refactored nixos directory & updated README

README.md

@@ -20,23 +20,26 @@
 - [Features](#-features)
 - [Installation](#-installation)
 - [Keybindings](#️-keybindings)
+- [Useful aliases in Fish Shell](#-useful-aliases-in-fish-shell)
 - [Useful info for Rustaceans](#-useful-info-for-rustaceans)
 - [License](#-license)
 
 ## 📖 About
 
-This repository houses my NixOS Linux configuration, featuring the Hyprland window manager and adorned with the stylish Catppuccin Macchiato theme. I rely on this setup as my daily driver for work and programming, primarily in Rust 🦀. Feel free to utilize it in its entirety or borrow specific components for your own configuration.
+This repository houses my NixOS Linux ❄️ flake configuration, featuring the Hyprland window manager and adorned with the stylish Catppuccin Macchiato theme. I rely on this setup as my daily driver for work and programming, primarily in Rust 🦀. Feel free to utilize it in its entirety or borrow specific components for your own configuration.
 
 🚨It's essential to note that this configuration is not minimalistic or lightweight and may require some disk space and knowledge to understand. If you're looking for something simpler, this configuration may not be suitable for you.
 
 This system leverages cutting-edge channels and versions of software to provide you with the latest updates and features. Notably, it utilizes:
 
+- **flake** (An experimental feature of the Nix package manager)
+- **nur** (The Nix User Repository)
 - **nixpkgs**: unstable
 - **rust**: nightly version
 
 This approach ensures that you stay on the forefront of technology, receiving the most recent software advancements promptly. 🚨However, it's important to note that this emphasis on bleeding-edge software may impact the stability of the system.
 
-🚨Please note that the system utilizes **Podman** instead of **Docker** for containerization due to various reasons, primarily related to security (rootless and daemonless containers), easier migration to Kubernetes, availability of pods, compatibility with systemd, and better security for `distrobox`. If you prefer to use **Docker** instead of **Podman**, you can make the switch by commenting out the **Podman** section in the `configuration.nix` file and uncommenting the **Docker** section. More details on **Docker** configuration in NixOS can be found [here](https://nixos.wiki/wiki/Docker).
+🚨Please note that the system utilizes **Podman** instead of **Docker** for containerization due to various reasons, primarily related to security (rootless and daemonless containers), easier migration to Kubernetes, availability of pods, compatibility with systemd, and better security for `distrobox`. If you prefer to use **Docker** instead of **Podman**, you can make the switch by commenting out the **Podman** section in the `nixos/virtualisation.nix` file and uncommenting the **Docker** section. More details on **Docker** configuration in NixOS can be found [here](https://nixos.wiki/wiki/Docker).
 
 The system also enables SELinux patches, as well as AppArmor and Tomoyo Linux Security Modules. It includes security daemons such as Fail2Ban and USBGuard, with Firejail preinstalled to meet your security requirements.
 
@@ -89,7 +92,7 @@ The showcased images do not reflect the latest version of the system's appearanc
 | Display Manager       | Greetd + Tuigreet           |
 | Containerization      | Podman                      |
 
-And many other useful utilities. The full list can be found in the system configuration at `/nixos/configuration.nix` file.
+And many other useful utilities. The full list can be found in the system configuration files at `nixos` directory.
 
 ## ✨ Features
 
@@ -105,16 +108,38 @@ And many other useful utilities. The full list can be found in the system config
 
 1. Download and Install NixOS from the [official site](https://nixos.org/download).
 2. Temporarily install ripgrep and fish using the command: `nix-shell -p ripgrep fish --run fish`. You can also use classic bash and grep for the next step without installing fish and ripgrep.
-3. Run the command `rg --hidden FIXME` and change/add lines to match your device, swaps, partitions, and file systems in the configuration files (`/etc/nixos/configuration.nix` & `/etc/nixos/hardware-configuration.nix`). 
+3. Run the command `rg --hidden FIXME` and change/add lines to match your device, swaps, partitions, peripherals, file systems, etc. in the configuration files. 
 
-   🚨Ensure that you configure USBGuard in the `configuration.nix` file to avoid potential issues. By default, USBGuard blocks all USB devices, which can lead to the disabling of crucial hardware components such as the integrated camera, bluetooth, wifi, etc. To configure USBGuard properly, add your trusted USB devices to the configuration. You can obtain a list of all connected devices by using the `lsusb` command from the `usbutils` package.
+   🚨Ensure that you configure USBGuard in the `nixos/usb.nix` file to avoid potential issues. By default, USBGuard blocks all USB devices, which can lead to the disabling of crucial hardware components such as the integrated camera, bluetooth, wifi, etc. To configure USBGuard properly, add your trusted USB devices to the configuration. You can obtain a list of all connected devices by using the `lsusb` command from the `usbutils` package.
 
     Failure to configure USBGuard appropriately may result in the inability to connect any USB devices to your machine. If needed, you can also disable USBGuard altogether by setting `services.usbguard.enable` to `false` in the configuration:`services.usbguard.enable = false;`. This step ensures that USBGuard is not actively blocking any USB devices.
 
+   🚨Also important: If you use disk encryption with LUKS and want to use encrypted swap, you need to enable swap on LUKS. This is usually auto-generated in `/etc/nixos/configuration.nix` under commented sections titled `# Setup keyfile` and `# Enable swap on luks` if you set it up during the NixOS installation process. You can simply copy this snippet to either `nixos/swap.nix`, `nixos/hardware-configuration.nix`, or `nixos/configuration.nix` (Personally, I prefer to copy it to `hardware-configuration.nix`).
+
+   Alternatively, you can set it up manually or use [swap encryption with a random key](https://nixos.wiki/wiki/Swap#Encrypt_swap_with_random_key).
+
 4. To change the default username and/or hostname, run the command `rg --hidden 'xnm'` to find and fix all instances of the username, and `rg --hidden 'isitreal-laptop'` for the hostname. Make sure to change the username to match yours to avoid login issues. 🚨Also, don't forget to change the git settings to yours in `home/.gitconfig` file.
-5. Copy all files (with replacements) from the `home` directory to your `$HOME` directory in Linux.
+5. Enable `flake` support (more [here](https://nixos.wiki/wiki/Flakes#Enable_flakes_temporarily)) on your current system. Don't forget to run `sudo nixos-rebuild switch` after enabling `flake` in your `/etc/configuration.nix`.
-6. Copy all files (with replacements) from the `nixos` directory to `/etc/nixos/`. 🚨It's recommended NOT to copy and replace `hardware-configuration.nix`; use default generated one, or only copy my `hardware-configuration.nix` if you have already change it for your hardware.
+6. Copy all files (with replacements) from the `home` directory to your `$HOME` directory in Linux.
-7. Run the command `sudo nixos-rebuild switch`. After this, you will have a complete system. You can also use flakes after first setup by running `sudo nixos-rebuild switch --flake /etc/nixos` if needed.
+7. Copy all files (with replacements) EXCEPT `hardware-configuration.nix` from the `nixos` directory to `/etc/nixos/`. 🚨It's recommended NOT to copy and replace `hardware-configuration.nix`; use default generated one, or only copy my `hardware-configuration.nix` if you have already change it for your hardware. 🚨Ensure that `system.stateVersion = "your_version";` is correctly set to the release version of the initial installation of your system in the `configuration.nix` file.
+8. Run the command `sudo nixos-rebuild switch --flake /etc/nixos`. After this, you will have a complete system.
+9. For an even more consistent experience across your apps, you can import Catppuccin theme config files into certain programs through their graphical user interfaces. This includes:
+
+ - Websites in your browser (Brave, Firefox, Chromium):
+   - Install the Stylus Extension from its [official website](https://add0n.com/stylus.html).
+   - Open the extension's settings page and navigate to the Backup section.
+   - Click "Import" and select the file `home/.config/stylus-catppuccin.json`.
+ - DuckDuckGo in any browser:
+   - Follow the [official guide](https://github.com/catppuccin/duckduckgo) provided by Catppuccin.
+
+   **Note**: Qutebrowser users can follow the same DuckDuckGo guide for customization, as installation doesn't require the Stylus Extension, which is not yet compatible with Qutebrowser.
+
+ - Cool-Retro-Term:
+   - Launch Cool-Retro-Term.
+   - Right-click on the window and select "Settings".
+   - In the General panel, click "Import" and select the file `home/.config/cool-retro-term-style.json`.
+   - Select the imported profile named "new-catppuccin-theme".
+   - Click "Load" and exit from "Settings"
 
 ## ⌨️ Keybindings
 
@@ -172,6 +197,27 @@ And many other useful utilities. The full list can be found in the system config
 
 You can find all other keybindings in `/home/.config/hypr/hyprland.conf` in the bind section. All system fish scripts are located at `/home/.config/fish/functions` directory.
 
+## 🐟 Useful aliases in Fish Shell
+
+This system includes a fish shell configuration file (`/home/.config/fish/config.fish`) that provides various aliases to enhance your experience working with it.
+
+Common commands:
+- `cl`: clear the terminal screen (shorthand for `clear`)
+- `lgit`: launch the `lazygit` command-line Git client
+- `ldocker`: launch the `lazydocker` command-line Docker client
+- `conf`: navigate to the `~/.config` directory
+
+NixOS-specific commands:
+- `nswitch`: rebuild your system using the current flake
+- `nswitchu`: rebuild and update your system using the current flake
+- `nau`: add the unstable channel to the package manager
+- `nsgc`: optimize the nix store and remove unreferenced and obsolete store paths (equivalent to `sudo nix-store --gc`)
+- `ngc`: delete old generations of user profiles (equivalent to `sudo nix-collect-garbage -d`)
+- `nixos`: navigate to the `/etc/nixos` directory
+- `store`: navigate to the `/nix/store` directory
+
+You can customize this configuration by adding more aliases to the file and editing existing ones. This makes your experience more personalized and smoother.
+
 ## 🦀 Useful info for Rustaceans
 
 Here are some tips to enhance your Rust experience on this system:
@@ -179,17 +225,17 @@ Here are some tips to enhance your Rust experience on this system:
 1. **Installation Customization:**
    This system utilizes [rust-overlay](https://github.com/oxalica/rust-overlay) for Rust installation using the Nix approach. To customize the installation, including modifications to compilation targets, components, channels, or profiles, follow these steps:
 
-   - Locate the `/nixos/rust-toolchain.toml` file and make the necessary adjustments based on your requirements.
+   - Locate the `nixos/rust-toolchain.toml` file and make the necessary adjustments based on your requirements.
 
    - If you are working on multiple projects with distinct `rust-toolchain.toml` files or need to switch between stable and nightly Rust versions, consider the following options:
    
      - Set up a Nix environment using `flake.nix` and [rust-overlay](https://github.com/oxalica/rust-overlay) for each project separately. Utilize `nix develop` or `direnv` to manage project-specific Rust environments.
 
-     - Alternatively, you can install `rustup` through `configuration.nix` and nixpkgs for a system-wide Rust setup. This allows you to manage Rust versions globally through `rustup`.
+     - Alternatively, you can install `rustup` through `environment.systemPackages` and nixpkgs for a system-wide Rust setup. This allows you to manage Rust versions globally through `rustup`.
 
 2. **Troubleshooting Compilation Issues:**
    If you encounter issues during Rust compilation, particularly those related to OpenSSL, SQLite, Wayland, or any other program utilized by `pkg-config` in the compilation process (see [here](https://nixos.wiki/wiki/Rust#Building_Rust_crates_that_require_external_system_libraries)), you can employ the `nix-shell -p pkg-config {your_dependency} [other_dependencies] --run fish` command. This command opens a Nix shell with the necessary dependencies, facilitating seamless code compilation. Alternatively, you can employ the approach outlined in the initial section (Installation Customization) by utilizing `flake.nix` with dev shell instead of `nix-shell`.
-   Moreover, when using the Nix Dev shell, be aware that the compilation takes place in the runtime directory, which might be insufficient for certain projects. To address this, you can adjust the runtime directory size in the `configuration.nix` file under `services.logind.extraConfig="RuntimeDirectorySize=8G"`.
+   Moreover, when using the Nix Dev shell, be aware that the compilation takes place in the runtime directory, which might be insufficient for certain projects. To address this, you can adjust the runtime directory size in the `nixos/users.nix` file under `services.logind.extraConfig="RuntimeDirectorySize=8G"`.
 
 3. **Cross-Compilation:**
    For cross-compilation, consider using tools like `zigbuild` or `cross`. Personally, I find `zigbuild` preferable, but both are valuable options for your cross-compilation needs.

home/.config/fish/config.fish

@@ -10,9 +10,9 @@ alias nixos="z /etc/nixos"
 alias store="z /nix/store"
 alias nswitch="sudo nixos-rebuild switch --flake /etc/nixos"
 alias nswitchu="sudo nixos-rebuild switch --flake /etc/nixos --update-input nixpkgs --update-input rust-overlay --commit-lock-file --upgrade"
-alias ncsu="sudo nix-channel --add https://nixos.org/channels/nixos-unstable nixos"
+alias nau="sudo nix-channel --add https://nixos.org/channels/nixos-unstable nixos"
 alias nsgc="sudo nix-store --gc"
-alias ncg="sudo nix-collect-garbage -d"
+alias ngc="sudo nix-collect-garbage -d"
 
 # if [ -z "$DISPLAY" ] && [ "$XDG_VTNR" -eq 1 ]
 #   exec Hyprland

nixos/auto-upgrade.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  # Scheduled auto upgrade system (this is only for system upgrades, 
+  # if you want to upgrade cargo\npm\pip global packages, docker containers or different part of the system 
+  # or get really full system upgrade, use `topgrade` CLI utility manually instead.
+  # I recommend running `topgrade` once a week or at least once a month)
+  system.autoUpgrade = {
+    enable = true;
+    operation = "switch"; # If you don't want to apply updates immediately, only after rebooting, use `boot` option in this case
+    flake = "/etc/nixos";
+    flags = [ "--update-input" "nixpkgs" "--update-input" "rust-overlay" "--commit-lock-file" ];
+    dates = "daily";
+    # channel = "https://nixos.org/channels/nixos-unstable";
+  };
+}

nixos/bluetooth.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  # Enable Bluetooth
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = false;
+  services.blueman.enable = true;
+}

nixos/bootloader.nix

@@ -0,0 +1,17 @@
+{ pkgs,  ... }:
+
+{
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.loader.timeout = 2;
+  boot.initrd.enable = true;
+  boot.initrd.systemd.enable = true;
+  boot.plymouth = {
+    enable = true;
+    font = "${pkgs.jetbrains-mono}/share/fonts/truetype/JetBrainsMono-Regular.ttf";
+    themePackages = [ pkgs.catppuccin-plymouth ];
+    theme = "catppuccin-macchiato";
+  };
+}

nixos/configuration.nix

@@ -2,708 +2,9 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ inputs, pkgs, lib, ... }:
+{ ... }:
 
 {
-  imports =
-    [
-      ./hardware-configuration.nix
-    ];
-
-  # Bootloader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
-  boot.loader.timeout = 2;
-  boot.initrd.enable = true;
-  boot.initrd.systemd.enable = true;
-  boot.plymouth = {
-    enable = true;
-    font = "${pkgs.jetbrains-mono}/share/fonts/truetype/JetBrainsMono-Regular.ttf";
-    themePackages = [ pkgs.catppuccin-plymouth ];
-    theme = "catppuccin-macchiato";
-  };
-
-  # Setup keyfile
-  boot.initrd.secrets = {
-    "/crypto_keyfile.bin" = null;
-  };
-
-  # FIXME: Enable swap on luks
-  zramSwap.enable = true;
-
-  # Enable Display Manager
-  services.greetd = {
-    enable = true;
-    settings = {
-      default_session = {
-        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --time-format '%I:%M %p | %a • %h | %F' --cmd Hyprland";
-        user = "greeter";
-      };
-    };
-  };
-
-  # # Enable Hyprland
-  programs.hyprland.enable = true;
-  environment.sessionVariables.NIXOS_OZONE_WL = "1";
-  environment.sessionVariables.WLR_NO_HARDWARE_CURSORS = "1";
-
-  # Enable Gnome
-  # services.xserver.enable = true;
-  # services.xserver.displayManager.gdm.enable = true;
-  # services.xserver.desktopManager.gnome.enable = true;
-
-  # Gnome Exclude Packages
-  # environment.gnome.excludePackages = (with pkgs; [
-  #   gnome-tour
-  # ]) ++ (with pkgs.gnome; [
-  #       gnome-terminal
-  #       gedit # text editor
-  #       epiphany # web browser
-  #       geary # email reader
-  #       tali # poker game
-  #       iagno # go game
-  #       hitori # sudoku game
-  #       atomix # puzzle game
-  # ]);
-
-  # Enable fingerprint scanner
-  # services.fprintd = {
-  #   enable = true;
-  #   tod.enable = true;
-  #   tod.driver = pkgs.libfprint-2-tod1-goodix-550a;
-  # };
-
-  # Enable Theme
-  environment.variables.GTK_THEME = "Catppuccin-Macchiato-Standard-Teal-Dark";
-  environment.variables.XCURSOR_THEME = "Catppuccin-Macchiato-Teal";
-  environment.variables.XCURSOR_SIZE = "24";
-  console = {
-    earlySetup = true;
-    colors = [
-      "24273a"
-      "ed8796"
-      "a6da95"
-      "eed49f"
-      "8aadf4"
-      "f5bde6"
-      "8bd5ca"
-      "cad3f5"
-      "5b6078"
-      "ed8796"
-      "a6da95"
-      "eed49f"
-      "8aadf4"
-      "f5bde6"
-      "8bd5ca"
-      "a5adcb"
-    ];
-  };
-
-  # Setup Env Variables
-  environment.variables.SPOTIFY_PATH = "${pkgs.spotify}/";
-  environment.variables.JDK_PATH = "${pkgs.jdk11}/";
-  environment.variables.NODEJS_PATH = "${pkgs.nodePackages_latest.nodejs}/";
-
-  environment.variables.CI = "1";
-  # environment.variables.CLIPBOARD_EDITOR = "hx";
-  environment.variables.CLIPBOARD_NOAUDIO = "1";
-  # environment.variables.CLIPBOARD_NOGUI = "1";
-  # environment.variables.CLIPBOARD_NOPROGRESS = "1";
-  # environment.variables.CLIPBOARD_NOREMOTE = "1";
-  environment.variables.CLIPBOARD_SILENT = "1";
-
-  # Nix Configuration
-  nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];    
-    auto-optimise-store = true;
-  };
-  
-  # Optimize storage and automatic scheduled GC running
-  # If you want to run GC manually, use commands:
-  # `nix-store --optimize` for finding and eliminating redundant copies of identical store paths
-  # `nix-store --gc` for optimizing the nix store and removing unreferenced and obsolete store paths
-  # `nix-collect-garbage -d` for deleting old generations of user profiles
-  nix.optimise.automatic = true;
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 7d";
-  };
-
-  # Change runtime directory size
-  services.logind.extraConfig = "RuntimeDirectorySize=8G";
-
-  # Scheduled auto upgrade system (this is only for system upgrades, 
-  # if you want to upgrade cargo\npm\pip global packages, docker containers or different part of the system 
-  # or get really full system upgrade, use `topgrade` CLI utility manually instead.
-  # I recommend to use `topgrade` once a week or at least once a month)
-  system.autoUpgrade = {
-    enable = true;
-    operation = "switch"; # If you don't want to apply updates immediately, only after rebooting, use `boot` option in this case
-    flake = "/etc/nixos";
-    flags = [ "--update-input" "nixpkgs" "--update-input" "rust-overlay" "--commit-lock-file" ];
-    dates = "daily";
-    # channel = "https://nixos.org/channels/nixos-unstable";
-  };
-
-
-  # Linux Kernel
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_lqx;
-  boot.kernelParams = [ 
-    "quiet"
-    "fbcon=nodefer"
-    "vt.global_cursor_default=0"
-    "kernel.modules_disabled=1"
-    "lsm=landlock,lockdown,yama,integrity,apparmor,bpf,tomoyo,selinux"
-    "usbcore.autosuspend=-1"
-    "video4linux"
-    "acpi_rev_override=5"
-    "security=selinux"
-  ];
-  # boot.kernelPatches = [ {
-  #      name = "selinux-config";
-  #      patch = null;
-  #      extraConfig = '' 
-  #              SECURITY_SELINUX y
-  #              SECURITY_SELINUX_BOOTPARAM n
-  #              SECURITY_SELINUX_DEVELOP y
-  #              SECURITY_SELINUX_AVC_STATS y
-  #              DEFAULT_SECURITY_SELINUX n
-  #            '';
-  # } ];
-
-  # Enable networking
-  networking.networkmanager = {
-    enable = true;
-    dns = "none";
-  };
-  networking.hostName = "isitreal-laptop"; # Define your hostname.
-  # Pick only one of the below networking options.
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
-
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-  # Enable Bluetooth
-  hardware.bluetooth.enable = true;
-  hardware.bluetooth.powerOnBoot = false;
-  services.blueman.enable = true;
-  
-  # Set your time zone.
-  time.hardwareClockInLocalTime = true;
-  time.timeZone = "Europe/Kyiv";
-
-  # Select internationalisation properties.
-  services.xserver = {
-    layout = "us,ua,ru";
-    xkbOptions = "grp:alt_shift_toggle";
-  };
-  
-  i18n.supportedLocales = [
-    "en_US.UTF-8/UTF-8"
-    "uk_UA.UTF-8/UTF-8"
-    "ru_RU.UTF-8/UTF-8"
-  ];
-  
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
-    LC_NAME = "en_US.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "en_US.UTF-8";
-  };
- 
-  # Fonts
-  fonts.packages = with pkgs; [
-    jetbrains-mono
-    nerd-font-patcher
-  ];
-
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
-  # Enable the OpenSSH daemon.
-  # services.openssh.enable = true;
-
-  # Open ports in the firewall.
-  networking.firewall.enable = true;
-  # networking.firewall.allowedTCPPorts = [ 3000 ];
-  # networking.firewall.allowedUDPPorts = [ 3000 ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
-  # Enable Encrypted Proxy DNS
-  networking = {
-    nameservers = [ "127.0.0.1" "::1"];
-    dhcpcd.extraConfig = "nohook resolv.conf";
-  };
-  services.dnscrypt-proxy2 = {
-    enable = true;
-    settings = {
-      ipv6_servers = true;
-      require_dnssec = true;
-
-      sources.public-resolvers = {
-        urls = [
-          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
-          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
-        ];
-        cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
-        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
-      };
-
-      # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
-      server_names = [ "cloudflare" "cloudflare-ipv6" "cloudflare-security" "cloudflare-security-ipv6" "adguard-dns-doh" "mullvad-adblock-doh" "mullvad-doh" "nextdns" "nextdns-ipv6" "quad9-dnscrypt-ipv4-filter-pri" "google" "google-ipv6" "ibksturm" ];
-    };
-  };
-
-  systemd.services.dnscrypt-proxy2.serviceConfig = {
-    StateDirectory = "dnscrypt-proxy";
-  };
-
-  # Enable Mullvad VPN
-  # services.mullvad-vpn.enable = true;
-  # services.mullvad-vpn.package = pkgs.mullvad; # `pkgs.mullvad` only provides the CLI tool, use `pkgs.mullvad-vpn` instead if you want to use the CLI and the GUI.
-
-  # Enable MAC Randomize
-  # systemd.services.macchanger = {
-  #   enable = true;
-  #   description = "Change MAC address";
-  #   wantedBy = [ "multi-user.target" ];
-  #   after = [ "network.target" ];
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     ExecStart = "${pkgs.macchanger}/bin/macchanger -r wlp0s20f3";
-  #     ExecStop = "${pkgs.macchanger}/bin/macchanger -p wlp0s20f3";
-  #     RemainAfterExit = true;
-  #   };
-  # };
-
-  # Enable security services
-  users.users.root.hashedPassword = "!";
-  security.tpm2 = {
-    enable = true;
-    pkcs11.enable = true;
-    tctiEnvironment.enable = true;
-  };
-  security.apparmor = {
-    enable = true;
-    packages = with pkgs; [
-      apparmor-utils
-      apparmor-profiles
-    ];
-  };
-  services.fail2ban.enable = true;
-  # security.polkit.enable = true;
-  services.usbguard = {
-    enable = true;
-    dbus.enable = true;
-    implicitPolicyTarget = "block";
-    # FIXME: set yours pref USB devices (change {id} to your trusted USB device), use `lsusb` command (from usbutils package) to get list of all connected USB devices including integrated devices like camera, bluetooth, wifi, etc. with their IDs
-    rules = ''
-      allow id {id} # device 1
-      allow id {id} # device 2
-    '';
-  };
-  services.clamav = {
-    daemon.enable = true;
-    updater.enable = true;
-    updater.interval = "daily"; #man systemd.time
-    updater.frequency = 12;
-  };
-  programs.firejail = {
-    enable = true;
-    wrappedBinaries = { 
-      mpv = {
-        executable = "${lib.getBin pkgs.mpv}/bin/mpv";
-        profile = "${pkgs.firejail}/etc/firejail/mpv.profile";
-      };
-      imv = {
-        executable = "${lib.getBin pkgs.imv}/bin/imv";
-        profile = "${pkgs.firejail}/etc/firejail/imv.profile";
-      };
-      zathura = {
-        executable = "${lib.getBin pkgs.zathura}/bin/zathura";
-        profile = "${pkgs.firejail}/etc/firejail/zathura.profile";
-      };
-      discord = {
-        executable = "${lib.getBin pkgs.discord}/bin/discord";
-      };
-    };
-  };
-
-  # Systemd services setup
-  systemd.package = pkgs.systemd.override { withSelinux = true; };
-  systemd.packages = with pkgs; [
-    auto-cpufreq
-  ];
-
-  # Enable services
-  services.geoclue2 = {
-    enable = true;
-    appConfig = {
-      "gammastep" = {
-        isAllowed = true;
-        isSystem = false;
-        users = [ "1000" ]; # FIXME: set your user id (to get user id use command 'id -u "your_user_name"')
-      };
-    };
-  };
-  # services.avahi = {
-  #   enable = true;
-  #   nssmdns = true;
-  # };
-  programs.browserpass.enable = true;
-  programs.direnv.enable = true;
-  services.upower.enable = true;
-  programs.fish.enable = true;
-  programs.dconf.enable = true;
-  services.dbus.enable = true;
-  services.dbus.packages = with pkgs; [
-  	xfce.xfconf
-  	gnome2.GConf
-  ];
-  programs.light.enable = true;
-  services.mpd.enable = true;
-  programs.thunar.enable = true;
-  services.tumbler.enable = true; 
-  services.fwupd.enable = true;
-  services.auto-cpufreq.enable = true;
-  security.pam.services.swaylock = {};
-  # services.udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
-  
-  # USB Automounting
-  services.gvfs.enable = true;
-  # services.udisks2.enable = true;
-  # services.devmon.enable = true;
-
-  # Wayland compatibility with X
-  # xdg.portal = {
-  #   enable = true;
-  #   wlr.enable = true;
-  # };
-
-  # Enable CUPS to print documents.
-  # services.printing.enable = true;
-  
-  ### Enable container manager
-
-  # Enable Containerd
-  # virtualisation.containerd.enable = true;
-
-  # Enable Docker
-  # virtualisation.docker.enable = true;
-  # virtualisation.docker.rootless = {
-  #   enable = true;
-  #   setSocketVariable = true;
-  # };
-  # users.extraGroups.docker.members = [ "xnm" ];
-
-  # Enable Podman
-  virtualisation = {
-    podman = {
-      enable = true;
-
-      # Create a `docker` alias for podman, to use it as a drop-in replacement
-      dockerCompat = true;
-
-      # Required for containers under podman-compose to be able to talk to each other.
-      defaultNetwork.settings.dns_enabled = true;
-    };
-  };
- 
-  # Enable sound with pipewire.
-  sound.enable = true;
-  hardware.pulseaudio.enable = false;
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-    wireplumber.enable = true;
-    # If you want to use JACK applications, uncomment this
-    # jack.enable = true;
-
-    # use the example session manager (no others are packaged yet so this is enabled by default,
-    # no need to redefine it in your config for now)
-    # media-session.enable = true;
-  };
-
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.xnm = {
-    isNormalUser = true;
-    description = "xnm";
-    extraGroups = [ "networkmanager" "input" "wheel" "video" "audio" "tss" ];
-    shell = pkgs.fish;
-    packages = with pkgs; [
-      spotify
-      youtube-music
-      discord
-      tdesktop
-      vscode
-      brave
-    ];
-  };
-
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
-
-  # Apply the overlay to the package set
-  nixpkgs.overlays = [
-    inputs.rust-overlay.overlays.default
-  ];
-
-  # Override packages
-  nixpkgs.config.packageOverrides = pkgs: {
-    colloid-icon-theme = pkgs.colloid-icon-theme.override { colorVariants = ["teal"]; };
-    catppuccin-gtk = pkgs.catppuccin-gtk.override {
-      accents = [ "teal" ]; # You can specify multiple accents here to output multiple themes 
-      size = "standard";
-      variant = "macchiato";
-    };
-    discord = pkgs.discord.override {
-      withOpenASAR = true;
-      withTTS = true;
-    };
-    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
-      inherit pkgs;
-    };
-  };
-
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  environment.systemPackages = with pkgs; [
-    policycoreutils
-    mold
-    gcc13
-    jdk11
-    go
-    gopls
-    delve
-    (python311Full.withPackages(ps: with ps; [ pygobject3 gobject-introspection pyqt6-sip]))
-    nodePackages_latest.nodejs
-    bun
-    lua
-    zig
-    numbat
-
-    python311Packages.python-lsp-server
-    nodePackages_latest.nodemon
-    nodePackages_latest.typescript
-    nodePackages_latest.typescript-language-server
-    nodePackages_latest.vscode-langservers-extracted
-    nodePackages_latest.yaml-language-server
-    nodePackages_latest.dockerfile-language-server-nodejs
-    sumneko-lua-language-server
-    marksman
-    nil
-    zls
-
-    (rust-bin.fromRustupToolchainFile ./rust-toolchain.toml)
-    evcxr #rust repl
-    taplo #toml formatter & lsp
-    cargo-watch
-    cargo-deny
-    cargo-audit
-    cargo-update
-    cargo-edit
-    cargo-outdated
-    cargo-license
-    cargo-tarpaulin
-    cargo-cross
-    cargo-zigbuild
-    cargo-nextest
-    cargo-spellcheck
-    cargo-modules
-    cargo-bloat
-    cargo-unused-features
-    bacon
-    lldb_16
-    upx
-
-    wasmedge
-    wasmer
-    lunatic
-    wasmi
-    # wasm3
-
-    # mullvad-closest
-    license-generator
-    git-ignore
-    just
-    xh
-    tgpt
-    wezterm
-    cool-retro-term
-    # mcfly # terminal history
-    starship
-    zellij
-    helix
-    git
-    progress
-    noti
-    topgrade
-    ripgrep
-    rewrk
-    wrk2
-    procs
-    tealdeer
-    # skim #fzf better alternative in rust
-    monolith
-    aria
-    # macchina #neofetch alternative in rust
-    sd
-    ouch
-    duf
-    du-dust
-    fd
-    jq
-    gh
-    trash-cli
-    zoxide
-    tokei
-    fzf
-    bat
-    mdcat
-    pandoc
-    lsd
-    gping
-    viu
-    tre-command
-    felix-fm
-    chafa
-
-    # nerdctl
-    # firecracker
-    # firectl
-    # flintlock
-    distrobox
-    qemu
-    podman-compose
-    podman-tui
-
-    lazydocker
-    lazygit
-    neofetch
-    onefetch
-    ipfetch
-    cpufetch
-    starfetch
-    octofetch
-    htop
-    bottom
-    btop
-    kmon
-
-    cmatrix
-    pipes-rs
-    rsclock
-    cava
-    figlet
-
-    qutebrowser
-    zathura
-    mpv
-    imv
-
-    numix-icon-theme-circle
-    colloid-icon-theme
-    catppuccin-gtk
-    catppuccin-kvantum
-    catppuccin-cursors.macchiatoTeal
-
-    at-spi2-atk
-    pamixer
-    pavucontrol
-    qt6.qtwayland
-    psi-notify
-    poweralertd
-    # wlsunset
-    gammastep
-    greetd.tuigreet
-    swaylock-effects
-    swayidle
-    brightnessctl
-    playerctl
-    psmisc
-    grim
-    slurp
-    imagemagick
-    swappy
-    ffmpeg_6-full
-    # wl-screenrec
-    wf-recorder
-    wl-clipboard
-    cliphist
-    clipboard-jh
-    xdg-utils
-    wtype
-    wlrctl
-    hyprpicker
-    pyprland
-    waybar
-    rofi-wayland
-    dunst
-    avizo
-    wlogout
-    wpaperd
-    # swww
-    gifsicle
-
-    nuspell
-    hyphen
-    hunspell
-    hunspellDicts.en_US
-    hunspellDicts.uk_UA
-    hunspellDicts.ru_RU
-
-    vulnix       #scan command: vulnix --system
-    clamav       #scan command: sudo freshcalm; clamscan [options] [file/directory/-]
-    chkrootkit   #scan command: sudo chkrootkit
-
-    # passphrase2pgp
-    pass-wayland
-    pass2csv
-    passExtensions.pass-tomb
-    passExtensions.pass-update
-    passExtensions.pass-otp
-    passExtensions.pass-import
-    passExtensions.pass-audit
-    tomb
-    docker-credential-helpers
-    pass-git-helper
-
-    # vulkan-tools
-    # opencl-info
-    # clinfo
-    # vdpauinfo
-    # libva-utils
-    # nvtop
-    usbutils
-    dig
-    speedtest-rs
-
-    # gnome.gnome-tweaks
-    # gnome.gnome-shell
-    # xsettingsd
-    # gnome.gnome-shell-extensions
-    # themechanger
-  ];
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
@@ -711,6 +12,7 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.11"; # Did you read the comment?
+  # FIXME: change it to version from your current, fresh and auto-generated after first installation `configuration.nix` config file
+  system.stateVersion = "your_version_here"; # Did you read the comment?
 
 }

nixos/display-manager.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+
+{
+  # Enable Display Manager
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --time-format '%I:%M %p | %a • %h | %F' --cmd Hyprland";
+        user = "greeter";
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    greetd.tuigreet
+  ];
+}

nixos/dns.nix

@@ -0,0 +1,36 @@
+{ ... }:
+
+{
+  # Enable Encrypted DNS
+  networking = {
+    nameservers = [ "127.0.0.1" "::1" ];
+    # If using dhcpcd:
+    dhcpcd.extraConfig = "nohook resolv.conf";
+    # If using NetworkManager:
+    networkmanager.dns = "none";
+  };
+
+  services.dnscrypt-proxy2 = {
+    enable = true;
+    settings = {
+      ipv6_servers = true;
+      require_dnssec = true;
+
+      sources.public-resolvers = {
+        urls = [
+          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
+          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
+        ];
+        cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
+        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+      };
+
+      # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
+      server_names = [ "cloudflare" "cloudflare-ipv6" "cloudflare-security" "cloudflare-security-ipv6" "adguard-dns-doh" "mullvad-adblock-doh" "mullvad-doh" "nextdns" "nextdns-ipv6" "quad9-dnscrypt-ipv4-filter-pri" "google" "google-ipv6" "ibksturm" ];
+    };
+  };
+
+  systemd.services.dnscrypt-proxy2.serviceConfig = {
+    StateDirectory = "dnscrypt-proxy";
+  };
+}

nixos/environment-variables.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+
+{
+  # Setup Env Variables
+  environment.variables.SPOTIFY_PATH = "${pkgs.spotify}/";
+  environment.variables.JDK_PATH = "${pkgs.jdk11}/";
+  environment.variables.NODEJS_PATH = "${pkgs.nodePackages_latest.nodejs}/";
+
+  environment.variables.CI = "1";
+  # environment.variables.CLIPBOARD_EDITOR = "hx";
+  environment.variables.CLIPBOARD_NOAUDIO = "1";
+  # environment.variables.CLIPBOARD_NOGUI = "1";
+  # environment.variables.CLIPBOARD_NOPROGRESS = "1";
+  # environment.variables.CLIPBOARD_NOREMOTE = "1";
+  environment.variables.CLIPBOARD_SILENT = "1";
+}

nixos/fingerprint-scanner.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  # Enable fingerprint scanner
+  services.fprintd = {
+    enable = true;
+    tod.enable = true;
+    tod.driver = pkgs.libfprint-2-tod1-goodix-550a;
+  };
+}

nixos/firewall.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  # Open ports in the firewall.
+  networking.firewall.enable = true;
+  # networking.firewall.allowedTCPPorts = [ 3000 ];
+  # networking.firewall.allowedUDPPorts = [ 3000 ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+}

nixos/flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1699099776,
+        "lastModified": 1701718080,
-        "narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
+        "narHash": "sha256-6ovz0pG76dE0P170pmmZex1wWcQoeiomUZGggfH9XPs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
+        "rev": "2c7f3c0fb7c08a0814627611d9d7d45ab6d75335",
         "type": "github"
       },
       "original": {
@@ -62,11 +62,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1699495996,
+        "lastModified": 1702001829,
-        "narHash": "sha256-m0LWmnEJhHTY4gJX9HPsQ8voZptvr1Sx6dXkk9Xp0sI=",
+        "narHash": "sha256-6gEVidNVqzTb06zIy2Gxhz9m6/jXyAgViRxfgEpZkQ8=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "603e4962d7d2225ba2caf66b0eabfcaa9a93c490",
+        "rev": "c2a1dd067a928624c1aab36f976758c0722c79bd",
         "type": "github"
       },
       "original": {

nixos/flake.nix

@@ -12,6 +12,45 @@
       specialArgs = { inherit inputs; };
       modules = [
         ./configuration.nix
+        ./hardware-configuration.nix
+        # ./fingerprint-scanner.nix
+        ./sound.nix
+        ./usb.nix
+        ./time.nix
+        ./swap.nix
+        ./bootloader.nix
+        ./nix-settings.nix
+        ./nixpkgs.nix
+        ./gc.nix
+        ./auto-upgrade.nix
+        ./linux-kernel.nix
+        ./screen.nix
+        ./display-manager.nix
+        ./theme.nix
+        ./internationalisation.nix
+        ./fonts.nix
+        ./security-services.nix
+        ./services.nix
+        # ./printing.nix
+        # ./gnome.nix
+        ./hyprland.nix
+        ./environment-variables.nix
+        ./bluetooth.nix
+        ./networking.nix
+        # ./mac-randomize.nix
+        # ./open-ssh.nix
+        ./firewall.nix
+        ./dns.nix
+        # ./vpn.nix
+        ./users.nix
+        ./virtualisation.nix
+        ./programming-languages.nix
+        ./lsp.nix
+        ./rust.nix
+        ./wasm.nix
+        ./info-fetchers.nix
+        ./utils.nix
+        ./terminal-utils.nix
       ];
     };
   };

nixos/fonts.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  # Fonts
+  fonts.packages = with pkgs; [
+    jetbrains-mono
+    nerd-font-patcher
+  ];
+}

nixos/gc.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  # Optimize storage and automatic scheduled GC running
+  # If you want to run GC manually, use commands:
+  # `nix-store --optimize` for finding and eliminating redundant copies of identical store paths
+  # `nix-store --gc` for optimizing the nix store and removing unreferenced and obsolete store paths
+  # `nix-collect-garbage -d` for deleting old generations of user profiles
+  nix.settings.auto-optimise-store = true;
+  nix.optimise.automatic = true;
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+}

nixos/gnome.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+
+{
+  # Enable Gnome
+  services.xserver.enable = true;
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+
+  # Gnome Exclude Packages
+  # environment.gnome.excludePackages = (with pkgs; [
+  #   gnome-tour
+  # ]) ++ (with pkgs.gnome; [
+  #       gnome-terminal
+  #       gedit # text editor
+  #       epiphany # web browser
+  #       geary # email reader
+  #       tali # poker game
+  #       iagno # go game
+  #       hitori # sudoku game
+  #       atomix # puzzle game
+  # ]);
+}

nixos/hardware-configuration.nix

@@ -10,12 +10,12 @@
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.blacklistedKernelModules = [ "nouveau" "nvidia" ];
+  boot.blacklistedKernelModules = [ "nouveau" "nvidia" ]; # Disable NVIDIA video cards
   boot.kernelParams = [ "i915.enable_guc=2" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  # FIXME: setup file systems, swap devices, luks and so on
+ # FIXME: Use your auto-generated `hardware-configuration.nix` instead of this file, you can tweak your `hardware-configuration.nix` using snippets from this file
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

nixos/hyprland.nix

@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+
+{
+  # Enable Hyprland
+  programs.hyprland.enable = true;
+  environment.sessionVariables.NIXOS_OZONE_WL = "1";
+  environment.sessionVariables.WLR_NO_HARDWARE_CURSORS = "1";
+
+  environment.systemPackages = with pkgs; [
+    wezterm
+    cool-retro-term
+
+    starship
+    helix
+
+    qutebrowser
+    zathura
+    mpv
+    imv
+  ];
+}

nixos/info-fetchers.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    neofetch
+    onefetch
+    ipfetch
+    cpufetch
+    starfetch
+    octofetch
+    htop
+    bottom
+    btop
+    kmon
+
+    # vulkan-tools
+    # opencl-info
+    # clinfo
+    # vdpauinfo
+    # libva-utils
+    # nvtop
+    dig
+    speedtest-rs
+  ];
+}

nixos/internationalisation.nix

@@ -0,0 +1,38 @@
+{ pkgs, ... }:
+
+{
+  # Select internationalisation properties.
+  services.xserver = {
+    layout = "us,ua,ru";
+    xkbOptions = "grp:alt_shift_toggle";
+  };
+  
+  i18n.supportedLocales = [
+    "en_US.UTF-8/UTF-8"
+    "uk_UA.UTF-8/UTF-8"
+    "ru_RU.UTF-8/UTF-8"
+  ];
+  
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  environment.systemPackages = with pkgs; [
+    nuspell
+    hyphen
+    hunspell
+    hunspellDicts.en_US
+    hunspellDicts.uk_UA
+    hunspellDicts.ru_RU
+  ];
+}

nixos/linux-kernel.nix

@@ -0,0 +1,34 @@
+{ pkgs, ... }:
+
+{
+  # Linux Kernel
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_lqx;
+  boot.kernelParams = [ 
+    "quiet"
+    "fbcon=nodefer"
+    "vt.global_cursor_default=0"
+    "kernel.modules_disabled=1"
+    "lsm=landlock,lockdown,yama,integrity,apparmor,bpf,tomoyo,selinux"
+    "usbcore.autosuspend=-1"
+    "video4linux"
+    "acpi_rev_override=5"
+    "security=selinux"
+  ];
+  # boot.kernelPatches = [ {
+  #      name = "selinux-config";
+  #      patch = null;
+  #      extraConfig = '' 
+  #              SECURITY_SELINUX y
+  #              SECURITY_SELINUX_BOOTPARAM n
+  #              SECURITY_SELINUX_DEVELOP y
+  #              SECURITY_SELINUX_AVC_STATS y
+  #              DEFAULT_SECURITY_SELINUX n
+  #            '';
+  # } ];
+
+  systemd.package = pkgs.systemd.override { withSelinux = true; };
+
+  environment.systemPackages = with pkgs; [
+    policycoreutils
+  ];
+}

nixos/lsp.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    python311Packages.python-lsp-server
+    nodePackages_latest.nodemon
+    nodePackages_latest.typescript
+    nodePackages_latest.typescript-language-server
+    nodePackages_latest.vscode-langservers-extracted
+    nodePackages_latest.yaml-language-server
+    nodePackages_latest.dockerfile-language-server-nodejs
+    sumneko-lua-language-server
+    marksman
+    nil
+    zls
+    gopls
+    delve
+  ];  
+}

nixos/mac-randomize.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+
+{
+  # When connecting to untrusted networks, such as public Wi-Fi use a random MAC address to prevent tracking and unauthorized access to your device.
+  # But my recommendation is to avoid untrusted networks whenever possible, opting for trusted home or mobile hotspot connections.
+  # Also, you can enhance your privacy and security by:
+    # - Employing a VPN (Virtual Private Network) to encrypt internet traffic.
+    # - Utilizing Encrypted DNS, with DNS over HTTPS (DoH) to encrypt communication with the DNS server and mask DNS traffic under HTTPS.
+
+  # Enable MAC Randomize
+  systemd.services.macchanger = {
+    enable = true;
+    description = "Change MAC address";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.macchanger}/bin/macchanger -r wlp0s20f3";
+      ExecStop = "${pkgs.macchanger}/bin/macchanger -p wlp0s20f3";
+      RemainAfterExit = true;
+    };
+  };
+}

nixos/networking.nix

@@ -0,0 +1,13 @@
+{ ... }:
+
+{
+  # Enable networking
+  networking.hostName = "isitreal-laptop"; # Define your hostname.
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+}

nixos/nix-settings.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  # Nix Configuration
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];    
+  };
+}

nixos/nixpkgs.nix

@@ -0,0 +1,13 @@
+{ ... }:
+
+{
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+  
+  # Override packages
+  nixpkgs.config.packageOverrides = pkgs: {
+    nur = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {
+      inherit pkgs;
+    };
+  };
+}

nixos/open-ssh.nix

@@ -0,0 +1,6 @@
+{ ... }:
+
+{
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+}

nixos/printing.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+  # services.avahi = {
+  #   enable = true;
+  #   nssmdns = true;
+  # };
+}

nixos/programming-languages.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    go
+    (python311Full.withPackages(ps: with ps; [ pygobject3 gobject-introspection pyqt6-sip]))
+    nodePackages_latest.nodejs
+    bun
+    lua
+    zig
+    numbat
+  ];
+}

nixos/rust.nix

@@ -0,0 +1,31 @@
+{ inputs, pkgs, ... }:
+
+{
+  # Apply the overlay to the package set
+  nixpkgs.overlays = [
+    inputs.rust-overlay.overlays.default
+  ];
+
+  environment.systemPackages = with pkgs; [
+    (rust-bin.fromRustupToolchainFile ./rust-toolchain.toml)
+    evcxr #rust repl
+    taplo #toml formatter & lsp
+    cargo-watch
+    cargo-deny
+    cargo-audit
+    cargo-update
+    cargo-edit
+    cargo-outdated
+    cargo-license
+    cargo-tarpaulin
+    cargo-cross
+    cargo-zigbuild
+    cargo-nextest
+    cargo-spellcheck
+    cargo-modules
+    cargo-bloat
+    cargo-unused-features
+    bacon
+    lldb_16
+  ];
+}

nixos/screen.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  services.geoclue2.appConfig = {
+      "gammastep" = {
+        isAllowed = true;
+        isSystem = false;
+        users = [ "1000" ]; # FIXME: set your user id (to get user id use command 'id -u "your_user_name"')
+      };
+  };
+  
+  programs.light.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    # wlsunset
+    gammastep
+    brightnessctl
+  ];
+}

nixos/security-services.nix

@@ -0,0 +1,72 @@
+{ pkgs, lib, ... }:
+
+{
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # Enable Security Services
+  users.users.root.hashedPassword = "!";
+  security.tpm2 = {
+    enable = true;
+    pkcs11.enable = true;
+    tctiEnvironment.enable = true;
+  };
+  security.apparmor = {
+    enable = true;
+    packages = with pkgs; [
+      apparmor-utils
+      apparmor-profiles
+    ];
+  };
+  services.fail2ban.enable = true;
+  security.pam.services.swaylock = {};
+  # security.polkit.enable = true;
+  programs.browserpass.enable = true;
+  services.clamav = {
+    daemon.enable = true;
+    updater.enable = true;
+    updater.interval = "daily"; #man systemd.time
+    updater.frequency = 12;
+  };
+  programs.firejail = {
+    enable = true;
+    wrappedBinaries = { 
+      mpv = {
+        executable = "${lib.getBin pkgs.mpv}/bin/mpv";
+        profile = "${pkgs.firejail}/etc/firejail/mpv.profile";
+      };
+      imv = {
+        executable = "${lib.getBin pkgs.imv}/bin/imv";
+        profile = "${pkgs.firejail}/etc/firejail/imv.profile";
+      };
+      zathura = {
+        executable = "${lib.getBin pkgs.zathura}/bin/zathura";
+        profile = "${pkgs.firejail}/etc/firejail/zathura.profile";
+      };
+      discord = {
+        executable = "${lib.getBin pkgs.discord}/bin/discord";
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    vulnix       #scan command: vulnix --system
+    clamav       #scan command: sudo freshcalm; clamscan [options] [file/directory/-]
+    chkrootkit   #scan command: sudo chkrootkit
+
+    # passphrase2pgp
+    pass-wayland
+    pass2csv
+    passExtensions.pass-tomb
+    passExtensions.pass-update
+    passExtensions.pass-otp
+    passExtensions.pass-import
+    passExtensions.pass-audit
+    tomb
+  ];
+}

nixos/services.nix

@@ -0,0 +1,60 @@
+{ pkgs, ... }:
+
+{
+  # Systemd services setup
+  systemd.packages = with pkgs; [
+    auto-cpufreq
+  ];
+  
+  # Enable Services
+  services.geoclue2.enable = true;
+  programs.direnv.enable = true;
+  services.upower.enable = true;
+  programs.fish.enable = true;
+  programs.dconf.enable = true;
+  services.dbus.enable = true;
+  services.dbus.packages = with pkgs; [
+  	xfce.xfconf
+  	gnome2.GConf
+  ];
+  services.mpd.enable = true;
+  programs.thunar.enable = true;
+  services.tumbler.enable = true; 
+  services.fwupd.enable = true;
+  services.auto-cpufreq.enable = true;
+  # services.udev.packages = with pkgs; [ gnome.gnome-settings-daemon ];
+
+  environment.systemPackages = with pkgs; [
+    at-spi2-atk
+    qt6.qtwayland
+    psi-notify
+    poweralertd
+    swaylock-effects
+    swayidle
+    playerctl
+    psmisc
+    grim
+    slurp
+    imagemagick
+    swappy
+    ffmpeg_6-full
+    # wl-screenrec
+    wf-recorder
+    wl-clipboard
+    cliphist
+    clipboard-jh
+    xdg-utils
+    wtype
+    wlrctl
+    hyprpicker
+    pyprland
+    waybar
+    rofi-wayland
+    dunst
+    avizo
+    wlogout
+    wpaperd
+    # swww
+    gifsicle
+  ];
+}

nixos/sound.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  # Enable sound with pipewire.
+  sound.enable = true;
+  hardware.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    wireplumber.enable = true;
+    # If you want to use JACK applications, uncomment this
+    # jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    # media-session.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    pamixer
+    pavucontrol
+  ];
+}

nixos/swap.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  zramSwap.enable = true;
+}

nixos/terminal-utils.nix

@@ -0,0 +1,55 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    upx
+    git
+    lazygit
+    license-generator
+    git-ignore
+    pass-git-helper
+    just
+    xh
+    tgpt
+    # mcfly # terminal history
+    zellij
+    progress
+    noti
+    topgrade
+    ripgrep
+    rewrk
+    wrk2
+    procs
+    tealdeer
+    # skim #fzf better alternative in rust
+    monolith
+    aria
+    # macchina #neofetch alternative in rust
+    sd
+    ouch
+    duf
+    du-dust
+    fd
+    jq
+    gh
+    trash-cli
+    zoxide
+    tokei
+    fzf
+    bat
+    mdcat
+    pandoc
+    lsd
+    gping
+    viu
+    tre-command
+    felix-fm
+    chafa
+
+    cmatrix
+    pipes-rs
+    rsclock
+    cava
+    figlet
+  ];
+}

nixos/theme.nix

@@ -0,0 +1,57 @@
+{ pkgs, ... }:
+
+{
+  # Enable Theme
+  environment.variables.GTK_THEME = "Catppuccin-Macchiato-Standard-Teal-Dark";
+  environment.variables.XCURSOR_THEME = "Catppuccin-Macchiato-Teal";
+  environment.variables.XCURSOR_SIZE = "24";
+  console = {
+    earlySetup = true;
+    colors = [
+      "24273a"
+      "ed8796"
+      "a6da95"
+      "eed49f"
+      "8aadf4"
+      "f5bde6"
+      "8bd5ca"
+      "cad3f5"
+      "5b6078"
+      "ed8796"
+      "a6da95"
+      "eed49f"
+      "8aadf4"
+      "f5bde6"
+      "8bd5ca"
+      "a5adcb"
+    ];
+  };
+
+  # Override packages
+  nixpkgs.config.packageOverrides = pkgs: {
+    colloid-icon-theme = pkgs.colloid-icon-theme.override { colorVariants = ["teal"]; };
+    catppuccin-gtk = pkgs.catppuccin-gtk.override {
+      accents = [ "teal" ]; # You can specify multiple accents here to output multiple themes 
+      size = "standard";
+      variant = "macchiato";
+    };
+    discord = pkgs.discord.override {
+      withOpenASAR = true;
+      withTTS = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    numix-icon-theme-circle
+    colloid-icon-theme
+    catppuccin-gtk
+    catppuccin-kvantum
+    catppuccin-cursors.macchiatoTeal
+
+    # gnome.gnome-tweaks
+    # gnome.gnome-shell
+    # xsettingsd
+    # gnome.gnome-shell-extensions
+    # themechanger
+  ];
+}

nixos/time.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  # Set your time zone.
+  time.hardwareClockInLocalTime = true;
+  time.timeZone = "Europe/Kyiv";
+}

nixos/usb.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+
+{
+  # USB Automounting
+  services.gvfs.enable = true;
+  # services.udisks2.enable = true;
+  # services.devmon.enable = true;
+
+  # Enable USB Guard
+  services.usbguard = {
+    enable = true;
+    dbus.enable = true;
+    implicitPolicyTarget = "block";
+    # FIXME: set yours pref USB devices (change {id} to your trusted USB device), use `lsusb` command (from usbutils package) to get list of all connected USB devices including integrated devices like camera, bluetooth, wifi, etc. with their IDs or just disable `usbguard`
+    rules = ''
+      allow id {id} # device 1
+      allow id {id} # device 2
+    '';
+  };
+
+  # Enable USB-specific packages
+  environment.systemPackages = with pkgs; [
+    usbutils
+  ];
+}

nixos/users.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+
+{
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.xnm = {
+    isNormalUser = true;
+    description = "xnm";
+    extraGroups = [ "networkmanager" "input" "wheel" "video" "audio" "tss" ];
+    shell = pkgs.fish;
+    packages = with pkgs; [
+      spotify
+      youtube-music
+      discord
+      tdesktop
+      vscode
+      brave
+    ];
+  };
+
+  # Change runtime directory size
+  services.logind.extraConfig = "RuntimeDirectorySize=8G";
+}

nixos/utils.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    mold
+    gcc13
+    jdk11
+  ];
+}

nixos/virtualisation.nix

@@ -0,0 +1,44 @@
+{ pkgs, ... }:
+
+{
+  # Enable Containerd
+  # virtualisation.containerd.enable = true;
+
+  # Enable Docker
+  # virtualisation.docker.enable = true;
+  # virtualisation.docker.rootless = {
+  #   enable = true;
+  #   setSocketVariable = true;
+  # };
+  # users.extraGroups.docker.members = [ "xnm" ];
+
+  # Enable Podman
+  virtualisation = {
+    podman = {
+      enable = true;
+
+      # Create a `docker` alias for podman, to use it as a drop-in replacement
+      dockerCompat = true;
+
+      # Required for containers under podman-compose to be able to talk to each other.
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    # nerdctl
+
+    # firecracker
+    # firectl
+    # flintlock
+
+    distrobox
+    qemu
+
+    podman-compose
+    podman-tui
+
+    # lazydocker
+    # docker-credential-helpers
+  ];
+}

nixos/vpn.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  # Enable Mullvad VPN
+  services.mullvad-vpn.enable = true;
+  services.mullvad-vpn.package = pkgs.mullvad; # `pkgs.mullvad` only provides the CLI tool, use `pkgs.mullvad-vpn` instead if you want to use the CLI and the GUI.
+
+  environment.systemPackages = with pkgs; [
+    mullvad-closest
+  ];
+}

nixos/wasm.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    wasmedge
+    wasmer
+    lunatic
+    wasmi
+    # wasm3
+  ];
+}