add work's conf

Signed-off-by: Hadi <hadi@example.com>

.sops.yaml

@@ -10,3 +10,7 @@ creation_rules:
     key_groups:
       - age:
         - *primary
+  - path_regex: hosts/work/secrets/secrets.yaml$
+    key_groups:
+      - age:
+        - *work

hosts/work/configuration.nix

@@ -0,0 +1,33 @@
+{config, ...}: {
+  imports = [
+    # Mostly system related configuration
+    ../../nixos/audio.nix
+    ../../nixos/fonts.nix
+    ../../nixos/home-manager.nix
+    ../../nixos/nix.nix
+    ../../nixos/systemd-boot.nix
+    ../../nixos/tuigreet.nix
+    ../../nixos/autologin.nix # Skip first TUIGreet login, use LUKS password to unlock the keyring
+    ../../nixos/users.nix
+    ../../nixos/utils.nix
+    ../../nixos/hyprland.nix
+    ../../home/programs/gui/helium/system.nix # I hate browser's configuration..
+
+    # CHANGEME: You should probably remove those things:
+    ./persistence.nix # impermanence: what to keep once "/" is wiped on boot
+    ./usbguard.nix
+    ./disko.nix
+    ./secrets
+
+    # You should let those lines as is
+    ./hardware-configuration.nix
+    ./variables.nix
+  ];
+
+  home-manager.users."${config.var.username}" = import ./home.nix;
+
+  users.users.${config.var.username}.hashedPassword = "$y$j9T$A7gH534UczuBxulj9IfEu1$ImRy3lpYpemRWNVIkA7efKPWXneFiqhZnEF1aMkWcD8"; # CHANGEME: This is my password
+
+  # Don't touch this
+  system.stateVersion = "26.05";
+}

hosts/work/disko.nix

@@ -0,0 +1,64 @@
+{
+  disko.devices = {
+    nodev = {
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "size=12G"
+          "mode=755"
+        ];
+      };
+    };
+
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/nvme-WD_PC_SN740_SDDQNQD-256G-1201_24175M800511";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = ["fmask=0077" "dmask=0077"];
+              };
+            };
+
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "crypted";
+                settings = {
+                  allowDiscards = true;
+                  bypassWorkqueues = true;
+                };
+                content = {
+                  type = "btrfs";
+                  extraArgs = ["-f"];
+                  subvolumes = {
+                    "/nix" = {
+                      mountpoint = "/nix";
+                      mountOptions = ["compress=zstd" "noatime"];
+                    };
+                    "/persist" = {
+                      mountpoint = "/persist";
+                      mountOptions = ["compress=zstd" "noatime"];
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  fileSystems."/persist".neededForBoot = true;
+}

hosts/work/flake.nix

@@ -0,0 +1,25 @@
+{
+  inputs,
+  nixpkgs,
+  pkgs-unstable,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  modules = [
+    {
+      nixpkgs.overlays = [
+        inputs.nur.overlays.default
+      ];
+      _module.args = {inherit inputs pkgs-unstable;};
+    }
+    inputs.home-manager.nixosModules.home-manager
+    inputs.stylix.nixosModules.stylix
+    inputs.sops-nix.nixosModules.sops
+    inputs.nix-index-database.nixosModules.default
+    inputs.helium-browser.nixosModules.default
+    inputs.impermanence.nixosModules.impermanence
+    inputs.disko.nixosModules.disko
+    ./disko.nix
+    ./configuration.nix
+  ];
+}

hosts/work/hardware-configuration.nix

@@ -0,0 +1,21 @@
+# Hardware detection - filesystems are managed by disko.nix
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  swapDevices = [];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/work/home.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  inputs,
+  ...
+}: {
+  imports = [
+    # Programs
+
+    ## GUI
+    ../../home/programs/gui/proton
+    ../../home/programs/gui/helium
+    ../../home/programs/gui/pkgs.nix
+
+    ## TUI
+    inputs.nvf-config.homeManagerModules.default
+    ../../home/programs/tui/ghostty
+    ../../home/programs/tui/ilovetui
+    ../../home/programs/tui/shell
+    ../../home/programs/tui/git
+    ../../home/programs/tui/git/lazygit.nix
+    ../../home/programs/tui/nixy
+    ../../home/programs/tui/nix-utils
+    ../../home/programs/tui/spotatui
+    ../../home/programs/tui/elio
+    ../../home/programs/tui/wikiman
+    ../../home/programs/tui/pkgs.nix
+
+    ## GROUPS
+    ../../home/programs/group/cybersecurity.nix
+    ../../home/programs/group/dev.nix
+
+    # System (Desktop environment like stuff)
+    ../../home/system/hyprlock
+    ../../home/system/hyprland
+    ../../home/system/waybar
+    ../../home/system/swaync
+    ../../home/system/tofi
+    ../../home/system/mime
+    ../../home/system/udiskie
+    ../../home/system/termfilechooser
+    ../../home/system/clipboard
+    ../../home/system/hypridle
+
+    ./variables.nix # Mostly user-specific configuration
+  ];
+
+  home = {
+    inherit (config.var) username;
+    homeDirectory = "/home/" + config.var.username;
+
+    persistence."/persist" = {
+      directories = [
+        ".config/nixos" # this repo itself (nixy manages it here)
+        ".local/share"
+        ".local/state"
+        ".cache"
+        "Notes"
+        "Projects"
+        "Documents"
+        "Downloads"
+        "Pictures"
+        "Videos"
+      ];
+
+      files = [
+        ".ssh/known_hosts"
+        ".config/sops/age/keys.txt"
+      ];
+    };
+
+    # Don't touch this
+    stateVersion = "26.05";
+  };
+
+  wayland.windowManager.hyprland.settings.monitor = [
+    "desc:Philips Consumer Electronics Company PHL 221B8L ZV02144013987,highres,0x0,1"
+  ];
+
+  programs = {
+    home-manager.enable = true;
+    nixy = {
+      enable = true;
+      configDirectory = config.var.configDirectory;
+    };
+  };
+}

hosts/work/persistence.nix

@@ -0,0 +1,28 @@
+# Impermanence: declares what should survive a wipe of "/".
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+
+    directories = [
+      "/etc/NetworkManager/system-connections" # Wifi connections, VPN
+      "/var/lib/bluetooth" # Bluetooth connections
+      "/var/lib/nixos" # keeps uid/gid stable across boots
+      "/var/lib/systemd/coredump"
+      "/var/lib/upower" # battery calibration state
+      "/var/lib/systemd/backlight" # remembers screen brightness
+      "/var/lib/systemd/timers" # last-run timestamps (e.g. nix gc weekly)
+      "/var/log"
+      "/var/cache/tuigreet"
+      "/var/db/sudo/lectured" # remembers that the sudo lecture was already shown
+    ];
+
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/var/lib/systemd/random-seed" # avoid a weak entropy pool on first boot
+    ];
+  };
+}

hosts/work/secrets/default.nix

@@ -0,0 +1,38 @@
+# Those are my secrets, encrypted with sops
+# You shouldn't import this file, unless you edit it
+{
+  pkgs,
+  config,
+  ...
+}: let
+  username = config.var.username;
+  home = "/home/${username}";
+in {
+  sops = {
+    age.keyFile = "${home}/.config/sops/age/keys.txt";
+    defaultSopsFile = ./secrets.yaml;
+    secrets = {
+      ssh-config = {
+        owner = username;
+        path = "${home}/.ssh/config";
+      };
+      netrc = {
+        owner = username;
+        path = "${home}/.netrc";
+      };
+      ssh-github-key = {
+        owner = username;
+        path = "${home}/.ssh/github";
+      };
+      ssh-gitlab-key = {
+        owner = username;
+        path = "${home}/.ssh/gitlab";
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    sops
+    age
+  ];
+}

hosts/work/secrets/secrets.yaml

@@ -0,0 +1,19 @@
+ssh-config: ENC[AES256_GCM,data:yTlt8SYPiON8aabbpQ9fE02hvp/u4oDmLaLuADzdOGdAL12MNe1QnNCND3lQ/nT+uxwm8k7OxExBfc70osLPjiq/CjNk1NOaO1nmBOXZqugnf33dF19P8SCMT2KtZTI1tYU2Kd5GmwpnozU6Qh0uJH+0ebR2tQnLChl16ap9fc6rg3AbD+XknSJ3+TndgZPBy4mN/MzT/GFL2kBDbYCmLoMXWDKxCM6ta1NvLRD8W7EBMeh/CNfkU+cw1kPjgPudDBP047VFudnqiueEAAigk3imqPyDFE1Jz4ouvVuLQz/f1BWnyZon3+sgHESAMRtAP3Lt7zo3s4PTJ04ohB4gk6K2fGBsFdyaWJp4uR8FMOhXrwG813KI,iv:W6bcO9ElLJ7YvN6PenqWNQnNSLi2WxZsjBc/adKdjeg=,tag:zKdx+RFXiOKpsY8EOGs46g==,type:str]
+netrc: ENC[AES256_GCM,data:dlfPJqzz7EZ5JHBmQr7imMDlQv9KFfzDKY6YywtPWR7re7z9jBFgMoaPRk62ocCVltofak6Zrsr3on1jPrrpMwk4DQYFSnQ5tvUTi/1LJWpf9GgjokC5nqc=,iv:se1ysRyzZmB6MjU4heFrDLHe2bv8Ml2iLC4MuIcQW9Y=,tag:oyu8wfR+9hvOuKmsk2sDXw==,type:str]
+ssh-github-key: ENC[AES256_GCM,data:BHBivx2D8RJaIHOagisu/OKm+M/Qpxsy8Dxsq4B8VyJukUdHN443DR2ikhTM0cm9twOnrGxLex67WiMASoYLfwy/j2frdBgJqJmGxER3INa1avKZWMlw4sX/xgBmes37enbraeSWdejg00vbhD1iVqH4IAGW0yleUaKJ1Q/0nydTjEcTow9rUUAJMlplq2ABFK2FKSMh0+DN9VSxcl2eRBQFz90OntWPavdXH5wY1256d7W3Oas8ZuNw1orWBFHUbMWaKR2aZSOC9OrxJgMNtM1cs3D4IyZoUzV/E7nymrXfRGxySdZ1ehx6HbfUchTKo1Z90mrhxTfrOWqwRFysVQRtsR3gu4pMdbimucTRyltKYMfM3oEVWo+DgC+/uR27UVj3rCMGglq657dbenY7A50oF4jSaRI8eTQ8K0tKPz2p7clCMBoCMLKanG7i3Qz5AH61xCXbdR5dv8B0JZOmQFuWnl74pJAhZnkjHb0H7ZYRhAA2YU/qbe0rQseFMAYHA+8gczVzLaCNyloWHoEt5OBv05clCjT8wjaXJD6rE7SvfOGTCvvZfduUU9ZOP7QaAquW7y1tMMj5pJYzxKI8sVi0Z7j+iTHIviZ+CDVWYFoE9eXe+RiV3CxBdF6gXyB3+Fn7ccxBmEeH7u40W8FlokA+dcbOY/BJDeANQkoSZYspKmjjJQNnYRCkNht8h9+s7T8l34rjHmi65vdMxsORT3MQLh2CV99qLqS4F03AWAzwJTP5f7+l10Uy6RTSCCfJfDDl+2Yy/NhNT23GUIZqLh29y4/0AzGqjm5iETUd78VlKtX+zt6TAVuAzjuEGmKJWp4aYGfzRIlpGDFddkNfTQwJKaS1AuWLQLBd/tTtNRKLFt7tUL87lS2K0WJCa40YM8alDbJNflL02edK3AqqQ+r7hvYbeyAL6QbpcyI+XRs8rUsZUtvFmLR2vzQ09EDYxC64BNhNKLd9ewzcSjYCc5JbNLqdyOd1nnmyUf8LkWoDW+VKMVPQdn+qiRvhWshrGuj8R8E/Vh7PptBXxgCz9IG59ZiUbchnJ0XFtHgWrekzwSmUe1NtPUcHdZlZ8JL+hAkrR5qQ3SAotEXQ5EQ/VahtQAF7sEaSfY4WDDcV1G4Rdkt3niZv7LZri13X8G6JP+9ClbVTLIPm6XXJfRBfmYXzZ+ANuhQhAs1aZTnporIpVUQX2d00mZtOwDW4i23t6AGyPgeGAb6j7zYri4s7+DpubDcjKrFV61gCVhAWbldmdzzgA8Yw7jvNpuK7C47drUJhmDvLpc+aaszxL4jGjcmLmlz+TNY+Fu9AdAyahIxvo1MS+FIHv867g8Mg24cDyNqvO4AtY/3BRukVIVaTXboU8GSmhTk8LBeY/DS7tzAAuY3koytq7LnCSsq+WrCM04c2+4z2EkwcOehdVnKNhJoZMFt9JeL4uRnrZ82OtDNH5bxWgAMvyqhzxqhN7OU8uuKFlqx0YRU/yneJlq6cSur3+8TOrmq/T7iHgGahryqyghWrMa5WphgVpX54K/32CytlDefFThWV9eqNNYIaCs9lbXD/MnhcF8AudRtjkz080vsid9sc1osg7rj1QHaa1QAHaIjPcGbrRJUfb59H505eQuBCjNkQIDUGe9vWD31DT8JvGC/yFJfhiEiyv6uPGRs+QIdQJsWPL9t0MBrZxE1MQDIZq854769EGte56EgAfh6Xzb4+jPpko55GA5zRFg+dpM2tr5irzAQ7iYmNcjdxCHglJsmJZo1EhS2c/iZF/Y3VfB8icsVSidz7wRGPdIubaz3eB5oA4kbu+c0srQd/ryJe9pZos3NQQ1INoayRzIsxVOn5eMwZ/04HvUAvT0CcAWYmolPxy2qONL0WZCFcV1v901a6u2MevO/ixJG8UnQJElNpWFdAbAY3w0BNTM84PH3Lr3VIWXRn+xpzXEUlxxl98eh34UVky/X6OM+iF0w6Md/ReYIb5SWMvFg2bRG/ut60fbnZOO8dNa94IL3yTIlYJcPbVDjiXIUw1JNg4deIKWjl0oF/ipFdM9YvCRIclQRtgWM0AQXk3+DKTmZcBTgfAj+nEfmgmH3dSwPOyo8eF33oRDz9ohewuky7xqEIduk38NFLfCgC10FLdngrNZFJfKlD7TvR+pTKuNf8M2jsFCxRUjToZWWhirGXT4jhPnt/wkREXgaKSQsoFYjA14CMQ0c4bVIHJ+wJTnlQvfaUaw0wBXLvqXgNddgqeLF5tcLZ0j/K4DNG0KToZvNt5pHCQzjjJVAEncsPM6L9jnoy/OiHw8c3gsHdjwQG0PR2U4+3KWtQI4Wp284j9O9ZTRd3mkAMedkv6w3d8OC6EIujk42Kcm88A28vXx3/wfFiH++SLQXhxIgBXhXq+gZaR4sKHq4V595MwV3evcISaPjrPi5XvEsRVfaL3abxAtguva8NSQCdTArg5bopE5ULj5BijKoLqbORZ3A/ADoivk2iAdmRHJXBsyh2Jm4S2LjBDjo/p6votZAneIl5hg+4uGVKlC+DxdWkjLC5u3rE7hhag2PEnoZC6EvJVhDtUNU5GAqv9VWbzlyqFjBiE9ATelcAmpsZulm7h+eprnCMXJ804WnYzinKikTQxH7QqK10Iskf3WnUb+7AoTw1SPNN0nbOYOefU/p0PCQJqhcxldfOUTBgUv/kpMqqFxUITO29ciPxiEKwDHjNR9z95I4IAMtjGf/EU6Dk82gMFfhJTUcPp6Vf5v7gLMT2ju71u1L7vXCOUiUbJlO74c8703kgkRkx6HLh9wj0b1d1gHs9ganB9ZiOC600xysQkbObkjHnH5dEbBnA+2StdIRVPwiOiZV0BZ0DCzMy6xSAGiY9ZAclKLbcuanIO4I/2fXXGZoP7jGeHSOg9GHqUVnELcl5ylFCXYuXtEHY2EeQutoOiL5CuRmbSwmKYeF7ThGiTOPGhKlfzwOxEH8V1jNPJ1gQtVdJAqMK09b2RirGeFgwZ93qMaJ7yfYbWWZlbaUjgCS1WY9qZyQ2uk5ycNZ8emInadCCgTlQfC6zRPBpdkzS2ogbUn/plHg6lsq0D3oVtWizQRtfUCtdIGX/wiEzZfud3w01VMrDD9/PdcvXTO5/xptYiCVm90tMtvdWhibrY/X+Ay8XXkZbVbHYLrwMYHpqzCaBBjuFbBjONQlQ2lffoNbWoBRCoMsZJQuH7QSCmRkEN6W/KFBehdoNOB+ibGCXGY6zbBtN8LNNDrnmMcZb3qg7lZoDz67G2JfMG6Eh1DBvXtfD7ksoNP+5N44DOfsQzoeh8w9hKEliHgMTTv66zFRSXur6ewN1isnI4UVkKWJ0H4h2Eq1SvlSHlk64uHT0P3FUM38WDYedXUQAAq5R97vbSlcpLKcdkw41cQQhv4C2g34GasirjLPLHHpUYujqTE35xgzYMKsFjN6k9YvzZBqTyUsDFDbN/cpD/4YSoEaW4bi+Wnb0VTkSQIEZdu8zsn0V2eJ9hKzq/EPwYVVieqXqOvGVlkWfwMIG070Ln/kNZKT6HqnUamJJ0T9T5ChYo4v2aIWLfhK1s58katmVMKvkOTT39notLu7bhOsU4uqs+ygjrCYqGuhf+OyLRXK61ejzbFMSn/lipInydGJ4MATs7S60y4ulXmZQ/wZ2roq1I7QuI7miTuF+6kkmYdgsGzF06uNnfr6hByxDYwGO2dQBFrLEO/mM8uzS0FICX1oGpxYiayjgXF1ktSmurQB9b+8iSCXbeLnJiyenXHhzYP0tRqEThsHGoQ1LC5hIBW3pITDk5Y9eU/S9v9/4FbKGdW2ziffvNUsTn1GKAsjjvk5xrs6e44FyPCSgUskF/EW2qoZ8govTfSzHonQOUsJlvxBBwecKHSLjjsq6lFJKxN/SPegPU++ZIaGmqdoQz4CIGP297yryVeIzopmL1RiB7guWkGmY3pOZOvdoQIybcgmnKLOW4JitaoQfSgaKfXJAAm1/HufxbEZIMpK7GdEHwKHU2NfhNW+du+R7MSCZHpk3aroqlYT4dnpR7jpc2/rwCcRHyUwhCzjNGXdPEXR4tYcf8iLgQUhKe1pygCMzzxptscDY5SYPgSSIKhWGJKpP4DSBBEshnIz1o4GlaFsD1c2z5/rBGX/Yia5bnAZ6vsRmxr9dLUTX5O67+ks77/nHatR43Q+PN9rtguW/aj3rSIdie4qcmGsAx4n8XiYRZ6mh+NnUcAWPl+N87+XByj0Yj7cnXGTgPqbQW6eHxT0oDIZL3xx6LYubyEgWBs1bk4hGSDSKmP9X7RFD9IAuzIZb0JJ3Gs+dBGT1IJ+ssir5uctPPikV9i5ngKJAmjROZznrBwyHX0YkGFywWPerGl1R3sdIz+8ThZDOq/vIkJLQ3z4ouk9/a5P7qjeVAi7zbG4JMArVeuamZvHrnopxIhSfaKdWmLhVZFj61Lgwy6/EZYeE1M5vesvvPnJV80PnW4qIh9FxJ6cALpYPLtKXnaVpX/yp9N4jyiESA3WKe+kBmEx51rFicXOK7nM7T89JPaZvh87roaOg2ZW+3yVSfca7+9wNVfhVbrRX7+7YR7K7RFD41UZzf8w=,iv:5cm0p7HkV3vY1I54eH63TcpJAh5dyCxhu73motjwjg4=,tag:dp0LqYOonv0F0Nx0Acjlug==,type:str]
+ssh-gitlab-key: ENC[AES256_GCM,data:TvbxkmVE5mhbCyp//CPNFjQPUQfyMfDjqoGDjVY+4pWJ4pUyuEeF2Fi3x8pSnytprtv2sKa+TI7SCQ7zFi3UMXLrz7NI97jDX1tSMfN/FICz2bT1YAsblR1wRhINvqcVguVL6qz37ICNklf7IU7tcvLD8GMQY2fbnBWCmn5ORbol0Za7J7i5Ycf/rdyPPBw2acJ+0sDhx0Qv0GBlYIPlZXiv9KUJlUP0o3lG3aYTWY1WmDjnSEPNBtUidceDgnhH42shZO/5oXEUVy+CVjGM79Z1nqsBodwsJyAaMGXU+nSAXdtKXk5mAq+AMSQn+jFf1BE2Q/LC/5HHs4Inmioimu+Xc2DkqK1LixtHcD63lrJH0CGM/dzwYHC5EUIQ/bz7H8IPam9Ckk0GUR34Hdy3MPRe5f8eyVT15uxx+qK5xI/00yqw8ExFQ2c1wnQJb21Q32BraQYUqgk9Qr0VWkQMERWxrUebc5J3Blu70sv1KwSpiJKGoqu9PdjwAqQe6kJMl0umOEtfCJ0rshUIWN7UVBTbZaafD13CfZI5ugqA8Wrpb0JOqtgTQTGuhDQbF/Eq/DQ4I0Df1I7BdITLmS40/G30mR/OmfksKGUBi5bMW2PKJeBTv983F9FEBr7d8+x0+v23oGnrHMghjSMYUT3kTz2FtES8fUDSsD3FHs8GffT/9qAb0mEUqUQYkg4RhDiZByXDIwpeipw9asfhFgCoSmERBygRr7anAI3XO3TOONqu2dcDg4+uoa5cBykKX7tIJXRGjdCeeEtLRL4t8YWMYxbyycS2apOM7kspjosXAWNMIxLlJ1TbQd7DMiIV1RnmqLIRXLExcLpQCGR36vJFB2Izlde5zea44+X3GZy0jH4JqjgMwdvnpbM2qaJgSf4ejAfg4t9XcCIh26iZ6wNziGH9BVloBKe0XAZ46W1YSNAfmPIVVgspA9LNZToqPYZGAajpvPc2a3JgHjoFVDW6F/tGrr+3reBRaoaksVmDy/RO5hkJjLVdvs9g53QJz5+okQNB1uSw++6m7WrYz69G1b2A9DgZhL7EpwiLPmRYKg/Lj/mEZMoLWeW6tIPmOQpakf4d1y143g+oPCSkuMWZmCV5aIX53HmRtsGu/v+SMhnj1fhPny9iRNF8JgIX12ldUAkEwfPQBWhu/1Z++hWzClRNbxp6slaM76wRsl5aHgrq+63hDkWB81ujglyHV0Gz0DAQ5AehPKD1W9ejVLa/O7EPqNpNhI13Y0hjvWoKdnagZYVptvrznLLyGsPnQREoJhnJg62qPn0p+XN21t1eWBqY+LFsGw8t2kM5YLfU8bT/vVZdGspH63A/v4bUmq9pJlyIpJUnwEVX1Ui45v/HOrM3kDSEdY8pmysLBPIvdoK1RMbCvGcz2FmbPJouho4+dztKbcOVHVhCtSJp9HGLhzcv4gjUt5Bv/2q1HvImVZtDwhpaao11j6AAW0ZFdg0ZaftD9ux5tmchDrM5bbMnVKzvvQZDpM9Bi0nJoBZLGq90tioydkxpBNDcIWkzy9j3muUBhbpqxP3mRdtxNSq53u6yNMg25cR6eC393HIaPORK8QVs7xzwPtq5LuI0o9KS+AtO2OHTAvogU0joDY0TYyoRjgD21m6a4u8bSYkRlMCs/qIUgmNpIH4BEFDBVZ61sM+YJq6LvlX8XbPzT2aABoirpTxM/oQ/74r0I7gUo+Vj1dBmOulCN3yvbXrLbFbRCw24V0XRgFamlk6lt8iL9EsrXh7E5adrPCWOZ3L8v1NE4mW/MsKU4OILXF8CWSL1pPhJ0dnUhQbrAGfd10lExFu54kUEFQnRDPu0gn4syESrmtH+3oUpBd10QmlnarKh7vaeNOMJEtry94KxGDpGkJBnkaC7S8+SIegQAb58J0Gy8/JbX0VbuUozPd1uCdPPfNrCeL4XnYUUkYen8Uj1J4mFvs1gkq8weuQtx6WI5X5i68rWnEPqiihjGPbNxAnZUCml8qD+gJFW0zzRr79Mml+0dqO57rpdzpANyN9llqQeoscMKJrshZBfMEM57/1f73CB9VrlNMVZ2KS5aX8OPw3BrsLEDTNBp03jeqjbPQugeH07K575fiADNFEyLr5k1cwfd6OiKH0t779Vl/SEq/e3GxTDLFNT29deOm6m+8vLnvd1lNCeWdYUAtJGRdFd6tYm16wVxaTyfz6Uv9KzJt0bC5Jp0zAESh0n/hmh67TZNRMCGXS4nIsn+MD8udyfGQXqgIC25uKpyKvuk5eho0OCf2UujYefsUqYShjPOEtJDP9pI8zmyksXXRuQOTjougLykiq9kJeA97FQ02nR06AheERxeA4IQDNYsSndcNGV8aPqzjxWc05kL5D+7QSfs+uYTHb/6ZuwNlY18ofwH3yZkXgtSY14vLU2QajYC+mAaBcQsWCu+RVR1jL0JRt26ael1H7w08lT34V8ThcZmCFsHHHvhbgiMK1Ixk65wmviqzHqtZkVq8S4JAoau6SnlmIv4ukZ0iNjlnDlgXSvwp/oRJsTE9R2rC2wWaWZ5yhjEwr83aEMP367hGDfQVltu+VUqHW9ejfEBs5S2emXtXl8MJZpDFnJI0dG+XqXVsS6a4OUYfWVlD5KrZHBQ240dNyOBOYmAkAur/gMLvbw7LND5gVFaJObL2+vBEy9bKhhKzAITpVXdsdxlz29V7VR6B1AnC9HUViBgrX4E1b6Nka5LHgMkvxtSmiLnmiu/XVpuRLwrYpqh8gFxDTr+RsJv5TzGHz3ZidTtmqTW0XcOc7lVYyFDEbpDu8PjUrRf7UPKkmBmdv89pE+xzSr+pUgftUlaie1LnLxIiBAHjFbZ0K8sZi2o/zzz8mFb9tHXQY0QyO9d47iEJWb1O4uzYpDrU6nIMbIccZfCa4LEQf3AJGgWxw+vszS7Y4V+ABvn8MYbq0aHkr16C0xttXbcQRXKmXqhlFJ5TyPlPxIswBAppJDiRtiUtQv68eME/LeOaxcAeAEHE96PZrYbIYP27HCqgg3xmna+DcjDs/208BTboQ8XtW+Rl6IldXfMuPmB9B1bI7Zy2JVNpriwUBAAi7gWPX6oynIPqGWmIjwgypI2ByhK6TFzMkA9ID5OHR1j49FtKLa/cmMaY6pR0CG9OYwn7MKWKL9iuhcnQOBInOH7FWk086huQFqphSv/pYoU0eP04+GZuEprK9E5wGgOENtdQqexUkT288OZUWgkPwxtPXw/2Hl2PfEMzBPEN/KxyvruWUC17KC9VvfVOaxcA8vxRe4/QNKlkZ26nnz9vhPABHVxjVlw/F4XVgrx0+s6NbKPMjHaFyQaZ7DmwjjOQLhYWTY5/pfNNLShoJ6XyRhvGEkI9FFXVrFJq9j8w38f7yzb3TuT/bP8MYX8jwr22jMLKLeCgPFwhvEpBwyh3PvQoCQZeejnSiXs3rRxtyTC108LM5R/tNdZA6ykWlQYbAxxE0NZs/U+fu+TuJzM+mt84EzffNX9bx+vISkNL35ra5sioMK9ENIISSBAFm3VU3EcmfLfriETdU6bmsYWePwcbxhr/Ad8qjIkg5+h0dML0l9MUkb2AKGMRD6THBeWD5FvSBCupIpC4Qg5M1P9ZihwfpqOzQNSQN81yIMM3JxZa80QKj6ei9bH4an+K7KhQQT/t/kEH5LW+MjrnxqZeHBwcvrZHqiLELg8+b0vsdwolUTshTGhyVD+JqveG3uvHor+fsJ08ZmVsR99Wnj4piFJ1r7V5DxZi49V2SOTLKayZZm59j5z9QE43R68gQ3/EwsGo2qTOZw1KZWajbGaJ1vFaROA/Lywsy64n5nuyY6RMq9wkT2yozAb6185qdLS8j3jebX+282/kV7AtDxOEv2eoY2AFBeOpJVIEgu5XHg9H3obE0LW5hMzETCeEhTGLWBoiWDmVM4K0WnFhfcNeWmRfT1ggN+i8Tj5kd8BiisCgfMesMUQfWbSWPfJQY2xEY7iPqUzhlv1XiCkfqshpdYiOHrXJbjDj3zt5HId1JuwBusiDydnLCW7UJHo3zWMVUAXZZOe3FS19kWrYvQtC7hPixcKIIOv6BrGMGPAC9pkfLbNZY2oEcuiHHuk2QDDitD68TQLZvK3pKmn7D6f8jM52t/PAoeIzvoba7ciCxsHytpctmdb5zbf+eAvO21LNbeMlsQ8G7I2btPLmbNAb/qWgJpqrdgy8Fb9Cl9h/b9U7kf92ExhD38a0zG/9pVdX/g1GMXm6xvLku9HsGj414WrQOaEpg6FmKo7Ck7YbWa/QUF/FqMCNXPpUpmF7IYBiMEOl4++bm7s0lc1dRXJq8k4Nc191Io+gmc4kzcQLmMMlBuBNk5lfHAIG9tH5kNKS7U0UO10LKKepXMTv6Pu/KCGmhDtDCf33fzjyBSomuoqQ0q3xzCXjKziz5ky5j0sueAemJrfD2oDvKKHC3HD+z1+peYRarXwlUQ4BzWjNOjYs1A//iqFG/ksnr+PnUHTCebYECoacDAvtQx,iv:h87uW6VOwRubj19DKxEoddRN5/2v+vmKlBxfZnGjY70=,tag:SV17QrAMwJb0QWOXRbPdnw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArNU91bTk5MFRLNGJESUxO
+            ZW9GYlpuYzVaZmdyTkYya09uRG51K1Q4UzA4ClA0ZTFVSnZFRHByT2VGRC91U25N
+            QlJ1ZVV6bkwwTFRWeGtBY3lBVWhHbjQKLS0tIExmaDE1KytoT3lIOW9FVHFISFZ3
+            anB1dCt2T00rYkZVc3QrbkthSktUNDAKY7msNeSNYxiJztgEyW1U9LwVnF502Jwi
+            TixdX6ZGcXx7oTQxjJ/Z+7+NL0t4ixQClApfnfnqk4877a6igcMFHw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1c8pawdsxptfslgrz2c56s39mrtnjzc5mm3hfzgr2wdwu2v6vfsdsupjsq6
+    lastmodified: "2026-08-17T08:40:00Z"
+    mac: ENC[AES256_GCM,data:+64rZq6qYUkRoLw9sqzdv+AS69kFTKs+9R+8pTjH1Ys3osJHl/k/ELvK/Gapm6I2Gi/H3LxqcQTGKCJPqmcqI1EckIQdK+4rd4rqs/X9BTo1MRkBTGNYmYfefOGcrVOZiaUwzlD+Q8j2+NNrzH0WlEXPXDOLktZQPjWEZCnpCs0=,iv:SdOoOwtWoB8yFvKLEh0wa5pcxAM57aI15nynpv9Pb4A=,tag:svIf5dz0xSXT8RrCoB6QNw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

hosts/work/usbguard.nix

@@ -0,0 +1,21 @@
+# USBGuard:
+# The following line allow all USB devices until a proper policy is configured.
+# Run `sudo usbguard generate-policy` with your devices plugged in,
+# then set rules = "<output>" and switch implicitPolicyTarget to "block".
+# services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
+{
+  services.usbguard = {
+    enable = true;
+    implicitPolicyTarget = "block";
+    IPCAllowedUsers = [
+      "root"
+    ];
+    rules = ''
+      allow id 1d6b:0002 serial "0000:00:14.0" name "xHCI Host Controller" hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
+      allow id 1d6b:0003 serial "0000:00:14.0" name "xHCI Host Controller" hash "prM+Jby/bFHCn2lNjQdAMbgc6tse3xVx+hZwjOPHSdQ=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
+      allow id 17ef:6190 serial "" name "Lenovo Calliope USB Keyboard G2" hash "CfZ9R/aoXGm7BN/ojVEzKQwVoxCUtRWMuACrE7BL/5Y=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "1-10" with-interface { 03:01:01 03:00:00 } with-connect-type "hotplug"
+      allow id 0781:5581 name " SanDisk 3.2Gen1"
+      allow id 17ef:608d name "Lenovo USB Optical Mouse"
+    '';
+  };
+}

hosts/work/variables.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  ...
+}: {
+  imports = [
+    # Choose your theme here:
+    ../../themes/nixy.nix
+  ];
+
+  config.var = {
+    hostname = "h-work";
+    username = "hadrien";
+    configDirectory = "/home/" + config.var.username + "/.config/nixos"; # The path of the nixos configuration directory
+
+    keyboardLayout = "fr";
+
+    timeZone = "Europe/Paris";
+    defaultLocale = "en_US.UTF-8";
+    extraLocale = "fr_FR.UTF-8";
+
+    git = {
+      username = "Hadi";
+      email = "hadi@example.fr";
+    };
+
+    autoUpgrade = false;
+    autoGarbageCollector = true;
+  };
+
+  # DON'T TOUCH THIS
+  options = {
+    var = lib.mkOption {
+      type = lib.types.attrs;
+      default = {};
+    };
+  };
+}