Hermes Agent
9180562410
services/nextcloud/password.txt était committé en clair ("nextcloudpassword")
depuis le 25/11/2025, jamais référencé dans la config, exposé publiquement
sur github/codeberg depuis. Supprimé.
adminpassFile ne fixe le mot de passe QUE lors de l'install initiale (occ
maintenance:install) : sur une instance déjà installée il est ignoré, donc
juste changer le secret sops n'aurait pas suffi. Ajout d'un ExecStartPost
sur nextcloud-setup qui force le mot de passe du compte root à la valeur
sops à chaque activation (self-healing).
Vérifié sur tower : ancien mot de passe "nextcloudpassword" -> 401 après
le switch, hash oc_users.password changé.
303 lines
10 KiB
Nix
303 lines
10 KiB
Nix
{
|
|
description = "NixOS configuration of Marc";
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
|
unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
home-manager = {
|
|
url = "github:nix-community/home-manager/release-26.05";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
nur = {
|
|
url = "github:nix-community/NUR";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
|
|
nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
|
|
nix-darwin.inputs.nixpkgs.follows = "nixpkgs-darwin";
|
|
|
|
clawdbot.url = "github:clawdbot/nix-clawdbot";
|
|
clawdbot.inputs.nixpkgs.follows = "nixpkgs";
|
|
# hyprland.url = "github:hyprwm/Hyprland?ref=v0.50.0";
|
|
# hy3.url = "github:outfoxxed/hy3?ref=hl0.50.0";
|
|
# hy3.url = "github:outfoxxed/hy3";
|
|
# hy3.inputs.hyprland.follows = "hyprland";
|
|
# nix-search-tv.url = "github:3timeslazy/nix-search-tv";
|
|
catppuccin.url = "github:catppuccin/nix";
|
|
# newt.url = "github:fosrl/newt";
|
|
claude-code.url = "github:sadjow/claude-code-nix";
|
|
|
|
nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
|
|
|
|
niri.url = "github:sodiboo/niri-flake";
|
|
niri.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
disko.url = "github:nix-community/disko";
|
|
disko.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
sops.url = "github:Mic92/sops-nix";
|
|
sops.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
nixvim.url = "github:nix-community/nixvim/nixos-26.05";
|
|
# nixvim.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
zen-browser.url = "github:youwen5/zen-browser-flake";
|
|
zen-browser.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
spicetify.url = "github:Gerg-L/spicetify-nix";
|
|
spicetify.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
# rycee-nurpkgs = {
|
|
# url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
|
|
# inputs.nixpkgs.follows = "nixpkgs";
|
|
# };
|
|
# hyprtasking = {
|
|
# url = "github:raybbian/hyprtasking";
|
|
# inputs.hyprland.follows = "hyprland";
|
|
# };
|
|
catppuccin-thunderbird = {
|
|
url = "github:catppuccin/thunderbird";
|
|
flake = false; # The repo isn't a flake; use as raw source
|
|
};
|
|
|
|
# On crée une entrée SPÉCIALE pour le téléphone
|
|
# nixpkgs-droid.url = "github:NixOS/nixpkgs/nixos-24.05";
|
|
|
|
nix-on-droid = {
|
|
url = "github:nix-community/nix-on-droid/master";
|
|
# url = "github:nix-community/nix-on-droid/release-24.05";
|
|
|
|
# C'EST LA LIGNE CRUCIALE :
|
|
# On lui dit de suivre la version Droid, pas la version Laptop.
|
|
# inputs.nixpkgs.follows = "nixpkgs-droid";
|
|
|
|
# On aligne aussi le home-manager interne de nix-on-droid
|
|
# inputs.home-manager.follows = "home-manager-droid";
|
|
};
|
|
|
|
# On définit aussi un home-manager compatible 24.05 pour le tel
|
|
# home-manager-droid = {
|
|
# url = "github:nix-community/home-manager/release-24.05";
|
|
# inputs.nixpkgs.follows = "nixpkgs-droid";
|
|
# };
|
|
|
|
# nixvim-droid.url = "github:nix-community/nixvim/nixos-24.05";
|
|
# nixvim-droid.inputs.nixpkgs.follows = "nixpkgs-droid";
|
|
|
|
# hyprland-plugins = {
|
|
# url = "github:hyprwm/hyprland-plugins";
|
|
# inputs.hyprland.follows = "hyprland";
|
|
# };
|
|
sopswarden = {
|
|
url = "github:pfassina/sopswarden";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
agenix.url = "github:ryantm/agenix";
|
|
microvm.url = "github:astro/microvm.nix";
|
|
|
|
# nwg-dock-hyprland-pin-nixpkgs.url = "nixpkgs/2098d845d76f8a21ae4fe12ed7c7df49098d3f15";
|
|
|
|
# nixgl.url = "github:guibou/nixGL";
|
|
# nixgl.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
backtest.url = "github:marcpartensky/backtest-cpp-py";
|
|
backtest.inputs.nixpkgs.follows = "nixpkgs";
|
|
portfolio-optimizer.url = "github:marcpartensky/portfolio-optimizer";
|
|
portfolio-optimizer.inputs.nixpkgs.follows = "nixpkgs";
|
|
option-pricer.url = "github:marcpartensky/option-pricer";
|
|
option-pricer.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
uv2nix.url = "github:pyproject-nix/uv2nix";
|
|
uv2nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
pyproject-nix.url = "github:pyproject-nix/pyproject.nix";
|
|
pyproject-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
discord-bot.url = "github:MarcPartensky/discord-bot";
|
|
|
|
hermes-agent.url = "github:NousResearch/hermes-agent";
|
|
# hermes-agent.inputs.nixpkgs.follows = "github:NousResearch/hermes-agent";
|
|
|
|
# UI web de chat (parité CLI) pour hermes-agent. Projet communautaire
|
|
# (MIT), il publie son propre flake + module NixOS. follows nixpkgs pour
|
|
# ne pas évaluer un second nixpkgs : le paquet ne fait que python3 +
|
|
# pyyaml + cryptography, la 26.05 suffit.
|
|
hermes-webui = {
|
|
url = "github:nesquena/hermes-webui";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Clients YouTube Music TUI (voir modules/home/{ytm-player,yututui,yt-collate,youtube-music-cli})
|
|
ytm-player = {
|
|
url = "github:peternaame-boop/ytm-player";
|
|
# v2.1.0 exige dbus-fast >= 5.0.0, absent de 26.05 (4.0.4) :
|
|
# on suit unstable, la nixpkgs que le flake upstream teste.
|
|
inputs.nixpkgs.follows = "unstable";
|
|
};
|
|
yututui = {
|
|
url = "github:Ochichan/Yututui";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
firefox-devtools-mcp = {
|
|
# Officiel Mozilla, MCP browser automation via WebDriver BiDi. Pin sur le
|
|
# commit de la release v0.10.4 (2026-09-22) ; flake=false, source brute.
|
|
url = "github:mozilla/firefox-devtools-mcp/bdb377af9ce3a3596e8c196786014ecee50fe178";
|
|
flake = false;
|
|
};
|
|
|
|
stalwart-mcp = {
|
|
# Rust MCP server for Stalwart Mail Server (webpatser/stalwart-mcp).
|
|
# JMAP access: read, search, real-time notifications via EventSource.
|
|
# Pin sur commit main (pas de release taggée).
|
|
url = "github:webpatser/stalwart-mcp/be2c16d5921f45395996a130a5a643c542ef2105";
|
|
flake = false;
|
|
};
|
|
|
|
jovian.url = "github:Jovian-Experiments/Jovian-NixOS";
|
|
# jovian.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
steam-config-nix = {
|
|
url = "github:different-name/steam-config-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
outputs = {
|
|
self,
|
|
nixpkgs,
|
|
...
|
|
} @ inputs: {
|
|
nixosConfigurations = {
|
|
laptop = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs;};
|
|
modules = [
|
|
./profiles/common
|
|
./profiles/laptop/configuration.nix
|
|
./services
|
|
];
|
|
};
|
|
|
|
tower = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs;};
|
|
modules = [
|
|
./profiles/common
|
|
./profiles/tower/configuration.nix
|
|
./services
|
|
];
|
|
};
|
|
|
|
deck = inputs.jovian.inputs.nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs;};
|
|
modules = [
|
|
./profiles/deck/configuration.nix
|
|
# ./services
|
|
];
|
|
};
|
|
|
|
laptop-iso = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs;};
|
|
modules = [
|
|
./modules/nixos/iso
|
|
|
|
inputs.disko.nixosModules.disko
|
|
inputs.nixvim.nixosModules.default
|
|
inputs.sopswarden.nixosModules.default
|
|
inputs.home-manager.nixosModules.default
|
|
./hosts/laptop/disko.nix
|
|
./hosts/laptop/hardware-configuration.nix
|
|
./profiles/laptop/configuration.nix
|
|
./services
|
|
./users.nix
|
|
];
|
|
};
|
|
|
|
deck-iso = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [./modules/nixos/iso ./users.nix {programs.zsh.enable = true;}];
|
|
};
|
|
|
|
anywhere = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs;};
|
|
modules = [
|
|
./profiles/anywhere/configuration.nix
|
|
./users.nix
|
|
];
|
|
};
|
|
|
|
# VM de dev microvm.nix (input `microvm`, voir vms/) : `just vm` ou
|
|
# `nix run .#dev`. Dupliquer vms/dev.nix pour une 2e VM.
|
|
dev = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
specialArgs = {inherit inputs;};
|
|
modules = [
|
|
inputs.microvm.nixosModules.microvm
|
|
./vms/dev.nix
|
|
];
|
|
};
|
|
};
|
|
|
|
# Runners des VM de dev, lançables directement : `nix run .#dev`.
|
|
packages.x86_64-linux.dev = self.nixosConfigurations.dev.config.microvm.declaredRunner;
|
|
|
|
nixOnDroidConfigurations.default = inputs.nix-on-droid.lib.nixOnDroidConfiguration {
|
|
# pkgs = import inputs.nixpkgs-droid {
|
|
pkgs = import inputs.nix-on-droid.inputs.nixpkgs {
|
|
system = "aarch64-linux";
|
|
};
|
|
extraSpecialArgs = {inherit inputs;};
|
|
# extraSpecialArgs = {
|
|
# inputs = inputs // {
|
|
# nixpkgs = inputs.nixpkgs-droid;
|
|
# home-manager = inputs.home-manager-droid;
|
|
# nixvim = inputs.nixvim-droid;
|
|
# };
|
|
# };
|
|
modules = [
|
|
# inputs.home-manager.nixosModules.default
|
|
./profiles/nix-on-droid/configuration.nix
|
|
# ./users.nix
|
|
];
|
|
};
|
|
|
|
homeConfigurations = {
|
|
"marc" = inputs.home-manager.lib.homeManagerConfiguration {
|
|
extraSpecialArgs = {inherit inputs;};
|
|
pkgs = import nixpkgs {
|
|
system = "x86_64-linux";
|
|
overlays = [inputs.nur.overlays.default inputs.clawdbot.overlays.default];
|
|
};
|
|
modules = [./users/marc/home.nix];
|
|
};
|
|
"marc@macos" = inputs.home-manager.lib.homeManagerConfiguration {
|
|
extraSpecialArgs = {inherit inputs;};
|
|
pkgs = import inputs.nixpkgs-darwin {
|
|
system = "aarch64-darwin";
|
|
};
|
|
modules = [./users/mac/home.nix];
|
|
};
|
|
"marc@deck" = inputs.home-manager.lib.homeManagerConfiguration {
|
|
extraSpecialArgs = {inherit inputs;};
|
|
pkgs = import nixpkgs {
|
|
system = "x86_64-linux";
|
|
config.allowUnfree = true;
|
|
};
|
|
modules = [./users/deck];
|
|
};
|
|
};
|
|
|
|
darwinConfigurations."macos" = inputs.nix-darwin.lib.darwinSystem {
|
|
system = "aarch64-darwin";
|
|
specialArgs = {inherit inputs;};
|
|
pkgs = import inputs.nixpkgs-darwin {system = "aarch64-darwin";};
|
|
modules = [
|
|
./profiles/macos/configuration.nix
|
|
{nixpkgs.config.allowUnfree = true;}
|
|
];
|
|
};
|
|
};
|
|
}
|