modified: .sops.yaml

modified: flake.nix modified: home/git.nix modified: home/nvchad.nix modified: home/ssh.nix modified: home/zsh.nix new file: hosts/virtualbox/README.md new file: hosts/virtualbox/configuration.nix new file: hosts/virtualbox/default.nix new file: hosts/virtualbox/hardware-configuration.nix modified: lib/hosts.nix modified: modules/core/README.md new file: modules/core/core.nix modified: modules/core/default.nix new file: modules/core/pkg.nix modified: modules/core/sops.nix modified: modules/desktop/README.md modified: modules/desktop/apps.nix modified: modules/desktop/default.nix new file: modules/desktop/fcitx5.nix new file: modules/desktop/pkg.nix modified: modules/server/README.md modified: modules/server/default.nix modified: modules/server/docker.nix new file: modules/server/pkg.nix modified: modules/server/ssh.nix new file: modules/server/virtualbox-guest.nix new file: modules/server/vscode-server.nix modified: modules/wsl/configuration.nix new file: profiles/virtualbox.nix modified: profiles/wsl.nix modified: secrets/users/README.md modified: secrets/users/luochen570.enc.yaml.example
2026-02-28 10:21:32 +08:00
parent 620b587010
commit 3659dc3e50
33 changed files with 312 additions and 165 deletions
--- a/home/ssh.nix
+++ b/home/ssh.nix
@@ -2,6 +2,10 @@
 {
  programs.ssh.enable = true;

+  # ~/.ssh/id_rsa comes from a sops secret file.
+  home.file.".ssh/id_rsa".source =
+    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";
+
  # ~/.ssh/config comes from a sops secret file.
  home.file.".ssh/config".source =
    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
--- a/hosts/virtualbox/README.md
+++ b/hosts/virtualbox/README.md
@@ -0,0 +1,11 @@
+# hosts/virtualbox
+
+VirtualBox guest host entry.
+
+## Layout
+```text
+hosts/virtualbox
+|- default.nix         # host entry, imports configuration.nix
+|- configuration.nix   # profile + hostName + machine specific options
+`- README.md
+```
--- a/hosts/virtualbox/configuration.nix
+++ b/hosts/virtualbox/configuration.nix
@@ -0,0 +1,11 @@
+{ ... }:
+{
+  imports = [
+    ../../profiles/virtualbox.nix
+  ];
+
+  networking.hostName = "virtualbox";
+
+  # Machine-specific config generated by nixos-generate-config can be
+  # merged here: disk layout, boot loader, filesystem, hardware options.
+}
--- a/hosts/virtualbox/default.nix
+++ b/hosts/virtualbox/default.nix
@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+  ];
+}
--- a/hosts/virtualbox/hardware-configuration.nix
+++ b/hosts/virtualbox/hardware-configuration.nix
@@ -0,0 +1,29 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "ohci_pci" "ehci_pci" "ahci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/31ec1b9d-9138-4051-86ed-51dc63f2619b";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/935D-FCF6";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  virtualisation.virtualbox.guest.enable = true;
+}
--- a/lib/hosts.nix
+++ b/lib/hosts.nix
@@ -13,4 +13,9 @@
    system = "x86_64-linux";
    profile = "wsl";
  };
+
+  virtualbox = {
+    system = "x86_64-linux";
+    profile = "virtualbox";
+  };
 }
--- a/modules/core/README.md
+++ b/modules/core/README.md
@@ -6,6 +6,7 @@
 ```text
 🧭 modules/core
 ├─ 🧩 default.nix  # 基础 imports + 时区/镜像源/flakes 等默认设置
+├─ 📦 pkg.nix      # 全局基础软件包
 ├─ 👤 users.nix    # 用户、默认 shell、密码与公钥
 └─ 🔐 sops.nix     # sops-nix secret 映射
 ```
--- a/modules/core/core.nix
+++ b/modules/core/core.nix
@@ -0,0 +1,30 @@
+{ lib, ... }:
+{
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+    substituters = [
+      "https://cache.nixos.org"
+      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
+      "https://mirror.sjtu.edu.cn/nix-channels/store"
+    ];
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbtr1HEhF2M7wP6+jJj6Jm23UM="
+    ];
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 14d";
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  time.timeZone = lib.mkDefault "Asia/Shanghai";
+  i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
+
+  networking.firewall.enable = lib.mkDefault true;
+
+  system.stateVersion = lib.mkDefault "25.05";
+}
--- a/modules/core/default.nix
+++ b/modules/core/default.nix
@@ -1,46 +1,9 @@
-{ lib, pkgs, ... }:
+{ ... }:
 {
  imports = [
+    ./core.nix
+    ./pkg.nix
    ./users.nix
    ./sops.nix
  ];
-
-  nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];
-    auto-optimise-store = true;
-    substituters = [
-      "https://cache.nixos.org"
-      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
-      "https://mirror.sjtu.edu.cn/nix-channels/store"
-    ];
-    trusted-public-keys = [
-      "cache.nixos.org-1:6NCHdD59X431o0gWypbtr1HEhF2M7wP6+jJj6Jm23UM="
-    ];
-  };
-
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 14d";
-  };
-
-  nixpkgs.config.allowUnfree = true;
-
-  time.timeZone = lib.mkDefault "Asia/Shanghai";
-  i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
-
-  networking.firewall.enable = lib.mkDefault true;
-
-  environment.systemPackages = with pkgs; [
-    curl
-    eza
-    git
-    htop
-    ranger
-    vim
-    wget
-  ];
-
-  system.stateVersion = lib.mkDefault "25.05";
 }
-
--- a/modules/core/pkg.nix
+++ b/modules/core/pkg.nix
@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    curl
+    eza
+    git
+    htop
+    ranger
+    vim
+    wget
+  ];
+}
--- a/modules/core/sops.nix
+++ b/modules/core/sops.nix
@@ -11,6 +11,11 @@ in
    defaultSopsFile = secretFile;
    secrets = lib.mkIf (builtins.pathExists secretFile) {
      "users/luochen570/authorized_key" = {};
+      "users/luochen570/ssh_private_key" = {
+        owner = "luochen570";
+        group = "users";
+        mode = "0400";
+      };
      "users/luochen570/ssh_config" = {
        owner = "luochen570";
        group = "users";
--- a/modules/desktop/README.md
+++ b/modules/desktop/README.md
@@ -5,8 +5,9 @@
 ## 🌲 目录树
 ```text
 🖥️ modules/desktop
-├─ 📦 default.nix   # 聚合入口（de + apps）
+├─ 📦 default.nix   # 聚合入口（de + pkg + apps）
 ├─ 🧭 de/           # 桌面环境模块（例如 KDE）
 ├─ 🪟 wm/           # 窗口管理器模块（预留）
+├─ 📦 pkg.nix       # 桌面软件包
 └─ 📱 apps.nix      # 桌面应用与默认浏览器关联
 ```
--- a/modules/desktop/apps.nix
+++ b/modules/desktop/apps.nix
@@ -1,18 +1,9 @@
-{ pkgs, ... }:
+{ ... }:
 {
-  environment.systemPackages = with pkgs; [
-    firefox
-    google-chrome
-    linuxqq
-    wechat-uos
-    xterm
-    kdePackages.kate
-    kdePackages.konsole
-  ];
-
  xdg.mime.enable = true;
  xdg.mime.defaultApplications = {
    "text/html" = [ "google-chrome.desktop" ];
+    "application/xhtml+xml" = [ "google-chrome.desktop" ];
    "x-scheme-handler/http" = [ "google-chrome.desktop" ];
    "x-scheme-handler/https" = [ "google-chrome.desktop" ];
  };
--- a/modules/desktop/default.nix
+++ b/modules/desktop/default.nix
@@ -2,6 +2,8 @@
 {
  imports = [
    ./de
+    ./pkg.nix
    ./apps.nix
+    ./fcitx5.nix
  ];
 }
--- a/modules/desktop/fcitx5.nix
+++ b/modules/desktop/fcitx5.nix
@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  i18n.inputMethod = {
+    enabled = "fcitx5";
+    fcitx5.addons = with pkgs; [
+      fcitx5-rime
+      fcitx5-configtool
+      fcitx5-gtk
+      fcitx5-chinese-addons
+    ];
+  };
+
+  environment.sessionVariables = {
+    GTK_IM_MODULE = "fcitx";
+    QT_IM_MODULE = "fcitx";
+    XMODIFIERS = "@im=fcitx";
+    SDL_IM_MODULE = "fcitx";
+    GLFW_IM_MODULE = "fcitx";
+  };
+}
--- a/modules/desktop/pkg.nix
+++ b/modules/desktop/pkg.nix
@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    firefox
+    google-chrome
+    linuxqq
+    wechat-uos
+    xterm
+    kdePackages.kate
+    kdePackages.konsole
+  ];
+}
--- a/modules/server/README.md
+++ b/modules/server/README.md
@@ -6,6 +6,8 @@
 ```text
 🗄️ modules/server
 ├─ 📦 default.nix         # 聚合入口
+├─ 📦 pkg.nix             # 服务器常用软件包
 ├─ 🔐 ssh.nix             # OpenSSH 参数
-└─ 🐳 docker.nix   # Docker 与清理策略
+├─ 🐳 docker.nix          # Docker 与清理策略
+└─ 🧠 vscode-server.nix   # VS Code Server 模块
 ```
--- a/modules/server/default.nix
+++ b/modules/server/default.nix
@@ -1,6 +1,7 @@
 { ... }:
 {
  imports = [
+    ./pkg.nix
    ./docker.nix
    ./ssh.nix
  ];
--- a/modules/server/pkg.nix
+++ b/modules/server/pkg.nix
@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    jq
+  ];
+}
--- a/modules/server/virtualbox-guest.nix
+++ b/modules/server/virtualbox-guest.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  # virtualbox-guest
+  virtualisation.virtualbox.guest.enable = true;
+  virtualisation.virtualbox.guest.dragAndDrop = true;
+}
--- a/modules/server/vscode-server.nix
+++ b/modules/server/vscode-server.nix
@@ -0,0 +1,13 @@
+{ inputs, ... }:
+{
+  imports = [
+    inputs.vscode-server.nixosModules.default
+  ];
+
+  services.vscode-server.enable = true;
+
+  programs.direnv.enable = true;
+  
+  # 允许未打补丁的动态二进制文件在 NixOS 上运行
+  programs.nix-ld.enable = true;
+}
--- a/modules/wsl/configuration.nix
+++ b/modules/wsl/configuration.nix
@@ -2,7 +2,7 @@
 {
  imports = [
    inputs.nixos-wsl.nixosModules.default
-    inputs.vscode-server.nixosModules.default
+    ../server/vscode-server.nix
  ];

  wsl = {
@@ -10,6 +10,5 @@
    defaultUser = username;
  };

-  services.vscode-server.enable = true;
  users.users.${username}.extraGroups = [ "vscode" "docker" "wheel" ];
 }
--- a/profiles/virtualbox.nix
+++ b/profiles/virtualbox.nix
@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ../modules/core
+    ../modules/desktop
+    ../modules/server/ssh.nix
+    ../modules/server/virtualbox-guest.nix
+    ../modules/server/vscode-server.nix
+  ];
+}
--- a/profiles/wsl.nix
+++ b/profiles/wsl.nix
@@ -3,6 +3,7 @@
  imports = [
    ../modules/core
    ../modules/wsl
+    ../modules/server/ssh.nix
  ];

  networking.firewall.enable = false;
--- a/secrets/users/README.md
+++ b/secrets/users/README.md
@@ -12,3 +12,4 @@
 ## 🔐 本地源文件（Git 黑名单）
 - 你可以在本目录维护 `*.source` 文件作为本地敏感源文件（例如真实域名和 IP）。
 - 这些文件已被仓库 `.gitignore` 屏蔽，不会被 Git 收集和推送。
+- 示例：`luochen570.ssh_config.source`、`luochen570.id_rsa.source`
--- a/secrets/users/luochen570.enc.yaml.example
+++ b/secrets/users/luochen570.enc.yaml.example
@@ -4,6 +4,10 @@
 users:
  luochen570:
    authorized_key: "ssh-rsa AAAA... your-comment"
+    ssh_private_key: |
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      <REPLACE_WITH_REAL_PRIVATE_KEY>
+      -----END OPENSSH PRIVATE KEY-----
    passwordHash: "REPLACE_WITH_mkpasswd_HASH"
    ssh_config: |
      # ~/.ssh/config