Move to a secure greeter

configuration.nix

@@ -72,7 +72,7 @@ in
       enable = true;
 
       # Create a `docker` alias for podman, to use it as a drop-in replacement
-      dockerCompat = true;
+      dockerCompat = false;
 
       # Required for containers under podman-compose to be able to talk to each other.
       defaultNetwork.settings.dns_enabled = true;
@@ -82,6 +82,8 @@ in
   # Configure console keymap
   console.keyMap = "de-latin1";
 
+  virtualisation.docker.enable = true;
+
   environment.systemPackages = with pkgs; [
     wget
     strongswan
@@ -89,6 +91,7 @@ in
     dive
     podman-tui
     podman-compose
+    docker-compose
     gmp
     gmp.dev
     pkg-config
@@ -109,6 +112,7 @@ in
       appimage-run
       libgcrypt
       libxcrypt
+      rclone
     ];
   };
 

desktop-environment/config.nix

@@ -1,49 +1,52 @@
 { pkgs, ... }:
 let
-    profile = import ../profile.nix;
+  profile = import ../profile.nix;
 in
 {
 
-    imports  = [
+  imports = [
-        ./browser.nix
+    ./browser.nix
-        ./planner.nix
+    ./planner.nix
-        ./window-manager.nix
+    ./window-manager.nix
-        ../applications/matrix.nix
+    ../applications/matrix.nix
-    ];
+  ];
 
-    environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; [
-        kitty
+    kitty
-        pamixer
+    pamixer
-        nemo-with-extensions
+    nemo-with-extensions
-    ];
+  ];
 
-    services.dbus.enable = true;
+  services.dbus.enable = true;
-    programs.dconf.enable = true;
+  programs.dconf.enable = true;
-    hardware.graphics.enable = true;
+  hardware.graphics.enable = true;
 
-    services.greetd = {
+  programs.regreet = {
-      enable = true;
+    enable = true;
-      settings = {
+  };
-        default_session = {
+
-          command = "Hyprland";
+  services.greetd = {
-          user = profile.username;
+    enable = true;
-        };
+    settings = {
+      default_session = {
+        command = "${pkgs.cage}/bin/cage -s -- ${pkgs.regreet}/bin/regreet";
       };
     };
+  };
 
-    xdg.portal = {
+  xdg.portal = {
-        enable = true;
+    enable = true;
-        extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
+    extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
-    };
+  };
 
-    hardware.nvidia = {
+  hardware.nvidia = {
-      modesetting.enable = true;
+    modesetting.enable = true;
-      powerManagement.enable = false;
+    powerManagement.enable = false;
-      open = false;
+    open = false;
-    };
+  };
 
-    systemd.targets.sleep.enable = false;
+  systemd.targets.sleep.enable = false;
-    systemd.targets.suspend.enable = false;
+  systemd.targets.suspend.enable = false;
-    systemd.targets.hibernate.enable = false;
+  systemd.targets.hibernate.enable = false;
-    systemd.targets.hybrid-sleep.enable = false;
+  systemd.targets.hybrid-sleep.enable = false;
 }

system-environment/config.nix

@@ -1,46 +1,48 @@
 { pkgs, lib, ... }:
 let
-    profile = import ../profile.nix;
+  profile = import ../profile.nix;
 in
 {
 
-    imports = [
+  imports = [
-        ./file-system.nix
+    ./file-system.nix
-        ./media.nix
+    ./media.nix
-        ./security/keyring.nix
+    ./security/keyring.nix
-    ];
+    ./printer.nix
+  ];
 
-    environment.systemPackages = with pkgs; [
+  environment.systemPackages =
-        gnumake
+    with pkgs;
-        python3
+    [
+      gnumake
+      python3
     ]
     ++ lib.optionals profile.modules.development [
-        cmake
+      cmake
-        cmakeCurses
+      cmakeCurses
 
-        # C/C++/Fortran tools
+      # C/C++/Fortran tools
-        gcc
+      gcc
-        clang
+      clang
 
-        # Common C based dependencies
+      # Common C based dependencies
-        eigen
+      eigen
 
-        # Ada/+Spark & Rust tools
+      # Ada/+Spark & Rust tools
-        alire
+      alire
-        gnat15
+      gnat15
-        gnat15Packages.gprbuild
+      gnat15Packages.gprbuild
-        gnat15Packages.gpr2
+      gnat15Packages.gpr2
-        gnat15Packages.gnatprove
+      gnat15Packages.gnatprove
-        gnat15Packages.gnatcoll-core
+      gnat15Packages.gnatcoll-core
-        gnat15Packages.gnatcoll-readline
+      gnat15Packages.gnatcoll-readline
-        gnat15Packages.gnatcoll-python3
+      gnat15Packages.gnatcoll-python3
-        gnat15Packages.gnatcoll-gmp
+      gnat15Packages.gnatcoll-gmp
-        rustc
+      rustc
-        cargo
+      cargo
     ];
 
-    environment.variables = {
+  environment.variables = {
-    };
+  };
-
 
 }

system-environment/printer.nix

@@ -0,0 +1,185 @@
+# Optional stuff to add to profile:
+#   add your user to scanner/lp groups if needed:
+#   users.users.<name>.extraGroups = [ "scanner" "lp" ];
+
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  ##########################################################################
+  # Printing
+  ##########################################################################
+
+  services.printing = {
+    enable = true;
+
+    # Driver collection
+    drivers = with pkgs; [
+      gutenprint
+      hplip
+      brlaser
+
+      # Canon inkjet support
+      cnijfilter2
+
+      # Generic IPP/AirPrint support
+      cups-filters
+    ];
+
+    # Network printer discovery
+    browsing = true;
+    defaultShared = false;
+
+    listenAddresses = [ "*:631" ];
+    allowFrom = [ "all" ];
+  };
+
+  # Avahi/mDNS for automatic printer discovery
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+
+    publish = {
+      enable = true;
+      userServices = true;
+    };
+  };
+
+  # Scanner discovery over network
+  hardware.sane = {
+    enable = true;
+
+    extraBackends = with pkgs; [
+      sane-airscan
+      brscan4
+      epson-escpr
+    ];
+  };
+
+  # Enable sane daemon
+  services.saned.enable = true;
+
+  # Some Brother scanners need this
+  environment.etc."sane.d/dll.d/brother".text = ''
+    brother4
+  '';
+
+  ##########################################################################
+  # OCR / PDF / Document Processing
+  ##########################################################################
+
+  environment.systemPackages = with pkgs; [
+
+    ######################################################################
+    # Printing / scanning GUI tools
+    ######################################################################
+
+    system-config-printer
+    simple-scan
+    xsane
+    sane-airscan
+
+    ######################################################################
+    # OCR
+    ######################################################################
+
+    tesseract
+    tesseract4
+    ocrmypdf
+
+    ######################################################################
+    # PDF tools
+    ######################################################################
+
+    poppler-utils
+    pdftk
+    qpdf
+    pdfcpu
+    mupdf
+
+    ######################################################################
+    # Image processing
+    ######################################################################
+
+    graphicsmagick
+
+    ######################################################################
+    # EPUB / HTML / Markdown / TeX conversions
+    ######################################################################
+
+    pandoc
+
+    ######################################################################
+    # Extra document tooling
+    ######################################################################
+
+    ghostscript
+    djvulibre
+    unoconv
+
+    ######################################################################
+    # CLI helpers
+    ######################################################################
+
+    file
+    ripgrep
+    fd
+    jq
+  ];
+
+  ##########################################################################
+  # Firewall
+  ##########################################################################
+
+  networking.firewall.allowedTCPPorts = [
+    631 # CUPS / IPP
+  ];
+
+  networking.firewall.allowedUDPPorts = [
+    5353 # mDNS / Avahi
+  ];
+
+  ##########################################################################
+  # Helpful shell aliases
+  ##########################################################################
+
+  environment.shellAliases = {
+
+    # Find printers/scanners
+    printers = "lpstat -e";
+    scanner-find = "scanimage -L";
+
+    # OCR examples
+    ocr-pdf = "ocrmypdf";
+    ocr-img = "tesseract";
+
+    # Convert markdown -> pdf
+    md2pdf = "pandoc -o output.pdf";
+
+    # Convert epub -> pdf
+    epub2pdf = "ebook-convert";
+
+    # Convert pdf -> text
+    pdf2txt = "pdftotext";
+
+    # Scan one page
+    scan-one = ''
+      scanimage --format=png > scan.png
+    '';
+
+    # Continuous scans until CTRL+C
+    scan-loop = ''
+      while true; do
+        TS=$(date +%s)
+        scanimage --format=png > scan-$TS.png
+        echo "scanned: scan-$TS.png"
+        sleep 1
+      done
+    '';
+  };
+}

terminal-environment/config.nix

@@ -12,7 +12,6 @@ in
     environment.systemPackages = with pkgs; [
         astyle
         hyfetch
-        fzf-zsh
         distrobox
     ];