Add 1Password GUI and CLI via NixOS programs module

Enables programs._1password (CLI) and programs._1password-gui with
polkit authorization for user chexit. allowUnfree is already set,
so packages install without additional config.

https://claude.ai/code/session_01NS2hpapno51a1Ng7hWaQKy

.github/workflows/check.yml

@@ -0,0 +1,46 @@
+name: Check NixOS Config
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/share/swift /usr/local/lib/android \
+            /opt/ghc /opt/hostedtoolcache/CodeQL /usr/local/share/boost \
+            "$AGENT_TOOLSDIRECTORY"
+          sudo docker image prune --all --force || true
+          df -h
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+
+      - name: Setup Cachix
+        uses: cachix/cachix-action@v15
+        with:
+          name: chexit   
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - name: Check flake syntax
+        run: nix flake check --no-build
+
+      - name: Build system config
+        run: |
+          nix build .#nixosConfigurations.chexit.config.system.build.toplevel \
+            --no-link \
+            --print-build-logs

configuration.nix

@@ -7,6 +7,7 @@
     ./desktop.nix
     ./nvidia.nix
     ./shell.nix
+    # ./yami-dev-stack.nix  # uncomment to enable Yami dev stack, then set services.yami-dev-stack below
   ];
 
   nix = {
@@ -76,10 +77,16 @@
   users.users.chexit = {
     isNormalUser = true;
     description = "chexit";
-    shell = pkgs.zsh;
+    shell = pkgs.fish;
     extraGroups = [ "networkmanager" "wheel" "docker" ];
   };
 
+  programs._1password.enable = true;
+  programs._1password-gui = {
+    enable = true;
+    polkitPolicyOwners = [ "chexit" ];
+  };
+
   programs.throne = {
     enable = true;
     tunMode.enable = true;
@@ -94,7 +101,8 @@
   programs.gamemode.enable = true;
 
   services.tailscale.enable = true;
-  virtualisation.docker.enable = true;
+  # Docker is now managed by yami-dev-stack.nix when that module is enabled.
+  # services.yami-dev-stack = { enable = true; user = "chexit"; };
 
   system.stateVersion = "25.11";
 }

flake.lock

@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776454077,
+        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1776169885,
+        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

home.nix

@@ -1,18 +1,20 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   home.username = "chexit";
   home.homeDirectory = "/home/chexit";
   home.stateVersion = "25.11";
 
-  programs.zsh = {
+  programs.fish = {
     enable = true;
-    enableCompletion = true;
+    shellAliases = {
-    autosuggestion.enable = true;
+      rebuild = "sudo nixos-rebuild switch --flake ~/nixos-config#chexit";
-    syntaxHighlighting.enable = true;
+    };
-    initContent = ''
+  };
-      source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
+
-    '';
+  programs.starship = {
+    enable = true;
+    enableFishIntegration = true;
   };
 
   programs.home-manager.enable = true;

packages.nix

@@ -4,7 +4,7 @@
   nixpkgs.config.allowUnfree = true;
 
   environment.systemPackages = with pkgs; [
-    # системное
+    # system
     wget
     git
     htop
@@ -14,11 +14,12 @@
     kdePackages.qtstyleplugin-kvantum
     kdePackages.kate
 
-    # софт
+    # soft
     firefox
     vesktop
     materialgram
     termius
+    throne
 
     # dev
     vscode

shell.nix

@@ -1,5 +1,5 @@
 { ... }:
 
 {
-  programs.zsh.enable = true;
+  programs.fish.enable = true;
 }

yami-dev-stack.nix

@@ -0,0 +1,159 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.yami-dev-stack;
+in
+{
+  options.services.yami-dev-stack = {
+    enable = mkEnableOption "Yami development stack (gitea, postgres, docker, runner)";
+
+    user = mkOption {
+      type = types.str;
+      description = "User that will own runner token and be added to docker group";
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # ── Systemd target ─────────────────────────────────────────────────────────
+    # Manual-only: nothing in wantedBy, so it never starts on boot.
+    systemd.targets.yami-dev = {
+      description = "Yami development stack (gitea, postgres, docker, runner)";
+      wantedBy = [ ];
+    };
+
+    # ── PostgreSQL 16 ──────────────────────────────────────────────────────────
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_16;
+      ensureDatabases = [ "gitea" ];
+      ensureUsers = [
+        {
+          name = "gitea";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    # Pull postgres under yami-dev.target; stop it when target stops.
+    systemd.services.postgresql = {
+      wantedBy = mkForce [ "yami-dev.target" ];
+      partOf   = [ "yami-dev.target" ];
+    };
+
+    # ── Gitea ──────────────────────────────────────────────────────────────────
+    services.gitea = {
+      enable   = true;
+      appName  = "Yami Git";
+
+      database = {
+        type   = "postgres";
+        socket = "/run/postgresql";
+        name   = "gitea";
+        user   = "gitea";
+      };
+
+      settings = {
+        server = {
+          DOMAIN           = "localhost";
+          ROOT_URL         = "http://localhost:3000/";
+          HTTP_ADDR        = "0.0.0.0";
+          HTTP_PORT        = 3000;
+          SSH_PORT         = 2222;
+          START_SSH_SERVER = true;
+          LFS_START_SERVER = true;
+        };
+
+        service = {
+          DISABLE_REGISTRATION      = true;
+          DEFAULT_KEEP_EMAIL_PRIVATE = true;
+        };
+
+        repository = {
+          DEFAULT_BRANCH         = "main";
+          ENABLE_PUSH_CREATE_USER = true;
+          ENABLE_PUSH_CREATE_ORG  = true;
+        };
+
+        actions = {
+          ENABLED             = true;
+          DEFAULT_ACTIONS_URL = "github";
+          LOG_RETENTION_DAYS  = 14;
+          ARTIFACT_RETENTION_DAYS = 30;
+        };
+
+        packages = {
+          ENABLED = true;
+        };
+
+        session = {
+          COOKIE_SECURE = false;
+        };
+
+        "cron.git_gc_repos" = {
+          ENABLED  = true;
+          SCHEDULE = "@every 72h";
+          ARGS     = "--aggressive --prune=now";
+        };
+      };
+    };
+
+    systemd.services.gitea = {
+      wantedBy = mkForce [ "yami-dev.target" ];
+      partOf   = [ "yami-dev.target" ];
+      after    = [ "postgresql.service" ];
+      requires = [ "postgresql.service" ];
+    };
+
+    # ── Docker ─────────────────────────────────────────────────────────────────
+    virtualisation.docker = {
+      enable      = true;
+      enableOnBoot = false;
+    };
+
+    systemd.services.docker = {
+      wantedBy = mkForce [ "yami-dev.target" ];
+      partOf   = [ "yami-dev.target" ];
+    };
+
+    users.users.${cfg.user}.extraGroups = [ "docker" ];
+
+    # ── Gitea Actions Runner ───────────────────────────────────────────────────
+    services.gitea-actions-runner.instances.default = {
+      enable    = true;
+      name      = "home-runner";
+      url       = "http://localhost:3000";
+      tokenFile = "/var/lib/gitea-runner/token";
+      labels    = [
+        "ubuntu-latest:docker://node:20"
+        "native:host"
+      ];
+    };
+
+    systemd.services."gitea-runner-default" = {
+      wantedBy = mkForce [ "yami-dev.target" ];
+      partOf   = [ "yami-dev.target" ];
+      after    = [ "gitea.service" "docker.service" ];
+      requires = [ "gitea.service" "docker.service" ];
+    };
+
+    # Directory for the runner token file; owner matches the runner service user.
+    systemd.tmpfiles.rules = [
+      "d /var/lib/gitea-runner 0700 gitea-runner gitea-runner -"
+    ];
+
+    # ── Shell aliases ──────────────────────────────────────────────────────────
+    environment.shellAliases = {
+      yami-up     = "sudo systemctl start yami-dev.target && echo 'Gitea → http://localhost:3000'";
+      yami-down   = "sudo systemctl stop yami-dev.target && echo 'Yami dev stack stopped'";
+      yami-status = "systemctl status yami-dev.target gitea postgresql docker gitea-runner-default --no-pager";
+      yami-logs   = "journalctl -u gitea -u gitea-runner-default -f";
+    };
+
+    # ── Firewall ───────────────────────────────────────────────────────────────
+    # Merged with existing rules (Steam etc.); does not overwrite them.
+    networking.firewall.allowedTCPPorts = [ 3000 2222 ];
+  };
+}