new file: .gitignore

new file:   .sops.yaml
	new file:   README.md
	modified:   flake.nix
	new file:   home/README.md
	new file:   home/default.nix
	modified:   home/git.nix
	new file:   home/ssh.nix
	new file:   hosts/README.md
	new file:   hosts/desktop/README.md
	new file:   hosts/desktop/configuration.nix
	new file:   hosts/desktop/default.nix
	new file:   hosts/server/README.md
	new file:   hosts/server/configuration.nix
	modified:   hosts/server/default.nix
	new file:   hosts/wsl/README.md
	new file:   hosts/wsl/configuration.nix
	new file:   hosts/wsl/default.nix
	new file:   lib/README.md
	new file:   lib/hosts.nix
	modified:   lib/mkHost.nix
	new file:   modules/README.md
	new file:   modules/core/README.md
	new file:   modules/core/default.nix
	new file:   modules/core/sops.nix
	new file:   modules/core/users.nix
	new file:   modules/desktop/README.md
	new file:   modules/desktop/apps.nix
	new file:   modules/desktop/de/README.md
	new file:   modules/desktop/de/default.nix
	new file:   modules/desktop/de/kde.nix
	new file:   modules/desktop/default.nix
	new file:   modules/desktop/wm/README.md
	new file:   modules/desktop/wm/default.nix
	new file:   modules/drivers/README.md
	new file:   modules/drivers/amdgpu.nix
	new file:   modules/drivers/nvidia.nix
	new file:   modules/server/README.md
	new file:   modules/server/default.nix
	new file:   modules/server/docker.nix
	new file:   modules/server/ssh.nix
	new file:   modules/wsl/README.md
	new file:   modules/wsl/configuration.nix
	new file:   modules/wsl/default.nix
	deleted:    modules/wsl/wsl.nix
	new file:   overlays/README.md
	new file:   profiles/README.md
	new file:   profiles/desktop.nix
	modified:   profiles/server.nix
	new file:   profiles/wsl.nix
	new file:   secrets/README.md
	new file:   secrets/users/README.md
	new file:   secrets/users/luochen570.enc.yaml.example
添加了一些文件并优化了了部分配置
桌面驱动有待改进等我去nixos实际操作一下改进
该配置纯gpt生产，可能存在一些问题，欢迎大家提出意见和建议
未经任何测试，直接提交了，请勿直接使用

.gitignore

@@ -0,0 +1,2 @@
+# Local sensitive source files (do not push)
+secrets/users/*.source

.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: ^secrets/users/.*\.ya?ml$
+    key_groups:
+      - age:
+          - age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY

README.md

@@ -0,0 +1,18 @@
+# 📦 nixos 配置仓库
+
+基于 Flake 的 NixOS 多主机配置。
+
+## 🌲 目录树
+```text
+📦 nixos
+├─ 🏠 home/         # Home Manager 用户配置（default.nix 聚合）
+├─ 🖥️ hosts/        # 主机入口
+├─ 🧩 lib/          # 公共函数（mkHost）
+├─ 🧱 modules/      # 系统模块（core/server/wsl）
+├─ 🎨 overlays/     # 包覆盖
+├─ 📚 profiles/     # 场景组合（desktop/server/wsl）
+└─ 🔐 secrets/      # sops 密钥模板与密文
+```
+
+## 🔗 引用关系
+`flake.nix` -> `lib/hosts.nix` + `lib/mkHost.nix` -> `hosts/*` + `profiles/*` -> `modules/*/default.nix` -> 子模块

flake.nix

@@ -2,10 +2,10 @@
   description = "My Infra";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
 
     home-manager = {
-      url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -17,35 +17,24 @@
     nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
 
     vscode-server.url = "github:nix-community/nixos-vscode-server";
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = inputs@{ self, nixpkgs, home-manager, ... }:
+  outputs = inputs@{ nixpkgs, home-manager, ... }:
   let
+    username = "luochen570";
+    hosts = import ./lib/hosts.nix;
     mkHost = import ./lib/mkHost.nix {
       inherit nixpkgs home-manager inputs;
     };
+    mkConfiguredHost = hostname: cfg: mkHost ({
+      inherit hostname username;
+    } // cfg);
   in {
-
-    nixosConfigurations = {
-
-      desktop = mkHost {
-        hostname = "desktop";
-        system = "x86_64-linux";
-        profile = "desktop";
-      };
-
-      server = mkHost {
-        hostname = "server";
-        system = "x86_64-linux";
-        profile = "server";
-      };
-
-      wsl = mkHost {
-        hostname = "wsl";
-        system = "x86_64-linux";
-        profile = "wsl";
-      };
-
-    };
+    nixosConfigurations = nixpkgs.lib.mapAttrs mkConfiguredHost hosts;
   };
-}
+}

home/README.md

@@ -0,0 +1,13 @@
+# 🏠 home 目录说明
+
+Home Manager 用户级配置目录。
+
+## 🌲 目录树
+```text
+🏠 home
+├─ 📦 default.nix   # 聚合入口，统一 imports
+├─ 📝 git.nix       # Git 配置
+├─ 🔐 ssh.nix       # SSH 配置（从 sops secret 链接）
+├─ 💻 zsh.nix       # Zsh 与插件
+└─ ✨ nvchad.nix    # Neovim(NvChad)
+```

home/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./git.nix
+    ./ssh.nix
+    ./zsh.nix
+    ./nvchad.nix
+  ];
+}

home/git.nix

@@ -1,5 +1,6 @@
-{  # Git
-    programs.git = {
+{ ... }:
+{
+  programs.git = {
     enable = true;
     settings = {
       user = {
@@ -9,4 +10,4 @@
       init.defaultBranch = "main";
     };
   };
-}
+}

home/ssh.nix

@@ -0,0 +1,8 @@
+{ config, ... }:
+{
+  programs.ssh.enable = true;
+
+  # ~/.ssh/config comes from a sops secret file.
+  home.file.".ssh/config".source =
+    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
+}

hosts/README.md

@@ -0,0 +1,23 @@
+# 🖥️ hosts 目录说明
+
+主机入口层。每台主机目录固定为三文件结构：
+- `default.nix`：统一入口，导入 `configuration.nix`
+- `configuration.nix`：主机配置（profile + hostName + 机器项）
+- `README.md`：目录说明
+
+## 🌲 目录树
+```text
+🖥️ hosts
+├─ 🧑‍💻 desktop/
+│  ├─ 🧩 default.nix
+│  ├─ ⚙️ configuration.nix
+│  └─ 📝 README.md
+├─ 🗄️ server/
+│  ├─ 🧩 default.nix
+│  ├─ ⚙️ configuration.nix
+│  └─ 📝 README.md
+└─ 🪟 wsl/
+   ├─ 🧩 default.nix
+   ├─ ⚙️ configuration.nix
+   └─ 📝 README.md
+```

hosts/desktop/README.md

@@ -0,0 +1,11 @@
+# 🧑‍💻 hosts/desktop
+
+桌面主机入口。
+
+## 🌲 目录树
+```text
+🧑‍💻 hosts/desktop
+├─ 🧩 default.nix           # 主机入口，引用 configuration.nix
+├─ ⚙️ configuration.nix     # profile + hostName + 机器相关配置
+└─ 📝 README.md
+```

hosts/desktop/configuration.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  imports = [
+    ../../profiles/desktop.nix
+  ];
+
+  networking.hostName = "desktop";
+
+  # Machine-specific config generated by nixos-generate-config can be
+  # merged here: disk layout, boot loader, filesystem, hardware options.
+}

hosts/desktop/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+  ];
+}

hosts/server/README.md

@@ -0,0 +1,11 @@
+# 🗄️ hosts/server
+
+服务器主机入口。
+
+## 🌲 目录树
+```text
+🗄️ hosts/server
+├─ 🧩 default.nix           # 主机入口，引用 configuration.nix
+├─ ⚙️ configuration.nix     # profile + hostName + 机器相关配置
+└─ 📝 README.md
+```

hosts/server/configuration.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  imports = [
+    ../../profiles/server.nix
+  ];
+
+  networking.hostName = "server";
+
+  # Machine-specific config generated by nixos-generate-config can be
+  # merged here: disk layout, boot loader, filesystem, hardware options.
+}

hosts/server/default.nix

@@ -2,9 +2,6 @@
 
 {
   imports = [
-    ./hardware.nix
-    ../../profiles/server.nix
+    ./configuration.nix
   ];
-
-  networking.hostName = "server";
-}
+}

hosts/wsl/README.md

@@ -0,0 +1,11 @@
+# 🪟 hosts/wsl
+
+WSL 主机入口。
+
+## 🌲 目录树
+```text
+🪟 hosts/wsl
+├─ 🧩 default.nix           # 主机入口，引用 configuration.nix
+├─ ⚙️ configuration.nix     # profile + hostName（可加 WSL 机器项）
+└─ 📝 README.md
+```

hosts/wsl/configuration.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ../../profiles/wsl.nix
+  ];
+
+  networking.hostName = "nixos-wsl";
+
+  # Keep minimal for WSL. Add machine-specific options here if needed.
+}

hosts/wsl/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+  ];
+}

lib/README.md

@@ -0,0 +1,10 @@
+# 🧩 lib 目录说明
+
+公共函数目录。
+
+## 🌲 目录树
+```text
+🧩 lib
+├─ ⚙️ mkHost.nix   # 组装 NixOS system 与 Home Manager（接收 username）
+└─ 📋 hosts.nix    # 主机清单（system/profile 映射）
+```

lib/hosts.nix

@@ -0,0 +1,16 @@
+{
+  desktop = {
+    system = "x86_64-linux";
+    profile = "desktop";
+  };
+
+  server = {
+    system = "x86_64-linux";
+    profile = "server";
+  };
+
+  wsl = {
+    system = "x86_64-linux";
+    profile = "wsl";
+  };
+}

lib/mkHost.nix

@@ -1,11 +1,35 @@
-{ nixpkgs, home-manager, system }:
-
-name: modules:
+{ nixpkgs, home-manager, inputs }:
+{
+  hostname,
+  system,
+  profile,
+  username,
+  extraModules ? [ ],
+  extraSpecialArgs ? { },
+}:
 nixpkgs.lib.nixosSystem {
   inherit system;
+  specialArgs = {
+    inherit inputs system username;
+  } // extraSpecialArgs;
 
-  modules =
-    modules ++ [
-      home-manager.nixosModules.home-manager
-    ];
-}
+  modules = [
+    inputs.sops-nix.nixosModules.sops
+    ../hosts/${hostname}
+    ../profiles/${profile}.nix
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = {
+        inherit inputs system;
+      };
+      home-manager.users.${username} = {
+        home.stateVersion = "25.05";
+        imports = [
+          ../home
+        ];
+      };
+    }
+  ] ++ extraModules;
+}

modules/README.md

@@ -0,0 +1,13 @@
+# 🧱 modules 目录说明
+
+系统模块目录。大部分子目录通过 `default.nix` 提供统一入口，驱动目录采用按文件显式引用。
+
+## 🌲 目录树
+```text
+🧱 modules
+├─ 🧭 core/         # 全局基础模块
+├─ 🖥️ desktop/      # 桌面模块（DE/WM/应用）
+├─ 🎮 drivers/      # 硬件驱动模块（如 NVIDIA）
+├─ 🗄️ server/       # 服务器模块
+└─ 🪟 wsl/          # WSL 模块
+```

modules/core/README.md

@@ -0,0 +1,11 @@
+# 🧭 modules/core
+
+所有主机场景都会引入的基础模块。
+
+## 🌲 目录树
+```text
+🧭 modules/core
+├─ 🧩 default.nix  # 基础 imports + 时区/镜像源/flakes 等默认设置
+├─ 👤 users.nix    # 用户、默认 shell、密码与公钥
+└─ 🔐 sops.nix     # sops-nix secret 映射
+```

modules/core/default.nix

@@ -0,0 +1,46 @@
+{ lib, pkgs, ... }:
+{
+  imports = [
+    ./users.nix
+    ./sops.nix
+  ];
+
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+    substituters = [
+      "https://cache.nixos.org"
+      "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
+      "https://mirror.sjtu.edu.cn/nix-channels/store"
+    ];
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbtr1HEhF2M7wP6+jJj6Jm23UM="
+    ];
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 14d";
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  time.timeZone = lib.mkDefault "Asia/Shanghai";
+  i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8";
+
+  networking.firewall.enable = lib.mkDefault true;
+
+  environment.systemPackages = with pkgs; [
+    curl
+    eza
+    git
+    htop
+    ranger
+    vim
+    wget
+  ];
+
+  system.stateVersion = lib.mkDefault "25.05";
+}
+

modules/core/sops.nix

@@ -0,0 +1,24 @@
+{ lib, ... }:
+let
+  secretFile = ../../secrets/users/luochen570.enc.yaml;
+in
+{
+  sops = {
+    age = {
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+    defaultSopsFile = secretFile;
+    secrets = lib.mkIf (builtins.pathExists secretFile) {
+      "users/luochen570/authorized_key" = {};
+      "users/luochen570/ssh_config" = {
+        owner = "luochen570";
+        group = "users";
+        mode = "0600";
+      };
+      "users/luochen570/passwordHash" = {
+        neededForUsers = true;
+      };
+    };
+  };
+}

modules/core/users.nix

@@ -0,0 +1,23 @@
+{ lib, pkgs, username, config, ... }:
+{
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+
+  users.users.${username} = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+  };
+
+  users.users.${username}.initialPassword = lib.mkIf
+    (!(config.sops.secrets ? "users/luochen570/passwordHash"))
+    "Dly928730@..";
+
+  users.users.${username}.openssh.authorizedKeys.keyFiles = lib.mkIf
+    (config.sops.secrets ? "users/luochen570/authorized_key")
+    [ config.sops.secrets."users/luochen570/authorized_key".path ];
+
+  users.users.${username}.hashedPasswordFile = lib.mkIf
+    (config.sops.secrets ? "users/luochen570/passwordHash")
+    config.sops.secrets."users/luochen570/passwordHash".path;
+}

modules/desktop/README.md

@@ -0,0 +1,12 @@
+# 🖥️ modules/desktop 目录说明
+
+桌面能力模块，按“桌面环境（DE）/窗口管理器（WM）/应用”拆分，便于后续扩展到多种桌面方案。
+
+## 🌲 目录树
+```text
+🖥️ modules/desktop
+├─ 📦 default.nix   # 聚合入口（de + apps）
+├─ 🧭 de/           # 桌面环境模块（例如 KDE）
+├─ 🪟 wm/           # 窗口管理器模块（预留）
+└─ 📱 apps.nix      # 桌面应用与默认浏览器关联
+```

modules/desktop/apps.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    firefox
+    google-chrome
+    linuxqq
+    wechat-uos
+    xterm
+    kdePackages.kate
+    kdePackages.konsole
+  ];
+
+  xdg.mime.enable = true;
+  xdg.mime.defaultApplications = {
+    "text/html" = [ "google-chrome.desktop" ];
+    "x-scheme-handler/http" = [ "google-chrome.desktop" ];
+    "x-scheme-handler/https" = [ "google-chrome.desktop" ];
+  };
+}

modules/desktop/de/README.md

@@ -0,0 +1,10 @@
+# 🧭 modules/desktop/de 目录说明
+
+桌面环境（Desktop Environment）目录。
+
+## 🌲 目录树
+```text
+🧭 modules/desktop/de
+├─ 📦 default.nix   # 聚合入口（当前仅 KDE）
+└─ ⚙️ kde.nix       # SDDM + Plasma 6
+```

modules/desktop/de/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./kde.nix
+  ];
+}

modules/desktop/de/kde.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  services.xserver.enable = true;
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+}

modules/desktop/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./de
+    ./apps.nix
+  ];
+}

modules/desktop/wm/README.md

@@ -0,0 +1,9 @@
+# 🪟 modules/desktop/wm 目录说明
+
+窗口管理器（Window Manager）目录，当前为预留结构。
+
+## 🌲 目录树
+```text
+🪟 modules/desktop/wm
+└─ 📦 default.nix   # 预留 future imports（hyprland/sway 等）
+```

modules/desktop/wm/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    # Future WM modules:
+    # ./hyprland.nix
+    # ./sway.nix
+  ];
+}

modules/drivers/README.md

@@ -0,0 +1,11 @@
+# 🎮 modules/drivers 目录说明
+
+硬件驱动模块目录，用于集中管理显卡等驱动配置。
+
+## 🌲 目录树
+```text
+🎮 modules/drivers
+├─ 🟢 nvidia.nix    # NVIDIA 驱动配置与双显卡备用说明
+├─ 🔴 amdgpu.nix    # AMD iGPU(9700X) 用户态图形/计算支持
+└─ 📝 README.md
+```

modules/drivers/amdgpu.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  # Ryzen 7 9700X iGPU (RDNA2) related userspace support.
+  # Keep as a secondary GPU setup; X primary driver is still controlled
+  # by the desktop profile / nvidia module.
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      amdvlk
+      rocmPackages.clr.icd
+    ];
+    extraPackages32 = with pkgs; [
+      driversi686Linux.amdvlk
+    ];
+  };
+}

modules/drivers/nvidia.nix

@@ -0,0 +1,43 @@
+{ config, ... }:
+{
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  hardware.graphics.enable = true;
+  hardware.nvidia = {
+    modesetting.enable = true;
+    open = true;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.latest;
+  };
+
+  # 备用方案（当前禁用）：
+  # 如果后续要启用 AMD 核显 + NVIDIA 独显切换，请取消下面整段注释。
+  #
+  # 重要提醒：
+  # 1) 先确认两张显卡的 PCIe Bus ID，再启用；否则图形界面可能无法启动。
+  # 2) 获取命令：lspci | grep -E "VGA|3D"
+  # 3) 示例输出常见为 "01:00.0"、"06:00.0"（16 进制）。
+  # 4) Nix 配置常用写法：PCI:<bus-dec>:<device-dec>:<function>
+  #    例如 01:00.0 -> PCI:1:0:0；06:00.0 -> PCI:6:0:0
+  #
+  # let
+  #   amdgpuBusId = "PCI:6:0:0";
+  #   nvidiaBusId = "PCI:1:0:0";
+  # in {
+  #   services.xserver.videoDrivers = [ "amdgpu" "nvidia" ];
+  #   hardware.nvidia.prime = {
+  #     offload.enable = true;
+  #     offload.enableOffloadCmd = true;
+  #     amdgpuBusId = amdgpuBusId;
+  #     nvidiaBusId = nvidiaBusId;
+  #   };
+  #   specialisation.nvidia-sync.configuration = {
+  #     hardware.nvidia.prime = {
+  #       offload.enable = lib.mkForce false;
+  #       sync.enable = true;
+  #       amdgpuBusId = amdgpuBusId;
+  #       nvidiaBusId = nvidiaBusId;
+  #     };
+  #   };
+  # }
+}

modules/server/README.md

@@ -0,0 +1,11 @@
+# 🗄️ modules/server
+
+服务器专用模块。
+
+## 🌲 目录树
+```text
+🗄️ modules/server
+├─ 📦 default.nix  # 聚合入口
+├─ 🔐 ssh.nix      # OpenSSH 参数
+└─ 🐳 docker.nix   # Docker 与清理策略
+```

modules/server/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./docker.nix
+    ./ssh.nix
+  ];
+}

modules/server/docker.nix

@@ -0,0 +1,11 @@
+{ ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    autoPrune = {
+      enable = true;
+      dates = "weekly";
+    };
+  };
+}
+

modules/server/ssh.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      X11Forwarding = false;
+    };
+    openFirewall = true;
+  };
+}
+

modules/wsl/README.md

@@ -0,0 +1,11 @@
+# 🪟 modules/wsl
+
+WSL 集成模块。
+
+## 🌲 目录树
+```text
+🪟 modules/wsl
+├─ 📦 default.nix         # 聚合入口
+├─ ⚙️ configuration.nix   # WSL 配置实现
+└─ 📝 README.md
+```

modules/wsl/configuration.nix

@@ -0,0 +1,15 @@
+{ inputs, username, ... }:
+{
+  imports = [
+    inputs.nixos-wsl.nixosModules.default
+    inputs.vscode-server.nixosModules.default
+  ];
+
+  wsl = {
+    enable = true;
+    defaultUser = username;
+  };
+
+  services.vscode-server.enable = true;
+  users.users.${username}.extraGroups = [ "vscode" "docker" "wheel" ];
+}

modules/wsl/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+  ];
+}

overlays/README.md

@@ -0,0 +1,9 @@
+# 🎨 overlays 目录说明
+
+`nixpkgs` 包覆盖目录。
+
+## 🌲 目录树
+```text
+🎨 overlays
+└─ (自定义 overlay 文件)
+```

profiles/README.md

@@ -0,0 +1,11 @@
+# 📚 profiles 目录说明
+
+场景化组合层，负责选择 `modules/*`。
+
+## 🌲 目录树
+```text
+📚 profiles
+├─ 🧑‍💻 desktop.nix  # core + desktop + drivers
+├─ 🗄️ server.nix      # core + server(default.nix)
+└─ 🪟 wsl.nix         # core + wsl(default.nix)
+```

profiles/desktop.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ../modules/core
+    ../modules/desktop
+    ../modules/drivers/nvidia.nix
+    ../modules/drivers/amdgpu.nix
+  ];
+}

profiles/server.nix

@@ -1,7 +1,6 @@
 {
   imports = [
     ../modules/core
-    ../modules/server/docker.nix
-    ../modules/server/ssh.nix
+    ../modules/server
   ];
-}
+}

profiles/wsl.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ../modules/core
+    ../modules/wsl
+  ];
+
+  networking.firewall.enable = false;
+}
+

secrets/README.md

@@ -0,0 +1,13 @@
+# 🔐 secrets 目录说明
+
+`sops-nix` 密钥目录。
+
+## 🌲 目录树
+```text
+🔐 secrets
+└─ 👤 users/
+```
+
+建议：
+- 仅提交加密后的 `*.enc.yaml`
+- 明文仅保留 `*.example` 模板

secrets/users/README.md

@@ -0,0 +1,14 @@
+# 👤 secrets/users 目录说明
+
+用户级 secret 模板与密文。
+
+## 🌲 目录树
+```text
+👤 secrets/users
+├─ 📄 luochen570.enc.yaml.example  # 明文模板（不部署）
+└─ 🔒 luochen570.enc.yaml          # 加密后部署文件
+```
+
+## 🔐 本地源文件（Git 黑名单）
+- 你可以在本目录维护 `*.source` 文件作为本地敏感源文件（例如真实域名和 IP）。
+- 这些文件已被仓库 `.gitignore` 屏蔽，不会被 Git 收集和推送。

secrets/users/luochen570.enc.yaml.example

@@ -0,0 +1,92 @@
+# Create encrypted file from this template:
+# cp secrets/users/luochen570.enc.yaml.example secrets/users/luochen570.enc.yaml
+# sops --encrypt --in-place secrets/users/luochen570.enc.yaml
+users:
+  luochen570:
+    authorized_key: "ssh-rsa AAAA... your-comment"
+    passwordHash: "REPLACE_WITH_mkpasswd_HASH"
+    ssh_config: |
+      # ~/.ssh/config
+      Host jz s0 pikvm nix zen gentoo ali tx jp k3s k3s-a1 k3s-a2 gmk
+          IdentityFile ~/.ssh/id_rsa
+
+      # <C1_DOMAIN>
+      Host jz
+          Hostname <C1_DOMAIN>
+          Port 10000
+          User root
+
+      # <S0_DOMAIN>
+      Host s0 pikvm nix k3s-1 k3s-2 k3s-3 test
+          Hostname <S0_DOMAIN>
+          User root
+
+      Host nix
+          User luochen570
+          Port 33
+
+      Host pikvm
+          Port 53912
+
+      Host k3s-1
+          Port 10000
+
+      Host k3s-2
+          Port 10002
+
+      Host k3s-3
+          Port 10004
+
+      Host test
+          Port 10008
+
+      Host zen
+          Hostname <ZEN_DOMAIN>
+          User root
+          Port 10002
+
+      Host gmk
+          Hostname <GMK_DOMAIN>
+          User root
+
+      Host fn
+          Hostname <FNOS_IP>
+          User luochen570
+
+      Host ali
+          Hostname <ALI_ECS_IP>
+          User ecs-user
+
+      Host tx
+          Hostname <TENCENT_CLOUD_IP>
+          User root
+
+      Host jp
+          Hostname <JP_SERVER_IP>
+          User root
+
+      Host hk
+          Hostname <HK_SERVER_IP>
+          User root
+
+      Host hk2
+          Hostname <HK2_SERVER_IP>
+          User root
+
+      Host k3s k3s-a1 k3s-a2 opensuse
+          User root
+          Hostname <S0_DOMAIN>
+
+      Host k3s
+          Port 10000
+
+      Host k3s-a1
+          Port 10004
+
+      Host opensuse
+          Port 10006
+
+      Host gitea
+          HostName <GITEA_IP>
+          User git
+          Port 222