Compare commits

...
9 Commits
13 changed files with 674 additions and 89 deletions

No files matched your search

Generated
+93 -49
View File
@@ -80,11 +80,11 @@
"tg_owt": "tg_owt"
},
"locked": {
"lastModified": 1790620039,
"narHash": "sha256-vFY8jKgUupRGrcO9ZfVyVNwOLxRa7dqitXYwDUQqUaU=",
"lastModified": 1792306878,
"narHash": "sha256-x9gB1qSAWKDKiX3uW0Z5asE2XzxkCfdVk5B/Og+fDlo=",
"owner": "ayugram-port",
"repo": "ayugram-desktop",
"rev": "3015ae5439dd2c14f15c76c3d451610456fa140d",
"rev": "5aafef7f62261f9dacb4e95aed950a4cc379273e",
"type": "github"
},
"original": {
@@ -268,6 +268,28 @@
"type": "gitlab"
}
},
"helix-steel": {
"inputs": {
"nixpkgs": [
"nixpkgs"
],
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1792336814,
"narHash": "sha256-FU4WIMHhIyvEMxHeN8+Qgb3VHsU6DP74ylsyZACLzM8=",
"owner": "mattwparas",
"repo": "helix",
"rev": "16a26934f39152b5cd81bf2f6944e18e680314d0",
"type": "github"
},
"original": {
"owner": "mattwparas",
"ref": "steel-event-system",
"repo": "helix",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@@ -275,11 +297,11 @@
]
},
"locked": {
"lastModified": 1791569574,
"narHash": "sha256-5sViLmjhTCtBTvhjSXXvd5LDrAFMydFFKZQisjE8Vds=",
"lastModified": 1792495086,
"narHash": "sha256-TyoYH983Nsc++1scw0SoOEKshPSJWJDxK7tTmuZ974M=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "6b88c12cc6d234de4888f5d21076fb11199d0844",
"rev": "ec80131710bffcdf3b8498cf41f3a0579833b023",
"type": "github"
},
"original": {
@@ -440,11 +462,11 @@
]
},
"locked": {
"lastModified": 1791378645,
"narHash": "sha256-9Eix+ZUcI9IUklrtJAD9l/nTcS/Byz7fi94Y3InxS2Y=",
"lastModified": 1792508453,
"narHash": "sha256-y+V5RFJcjnV1+ZzImkfiSJ97iDIflanjP2OR9lemvTs=",
"owner": "hyprwm",
"repo": "hyprland-plugins",
"rev": "428bfcd1c9ee34965400bb359349f518140c9920",
"rev": "d2427d4d15b36df40468f5a58bbd67cdba19835d",
"type": "github"
},
"original": {
@@ -672,11 +694,11 @@
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1791426274,
"narHash": "sha256-MWhktfFtFE8Jl7bf9Pkp7TR5MSdYCjCswSo0Gkb4ywc=",
"lastModified": 1792503283,
"narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "7c8764b7c7b09b34f632464276218ef9090eaa11",
"rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
"type": "github"
},
"original": {
@@ -688,11 +710,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1790463110,
"narHash": "sha256-hKlVl12B1dF0Q5vd9dY3lIJM5mFGWYSlXwSLAqHZ1+s=",
"lastModified": 1792094642,
"narHash": "sha256-zp8ToDMnqZcu4o4IH9pdwXFXGp7yLm/M0dEnNWnyd7I=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "e158d9ed9b51c98974c5e66e1ba1c9e0255fecaa",
"rev": "fe13242281a67641c0102cdb1087f0ebe586c7df",
"type": "github"
},
"original": {
@@ -720,11 +742,11 @@
},
"nixpkgs_4": {
"locked": {
"lastModified": 1791456040,
"narHash": "sha256-H83yz/do+hjOO0uujHyH8RgtIQP2v7Mw+cLwcZK/xKc=",
"lastModified": 1792502884,
"narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "e7439b6b14ad3cc35d05608ebca9bce01a25f5f8",
"rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
"type": "github"
},
"original": {
@@ -736,11 +758,11 @@
},
"nixpkgs_5": {
"locked": {
"lastModified": 1790769526,
"narHash": "sha256-5AIVFLRcx8YAwbFTVPTs7YhwJH7JyHfAQsvXmpovcXI=",
"lastModified": 1791487292,
"narHash": "sha256-tqM7xDEsaeK1p6VvRygeZ9LkQRpUUkbRT02BHv6hnTM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c9fe7d12cd78d1adcd12dd15e24432dde5b155a0",
"rev": "8edc0c72e3a38faf5434e40d1f19431125fe4b30",
"type": "github"
},
"original": {
@@ -784,11 +806,11 @@
},
"nixpkgs_8": {
"locked": {
"lastModified": 1791456040,
"narHash": "sha256-H83yz/do+hjOO0uujHyH8RgtIQP2v7Mw+cLwcZK/xKc=",
"lastModified": 1792502884,
"narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "e7439b6b14ad3cc35d05608ebca9bce01a25f5f8",
"rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
"type": "github"
},
"original": {
@@ -849,6 +871,7 @@
"inputs": {
"ags": "ags",
"ayugram-desktop": "ayugram-desktop",
"helix-steel": "helix-steel",
"home-manager": "home-manager",
"hyprland": "hyprland",
"hyprland-plugins": "hyprland-plugins",
@@ -866,11 +889,11 @@
"russia-blocked-geoip": {
"flake": false,
"locked": {
"lastModified": 1791541118,
"narHash": "sha256-nFzXcNfeaujgzCkwTVxk+FJO5fpnGjN0iFjoO+rSHpI=",
"lastModified": 1792592746,
"narHash": "sha256-hDb67lqlxWt3iBsRvxWdE7G4Eg+JEyNRQo7OTqzaDRI=",
"owner": "runetfreedom",
"repo": "russia-blocked-geoip",
"rev": "8a0bb95551940aa0f88e1699687160d19ac1ea51",
"rev": "8898c3b0d779b8aa05b933b97022d7458af2df8d",
"type": "github"
},
"original": {
@@ -881,6 +904,27 @@
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"helix-steel",
"nixpkgs"
]
},
"locked": {
"lastModified": 1775358767,
"narHash": "sha256-f2eC+WIfhjevCPQILuV08i/kmKZzYZpUvkom/33VxCA=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "20fd44bc663daa53a2575e01293e24e681d62244",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"rust-overlay_2": {
"inputs": {
"nixpkgs": [
"yazi",
@@ -906,11 +950,11 @@
"nixpkgs": "nixpkgs_5"
},
"locked": {
"lastModified": 1791103873,
"narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
"lastModified": 1792056300,
"narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
"rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
"type": "github"
},
"original": {
@@ -937,11 +981,11 @@
"tinted-zed": "tinted-zed"
},
"locked": {
"lastModified": 1790880877,
"narHash": "sha256-j42XqSKOAtuqtfHiElyHre2YS/h3Y3q1DjFnKODN1/k=",
"lastModified": 1791574276,
"narHash": "sha256-UMnLnZ3JlA7UTBNNNx1rNsXYoPP/cirXLCKGiQ/yDx8=",
"owner": "danth",
"repo": "stylix",
"rev": "7c065d1ed05381fceb2403b963c5ad150f32fe39",
"rev": "2856c4c6a845b9bec98828ef197abe176e4806bb",
"type": "github"
},
"original": {
@@ -1004,11 +1048,11 @@
]
},
"locked": {
"lastModified": 1789877109,
"narHash": "sha256-gFYDctvZQdqpKkSYf/QJZwRkQM2YPQ3wHfUxHIP8cDM=",
"lastModified": 1791698670,
"narHash": "sha256-D4GTULEDsGmk4ue01cetWZ6E/emb3FrUys612rg7a5E=",
"owner": "ndfined-crp",
"repo": "tg_owt",
"rev": "25a781fb72647a14adee9f764761c5c8b773c6b0",
"rev": "29330d167ede474885e8aa87b037769cb1cabfc9",
"type": "github"
},
"original": {
@@ -1126,14 +1170,14 @@
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs_7",
"rust-overlay": "rust-overlay"
"rust-overlay": "rust-overlay_2"
},
"locked": {
"lastModified": 1791533868,
"narHash": "sha256-KcNMm4C+07B4ukgs23tQYUi8DDGljSdQBZl3+Ibt0Pk=",
"lastModified": 1792507858,
"narHash": "sha256-EEfOrxveuFcXigE5frf6U5rzw1JdzRZ9IcSZzysnHGA=",
"owner": "sxyazi",
"repo": "yazi",
"rev": "1091972581e0d23ed575be967e9a6ef75a17474b",
"rev": "7c45837d553b6cb8032bd7fec2106fdb628e4017",
"type": "github"
},
"original": {
@@ -1145,11 +1189,11 @@
"yazi-plugins": {
"flake": false,
"locked": {
"lastModified": 1790956605,
"narHash": "sha256-/BNGoWziHIZ9i+RoTWGq/q3ZowNCyHGBOWiz8v2/vOE=",
"lastModified": 1792088615,
"narHash": "sha256-3ddGRQSzxyurNcyYJA+9LTLXTCjBFGATTqdkuGKixzA=",
"owner": "yazi-rs",
"repo": "plugins",
"rev": "6229767f7fef39a2a78f5cee9122cc4dfb43f327",
"rev": "9166202cc1694c98bac3a639874d6f4c0eaa2dab",
"type": "github"
},
"original": {
@@ -1164,11 +1208,11 @@
"zapret-flowseal": "zapret-flowseal"
},
"locked": {
"lastModified": 1790422884,
"narHash": "sha256-va22R1zFF7JmibmFwezLYfRup8PfVO3pV7toQH+cbL0=",
"lastModified": 1792489877,
"narHash": "sha256-4/g+qlw4G+2ACSww4vaRsJVLihREjf0eBwofDmeuTns=",
"owner": "kartavkun",
"repo": "zapret-discord-youtube",
"rev": "b82f45c363506588afbb45fefe41fe4670ae1480",
"rev": "69b88b5e51242ddacd87109f31e028e1bef553f6",
"type": "github"
},
"original": {
@@ -1180,11 +1224,11 @@
"zapret-flowseal": {
"flake": false,
"locked": {
"lastModified": 1790845315,
"narHash": "sha256-zhyCW0LFkWkByHu2Vfgita8Bh3lIexUemGyz9elekUQ=",
"lastModified": 1792471264,
"narHash": "sha256-5qKg2BvW4XcjY+Az9ocvwACcfsfBpG4I3Xh6SCPksIM=",
"owner": "Flowseal",
"repo": "zapret-discord-youtube",
"rev": "eb16c1419057e36b8a36fbe7c959483450e6ac8b",
"rev": "176f56dc3f11ce5915c26abcdde903f93d835b64",
"type": "github"
},
"original": {
+5
View File
@@ -52,6 +52,11 @@
inputs.nixpkgs.follows = "nixpkgs";
};
helix-steel = {
url = "github:mattwparas/helix/steel-event-system";
inputs.nixpkgs.follows = "nixpkgs";
};
russia-blocked-geoip = {
url = "github:runetfreedom/russia-blocked-geoip/release";
flake = false;
+1 -1
View File
@@ -12,6 +12,7 @@
./modules/thinkpad.nix
./modules/fingerprint.nix
./secrets/secrets.nix
./modules/bottles.nix
(import ../modules/common.nix {
inherit lib;
@@ -33,7 +34,6 @@
host.laptop = true;
programs.gamemode.enable = true;
hardware.bluetooth.enable = true;
services.printing.enable = true;
}
+5
View File
@@ -0,0 +1,5 @@
{pkgs-stable, ...}: {
environment.systemPackages = with pkgs-stable; [
bottles
];
}
+311 -16
View File
@@ -1,20 +1,315 @@
{ config, ... }: {
services.fprintd.enable = true;
{ lib, pkgs, ... }: let
pythonValidityPatch = pkgs.writeText "python-validity-python-3.14.patch" ''
diff --git a/validitysensor/flash.py b/validitysensor/flash.py
index d37f15a..be3d4a1 100644
--- a/validitysensor/flash.py
+++ b/validitysensor/flash.py
@@ -34,6 +34,10 @@ def get_flash_info():
rsp = tls.cmd(unhex('3e'))
assert_status(rsp)
rsp = rsp[2:]
+ if len(rsp) < 0xe:
+ # An uninitialised 06cb:009a returns only the success status word.
+ # Let init_flash() format it instead of failing in struct.unpack().
+ return FlashInfo(None, 0, 0, 0, 0, [])
hdr = rsp[:0xe]
rsp = rsp[0xe:]
jid0, jid1, blocks, unknown0, blocksize, unknown1, pcnt = unpack('<HHHHHHH', hdr)
diff --git a/validitysensor/init.py b/validitysensor/init.py
index 18890c5..710668c 100644
--- a/validitysensor/init.py
+++ b/validitysensor/init.py
@@ -25,8 +25,8 @@ def close():
security.pam.services = {
sudo.fprintAuth = true;
login.fprintAuth = false;
hyprlock.fprintAuth = false;
};
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (action.id == "net.reactivated.fprint.device.enroll" &&
subject.isInGroup("fprint")) {
return polkit.Result.YES;
}
});
def open_common():
init_data_dir()
- init_flash()
usb.send_init()
+ init_flash()
tls.parse_tls_flash(read_tls_flash())
tls.open()
upload_fwext()
diff --git a/validitysensor/usb.py b/validitysensor/usb.py
index 9db2b07..353b2c7 100644
--- a/validitysensor/usb.py
+++ b/validitysensor/usb.py
@@ -1,6 +1,7 @@
import errno
import logging
+import time
import typing
from binascii import hexlify, unhexlify
from enum import Enum
from struct import unpack
@@ -68,22 +69,32 @@ class Usb:
def close(self):
if self.dev is not None:
try:
self.dev.reset()
self.dev = None
except:
pass
${" "}
def usb_dev(self):
return self.dev
${" "}
+ def cmd_retry_busy(self, command: bytes):
+ # Metallica sensors can report 0x0104 for a few seconds after wake-up.
+ for _ in range(20):
+ rsp = self.cmd(command)
+ status, = unpack('<H', rsp[:2])
+ if status != 0x0104:
+ return rsp
+ time.sleep(0.5)
+ return rsp
+
def send_init(self):
# self.dev.set_configuration()
${" "}
# TODO analyse responses, detect hardware type
- assert_status(self.cmd(unhexlify('01'))) # RomInfo.get()
+ assert_status(self.cmd_retry_busy(unhexlify('01'))) # RomInfo.get()
assert_status(self.cmd(unhexlify('19')))
${" "}
# 43 -- get partition header(?) (02 -- fwext partition)
# c28c745a in response is a FwextBuildtime = 0x5A748CC2
- rsp = self.cmd(unhexlify('4302')) # get_fw_info()
+ rsp = self.cmd_retry_busy(unhexlify('4302')) # get_fw_info()
${" "}
'';
users.users.kirill.extraGroups = [ "fprint" ];
python-validity = pkgs.python3Packages.buildPythonApplication rec {
pname = "python-validity";
version = "0.15-unstable-2020-12-14";
pyproject = true;
src = pkgs.fetchFromGitHub {
owner = "uunicorn";
repo = "python-validity";
rev = "a6bbc21dce7b8b3c3cd92378a0b2579a2fb45920";
hash = "sha256-RflX7e6nd11pSg8mh3mjZiVGNUSdox/SKXHR4W+PhMs=";
};
postPatch = ''
${lib.getExe pkgs.gitMinimal} apply ${pythonValidityPatch}
'';
build-system = [ pkgs.python3Packages.setuptools ];
dependencies = with pkgs.python3Packages; [
cryptography
dbus-python
pygobject3
pyusb
pyyaml
];
nativeBuildInputs = [ pkgs.makeWrapper ];
postInstall = ''
install -Dm755 dbus_service/dbus-service \
"$out/lib/python-validity/dbus-service"
install -Dm644 dbus_service/io.github.uunicorn.Fprint.conf \
"$out/share/dbus-1/system.d/io.github.uunicorn.Fprint.conf"
install -Dm755 dbus_service/dbus-service \
"$out/bin/python-validity-service"
install -Dm755 scripts/factory-reset.py \
"$out/bin/validity-factory-reset"
install -d "$out/share/python-validity/playground"
install -m755 \
scripts/dbus-cmd.py \
scripts/lsdbus.py \
scripts/factory-reset.py \
scripts/prototype.py \
"$out/share/python-validity/playground/"
'';
postFixup = ''
wrapProgram "$out/bin/validity-sensors-firmware" \
--prefix PATH : ${lib.makeBinPath [
pkgs.findutils
pkgs.innoextract
]}
'';
# Upstream does not have an automated test suite.
doCheck = false;
meta = {
description = "Userspace driver for Validity and Synaptics fingerprint sensors";
homepage = "https://github.com/uunicorn/python-validity";
license = lib.licenses.mit;
platforms = lib.platforms.linux;
};
};
fprintd-clients = pkgs.runCommand "fprintd-clients" { } ''
mkdir -p "$out/bin"
for client in fprintd-delete fprintd-enroll fprintd-list fprintd-verify; do
ln -s "${pkgs.fprintd}/bin/$client" "$out/bin/$client"
done
'';
systemctl = lib.getExe' pkgs.systemd "systemctl";
busctl = lib.getExe' pkgs.systemd "busctl";
timeout = lib.getExe' pkgs.coreutils "timeout";
sleep = lib.getExe' pkgs.coreutils "sleep";
fprintdList = lib.getExe' pkgs.fprintd "fprintd-list";
# python-validity initializes the sensor before it registers with
# open-fprintd, so a successful ListEnrolledFingers call means the sensor is
# usable. This is used as ExecStartPost and by greetd ordering.
waitForFprint = pkgs.writeShellScript "wait-for-fprint" ''
for ((i = 0; i < 120; i++)); do
devices="$(${timeout} 1 ${busctl} --system call \
net.reactivated.Fprint \
/net/reactivated/Fprint/Manager \
net.reactivated.Fprint.Manager GetDevices 2>/dev/null || true)"
if [[ "$devices" =~ ^ao\ [1-9] ]]; then
echo "wait-for-fprint: sensor initialized: $devices"
exit 0
fi
${sleep} 0.5
done
echo "wait-for-fprint: sensor initialization timeout" >&2
exit 1
'';
# The xHCI controller is reset during resume, which invalidates
# python-validity's USB handle. Restart it from a systemd-sleep hook: the
# hook runs before logind emits PrepareForSleep(false), so hyprlock's
# built-in fingerprint auth sees a working sensor as soon as it resumes.
fprintResumeHook = pkgs.writeShellScript "fprint-resume" ''
if [ "$1" != "post" ]; then
exit 0
fi
# Stop the old instance first so its stale D-Bus target cannot be selected
# by the readiness checks below. Start without blocking because
# python-validity's ExecStartPost waits for fprintd, but open-fprintd is
# still suspended until Resume is called below.
${timeout} 10 ${systemctl} stop python3-validity.service || true
${systemctl} start --no-block python3-validity.service || true
# Clear open-fprintd's suspended flag. This also unblocks the new
# python-validity instance's ExecStartPost.
${timeout} 10 ${busctl} call net.reactivated.Fprint /net/reactivated/Fprint/Manager \
net.reactivated.Fprint.Manager Resume || true
# Wait for the new backend to register.
for ((i = 0; i < 30; i++)); do
if ${timeout} 0.5 ${fprintdList} root >/dev/null 2>&1; then
break
fi
${sleep} 0.1
done
# The target now exists, so Resume reinitializes the sensor. Wait for it
# to become responsive before logind starts hyprlock's fingerprint auth.
${timeout} 10 ${busctl} call net.reactivated.Fprint /net/reactivated/Fprint/Manager \
net.reactivated.Fprint.Manager Resume || true
for ((i = 0; i < 30; i++)); do
if ${timeout} 0.5 ${fprintdList} root >/dev/null 2>&1; then
exit 0
fi
${sleep} 0.1
done
echo "fprint-resume: fingerprint backend did not become ready" >&2
'';
sleepTargets = [
"suspend.target"
"hibernate.target"
"hybrid-sleep.target"
"suspend-then-hibernate.target"
];
in {
services = {
# The 06cb:009a sensor is driven by python-validity through open-fprintd;
# stock fprintd/libfprint cannot handle it.
fprintd.enable = false;
dbus.packages = [
pkgs.open-fprintd
python-validity
];
};
security.pam.services = {
greetd.fprintAuth = true;
polkit-1.fprintAuth = true;
sudo.fprintAuth = true;
login.fprintAuth = true;
# hyprlock still needs a PAM service for password authentication, but it
# must not run pam_fprintd: its own D-Bus fingerprint implementation is
# used instead. Two implementations would fight over the device, and the
# PAM one breaks when the sensor is reset across suspend.
hyprlock = {};
};
environment.etc."systemd/system-sleep/50-fprint-resume".source = fprintResumeHook;
systemd.services = {
open-fprintd = {
description = "Open FPrint daemon";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "dbus";
BusName = "net.reactivated.Fprint";
ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/open-fprintd";
Restart = "on-failure";
};
};
python3-validity = {
description = "python-validity fingerprint sensor backend";
wantedBy = [ "multi-user.target" ];
after = [ "open-fprintd.service" ];
wants = [ "open-fprintd.service" ];
serviceConfig = {
Type = "simple";
ExecStart = "${python-validity}/bin/python-validity-service";
ExecStartPost = "-${waitForFprint}";
Restart = "always";
RestartSec = 2;
RuntimeDirectory = "python-validity";
RuntimeDirectoryMode = "0700";
RuntimeDirectoryPreserve = "yes";
};
};
open-fprintd-suspend = {
description = "Suspend open-fprintd backends";
wantedBy = sleepTargets;
before = sleepTargets;
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/suspend.py";
};
};
};
# The sleep hook above resumes open-fprintd before logind wakes the
# graphical session. The stock open-fprintd-resume unit runs later and
# resets the sensor while hyprlock is already verifying, so it must not be
# enabled. Order greetd (and therefore Hyprland/hyprlock) after the
# fingerprint backend so the first lock screen can use the sensor.
systemd.services.greetd = {
after = [ "python3-validity.service" ];
wants = [ "python3-validity.service" ];
};
environment.systemPackages = [
fprintd-clients
python-validity
];
}
-1
View File
@@ -13,7 +13,6 @@
services = {
fwupd.enable = true;
thermald.enable = true;
fprintd.enable = true;
logind.settings.Login = {
HandleLidSwitch = "suspend-then-hibernate";
+2 -2
View File
@@ -5,13 +5,13 @@
./user/sleepMode.nix
./user/ghostty.nix
./user/qt.nix
./user/zed-idea.nix
./user/helix.nix
#./user/zed-idea.nix
./user/walker.nix
./user/btop.nix
./user/zsh.nix
./user/packages/utils.nix
./user/packages/desktop.nix
./user/packages/kdenlive.nix
./user/quickshell.nix
./user/wob.nix
./user/secrets.nix
+192
View File
@@ -0,0 +1,192 @@
{ inputs, pkgs, lib, config, ... }: let
# glibc >= 2.44 defines bsearch() as a C23 const-generic macro, which clashes
# with the copy vendored by some tree-sitter grammars (tree-sitter-perl).
# Drop the vendored implementation, same as nixpkgs does for upstream helix.
patchedStdenv = pkgs.stdenv // {
mkDerivation = args: pkgs.stdenv.mkDerivation (args // {
postPatch = (args.postPatch or "") + ''
if [ -e src/bsearch.c ]; then
rm src/bsearch.c
substituteInPlace src/tsp_unicode.h \
--replace-fail '#include "bsearch.c"' ""
fi
'';
});
};
helixGrammars = pkgs.callPackage "${inputs.helix-steel}/grammars.nix" {
stdenv = patchedStdenv;
};
helixSteel =
(
pkgs.callPackage "${inputs.helix-steel}/default.nix" {
gitRev = inputs.helix-steel.rev;
# The upstream flake builds the grammars with its own callPackage,
# swap in the patched ones.
callPackage = path: args:
if toString path == toString "${inputs.helix-steel}/grammars.nix" then helixGrammars
else pkgs.callPackage path args;
}
)
.overrideAttrs (old: {
cargoBuildFlags = (old.cargoBuildFlags or []) ++ [
"--features"
"steel,git"
];
});
comment-headers = pkgs.fetchurl {
url = "https://github.com/codingvivi/comment-dividers.hx/raw/refs/heads/main/comment_headers.scm";
name = "comment_headers.scm";
hash = "sha256-ohgn6DFJl0rdRJuri6Frs/uUlUsPxMvPHDuw4FS3qEE=";
};
patched-comment-headers = pkgs.runCommand "comment_headers.scm" { } ''
install -m 0644 ${comment-headers} "$out"
${pkgs.python3}/bin/python3 - <<'PY'
from pathlib import Path
import os
import sys
p = Path(os.environ["out"])
s = p.read_text()
start_marker = "(define (get-block-delims)"
end_marker = "(define (delete_till_first_nonwhitespace!)"
try:
start = s.index(start_marker)
end = s.index(end_marker, start)
except ValueError as e:
sys.exit(f"failed to find function markers: {e}")
new_get_block_delims = """(define (get-block-delims)
(helix.static.open_above)
(helix.static.insert_string "test_string")
(helix.static.normal_mode)
(helix.static.extend_to_line_bounds)
(helix.static.trim_selections)
(helix.static.toggle_comments)
(let* ([commented-test-string (helix.static.current-highlighted-text!)]
[strings-without-whitespace (split-whitespace commented-test-string)])
(delete-line-noyank!)
(cond
[(and (> (length strings-without-whitespace) 1)
(equal? (last strings-without-whitespace) "test_string"))
(list (first strings-without-whitespace) "")]
[(> (length strings-without-whitespace) 2)
(list (first strings-without-whitespace) (last strings-without-whitespace))]
[else
(list "" "")])))
"""
s = s[:start] + new_get_block_delims + s[end:]
old = "(make-line line-length fill-pattern #f padding-pattern)"
new = "(make-line line-length \"\" fill-pattern padding-pattern)"
if old not in s:
sys.exit("failed to find insert-divider make-line call")
s = s.replace(old, new)
p.write_text(s)
PY
'';
in {
home.packages = with pkgs; [
steel
wakatime-cli
];
# Wakapi is WakaTime-compatible, so the same plugin/client works.
sops.templates.".wakatime.cfg" = {
path = "${config.home.homeDirectory}/.wakatime.cfg";
mode = "0600";
content = ''
[settings]
api_url = https://coding.srcoder.moe/api
api_key = ${config.sops.placeholder."tokens/apis/wakapi"}
'';
};
home.activation.installWakatimeHx = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
export PATH="${pkgs.steel}/bin:$PATH"
export STEEL_HOME="${config.xdg.dataHome}/steel"
if [ ! -f "$STEEL_HOME/cogs/wakatime/wakatime.scm" ]; then
forge pkg install --git https://github.com/Xerxes-2/wakatime.hx.git
fi
'';
programs.helix = {
enable = true;
package = helixSteel;
defaultEditor = true;
settings = {
# theme = "catppuccin-mocha";
editor = {
insert-final-newline = false;
indent-guides.render = true;
whitespace.render = {
space = "all";
tab = "all";
nbsp = "none";
nnbsp = "none";
newline = "none";
};
cursor-shape = {
normal = "block";
insert = "bar";
select = "underline";
};
};
keys.normal = {
space = {
C-c = {
h = ":comment-h1";
j = ":comment-h2";
k = ":comment-h3";
d = ":comment-divider";
};
};
S-down = ["extend_to_line_bounds" "delete_selection" "paste_after"];
S-up = ["extend_to_line_bounds" "delete_selection" "move_line_up" "paste_before"];
};
};
};
xdg.configFile = {
"helix/cogs/comment_headers.scm".source = patched-comment-headers;
"helix/helix.scm".text = ''
(require (prefix-in div. "cogs/comment_headers.scm"))
(provide comment-h1 comment-h2 comment-h3 comment-divider)
(define (comment-h1)
(div.insert-h1!))
(define (comment-h2)
(div.insert-h2!))
(define (comment-h3)
(div.insert-h3!))
(define (comment-divider)
(div.insert-divider! 80 "~"))
'';
"helix/init.scm".text = ''
;; Steel init file
(require "wakatime/wakatime.scm")
'';
};
}
-5
View File
@@ -1,5 +0,0 @@
{ pkgs, ... }: {
home.packages = with pkgs; [
heroic
];
}
-5
View File
@@ -1,5 +0,0 @@
{ pkgs, ... }: {
home.packages = with pkgs; [
kdePackages.kdenlive
];
}
+1
View File
@@ -4,5 +4,6 @@
age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
secrets."tokens/apis/wallhaven" = {};
secrets."tokens/apis/wakapi" = {};
};
}
+55 -2
View File
@@ -1,8 +1,50 @@
{ pkgs, lib, ... }:
{ config, pkgs, lib, ... }:
let
hyprLua = import ./hyprland/lua.nix { inherit lib; };
hyprlock = lib.getExe pkgs.hyprlock;
hyprctl = lib.getExe' config.wayland.windowManager.hyprland.package "hyprctl";
loginctl = lib.getExe' pkgs.systemd "loginctl";
pidof = lib.getExe' pkgs.procps "pidof";
fprintdList = lib.getExe' pkgs.fprintd "fprintd-list";
timeout = lib.getExe' pkgs.coreutils "timeout";
sleepCmd = lib.getExe' pkgs.coreutils "sleep";
sh = lib.getExe pkgs.bash;
hyprlockWait = pkgs.writeShellScript "hyprlock-wait-fprint" ''
for i in $(seq 1 60); do
if ${timeout} 1 ${fprintdList} kirill >/dev/null 2>&1; then
break
fi
${sleepCmd} 1
done
exec ${hyprlock}
'';
in {
wayland.windowManager.hyprland.settings.on = [ (hyprLua.onStart [ "hyprlock" ]) ];
wayland.windowManager.hyprland.settings.on = [ (hyprLua.onStart [ "${hyprlockWait}" ]) ];
# Hypridle listens to logind's PrepareForSleep signal: it locks the session
# before suspend and makes sure hyprlock is running (and the display is on)
# after resume.
services.hypridle = {
enable = true;
settings = {
general = {
lock_cmd = "${pidof} hyprlock >/dev/null || ${hyprlockWait}";
before_sleep_cmd = "${loginctl} lock-session";
after_sleep_cmd = "${pidof} hyprlock >/dev/null || ${hyprlockWait} & ${hyprctl} dispatch 'hl.dsp.dpms({action = \"on\"})'";
};
# Hypridle requires at least one listener, so keep a no-op timer that
# practically never fires. Screen locking is driven by sleep/resume only.
listener = [
{
timeout = 604800; # 7 days
on-timeout = "";
}
];
};
};
programs.hyprlock = let
image = pkgs.fetchurl {
@@ -14,6 +56,17 @@ in {
enable = true;
settings = {
# Hyprlock's built-in fingerprint support watches logind's
# PrepareForSleep signal and re-arms itself after resume. PAM-based
# fingerprint auth (security.pam.services.hyprlock.fprintAuth) does not
# survive the fingerprint device being reset during suspend.
auth.fingerprint = {
enabled = true;
ready_message = "Scan fingerprint to unlock";
present_message = "Scanning...";
retry_delay = 250;
};
background = {
path = lib.mkForce "${image}";
blur_passes = 0;
+9 -8
View File
@@ -1,18 +1,19 @@
tokens:
apis:
wallhaven: ENC[AES256_GCM,data:pW9QiCB8yM2xSZQG96qCKOGOJbSFFrFxu8s1tHfmzWw=,iv:sezKkABxqVtd3mK8+WxEDPd+GtpyBcUJVLDlj/D68nU=,tag:HWE2QZf66dZGjK21WcxtiA==,type:str]
wallhaven: ENC[AES256_GCM,data:yO+thw4xgpMBuNx2LyxguDxAzoKSeDCyAAOcgtTxx74=,iv:j3LGKXnmykTamSuuIFbACT0kRDFazOhNEgWtVoxiWK4=,tag:jLaJrcUmDuxVj1D65NZhyg==,type:str]
wakapi: ENC[AES256_GCM,data:B4BOqy6TyZj4qPB9H7Ne+XaW701tX+ho8dMn0EGvqzdVOKq+,iv:/P6KZV9KgIBXslB3yZD5G3XER279iJ6/R2n+ZdTaBLs=,tag:r/SDXjofl8DdDlzP9Xo5mQ==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUVVBNekFNbWNhSEx1d0c0
NHRNWW9iR3FSMnZIMkRKQy9pTTIzV2R6VG1BClJ4clI5SzRCTnJhZ25JSEJ3dkFF
QVE4VUt3YXBKZnRES3dXSjJxM2RJU0kKLS0tIExKci9iQWJ4VVdyU1dteVZXb21k
S1VhaW5rQVkzUWMweHdNaThmblRYWWMKrhP0P4ftPNKfjss5JDa4SESSYXdop/U/
uIfI1RPTXbReF124NIIEvJ6AsiQKDDCjpgT0m/1i/U3yIF1UejPiQg==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MXcwbkFxZ2R4V0ppOGo3
UmFsTTJGekQ0NGVtTFpCRm50ekxJcEZUUW1FCkF5aStVckVNaVJndmptdnhtNjgx
Z056TVF5ZVRuMWJZKzk1WlRZTXN3bjAKLS0tIEhHd1JyTkhIdjJuZVZtSFlTRXIy
cTRWRkZXUmcrcHRXU2pyTzh1OGhaSkkKiqYLrPm1zS0PfrIeUnZHXvvHcY15PxDS
01jUzubGavkuOXb0hJmr6oBkEkSMBW+GLewduqj0SxGF2yxTSkM0kQ==
-----END AGE ENCRYPTED FILE-----
recipient: age1tx6jdr6535xxeygpwkkgvdwc24tulr420cm7gk56xzfp0slzeqks2nwpyg
lastmodified: "2026-10-17T13:36:46Z"
mac: ENC[AES256_GCM,data:stlsKKQhQL6+utokuXvNZH1dlWfEeUa5nORN5eQnbNcXbo1MrFVz9wVDqVtpgZOc3/v8p4YaHXLhQl8/RpawAwQH03gvcZ5zt1aA+Z7K6yh9ONRSnwz2lUXwCbpaf0xYRIlzv7pSPBJdLfYSN3kaEwVKrItAsPxuHEI/WEh8M3Y=,iv:W1vLWvQ7b635MpbUC7m3ATBPa/MujvAji2/MN9kldq4=,tag:DlVg1LCVvjPOg4nRP3rjAA==,type:str]
lastmodified: "2026-10-21T17:46:52Z"
mac: ENC[AES256_GCM,data:mLdD78pb0Qf30+l/igb+jXMHxNXTXJPNtsi3cGeEgYLKxnx02OVBuOnncMZvN351yh7h5if9pCqwCJeOISWU8uFZrQdJeDjdmIPlP1eqzBQ7fK4fhEeRzAcn4dTQ5tcmu3uXmWElKcBYhMFEPr3/etyfDcX5ZFwOra8wUqU8nq4=,iv:TydKNjO5stupovtCF/rHMtr1Da2IFafMZiLQxsln1uA=,tag:kXl5eELy9I5APJkAQ8tk3w==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3