Add OpenBao

dotfiles/.bashrc

@@ -29,6 +29,10 @@ function ngc {
 bind '"\e[A": history-search-backward'
 bind '"\e[B": history-search-forward'
 
+bind "set completion-ignore-case on"
+bind "set completion-map-case on"
+bind "set show-all-if-ambiguous on"
+
 export HISTSIZE=10000
 export HISTFILESIZE=10000
 
@@ -45,4 +49,4 @@ PS1='\[\033[0;33m\][\u@\h:\w]\$\[\033[0m\] '
 RIPGREP_CONFIG_PATH=~/.ripgreprc
 
 # Disable ctrl+s
-stty -ixon
+stty -ixon

dotfiles/.gitconfig

@@ -1,8 +1,7 @@
 [user]
 	name = Bart van der Braak
 	email = bart@vanderbraak.nl
-	# signingkey = 26ED0D75D89D9B61
-
+	signingkey = ~/.ssh/id_ed25519.pub
 [alias]
 	p = push
 	st = status
@@ -13,28 +12,29 @@
 	gl = config --global -l
 	aa = add .
 	pushfwl = push --force-with-lease
-
 [core]
 	excludesfile = ~/.gitignore
 	pager = delta
-
+	editor = vim
 [interactive]
-    diffFilter = delta --color-only
-
+	diffFilter = delta --color-only
 [init]
 	defaultBranch = main
-
+[gpg]
+	format = ssh
+[gpg "ssh"]
+	allowedSignersFile = ~/.ssh/allowed_signers
+	signingKey = ~/.ssh/id_ed25519.pub
+	signingAlgorithm = ssh-ed25519
+	signingNamespace = gitea
 [commit]
-	# gpgsign = true
-
+	gpgsign = true
 [push]
 	autoSetupRemote = true
-
 [filter "lfs"]
 	clean = git-lfs clean -- %f
 	smudge = git-lfs smudge -- %f
 	process = git-lfs filter-process
 	required = true
-
-[includeIf "gitdir:~/Repos/projects.blender.org/"]
-    path = ~/.config/git/blender.gitconfig
+[includeIf "gitdir:~/Repositories/blender.org/"]
+        path = ~/.config/git/blender.gitconfig

dotfiles/.nix-channels

@@ -1 +1 @@
-https://nixos.org/channels/nixos-unstable nixos
+https://nixos.org/channels/nixos-25.05 nixos

dotfiles/symlink.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
 dotfiles_home="${1:-$(dirname "$(realpath "$0")")}"
-cp -rsf "$dotfiles_home" $HOME
+cp -rsf "$dotfiles_home"/. $HOME
 
 echo "Dotfiles have been recursively copied and symlinked from $dotfiles_home to $HOME."

gentoo/portage/package.accept_keywords/awscli

@@ -0,0 +1 @@
+app-admin/awscli-bin ~amd64

gentoo/portage/package.accept_keywords/firefox-dev

@@ -0,0 +1 @@
+www-client/firefox-developer-bin ~amd64

gentoo/portage/package.accept_keywords/ghostty

@@ -0,0 +1,3 @@
+dev-lang/zig ~amd64
+x11-terms/ghostty ~amd64
+app-eselect/eselect-zig ~amd64

gentoo/portage/package.accept_keywords/git-filter-repo

@@ -0,0 +1,2 @@
+dev-vcs/git-filter-repo ~amd64
+

gentoo/portage/package.accept_keywords/insomnia

@@ -0,0 +1 @@
+dev-util/insomnia-bin ~amd64

gentoo/portage/package.accept_keywords/just

@@ -0,0 +1 @@
+dev-build/just ~amd64

gentoo/portage/package.accept_keywords/k9scli

@@ -0,0 +1 @@
+sys-cluster/k9scli ~amd64

gentoo/portage/package.accept_keywords/logseq

@@ -0,0 +1 @@
+app-editors/logseq-desktop-bin ~amd64

gentoo/portage/package.accept_keywords/opentofu

@@ -0,0 +1 @@
+app-admin/opentofu ~amd64

gentoo/portage/package.accept_keywords/wezterm

@@ -0,0 +1 @@
+x11-terms/wezterm ~amd64

gentoo/portage/package.accept_keywords/zen-browser

@@ -0,0 +1 @@
+www-client/zen-bin ~amd64

gentoo/portage/package.use/ghostty

@@ -0,0 +1,5 @@
+media-libs/harfbuzz abi_x86_32
+media-gfx/graphite2 abi_x86_32
+x11-libs/pixman abi_x86_32
+x11-libs/cairo abi_x86_32
+dev-libs/lzo abi_x86_32

gentoo/portage/package.use/iputils

@@ -0,0 +1,2 @@
+net-misc/iputils tracepath
+

nixos/configuration.nix

@@ -28,16 +28,7 @@
     LC_TELEPHONE = "nl_NL.UTF-8";
     LC_TIME = "en_US.UTF-8";
   };
-
-  # Fonts configuration
-  fonts = {
-    enableDefaultPackages = true;
-    packages = with pkgs; [
-      jetbrains-mono
-      nerdfonts
-    ];
-  };
-
+  
   # Optimization & Garbage Collection
 
   # Optimize Nix-Store During Rebuilds

nixos/flake.lock

@@ -1,24 +1,49 @@
 {
   "nodes": {
-    "nixpkgs": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "zen-browser",
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 0,
-        "narHash": "sha256-vH5mXxEvZeoGNkqKoCluhTGfoeXCZ1seYhC2pbMN0sg=",
-        "path": "/nix/store/zd5dgszslv09jzybcpf25gpl12s6r2d9-source",
-        "type": "path"
+        "lastModified": 1743604125,
+        "narHash": "sha256-ZD61DNbsBt1mQbinAaaEqKaJk2RFo9R/j+eYWeGMx7A=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "180fd43eea296e62ae68e079fcf56aba268b9a1a",
+        "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1749727998,
+        "narHash": "sha256-mHv/yeUbmL91/TvV95p+mBVahm9mdQMJoqaTVTALaFw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fd487183437963a59ba763c0cc4f27e3447dd6dd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1735471104,
-        "narHash": "sha256-0q9NGQySwDQc7RhAV2ukfnu7Gxa5/ybJ2ANT8DQrQrs=",
+        "lastModified": 1743448293,
+        "narHash": "sha256-bmEPmSjJakAp/JojZRrUvNcDX2R5/nuX6bm+seVaGhs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "88195a94f390381c6afcdaa933c2f6ff93959cb4",
+        "rev": "77b584d61ff80b4cef9245829a6f1dfad5afdfa3",
         "type": "github"
       },
       "original": {
@@ -36,14 +61,15 @@
     },
     "zen-browser": {
       "inputs": {
+        "home-manager": "home-manager",
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1737404254,
-        "narHash": "sha256-L8Lxp/WVdy9gKO2cXptphdP8cMsnGvZF5Noj8N3jLzI=",
+        "lastModified": 1749745531,
+        "narHash": "sha256-+nnmuYVhQPbELuW2lZCWpTAJo955Qng/SCcLVO/RP6c=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "f8ef9c97ac2f49d5c04dbf3b3d80a0490c05fefb",
+        "rev": "50ec60bcf3528db062700673f61f86d82ca6cda0",
         "type": "github"
       },
       "original": {

nixos/flake.nix

@@ -2,38 +2,38 @@
   description = "Bart's NixOS Configuration";
 
   inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
     zen-browser.url = "github:0xc000022070/zen-browser-flake";
   };
 
-  outputs =
-    { nixpkgs, ... }@inputs:
-    {
-      nixosConfigurations = {
-        tongfang = nixpkgs.lib.nixosSystem {
-          specialArgs = { inherit inputs; };
-          modules = [
-            ./hardware/tongfang.nix
-            ./configuration.nix
-            ./users.nix
-            ./packages.nix
-            ./services.nix
-            ./modules/bootloader.nix
-          ];
-        };
-        qemu = nixpkgs.lib.nixosSystem {
-          specialArgs = { inherit inputs; };
-          modules = [
-            ./hardware/qemu.nix
-
-            ./modules/kde.nix
-            ./modules/configuration.nix
-            ./modules/display-manager.nix
-            ./modules/greeter.nix
-            ./modules/networking.nix
-            ./modules/nix-settings.nix
-            ./modules/users.nix
-          ];
-        };
+  outputs = { nixpkgs, ... }@inputs: {
+    nixosConfigurations = {
+      tongfang = nixpkgs.lib.nixosSystem {
+        specialArgs = { inherit inputs; };
+        modules = [
+          ./hardware/tongfang.nix
+          ./configuration.nix
+          ./users.nix
+          ./packages.nix
+          ./services.nix
+          ./modules/bootloader.nix
+          ./modules/fonts.nix
+          ./modules/vpn.nix
+        ];
+      };
+      qemu = nixpkgs.lib.nixosSystem {
+        specialArgs = { inherit inputs; };
+        modules = [
+          ./hardware/qemu.nix
+          ./modules/kde.nix
+          ./modules/configuration.nix
+          ./modules/display-manager.nix
+          ./modules/greeter.nix
+          ./modules/networking.nix
+          ./modules/nix-settings.nix
+          ./modules/users.nix
+        ];
       };
     };
+  };
 }

nixos/hardware/tongfang.nix

@@ -29,24 +29,29 @@ in
     "sdhci_pci"
   ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ 
+    "kvm-amd"
+    "crypto_simd"
+    "cryptd"
+  ];
   boot.extraModulePackages = [ yt6801 ];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/c7cf28c3-5744-45cc-8a81-456d24e44b7a";
-    fsType = "ext4";
-  };
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/292e05de-6ddb-4a31-bc8a-92314b13d5c8";
+      fsType = "ext4";
+    };
 
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/CEF6-7DAA";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
+  boot.initrd.luks.devices."luks-bbe16a5b-ae1e-4297-a250-ebb8e950e12c".device = "/dev/disk/by-uuid/bbe16a5b-ae1e-4297-a250-ebb8e950e12c";
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/28FA-4261";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/f4aac953-a60d-478a-84bc-ac659360ca03"; }
     ];
-  };
-
-  swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

nixos/modules/devops-tools.nix

@@ -4,6 +4,7 @@
   environment.systemPackages = with pkgs; [
     azure-cli
     opentofu
+    bao
     curl
     go-task
     sops

nixos/modules/fonts.nix

@@ -1,10 +1,94 @@
 { pkgs, ... }:
 
-{
-  # Fonts
-  fonts.packages = with pkgs; [
-    jetbrains-mono
-    nerd-font-patcher
-    noto-fonts-color-emoji
-  ];
+let
+  fontSources = {
+    sf-pro = {
+      url = "https://devimages-cdn.apple.com/design/resources/download/SF-Pro.dmg";
+      hash = "sha256-Lk14U5iLc03BrzO5IdjUwORADqwxKSSg6rS3OlH9aa4=";
+    };
+    sf-compact = {
+      url = "https://devimages-cdn.apple.com/design/resources/download/SF-Compact.dmg";
+      hash = "sha256-CMNP+sL5nshwK0lGBERp+S3YinscCGTi1LVZVl+PuOM=";
+    };
+    sf-mono = {
+      url = "https://devimages-cdn.apple.com/design/resources/download/SF-Mono.dmg";
+      hash = "sha256-bUoLeOOqzQb5E/ZCzq0cfbSvNO1IhW1xcaLgtV2aeUU=";
+    };
+    sf-arabic = {
+      url = "https://devimages-cdn.apple.com/design/resources/download/SF-Arabic.dmg";
+      hash = "sha256-J2DGLVArdwEsSVF8LqOS7C1MZH/gYJhckn30jRBRl7k=";
+    };
+    ny = {
+      url = "https://devimages-cdn.apple.com/design/resources/download/NY.dmg";
+      hash = "sha256-HC7ttFJswPMm+Lfql49aQzdWR2osjFYHJTdgjtuI+PQ=";
+    };
+  };
+
+  makeAppleFont = name: pkgName: source:
+    pkgs.stdenv.mkDerivation {
+      inherit name;
+
+      src = pkgs.fetchurl {
+        inherit (source) url hash;
+      };
+
+      version = "0.3.0";
+
+      unpackPhase = ''
+        undmg $src
+        7z x '${pkgName}'
+        7z x 'Payload~'
+      '';
+
+      buildInputs = [
+        pkgs.undmg
+        pkgs.p7zip
+      ];
+      setSourceRoot = "sourceRoot=`pwd`";
+      installPhase = ''
+        mkdir -p $out/share/fonts/opentype
+        mkdir -p $out/share/fonts/truetype
+        find -name \*.otf -exec mv {} $out/share/fonts/opentype/ \;
+        find -name \*.ttf -exec mv {} $out/share/fonts/truetype/ \;
+      '';
+    };
+
+  appleColorEmoji = pkgs.stdenv.mkDerivation {
+    name = "apple-color-emoji";
+
+    src = pkgs.fetchurl {
+      url = "https://github.com/samuelngs/apple-emoji-linux/releases/download/v17.4/AppleColorEmoji.ttf";
+      hash = "sha256-SG3JQLybhY/fMX+XqmB/BKhQSBB0N1VRqa+H6laVUPE=";
+    };
+    unpackPhase = ":";
+    installPhase = ''
+      mkdir -p $out/share/fonts/truetype
+      cp $src $out/share/fonts/truetype/AppleColorEmoji.ttf
+    '';
+  };
+
+in {
+  fonts = {
+    enableDefaultPackages = true;
+    packages = with pkgs; [
+      jetbrains-mono
+      noto-fonts-emoji
+      (makeAppleFont "sf-pro" "SF Pro Fonts.pkg" fontSources.sf-pro)
+      (makeAppleFont "sf-compact" "SF Compact Fonts.pkg" fontSources.sf-compact)
+      (makeAppleFont "sf-mono" "SF Mono Fonts.pkg" fontSources.sf-mono)
+      (makeAppleFont "sf-arabic" "SF Arabic Fonts.pkg" fontSources.sf-arabic)
+      (makeAppleFont "ny" "NY Fonts.pkg" fontSources.ny)
+      appleColorEmoji
+    ];
+    fontconfig = {
+      defaultFonts = {
+        serif = [  "SF Pro" ];
+        sansSerif = [ "SF Pro" ];
+        monospace = [ "JetBrainsMono Nerd Font Mono" ];
+        emoji = [ "Apple Color Emoji" ];
+      };
+      useEmbeddedBitmaps = true;
+    };
+  };
 }
+

nixos/modules/ollama.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  # Add Ollama and OpenWebUI
+  services.ollama = {
+    enable = true;
+    loadModels = [ deepseek-r1:32b ];
+    acceleration = "rocm";
+    rocmOverrideGfx = "11.0.0";
+    environmentVariables = {
+      HSA_OVERRIDE_GFX_VERSION = "11.0.0";
+    };
+  };
+  
+  services.open-webui.enable = true;
+}

nixos/packages.nix

@@ -24,6 +24,7 @@ in
       curl
       fzf
       jq
+      delta
       unzip
       silver-searcher
       ripgrep
@@ -36,5 +37,13 @@ in
       dig
       zig
       spotify
+      exfat
+      exfatprogs
+      remmina
+      s3cmd
+      powershell
+      git-lfs
+      ruff
+      meld
     ];
 }

nixos/services.nix

@@ -8,6 +8,10 @@
     wayland.enable = true;
   };
   services.desktopManager.plasma6.enable = true;
+  qt = {
+    enable = true;
+    platformTheme = "kde";
+  };
 
   # Audio system with PipeWire
   # Enable PipeWire and ALSA support

nixos/users.nix

@@ -9,20 +9,24 @@
       "wheel"
       "libvirtd"
       "docker"
+      "dialout" # for nanokvm usb
     ];
     packages = with pkgs; [
       vscodium
+      ungoogled-chromium
       thunderbird
       fastfetch
       ghostty
       neovim
       logseq
       element-desktop
+      cinny-desktop
+      signal-desktop
       go-task
       opentofu
       python3
       gnumake
-      gccgo
+      go
       nodejs_22
       corepack_22
       azure-cli
@@ -31,6 +35,12 @@
       inkscape
       gimp
       nixfmt-rfc-style
+      cloud-utils
+      ansible-lint
+      zed-editor
+      prismlauncher
+      runelite
+      bolt-launcher
     ];
   };
 
@@ -40,6 +50,9 @@
   nixpkgs.config.permittedInsecurePackages = [
     # Workaround for electron dependency in Logseq
     "electron-27.3.11"
+    # Workaround for Cinny to work
+    "cinny-unwrapped-4.2.3"
+    "cinny-4.2.3"
   ];
 
   programs._1password.enable = true;
@@ -71,9 +84,5 @@
   virtualisation.docker = {
     enable = true;
     enableOnBoot = false;
-    rootless = {
-      enable = true;
-      setSocketVariable = true;
-    };
   };
 }