Merge branch 'master' into firewall-changes

Reviewed-on: #16

flake.lock

@@ -32,11 +32,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1789283312,
+        "lastModified": 1791702392,
-        "narHash": "sha256-Sv/2AyUTydH5d4eNk/ej1lHD1rpDvNjiB5Y3hmg/EGk=",
+        "narHash": "sha256-8uWZP3UiJBtYzBzazI18WvlshKYHxPb+8aqm02OxL5M=",
         "ref": "refs/heads/master",
-        "rev": "31673a5c64497a0f40487d51820d3738dec13d60",
+        "rev": "ee2a27ad749d6d774e26c2be5de5f3a5ecd4a93f",
-        "revCount": 24,
+        "revCount": 28,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
       },
@@ -267,11 +267,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1789623807,
+        "lastModified": 1792166485,
-        "narHash": "sha256-pqmP+T+fR2+MDen+ro2iF7mdH7S83AUuvNZwVDl3jUk=",
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "b19679b19d64dc29b96caf07e3282c250611ac57",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789623807,
+        "lastModified": 1792166485,
-        "narHash": "sha256-pqmP+T+fR2+MDen+ro2iF7mdH7S83AUuvNZwVDl3jUk=",
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "b19679b19d64dc29b96caf07e3282c250611ac57",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -313,11 +313,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1789887932,
+        "lastModified": 1791702441,
-        "narHash": "sha256-ryX9MgESeWwjpFMgxlaF97FgtaRyfIELgFLEeUR8xLQ=",
+        "narHash": "sha256-qHf8tVIYu6OE1PKcthmpBgblg27u3bU7v4TVqy0B3jg=",
         "ref": "refs/heads/master",
-        "rev": "70288a728cc39eb5f390f71ae24d4a58763216b1",
+        "rev": "2c2e99f6347e9be744a72f7df6043015989d6cd7",
-        "revCount": 14,
+        "revCount": 17,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
       },
@@ -333,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789267039,
+        "lastModified": 1792274446,
-        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
+        "narHash": "sha256-AM1HmBeDnB2B3dSiXuCYeu7Me+lHNpz/P39lVxGJBuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
+        "rev": "ab3823b4b24c0c3ca984c1f3ee577fd6d667424c",
         "type": "github"
       },
       "original": {
@@ -355,11 +355,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789867870,
+        "lastModified": 1792098797,
-        "narHash": "sha256-sOag/7DTqw4tXLI7UxjrZxPGV+dlTe6zFtJn0VSkgFM=",
+        "narHash": "sha256-u4DIIZgznEGzByxXrxWCXK19VcMtTBmi/M9gZ7Jk9bM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d2a22a3659a6ae99847ea9176114f6957b8ac62e",
+        "rev": "640725978b99076e18e069f6e7d2959124584f8f",
         "type": "github"
       },
       "original": {
@@ -370,11 +370,11 @@
     },
     "mnw": {
       "locked": {
-        "lastModified": 1780772958,
+        "lastModified": 1784154424,
-        "narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=",
+        "narHash": "sha256-HRn4O1X2ShYtbq5Egji72/aemyc2cIQicjRZD9hBqM8=",
         "owner": "Gerg-L",
         "repo": "mnw",
-        "rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160",
+        "rev": "0151d9fa87992cbeb67c86616fb9170dcec830b6",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1789749394,
+        "lastModified": 1792030654,
-        "narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=",
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1789749394,
+        "lastModified": 1792030654,
-        "narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=",
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -449,11 +449,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1787498568,
+        "lastModified": 1790046670,
-        "narHash": "sha256-FoOSoBG7tEvOlGRTpWnVdY506Ner4y7r7UYO3OGgmE8=",
+        "narHash": "sha256-OJe62m8gZx4xEAQnMcqH1u31/uu4Xf0q2ykAEHZfgrg=",
-        "rev": "56c02bc00adcf003215cc4bd996d6efaf4cff188",
+        "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1060451.56c02bc00adc/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077996.6774f7bc2537/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -487,11 +487,11 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1789887979,
+        "lastModified": 1792344577,
-        "narHash": "sha256-ln0cOIfvEFNd4IdVbiYfdtxS01E5npnstm0YCTOxpJY=",
+        "narHash": "sha256-Sbd2veIdg9iDiwwDeEKIiuk8FYMtjBXWvDlrrM0FjVA=",
         "ref": "refs/heads/master",
-        "rev": "39c33599b191ae2d595b3cc38e8ad4bf2766cd89",
+        "rev": "2debafc63297a24d2ca5c749b0d3f6bdbf6324cb",
-        "revCount": 99,
+        "revCount": 113,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       },
@@ -507,11 +507,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1789854559,
+        "lastModified": 1792175215,
-        "narHash": "sha256-6GDssza3F+ukpUujSuTL50vW5AHaoG+4vjsDgWqRyeQ=",
+        "narHash": "sha256-XD64JVLV8iE4lR+W5gkTweEaT+SBwOrSy0+le2WgITI=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "85bf39cd0409ad8a7fa5b3ad0d29e89e9da97a0e",
+        "rev": "a736b60b1e2019931168979951c94dc46e342957",
         "type": "github"
       },
       "original": {
@@ -563,11 +563,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789196581,
+        "lastModified": 1791620365,
-        "narHash": "sha256-yJr1Bt4fKkKIpPYbsKGqJ0VFdoDnURgRwuffmBQ2WzY=",
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "228ecefb6329d5a531b77b46b581a2f0c26ee056",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -585,11 +585,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789802016,
+        "lastModified": 1791620365,
-        "narHash": "sha256-QVFfArbYaQMGK4dFV+5RUL72Ci+hNHVhaF/R9qJfDhs=",
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "26a71e661c47bd21a05d06fec749f3f7c75e9d12",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -606,11 +606,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789802016,
+        "lastModified": 1792219666,
-        "narHash": "sha256-QVFfArbYaQMGK4dFV+5RUL72Ci+hNHVhaF/R9qJfDhs=",
+        "narHash": "sha256-RMO08tKD+hFIL5ryWi85VY4aHE5oIpdV1h4kVFctOkw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "26a71e661c47bd21a05d06fec749f3f7c75e9d12",
+        "rev": "a110337465cfb76e3806b81b9db3094c3e6e770a",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1789802016,
+        "lastModified": 1792307278,
-        "narHash": "sha256-QVFfArbYaQMGK4dFV+5RUL72Ci+hNHVhaF/R9qJfDhs=",
+        "narHash": "sha256-wJgFFtw/vlzsjWrQFmTn40TTkSkqHM4XXN0nh4q4uMk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "26a71e661c47bd21a05d06fec749f3f7c75e9d12",
+        "rev": "42076d1c6a0fb405ed04f9a674e4a8f69de62ba3",
         "type": "github"
       },
       "original": {

home/default.nix

@@ -1,6 +1,7 @@
 { lib
 , pkgs
 , userName
+, isNixOS ? true
 , ...
 }: let
   # Have a file sturcture that holds all the configuration files that can't be configured by Nix
@@ -30,6 +31,19 @@ in
       stateVersion = "24.11";
     }
 
+    (lib.mkIf isNixOS {
+      sessionVariables = {
+        XDG_CURRENT_DESKTOP = "sway";
+        XDG_SESSION_TYPE = "wayland";
+        XDG_SESSION_DESKTOP = "sway";
+        XDG_CONFIG_HOME = "$HOME/.config";
+        XDG_CACHE_HOME = "$HOME/.cache";
+        XDG_DATA_HOME = "$HOME/.local/share";
+        XDG_STATE_HOME = "$HOME/.local/state";
+        NIXOS_OZONE_WL = "1";
+      };
+    })
+
     (lib.mkIf pkgs.stdenv.isLinux {
       pointerCursor = {
         gtk.enable = true;

home/neovim.nix

@@ -27,6 +27,7 @@
             enable = true;
             lsp.servers = [ "typescript-language-server" "deno" ];
           };
+          csharp.enable = true;
         };
 
         utility.surround.enable = true;

home/shell.nix

@@ -66,8 +66,14 @@
             "The gods themselves will be my meal. Your dear companions my dessert. Upon this world I'll feast, and death shall follow in my wake. All your hate, all your rage, you will render unto me." \
             "Boring, boring, boring" \
             "Would you be 'happier' had I a 'good reason'?" \
-            "A test of your reflexes!"
+            "A test of your reflexes!" \ 
-
+            "Yer a wizard, Wyatt" \
+            "Yer a lizard, Wyatt" \ 
+            "Po-Tay-To boil em mash em stick em in a stew" \ 
+            "Oh look it's the cutie patootie potato!" 
+            "What a charming young man" \ 
+            "Wyatt, you are smart, kind, and resilient. I believe in you no matter what life throws at you! Kick this project's butt!! - Nico" \
+            "Ganbatte!"
 
           set choose_meme (random)"%"(count $memes)
           set choose_meme $memes[(math $choose_meme"+1")]

home/sway.nix

@@ -153,6 +153,6 @@ in {
 
   programs.waybar = {
     enable = pkgs.stdenv.isLinux;
-    systemd.enable = false;
+    systemd.enable = true;
   };
 }

modules/desktop/default.nix

@@ -1,178 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  cfg = config.desktop;
-
-  defaultWaylandPackages = with pkgs; [
-    brightnessctl
-    cliphist
-    foot
-    grim
-    libnotify
-    mako
-    networkmanagerapplet
-    playerctl
-    polkit_gnome
-    pavucontrol
-    rofi
-    slurp
-    waybar
-    wl-clipboard
-    xdg-utils
-  ];
-
-  defaultSwayPackages =
-    defaultWaylandPackages
-    ++ (with pkgs; [
-      pulseaudio
-      swayidle
-      swaylock
-      wmenu
-    ]);
-
-  resolvedDisplayManager =
-    if cfg.displayManager != "auto"
-    then cfg.displayManager
-    else if cfg.gnome.enable
-    then "gdm"
-    else if cfg.xfce.enable
-    then "lightdm"
-    else "none";
-in {
-  imports = [./xdg.nix];
-
-  options.desktop = {
-    displayManager = lib.mkOption {
-      type = lib.types.enum ["auto" "none" "gdm" "lightdm" "ly"];
-      default = "auto";
-      description = ''
-        Display manager to enable. In auto mode, GDM is used when GNOME is
-        enabled, LightDM is used when XFCE is enabled, and no display manager
-        is enabled for compositor-only configurations.
-      '';
-    };
-
-    gnome.enable = lib.mkEnableOption "the vanilla GNOME desktop environment";
-
-    xfce.enable = lib.mkEnableOption "the vanilla XFCE desktop environment";
-
-    sway = {
-      enable = lib.mkEnableOption "the Sway Wayland compositor";
-
-      extraPackages = lib.mkOption {
-        type = with lib.types; listOf package;
-        default = defaultSwayPackages;
-        defaultText = lib.literalExpression ''
-          with pkgs; [
-            brightnessctl
-            cliphist
-            foot
-            grim
-            libnotify
-            mako
-            networkmanagerapplet
-            playerctl
-            polkit_gnome
-            pulseaudio
-            pavucontrol
-            rofi
-            slurp
-            swayidle
-            swaylock
-            waybar
-            wl-clipboard
-            wmenu
-            xdg-utils
-          ]
-        '';
-        description = "Packages installed alongside Sway.";
-      };
-    };
-
-    hyprland = {
-      enable = lib.mkEnableOption "the Hyprland Wayland compositor";
-
-      extraPackages = lib.mkOption {
-        type = with lib.types; listOf package;
-        default = defaultWaylandPackages;
-        defaultText = lib.literalExpression ''
-          with pkgs; [
-            brightnessctl
-            cliphist
-            foot
-            grim
-            libnotify
-            mako
-            networkmanagerapplet
-            playerctl
-            polkit_gnome
-            pavucontrol
-            rofi
-            slurp
-            waybar
-            wl-clipboard
-            xdg-utils
-          ]
-        '';
-        description = ''
-          Packages installed alongside Hyprland. Hyprlock and Hypridle are
-          enabled separately so their NixOS integration, including PAM, is
-          configured as well.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.gnome.enable {
-      services.desktopManager.gnome.enable = true;
-    })
-
-    (lib.mkIf cfg.xfce.enable {
-      services.xserver = {
-        enable = true;
-        desktopManager.xfce.enable = true;
-      };
-    })
-
-    (lib.mkIf cfg.sway.enable {
-      programs.sway = {
-        enable = true;
-        wrapperFeatures.gtk = true;
-        extraPackages = cfg.sway.extraPackages;
-        extraSessionCommands = ''
-          export XDG_SESSION_TYPE=wayland
-          export XDG_SESSION_DESKTOP=sway
-          export NIXOS_OZONE_WL=1
-        '';
-      };
-    })
-
-    (lib.mkIf cfg.hyprland.enable {
-      programs = {
-        hyprland.enable = true;
-        hyprlock.enable = lib.mkDefault true;
-      };
-
-      environment.systemPackages = cfg.hyprland.extraPackages;
-    })
-
-    (lib.mkIf (resolvedDisplayManager == "gdm") {
-      services.displayManager.gdm.enable = true;
-    })
-
-    (lib.mkIf (resolvedDisplayManager == "lightdm") {
-      services.xserver = {
-        enable = true;
-        displayManager.lightdm.enable = true;
-      };
-    })
-
-    (lib.mkIf (resolvedDisplayManager == "ly") {
-      services.displayManager.ly.enable = true;
-    })
-  ];
-}

modules/desktop/xdg.nix

@@ -1,42 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  cfg = config.desktop;
-  needsGtkPortal = cfg.xfce.enable || cfg.hyprland.enable;
-  usesPortal = cfg.gnome.enable || cfg.xfce.enable || cfg.sway.enable || cfg.hyprland.enable;
-in {
-  config = lib.mkMerge [
-    # GNOME and Sway configure their own portals in NixOS. XFCE needs a
-    # portal; Hyprland benefits from GTK as a fallback to its native one.
-    (lib.mkIf needsGtkPortal {
-      xdg.portal = {
-        enable = true;
-        extraPortals = [pkgs.xdg-desktop-portal-gtk];
-      };
-    })
-
-    (lib.mkIf (cfg.sway.enable || needsGtkPortal) {
-      xdg.portal.config.common.default = ["gtk"];
-    })
-
-    (lib.mkIf (usesPortal && config.services.gnome.gnome-keyring.enable) {
-      xdg.portal.config.common."org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
-    })
-
-    (lib.mkIf (cfg.sway.enable && config.services.gnome.gnome-keyring.enable) {
-      xdg.portal.config.sway."org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
-    })
-
-    # A per-desktop config takes precedence over Hyprland's packaged config,
-    # so include its native portal whenever adding a Secret preference.
-    (lib.mkIf (cfg.hyprland.enable && config.services.gnome.gnome-keyring.enable) {
-      xdg.portal.config.hyprland = {
-        default = ["hyprland" "gtk"];
-        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
-      };
-    })
-  ];
-}

modules/machine/cloud/configuration.nix

@@ -22,7 +22,6 @@ in {
     })
     ../../apps/gaming.nix
     ../../apps/appimage.nix
-    ../../desktop
     ../../graphics
     ../../pwrMgmt
     ../../networking/core.nix
@@ -75,6 +74,7 @@ in {
     brightnessctl
     wttrbar
     cliphist
+    xdg-desktop-portal-gtk
     xdg-utils
     flatpak-xdg-utils
     desktop-file-utils
@@ -89,10 +89,6 @@ in {
   # Enable Polkit
   security.polkit.enable = true;
 
-  # Enable desktop support (sway)
-  desktop.sway.enable = true;
-  desktop.displayManager = "ly";
-
   # Graphics module (../../graphics/default.nix)
   graphics = {
     enable = true;
@@ -155,7 +151,10 @@ in {
 
   # Core networking module (see ../../networking/core.nix)
   network = {
-    firewall.enable = true;
+    firewall = {
+      enable = true;
+      firewalld.enable = true;
+    };
     networkManager.enable = true;
   };
 
@@ -193,6 +192,27 @@ in {
   # AppImage support
   appimage.enable = true;
 
+  # XDG stuff
+  xdg = {
+    portal = {
+      enable = true;
+      config = {
+        sway = {
+          default = ["wlr" "gtk"];
+          "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+        };
+        common = {
+          default = ["gtk"];
+          "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+        };
+      };
+      extraPortals = with pkgs; [
+        xdg-desktop-portal-wlr
+        xdg-desktop-portal-gtk
+      ];
+    };
+  };
+
   # sched_ext userspace CPU scheduling stuff - idk
   services.scx = {
     enable = true;

modules/networking/core.nix

@@ -8,6 +8,12 @@ in {
   options.network = {
     firewall = {
       enable = lib.mkEnableOption "system firewall";
+      firewalld.enable = lib.mkEnableOption "firewalld with its nftables backend";
+      nftables.extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Rules inside a separate inet nftables table alongside firewalld";
+      };
       tcpPorts = {
         ssh.enable = lib.mkEnableOption "SSH service port (22)";
         web.enable = lib.mkEnableOption "common web service ports (80, 443)";
@@ -42,6 +48,21 @@ in {
     };
   };
   config = {
+    assertions = [
+      {
+        assertion = cfg.firewall.nftables.extraConfig == "" || cfg.firewall.firewalld.enable;
+        message = "network.firewall.nftables.extraConfig requires network.firewall.firewalld.enable";
+      }
+    ];
+    services.firewalld.enable = cfg.firewall.firewalld.enable;
+    networking.nftables = lib.mkIf cfg.firewall.firewalld.enable {
+      enable = true;
+      flushRuleset = false;
+      tables."local-extra" = lib.mkIf (cfg.firewall.nftables.extraConfig != "") {
+        family = "inet";
+        content = cfg.firewall.nftables.extraConfig;
+      };
+    };
     networking.firewall = {
       enable = cfg.firewall.enable;
       allowedTCPPorts = lib.flatten [