...

5 files changed, 15 insertions, 78 deletions

diff --git a/os/core/audio.nix b/os/core/audio.nix
index 5b9607c..e677a90 100644
--- a/os/core/audio.nix
+++ b/os/core/audio.nix
@@ -25,20 +25,6 @@ in
           alsa.support32Bit = true;
           jack.enable = true;
           wireplumber.enable = true;
-
-          # wireplumber.extraConfig."10-force-input-awake" = {
-          #   "monitor.alsa.rules" = [
-          #     {
-          #       matches = [
-          #         { "node.name" = "~alsa_input.*HyperX.*"; }
-          #         { "node.name" = "~alsa_output.*HyperX.*"; }
-          #       ];
-          #       actions.update-props = {
-          #         "session.suspend-on-idle" = false;
-          #       };
-          #     }
-          #   ];
-          # };
         };
         playerctld.enable = true;
         spotifyd.enable = true;
@@ -50,14 +36,9 @@ in
       hardware.enableAllFirmware = true;
 
       environment.systemPackages = with pkgs; [
-        helvum
+        crosspipe
         alsa-utils
       ];
-
-      # boot.kernelParams = [ "usbcore.autosuspend=-1" ];
-      # boot.extraModprobeConfig = ''
-      #   options snd-usb-audio power_save=0
-      # '';
     })
 
     (lib.mkIf cfg.disable-devices.enable {
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index aae167e..6eca320 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -48,13 +48,6 @@ in
         default = 0;
         description = "Index of the default boot entry";
       };
-      signing = {
-        enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
-        keyId = lib.mkOption {
-          type = lib.types.str;
-          description = "The GPG Key ID used to sign the boot files";
-        };
-      };
     };
 
     luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -104,36 +97,7 @@ in
         default = cfg.grub.defaultEntry;
         enableCryptodisk = cfg.luks.enable;
         copyKernels = true;
-
-        extraConfig = lib.mkIf cfg.grub.signing.enable ''
-          set check_signatures=enforce
-          terminal_input console
-          terminal_output console
-        '';
-
-        extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
-          echo "Signing with keys from ${gpgHome}"
-
-          SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
-
-          $SIGN_CMD /boot/grub/grub.cfg
-
-          for f in /boot/nixos/*; do
-            if [[ "$f" != *.sig ]]; then
-              $SIGN_CMD "$f"
-            fi
-          done
-        '';
       };
-      environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
     })
-    {
-      assertions = [
-        {
-          assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
-          message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
-        }
-      ];
-    }
   ];
 }
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 4835cb8..d3021e4 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -6,18 +6,22 @@ in
   options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
   config = lib.mkIf cfg.enable {
     networking = {
-      useDHCP = lib.mkDefault true;
       networkmanager = {
         enable = true;
-        wifi.macAddress = "stable-ssid";
-        ethernet.macAddress = "stable-ssid";
+        wifi = {
+          macAddress = "random";
+          backend = "iwd";
+        };
+        ethernet.macAddress = "random";
+        dns = "systemd-resolved";
       };
       firewall = {
-        enable = true;
+        enable = false;
         allowedTCPPorts = [ ];
         allowedUDPPorts = [ ];
       };
     };
+    services.resolved.enable = true;
     systemd.services."NetworkManager-wait-online".enable = false;
   };
 }
diff --git a/os/core/security.nix b/os/core/security.nix
index bc2c41c..f1c41c2 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -21,21 +21,15 @@ in
       rtkit.enable = true;
     };
 
-    # systemd.user.services.polkit-gnome-authentication-agent-1 = {
-    #   description = "gnome-polkit-authentication-agent-1";
-    #   wantedBy = [ "graphical-session.target" ];
-    #   serviceConfig = {
-    #     Type = "simple";
-    #     ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
-    #     Restart = "on-failure";
-    #     RestartSec = 1;
-    #     TimeoutStopSec = 10;
-    #   };
-    # };
-
     environment.systemPackages = with pkgs; [
       veracrypt
+
       bitwarden-desktop
+      keyguard
+
+      keepassxc
+      keepassxc-go
+      git-credential-keepassxc
     ];
   };
 }
diff --git a/os/core/ssh.nix b/os/core/ssh.nix
index d41c116..a0cb1f4 100644
--- a/os/core/ssh.nix
+++ b/os/core/ssh.nix
@@ -12,12 +12,6 @@ in
   options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.rclone ];
-    services.tailscale = {
-      enable = true;
-      openFirewall = true;
-    };
-
     services.openssh = {
       enable = true;
       settings = {