initial config

2026-04-20 15:08:47 +00:00
commit 8f4daf76b8
27 changed files with 1458 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,6 @@
+result
+result-*
+.direnv/
+*.qcow2
+secrets/
+.DS_Store
--- a/config/alacritty/alacritty.toml
+++ b/config/alacritty/alacritty.toml
@@ -0,0 +1,67 @@
+# ══════════════════════════════════════════
+# ALACRITTY CONFIGURATION — Gruvbox Dark
+# ══════════════════════════════════════════
+
+[window]
+padding = { x = 8, y = 8 }
+decorations = "None"
+opacity = 0.95
+dynamic_padding = true
+startup_mode = "Maximized"
+
+[font]
+size = 13.0
+
+[font.normal]
+family = "JetBrainsMono Nerd Font"
+style = "Regular"
+
+[font.bold]
+family = "JetBrainsMono Nerd Font"
+style = "Bold"
+
+[font.italic]
+family = "JetBrainsMono Nerd Font"
+style = "Italic"
+
+[scrolling]
+history = 10000
+multiplier = 3
+
+[selection]
+save_to_clipboard = true
+
+# ── Gruvbox Dark Hard ───────────────────
+[colors.primary]
+background = "#1d2021"
+foreground = "#ebdbb2"
+
+[colors.cursor]
+text = "#1d2021"
+cursor = "#ebdbb2"
+
+[colors.normal]
+black   = "#282828"
+red     = "#cc241d"
+green   = "#98971a"
+yellow  = "#d79921"
+blue    = "#458588"
+magenta = "#b16286"
+cyan    = "#689d6a"
+white   = "#a89984"
+
+[colors.bright]
+black   = "#928374"
+red     = "#fb4934"
+green   = "#b8bb26"
+yellow  = "#fabd2f"
+blue    = "#83a598"
+magenta = "#d3869b"
+cyan    = "#8ec07c"
+white   = "#ebdbb2"
+
+# ── Keyboard Bindings ───────────────────
+[[keyboard.bindings]]
+key = "N"
+mods = "Control|Shift"
+action = "CreateNewWindow"
--- a/config/hypr/hyprland.conf
+++ b/config/hypr/hyprland.conf
@@ -0,0 +1,233 @@
+# ══════════════════════════════════════════
+# HYPRLAND CONFIGURATION — Omarchy-style
+# ══════════════════════════════════════════
+# Keyboard-first. Consistent keybinds. Clean aesthetics.
+# Super is the main modifier (like omarchy).
+# ══════════════════════════════════════════
+
+# ── Monitors ─────────────────────────────
+# Adjust for your setup. "preferred" auto-detects.
+monitor = , preferred, auto, 1
+
+# ── Autostart ────────────────────────────
+exec-once = waybar
+exec-once = walker --gapplication-service
+exec-once = mako
+exec-once = wl-paste --type text --watch cliphist store
+exec-once = wl-paste --type image --watch cliphist store
+exec-once = wl-clip-persist --clipboard regular
+exec-once = nm-applet --indicator
+exec-once = blueman-applet
+exec-once = /usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1
+
+# ── General ──────────────────────────────
+general {
+    gaps_in = 4
+    gaps_out = 8
+    border_size = 2
+
+    # Gruvbox colors
+    col.active_border = rgba(d79921ff) rgba(b8bb26ff) 45deg
+    col.inactive_border = rgba(504945ff)
+
+    layout = dwindle
+    allow_tearing = false
+}
+
+# ── Decoration ───────────────────────────
+decoration {
+    rounding = 8
+
+    blur {
+        enabled = true
+        size = 6
+        passes = 2
+        new_optimizations = true
+        xray = false
+    }
+
+    shadow {
+        enabled = true
+        range = 12
+        render_power = 3
+        color = rgba(1d2021cc)
+    }
+}
+
+# ── Animations ───────────────────────────
+animations {
+    enabled = true
+    bezier = ease, 0.25, 0.1, 0.25, 1
+    bezier = overshot, 0.05, 0.9, 0.1, 1.1
+
+    animation = windows, 1, 4, overshot, slide
+    animation = windowsOut, 1, 4, ease, slide
+    animation = fade, 1, 4, ease
+    animation = workspaces, 1, 4, overshot, slidevert
+    animation = border, 1, 6, ease
+}
+
+# ── Layout ───────────────────────────────
+dwindle {
+    pseudotile = true
+    preserve_split = true
+    force_split = 2
+}
+
+master {
+    new_status = master
+}
+
+# ── Input ────────────────────────────────
+input {
+    kb_layout = us
+    kb_options = caps:escape
+
+    follow_mouse = 1
+    sensitivity = 0
+
+    touchpad {
+        natural_scroll = true
+        tap-to-click = true
+        drag_lock = true
+    }
+}
+
+gestures {
+    workspace_swipe = true
+    workspace_swipe_fingers = 3
+}
+
+# ── Misc ─────────────────────────────────
+misc {
+    disable_hyprland_logo = true
+    disable_splash_rendering = true
+    force_default_wallpaper = 0
+    vfr = true
+}
+
+
+# ══════════════════════════════════════════
+# KEYBINDINGS — Omarchy-inspired
+# ══════════════════════════════════════════
+# Super = main modifier
+# Super + Return = terminal
+# Super + Space  = app launcher
+# Super + Shift + Return = browser
+# Super + Q = close window
+# Super + K = show all keybinds (via walker)
+# ══════════════════════════════════════════
+
+$mod = SUPER
+
+# ── Core ─────────────────────────────────
+bind = $mod, Return, exec, alacritty
+bind = $mod SHIFT, Return, exec, firefox     # Change to helium if installed
+bind = $mod, Space, exec, walker
+bind = $mod, Q, killactive
+bind = $mod SHIFT, Q, exit
+bind = $mod, V, togglefloating
+bind = $mod, F, fullscreen
+bind = $mod, P, pseudo                       # dwindle pseudo-tile
+bind = $mod, J, togglesplit                  # dwindle toggle split direction
+
+# ── Applications ─────────────────────────
+bind = $mod, E, exec, nautilus               # File manager
+bind = $mod, B, exec, bitwarden              # Password manager
+bind = $mod SHIFT, S, exec, spotify
+bind = $mod, C, exec, cursor                 # Cursor IDE
+bind = $mod SHIFT, C, exec, code             # VS Code (antigravity)
+
+# ── Window Focus (vim keys) ──────────────
+bind = $mod, h, movefocus, l
+bind = $mod, l, movefocus, r
+bind = $mod, k, movefocus, u
+bind = $mod, j, movefocus, d
+
+# ── Window Move ──────────────────────────
+bind = $mod SHIFT, h, movewindow, l
+bind = $mod SHIFT, l, movewindow, r
+bind = $mod SHIFT, k, movewindow, u
+bind = $mod SHIFT, j, movewindow, d
+
+# ── Window Resize ────────────────────────
+binde = $mod CTRL, h, resizeactive, -40 0
+binde = $mod CTRL, l, resizeactive, 40 0
+binde = $mod CTRL, k, resizeactive, 0 -40
+binde = $mod CTRL, j, resizeactive, 0 40
+
+# ── Workspaces ───────────────────────────
+bind = $mod, 1, workspace, 1
+bind = $mod, 2, workspace, 2
+bind = $mod, 3, workspace, 3
+bind = $mod, 4, workspace, 4
+bind = $mod, 5, workspace, 5
+bind = $mod, 6, workspace, 6
+bind = $mod, 7, workspace, 7
+bind = $mod, 8, workspace, 8
+bind = $mod, 9, workspace, 9
+bind = $mod, 0, workspace, 10
+
+# Move window to workspace
+bind = $mod SHIFT, 1, movetoworkspace, 1
+bind = $mod SHIFT, 2, movetoworkspace, 2
+bind = $mod SHIFT, 3, movetoworkspace, 3
+bind = $mod SHIFT, 4, movetoworkspace, 4
+bind = $mod SHIFT, 5, movetoworkspace, 5
+bind = $mod SHIFT, 6, movetoworkspace, 6
+bind = $mod SHIFT, 7, movetoworkspace, 7
+bind = $mod SHIFT, 8, movetoworkspace, 8
+bind = $mod SHIFT, 9, movetoworkspace, 9
+bind = $mod SHIFT, 0, movetoworkspace, 10
+
+# Workspace navigation
+bind = $mod, Tab, workspace, e+1
+bind = $mod SHIFT, Tab, workspace, e-1
+
+# ── Special Workspace (Scratchpad) ───────
+bind = $mod, S, togglespecialworkspace, magic
+bind = $mod SHIFT, S, movetoworkspace, special:magic
+
+# ── Screenshots ──────────────────────────
+bind = , Print, exec, grim -g "$(slurp)" - | swappy -f -
+bind = $mod, Print, exec, grim - | swappy -f -
+
+# ── Media Keys ───────────────────────────
+bindel = , XF86AudioRaiseVolume, exec, swayosd-client --output-volume raise
+bindel = , XF86AudioLowerVolume, exec, swayosd-client --output-volume lower
+bindl  = , XF86AudioMute, exec, swayosd-client --output-volume mute-toggle
+bindl  = , XF86AudioMicMute, exec, swayosd-client --input-volume mute-toggle
+bindel = , XF86MonBrightnessUp, exec, swayosd-client --brightness raise
+bindel = , XF86MonBrightnessDown, exec, swayosd-client --brightness lower
+bindl  = , XF86AudioPlay, exec, playerctl play-pause
+bindl  = , XF86AudioNext, exec, playerctl next
+bindl  = , XF86AudioPrev, exec, playerctl previous
+
+# ── Clipboard History ────────────────────
+bind = $mod CTRL, V, exec, cliphist list | walker --dmenu | cliphist decode | wl-copy
+
+# ── Lock Screen ──────────────────────────
+bind = $mod CTRL, L, exec, hyprlock
+
+# ── Mouse Bindings ───────────────────────
+bindm = $mod, mouse:272, movewindow
+bindm = $mod, mouse:273, resizewindow
+
+# ── Window Rules ─────────────────────────
+windowrulev2 = float, class:^(pavucontrol)$
+windowrulev2 = float, class:^(blueman-manager)$
+windowrulev2 = float, class:^(nm-connection-editor)$
+windowrulev2 = float, class:^(bitwarden)$
+windowrulev2 = float, title:^(Picture-in-Picture)$
+windowrulev2 = pin, title:^(Picture-in-Picture)$
+
+# ── Environment Variables ────────────────
+env = XCURSOR_SIZE, 24
+env = QT_QPA_PLATFORMTHEME, qt5ct
+env = QT_QPA_PLATFORM, wayland
+env = GDK_BACKEND, wayland
+env = SDL_VIDEODRIVER, wayland
+env = CLUTTER_BACKEND, wayland
+env = XDG_CURRENT_DESKTOP, Hyprland
+env = XDG_SESSION_TYPE, wayland
+env = XDG_SESSION_DESKTOP, Hyprland
--- a/config/walker/config.toml
+++ b/config/walker/config.toml
@@ -0,0 +1,39 @@
+# ══════════════════════════════════════════
+# WALKER CONFIGURATION
+# ══════════════════════════════════════════
+# Wayland-native application launcher for Hyprland.
+# Activated with Super+Space.
+# ══════════════════════════════════════════
+
+[search]
+placeholder = "Search..."
+delay = 0
+
+[ui]
+fullscreen = false
+ignore_exclusive = false
+show_initial_entries = true
+
+[ui.anchors]
+top = true
+bottom = false
+left = true
+right = true
+
+# Gruvbox theme
+[theme.ui.window]
+box.margin_top = 200
+box.margin_bottom = 200
+box.margin_start = 300
+box.margin_end = 300
+
+# Modules — which sources to search
+[modules]
+applications.weight = 1
+runner.weight = 5
+websearch.weight = 10
+
+# Web search via DuckDuckGo
+[modules.websearch]
+prefix = "?"
+engines = ["duckduckgo"]
--- a/config/waybar/config.jsonc
+++ b/config/waybar/config.jsonc
@@ -0,0 +1,115 @@
+// ══════════════════════════════════════════
+// WAYBAR CONFIGURATION — Gruvbox Dark
+// ══════════════════════════════════════════
+{
+    "layer": "top",
+    "position": "top",
+    "height": 36,
+    "spacing": 4,
+    "margin-top": 4,
+    "margin-left": 8,
+    "margin-right": 8,
+
+    // Module layout
+    "modules-left": [
+        "hyprland/workspaces",
+        "hyprland/window"
+    ],
+    "modules-center": [
+        "clock"
+    ],
+    "modules-right": [
+        "tray",
+        "pulseaudio",
+        "network",
+        "bluetooth",
+        "battery",
+        "custom/power"
+    ],
+
+    // ── Workspaces ────────────────────────
+    "hyprland/workspaces": {
+        "format": "{icon}",
+        "format-icons": {
+            "1": "1",
+            "2": "2",
+            "3": "3",
+            "4": "4",
+            "5": "5",
+            "6": "6",
+            "7": "7",
+            "8": "8",
+            "9": "9",
+            "10": "0"
+        },
+        "on-click": "activate",
+        "sort-by-number": true,
+        "active-only": false
+    },
+
+    // ── Window Title ──────────────────────
+    "hyprland/window": {
+        "format": "{}",
+        "max-length": 40,
+        "separate-outputs": true
+    },
+
+    // ── Clock ─────────────────────────────
+    "clock": {
+        "format": "{:%H:%M}",
+        "format-alt": "{:%A, %B %d, %Y  %H:%M}",
+        "tooltip-format": "<tt><small>{calendar}</small></tt>"
+    },
+
+    // ── Audio ─────────────────────────────
+    "pulseaudio": {
+        "format": "{icon} {volume}%",
+        "format-muted": " muted",
+        "format-icons": {
+            "default": ["", "", ""]
+        },
+        "on-click": "pavucontrol"
+    },
+
+    // ── Network ───────────────────────────
+    "network": {
+        "format-wifi": " {signalStrength}%",
+        "format-ethernet": " {ipaddr}",
+        "format-disconnected": " off",
+        "tooltip-format-wifi": "{essid} ({signalStrength}%)\n{ipaddr}",
+        "on-click": "nm-connection-editor"
+    },
+
+    // ── Bluetooth ─────────────────────────
+    "bluetooth": {
+        "format": " {status}",
+        "format-connected": " {device_alias}",
+        "format-disabled": "",
+        "on-click": "blueman-manager"
+    },
+
+    // ── Battery ───────────────────────────
+    "battery": {
+        "states": {
+            "warning": 30,
+            "critical": 15
+        },
+        "format": "{icon} {capacity}%",
+        "format-charging": " {capacity}%",
+        "format-plugged": " {capacity}%",
+        "format-icons": ["", "", "", "", ""]
+    },
+
+    // ── System Tray ───────────────────────
+    "tray": {
+        "icon-size": 16,
+        "spacing": 8
+    },
+
+    // ── Power Button ──────────────────────
+    "custom/power": {
+        "format": "",
+        "on-click": "hyprlock",
+        "tooltip": false
+    }
+}
--- a/config/waybar/style.css
+++ b/config/waybar/style.css
@@ -0,0 +1,150 @@
+/* ══════════════════════════════════════════
+ * WAYBAR STYLES — Gruvbox Dark
+ * ══════════════════════════════════════════
+ * Gruvbox palette:
+ *   bg0_h  = #1d2021   (hardest dark)
+ *   bg0    = #282828   (dark background)
+ *   bg1    = #3c3836
+ *   bg2    = #504945
+ *   fg     = #ebdbb2   (light foreground)
+ *   yellow = #d79921
+ *   green  = #b8bb26
+ *   red    = #cc241d
+ *   aqua   = #689d6a
+ *   orange = #d65d0e
+ *   blue   = #458588
+ * ══════════════════════════════════════════ */
+
+* {
+    font-family: "JetBrainsMono Nerd Font", monospace;
+    font-size: 13px;
+    min-height: 0;
+    border: none;
+    border-radius: 0;
+}
+
+window#waybar {
+    background: rgba(29, 32, 33, 0.92);
+    color: #ebdbb2;
+    border-radius: 10px;
+}
+
+/* ── Module defaults ─────────────────── */
+#workspaces,
+#window,
+#clock,
+#pulseaudio,
+#network,
+#bluetooth,
+#battery,
+#tray,
+#custom-power {
+    padding: 0 10px;
+    margin: 4px 2px;
+    border-radius: 6px;
+    background: transparent;
+}
+
+/* ── Workspaces ──────────────────────── */
+#workspaces button {
+    color: #a89984;
+    padding: 0 6px;
+    margin: 2px;
+    border-radius: 4px;
+    background: transparent;
+    transition: all 0.2s ease;
+}
+
+#workspaces button.active {
+    color: #1d2021;
+    background: #d79921;
+    font-weight: bold;
+}
+
+#workspaces button:hover {
+    color: #ebdbb2;
+    background: #504945;
+}
+
+/* ── Window Title ────────────────────── */
+#window {
+    color: #a89984;
+    font-style: italic;
+}
+
+/* ── Clock ───────────────────────────── */
+#clock {
+    color: #ebdbb2;
+    font-weight: bold;
+}
+
+/* ── Audio ───────────────────────────── */
+#pulseaudio {
+    color: #b8bb26;
+}
+
+#pulseaudio.muted {
+    color: #928374;
+}
+
+/* ── Network ─────────────────────────── */
+#network {
+    color: #83a598;
+}
+
+#network.disconnected {
+    color: #cc241d;
+}
+
+/* ── Bluetooth ───────────────────────── */
+#bluetooth {
+    color: #458588;
+}
+
+/* ── Battery ─────────────────────────── */
+#battery {
+    color: #b8bb26;
+}
+
+#battery.charging {
+    color: #d79921;
+}
+
+#battery.warning:not(.charging) {
+    color: #d65d0e;
+}
+
+#battery.critical:not(.charging) {
+    color: #cc241d;
+    animation: blink 1s steps(2) infinite;
+}
+
+@keyframes blink {
+    to { color: #ebdbb2; }
+}
+
+/* ── System Tray ─────────────────────── */
+#tray > .passive {
+    -gtk-icon-effect: dim;
+}
+
+/* ── Power Button ────────────────────── */
+#custom-power {
+    color: #cc241d;
+    padding: 0 8px;
+}
+
+#custom-power:hover {
+    color: #fb4934;
+}
+
+/* ── Tooltips ────────────────────────── */
+tooltip {
+    background: #282828;
+    border: 1px solid #504945;
+    border-radius: 6px;
+}
+
+tooltip label {
+    color: #ebdbb2;
+}
--- a/flake.nix
+++ b/flake.nix
@@ -0,0 +1,64 @@
+{
+  description = "Matiss NixOS - Hyprland Workstation";
+
+  inputs = {
+    # Stable NixOS foundation
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
+
+    # Unstable for bleeding-edge packages
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+
+    # Home Manager (matches system 25.11)
+    home-manager.url = "github:nix-community/home-manager/release-25.11";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+
+    # Nixvim (Neovim configuration as Nix)
+    nixvim.url = "github:nix-community/nixvim/nixos-25.11";
+
+    # sops-nix (secrets management)
+    sops-nix.url = "github:mic92/sops-nix";
+
+    # Helium Browser (privacy-first Chromium)
+    helium-browser.url = "github:nicchongwb/helium-browser-nix";
+    helium-browser.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = { self, nixpkgs, nixpkgs-unstable, home-manager, nixvim, sops-nix, helium-browser, ... }@inputs:
+  let
+    system = "x86_64-linux";
+
+    # Shared modules for all NixOS hosts
+    sharedModules = [
+      sops-nix.nixosModules.sops
+
+      # Home Manager
+      home-manager.nixosModules.home-manager
+      {
+        home-manager.useGlobalPkgs = true;
+        home-manager.useUserPackages = true;
+        home-manager.extraSpecialArgs = { inherit inputs; };
+        home-manager.backupFileExtension = "backup";
+        home-manager.users.matiss = import ./home.nix;
+      }
+
+      # Overlays
+      ({ config, pkgs, ... }: {
+        nixpkgs.overlays = [
+          (final: prev: {
+            unstable = import nixpkgs-unstable {
+              localSystem = final.stdenv.hostPlatform;
+              config.allowUnfree = true;
+            };
+          })
+        ];
+      })
+    ];
+  in
+  {
+    nixosConfigurations.matiss = nixpkgs.lib.nixosSystem {
+      inherit system;
+      specialArgs = { inherit inputs; };
+      modules = [ ./hosts/default/configuration.nix ] ++ sharedModules;
+    };
+  };
+}
--- a/home.nix
+++ b/home.nix
@@ -0,0 +1,28 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+
+{
+  imports = [
+    # Nixvim module
+    inputs.nixvim.homeModules.nixvim
+
+    # User modules
+    ./modules/user/packages.nix
+    ./modules/user/shell.nix
+    ./modules/user/git.nix
+    ./modules/user/applications.nix
+    ./modules/user/neovim.nix
+    ./modules/user/theming.nix
+    ./modules/user/dotfiles.nix
+  ];
+
+  home.username = "matiss";
+  home.homeDirectory = "/home/matiss";
+
+  home.stateVersion = "25.11";
+  programs.home-manager.enable = true;
+}
--- a/hosts/default/configuration.nix
+++ b/hosts/default/configuration.nix
@@ -0,0 +1,24 @@
+# ==========================================
+# HOST: matiss (Hyprland Workstation)
+# ==========================================
+{ config, pkgs, inputs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    # System modules
+    ../../modules/system/nix.nix
+    ../../modules/system/boot.nix
+    ../../modules/system/network.nix
+    ../../modules/system/firewall.nix
+    ../../modules/system/desktop.nix
+    ../../modules/system/hardware.nix
+    ../../modules/system/user.nix
+    ../../modules/system/fonts.nix
+    ../../modules/system/services.nix
+    ../../modules/system/vpn.nix
+  ];
+
+  networking.hostName = "matiss";
+}
--- a/hosts/default/hardware-configuration.nix
+++ b/hosts/default/hardware-configuration.nix
@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by 'nixos-generate-config'
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "vmd" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/fee68672-3a01-4156-ac68-e035f325a6e6";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/F2AB-5A1A";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
--- a/modules/system/boot.nix
+++ b/modules/system/boot.nix
@@ -0,0 +1,13 @@
+# ==========================================
+# BOOT CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.systemd-boot.configurationLimit = 10;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Use the latest kernel
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+}
--- a/modules/system/desktop.nix
+++ b/modules/system/desktop.nix
@@ -0,0 +1,77 @@
+# ==========================================
+# DESKTOP ENVIRONMENT — Hyprland + Waybar + Walker
+# ==========================================
+# Omarchy-inspired: keyboard-first tiling Wayland compositor
+# with a clean status bar and fast application launcher.
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  # Hyprland compositor
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+
+  # greetd + tuigreet (minimal TUI login — no bloated DMs)
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd Hyprland";
+        user = "greeter";
+      };
+    };
+  };
+
+  # Disable other display managers
+  services.xserver.enable = false;
+
+  # Polkit for privilege escalation prompts
+  security.polkit.enable = true;
+
+  # GNOME Keyring for secrets/passwords
+  services.gnome.gnome-keyring.enable = true;
+  security.pam.services.greetd.enableGnomeKeyring = true;
+
+  # Screen locking
+  programs.hyprlock.enable = true;
+
+  # Idle management
+  services.hypridle.enable = true;
+
+  # XDG Desktop Portal (screen sharing, file pickers)
+  xdg.portal = {
+    enable = true;
+    extraPortals = [
+      pkgs.xdg-desktop-portal-hyprland
+      pkgs.xdg-desktop-portal-gtk
+    ];
+  };
+
+  # Keyboard — caps lock as escape (omarchy default)
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+    options = "caps:escape";
+  };
+
+  # Desktop packages available system-wide
+  environment.systemPackages = with pkgs; [
+    waybar             # Status bar
+    walker             # Application launcher
+    mako               # Notification daemon
+    wl-clipboard       # Wayland clipboard
+    cliphist           # Clipboard history
+    brightnessctl      # Backlight control
+    playerctl          # Media key control
+    swayosd            # On-screen display for volume/brightness
+    grim               # Screenshot
+    slurp              # Region selection
+    swappy             # Screenshot editor
+    wdisplays          # Display configurator
+    networkmanagerapplet # Tray network widget
+    blueman            # Bluetooth manager
+    polkit_gnome       # Polkit GUI agent
+  ];
+}
--- a/modules/system/firewall.nix
+++ b/modules/system/firewall.nix
@@ -0,0 +1,13 @@
+# ==========================================
+# FIREWALL CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  # UFW-style firewall — deny all inbound by default
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ ];
+    allowedUDPPorts = [ ];
+  };
+}
--- a/modules/system/fonts.nix
+++ b/modules/system/fonts.nix
@@ -0,0 +1,24 @@
+# ==========================================
+# FONTS CONFIGURATION
+# ==========================================
+# Omarchy default: JetBrainsMono Nerd Font
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  fonts.packages = with pkgs; [
+    nerd-fonts.jetbrains-mono
+    nerd-fonts.fira-code
+    nerd-fonts._0xproto
+    nerd-fonts.droid-sans-mono
+    noto-fonts
+    noto-fonts-emoji
+  ];
+
+  fonts.fontconfig.defaultFonts = {
+    monospace = [ "JetBrainsMono Nerd Font" "FiraCode Nerd Font" ];
+    sansSerif = [ "Noto Sans" ];
+    serif = [ "Noto Serif" ];
+    emoji = [ "Noto Color Emoji" ];
+  };
+}
--- a/modules/system/hardware.nix
+++ b/modules/system/hardware.nix
@@ -0,0 +1,34 @@
+# ==========================================
+# HARDWARE & AUDIO CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  hardware.bluetooth.enable = true;
+  hardware.bluetooth.powerOnBoot = true;
+
+  services.printing.enable = true;
+
+  # Audio — PipeWire (replaces PulseAudio)
+  security.rtkit.enable = true;
+  services.pulseaudio.enable = false;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    wireplumber.enable = true;
+  };
+
+  # GPU — uncomment the section for your hardware:
+
+  # --- NVIDIA ---
+  # hardware.nvidia.modesetting.enable = true;
+  # services.xserver.videoDrivers = [ "nvidia" ];
+
+  # --- AMD ---
+  # hardware.amdgpu.enable = true;
+
+  # --- Intel (12th Gen i7-12700H) ---
+  hardware.graphics.enable = true;
+}
--- a/modules/system/network.nix
+++ b/modules/system/network.nix
@@ -0,0 +1,27 @@
+# ==========================================
+# NETWORKING & TIME CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  networking.networkmanager.enable = true;
+
+  # Disable wait-online to speed up boot
+  systemd.services.NetworkManager-wait-online.enable = false;
+
+  # Set your timezone
+  time.timeZone = "Europe/Riga";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "lv_LV.UTF-8";
+    LC_IDENTIFICATION = "lv_LV.UTF-8";
+    LC_MEASUREMENT = "lv_LV.UTF-8";
+    LC_MONETARY = "lv_LV.UTF-8";
+    LC_NAME = "lv_LV.UTF-8";
+    LC_NUMERIC = "lv_LV.UTF-8";
+    LC_PAPER = "lv_LV.UTF-8";
+    LC_TELEPHONE = "lv_LV.UTF-8";
+    LC_TIME = "lv_LV.UTF-8";
+  };
+}
--- a/modules/system/nix.nix
+++ b/modules/system/nix.nix
@@ -0,0 +1,23 @@
+# ==========================================
+# NIX CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+    max-jobs = "auto";
+    cores = 0;
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  system.stateVersion = "25.11";
+}
--- a/modules/system/services.nix
+++ b/modules/system/services.nix
@@ -0,0 +1,32 @@
+# ==========================================
+# SYSTEM SERVICES CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  # Zsh at system level (config lives in home-manager)
+  programs.zsh.enable = true;
+
+  # Docker
+  virtualisation.docker = {
+    enable = true;
+    autoPrune = {
+      enable = true;
+      dates = "weekly";
+      flags = [ "--all" "--volumes" ];
+    };
+  };
+
+  # nix-ld — run unpatched binaries (Cursor, Codex, etc.)
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    stdenv.cc.cc
+    zlib
+    fuse3
+    icu
+    nss
+    openssl
+    curl
+    expat
+  ];
+}
--- a/modules/system/user.nix
+++ b/modules/system/user.nix
@@ -0,0 +1,21 @@
+# ==========================================
+# USER CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  users.users.matiss = {
+    isNormalUser = true;
+    description = "Matiss";
+    extraGroups = [ "networkmanager" "wheel" "docker" "video" "render" "input" ];
+    shell = pkgs.zsh;
+  };
+
+  # Core system packages (available to all users)
+  environment.systemPackages = with pkgs; [
+    git
+    vim
+    wget
+    curl
+  ];
+}
--- a/modules/system/vpn.nix
+++ b/modules/system/vpn.nix
@@ -0,0 +1,14 @@
+# ==========================================
+# VPN CONFIGURATION — Tailscale
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+
+  # Loose rpfilter for Tailscale subnet routing
+  networking.firewall.checkReversePath = "loose";
+}
--- a/modules/user/applications.nix
+++ b/modules/user/applications.nix
@@ -0,0 +1,30 @@
+# ==========================================
+# APPLICATIONS CONFIGURATION
+# ==========================================
+{ config, pkgs, inputs, ... }:
+
+{
+  # XDG default applications
+  xdg.mimeApps = {
+    enable = true;
+    defaultApplications = {
+      "text/html" = "Alacritty.desktop";
+      "x-scheme-handler/http" = "Alacritty.desktop";   # Override with your browser .desktop
+      "x-scheme-handler/https" = "Alacritty.desktop";
+      "text/plain" = "nvim.desktop";
+    };
+  };
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+    VISUAL = "nvim";
+    BROWSER = "firefox";        # Placeholder — change to helium if installed
+    TERMINAL = "alacritty";
+
+    # Wayland-native rendering for Electron apps
+    NIXOS_OZONE_WL = "1";
+
+    # Fix Java Swing apps on Wayland
+    _JAVA_AWT_WM_NONREPARENTING = "1";
+  };
+}
--- a/modules/user/dotfiles.nix
+++ b/modules/user/dotfiles.nix
@@ -0,0 +1,19 @@
+# ==========================================
+# DOTFILES — Symlink config files
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  # Hyprland configuration
+  xdg.configFile."hypr/hyprland.conf".source = ../../config/hypr/hyprland.conf;
+
+  # Waybar
+  xdg.configFile."waybar/config.jsonc".source = ../../config/waybar/config.jsonc;
+  xdg.configFile."waybar/style.css".source = ../../config/waybar/style.css;
+
+  # Walker launcher
+  xdg.configFile."walker/config.toml".source = ../../config/walker/config.toml;
+
+  # Alacritty terminal
+  xdg.configFile."alacritty/alacritty.toml".source = ../../config/alacritty/alacritty.toml;
+}
--- a/modules/user/git.nix
+++ b/modules/user/git.nix
@@ -0,0 +1,39 @@
+# ==========================================
+# GIT CONFIGURATION
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "Matiss";                                    # CHANGE ME
+        email = "your-email@users.noreply.github.com";      # CHANGE ME
+      };
+
+      # SSH for GitHub by default
+      url."git@github.com:".insteadOf = "https://github.com/";
+
+      init.defaultBranch = "main";
+      diff.algorithm = "histogram";
+
+      push = {
+        autoSetupRemote = true;
+        default = "current";
+      };
+    };
+  };
+
+  # SSH — GitHub key
+  programs.ssh = {
+    enable = true;
+    matchBlocks."github.com" = {
+      identityFile = "/home/matiss/.ssh/id_ed25519";  # CHANGE ME to your key path
+      identitiesOnly = true;
+    };
+    matchBlocks."*" = {
+      setEnv.TERM = "xterm-256color";
+    };
+  };
+}
--- a/modules/user/neovim.nix
+++ b/modules/user/neovim.nix
@@ -0,0 +1,131 @@
+# ==========================================
+# NEOVIM CONFIGURATION (via Nixvim)
+# ==========================================
+# Gruvbox theme, LSP, Treesitter, Telescope, file tree.
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  programs.nixvim = {
+    enable = true;
+
+    opts = {
+      number = true;
+      relativenumber = true;
+      shiftwidth = 2;
+      tabstop = 2;
+      expandtab = true;
+      smartindent = true;
+      wrap = false;
+      swapfile = false;
+      backup = false;
+      undofile = true;
+      hlsearch = false;
+      incsearch = true;
+      termguicolors = true;
+      scrolloff = 8;
+      signcolumn = "yes";
+      updatetime = 50;
+      clipboard = "unnamedplus";
+    };
+
+    globals = {
+      mapleader = " ";
+      maplocalleader = " ";
+    };
+
+    # Gruvbox colorscheme — matches omarchy aesthetic
+    colorschemes.gruvbox = {
+      enable = true;
+      settings = {
+        contrast_dark = "hard";
+        transparent_mode = true;
+      };
+    };
+
+    # Treesitter (syntax highlighting)
+    plugins.treesitter = {
+      enable = true;
+      settings.highlight.enable = true;
+      settings.indent.enable = true;
+    };
+
+    # Telescope (fuzzy finder)
+    plugins.telescope = {
+      enable = true;
+      keymaps = {
+        "<leader>ff" = { action = "find_files"; options.desc = "Find files"; };
+        "<leader>fg" = { action = "live_grep"; options.desc = "Live grep"; };
+        "<leader>fb" = { action = "buffers"; options.desc = "Buffers"; };
+        "<leader>fh" = { action = "help_tags"; options.desc = "Help tags"; };
+        "<leader>fr" = { action = "oldfiles"; options.desc = "Recent files"; };
+      };
+    };
+
+    # Neo-tree (file tree)
+    plugins.neo-tree = {
+      enable = true;
+    };
+
+    # LSP
+    plugins.lsp = {
+      enable = true;
+      servers = {
+        nil_ls.enable = true;        # Nix
+        pyright.enable = true;       # Python
+        ts_ls.enable = true;         # TypeScript/JavaScript
+        bashls.enable = true;        # Bash
+        jsonls.enable = true;        # JSON
+        yamlls.enable = true;        # YAML
+        html.enable = true;          # HTML
+        cssls.enable = true;         # CSS
+      };
+    };
+
+    # Autocompletion
+    plugins.cmp = {
+      enable = true;
+      autoEnableSources = true;
+      settings = {
+        sources = [
+          { name = "nvim_lsp"; }
+          { name = "path"; }
+          { name = "buffer"; }
+        ];
+        mapping = {
+          "<C-n>" = "cmp.mapping.select_next_item()";
+          "<C-p>" = "cmp.mapping.select_prev_item()";
+          "<C-y>" = "cmp.mapping.confirm({ select = true })";
+          "<C-Space>" = "cmp.mapping.complete()";
+        };
+      };
+    };
+
+    # Status line
+    plugins.lualine = {
+      enable = true;
+      settings.options.theme = "gruvbox";
+    };
+
+    # Autopairs
+    plugins.nvim-autopairs.enable = true;
+
+    # Git signs in the gutter
+    plugins.gitsigns.enable = true;
+
+    # Which-key (show keybindings)
+    plugins.which-key.enable = true;
+
+    # Keymaps
+    keymaps = [
+      { key = "<leader>e"; action = "<cmd>Neotree toggle<CR>"; options.desc = "Toggle file tree"; }
+      { key = "<leader>w"; action = "<cmd>w<CR>"; options.desc = "Save"; }
+      { key = "<leader>q"; action = "<cmd>q<CR>"; options.desc = "Quit"; }
+      # Window navigation
+      { key = "<C-h>"; action = "<C-w>h"; options.desc = "Move left"; }
+      { key = "<C-j>"; action = "<C-w>j"; options.desc = "Move down"; }
+      { key = "<C-k>"; action = "<C-w>k"; options.desc = "Move up"; }
+      { key = "<C-l>"; action = "<C-w>l"; options.desc = "Move right"; }
+    ];
+  };
+}
--- a/modules/user/packages.nix
+++ b/modules/user/packages.nix
@@ -0,0 +1,90 @@
+# ==========================================
+# PACKAGES — User Applications
+# ==========================================
+# Spec: Codex, Claude Code, Gemini CLI, Helium, Cursor,
+#        Antigravity, Lazydocker, Git, Gh, Alacritty,
+#        Zoxide, Fzf, Bat, Eza, Fd, Impala, Bun, Nodejs,
+#        Docker, Bitwarden, Beeper, Python, Spotify, Tailscale
+# ==========================================
+{ config, pkgs, inputs, ... }:
+
+{
+  home.packages = with pkgs; [
+    # ── AI Coding Tools ──────────────────────────────────
+    unstable.claude-code            # Claude Code CLI
+    unstable.antigravity            # Antigravity IDE
+    # codex: install via `npm i -g @openai/codex` (not in nixpkgs)
+    # gemini-cli: install via `npm i -g @google/gemini-cli` (not in nixpkgs)
+
+    # ── Terminals & Editors ──────────────────────────────
+    alacritty                       # GPU-accelerated terminal
+    code-cursor                     # Cursor IDE
+
+    # ── Browsers ─────────────────────────────────────────
+    # Helium: add inputs.helium-browser flake package here
+    # if the flake builds for your system, uncomment:
+    # inputs.helium-browser.packages.${pkgs.stdenv.hostPlatform.system}.default
+
+    # ── CLI Essentials (omarchy-style) ───────────────────
+    bat                             # cat with syntax highlighting
+    eza                             # modern ls
+    fd                              # modern find
+    fzf                             # fuzzy finder
+    zoxide                          # smart cd
+    ripgrep                         # fast grep
+    lazydocker                      # Docker TUI
+    impala                          # TUI WiFi manager
+    yazi                            # TUI file manager
+    btop                            # system monitor
+    fastfetch                       # system info
+    tealdeer                        # tldr man pages
+
+    # ── Version Control ──────────────────────────────────
+    git
+    gh                              # GitHub CLI
+    lazygit                         # Git TUI
+
+    # ── Development Runtimes ─────────────────────────────
+    nodejs
+    bun
+    python3
+    uv                              # fast Python package manager
+
+    # ── Containers ───────────────────────────────────────
+    docker-compose
+
+    # ── Desktop Apps ─────────────────────────────────────
+    bitwarden                       # password manager
+    beeper                          # unified messaging
+    spotify                         # music
+
+    # ── System Utilities ─────────────────────────────────
+    wget
+    curl
+    unzip
+    wl-clipboard
+    cliphist
+    wl-clip-persist
+
+    # ── Theming Dependencies ─────────────────────────────
+    gnome-themes-extra
+    adwaita-qt
+    adwaita-qt6
+    dconf
+  ];
+
+  # ── Post-activation: Install npm-only tools ────────────
+  # Codex and Gemini CLI aren't in nixpkgs; install them
+  # globally via npm after first `nixos-rebuild switch`.
+  home.activation.installNpmTools = config.lib.dag.entryAfter [ "writeBoundary" ] ''
+    export PATH="${pkgs.nodejs}/bin:$PATH"
+    if ! command -v codex &> /dev/null; then
+      echo "Installing @openai/codex via npm..."
+      ${pkgs.nodejs}/bin/npm i -g @openai/codex 2>/dev/null || true
+    fi
+    if ! command -v gemini &> /dev/null; then
+      echo "Installing @google/gemini-cli via npm..."
+      ${pkgs.nodejs}/bin/npm i -g @google/gemini-cli 2>/dev/null || true
+    fi
+  '';
+}
--- a/modules/user/shell.nix
+++ b/modules/user/shell.nix
@@ -0,0 +1,80 @@
+# ==========================================
+# SHELL CONFIGURATION (Zsh)
+# ==========================================
+# Omarchy-style: Oh-My-Zsh + modern CLI replacements
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  # Atuin — searchable shell history
+  programs.atuin = {
+    enable = true;
+    enableZshIntegration = true;
+    settings = {
+      auto_sync = false;
+      search_mode = "fuzzy";
+    };
+  };
+
+  # Zsh
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+
+    shellAliases = {
+      # Rebuild shortcuts
+      upd = "cd ~/nixos-config && sudo nixos-rebuild switch --flake . && echo 'Done!'";
+      upd-test = "cd ~/nixos-config && sudo nixos-rebuild test --flake .";
+      upd-build = "cd ~/nixos-config && nixos-rebuild dry-build --flake .";
+
+      # Modern replacements
+      ls = "eza --icons";
+      ll = "eza -la --icons";
+      lt = "eza -la --icons --tree --level=2";
+      cat = "bat --style=plain";
+      find = "fd";
+
+      # Clipboard (Wayland)
+      pbcopy = "wl-copy";
+      pbpaste = "wl-paste";
+
+      # Docker
+      lzd = "lazydocker";
+
+      # Git
+      lg = "lazygit";
+    };
+
+    oh-my-zsh = {
+      enable = true;
+      theme = "gnzh";
+      plugins = [
+        "git"
+        "docker"
+        "docker-compose"
+        "eza"
+        "zoxide"
+        "colored-man-pages"
+        "fzf"
+      ];
+    };
+
+    initContent = ''
+      # Force Atuin up-arrow binding
+      bindkey '^[[A' atuin-up-search
+      bindkey '^[OA' atuin-up-search
+
+      # Yazi wrapper — cd on exit
+      function y() {
+        local tmp="$(mktemp -t "yazi-cwd.XXXXXX")" cwd
+        yazi "$@" --cwd-file="$tmp"
+        if cwd="$(cat -- "$tmp")" && [ -n "$cwd" ] && [ "$cwd" != "$PWD" ]; then
+          builtin cd -- "$cwd"
+        fi
+        rm -f -- "$tmp"
+      }
+    '';
+  };
+}
--- a/modules/user/theming.nix
+++ b/modules/user/theming.nix
@@ -0,0 +1,34 @@
+# ==========================================
+# THEMING CONFIGURATION — Gruvbox Dark
+# ==========================================
+# Omarchy philosophy: one theme, consistently applied
+# across all applications and UI components.
+# ==========================================
+{ config, pkgs, ... }:
+
+{
+  # GTK Dark Mode
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Adwaita-dark";
+      package = pkgs.gnome-themes-extra;
+    };
+    gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
+    gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
+  };
+
+  # Qt Dark Mode
+  qt = {
+    enable = true;
+    platformTheme.name = "adwaita";
+    style.name = "adwaita-dark";
+  };
+
+  # Dark mode preference for GNOME/GTK apps
+  dconf.settings = {
+    "org/gnome/desktop/interface" = {
+      color-scheme = "prefer-dark";
+    };
+  };
+}