up

modules/base/default.nix

@@ -0,0 +1,54 @@
+{
+  agenix,
+  pkgs,
+  user,
+  ...
+}: {
+  imports = [
+    agenix.darwinModules.default
+  ];
+
+  nixpkgs = {
+    overlays = let
+      path = ../../overlays;
+    in
+      with builtins;
+        map (n: import (path + ("/" + n))) (
+          filter (n: match ".*\\.nix" n != null || pathExists (path + ("/" + n + "/default.nix"))) (
+            attrNames (readDir path)
+          )
+        );
+  };
+
+  nix = {
+    package = pkgs.nix;
+    settings = {
+      trusted-users = [
+        "@admin"
+        "${user}"
+      ];
+      substituters = [
+        "https://nix-community.cachix.org"
+        "https://cache.nixos.org"
+      ];
+      trusted-public-keys = ["cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="];
+    };
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 30d";
+    };
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  environment.systemPackages = with pkgs; [
+    agenix.packages."${pkgs.system}".default
+  ];
+
+  programs.fish.enable = true;
+
+  services.tailscale = {
+    enable = true;
+  };
+}

modules/base/home-manager/atuin.nix

@@ -0,0 +1,6 @@
+{
+  programs.atuin = {
+    enable = true;
+    enableFishIntegration = true;
+  };
+}

modules/base/home-manager/bat.nix

@@ -0,0 +1,20 @@
+{pkgs, ...}: {
+  programs.bat = {
+    enable = true;
+    config = {
+      theme = "Catppuccin Latte";
+      pager = "ov";
+    };
+    themes = {
+      "Catppuccin Latte" = {
+        src = pkgs.fetchFromGitHub {
+          owner = "catppuccin";
+          repo = "bat";
+          rev = "6810349b28055dce54076712fc05fc68da4b8ec0";
+          sha256 = "lJapSgRVENTrbmpVyn+UQabC9fpV1G1e+CdlJ090uvg=";
+        };
+        file = "Themes/Catppuccin Latte.tmTheme";
+      };
+    };
+  };
+}

modules/base/home-manager/default.nix

@@ -0,0 +1,28 @@
+{
+  imports = [
+    ./atuin.nix
+    ./bat.nix
+    ./eza.nix
+    ./fish.nix
+    ./git.nix
+    ./lazygit.nix
+    ./neovim
+    ./mise.nix
+    ./ssh.nix
+    ./starship.nix
+    ./zellij.nix
+    ./zoxide.nix
+    ./zsh.nix
+  ];
+
+  programs.home-manager.enable = true;
+  programs.direnv = {
+    enable = true;
+    nix-direnv.enable = true;
+  };
+
+  home.shellAliases = {
+    v = "nvim";
+    lg = "lazygit";
+  };
+}

modules/base/home-manager/eza.nix

@@ -0,0 +1,6 @@
+{
+  programs.eza = {
+    enable = true;
+    enableFishIntegration = true;
+  };
+}

modules/base/home-manager/fish.nix

@@ -0,0 +1,9 @@
+{
+  programs.fish = {
+    enable = true;
+    interactiveShellInit = ''
+      set fish_greeting # Disable greeting
+      set -gx LS_COLORS "$(vivid generate catppuccin-latte)"
+    '';
+  };
+}

modules/base/home-manager/git.nix

@@ -0,0 +1,22 @@
+{...}: let
+  name = "Christoph Schmatzler";
+in {
+  programs.git = {
+    enable = true;
+    ignores = ["*.swp"];
+    userName = name;
+    lfs = {
+      enable = true;
+    };
+    extraConfig = {
+      init.defaultBranch = "main";
+      core = {
+        editor = "vim";
+        autocrlf = "input";
+      };
+      # commit.gpgsign = true;
+      pull.rebase = true;
+      rebase.autoStash = true;
+    };
+  };
+}

modules/base/home-manager/lazygit.nix

@@ -0,0 +1,43 @@
+{
+  programs.lazygit = {
+    enable = true;
+    settings = {
+      gui = {
+        theme = {
+          activeBorderColor = [
+            "#8839ef"
+            "bold"
+          ];
+          inactiveBorderColor = [
+            "#6c6f85"
+          ];
+          optionsTextColor = [
+            "#1e66f5"
+          ];
+          selectedLineBgColor = [
+            "#ccd0da"
+          ];
+          cherryPickedCommitBgColor = [
+            "#bcc0cc"
+          ];
+          cherryPickedCommitFgColor = [
+            "#8839ef"
+          ];
+          unstagedChangesColor = [
+            "#d20f39"
+          ];
+          defaultFgColor = [
+            "#4c4f69"
+          ];
+          searchingActiveBorderColor = [
+            "#df8e1d"
+          ];
+        };
+
+        authorColors = {
+          "*" = "#7287fd";
+        };
+      };
+    };
+  };
+}

modules/base/home-manager/mise.nix

@@ -0,0 +1,10 @@
+{
+  programs.mise = {
+    enable = true;
+    enableFishIntegration = true;
+    enableZshIntegration = true;
+    settings = {
+      auto_install = false;
+    };
+  };
+}

modules/base/home-manager/neovim/autocmd.nix

@@ -0,0 +1,47 @@
+{
+  programs.nixvim = {
+    autoGroups = {
+      Christoph = {};
+    };
+
+    autoCmd = [
+      {
+        event = "BufWritePre";
+        group = "Christoph";
+        pattern = "*";
+        command = "%s/\\s\\+$//e";
+      }
+      {
+        event = "BufReadPost";
+        group = "Christoph";
+        pattern = "*";
+        command = "normal zR";
+      }
+      {
+        event = "FileReadPost";
+        group = "Christoph";
+        pattern = "*";
+        command = "normal zR";
+      }
+      {
+        event = "LspAttach";
+        group = "Christoph";
+        callback.__raw = ''
+          function(e)
+            local opts = { buffer = e.buf }
+            vim.keymap.set("n", "gd", function() vim.lsp.buf.definition() end, opts)
+            vim.keymap.set("n", "K", function() vim.lsp.buf.hover() end, opts)
+            vim.keymap.set("n", "<leader>vws", function() vim.lsp.buf.workspace_symbol() end, opts)
+            vim.keymap.set("n", "<leader>vd", function() vim.diagnostic.open_float() end, opts)
+            vim.keymap.set("n", "<leader>vca", function() vim.lsp.buf.code_action() end, opts)
+            vim.keymap.set("n", "<leader>vrr", function() vim.lsp.buf.references() end, opts)
+            vim.keymap.set("n", "<leader>vrn", function() vim.lsp.buf.rename() end, opts)
+            vim.keymap.set("i", "<C-h>", function() vim.lsp.buf.signature_help() end, opts)
+            vim.keymap.set("n", "[d", function() vim.diagnostic.goto_next() end, opts)
+            vim.keymap.set("n", "]d", function() vim.diagnostic.goto_prev() end, opts)
+          end
+        '';
+      }
+    ];
+  };
+}

modules/base/home-manager/neovim/default.nix

@@ -0,0 +1,26 @@
+{
+  imports = [
+    ./autocmd.nix
+    ./mappings.nix
+    ./options.nix
+    ./plugins/conform.nix
+    ./plugins/grug-far.nix
+    ./plugins/lazygit.nix
+    ./plugins/lsp.nix
+    ./plugins/mini.nix
+    ./plugins/treesitter.nix
+  ];
+
+  programs.nixvim = {
+    enable = true;
+    defaultEditor = true;
+    luaLoader.enable = true;
+
+    colorschemes.catppuccin = {
+      enable = true;
+      settings = {
+        flavour = "latte";
+      };
+    };
+  };
+}

modules/base/home-manager/neovim/mappings.nix

@@ -0,0 +1,165 @@
+{
+  programs.nixvim.keymaps = [
+    # e - explore/edit
+    {
+      mode = "n";
+      key = "<leader>ed";
+      action = ":lua require('mini.files').open()<CR>";
+      options.desc = "Directory";
+    }
+    {
+      mode = "n";
+      key = "<leader>ef";
+      action = ":lua require('mini.files').open(vim.api.nvim_buf_get_name(0))<CR>";
+      options.desc = "File directory";
+    }
+    {
+      mode = "n";
+      key = "<leader>er";
+      action = ":lua require('grug-far').open()<CR>";
+      options.desc = "Search and replace";
+    }
+    # f - find
+    {
+      mode = "n";
+      key = "<leader>f/";
+      action = ":Pick history scope='/'<CR>";
+      options.desc = "'/' history";
+    }
+    {
+      mode = "n";
+      key = "<leader>f:";
+      action = ":Pick history scope=':'<CR>";
+      options.desc = "':' history";
+    }
+    {
+      mode = "n";
+      key = "<leader>fa";
+      action = ":Pick git_hunks scope='staged'<CR>";
+      options.desc = "Added hunks (all)";
+    }
+    {
+      mode = "n";
+      key = "<leader>fA";
+      action = ":Pick git_hunks path='%' scope='staged'<CR>";
+      options.desc = "Added hunks (buffer)";
+    }
+    {
+      mode = "n";
+      key = "<leader>fb";
+      action = ":Pick buffers<CR>";
+      options.desc = "Buffers";
+    }
+    {
+      mode = "n";
+      key = "<leader>fd";
+      action = ":Pick diagnostic scope='all'<CR>";
+      options.desc = "Diagnostic (workspace)";
+    }
+    {
+      mode = "n";
+      key = "<leader>fD";
+      action = ":Pick diagnostic scope='current'<CR>";
+      options.desc = "Diagnostic (buffer)";
+    }
+    {
+      mode = "n";
+      key = "<leader>ff";
+      action = ":Pick files<CR>";
+      options.desc = "Search files";
+    }
+    {
+      mode = "n";
+      key = "<leader>fg";
+      action = ":Pick grep_live<CR>";
+      options.desc = "Grep";
+    }
+    {
+      mode = "n";
+      key = "<leader>fr";
+      action = ":Pick lsp scope='references'<CR>";
+      options.desc = "References (LSP)";
+    }
+    {
+      mode = "n";
+      key = "<leader>fs";
+      action = ":Pick lsp scope='workspace_symbol'<CR>";
+      options.desc = "Symbols (LSP, workspace)";
+    }
+    {
+      mode = "n";
+      key = "<leader>fS";
+      action = ":Pick lsp scope='document_symbol'<CR>";
+      options.desc = "Symbols (LSP, buffer)";
+    }
+    # g - git
+    {
+      mode = "n";
+      key = "<leader>gg";
+      action = ":LazyGit<CR>";
+      options.desc = "Lazygit";
+    }
+    # l - lsp/formatter
+    {
+      mode = "n";
+      key = "<leader>la";
+      action = ":lua vim.lsp.buf.code_action()<CR>";
+      options.desc = "Actions";
+    }
+    {
+      mode = "n";
+      key = "<leader>ld";
+      action = ":lua vim.diagnostic.open_float()<CR>";
+      options.desc = "Diagnostics popup";
+    }
+    {
+      mode = "n";
+      key = "<leader>lf";
+      action = ":lua require('conform').format({ lsp_fallback = true })<CR>";
+      options.desc = "Format";
+    }
+    {
+      mode = "n";
+      key = "<leader>li";
+      action = ":lua vim.lsp.buf.hover()<CR>";
+      options.desc = "Information";
+    }
+    {
+      mode = "n";
+      key = "<leader>lj";
+      action = ":lua vim.diagnostic.goto_next()<CR>";
+      options.desc = "Next diagnostic";
+    }
+    {
+      mode = "n";
+      key = "<leader>lk";
+      action = ":lua vim.diagnostic.goto_prev()<CR>";
+      options.desc = "Prev diagnostic";
+    }
+    {
+      mode = "n";
+      key = "<leader>lr";
+      action = ":lua vim.lsp.buf.rename()<CR>";
+      options.desc = "Rename";
+    }
+    {
+      mode = "n";
+      key = "<leader>lR";
+      action = ":lua vim.lsp.buf.references()<CR>";
+      options.desc = "References";
+    }
+    {
+      mode = "n";
+      key = "<leader>ls";
+      action = ":lua vim.lsp.buf.definition()<CR>";
+      options.desc = "Source definition";
+    }
+    # other
+    {
+      mode = "n";
+      key = "sj";
+      action = ":lua require('mini.jump2d').start(require('mini.jump2d').builtin_opts.query)<CR>";
+      options.desc = "Jump to character";
+    }
+  ];
+}

modules/base/home-manager/neovim/options.nix

@@ -0,0 +1,16 @@
+{
+  programs.nixvim = {
+    globals = {
+      # clipboard = "osc52";
+    };
+    opts = {
+      clipboard = "unnamedplus";
+      expandtab = true;
+      ignorecase = true;
+      mouse = "";
+      relativenumber = true;
+      shiftwidth = 2;
+      smartcase = true;
+    };
+  };
+}

modules/base/home-manager/neovim/plugins/conform.nix

@@ -0,0 +1,14 @@
+{
+  programs.nixvim.plugins.conform-nvim = {
+    enable = true;
+    settings = {
+      format_on_save = {};
+      formatters_by_ft = {
+        nix = ["alejandra"];
+        javascript = ["prettier"];
+        typescript = ["prettier"];
+        elixir = ["mix"];
+      };
+    };
+  };
+}

modules/base/home-manager/neovim/plugins/grug-far.nix

@@ -0,0 +1,7 @@
+{
+  programs.nixvim.plugins = {
+    grug-far = {
+      enable = true;
+    };
+  };
+}

modules/base/home-manager/neovim/plugins/lazygit.nix

@@ -0,0 +1,5 @@
+{
+  programs.nixvim.plugins.lazygit = {
+    enable = true;
+  };
+}

modules/base/home-manager/neovim/plugins/lsp.nix

@@ -0,0 +1,15 @@
+{
+  programs.nixvim.plugins = {
+    lsp = {
+      enable = true;
+      inlayHints = true;
+      servers = {
+        nil_ls.enable = true; # Nix
+        ts_ls.enable = true; # TS/JS
+        cssls.enable = true; # CSS
+        dockerls.enable = true; # Docker
+        elixirls.enable = true; # Elixir
+      };
+    };
+  };
+}

modules/base/home-manager/neovim/plugins/mini.nix

@@ -0,0 +1,158 @@
+{
+  programs.nixvim.plugins.mini = {
+    enable = true;
+    modules = {
+      ai = {
+        custom_textobjects = {
+          B.__raw = "require('mini.extra').gen_ai_spec.buffer()";
+          F.__raw = "require('mini.ai').gen_spec.treesitter({ a = '@function.outer', i = '@function.inner' })";
+        };
+      };
+      align = {};
+      basics = {
+        options = {
+          basic = true;
+          extra_ui = true;
+        };
+        mappings = {
+          basic = false;
+        };
+        autocommands = {
+          basic = true;
+        };
+      };
+      bracketed = {};
+      clue = {
+        clues.__raw = ''
+          {
+            { mode = 'n', keys = '<Leader>e', desc = '+Explore/+Edit' },
+            { mode = 'n', keys = '<Leader>f', desc = '+Find' },
+            { mode = 'n', keys = '<Leader>g', desc = '+Git' },
+            { mode = 'n', keys = '<Leader>l', desc = '+LSP' },
+            { mode = 'x', keys = '<Leader>l', desc = '+LSP' },
+            require("mini.clue").gen_clues.builtin_completion(),
+            require("mini.clue").gen_clues.g(),
+            require("mini.clue").gen_clues.marks(),
+            require("mini.clue").gen_clues.registers(),
+            require("mini.clue").gen_clues.windows({ submode_resize = true }),
+            require("mini.clue").gen_clues.z(),
+          }
+        '';
+        triggers = [
+          {
+            mode = "n";
+            keys = "<Leader>";
+          }
+          {
+            mode = "x";
+            keys = "<Leader>";
+          }
+          {
+            mode = "n";
+            keys = "[";
+          }
+          {
+            mode = "n";
+            keys = "]";
+          }
+          {
+            mode = "x";
+            keys = "[";
+          }
+          {
+            mode = "x";
+            keys = "]";
+          }
+          {
+            mode = "i";
+            keys = "<C-x>";
+          }
+          {
+            mode = "n";
+            keys = "g";
+          }
+          {
+            mode = "x";
+            keys = "g";
+          }
+
+          {
+            mode = "n";
+            keys = "\"";
+          }
+          {
+            mode = "x";
+            keys = "\"";
+          }
+          {
+            mode = "i";
+            keys = "<C-r>";
+          }
+          {
+            mode = "c";
+            keys = "<C-r>";
+          }
+          {
+            mode = "n";
+            keys = "<C-w>";
+          }
+          {
+            mode = "n";
+            keys = "z";
+          }
+          {
+            mode = "x";
+            keys = "z";
+          }
+          {
+            mode = "n";
+            keys = "'";
+          }
+          {
+            mode = "n";
+            keys = "`";
+          }
+          {
+            mode = "x";
+            keys = "'";
+          }
+          {
+            mode = "x";
+            keys = "`";
+          }
+        ];
+      };
+      comment = {};
+      completion = {
+        lsp_completion = {
+          source_func = "omnifunc";
+        };
+      };
+      diff = {};
+      extra = {};
+      files = {};
+      git = {};
+      icons = {};
+      indentscope = {};
+      jump = {};
+      jump2d = {
+        settings = {
+          spotter.__raw = "require('mini.jump2d').gen_spotter.pattern('[^%s%p]+')";
+          labels = "asdfghjkl";
+          view = {
+            dim = true;
+            n_steps_ahead = 2;
+          };
+        };
+      };
+      move = {};
+      pairs = {};
+      pick = {};
+      starter = {};
+      statusline = {};
+      surround = {};
+      trailspace = {};
+      visits = {};
+    };
+  };
+}

modules/base/home-manager/neovim/plugins/treesitter.nix

@@ -0,0 +1,19 @@
+{pkgs, ...}: {
+  programs.nixvim.plugins.treesitter = {
+    enable = true;
+    settings = {
+      highlight.enable = true;
+      indent.enable = true;
+    };
+    grammarPackages = with pkgs.vimPlugins.nvim-treesitter.builtGrammars; [
+      bash
+      fish
+      elixir
+      heex
+      json
+      nix
+      toml
+      yaml
+    ];
+  };
+}

modules/base/home-manager/ssh.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  lib,
+  user,
+  ...
+}: {
+  programs.ssh = {
+    enable = true;
+    includes = [
+      (lib.mkIf pkgs.stdenv.hostPlatform.isLinux "/home/${user}/.ssh/config_external")
+      (lib.mkIf pkgs.stdenv.hostPlatform.isDarwin "/Users/${user}/.ssh/config_external")
+    ];
+    matchBlocks = {
+      "github.com" = {
+        identitiesOnly = true;
+        identityFile = [
+          (lib.mkIf pkgs.stdenv.hostPlatform.isLinux "/home/${user}/.ssh/id_ed25519")
+          (lib.mkIf pkgs.stdenv.hostPlatform.isDarwin "/Users/${user}/.ssh/id_ed25519")
+        ];
+      };
+    };
+  };
+}

modules/base/home-manager/starship.nix

@@ -0,0 +1,34 @@
+{lib, ...}: {
+  programs.starship = {
+    enable = true;
+    enableFishIntegration = true;
+    settings = {
+      add_newline = true;
+      command_timeout = 750;
+
+      format = lib.concatStrings [
+        "$directory"
+        "$git_branch"
+        "$git_status"
+        "$git_metrics"
+        "$line_break"
+        "$character"
+      ];
+
+      character = {
+        success_symbol = "[❯](bold green)";
+        error_symbol = "[❯](bold red)";
+      };
+
+      git_branch = {
+        format = " [ $branch]($style) ";
+      };
+
+      git_metrics = {
+        disabled = false;
+        added_style = "bold green";
+        format = "[+$added]($added_style)/[-$deleted]($deleted_style) ";
+      };
+    };
+  };
+}

modules/base/home-manager/zellij.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  programs.zellij = {
+    enable = true;
+    enableFishIntegration = lib.mkDefault false;
+    settings = {
+      theme = "catppuccin-latte";
+      default_layout = "compact";
+      default_shell = "${pkgs.fish}/bin/fish";
+      no_pane_frames = true;
+      show_startup_tips = false;
+      show_release_notes = false;
+    };
+  };
+}

modules/base/home-manager/zoxide.nix

@@ -0,0 +1,6 @@
+{
+  programs.zoxide = {
+    enable = true;
+    enableFishIntegration = true;
+  };
+}

modules/base/home-manager/zsh.nix

@@ -0,0 +1,5 @@
+{
+  programs.zsh = {
+    enable = true;
+  };
+}

modules/base/packages.nix

@@ -0,0 +1,35 @@
+{pkgs}:
+with pkgs; [
+  age
+  age-plugin-yubikey
+  alejandra
+  claude-code
+  delta
+  docker
+  docker-compose
+  fastfetch
+  gh
+  git
+  gnupg
+  htop
+  iosevka
+  jq
+  killall
+  libfido2
+  nodejs_24
+  nurl
+  opencode
+  openssh
+  postgresql_17
+  prettier
+  python312
+  ripgrep
+  sqlite
+  tree
+  tree-sitter
+  unrar
+  unzip
+  vivid
+  wget
+  zip
+]

modules/darwin/default.nix

@@ -0,0 +1,72 @@
+{
+  config,
+  pkgs,
+  nixvim,
+  user,
+  ...
+}: {
+  imports = [
+    ./secrets.nix
+    ./system.nix
+    ./homebrew.nix
+    ./dock
+  ];
+
+  system = {
+    primaryUser = user;
+    stateVersion = 6;
+  };
+
+  nix.gc.interval = {
+    Weekday = 0;
+    Hour = 2;
+    Minute = 0;
+  };
+
+  users.users.${user} = {
+    name = "${user}";
+    home = "/Users/${user}";
+    isHidden = false;
+    shell = pkgs.fish;
+  };
+
+  home-manager = {
+    users.${user} = {
+      pkgs,
+      config,
+      lib,
+      ...
+    }: {
+      _module.args = {inherit user;};
+      imports = [
+        nixvim.homeModules.nixvim
+        ../base/home-manager
+        ./home-manager/ghostty.nix
+      ];
+      fonts.fontconfig.enable = true;
+      home = {
+        packages = pkgs.callPackage ../base/packages.nix {} ++ pkgs.callPackage ./packages.nix {};
+        stateVersion = "25.11";
+      };
+    };
+  };
+
+  local = {
+    dock = {
+      enable = true;
+      username = user;
+      entries = [
+        {path = "/Applications/Safari.app/";}
+        {path = "/${pkgs.ghostty-bin}/Applications/Ghostty.app/";}
+        {path = "/System/Applications/Notes.app/";}
+        {path = "/System/Applications/Music.app/";}
+        {path = "/System/Applications/System Settings.app/";}
+        {
+          path = "${config.users.users.${user}.home}/Downloads";
+          section = "others";
+          options = "--sort name --view grid --display stack";
+        }
+      ];
+    };
+  };
+}

modules/darwin/dock/default.nix

@@ -0,0 +1,104 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.local.dock;
+  inherit (pkgs) stdenv dockutil;
+in {
+  options = {
+    local.dock = {
+      enable = mkOption {
+        description = "Enable dock";
+        default = stdenv.isDarwin;
+        example = false;
+      };
+
+      entries = mkOption {
+        description = "Entries on the Dock";
+        type = with types;
+          listOf (submodule {
+            options = {
+              path = lib.mkOption {type = str;};
+              section = lib.mkOption {
+                type = str;
+                default = "apps";
+              };
+              options = lib.mkOption {
+                type = str;
+                default = "";
+              };
+            };
+          });
+        readOnly = true;
+      };
+
+      username = mkOption {
+        description = "Username to apply the dock settings to";
+        type = types.str;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable (
+    let
+      normalize = path:
+        if hasSuffix ".app" path
+        then path + "/"
+        else path;
+      entryURI = path:
+        "file://"
+        + (
+          builtins.replaceStrings
+          [
+            " "
+            "!"
+            "\""
+            "#"
+            "$"
+            "%"
+            "&"
+            "'"
+            "("
+            ")"
+          ]
+          [
+            "%20"
+            "%21"
+            "%22"
+            "%23"
+            "%24"
+            "%25"
+            "%26"
+            "%27"
+            "%28"
+            "%29"
+          ]
+          (normalize path)
+        );
+      wantURIs = concatMapStrings (entry: "${entryURI entry.path}\n") cfg.entries;
+      createEntries =
+        concatMapStrings (
+          entry: "${dockutil}/bin/dockutil --no-restart --add '${entry.path}' --section ${entry.section} ${entry.options}\n"
+        )
+        cfg.entries;
+    in {
+      system.activationScripts.postActivation.text = ''
+          echo >&2 "Setting up the Dock for ${cfg.username}..."
+          su ${cfg.username} -s /bin/sh <<'USERBLOCK'
+        haveURIs="$(${dockutil}/bin/dockutil --list | ${pkgs.coreutils}/bin/cut -f2)"
+        if ! diff -wu <(echo -n "$haveURIs") <(echo -n '${wantURIs}') >&2 ; then
+          echo >&2 "Resetting Dock."
+          ${dockutil}/bin/dockutil --no-restart --remove all
+          ${createEntries}
+          killall Dock
+        else
+          echo >&2 "Dock setup complete."
+        fi
+        USERBLOCK
+      '';
+    }
+  );
+}

modules/darwin/home-manager/ghostty.nix

@@ -0,0 +1,26 @@
+{pkgs, ...}: {
+  programs.ghostty = {
+    enable = true;
+    package = pkgs.ghostty-bin;
+    settings = {
+      command = "${pkgs.fish}/bin/fish";
+      theme = "catppuccin-latte";
+      window-padding-x = 8;
+      window-padding-y = 2;
+      window-padding-balance = true;
+      font-family = "Iosevka";
+      font-size = 15.5;
+      font-feature = [
+        "-calt"
+        "-dlig"
+      ];
+      cursor-style = "block";
+      mouse-hide-while-typing = true;
+      mouse-scroll-multiplier = 1.25;
+      shell-integration = "detect";
+      shell-integration-features = "no-cursor";
+      clipboard-read = "allow";
+      clipboard-write = "allow";
+    };
+  };
+}

modules/darwin/homebrew.nix

@@ -0,0 +1,11 @@
+{
+  homebrew = {
+    enable = true;
+    casks = [
+      "orbstack"
+    ];
+    masApps = {
+      "wipr2" = 1662217862;
+    };
+  };
+}

modules/darwin/packages.nix

@@ -0,0 +1,8 @@
+{pkgs}:
+with pkgs; [
+  _1password-gui
+  dockutil
+  mas
+  raycast
+  whatsapp-for-mac
+]

modules/darwin/secrets.nix

@@ -0,0 +1,12 @@
+{
+  config,
+  pkgs,
+  agenix,
+  secrets,
+  user,
+  ...
+}: {
+  age.identityPaths = [
+    "/Users/${user}/.ssh/id_ed25519"
+  ];
+}

modules/darwin/system.nix

@@ -0,0 +1,30 @@
+{lib, ...}: {
+  system.defaults = {
+    NSGlobalDomain = {
+      AppleShowAllExtensions = true;
+      ApplePressAndHoldEnabled = false;
+      KeyRepeat = 2;
+      InitialKeyRepeat = 15;
+      "com.apple.mouse.tapBehavior" = 1;
+      "com.apple.sound.beep.volume" = 0.0;
+      "com.apple.sound.beep.feedback" = 0;
+    };
+
+    dock = {
+      autohide = true;
+      show-recents = false;
+      launchanim = true;
+      orientation = "bottom";
+      tilesize = 60;
+    };
+
+    finder = {
+      _FXShowPosixPathInTitle = false;
+    };
+
+    trackpad = {
+      Clicking = true;
+      TrackpadThreeFingerDrag = true;
+    };
+  };
+}

modules/nixos/default.nix

@@ -0,0 +1,114 @@
+{
+  pkgs,
+  nixvim,
+  config,
+  user,
+  agenix,
+  ...
+}: let
+  sshKeys = import ../../shared/ssh-keys.nix;
+in {
+  imports = [
+    agenix.nixosModules.default
+  ];
+
+  system.stateVersion = "25.11";
+  time.timeZone = "UTC";
+
+  nix = {
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+    nixPath = ["nixos-config=/home/${user}/.local/share/src/nixos-config:/etc/nixos"];
+  };
+
+  networking.firewall = {
+    enable = true;
+    trustedInterfaces = ["eno1" "tailscale0"];
+  };
+
+  services = {
+    openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "yes";
+        PasswordAuthentication = false;
+      };
+    };
+    tailscale = {
+      enable = true;
+      port = 41641;
+      useRoutingFeatures = "server";
+      openFirewall = true;
+    };
+    adguardhome = {
+      enable = true;
+      port = 10000;
+      settings = {
+        dns = {
+          upstream_dns = [
+            "1.1.1.1"
+            "1.0.0.1"
+          ];
+        };
+        filtering = {
+          protection_enabled = true;
+          filtering_enabled = true;
+          safe_search = {
+            enabled = false;
+          };
+        };
+      };
+    };
+  };
+
+  users.users = {
+    ${user} = {
+      isNormalUser = true;
+      home = "/home/${user}";
+      extraGroups = [
+        "wheel"
+        "sudo"
+        "network"
+        "systemd-journal"
+        "docker"
+      ];
+      shell = pkgs.fish;
+      openssh.authorizedKeys.keys = sshKeys.keys;
+    };
+
+    root = {
+      openssh.authorizedKeys.keys = sshKeys.keys;
+    };
+  };
+
+  security.sudo = {
+    enable = true;
+  };
+
+  environment.systemPackages = [
+    agenix.packages."${pkgs.system}".default
+  ];
+
+  home-manager = {
+    users.${user} = {
+      pkgs,
+      config,
+      lib,
+      ...
+    }: {
+      _module.args = {inherit user;};
+      imports = [
+        nixvim.homeModules.nixvim
+        ../base/home-manager
+        ./home-manager/zellij.nix
+      ];
+      home = {
+        packages = pkgs.callPackage ../base/packages.nix {} ++ pkgs.callPackage ./packages.nix {};
+        stateVersion = "25.11";
+      };
+    };
+  };
+}

modules/nixos/home-manager/zellij.nix

@@ -0,0 +1,5 @@
+{
+  programs.zellij = {
+    enableFishIntegration = true;
+  };
+}

modules/nixos/packages.nix

@@ -0,0 +1,4 @@
+{pkgs}:
+with pkgs; [
+  gcc15
+]