yeah

Signed-off-by: unexplrd <unexplrd@linerds.us>

hosts/dunamis/catppuccin.nix

@@ -1,9 +0,0 @@
-{inputs, ...}: {
-  imports = with inputs; [
-    catppuccin.nixosModules.catppuccin
-  ];
-  catppuccin = {
-    enable = true;
-    flavor = "latte";
-  };
-}

hosts/dunamis/configuration.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  config,
   inputs,
   ...
 }: {
@@ -12,7 +13,6 @@
     ./programs.nix
     ./stylix.nix
     # ./stylix-light.nix
-    # ./catppuccin.nix
     ./disko.nix
     ./users.nix
     ./sops.nix
@@ -26,6 +26,13 @@
     channel.enable = false;
     settings.experimental-features = ["nix-command" "flakes"];
     daemonCPUSchedPolicy = "idle";
+    sshServe.enable = true;
+    sshServe.keys = let
+      s = inputs.mysecrets;
+    in [
+      (builtins.readFile
+        "${s}/ssh/id_ed25519_sarien_user.pub")
+    ];
   };
 
   system.stateVersion = "25.05";

hosts/dunamis/hardware.nix

@@ -27,6 +27,27 @@
       ];
     };
   };
+  boot.kernelParams = [
+    "mitigations=auto"
+    "spectre_v2=on"
+    "spectre_bhi=on"
+    "spec_store_bypass_disable=on"
+    "tsx=off"
+    "kvm.nx_huge_pages=force"
+    "nosmt=force"
+    "l1d_flush=on"
+    "spec_rstack_overflow=safe-ret"
+    "gather_data_sampling=force"
+    "reg_file_data_sampling=on"
+    "module.sig_enforce=1"
+    "lockdown=confidentiality"
+    "intel_iommu=on"
+    "amd_iommu=force_isolation"
+    "efi=disable_early_pci_dma"
+    "iommu=force"
+    "iommu.passthrough=0"
+    "iommu.strict=1"
+  ];
 
   hardware.graphics = {
     enable = true;

hosts/dunamis/users.nix

@@ -9,7 +9,7 @@
 in {
   nix.settings.trusted-users = [
     "user"
-    "remotebuild"
+    "nix-ssh"
   ];
   users.mutableUsers = false;
   users.users = {
@@ -23,16 +23,5 @@ in {
         "${secrets}/ssh/id_ed25519_eldrid_user.pub"
       ];
     };
-    remotebuild = {
-      isNormalUser = true;
-      createHome = false;
-      group = "remotebuild";
-      openssh.authorizedKeys.keyFiles = [
-        "${secrets}/ssh/id_ed25519_sarien_user.pub"
-        "${secrets}/ssh/id_ed25519_eldrid_user.pub"
-        "${secrets}/ssh/id_ed25519_eldrid_rmbuild.pub"
-      ];
-    };
   };
-  users.groups.remotebuild = {};
 }

hosts/dunamis/users/user/catppuccin.nix

@@ -1,9 +0,0 @@
-{inputs, ...}: {
-  imports = with inputs; [
-    catppuccin.homeManagerModules.catppuccin
-  ];
-  catppuccin = {
-    enable = true;
-    flavor = "latte";
-  };
-}

hosts/dunamis/users/user/flatpak.nix

@@ -22,24 +22,23 @@
       "com.obsproject.Studio"
       "com.bitwarden.desktop"
       "com.github.tchx84.Flatseal"
+      "de.haeckerfelix.Fragments"
       "org.qbittorrent.qBittorrent"
 
       # "com.transmissionbt.Transmission"
       "com.usebottles.bottles"
       "com.logseq.Logseq"
       "org.octave.Octave"
-      "io.github.martchus.syncthingtray"
 
       # chatting
       "org.signal.Signal"
       "im.riot.Riot"
       "org.telegram.desktop"
       "io.github.spacingbat3.webcord"
-      # "dev.vencord.Vesktop"
       "org.mozilla.Thunderbird"
 
       # media
-      "org.atheme.audacious"
+      "io.bassi.Amberol"
       "io.freetubeapp.FreeTube"
       #"io.github.celluloid_player.Celluloid"
       # "io.mpv.Mpv"
@@ -62,38 +61,29 @@
         Context = {
           sockets = ["wayland" "!x11" "!fallback-x11"];
           filesystems = [
+            "!host"
+            "!home"
+            "!~/.ssh"
             "xdg-run/pipewire-0"
             "xdg-config/gtk-3.0:ro"
             "xdg-config/gtk-4.0:ro"
-            # "~/.local/share/fonts:ro"
             "~/.local/share/icons:ro"
-            # "~/.nix-profile/share/icons:ro"
-            # "~/.nix-profile/share/fonts:ro"
             "/nix/store:ro"
           ];
         };
         Environment = {
-          XCURSOR_PATH = "/run/host/user-share/icons:/run/host/share/icons";
           ELECTRON_OZONE_PLATFORM_HINT = "wayland";
-          #GTK_THEME = "adw-gtk3";
         };
       };
-      "io.github.martchus.syncthingtray".Context.filesystems = ["/storage/games/heroic/Factorio/game/saves"];
-      "org.octave.Octave".Context.sockets = ["x11"];
-      "org.octave.Octave".Environment = {QT_QPA_PLATFORM = "xcb";};
       "com.valvesoftware.Steam" = {
         Context = {
           sockets = ["x11" "wayland"];
           filesystems = ["/storage/games/steam"];
         };
-        Environment = {
-          STEAM_FORCE_DESKTOPUI_SCALING = "1.3";
-        };
+        Environment.STEAM_FORCE_DESKTOPUI_SCALING = "1.3";
       };
       "org.signal.Signal" = {
-        Environment = {
-          SIGNAL_PASSWORD_STORE = "gnome-libsecret";
-        };
+        Environment.SIGNAL_PASSWORD_STORE = "gnome-libsecret";
       };
       "net.lutris.Lutris".Context = {
         sockets = ["x11" "wayland"];
@@ -104,9 +94,7 @@
         filesystems = ["/storage/games/heroic" "~/games/heroic"];
       };
       "com.usebottles.Bottles" = {
-        Context = {
-          sockets = ["x11" "wayland"];
-        };
+        Context.sockets = ["x11" "wayland"];
       };
     };
   };

hosts/dunamis/users/user/home-configuration.nix

@@ -5,7 +5,6 @@
     self.homeModules.programs
     ./programs.nix
     ./flatpak.nix
-    # ./sops.nix
   ];
   desktop = {
     niri.enable = true;

hosts/dunamis/users/user/sops.nix

@@ -1,26 +0,0 @@
-{inputs, ...}: let
-  secretsPath = builtins.toString inputs.mysecrets;
-in {
-  # imports = with inputs; [
-  #   sops-nix.homeManagerModules.sops
-  # ];
-  # sops = {
-  # age.keyFile = "/var/lib/sops-nix/key.txt";
-
-  # defaultSopsFile = "${secretsPath}/secrets.yaml";
-  # validateSopsFiles = false;
-
-  # secrets = {
-  #   "ssh/private/dunamis-user" = {
-  #     path = "/home/user/.ssh/id_ed25519";
-  #   };
-  # };
-  home.file."id_ed25519_pub" = {
-    source = "${secretsPath}/ssh/user/id_dunamis_ed25519.pub";
-    target = ".ssh/id_ed25519.pub";
-  };
-  home.file."id_uni_ed25519_pub" = {
-    source = "${secretsPath}/ssh/user/id_uni_ed25519.pub";
-    target = ".ssh/id_uni_ed25519.pub";
-  };
-}