ZionOS

.sops.yaml

@@ -0,0 +1,12 @@
+keys:
+  users:
+    - &rap_zion age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf
+    - &kubex age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr
+    - &firefly age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp
+creation_rules:
+  - path_regex: secrets/common/ssh.yaml$
+    key_groups:
+      - age:
+          - *rap_zion
+          - *kubex
+          - *firefly

README.md

@@ -45,9 +45,9 @@ nh home switch -c nix@firefly .
 # nix build installer iso
 nix build .#nixosConfigurations.vinox.config.system.build.isoImage
 
-# nh remote switch
-nh os switch --hostname kubex . -d always --target-host kubex
-nh os switch --hostname nixberry . -d always --target-host <IP>
+# nh remote switch / update
+nh os boot --hostname kubex . -d always --target-host kubex
+nh os boot --hostname nixberry . -d always --target-host <IP>
 
 # nix remote switch
 nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo

TASK.md

@@ -0,0 +1,26 @@
+# Sway Home-Manager Module Task List
+
+- [x] Inspect the existing Hyprland Home Manager module and keybinding file to identify the small shared surface worth migrating.
+- [x] Confirm first-iteration scope:
+  - Sway is additive alongside Hyprland.
+  - Do not migrate Hyprland addons or wallpapers.
+  - Only migrate keybindings and core Hyprland config where Sway has a simple equivalent.
+  - Ignore the `configOnly` options its only for hyprland
+- [x] Create a new `modules/home/desktops/sway/default.nix` Home Manager module with a minimal option surface modeled after Hyprland.
+- [x] Keep the Sway role option surface intentionally small for the first pass:
+  - `enable`
+  - `autostart`
+  - package option only if needed by the Home Manager Sway module
+- [x] Translate the relevant Hyprland core config into Sway equivalents:
+  - session environment variables
+  - keyboard layout / variant / repeat settings
+  - gaps and border settings
+  - basic floating / assignment rules where Sway supports an equivalent
+- [x] Migrate the current Hyprland key mapping into an initial Sway binding set, simplifying or dropping Hyprland-only behavior where there is no cheap equivalent.
+- [x] Keep side-by-side enablement conflict-aware:
+  - avoid migrating portal config unless Sway specifically needs separate wiring
+  - avoid addon-specific services and wallpaper handling
+- [x] Enable the Sway role in the target Home Manager host configuration without removing Hyprland.
+- [x] Run focused validation on the edited Nix files and fix syntax or module errors from the first pass.
+- [x] Summarize what was migrated directly, what was simplified, and what remains intentionally Hyprland-only.
+- [x] Update the docs for firefly, to create all necessary files outside of Home-Manager.

docs/firefly.md

@@ -26,14 +26,24 @@ nix develop
 switch-firefly
 ```
 
-4. Create `hyprland` desktop file.
+4. Create compositor desktop files.
+
+`firefly` uses `roles.desktop.hyprland.configOnly = true`, so Home Manager only writes Hyprland configuration. Hyprland itself must come from the cppiber PPA and the display manager must start the APT/PPA binary directly.
+
+`firefly` also uses `roles.desktop.sway.package = null`, so Home Manager writes Sway configuration without installing or wrapping Sway. Sway and the display manager session file must exist on the host.
 
 ```bash
 echo "[Desktop Entry]
 Name=Hyprland
 Comment=An intelligent dynamic tiling Wayland compositor
-Exec=/home/$USER/.nix-profile/bin/start-hyprland
+Exec=/usr/bin/Hyprland
 Type=Application" | sudo tee /usr/share/wayland-sessions/hyprland.desktop
+
+echo "[Desktop Entry]
+Name=Sway
+Comment=An i3-compatible Wayland compositor
+Exec=/usr/bin/sway
+Type=Application" | sudo tee /usr/share/wayland-sessions/sway.desktop
 ```
 
 5. Copy user-certificate to firefox
@@ -82,12 +92,33 @@ dconf read /org/gnome/desktop/interface/gtk-theme # Read the actual name
 Those programs are installed via apt, since they do not work within `nix`.
 
 ```bash
-# TODO: Check why hyprlock not working
 sudo add-apt-repository ppa:cppiber/hyprland
 sudo apt update
 sudo apt -y install \
-  xdg-desktop-portal-wlr \
+  hyprland \
+  sway \
+  xdg-desktop-portal \
+  xdg-desktop-portal-hyprland \
+  xdg-desktop-portal-gtk \
   mumble \
   swaylock \
   podman
 ```
+
+Home Manager must not manage Hyprland, Sway, or portal packages on `firefly`. Verify the active setup after switching:
+
+```bash
+readlink -f "$(command -v Hyprland)"
+readlink -f "$(command -v sway)"
+systemctl --user cat xdg-desktop-portal*.service
+systemctl --user show-environment | grep NIX_XDG_DESKTOP_PORTAL_DIR
+find ~/.config/xdg-desktop-portal ~/.nix-profile/share/xdg-desktop-portal -maxdepth 3 -type f 2>/dev/null
+```
+
+Expected results:
+
+- `Hyprland` resolves to `/usr/bin/Hyprland`.
+- `sway` resolves to `/usr/bin/sway`.
+- Portal services come from the host packages, not Home Manager-generated user units.
+- `NIX_XDG_DESKTOP_PORTAL_DIR` is absent from the user systemd environment.
+- The `find` command does not show Home Manager-generated portal config under `~/.config/xdg-desktop-portal` or Nix profile portal definitions under `~/.nix-profile/share/xdg-desktop-portal`.

docs/k3s.md

@@ -31,6 +31,13 @@ sudo zpool create -f \
     raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd
 ```
 
+The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main`
+if needed, then loads its encryption key from `rap@nixberry` before `k3s.service`
+starts.
+
+Because the unit runs non-interactively, `kubex` is configured for passwordless sudo
+for members of the `wheel` group.
+
 ## Copy kubeconfig
 
 ```bash

docs/new-host.md

@@ -5,16 +5,33 @@ option.
 
 ## Sops-nix
 
-In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied
-over to the `.sops.yaml` config.
+In order to access secrets via `sops-nix`, this repo uses an `age` identity file by default. For a YubiKey-backed
+setup, point the host at an `age-plugin-yubikey` identity file instead.
 
-```
-# Connect to the new host, and copy the public key of the autogenerated age-key.
-sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key"
+This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`:
+
+- NixOS hosts get them from `modules/nixos/system/sops.nix`
+- standalone Home Manager hosts get them from `modules/home/services/sops.nix`
+- hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files
 
-# Add recipient in .sops.yaml and paste public key, assign it to a creaton_rule.
-# Then a rekey for the secrets.yaml is necessary.
-sops updatekeys secrets/secrets.yaml
+```
+# Install the tools needed for a YubiKey-backed age identity.
+services.pcscd.enable = true;
+environment.systemPackages = with pkgs; [
+  age
+  age-plugin-yubikey
+];
+
+# Generate a YubiKey identity and use it in the host config.
+age-plugin-yubikey --generate \
+  --name swiss \
+  --slot 82 \
+  --pin-policy once \
+  --touch-policy cached \
+  > ~/.config/sops/age/yubikey-identity.txt
+
+# The corresponding recipient can then be added to `.sops.yaml`.
+age-plugin-yubikey --list
 ```
 
 ## Github action