Update Work Laptop #42

Merged

cameron merged 1 commit from work-laptop-improvements into main

2026-07-06 12:55:09 -04:00

cameron commented

2026-07-06 12:48:17 -04:00

Owner

Summary

This updates the cavanhouzen-nix work laptop configuration to move user-scoped settings into Home Manager, clean up redundant host defaults, switch the managed Wi-Fi profile to BenchWifi, and add hardware-backed authentication improvements for disk unlock and PAM.

Changes

Home Manager for work laptop

Added a new work-laptop/home.nix Home Manager module for the cavanhouzen user.
Wired Home Manager into the cavanhouzen-nix flake configuration.
Moved user-scoped configuration out of the NixOS host module:
- user packages
- Firefox
- direnv
- tmux
- SSH client config
- Git identity and signing config
Updated the new Home Manager profile to home.stateVersion = "26.11".
Modernized Git SSH signing by using first-class Home Manager options:
- programs.git.signing.format = "ssh"
- programs.git.signing.key
- programs.git.signing.signByDefault

Work laptop host cleanup

Removed redundant/default host settings:
- i18n.defaultLocale = "en_US.UTF-8"
- services.xserver.xkb.layout = "us"
- services.xserver.xkb.variant = ""
Kept system-level configuration in NixOS where appropriate:
- user account declaration
- password hash secret
- SSH private key secret materialization
- nix-ld
- nh
- OpenSSH daemon
- unfree package allowance

BenchWifi NetworkManager profile

Replaced the managed MIDGUEST NetworkManager profile with BenchWifi.
Added a new encrypted benchwifi.age secret for the Wi-Fi PSK.
Registered the new secret in work-laptop/secrets/secrets.nix.
Removed now-redundant NetworkManager profile defaults:
- Wi-Fi infrastructure mode
- IPv4 auto method
- IPv6 auto method
Removed the old midguest.age secret from the work laptop secrets.

LUKS unlock improvements

Enabled systemd stage 1 initrd.
Configured the root LUKS device to unlock with an enrolled FIDO2 security key via:
```
crypttabExtraOpts = [ "fido2-device=auto" ];
```

## Summary This updates the `cavanhouzen-nix` work laptop configuration to move user-scoped settings into Home Manager, clean up redundant host defaults, switch the managed Wi-Fi profile to BenchWifi, and add hardware-backed authentication improvements for disk unlock and PAM. ## Changes ### Home Manager for work laptop - Added a new `work-laptop/home.nix` Home Manager module for the `cavanhouzen` user. - Wired Home Manager into the `cavanhouzen-nix` flake configuration. - Moved user-scoped configuration out of the NixOS host module: - user packages - Firefox - direnv - tmux - SSH client config - Git identity and signing config - Updated the new Home Manager profile to `home.stateVersion = "26.11"`. - Modernized Git SSH signing by using first-class Home Manager options: - `programs.git.signing.format = "ssh"` - `programs.git.signing.key` - `programs.git.signing.signByDefault` ### Work laptop host cleanup - Removed redundant/default host settings: - `i18n.defaultLocale = "en_US.UTF-8"` - `services.xserver.xkb.layout = "us"` - `services.xserver.xkb.variant = ""` - Kept system-level configuration in NixOS where appropriate: - user account declaration - password hash secret - SSH private key secret materialization - `nix-ld` - `nh` - OpenSSH daemon - unfree package allowance ### BenchWifi NetworkManager profile - Replaced the managed `MIDGUEST` NetworkManager profile with `BenchWifi`. - Added a new encrypted `benchwifi.age` secret for the Wi-Fi PSK. - Registered the new secret in `work-laptop/secrets/secrets.nix`. - Removed now-redundant NetworkManager profile defaults: - Wi-Fi infrastructure mode - IPv4 auto method - IPv6 auto method - Removed the old `midguest.age` secret from the work laptop secrets. ### LUKS unlock improvements - Enabled systemd stage 1 initrd. - Configured the root LUKS device to unlock with an enrolled FIDO2 security key via: ```nix crypttabExtraOpts = [ "fido2-device=auto" ];

cameron added 1 commit

2026-07-06 12:48:17 -04:00