changes to user seciurity

iina

.github/workflows/update.yml

@@ -5,7 +5,7 @@ on:
     - cron: "0 0 * * 0" # runs weekly on Sunday at 00:00
 
 jobs:
-  lockfile:
+  update_lockfile:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -19,3 +19,4 @@ jobs:
           pr-labels: | # Labels to be set on the PR
             dependencies
             automated
+          token: ${{ secrets.GH_TOKEN }}

defaults/nvim/init.lua

@@ -1,6 +1,14 @@
 -- This file simply bootstraps the installation of Lazy.nvim and then calls other files for execution
 -- This file doesn't necessarily need to be touched, BE CAUTIOUS editing this file and proceed at your own risk.
 local lazypath = vim.env.LAZY or vim.fn.stdpath "data" .. "/lazy/lazy.nvim"
+
+vim.api.nvim_set_keymap("v", "<sc-c>", '"+y', { noremap = true })
+vim.api.nvim_set_keymap("n", "<sc-v>", 'l"+P', { noremap = true })
+vim.api.nvim_set_keymap("v", "<sc-v>", '"+P', { noremap = true })
+vim.api.nvim_set_keymap("c", "<sc-v>", '<C-o>l<C-o>"+<C-o>P<C-o>l', { noremap = true })
+vim.api.nvim_set_keymap("i", "<sc-v>", '<ESC>l"+Pli', { noremap = true })
+vim.api.nvim_set_keymap("t", "<sc-v>", '<C-\\><C-n>"+Pi', { noremap = true })
+
 if not (vim.env.LAZY or (vim.uv or vim.loop).fs_stat(lazypath)) then
   -- stylua: ignore
   vim.fn.system({ "git", "clone", "--filter=blob:none", "https://github.com/folke/lazy.nvim.git", "--branch=stable", lazypath })

flake.lock

@@ -7,16 +7,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1738743987,
+        "lastModified": 1743127615,
-        "narHash": "sha256-O3bnAfsObto6l2tQOmQlrO6Z2kD6yKwOWfs7pA0CpOc=",
+        "narHash": "sha256-+sMGqywrSr50BGMLMeY789mSrzjkoxZiu61eWjYS/8o=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "ae406c04577ff9a64087018c79b4fdc02468c87c",
+        "rev": "fc843893cecc1838a59713ee3e50e9e7edc6207c",
         "type": "github"
       },
       "original": {
         "owner": "lnl7",
-        "ref": "master",
+        "ref": "nix-darwin-24.11",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736373539,
+        "lastModified": 1744743431,
-        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
+        "narHash": "sha256-iyn/WBYDc7OtjSawbegINDe/gIkok888kQxk3aVnkgg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
+        "rev": "c61bfe3ae692f42ce688b5865fac9e0de58e1387",
         "type": "github"
       },
       "original": {
@@ -60,11 +60,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1738702386,
+        "lastModified": 1744440957,
-        "narHash": "sha256-nJj8f78AYAxl/zqLiFGXn5Im1qjFKU8yBPKoWEeZN5M=",
+        "narHash": "sha256-FHlSkNqFmPxPJvy+6fNLaNeWnF1lZSgqVCl/eWaJRc4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "030ba1976b7c0e1a67d9716b17308ccdab5b381e",
+        "rev": "26d499fc9f1d567283d5d56fcf367edd815dba1d",
         "type": "github"
       },
       "original": {

flake.nix

@@ -8,7 +8,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     darwin = {
-      url = "github:lnl7/nix-darwin/master";
+      url = "github:lnl7/nix-darwin/nix-darwin-24.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };

meta/maintainers.nix

@@ -0,0 +1,11 @@
+{...}: {
+  "wymiller" = {
+    email = "wyatt@wyattjmiller.com";
+    name = "Wyatt J. Miller";
+    homepage = "https://wyattjmiller.com";
+    license = {
+      spdxID = "MPL-2.0";
+      fullName = "Mozilla Public License 2.0";
+    };
+  };
+}

modules/common/users.nix

@@ -5,6 +5,10 @@
   hostname,
   ...
 } @ args: {
+  imports = [
+    ../security/sudo.nix
+  ];
+
   networking.hostName = hostname;
 
   # Don't forget to set a password with ‘passwd’!
@@ -23,7 +27,7 @@
     })
   ];
 
-  security.sudo.wheelNeedsPassword = false;
+  security.sudo.needsPassword = false;
 
   users.groups.wyatt = {};
 

modules/machine/sephiroth/apps.nix

@@ -22,6 +22,7 @@
     };
 
     taps = [
+      "iina/homebrew-mpv-iina"
     ];
 
     brews = [
@@ -31,6 +32,14 @@
       "ghostty"
       "raycast"
       "jordanbaird-ice"
+      "iina"
+      "linearmouse"
+      "sanesidebuttons"
+      "betterdisplay"
+      "maccy"
+      "swift-quit"
+      "medis"
+      # "alt-tab"
     ];
   };
 }

modules/security/README.md

@@ -0,0 +1,3 @@
+# Security modules
+
+These are modules relating to security and security-related programs

modules/security/sudo.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  options = {
+    security.sudo = {
+      needsPassword = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether users in the wheel group need to provide a password for sudo.";
+      };
+    };
+  };
+
+  config = {
+    environment.etc."sudoers.d/wheel-no-password" = mkIf (!config.security.sudo.needsPassword) {
+      text = ''
+        %wheel ALL=(ALL) NOPASSWD: ALL
+      '';
+      # mode = "0440";
+    };
+  };
+}