feat(sops): Added secrets for nix customization

host/ThinkPad/configuration.nix

@@ -12,7 +12,6 @@
       ./modules/thinkpad.nix
       ./modules/fingerprint.nix
       ./secrets/secrets.nix
-      ./modules/bottles.nix
 
     (import ../modules/common.nix {
       inherit lib;
@@ -34,6 +33,7 @@
 
   host.laptop = true;
 
+  programs.gamemode.enable = true;
   hardware.bluetooth.enable = true;
   services.printing.enable = true;
 }

host/ThinkPad/modules/bottles.nix

@@ -1,5 +0,0 @@
-{pkgs-stable, ...}: {
-  environment.systemPackages = with pkgs-stable; [
-    bottles
-  ];
-}

host/ThinkPad/modules/fingerprint.nix

@@ -152,79 +152,6 @@
     done
   '';
 
-  systemctl = lib.getExe' pkgs.systemd "systemctl";
-  busctl = lib.getExe' pkgs.systemd "busctl";
-  timeout = lib.getExe' pkgs.coreutils "timeout";
-  sleep = lib.getExe' pkgs.coreutils "sleep";
-  fprintdList = lib.getExe' pkgs.fprintd "fprintd-list";
-
-  # python-validity initializes the sensor before it registers with
-  # open-fprintd, so a successful ListEnrolledFingers call means the sensor is
-  # usable.  This is used as ExecStartPost and by greetd ordering.
-  waitForFprint = pkgs.writeShellScript "wait-for-fprint" ''
-    for ((i = 0; i < 120; i++)); do
-
-      devices="$(${timeout} 1 ${busctl} --system call \
-        net.reactivated.Fprint \
-        /net/reactivated/Fprint/Manager \
-        net.reactivated.Fprint.Manager GetDevices 2>/dev/null || true)"
-
-      if [[ "$devices" =~ ^ao\ [1-9] ]]; then
-        echo "wait-for-fprint: sensor initialized: $devices"
-        exit 0
-      fi
-
-      ${sleep} 0.5
-    done
-
-    echo "wait-for-fprint: sensor initialization timeout" >&2
-    exit 1
-  '';
-
-  # The xHCI controller is reset during resume, which invalidates
-  # python-validity's USB handle.  Restart it from a systemd-sleep hook: the
-  # hook runs before logind emits PrepareForSleep(false), so hyprlock's
-  # built-in fingerprint auth sees a working sensor as soon as it resumes.
-  fprintResumeHook = pkgs.writeShellScript "fprint-resume" ''
-    if [ "$1" != "post" ]; then
-      exit 0
-    fi
-
-    # Stop the old instance first so its stale D-Bus target cannot be selected
-    # by the readiness checks below.  Start without blocking because
-    # python-validity's ExecStartPost waits for fprintd, but open-fprintd is
-    # still suspended until Resume is called below.
-    ${timeout} 10 ${systemctl} stop python3-validity.service || true
-    ${systemctl} start --no-block python3-validity.service || true
-
-    # Clear open-fprintd's suspended flag.  This also unblocks the new
-    # python-validity instance's ExecStartPost.
-    ${timeout} 10 ${busctl} call net.reactivated.Fprint /net/reactivated/Fprint/Manager \
-      net.reactivated.Fprint.Manager Resume || true
-
-    # Wait for the new backend to register.
-    for ((i = 0; i < 30; i++)); do
-      if ${timeout} 0.5 ${fprintdList} root >/dev/null 2>&1; then
-        break
-      fi
-      ${sleep} 0.1
-    done
-
-    # The target now exists, so Resume reinitializes the sensor.  Wait for it
-    # to become responsive before logind starts hyprlock's fingerprint auth.
-    ${timeout} 10 ${busctl} call net.reactivated.Fprint /net/reactivated/Fprint/Manager \
-      net.reactivated.Fprint.Manager Resume || true
-
-    for ((i = 0; i < 30; i++)); do
-      if ${timeout} 0.5 ${fprintdList} root >/dev/null 2>&1; then
-        exit 0
-      fi
-      ${sleep} 0.1
-    done
-
-    echo "fprint-resume: fingerprint backend did not become ready" >&2
-  '';
-
   sleepTargets = [
     "suspend.target"
     "hibernate.target"
@@ -248,16 +175,9 @@ in {
     polkit-1.fprintAuth = true;
     sudo.fprintAuth = true;
     login.fprintAuth = true;
-
+    hyprlock.fprintAuth = true;
-    # hyprlock still needs a PAM service for password authentication, but it
-    # must not run pam_fprintd: its own D-Bus fingerprint implementation is
-    # used instead.  Two implementations would fight over the device, and the
-    # PAM one breaks when the sensor is reset across suspend.
-    hyprlock = {};
   };
 
-  environment.etc."systemd/system-sleep/50-fprint-resume".source = fprintResumeHook;
-
   systemd.services = {
     open-fprintd = {
       description = "Open FPrint daemon";
@@ -278,7 +198,6 @@ in {
       serviceConfig = {
         Type = "simple";
         ExecStart = "${python-validity}/bin/python-validity-service";
-        ExecStartPost = "-${waitForFprint}";
         Restart = "always";
         RestartSec = 2;
         RuntimeDirectory = "python-validity";
@@ -296,16 +215,16 @@ in {
         ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/suspend.py";
       };
     };
-  };
 
-  # The sleep hook above resumes open-fprintd before logind wakes the
+    open-fprintd-resume = {
-  # graphical session.  The stock open-fprintd-resume unit runs later and
+      description = "Resume open-fprintd backends";
-  # resets the sensor while hyprlock is already verifying, so it must not be
+      wantedBy = sleepTargets;
-  # enabled.  Order greetd (and therefore Hyprland/hyprlock) after the
+      after = sleepTargets;
-  # fingerprint backend so the first lock screen can use the sensor.
+      serviceConfig = {
-  systemd.services.greetd = {
+        Type = "oneshot";
-    after = [ "python3-validity.service" ];
+        ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/resume.py";
-    wants = [ "python3-validity.service" ];
+      };
+    };
   };
 
   environment.systemPackages = [

modules/user.nix

@@ -6,7 +6,7 @@
         ./user/ghostty.nix
         ./user/qt.nix
         ./user/helix.nix
-        #./user/zed-idea.nix
+        ./user/zed-idea.nix
         ./user/walker.nix
         ./user/btop.nix
         ./user/zsh.nix

modules/user/helix.nix

@@ -131,6 +131,7 @@ in {
     settings = {
       # theme = "catppuccin-mocha";
       editor = {
+        rulers = [ 81 ];
         insert-final-newline = false;
         indent-guides.render = true;
 

modules/user/sleepMode.nix

@@ -1,50 +1,8 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, lib, ... }:
 let
   hyprLua = import ./hyprland/lua.nix { inherit lib; };
-
-  hyprlock = lib.getExe pkgs.hyprlock;
-  hyprctl = lib.getExe' config.wayland.windowManager.hyprland.package "hyprctl";
-  loginctl = lib.getExe' pkgs.systemd "loginctl";
-  pidof = lib.getExe' pkgs.procps "pidof";
-  fprintdList = lib.getExe' pkgs.fprintd "fprintd-list";
-  timeout = lib.getExe' pkgs.coreutils "timeout";
-  sleepCmd = lib.getExe' pkgs.coreutils "sleep";
-  sh = lib.getExe pkgs.bash;
-
-  hyprlockWait = pkgs.writeShellScript "hyprlock-wait-fprint" ''
-    for i in $(seq 1 60); do
-      if ${timeout} 1 ${fprintdList} kirill >/dev/null 2>&1; then
-        break
-      fi
-      ${sleepCmd} 1
-    done
-    exec ${hyprlock}
-  '';
 in {
-  wayland.windowManager.hyprland.settings.on = [ (hyprLua.onStart [ "${hyprlockWait}" ]) ];
+  wayland.windowManager.hyprland.settings.on = [ (hyprLua.onStart [ "hyprlock" ]) ];
-
-  # Hypridle listens to logind's PrepareForSleep signal: it locks the session
-  # before suspend and makes sure hyprlock is running (and the display is on)
-  # after resume.
-  services.hypridle = {
-    enable = true;
-    settings = {
-      general = {
-        lock_cmd = "${pidof} hyprlock >/dev/null || ${hyprlockWait}";
-        before_sleep_cmd = "${loginctl} lock-session";
-        after_sleep_cmd = "${pidof} hyprlock >/dev/null || ${hyprlockWait} & ${hyprctl} dispatch 'hl.dsp.dpms({action = \"on\"})'";
-      };
-
-      # Hypridle requires at least one listener, so keep a no-op timer that
-      # practically never fires. Screen locking is driven by sleep/resume only.
-      listener = [
-        {
-          timeout = 604800; # 7 days
-          on-timeout = "";
-        }
-      ];
-    };
-  };
 
   programs.hyprlock = let
     image = pkgs.fetchurl {
@@ -56,17 +14,6 @@ in {
     enable = true;
 
     settings = {
-      # Hyprlock's built-in fingerprint support watches logind's
-      # PrepareForSleep signal and re-arms itself after resume.  PAM-based
-      # fingerprint auth (security.pam.services.hyprlock.fprintAuth) does not
-      # survive the fingerprint device being reset during suspend.
-      auth.fingerprint = {
-        enabled = true;
-        ready_message = "Scan fingerprint to unlock";
-        present_message = "Scanning...";
-        retry_delay = 250;
-      };
-
       background = {
         path = lib.mkForce "${image}";
         blur_passes = 0;