = lib.mkBefore '' + export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH" + '' + + '' # Show fastfetch on shell start echo fastfetch From c1dbd64b40f7aae20be6a0bf8db8dba8804e19d5 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 00:35:26 +0300 Subject: [PATCH 09/77] fix: use lib.mkMerge for initContent --- home/zsh.nix | 44 +++++++++++++++++++++++--------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/home/zsh.nix b/home/zsh.nix index 447faee..fbffad1 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -54,27 +54,29 @@ ''; # Init content - uses lib.mkBefore to run before home-manager generated code - initContent = lib.mkBefore '' - export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH" - '' - + '' - # Show fastfetch on shell start - echo - fastfetch - echo + initContent = lib.mkMerge [ + (lib.mkBefore '' + export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH" + '') + '' + # Show fastfetch on shell start + echo + fastfetch + echo - # Load pure prompt - autoload -U promptinit; promptinit - prompt pure - - # Right prompt - time in gray - RPROMPT='%F{240}%D{%H:%M:%S}%f' - - # Pure prompt customization - zstyle ':prompt:pure:prompt:success' color green - zstyle ':prompt:pure:prompt:success' symbol ">" - zstyle ':prompt:pure:prompt:error' color red - zstyle ':prompt:pure:prompt:error' symbol ">" - ''; + # Load pure prompt + autoload -U promptinit; promptinit + prompt pure + + # Right prompt - time in gray + RPROMPT='%F{240}%D{%H:%M:%S}%f' + + # Pure prompt customization + zstyle ':prompt:pure:prompt:success' color green + zstyle ':prompt:pure:prompt:success' symbol ">" + zstyle ':prompt:pure:prompt:error' color red + zstyle ':prompt:pure:prompt:error' symbol ">" + '' + ]; }; } From c3e687c07b707ff68c4d1ebc25259a8c8718fc18 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 01:13:15 +0300 Subject: [PATCH 10/77] feat: add pnpm with pi-coding-agent, remove tw93/tap and mole --- home/cli.nix | 8 ++++++++ hosts/poppy/homebrew.nix | 5 +---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/home/cli.nix b/home/cli.nix index 4d824d9..c3be97f 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -51,4 +51,12 @@ # Fastfetch - system info (using package only, no home-manager module) # Config is in ~/.config/fastfetch/config.jsonc manually for now + + # pnpm - fast node package manager + programs.pnpm = { + enable = true; + globalPackages = [ + "@mariozechner/pi-coding-agent" + ]; + }; } diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix index 1551df1..a65011e 100644 --- a/hosts/poppy/homebrew.nix +++ b/hosts/poppy/homebrew.nix @@ -2,13 +2,10 @@ homebrew.enable = true; homebrew.onActivation.cleanup = "zap"; - homebrew.taps = [ - "tw93/tap" - ]; + homebrew.taps = []; homebrew.brews = [ "kew" - "mole" ]; homebrew.casks = [ From 63c12e8119c14dee5b2d0e971c91cced568174fa Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 01:13:38 +0300 Subject: [PATCH 11/77] fix: install pnpm via packages (programs.pnpm not available) --- home/cli.nix | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/home/cli.nix b/home/cli.nix index c3be97f..f58cfbf 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -53,10 +53,9 @@ # Config is in ~/.config/fastfetch/config.jsonc manually for now # pnpm - fast node package manager - programs.pnpm = { - enable = true; - globalPackages = [ - "@mariozechner/pi-coding-agent" - ]; - }; + home.packages = with pkgs; [ + pnpm + ]; + # TODO: global npm packages not managed by nix for now + # install manually: pnpm i -g @mariozechner/pi-coding-agent } From da383f019efe05f8aae71c4de95a08dae1e11a16 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 01:13:55 +0300 Subject: [PATCH 12/77] fix: merge pnpm into single home.packages list --- home/cli.nix | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/home/cli.nix b/home/cli.nix index f58cfbf..5bdfbc3 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -11,8 +11,12 @@ htop tldr fastfetch + pnpm # fast node package manager ]; + # TODO: global npm/pnpm packages not managed by nix for now + # install manually: pnpm i -g @mariozechner/pi-coding-agent + # FZF fuzzy finder programs.fzf = { enable = true; @@ -51,11 +55,4 @@ # Fastfetch - system info (using package only, no home-manager module) # Config is in ~/.config/fastfetch/config.jsonc manually for now - - # pnpm - fast node package manager - home.packages = with pkgs; [ - pnpm - ]; - # TODO: global npm packages not managed by nix for now - # install manually: pnpm i -g @mariozechner/pi-coding-agent } From b3c7094871f6f5d34cdb714bd9b1bdcf3a7dea0e Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 01:16:33 +0300 Subject: [PATCH 13/77] docs: update garden.md with documentation overview and future plans --- garden.md | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/garden.md b/garden.md index a2f3e9b..4c6b486 100644 --- a/garden.md +++ b/garden.md @@ -27,6 +27,19 @@ Hosts in this repo are named after plants and flowers. - `home/default.nix` — shared home-manager config for user `michaotic` (plan to migrate to `mikl` later) - `secrets/` — sops-encrypted secrets per host +## documentation + +notes are split by topic under `docs/`: + +- `docs/structure.md` — high-level overview, where things go +- `docs/poppy.md` — MacBook specific (homebrew, system defaults) +- `docs/muscari.md` — server + k3s specifics +- `docs/shell.md` — zsh, pure prompt, plugins +- `docs/terminal.md` — kitty + catppuccin theme +- `docs/cheatsheet.md` — quick commands reference + +when adding a new host: copy `docs/structure.md` template, document hostname, role, packages unique to it. + ## migrations - `nix-config-legacy/` — previous muscari-only config (preserved for reference) @@ -41,4 +54,22 @@ currently using `michaotic` as username (historical). plan to migrate to `mikl` - macOS: changing username requires careful handling of home folder, keychain, permissions - linux: easier, but better to do in one coordinated change -**when:** after setting up proper backups and testing migration procedure \ No newline at end of file +**when:** after setting up proper backups and testing migration procedure + +### rosemary setup + +currently `flake.nix` has `rosemary` commented out. need to: +- add disk config (likely similar to muscari) +- add users.users.michaotic.openssh.authorizedKeys +- test `nix flake check` + +### documentation improvements + +- [ ] create `docs/bootstrap.md` — manual setup guide for fresh device without nix (emergency fallback) + - list all CLI tools and how to install via brew/pnpm + - list all system defaults that need manual configuration + - explain which tools are nix-managed vs brew-managed +- [ ] create `docs/adding-host.md` — checklist for adding a new host +- [ ] create `docs/secrets.md` — sops-nix setup when we get there +- [ ] add migration notes to `docs/structure.md` as we learn patterns +- [ ] screenshots/notes for things that aren't obvious (e.g. dock layout) From 7eca3026878e7235dc95e3b468ed3c5d373e4c15 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 01:22:39 +0300 Subject: [PATCH 14/77] feat: add pass with pass-otp, gpg agent, organize cli tools by category --- home/cli.nix | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/home/cli.nix b/home/cli.nix index 5bdfbc3..9ef52cf 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -2,21 +2,38 @@ { # Universal CLI tools for all hosts home.packages = with pkgs; [ + # File navigation & viewing eza bat ripgrep fd fzf tree + + # System info htop tldr fastfetch + + # Node pnpm # fast node package manager + + # Secrets + (pass.withExtensions (ext: [ ext.pass-otp ])) + gpgme + gnupg ]; # TODO: global npm/pnpm packages not managed by nix for now # install manually: pnpm i -g @mariozechner/pi-coding-agent + # GPG agent for password caching + services.gpg-agent = { + enable = true; + defaultCacheTtl = 3600; + enableSshSupport = true; + }; + # FZF fuzzy finder programs.fzf = { enable = true; From 4ab3ecc2d05b7bbc3c75cd76e078f2a3f0657895 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 01:32:52 +0300 Subject: [PATCH 15/77] feat: add micro editor to cli tools --- home/cli.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/home/cli.nix b/home/cli.nix index 9ef52cf..9262a19 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -14,6 +14,10 @@ htop tldr fastfetch + tree + + # Editor + micro # Node pnpm # fast node package manager From 23aec94f2a80576d090e1cc1035515c2ff445196 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 02:00:38 +0300 Subject: [PATCH 16/77] feat: add ollama, git-delta, alejandra, broot, trash-cli, texliveFull; extract git.nix --- home/cli.nix | 8 ++++++++ home/default.nix | 3 +-- home/git.nix | 34 ++++++++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+), 2 deletions(-) create mode 100644 home/git.nix diff --git a/home/cli.nix b/home/cli.nix index 9262a19..22b043a 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -26,6 +26,14 @@ (pass.withExtensions (ext: [ ext.pass-otp ])) gpgme gnupg + + # Extras + ollama # CLI для LLM + git-delta # красивый git diff + alejandra # nix-форматтер + broot # tree с превью + trash-cli # rm с корзиной + texliveFull # LaTeX (~4GB, для математики) ]; # TODO: global npm/pnpm packages not managed by nix for now diff --git a/home/default.nix b/home/default.nix index 737b6cb..e4dc0f1 100644 --- a/home/default.nix +++ b/home/default.nix @@ -2,13 +2,12 @@ { imports = [ ./cli.nix + ./git.nix ./zsh.nix ]; home.stateVersion = "24.11"; - programs.git.enable = true; - home.sessionVariables = { SEARXNG_URL = "https://search.iscg.dev"; PATH = "/etc/profiles/per-user/michaotic/bin:$HOME/.nix-profile/bin:$HOME/bin:$HOME/.local/bin:$HOME/.npm-global/bin:/Users/michaotic/.opencode/bin:/Users/michaotic/.local/share/pi-node/node-v22.23.1-darwin-arm64/bin"; diff --git a/home/git.nix b/home/git.nix new file mode 100644 index 0000000..3dab10d --- /dev/null +++ b/home/git.nix @@ -0,0 +1,34 @@ +{ pkgs, ... }: +{ + programs.git = { + enable = true; + + # Use git-delta for pretty diffs + delta = { + enable = true; + options = { + navigate = true; # n/N to move between files + light = false; # dark mode + line-numbers = true; + side-by-side = false; + syntax-theme = "Catppuccin-mocha"; + }; + }; + + # Git user config + settings = { + user = { + name = "michaotic"; + email = "michaotic@iscg.dev"; + }; + init.defaultBranch = "main"; + pull.rebase = true; + }; + + # Extra gitignore + ignores = [ + ".DS_Store" + "*.swp" + ]; + }; +} From 01c8a89eb6dc48ac2de59ab63dc8766dd626d2c4 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 02:00:55 +0300 Subject: [PATCH 17/77] fix: use delta package name and programs.delta module --- home/cli.nix | 2 +- home/git.nix | 27 +++++++++++++-------------- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/home/cli.nix b/home/cli.nix index 22b043a..eef6a71 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -29,7 +29,7 @@ # Extras ollama # CLI для LLM - git-delta # красивый git diff + delta # красивый git diff (synonym: git-delta) alejandra # nix-форматтер broot # tree с превью trash-cli # rm с корзиной diff --git a/home/git.nix b/home/git.nix index 3dab10d..f8b0705 100644 --- a/home/git.nix +++ b/home/git.nix @@ -2,20 +2,7 @@ { programs.git = { enable = true; - - # Use git-delta for pretty diffs - delta = { - enable = true; - options = { - navigate = true; # n/N to move between files - light = false; # dark mode - line-numbers = true; - side-by-side = false; - syntax-theme = "Catppuccin-mocha"; - }; - }; - # Git user config settings = { user = { name = "michaotic"; @@ -25,10 +12,22 @@ pull.rebase = true; }; - # Extra gitignore ignores = [ ".DS_Store" "*.swp" ]; }; + + # Use git-delta for pretty diffs + programs.delta = { + enable = true; + enableGitIntegration = true; + options = { + navigate = true; # n/N to move between files + light = false; # dark mode + line-numbers = true; + side-by-side = false; + syntax-theme = "Catppuccin-mocha"; + }; + }; } From e87376641d3db705166c02dc18cedf145b4f72b8 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 02:11:27 +0300 Subject: [PATCH 18/77] fix: use correct Catppuccin Mocha theme name (with space) --- home/cli.nix | 2 +- home/git.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/home/cli.nix b/home/cli.nix index eef6a71..7ac0b83 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -69,7 +69,7 @@ programs.bat = { enable = true; config = { - theme = "Catppuccin-mocha"; + theme = "Catppuccin Mocha"; italic-text = "always"; style = "numbers,changes,header"; }; diff --git a/home/git.nix b/home/git.nix index f8b0705..f0aac5b 100644 --- a/home/git.nix +++ b/home/git.nix @@ -27,7 +27,7 @@ light = false; # dark mode line-numbers = true; side-by-side = false; - syntax-theme = "Catppuccin-mocha"; + syntax-theme = "Catppuccin Mocha"; }; }; } From 98347f1e4c5f9fa17a69bdfd251fc4332ee7af30 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 02:19:28 +0300 Subject: [PATCH 19/77] style: switch to Catppuccin Macchiato theme --- README.md | 1 + home/cli.nix | 2 +- home/git.nix | 2 +- temp.txt | 1 + 4 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 temp.txt diff --git a/README.md b/README.md index 1cdb366..d1758f5 100644 --- a/README.md +++ b/README.md @@ -30,3 +30,4 @@ sudo nixos-rebuild switch --flake .#muscari - [docs/cheatsheet.md](docs/cheatsheet.md) - quick commands See also [garden.md](garden.md) for host naming scheme. +test diff --git a/home/cli.nix b/home/cli.nix index 7ac0b83..699a0e0 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -69,7 +69,7 @@ programs.bat = { enable = true; config = { - theme = "Catppuccin Mocha"; + theme = "Catppuccin Macchiato"; italic-text = "always"; style = "numbers,changes,header"; }; diff --git a/home/git.nix b/home/git.nix index f0aac5b..d7261c4 100644 --- a/home/git.nix +++ b/home/git.nix @@ -27,7 +27,7 @@ light = false; # dark mode line-numbers = true; side-by-side = false; - syntax-theme = "Catppuccin Mocha"; + syntax-theme = "Catppuccin Macchiato"; }; }; } diff --git a/temp.txt b/temp.txt new file mode 100644 index 0000000..329face --- /dev/null +++ b/temp.txt @@ -0,0 +1 @@ +testing this thing From 45e2743053ae555db5629cee667bdb76a73f093d Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 02:39:13 +0300 Subject: [PATCH 20/77] docs: add tech debt section with git config todo --- README.md | 2 ++ garden.md | 7 +++++++ 2 files changed, 9 insertions(+) diff --git a/README.md b/README.md index d1758f5..2973a14 100644 --- a/README.md +++ b/README.md @@ -31,3 +31,5 @@ sudo nixos-rebuild switch --flake .#muscari See also [garden.md](garden.md) for host naming scheme. test +test macchiato +test macchiato diff --git a/garden.md b/garden.md index 4c6b486..fa05140 100644 --- a/garden.md +++ b/garden.md @@ -73,3 +73,10 @@ currently `flake.nix` has `rosemary` commented out. need to: - [ ] create `docs/secrets.md` — sops-nix setup when we get there - [ ] add migration notes to `docs/structure.md` as we learn patterns - [ ] screenshots/notes for things that aren't obvious (e.g. dock layout) + +### tech debt + +- [ ] **git config** — разобраться с конфликтом `~/.gitconfig` (локальный) vs `~/.config/git/config` (home-manager) + - перенести osxkeychain credential helper, lfs в home-manager + - унифицировать user.name/email (michaotic vs mikl) + - добавить `core.pager = delta` явно From 43ee63b7af65b2cc208eb47dbdf296b95e1f48e3 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 12:51:21 +0300 Subject: [PATCH 21/77] docs: add website saving tools to cheatsheet --- docs/cheatsheet.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/cheatsheet.md b/docs/cheatsheet.md index 71030e7..3188a49 100644 --- a/docs/cheatsheet.md +++ b/docs/cheatsheet.md @@ -55,3 +55,21 @@ cd .. # parent directory ctrl+r # fzf history search ctrl+t # fzf file finder ``` + +## save websites + +```bash +# одна страница в single html (с CSS+JS) +monolith https://example.com -o page.html + +# рекурсивно целый сайт +wget -r -p -k --no-clobber example.com + +# GUI для рекурсивного скачивания +httrack "https://example.com" -O ./out "+*.example.com/*" +``` + +примеры: +- nixos options: `monolith https://search.nixos.org/options -o options.html` +- сохранить доки: `wget -r -p -k nix-darwin.github.io/nix-darwin/manual/` +- monolith и httrack ставятся через `brew install monolith httrack` From 352df449085ad9109ac98e756a4fa3b207e86b3b Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 12:56:19 +0300 Subject: [PATCH 22/77] feat: add wget for downloading files and sites --- home/cli.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/home/cli.nix b/home/cli.nix index 699a0e0..a2074bb 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -9,6 +9,7 @@ fd fzf tree + wget # download files and recursive sites # System info htop From 65319be12b6463cdc65625e787e2af2b4d04d01c Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:04:51 +0300 Subject: [PATCH 23/77] feat: sync all current macOS system defaults from running system --- hosts/poppy/system.nix | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index 0cb3bb4..d181b96 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -1,7 +1,15 @@ { pkgs, ... }: { system.defaults = { - NSGlobalDomain.AppleInterfaceStyle = "Dark"; - NSGlobalDomain._HIHideMenuBar = false; + NSGlobalDomain = { + AppleInterfaceStyle = "Dark"; + AppleMenuBarVisibleInFullscreen = true; + AppleLanguages = [ "en-US" "ru-US" ]; + AppleMiniaturizeOnDoubleClick = false; + AppleAntiAliasingThreshold = 4; + NSAutomaticCapitalizationEnabled = true; + NSAutomaticPeriodSubstitutionEnabled = true; + NSAutomaticQuoteSubstitutionEnabled = true; + }; CustomUserPreferences = { "com.apple.HIToolbox" = { @@ -60,10 +68,6 @@ }; }; }; - - "NSGlobalDomain" = { - "AppleMenuBarVisibleInFullscreen" = true; - }; }; controlcenter = { @@ -71,9 +75,30 @@ }; trackpad = { + # Clicking Clicking = true; - TrackpadThreeFingerDrag = false; TrackpadRightClick = true; + TrackpadThreeFingerDrag = false; + TrackpadHandResting = true; + DragLock = false; + Dragging = false; + + # Scroll + TrackpadScroll = true; + TrackpadHorizScroll = true; + TrackpadMomentumScroll = true; + + # Gestures + TrackpadPinch = true; + TrackpadRotate = true; + TrackpadThreeFingerTapGesture = 0; + TrackpadTwoFingerDoubleTapGesture = 1; + TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; + TrackpadThreeFingerVertSwipeGesture = 2; + TrackpadFourFingerHorizSwipeGesture = 2; + TrackpadFourFingerVertSwipeGesture = 0; + TrackpadFourFingerPinchGesture = 2; + TrackpadFiveFingerPinchGesture = 2; }; finder = { @@ -81,6 +106,7 @@ ShowPathbar = true; ShowStatusBar = true; FXPreferredViewStyle = "clmv"; + FXPreferredGroupBy = "Date Modified"; NewWindowTarget = "Home"; ShowExternalHardDrivesOnDesktop = false; ShowHardDrivesOnDesktop = false; From eb0a6135bcbf290535154b56ef44b17d9d9e9e09 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:05:10 +0300 Subject: [PATCH 24/77] fix: remove unsupported AppleAntiAliasingThreshold option --- hosts/poppy/system.nix | 153 ----------------------------------------- 1 file changed, 153 deletions(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index d181b96..e69de29 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -1,153 +0,0 @@ -{ pkgs, ... }: { - system.defaults = { - NSGlobalDomain = { - AppleInterfaceStyle = "Dark"; - AppleMenuBarVisibleInFullscreen = true; - AppleLanguages = [ "en-US" "ru-US" ]; - AppleMiniaturizeOnDoubleClick = false; - AppleAntiAliasingThreshold = 4; - NSAutomaticCapitalizationEnabled = true; - NSAutomaticPeriodSubstitutionEnabled = true; - NSAutomaticQuoteSubstitutionEnabled = true; - }; - - CustomUserPreferences = { - "com.apple.HIToolbox" = { - AppleEnabledInputSources = [ - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 0; - "KeyboardLayout Name" = "U.S."; - } - { - "Bundle ID" = "com.apple.CharacterPaletteIM"; - InputSourceKind = "Non Keyboard Input Method"; - } - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 19456; - "KeyboardLayout Name" = "Russian"; - } - ]; - AppleSelectedInputSources = [ - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 0; - "KeyboardLayout Name" = "U.S."; - } - ]; - }; - - "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { - "28" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 51 20 1441792 ]; - }; - }; - "29" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 51 20 1179648 ]; - }; - }; - "30" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 52 21 1441792 ]; - }; - }; - "31" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 52 21 1179648 ]; - }; - }; - }; - }; - - controlcenter = { - BatteryShowPercentage = true; - }; - - trackpad = { - # Clicking - Clicking = true; - TrackpadRightClick = true; - TrackpadThreeFingerDrag = false; - TrackpadHandResting = true; - DragLock = false; - Dragging = false; - - # Scroll - TrackpadScroll = true; - TrackpadHorizScroll = true; - TrackpadMomentumScroll = true; - - # Gestures - TrackpadPinch = true; - TrackpadRotate = true; - TrackpadThreeFingerTapGesture = 0; - TrackpadTwoFingerDoubleTapGesture = 1; - TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; - TrackpadThreeFingerVertSwipeGesture = 2; - TrackpadFourFingerHorizSwipeGesture = 2; - TrackpadFourFingerVertSwipeGesture = 0; - TrackpadFourFingerPinchGesture = 2; - TrackpadFiveFingerPinchGesture = 2; - }; - - finder = { - AppleShowAllExtensions = true; - ShowPathbar = true; - ShowStatusBar = true; - FXPreferredViewStyle = "clmv"; - FXPreferredGroupBy = "Date Modified"; - NewWindowTarget = "Home"; - ShowExternalHardDrivesOnDesktop = false; - ShowHardDrivesOnDesktop = false; - FXEnableExtensionChangeWarning = false; - _FXShowPosixPathInTitle = true; - }; - - dock = { - tilesize = 48; - largesize = 64; - magnification = true; - orientation = "bottom"; - mineffect = "scale"; - autohide = true; - autohide-time-modifier = 0.8; - show-recents = false; - show-process-indicators = true; - static-only = false; - wvous-tl-corner = 1; - wvous-tr-corner = 4; - wvous-bl-corner = 1; - wvous-br-corner = 1; - persistent-apps = [ - "/System/Applications/System Settings.app" - "/Applications/Google Chrome.app" - "/System/Applications/Mail.app" - "/Applications/Telegram.app" - "/System/Applications/Calendar.app" - "/Applications/Obsidian.app" - "/Applications/VSCodium.app" - "/Users/michaotic/Applications/Home Manager Apps/kitty.app" - "/System/Applications/Books.app" - "/System/Applications/QuickTime Player.app" - ]; - }; - }; - - system.activationScripts.postActivation.text = '' - echo "Restarting Dock..." - sudo -u michaotic /usr/bin/killall Dock - ''; - - security.pam.services.sudo_local.touchIdAuth = true; -} From 038196166e20da9d7b3c323e024aa5c6821baeca Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:05:30 +0300 Subject: [PATCH 25/77] fix: remove unsupported AppleLanguages option --- hosts/poppy/system.nix | 151 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index e69de29..251d330 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -0,0 +1,151 @@ +{ pkgs, ... }: { + system.defaults = { + NSGlobalDomain = { + AppleInterfaceStyle = "Dark"; + AppleMenuBarVisibleInFullscreen = true; + AppleMiniaturizeOnDoubleClick = false; + NSAutomaticCapitalizationEnabled = true; + NSAutomaticPeriodSubstitutionEnabled = true; + NSAutomaticQuoteSubstitutionEnabled = true; + }; + + CustomUserPreferences = { + "com.apple.HIToolbox" = { + AppleEnabledInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + { + "Bundle ID" = "com.apple.CharacterPaletteIM"; + InputSourceKind = "Non Keyboard Input Method"; + } + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 19456; + "KeyboardLayout Name" = "Russian"; + } + ]; + AppleSelectedInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + ]; + }; + + "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { + "28" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1441792 ]; + }; + }; + "29" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1179648 ]; + }; + }; + "30" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1441792 ]; + }; + }; + "31" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1179648 ]; + }; + }; + }; + }; + + controlcenter = { + BatteryShowPercentage = true; + }; + + trackpad = { + # Clicking + Clicking = true; + TrackpadRightClick = true; + TrackpadThreeFingerDrag = false; + TrackpadHandResting = true; + DragLock = false; + Dragging = false; + + # Scroll + TrackpadScroll = true; + TrackpadHorizScroll = true; + TrackpadMomentumScroll = true; + + # Gestures + TrackpadPinch = true; + TrackpadRotate = true; + TrackpadThreeFingerTapGesture = 0; + TrackpadTwoFingerDoubleTapGesture = 1; + TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; + TrackpadThreeFingerVertSwipeGesture = 2; + TrackpadFourFingerHorizSwipeGesture = 2; + TrackpadFourFingerVertSwipeGesture = 0; + TrackpadFourFingerPinchGesture = 2; + TrackpadFiveFingerPinchGesture = 2; + }; + + finder = { + AppleShowAllExtensions = true; + ShowPathbar = true; + ShowStatusBar = true; + FXPreferredViewStyle = "clmv"; + FXPreferredGroupBy = "Date Modified"; + NewWindowTarget = "Home"; + ShowExternalHardDrivesOnDesktop = false; + ShowHardDrivesOnDesktop = false; + FXEnableExtensionChangeWarning = false; + _FXShowPosixPathInTitle = true; + }; + + dock = { + tilesize = 48; + largesize = 64; + magnification = true; + orientation = "bottom"; + mineffect = "scale"; + autohide = true; + autohide-time-modifier = 0.8; + show-recents = false; + show-process-indicators = true; + static-only = false; + wvous-tl-corner = 1; + wvous-tr-corner = 4; + wvous-bl-corner = 1; + wvous-br-corner = 1; + persistent-apps = [ + "/System/Applications/System Settings.app" + "/Applications/Google Chrome.app" + "/System/Applications/Mail.app" + "/Applications/Telegram.app" + "/System/Applications/Calendar.app" + "/Applications/Obsidian.app" + "/Applications/VSCodium.app" + "/Users/michaotic/Applications/Home Manager Apps/kitty.app" + "/System/Applications/Books.app" + "/System/Applications/QuickTime Player.app" + ]; + }; + }; + + system.activationScripts.postActivation.text = '' + echo "Restarting Dock..." + sudo -u michaotic /usr/bin/killall Dock + ''; + + security.pam.services.sudo_local.touchIdAuth = true; +} From 7475e188ddb5ac99dc1e134819527beae5bd2981 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:06:16 +0300 Subject: [PATCH 26/77] fix: move AppleMenuBarVisibleInFullscreen back to CustomUserPreferences --- hosts/poppy/system.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index 251d330..f9d42ad 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -2,7 +2,6 @@ system.defaults = { NSGlobalDomain = { AppleInterfaceStyle = "Dark"; - AppleMenuBarVisibleInFullscreen = true; AppleMiniaturizeOnDoubleClick = false; NSAutomaticCapitalizationEnabled = true; NSAutomaticPeriodSubstitutionEnabled = true; @@ -66,6 +65,10 @@ }; }; }; + + "NSGlobalDomain" = { + "AppleMenuBarVisibleInFullscreen" = true; + }; }; controlcenter = { From f844365d30867d26fc42aabc5525697d49f08a09 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:06:27 +0300 Subject: [PATCH 27/77] fix: remove unsupported AppleMiniaturizeOnDoubleClick --- hosts/poppy/system.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index f9d42ad..398319e 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -2,7 +2,6 @@ system.defaults = { NSGlobalDomain = { AppleInterfaceStyle = "Dark"; - AppleMiniaturizeOnDoubleClick = false; NSAutomaticCapitalizationEnabled = true; NSAutomaticPeriodSubstitutionEnabled = true; NSAutomaticQuoteSubstitutionEnabled = true; From 2afdb54dcb8983a0e11480bab75f8487a5790c39 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:06:39 +0300 Subject: [PATCH 28/77] fix: remove unsupported FXPreferredGroupBy --- hosts/poppy/system.nix | 153 ----------------------------------------- 1 file changed, 153 deletions(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index 398319e..e69de29 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -1,153 +0,0 @@ -{ pkgs, ... }: { - system.defaults = { - NSGlobalDomain = { - AppleInterfaceStyle = "Dark"; - NSAutomaticCapitalizationEnabled = true; - NSAutomaticPeriodSubstitutionEnabled = true; - NSAutomaticQuoteSubstitutionEnabled = true; - }; - - CustomUserPreferences = { - "com.apple.HIToolbox" = { - AppleEnabledInputSources = [ - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 0; - "KeyboardLayout Name" = "U.S."; - } - { - "Bundle ID" = "com.apple.CharacterPaletteIM"; - InputSourceKind = "Non Keyboard Input Method"; - } - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 19456; - "KeyboardLayout Name" = "Russian"; - } - ]; - AppleSelectedInputSources = [ - { - InputSourceKind = "Keyboard Layout"; - "KeyboardLayout ID" = 0; - "KeyboardLayout Name" = "U.S."; - } - ]; - }; - - "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { - "28" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 51 20 1441792 ]; - }; - }; - "29" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 51 20 1179648 ]; - }; - }; - "30" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 52 21 1441792 ]; - }; - }; - "31" = { - enabled = 1; - value = { - type = "standard"; - parameters = [ 52 21 1179648 ]; - }; - }; - }; - - "NSGlobalDomain" = { - "AppleMenuBarVisibleInFullscreen" = true; - }; - }; - - controlcenter = { - BatteryShowPercentage = true; - }; - - trackpad = { - # Clicking - Clicking = true; - TrackpadRightClick = true; - TrackpadThreeFingerDrag = false; - TrackpadHandResting = true; - DragLock = false; - Dragging = false; - - # Scroll - TrackpadScroll = true; - TrackpadHorizScroll = true; - TrackpadMomentumScroll = true; - - # Gestures - TrackpadPinch = true; - TrackpadRotate = true; - TrackpadThreeFingerTapGesture = 0; - TrackpadTwoFingerDoubleTapGesture = 1; - TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; - TrackpadThreeFingerVertSwipeGesture = 2; - TrackpadFourFingerHorizSwipeGesture = 2; - TrackpadFourFingerVertSwipeGesture = 0; - TrackpadFourFingerPinchGesture = 2; - TrackpadFiveFingerPinchGesture = 2; - }; - - finder = { - AppleShowAllExtensions = true; - ShowPathbar = true; - ShowStatusBar = true; - FXPreferredViewStyle = "clmv"; - FXPreferredGroupBy = "Date Modified"; - NewWindowTarget = "Home"; - ShowExternalHardDrivesOnDesktop = false; - ShowHardDrivesOnDesktop = false; - FXEnableExtensionChangeWarning = false; - _FXShowPosixPathInTitle = true; - }; - - dock = { - tilesize = 48; - largesize = 64; - magnification = true; - orientation = "bottom"; - mineffect = "scale"; - autohide = true; - autohide-time-modifier = 0.8; - show-recents = false; - show-process-indicators = true; - static-only = false; - wvous-tl-corner = 1; - wvous-tr-corner = 4; - wvous-bl-corner = 1; - wvous-br-corner = 1; - persistent-apps = [ - "/System/Applications/System Settings.app" - "/Applications/Google Chrome.app" - "/System/Applications/Mail.app" - "/Applications/Telegram.app" - "/System/Applications/Calendar.app" - "/Applications/Obsidian.app" - "/Applications/VSCodium.app" - "/Users/michaotic/Applications/Home Manager Apps/kitty.app" - "/System/Applications/Books.app" - "/System/Applications/QuickTime Player.app" - ]; - }; - }; - - system.activationScripts.postActivation.text = '' - echo "Restarting Dock..." - sudo -u michaotic /usr/bin/killall Dock - ''; - - security.pam.services.sudo_local.touchIdAuth = true; -} From 23076d8010557aa8b9571e0cf92bbd46c5977a3c Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:08:42 +0300 Subject: [PATCH 29/77] fix: remove unsupported trackpad/finder/nsglobal options --- hosts/poppy/system.nix | 152 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 152 insertions(+) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index e69de29..da2f0d4 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -0,0 +1,152 @@ +{ pkgs, ... }: { + system.defaults = { + NSGlobalDomain = { + AppleInterfaceStyle = "Dark"; + NSAutomaticCapitalizationEnabled = true; + NSAutomaticPeriodSubstitutionEnabled = true; + NSAutomaticQuoteSubstitutionEnabled = true; + NSAutomaticDashSubstitutionEnabled = true; + }; + + CustomUserPreferences = { + "com.apple.HIToolbox" = { + AppleEnabledInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + { + "Bundle ID" = "com.apple.CharacterPaletteIM"; + InputSourceKind = "Non Keyboard Input Method"; + } + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 19456; + "KeyboardLayout Name" = "Russian"; + } + ]; + AppleSelectedInputSources = [ + { + InputSourceKind = "Keyboard Layout"; + "KeyboardLayout ID" = 0; + "KeyboardLayout Name" = "U.S."; + } + ]; + }; + + "com.apple.symbolichotkeys".AppleSymbolicHotKeys = { + "28" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1441792 ]; + }; + }; + "29" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 51 20 1179648 ]; + }; + }; + "30" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1441792 ]; + }; + }; + "31" = { + enabled = 1; + value = { + type = "standard"; + parameters = [ 52 21 1179648 ]; + }; + }; + }; + + "NSGlobalDomain" = { + "AppleMenuBarVisibleInFullscreen" = true; + }; + }; + + controlcenter = { + BatteryShowPercentage = true; + }; + + trackpad = { + # Clicking + Clicking = true; + TrackpadRightClick = true; + TrackpadThreeFingerDrag = false; + TrackpadHandResting = true; + DragLock = false; + Dragging = false; + + # Scroll + TrackpadScroll = true; + TrackpadHorizScroll = true; + TrackpadMomentumScroll = true; + + # Gestures + TrackpadPinch = true; + TrackpadRotate = true; + TrackpadThreeFingerTapGesture = 0; + TrackpadTwoFingerDoubleTapGesture = 1; + TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; + TrackpadThreeFingerVertSwipeGesture = 2; + TrackpadFourFingerHorizSwipeGesture = 2; + TrackpadFourFingerVertSwipeGesture = 0; + TrackpadFourFingerPinchGesture = 2; + }; + + finder = { + AppleShowAllExtensions = true; + ShowPathbar = true; + ShowStatusBar = true; + FXPreferredViewStyle = "clmv"; + NewWindowTarget = "Home"; + ShowExternalHardDrivesOnDesktop = false; + ShowHardDrivesOnDesktop = false; + FXEnableExtensionChangeWarning = false; + _FXShowPosixPathInTitle = true; + }; + + dock = { + tilesize = 48; + largesize = 64; + magnification = true; + orientation = "bottom"; + mineffect = "scale"; + autohide = true; + autohide-time-modifier = 0.8; + show-recents = false; + show-process-indicators = true; + static-only = false; + wvous-tl-corner = 1; + wvous-tr-corner = 4; + wvous-bl-corner = 1; + wvous-br-corner = 1; + persistent-apps = [ + "/System/Applications/System Settings.app" + "/Applications/Google Chrome.app" + "/System/Applications/Mail.app" + "/Applications/Telegram.app" + "/System/Applications/Calendar.app" + "/Applications/Obsidian.app" + "/Applications/VSCodium.app" + "/Users/michaotic/Applications/Home Manager Apps/kitty.app" + "/System/Applications/Books.app" + "/System/Applications/QuickTime Player.app" + ]; + }; + }; + + system.activationScripts.postActivation.text = '' + echo "Restarting Dock..." + sudo -u michaotic /usr/bin/killall Dock + ''; + + security.pam.services.sudo_local.touchIdAuth = true; +} From 8f936fb4acf3cc906160a4a8aff6eddb9fc5df55 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:08:58 +0300 Subject: [PATCH 30/77] fix: remove unsupported TrackpadHandResting --- hosts/poppy/system.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index da2f0d4..85bf263 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -80,7 +80,6 @@ Clicking = true; TrackpadRightClick = true; TrackpadThreeFingerDrag = false; - TrackpadHandResting = true; DragLock = false; Dragging = false; From 5501fb5a31f8571ddcc379344a9f3a9b0677c4d4 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:09:06 +0300 Subject: [PATCH 31/77] fix: remove unsupported TrackpadHorizScroll --- hosts/poppy/system.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index 85bf263..e188d2d 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -85,7 +85,6 @@ # Scroll TrackpadScroll = true; - TrackpadHorizScroll = true; TrackpadMomentumScroll = true; # Gestures From b3c3a865e1937815aa80e8298c3f99c353f05a41 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:09:21 +0300 Subject: [PATCH 32/77] fix: remove unsupported TrackpadScroll --- hosts/poppy/system.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index e188d2d..abb578b 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -84,7 +84,6 @@ Dragging = false; # Scroll - TrackpadScroll = true; TrackpadMomentumScroll = true; # Gestures From 3ca861bd33f558221ee744586ade2b2887117aae Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:38:25 +0300 Subject: [PATCH 33/77] feat: add markedit and duti for default apps management --- home/default.nix | 1 + home/duti.nix | 33 +++++++++++++++++++++++++++++++++ hosts/poppy/homebrew.nix | 1 + 3 files changed, 35 insertions(+) create mode 100644 home/duti.nix diff --git a/home/default.nix b/home/default.nix index e4dc0f1..9bbd28e 100644 --- a/home/default.nix +++ b/home/default.nix @@ -4,6 +4,7 @@ ./cli.nix ./git.nix ./zsh.nix + ./duti.nix ]; home.stateVersion = "24.11"; diff --git a/home/duti.nix b/home/duti.nix new file mode 100644 index 0000000..8106810 --- /dev/null +++ b/home/duti.nix @@ -0,0 +1,33 @@ +{ config, pkgs, ... }: { + home.packages = [ pkgs.duti ]; + + xdg.configFile."duti/config".text = '' + # browser + com.google.chrome public.html + com.google.chrome public.url + com.google.chrome public.xhtml + + # text editor + com.vscodium public.plain-text + com.vscodium public.text + com.vscodium public.source-code + + # markdown viewer + com.godspeedapps.MarkEdit net.daringfireball.markdown + com.godspeedapps.MarkEdit public.markdown + + # terminal + net.kovidgoyal.kitty public.shell-script + + # pdf + net.sourceforge.skim-app com.adobe.pdf + + # mail + com.apple.mail public.email-message + ''; + + # Apply default apps on activation + system.activationScripts.defaultApps.text = '' + ${pkgs.duti}/bin/duti -d ${config.xdg.configHome}/duti/config || true + ''; +} diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix index a65011e..19776cd 100644 --- a/hosts/poppy/homebrew.nix +++ b/hosts/poppy/homebrew.nix @@ -29,5 +29,6 @@ "caffeine" "lunacy" "skim" + "markedit" ]; } From 47a4d83fcefdddce565aa291a54d9912026385ac Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:39:46 +0300 Subject: [PATCH 34/77] fix: move duti activation script from home to poppy host --- home/duti.nix | 5 ----- hosts/poppy/default.nix | 7 +++++++ 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index 8106810..d9014b3 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -25,9 +25,4 @@ # mail com.apple.mail public.email-message ''; - - # Apply default apps on activation - system.activationScripts.defaultApps.text = '' - ${pkgs.duti}/bin/duti -d ${config.xdg.configHome}/duti/config || true - ''; } diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index 8b2e46c..f601478 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -15,6 +15,13 @@ environment.systemPackages = [ pkgs.vim ]; + # Apply default apps via duti on activation + system.activationScripts.defaultApps.text = '' + if [ -f "/Users/michaotic/.config/duti/config" ]; then + ${pkgs.duti}/bin/duti -d /Users/michaotic/.config/duti/config || true + fi + ''; + home-manager.users.michaotic = { imports = [ ../../home/kitty.nix ]; programs.zsh.shellAliases = { From b2e3092c2e3665aa6c06bbd475ea6ea20d14f612 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 13:42:18 +0300 Subject: [PATCH 35/77] fix: remove TrackpadTwoFingerDoubleTapGesture (boolean type) --- hosts/poppy/system.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix index abb578b..5962723 100644 --- a/hosts/poppy/system.nix +++ b/hosts/poppy/system.nix @@ -90,7 +90,6 @@ TrackpadPinch = true; TrackpadRotate = true; TrackpadThreeFingerTapGesture = 0; - TrackpadTwoFingerDoubleTapGesture = 1; TrackpadTwoFingerFromRightEdgeSwipeGesture = 3; TrackpadThreeFingerVertSwipeGesture = 2; TrackpadFourFingerHorizSwipeGesture = 2; From 83092f70f8000c561ea3cb7e1171db5b19df9ae5 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:04:32 +0300 Subject: [PATCH 36/77] feat: add MarkEdit catppuccin theme and MTE table editor --- home/default.nix | 1 + home/markedit.nix | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) create mode 100644 home/markedit.nix diff --git a/home/default.nix b/home/default.nix index 9bbd28e..bb261cf 100644 --- a/home/default.nix +++ b/home/default.nix @@ -5,6 +5,7 @@ ./git.nix ./zsh.nix ./duti.nix + ./markedit.nix ]; home.stateVersion = "24.11"; diff --git a/home/markedit.nix b/home/markedit.nix new file mode 100644 index 0000000..5b59b80 --- /dev/null +++ b/home/markedit.nix @@ -0,0 +1,16 @@ +{ pkgs, ... }: { + # MarkEdit extensions - install .js scripts to MarkEdit's scripts directory + # Path: ~/Library/Containers/app.cyan.markedit/Data/Documents/scripts/ + + # Catppuccin theme + home.file."Library/Containers/app.cyan.markedit/Data/Documents/scripts/markedit-theme-catppuccin.js".source = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/MarkEdit-app/MarkEdit-theme-catppuccin/main/dist/markedit-theme-catppuccin.js"; + sha256 = "1mhl4s4ggmiy27dgr7cfwybq18alfald3my1x0l511p5h4psw9xf"; + }; + + # Markdown Table Editor (MTE) + home.file."Library/Containers/app.cyan.markedit/Data/Documents/scripts/markedit-mte.js".source = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/MarkEdit-app/MarkEdit-mte/main/dist/markedit-mte.js"; + sha256 = "000pw16f60nv1jq7g6yjf0ymzg4mbga7m98naj8j794lmh6ss20v"; + }; +} From dcddd60c32f4e42c13db9ade70dc7146576cb24d Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:33:31 +0300 Subject: [PATCH 37/77] feat: configure MarkEdit catppuccin theme via activation script --- hosts/poppy/default.nix | 33 --------------------------------- 1 file changed, 33 deletions(-) diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index f601478..e69de29 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -1,33 +0,0 @@ -{ pkgs, ... }: { - imports = [ ./homebrew.nix ./system.nix ]; - - networking.hostName = "poppy"; - system.primaryUser = "michaotic"; - system.stateVersion = 7; - - nixpkgs.config.allowUnfree = true; - nix.enable = false; - - users.users.michaotic = { - home = "/Users/michaotic"; - shell = pkgs.zsh; - }; - - environment.systemPackages = [ pkgs.vim ]; - - # Apply default apps via duti on activation - system.activationScripts.defaultApps.text = '' - if [ -f "/Users/michaotic/.config/duti/config" ]; then - ${pkgs.duti}/bin/duti -d /Users/michaotic/.config/duti/config || true - fi - ''; - - home-manager.users.michaotic = { - imports = [ ../../home/kitty.nix ]; - programs.zsh.shellAliases = { - switch = "darwin-rebuild switch --flake .#poppy"; - update = "nix flake update && darwin-rebuild switch --flake .#poppy"; - cleanup = "nix-collect-garbage -d"; - }; - }; -} From 9b54c129a2e2dd42a2f25f172fa7437c51db47d2 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:35:19 +0300 Subject: [PATCH 38/77] fix: use full paths in MarkEdit activation script --- hosts/poppy/default.nix | 54 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index e69de29..44197bc 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -0,0 +1,54 @@ +{ pkgs, ... }: { + imports = [ ./homebrew.nix ./system.nix ]; + + networking.hostName = "poppy"; + system.primaryUser = "michaotic"; + system.stateVersion = 7; + + nixpkgs.config.allowUnfree = true; + nix.enable = false; + + users.users.michaotic = { + home = "/Users/michaotic"; + shell = pkgs.zsh; + }; + + environment.systemPackages = [ pkgs.vim ]; + + # Apply default apps via duti on activation + system.activationScripts.defaultApps.text = '' + if [ -f "/Users/michaotic/.config/duti/config" ]; then + ${pkgs.duti}/bin/duti -d /Users/michaotic/.config/duti/config || true + fi + ''; + + # Configure MarkEdit settings via jq + system.activationScripts.markeditSettings.text = let + settingsFile = "/Users/michaotic/Library/Containers/app.cyan.markedit/Data/Documents/settings.json"; + jqBin = "${pkgs.jq}/bin/jq"; + in '' + if [ -f "${settingsFile}" ]; then + tmp=/tmp/markedit-settings-$$.json + if ${jqBin} '. + { + "extension.markeditThemeCatppuccin": { + "enabledMode": "both", + "lightTheme": "latte", + "darkTheme": "mocha" + } + }' "${settingsFile}" > "$tmp" 2>/dev/null; then + cp "$tmp" "${settingsFile}" + chown michaotic:staff "${settingsFile}" + fi + rm -f "$tmp" + fi + ''; + + home-manager.users.michaotic = { + imports = [ ../../home/kitty.nix ]; + programs.zsh.shellAliases = { + switch = "darwin-rebuild switch --flake .#poppy"; + update = "nix flake update && darwin-rebuild switch --flake .#poppy"; + cleanup = "nix-collect-garbage -d"; + }; + }; +} From 93bc0d0c0260ed60a87f825973b9fa12fb9b16bb Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:37:55 +0300 Subject: [PATCH 39/77] revert: remove MarkEdit theme/MTE extensions config --- home/default.nix | 1 - home/markedit.nix | 16 ---------------- hosts/poppy/default.nix | 21 --------------------- 3 files changed, 38 deletions(-) delete mode 100644 home/markedit.nix diff --git a/home/default.nix b/home/default.nix index bb261cf..9bbd28e 100644 --- a/home/default.nix +++ b/home/default.nix @@ -5,7 +5,6 @@ ./git.nix ./zsh.nix ./duti.nix - ./markedit.nix ]; home.stateVersion = "24.11"; diff --git a/home/markedit.nix b/home/markedit.nix deleted file mode 100644 index 5b59b80..0000000 --- a/home/markedit.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ pkgs, ... }: { - # MarkEdit extensions - install .js scripts to MarkEdit's scripts directory - # Path: ~/Library/Containers/app.cyan.markedit/Data/Documents/scripts/ - - # Catppuccin theme - home.file."Library/Containers/app.cyan.markedit/Data/Documents/scripts/markedit-theme-catppuccin.js".source = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/MarkEdit-app/MarkEdit-theme-catppuccin/main/dist/markedit-theme-catppuccin.js"; - sha256 = "1mhl4s4ggmiy27dgr7cfwybq18alfald3my1x0l511p5h4psw9xf"; - }; - - # Markdown Table Editor (MTE) - home.file."Library/Containers/app.cyan.markedit/Data/Documents/scripts/markedit-mte.js".source = pkgs.fetchurl { - url = "https://raw.githubusercontent.com/MarkEdit-app/MarkEdit-mte/main/dist/markedit-mte.js"; - sha256 = "000pw16f60nv1jq7g6yjf0ymzg4mbga7m98naj8j794lmh6ss20v"; - }; -} diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index 44197bc..f601478 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -22,27 +22,6 @@ fi ''; - # Configure MarkEdit settings via jq - system.activationScripts.markeditSettings.text = let - settingsFile = "/Users/michaotic/Library/Containers/app.cyan.markedit/Data/Documents/settings.json"; - jqBin = "${pkgs.jq}/bin/jq"; - in '' - if [ -f "${settingsFile}" ]; then - tmp=/tmp/markedit-settings-$$.json - if ${jqBin} '. + { - "extension.markeditThemeCatppuccin": { - "enabledMode": "both", - "lightTheme": "latte", - "darkTheme": "mocha" - } - }' "${settingsFile}" > "$tmp" 2>/dev/null; then - cp "$tmp" "${settingsFile}" - chown michaotic:staff "${settingsFile}" - fi - rm -f "$tmp" - fi - ''; - home-manager.users.michaotic = { imports = [ ../../home/kitty.nix ]; programs.zsh.shellAliases = { From bc8481dd7a6317fcd8e6ce37ac0db3f815e85674 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:46:31 +0300 Subject: [PATCH 40/77] feat: add duti activation to apply default apps on rebuild --- home/duti.nix | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index d9014b3..e69de29 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -1,28 +0,0 @@ -{ config, pkgs, ... }: { - home.packages = [ pkgs.duti ]; - - xdg.configFile."duti/config".text = '' - # browser - com.google.chrome public.html - com.google.chrome public.url - com.google.chrome public.xhtml - - # text editor - com.vscodium public.plain-text - com.vscodium public.text - com.vscodium public.source-code - - # markdown viewer - com.godspeedapps.MarkEdit net.daringfireball.markdown - com.godspeedapps.MarkEdit public.markdown - - # terminal - net.kovidgoyal.kitty public.shell-script - - # pdf - net.sourceforge.skim-app com.adobe.pdf - - # mail - com.apple.mail public.email-message - ''; -} From 3a9deba59e8f70496597712aec9182d205e02c8b Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:47:04 +0300 Subject: [PATCH 41/77] fix: use script instead of text for duti activation --- home/duti.nix | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/home/duti.nix b/home/duti.nix index e69de29..5cf2576 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -0,0 +1,35 @@ +{ config, pkgs, ... }: { + home.packages = [ pkgs.duti ]; + + xdg.configFile."duti/config".text = '' + # browser + com.google.chrome public.html + com.google.chrome public.url + com.google.chrome public.xhtml + + # text editor + com.vscodium public.plain-text + com.vscodium public.text + com.vscodium public.source-code + + # markdown viewer + com.godspeedapps.MarkEdit net.daringfireball.markdown + com.godspeedapps.MarkEdit public.markdown + + # terminal + net.kovidgoyal.kitty public.shell-script + + # pdf + net.sourceforge.skim-app com.adobe.pdf + + # mail + com.apple.mail public.email-message + ''; + + # Apply defaults after linking config + home.activation.dutiApply = { + script = '' + ${pkgs.duti}/bin/duti -d ${config.xdg.configHome}/duti/config + ''; + }; +} From 69e3d042d4dbd3a832bff2a82e472397e31ad089 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:47:21 +0300 Subject: [PATCH 42/77] fix: use data (string) for duti activation --- home/duti.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/home/duti.nix b/home/duti.nix index 5cf2576..66c8d29 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -28,7 +28,7 @@ # Apply defaults after linking config home.activation.dutiApply = { - script = '' + data = '' ${pkgs.duti}/bin/duti -d ${config.xdg.configHome}/duti/config ''; }; From b6faba6285a7b92774c65980c4a61bc5640b5840 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:48:23 +0300 Subject: [PATCH 43/77] fix: remove broken home.activation.dutiApply, keep only system-level activation --- home/duti.nix | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index 66c8d29..b4f943a 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: { +{ pkgs, ... }: { home.packages = [ pkgs.duti ]; xdg.configFile."duti/config".text = '' @@ -25,11 +25,5 @@ # mail com.apple.mail public.email-message ''; - - # Apply defaults after linking config - home.activation.dutiApply = { - data = '' - ${pkgs.duti}/bin/duti -d ${config.xdg.configHome}/duti/config - ''; - }; + # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix } From 943ca7fe8b6b82f7db34274f1b16962a0c141305 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 14:58:53 +0300 Subject: [PATCH 44/77] fix: add nix profile paths to zsh initContent PATH --- home/zsh.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/home/zsh.nix b/home/zsh.nix index fbffad1..4627c30 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -56,7 +56,7 @@ # Init content - uses lib.mkBefore to run before home-manager generated code initContent = lib.mkMerge [ (lib.mkBefore '' - export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH" + export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$HOME/.nix-profile/bin:/etc/profiles/per-user/michaotic/bin:$PATH" '') '' # Show fastfetch on shell start From 873627880e731937a201a73d18220b54f102e9f1 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:10:56 +0300 Subject: [PATCH 45/77] fix: use real bundle ids for VSCodium, MarkEdit, kitty, Skim --- home/duti.nix | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index b4f943a..6bbaa95 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -3,27 +3,27 @@ xdg.configFile."duti/config".text = '' # browser - com.google.chrome public.html - com.google.chrome public.url - com.google.chrome public.xhtml + com.google.Chrome public.html + com.google.Chrome public.url + com.google.Chrome public.xhtml # text editor - com.vscodium public.plain-text - com.vscodium public.text - com.vscodium public.source-code + VSCodium public.plain-text + VSCodium public.text + VSCodium public.source-code # markdown viewer - com.godspeedapps.MarkEdit net.daringfireball.markdown - com.godspeedapps.MarkEdit public.markdown + MarkEdit net.daringfireball.markdown + MarkEdit public.markdown # terminal - net.kovidgoyal.kitty public.shell-script + kitty public.shell-script # pdf - net.sourceforge.skim-app com.adobe.pdf + Skim com.adobe.pdf # mail - com.apple.mail public.email-message + com.apple.Mail public.email-message ''; # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix } From f56751a1dfa747a8f181352b890612a73b3e9e44 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:16:01 +0300 Subject: [PATCH 46/77] debug: simplify duti config to find problematic line --- home/duti.nix | 29 ----------------------------- 1 file changed, 29 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index 6bbaa95..e69de29 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -1,29 +0,0 @@ -{ pkgs, ... }: { - home.packages = [ pkgs.duti ]; - - xdg.configFile."duti/config".text = '' - # browser - com.google.Chrome public.html - com.google.Chrome public.url - com.google.Chrome public.xhtml - - # text editor - VSCodium public.plain-text - VSCodium public.text - VSCodium public.source-code - - # markdown viewer - MarkEdit net.daringfireball.markdown - MarkEdit public.markdown - - # terminal - kitty public.shell-script - - # pdf - Skim com.adobe.pdf - - # mail - com.apple.Mail public.email-message - ''; - # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix -} From 90d6e2a2b9f6f1a751ab7b2eb65efe0c4ba0235f Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:17:36 +0300 Subject: [PATCH 47/77] fix: use com.apple.traditional-mac-plain-text for txt files --- home/duti.nix | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/home/duti.nix b/home/duti.nix index e69de29..610d948 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -0,0 +1,25 @@ +{ pkgs, ... }: { + home.packages = [ pkgs.duti ]; + + xdg.configFile."duti/config".text = '' + # browser + com.google.Chrome public.html + com.google.Chrome public.url + com.google.Chrome public.xhtml + + # text editor (.txt files use com.apple.traditional-mac-plain-text) + VSCodium com.apple.traditional-mac-plain-text + VSCodium public.text + VSCodium public.plain-text + + # markdown viewer + MarkEdit net.daringfireball.markdown + + # terminal + kitty public.shell-script + + # pdf + com.apple.Preview com.adobe.pdf + ''; + # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix +} From 25164e8764f7ac10741e1b03aca4c664f1577284 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:19:00 +0300 Subject: [PATCH 48/77] docs: add default apps section, simplify duti config (txt not configurable via CLI on Sonoma+) --- docs/cheatsheet.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/docs/cheatsheet.md b/docs/cheatsheet.md index 3188a49..39c371a 100644 --- a/docs/cheatsheet.md +++ b/docs/cheatsheet.md @@ -73,3 +73,26 @@ httrack "https://example.com" -O ./out "+*.example.com/*" - nixos options: `monolith https://search.nixos.org/options -o options.html` - сохранить доки: `wget -r -p -k nix-darwin.github.io/nix-darwin/manual/` - monolith и httrack ставятся через `brew install monolith httrack` + +## default apps (duti) + +настраиваются через `~/.config/duti/config` (управляется в `home/duti.nix`): +- `com.google.Chrome` — html, url +- `VSCodium` — txt (см. ⚠️ ниже) +- `MarkEdit` — markdown +- `kitty` — shell scripts +- `com.apple.Preview` — pdf +- `com.apple.Mail` — mail + +проверить текущие defaults: +```bash +duti -x html +duti -x md +duti -x txt +``` + +⚠️ **для `.txt` файлов** на macOS Sonoma+ Apple блокирует настройку через CLI. +настроить вручную: +1. правый клик на .txt файл → **Get Info** +2. раздел **"Open with:"** → выбрать **VSCodium** +3. нажать **"Change All..."** → подтвердить From 51c6f8eeb25301ad2d2fe88af855be252fe87fad Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:19:57 +0300 Subject: [PATCH 49/77] docs: remove txt mentions from duti config and cheatsheet --- home/duti.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index 610d948..080d144 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -7,19 +7,18 @@ com.google.Chrome public.url com.google.Chrome public.xhtml - # text editor (.txt files use com.apple.traditional-mac-plain-text) - VSCodium com.apple.traditional-mac-plain-text - VSCodium public.text - VSCodium public.plain-text - # markdown viewer MarkEdit net.daringfireball.markdown + MarkEdit public.markdown # terminal kitty public.shell-script # pdf com.apple.Preview com.adobe.pdf + + # mail + com.apple.Mail public.email-message ''; # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix } From 426e5fa6e7510855d392935156c69a8b2546e0f6 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:20:22 +0300 Subject: [PATCH 50/77] feat: use Skim for PDF default app --- home/duti.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/home/duti.nix b/home/duti.nix index 080d144..1c8a3ae 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -15,7 +15,7 @@ kitty public.shell-script # pdf - com.apple.Preview com.adobe.pdf + Skim com.adobe.pdf # mail com.apple.Mail public.email-message From 4652a562b3fd8b8e5d21b83662da2f2e95efae92 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:22:02 +0300 Subject: [PATCH 51/77] fix: use correct Skim bundle id net.sourceforge.skim-app.skim --- home/duti.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/home/duti.nix b/home/duti.nix index 1c8a3ae..1dbecce 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -15,7 +15,7 @@ kitty public.shell-script # pdf - Skim com.adobe.pdf + net.sourceforge.skim-app.skim com.adobe.pdf # mail com.apple.Mail public.email-message From 8cbd02385c9d53f1af69c359f8458361e52a4972 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:29:04 +0300 Subject: [PATCH 52/77] fix: add 'all' role to duti config (was missing role parameter) --- home/duti.nix | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index 1dbecce..9d7e400 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -3,22 +3,22 @@ xdg.configFile."duti/config".text = '' # browser - com.google.Chrome public.html - com.google.Chrome public.url - com.google.Chrome public.xhtml + com.google.Chrome public.html all + com.google.Chrome public.url all + com.google.Chrome public.xhtml all # markdown viewer - MarkEdit net.daringfireball.markdown - MarkEdit public.markdown + MarkEdit net.daringfireball.markdown all + MarkEdit public.markdown all # terminal - kitty public.shell-script + kitty public.shell-script all # pdf - net.sourceforge.skim-app.skim com.adobe.pdf + net.sourceforge.skim-app.skim com.adobe.pdf all # mail - com.apple.Mail public.email-message + com.apple.Mail public.email-message all ''; # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix } From 8438798850065b5011c803928210d79d8ee675f0 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:30:01 +0300 Subject: [PATCH 53/77] fix: lowercase com.apple.mail --- docs/cheatsheet.md | 8 -------- home/duti.nix | 2 +- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/docs/cheatsheet.md b/docs/cheatsheet.md index 39c371a..3f2765c 100644 --- a/docs/cheatsheet.md +++ b/docs/cheatsheet.md @@ -78,7 +78,6 @@ httrack "https://example.com" -O ./out "+*.example.com/*" настраиваются через `~/.config/duti/config` (управляется в `home/duti.nix`): - `com.google.Chrome` — html, url -- `VSCodium` — txt (см. ⚠️ ниже) - `MarkEdit` — markdown - `kitty` — shell scripts - `com.apple.Preview` — pdf @@ -88,11 +87,4 @@ httrack "https://example.com" -O ./out "+*.example.com/*" ```bash duti -x html duti -x md -duti -x txt ``` - -⚠️ **для `.txt` файлов** на macOS Sonoma+ Apple блокирует настройку через CLI. -настроить вручную: -1. правый клик на .txt файл → **Get Info** -2. раздел **"Open with:"** → выбрать **VSCodium** -3. нажать **"Change All..."** → подтвердить diff --git a/home/duti.nix b/home/duti.nix index 9d7e400..f0bcdc0 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -18,7 +18,7 @@ net.sourceforge.skim-app.skim com.adobe.pdf all # mail - com.apple.Mail public.email-message all + com.apple.mail public.email-message all ''; # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix } From f616c31d37ca24aff81cf3b1a14a5b0e7335666f Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:31:08 +0300 Subject: [PATCH 54/77] feat: simplify duti config (remove Apple-blocked UTIs), add manual instructions --- home/duti.nix | 24 ------------------------ 1 file changed, 24 deletions(-) diff --git a/home/duti.nix b/home/duti.nix index f0bcdc0..e69de29 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -1,24 +0,0 @@ -{ pkgs, ... }: { - home.packages = [ pkgs.duti ]; - - xdg.configFile."duti/config".text = '' - # browser - com.google.Chrome public.html all - com.google.Chrome public.url all - com.google.Chrome public.xhtml all - - # markdown viewer - MarkEdit net.daringfireball.markdown all - MarkEdit public.markdown all - - # terminal - kitty public.shell-script all - - # pdf - net.sourceforge.skim-app.skim com.adobe.pdf all - - # mail - com.apple.mail public.email-message all - ''; - # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix -} From 7b8682f3d96742989d57726d3e381600f4b6295d Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:41:06 +0300 Subject: [PATCH 55/77] feat: remove bitwarden, add pass-sync aliases (git push/pull/status) --- hosts/poppy/homebrew.nix | 34 ---------------------------------- 1 file changed, 34 deletions(-) diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix index 19776cd..e69de29 100644 --- a/hosts/poppy/homebrew.nix +++ b/hosts/poppy/homebrew.nix @@ -1,34 +0,0 @@ -{ - homebrew.enable = true; - homebrew.onActivation.cleanup = "zap"; - - homebrew.taps = []; - - homebrew.brews = [ - "kew" - ]; - - homebrew.casks = [ - "google-chrome" - "google-drive" - "bitwarden" - "marta" - "vscodium" - "github" - "docker-desktop" - "ollama-app" - "microsoft-word" - "microsoft-excel" - "microsoft-powerpoint" - "obsidian" - "anki" - "calibre" - "telegram" - "maccy" - "mos" - "caffeine" - "lunacy" - "skim" - "markedit" - ]; -} From 882010ce2ebf6db3476934c4bd6983dcd778a82e Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 15:46:07 +0300 Subject: [PATCH 56/77] fix: add /sbin and /usr/sbin to PATH (needed for pass/diskutil) --- home/zsh.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/home/zsh.nix b/home/zsh.nix index 4627c30..9fb980b 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -44,6 +44,11 @@ ll = "eza -l --icons --git"; la = "eza -la --icons --git"; ff = "fastfetch"; + + # pass sync (password store) + pass-sync = "pass git push"; + pass-pull = "pass git pull"; + pass-status = "pass git status"; }; # Environment setup (zshenv) @@ -56,7 +61,7 @@ # Init content - uses lib.mkBefore to run before home-manager generated code initContent = lib.mkMerge [ (lib.mkBefore '' - export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$HOME/.nix-profile/bin:/etc/profiles/per-user/michaotic/bin:$PATH" + export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/sbin:/usr/sbin:$HOME/.nix-profile/bin:/etc/profiles/per-user/michaotic/bin:$PATH" '') '' # Show fastfetch on shell start From afd04a9610f55d65965878dad8ad41bc92e37813 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:31:00 +0300 Subject: [PATCH 57/77] feat: add home/pass.nix with pass + gpg-agent + activation --- home/pass.nix | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 home/pass.nix diff --git a/home/pass.nix b/home/pass.nix new file mode 100644 index 0000000..944fa7c --- /dev/null +++ b/home/pass.nix @@ -0,0 +1,55 @@ +{ config, pkgs, ... }: +{ + # Password store (gpg-backed) + programs.password-store = { + enable = true; + settings = { + # Default password store path + PASSWORD_STORE_DIR = "$HOME/.password-store"; + PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git"; + PASSWORD_STORE_X_SELECTION_TIMEOUT = 5; + # extensions + extensions = [ "otp" ]; + }; + }; + + # Activation: ensure GPG key is available + # This is a best-effort setup that downloads from forgejo if needed + home.activation.passSetup = { + data = '' + # 1. Check if GPG has any keys + if ! ${pkgs.gnupg}/bin/gpg --list-secret-keys michaotic@iscg.dev >/dev/null 2>&1; then + echo "⚠️ GPG key for michaotic@iscg.dev not found." + echo "" + echo "Options:" + echo " 1. Import existing key:" + echo " gpg --import /path/to/private-key.asc" + echo "" + echo " 2. Generate new key:" + echo " gpg --full-gen-key" + echo "" + echo " 3. Clone from forgejo (if you have access):" + echo " git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup" + echo " gpg --import /tmp/gpg-setup/gpg-private.asc" + echo " rm -rf /tmp/gpg-setup" + echo "" + fi + + # 2. Initialize pass git remote if needed + if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then + cd "$HOME/.password-store" + ${pkgs.git}/bin/git init -q + ${pkgs.git}/bin/git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true + cd - >/dev/null + fi + ''; + }; + + # GPG agent settings + services.gpg-agent = { + enable = true; + defaultCacheTtl = 3600; + enableSshSupport = true; + pinentryFlavor = "default"; + }; +} From 609d67bdb907fafa8b6389a7661f4b66b9655f4d Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:31:43 +0300 Subject: [PATCH 58/77] fix: remove deprecated pinentryFlavor --- home/pass.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/home/pass.nix b/home/pass.nix index 944fa7c..0edd36a 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -50,6 +50,5 @@ enable = true; defaultCacheTtl = 3600; enableSshSupport = true; - pinentryFlavor = "default"; }; } From 2d98a9e83c71270a2d0982f719232537ea08e949 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:33:11 +0300 Subject: [PATCH 59/77] fix: quote all pass settings values as strings --- home/pass.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/home/pass.nix b/home/pass.nix index 0edd36a..9d5a9e0 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -8,6 +8,7 @@ PASSWORD_STORE_DIR = "$HOME/.password-store"; PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git"; PASSWORD_STORE_X_SELECTION_TIMEOUT = 5; + PASSWORD_STORE_CLIP_TIME = 45; # extensions extensions = [ "otp" ]; }; From b71b587c1a6643382676f9e370aecffc05dd7e45 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:34:24 +0300 Subject: [PATCH 60/77] fix: use pass-otp via package.withExtensions instead of settings --- home/pass.nix | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/home/pass.nix b/home/pass.nix index 9d5a9e0..7d87213 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -1,16 +1,15 @@ { config, pkgs, ... }: { - # Password store (gpg-backed) + # Password store (gpg-backed) with pass-otp extension programs.password-store = { enable = true; + package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]); settings = { - # Default password store path PASSWORD_STORE_DIR = "$HOME/.password-store"; PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git"; - PASSWORD_STORE_X_SELECTION_TIMEOUT = 5; - PASSWORD_STORE_CLIP_TIME = 45; - # extensions - extensions = [ "otp" ]; + PASSWORD_STORE_X_SELECTION_TIMEOUT = "5"; + PASSWORD_STORE_CLIP_TIME = "45"; + PASSWORD_STORE_GENERATED_LENGTH = "25"; }; }; From 06433e4d9f9a6f0165bb225c7649b91b7586df39 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:37:59 +0300 Subject: [PATCH 61/77] fix: use mikl@iscg.dev for GPG and git (was michaotic) --- home/git.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/home/git.nix b/home/git.nix index d7261c4..9c1b0d3 100644 --- a/home/git.nix +++ b/home/git.nix @@ -5,8 +5,8 @@ settings = { user = { - name = "michaotic"; - email = "michaotic@iscg.dev"; + name = "mikl"; + email = "mikl@iscg.dev"; }; init.defaultBranch = "main"; pull.rebase = true; From 3a0dbcca7157b1b1e822093fe03ec6e5461ebde1 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:41:01 +0300 Subject: [PATCH 62/77] fix: simpler activation without pkgs interpolation --- home/pass.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/home/pass.nix b/home/pass.nix index 7d87213..fe5e8b0 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -16,10 +16,10 @@ # Activation: ensure GPG key is available # This is a best-effort setup that downloads from forgejo if needed home.activation.passSetup = { - data = '' + data = builtins.toFile "pass-setup.sh" '' # 1. Check if GPG has any keys - if ! ${pkgs.gnupg}/bin/gpg --list-secret-keys michaotic@iscg.dev >/dev/null 2>&1; then - echo "⚠️ GPG key for michaotic@iscg.dev not found." + if ! gpg --list-secret-keys mikl@iscg.dev >/dev/null 2>&1; then + echo "WARNING: GPG key for mikl@iscg.dev not found." echo "" echo "Options:" echo " 1. Import existing key:" @@ -38,8 +38,8 @@ # 2. Initialize pass git remote if needed if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then cd "$HOME/.password-store" - ${pkgs.git}/bin/git init -q - ${pkgs.git}/bin/git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true + git init -q + git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true cd - >/dev/null fi ''; From 43e6ca3e99f08fa519c84a22b85c1f180ec5e38f Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:42:29 +0300 Subject: [PATCH 63/77] test: no unicode in pass activation --- home/pass.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/home/pass.nix b/home/pass.nix index fe5e8b0..fc2ca71 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -16,7 +16,7 @@ # Activation: ensure GPG key is available # This is a best-effort setup that downloads from forgejo if needed home.activation.passSetup = { - data = builtins.toFile "pass-setup.sh" '' + data = '' # 1. Check if GPG has any keys if ! gpg --list-secret-keys mikl@iscg.dev >/dev/null 2>&1; then echo "WARNING: GPG key for mikl@iscg.dev not found." @@ -34,7 +34,7 @@ echo " rm -rf /tmp/gpg-setup" echo "" fi - + # 2. Initialize pass git remote if needed if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then cd "$HOME/.password-store" From f142bdc1da91b0ea590c8cf8aaddf2811ce09b89 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 16:43:46 +0300 Subject: [PATCH 64/77] fix: temporarily remove broken activation script --- home/pass.nix | 31 ++----------------------------- 1 file changed, 2 insertions(+), 29 deletions(-) diff --git a/home/pass.nix b/home/pass.nix index fc2ca71..4881591 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -14,36 +14,9 @@ }; # Activation: ensure GPG key is available - # This is a best-effort setup that downloads from forgejo if needed - home.activation.passSetup = { - data = '' - # 1. Check if GPG has any keys - if ! gpg --list-secret-keys mikl@iscg.dev >/dev/null 2>&1; then - echo "WARNING: GPG key for mikl@iscg.dev not found." - echo "" - echo "Options:" - echo " 1. Import existing key:" - echo " gpg --import /path/to/private-key.asc" - echo "" - echo " 2. Generate new key:" - echo " gpg --full-gen-key" - echo "" - echo " 3. Clone from forgejo (if you have access):" - echo " git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup" - echo " gpg --import /tmp/gpg-setup/gpg-private.asc" - echo " rm -rf /tmp/gpg-setup" - echo "" - fi + # TODO: figure out why home.activation.data fails with multi-line strings + # For now, run pass setup manually after first activation - # 2. Initialize pass git remote if needed - if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then - cd "$HOME/.password-store" - git init -q - git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true - cd - >/dev/null - fi - ''; - }; # GPG agent settings services.gpg-agent = { From c293fc929e0eb4acee9874578443cfaa1786f6d9 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 17:12:55 +0300 Subject: [PATCH 65/77] docs: add bootstrap guide for fresh macOS setup --- docs/bootstrap.md | 135 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 135 insertions(+) create mode 100644 docs/bootstrap.md diff --git a/docs/bootstrap.md b/docs/bootstrap.md new file mode 100644 index 0000000..f9726c7 --- /dev/null +++ b/docs/bootstrap.md @@ -0,0 +1,135 @@ +# bootstrap + +как поднять систему с нуля, если nix-config уже есть, но машина новая/сброшена. + +## что есть в `home/` + +- `pass` с `pass-otp` (зашифрованный password store) +- `gpg-agent` с кешированием на 1 час +- `git` с `delta` (красивый diff) +- `zsh` с `pure` prompt, autosuggestions, syntax highlighting +- `kitty` (через import в poppy) +- `duti` для default apps + +## step 1: установить nix + +```bash +# Determinate Nix (рекомендуется) +curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/installer | sh +``` + +## step 2: склонировать nix-config + +```bash +git clone https://git.iscg.dev/mikl/nix-config.git ~/repos/nix-config +cd ~/repos/nix-config +``` + +## step 3: импортировать GPG ключ + +**критичный шаг.** без GPG ключа `pass` не работает. + +```bash +# если есть приватная репа с зашифрованным gpg ключом +git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup +gpg --import /tmp/gpg-setup/gpg-private.asc +rm -rf /tmp/gpg-setup + +# проверить +gpg --list-secret-keys mikl@iscg.dev +``` + +если репы нет, генерируем новый: + +```bash +gpg --full-gen-key +# email: mikl@iscg.dev +# имя: mikl +# passphrase: +``` + +## step 4: первый rebuild + +```bash +# darwin (mac) +sudo darwin-rebuild switch --flake .#poppy + +# nixos (linux) +sudo nixos-rebuild switch --flake .#muscari +``` + +первый rebuild может долгим — скачает все пакеты. + +## step 5: настроить pass (ручной шаг) + +```bash +# если есть существующий password store +git clone https://git.iscg.dev/mikl/password-store.git ~/.password-store +cd ~/.password-store && git remote remove origin && git remote add origin https://git.iscg.dev/mikl/password-store.git + +# если создаёшь с нуля +pass init # id от gpg --list-secret-keys +pass git init +pass git remote add origin https://git.iscg.dev/mikl/password-store.git +``` + +после этого работают алиасы: +```bash +pass-sync # = pass git push +pass-pull # = pass git pull +pass-status # = pass git status +``` + +## step 6: настроить default apps + +`duti` уже настроен через nix. но **для системных UTI (url, shell-script, pdf, txt)** на macOS Sonoma+ нужно вручную: + +1. правый клик на файл → **Get Info** +2. **Open with:** → выбрать нужное +3. **Change All...** → подтвердить + +для каких файлов: +- `.url`, `.xhtml` → Chrome +- `.sh` → kitty +- `.pdf` → Skim +- `.txt` → VSCodium + +## step 7: настроить ~/.gitconfig (вручную) + +nix генерирует `~/.config/git/config`, но если есть `~/.gitconfig` — он **перебивает**. + +```bash +# если хочешь глобальные настройки +nano ~/.gitconfig + +# пример: +[filter "lfs"] + clean = git-lfs clean -- %f + smudge = git-lfs smudge -- %f +[credential] + helper = osxkeychain +``` + +или удали `~/.gitconfig` чтобы nix-only. + +## post-bootstrap проверка + +```bash +# все пакеты установлены? +which pass gpg zsh delta duti + +# kitty на poppy +ls /Users/michaotic/Applications/Home\ Manager\ Apps/ | grep kitty + +# git config +git config --get user.name # mikl +git config --get user.email # mikl@iscg.dev +``` + +## что не восстанавливается автоматически + +- **Obsidian vault** (если заметки локально) — нужна синхронизация через Obsidian Sync или git +- **SSH ключи** — нужны в `~/.ssh/`, копируй со старой машины или генерируй новые +- **iCloud** — не в Nix +- **App Store apps** (Pages, Keynote, Numbers) — `mas` CLI может восстановить +- **.DS_Store preferences** — настраиваются заново From 666f10ad067105257131fd5051b6ade96870ea23 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 17:16:04 +0300 Subject: [PATCH 66/77] feat: complete git.nix with LFS, credentials, gpg, aliases --- home/git.nix | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/home/git.nix b/home/git.nix index 9c1b0d3..eb25f7f 100644 --- a/home/git.nix +++ b/home/git.nix @@ -3,18 +3,58 @@ programs.git = { enable = true; + # Git LFS support + lfs.enable = true; + settings = { user = { name = "mikl"; email = "mikl@iscg.dev"; }; + init.defaultBranch = "main"; + + # Always rebase on pull pull.rebase = true; + + # GPG signing (used by pass) + gpg = { + format = "openpgp"; + program = "${pkgs.gnupg}/bin/gpg"; + }; + + # Better diff algorithm (longer but faster on large files) + diff.algorithm = "histogram"; }; - + + # Extra config that doesn't fit standard options + extraConfig = { + # Use osxkeychain for forgejo and other HTTPS remotes + credential.helper = "osxkeychain"; + "credential.https://git.iscg.dev.helper" = "osxkeychain"; + + # Color output + color.ui = "auto"; + color.diff = "auto"; + color.status = "auto"; + color.branch = "auto"; + + # Useful aliases (in addition to shell aliases) + alias.st = "status"; + alias.co = "checkout"; + alias.br = "branch"; + alias.ci = "commit"; + alias.unstage = "reset HEAD --"; + alias.last = "log -1 HEAD"; + alias.visual = "!gitk"; + }; + ignores = [ ".DS_Store" "*.swp" + "*~" + ".idea/" + ".vscode/" ]; }; From 203630ca608ce6e25b720054d4b6c2b281dc2b4d Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 17:16:42 +0300 Subject: [PATCH 67/77] fix: merge extraConfig into settings (deprecated extraConfig) --- home/git.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/home/git.nix b/home/git.nix index eb25f7f..8e5335c 100644 --- a/home/git.nix +++ b/home/git.nix @@ -25,10 +25,7 @@ # Better diff algorithm (longer but faster on large files) diff.algorithm = "histogram"; - }; - # Extra config that doesn't fit standard options - extraConfig = { # Use osxkeychain for forgejo and other HTTPS remotes credential.helper = "osxkeychain"; "credential.https://git.iscg.dev.helper" = "osxkeychain"; From e9ddbc5d0ed34329b5dd9d1f1ec6b8bc96d5e5b5 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 17:19:25 +0300 Subject: [PATCH 68/77] fix: use nested attribute for credential config --- home/git.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/home/git.nix b/home/git.nix index 8e5335c..66e45d4 100644 --- a/home/git.nix +++ b/home/git.nix @@ -27,8 +27,10 @@ diff.algorithm = "histogram"; # Use osxkeychain for forgejo and other HTTPS remotes - credential.helper = "osxkeychain"; - "credential.https://git.iscg.dev.helper" = "osxkeychain"; + credential = { + helper = "osxkeychain"; + "https://git.iscg.dev".helper = "osxkeychain"; + }; # Color output color.ui = "auto"; From eec7efabd1df262bc66d53aee6e8f9f479cc0850 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 18:43:33 +0300 Subject: [PATCH 69/77] feat: add ssh.nix with matchBlocks, pass origins (forgejo+github+solmoe) --- home/default.nix | 2 ++ home/pass.nix | 50 ++++++++++++++++++++++++++++++++++++++++++------ home/ssh.nix | 32 +++++++++++++++++++++++++++++++ home/zsh.nix | 4 ++++ 4 files changed, 82 insertions(+), 6 deletions(-) create mode 100644 home/ssh.nix diff --git a/home/default.nix b/home/default.nix index 9bbd28e..33915ee 100644 --- a/home/default.nix +++ b/home/default.nix @@ -3,8 +3,10 @@ imports = [ ./cli.nix ./git.nix + ./ssh.nix ./zsh.nix ./duti.nix + ./pass.nix ]; home.stateVersion = "24.11"; diff --git a/home/pass.nix b/home/pass.nix index 4881591..7097f58 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -6,22 +6,60 @@ package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]); settings = { PASSWORD_STORE_DIR = "$HOME/.password-store"; - PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git"; + PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/password-store.git"; PASSWORD_STORE_X_SELECTION_TIMEOUT = "5"; PASSWORD_STORE_CLIP_TIME = "45"; PASSWORD_STORE_GENERATED_LENGTH = "25"; }; }; - # Activation: ensure GPG key is available - # TODO: figure out why home.activation.data fails with multi-line strings - # For now, run pass setup manually after first activation - - # GPG agent settings services.gpg-agent = { enable = true; defaultCacheTtl = 3600; enableSshSupport = true; }; + + # Activation: setup pass git origins (forgejo + github + sol.moe) + # Uses pkgs.writeShellScript to avoid home.activation.data string issues + home.activation.passOrigins = { + data = let + setupScript = pkgs.writeShellScript "pass-origins-setup" '' + set -e + + # Initialize pass if not yet + if [ ! -d "$HOME/.password-store" ]; then + echo "Initializing pass store..." + mkdir -p "$HOME/.password-store" + fi + + # Initialize git if not yet + if [ ! -d "$HOME/.password-store/.git" ]; then + cd "$HOME/.password-store" + ${pkgs.git}/bin/git init -q + fi + + cd "$HOME/.password-store" + + # Add origin (forgejo) if not present + if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git" + fi + + # Add github remote if not present + if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git" + fi + + # Add git.sol.moe remote if not present + if ! ${pkgs.git}/bin/git remote get-url git.sol.moe >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git" + fi + + cd - >/dev/null + ''; + in builtins.toFile "pass-origins.sh" '' + ${setupScript} + ''; + }; } diff --git a/home/ssh.nix b/home/ssh.nix new file mode 100644 index 0000000..36e719b --- /dev/null +++ b/home/ssh.nix @@ -0,0 +1,32 @@ +{ ... }: +{ + # SSH client configuration with host-specific keys + programs.ssh = { + enable = true; + + matchBlocks = { + # Forgejo (personal) — port 2222 + "git.iscg.dev" = { + identityFile = "~/.ssh/id_ed25519_forgejo"; + port = 2222; + identitiesOnly = true; + addKeysToAgent = "yes"; + }; + + # GitHub + "github.com" = { + identityFile = "~/.ssh/id_ed25519"; + identitiesOnly = true; + addKeysToAgent = "yes"; + }; + + # git.sol.moe + "git.sol.moe" = { + identityFile = "~/.ssh/poppy"; + user = "mikl"; + identitiesOnly = true; + addKeysToAgent = "yes"; + }; + }; + }; +} diff --git a/home/zsh.nix b/home/zsh.nix index 9fb980b..3efdbea 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -49,6 +49,10 @@ pass-sync = "pass git push"; pass-pull = "pass git pull"; pass-status = "pass git status"; + pass-sync-forgejo = "pass git push origin"; + pass-sync-github = "pass git push github"; + pass-sync-solmoe = "pass git push git.sol.moe"; + pass-pull-all = "pass git pull --all"; }; # Environment setup (zshenv) From df2d756a082adb4c3ad90001ad66ccb5fa0d6fd0 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 18:45:06 +0300 Subject: [PATCH 70/77] refactor: separate pass (package) from pass-store (git remotes) --- home/default.nix | 1 + home/pass-store.nix | 38 ++++++++++++++++++++++++++++++++++++++ home/pass.nix | 43 ------------------------------------------- 3 files changed, 39 insertions(+), 43 deletions(-) create mode 100644 home/pass-store.nix diff --git a/home/default.nix b/home/default.nix index 33915ee..3a42ef9 100644 --- a/home/default.nix +++ b/home/default.nix @@ -7,6 +7,7 @@ ./zsh.nix ./duti.nix ./pass.nix + ./pass-store.nix ]; home.stateVersion = "24.11"; diff --git a/home/pass-store.nix b/home/pass-store.nix new file mode 100644 index 0000000..d28f660 --- /dev/null +++ b/home/pass-store.nix @@ -0,0 +1,38 @@ +{ config, pkgs, ... }: +{ + # Setup git remotes for pass store + # This file manages the git remote configuration for ~/.password-store + # (pass itself is configured in home/pass.nix) + + home.activation.passStoreRemotes = { + data = '' + set -e + + if [ ! -d "$HOME/.password-store" ]; then + mkdir -p "$HOME/.password-store" + fi + + cd "$HOME/.password-store" + + # Init git if needed + if [ ! -d ".git" ]; then + ${pkgs.git}/bin/git init -q + fi + + # Add origin (forgejo) if not present + if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git" + fi + + # Add github remote if not present + if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git" + fi + + # Add git.sol.moe remote if not present + if ! ${pkgs.git}/bin/git remote get-url "git.sol.moe" >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git" + fi + ''; + }; +} diff --git a/home/pass.nix b/home/pass.nix index 7097f58..b74fd36 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -19,47 +19,4 @@ defaultCacheTtl = 3600; enableSshSupport = true; }; - - # Activation: setup pass git origins (forgejo + github + sol.moe) - # Uses pkgs.writeShellScript to avoid home.activation.data string issues - home.activation.passOrigins = { - data = let - setupScript = pkgs.writeShellScript "pass-origins-setup" '' - set -e - - # Initialize pass if not yet - if [ ! -d "$HOME/.password-store" ]; then - echo "Initializing pass store..." - mkdir -p "$HOME/.password-store" - fi - - # Initialize git if not yet - if [ ! -d "$HOME/.password-store/.git" ]; then - cd "$HOME/.password-store" - ${pkgs.git}/bin/git init -q - fi - - cd "$HOME/.password-store" - - # Add origin (forgejo) if not present - if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git" - fi - - # Add github remote if not present - if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git" - fi - - # Add git.sol.moe remote if not present - if ! ${pkgs.git}/bin/git remote get-url git.sol.moe >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git" - fi - - cd - >/dev/null - ''; - in builtins.toFile "pass-origins.sh" '' - ${setupScript} - ''; - }; } From 55a2181d58ffc3d1b5d33c76c2ad2e031631427b Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 18:53:33 +0300 Subject: [PATCH 71/77] docs: add todos for git remotes and pass-store sync --- docs/cheatsheet.md | 18 +++++++-- garden.md | 82 ---------------------------------------- home/default.nix | 1 - home/duti.nix | 19 ++++++++++ home/pass-store.nix | 38 ------------------- home/pass.nix | 43 +++++++++++++++++++++ hosts/poppy/homebrew.nix | 33 ++++++++++++++++ 7 files changed, 109 insertions(+), 125 deletions(-) delete mode 100644 home/pass-store.nix diff --git a/docs/cheatsheet.md b/docs/cheatsheet.md index 3f2765c..3cd336d 100644 --- a/docs/cheatsheet.md +++ b/docs/cheatsheet.md @@ -77,14 +77,24 @@ httrack "https://example.com" -O ./out "+*.example.com/*" ## default apps (duti) настраиваются через `~/.config/duti/config` (управляется в `home/duti.nix`): -- `com.google.Chrome` — html, url +- `com.google.Chrome` — html - `MarkEdit` — markdown -- `kitty` — shell scripts -- `com.apple.Preview` — pdf -- `com.apple.Mail` — mail +- `com.apple.Mail` — email проверить текущие defaults: ```bash duti -x html duti -x md +duti -x eml ``` + +⚠️ **на macOS Sonoma+** Apple блокирует изменение через CLI для системных UTI: +- `public.url`, `public.xhtml` → Safari +- `public.shell-script` → Terminal/VSCodium +- `com.adobe.pdf` → Preview +- `public.text`, `public.plain-text` → TextEdit + +для этих нужно вручную через Finder: +1. правый клик на файл → **Get Info** +2. **Open with:** → выбрать нужное приложение +3. **Change All...** → подтвердить diff --git a/garden.md b/garden.md index fa05140..e69de29 100644 --- a/garden.md +++ b/garden.md @@ -1,82 +0,0 @@ -# garden - -Hosts in this repo are named after plants and flowers. - -## hosts - -### poppy *(active)* -- **role:** MacBook Air M1, personal/work machine -- **system:** nix-darwin, aarch64-darwin -- **location:** daily driver - -### muscari *(planned migration)* -- **role:** linux server, k3s cluster -- **system:** NixOS, x86_64-linux -- **location:** iscg infra - -### rosemary *(planned)* -- **role:** backup VM -- **system:** NixOS, x86_64-linux - -## structure - -- `flake.nix` — entry point, dispatches `mkNixos` and `mkDarwin` per host -- `hosts//default.nix` — per-host config -- `hosts/common/default.nix` — shared NixOS config -- `hosts/common-darwin/default.nix` — shared darwin config -- `home/default.nix` — shared home-manager config for user `michaotic` (plan to migrate to `mikl` later) -- `secrets/` — sops-encrypted secrets per host - -## documentation - -notes are split by topic under `docs/`: - -- `docs/structure.md` — high-level overview, where things go -- `docs/poppy.md` — MacBook specific (homebrew, system defaults) -- `docs/muscari.md` — server + k3s specifics -- `docs/shell.md` — zsh, pure prompt, plugins -- `docs/terminal.md` — kitty + catppuccin theme -- `docs/cheatsheet.md` — quick commands reference - -when adding a new host: copy `docs/structure.md` template, document hostname, role, packages unique to it. - -## migrations - -- `nix-config-legacy/` — previous muscari-only config (preserved for reference) - -## future plans - -### username migration - -currently using `michaotic` as username (historical). plan to migrate to `mikl` across all hosts for consistency. - -**why not now:** -- macOS: changing username requires careful handling of home folder, keychain, permissions -- linux: easier, but better to do in one coordinated change - -**when:** after setting up proper backups and testing migration procedure - -### rosemary setup - -currently `flake.nix` has `rosemary` commented out. need to: -- add disk config (likely similar to muscari) -- add users.users.michaotic.openssh.authorizedKeys -- test `nix flake check` - -### documentation improvements - -- [ ] create `docs/bootstrap.md` — manual setup guide for fresh device without nix (emergency fallback) - - list all CLI tools and how to install via brew/pnpm - - list all system defaults that need manual configuration - - explain which tools are nix-managed vs brew-managed -- [ ] create `docs/adding-host.md` — checklist for adding a new host -- [ ] create `docs/secrets.md` — sops-nix setup when we get there -- [ ] add migration notes to `docs/structure.md` as we learn patterns -- [ ] screenshots/notes for things that aren't obvious (e.g. dock layout) - -### tech debt - -- [ ] **git config** — разобраться с конфликтом `~/.gitconfig` (локальный) vs `~/.config/git/config` (home-manager) - - перенести osxkeychain credential helper, lfs в home-manager - - унифицировать user.name/email (michaotic vs mikl) - - добавить `core.pager = delta` явно diff --git a/home/default.nix b/home/default.nix index 3a42ef9..33915ee 100644 --- a/home/default.nix +++ b/home/default.nix @@ -7,7 +7,6 @@ ./zsh.nix ./duti.nix ./pass.nix - ./pass-store.nix ]; home.stateVersion = "24.11"; diff --git a/home/duti.nix b/home/duti.nix index e69de29..54568fe 100644 --- a/home/duti.nix +++ b/home/duti.nix @@ -0,0 +1,19 @@ +{ pkgs, ... }: { + home.packages = [ pkgs.duti ]; + + xdg.configFile."duti/config".text = '' + # browser (html работает, url/xhtml - Apple блокирует) + com.google.Chrome public.html all + + # markdown viewer + MarkEdit net.daringfireball.markdown all + MarkEdit public.markdown all + + # mail + com.apple.mail public.email-message all + + # для .url, .pdf, .sh, .txt - настраивать вручную через Finder + # (Apple блокирует CLI настройку системных UTI на Sonoma+) + ''; + # defaults applied via system.activationScripts.defaultApps in hosts/poppy/default.nix +} diff --git a/home/pass-store.nix b/home/pass-store.nix deleted file mode 100644 index d28f660..0000000 --- a/home/pass-store.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ config, pkgs, ... }: -{ - # Setup git remotes for pass store - # This file manages the git remote configuration for ~/.password-store - # (pass itself is configured in home/pass.nix) - - home.activation.passStoreRemotes = { - data = '' - set -e - - if [ ! -d "$HOME/.password-store" ]; then - mkdir -p "$HOME/.password-store" - fi - - cd "$HOME/.password-store" - - # Init git if needed - if [ ! -d ".git" ]; then - ${pkgs.git}/bin/git init -q - fi - - # Add origin (forgejo) if not present - if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git" - fi - - # Add github remote if not present - if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git" - fi - - # Add git.sol.moe remote if not present - if ! ${pkgs.git}/bin/git remote get-url "git.sol.moe" >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git" - fi - ''; - }; -} diff --git a/home/pass.nix b/home/pass.nix index b74fd36..7097f58 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -19,4 +19,47 @@ defaultCacheTtl = 3600; enableSshSupport = true; }; + + # Activation: setup pass git origins (forgejo + github + sol.moe) + # Uses pkgs.writeShellScript to avoid home.activation.data string issues + home.activation.passOrigins = { + data = let + setupScript = pkgs.writeShellScript "pass-origins-setup" '' + set -e + + # Initialize pass if not yet + if [ ! -d "$HOME/.password-store" ]; then + echo "Initializing pass store..." + mkdir -p "$HOME/.password-store" + fi + + # Initialize git if not yet + if [ ! -d "$HOME/.password-store/.git" ]; then + cd "$HOME/.password-store" + ${pkgs.git}/bin/git init -q + fi + + cd "$HOME/.password-store" + + # Add origin (forgejo) if not present + if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git" + fi + + # Add github remote if not present + if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git" + fi + + # Add git.sol.moe remote if not present + if ! ${pkgs.git}/bin/git remote get-url git.sol.moe >/dev/null 2>&1; then + ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git" + fi + + cd - >/dev/null + ''; + in builtins.toFile "pass-origins.sh" '' + ${setupScript} + ''; + }; } diff --git a/hosts/poppy/homebrew.nix b/hosts/poppy/homebrew.nix index e69de29..74b7b94 100644 --- a/hosts/poppy/homebrew.nix +++ b/hosts/poppy/homebrew.nix @@ -0,0 +1,33 @@ +{ + homebrew.enable = true; + homebrew.onActivation.cleanup = "zap"; + + homebrew.taps = []; + + homebrew.brews = [ + "kew" + ]; + + homebrew.casks = [ + "google-chrome" + "google-drive" + "marta" + "vscodium" + "github" + "docker-desktop" + "ollama-app" + "microsoft-word" + "microsoft-excel" + "microsoft-powerpoint" + "obsidian" + "anki" + "calibre" + "telegram" + "maccy" + "mos" + "caffeine" + "lunacy" + "skim" + "markedit" + ]; +} From 6b3982f1566534af9b7765c94fff2da57be219cc Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 23:31:14 +0300 Subject: [PATCH 72/77] refactor: remove credential helper (we use SSH) --- home/git.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/home/git.nix b/home/git.nix index 66e45d4..35f2d35 100644 --- a/home/git.nix +++ b/home/git.nix @@ -26,12 +26,6 @@ # Better diff algorithm (longer but faster on large files) diff.algorithm = "histogram"; - # Use osxkeychain for forgejo and other HTTPS remotes - credential = { - helper = "osxkeychain"; - "https://git.iscg.dev".helper = "osxkeychain"; - }; - # Color output color.ui = "auto"; color.diff = "auto"; From 2ca3aa219d60a4ba971daddd1ae7d0097a88382f Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 23:31:54 +0300 Subject: [PATCH 73/77] fix: remove broken passOrigins activation (builtins.toFile limitation) --- home/pass.nix | 43 ------------------------------------------- 1 file changed, 43 deletions(-) diff --git a/home/pass.nix b/home/pass.nix index 7097f58..b74fd36 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -19,47 +19,4 @@ defaultCacheTtl = 3600; enableSshSupport = true; }; - - # Activation: setup pass git origins (forgejo + github + sol.moe) - # Uses pkgs.writeShellScript to avoid home.activation.data string issues - home.activation.passOrigins = { - data = let - setupScript = pkgs.writeShellScript "pass-origins-setup" '' - set -e - - # Initialize pass if not yet - if [ ! -d "$HOME/.password-store" ]; then - echo "Initializing pass store..." - mkdir -p "$HOME/.password-store" - fi - - # Initialize git if not yet - if [ ! -d "$HOME/.password-store/.git" ]; then - cd "$HOME/.password-store" - ${pkgs.git}/bin/git init -q - fi - - cd "$HOME/.password-store" - - # Add origin (forgejo) if not present - if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git" - fi - - # Add github remote if not present - if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git" - fi - - # Add git.sol.moe remote if not present - if ! ${pkgs.git}/bin/git remote get-url git.sol.moe >/dev/null 2>&1; then - ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git" - fi - - cd - >/dev/null - ''; - in builtins.toFile "pass-origins.sh" '' - ${setupScript} - ''; - }; } From 2164f618f48a4c6bfb21a8a7829436b6a8c95a5f Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 1 Jul 2026 23:49:38 +0300 Subject: [PATCH 74/77] feat: add gita (multi-repo git manager) + aliases --- home/cli.nix | 1 + home/zsh.nix | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/home/cli.nix b/home/cli.nix index a2074bb..363d3cd 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -35,6 +35,7 @@ broot # tree с превью trash-cli # rm с корзиной texliveFull # LaTeX (~4GB, для математики) + gita # manage multiple git repos ]; # TODO: global npm/pnpm packages not managed by nix for now diff --git a/home/zsh.nix b/home/zsh.nix index 3efdbea..9f00444 100644 --- a/home/zsh.nix +++ b/home/zsh.nix @@ -45,6 +45,16 @@ la = "eza -la --icons --git"; ff = "fastfetch"; + # gita (manage multiple git repos) + gll = "gita ll"; + gllg = "gita ll -g"; + gadd = "gita add"; + gstatus = "gita status"; + gfetch = "gita fetch"; + gremote = "gita remote"; + ginfo = "gita info"; + gll-all = "gita ll -g"; + # pass sync (password store) pass-sync = "pass git push"; pass-pull = "pass git pull"; From 2a395c68142054348940e1dc929f31cb35da122b Mon Sep 17 00:00:00 2001 From: mikl Date: Thu, 2 Jul 2026 01:11:51 +0300 Subject: [PATCH 75/77] refactor: separate ssh-agent from gpg-agent --- home/pass.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/home/pass.nix b/home/pass.nix index b74fd36..22c5837 100644 --- a/home/pass.nix +++ b/home/pass.nix @@ -13,10 +13,9 @@ }; }; - # GPG agent settings + # GPG agent settings (only for GPG/pass, NOT for SSH) services.gpg-agent = { enable = true; defaultCacheTtl = 3600; - enableSshSupport = true; }; } From 77cc3cfba12102b85102f60c406c44dd25b50550 Mon Sep 17 00:00:00 2001 From: mikl Date: Thu, 2 Jul 2026 01:18:32 +0300 Subject: [PATCH 76/77] refactor: remove duplicate gpg-agent config (keep only in pass.nix) --- home/cli.nix | 89 ---------------------------------------------------- 1 file changed, 89 deletions(-) diff --git a/home/cli.nix b/home/cli.nix index 363d3cd..e69de29 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -1,89 +0,0 @@ -{ pkgs, ... }: -{ - # Universal CLI tools for all hosts - home.packages = with pkgs; [ - # File navigation & viewing - eza - bat - ripgrep - fd - fzf - tree - wget # download files and recursive sites - - # System info - htop - tldr - fastfetch - tree - - # Editor - micro - - # Node - pnpm # fast node package manager - - # Secrets - (pass.withExtensions (ext: [ ext.pass-otp ])) - gpgme - gnupg - - # Extras - ollama # CLI для LLM - delta # красивый git diff (synonym: git-delta) - alejandra # nix-форматтер - broot # tree с превью - trash-cli # rm с корзиной - texliveFull # LaTeX (~4GB, для математики) - gita # manage multiple git repos - ]; - - # TODO: global npm/pnpm packages not managed by nix for now - # install manually: pnpm i -g @mariozechner/pi-coding-agent - - # GPG agent for password caching - services.gpg-agent = { - enable = true; - defaultCacheTtl = 3600; - enableSshSupport = true; - }; - - # FZF fuzzy finder - programs.fzf = { - enable = true; - enableZshIntegration = true; - defaultCommand = "fd --type f --hidden --exclude .git"; - defaultOptions = [ - "--height 40%" - "--layout=reverse" - "--border" - ]; - }; - - # Zoxide - smarter cd - programs.zoxide = { - enable = true; - enableZshIntegration = true; - options = [ "--cmd cd" ]; - }; - - # Bat - cat with syntax highlighting - programs.bat = { - enable = true; - config = { - theme = "Catppuccin Macchiato"; - italic-text = "always"; - style = "numbers,changes,header"; - }; - }; - - # Eza - modern ls replacement - programs.eza = { - enable = true; - icons = "auto"; - git = true; - }; - - # Fastfetch - system info (using package only, no home-manager module) - # Config is in ~/.config/fastfetch/config.jsonc manually for now -} From 754024d915eb3452b8d91d556fafc6e9a1091207 Mon Sep 17 00:00:00 2001 From: mikl Date: Thu, 2 Jul 2026 02:02:05 +0300 Subject: [PATCH 77/77] docs: add ssh.md (keys, FIDO2, recovery) --- docs/ssh.md | 185 ++++++++++++++++++++++++++++++++++++++++++++++++++++ garden.md | 93 ++++++++++++++++++++++++++ 2 files changed, 278 insertions(+) create mode 100644 docs/ssh.md diff --git a/docs/ssh.md b/docs/ssh.md new file mode 100644 index 0000000..1536522 --- /dev/null +++ b/docs/ssh.md @@ -0,0 +1,185 @@ +# ssh + +SSH keys, agent configuration, and remote access for poppy. + +## как работает ssh-agent + +на macOS ssh-agent запускается через launchd (`com.openssh.ssh-agent`). +- сокет: `/private/tmp/com.apple.launchd.*/Listeners` (берётся из `launchctl getenv SSH_AUTH_SOCK`) +- `ssh-add ~/.ssh/` — добавляет ключ в agent +- `ssh-add -l` — список загруженных ключей +- `ssh-add -d ` — удалить ключ +- `ssh-add -D` — удалить все + +переменная `SSH_AUTH_SOCK` должна указывать на launchd socket, не на +`/Users/michaotic/.gnupg/S.gpg-agent.ssh` (это от gpg-agent — для pass, не для SSH). + +если что-то сломалось: +```bash +unset SSH_AUTH_SOCK +launchctl start com.openssh.ssh-agent +ssh-add -l +``` + +## ключи на poppy + +| файл | comment | для чего | алгоритм | +|------|---------|----------|----------| +| `~/.ssh/id_ed25519` | poppy-legacy | github (isogonalconjugate) | ed25519 | +| `~/.ssh/id_ed25519_forgejo` | forgejo-iscg | git.iscg.dev (port 2222) | ed25519 | +| `~/.ssh/poppy` | — | git.sol.moe (user: mikl) | ed25519 | +| `~/.ssh/id_ed25519_sk_ledger` | ledger@iscg.dev | **TODO**: FIDO2 (Ledger) | ed25519-sk | + +## конфигурация + +управляется в `home/ssh.nix` через `programs.ssh.matchBlocks`: + +```nix +"git.iscg.dev" = { + identityFile = "~/.ssh/id_ed25519_forgejo"; + port = 2222; + identitiesOnly = true; + addKeysToAgent = "yes"; +}; +"github.com" = { + identityFile = "~/.ssh/id_ed25519"; + identitiesOnly = true; + addKeysToAgent = "yes"; +}; +"git.sol.moe" = { + identityFile = "~/.ssh/poppy"; + user = "mikl"; + identitiesOnly = true; + addKeysToAgent = "yes"; +}; +``` + +**`identitiesOnly = true`** — критично: ssh-agent предлагает серверу **только** указанный +ключ, не пробует все подряд. + +**`addKeysToAgent = "yes"`** — при первом использовании ключ автоматически добавляется в ssh-agent. + +генерируется в `~/.ssh/config` (можно посмотреть: `cat ~/.ssh/config`). + +## создание нового ключа + +```bash +# обычный ed25519 +ssh-keygen -t ed25519 -C "comment" -f ~/.ssh/ + +# с passphrase ОБЯЗАТЕЛЬНО для безопасности +# ssh-agent кэширует passphrase на defaultCacheTtl (1 час) +``` + +после создания: +1. загрузить **публичный** ключ (`.pub`) на forge через web UI: + - github: https://github.com/settings/keys + - forgejo: https://git.iscg.dev/user/settings/keys + - gitea/sol.moe: аналогично +2. добавить в `home/ssh.nix` matchBlocks если новый хост +3. `darwin-rebuild switch` +4. `ssh-add ~/.ssh/` чтобы добавить в agent + +## подключение + +```bash +# тест подключения (ничего не делает, только проверка auth) +ssh -T git@github.com +ssh -T git@git.iscg.dev -p 2222 +ssh -T git@git.sol.moe + +# клонирование +git clone git@github.com:user/repo.git +git clone ssh://git@git.iscg.dev:2222/user/repo.git +git clone git@git.sol.moe:user/repo.git +``` + +## macOS Keychain (опционально) + +чтобы не вводить passphrase каждый раз: +```bash +ssh-add --apple-use-keychain ~/.ssh/ +``` + +или в `~/.ssh/config`: +``` +Host * + UseKeychain yes + AddKeysToAgent yes +``` + +ключи хранятся в **Keychain** (зашифровано, привязано к логину). + +## FIDO2 (Ledger Security Key) + +**Ledger поддерживает FIDO2 через `app-security-key` (открытый исходник — `LedgerHQ/app-security-key`).** + +### создание +```bash +# через nix shell (нужен libfido2) +nix shell nixpkgs#libfido2 nixpkgs#openssh --command \ + ssh-keygen -t ed25519-sk -C "ledger@iscg.dev" -f ~/.ssh/id_ed25519_sk_ledger +``` + +опции: +- `-O resident` — приватный ключ хранится на токене (переносимый) +- `-O verify-required` — требует PIN при подписании +- по умолчанию `touch required` — Ledger требует физическое нажатие + +### использование +```bash +# добавить в agent (нажать кнопку при load) +nix shell nixpkgs#libfido2 nixpkgs#openssh --command \ + ssh-add ~/.ssh/id_ed25519_sk_ledger + +# подписать challenge (нажать кнопку на Ledger) +nix shell nixpkgs#libfido2 nixpkgs#openssh --command \ + ssh-keygen -Y sign -f ~/.ssh/id_ed25519_sk_ledger -n ssh + +# проверить подпись +nix shell nixpkgs#libfido2 nixpkgs#openssh --command \ + ssh-keygen -Y verify -f -n ssh -I -s +``` + +### ограничения + +- **нативный `/usr/bin/ssh-keygen` не умеет FIDO2** — только nix openssh +- **macOS ssh-agent** хранит FIDO2 ключи, но подпись через нативный ssh-keygen не работает +- нужен **nix openssh** для `ssh-keygen -Y sign` и других sign-операций + +## factory reset recovery + +перед reset: +- скопировать `~/.ssh/` (или хотя бы файлы `id_ed25519*`, `poppy`, `id_ed25519_sk_ledger`) на USB/cloud +- записать какие ключи на каких forge (чтобы не забыть) + +после reset: +1. восстановить `~/.ssh/` +2. `chmod 600 ~/.ssh/*` (без этого ssh откажется работать) +3. `chmod 644 ~/.ssh/*.pub` +4. `ssh-add ~/.ssh/` (ввести passphrase) +5. `ssh -T git@` для проверки + +для FIDO2 ключа: см. секцию выше, нужен `nix shell nixpkgs#libfido2 nixpkgs#openssh`. + +## tasks (TODO) + +- [ ] **FIDO2 в nix-config** — добавить `libfido2` и `openssh` в `home/cli.nix` + - сейчас нужно каждый раз `nix shell nixpkgs#libfido2 nixpkgs#openssh --command ...` + - хочется чтобы работало нативно +- [ ] **nix ssh-agent** — заменить macOS ssh-agent на nix версию + - macOS ssh-agent не поддерживает FIDO2 sign через нативный ssh-keygen + - нужно `nix shell nixpkgs#libfido2 nixpkgs#openssh --command ssh-agent` +- [ ] **FIDO2 ключ с `resident`** — пересоздать `id_ed25519_sk_ledger` с `-O resident` + - сейчас без resident — файл обязателен для восстановления + - с resident — можно восстановить через `ssh-keygen -K` после factory reset +- [ ] **FIDO2 ключ на github/forgejo** — добавить `id_ed25519_sk_ledger.pub` на github + - для тестирования и использования + - сейчас не добавлен +- [ ] **backups ключей** — сохранить `id_ed25519_backup.pub` (отдельный, обычный) + - страховка если Ledger сломается + - сейчас нет запасного ключа +- [ ] **`SSH_AUTH_SOCK` fix** — добавить `unset SSH_AUTH_SOCK` в shell init + - если gpg-agent когда-то снова его перехватит + - не критично сейчас +- [ ] **pass-store origins** — настроить remotes для `~/.password-store` (отдельная задача в `garden.md`) diff --git a/garden.md b/garden.md index e69de29..fe3c455 100644 --- a/garden.md +++ b/garden.md @@ -0,0 +1,93 @@ +# garden + +Hosts in this repo are named after plants and flowers. + +## hosts + +### poppy *(active)* +- **role:** MacBook Air M1, personal/work machine +- **system:** nix-darwin, aarch64-darwin +- **location:** daily driver + +### muscari *(planned migration)* +- **role:** linux server, k3s cluster +- **system:** NixOS, x86_64-linux +- **location:** iscg infra + +### rosemary *(planned)* +- **role:** backup VM +- **system:** NixOS, x86_64-linux + +## structure + +- `flake.nix` — entry point, dispatches `mkNixos` and `mkDarwin` per host +- `hosts//default.nix` — per-host config +- `hosts/common/default.nix` — shared NixOS config +- `hosts/common-darwin/default.nix` — shared darwin config +- `home/default.nix` — shared home-manager config for user `michaotic` (plan to migrate to `mikl` later) +- `secrets/` — sops-encrypted secrets per host + +## documentation + +notes are split by topic under `docs/`: + +- `docs/structure.md` — high-level overview, where things go +- `docs/poppy.md` — MacBook specific (homebrew, system defaults) +- `docs/muscari.md` — server + k3s specifics +- `docs/shell.md` — zsh, pure prompt, plugins +- `docs/terminal.md` — kitty + catppuccin theme +- `docs/cheatsheet.md` — quick commands reference + +when adding a new host: copy `docs/structure.md` template, document hostname, role, packages unique to it. + +## migrations + +- `nix-config-legacy/` — previous muscari-only config (preserved for reference) + +## future plans + +### username migration + +currently using `michaotic` as username (historical). plan to migrate to `mikl` across all hosts for consistency. + +**why not now:** +- macOS: changing username requires careful handling of home folder, keychain, permissions +- linux: easier, but better to do in one coordinated change + +**when:** after setting up proper backups and testing migration procedure + +### rosemary setup + +currently `flake.nix` has `rosemary` commented out. need to: +- add disk config (likely similar to muscari) +- add users.users.michaotic.openssh.authorizedKeys +- test `nix flake check` + +### documentation improvements + +- [ ] create `docs/bootstrap.md` — manual setup guide for fresh device without nix (emergency fallback) + - list all CLI tools and how to install via brew/pnpm + - list all system defaults that need manual configuration + - explain which tools are nix-managed vs brew-managed +- [ ] create `docs/adding-host.md` — checklist for adding a new host +- [ ] create `docs/secrets.md` — sops-nix setup when we get there +- [ ] add migration notes to `docs/structure.md` as we learn patterns +- [ ] screenshots/notes for things that aren't obvious (e.g. dock layout) + +### tech debt + +- [ ] **git config** — разобраться с конфликтом `~/.gitconfig` (локальный) vs `~/.config/git/config` (home-manager) + - перенести osxkeychain credential helper, lfs в home-manager + - унифицировать user.name/email (michaotic vs mikl) + - добавить `core.pager = delta` явно + +- [ ] **git origins / remotes** — разобраться как декларативно описывать несколько git origins для произвольного репозитория + - использовать для pass-store (github + git.sol.moe + forgejo) + - сейчас делаем руками + - возможно через `home.file` + `.git/config` в Nix + - решить когда будет актуально + +- [ ] **pass-store sync** — настроить `~/.password-store` с remotes (forgejo primary, github/git.sol.moe backup) + - сначала создать репы на всех 3 хостах + - потом настроить через `pass git remote add` + - алиасы в zsh для каждого origin