From b880a194baebec62670b3c4e45deac1253b95508 Mon Sep 17 00:00:00 2001 From: Aner Zakobar Date: Tue, 13 Oct 2026 09:50:44 +0300 Subject: [PATCH] Set real values for genericized git-config/encryption/send-alert/printing Mirrors the azos-core change: drops the now-fully-migrated features/{git-config,encryption,printing}, rewrites features/homey-alert down to just the azos-homey-ntfy-alert overlay package (the ntfy-specific remote-notification command plugged into azos.send-alert.remoteCommand), and sets every real personal value (name/email/signing key, GPG key id, YubiKey/browserpass/gpg-ssh toggles and keygrip/pubkey, printing username) directly in home-manager/home.nix and nixos/configuration.nix, same place the other personal values (azos.name, azos.headphones.devices) already live. --- azos-core | 2 +- features/encryption/default.nix | 80 --------- features/encryption/gpg-as-ssh.pub | 1 - features/encryption/ssh-config | 1 - features/encryption/sshcontrol | 1 - features/git-config/default.nix | 32 ---- features/git-config/pass-git-mapping.ini | 2 - features/homey-alert/default.nix | 205 +++-------------------- features/homey-alert/notify-skill.md | 65 ------- features/nextcloud/default.nix | 10 +- features/printing/default.nix | 55 ------ features/steam/default.nix | 8 + home-manager/home.nix | 25 ++- nixos/configuration.nix | 2 +- 14 files changed, 56 insertions(+), 433 deletions(-) delete mode 100644 features/encryption/default.nix delete mode 100755 features/encryption/gpg-as-ssh.pub delete mode 100755 features/encryption/ssh-config delete mode 100755 features/encryption/sshcontrol delete mode 100644 features/git-config/default.nix delete mode 100644 features/git-config/pass-git-mapping.ini delete mode 100644 features/homey-alert/notify-skill.md delete mode 100644 features/printing/default.nix diff --git a/azos-core b/azos-core index e39b517..3b4cb38 160000 --- a/azos-core +++ b/azos-core @@ -1 +1 @@ -Subproject commit e39b517168c611408cd6bce0078b540a46f783e6 +Subproject commit 3b4cb389908feccbacdb3ed87c99a38549681ad6 diff --git a/features/encryption/default.nix b/features/encryption/default.nix deleted file mode 100644 index 86f81e1..0000000 --- a/features/encryption/default.nix +++ /dev/null @@ -1,80 +0,0 @@ -{...}: { - config.flake.modules.homeManager.encryption = { - lib, - config, - pkgs, - ... - }: { - options.azos.encryption.enable = lib.mkOption { - default = true; - type = lib.types.bool; - }; - config = lib.mkIf config.azos.encryption.enable { - programs.password-store = { - enable = true; - settings = { - PASSWORD_STORE_KEY = "26B851F81F8F7C55"; - }; - }; - home.packages = with pkgs; [ - yubikey-personalization - ]; - programs.gpg = { - enable = true; - }; - programs.browserpass = { - enable = true; - browsers = ["chromium"]; - }; - services.gpg-agent = { - enable = true; - enableSshSupport = true; - grabKeyboardAndMouse = false; - pinentry.package = pkgs.pinentry-emacs; - extraConfig = '' - allow-emacs-pinentry - allow-loopback-pinentry - ''; - }; - - # pinentry-emacs needs INSIDE_EMACS set, but NOT on gpg-agent itself: - # gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on its own process at - # startup (agent/gpg-agent.c, both supervised and daemon mode) -- by - # design, it expects this to arrive per-connection from the CLIENT, - # not statically from its own daemon environment. Each gpg/git - # invocation reads INSIDE_EMACS from its own env and forwards it to - # gpg-agent via "OPTION putenv=INSIDE_EMACS=..." (common/asshelp.c: - # send_pinentry_environment); gpg-agent stores that per-session and - # copies it into the forked pinentry's actual env for that one - # request (agent/call-pinentry.c:atfork_core). So the var has to be - # set on whatever shell/process runs git or gpg -- a prior attempt - # at this set it on gpg-agent.service's systemd Environment instead, - # which gpg-agent silently discards before it can ever be read. - # - # Only safe to set globally when Emacs is structurally guaranteed to - # be up and responsive -- i.e. under EXWM, where Emacs *is* the - # window manager. Elsewhere Emacs may not be running (fine: the - # loopback socket connect fails instantly, same fast fallback as - # today) or may be running but transiently busy (not fine: pinentry - # then blocks on the Assuan handshake for up to its 60s timeout - # before falling back, which is strictly worse than today's instant - # failure). - home.sessionVariables = lib.mkIf config.azos.suites.exwm.enable { - INSIDE_EMACS = "t"; - }; - - home.file.".ssh/config".source = ./ssh-config; - home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub; - home.file.".gnupg/sshcontrol".source = ./sshcontrol; - - # home-manager creates ~/.gnupg (via the files above) with the default - # umask, which can leave it group/other-readable. gpg refuses to trust - # a homedir like that and prints an "unsafe permissions" warning on - # every invocation, which pollutes anything that captures gpg/pass - # output (e.g. shell-command-to-string). Enforce 700 on every switch. - home.activation.gnupgPerms = lib.hm.dag.entryAfter ["writeBoundary"] '' - $DRY_RUN_CMD chmod 700 "$HOME/.gnupg" - ''; - }; - }; -} diff --git a/features/encryption/gpg-as-ssh.pub b/features/encryption/gpg-as-ssh.pub deleted file mode 100755 index 676c8b0..0000000 --- a/features/encryption/gpg-as-ssh.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMdozJewuuqG4VuwGhI5Uw2xDIUrkQwyPGQ2q3tvnPq/VoV+zfdnou42I6XYEfOGd6xfLR0byOGCk1Ia1F/picBsxADEaJFBnTny5MWNA5MxwJIYUPW5+kFN1TmxdNGmj0WJ8qZeKkS3ffixdHlHTVu4Rzrlu8qDdw8TmgcvD7sHpNaBB+hwG9B/s5BAozfXvyXtW51lLLrEZdmUXJxAP51ubVgysZ985PA89o4G7LUE20IKAj3rgylLwq+Lz2PoGmVCptPTknLLzGlxTy2mU/tESJtS4iUvshSYiKak73BSen88xLWL/eZGFzOLW4TNem/qT0ykqK1s1BaGWCcQiDWN+Lpa3XqTbFN054MfhLdEMp+NjrdsCbZORzp9p2ZPDqi5jI1Hy7IN/8VzzB+T13MX6YhW7CBBqUZaivGhVQGsNjrFusPGhCaZrzNJ1l4qssLAlOh9qdaYzqDe+BIHsty55vw4Ph+Axou82babpLoiQzkCol2TWjPr7JSfHFkm6CmoTQ7mK8m7jRCodmxF+BEe4Usr+HrTKDc9fr5P4mdfL0O+ZPrlkPuG1zBTMal9MPxeCk4emzOZf7vBMNzb0aKHbOtSdVk/IcjatlDd2EIo34e5A6anLRMAdxb7901mnCAcjvCn6+ArNV8nr+NBk1+UvumZ+Q59LTrAkgRt3rBw== openpgp:0x13E0C25D diff --git a/features/encryption/ssh-config b/features/encryption/ssh-config deleted file mode 100755 index 12f4b53..0000000 --- a/features/encryption/ssh-config +++ /dev/null @@ -1 +0,0 @@ -IdentityAgent ${XDG_RUNTIME_DIR}/gnupg/S.gpg-agent.ssh diff --git a/features/encryption/sshcontrol b/features/encryption/sshcontrol deleted file mode 100755 index a38e649..0000000 --- a/features/encryption/sshcontrol +++ /dev/null @@ -1 +0,0 @@ -37710BAB5F6DC9878A450CDA8A4661D932C04ACB diff --git a/features/git-config/default.nix b/features/git-config/default.nix deleted file mode 100644 index 386ee9c..0000000 --- a/features/git-config/default.nix +++ /dev/null @@ -1,32 +0,0 @@ -{...}: { - config.flake.modules.homeManager.git-config = { - lib, - config, - pkgs, - ... - }: { - options.azos.git-config.enable = lib.mkOption { - default = true; - type = lib.types.bool; - }; - config = lib.mkIf config.azos.git-config.enable { - home.packages = with pkgs; [pass-git-helper unzip]; - programs.git = { - enable = true; - signing = { - key = "BB141234A3DD953D"; - signByDefault = true; - }; - settings = { - credential.helper = "!pass-git-helper $@"; - user = { - name = "Aner Zakobar"; - email = "aner@zakobar.com"; - }; - }; - }; - home.file.".config/pass-git-helper/git-pass-mapping.ini".source = - ./pass-git-mapping.ini; - }; - }; -} diff --git a/features/git-config/pass-git-mapping.ini b/features/git-config/pass-git-mapping.ini deleted file mode 100644 index 6b7305d..0000000 --- a/features/git-config/pass-git-mapping.ini +++ /dev/null @@ -1,2 +0,0 @@ -[*git.zakobar.com*] -target=zakobar.com \ No newline at end of file diff --git a/features/homey-alert/default.nix b/features/homey-alert/default.nix index 668b43d..177dd32 100644 --- a/features/homey-alert/default.nix +++ b/features/homey-alert/default.nix @@ -1,191 +1,28 @@ {...}: { - config.flake.modules.homeManager.homey-alert = { - lib, - config, - pkgs, - ... - }: { - options.azos.homey-alert.enable = lib.mkOption { - default = false; - example = true; - type = lib.types.bool; - }; - options.azos.homey-alert.longCommandThresholdSeconds = lib.mkOption { - default = 300; - example = 600; - type = lib.types.int; - description = '' - Installs a global PreToolUse hook (matcher "Bash") in - ~/.claude/settings.json that transparently wraps every Bash command - Claude Code runs: it times the command, and if it ran at or past - this threshold, fires homey-alert with the elapsed time and exit - code once it finishes. Commands that finish faster are unaffected. + config.flake.overlayPkgs.azos-homey-ntfy-alert = pkgs: + pkgs.writeShellApplication { + name = "azos-homey-ntfy-alert"; + runtimeInputs = with pkgs; [curl pass]; + text = '' + TOKEN="$(pass zakobar-homecenter/ntfy-token)" - This exists so long-running commands (big rclone transfers, builds) - notify automatically even when Claude never thinks to chain - homey-alert itself, and even if the harness moves the command to - the background partway through. + CMD=( + curl -sf + -H "Authorization: Bearer $TOKEN" + -H "Priority: ''${PRIORITY:-default}" + ) + [[ -n "''${TITLE:-}" ]] && CMD+=(-H "Title: $TITLE") + [[ -n "''${TAGS:-}" ]] && CMD+=(-H "Tags: $TAGS") + CMD+=(-d "''${MESSAGE:-}" https://ntfy.zakobar.com/alerts) - The hook only adds timing + notification around the command as - given -- it does not change permissions, so normal confirmation - prompts for risky commands still happen exactly as before. - ''; - }; - - config = lib.mkIf config.azos.homey-alert.enable (let - threshold = toString config.azos.homey-alert.longCommandThresholdSeconds; - # Rewrites every Bash tool command to time itself and fire - # homey-alert if it ran at or past the threshold. The original - # command is spliced in verbatim (not eval'd from an encoded blob) - # so it stays human-readable in any permission prompt, and it's run - # in a subshell so the wrapper's own timing/notify code still runs - # even if the original command uses `set -e` or calls `exit`. - # permissionDecision is deliberately omitted from the hook's JSON - # output: supplying it (even as "allow") would bypass the normal - # confirmation flow, which must stay untouched here. - bashNotifyHook = pkgs.writeShellApplication { - name = "azos-bash-notify-hook"; - runtimeInputs = [pkgs.jq]; - text = '' - input=$(cat) - command=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null) || command="" - - if [ -z "$command" ]; then - echo '{}' - exit 0 - fi - - wrapped="__azos_notify_start=\$(date +%s) - ( - $command - ) - __azos_notify_rc=\$? - __azos_notify_dur=\$(( \$(date +%s) - __azos_notify_start )) - if [ \"\$__azos_notify_dur\" -ge ${threshold} ]; then - __azos_notify_tag=\$([ \"\$__azos_notify_rc\" -eq 0 ] && echo white_check_mark || echo x) - homey-alert -t \"Long command\" -T \"\$__azos_notify_tag\" \"Finished in \$__azos_notify_dur s (exit \$__azos_notify_rc)\" >/dev/null 2>&1 || true - fi - exit \"\$__azos_notify_rc\"" - - jq -n --arg cmd "$wrapped" \ - '{hookSpecificOutput: {hookEventName: "PreToolUse", updatedInput: {command: $cmd}}}' 2>/dev/null || echo '{}' - ''; - }; - in { - azos.claude.globalSkills.notify = ./notify-skill.md; - - home.activation.configureBashNotifyHook = lib.hm.dag.entryAfter ["writeBoundary"] '' - SETTINGS_JSON="$HOME/.claude/settings.json" - HOOK_ENTRY=$(${pkgs.jq}/bin/jq -n \ - --arg cmd "${bashNotifyHook}/bin/azos-bash-notify-hook" \ - '{ - matcher: "Bash", - hooks: [{type: "command", command: $cmd}] - }') - - if [ -f "$SETTINGS_JSON" ]; then - tmp=$(mktemp) - ${pkgs.jq}/bin/jq --argjson entry "$HOOK_ENTRY" \ - '.hooks.PreToolUse = ((.hooks.PreToolUse // []) | map(select(.matcher != $entry.matcher))) + [$entry]' \ - "$SETTINGS_JSON" > "$tmp" && mv "$tmp" "$SETTINGS_JSON" + if [[ -n "''${AZOS_SEND_ALERT_PRINT_REMOTE:-}" ]]; then + # Shell-quote each element so the output is safe to embed in SSH commands -- + # the token is already resolved above, so the remote host only needs curl. + printf '%q ' "''${CMD[@]}" + printf '\n' else - ${pkgs.jq}/bin/jq -n --argjson entry "$HOOK_ENTRY" \ - '{hooks: {PreToolUse: [$entry]}}' > "$SETTINGS_JSON" + "''${CMD[@]}" fi ''; - - home.packages = [ - bashNotifyHook - (pkgs.writeShellApplication { - name = "homey-alert"; - runtimeInputs = with pkgs; [curl pass libnotify]; - text = '' - usage() { - cat <&2; usage >&2; exit 1 ;; - *) break ;; - esac - done - - if [[ $# -gt 0 ]]; then - MESSAGE="$*" - elif [[ ! -t 0 ]]; then - MESSAGE="$(cat)" - else - echo "homey-alert: no message provided" >&2 - usage >&2 - exit 1 - fi - - TOKEN="$(pass zakobar-homecenter/ntfy-token)" - - # Build the curl invocation as an array — single source of truth for both modes - CMD=( - curl -sf - -H "Authorization: Bearer $TOKEN" - -H "Priority: $PRIORITY" - ) - [[ -n "$TITLE" ]] && CMD+=(-H "Title: $TITLE") - [[ -n "$TAGS" ]] && CMD+=(-H "Tags: $TAGS") - CMD+=(-d "$MESSAGE" https://ntfy.zakobar.com/alerts) - - if $PRINT_REMOTE; then - # Shell-quote each element so the output is safe to embed in SSH commands - printf '%q ' "''${CMD[@]}" - printf '\n' - else - "''${CMD[@]}" || true - - # Local desktop notification, independent of the ntfy push above -- - # the server isn't always up, so this always fires as a fallback. - URGENCY="normal" - case "$PRIORITY" in - min|low) URGENCY="low" ;; - high|urgent) URGENCY="critical" ;; - esac - notify-send -u "$URGENCY" "''${TITLE:-homey-alert}" "$MESSAGE" || true - fi - ''; - }) - ]; - }); - }; + }; } diff --git a/features/homey-alert/notify-skill.md b/features/homey-alert/notify-skill.md deleted file mode 100644 index 296aba5..0000000 --- a/features/homey-alert/notify-skill.md +++ /dev/null @@ -1,65 +0,0 @@ -# Homey Alert — sending ntfy notifications when tasks finish - -Use `homey-alert` to push notifications to Aner's homelab ntfy server when long tasks complete. - -## When to use proactively - -When running (or suggesting) a command that will take more than ~30 seconds — training runs, -builds, deploys, downloads, test suites — append a notification automatically. Don't wait to -be asked. - -## Background / async tasks (Claude Code specifically) - -If you (the agent) are running a command via Bash that could take longer than -~10 minutes — large rclone/rsync transfers, builds, training runs — and it -might run in the background (either because you set `run_in_background`, or -because the harness auto-backgrounds it after its timeout), chain the -`homey-alert` call **into that same command string from the start**. Don't -wait until you notice it's taking a while and then think about notifying — -by then the command is already running without it, and the harness's own -"task finished" signal only reaches this session, not Aner's phone. Chaining -upfront is the only way to get a real ntfy push the moment it actually -finishes: - -```bash -rclone copy ... ; homey-alert -t "Backup" -p default -T "$([ $? -eq 0 ] && echo white_check_mark || echo x)" "rclone copy finished (exit $?)" -``` - -## Local commands - -Append after the command so it fires on success only (`&&`) or always (`;`): - -```bash -# Notify on success only -long_cmd && homey-alert "Task done" - -# Always notify (even on failure) — prefer this for deploys/training -long_cmd; homey-alert -t "Training" -p high -T "$([ $? -eq 0 ] && echo white_check_mark || echo x)" "Exited $?" -``` - -## Remote commands (SSH / training machines) - -Remote machines don't have `homey-alert`. Use `-r`/`--print-remote` to get a self-contained -`curl` command with the token already embedded. The `$(...)` expands **locally**; the resulting -command string is what the remote machine executes. - -```bash -ssh user@host "python train.py && $(homey-alert -r -t 'Training' -p high -T white_check_mark 'Model finished')" -``` - -The remote machine only needs `curl` (universally available). - -## Flags - -| Flag | Short | Values / notes | -|------|-------|----------------| -| `--title TITLE` | `-t` | Notification title | -| `--priority PRIO` | `-p` | `min` / `low` / `default` / `high` / `urgent` | -| `--tags TAGS` | `-T` | Comma-separated emoji shortcodes: `white_check_mark`, `x`, `warning`, `rotating_light`, `tada` | -| `--print-remote` | `-r` | Print curl command instead of running (embed token locally, run remotely) | - -## Choosing priority and tags - -- Routine completion (backup, build): `default` priority, `white_check_mark` -- Training / long job: `high` priority, `white_check_mark` on success / `x` on failure -- Something broke: `urgent` priority, `rotating_light` diff --git a/features/nextcloud/default.nix b/features/nextcloud/default.nix index b5b9180..0c95179 100644 --- a/features/nextcloud/default.nix +++ b/features/nextcloud/default.nix @@ -23,12 +23,12 @@ nextcloudMountSafe = pkgs.writeShellScript "nextcloud-mount-safe" '' set -eu mountpoint="$HOME/${mountDir}" - mkdir -p "$mountpoint" + ${pkgs.coreutils}/bin/mkdir -p "$mountpoint" while ! ${pkgs.azos-card-present}/bin/azos-card-present; do ${pkgs.coreutils}/bin/sleep 10 done - password=$(${pkgs.pass}/bin/pass zakobar.com | head -1) - uid=$(${pkgs.pass}/bin/pass nextcloud-username/aner | head -1) + password=$(${pkgs.pass}/bin/pass zakobar.com | ${pkgs.coreutils}/bin/head -1) + uid=$(${pkgs.pass}/bin/pass nextcloud-username/aner | ${pkgs.coreutils}/bin/head -1) export RCLONE_CONFIG_${remoteNameEnv}_TYPE=webdav export RCLONE_CONFIG_${remoteNameEnv}_URL="https://nextcloud.zakobar.com/remote.php/dav/files/$uid/" export RCLONE_CONFIG_${remoteNameEnv}_VENDOR=nextcloud @@ -63,9 +63,9 @@ Unit.Description = "Mount Nextcloud ${remoteSubfolder} via rclone (waits silently for YubiKey)"; Service = { Type = "simple"; - Environment = "PATH=${pkgs.fuse3}/bin:${pkgs.fuse}/bin"; + Environment = "PATH=/run/wrappers/bin:${pkgs.fuse3}/bin:${pkgs.fuse}/bin"; ExecStart = "${nextcloudMountSafe}"; - ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u %h/${mountDir}"; + ExecStop = "/run/wrappers/bin/fusermount3 -u %h/${mountDir}"; Restart = "always"; RestartSec = "10s"; }; diff --git a/features/printing/default.nix b/features/printing/default.nix deleted file mode 100644 index 6103145..0000000 --- a/features/printing/default.nix +++ /dev/null @@ -1,55 +0,0 @@ -{...}: { - config.flake.modules.nixos.printing = { - lib, - config, - pkgs, - ... - }: let - webpFilter = pkgs.writeShellScript "webptopdf" '' - if [ $# -ge 6 ]; then - INPUT="$6" - TMPFILE="" - else - TMPFILE=$(mktemp /tmp/cups-webp-XXXXXX.webp) - cat > "$TMPFILE" - INPUT="$TMPFILE" - fi - TMPOUT=$(mktemp /tmp/cups-webp-XXXXXX.pdf) - ${pkgs.imagemagick}/bin/magick "$INPUT" "$TMPOUT" - cat "$TMPOUT" - rm -f "$TMPOUT" - [ -n "$TMPFILE" ] && rm -f "$TMPFILE" - ''; - - webpCupsMime = pkgs.runCommand "webp-cups-mime" {} '' - mkdir -p $out/lib/cups/filter $out/share/cups/mime - cp ${webpFilter} $out/lib/cups/filter/webptopdf - chmod +x $out/lib/cups/filter/webptopdf - echo 'image/webp webp string(0,"RIFF") string(8,"WEBP")' > $out/share/cups/mime/webp.types - echo 'image/webp application/pdf 0 webptopdf' > $out/share/cups/mime/webp.convs - ''; - in { - options.azos.printing.enable = lib.mkOption { - default = false; - example = true; - type = lib.types.bool; - }; - - config = lib.mkIf config.azos.printing.enable { - services.printing = { - enable = true; - drivers = [pkgs.hplip webpCupsMime]; - }; - - environment.systemPackages = [pkgs.hplip]; - - services.avahi = { - enable = true; - nssmdns4 = true; - openFirewall = true; - }; - - users.users.aner.extraGroups = ["lp"]; - }; - }; -} diff --git a/features/steam/default.nix b/features/steam/default.nix index 3907720..fca6b5f 100644 --- a/features/steam/default.nix +++ b/features/steam/default.nix @@ -10,6 +10,14 @@ }; config = lib.mkIf config.azos.steam.enable { programs.steam.enable = true; + + # HORI STICK A fight stick (0f0d:0040) is missing from Steam's bundled + # 60-steam-input.rules, so Steam can't open its hidraw node for Steam + # Input and falls back to a generic joystick mapping that drops BTN_C + # (Circle). Grant the same uaccess the other HORI devices get. + services.udev.extraRules = '' + KERNEL=="hidraw*", ATTRS{idVendor}=="0f0d", ATTRS{idProduct}=="0040", MODE="0660", TAG+="uaccess" + ''; }; }; } diff --git a/home-manager/home.nix b/home-manager/home.nix index b0d441c..41b213e 100755 --- a/home-manager/home.nix +++ b/home-manager/home.nix @@ -16,9 +16,6 @@ suiteModules.homeManager.exwm suiteModules.homeManager.lauretta suiteModules.homeManager.claude - suiteModules.homeManager.encryption - suiteModules.homeManager.git-config - suiteModules.homeManager.hfsprogs suiteModules.homeManager.hyprland suiteModules.homeManager.mail suiteModules.homeManager.mpris-proxy @@ -29,7 +26,6 @@ suiteModules.homeManager.snx-rs suiteModules.homeManager.roam-backup suiteModules.homeManager.ytdl - suiteModules.homeManager.homey-alert suiteModules.homeManager.leetcode ]; @@ -56,7 +52,26 @@ } ]; azos.roam-backup.enable = true; - azos.homey-alert.enable = true; + + azos.send-alert.enable = true; + azos.send-alert.remoteCommand = "${pkgs.azos-homey-ntfy-alert}/bin/azos-homey-ntfy-alert"; + + azos.git-config.userName = "Aner Zakobar"; + azos.git-config.userEmail = "aner@zakobar.com"; + azos.git-config.signing.enable = true; + azos.git-config.signing.key = "BB141234A3DD953D"; + azos.git-config.passCredentialHelper.enable = true; + azos.git-config.passCredentialHelper.mapping = '' + [*git.zakobar.com*] + target=zakobar.com + ''; + + azos.encryption.passwordStore.gpgKeyId = "26B851F81F8F7C55"; + azos.encryption.yubikey.enable = true; + azos.encryption.browserpass.enable = true; + azos.encryption.gpgSsh.enable = true; + azos.encryption.gpgSsh.keygrip = "37710BAB5F6DC9878A450CDA8A4661D932C04ACB"; + azos.encryption.gpgSsh.publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMdozJewuuqG4VuwGhI5Uw2xDIUrkQwyPGQ2q3tvnPq/VoV+zfdnou42I6XYEfOGd6xfLR0byOGCk1Ia1F/picBsxADEaJFBnTny5MWNA5MxwJIYUPW5+kFN1TmxdNGmj0WJ8qZeKkS3ffixdHlHTVu4Rzrlu8qDdw8TmgcvD7sHpNaBB+hwG9B/s5BAozfXvyXtW51lLLrEZdmUXJxAP51ubVgysZ985PA89o4G7LUE20IKAj3rgylLwq+Lz2PoGmVCptPTknLLzGlxTy2mU/tESJtS4iUvshSYiKak73BSen88xLWL/eZGFzOLW4TNem/qT0ykqK1s1BaGWCcQiDWN+Lpa3XqTbFN054MfhLdEMp+NjrdsCbZORzp9p2ZPDqi5jI1Hy7IN/8VzzB+T13MX6YhW7CBBqUZaivGhVQGsNjrFusPGhCaZrzNJ1l4qssLAlOh9qdaYzqDe+BIHsty55vw4Ph+Axou82babpLoiQzkCol2TWjPr7JSfHFkm6CmoTQ7mK8m7jRCodmxF+BEe4Usr+HrTKDc9fr5P4mdfL0O+ZPrlkPuG1zBTMal9MPxeCk4emzOZf7vBMNzb0aKHbOtSdVk/IcjatlDd2EIo34e5A6anLRMAdxb7901mnCAcjvCn6+ArNV8nr+NBk1+UvumZ+Q59LTrAkgRt3rBw== openpgp:0x13E0C25D"; home = { username = "aner"; diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 33b866e..a40ecab 100644 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -18,7 +18,6 @@ suiteModules.nixos.dev suiteModules.nixos.steam suiteModules.nixos.attic - suiteModules.nixos.printing suiteModules.nixos.hardware-auth ]; @@ -94,6 +93,7 @@ azos.suites.exwm.enable = true; azos.attic.enable = true; azos.printing.enable = true; + azos.printing.username = "aner"; azos.hardware-auth.enable = true; # Needed for unprivileged FUSE mounts (e.g. rclone mount) -- without this,