nixos: start using home-manager

ops/nixos/lib/client.nix

@@ -2,20 +2,15 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-{ pkgs, depot, lib, ... }:
+{ pkgs, config, depot, lib, ... }:
 let 
   inherit (lib) mkBefore;
 in
 {
-  nix.gc.automatic = false;
+  imports = [ ../../../third_party/home-manager/nixos ];
 
-  users.users.lukegb.packages = mkBefore (with pkgs; [
+  config = {
-    depot.nix.pkgs.copybara
+    my.home-manager.imports = lib.mkAfter [ ./home-manager/client.nix ];
-    direnv
+    nix.gc.automatic = false;
-    git
+  };
-    go
-    graphicsmagick-imagemagick-compat
-    ripgrep
-    whois
-  ]);
 }

ops/nixos/lib/common.nix

@@ -2,90 +2,113 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-{ pkgs, depot, lib, rebuilder, ... }:
+{ pkgs, config, depot, lib, rebuilder, ... }@args:
 let 
   inherit (lib) mkDefault;
 in
 {
-  hardware.enableRedistributableFirmware = true;
+  options.my.home-manager.imports = lib.mkOption {
-
+    type = lib.types.listOf lib.types.path;
-  nix = {
+    default = [ ./home-manager/common.nix ];
-    nixPath = [ "depot=/home/lukegb/depot/" "nixpkgs=/home/lukegb/depot/third_party/nixpkgs/" ];
-    trustedUsers = [ "root" "@wheel" ];
-    binaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
-    trustedBinaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
-    envVars = {
-      AWS_ACCESS_KEY_ID = "${depot.ops.secrets.nixCache.AWS_ACCESS_KEY_ID}";
-      AWS_SECRET_ACCESS_KEY = "${depot.ops.secrets.nixCache.AWS_SECRET_ACCESS_KEY}";
-    };
   };
-  nixpkgs.config = depot.third_party.nixpkgsConfig;
+  options.my.home-manager.system = lib.mkOption {
-
+    type = lib.types.nullOr lib.types.anything;
-  i18n.defaultLocale = "en_GB.UTF-8";
+    default = null;
-  console.keyMap = "us";
-
-  time.timeZone = mkDefault "Etc/UTC";
-
-  environment.systemPackages = with pkgs; [
-    vim rxvt_unicode.terminfo tmux rebuilder tailscale rsync
-    (mercurial.overridePythonAttrs (origAttrs: {
-      propagatedBuildInputs = origAttrs.propagatedBuildInputs ++ [python3Packages.hg-evolve depot.nix.pkgs.hg-git];
-    }))
-  ];
-
-  networking.firewall = {
-    allowPing = true;
   };
 
-  users.mutableUsers = false;
+  config = {
-  users.users = let secrets = depot.ops.secrets; in {
+    hardware.enableRedistributableFirmware = true;
-    root.hashedPassword = secrets.passwordHashes.root;
+
-    lukegb = {
+    nix = {
-      isNormalUser = true;
+      nixPath = [ "depot=/home/lukegb/depot/" "nixpkgs=/home/lukegb/depot/third_party/nixpkgs/" ];
-      uid = 1000;
+      trustedUsers = [ "root" "@wheel" ];
-      extraGroups = [ "wheel" ];
+      binaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
-      hashedPassword = secrets.passwordHashes.lukegb;
+      trustedBinaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
+      envVars = {
+        AWS_ACCESS_KEY_ID = "${depot.ops.secrets.nixCache.AWS_ACCESS_KEY_ID}";
+        AWS_SECRET_ACCESS_KEY = "${depot.ops.secrets.nixCache.AWS_SECRET_ACCESS_KEY}";
+      };
     };
-    deployer = {
+    nixpkgs.config = depot.third_party.nixpkgsConfig;
-      isSystemUser = true;
+
-      uid = 1001;
+    i18n.defaultLocale = "en_GB.UTF-8";
-      hashedPassword = "!";
+    console.keyMap = "us";
-      useDefaultShell = true;
+
-      home = "/var/lib/deployer";
+    time.timeZone = mkDefault "Etc/UTC";
-      createHome = true;
+
-      openssh.authorizedKeys.keyFiles = [
+    environment.systemPackages = with pkgs; [
-        ../../secrets/deployer_ed25519.pub
+      vim rxvt_unicode.terminfo tmux rebuilder tailscale rsync
-      ];
+      (mercurial.overridePythonAttrs (origAttrs: {
+        propagatedBuildInputs = origAttrs.propagatedBuildInputs ++ [python3Packages.hg-evolve depot.nix.pkgs.hg-git];
+      }))
+    ];
+
+    networking.firewall = {
+      allowPing = true;
     };
-  };
+
-  security.sudo.extraRules = [{
+    users.mutableUsers = false;
-    users = [ "deployer" ];
+    users.users = let secrets = depot.ops.secrets; in {
-    commands = [{
+      root.hashedPassword = secrets.passwordHashes.root;
-      command = "${rebuilder}/bin/rebuilder";
+      lukegb = {
-      options = [ "NOPASSWD" ];
+        isNormalUser = true;
+        uid = 1000;
+        extraGroups = [ "wheel" ];
+        hashedPassword = secrets.passwordHashes.lukegb;
+      };
+      deployer = {
+        isSystemUser = true;
+        uid = 1001;
+        hashedPassword = "!";
+        useDefaultShell = true;
+        home = "/var/lib/deployer";
+        createHome = true;
+        openssh.authorizedKeys.keyFiles = [
+          ../../secrets/deployer_ed25519.pub
+        ];
+      };
+    };
+    security.sudo.extraRules = [{
+      users = [ "deployer" ];
+      commands = [{
+        command = "${rebuilder}/bin/rebuilder";
+        options = [ "NOPASSWD" ];
+      }];
     }];
-  }];
+    security.sudo.extraConfig = ''
-  security.sudo.extraConfig = ''
+      Defaults:deployer !requiretty
-    Defaults:deployer !requiretty
+    '';
-  '';
 
-  programs.mtr.enable = true;
+    programs.mtr.enable = true;
-  services.openssh.enable = true;
+    services.openssh.enable = true;
-  services.tailscale.enable = true;
+    services.tailscale.enable = true;
 
-  boot = {
+    boot = {
-    kernelModules = [ "tcp_bbr" ];
+      kernelModules = [ "tcp_bbr" ];
-    kernel.sysctl."net.ipv4.tcp_congestion_control" = "bbr";
+      kernel.sysctl."net.ipv4.tcp_congestion_control" = "bbr";
-    kernel.sysctl."net.core.default_qdisc" = "fq_codel";
+      kernel.sysctl."net.core.default_qdisc" = "fq_codel";
-  };
+    };
 
-  system.activationScripts.lukegb-hgrc = lib.stringAfter [ "users" "groups" ] ''
+    # Clean up daily.
-    ln -sfn ${./hgrc} /home/lukegb/.hgrc
+    nix.gc = {
-  '';
+      automatic = lib.mkDefault true;
+      dates = "*-*-* 05:00:00";
+    };
 
-  # Clean up daily.
+    home-manager.useUserPackages = true;
-  nix.gc = {
+    home-manager.useGlobalPkgs = true;
-    automatic = lib.mkDefault true;
+
-    dates = "*-*-* 05:00:00";
+    systemd.services."home-manager-lukegb" = {
+      before = [ "display-manager.service" ];
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    home-manager.users.lukegb = { pkgs, ... }: ({
+      imports = [ ({
+        _module.args = args;
+      })] ++ config.my.home-manager.imports ++ (
+        lib.optional (config.my.home-manager.system != null) config.my.home-manager.system
+      );
+    });
   };
 }

ops/nixos/lib/graphical-client.nix

@@ -11,24 +11,28 @@ in
     ./client.nix
   ];
 
-  fonts.fonts = with pkgs; [
+  config = {
-    iosevka
+    my.home-manager.imports = lib.mkAfter [ ./home-manager/graphical-client.nix ];
-  ];
-  services.udev.packages = [ pkgs.libu2f-host ];
-  services.pcscd.enable = true;
 
-  sound.enable = true;
+    fonts.fonts = with pkgs; [
-  hardware.pulseaudio.enable = true;
+      iosevka
+    ];
+    services.udev.packages = [ pkgs.libu2f-host ];
+    services.pcscd.enable = true;
 
-  users.users.lukegb.packages = mkBefore (with pkgs; [
+    sound.enable = true;
-    chromium
+    hardware.pulseaudio.enable = true;
-    dino
+
-    lutris
+    users.users.lukegb.packages = mkBefore (with pkgs; [
-    pavucontrol
+      chromium
-    rxvt_unicode
+      dino
-    teamspeak_client
+      lutris
-    virtmanager
+      pavucontrol
-    xclip
+      rxvt_unicode
-    yubioath-desktop
+      teamspeak_client
-  ]);
+      virtmanager
+      xclip
+      yubioath-desktop
+    ]);
+  };
 }

ops/nixos/lib/home-manager/client.nix

@@ -0,0 +1,38 @@
+{ depot, lib, pkgs, ... }:
+{
+  imports = [ ./common.nix ];
+
+  programs.git = {
+    enable = true;
+    package = pkgs.gitAndTools.gitFull;
+    extraConfig = {
+      user.name = "Luke Granger-Brown";
+      user.email = "git@lukegb.com";
+      pull.ff = "only";
+    };
+  };
+  programs.direnv.enable = true;
+  programs.bash.enableVteIntegration = true;
+  programs.vim = {
+    plugins = (with pkgs.vimPlugins; [
+      vim-go
+    ]);
+    extraConfig = ''
+      source $VIMRUNTIME/defaults.vim
+
+      let g:go_def_mode='gopls'
+      let g:go_info_mode='gopls'
+      let g:go_fmt_command='goimports'
+
+      set mouse=
+    '';
+  };
+
+  home.packages = lib.mkAfter (with pkgs; [
+    depot.nix.pkgs.copybara
+    go
+    gopls
+    goimports
+    graphicsmagick-imagemagick-compat
+  ]);
+}

ops/nixos/lib/home-manager/common.nix

@@ -0,0 +1,55 @@
+{ depot, pkgs, ... }:
+{
+  programs.home-manager.enable = true;
+
+  home.username = "lukegb";
+  home.homeDirectory = "/home/lukegb";
+  home.file = {
+    ".hgrc".source = ./hgrc;
+  };
+
+  programs.bash = {
+    enable = true;
+    enableVteIntegration = true;
+
+    initExtra = ''
+      function join_by { local IFS="$1"; shift; echo "$*"; }
+
+      if [[ -z "$LAUNCH_SHLVL" ]]; then
+        export LAUNCH_SHLVL="$SHLVL"
+      fi
+      export LAUNCH_DEPTH="$(expr $SHLVL - $LAUNCH_SHLVL)"
+      export LAUNCH_DEPTH_STR=""
+      if [[ "$LAUNCH_DEPTH" > 0 ]]; then
+        if [[ "$PATH" == /nix/store/* ]]; then
+          declare -a RECENT_PKGS
+          while read -rd: pathseg; do
+            if [[ "$pathseg" != /nix/store/* ]]; then
+              break
+            fi
+            RECENT_PKGS+=("$(echo "$pathseg" | sed -E -e 's,^/nix/store/[a-z0-9]+-,,' -e 's,/.*$,,' -e 's,-[0-9.]+$,,')")
+          done <<< $PATH
+          RECENT_PKG="$(join_by ":" "''${RECENT_PKGS[@]}")"
+          if [[ "''${#RECENT_PKG}" > 32 ]]; then
+            RECENT_PKGS="''${RECENT_PKGS[0]}"
+          fi
+          if [[ ! -z "$RECENT_PKG" ]]; then
+            LAUNCH_DEPTH_STR="[$RECENT_PKG] "
+          fi
+        fi
+        if [[ -z "$LAUNCH_DEPTH_STR" ]]; then
+          LAUNCH_DEPTH_STR="[$LAUNCH_DEPTH] "
+        fi
+      fi
+      export PS1="\n\[\033[1;32m\]$LAUNCH_DEPTH_STR[\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$ \[\033[0m\]"
+    '';
+  };
+  programs.vim.enable = true;
+
+  home.packages = (with pkgs; [
+    ripgrep
+    whois
+  ]);
+
+  home.stateVersion = "20.09";
+}

ops/nixos/lib/home-manager/graphical-client.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  imports = [ ./client.nix ];
+
+  gtk = {
+    enable = true;
+    gtk3.extraConfig = {
+      gtk-application-prefer-dark-theme = 1;
+    };
+  };
+  qt = {
+    enable = true;
+    platformTheme = "gtk";
+  };
+}

ops/nixos/porcorosso/default.nix

@@ -110,7 +110,7 @@ in {
       if [[ $EUID -ne 0 ]]; then
         exec sudo "$0" "$@"
       fi
-    
+
       efibootmgr -n 0001
       systemctl reboot
     '')
@@ -142,7 +142,9 @@ in {
   # Define a user account.
   users.users.lukegb = {
     extraGroups = [ "wheel" "networkmanager" ];
-    packages = with pkgs; [
+  };
+  my.home-manager.system = {...}: {
+    home.packages = lib.mkAfter (with pkgs; [
       (steam.override { extraProfile = nvidia-offload-profile; })
       (writeScriptBin "javaws" ''
         #!/bin/sh
@@ -160,7 +162,7 @@ in {
       iotop
       iw
       vulkan-tools
-    ];
+    ]);
   };
 
   # github.com/target/lorri