flake update

CLAUDE.md

@@ -1,71 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Overview
-
-NixOS dotfiles repository using Nix Flakes for managing multiple machines. Configuration is in French (comments, docs).
-
-## Build & Deploy Commands
-
-```bash
-# Rebuild and switch configuration (local)
-sudo nixos-rebuild switch --flake .#<hostname>
-
-# Rebuild on remote machine
-nixos-rebuild switch --flake .#<hostname> --target-host beastie@<ip> --sudo
-
-# Bootstrap new machine with nixos-anywhere
-nixos-anywhere --flake .#generic --target-host root@<ip> \
-  --generate-hardware-config nixos-generate-config ./hosts/generic/hardware-configuration.nix
-
-# Generate custom ISO
-nixos-generate --format iso --configuration ./iso/customiso.nix -o ~/Downloads/nixos.iso
-
-# Update flake inputs
-nix flake update
-
-# Update secrets after adding new host key
-sops updatekeys secrets.yaml
-nix flake update mysecrets
-```
-
-## Architecture
-
-**Flake Inputs:**
-- `nixpkgs-stable` (25.05) and `nixpkgs-unstable` channels
-- `disko` for declarative disk partitioning
-- `sops-nix` for encrypted secrets
-- `mysecrets` - local git repo at `/home/beastie/nixos/secrets` (required dependency)
-
-**Hosts:** `generic` (ISO), `test-kvm` (stable), `home-nix` (unstable), `work-nix` (unstable)
-
-**Module Hierarchy:**
-1. `modules/core/` - Applied to ALL hosts (grub, ssh, packages, users, tty, system)
-2. `modules/optionnals/` - Selectively imported per host
-3. `modules/optionnals/hosts/<hostname>.nix` - Host-specific networking, services
-4. `modules/optionnals/desktop/` - Desktop environment modules (Hyprland, apps)
-
-## Key Patterns
-
-**Custom Options** (`modules/optionnals/options.nix`):
-- `my.laninterface`, `my.ipv4address`, `my.ipv4netmask`, `my.ipv4gateway`, `my.wolipv6address`
-
-**Special Args** passed to all modules via flake.nix:
-- `hostname` and `username` - used for host/user-specific configuration
-
-**Secrets (sops-nix):**
-- Encrypted YAML in separate `mysecrets` repo
-- Referenced via `config.sops.secrets.<name>.path` or `config.sops.templates`
-- Age encryption with SSH host keys
-
-**XDG Config Distribution:**
-- Desktop configs (hyprland, waybar, kitty, rofi) use `environment.etc."xdg/<app>".source`
-- Host-specific variants: `hyprland-${hostname}.conf`
-
-## Important Considerations
-
-- Test changes on `test-kvm` before deploying to production hosts
-- `mysecrets` flake input must exist locally at `/home/beastie/nixos/secrets`
-- Different hosts use different `stateVersion` (25.05 vs 25.11)
-- Core module changes affect ALL machines

flake.lock

@@ -3,15 +3,15 @@
     "disko": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1769524058,
+        "lastModified": 1762276996,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
         "type": "github"
       },
       "original": {
@@ -23,11 +23,11 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1769035388,
+        "lastModified": 1759883911,
-        "narHash": "sha256-Uaih4r++akPmfACCTAUZ21tb5wKD6ms2dLtzqE8f304=",
+        "narHash": "sha256-IAKCQ9dIeMAdoi4fQdJAdWlLrNh/PURqGz7pmlo9cUw=",
         "ref": "refs/heads/main",
-        "rev": "d3c44cb624ae2c1a13a172346fb5422d27e59348",
+        "rev": "7e39f4cde171d9273efddf2153d972d6fbf2a710",
-        "revCount": 20,
+        "revCount": 15,
         "type": "git",
         "url": "file:///home/beastie/nixos/secrets"
       },
@@ -36,29 +36,13 @@
         "url": "file:///home/beastie/nixos/secrets"
       }
     },
-    "nixpkgs-stable": {
+    "nixpkgs": {
       "locked": {
-        "lastModified": 1767313136,
+        "lastModified": 1762363567,
-        "narHash": "sha256-16KkgfdYqjaeRGBaYsNrhPRRENs0qzkQVUooNHtoy2w=",
+        "narHash": "sha256-YRqMDEtSMbitIMj+JLpheSz0pwEr0Rmy5mC7myl17xs=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ac62194c3917d5f474c1a844b6fd6da2db95077d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unstable": {
-      "locked": {
-        "lastModified": 1770115704,
-        "narHash": "sha256-KHFT9UWOF2yRPlAnSXQJh6uVcgNcWlFqqiAZ7OVlHNc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e6eae2ee2110f3d31110d5c222cd395303343b08",
+        "rev": "ae814fd3904b621d8ab97418f1d0f2eb0d3716f4",
         "type": "github"
       },
       "original": {
@@ -72,23 +56,22 @@
       "inputs": {
         "disko": "disko",
         "mysecrets": "mysecrets",
-        "nixpkgs-stable": "nixpkgs-stable",
+        "nixpkgs": "nixpkgs",
-        "nixpkgs-unstable": "nixpkgs-unstable",
         "sops-nix": "sops-nix"
       }
     },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1770145881,
+        "lastModified": 1760998189,
-        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,17 +2,16 @@
   description = "A very basic flake";
 
   inputs = {
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
 
     disko = {
       url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     sops-nix = {
       url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     mysecrets = {
@@ -47,10 +46,10 @@
     {
       nixosConfigurations = {
         #nixos-anywhere -- --flake './#generic' --generate-hardware-config nixos-generate-config ./hosts/generic/hardware-configuration.nix --target-host beastie@192.168.122.204
-        generic = mkSystem inputs.nixpkgs-stable "x86_64-linux" "generic" "beastie";
+        generic = mkSystem inputs.nixpkgs "x86_64-linux" "generic" "beastie";
-        test-kvm = mkSystem inputs.nixpkgs-stable "x86_64-linux" "test-kvm" "beastie";
+        test-kvm = mkSystem inputs.nixpkgs "x86_64-linux" "test-kvm" "beastie";
-        home-nix = mkSystem inputs.nixpkgs-unstable "x86_64-linux" "home-nix" "beastie";
+        home-nix = mkSystem inputs.nixpkgs "x86_64-linux" "home-nix" "beastie";
-        work-nix = mkSystem inputs.nixpkgs-unstable "x86_64-linux" "work-nix" "beastie";
+        work-nix = mkSystem inputs.nixpkgs "x86_64-linux" "work-nix" "beastie";
         # live-usb = mkSystem inputs.nixpkgs "x86_64-linux" "live-usb" "beastie";
         #nixos-rebuild switch --flake ./#home-nix --sudo
       };

hosts/generic/default.nix

@@ -5,8 +5,8 @@
   ...
 }:
 {
-  system.stateVersion = "25.05";
+  system.stateVersion = "25.11";
-
+  
   imports = [
     ./disk-config.nix
     ./hardware-configuration.nix
@@ -83,7 +83,6 @@
     pkgs.nixos-anywhere
     pkgs.nixos-generators
     pkgs.ssh-to-age
-    pkgs.htop
   ];
 
   services.openssh.enable = true;

hosts/generic/disk-config.nix

@@ -6,7 +6,7 @@
     disk = {
       main = {
         type = "disk";
-        device = "/dev/vda";
+        device = "/dev/nvme0n1";
         content = {
           type = "gpt";
           partitions = {
@@ -23,88 +23,42 @@
             };
             SYS = {
               size = "100%";
-              type = "8300";
+              type = "8309";
               name = "SYS";
               content = {
-                type = "btrfs";
+                type = "luks";
-                extraArgs = [ "-f --nodiscard --label root" ];
+                name = "rootfs";
-                subvolumes = {
+                settings = {
-                  "@" = {
+                  allowDiscards = true;
-                    mountpoint = "/";
+                };
-                    mountOptions = [
+                content = {
-                      "defaults"
+                  type = "btrfs";
-                      "ssd"
+                  extraArgs = [ "-f --nodiscard --label root" ];
-                      "compress=zstd"
+                  subvolumes = {
-                      "autodefrag"
+                    "@" = {
-                      "noatime"
+                      mountpoint = "/";
-                      "nodiscard"
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                    ];
+                    };
-                  };
+                    "@root" = {
-                  "@root" = {
+                      mountpoint = "/root";
-                    mountpoint = "/root";
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                    mountOptions = [
+                    };
-                      "defaults"
+                    "@home" = {
-                      "ssd"
+                      mountpoint = "/home";
-                      "compress=zstd"
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                      "autodefrag"
+                    };
-                      "noatime"
+                    "@nix" = {
-                      "nodiscard"
+                      mountpoint = "/nix";
-                    ];
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                  };
+                    };
-                  "@home" = {
+                    "@var" = {
-                    mountpoint = "/home";
+                      mountpoint = "/var";
-                    mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                      "defaults"
+                    };
-                      "ssd"
+                    "@games" = {
-                      "compress=zstd"
+                      mountpoint = "/games";
-                      "autodefrag"
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                      "noatime"
+                    };
-                      "nodiscard"
-                    ];
-                  };
-                  "@nix" = {
-                    mountpoint = "/nix";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@var" = {
-                    mountpoint = "/var";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@data" = {
-                    mountpoint = "/games";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@backups" = {
-                    mountpoint = "/games";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
                   };
                 };
               };

hosts/generic/hardware-configuration.nix

@@ -5,13 +5,14 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/home-nix/default.nix

@@ -1,4 +1,6 @@
 {
+  pkgs,
+  username,
   hostname,
   modulesPath,
   inputs,
@@ -6,7 +8,7 @@
 }:
 {
   system.stateVersion = "25.11";
-
+  
   imports = builtins.trace "${inputs.mysecrets}" [
     (modulesPath + "/installer/scan/not-detected.nix")
     ./disk-config.nix
@@ -14,4 +16,4 @@
     ../../modules/core
     ../../modules/optionnals/hosts/${hostname}.nix
   ];
-}
+}

hosts/home-nix/disk-config.nix

@@ -37,69 +37,27 @@
                   subvolumes = {
                     "@" = {
                       mountpoint = "/";
-                      mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                        "defaults"
-                        "ssd"
-                        "compress=zstd"
-                        "autodefrag"
-                        "noatime"
-                        "nodiscard"
-                      ];
                     };
                     "@root" = {
                       mountpoint = "/root";
-                      mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                        "defaults"
-                        "ssd"
-                        "compress=zstd"
-                        "autodefrag"
-                        "noatime"
-                        "nodiscard"
-                      ];
                     };
                     "@home" = {
                       mountpoint = "/home";
-                      mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                        "defaults"
-                        "ssd"
-                        "compress=zstd"
-                        "autodefrag"
-                        "noatime"
-                        "nodiscard"
-                      ];
                     };
                     "@nix" = {
                       mountpoint = "/nix";
-                      mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                        "defaults"
-                        "ssd"
-                        "compress=zstd"
-                        "autodefrag"
-                        "noatime"
-                        "nodiscard"
-                      ];
                     };
                     "@var" = {
                       mountpoint = "/var";
-                      mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                        "defaults"
-                        "ssd"
-                        "compress=zstd"
-                        "autodefrag"
-                        "noatime"
-                        "nodiscard"
-                      ];
                     };
                     "@games" = {
                       mountpoint = "/games";
-                      mountOptions = [
+                      mountOptions = [ "defaults" "ssd" "compress=zstd" "autodefrag" "noatime" "nodiscard" ];
-                        "defaults"
-                        "ssd"
-                        "compress=zstd"
-                        "autodefrag"
-                        "noatime"
-                        "nodiscard"
-                      ];
                     };
                   };
                 };

hosts/home-nix/hardware-configuration.nix

@@ -1,47 +1,18 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
-  ];
+    ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-    "xhci_pci"
-    "ehci_pci"
-    "ahci"
-    "nvme"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  environment.etc."crypttab".text = ''
-    datafs UUID=5ca962a7-537f-46ce-ba50-9cc9cefd012b /etc/secrets/datafs.key luks
-  '';
-
-  fileSystems."/data" = {
-    device = "/dev/disk/by-uuid/a8ea6a7b-3733-40d8-bee8-45806aaacfe1";
-    fsType = "btrfs";
-    options = [
-      "defaults"
-      "compress=zstd"
-      "autodefrag"
-      "noatime"
-      "nofail"
-    ];
-  };
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/test-kvm/default.nix

@@ -7,13 +7,50 @@
   ...
 }:
 {
-  system.stateVersion = "25.05";
+  system.stateVersion = "25.11";
 
   imports = builtins.trace "${inputs.mysecrets}" [
     (modulesPath + "/installer/scan/not-detected.nix")
+    ./network.nix
     ./disk-config.nix
     ./hardware-configuration.nix
     ../../modules/core
     ../../modules/optionnals/hosts/${hostname}.nix
   ];
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  time.timeZone = "Europe/Paris";
+
+  nix = {
+    settings = {
+      ## Enable flakes
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      ## Users trusted to use flake command
+      trusted-users = [
+        "root"
+        "${username}"
+      ];
+    };
+  };
+
+  ## Enable virtualisation guest settings
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+  services.xserver = {
+    videoDrivers = [ "modesetting" ]; # Driver vidéo optimisé pour QEMU/KVM
+  };
+
+  environment.systemPackages = [
+    pkgs.spice-gtk # Outils SPICE
+    pkgs.spice-protocol # Protocoles SPICE
+  ];
+
+  #fileSystems."/" = {
+  #  device = "/dev/vda2"; # Disque virtuel typique
+  #  fsType = "btrfs";
+  #};
 }

hosts/test-kvm/disk-config.nix

@@ -10,103 +10,22 @@
         content = {
           type = "gpt";
           partitions = {
-            EFI = {
+            ESP = {
               size = "512M";
               type = "EF00";
-              name = "EFI";
               content = {
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
               };
             };
-            SYS = {
+            root = {
               size = "100%";
               type = "8300";
-              name = "SYS";
               content = {
-                type = "btrfs";
+                type = "filesystem";
-                extraArgs = [ "-f --nodiscard --label root" ];
+                format = "btrfs";
-                subvolumes = {
+                mountpoint = "/";
-                  "@" = {
-                    mountpoint = "/";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@root" = {
-                    mountpoint = "/root";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@home" = {
-                    mountpoint = "/home";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@nix" = {
-                    mountpoint = "/nix";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@var" = {
-                    mountpoint = "/var";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@data" = {
-                    mountpoint = "/games";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                  "@backups" = {
-                    mountpoint = "/games";
-                    mountOptions = [
-                      "defaults"
-                      "ssd"
-                      "compress=zstd"
-                      "autodefrag"
-                      "noatime"
-                      "nodiscard"
-                    ];
-                  };
-                };
               };
             };
           };

hosts/test-kvm/hardware-configuration.nix

@@ -1,16 +1,38 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.availableKernelModules = [
-  boot.initrd.kernelModules = [ ];
+    "ahci"
-  boot.kernelModules = [ "kvm-intel" ];
+    "xhci_pci"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+    "virtio_scsi"
+    "virtio_net"
+    "virtio_blk"
+  ];
+  boot.initrd.kernelModules = [
+    "virtio_balloon"
+    "virtio_console"
+    "virtio_rng"
+  ];
+  boot.kernelModules = [
+    "kvm-intel"
+    "virtio-gpu"
+  ];
   boot.extraModulePackages = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

hosts/work-nix/default.nix

@@ -1,4 +1,6 @@
 {
+  pkgs,
+  username,
   hostname,
   modulesPath,
   inputs,

modules/core/default.nix

@@ -5,7 +5,6 @@
   imports = [
     ./grub.nix
     ./packages.nix
-    ./sops.nix
     ./ssh.nix
     ./system.nix
     ./tty.nix

modules/core/packages.nix

@@ -15,7 +15,6 @@
     pkgs.unzip
     pkgs.sops
     pkgs.ssh-to-age
-    pkgs.age
     pkgs.nixos-anywhere
     pkgs.nixos-generators
     pkgs.efibootmgr
@@ -24,9 +23,6 @@
     pkgs.jq
     pkgs.bash
     pkgs.fzf
-    pkgs.bc
-    pkgs.wakeonlan
-    pkgs.openssl
   ];
   services = {
     locate = {

modules/core/sops.nix

@@ -1,19 +0,0 @@
-{
-  inputs,
-  ...
-}:
-let
-  secretsPath = builtins.toString inputs.mysecrets;
-in
-{
-  sops = {
-    defaultSopsFile = "${secretsPath}/secrets.yaml";
-    age = {
-      sshKeyPaths = [
-        "/etc/ssh/ssh_host_ed25519_key"
-      ];
-      keyFile = "/var/lib/sops-nix/key.txt";
-      generateKey = true;
-    };
-  };
-}

modules/core/system.nix

@@ -2,6 +2,8 @@
   pkgs,
   username,
   hostname,
+  modulesPath,
+  inputs,
   ...
 }:
 {
@@ -21,14 +23,12 @@
         "root"
         "${username}"
       ];
-      ## Use 24 cores during building phases
-      cores = 24;
-      max-jobs = "auto";
     };
   };
 
   networking = {
     hostName = "${hostname}";
+    networkmanager.enable = true;
     firewall.enable = true;
   };
-}
+}

modules/core/users.nix

@@ -5,11 +5,6 @@
   ...
 }:
 {
-  sops.secrets = {
-    "users_password/beastie" = {
-      neededForUsers = true;
-    };
-  };
   users = {
     users = {
       ${username} = {

modules/optionnals/ai.nix

@@ -4,36 +4,37 @@
 }:
 {
   # Activer Ollama comme service
-  # services.ollama = {
+  services.ollama = {
-  #   enable = true;
+    enable = true;
-  #   acceleration = "cuda";
+    acceleration = "cuda";
-  #   environmentVariables = {
+    environmentVariables = {
-  #     OLLAMA_FLASH_ATTENTION = "1"; # ← Flash Attention
+      OLLAMA_FLASH_ATTENTION = "1"; # ← Flash Attention
-  #     OLLAMA_NUM_PARALLEL = "2"; # ← Requêtes parallèles
+      OLLAMA_NUM_PARALLEL = "2"; # ← Requêtes parallèles
-  #     OLLAMA_MAX_LOADED_MODELS = "1"; # ← Garder 2 modèles en VRAM
+      OLLAMA_MAX_LOADED_MODELS = "1"; # ← Garder 2 modèles en VRAM
-  #     OLLAMA_KEEP_ALIVE = "5m";
+      OLLAMA_KEEP_ALIVE = "5m";
-  #   };
+    };
-  # };
+  };
-  # services.open-webui = {
+
-  #   enable = true;
+  services.open-webui = {
-  #   port = 8080; # Port par défaut
+    enable = true;
-  #   host = "127.0.0.1"; # Localhost uniquement
+    port = 8080; # Port par défaut
-  #   openFirewall = true;
+    host = "127.0.0.1"; # Localhost uniquement
-  #   # Pour accès réseau : host = "0.0.0.0";
+    openFirewall = true;
-  #   environment = {
+    # Pour accès réseau : host = "0.0.0.0";
-  #     ANONYMIZED_TELEMETRY = "True";
+    environment = {
-  #     DO_NOT_TRACK = "True";
+      ANONYMIZED_TELEMETRY = "True";
-  #     SCARF_NO_ANALYTICS = "True";
+      DO_NOT_TRACK = "True";
-  #     # URL d'Ollama (local)
+      SCARF_NO_ANALYTICS = "True";
-  #     OLLAMA_BASE_URL = "http://127.0.0.1:11434";
+      # URL d'Ollama (local)
-  #     # Autres options optionnelles (https://docs.openwebui.com/getting-started/env-configuration/#web-search)
+      OLLAMA_BASE_URL = "http://127.0.0.1:11434";
-  #     WEBUI_AUTH = "False"; # Desactive l'authentification
+      # Autres options optionnelles (https://docs.openwebui.com/getting-started/env-configuration/#web-search)
-  #     # ENABLE_WEB_SEARCH = "True";
+      WEBUI_AUTH = "False"; # Desactive l'authentification
-  #     # ENABLE_SEARCH_QUERY_GENERATION = "True";
+      # ENABLE_WEB_SEARCH = "True";
-  #     # WEB_SEARCH_ENGINE = "duckduckgo";
+      # ENABLE_SEARCH_QUERY_GENERATION = "True";
-  #     # WEB_LOADER_ENGINE = "safe_web";
+      # WEB_SEARCH_ENGINE = "duckduckgo";
-  #   };
+      # WEB_LOADER_ENGINE = "safe_web";
-  # };
+    };
+  };
   environment = {
     systemPackages = [
       pkgs.lmstudio
@@ -42,5 +43,8 @@
     variables = {
       OLLAMA_API_BASE = "http://localhost:11434";
     };
+    shellAliases = {
+      aider = "aider --config ~/.config/aider/.aider.conf.yml";
+    };
   };
 }

modules/optionnals/desktop/code.nix

@@ -71,31 +71,27 @@ let
 in
 {
   environment.systemPackages = [
-    # (pkgs.vscode-with-extensions.override {
+    (pkgs.vscode-with-extensions.override {
-    #   vscode = pkgs.vscodium;
+      vscode = pkgs.vscodium;
-    #   vscodeExtensions = [
+      vscodeExtensions = [
-    #     # pkgs.vscode-extensions.continue.continue
+        pkgs.vscode-extensions.continue.continue
-    #     pkgs.vscode-extensions.catppuccin.catppuccin-vsc
+        pkgs.vscode-extensions.catppuccin.catppuccin-vsc
-    #     pkgs.vscode-extensions.catppuccin.catppuccin-vsc-icons
+        pkgs.vscode-extensions.catppuccin.catppuccin-vsc-icons
-    #     pkgs.vscode-extensions.jnoortheen.nix-ide
+        pkgs.vscode-extensions.jnoortheen.nix-ide
-    #     pkgs.vscode-extensions.redhat.ansible
+        pkgs.vscode-extensions.redhat.ansible
-    #     pkgs.vscode-extensions.redhat.vscode-yaml
+        pkgs.vscode-extensions.redhat.vscode-yaml
-    #     pkgs.vscode-extensions.ms-azuretools.vscode-docker
+        pkgs.vscode-extensions.ms-azuretools.vscode-docker
-    #     pkgs.vscode-extensions.mads-hartmann.bash-ide-vscode
+        pkgs.vscode-extensions.mads-hartmann.bash-ide-vscode
-    #   ]
+      ]
-    #   ++ [ open-remote-ssh ];
+      ++ [ open-remote-ssh ];
-    # })
+    })
-    pkgs.vscodium
     pkgs.nodejs_24
     pkgs.nodePackages.npm
     pkgs.gcc
     pkgs.gnumake
     pkgs.nixd
-    pkgs.nixfmt
+    pkgs.nixfmt-rfc-style
     pkgs.ansible
     pkgs.python313
-    pkgs.claude-code
-    pkgs.nodejs
-    pkgs.php
   ];
 }

modules/optionnals/desktop/config/etc/xdg/hypr/hyprland-home-nix.conf

@@ -13,5 +13,3 @@ workspace = 5, monitor:HDMI-A-2
 workspace = 6, monitor:HDMI-A-2
 workspace = 7, monitor:HDMI-A-2
 workspace = 8, monitor:HDMI-A-2
-
-exec-once = nextcloud

modules/optionnals/desktop/config/etc/xdg/hypr/hyprland.conf

@@ -22,6 +22,7 @@ $terminal = kitty
 exec-once = hyprpaper
 exec-once = waybar
 
+
 #############################
 ### ENVIRONMENT VARIABLES ###
 #############################
@@ -164,8 +165,8 @@ master {
 
 # https://wiki.hyprland.org/Configuring/Variables/#misc
 misc {
-    force_default_wallpaper = 1 # Set to 0 or 1 to disable the anime mascot wallpapers
+    force_default_wallpaper = -1 # Set to 0 or 1 to disable the anime mascot wallpapers
-    disable_hyprland_logo = true # If true disables the random hyprland logo / anime girl background. :(
+    disable_hyprland_logo = false # If true disables the random hyprland logo / anime girl background. :(
 }
 
 
@@ -308,17 +309,15 @@ bindl = , XF86AudioPrev, exec, playerctl previous
 # windowrule = float,class:^(kitty)$,title:^(kitty)$
 
 # Ignore maximize requests from apps. You'll probably like this.
-# windowrule = suppressevent maximize, class:.*
+windowrule = suppressevent maximize, class:.*
 
 # Fix some dragging issues with XWayland
-# windowrule = nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0
+windowrule = nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0
 
 # Supprimer la transparence pour des applications spécifiques
-# Opacity order : active, inactive, fullscreen
+windowrulev2 = opacity 1.0 override,class:firefox
-windowrule = match:class firefox, opacity 1.0 override 0.95 override 1.0 override
+windowrulev2 = opacity 1.0 override,class:^(chromium)$
-windowrule = match:class chromium, opacity 1.0 override 0.95 override 1.0 override
+windowrulev2 = opacity 1.0 override,class:^(mpv)$
-windowrule = match:class mpv, opacity 0.95 override 0.80 override 1.0 override
+windowrulev2 = opacity 1.0 override,class:^(mpv)$
-
-#windowrule = match:class mpv, fullscreen override
-#windowrulev2 = fullscreen,class:^(mpv)$
 
+windowrulev2 = fullscreen,class:^(mpv)$

modules/optionnals/desktop/config/etc/xdg/hypr/hyprpaper.conf

@@ -1,7 +1,2 @@
-wallpaper {
+preload = ~/Downloads/wallpaper.jpeg
-    monitor =
+wallpaper = , ~/Downloads/wallpaper.jpeg
-    path = ~/Downloads/wallpaper.jpeg
-    fit_mode = cover
-}
-
-splash = false

modules/optionnals/desktop/config/etc/xdg/scripts/waybar-mailbox.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 _USER=beastie
-_PASSWD=$(cat /run/secrets/ldap_unxiyourbrain/password)
+_PASSWD='}q6658JD~{}{oiRWsb~Q{P@SV=Qsy,ae'
 _SERVER=unixyourbrain.org
 _FOLDER=Admin
 

modules/optionnals/desktop/config/etc/xdg/scripts/waybar-update.sh

@@ -3,13 +3,13 @@
 cd ~/nixos/dotfiles || exit
 
 # Obtenir le hash actuel
-current_hash=$(nix flake metadata --json 2>/dev/null | jq -r '.locks.nodes."nixpkgs-unstable".locked.rev')
+current_hash=$(nix flake metadata --json 2>/dev/null | jq -r '.locks.nodes.nixpkgs.locked.rev')
 
 # Obtenir le hash le plus récent
 latest_hash=$(nix flake metadata github:NixOS/nixpkgs/nixos-unstable --json | jq -r '.locked.rev')
 
 # Date du commit local
-local_commit_date=$(nix flake metadata --json 2>/dev/null | jq -r '.locks.nodes."nixpkgs-unstable".locked.lastModified')
+local_commit_date=$(nix flake metadata --json 2>/dev/null | jq -r '.locks.nodes.nixpkgs.locked.lastModified')
 local_commit_date=$(date -d "@${local_commit_date}" "+%d/%m/%Y à %H:%M")
 
 if [ "$current_hash" != "$latest_hash" ]; then
@@ -17,7 +17,7 @@ if [ "$current_hash" != "$latest_hash" ]; then
   maj_count=$(curl -s "https://api.github.com/repos/NixOS/nixpkgs/compare/${current_hash}...${latest_hash}" | jq -r '.ahead_by // 0' 2>/dev/null || echo "?")
 
   # Date du commit distant
-  remote_commit_date=$(curl -s https://api.github.com/repos/NixOS/nixpkgs/commits/${latest_hash} | jq -r '.commit.author.date')
+  remote_commit_date=$(curl -s https://api.github.com/repos/NixOS/nixpkgs/commits/c87b95e25065c028d31a94f06a62927d18763fdf | jq -r '.commit.author.date')
   remote_commit_date=$(date -d "${remote_commit_date}" "+%d/%m/%Y à %H:%M")
   printf '{"text": "%s ", "tooltip": "Commit distant : %s\\nCommit local : %s"}' "${maj_count}" "${remote_commit_date}" "${local_commit_date}"
     # Compter les commits entre les deux

modules/optionnals/desktop/gaming.nix

@@ -1,18 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  hardware.graphics.enable32Bit = true;
-  programs.steam.enable = true;
-  programs.steam.gamescopeSession.enable = true;
-  programs.gamemode.enable = true;
-  environment.systemPackages = with pkgs; [
-    vulkan-tools
-    lutris
-    wine-staging
-    winetricks
-    mangohud
-    protonup-ng
-  ];
-}

modules/optionnals/desktop/kitty.nix

@@ -23,7 +23,7 @@
         [[ "$TERM" == "xterm-kitty" ]] && export TERM="xterm-256color" 
         [[ -f ${pkgs.nitch}/bin/nitch ]] && nitch
         if [[ -z $DISPLAY ]] && [[ $(tty) = /dev/tty1 ]]; then
-          start-hyprland -- --config /etc/xdg/hypr/hyprland.conf
+          hyprland --config /etc/xdg/hypr/hyprland.conf
         fi
       '';
     };

modules/optionnals/desktop/nextcloud.nix

@@ -1,12 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  services.gnome.gnome-keyring.enable = true;
-
-  environment.systemPackages = [
-    pkgs.nextcloud-client
-    pkgs.seahorse
-  ];
-}

modules/optionnals/desktop/nvidia.nix

@@ -20,7 +20,5 @@
       package = config.boot.kernelPackages.nvidiaPackages.latest;
     };
   };
-  environment.systemPackages = [
+  environment.systemPackages = [ pkgs.nvtopPackages.full ];
-    pkgs.nvtopPackages.full
-  ];
 }

modules/optionnals/desktop/packages.nix

@@ -6,11 +6,9 @@
   environment.systemPackages = [
     pkgs.remmina
     pkgs.mpv
-    pkgs.jellyfin-mpv-shim
     pkgs.yt-dlp
     pkgs.chromium
     pkgs.firefox
-    pkgs.thunderbird
     pkgs.keepassxc
     pkgs.nwg-look
     pkgs.gimp
@@ -26,11 +24,6 @@
     pkgs.catppuccin-cursors
     pkgs.catppuccin-gtk
     pkgs.postman
-    pkgs.samba
-    pkgs.openldap
-    pkgs.argocd
-    pkgs.talosctl
-    pkgs.talhelper
   ];
   fonts.packages = [
     pkgs.nerd-fonts.dejavu-sans-mono

modules/optionnals/desktop/starship.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   ...
 }:
 {

modules/optionnals/desktop/virt-manager.nix

@@ -4,4 +4,4 @@
 {
   programs.virt-manager.enable = true;
   virtualisation.spiceUSBRedirection.enable = true;
-}
+}

modules/optionnals/docker.nix

@@ -1,8 +0,0 @@
-{
-  username,
-  ...
-}:
-{
-  virtualisation.docker.enable = true;
-  users.users.${username}.extraGroups = [ "docker" ];
-}

modules/optionnals/hosts/home-nix.nix

@@ -5,42 +5,30 @@
 }:
 {
   imports = [
-    #../ai.nix
+    ../ai.nix
     ../autologin.nix
-    ../docker.nix
     ../k8s.nix
-    ../libvirt.nix
     ../openfortivpn.nix
-    ../options.nix
     ../packages.nix
     ../sops-desktop.nix
     ../ssh.nix
     ../sudo-nopasswd.nix
-    ../wakeonlan.nix
 
     ### Import GUI modules
     ../desktop/code.nix
     ../desktop/dunst.nix
-    ../desktop/gaming.nix
     ../desktop/kitty.nix
-    ../desktop/nextcloud.nix
     ../desktop/packages.nix
     ../desktop/pipewire.nix
     ../desktop/qwerty-fr.nix
     ../desktop/rofi.nix
     ../desktop/starship.nix
-    ../desktop/virt-manager.nix
     ../desktop/wayland.nix
 
     ### Import Graphics modules
     ../desktop/nvidia.nix
   ];
 
-  my.laninterface = "enp5s0";
-  my.ipv4address = "192.168.0.2";
-  my.ipv4netmask = 24;
-  my.ipv4gateway = "192.168.0.254";
-
   sops = {
     secrets = {
       "wireguard_home/publickey" = { };
@@ -49,31 +37,25 @@
     };
   };
 
-  #services.resolved.enable = false;
-
   networking = {
-    #useNetworkd = true;
+    interfaces.enp5s0 = {
-    #useHostResolvConf = false;
-    interfaces.${config.my.laninterface} = {
       ipv4.addresses = [
         {
-          address = config.my.ipv4address;
+          address = "192.168.0.2";
-          prefixLength = config.my.ipv4netmask;
+          prefixLength = 24;
         }
       ];
     };
     defaultGateway = {
-      address = config.my.ipv4gateway;
+      address = "192.168.0.254";
-      interface = config.my.laninterface;
+      interface = "enp5s0";
     };
     nameservers = [
-      "10.0.0.1"
+      #"9.9.9.9"
-      "9.9.9.9"
       "2001:41d0:303:20da::1"
       "217.182.138.218"
     ];
     extraHosts = ''
-      #172.18.229.240  test-mycarto.grandbesancon.fr
       172.18.21.172     errorpages.grandbesancon.fr
       #172.18.23.4    dozzle.grandbesancon.fr
       #172.18.22.206  toto.grandbesancon.fr
@@ -81,8 +63,6 @@
       #172.18.20.37   sso.grandbesancon.fr
       #172.18.20.229  auth.grandbesancon.fr
       #172.18.20.181  traefikauth.grandbesancon.fr
-      172.18.21.174     test-patchmon.grandbesancon.fr
-      172.18.229.240    test-mycarto-autonome.grandbesancon.fr
     '';
     wireguard = {
       interfaces = {
@@ -110,29 +90,5 @@
       };
     };
   };
-
+  environment.systemPackages = [ pkgs.tor-browser ];
-  sops.secrets."home-nix/myipv6address" = { };
-
-  systemd.services.ipv6-setup = {
-    description = "Configure IPv6";
-    after = [
-      "network.target"
-      "sops-nix.service"
-    ];
-    wants = [ "sops-nix.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = pkgs.writeShellScript "setup-ipv6" ''
-        ${pkgs.iproute2}/bin/ip -6 addr add $(cat ${
-          config.sops.secrets."home-nix/myipv6address".path
-        })/64 dev ${config.my.laninterface} || true
-      '';
-    };
-  };
-
-  environment.systemPackages = [
-    pkgs.tor-browser
-  ];
 }

modules/optionnals/hosts/test-kvm.nix

@@ -1,5 +1,4 @@
 {
-  pkgs,
   ...
 }:
 {
@@ -7,70 +6,14 @@
     ../sops-desktop.nix
     ../sudo-nopasswd.nix
     ../autologin.nix
-    ../packages.nix
+    ../ssh.nix
 
-    ## Server
+    ### Import GUI modules
-    ../server/starship.nix
+    ../desktop/dunst.nix
-    ../server/wireguard-ui.nix
+    ../desktop/kitty.nix
+    ../desktop/packages.nix
+    ../desktop/qwerty-fr.nix
+    ../desktop/rofi.nix
+    ../desktop/wayland.nix
   ];
-
-  ## Enable virtualisation guest settings
-  services.qemuGuest.enable = true;
-  services.spice-vdagentd.enable = true;
-  services.xserver = {
-    videoDrivers = [ "modesetting" ]; # Driver vidéo optimisé pour QEMU/KVM
-  };
-
-  environment.systemPackages = [
-    pkgs.spice-gtk # Outils SPICE
-    pkgs.spice-protocol # Protocoles SPICE
-  ];
-
-  systemd.network.links."10-eth0" = {
-    matchConfig.MACAddress = "52:54:00:a3:d7:56";
-    linkConfig.Name = "eth0";
-  };
-
-  systemd.network.netdevs."10-dummy0" = {
-    netdevConfig = {
-      Kind = "dummy";
-      Name = "dummy0";
-    };
-  };
-
-  networking = {
-    useNetworkd = true;
-    useDHCP = false;
-
-    interfaces = {
-      dummy0 = {
-        ipv4.addresses = [
-          {
-            address = "192.168.2.1";
-            prefixLength = 24;
-          }
-        ];
-      };
-      eth0 = {
-        ipv4.addresses = [
-          {
-            address = "192.168.122.10";
-            prefixLength = 24;
-          }
-        ];
-      };
-    };
-    defaultGateway = {
-      address = "192.168.122.1";
-      interface = "eth0";
-    };
-    nameservers = [
-      #"9.9.9.9"
-      "2001:41d0:303:20da::1"
-      "217.182.138.218"
-    ];
-    extraHosts = ''
-      172.18.21.172     errorpages.grandbesancon.fr
-    '';
-  };
 }

modules/optionnals/hosts/work-nix.nix

@@ -1,12 +1,10 @@
 {
-  pkgs,
   username,
   ...
 }:
 {
   imports = [
     ../autologin.nix
-    ../docker.nix
     ../k8s.nix
     ../libvirt.nix
     ../openfortivpn.nix
@@ -35,17 +33,11 @@
   networking = {
     networkmanager.enable = true;
     extraHosts = ''
-      carto-interavtive               172.18.20.134
+      carto-interavtive 172.18.20.134
-      test-patchmon.grandbesancon.fr  172.18.21.174
-      test-crowdsec.grandbesancon.fr  172.18.21.67
-      test-syslog.grandbesancon.fr    172.18.21.67
     '';
   };
-  users.users.${username} = {
+    users.users.${username} = {
     extraGroups = [ "networkmanager" ];
   };
   programs.nm-applet.enable = true;
-  environment.systemPackages = [
-    pkgs.wireguard-tools
-  ];
 }

modules/optionnals/libvirt.nix

@@ -4,24 +4,18 @@
   ...
 }:
 {
-  users.users.${username} = {
-    extraGroups = [ "libvirtd" ];
-  };
   virtualisation = {
     libvirtd = {
       enable = true;
       qemu = {
         package = pkgs.qemu_full;
-        #package = pkgs.qemu;
         runAsRoot = true;
         swtpm.enable = true;
-        vhostUserPackages = [
-          pkgs.virtiofsd
-        ];
       };
     };
+
+  };
+  users.users.${username} = {
+    extraGroups = [ "libvirtd" ];
   };
-  environment.systemPackages = with pkgs; [
-    virtiofsd
-  ];
 }

modules/optionnals/options.nix

@@ -1,26 +0,0 @@
-{
-  lib,
-  ...
-}:
-{
-  options.my.laninterface = lib.mkOption {
-    type = lib.types.str;
-    default = "enp5s0";
-  };
-  options.my.ipv4address = lib.mkOption {
-    type = lib.types.str;
-    default = "127.0.0.1";
-  };
-  options.my.ipv4netmask = lib.mkOption {
-    type = lib.types.int;
-    default = 8;
-  };
-  options.my.ipv4gateway = lib.mkOption {
-    type = lib.types.str;
-    default = "127.0.0.254";
-  };
-  options.my.wolipv6address = lib.mkOption {
-    type = lib.types.str;
-    default = "fc::0";
-  };
-}

modules/optionnals/server/starship.nix

@@ -1,101 +0,0 @@
-{
-  ...
-}:
-{
-  environment.sessionVariables = {
-    KUBECONFIG = "$HOME/.kube/config";
-  };
-  programs.starship = {
-    enable = true;
-    settings = {
-      add_newline = true;
-      command_timeout = 1300;
-      scan_timeout = 50;
-      format = "[┌─](fg:surface1)$hostname$username$directory$git_branch$git_status[](fg:base bg:sky)$fill$kubernetes$time[─┐ ](fg:surface1)$line_break[└ ](fg:surface1)";
-      right_format = "[┘](fg:surface1)";
-      palette = "catppuccin_frappe";
-
-      hostname = {
-        ssh_only = false;
-        format = "[](bg:base fg:mauve)[ $hostname ](bg:mauve fg:base)[](bg:mauve fg:blue)";
-        disabled = false;
-      };
-
-      username = {
-        style_user = "bg:blue fg:base";
-        style_root = "bg:red fg:base bold";
-        format = "[ $user ]($style)[](bg:blue fg:sapphire)";
-        show_always = true;
-        disabled = false;
-      };
-
-      directory = {
-        format = "[ $path ](bg:sapphire fg:base)[](bg:sapphire fg:sky)";
-        truncation_length = 3;
-        truncation_symbol = "…/";
-      };
-
-      git_branch = {
-        symbol = " ";
-        format = "[ $symbol$branch(:$remote_branch) ](fg:base bg:sky)";
-        disabled = false;
-      };
-
-      git_status = {
-        format = "([$all_status$ahead_behind ](fg:base bg:sky))";
-        conflicted = "😵";
-        ahead = "";
-        behind = "";
-        diverged = "😵";
-        up_to_date = "✓";
-        untracked = "★";
-        stashed = "📦";
-        modified = "✗";
-        #staged = "[($count)](fg:base bg:sapphire)"
-        staged = "";
-        renamed = "";
-        deleted = "";
-        disabled = false;
-      };
-
-      fill = {
-        symbol = "─";
-        style = "surface1";
-      };
-
-      kubernetes = {
-        disabled = false;
-        format = "[](fg:blue bg:base)[ ($namespace)/($cluster) ](fg:base bg:blue)[](bg:blue fg:mauve)";
-      };
-
-      palettes.catppuccin_frappe = {
-        rosewater = "#f2d5cf";
-        flamingo = "#eebebe";
-        pink = "#f4b8e4";
-        mauve = "#ca9ee6";
-        red = "#e78284";
-        maroon = "#ea999c";
-        peach = "#ef9f76";
-        yellow = "#e5c890";
-        green = "#a6d189";
-        teal = "#81c8be";
-        sky = "#99d1db";
-        sapphire = "#85c1dc";
-        blue = "#8caaee";
-        lavender = "#babbf1";
-        text = "#c6d0f5";
-        subtext1 = "#b5bfe2";
-        subtext0 = "#a5adce";
-        overlay2 = "#949cbb";
-        overlay1 = "#838ba7";
-        overlay0 = "#737994";
-        surface2 = "#626880";
-        surface1 = "#51576d";
-        surface0 = "#414559";
-        base = "#303446";
-        mantle = "#292c3c";
-        crust = "#232634";
-      };
-    };
-  };
-}

modules/optionnals/server/wireguard-ui.nix

@@ -1,97 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  environment.systemPackages = [
-    pkgs.wireguard-tools
-    pkgs.wireguard-ui
-  ];
-
-  users.users.wireguard-ui = {
-    isSystemUser = true;
-    group = "wireguard-ui";
-    home = "/var/lib/wireguard-ui";
-    createHome = true;
-    description = "WireGuard UI service user";
-  };
-
-  users.groups.wireguard-ui = { };
-
-  systemd = {
-    tmpfiles.rules = [
-      "d /etc/wireguard 0750 wireguard-ui wireguard-ui -"
-      "d /var/lib/wireguard-ui 0750 wireguard-ui wireguard-ui -"
-    ];
-
-    services = {
-      wg-quick-wg0 = {
-        description = "WireGuard via wg-quick(8) for wg0";
-        after = [
-          "network-online.target"
-          "wireguard-ui.service"
-        ];
-        wants = [ "network-online.target" ];
-        wantedBy = [
-          "multi-user.target"
-          "sshd.service"
-        ];
-
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = "${pkgs.wireguard-tools}/bin/wg-quick up wg0";
-          ExecStop = "${pkgs.wireguard-tools}/bin/wg-quick down wg0";
-          ExecReload = "${pkgs.bash}/bin/bash -c 'exec ${pkgs.wireguard-tools}/bin/wg syncconf wg0 <(exec ${pkgs.wireguard-tools}/bin/wg-quick strip wg0)'";
-          Environment = [ "WG_ENDPOINT_RESOLUTION_RETRIES=infinity" ];
-        };
-      };
-
-      wireguard-ui = {
-        description = "WireGuard UI";
-        documentation = [ "https://github.com/ngoduykhanh/wireguard-ui" ];
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
-
-        serviceConfig = {
-          ExecStart = "${pkgs.wireguard-ui}/bin/wireguard-ui";
-          Restart = "on-failure";
-          WorkingDirectory = "/var/lib/wireguard-ui";
-          StateDirectory = "wireguard-ui";
-          User = "wireguard-ui";
-          Group = "wireguard-ui";
-          ReadWritePaths = [
-            "/var/lib/wireguard-ui"
-            "/etc/wireguard"
-          ];
-
-          Environment = [
-            # "WGUI_ENDPOINT_ADDRESS=${config.custom.wireguard-ui.endpointAddress}"
-            # "WGUI_DNS=${config.custom.wireguard-ui.dns}"
-          ];
-
-          AmbientCapabilities = "CAP_NET_ADMIN";
-        };
-      };
-
-      wg-quick-wg0-reload = {
-        description = "Reload WireGuard config";
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStart = "${pkgs.systemd}/bin/systemctl reload wg-quick-wg0.service";
-        };
-      };
-    };
-
-    paths.wg-quick-wg0-reload = {
-      description = "Watch /etc/wireguard/wg0.conf for changes";
-      wantedBy = [ "multi-user.target" ];
-      pathConfig = {
-        PathModified = "/etc/wireguard/wg0.conf";
-      };
-    };
-  };
-  networking.firewall.allowedTCPPorts = [ 5000 ];
-  networking.firewall.allowedUDPPorts = [ 51820 ];
-}

modules/optionnals/sops-desktop.nix

@@ -1,61 +1,66 @@
 {
+  inputs,
   username,
   ...
 }:
+let
+  secretsPath = builtins.toString inputs.mysecrets;
+in
 {
-  sops.secrets = {
+  sops = {
-    "users_password/beastie" = {
+    defaultSopsFile = "${secretsPath}/secrets.yaml";
-      neededForUsers = true;
+    age = {
+      sshKeyPaths = [
+        "/etc/ssh/ssh_host_ed25519_key"
+      ];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
     };
-    "ssh_keys/default_pub" = {
+
-      owner = "${username}";
+    secrets = {
-      mode = "0644";
+      "users_password/beastie" = {
-      path = "/home/${username}/.ssh/id_ed25519.pub";
+        neededForUsers = true;
-    };
+      };
-    "ssh_keys/default_priv" = {
+      "ssh_keys/default_pub" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0600";
+        mode = "0644";
-      path = "/home/${username}/.ssh/id_ed25519";
+        path = "/home/${username}/.ssh/id_ed25519.pub";
-    };
+      };
-    "ssh_keys/ansible_pub" = {
+      "ssh_keys/default_priv" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0644";
+        mode = "0600";
-      path = "/home/${username}/.ssh/id_ed25519_ansible.pub";
+        path = "/home/${username}/.ssh/id_ed25519";
-    };
+      };
-    "ssh_keys/ansible_priv" = {
+      "ssh_keys/ansible_pub" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0600";
+        mode = "0644";
-      path = "/home/${username}/.ssh/id_ed25519_ansible";
+        path = "/home/${username}/.ssh/id_ed25519_ansible.pub";
-    };
+      };
-    "ssh_keys/beastie_pub" = {
+      "ssh_keys/ansible_priv" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0644";
+        mode = "0600";
-      path = "/home/${username}/.ssh/id_ed25519_beastie.pub";
+        path = "/home/${username}/.ssh/id_ed25519_ansible";
-    };
+      };
-    "ssh_keys/beastie_priv" = {
+      "ssh_keys/beastie_pub" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0600";
+        mode = "0644";
-      path = "/home/${username}/.ssh/id_ed25519_beastie";
+        path = "/home/${username}/.ssh/id_ed25519_beastie.pub";
-    };
+      };
-    "ssh_keys/gitea_semaphore_pub" = {
+      "ssh_keys/beastie_priv" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0644";
+        mode = "0600";
-      path = "/home/${username}/.ssh/id_ed25519_gitea_semaphore.pub";
+        path = "/home/${username}/.ssh/id_ed25519_beastie";
-    };
+      };
-    "ssh_keys/gitea_semaphore_priv" = {
+      "ssh_keys/gitea_semaphore_pub" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0600";
+        mode = "0644";
-      path = "/home/${username}/.ssh/id_ed25519_gitea_semaphore";
+        path = "/home/${username}/.ssh/id_ed25519_gitea_semaphore.pub";
-    };
+      };
-    "ssh_keys/wol_pub" = {
+      "ssh_keys/gitea_semaphore_priv" = {
-      owner = "${username}";
+        owner = "${username}";
-      mode = "0644";
+        mode = "0600";
-      path = "/home/${username}/.ssh/id_ed25519_wol";
+        path = "/home/${username}/.ssh/id_ed25519_gitea_semaphore";
-    };
+      };
-    "ssh_keys/wol_priv" = {
-      owner = "${username}";
-      mode = "0600";
-      path = "/home/${username}/.ssh/id_ed25519_wol.priv";
     };
   };
 }

modules/optionnals/wakeonlan.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  pkgs,
-  hostname,
-  ...
-}:
-{
-  systemd.services."wol${config.my.laninterface}" = {
-    description = "Wake-on-LAN for ${config.my.laninterface}";
-    after = [ "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${pkgs.ethtool}/bin/ethtool -s ${config.my.laninterface} wol g";
-      RandomizedDelaySec = "30s";
-    };
-  };
-  environment.systemPackages = [ pkgs.ethtool ];
-
-  my.wolipv6address = "2a01:e0a:f5d:3400:6b2c:41d7:e9f5";
-
-  boot.initrd = {
-    network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 65234;
-        authorizedKeys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ2+PXfG/37rsvcVr2RAHzXmGHMr8+8iBH//1YS+zWd3"
-        ]; # ta clé publique
-        hostKeys = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      };
-      postCommands = ''
-        ip -6 addr add ${config.my.wolipv6address}/64 dev ${config.my.laninterface}
-        ip -6 route add default via fe80::3a07:16ff:fe11:45a8 dev ${config.my.laninterface}
-      '';
-    };
-    availableKernelModules = [ "r8169" ];
-
-  };
-
-  boot = {
-    kernelParams = [
-      "ip=${config.my.ipv4address}::255.255.255.0:${config.my.ipv4gateway}:${hostname}:${config.my.laninterface}:off"
-    ];
-  };
-}