Description

As I'm just learning Nix, I'm using this mostly as reference to build my own system, building it one block at a time

old setups

Note: currently I'm building outgoing traffic rules via opensnitch and this is in progress, so currently you need to approve almost any connection manually, if your needs derive from mine, you might need to modify the opensnitch rules, to not always be prompted

Installation

See the Installation Guide

If you install it, read the install guide to the end and especially read the part about preservation!

Documentation (incl. Configuration)

See the Docs

Outgoing Traffic Rules

-> filtered via OpenSnitch, requests outside the configured ones need to be approved TODO: update the docs in that regard

Useful command

echo test | wl-copy pipes the output of the command before into the clipboard

Aliases

Alias	Info	Command	Limitations
rebuild	rebuilds the system	sudo nixos-rebuild switch --flake /etc/nixos/#nixos	flake must be in /etc/nixos
ga	git	git add	-
gc	git	git commit -m	-
gp	git	git push	-
gac	git	ga && gc	-
gjp	git	ga && gc '.' && gp	-
mkcd	create dir & go into it	fish function mkdir -p '$1' && cd '$1'	only for fish shell
zj	zellij shortcut	zellij	-

ZelliJ Layouts

• ocaml (requires a dev shell for this to make sense)

Whats used in the build

this list might not be complete

What	Solution
WM	Niri + Noctalia v5
Terminal	Alacritty
Shell	Fish
Editor	Helix, Zed
File Manager	Yazi
Browser	Brave Origin, Mullvad Browser
Mail	Aerc

Credits

This is heavily based on github.com/ryan4yin/nix-config

Useful Resources:

• Ryan4Yin's NixOS Config as Reference
• NixPkg Search
• Official NixOS Wiki

---

TODO's

Planned

• Noctalia disable Plugin Update Checks, this should be handled via Nix ig
• Tighten / Add more OpenSnitch rules
• Enable the catpuccin cache
• App Sandboxing (especially for Browsers)
  • Bubble Wrap manually? guess there is also stuff like nixpak etc that is supposed to make this easier
  • Firejail? (although its big & suid -> might even pose a new attack surface)
  • Flatpaks? with stronger defaults?
• KeepassXC Extension in Brave + KeepassXC Communication
• VPN (maybe via Wireguard?, not a self hosted one, as privacy is the goal here, not http traffic that i want to tunnel or such things)

Currently not possible / High Effort-Low Value

• Brave minimize whats persisted - currently not working as wanted, since the way chromium (brave) handles edits in files (by replacing them)
• Some form of Mandatory Access Control