modified: .sops.yaml

modified:   flake.nix
	modified:   home/git.nix
	modified:   home/nvchad.nix
	modified:   home/ssh.nix
	modified:   home/zsh.nix
	new file:   hosts/virtualbox/README.md
	new file:   hosts/virtualbox/configuration.nix
	new file:   hosts/virtualbox/default.nix
	new file:   hosts/virtualbox/hardware-configuration.nix
	modified:   lib/hosts.nix
	modified:   modules/core/README.md
	new file:   modules/core/core.nix
	modified:   modules/core/default.nix
	new file:   modules/core/pkg.nix
	modified:   modules/core/sops.nix
	modified:   modules/desktop/README.md
	modified:   modules/desktop/apps.nix
	modified:   modules/desktop/default.nix
	new file:   modules/desktop/fcitx5.nix
	new file:   modules/desktop/pkg.nix
	modified:   modules/server/README.md
	modified:   modules/server/default.nix
	modified:   modules/server/docker.nix
	new file:   modules/server/pkg.nix
	modified:   modules/server/ssh.nix
	new file:   modules/server/virtualbox-guest.nix
	new file:   modules/server/vscode-server.nix
	modified:   modules/wsl/configuration.nix
	new file:   profiles/virtualbox.nix
	modified:   profiles/wsl.nix
	modified:   secrets/users/README.md
	modified:   secrets/users/luochen570.enc.yaml.example

home/ssh.nix

@@ -2,6 +2,10 @@
 {
   programs.ssh.enable = true;
 
+  # ~/.ssh/id_rsa comes from a sops secret file.
+  home.file.".ssh/id_rsa".source =
+    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";
+
   # ~/.ssh/config comes from a sops secret file.
   home.file.".ssh/config".source =
     config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";

hosts/virtualbox/README.md

@@ -0,0 +1,11 @@
+# hosts/virtualbox
+
+VirtualBox guest host entry.
+
+## Layout
+```text
+hosts/virtualbox
+|- default.nix         # host entry, imports configuration.nix
+|- configuration.nix   # profile + hostName + machine specific options
+`- README.md
+```

hosts/virtualbox/configuration.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  imports = [
+    ../../profiles/virtualbox.nix
+  ];
+
+  networking.hostName = "virtualbox";
+
+  # Machine-specific config generated by nixos-generate-config can be
+  # merged here: disk layout, boot loader, filesystem, hardware options.
+}

hosts/virtualbox/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+  ];
+}

hosts/virtualbox/hardware-configuration.nix

@@ -0,0 +1,29 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "ohci_pci" "ehci_pci" "ahci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/31ec1b9d-9138-4051-86ed-51dc63f2619b";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/935D-FCF6";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.virtualbox.guest.enable = true;
+}

lib/hosts.nix

@@ -13,4 +13,9 @@
     system = "x86_64-linux";
     profile = "wsl";
   };
+
+  virtualbox = {
+    system = "x86_64-linux";
+    profile = "virtualbox";
+  };
 }

modules/core/README.md

@@ -6,6 +6,7 @@
 ```text
 🧭 modules/core
 ├─ 🧩 default.nix  # 基础 imports + 时区/镜像源/flakes 等默认设置
+├─ 📦 pkg.nix      # 全局基础软件包
 ├─ 👤 users.nix    # 用户、默认 shell、密码与公钥
 └─ 🔐 sops.nix     # sops-nix secret 映射
 ```

modules/core/core.nix

@@ -0,0 +1,30 @@
+{ lib, ... }:
+{
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+    substituters = [
+      "https://cache.nixos.org"
+      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
+      "https://mirror.sjtu.edu.cn/nix-channels/store"
+    ];
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbtr1HEhF2M7wP6+jJj6Jm23UM="
+    ];
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 14d";
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  time.timeZone = lib.mkDefault "Asia/Shanghai";
+  i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
+
+  networking.firewall.enable = lib.mkDefault true;
+
+  system.stateVersion = lib.mkDefault "25.05";
+}

modules/core/default.nix

@@ -1,46 +1,9 @@
-{ lib, pkgs, ... }:
+{ ... }:
 {
   imports = [
+    ./core.nix
+    ./pkg.nix
     ./users.nix
     ./sops.nix
   ];
-
-  nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];
-    auto-optimise-store = true;
-    substituters = [
-      "https://cache.nixos.org"
-      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
-      "https://mirror.sjtu.edu.cn/nix-channels/store"
-    ];
-    trusted-public-keys = [
-      "cache.nixos.org-1:6NCHdD59X431o0gWypbtr1HEhF2M7wP6+jJj6Jm23UM="
-    ];
-  };
-
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 14d";
-  };
-
-  nixpkgs.config.allowUnfree = true;
-
-  time.timeZone = lib.mkDefault "Asia/Shanghai";
-  i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
-
-  networking.firewall.enable = lib.mkDefault true;
-
-  environment.systemPackages = with pkgs; [
-    curl
-    eza
-    git
-    htop
-    ranger
-    vim
-    wget
-  ];
-
-  system.stateVersion = lib.mkDefault "25.05";
 }
-

modules/core/pkg.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    curl
+    eza
+    git
+    htop
+    ranger
+    vim
+    wget
+  ];
+}

modules/core/sops.nix

@@ -11,6 +11,11 @@ in
     defaultSopsFile = secretFile;
     secrets = lib.mkIf (builtins.pathExists secretFile) {
       "users/luochen570/authorized_key" = {};
+      "users/luochen570/ssh_private_key" = {
+        owner = "luochen570";
+        group = "users";
+        mode = "0400";
+      };
       "users/luochen570/ssh_config" = {
         owner = "luochen570";
         group = "users";

modules/desktop/README.md

@@ -5,8 +5,9 @@
 ## 🌲 目录树
 ```text
 🖥️ modules/desktop
-├─ 📦 default.nix   # 聚合入口（de + apps）
+├─ 📦 default.nix   # 聚合入口（de + pkg + apps）
 ├─ 🧭 de/           # 桌面环境模块（例如 KDE）
 ├─ 🪟 wm/           # 窗口管理器模块（预留）
+├─ 📦 pkg.nix       # 桌面软件包
 └─ 📱 apps.nix      # 桌面应用与默认浏览器关联
 ```

modules/desktop/apps.nix

@@ -1,18 +1,9 @@
-{ pkgs, ... }:
+{ ... }:
 {
-  environment.systemPackages = with pkgs; [
-    firefox
-    google-chrome
-    linuxqq
-    wechat-uos
-    xterm
-    kdePackages.kate
-    kdePackages.konsole
-  ];
-
   xdg.mime.enable = true;
   xdg.mime.defaultApplications = {
     "text/html" = [ "google-chrome.desktop" ];
+    "application/xhtml+xml" = [ "google-chrome.desktop" ];
     "x-scheme-handler/http" = [ "google-chrome.desktop" ];
     "x-scheme-handler/https" = [ "google-chrome.desktop" ];
   };

modules/desktop/default.nix

@@ -2,6 +2,8 @@
 {
   imports = [
     ./de
+    ./pkg.nix
     ./apps.nix
+    ./fcitx5.nix
   ];
 }

modules/desktop/fcitx5.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  i18n.inputMethod = {
+    enabled = "fcitx5";
+    fcitx5.addons = with pkgs; [
+      fcitx5-rime
+      fcitx5-configtool
+      fcitx5-gtk
+      fcitx5-chinese-addons
+    ];
+  };
+
+  environment.sessionVariables = {
+    GTK_IM_MODULE = "fcitx";
+    QT_IM_MODULE = "fcitx";
+    XMODIFIERS = "@im=fcitx";
+    SDL_IM_MODULE = "fcitx";
+    GLFW_IM_MODULE = "fcitx";
+  };
+}

modules/desktop/pkg.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    firefox
+    google-chrome
+    linuxqq
+    wechat-uos
+    xterm
+    kdePackages.kate
+    kdePackages.konsole
+  ];
+}

modules/server/README.md

@@ -5,7 +5,9 @@
 ## 🌲 目录树
 ```text
 🗄️ modules/server
-├─ 📦 default.nix  # 聚合入口
+├─ 📦 default.nix         # 聚合入口
-├─ 🔐 ssh.nix      # OpenSSH 参数
+├─ 📦 pkg.nix             # 服务器常用软件包
-└─ 🐳 docker.nix   # Docker 与清理策略
+├─ 🔐 ssh.nix             # OpenSSH 参数
+├─ 🐳 docker.nix          # Docker 与清理策略
+└─ 🧠 vscode-server.nix   # VS Code Server 模块
 ```

modules/server/default.nix

@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./pkg.nix
     ./docker.nix
     ./ssh.nix
   ];

modules/server/pkg.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    jq
+  ];
+}

modules/server/virtualbox-guest.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  # virtualbox-guest
+  virtualisation.virtualbox.guest.enable = true;
+  virtualisation.virtualbox.guest.dragAndDrop = true;
+}

modules/server/vscode-server.nix

@@ -0,0 +1,13 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.vscode-server.nixosModules.default
+  ];
+
+  services.vscode-server.enable = true;
+
+  programs.direnv.enable = true;
+  
+  # 允许未打补丁的动态二进制文件在 NixOS 上运行
+  programs.nix-ld.enable = true;
+}

modules/wsl/configuration.nix

@@ -2,7 +2,7 @@
 {
   imports = [
     inputs.nixos-wsl.nixosModules.default
-    inputs.vscode-server.nixosModules.default
+    ../server/vscode-server.nix
   ];
 
   wsl = {
@@ -10,6 +10,5 @@
     defaultUser = username;
   };
 
-  services.vscode-server.enable = true;
   users.users.${username}.extraGroups = [ "vscode" "docker" "wheel" ];
 }

profiles/virtualbox.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ../modules/core
+    ../modules/desktop
+    ../modules/server/ssh.nix
+    ../modules/server/virtualbox-guest.nix
+    ../modules/server/vscode-server.nix
+  ];
+}

profiles/wsl.nix

@@ -3,6 +3,7 @@
   imports = [
     ../modules/core
     ../modules/wsl
+    ../modules/server/ssh.nix
   ];
 
   networking.firewall.enable = false;

secrets/users/README.md

@@ -12,3 +12,4 @@
 ## 🔐 本地源文件（Git 黑名单）
 - 你可以在本目录维护 `*.source` 文件作为本地敏感源文件（例如真实域名和 IP）。
 - 这些文件已被仓库 `.gitignore` 屏蔽，不会被 Git 收集和推送。
+- 示例：`luochen570.ssh_config.source`、`luochen570.id_rsa.source`

secrets/users/luochen570.enc.yaml.example

@@ -4,6 +4,10 @@
 users:
   luochen570:
     authorized_key: "ssh-rsa AAAA... your-comment"
+    ssh_private_key: |
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      <REPLACE_WITH_REAL_PRIVATE_KEY>
+      -----END OPENSSH PRIVATE KEY-----
     passwordHash: "REPLACE_WITH_mkpasswd_HASH"
     ssh_config: |
       # ~/.ssh/config