configured a spotify widget for waybar

flake.lock

@@ -185,11 +185,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1685729674,
+        "lastModified": 1685808451,
-        "narHash": "sha256-i5+/bAZVmCbeIKmnwyd2DG3mGrP4LOJWbsU7nJ1lzuA=",
+        "narHash": "sha256-IxiTI9WDvhIM8ciAmBX+EARu/B4h+quWLo/8w86tXrc=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "871ab24c6e9d2fb6e48cbf990ddddf0c46a950af",
+        "rev": "df98db50924c05f0bd7a8c95cdab5d4ece13a1f1",
         "type": "github"
       },
       "original": {
@@ -307,11 +307,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1683638468,
+        "lastModified": 1685764721,
-        "narHash": "sha256-tQEaGZfZ2Hpw+XIVEHaJ8FaF1yNQyMDDhUyIQ7LTIEg=",
+        "narHash": "sha256-CIy1iwQTEKfZRrid4gBLA+r/LPGA9IUFo0lKJVyECGI=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "219067a5e3cf4b9581c8b4fcfc59ecd5af953d07",
+        "rev": "669ca1f2e2bc401abab6b837ae9c51503edc9b49",
         "type": "github"
       },
       "original": {
@@ -618,11 +618,11 @@
       "flake": false,
       "locked": {
         "host": "gitlab.freedesktop.org",
-        "lastModified": 1685723274,
+        "lastModified": 1685803001,
-        "narHash": "sha256-mjETVZbVheaSO0VRKQHWYAHcoKwYu0WZ0vhKVN7vyRo=",
+        "narHash": "sha256-yxq/U9zL1ssFZtgT27A96UKteCiKb3zSmbA/dokK76U=",
         "owner": "wlroots",
         "repo": "wlroots",
-        "rev": "6668c822b3bf58ca5af5d370ef03b075be3e4d27",
+        "rev": "b61d5922f1d0910a848deb100570ad8587aea38d",
         "type": "gitlab"
       },
       "original": {

flake.nix

@@ -60,9 +60,12 @@
     , simple-nixos-mailserver
     , ...
     }@attrs: {
-      packages.x86_64-linux.iso = self.nixosConfigurations.iso.config.system.build.isoImage;
+      packages.x86_64-linux = {
-      packages.x86_64-linux.jmri = nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/jmri { };
+        iso = self.nixosConfigurations.iso.config.system.build.isoImage;
-      packages.x86_64-linux.adguardian-term = nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/adguardian-term { };
+        jmri = nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/jmri { };
+        adguardian-term = nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/adguardian-term { };
+        pww = nixpkgs.legacyPackages.x86_64-linux.callPackage ./pkgs/pww { };
+      };
       hydraJobs = self.packages;
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
       nixosConfigurations = {

hosts/falkenstein-1/default.nix

@@ -56,6 +56,10 @@
     ports = [ 2222 ];
     settings.PasswordAuthentication = false;
   };
+  security = {
+    audit.enable = true;
+    auditd.enable = true;
+  };
   users.users.root.openssh.authorizedKeys.keyFiles = [
     ../../keys/ssh/rouven-thinkpad
     ../../keys/ssh/rouven-pixel

hosts/nuc/default.nix

@@ -64,6 +64,11 @@
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
+  security = {
+    audit.enable = true;
+    auditd.enable = true;
+  };
+
 
   # firmware updates
   services.fwupd.enable = true;

hosts/thinkpad/default.nix

@@ -46,7 +46,6 @@
   sops.age.sshKeyPaths = lib.mkForce [ "/nix/persist/system/etc/ssh/ssh_host_ed25519_key" ];
   sops.gnupg.sshKeyPaths = lib.mkForce [ ];
 
-
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
   console = {
@@ -87,7 +86,11 @@
   #hardware.pulseaudio.enable = true;
   hardware.bluetooth.enable = true;
 
-  security.polkit.enable = true;
+  security = {
+    polkit.enable = true;
+    audit.enable = true;
+    auditd.enable = true;
+  };
 
   services.pipewire = {
     enable = true;
@@ -120,7 +123,11 @@
       nssmdns = true;
     };
     fprintd.enable = true; # log in using fingerprint
-    openssh.enable = true; # enabled ssh to have the host keys
+    # enabled ssh to have the host keys
+    openssh = {
+      enable = true;
+      openFirewall = false;
+    };
     btrfs.autoScrub.enable = true; # periodically check filesystem and repair it
     fwupd.enable = true; # firmware updates
   };

pkgs/pww/default.nix

@@ -0,0 +1,26 @@
+{ stdenv, lib, buildGoModule, path, pkgs, go, fetchFromGitHub, playerctl }:
+buildGoModule rec {
+  pname = "pww";
+  version = "unstable-2023-04-06";
+
+  src = fetchFromGitHub {
+    owner = "abenz1267";
+    repo = "pww";
+    rev = "8c973e600052d1c94a0921ed10d0723c123187c6"; # unstable because 6.0.0 has some crashes
+    hash = "sha256-IqLo1MlPGaM0n0TEhptiM5FvqJ8bsEPn7N2EEL6iWK8=";
+  };
+
+  buildInputs = [ playerctl ];
+
+  outputs = [ "out" ];
+
+  vendorSha256 = "sha256-3PnXB8AfZtgmYEPJuh0fwvG38dtngoS/lxyx3H+rvFs=";
+
+  meta = with lib; {
+    description = "Utility wrapper around playerctl";
+    homepage = "https://github.com/Mic92/sops-nix";
+    license = licenses.mit;
+    maintainers = with maintainers; [ therealr5 ];
+    platforms = platforms.all;
+  };
+}

users/rouven/fixes.nix

@@ -1,5 +1,10 @@
 { pkgs, ... }:
 {
+  # open ports for kde connect
+  networking.firewall = rec {
+    allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
+    allowedUDPPortRanges = allowedTCPPortRanges;
+  };
   # fixes pam entries for swaylock
   security.pam.services.swaylock.text = ''
     # Account management.

users/rouven/modules/hyprland/waybar.nix

@@ -1,7 +1,6 @@
-{ config, pkgs, hyprland, ... }:
+{ self, config, pkgs, hyprland, ... }:
 {
-  # waybar needs hyprctl
+  systemd.user.services.waybar.Service.Environment = "PATH=${pkgs.hyprland}/bin:${pkgs.playerctl}/bin:${pkgs.pulseaudio}/bin";
-  systemd.user.services.waybar.Service.Environment = "PATH=${pkgs.hyprland}/bin";
   programs.waybar = {
     enable = true;
     systemd.enable = true;
@@ -11,7 +10,7 @@
         layer = "top";
         position = "top";
         height = 26;
-        modules-left = [ "wlr/workspaces" "hyprland/window" ];
+        modules-left = [ "wlr/workspaces" "hyprland/window" "custom/spotifytitle" ];
         modules-right = [ "network" "cpu" "temperature" "pulseaudio" "battery" "tray" "clock" ];
         network = {
           format-wifi = "  {essid} ({signalStrength}%)";
@@ -29,6 +28,13 @@
           format = "   {}";
           separate-outputs = true;
         };
+
+        "custom/spotifytitle" = {
+          format = "  {}";
+          max-length = 80;
+          return-type = "json";
+          exec = "${self.packages.x86_64-linux.pww}/bin/pww -w spotifyd:title -f '{{title}} - {{artist}}' -p None 2> /dev/null";
+        };
         cpu = {
           format = "{usage}% ";
         };
@@ -101,6 +107,7 @@
         background-color: #eb4d4b;
     }
     
+    #custom-spotifytitle,
     #clock,
     #battery,
     #cpu,
@@ -129,6 +136,20 @@
         background-color: #${config.colorScheme.colors.base00};
     }
     
+    #custom-spotifytitle {
+        background: #1db954;
+        color: #191414;
+        opacity: 1;
+        transition-property: opacity;
+        transition-duration: 0.25s;
+    }
+    
+    #custom-spotifytitle.Paused,
+    #custom-spotifytitle.Stopped,
+    #custom-spotifytitle.Inactive {
+        opacity: 0.5;
+    }
+
     #battery {
         background-color: #${config.colorScheme.colors.base02};
         color: #${config.colorScheme.colors.base05};

users/rouven/modules/packages.nix

@@ -69,6 +69,11 @@
     # })
   ];
 
+  services.kdeconnect = {
+    enable = true;
+    indicator = true;
+  };
+
   xdg.mimeApps = {
     enable = true;
     defaultApplications =