Nix configurations of thrix.

Used to manage developer laptop based on Bootable Containers and nix-toolbox.

Materializes Home Manager symlinks as real files so the Silverblue host can read them from outside the toolbox container. Useful for any config file that a host-side program (sway, waybar, foot, firefox) needs to access directly.

In your flake.nix:

inputs = {
  nix-config = {
    url = "github:thrix/nix-config";
    inputs.nixpkgs.follows = "nixpkgs";
    inputs.home-manager.follows = "home-manager";
  };
};

homeConfigurations."alice" = home-manager.lib.homeManagerConfiguration {
  pkgs = nixpkgs.legacyPackages.x86_64-linux;
  modules = [
    inputs.nix-config.homeManagerModules.hostConfig
    ./home.nix
  ];
};

In your home.nix:

hostConfig = {
  enable = true;

  # Automatically materialize all xdg.desktopEntries as real files
  xdgDesktopEntries = true;

  # Any other Home Manager-managed files the host needs to read
  files = [
    ".config/sway/config"
    ".config/waybar/config"
  ];
};

Runs HashiCorp Vault as a systemd user service with pluggable auto-unseal and plugin management. Designed for personal use — generates short-lived tokens (GitHub, GitLab) instead of managing long-lived PATs.

• Vault server as a systemd user service (file storage, localhost only, UI enabled)
• Pluggable unseal: 1password, file, or manual
• Plugin management: copies plugin binaries from nix store to Vault's plugin directory
• Manual unseal via vault-unseal command (also re-logins and triggers refresh timers)
• Web UI at http://127.0.0.1:8200/ui

In your flake.nix:

inputs = {
  nix-config = {
    url = "github:thrix/nix-config";
    inputs.nixpkgs.follows = "nixpkgs";
    inputs.home-manager.follows = "home-manager";
  };
};

homeConfigurations."alice" = home-manager.lib.homeManagerConfiguration {
  pkgs = nixpkgs.legacyPackages.x86_64-linux;
  modules = [
    inputs.nix-config.homeManagerModules.vault
    ./home.nix
  ];
};

In your home.nix:

# Minimal — manual unseal
vault.enable = true;

# With 1Password auto-unseal
vault = {
  enable = true;
  unseal.method = "1password";
};

# With file-based auto-unseal
vault = {
  enable = true;
  unseal = {
    method = "file";
    file.path = "~/.vault/unseal-key";
  };
};

After make switch:

# 1. Check Vault is running
systemctl --user status vault

# 2. Initialize Vault (one-time)
vault-bootstrap

# 3. Store the printed unseal key + root token in 1Password
#    (vault-bootstrap prints the exact command)

# 4. Open a new shell — auto-unseal happens via biometric prompt

# 5. Verify
vault status

To replace long-lived GitHub PATs with 1-hour auto-expiring tokens:

1. Create a GitHub App with needed permissions
2. Install it on your account/orgs
3. Download the private key (.pem)
4. Run vault-setup-github — it registers the plugin and configures the App

# Get a short-lived token
vault read -field=token github/token

# Use the ght alias
export GITHUB_TOKEN=$(ght)

To replace long-lived GitLab PATs with short-lived group access tokens, via the vault-plugin-secrets-gitlab plugin. Both gitlab.com and gitlab.cee.redhat.com are supported as named configs (com and cee) under a single gitlab/ mount.

1. Create a GitLab token with the api scope and Owner on the group you want to mint tokens for (a personal access token, or a group access token — no instance-admin rights required)
2. Run vault-setup-gitlab — it registers the plugin, enables the engine, and prompts for the instance + group/role details. Run it once per instance (use names com and cee)

# Get a short-lived token
vault read -field=token gitlab/token/com

# Use the glt / glt-cee aliases
export GITLAB_TOKEN=$(glt)        # gitlab.com
export GITLAB_TOKEN=$(glt-cee)    # gitlab.cee.redhat.com

The gitlab-mcp and gitlab-cee-mcp refresh timers re-mint these tokens and recreate the corresponding toolhive MCP servers before each lease expires, the same way github-thrix does.