me like nix
1{ inputs, ... }:
2
3let
4 sshAuthorizedKeys = [
5 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCIqgZ7kedxo+mOW7YG73Vp3zel3h180y3GKvHtRsXfGlpIIvRDy7pgCBQ4AGXYD4y78URQmFohYSAPqCPOPaWcU2un3XG9KvCzEsHmsbskPonitUmCiKvrKkb6oW4jCBtd7AEtBn+AiajAQFtPZ7NN2Df3AmTypvR6Irg7R+nxnfc9NTIHmGvxSDyWcbb4pguL20sctUSqGL6xGh8q/bqhdOThSimM+z9bEUNxK/5rPhwkNniMrp4pJcUrUiAh5/4DiRFG6KT+oeg+/myoz/Z1sPvAs7u/8JDQI4RshRD8Hu0oTkRBN6Hxj478q2SXbeBUZlD6IdjP3RhGpmSecoDdtWqKbpuV3eVRtQtba3KL86GBeV/bugaOdJ1Aud+1SOFJreAAuvxzMMKT+cdQZk6oOPP148DA/No+mDm/2S43lcdCXh79wA6YRAmKQ8jmZxTCtPutrvuZK1rguvvUlEoG/vhdNHh7eDa4Td07V6bjCRPUl8qk/e4M0E3pwsTlZc="
6 "no-touch-required sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILdilHXHdAP/V8Zq28EzHKtLAMMaFPu4+1det2N50QfhAAAABHNzaDo= sean@framework16"
7 ];
8in
9{
10 flake.modules.nixos.sean =
11 { pkgs, ... }:
12 {
13 users.groups.storage = { };
14 users.groups.plugdev = { };
15 users.users.sean = {
16 isNormalUser = true;
17 description = "Sean Aye";
18 extraGroups = [
19 "docker"
20 "networkmanager"
21 "wheel"
22 "video"
23 "disk"
24 "storage"
25 "input"
26 "plugdev"
27 "dialout"
28 ];
29 shell = pkgs.fish;
30 linger = true;
31 openssh.authorizedKeys.keys = sshAuthorizedKeys;
32 };
33
34 programs.fish.enable = true;
35 programs._1password.enable = true;
36 programs._1password-gui = {
37 enable = true;
38 polkitPolicyOwners = [ "sean" ];
39 };
40 };
41
42 flake.modules.homeManager.sean =
43 { pkgs, config, ... }:
44 {
45 home.username = "sean";
46 home.homeDirectory = "/home/sean";
47 home.stateVersion = "25.05";
48
49 nixpkgs.config.allowUnfree = true;
50 nixpkgs.config.permittedInsecurePackages = [
51 "libsoup-2.74.3"
52 ];
53
54 home.packages = with pkgs; [
55 inputs.agenix.packages.${pkgs.system}.default
56 age-plugin-yubikey
57 lxqt.lxqt-policykit
58 ];
59
60 programs.ssh = {
61 enable = true;
62 enableDefaultConfig = false;
63 matchBlocks = {
64 "*" = {
65 identityFile = [
66 "${config.home.homeDirectory}/.ssh/id_ed25519_sk_rk"
67 ];
68 };
69 };
70 };
71
72 programs.awscli = {
73 enable = true;
74 settings = {
75 "default" = {
76 region = "us-east-1";
77 };
78 };
79 };
80
81 home.sessionVariables = {
82 EDITOR = "hx";
83 VISUAL = "hx";
84 SUDO_EDITOR = "hx";
85 SSH_AUTH_SOCK = "${config.home.homeDirectory}/.1password/agent.sock";
86 SSH_ASKPASS = "${pkgs.openssh-askpass}/bin/gnome-ssh-askpass3";
87 SSH_ASKPASS_REQUIRE = "prefer";
88 };
89
90 # SSH allowed signers for commit signature verification
91 home.file.".ssh/allowed_signers".text = ''
92 hello@seanaye.ca ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCIqgZ7kedxo+mOW7YG73Vp3zel3h180y3GKvHtRsXfGlpIIvRDy7pgCBQ4AGXYD4y78URQmFohYSAPqCPOPaWcU2un3XG9KvCzEsHmsbskPonitUmCiKvrKkb6oW4jCBtd7AEtBn+AiajAQFtPZ7NN2Df3AmTypvR6Irg7R+nxnfc9NTIHmGvxSDyWcbb4pguL20sctUSqGL6xGh8q/bqhdOThSimM+z9bEUNxK/5rPhwkNniMrp4pJcUrUiAh5/4DiRFG6KT+oeg+/myoz/Z1sPvAs7u/8JDQI4RshRD8Hu0oTkRBN6Hxj478q2SXbeBUZlD6IdjP3RhGpmSecoDdtWqKbpuV3eVRtQtba3KL86GBeV/bugaOdJ1Aud+1SOFJreAAuvxzMMKT+cdQZk6oOPP148DA/No+mDm/2S43lcdCXh79wA6YRAmKQ8jmZxTCtPutrvuZK1rguvvUlEoG/vhdNHh7eDa4Td07V6bjCRPUl8qk/e4M0E3pwsTlZc=
93 hello@seanaye.ca sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILdilHXHdAP/V8Zq28EzHKtLAMMaFPu4+1det2N50QfhAAAABHNzaDo= sean@framework16
94 '';
95
96 # Yubikey identity for agenix
97 home.file.".config/agenix/yubikey-identity.txt".text = ''
98 # Serial: 26930059, Slot: 1
99 # Name: agenix
100 # Recipient: age1yubikey1qw64ag5lzvn9ekrflu5ruj4a6ucycscl6ctk39fjzf76jptsay39z442pxv
101 AGE-PLUGIN-YUBIKEY-1304E5QVZZD74FKSP8FMCT
102 '';
103
104 # Same identity for sops
105 home.file.".config/sops/age/keys.txt".text = ''
106 # Serial: 26930059, Slot: 1
107 # Name: agenix
108 # Recipient: age1yubikey1qw64ag5lzvn9ekrflu5ruj4a6ucycscl6ctk39fjzf76jptsay39z442pxv
109 AGE-PLUGIN-YUBIKEY-1304E5QVZZD74FKSP8FMCT
110 '';
111
112 # Yubikey sudo access
113 home.file.".config/Yubico/u2f_keys".text = ''
114 sean:2HY//CedY0ZSrKf57lT7abxG8+8bkPyxCfp/0HMlk/il/5W8pn4R5xLiZDcJtvL85U24h9IEIxa4CS22mpaDSA==,gcD/dpLdwvUFcGGPHS4qNsarH4lOEy1AJAT7zoC6BPlFRUYEa8DpVVKFTcvT6PotjnSHSrWWGb/f3U2k2jIOIw==,es256,+presence
115 '';
116
117 programs.home-manager.enable = true;
118 };
119}