flake.lock: update mysecrets

hosts/dunamis/configuration.nix: add dnscrypt
hosts/dunamis/sops.nix: add another ssh key
hosts/dunamis/users/user/home-configuration.nix: import sops.nix
hosts/dunamis/users/user/sops.nix: link public keys
modules/home/desktop/niri/default.nix: redo layout string insertion

Signed-off-by: unexplrd <unexplrd@linerds.us>

flake.lock

@@ -968,11 +968,11 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1741087081,
+        "lastModified": 1742222377,
-        "narHash": "sha256-ms5PD6kSBXT/rYKJkq4hFCPIkTQfURHOoEagBhz+19o=",
+        "narHash": "sha256-Yte1I7I7Zf4eeeIvHgRGNElTUdKEke5L3O3VlAFNxkc=",
         "ref": "refs/heads/main",
-        "rev": "1b15f763e44502b6afcc526ae4a04eeae0424de2",
+        "rev": "aa1b7e2fb86c6c9f4557bcbe4071b7da0f3bef6f",
-        "revCount": 8,
+        "revCount": 10,
         "type": "git",
         "url": "ssh://gitea@gitea.linerds.us/unexplrd/nix-secrets"
       },

hosts/dunamis/configuration.nix

@@ -62,6 +62,14 @@
     fwupd.enable = true;
     openssh.enable = true;
     syncthing.openDefaultPorts = true;
+    dnscrypt-proxy2 = {
+      enable = true;
+      settings = {
+        require_dnssec = true;
+        server_names = ["mullvad-doh"];
+        bootstrap_resolvers = ["9.9.9.11:53" "9.9.9.9:53"];
+      };
+    };
     opensnitch = {
       enable = false;
       settings = {

hosts/dunamis/sops.nix

@@ -24,6 +24,11 @@ in {
         mode = "0400";
         owner = "user";
       };
+      "ssh-private-uni" = {
+        path = "/home/user/.ssh/id_uni_ed25519";
+        mode = "0400";
+        owner = "user";
+      };
     };
   };
 }

hosts/dunamis/users/user/home-configuration.nix

@@ -5,6 +5,7 @@
     self.homeModules.programs
     ./programs.nix
     ./flatpak.nix
+    ./sops.nix
   ];
   desktop.niri.enable = true;
   home = {

hosts/dunamis/users/user/sops.nix

@@ -1,20 +1,26 @@
 {inputs, ...}: let
   secretsPath = builtins.toString inputs.mysecrets;
 in {
-  imports = with inputs; [
+  # imports = with inputs; [
-    sops-nix.homeManagerModules.sops
+  #   sops-nix.homeManagerModules.sops
-  ];
+  # ];
+  # sops = {
+  # age.keyFile = "/var/lib/sops-nix/key.txt";
 
-  sops = {
+  # defaultSopsFile = "${secretsPath}/secrets.yaml";
-    age.keyFile = "/var/lib/sops-nix/key.txt";
+  # validateSopsFiles = false;
 
-    defaultSopsFile = "${secretsPath}/secrets.yaml";
+  # secrets = {
-    validateSopsFiles = false;
+  #   "ssh/private/dunamis-user" = {
-
+  #     path = "/home/user/.ssh/id_ed25519";
-    secrets = {
+  #   };
-      "ssh/private/dunamis-user" = {
+  # };
-        path = "/home/user/.ssh/id_ed25519";
+  home.file."id_ed25519_pub" = {
-      };
+    source = "${secretsPath}/ssh/user/id_dunamis_ed25519.pub";
+    target = ".ssh/id_ed25519.pub";
   };
+  home.file."id_uni_ed25519_pub" = {
+    source = "${secretsPath}/ssh/user/id_uni_ed25519.pub";
+    target = ".ssh/id_uni_ed25519.pub";
   };
 }

modules/home/desktop/niri/default.nix

@@ -389,7 +389,7 @@ in {
           down = "e";
           up = "i";
           right = "o";
-          niriConfig = ''
+        in ''
           environment {
               DISPLAY ":123"
               QT_QPA_PLATFORM "wayland"
@@ -405,13 +405,15 @@ in {
             keyboard {
               xkb {
                 layout "us,ua"
-                        // variant "colemak_dh,"
+                ${
-                        options "grp:menu_toggle"
+            if hostname == "dunamis"
+            then "// variant \"colemak_dhm,\""
+            else "variant \"colemak_dhm,\""
+          }
                 }
                 repeat-delay 200
                 repeat-rate 50
                 track-layout "global"
-
               }
               touchpad {
                 // off
@@ -431,15 +433,9 @@ in {
                 accel-profile "flat"
                 // scroll-method "no-scroll"
               }
-                /-touch {
-                  off
-                }
-
               warp-mouse-to-focus
-
               // focus-follows-mouse
           }
-
           output "eDP-1" {
               // off
               scale 1.2
@@ -653,7 +649,6 @@ in {
             Alt+XF86MonBrightnessUp    allow-when-locked=true { spawn "brightnessctl" "s" "5%+" "-d" "${keyboard}::kbd_backlight"; }
             Alt+XF86MonBrightnessDown  allow-when-locked=true { spawn "brightnessctl" "s" "5%-" "-d" "${keyboard}::kbd_backlight"; }
 
-
             Mod+Left      { focus-column-left; }
             Mod+Down      { focus-window-or-workspace-down; }
             Mod+Up        { focus-window-or-workspace-up; }
@@ -711,7 +706,6 @@ in {
             Mod+WheelScrollLeft             { focus-column-left; }
             Mod+Ctrl+WheelScrollRight       { move-column-right; }
             Mod+Ctrl+WheelScrollLeft        { move-column-left; }
-
             Mod+Shift+WheelScrollDown       { focus-column-right; }
             Mod+Shift+WheelScrollUp         { focus-column-left; }
             Mod+Ctrl+Shift+WheelScrollDown  { move-column-right; }
@@ -778,10 +772,6 @@ in {
             Mod+Ctrl+Shift+9 { move-column-to-workspace 9; }
           }
         '';
-        in
-          if hostname != "dunamis"
-          then (builtins.replaceStrings ["// variant \"colemak_dh,\""] ["variant \"colemak_dh,\""] niriConfig)
-          else niriConfig;
       };
     };
     programs.waybar = {