add machine: grymforge

flake.nix

@@ -45,6 +45,11 @@
         "x86_64-darwin"
         "aarch64-darwin"
       ];
+      perSystem =
+        { pkgs, ... }:
+        {
+          formatter = pkgs.nixfmt-tree;
+        };
       imports = [
         (inputs.import-tree ./modules/top)
         (inputs.import-tree ./modules/hosts)

modules/features/editor-neovim-package.nix

@@ -1,8 +1,11 @@
 { ... }:
 {
   config.dendritic.features.editor-neovim.homeModules = [
-    ({ pkgs, ... }: {
+    (
+      { pkgs, ... }:
+      {
         home.packages = with pkgs; [ neovim ];
-    })
+      }
+    )
   ];
 }

modules/features/nvim.nix

@@ -1,7 +1,9 @@
 { inputs, ... }:
 {
   config.dendritic.features.editor-neovim.homeModules = [
-    ({ pkgs, lib, ... }: {
+    (
+      { pkgs, lib, ... }:
+      {
         imports = [
           inputs.nvf.homeManagerModules.default
           ../home/programs/neovim/options.nix
@@ -90,6 +92,7 @@
             }
           ];
         };
-    })
+      }
+    )
   ];
 }

modules/features/programs/cli/cli-programs.nix

@@ -11,6 +11,7 @@
 
           home.packages = with pkgs; [
             vhs
+            libqalculate
           ];
         }
       )

modules/features/programs/cli/cli-tmux.nix

@@ -79,7 +79,7 @@
               bind -N "⌘+^+t join pane" J join-pane -t 1
               bind -N "⌘+e editor" E new-window -S -n '📝' 'nvim +GoToFile'
 
-              bind -N "⌘+g lazyjj" g new-window -S -n '🌳' 'lazyjj'
+              bind -N "⌘+g jjui" g new-window -S -n '🌳' 'jjui'
 
               bind -N "⌘+⇧+Q kill current session" Q kill-session
               bind -N "⌘+⇧+T break pane" B break-pane
@@ -116,7 +116,7 @@
             fzf
             fd
             zoxide
-            lazyjj
+            jjui
           ];
 
           programs.zsh = {

modules/features/secrets-sops.nix

@@ -2,7 +2,9 @@
 {
   config.dendritic.features = {
     secrets-home-sops.homeModules = [
-      ({ inputs, config, ... }: {
+      (
+        { inputs, config, ... }:
+        {
           imports = [
             inputs.sops-nix.homeModules.sops
           ];
@@ -14,11 +16,14 @@
           sops.secrets."user/test" = {
             path = ".config/secrets/test";
           };
-      })
+        }
+      )
     ];
 
     secrets-system-sops.nixosModules = [
-      ({ inputs, config, ... }: {
+      (
+        { inputs, config, ... }:
+        {
           imports = [
             inputs.sops-nix.nixosModules.sops
           ];
@@ -28,7 +33,8 @@
           sops.age.keyFile = "/home/${config.dendritic.current.primaryUser}/.config/sops/age/keys.txt";
 
           sops.secrets."system/example" = { };
-      })
+        }
+      )
     ];
   };
 }

modules/home/devenv.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   home.packages = with pkgs; [
     cachix
     devenv

modules/home/programs/atuin.nix

@@ -1,5 +1,6 @@
 # ✨ Magical shell history
-{...}: {
+{ ... }:
+{
   programs.atuin = {
     enable = true;
     flags = [

modules/home/programs/bat.nix

@@ -1,5 +1,6 @@
 # A cat clone with syntax highlighting and Git integration.
-{...}: {
+{ ... }:
+{
   programs.bat = {
     enable = true;
   };

modules/home/programs/broot.nix

@@ -1,5 +1,6 @@
 # An interactive treeview directory navigator
-{...}: {
+{ ... }:
+{
   programs.broot = {
     enable = true;
     enableZshIntegration = true;

modules/home/programs/btop.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   programs.btop = {
     enable = true;
   };

modules/home/programs/eza.nix

@@ -1,5 +1,6 @@
 # A modern replacement for 'ls'.
-{...}: {
+{ ... }:
+{
   programs.eza = {
     enable = true;
     enableZshIntegration = true;

modules/home/programs/fzf.nix

@@ -3,11 +3,13 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   accent = "#" + config.lib.stylix.colors.base0D;
   foreground = "#" + config.lib.stylix.colors.base05;
   muted = "#" + config.lib.stylix.colors.base03;
-in {
+in
+{
   programs.fzf = {
     enable = true;
     enableZshIntegration = true;

modules/home/programs/ghostty.nix

@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   programs.ghostty = {
     enable = true;
     enableZshIntegration = true;

modules/home/programs/k9s.nix

@@ -1,5 +1,6 @@
 # A terminal-based Kubernetes CLI.
-{...}: {
+{ ... }:
+{
   programs.k9s = {
     enable = true;
   };

modules/home/programs/niri/applications.nix

@@ -1,4 +1,5 @@
-{pkgs}: {
+{ pkgs }:
+{
   browser = "${pkgs.firefox}/bin/firefox";
   terminal = "${pkgs.ghostty}/bin/ghostty";
   fileManager = "${pkgs.thunar}/bin/thunar";

modules/home/programs/niri/settings.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   home.sessionVariables = {
     XDG_ICON_DIR = "${pkgs.whitesur-icon-theme}/share/icons/WhiteSur";
     GSETTINGS_SCHEMA_DIR = "${pkgs.gsettings-desktop-schemas}/share/gsettings-schemas/${pkgs.gsettings-desktop-schemas.name}/glib-2.0/schemas";

modules/home/programs/pass.nix

@@ -1,5 +1,6 @@
 # ✨ password manager
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.password-store = {
     enable = true;
     package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);

modules/home/programs/starship.nix

@@ -3,10 +3,12 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   accent = "#${config.lib.stylix.colors.base0D}";
   background-alt = "#${config.lib.stylix.colors.base01}";
-in {
+in
+{
   programs.starship = {
     enable = true;
     enableZshIntegration = true;

modules/hosts/grymforge.nix

@@ -0,0 +1,22 @@
+{
+  config.dendritic.hosts.grymforge = {
+    system = "x86_64-linux";
+    type = "desktop";
+    roles = [
+      "workstation"
+    ];
+    primaryUser = "gwg313";
+    primaryUserExtraGroups = [
+      "wheel"
+      "networkmanager"
+      "audio"
+    ];
+
+    nixosModules = [
+      ../nixos/hardware/grymforge.nix
+      ../nixos/hosts/candlekeep/ssh.nix
+      ../nixos/hosts/candlekeep/nfs.nix
+      ../nixos/hosts/candlekeep/networking.nix
+    ];
+  };
+}

modules/nixos/bluetooth.nix

@@ -2,7 +2,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   config = lib.mkIf config.bluetooth.enable {
     services.blueman.enable = true;
     hardware.bluetooth = {

modules/nixos/comma.nix

@@ -1,4 +1,5 @@
-{_}: {
+{ _ }:
+{
   # Disable so comma can be installed
   programs.command-not-found.enable = false;
   programs.nix-index-database.comma.enable = true;

modules/nixos/gui/dbus.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   services.dbus = {
     enable = true;
     packages = [ pkgs.dconf ];

modules/nixos/gui/gnupg.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;

modules/nixos/gui/wayland.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   environment.systemPackages = with pkgs; [
     wlr-randr
     wl-clipboard

modules/nixos/hardware/candlekeep.nix

@@ -7,7 +7,8 @@
   pkgs,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
     # ../../common/nixos/nfs.nix
@@ -29,14 +30,16 @@
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
     };
-    initrd.luks.devices."luks-1dbfdeb6-8537-41b2-abf0-09373af3eeee".device = "/dev/disk/by-uuid/1dbfdeb6-8537-41b2-abf0-09373af3eeee";
+    initrd.luks.devices."luks-1dbfdeb6-8537-41b2-abf0-09373af3eeee".device =
+      "/dev/disk/by-uuid/1dbfdeb6-8537-41b2-abf0-09373af3eeee";
   };
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/c79b630a-d130-42ed-8cdc-3f8545fe2993";
     fsType = "ext4";
   };
 
-  boot.initrd.luks.devices."luks-96e3b309-ca79-4b42-aca5-3f098b123758".device = "/dev/disk/by-uuid/96e3b309-ca79-4b42-aca5-3f098b123758";
+  boot.initrd.luks.devices."luks-96e3b309-ca79-4b42-aca5-3f098b123758".device =
+    "/dev/disk/by-uuid/96e3b309-ca79-4b42-aca5-3f098b123758";
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/1FBA-8B80";
     fsType = "vfat";

modules/nixos/hardware/grymforge.nix

@@ -0,0 +1,68 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  boot = {
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+
+    initrd.luks.devices."luks-ab8d2b18-14de-44ff-a7b5-91d5f5d0e937".device =
+      "/dev/disk/by-uuid/ab8d2b18-14de-44ff-a7b5-91d5f5d0e937";
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/95565731-9a95-4fcc-857d-1f066f4e4acf";
+    fsType = "ext4";
+  };
+
+  boot.initrd.luks.devices."luks-c140b0df-2cce-4710-a2fa-94dd3016a7e6".device =
+    "/dev/disk/by-uuid/c140b0df-2cce-4710-a2fa-94dd3016a7e6";
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/34C4-ECCE";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/2fea88dc-b9a8-40d6-a87d-f7383548e60d"; }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

modules/nixos/locale.nix

@@ -1,4 +1,5 @@
-{_}: {
+{ _ }:
+{
   # Set your time zone.
   time.timeZone = "America/Toronto";
 

modules/nixos/pipewire.nix

@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   # Enable sound with pipewire.
   hardware.pulseaudio.enable = false;
   # hardware.alsa.enablePersistence = true;

modules/nixos/ssh/ssh_guard.nix

@@ -2,7 +2,8 @@
   config,
   lib,
   ...
-}: {
+}:
+{
   services.sshguard = {
     enable = true;
     services = [

modules/nixos/sysctl/file_system.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   boot.kernel.sysctl = {
     # disallow core dumping by SUID/SGID programs
     "fs.suid_dumpable" = 0;

modules/nixos/sysctl/network.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   boot.kernel.sysctl = {
   };
 }

modules/nixos/sysctl/networking/ipv4.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   boot.kernel.sysctl = {
     # enable BBR congestion control
     "net.ipv4.tcp_congestion_control" = "bbr";

modules/nixos/sysctl/networking/ipv6.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   boot.kernel.sysctl = {
     # disallow IPv6 packet forwarding
     "net.ipv6.conf.default.forwarding" = 0;

modules/nixos/sysctl/virtualization.nix

@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   boot.kernel.sysctl = {
     # do not allow mmap in lower addresses
     "vm.mmap_min_addr" = 65536;

modules/top/inventory/features.nix

@@ -2,7 +2,9 @@
 {
   options.dendritic.features = lib.mkOption {
     type = lib.types.attrsOf (
-      lib.types.submodule ({ name, ... }: {
+      lib.types.submodule (
+        { name, ... }:
+        {
           options = {
             name = lib.mkOption {
               type = lib.types.str;
@@ -29,7 +31,8 @@
               default = true;
             };
           };
-      })
+        }
+      )
     );
     default = { };
   };

modules/top/inventory/hosts.nix

@@ -1,7 +1,10 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   options.dendritic.hosts = lib.mkOption {
     type = lib.types.attrsOf (
-      lib.types.submodule ({name, ...}: {
+      lib.types.submodule (
+        { name, ... }:
+        {
           options = {
             name = lib.mkOption {
               type = lib.types.str;
@@ -13,7 +16,11 @@
             };
 
             type = lib.mkOption {
-            type = lib.types.enum ["laptop" "desktop" "server"];
+              type = lib.types.enum [
+                "laptop"
+                "desktop"
+                "server"
+              ];
             };
 
             roles = lib.mkOption {
@@ -28,7 +35,10 @@
 
             primaryUserExtraGroups = lib.mkOption {
               type = lib.types.listOf lib.types.str;
-            default = ["wheel" "networkmanager"];
+              default = [
+                "wheel"
+                "networkmanager"
+              ];
             };
 
             nixosModules = lib.mkOption {
@@ -36,7 +46,8 @@
               default = [ ];
             };
           };
-      })
+        }
+      )
     );
     default = { };
   };

modules/top/inventory/users.nix

@@ -1,7 +1,10 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   options.dendritic.users = lib.mkOption {
     type = lib.types.attrsOf (
-      lib.types.submodule ({name, ...}: {
+      lib.types.submodule (
+        { name, ... }:
+        {
           options = {
             name = lib.mkOption {
               type = lib.types.str;
@@ -25,7 +28,9 @@
 
             homes = lib.mkOption {
               type = lib.types.attrsOf (
-              lib.types.submodule ({name, ...}: {
+                lib.types.submodule (
+                  { name, ... }:
+                  {
                     options = {
                       host = lib.mkOption {
                         type = lib.types.str;
@@ -51,12 +56,14 @@
                         default = [ ];
                       };
                     };
-              })
+                  }
+                )
               );
               default = { };
             };
           };
-      })
+        }
+      )
     );
     default = { };
   };

modules/users/gwg313.nix

@@ -17,5 +17,12 @@
       roles = [ "workstation" ];
       extraModules = [ ];
     };
+
+    homes.grymforge = {
+      system = "x86_64-linux";
+      stateVersion = "25.11";
+      roles = [ "workstation" ];
+      extraModules = [ ];
+    };
   };
 }

secrets/hosts/grymforge.yaml

@@ -0,0 +1,17 @@
+system:
+    example: ENC[AES256_GCM,data:HGduc8uq6YhzDBM=,iv:IDdNjIjWAhTEzHiGrsuSpHSjidpeFnGdzkiBCjBv5H4=,tag:pm2IGSy3siDAhn2E7lMUhA==,type:str]
+sops:
+    age:
+        - recipient: age1k3hs0gyzrmsdyqh9lpret46q3xaayxxntruzc4euy6h3slqn4u6q36h7rg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0R1VYMmEvdWk5UzBQLzds
+            Q2JzSC9zZFJVWldHbTlkdTIrSXNFLzZqdjBFClJqZmxTSCtjeGwxNjA3VFVscEtP
+            NEhOcU9la2MzNWNEK1NwU0dNTHlPNFUKLS0tIHVWVlRkRHlwb21IemRFS3FTT1kz
+            U21XTEVjNWgzVHVYQ2dDQmIrV21EdGMKw14LaWlK9WbBXxnNvKfNgg44K9/Y7p5H
+            +3QeahQRu8OYn/tFyaMiRxIzLWOhBhtdqAH8k2GN2X5TxzGA1vxGXg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-14T00:22:17Z"
+    mac: ENC[AES256_GCM,data:bPSDTqcfnnUcj80y+9qUfWkX9NcBWdQETMC3qyZYB3FWrJryepWn4bMUEb5IBfwcZXiKWmvyOTXjFYEkx4F4YGZA0qz3usuq6EjeZDSFrpf9Itr9wdc400mc7cf5YFtNOkf+BuE3nsYQDj1KViBKReEgMjZe9bHjvmi1f+utvjM=,iv:DcvjgVAUTily7Xm1+3NCA7/P3+qE05WlQkkqKggm27g=,tag:47TIh6ybU4Cu8QybMxuz/g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2