midchildan / dotfiles

My personal dotfiles.

dotfiles

dotfiles for my personal use.

Requirements

Nix Package Manager

Consult the following for more details.

• Official website
• Official docs

Installation

Step 1: Preparation

Drop into a nix-shell with the following command. This would download some commands required for setup, open a new temporary shell, and make the commands available through PATH.

$ system="$(nix-instantiate --eval -E 'builtins.currentSystem' | tr -d '"')"
$ nix-shell -A "devShells.$system.setup" 'https://github.com/midchildan/dotfiles/archive/main.tar.gz'
$

Step 2: Setup your repository

Fork this repository and clone it to your location of choice. Then edit nix/config.nix and commit the changes.

$ git clone https://github.com/${USER}/dotfiles.git ~/Documents/src/repos/github.com/${USER}/dotfiles
$ cd ~/Documents/src/repos/github.com/${USER}/dotfiles
$ nvim nix/config.nix
$ git commit -am 'chore: adjust config.nix for my own use'

Step 3: Checkout the relevant branch

Using the table in the Supported Platforms section, checkout the most relevant branch for your platform. Note that instead of checking out your chosen branch directly, it is recommended that you create a local branch based on your chosen branch that is tied to your local machine and check it out to a separate path for deployment. This way, you can make edits on any branch without affecting your current configuration.

$ git branch --track local  # create local branch
$ git worktree add ~/.config/dotfiles local  # checkout local branch

Step 4: Symlink dotfiles

Run the setup script. This script would symlink files in files to your home directory. It should be run each time changes are made to your dotfiles even after bootstrapping is complete. The --init flag indicates that this is the first time you've run this script.

$ ./setup.sh --init

Step 5: Bootstrap NixOS / Nix-Darwin / Home Manager Configuration

For details about each, read the docs linked below. Pick the ones you need and configure them as needed before proceeding.

Software	File	Required?
Home Manager	nix/home/README.md	yes
NixOS	nix/nixos/README.md	no
Nix-Darwin	nix/darwin/README.md	no

Bootstrapping instructions for each are listed below. Home Manager can optionally be integrated into NixOS or Nix-Darwin. If you do this, NixOS or Nix-Darwin would take care of bootstrapping Home Manager for you.

• Home Manager:

$ nix run '.#home' -- switch --flake .

• NixOS:

$ sudo nix --experimental-features 'nix-command flakes' run '.#os' -- switch --flake '.#'

• nix-darwin:

$ nix --experimental-features 'nix-command flakes' run '.#os' -- switch --flake '.#'
$ sudo -H nix-env -e '*' # remove existing packages not managed by nix-darwin

Supported platforms

branch	platform
main	Linux
osx	macOS

In addition to the platforms listed above, support for one-off remote Linux sessions is included in the gh-pages branch. This is useful in cases where it's cumbersome to maintain a full-blown dotfiles, e.g. docker sessions, servers you rarely login to directly, etc. Notably, this branch doesn't require Nix. See here for details.

Changes common to all platforms should first be made in main, and then merged into the remaining branches. Make sure you never go the other way and merge non-main branches into main or you'll end up with non-common platform-specific stuff in main.

dotfiles's Issues

The xz backdoor situation

Problem

The upstream tarball of xz was found to be backdoored. Fortunately, it reportedly doesn't affect the Nixpkgs package because the backdoor is only inserted into the binary on DEB and RPM based build environments. However, the user behind the backdoor has other commits in multiple high profile open source projects which haven't been further scrutinized yet.

TODO

• Temporarily downgrade Nixpkgs to a commit that doesn't include the compromised version of xz?
• Apply NixOS/nixpkgs#300028 (Progress)
• Apply NixOS/nixpkgs#300122 (Progress)
• Apply NixOS/nixpkgs#300114 (Progress)

References

• https://www.openwall.com/lists/oss-security/2024/03/29/
• https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405/31
• https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
• https://boehs.org/node/everything-i-know-about-the-xz-backdoor
• https://news.ycombinator.com/item?id=39865810

GnuPG-related options assume that "pinentry_mac" package is installed

In the nix/home/modules/gnupg/default.nix file, there's a binding for the "pinentry-mac" variable that reads the value of pkgs.pinentry_mac, referencing the Nix package. However, I don't see anywhere else in this repository that ensures that the pinentry_mac package will be installed if we're using macOS and GnuPG is enabled.

The nix/home/news.nix file entry from December 2020 mentions a dotfiles.pinentry-mac module, but I don't see such a module present today.

Do we need to mention the pinentry_mac project somewhere, such as in the nix/home/profiles/essential.nix file, or maybe just in the nix/home/modules/gnupg/default.nix file?

Use Nix stable

It'd be soon possible to use flakes without Nix unstable.

TODO

• Wait for Nix 2.4 to reach the nixpkgs-unstable channel (check https://nixpk.gs/pr-tracker.html?pr=144197)
• Re-enable the "Upgrade Dependencies" workflow

Notes

On a related note, Home Manager updates would have to be deferred until Nix 2.4 reaches nixpkgs-unstable or nix-direnv would cease to work with flakes. This is due to Home Manager PR 2458.