fix shell path

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>

README.md

@@ -33,6 +33,7 @@ _secrets_, and _custom theming_ all in one place.
 - 💻 Hyprland & TUIs: Preconfigured Hyprland ecosystem with a lot of cool TUIs
 - 🎨 Consistent Theming: Base16 & Stylix-powered themes
 - ⌨️ Vim-like Everywhere: Unified keybindings (Hyprland, nvim, vimium, etc.)
+- 🔒 Hardened by Default: LUKS encryption, sops-nix secrets, impermanence and more
 
 ## Table of Content
 

home/programs/gui/pkgs.nix

@@ -19,5 +19,6 @@
   home.persistence."/persist".directories = [
     ".config/ticktick"
     ".config/Signal"
+    ".config/obsidian"
   ];
 }

home/system/waybar/scripts.nix

@@ -7,7 +7,7 @@
     runtimeInputs = with pkgs; [procps coreutils];
     text = ''
       printf '%s' "$1" > /tmp/waybar-osd
-      pkill -x -RTMIN+8 waybar 2>/dev/null || true
+      pkill -f -RTMIN+8 '^waybar$' 2>/dev/null || true
     '';
   };
 

hosts/laptop/configuration.nix

@@ -29,6 +29,8 @@
 
   home-manager.users."${config.var.username}" = import ./home.nix;
 
+  users.users.${config.var.username}.hashedPassword = "$y$j9T$A7gH534UczuBxulj9IfEu1$ImRy3lpYpemRWNVIkA7efKPWXneFiqhZnEF1aMkWcD8"; # CHANGEME: This is my password
+
   # Don't touch this
   system.stateVersion = "26.05";
 }

hosts/laptop/home.nix

@@ -64,7 +64,7 @@
 
       files = [
         ".ssh/known_hosts"
-        ".config/sops-nix/age/keys.txt"
+        ".config/sops/age/keys.txt"
       ];
     };
 

hosts/laptop/persistence.nix

@@ -1,5 +1,5 @@
 # Impermanence: declares what should survive a wipe of "/".
-{config, ...}: {
+{
   environment.persistence."/persist" = {
     hideMounts = true;
 
@@ -13,6 +13,7 @@
       "/var/lib/systemd/timers" # last-run timestamps (e.g. nix gc weekly)
       "/var/log"
       "/var/cache/tuigreet"
+      "/var/db/sudo/lectured" # remembers that the sudo lecture was already shown
     ];
 
     files = [
@@ -24,14 +25,4 @@
       "/var/lib/systemd/random-seed" # avoid a weak entropy pool on first boot
     ];
   };
-
-  # -- How to find what's missing --
-  # Use the system normally for a week or two, then look for files that
-  # changed recently outside of what's already declared above:
-  #   find "/home/${config.var.username}" -xdev -type f -mtime -14 \
-  #     -not -path '*/.cache/*' -not -path '*/Cache/*' | less
-  # Anything that keeps showing up there (app state, history files,
-  # game saves, browser profile, spotify/lazygit config, GPG state, etc.)
-  # is a candidate to add above. Do this *before* switching root to a
-  # wipeable filesystem, not after.
 }

hosts/laptop/secrets/default.nix

@@ -9,7 +9,7 @@
   home = "/home/${username}";
 in {
   sops = {
-    age.keyFile = "${home}/.config/sops-nix/age/keys.txt";
+    age.keyFile = "${home}/.config/sops/age/keys.txt";
     defaultSopsFile = ./secrets.yaml;
     secrets = {
       ssh-config = {

hosts/laptop/secrets/secrets.yaml

@@ -16,7 +16,7 @@ sops:
             FSfQWnjhe/a7BJtJEcKZkjOQU0mYqlSu+uT2RA9diCQeRUJPRF+nAw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age12yvtj49pfh3fqzqflscm0ek4yzrjhr6cqhn7x89gdxnlykq0xudq5c7334
-    lastmodified: "2026-08-13T18:02:38Z"
+    lastmodified: "2026-08-13T21:43:40Z"
-    mac: ENC[AES256_GCM,data:NXEE083Qakiy8OQKwRSX0hvbdwfjONNdL9hocIMfvPOY71wWYpS0HbD/qtPwv5VkHnyumAF7XwKEEOns1UeEULI03fYePq4tUphYTfyKh6UL1NL6WKUPXU/K0PHZrPIyo2CrvSSC0PeUc8ZbhjEeNbL16UELUJNtzZ6M/UbhqD0=,iv:kYFvQsnOqZLUshKiw1SuUFQ1MWOaN8TJgFZXmmAyYag=,tag:4+tFSVzJolcdhrF+pUfeZA==,type:str]
+    mac: ENC[AES256_GCM,data:aOONPIVt40AwHYs26+wJ9Sf50OkZ6mA+6r6nHIhnkpra1b/XmNISxjRICOn0F/ct7MUgzmg4GH6otSTFWo16ch/LqY1osDUA0HtmeJ/wVQ77IBZtSPNWaQnixcYUa+bu3PJApNdAG6BrLwGdnhBRRj9c0A6kPFqru/agcKNM3yg=,iv:f0oDpA3YIqseb/SSdnWjsVzClY/x+zzuRCDOuKRH33Y=,tag:Bam7vuGopRbjPCJ2YlTFGA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

hosts/laptop/wireguard.nix

@@ -5,8 +5,6 @@
 }: let
   vpnConnection = "wg-vpn";
 
-  # Same OSD mechanism as home/system/waybar/scripts.nix's waybar-osd: drop the
-  # text in /tmp/waybar-osd and nudge waybar's custom/osd module to show it.
   toggleVpn = pkgs.writeShellScript "toggle-wg-vpn" ''
     set -euo pipefail
     nmcli="${pkgs.networkmanager}/bin/nmcli"
@@ -20,7 +18,7 @@
     fi
 
     printf '%s' "$OSD_TEXT" > /tmp/waybar-osd
-    ${pkgs.procps}/bin/pkill -x -RTMIN+8 waybar 2>/dev/null || true
+    ${pkgs.procps}/bin/pkill -f -RTMIN+8 '^waybar$' 2>/dev/null || true
   '';
 in {
   environment.systemPackages = [

nixos/users.nix

@@ -17,9 +17,6 @@ in {
         "networkmanager"
         "wheel"
       ];
-      # CHANGEME: Set your password with: mkpasswd -m sha-512
-      # Or use initialPassword for first boot, then change it
-      initialPassword = "nixos";
     };
   };
 }

shell.nix

@@ -3,7 +3,7 @@
   gitHooksLib,
 }: let
   hooks = gitHooksLib.run {
-    src = ../.;
+    src = ./.;
     hooks = {
       inject-exec = {
         enable = true;