James' Dotfiles

Welcome to my dotfiles. This is a mess of NixOS and Home-Manager

NixOS

Installation

1. Install NixOS on your device.
2. Clone this repository:

   git clone https://github.com/your-username/nix-dots.git

3. Deploy the repository:
   • Local deployment:

     sudo nixos-rebuild switch --flake .#nixosConfiguration

   • Remote deployment:

     nixos-rebuild --target-host [email protected] --use-remote-sudo switch --flake .#klipperpi

Raspberry Pi

Some pain points when configuring the raspberry pi and building the image to flash it.

Agenix requires the public key of the host that you are deploying the secret to. Specifically a pubkey from /etc/ssh. This is configured on first boot. So how do you flash the pi and have the wifi configuration baked in as I have it setup in the configuration.nix. Before I can do that I have to do the following:

1. hard code the wifi password
2. build the image
3. flash the sd card
4. deploy the pi
5. ssh into the pi and get the pubkey
6. build the secret with agenix
7. update the configuration to consume the secret

This is all a pain in the ass and exposes the wifi secret in your local /nix/store.(nix-collect-garbage -d is your friend after this).

---

Possible Option: Thanks Blades

Flash the sd for the pi as an access point. Fetch the pubkey and then proceed with agenix to set up and configure the wifi network. Router AP Example

Agenix Workflow

so my brain remembers

1. Get the pubkey for the device that will consume the secret from /etc/ssh
2. Add that pubkey to secrets.nix
   1. I think you can use a different secret for things that are specific to the user. But I haven't had a need yet.
3. Create the secret
   1. cd secrets/ or make the directory and cd there
   2. nix run github:ryantm/agenix -- -e klipperpi.age < This should point at the secretName.age you just added
   3. A text editor will pop up and you add your secret in whatever format you need (k:v, rsa, env, string)
   4. Save the file and it will populate as secrets/secretName.age
4. Consume the secret
   1. Wherever you need to consume the secret add a file reference to it
      1. age.secrets.klipperpi.file = ../../secrets/klipperpi.age;
   2. Then add a path reference to whatever consumes it.

      1. wireless.environmentFile = config.age.secrets.klipperpi.path;
         

wireless.environmentFile reference

Nifty Features

Firfox Securish:

In here I've set some basic sane settings for configuring firefox based on ffprofiles.com. You can create multiple profiles and override the defaultSettings with the // construct.

{
  programs.firefox.profiles.NAME.settings = defaultSettings // {
    "app.update.auto" = false;
    "browser.startup.homepage" = "https://lobste.rs";
  };
}

gsconnect:

This is actually configured in a few places:

• Package install
• Firewall Rules This won't work without some TCP and UDP ports open

  {
    networking.firewall = {
      allowedTCPPortRanges = [
        # KDE Connect
        { from = 1714; to = 1764; }
      ];
      allowedUDPPortRanges = [
        # KDE Connect
        { from = 1714; to = 1764; }
      ];
    };
  }

  Then you install KDE Connect on your phone. And follow the instructions to set it up.

Inspiration / Credit Links:

Blades dots

Aldoborrero's blog

• related git repo