mirror of
https://github.com/Misterio77/Foundry.git
synced 2026-08-24 02:14:13 -05:00
Gabriel Fontes
74fbb4c331
Move the Pi web-search credentials to a host-wide SOPS file and declare them for both NixOS and System Manager users. Leave mgc's age recipient disabled until Ubuntu is reinstalled. Assisted-by: pi (gpt-5.6-sol)
83 lines
2.3 KiB
Nix
83 lines
2.3 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
...
|
|
}: let
|
|
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
|
|
lightStartHour = 7;
|
|
darkStartHour = 18;
|
|
homeActivation = config.home-manager.users.gabriel.home.activationPackage;
|
|
activateHomeForTime = pkgs.writeShellScript "activate-home-gabriel-for-time" ''
|
|
set -euo pipefail
|
|
|
|
profiles="$HOME/.local/state/nix/profiles"
|
|
base=${homeActivation}
|
|
|
|
hour="$(${lib.getExe' pkgs.coreutils "date"} +%H)"
|
|
if [ "$hour" -ge ${toString lightStartHour} ] && [ "$hour" -lt ${toString darkStartHour} ]; then
|
|
specialisation="$base/specialisation/light"
|
|
else
|
|
specialisation="$base/specialisation/dark"
|
|
fi
|
|
|
|
eval "$(XDG_RUNTIME_DIR=''${XDG_RUNTIME_DIR:-/run/user/$UID} ${pkgs.systemd}/bin/systemctl --user show-environment 2>/dev/null | ${lib.getExe pkgs.gnused} -En '/^(DBUS_SESSION_BUS_ADDRESS|DISPLAY|WAYLAND_DISPLAY|XAUTHORITY|XDG_RUNTIME_DIR)=/s/^/export /p')"
|
|
|
|
# Activate specialisation
|
|
"$specialisation/activate" --driver-version 1
|
|
# Link base config (so that user can switch between them)
|
|
ln -sfT "$base" "$profiles/home-manager-base"
|
|
'';
|
|
in {
|
|
users.mutableUsers = false;
|
|
users.users.gabriel = {
|
|
isNormalUser = true;
|
|
shell = pkgs.fish;
|
|
extraGroups = ifTheyExist [
|
|
"audio"
|
|
"deluge"
|
|
"docker"
|
|
"git"
|
|
"i2c"
|
|
"libvirtd"
|
|
"minecraft"
|
|
"mysql"
|
|
"wpa_supplicant"
|
|
"plugdev"
|
|
"podman"
|
|
"tss"
|
|
"video"
|
|
"wheel"
|
|
"wireshark"
|
|
];
|
|
|
|
openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile ../../../../../home/gabriel/ssh.pub);
|
|
hashedPasswordFile = config.sops.secrets.gabriel-password.path;
|
|
packages = [pkgs.home-manager];
|
|
};
|
|
|
|
sops.secrets = {
|
|
gabriel-password = {
|
|
sopsFile = ../../secrets.yaml;
|
|
neededForUsers = true;
|
|
};
|
|
brave_api_key = {
|
|
sopsFile = ../../../../secrets.yaml;
|
|
owner = "gabriel";
|
|
};
|
|
kagi_session_token = {
|
|
sopsFile = ../../../../secrets.yaml;
|
|
owner = "gabriel";
|
|
};
|
|
};
|
|
|
|
home-manager.users.gabriel = import ../../../../../home/gabriel/${config.networking.hostName}.nix;
|
|
|
|
systemd.services.home-manager-gabriel.serviceConfig.ExecStart = lib.mkForce activateHomeForTime;
|
|
|
|
security.pam.services = {
|
|
swaylock = {};
|
|
hyprlock = {};
|
|
};
|
|
}
|