nvim-web-devicons

modules/features/mtls.nix

@@ -96,32 +96,35 @@ let
     group,
   }:
   let
-    catCmd = lib.getExe' pkgs.coreutils "cat";
-    chownCmd = lib.getExe' pkgs.coreutils "chown";
-    chmodCmd = lib.getExe' pkgs.coreutils "chmod";
-    stepCmd = lib.getExe pkgs.step-cli;
     sanArgs = lib.concatMapStringsSep " " (s: "--san \"${s}\"") san;
   in
-    pkgs.writeShellScriptBin "mtls-generate" ''
-      set -euo pipefail
-      ${stepCmd} ca certificate \
-        ${subject} ${certFile} ${keyFile} \
-        --not-before=-5m --not-after=${lifetime} \
-        --provisioner ${provisioner} \
-        ${sanArgs} \
-        "$@"
-      (umask 077; ${catCmd} ${certFile} ${keyFile} > ${bundleFile})
-      ${chownCmd} ${user}:${group} ${certFile} ${keyFile} ${bundleFile}
-      ${chmodCmd} 640 ${certFile} ${keyFile} ${bundleFile}
-      printf '\033[32m✔\033[0m \033[1mmTLS Bundle:\033[0m %s\n' ${lib.escapeShellArg bundleFile}
-    '';
+    pkgs.writeShellApplication {
+      name = "mtls-generate";
+      runtimeInputs = with pkgs; [ coreutils step-cli ];
+      text = ''
+        set -euo pipefail
+        step ca certificate ${subject} ${certFile} ${keyFile} \
+          --provisioner ${provisioner} \
+          --not-before=-5m --not-after=${lifetime} \
+          ${sanArgs} \
+          "$@"
+        (umask 077; cat ${certFile} ${keyFile} > ${bundleFile})
+        chown ${user}:${group} ${certFile} ${keyFile} ${bundleFile}
+        chmod 640 ${certFile} ${keyFile} ${bundleFile}
+        printf '\033[32m✔\033[0m \033[1mmTLS Bundle:\033[0m %s\n' ${lib.escapeShellArg bundleFile}
+      '';
+    };
   
-  mkMtlsCheckScript = { pkgs, bundleFile }: pkgs.writeShellScriptBin "mtls-check" ''
-    ${lib.getExe pkgs.openssl} x509 \
-    -noout -subject -issuer \
-    -ext subjectAltName,extendedKeyUsage \
-    -enddate -in ${bundleFile}
-  '';
+  mkMtlsCheckScript = { pkgs, bundleFile }: pkgs.writeShellApplication {
+    name = "mtls-check";
+    runtimeInputs = with pkgs; [ openssl ];
+    text = ''
+      openssl x509 -noout -in ${bundleFile} \
+        -subject -issuer \
+        -ext subjectAltName,extendedKeyUsage \
+        -enddate
+    '';
+  };
 
   mkMtlsRenewScript = {
     pkgs,
@@ -129,12 +132,7 @@ let
     systemctlArgs ? [ ],
   }:
   let
-    catCmd = lib.getExe' pkgs.coreutils "cat";
-    echoCmd = lib.getExe' pkgs.coreutils "echo";
-    chownCmd = lib.getExe' pkgs.coreutils "chown";
-    chmodCmd = lib.getExe' pkgs.coreutils "chmod";
-    stepCmd = lib.getExe pkgs.step-cli;
-    systemctlCmd = "${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs}";
+    systemctlCmd = "systemctl ${lib.escapeShellArgs systemctlArgs}";
 
     hasReloadUnits = cfg.renew.reloadUnits != [ ];
     renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
@@ -148,7 +146,10 @@ let
 
     fileOwner = "${cfg.renew.user}:${cfg.renew.group}";
   in
-    pkgs.writeShellScriptBin "mtls-renew" ''
+    pkgs.writeShellApplication {
+      name = "mtls-renew";
+      runtimeInputs = with pkgs; [ coreutils step-cli systemd ];
+      text = ''
       set -euo pipefail
 
       YELLOW_BANG="\e[33m!\e[0m"
@@ -161,33 +162,31 @@ let
         shift
         ;;
         *)
-        ${echoCmd} -e "$YELLOW_BANG Warning: ignoring unrecognized argument '$1'"
+        echo -e "$YELLOW_BANG Warning: ignoring unrecognized argument '$1'"
         exit 1
         ;;
       esac
       done
 
-      if [[ $force -eq 0 ]] && ! ${stepCmd} certificate needs-renewal "${cfg.certFile}"; then
-        ${echoCmd} "Skipping renew"
+      if [[ $force -eq 0 ]] && ! step certificate needs-renewal "${cfg.certFile}"; then
+        echo "Skipping renew"
         exit 0
       fi
 
-      ${echoCmd} "Renewing mTLS certificate"
-      ${stepCmd} ca renew --force "${cfg.certFile}" "${cfg.keyFile}"
-      (umask 077; ${catCmd} "${cfg.certFile}" "${cfg.keyFile}" > "${cfg.bundleFile}")
-      ${chownCmd} ${fileOwner} ${cfg.certFile} ${cfg.keyFile} ${cfg.bundleFile}
-      ${chmodCmd} 640 ${cfg.certFile} ${cfg.keyFile} ${cfg.bundleFile}
+      echo "Renewing mTLS certificate"
+      step ca renew --force "${cfg.certFile}" "${cfg.keyFile}"
+      (umask 077; cat "${cfg.certFile}" "${cfg.keyFile}" > "${cfg.bundleFile}")
+      chown ${fileOwner} ${cfg.certFile} ${cfg.keyFile} ${cfg.bundleFile}
+      chmod 640 ${cfg.certFile} ${cfg.keyFile} ${cfg.bundleFile}
 
       ${lib.optionalString hasReloadUnits ''
-      ${echoCmd} "Reloading units: ${lib.concatStringsSep ", " cfg.renew.reloadUnits}"
-      ${renewReloadScript}
+        echo "Reloading units: ${lib.concatStringsSep ", " cfg.renew.reloadUnits}"
+        ${renewReloadScript}
       ''}
 
-      ${lib.optionalString hasPostCommands ''
-      ${echoCmd} "Post commands:"
-      ${renewPostCommands}
-      ''}
-    '';
+      ${lib.optionalString hasPostCommands ''echo "Post commands:" ${renewPostCommands}''}
+      '';
+    };
 
   mkNixosMtlsRenewService = { pkgs, cfg, ... }:
     {

modules/features/shell-tools.nix

@@ -34,9 +34,7 @@
         xclip
         jq
         ripgrep
-        (writeShellScriptBin "ds" ''
-          ${lib.getExe pkgs.gdu} -x -I /snap /
-        '')
+        (writeShellScriptBin "ds" ''${lib.getExe pkgs.gdu} -x -I /snap /'')
       ];
     };
   };

modules/hosts/janus/default.nix

@@ -3,7 +3,7 @@ let
   username = "john";
   hostname = "janus";
   ca-url = "https://janus.john-stream.com/";
-  fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+  fingerprint = builtins.readFile ./fingerprint;
 in
 {
   flake.modules.nixos.janus-ca =
@@ -102,7 +102,7 @@ in
     };
   };
 
-  perSystem = { pkgs, lib, ... }: {
+  perSystem = { system, pkgs, lib, ... }: {
     packages.janus-ca = inputs.wrappers.lib.wrapPackage {
       inherit pkgs;
       package = pkgs.step-cli;

modules/hosts/janus/fingerprint

@@ -0,0 +1 @@
+2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6

modules/hosts/john-pc/default.nix

@@ -3,26 +3,23 @@ let
   username = "john";
   hostname = "john-pc-ubuntu";
 
-  testHost = "soteria"; # which host to test build
-  testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
-  resolvedTarget = "test-nix";
   # testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
+  # testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
+  testHost = "soteria"; # which host to test build
+  testTarget = "test-nix";
 
 in
 {
   flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }:
   let
-    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
+    selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
     resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
-
-    testPushCmd = (pkgs.writeShellScriptBin "test-push" ''
-      ${lib.getExe' pkgs.coreutils "echo"} "Pushing ${testHost} to ${resolvedTarget}"
-      ${lib.getExe pkgs.nh} os switch ${flakeDir}#${testHost} \
-        -e passwordless \
-        --target-host ${resolvedTarget} \
-        --diff always \
-        "$@"
-    '');
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
+    test-push = with pkgs; writeShellApplication {
+      name = "test-push";
+      runtimeInputs = [ nh ];
+      text = ''nh os switch ${flakeDir}#${testHost} --target-host root@${testTarget} -e none'';
+    };
   in
   {
     imports = with inputs.self.modules.homeManager; [
@@ -46,8 +43,11 @@ in
     home.homeDirectory = "/home/${username}";
     home.packages = with pkgs; [
       nixos-rebuild
-      testPushCmd
-      inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.my-neovim
+      test-push
+      selfPkgs.neovim-min
+      # ${selfPkgs}.my-neovim
+      selfPkgs.richPrinter
+      selfPkgs.janus-ca
     ];
 
     shell.program = "zsh";

modules/nix-tools/rebuild.nix

@@ -6,11 +6,21 @@
       flakeDir = config.rebuild.flakeDir;
       echoCmd = lib.getExe' pkgs.coreutils "echo";
       hostnameCmd = "$(${lib.getExe pkgs.hostname} -s)";
-      nfs = (pkgs.writeShellScriptBin "nfs" ''
-        HOSTNAME=${hostnameCmd}
-        ${echoCmd} "Switching to the $HOSTNAME nixos profile"
-        sudo ${lib.getExe pkgs.nixos-rebuild} switch --impure --flake ${flakeDir}#$HOSTNAME
-      '');
+
+      nfs = with pkgs; writeShellApplication {
+        name = "nfs";
+        runtimeInputs = [ coreutils hostname nh ];
+        text = ''
+          HOSTNAME=$(hostname -s)
+          echo "Switching to the $HOSTNAME nixos profile"
+          sudo nh os switch "$@" ${flakeDir}#$HOSTNAME
+        '';
+      };
+      nfsu = with pkgs; writeShellApplication {
+        name = "nfsu";
+        runtimeInputs = [ nfs pkgs.git ];
+        text = ''nfs --refresh "$@"'';
+      };
     in
     {
       options.rebuild = {
@@ -22,29 +32,73 @@
       };
 
       config = {
-        environment.systemPackages = with pkgs; [
-          nfs
-          (writeShellScriptBin "nfsu" ''
-            ${lib.getExe nix} flake update --impure --flake ${flakeDir}
-            ${lib.getExe git} -C ${flakeDir} add ${flakeDir}/flake.lock > /dev/null 2>&1
-            ${lib.getExe nfs}
-          '')
-        ];
+        environment.systemPackages = with pkgs; [ nfs nfsu ];
       };
     };
 
   flake.modules.homeManager.rebuild =
     { config, pkgs, lib, ... }:
     let
-      nixBin = lib.getExe pkgs.nix;
       flakeDir = config.homeManagerFlakeDir;
-      echoCmd = lib.getExe' pkgs.coreutils "echo";
       hostnameCmd = "$(${lib.getExe pkgs.hostname} -s)";
-      nhms = (pkgs.writeShellScriptBin "nhms" ''
-        HOSTNAME=${hostnameCmd}
-        ${echoCmd} "Switching to the $HOSTNAME home-manager profile"
-        ${lib.getExe pkgs.nh} home switch ${flakeDir} -c $HOSTNAME "$@"
-      '');
+
+      flake-parts-check = with pkgs; writeShellApplication {
+        name = "flake-parts-check";
+        runtimeInputs = [ nix ];
+        text = ''
+          cd ${flakeDir}
+          nix run "${flakeDir}#write-flake"
+          nix flake check
+        '';
+      };
+
+      nhms = with pkgs; writeShellApplication {
+        name = "nhms";
+        runtimeInputs = [ coreutils hostname nh ];
+        text = ''
+          HOSTNAME=$(hostname -s)
+          echo "Switching to the $HOSTNAME home-manager profile"
+          nh home switch ${flakeDir} -c "$HOSTNAME" "$@"
+        '';
+      };
+
+      nhmu = with pkgs; writeShellApplication {
+        name = "nhmu";
+        runtimeInputs = [ nhms ];
+        text = ''nhms --update'';
+      };
+
+      test-build = with pkgs; writeShellApplication {
+        name = "test-build";
+        runtimeInputs = [ coreutils nix hostname ];
+        text = ''
+          if [ -z "$1" ]; then
+            HOSTNAME=$(hostname -s)
+          else
+            HOSTNAME="$1"
+          fi
+          echo "Testing the evaulation of the nixos config for $HOSTNAME"
+          nix eval "${flakeDir}#nixosConfigurations.$HOSTNAME.config.system.build.toplevel.drvPath"
+        '';
+      };
+
+      cleanup = with pkgs; writeShellApplication {
+        name = "cleanup";
+        runtimeInputs = [ coreutils home-manager nix ];
+        text = ''
+          set -e
+          DAYS=$1
+          if [ -z "$DAYS" ]; then
+            echo "usage: cleanup <days>"
+            exit 1
+          fi
+          home-manager expire-generations "-$DAYS days"
+          nix profile wipe-history --older-than "''${DAYS}d"
+          nix store gc
+          nix store optimise
+        '';
+      };
+
     in
     {
       options = {
@@ -53,52 +107,25 @@
           type = lib.types.str;
           default = "${config.xdg.configHome}/home-manager";
         };
-        buildHostname = lib.mkOption {
-          description = "Hostname for the NixOS configuration to use.";
-          type = lib.types.str;
-          default = hostnameCmd;
-        };
       };
 
       config = {
         home.activation.printFlakeDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
-          run ${echoCmd} "Home Manager flake directory: ${flakeDir}"
+          run echo "Home Manager flake directory: ${flakeDir}"
         '';
 
         home.packages = with pkgs; [
           home-manager
-          (writeShellScriptBin "flake-parts-check" ''
-            cd ${flakeDir}
-            ${nixBin} run "${flakeDir}#write-flake"
-            ${nixBin} flake check
-          '')
-          nhms
-          (writeShellScriptBin "nhmu" ''
-            ${lib.getExe nhms} --update
-          '')
-
-          (writeShellScriptBin "test-build" ''
-            if [ -z "$1" ]; then
-              HOSTNAME=${hostnameCmd}
-            else
-              HOSTNAME="$1"
-            fi
-            ${echoCmd} "Testing the evaulation of the nixos config for $HOSTNAME"
-            ${lib.getExe nix} eval ${flakeDir}#nixosConfigurations.$HOSTNAME.config.system.build.toplevel.drvPath
-          '')
-
-          (writeShellScriptBin "cleanup" ''
-            set -e
-            DAYS=$1
-            if [ -z "$DAYS" ]; then
-              ${echoCmd} "usage: cleanup <days>"
-              exit 1
-            fi
-            ${lib.getExe home-manager} expire-generations "-$DAYS days"
-            ${lib.getExe nix} profile wipe-history --older-than "''${DAYS}d"
-            ${lib.getExe nix} store gc
-            ${lib.getExe nix} store optimise
-          '')
+          (symlinkJoin {
+            name = "build-tools";
+            paths = [
+              flake-parts-check
+              nhms
+              nhmu
+              test-build
+              cleanup
+            ];
+          })
         ];
       };
     };

modules/programs/zsh.nix

@@ -93,9 +93,13 @@ in
             git.enable = true;
             # git.neogit.enable = true;
             extraPlugins = with pkgs.vimPlugins; {
+              icons = {
+                package = nvim-web-devicons;
+              };
               octo = {
                 package = octo-nvim;
-                after = ["telescope"];
+                setup = "require('octo').setup {}";
+                after = ["telescope" "icons"];
               };
             };