refector

modules/home/devtool/ciscopackettracer.nix

@@ -0,0 +1,19 @@
+{ pkgs, inputs, ... }:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+  pkgsPacketTracer8 = import inputs.nixpkgs-2511 {
+    inherit system;
+    config = {
+      allowUnfree = true;
+      permittedInsecurePackages = [
+        "ciscoPacketTracer8-8.2.2"
+      ];
+    };
+  };
+in
+{
+  home.packages = [
+    pkgs.cisco-packet-tracer_9
+    pkgsPacketTracer8.ciscoPacketTracer8
+  ];
+}

modules/home/devtool/ghostty.nix

@@ -0,0 +1,49 @@
+{pkgs, ...}: {
+  programs.ghostty = {
+    enable = true;
+    package = if pkgs.stdenv.isDarwin then pkgs.ghostty-bin else pkgs.ghostty;
+
+    enableFishIntegration = true;
+    settings = {
+      background = "#fcf8f9";
+      foreground = "#191017";
+      
+      cursor-color = "#301d23";
+      selection-background = "#f4ecee";
+      selection-foreground = "#191017";
+
+      palette = [
+        "0=#5c5f77"
+        "1=#d20f39"
+        "2=#40a02b"
+        "3=#df8e1d"
+        "4=#1e66f5"
+        "5=#ea76cb"
+        "6=#179299"
+        "7=#acb0be"
+        "8=#6c6f85"
+        "9=#d20f39"
+        "10=#40a02b"
+        "11=#df8e1d"
+        "12=#1e66f5"
+        "13=#ea76cb"
+        "14=#179299"
+        "15=#bcc0cc"
+      ];
+
+      window-colorspace = "srgb";
+      window-theme = "ghostty";
+      window-subtitle = "working-directory";
+
+      font-family = "JetBrainsMono NFM Regular";
+      font-family-bold = "JetBrainsMono NFM Bold";
+      font-family-italic = "JetBrainsMono NFM Bold Italic";
+      font-family-bold-italic = "JetBrainsMono NFM Italic";
+
+      window-width = 100;
+      window-height = 30;
+
+      auto-update = "off";
+    };
+  };
+}

modules/home/devtool/git.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+{
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "imnyang";
+        email = "imnyang@pm.me";
+        signingkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD";
+      };
+      gpg = {
+        format = "ssh";
+        "ssh".program = "${pkgs._1password-gui}/bin/op-ssh-sign";
+      };
+      commit.gpgsign = true;
+      init.defaultBranch = "main";
+      pull.rebase = false;
+      includeIf."gitdir:~/workspaces/git/adofai.gg/" = {
+        path = builtins.toFile "gitconfig-adofaigg" ''
+          [user]
+            email = imnyang@adofai.gg
+        '';
+      };
+    };
+  };
+}

modules/home/devtool/neovim.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
+  programs.neovim = {
+    enable = true;
+    withRuby = true;
+    withPython3 = true;
+    viAlias = true;
+    vimAlias = true;
+  };
+
+  home.activation.nvimConfigRepo = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    target="${config.xdg.configHome}/nvim"
+
+    rm -rf "$target"
+
+    ${pkgs.git}/bin/git clone https://git.pari.ng/imnyang/nvim-config.git "$target"
+  '';
+}

modules/home/devtool/vscode.nix

@@ -0,0 +1,51 @@
+{ pkgs, ... }:
+let
+  styleScript = pkgs.writeText "inject.js" ''
+    ;(() => {
+      const el = document.createElement('style')
+      el.innerText = `
+      .part.editor>.content .editor-group-container .editor-group-watermark .letterpress {
+        background-image: url("https://file.mizuki.guru/.tesiotjosaeifjpoeawsjfnpoiawsejfopieawjfopjakweopfjawieof/IN_VISUAL_STUDIO_CODE.webp") !important;
+        opacity: 1.0;
+        overflow: visible;
+        filter: none;
+        aspect-ratio: 16 / 9 !important;
+        max-height: fit-content !important;
+      }
+      `
+      document.head.appendChild(el)
+    })();
+  '';
+in
+{
+  programs.vscode = {
+    enable = true;
+    mutableExtensionsDir = true;
+    userSettings = {
+      "extensions.autoUpdate" = true;
+    };
+    package = (pkgs.vscode.override { isInsiders = true; }).overrideAttrs (oldAttrs: {
+      version = "latest";
+
+      src = builtins.fetchTarball {
+        url = "https://code.visualstudio.com/sha/download?build=insider&os=linux-x64";
+        sha256 = "1vzf897inlzxfwmnaykkj3gqg18wbh9zhv7lnh3if6agixv0v91b";
+      };
+
+      buildInputs = oldAttrs.buildInputs ++ [
+        pkgs.krb5
+        pkgs.libsoup_3
+        pkgs.webkitgtk_4_1
+        pkgs.libxtst
+        pkgs.libjpeg8
+        pkgs.pipewire
+        pkgs.libei
+      ];
+
+      postFixup = ''
+        cat ${styleScript} >> $out/lib/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.js
+      ''
+      + (oldAttrs.postFixup or "");
+    });
+  };
+}

modules/home/devtool/zed.nix

@@ -0,0 +1,75 @@
+{ pkgs, ... }:
+
+{
+  programs.zed-editor = {
+    enable = true;
+    package = if pkgs.stdenv.isDarwin then null else pkgs.zed-editor;
+    extensions = [
+      "nix"
+      "toml"
+      "rust"
+      "git-firefly"
+    ];
+    userSettings = {
+      "autosave" = "on_focus_change";
+      "ui_font_size" = 16;
+      "buffer_font_size" = 15;
+
+      "theme" = {
+        "mode" = "light";
+        "light" = "One Light";
+        "dark" = "One Dark";
+      };
+
+      "theme_overrides" = {
+        "One Light" = {
+          "background" = "#FDF7F9";
+          "status_bar.background" = "#FDF7F9";
+          "title_bar.background" = "#FDF7F9";
+          "elevated_surface.background" = "#FDF7F9";
+
+          # 핵심: sidebar/project panel 쪽은 투명 제거
+          "surface.background" = "#FDF7F9";
+          "panel.background" = "#FDF7F9";
+          "editor.gutter.background" = "#FDF7F9";
+          "tab_bar.background" = "#FDF7F9";
+          "toolbar.background" = "#FDF7F9";
+          "terminal.background" = "#FDF7F9";
+
+          # editor만 투명 유지하고 싶으면 이건 남겨도 됨
+          "editor.background" = "#00000000";
+
+          "editor.line_number" = "#A38F96";
+          "border" = "#F2E6EA";
+          "hint.background" = "#F7EBEE";
+          "editor.active_line_number" = "#191013";
+
+          "tab.active_background" = "#8165701a";
+          "element.selected" = "#8165701a";
+          "tab.inactive_background" = "#FDF7F9";
+
+          "editor.indent_guide" = "#F2E6EA";
+          "editor.indent_guide_active" = "#E6D5DB";
+          "panel.indent_guide" = "#F2E6EA";
+          "panel.indent_guide_hover" = "#E6D5DB";
+          "panel.indent_guide_active" = "#D9C4CC";
+
+          "panel.focused_border" = "#00000000";
+          "element.active" = "#81657029";
+          "border.variant" = "#00000000";
+          "scrollbar.track.border" = "#00000000";
+          "editor.active_line.background" = "#8165700f";
+          "scrollbar.track.background" = "#00000000";
+          "scrollbar.thumb.background" = "#A38F9680";
+          "ghost_element.background" = "#00000000";
+          "element.hover" = "#8165700f";
+          "ghost_element.hover" = "#8165700f";
+          "ghost_element.active" = "#8165701a";
+          "ghost_element.selected" = "#81657024";
+          "drop_target.background" = "#8165701a";
+          "editor.highlighted_line.background" = "#8165701a";
+        };
+      };
+    };
+  };
+}

modules/home/firefox.nix

@@ -1,29 +0,0 @@
-{ pkgs, config, ... }:
-{
-  programs.firefox = {
-    enable = true;
-    configPath = ".mozilla/firefox";
-    package = pkgs.firefox-devedition;
-    policies = {
-      Preferences = {
-        "widget.use-xdg-desktop-portal.file-picker" = {
-          Value = 1;
-          Status = "default";
-        };
-        "middlemouse.paste" = {
-          Value = false;
-          Status = "default";
-        };
-      };
-      ExtensionSettings = {
-        "figma-windows-ua-spoofer@imnyang.local" = {
-          installation_mode = "force_installed";
-          install_url = "https://git.mizuki.guru/imnyang/thisiswindowsfigma/releases/download/v1.0.0/d168a70cb6a24fe4a478-1.0.0.xpi";
-        };
-      };
-    };
-  };
-
-  home.file.".waterfox/native-messaging-hosts".source =
-    config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/.mozilla/native-messaging-hosts";
-}

modules/nixos/features/management/cockpit.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  virtualisation.libvirtd = {
+    enable = true;
+    dbus.enable = true;
+  };
+  users.groups.libvirtd.members = [ "imnyang" ];
+
+  services.cockpit = {
+    enable = true;
+    plugins = with pkgs; [
+      cockpit-machines
+      cockpit-files
+      cockpit-podman
+    ];
+    openFirewall = true;
+    allowed-origins = [ "*" ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    libvirt-dbus
+    virt-manager
+    virt-viewer
+  ];
+}

modules/nixos/features/management/docker.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  virtualisation.docker.enable = true;
+}

modules/nixos/features/management/podman.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  virtualisation = {
+    containers.enable = true;
+    podman = {
+      enable = true;
+      dockerCompat = true;
+      defaultNetwork.settings.dns_enabled = true; # Required for containers under podman-compose to be able to talk to each other.
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    podman-compose
+    podman
+    podman-tui
+  ];
+
+  users.users.imnyang = {
+    extraGroups = [
+      "podman"
+    ];
+  };
+}

modules/nixos/features/remote/ssh.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+    };
+  };
+}

modules/nixos/features/remote/sunshine.nix

@@ -0,0 +1,16 @@
+{
+  ...
+}:
+
+{
+  services.sunshine = {
+    enable = true;
+    autoStart = true;
+    capSysAdmin = true; # only needed for Wayland -- omit this when using with Xorg
+    openFirewall = true;
+  };
+  users.users.imnyang = {
+    extraGroups = [ "uinput" ];
+  };
+  hardware.uinput.enable = true;
+}

modules/nixos/features/system/bluetooth.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General = {
+        Experimental = true;
+        FastConnectable = true;
+      };
+      Policy = {
+        AutoEnable = true;
+      };
+    };
+  };
+}

modules/nixos/features/system/boot.nix

@@ -0,0 +1,32 @@
+{ pkgs, ... }:
+{
+  # boot.plymouth.enable = true;
+  boot.loader = {
+    grub = {
+      enable = true;
+      efiSupport = true;
+      useOSProber = true;
+      efiInstallAsRemovable = true;
+      device = "nodev";
+      enableCryptodisk = true;
+
+      # extraInstallCommands = ''
+      #   mkdir -p /boot/EFI/BOOT
+
+      #   cp -f /boot/EFI/NixOS-boot/grubx64.efi /boot/EFI/BOOT/BOOTX64.EFI
+      # '';
+
+      default = "saved";
+      extraConfig = ''
+        GRUB_SAVEDEFAULT=true
+      '';
+    };
+    # efi.canTouchEfiVariables = true;
+    efi.efiSysMountPoint = "/boot";
+  };
+
+  boot.initrd.systemd.enable = true;
+  boot.initrd.systemd.emergencyAccess = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+}

modules/nixos/features/system/graphics.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+}

modules/nixos/features/system/grub-standalone.nix

@@ -0,0 +1,74 @@
+{ pkgs, config, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    grub2_efi
+  ];
+ 
+  system.activationScripts = {
+    # This, has to be the LAST GRUB script to run.
+    # The reason is that a standalone GRUB image takes with it
+    # the configuration too, apparently.
+    # "90-generate-standalone-grub" = {
+    #   text = ''
+    #     if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+    #       echo "Generating standalone GRUB EFI entry..."
+ 
+    #       ESP="${config.boot.loader.efi.efiSysMountPoint}"
+    #       OUT_DIR="$ESP/EFI/NixOS-boot"
+    #       FALLBACK_DIR="$ESP/EFI/BOOT"
+    #       mkdir -p "$OUT_DIR" "$FALLBACK_DIR"
+ 
+    #       OUT="$OUT_DIR/grubx64.efi"
+    #       FALLBACK="$FALLBACK_DIR/BOOTX64.EFI"
+ 
+    #       # GPT-5 told me to add all those modules, idk.
+    #       ${pkgs.grub2_efi}/bin/grub-mkstandalone -O x86_64-efi -o "$OUT" \
+    #         "boot/grub/grub.cfg=${pkgs.writeText "grub-standalone-template.cfg" ''
+    #           search --file --no-floppy --set=esp /EFI/NixOS-boot/grubx64.efi
+    #           set prefix=($esp)/grub
+    #           if [ -f ($esp)/grub/grubenv ]; then
+    #             load_env ($esp)/grub/grubenv
+    #           fi
+    #           if [ -f ($esp)/grub/grub.cfg ]; then
+    #             configfile ($esp)/grub/grub.cfg
+    #           else
+    #             echo "Error: ($esp)/grub/grub.cfg not found."
+    #             sleep 5
+    #           fi
+    #           ''}" \
+    #         --modules="part_gpt part_msdos fat normal search search_fs_uuid search_label configfile linux gzio efi_gop efi_uga all_video gfxterm gfxmenu png jpeg tga font" \
+    #         --disable-shim-lock
+ 
+    #       # It's so stupid but otherwise it won't boot:
+    #       # https://wejn.org/2021/09/fixing-grub-verification-requested-nobody-cares/
+    #       ${pkgs.gnused}/bin/sed -i 's/SecureBoot/SecureB00t/' "$OUT"
+ 
+    #       cp -f "$OUT" "$FALLBACK"
+    #     fi
+    #   '';
+    # };
+    "99-sign-all" = {
+      text = ''
+        if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+          echo "Signing all EFI binaries with sbctl..."
+          
+          # 1. 파일이 존재하는지 먼저 확인하고, 
+          # 2. 이미 등록되어 있다면 sign-all로 한 번에 처리하거나,
+          # 3. 개별 파일에 대해 에러가 나도 스크립트가 중단되지 않도록 || true를 붙입니다.
+
+          # 주요 바이너리들을 DB에 등록 (이미 등록되어 있으면 sbctl이 알아서 스킵하거나 에러를 낼 텐데, 그걸 무시합니다)
+          ${pkgs.sbctl}/bin/sbctl sign -s /boot/EFI/NixOS-boot/grubx64.efi || true
+          ${pkgs.sbctl}/bin/sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI || true
+          
+          # Windows 부트로더 등 다른 파일들도 필요한 경우 추가
+          if [ -f /boot/EFI/Microsoft/Boot/bootmgfw.efi ]; then
+            ${pkgs.sbctl}/bin/sbctl sign -s /boot/EFI/Microsoft/Boot/bootmgfw.efi || true
+          fi
+
+          # 4. 마지막으로 전체 서명 수행
+          ${pkgs.sbctl}/bin/sbctl sign-all || echo "Some files failed to sign, but continuing..."
+        fi
+      '';
+    };
+  };
+}

modules/nixos/features/system/sbctl.nix

@@ -0,0 +1,37 @@
+{ pkgs, config, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    sbctl
+  ];
+ 
+  # The 99 here ensures that this runs AFTER the grub activation scripts.
+  system.activationScripts."99-sign-all" = {
+    text = ''
+      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+        # `sbctl verify --json` returns "null" if there is an error,
+        # empty string if there are no files in the database.
+        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
+ 
+          echo "Signing all EFI binaries with sbctl..."
+ 
+          ESP="${config.boot.loader.efi.efiSysMountPoint}"
+          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
+ 
+          # Removing all the files first.
+          for file in "${"$"}{files[@]}"; do
+            echo "Removing from sbctl: $file"
+            # The `|| true` part is because otherwise some files might not exist and
+            # the script would return an error.
+            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
+          done
+ 
+          for file in "${"$"}{files[@]}"; do
+            echo "Signing with sbctl: $file"
+            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
+          done
+ 
+        fi
+      fi
+    '';
+  };
+}

modules/nixos/features/system/sound.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  # 사운드
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+}

modules/nixos/features/system/virtualisation.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+  };
+
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu = {
+      package = pkgs.qemu_kvm;
+      runAsRoot = true;
+      swtpm.enable = true;
+    };
+  };
+
+  # Override the virt-secret-init-encryption service to use correct shell path
+  systemd.services.virt-secret-init-encryption = {
+    serviceConfig.ExecStart = [
+      ""
+      "${pkgs.bash}/bin/bash -c 'umask 0077 && (${pkgs.coreutils}/bin/dd if=/dev/urandom status=none bs=32 count=1 | ${pkgs.systemd}/bin/systemd-creds encrypt --name=secrets-encryption-key - /var/lib/libvirt/secrets/secrets-encryption-key)'"
+    ];
+  };
+}