[!WARNING] The pam_shim is POC code, so be careful with using it on your own machine. Use it at your own risk.

The problem

At work I have to use Ubuntu but I want to share my nix config between all my devices i.e. desktop and work laptop. On my home setup I have been using Niri with Noctalia shell (quickshell) on NixOS. Everything works fine I can use the Noctalia shell lock screen and can authenticate fine.

However when I tried to do that on my Ubuntu machine, it wouldn’t let me log back in after locking the screen. Remember everything is installed via Nix (home-manager).

PAM

PAM is Linux’s standard authentication framework. When you lock your screen and type your password, PAM handles the authentication logic. It’s called “pluggable” because system administrators can configure different authentication methods (passwords, fingerprints, smart cards) without modifying applications.

PAM & Nix

Nix packages are completely self-contained. When you install a package with Nix, it includes all its dependencies in /nix/store/. But this creates a problem with PAM:

NixOS

Application → /nix/store/xxx-linux-pam/lib/libpam.so.2
           → /nix/store/yyy-pam-modules/lib/security/pam_unix.so
           → /etc/pam.d/ (managed by NixOS)
           → Authenticate ✅

Ubuntu

Application → /nix/store/xxx-linux-pam/lib/libpam.so.2
           → /nix/store/yyy-pam-modules/lib/security/pam_unix.so (doesn't exist!)
           → /etc/pam.d/ (managed by Ubuntu, expects different paths)
           → Authentication FAILS ❌

So we are locked out “forever” until we reboot, obviously not great. I know I hit this issue before with Hyprland and hyprlock (or swaylock) and ended up installing them via apt and not Nix. But this time I wanted to avoid doing that. I came across this issue.

Solution

We can use pam_shim, which creates a translation layer we can use. Whilst not breaking Nix’s package isolation.

1. PAM Shim Library: pam-shim creates a wrapper library that intercepts PAM calls and redirects them to the host system’s PAM library (/lib/x86_64-linux-gnu/libpam.so.0 on Ubuntu)

2. Patching: The replacePam function uses patchelf to replace PAM library references in the QuickShell binary with the shim library

3. Runtime: When noctalia-shell’s lock screen tries to authenticate:

   • QuickShell calls PAM functions
   • Calls go through the shim library
   • Shim redirects to Ubuntu’s native PAM
   • Authentication works against Ubuntu’s PAM stack

QuickShell → pam_shim intercepts pam_authenticate()
        → fork() subprocess
        → exec /lib64/ld-linux-x86-64.so.2 (system dynamic linker)
        → loads /lib/x86_64-linux-gnu/libpam.so.0 (Ubuntu's native PAM)
        → reads /etc/pam.d/common-auth (Ubuntu's PAM config)
        → loads /lib/x86_64-linux-gnu/security/pam_unix.so (Ubuntu's PAM module)
        → checks /etc/shadow (system password database)
        → returns PAM_SUCCESS via IPC to pam_shim
        → pam_shim returns result to QuickShell
        → Authentication SUCCEEDS ✅

Fix

update flake.nix

# PAM shim for non-NixOS systems
# Using 'next' branch for full libpam.so.0 API coverage
pam-shim = {
  url = "github:Cu3PO42/pam_shim/next";
  inputs.nixpkgs.follows = "nixpkgs";
};

inputs.pam-shim.homeModules.default

In our non-NixOS system i.e. modules/roles/non-nixos.nix

# PAM authentication fix for non-NixOS
pamShim.enable = true;

And add this overlay for all quickshell packages (what Noctalia shell uses). This will also work with other quickshells like DankMaterialLinux.

# Override quickshell globally with PAM-shimmed version
nixpkgs.overlays = [
  (final: prev: {
    quickshell = config.lib.pamShim.replacePam prev.quickshell;
  })
];

Where you have your noctalia-shell Nix config defined, i.e. noctalia.nix.

# Noctalia shell with PAM shim for lock screen authentication
systemd.user.services.noctalia-shell = mkIf config.desktops.addons.noctalia.enable (
  let
    shimmedQuickshell = config.lib.pamShim.replacePam pkgs.quickshell;
  in
  {
    Service = {
      ExecStart = lib.mkForce "${pkgs.writeShellScript "noctalia-nixgl" ''
        export PATH="${pkgs.wlsunset}/bin:${pkgs.wl-clipboard}/bin:${pkgs.cliphist}/bin:${pkgs.coreutils}/bin:${pkgs.gnugrep}/bin:${pkgs.gnused}/bin:${pkgs.bash}/bin:/run/wrappers/bin:${config.home.profileDirectory}/bin:/usr/bin:/bin"
        exec ${config.lib.nixGL.wrap shimmedQuickshell}/bin/quickshell -p ${config.programs.noctalia-shell.package}/share/noctalia-shell
      ''}";
    };
  }
);

Appendix

• pam_shim Repository

Background

I use Neovim (btw!) and Nix (btw btw!!!). I mean, half the reason to use these tools is to tell other people you use them, right? 😉 Otherwise, why would I go through the pain I experienced today? “What pain?” you ask. Good question!

A few weeks ago, I noticed that running tests in Neovim was failing with a no test found error. I’m using neotest and neotest-golang to run tests within Neovim.

Here’s a link to my config.

I’m also using the nightly build of Neovim, so getting the latest version isn’t great if you want stability. Things can break at any moment, like running tests. Anyway, today (November 1st), I had some free time and decided to spend most of the day fixing this issue. poświęcenie

Setup

I’m using NixOS (should I do another “btw” joke??? 🤔), so I want to manage all my dependencies with Nix. I’m also using NixCats, which allows me to configure Neovim with Lua but package it with Nix (it has a few other features I don’t really use, but others might).

One of the nice features of NixCats is that we can easily add Neovim plugins that aren’t in nixpkgs using our flake inputs:

plugins-neotest-golang = {
  url = "github:fredrikaverpil/neotest-golang";
  flake = false;
};

We just need to add plugins-x, and then we can reference it in our NixCats config like pkgs.neovimPlugins.neotest-golang. It’s tied to my flake, so I can just run nix flake update to update those Neovim plugins along with every other input. Then I upgrade my setup, as you might with apt upgrade, but with nh os switch or nh home switch.

Debugging 🐛

This setup means I can use the latest version of this plugin (v2.5.0 at the time of writing), but even upgrading to the latest version wasn’t enough. I probably shouldn’t have tied it to the main branch. 😅

I found this issue, which made me think I should try the latest version.

After a lot of (wasted) debugging, I finally read the migration guide. An amateur mistake, I know. 🤦

nvim-treesitter

It turns out I need to use nvim-treesitter, but the main branch, not the master branch, which is frozen and no longer under development. There’s an existing overlay we can use so we don’t have to change how we install our dependencies.

Like so:

nvim-treesitter-main = {
  url = "github:iofq/nvim-treesitter-main";
  inputs.nixpkgs.follows = "nixpkgs";
};

I’m also using snowfall-lib, so I can add a new overlay like so in my flake.nix:

overlays = with inputs; [
    # ...
    nvim-treesitter-main.overlays.default
];

I also created a new overlay file, overlays/nvim-treesitter-main/default.nix:

inputs: final: prev: {
  vimPlugins = prev.vimPlugins // {
    nvim-treesitter = prev.vimPlugins.nvim-treesitter.withAllGrammars;
    nvim-treesitter-textobjects = prev.vimPlugins.nvim-treesitter-textobjects.overrideAttrs (old: {
      dependencies = with prev.vimPlugins; [ nvim-treesitter ];
    });
  };
}

You can also add the cache to save some time rebuilding all the grammars on your own machine:

trusted-substituters = [
  "https://nvim-treesitter-main.cachix.org"
];

Then, in my Neovim config, I updated the setup to look like this:

require("nvim-treesitter").setup()

After this, when I opened a Markdown document, I noticed it was all white. But using InspectTree, the AST looked correct. It seemed like highlighting wasn’t working, which, again, if I had read the docs, I would’ve seen that I need to create an autocommand.

vim.api.nvim_create_autocmd("FileType", {
	pattern = "*",
	callback = function(args)
		-- Add error handling to prevent crashes during session restore
		local success, err = pcall(function()
			-- Check if parser is available before starting
			local lang = vim.bo[args.buf].filetype
			local ts_lang = vim.treesitter.language.get_lang(lang)
			if ts_lang then
				vim.treesitter.start(args.buf)
			end
		end)
		if not success then
			-- Silently fail if treesitter can't start for this buffer
			vim.notify("Treesitter failed to start for " .. vim.bo[args.buf].filetype .. ": " .. err, vim.log.levels.DEBUG)
		end
	end,
})

textobjects

To set up textobjects, we need to set up the plugin separately as well, also using the main branch. It now looks something like this:

require("nvim-treesitter-textobjects").setup({
    select = {
        lookahead = true,
        selection_modes = {
            ["@parameter.outer"] = "v",
            ["@function.outer"] = "V",
            ["@class.outer"] = "<c-v>",
        },
        include_surrounding_whitespace = false,
    },
    move = {
        set_jumps = true,
    },
})

-- Set up select keymaps using the new API
vim.keymap.set({ "x", "o" }, "af", function()
    require("nvim-treesitter-textobjects.select").select_textobject("@function.outer", "textobjects")
end)
vim.keymap.set({ "x", "o" }, "if", function()
    require("nvim-treesitter-textobjects.select").select_textobject("@function.inner", "textobjects")
end)
vim.keymap.set({ "x", "o" }, "ac", function()
    require("nvim-treesitter-textobjects.select").select_textobject("@class.outer", "textobjects")
end)

Notice how we now set up the textobjects as keybindings. Then, for swap and repeatable, assuming you were using those, it looks something like this:

vim.keymap.set("n", "<leader>a", function()
    require("nvim-treesitter-textobjects.swap").swap_next("@parameter.inner")
end)
vim.keymap.set("n", "<leader>A", function()
    require("nvim-treesitter-textobjects.swap").swap_previous("@parameter.outer")
end)

local ts_repeat_ok, ts_repeat_move = pcall(require, "nvim-treesitter-textobjects.repeatable_move")
if ts_repeat_ok then
    vim.keymap.set({ "n", "x", "o" }, ";", ts_repeat_move.repeat_last_move_next)
    vim.keymap.set({ "n", "x", "o" }, ",", ts_repeat_move.repeat_last_move_previous)
    vim.keymap.set({ "n", "x", "o" }, "f", ts_repeat_move.builtin_f_expr, { expr = true })
    vim.keymap.set({ "n", "x", "o" }, "F", ts_repeat_move.builtin_F_expr, { expr = true })
    vim.keymap.set({ "n", "x", "o" }, "t", ts_repeat_move.builtin_t_expr, { expr = true })
    vim.keymap.set({ "n", "x", "o" }, "T", ts_repeat_move.builtin_T_expr, { expr = true })
end

incremental selection

You can now do this via the LSP instead of the textobjects plugin, so I added the following plugins:

vim.keymap.set("x", "<c-space>", function()
    vim.lsp.buf.selection_range("outer")
end, { desc = "Expand selection (incremental)" })

vim.keymap.set("x", "<M-space>", function()
    vim.lsp.buf.selection_range("inner")
end, { desc = "Shrink selection (incremental)" })

vim.keymap.set("n", "<c-space>", function()
    vim.cmd("normal! v")
    vim.lsp.buf.selection_range("outer")
end, { desc = "Start incremental selection" })

vim.keymap.set("x", "<c-s>", function()
    vim.lsp.buf.selection_range("outer")
end, { desc = "Expand to scope" })

Neotest

I thought that would be enough, but I noticed in my ~/.local/state/nvim/neotest.log that I was getting the following error:

WARN | 2025-11-01T20:10:40Z+0000 | ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:203 | CHILD | Error in remote call ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:130: attempt to index a nil value
stack traceback:
    ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:130: in function 'get__parse_root'
    ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:162: in function 'parse_positions_from_string'
    ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:209: in function 'func'
    ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:195: in function <...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:194>
    [C]: in function 'xpcall'
    ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:194: in function <...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:193>
WARN | 2025-11-01T20:10:40Z+0000 | ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:203 | CHILD | Error in remote call ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:130: attempt to index a nil val

I found this issue and this fix. Then I updated Neotest to the latest version by again adding it as an input:

plugins-neotest = {
  url = "github:nvim-neotest/neotest";
  flake = false;
};

and

test = with pkgs.vimPlugins; [
  pkgs.neovimPlugins.neotest
];

Finally fixed? 🙏

Then I ran nh home switch (similar to home-manager switch --flake ~/nixicle#haseeb@workstation). I reloaded Neovim, and voila, it works now! That was my day of yak shaving and fixing random broken stuff. 🐐

I guess it goes without saying that if you’re running on the bleeding edge, things will break. The advantage is that usually only one thing breaks at a time, whereas with a major upgrade, multiple things might break, and you have to fix them all at once.

Also, this classic video is a must-watch!!!! 🤣

Recently I have been trying to update the emojis when I run nh. Particularly the nom output.

The old output was like so:

To fix this update your nh derivation like so:

environment.systemPackages = with pkgs; [
  (pkgs.nh.override {
    nix-output-monitor = pkgs.nix-output-monitor.overrideAttrs (old: {
      postPatch = old.postPatch or "" + ''
        substituteInPlace lib/NOM/Print.hs \
          --replace 'down = "↓"' 'down = "\xf072e"' \
          --replace 'up = "↑"' 'up = "\xf0737"' \
          --replace 'clock = "⏱"' 'clock = "\xf520"' \
          --replace 'running = "⏵"' 'running = "\xf04b"' \
          --replace 'done = "✔"' 'done = "\xf00c"' \
          --replace 'todo = "⏸"' 'todo = "\xf04d"' \
          --replace 'warning = "⚠"' 'warning = "\xf071"' \
          --replace 'average = "∅"' 'average = "\xf1da"' \
          --replace 'bigsum = "∑"' 'bigsum = "\xf04a0"'
      '';
    });
  })
];

Note you will no longer be able to use the default nix cache to build this. So everytime nh updates you will need to manually build it.

That’s it!

So I have a small home lab, where I have a few random things running, like a GitLab CI runner, a media server etc. All my home lab servers (3 of them) are running NixOS and are defined within my Nix flake what services they run.

For example: https://gitlab.com/hmajid2301/nixicle/-/blob/main/systems/x86_64-linux/ms01/default.nix?ref_type=heads

They are set up using nixos-anywhere like most of my other services. Then using deploy-rs we can ssh onto our home lab servers and deploy nix config, i.e. updating packages.

I wanted a more automated way to do, i.e. anytime nixicle repo changes, try to deploy those changes to my home lab on CI.

Tailscale

I connect to my home lab using Tailscale a very cool tool, think like a VPN, it uses WireGuard behind the scenes. With some extra stuff on top to provide a really nice user experience. Highly recommend if you are looking to get into homelabbing.

So first, our CI runner would need to be able to connect to Tailscale to be able to deploy our new config onto the home lab servers.

I will assume you have already set up your Tailscale account for the next part. I may create a tutorial later on how you can do it. Better to be honest, there is a ton of decent literature available already, including videos.

First, let’s create an auth key. Go to: https://login.tailscale.com/admin/settings/keys

We want to enable Ephemeral, so the device gets removed from our list, else every time CI runs we will get a new device in our list of machines. Then, in my case, I need to also check the pre-approve, so the admin doesn’t need to manually approve it, slightly defeating the purpose of CI.

You can also optionally create a tag for your machines using this auth key. In my case, I wanted to tag it with CI. Which we can then use for ACL rules etc.

Gitlab CI

After creating the key copy the value, you won’t be able to see it again, so keep that in mind. Add it to your CI variables, you can check the masked option, so the auth key isn’t accidentally printed in CI.

(You can access this using the left side bar; setting > CI/CD > Variables)

Then our CI file may look something like this .gitlab-ci.yml

image: nixos/nix

stages:
  - deploy

tailscale:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - mkdir -p /etc/nix/ /etc/ssh/
    - echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
    - nix-env -iA nixpkgs.docker nixpkgs.go-task nixpkgs.flyctl nixpkgs.tailscale nixpkgs.jq
    - ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519
    - ssh-keygen -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - echo "Host *" >> ~/.ssh/config
    - echo "  StrictHostKeyChecking no" >> ~/.ssh/config
    - echo "  UserKnownHostsFile /dev/null" >> ~/.ssh/config
    - export SSH_ASKPASS_REQUIRE=never
    - eval $(ssh-agent -s)
    - ssh-add ~/.ssh/id_ed25519 2>/dev/null

    - tailscaled --state="mem:" --statedir=/var/lib/tailscale &
    - tailscale up --authkey=${TAILSCALE_AUTHKEY} --hostname="gitlab-$(cat /etc/hostname)" --accept-routes --ssh
    - nix profile install github:serokell/deploy-rs
    - deploy ".#ms01" --hostname ms01 --ssh-user nixos --skip-checks --confirm-timeout "600" --remote-build

Let’s break this file down

First, we want to create some SSH keys so that you can SSH on the CI runner onto the home lab server.

The next part we start up the Tailscale daemon in the background, and then we authenticate with Tailscale so our runner can now connect to our home lab servers

Then, finally, we install deploy-rs and use it to SSH to our machines and deploy to it.

Tailscale SSH

I also had to enable Tailscale ssh on the host devices so we could SSH from the runner without needing to include an SSH private key and adding that to the allowed SSH list on each server. Which we can do like so:

tailscale set --ssh

This lets Tailscale take over SSH for us, users can still SSH like normal, but you can also SSH like normal as well. But just make sure you are aware of the security implications before you turn it on.

Then I set up on ACLs like so:

	"tagOwners": {
		"tag:ci":           [],
		"tag:homelab":      [],
	},

	// Define access control lists for users, groups, autogroups, tags,
	// Tailscale IP addresses, and subnet ranges.
	"acls": [
		// Allow all connections.
		// Comment this section out if you want to define specific restrictions.
		{"action": "accept", "src": ["tag:ci"], "dst": ["tag:homelab:*"]},
		{
			"action": "accept",
			"src":    ["tag:homelab"],
			"dst":    ["tag:homelab:*"],
		},
	],

	// Define users and devices that can use Tailscale SSH.
	"ssh": [
		// Allow all users to SSH into their own devices in check mode.
		// Comment this section out if you want to define specific restrictions.
		{
			"action": "accept",
			"src":    ["autogroup:member", "tag:ci"],
			"dst":    ["tag:homelab"],
			"users":  ["autogroup:nonroot", "root"],
		},
		{
			"action": "accept",
			"src":    ["tag:ci"],
			"dst":    ["tag:homelab"],
			"users":  ["nixos", "root"],
		},
	],

I am no expert on ACL rules in Tailscale, but I think this allows the CI runner to SSH onto the home lab servers. Which I, of course, have already tagged with home lab.

Currently, I am using a fork of the original plugin, as the fish shell v4 broke it but eventually can use the original.

How it works:

Fish will search $fish_complete_path dynamically, so the idea is to implement a function which listens for changes to $XDG_DATA_DIRS, and attempts to keep that in sync with $fish_complete_path.

But in your nix config you can put this plugin:

{
  programs.fish = {
  # ...
  plugins = [
    # ...
    # INFO: Using this to get shell completion for programs added to the path through nix+direnv.
    # Issue to upstream into direnv:Add commentMore actions
    # https://github.com/direnv/direnv/issues/443
    {
      name = "completion-sync";
      src = pkgs.fetchFromGitHub {
        owner = "iynaix";
        repo = "fish-completion-sync";
        rev = "4f058ad2986727a5f510e757bc82cbbfca4596f0";
        sha256 = "sha256-kHpdCQdYcpvi9EFM/uZXv93mZqlk1zCi2DRhWaDyK5g=";
      };
    }
  ];
}

According to someone who solved these issues and got in touch with me, this works on zsh: https://github.com/BronzeDeer/zsh-completion-sync Or for other shells, look here: https://github.com/direnv/direnv/issues/443.

Why Nix?

In my project, it is a go web app, so all the dependencies in the project are managed as go modules by my go.mod file. Then everything else the developer needs is set up as a dev shell. Things like the standalone tailwind CLI, I am using a nix flake which already has DaisyUI built in so it can also generate those types i.e. btn in the final styles.css (or whatever you called it). The flake is here: https://github.com/aabccd021/tailwindcss-daisyui-nix

I didn’t want to have multiple package managers, using npm or something else.

You can learn more about this here: https://www.youtube.com/watch?v=bdGfn_ihHOk

Setup

Assuming we have enabled the tailwind LSP in our Neovim config, I am using NixCats, and it looks it like this (using nvim-lspconfig):

{
    "tailwindcss",
    lsp = {},
},

You can find my full config here:

• https://gitlab.com/hmajid2301/nixicle/-/blob/8c959ca5bd6436595592d0cedf932787ba86e359/modules/home/cli/editors/neovim/lua/myLuaConf/LSPs/init.lua#L199
• https://gitlab.com/hmajid2301/nixicle/-/blob/MAJ-311/modules/home/cli/editors/neovim/default.nix#L48

So first I added this flake as an input

tailwindcss_daisy.url = "github:aabccd021/tailwindcss-daisyui-nix/lsp";
tailwindcss_daisy.inputs.nixpkgs.follows = "nixpkgs";

Then install the following packages:

tailwindcss-language-server
tailwindcss_daisy.packages.${system}.default

The tailwindcss-language-server being the LSP server for tailwind. Normally, this is installed in my dot files repo. (I linked above). But this one is an overlay from the flake. So this one also has DaisyUI in its NODE_PATH. Then it also auto-complete classes from DaisyUI.

Read this issue: https://github.com/aabccd021/tailwindcss-daisyui-nix/issues/1

Finally, to get the tailwind LSP to work, we need to create an empty tailwind.config.js. Else, the tailwind LSP does not seem to start correctly. Even though the project is configured using the CSS file (probably will be fixed)

That’s it! It took me a while to figure it out, but this seems to work pretty nicely.

There is currently a branch in home-manager we can pull into our config, which provides a convenient way to wrap these apps in nixGL rather than needing to specify say nixGLIntel kitty in our terminal or say Hyprland config (key bindings).

First, let’s import the relevant code from the branch/PR:

 imports = [
    # TODO: remove when https://github.com/nix-community/home-manager/pull/5355 gets merged:
    (builtins.fetchurl {
      url = "https://raw.githubusercontent.com/Smona/home-manager/nixgl-compat/modules/misc/nixgl.nix";
      sha256 = "01dkfr9wq3ib5hlyq9zq662mp0jl42fw3f6gd2qgdf8l8ia78j7i";
    })
  ];

Then, simply, we can do something like this:

programs = {
    kitty.package = config.lib.nixGL.wrap pkgs.kitty;
    firefox.package = config.lib.nixGL.wrap pkgs.firefox;
}

Then we should be able to use the apps like normal, such as using our app launcher like rofi. That’s It!

Appendix

• Commit with nixGL wrap in my own config

When shell completions don’t work with direnv, you may need to use nix develop to load the shell manually.

Background

I am using nix-direnv, with nix devshell to autoload into my development environments. I changed the directory and the devshell is automagically loaded without me doing anything, which is great. Provides me with a bunch of tools specific for that project. With all the benefits of Nix, mainly reproducibility.

❯ z banterbus/
direnv: loading ~/projects/banterbus/.envrc
direnv: using flake
direnv: nix-direnv: Using cached dev shell
direnv: export +AR +AS +CC +CONFIG_SHELL +CXX +GOTOOLDIR +HOST_PATH +IN_NIX_SHELL +LD +NIX_BINTOOLS +NIX_BINTOOLS_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu +NIX_BUILD_CORES +NIX_CC +NIX_CC_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu +NIX_CFLAGS_COMPILE +NIX_ENFORCE_NO_NATIVE +NIX_HARDENING_ENABLE +NIX_LDFLAGS +NIX_STORE +NM +OBJCOPY +OBJDUMP +PLAYWRIGHT_BROWSERS_PATH +PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD +RANLIB +READELF +SIZE +SOURCE_DATE_EPOCH +STRINGS +STRIP +__structuredAttrs +buildInputs +buildPhase +builder +cmakeFlags +configureFlags +depsBuildBuild +depsBuildBuildPropagated +depsBuildTarget +depsBuildTargetPropagated +depsHostHost +depsHostHostPropagated +depsTargetTarget +depsTargetTargetPropagated +doCheck +doInstallCheck +dontAddDisableDepTrack +hardeningDisable +mesonFlags +name +nativeBuildInputs +out +outputs +patches +phases +preferLocalBuild +propagatedBuildInputs +propagatedNativeBuildInputs +shell +shellHook +stdenv +strictDeps +system ~PATH ~XDG_DATA_DIRS

Where my mkShell function looks something like:

{
  pkgs.mkShell {
    hardeningDisable = ["all"];
    shellHook = ''
      export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
      export PLAYWRIGHT_BROWSERS_PATH="${pkgs.playwright-driver.browsers}"
      ${pre-commit-check.shellHook}
    '';
    buildInputs = pre-commit-check.enabledPackages;
    packages = with pkgs; [
      # TODO: workout how to use go env
      # goEnv
      gomod2nix
      go_1_22
      playwright-test

      goose
      air
      golangci-lint
      gotools
      gotestsum
      gocover-cobertura
      go-task
      go-mockery
      goreleaser
      golines

      tailwindcss
      templ
      sqlc
    ];
  }
}

You can see I have certain tools I want other developers to have access to like go-task, which they will automatically get when they load into the devshell.

Issue

This is all great; however, I have noticed that shell completions stopped working. Where I can normally do task <TAB>

❯ task tests:e2e
build:dev  (Build the app for development, generates all the files needed for the binary.)  generate:sqlc  (Generates the code to interact with SQL DB.)
coverage                            (Run the integration tests and gets the code coverage)  lint                                      (Runs the linter.)
dev                                       (Start the app in dev mode with live-reloading.)  release                              (Release the CLI tool.)
docker:build                                            (Builds a Docker image using Nix.)  tests                                  (Runs all the tests.)
docker:load                                (Loads the Docker image from tar (in results).)  tests:e2e                  (Runs e2e tests with playwright.)
docker:publish                                                (Publishes the Docker image)  tests:integration          (Runs all the integration tests.)
format                                                               (Runs the formatter.)  tests:unit                        (Runs all the unit tests.)

However, in the devshell this does not work until I load into the shell manually nix develop. Which does defeat the purpose of using nix-direnv as you need to manually run a command now.

I don’t know what causes this and will do a deeper dive at some point 🤔.

I did this in my home-manger config. First we install the Symbols Nerd Font, there are two ways we can normally add nerd fonts. Either patch our font, which I had already done with my font Mono Lisa or use this font (symbols), alongside your font (as a fallback). I haven’t fully managed to get that to work on my system, so I have both normal Mono Lisa and Nerd Font variants on my system at the moment. Else other apps besides Kitty break. Anyway, tangent aside, you can install like this:

{
home.packages = with pkgs; [
  (nerdfonts.override {fonts = ["NerdFontsSymbolsOnly"];})
];
}

Next my Stylix config looks something like this, for my emoji font:

{
stylix = {
  enable = true;

  fonts = {
    emoji = {
      package = pkgs.noto-fonts-emoji;
      name = "Noto Color Emoji";
    };
  };
};
}

Then finally, I configure Kitty like this, the key lines being the ones defined in the extraConfig. Here we are setting symbols to map to emoji font and other nerd font symbols to the symbols’ font.

{
programs.kitty = {
  enable = true;

  extraConfig = ''
    symbol_map U+e000-U+e00a,U+ea60-U+ebeb,U+e0a0-U+e0c8,U+e0ca,U+e0cc-U+e0d4,U+e200-U+e2a9,U+e300-U+e3e3,U+e5fa-U+e6b1,U+e700-U+e7c5,U+f000-U+f2e0,U+f300-U+f372,U+f400-U+f532,U+f0001-U+f1af0 Symbols Nerd Font Mono
    symbol_map U+2600-U+26FF Noto Color Emoji
  '';

  settings = {
    shell = "fish";
    window_padding_width = 10;
    scrollback_lines = 10000;
    show_hyperlink_targets = "yes";
    enable_audio_bell = false;
    url_style = "none";
    underline_hyperlinks = "never";
    copy_on_select = "clipboard";
  };
};
}

This is what it looks like.

My current Zellij status bar.

(Optional) Background

A bit of background, which you can skip if you’d like.

What is zellij?

Some of you may be wondering what is zellij/tmux. They are what we call multiplexers. Essentially, our terminals now can have a client server architecture. So we can kill our terminal but, our session will still be alive. Which makes it great for jumping between projects if you are using say Neovim. When I first moved to tmux, I found it is great because now I don’t need 4/5 VS Code instances open. Instead, I could use a script to jump between my projects, and tmux would keep the session alive, so just how I left the project. Zellij does basically the same thing for me.

Why zellij?

A few reasons, but the main one being I really, really like the floating panes. I know you can probably achieve the same just using normal panes and just swapping between them, but I really like the idea of having floating panes and still have what I was working on just behind the pane. It makes harder for me to forget or lost context on what I was doing.

Zellij, is modal a bit like vim, depending on the mode your keyboard shortcuts can change, i.e. scroll mode, tab or pane mode. At first, I didn’t like this, but now I’ve come to find it pretty useful.

Status Bar

I don’t really like the default status bar in zellij, it is very useful at the beginning when you are learning the keyboard shortcuts. I soon moved over the minimal status bar and moved it to the top, so I could tell it apart easier from my Neovim status bar. However, I didn’t like the fact I couldn’t change the colour, it would always be green and didn’t fit the rest of my theme (catppuccin mocha).

So what we will now do is configure the status bar, I found this plugin. Which allows us to customise our status bar, I wanted mine to look more like how I had it in my tmux configuration.

Here is how the old status bar looked.

Nix

I have configured zellij using Nix via home-manager. So the rest of the post will show you how I did that. It should be easily adjusted for other setups.

I will show you how I configured it in Nix, though it should be easy enough to work out the non-nix version. If you are using Nix flakes, you can add it as an input to your flake.

{
    zjstatus = {
      url = "github:dj95/zjstatus";
    };
}

Then add the following overlay, since I’m using the [snowfall-lib] I can do something like overlays/zjstatus/default.nix:

{
    {inputs, ...}: final: prev: {
      zjstatus = inputs.zjstatus.packages.${prev.system}.default;
    }
}

Next create a module for your zellij config, in my case I put in a file called home/cli/multiplexers/zellij/default.nix.

Here, we enable zellij (using the home-manager options).

{
    xdg.configFile."zellij/config.kdl".source = ./config.kdl;
    programs.zellij = {
      enable = true;
    };
}

Where my config.kdl looks something like this, my specific key bindings. Just to be more Alt based, so it doesn’t clash with my Neovim bindings.

theme "catppuccin-mocha"
pane_frames false
simplified_ui true
default_shell "fish"
copy_on_select true

// If you'd like to override the default keybindings completely, be sure to change "keybinds" to "keybinds clear-defaults=true"
keybinds {

}

Now onto the real meat and potatoes of the post, my default layout, you can see my full config here. Also note how we reference the plugin using the nix package here plugin location="file://${pkgs.zjstatus}/bin/zjstatus.wasm".

{
    xdg.configFile."zellij/layouts/default.kdl".text = ''
      layout {
          default_tab_template {
              pane size=2 borderless=true {
                  plugin location="file://${pkgs.zjstatus}/bin/zjstatus.wasm" {
                      format_left   "{mode}#[bg=#${colors.base00}] {tabs}"
                      format_center ""
                      format_right  "#[bg=#${colors.base00},fg=#${colors.base0D}]#[bg=#${colors.base0D},fg=#${colors.base01},bold] #[bg=#${colors.base02},fg=#${colors.base05},bold] {session} #[bg=#${colors.base03},fg=#${colors.base05},bold]"
                      format_space  ""
                      format_hide_on_overlength "true"
                      format_precedence "crl"

                      border_enabled  "false"
                      border_char     "─"
                      border_format   "#[fg=#6C7086]{char}"
                      border_position "top"

                      mode_normal        "#[bg=#${colors.base0B},fg=#${colors.base02},bold] NORMAL#[bg=#${colors.base03},fg=#${colors.base0B}]█"
                      mode_locked        "#[bg=#${colors.base04},fg=#${colors.base02},bold] LOCKED #[bg=#${colors.base03},fg=#${colors.base04}]█"
                      mode_resize        "#[bg=#${colors.base08},fg=#${colors.base02},bold] RESIZE#[bg=#${colors.base03},fg=#${colors.base08}]█"
                      mode_pane          "#[bg=#${colors.base0D},fg=#${colors.base02},bold] PANE#[bg=#${colors.base03},fg=#${colors.base0D}]█"
                      mode_tab           "#[bg=#${colors.base07},fg=#${colors.base02},bold] TAB#[bg=#${colors.base03},fg=#${colors.base07}]█"
                      mode_scroll        "#[bg=#${colors.base0A},fg=#${colors.base02},bold] SCROLL#[bg=#${colors.base03},fg=#${colors.base0A}]█"
                      mode_enter_search  "#[bg=#${colors.base0D},fg=#${colors.base02},bold] ENT-SEARCH#[bg=#${colors.base03},fg=#${colors.base0D}]█"
                      mode_search        "#[bg=#${colors.base0D},fg=#${colors.base02},bold] SEARCHARCH#[bg=#${colors.base03},fg=#${colors.base0D}]█"
                      mode_rename_tab    "#[bg=#${colors.base07},fg=#${colors.base02},bold] RENAME-TAB#[bg=#${colors.base03},fg=#${colors.base07}]█"
                      mode_rename_pane   "#[bg=#${colors.base0D},fg=#${colors.base02},bold] RENAME-PANE#[bg=#${colors.base03},fg=#${colors.base0D}]█"
                      mode_session       "#[bg=#${colors.base0E},fg=#${colors.base02},bold] SESSION#[bg=#${colors.base03},fg=#${colors.base0E}]█"
                      mode_move          "#[bg=#${colors.base0F},fg=#${colors.base02},bold] MOVE#[bg=#${colors.base03},fg=#${colors.base0F}]█"
                      mode_prompt        "#[bg=#${colors.base0D},fg=#${colors.base02},bold] PROMPT#[bg=#${colors.base03},fg=#${colors.base0D}]█"
                      mode_tmux          "#[bg=#${colors.base09},fg=#${colors.base02},bold] TMUX#[bg=#${colors.base03},fg=#${colors.base09}]█"

                      // formatting for inactive tabs
                      tab_normal              "#[bg=#${colors.base03},fg=#${colors.base0D}]█#[bg=#${colors.base0D},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{floating_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
                      tab_normal_fullscreen   "#[bg=#${colors.base03},fg=#${colors.base0D}]█#[bg=#${colors.base0D},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{fullscreen_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
                      tab_normal_sync         "#[bg=#${colors.base03},fg=#${colors.base0D}]█#[bg=#${colors.base0D},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{sync_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"

                      // formatting for the current active tab
                      tab_active              "#[bg=#${colors.base03},fg=#${colors.base09}]█#[bg=#${colors.base09},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{floating_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
                      tab_active_fullscreen   "#[bg=#${colors.base03},fg=#${colors.base09}]█#[bg=#${colors.base09},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{fullscreen_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
                      tab_active_sync         "#[bg=#${colors.base03},fg=#${colors.base09}]█#[bg=#${colors.base09},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{sync_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"

                      // separator between the tabs
                      tab_separator           "#[bg=#${colors.base00}] "

                      // indicators
                      tab_sync_indicator       " "
                      tab_fullscreen_indicator " 󰊓"
                      tab_floating_indicator   " 󰹙"

                      command_git_branch_command     "git rev-parse --abbrev-ref HEAD"
                      command_git_branch_format      "#[fg=blue] {stdout} "
                      command_git_branch_interval    "10"
                      command_git_branch_rendermode  "static"

                      datetime        "#[fg=#6C7086,bold] {format} "
                      datetime_format "%A, %d %b %Y %H:%M"
                      datetime_timezone "Europe/London"
                  }
              }
              children
          }
      }
    '';
}

I am using stylix to theme my apps inherit (config.lib.stylix) colors;, which uses the base16 colours so instead of hardcoding colours, I reference these colours.

Essentially, all we do on the left-hand side we use straight “█” and on the right-hand side I use the circular “”. My current active tab is orange and inactive is blue, where the colour of the text is white.

Then the different colours for the different modes, i.e. normal, tab, locked.

Auto rename tabs

I also wanted to auto-rename the tabs in zellij like happened in tmux. Depending on the process running, the tab name would change to that.

So, with some help from ChatGPT and a Reddit thread. I came up with the following:

if status is-interactive
    if type -q zellij
        # Update the zellij tab name with the current process name or pwd.
        function zellij_tab_name_update_pre --on-event fish_preexec
            if set -q ZELLIJ
                set -l cmd_line (string split " " -- $argv)
                set -l process_name $cmd_line[1]
                if test -n "$process_name" -a "$process_name" != "z"
                    command nohup zellij action rename-tab $process_name >/dev/null 2>&1
                end
            end
        end

        function zellij_tab_name_update_post --on-event fish_postexec
            if set -q ZELLIJ
                set -l cmd_line (string split " " -- $argv)
                set -l process_name $cmd_line[1]
                if test "$process_name" = "z"
                    command nohup zellij action rename-tab (prompt_pwd) >/dev/null 2>&1
                end
            end
        end
    end
end

Since I use zoxide, I don’t want to see just z, when I change directory; hence I have the code to ignore. It is possible we can simplify this, but it works for now. However, one issue I did note was that the process running the floating pane would overwrite the main process, i.e. running Neovim in a tab I would like to see nvim but since I ran git, it now shows git.

Nix

Since I am also configuring fish shell with nix, I added the above to the interactiveShellInit.

{
    programs.fish = {
      enable = true;
      interactiveShellInit = ''
      '';
    }
}

Appendix

• Thanks for inspiration
• Reddit thread auto-rename

Recently, I was trying to create a derivation which needed to pull git submodules as well. I was getting an error which look something like this:

data/meson.build:76:0: ERROR: Nonexistent build file 'data/submodules/meson.build'

It was coming from this derivation https://gitlab.com/hmajid2301/dotfiles/-/blob/c153de146a3bf9339cbef013ac65bc32e6305c8e/packages/gradience/default.nix for building the latest version of gradience.

It turns out when we do a fetchFromGitHub we need to explicitly tell it to also pull submodules, which makes sense. So I was able to fix this. I had to add the fetchSubmodules argument:

{
  pkgs,
  lib,
  fetchFromGitHub,
  ...
}:
pkgs.python3Packages.buildPythonApplication {
  pname = "gradience";
  version = "0.8.0-beta1";

  src = fetchFromGitHub {
    owner = "GradienceTeam";
    repo = "Gradience";
    rev = "90b774174da0e3c6b5314e38226bea653a5bf57a";
    sha256 = "sha256-C0GV6vOEZ0wTaKO7BgGuFvHsHeaVwH0W1U8yKUMrO9c=";
    fetchSubmodules = true;
  };
}

That’s it! A simple fix, but took me longer than it should’ve done to figure it out.

Previously I was creating my own ISO and then burning that to a USB and using that USB as live media to install my config. I had a custom script nix_installer, which would run automatically when you loaded into the gnome shell.

However, I think I have found a slightly better way to do this, recently (earlier this week). This is the process I used recently to reinstall my workstation. We will be doing this using this really cool tool nixos-anywhere. Which involves installing our config using SSH.

Note you can still generate an ISO using the snowfall library, but I haven’t tested it yet with my config.

What do you need?

• Nix configuration: The nix configuration we want to install
• Two devices
• Target device: My personal desktop, this is where we will install the config onto
  • Need to be able to connect to this from the source device
• Source device: My laptop, which can connect to my desktop to install the config
• Disko configuration: So we know how to partition our disk(s)

Disko

To partition our disks, we can use the fantastic disko tool. Which allows us to declaratively declare how to partition our disk(s), in nix configuration. Having a look at an example, one I have:

{
  disko.devices = {
    disk = {
      nvme0n1 = {
        type = "disk";
        device = "/dev/nvme0n1";
        content = {
          type = "gpt";
          partitions = {
            ESP = {
              label = "boot";
              name = "ESP";
              size = "512M";
              type = "EF00";
              content = {
                type = "filesystem";
                format = "vfat";
                mountpoint = "/boot";
                mountOptions = [
                  "defaults"
                ];
              };
            };
            luks = {
              size = "100%";
              label = "luks";
              content = {
                type = "luks";
                name = "cryptroot";
                extraOpenArgs = [
                  "--allow-discards"
                  "--perf-no_read_workqueue"
                  "--perf-no_write_workqueue"
                ];
                # https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html
                settings = {crypttabExtraOpts = ["fido2-device=auto" "token-timeout=10"];};
                content = {
                  type = "btrfs";
                  extraArgs = ["-L" "nixos" "-f"];
                  subvolumes = {
                    "/root" = {
                      mountpoint = "/";
                      mountOptions = ["subvol=root" "compress=zstd" "noatime"];
                    };
                    "/home" = {
                      mountpoint = "/home";
                      mountOptions = ["subvol=home" "compress=zstd" "noatime"];
                    };
                    "/nix" = {
                      mountpoint = "/nix";
                      mountOptions = ["subvol=nix" "compress=zstd" "noatime"];
                    };
                    "/persist" = {
                      mountpoint = "/persist";
                      mountOptions = ["subvol=persist" "compress=zstd" "noatime"];
                    };
                    "/log" = {
                      mountpoint = "/var/log";
                      mountOptions = ["subvol=log" "compress=zstd" "noatime"];
                    };
                    "/swap" = {
                      mountpoint = "/swap";
                      swap.swapfile.size = "64G";
                    };
                  };
                };
              };
            };
          };
        };
      };
    };
  };

  fileSystems."/persist".neededForBoot = true;
  fileSystems."/var/log".neededForBoot = true;
}

Here we create a LUKS encrypted using BTRFS. Where we have a bunch of sub volumes intended to be used for impermanence setup and we even have a swap sub volume.

The cool thing about this it removes the manual partition we would have to-do and now nixos-anywhere can do it for us. In our system configuration, the disk config is imported like so, in my snowfall-based nix config systems/x86_64-linux/workstation/default.nix.

{
  pkgs,
  lib,
  ...
}: {
  imports = [
    ./hardware-configuration.nix
    ./disks.nix
  ];
}

Install

Assuming the target device has no OS on it yet, you can simply boot from the normal NixOS ISO (say gnome). Which provides us an SSH service we can connect to from our source device (my laptop). You can see more details here.

On target device

• Boot from live media ISO
• Grab IP address ip addr
  • Likely something like 192.168.1.8 (see output below)
• Copy our public SSH keys of the source device and put them into the authorized_keys
  • In my case, I can grab them from GitHub
    • mkdir -p ~/.ssh curl https://github.com/hmajid2301.keys > ~/.ssh/authorized_keys
• Now we can SSH from source to target

 ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: enp16s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 74:56:3c:bb:2f:41 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.8/24 brd 192.168.1.255 scope global noprefixroute enp16s0
       valid_lft forever preferred_lft forever
    inet6 2a0a:ef40:10f9:e01:b554:c3ad:550d:8fcd/64 scope global temporary dynamic
       valid_lft 84920sec preferred_lft 2120sec
    inet6 2a0a:ef40:10f9:e01:7135:7af1:7f82:9ac/64 scope global dynamic mngtmpaddr noprefixroute
       valid_lft 84920sec preferred_lft 2120sec
    inet6 fe80::7203:6b95:514e:c231/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

On source device

git clone git@github.com:hmajid2301/dotfiles.git ~/dotfiles/
cd dotfiles

nix develop
nixos-anywhere -- --flake '.#workstation' nixos@192.168.1.8

Then follow and answer the question it asks you, like the password to use for LUKS. This is basically a really nice way we can now install NixOS onto a new or existing device. With minimal effort, in my opinion.

credit for meme

I mean, likely this will probably happen a lot, as my configuration changes more often than it should 🙈. Anyway, into the main topic.

My dotfiles

Snowfall what?

I recently ported my Nix configuration (dotfiles), to use the snowfall-lib to structure my Nix config.

It is an opinionated library that I think removes a ton of boilerplate from my Nix configuration. I like having my code structured, and I like not having to think about it much.

One thing I really enjoy is I don’t need to import all of my modules and config. Snowfall handles this all for us. We will see a before and after for one of my NixOS system configuration files. Basically less boilerplate, as I said above.

Structure

Let’s have a look at the structure and explain briefly what’s in it

.
├── flake.lock
├── flake.nix
├── homes
│  ├── x86-64-install-iso
│  └── x86_64-linux
├── lib
│  └── module
├── modules
│  ├── home
│  │  ├── browsers
│  │  ├── cli
│  │  ├── desktops
│  │  ├── programs
│  │  ├── secrets.yaml
│  │  ├── security
│  │  ├── services
│  │  ├── suites
│  │  ├── systems
│  │  └── user
│  └── nixos
│     ├── cli
│     ├── hardware
│     ├── secrets.yaml
│     ├── security
│     ├── services
│     ├── suites
│     ├── system
│     └── user
├── packages
├── shells
└── systems
   ├── x86_64-install-iso
   └── x86_64-linux
      ├── framework
      ├── vm
      └── workstation

• flake.nix: Entry point for the configuration
• homes: home manager configuration for each device
• modules: Specific Nix configuration, anything shared between multiple devices split into home-manager and NixOS modules
• packages: Nix packages specific to me, some of these are those not available on nixpkgs yet. Some are specific to me, like wallpaper or fonts
• shell: The devshell for this project
• systems: The NixOS configuration for each device

Taking a deeper dive into my configuration into what is going on each folder.

Modules

The main part of my configuration, contains all the re-usable bits of my config. That can be shared, between multiple devices. Let’s see what I mean.

First of all, it is broken down into two parts, one for my NixOS specific config and one for home-manager. As before I try to put as much of my config into the modules/home part because it means I can configure more of my machine using Nix that doesn’t use NixOS. Like my Ubuntu work laptop.

NixOS

I tried to split into various sub folders relating to what that config is related to, for example CLI tooling. moudles/nixos/cli/programs/nh/default.nix:

{
  config,
  lib,
  ...
}:
with lib;
with lib.nixicle; let
  cfg = config.cli.programs.nh;
in {
  options.cli.programs.nh = with types; {
    enable = mkBoolOpt false "Whether or not to enable nh.";
  };

  config = mkIf cfg.enable {
    programs.nh = {
      enable = true;
      clean.enable = true;
      clean.extraArgs = "--keep-since 4d --keep 3";
      flake = "/home/${config.user.name}/dotfiles";
    };
  };
}

This is the general format of all of my files. Where we need to manually enable all the various modules we want to use. To reduce boilerplate because often similar devices will want the same modules, think of them as “features”. I have the concept of suites. I don’t have many suites, but if we have a look at the common and desktop suites as an example. modules/nixos/suites/common/default.nix:

{
  lib,
  config,
  ...
}:
with lib; let
  cfg = config.suites.common;
in {
  options.suites.common = {
    enable = mkEnableOption "Enable common configuration";
  };

  config = mkIf cfg.enable {
    nix.enable = true;
    hardware = {
      audio.enable = true;
      bluetooth.enable = true;
      networking.enable = true;
    };

    services = {
      openssh.enable = true;
    };

    security = {
      sops.enable = true;
      yubikey.enable = true;
    };

    system = {
      boot = {
        enable = true;
        plymouth = true;
      };

      fonts.enable = true;
      locale.enable = true;
    };
  };
}

These are modules that most of my devices will enable and use. Which enable modules similar to the one we saw for nh.

{
  lib,
  config,
  ...
}:
with lib;
with lib.nixicle; let
  cfg = config.suites.desktop;
in {
  options.suites.desktop = {
    enable = mkEnableOption "Enable desktop configuration";
  };

  config = mkIf cfg.enable {
    suites = {
      common.enable = true;

      desktop.addons = {
        nautilus.enable = true;
      };
    };

    hardware = {
      logitechMouse.enable = true;
      zsa.enable = true;
    };

    services = {
      nixicle.avahi.enable = true;
      backup.enable = true;
      vpn.enable = true;
      virtualisation.podman.enable = true;
    };

    cli.programs = {
      nh.enable = true;
      nix-ld.enable = true;
    };

    user = {
      name = "haseeb";
      initialPassword = "1";
    };
  };
}

Then we can also see, the desktop suite using the common suite and extending with more config modules I will want. Like enabling Podman, backups and a VPN. Things I want across all of my Desktops.

That’s the main bit! These are just modules that are then imported, and we will see this a bit later. The NixOS stuff doesn’t tend to change much, and it mostly the same across all of my devices that run NixOS.

home

The main bit of my config as with my old config relates to home-manager, again so I can use this config also on non NixOS devices. The structure here is much the same. Except there is a lot more choice and modules not turned on.

Such as modules/home/cli/terminals/ contains all the terminals I could use on my device. Though usually, we only have one enabled at a time, but the choice is there if we want it.

  alacritty/
  foot/
  kitty/
  wezterm/

Each config looks pretty similar to other ones we saw above:

{
  config,
  lib,
  ...
}:
with lib;
with lib.nixicle; let
  cfg = config.cli.terminals.foot;
in {
  options.cli.terminals.foot = with types; {
    enable = mkBoolOpt false "enable foot terminal emulator";
  };

  config = mkIf cfg.enable {
    programs.foot = {
      enable = true;
      catppuccin.enable = true;

      settings = {
        main = {
          term = "foot";
          font = "MonoLisa Nerd Font:size=14; Noto Color Emoji:size=20";
          shell = "fish";
          pad = "30x30";
          selection-target = "clipboard";
        };

        scrollback = {
          lines = 10000;
        };
      };
    };
  };
}

We can enable it using cli.terminals.foot.enable = true;, in our home-manager config. We also have a bunch of suites we can use with this config.

  common/
  desktop/
  development/
  gaming/
  guis/
  streaming/

We can turn them on depending on the device. Such as on my work laptop, I will not use the gaming suite. If we look at the modules/home/suites/development/default.nix file:

{
  lib,
  config,
  ...
}:
with lib; let
  cfg = config.suites.development;
in {
  options.suites.development = {
    enable = mkEnableOption "Enable development configuration";
  };

  config = mkIf cfg.enable {
    suites.common.enable = true;

    cli = {
      editors.nvim.enable = true;
      multiplexers.zellij.enable = true;

      programs = {
        attic.enable = true;
        atuin.enable = true;
        bat.enable = true;
        bottom.enable = true;
        direnv.enable = true;
        eza.enable = true;
        fzf.enable = true;
        git.enable = true;
        gpg.enable = true;
        k8s.enable = true;
        modern-unix.enable = true;
        network-tools.enable = true;
        nix-index.enable = true;
        podman.enable = true;
        ssh.enable = true;
        starship.enable = true;
        yazi.enable = true;
        zoxide.enable = true;
      };
    };
  };
}

We can see here I am enabling most of the CLI tooling I want available one by one. This allows us to turn them off on certain machines, if we want to overwrite this, in a specific device config.

Neovim

A decent part of my home-manager config is configuring Neovim. I use Neovim btw!!!! ;) And I use NixOS btw!!!! And I used to use Arch btw!!!! Okay, with those important details out of the way. As I said before, I had a bunch of imports but now in each folder we have a default.nix which contains this import:

{
  imports = lib.snowfall.fs.get-non-default-nix-files ./.;
}

So we may have something nvim/editor/default.nix and this will import everything in nvim/editor/ folder.

  default.nix
  focus.nix
  telescope.nix
  trouble.nix

Shell

We can set up development shells as well, for example to create a default devshell we can do this at shells/default/default.nix:

{pkgs, ...}: let
  json2nix = pkgs.writeScriptBin "json2nix" ''
    ${pkgs.python3}/bin/python ${pkgs.fetchurl {
      url = "https://gitlab.com/-/snippets/3613708/raw/main/json2nix.py";
      hash = "sha256-zZeL3JwwD8gmrf+fG/SPP51vOOUuhsfcQuMj6HNfppU=";
    }} $@
  '';

  yaml2nix = pkgs.writeScriptBin "yaml2nix" ''
    nix run github:euank/yaml2nix '.args'
  '';
in
  pkgs.mkShell {
    NIX_CONFIG = "extra-experimental-features = nix-command flakes repl-flake";

    packages = with pkgs; [
      yaml2nix
      json2nix
      statix
      deadnix
      alejandra
      home-manager
      git
      sops
      ssh-to-age
      gnupg
      age
    ];
  }

We can then load into this using nix develop, or use direnv. Where we have a .envrc file with the contents:

use flake

Which will load into our devshell for us when we change into this folder. We will have all of the above packages made available for this project.

Systems

These are first split into by architecture, then the hostname of the machine systems/x86_64-linux/workstation/default.nix:

Before, my specific system configuration look something like this

{ inputs, ... }: {
  imports = [
    inputs.hardware.nixosModules.framework-12th-gen-intel
    inputs.hyprland.nixosModules.default
    inputs.disko.nixosModules.disko

    ./hardware-configuration.nix
    ./disks.nix

    ../../nixos/global
    ../../nixos/users/haseeb.nix

    ../../nixos/optional/backup.nix
    ../../nixos/optional/fingerprint.nix
    ../../nixos/optional/docker.nix
    ../../nixos/optional/fonts.nix
    ../../nixos/optional/pipewire.nix
    ../../nixos/optional/greetd.nix
    ../../nixos/optional/quietboot.nix
    ../../nixos/optional/vfio.nix
    ../../nixos/optional/vpn.nix
    ../../nixos/optional/pam.nix
    ../../nixos/optional/grub.nix
  ];

  networking = {
    hostName = "framework";
  };

  system.stateVersion = "23.05";
}

And now it looks like, we can see far fewer imports, and then I turn on some specific modules to this system. I like this approach because is it easier to make changes per system if I want. Such as not turning on the gaming suite on my Laptop, say just my PC.

{
  pkgs,
  lib,
  ...
}: {
  imports = [
    ./hardware-configuration.nix
    ./disks.nix
  ];

  services = {
    virtualisation.kvm.enable = true;
    hardware.openrgb.enable = true;
  };

  suites = {
    gaming.enable = true;
    desktop = {
      enable = true;
      addons = {
        hyprland.enable = true;
      };
    };
  };

  networking.hostName = "workstation";

  system.stateVersion = "23.11";
}

homes

This is very similar to the systems homes/x86_64-linux/haseeb@workstation/default.nix, now we split using username@hostname. When we build our NixOS config it will either match on workstation or the username we are logged in as, i.e. haseeb.

Having a look at before and after, here I was already using modules options to enable and disable certain packages/tools. Unliked in our NixOS specific config above (systems).

{
  inputs,
  pkgs,
  lib,
  config,
  ...
}: {
  imports = [
    ../../home-manager
    ../../home-manager/programs/gaming.nix
    ../../home-manager/programs/discord
  ];

  config = {
    modules = {
      browsers = {
        firefox.enable = true;
      };

      editors = {
        nvim.enable = true;
      };

      multiplexers = {
        zellij.enable = true;
      };

      shells = {
        fish.enable = true;
      };

      wms = {
        hyprland.enable = true;
      };

      terminals = {
        wezterm.enable = true;
      };
    };

    my.settings = {
      wallpaper = "~/dotfiles/home-manager/wallpapers/Kurzgesagt-Galaxy_2.png";
      host = "desktop";
      default = {
        shell = "${pkgs.fish}/bin/fish";
        terminal = "wezterm";
        browser = "firefox";
        editor = "nvim";
      };
    };

    colorscheme = inputs.nix-colors.colorSchemes.catppuccin-mocha;

    home = {
      username = lib.mkDefault "haseeb";
      homeDirectory = lib.mkDefault "/home/${config.home.username}";
      stateVersion = lib.mkDefault "23.11";
    };
  };
}

The new version looks something like:

{
  cli.programs.git.allowedSigners = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINP5gqbEEj+pykK58djSI1vtMtFiaYcygqhHd3mzPbSt hello@haseebmajid.dev";

  suites = {
    desktop.enable = true;
    gaming.enable = true;
    streaming.enable = true;
  };

  desktops.hyprland.enable = true;

  nixicle.user = {
    enable = true;
    name = "haseeb";
  };

  home.stateVersion = "23.11";
}

Here we could again use something my.settings though so we can change the default terminal in one place and reference it everywhere. However, we could overwrite some of these setting as well, such as on certain devices I am using an older version of Hyprland and don’t have bindi:

{
  programs.waybar.package = inputs.waybar.packages."${pkgs.system}".waybar;
  wayland.windowManager.hyprland.keyBinds.bindi = lib.mkForce {};
}

Or tying waybar to a specific version of our inputs, again because I’m using an older version of Hyprland.

Summary

So to summarise I migrated my config to use snowfall-lib, which remove boilerplate and gives me a super opinionated layout for my config. Alongside this, using some of the example config below, I made all of my modules now into something we need to enable. Making it way easier to turn on “features” in my nix config.

Example Configuration

Some example configurations that I used as inspiration and to help me update my config.

• https://github.com/jakehamilton/config
• https://github.com/IogaMaster/dotfiles
• https://github.com/khaneliman/khanelinix

If you are like me, you may be configuring your Neovim configuration using NixVim. Which is a “framework” making it easier to configure Neovim using mostly Nix configuration. Allowing us to keep most of our config in one language, at least in my case.

I started using Neorg to manage my notes and to-do lists in my “second-brain”, but noticed that the metadata part was not being highlighted as I expected.

My config looked something like:

{
  programs.nixvim = {
    plugins = {
      neorg = {
        enable = true;
        lazyLoading = true;
        modules = {
          # ...
        };
      };

      treesitter = {
        grammarPackages = with config.programs.nixvim.plugins.treesitter.package.builtGrammars; [
          norg
        ];
      };
    };
  };
}

Turns out there is another tree sitter package for the n Neorg metadata, but this is not available with nvim-treesitter. Hence, also not available with Nixvim. I was able to resolve my issue my using the tree-sitter specific grammar like so:

{
  programs.nixvim = {
    plugins = {
      neorg = {
        enable = true;
        lazyLoading = true;
        modules = {
          # ...
        };
      };

      treesitter = {
        grammarPackages = with pkgs.tree-sitter-grammars; [
          tree-sitter-norg
          tree-sitter-norg-meta
        ];
      };
    };
  };
}

It looks like this. That’s it!

I have been using Zellij for a while now. I tried to set up layouts for one of my personal projects. So that we could have tests and linting running and any other tasks we may want whilst doing development ¹.

However, I had an issue working out how to call commands that required direnv and nix to set up development environments. In my case, my nix dev shell installed the go-task tool to run tasks such as task lint or task tests. However the shell that zellij was running the commands in for the layout did not load my Nix dev shell, so the go-task binary was not available.

So to fix this, we need to do something like this layout.kdl:

layout {
    pane size=1 borderless=true {
        plugin location="zellij:tab-bar"
    }
    pane {
        command "fish"
        args "-c" "direnv exec . task lint"
    }
    pane {
        command "fish"
        args "-c" "direnv exec . task tests"
    }
    pane {
        command "docker-compose"
        args "up" "--build -d"
    }
}

Where the key being we need to execute the direnv environment i.e. direnv exec ., then we can run commands like normal. Where direnv .envrc file contains use flake. That’s it! If you want Zellij to use direnv and load your nix flake dev shell, you have to add a bit of boilerplate, which is not ideal but

Recently I stopped using tmux to try zellij, however I noticed when I removed tmux from my nix config. I was getting the following error, when rebuilding my home-manager config:

The user systemd session is degraded:
  UNIT         LOAD   ACTIVE SUB    DESCRIPTION
● tmux.service loaded failed failed tmux default session (detached)

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

I was wondering where this error was coming from, turns it the symlink to tmux.service has not been deleted that nix would create.

ls -al ~/.config/systemd/user/tmux.service
Permissions Size User        Group       Date Modified Name
.rw-rw-r--   453 haseebmajid haseebmajid 22 Aug  2023   /home/haseebmajid/.config/systemd/user/tmux.service

If we look at other systemd services we can see them symlinked to a nix package in the nix store.

ls -al ~/.config/systemd/user
lrwxrwxrwx     - haseebmajid haseebmajid 20 Feb 17:04   spotifyd.service -> /nix/store/7v52bpcyi0zqv012rrmd7s2r742hb2cy-home-manager-files/.config/systemd/user/spotifyd.service
lrwxrwxrwx     - haseebmajid haseebmajid 20 Feb 17:04   swayidle.service -> /nix/store/7v52bpcyi0zqv012rrmd7s2r742hb2cy-home-manager-files/.config/systemd/user/swayidle.service

So we can simply remove the tmux file, rm ~/.config/systemd/user/tmux.service. I should look into why this symlink is not removed.

However, I kept getting the following errors:

nix-shell -p vimPluginsUpdater --run vim-plugins-updater
error:
       … while calling the 'derivationStrict' builtin

         at /builtin/derivation.nix:9:12: (source not available)

       … while evaluating derivation 'shell'
         whose name attribute is located at /nix/store/whhzjfgalghpm34irclh01c0afynmyll-nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:300:7

       … while evaluating attribute 'buildInputs' of derivation 'shell'

         at /nix/store/whhzjfgalghpm34irclh01c0afynmyll-nixpkgs/nixpkgs/pkgs/stdenv/generic/make-derivation.nix:347:7:

          346|       depsHostHost                = lib.elemAt (lib.elemAt dependencies 1) 0;
          347|       buildInputs                 = lib.elemAt (lib.elemAt dependencies 1) 1;
             |       ^
          348|       depsTargetTarget            = lib.elemAt (lib.elemAt dependencies 2) 0;

       error: undefined variable 'vimPluginsUpdater'

       at «string»:1:107:

            1| {...}@args: with import <nixpkgs> args; (pkgs.runCommandCC or pkgs.runCommand) "shell" { buildInputs = [ (vimPluginsUpdater) ]; } ""

Or I was getting 429 network errors, too many requests to GitHub.

Solution

I found this great person who was able to solve my issue on discourse. Assuming you have a fork of nixpkgs and have to clone it locally, i.e. git clone https://github.com/hmajid2301/nixpkgs.git

1. Update nixpkgs/pkgs/applications/editors/vim/plugins/vim-plugin-names
2. Can do this using the ./update.py add "gbprod/yanky.nvim" (where gbprod/yanky.nvim is the path to git repository)
3. Export your GitHub Personal Token
4. You can create one by following this link
5. export GITHUB_API_TOKEN=your_token
6. I will do a post in the future about how you can do this in fish shell and keep secrets out of your shell history.
7. nix-shell -I nixpkgs=channel:nixpkgs-unstable -p vimPluginsUpdater --run vim-plugins-updater
8. Make sure to run this in the repository root
9. Push your changes and create a PR with nixpkgs repo
10. You will likely need to rebase your commits to follow the contribution guidelines, check those when creating the PR

That’s it! I am not sure if this will be useful for others (I will most likely reference this myself in the future), but that’s the easiest way I found to add new vim plugins to nixpkgs.

In this article, I will go over how to get sops-nix to work properly with home-manager. One issue I noticed was that when I used with home-manager modules/options, I would see a string like “%r/secrets/haseeb/…”. The %r would not be replaced.

Relevant Issue: https://github.com/Mic92/sops-nix/issues/28

Assumption

I will assume you have already setup sops-nix and are using it. In the sense, you have a .sops.yaml file and are already using it with NixOS. The instructions in the README is mostly pretty clear how to get setup, but I may in future create another article how I set up sops-nix. But in this post, we will simply go over how we can make it work with home-manager. I will also assume you are using nix flakes and have passed sops-nix as an input.

Solution

So I have a file called home-manager/security/sops.nix which looks like this:

{
  inputs,
  pkgs,
  ...
}: {
  imports = [
    inputs.sops-nix.homeManagerModules.sops
  ];

  sops = {
    gnupg = {
      home = "~/.gnupg";
      sshKeyPaths = [];
    };
    defaultSymlinkPath = "/run/user/1000/secrets";
    defaultSecretsMountPoint = "/run/user/1000/secrets.d";
  };

  home.packages = with pkgs; [
    sops
  ];
}

Where the key bit to making it work is the default values here, which tell sops where to mount the secret in tmpfs. The temporary file-system where are secrets will be stored in files.

ls -al /run/user/1000/secrets/atuin_key

Permissions Size User   Group Date Modified Name
.r--------   146 haseeb users 28 Jan 09:26   /run/user/1000/secrets/atuin_key

Other than that, we install sops so we can use the CLI tool to edit our sops files and add secrets. Where I have a home-manager/secrets.yaml file for storing all secrets related to home-manager.

Atuin

So first I do sops home-manager/secrets.yaml, and add my Atuin secret encryption key to this file. Having a look at how I use it in one of my modules, say home-manager/programs/atuin.nix

{
  config,
  pkgs,
  ...
}: {
  programs.atuin = {
    enable = true;
    settings = {
      # ...
      key_path = config.sops.secrets.atuin_key.path;
    };
  };

  sops.secrets.atuin_key = {
    sopsFile = ../secrets.yaml;
  };
}

Where we reference this secret in this module. Once this has been built using home manager, if we look at the config for Atuin that is generated by nix. It will point to that /run/user/1000/secrets/atuin_key file.

Recently on my laptop I had to add some extra config settings to my Hyprland config. Rather than polluting my hyprland.nix file with if, else depending on the host. I wanted to add the extra config in the home.nix of the host. So it’s contained within that host. Where my home.nix is the entry point for my home-manager config for that host.

My hyprland.nix looks like this:

{
wayland.windowManager.hyprland = {
  enable = true;
  extraConfig = ''
     input {
        kb_layout = gb
        touchpad {
            disable_while_typing=false
        }
     }
  '';
};
}

I want to add some extra config to the extraConfig option/attribute of this attribute set. Then in my home.nix I added the following:

{
wayland.windowManager.hyprland.extraConfig = lib.mkAfter ''
  exec-once = /usr/libexec/geoclue-2.0/demos/agent
  exec-once = warp-taskbar

  bind=,XF86Launch5,exec,/usr/local/bin/swaylock -S
  bind=,XF86Launch4,exec,/usr/local/bin/swaylock -S
  bind=SUPER,backspace,exec,/usr/local/bin/swaylock -S
'';
}

In this case we want to start some processes on this host, like showing warp in my taskbar. The key line here being lib.mkAfter. Which will append the content after the existing config options we defined in hyprland.nix

As per some of my recent articles, you will be aware I am using Hyprland (tiling manager) on Ubuntu and managing the config using nix (home-manager). I was having issues where for some reason it wouldn’t set the PATH variable correctly.

On my NixOS machine, the following would be fine:

bind=,XF86AudioRaiseVolume,exec, volume --inc
bind=,XF86AudioLowerVolume,exec, volume --dec

However, on Ubuntu I needed to provide the full path:

bind=,XF86AudioRaiseVolume,exec, ${volume}/bin/volume --inc

So in the Hyprland config it would look like:

bind=,XF86AudioRaiseVolume,exec, /nix/store/q1wm84g65smaq4agq7zp40q57x3534ni-volume/bin/volume --inc

It was because the session was being started by GDM (gnome), and the PATH variable was not being set properly. In Wayland GDM picks up environment variables from ~/.config/environment.d/envvars.conf ¹ so we can add it here.

❯ bat ~/.config/environment.d/envvars.conf --plain
PATH="$PATH:/home/haseebmajid/.nix-profile/bin"

Replace haseebmajid with your username (or I guess $HOME should work). This means when we run scripts now, it will source them from this nix-profile folder. Where the binaries get symlinked, including the volume script above. So now you don’t need to specify the full path (though maybe you should 🤷)

Appendix

• Hyprland Config
• Reddit Thread
• Discourse Thread

Now we have looked at our choice of hardware, which OS to use and specifically, how to configure NixOS (at a high-level), using a git repository.

In this part, we will go over which window manager to use. There are two main types we could use here. Either a desktop environment like Gnome or KDE. Which comes with batteries included, it provides us with everything we need and we don’t need to configure much to get stuff working. Things like a notification daemon, polkit (for auth).

Whereas in a more bare-bones window manager such as Hyprland, i3, Sway they are far more bare bones and we need to setup a lot more things ourselves. They are more customisable but more effort to set up, they also tend to be more light weight on resources.

In this section, we will look at using a tiling window manager Hyprland, though, you could also look at using Sway.

Why a tiling manager?

A tiling window manager is great because it handles placing our window automatically for us. This allows for more efficient usage of our space. Rather than multiple overlapping windows, each window has its own space on the display.

It also makes it much easier to be keyboard-driven, so we need to rely on our mouse a lot less. We can use the keyboard to swap between open windows. We can also open apps using a tool like rofi again from the keyboard. This just helps us be quicker, not wasting time needing to reach for the mouse.

Why Hyprland?

I mean, between Sway and Hyprland I don’t think there is much difference, the main reason I chose to use Hyprland was because I saw plenty of people ricing it on unixporn, especially with NixOS. So I used some of their setups as inspiration.

Hyprland also has a few nice compositor tweaks like transparency and animations. Which I think makes things more interesting. But any other Wayland tiling manager will do, such as Sway or River. I don’t have a super strong reason to use Hyprland.

Saying that, since plenty of people seem to be using it, it’s easy to find example setups and copy them or nick bits I like.

How do I use Hyprland?

So you may be wondering how does a window manager fits in to our development workflow. Specifically, a tiling window manager. Typically, I will have 5–6 workspaces in use:

• 1: Coding (main monitor)
  • Entirely dedicated to my code editor (Neovim in my terminal)
    • Usually has a few splits for different buffers
• 2: Firefox (secondary monitor)
  • Two Firefox windows
    • One playing random YouTube videos
    • The other with documentation or related to the work I am currently doing
• 3: Secondary project
  • Contains terminal with Neovim
  • Firefox window related to project
• 4: Monkeytype
  • Firefox for me to practice my typing when I get bored
• 5: Social Apps
  • Ferdi
  • Discord
• 6: Gaming
  • Steam
  • Lutris

I mainly use workspace 1 & 2, I also use tmux-browser which means I can manage my browser tabs per tmux session (more on this in a future post). Where the open Firefox window will often be one managed by tmux-browser.

Wayland

I have personally decided to try to use Wayland compilable window managers. I know people have issues with Wayland. But for the most part, Wayland just seems to work fine for me. I originally swapped to Wayland because I had two monitors and I wanted to set the refresh rate of each separately. Whereas XServer treats them as one display, so I had to set it 60Hz, but now I can have one monitor on 144Hz and another on 60Hz.

Note your mileage may vary, and you may well have issues with Wayland, especially if you are using an Nvidia GPU.

Setup

One of the things I like about NixOS is it makes it straightforward to add new packages and config.

flake input

First, update our flake inputs to add Hyprland.

hyprland.url = "github:hyprwm/Hyprland";

home-manager

So, having a look at my hyprland.nix file:

{ inputs
, config
, pkgs
, ...
}:
let
  laptop_lid_switch = pkgs.writeShellScriptBin "laptop_lid_switch" ''
    #!/usr/bin/env bash

    if grep open /proc/acpi/button/lid/LID0/state; then
        hyprctl keyword monitor "eDP-1, 2256x1504@60, 0x0, 1"
    else
        if [[ `hyprctl monitors | grep "Monitor" | wc -l` != 1 ]]; then
            hyprctl keyword monitor "eDP-1, disable"
        fi
    fi
  '';
in
{
  imports = [
    inputs.hyprland.homeManagerModules.default
    ./common
  ];

  home.packages = [
    inputs.hypr-contrib.packages.${pkgs.system}.grimblast
    inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland
  ];

  nix.settings = {
    substituters = [ "https://hyprland.cachix.org" ];
    trusted-public-keys = [ "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc=" ];
  };

  wayland.windowManager.hyprland = {
    enable = true;
    # TODO: move to https://github.com/spikespaz/hyprland-nix
    extraConfig = ''
      # ASCII Art from https://fsymbols.com/generators/carty/
      input {
      	kb_layout = gb
      	touchpad {
      		disable_while_typing=false
      	}
      }

      general {
      	gaps_in = 3
      	gaps_out = 5
      	border_size = 3
      	col.active_border=0xff${config.colorscheme.colors.base07}
      	col.inactive_border=0xff${config.colorscheme.colors.base02}
      }

      decoration {
      	rounding=5
      }

      misc {
       vrr = 2
       disable_hyprland_logo = 1;
      }

      $notifycmd = notify-send -h string:x-canonical-private-synchronous:hypr-cfg -u low

      # █▀ █░█ █▀█ █▀█ ▀█▀ █▀▀ █░█ ▀█▀ █▀
      # ▄█ █▀█ █▄█ █▀▄ ░█░ █▄▄ █▄█ ░█░ ▄█
      bind = SUPER, Return, exec, ${config.my.settings.default.terminal}
      bind = SUPER, b, exec, ${config.my.settings.default.browser}
      bind = SUPER, a, exec, rofi -show drun -modi drun
      bind = ALT, Tab, exec, rofi -show window
      bind = SUPER, w, exec, makoctl dismiss
      # ...

    '';
  };
}

I cut out some config so it’s easier to follow the file above. By going over it section by section:

  laptop_lid_switch = pkgs.writeShellScriptBin "laptop_lid_switch" ''
    #!/usr/bin/env bash

    if grep open /proc/acpi/button/lid/LID0/state; then
        hyprctl keyword monitor "eDP-1, 2256x1504@60, 0x0, 1"
    else
        if [[ `hyprctl monitors | grep "Monitor" | wc -l` != 1 ]]; then
            hyprctl keyword monitor "eDP-1, disable"
        fi
    fi
  '';

This first bit, a simple bash script which is used to switch off the display on a laptop when the lid is closed. We will see how it is used later, we give it the name laptop_lid_switch.

  imports = [
    inputs.hyprland.homeManagerModules.default
    ./common
  ];

  home.packages = [
    inputs.hyprland.packages.${pkgs.system}.xdg-desktop-portal-hyprland
  ];

  nix.settings = {
    substituters = [ "https://hyprland.cachix.org" ];
    trusted-public-keys = [ "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc=" ];
  };

The next bit, we import our packages inputs.hyprland.homeManagerModules.default, using the input we defined before. Which handles things like creating a config file for us. I also have some common settings I like to share between my window managers, like GTK settings.

Next, we install xdg-desktop-portal-hyprland, which lets other apps communicate with the compositor through d-bus. Think for use cases like screen sharing.

An XDG Desktop Portal (later called XDP) is a program that lets other applications communicate swiftly with the compositor through D-Bus.

Then finally we set some nix settings, to point to a new binary cache to pull Hyprland dependencies from as they aren’t built on the normal nix cache. This saves us time building the Hyprland deps locally.

The next bit, we specify our Hyprland options in Nix:

{
  wayland.windowManager.hyprland = {
    enable = true;
    extraConfig = ''
      # ASCII Art from https://fsymbols.com/generators/carty/
      input {
      	kb_layout = gb
      	touchpad {
      		disable_while_typing=false
      	}
      }
    '';
  };
}

For now, using the options available in home-manager, I enable Hyprland. Then basically the rest of the config is in extraConfig, we just pass it a string, and it writes it to the ~/.config/hypr/hyprland.conf. More options here: https://mipmip.github.io/home-manager-option-search/?query=hyprland

At some point Hyprland may be configured differently using, https://github.com/spikespaz/hyprland-nix

config

Going over the most interesting bits of my Hyprland config:

bind = SUPER, Return, exec, ${config.my.settings.default.terminal}
bind = SUPER, b, exec, ${config.my.settings.default.browser}
bind = SUPER, a, exec, rofi -show drun -modi drun
bind = ALT, Tab, exec, rofi -show window

Here we set some key bindings such as how to open my terminal and Rofi my app launcher. Probably my two most key bindings, especially Rofi, how I open new apps in Hyprland.

windowrulev2 = fullscreen, title:^(Guild Wars 2)$
windowrulev2 = idleinhibit focus, class:^(mpv)$
windowrulev2 = idleinhibit fullscreen, class:^(firefox)$

Next, we define some exceptions to our rules, such as Guild Wars 2 (video game) starting in full-screen mode by default. Then, if Firefox is in full screen, i.e. when watching a video, stop idling from occurring.

exec-once = swaync &
exec-once = kanshi &
exec-once = sway-audio-idle-inhibit -w &
exec-once = waybar &
exec-once = gammastep-indicator &
exec-once = swaybg -i ${config.my.settings.wallpaper} --mode fill &

Next we define a bunch of apps we want to be run on startup, such as swaync for notifications, swaybg for wallpaper and gammastep-indicator to tell us when our blue light filter is on.

bindl=,switch:Lid Switch, exec, ${laptop_lid_switch}

Here, we use it to run our laptop lid switch script every time our laptop lid status changes.

bind=,XF86MonBrightnessUp,exec, brightness --inc
bind=,XF86MonBrightnessDown,exec, brightness --dec
bind=,XF86AudioRaiseVolume,exec, volume --inc
bind=,XF86AudioLowerVolume,exec, volume --dec
bind=,XF86AudioMute,exec, volume --toggle
bind=,XF86AudioMicMute,exec, volume --toggle-mic
bind=,XF86AudioNext,exec,playerctl next
bind=,XF86AudioPrev,exec,playerctl previous
bind=,XF86AudioPlay,exec,playerctl play-pause
bind=,XF86AudioStop,exec,playerctl stop
bind=ALT,XF86AudioNext,exec,playerctld shift
bind=ALT,XF86AudioPrev,exec,playerctld unshift
bind=ALT,XF86AudioPlay,exec,systemctl --user restart playerctld

The rest of the config is just key bindings, this bit is around “special” keys on my keyboard either the volume control knob or laptop function keys to increase volume and brightness. Where brightness and volume are custom scripts I have defined myself. We will see them a bit later.

bind=SUPER,h,movefocus,l
bind=SUPER,l,movefocus,r
bind=SUPER,k,movefocus,u
bind=SUPER,j,movefocus,d

The next bit of my config is all around window management. Note all of these bits will use a combination of the vim keys to do various things, i.e. here pressing super+l changes the focus to the window to the right. To simplify I will just show the first key binding, but there will be 4 key bindings for each of the following.

• bind=SUPER,h,movefocus,l: Pressing SUPER+h will change focus to a window on the left of the current focused one.
• bind=SUPERSHIFT,h,swapwindow,l: Pressing SHIFT+SUPER+h will swap the current focused window with the one to the left of it
• bind=SUPERCONTROL,h,focusmonitor,l: Pressing CTRL+SUPER+h will swap the focus to the monitor on the left
• bind=SUPERALT,h,movecurrentworkspacetomonitor,l: Pressing ALT+SUPER+h will move the current workspace (all the windows) to the monitor on the left
• bind=SUPERALT,h,movecurrentworkspacetomonitor,l: Pressing ALT+SUPER+h will move the current workspace (all the windows) to the monitor on the left

 bind=SUPER,1,workspace,01

One of our most important commands, changes to that workspace when pressing SUPER+1. I have workspaces from 0 to 9. Again, assume, for the following commands, it goes from workspace 1 - 10.

bind=SUPERSHIFT,1,movetoworkspacesilent,01

This command moves the current focused window to a specific workspace, i.e. SUPER+SHIFT+1 moves the window to workspace 1.

bind = SUPER, Q, killactive,
bind = SUPER, F, fullscreen, 0
bind = SUPER, F, exec, $notifycmd 'Fullscreen Mode'
bind = SUPER, S, pseudo,
bind = SUPER, S, exec, $notifycmd 'Pseudo Mode'
bind = SUPER, Space, togglefloating,
bind = SUPER, Space, centerwindow,

These commands can be used to change our windows, I use SUPER + Q a lot to kill the focused window. The other can be used to turn an app full screen, or let it float or even move it centre. Which can be useful in specific circumstances.

bindm=SUPER, mouse:272, movewindow
bindm=SUPER, mouse:273, resizewindow

binde = SUPERALT, h, resizeactive, -20 0
binde = SUPERALT, l, resizeactive, 20 0
binde = SUPERALT, k, resizeactive, 0 -20
binde = SUPERALT, j, resizeactive, 0 20

Finally, we have a bunch of commands for resizing windows, either using the keyboard or our mouse (sometimes we all feel lazy).

NixOS

Setting up Hyprland using home-manager is not enough, we also need to set it in NixOS. The main thing being is we need to import inputs.hyprland.nixosModules.default. This sets up a bunch of stuff we will need, such as polkit etc.

greetd

Then finally, we need a way to launch Hyprland when we log in, I decided to use greetd to do that for us. Here, we tell it to run the Hyprland command for the user haseeb (I have set up auto-login).

{
  services.greetd = {
    enable = true;
    settings = rec {
      initial_session = {
        command = "Hyprland";
        user = "haseeb";
      };
      default_session = initial_session;
    };
  };
  environment.etc."greetd/environments".text = ''
    Hyprland
  '';
}