.sops.yaml

@@ -1,7 +0,0 @@
-keys:
-  - &primary age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
-creation_rules:
-  - path_regex: secrets/secrets.yaml$
-    key_groups:
-      - age:
-        - *primary

flake.nix

@@ -9,41 +9,27 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     disko = {
       url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs =
+  outputs = { nixpkgs, home-manager, disko, ... }: {
-    {
+    nixosConfigurations = {
-      nixpkgs,
+      plexy = nixpkgs.lib.nixosSystem {
-      home-manager,
+        system = "x86_64-linux";
-      sops-nix,
+        modules = [
-      disko,
+          ./hosts/plexy
-      ...
+          home-manager.nixosModules.home-manager
-    }:
+          {
-    {
+            home-manager.useGlobalPkgs = true;
-      nixosConfigurations = {
+            home-manager.useUserPackages = true;
-        plexy = nixpkgs.lib.nixosSystem {
+            home-manager.users.wekuz = import ./hosts/plexy/home.nix;
-          system = "x86_64-linux";
+          }
-          modules = [
+          disko.nixosModules.disko
-            ./hosts/plexy
+        ];
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.wekuz = import ./hosts/plexy/home.nix;
-            }
-            sops-nix.nixosModules.sops
-            disko.nixosModules.disko
-          ];
-        };
       };
     };
+  };
 }

hosts/plexy/default.nix

@@ -1,15 +1,7 @@
-{
+{ config, lib, pkgs, ... }:
-  inputs,
-  pkgs,
-  ...
-}:
 
 {
-  imports = [
+  imports = [ ./hardware-configuration.nix ./disko-config.nix ];
-    ./hardware-configuration.nix
-    inputs.sops-nix.nixosModules.sops
-    ./disko-config.nix
-  ];
 
   nix = {
     package = pkgs.nixVersions.stable;
@@ -20,10 +12,7 @@
       dates = "weekly";
       options = "--delete-older-than 2w";
     };
-    settings.experimental-features = [
+    settings.experimental-features = [ "nix-command" "flakes" ];
-      "nix-command"
-      "flakes"
-    ];
 
     extraOptions = ''
       min-free = 512000000
@@ -41,10 +30,7 @@
 
   hardware.graphics = {
     enable = true;
-    extraPackages = with pkgs; [
+    extraPackages = with pkgs; [ intel-media-driver intel-vaapi-driver ];
-      intel-media-driver
-      intel-vaapi-driver
-    ];
   };
 
   time.timeZone = "Europe/Tallinn";
@@ -53,21 +39,7 @@
     hostName = "plexy";
     networkmanager.enable = true;
     nftables.enable = true;
-    firewall.allowedTCPPorts = [
+    firewall.allowedTCPPorts = [ 22 80 443 ];
-      22
-      80
-      443
-    ];
-  };
-
-  sops = {
-    defaultSopsFile = ./secrets/secrets.yaml;
-    defaultSopsFormat = "yaml";
-    age.keyFile = /var/lib/sops-nix/key.txt;
-
-    secrets = {
-      super_secret_api = { };
-    };
   };
 
   services = {
@@ -78,15 +50,23 @@
     };
   };
 
+  virtualisation = {
+    docker = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        dates = "weekly";
+        randomizedDelaySec = "30min";
+        flags = [ "--all" "--volumes" ];
+      };
+    };
+  };
+
   environment.variables.EDITOR = "nvim";
 
   users.users.wekuz = {
     isNormalUser = true;
-    extraGroups = [
+    extraGroups = [ "wheel" "networkmanager" "docker" ];
-      "wheel"
-      "networkmanager"
-      "docker"
-    ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs3aPxyJpVGytuVSO3va2WybKNFMR241o8DCJQbBEWV"
     ];

hosts/plexy/disko-config.nix

@@ -24,25 +24,16 @@
                 extraArgs = [ "-f" ]; # Override existing partition
                 subvolumes = {
                   "/rootfs" = {
-                    mountOptions = [
+                    mountOptions = [ "compress=zstd" "noatime" ];
-                      "compress=zstd"
-                      "noatime"
-                    ];
                     mountpoint = "/";
                   };
                   "/home" = {
-                    mountOptions = [
+                    mountOptions = [ "compress=zstd" "noatime" ];
-                      "compress=zstd"
-                      "noatime"
-                    ];
                     mountpoint = "/home";
                   };
                   "/home/wekuz" = { };
                   "/nix" = {
-                    mountOptions = [
+                    mountOptions = [ "compress=zstd" "noatime" ];
-                      "compress=zstd"
-                      "noatime"
-                    ];
                     mountpoint = "/nix";
                   };
                   # TODO: /log

hosts/plexy/hardware-configuration.nix

@@ -1,22 +1,10 @@
-{
+{ config, lib, pkgs, modulesPath, ... }:
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [
+  boot.initrd.availableKernelModules =
-    "xhci_pci"
+    [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-    "ahci"
-    "nvme"
-    "usbhid"
-    "usb_storage"
-    "sd_mod"
-  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

hosts/plexy/home.nix

@@ -45,9 +45,7 @@
     };
   };
 
-  programs.zsh = {
+  programs.zsh = { enable = true; };
-    enable = true;
-  };
 
   home.stateVersion = "25.11";
 }

secrets/secrets.yaml

@@ -1,16 +0,0 @@
-super_secret_api: ENC[AES256_GCM,data:k0iECBf6Q0eJ,iv:aZ9nNh7IMK4Ge/xgZblaO86ZEABBW/f8PJV+Kgj2Y0g=,tag:p9x7IsZYIfaa6hlzRPceQw==,type:str]
-sops:
-    age:
-        - recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSERvcGNXdDlUb3NBUm40
-            WW1mVlY5YlpxclBxT3htQ1orbHpxTnBUTEJNCkZaZnUzZUZNQmk0RmU2U2RkOUVI
-            ZElUbVZEMjBNd0hKZkU0WjMzajgySVEKLS0tIE9rNkdoeWJzU1h5U0ZVa2YveGE0
-            eDUxR1V0ZEFSYnZTYnYzakFydEliaFUKoa/gHecAy01vTk7I02KMGGPHZBql5K48
-            hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-30T13:57:31Z"
-    mac: ENC[AES256_GCM,data:OAa6W+v/eeuzSFKbiSzyUoFA40SHYDdhzMzTw35ytBGhfNJRPLNBKnQBnPE1fqkrcc+pQgjrOdhsz+V5EV+ze/7G69HADYxd/G4/zqK3+FyU7CBsNKpoCjXYTcEkBco8t76LEFefmE/BJcUm5JEBZ2Hudnkm50fdyQDIWlips+w=,iv:amKno6v2RUAKOM4Rh126T1RHomxU31MJwmbLkkHc7JU=,tag:/ddTFf1vp7THLK5kh57EzQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0