5 files changed, 125 insertions, 88 deletions

diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 6214569a..258a83f7 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -13,9 +13,8 @@ in {
   imports = with flake.nixosModules.systemProfiles; [
     ./hw.nix
     ./email ./libvirt ./greetd
-    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager
+    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager lanzaboote
     flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1
-    flakeInputs.impermanence.nixosModules.impermanence
     flakeInputs.nixVirt.nixosModules.default
   ];
 
@@ -34,6 +33,10 @@ in {
       initrd = {
         systemd = {
           emergencyAccess = config.users.users.root.hashedPassword;
+          extraBin = {
+            "vim" = lib.getExe pkgs.vim;
+            "grep" = lib.getExe pkgs.gnugrep;
+          };
         };
         luks.devices = {
           nvm0 = { device = "/dev/disk/by-uuid/bef17e86-d929-4a60-97cb-6bfa133face7"; bypassWorkqueues = true; };
@@ -47,13 +50,8 @@ in {
 
       blacklistedKernelModules = [ "nouveau" ];
 
-      # Use the systemd-boot EFI boot loader.
+      lanzaboote.configurationLimit = 15;
       loader = {
-        systemd-boot = {
-          enable = true;
-          configurationLimit = 15;
-          netbootxyz.enable = true;
-        };
         efi.canTouchEfiVariables = true;
         timeout = null;
       };
@@ -64,19 +62,27 @@ in {
       kernelPatches = [
         { name = "edac-config";
           patch = null;
-          extraStructuredConfig = with lib.kernel; {
+          structuredExtraConfig = with lib.kernel; {
             EDAC = yes;
             EDAC_IE31200 = yes;
           };
         }
         { name = "zswap-default";
           patch = null;
-          extraStructuredConfig = with lib.kernel; {
+          structuredExtraConfig = with lib.kernel; {
             ZSWAP_DEFAULT_ON = yes;
             ZSWAP_SHRINKER_DEFAULT_ON = yes;
           };
         }
       ];
+      consoleLogLevel = 3;
+      kernelParams = [
+        "quiet"
+        "boot.shell_on_fail"
+        "udev.log_priority=3"
+        "rd.systemd.show_status=auto"
+        "plymouth.use-simpledrm"
+      ];
 
       tmp.useTmpfs = true;
 
@@ -98,6 +104,8 @@ in {
         server ptbtime2.ptb.de prefer iburst nts
         server ptbtime3.ptb.de prefer iburst nts
         server ptbtime4.ptb.de prefer iburst nts
+        pool ntppool1.time.nl prefer iburst nts
+        pool ntppool2.time.nl prefer iburst nts
 
         authselectmode require
         minsources 3
@@ -394,10 +402,10 @@ in {
 
       thinkfan.enable = true;
 
-      logind = {
-        lidSwitch = "suspend";
-        lidSwitchDocked = "ignore";
-        lidSwitchExternalPower = "ignore";
+      logind.settings.Login = {
+        HandleLidSwitch = "suspend";
+        HandleLidSwitchDocked = "ignore";
+        HandleLidSwitchExternalPower = "ignore";
       };
 
       atd = {
@@ -439,11 +447,6 @@ in {
 
     systemd.tmpfiles.settings = {
       "10-localtime"."/etc/localtime".L.argument = "/.bcachefs/etc/localtime";
-
-      # "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" {
-      #   last_user = "gkleen";
-      #   user_to_last_sess.gkleen = "Niri";
-      # });
     };
 
     users = {
@@ -569,10 +572,9 @@ in {
         # setLdLibraryPath = true;
       };
 
-      firmware = [ pkgs.firmwareLinuxNonfree ];
+      firmware = [ pkgs.linux-firmware ];
 
       keyboard.uhk.enable = true;
-      nitrokey.enable = true;
     };
 
     # sound.enable = true;
@@ -626,6 +628,10 @@ in {
       dconf.enable = true;
       niri.enable = true;
       fuse.userAllowOther = true;
+      captive-browser = {
+        enable = true;
+        interface = "wlp82s0";
+      };
     };
 
     services.pcscd.enable = true;
@@ -637,11 +643,6 @@ in {
       group = "users";
     };
 
-    i18n.inputMethod = {
-      enable = true;
-      type = "ibus";
-    };
-
     environment.sessionVariables."GTK_USE_PORTAL" = "1";
     xdg.portal = {
       enable = true;
@@ -652,7 +653,7 @@ in {
         "org.freedesktop.impl.portal.OpenFile" = ["gtk"];
         "org.freedesktop.impl.portal.Access" = ["gtk"];
         "org.freedesktop.impl.portal.Notification" = ["gtk"];
-        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+        "org.freedesktop.impl.portal.Secret" = ["none"];
         "org.freedesktop.impl.portal.Inhibit" = ["none"];
       };
     };
@@ -672,24 +673,16 @@ in {
         "/var/lib/bluetooth"
         "/var/lib/upower"
         "/var/lib/postfix"
+        "/var/lib/regreet"
         "/etc/NetworkManager/system-connections"
+        config.boot.lanzaboote.pkiBundle
       ];
       files = [
       ];
+      timezone = true;
     };
 
-    systemd.services.timezone = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = "${pkgs.coreutils}/bin/cp -vP /.bcachefs/etc/localtime /etc/localtime";
-        ExecStop = "${pkgs.coreutils}/bin/cp -vP /etc/localtime /.bcachefs/etc/localtime";
-      };
-    };
-    services.tzupdate.enable = true;
-
-    security.pam.services.gtklock = {};
+    security.pam.services.quickshell = {};
 
     home-manager.sharedModules = [ flakeInputs.nixVirt.homeModules.default ];
 
diff --git a/hosts/sif/email/default.nix b/hosts/sif/email/default.nix
index 4eda236e..bebf7980 100644
--- a/hosts/sif/email/default.nix
+++ b/hosts/sif/email/default.nix
@@ -5,11 +5,12 @@
     enableSmtp = false;
     enableSubmission = false;
     setSendmail = true;
-    networksStyle = "host";
-    hostname = "sif.midgard.yggdrasil";
-    destination = [];
-    recipientDelimiter = "+";
-    config = {
+    # networksStyle = "host";
+    settings.main = {
+      recpipient_delimiter = "+";
+      mydestination = [];
+      myhostname = "sif.midgard.yggdrasil";
+
       mydomain = "yggdrasil.li";
 
       local_transport = "error:5.1.1 No local delivery";
@@ -19,7 +20,7 @@
 
       inet_interfaces = "loopback-only";
 
-      message_size_limit = "0";
+      message_size_limit = 0;
 
       authorized_submit_users = "inline:{ gkleen= }";
       authorized_flush_users = "inline:{ gkleen= }";
@@ -41,7 +42,7 @@
         /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
         /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
       ''}'';
-      relayhost = "[surtr.yggdrasil.li]:465";
+      relayhost = ["[surtr.yggdrasil.li]:465"];
       default_transport = "relay";
 
       smtp_sasl_auth_enable = true;
@@ -56,7 +57,7 @@
       smtp_tls_loglevel = "1";
       smtp_dns_support_level = "dnssec";
     };
-    masterConfig = {
+    settings.master = {
       submission = {
         type = "inet";
         private = false;
diff --git a/hosts/sif/greetd/default.nix b/hosts/sif/greetd/default.nix
index 37ca13c5..081b6346 100644
--- a/hosts/sif/greetd/default.nix
+++ b/hosts/sif/greetd/default.nix
@@ -1,49 +1,92 @@
-{ pkgs, ... }:
-{
+{ config, pkgs, lib, flakeInputs, ... }:
+
+let
+  gkleenConfig = config.home-manager.users."gkleen";
+  toIni = lib.generators.toINI {
+    mkKeyValue =
+      key: value:
+      let
+        value' = if lib.isBool value then lib.boolToString value else toString value;
+      in
+      "${lib.escape [ "=" ] key}=${value'}";
+  };
+  toDconfIni = let
+    gvariant = import (flakeInputs.home-manager + "/modules/lib/gvariant.nix") { inherit lib; };
+    mkIniKeyValue = key: value: "${key}=${toString (gvariant.mkValue value)}";
+  in lib.generators.toINI { mkKeyValue = mkIniKeyValue; };
+in {
   config = {
     services.greetd = {
       enable = true;
-    #   settings.default_session.command = let
-    #     cfg = config.programs.regreet;
-    #   in pkgs.writeShellScript "greeter" ''
-    #       modprobe -r nvidia_drm
+      settings.default_session.command = lib.getExe (pkgs.writeShellApplication {
+        name = "sway";
+        runtimeInputs = [ pkgs.sway pkgs.fontconfig ];
+        runtimeEnv = {
+          XDG_DATA_DIRS = lib.makeSearchPath "share" [
+            pkgs.equilux-theme pkgs.paper-icon-theme pkgs.fira
+          ];
+          QT_PLUGIN_PATH = lib.makeSearchPath (pkgs.qt6.qtbase.qtPluginPrefix) [
+            pkgs.qt6Packages.qtbase
+          ];
+          QML2_IMPORT_PATH = lib.makeSearchPath (pkgs.qt6.qtbase.qtQmlPrefix) [
+            pkgs.qt6Packages.qtbase
+          ];
+          QT_QPA_PLATFORMTHEME = "gtk3";
+          XDG_CONFIG_DIR = pkgs.symlinkJoin {
+            name = "config";
+            paths = [
+              (pkgs.writeTextDir "gtk-3.0/settings.ini" (toIni {
+                Settings = {
+                  gtk-font-name = "Fira Sans 10";
+                  gtk-theme-name = "Equilux-compact";
+                  gtk-icon-theme-name = "Paper-Mono-Dark";
+                };
+              }))
+            ];
+          };
+          # XDG_CACHE_HOME = "/var/cache/greetd/greeter";
+          # XDG_CONFIG_HOME = "/var/cache/greetd/greeter/config";
+        };
+        text = ''
+          exec &>/tmp/sway-$$.log
+
+          unset MANAGERPID SYSTEMD_EXEC_PID
+
+          # ${lib.getExe' pkgs.coreutils "mkdir"} -p ''${XDG_CONFIG_HOME}/dconf
+          ${lib.getExe pkgs.dconf} load / < ${pkgs.writeText "dconf.ini" (toDconfIni {
+            "org/gnome/desktop/interface" = {
+              "color-scheme" = "prefer-dark";
+              "font-name" = "Fira Sans 10";
+              "gtk-theme" = "Equilux-compact";
+              "icon-theme" = "Paper-Mono-Dark";
+            };
+          })}
+
+          exec sway --unsupported-gpu --config ${pkgs.writeText "sway-config" ''
+            exec "${lib.getExe' config.systemd.package "systemctl"} --user import-environment {,WAYLAND_}DISPLAY SWAYSOCK; ${lib.getExe gkleenConfig.programs.quickshell.package} --path ${gkleenConfig.xdg.configFile."quickshell".source}/displaymanager.qml; swaymsg exit"
 
-    #       exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
-    #     '';
+            input type:keyboard {
+              xkb_layout "us,us"
+              xkb_variant "dvp,"
+              xkb_options "compose:caps,grp:win_space_toggle"
+            }
+
+            output eDP-1 scale 1.5
+          ''}
+        '';
+      });
     };
-    systemd.services.greetd.environment = {
-      XKB_DEFAULT_LAYOUT = "us,us";
-      XKB_DEFAULT_VARIANT = "dvp,";
-      XKB_DEFAULT_OPTIONS = "compose:caps,grp:win_space_toggle";
+
+    # security.pam.services.greetd.fprintAuth = false;
+
+    systemd.services.greetd.serviceConfig = {
+      ExecStartPre = ''${lib.getExe' pkgs.coreutils "install"} -d -o greeter -g greeter -m 0700 ''${CACHE_DIRECTORY}/greeter'';
+      # CacheDirectory = "greetd";
     };
-    programs.regreet = {
-      enable = true;
-      theme = {
-        package = pkgs.equilux-theme;
-        name = "Equilux-compact";
-      };
-      iconTheme = {
-        package = pkgs.paper-icon-theme;
-        name = "Paper-Mono-Dark";
-      };
-      font = {
-        package = pkgs.fira;
-        name = "Fira Sans";
-        # size = 6;
-      };
-      cageArgs = [ "-s" "-m" "last" ];
-      settings = {
-        GTK.application_prefer_dark_theme = true;
-        widget.clock.format = "%F %H:%M:%S%:z";
-        background = {
-          path = pkgs.runCommand "wallpaper.png" {
-            buildInputs = with pkgs; [ imagemagick ];
-          } ''
-            magick ${./wallpaper.png} -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$out"
-          '';
-          fit = "Cover";
-        };
-      };
+
+    users.users.greeter = {
+      home = "/var/lib/greeter";
+      createHome = true;
     };
   };
 }
diff --git a/hosts/sif/greetd/wallpaper.png b/hosts/sif/greetd/wallpaper.png
deleted file mode 100644
index 20fc761a..00000000
--- a/hosts/sif/greetd/wallpaper.png
+++ /dev/null
diff --git a/hosts/sif/hw.nix b/hosts/sif/hw.nix
index 1bcf0261..e567c37d 100644
--- a/hosts/sif/hw.nix
+++ b/hosts/sif/hw.nix
@@ -25,7 +25,7 @@
   # system.etc.overlay.enable = false;
 
   boot.initrd.systemd.packages = [
-    (pkgs.writeTextDir "/etc/systemd/system/\\x2ebcachefs.mount.d/block_scan.conf" ''
+    (pkgs.writeTextDir "/etc/systemd/system/sysroot-.bcachefs.mount.d/block_scan.conf" ''
       [Mount]
       Environment=BCACHEFS_BLOCK_SCAN=1
     '')