refactor: gate ssh sops symlinks, follow nixos-wsl, fix CRLF

- home/ssh.nix: only create /run/secrets symlinks when secrets exist - flake.nix: nixos-wsl explicit nixpkgs follows - fix CRLF line endings: nvchad.nix, virtualbox-guest.nix, docker.nix
security: comment out plaintext initialPassword
2026-08-13 04:17:18 +08:00 · 2026-08-13 04:17:18 +08:00 · 2026-08-13 04:17:18 +08:00
13 changed files with 109 additions and 165 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -16,39 +16,21 @@
        "type": "github"
      }
    },
-    "flake-utils": {
+    "flake-parts": {
      "inputs": {
-        "systems": "systems"
+        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
        "type": "github"
      }
    },
@@ -59,34 +41,33 @@
        ]
      },
      "locked": {
-        "lastModified": 1763992789,
-        "narHash": "sha256-WHkdBlw6oyxXIra/vQPYLtqY+3G8dUVZM8bEXk0t8x4=",
+        "lastModified": 1785119570,
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "44831a7eaba4360fb81f2acc5ea6de5fde90aaa3",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-26.05",
        "repo": "home-manager",
        "type": "github"
      }
    },
    "nix4nvchad": {
      "inputs": {
-        "flake-utils": "flake-utils",
        "nixpkgs": [
          "nixpkgs"
        ],
        "nvchad-starter": "nvchad-starter"
      },
      "locked": {
-        "lastModified": 1772187015,
-        "narHash": "sha256-8UA+HVKxRqyv1wuAln4gxskq8ZbW5ttKZg5kDp0R154=",
+        "lastModified": 1786241713,
+        "narHash": "sha256-+Ujhw7RDws25N6EYy/G4764k6T0hpGNqEup/bGTQrkc=",
        "owner": "nix-community",
        "repo": "nix4nvchad",
-        "rev": "cde302611dfdcaece9756b48f68eb808645929b5",
+        "rev": "a6277b06ed0de32831ce8e49686fd3a06201a23b",
        "type": "github"
      },
      "original": {
@@ -98,14 +79,16 @@
    "nixos-wsl": {
      "inputs": {
        "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1771563879,
-        "narHash": "sha256-vA5hocvdGhr+jfBN7A7ogeZqIz2qx01EixXwdVsQcnE=",
+        "lastModified": 1784642409,
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "379d20c55f552e91fb9f3f0382e4a97d3f452943",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
        "type": "github"
      },
      "original": {
@@ -117,50 +100,35 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1770019141,
-        "narHash": "sha256-VKS4ZLNx4PNrABoB0L8KUpc1fE7CLpQXQs985tGfaCU=",
+        "lastModified": 1786430034,
+        "narHash": "sha256-Vux08kA5PICwS2sViCMfwVLAHNoH8TkKAeBo25LjpMI=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "cb369ef2efd432b3cdf8622b0ffc0a97a02f3137",
+        "rev": "70cc4559b10a6062b05ff1af17e0add065ccaed9",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-26.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "nixpkgs_2": {
+    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1767313136,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
+        "lastModified": 1772328832,
+        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
        "type": "github"
      },
      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
        "type": "github"
      }
    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1682134069,
-        "narHash": "sha256-TnI/ZXSmRxQDt2sjRYK/8j8iha4B4zP2cnQCZZ3vp7k=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "fd901ef4bf93499374c5af385b2943f5801c0833",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
    "nvchad-starter": {
      "flake": false,
      "locked": {
@@ -183,7 +151,7 @@
        "home-manager": "home-manager",
        "nix4nvchad": "nix4nvchad",
        "nixos-wsl": "nixos-wsl",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
        "sops-nix": "sops-nix",
        "vscode-server": "vscode-server"
      }
@@ -195,11 +163,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772048434,
-        "narHash": "sha256-/wA0OaH6kZ/pFA+nXR/tvg5oupOmEDmMS5us79JT60o=",
+        "lastModified": 1786375908,
+        "narHash": "sha256-G7qDAT98nywA4EFmJCwIRO5wKvDlBBN3BWpsOnjAto8=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "334daa7c273dd8bf7a0cd370e4e16022b64e55e9",
+        "rev": "d1337e05ba0a8e88a75d2c0e1595d82f3b3e2ac4",
        "type": "github"
      },
      "original": {
@@ -208,47 +176,16 @@
        "type": "github"
      }
    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
    "vscode-server": {
      "inputs": {
-        "flake-utils": "flake-utils_2",
-        "nixpkgs": "nixpkgs_3"
+        "flake-parts": "flake-parts"
      },
      "locked": {
-        "lastModified": 1770124655,
-        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
+        "lastModified": 1784312229,
+        "narHash": "sha256-2uHCSUw341o3my1R0U0YCfbnMEazylxb58evWsjGL50=",
        "owner": "nix-community",
        "repo": "nixos-vscode-server",
-        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
+        "rev": "2f984dfbe7e5271b5c413d3e734374cc1306c921",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -2,10 +2,10 @@
  description = "luochen570's NixOS configuration";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";

    home-manager = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-26.05";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -16,7 +16,10 @@
    };

    # NixOS WSL
-    nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
+    nixos-wsl = {
+      url = "github:nix-community/NixOS-WSL/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };

    # VS Code Server
    vscode-server.url = "github:nix-community/nixos-vscode-server";
--- a/home/git.nix
+++ b/home/git.nix
@@ -2,9 +2,9 @@
 {
  programs.git = {
    enable = true;
-    userName = "luochen570";
-    userEmail = "1160510664@qq.com";
-    extraConfig = {
+    settings = {
+      user.name = "luochen570";
+      user.email = "1160510664@qq.com";
      init.defaultBranch = "main";
    };
  };
--- a/home/ssh.nix
+++ b/home/ssh.nix
@@ -1,12 +1,18 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  # 与 modules/core/sops.nix 保持同一开关：secrets 文件存在时才启用。
+  secretsEnabled = builtins.pathExists ../../secrets/users/luochen570.enc.yaml;
+in
 {
  programs.ssh.enable = true;

-  # ~/.ssh/id_rsa 来自 sops secret 文件。
-  home.file.".ssh/id_rsa".source =
-    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";
+  home.file = lib.mkIf secretsEnabled {
+    # ~/.ssh/id_rsa 来自 sops secret 文件。
+    ".ssh/id_rsa".source =
+      config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";

-  # ~/.ssh/config 来自 sops secret 文件。
-  home.file.".ssh/config".source =
-    config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
+    # ~/.ssh/config 来自 sops secret 文件。
+    ".ssh/config".source =
+      config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
+  };
 }
--- a/hosts/desktop/default.nix
+++ b/hosts/desktop/default.nix
@@ -2,5 +2,6 @@
 {
  imports = [
    ./configuration.nix
+    ./hardware-configuration.nix
  ];
 }
--- a/hosts/nixos-lxc/configuration.nix
+++ b/hosts/nixos-lxc/configuration.nix
@@ -21,10 +21,8 @@
  # 由宿主机处理 fstrim
  services.fstrim.enable = false;

-  services.resolved = {
-    extraConfig = ''
-      Cache=true
-      CacheFromLocalhost=true
-    '';
+  services.resolved.settings.Resolve = {
+    Cache = true;
+    CacheFromLocalhost = true;
  };
 }
--- a/modules/core/users.nix
+++ b/modules/core/users.nix
@@ -9,7 +9,9 @@
    shell = pkgs.zsh;
  }
  // lib.optionalAttrs (!(config.sops.secrets ? "users/luochen570/passwordHash")) {
-    initialPassword = "Dly928730@..";
+    # 安装新机时的临时密码快捷方式（明文仅用于首次安装，装完请改用 sops 哈希或移除）。
+    # 需要时解开注释使用；平时保持注释，避免明文进入 /nix/store。
+    # initialPassword = "Dly928730@..";
  }
  // lib.optionalAttrs (config.sops.secrets ? "users/luochen570/authorized_key") {
    openssh.authorizedKeys.keyFiles = [ config.sops.secrets."users/luochen570/authorized_key".path ];
--- a/modules/desktop/fcitx5.nix
+++ b/modules/desktop/fcitx5.nix
@@ -4,9 +4,9 @@
    enabled = "fcitx5";
    fcitx5.addons = with pkgs; [
      fcitx5-rime
-      fcitx5-configtool
+      qt6Packages.fcitx5-configtool
      fcitx5-gtk
-      fcitx5-chinese-addons
+      qt6Packages.fcitx5-chinese-addons
    ];
  };

--- a/modules/drivers/amdgpu.nix
+++ b/modules/drivers/amdgpu.nix
@@ -3,14 +3,11 @@
  # Ryzen 7 9700X 核显（RDNA2）相关的用户态支持。
  # 作为辅助显卡配置保留；X 的主显卡驱动仍由
  # desktop profile / nvidia 模块控制。
+  # amdvlk 在 26.05 已被官方移除（AMD 弃用，RADV 默认启用）。
  hardware.graphics = {
    enable = true;
    extraPackages = with pkgs; [
-      amdvlk
      rocmPackages.clr.icd
    ];
-    extraPackages32 = with pkgs; [
-      driversi686Linux.amdvlk
-    ];
  };
 }