enroll laptop

flake/hosts.nix

@@ -72,6 +72,12 @@ let
         hosts.desktop
         system.systemd-boot
       ];
+      nixos.laptop = suites.desktop ++ [
+        hosts.laptop
+        system.disko
+        services.sing-box
+        system.systemd-boot
+      ];
 
       nixos.hgh0 = suites.server ++ [
         hosts.hgh0
@@ -212,6 +218,10 @@ in
       name = "sjc1";
       system = "x86_64-linux";
     })
+    (mkHost {
+      name = "laptop";
+      system = "x86_64-linux";
+    })
   ];
 
   flake.passthru = {

nixos/config/sops.nix

@@ -10,6 +10,7 @@ let
     router = "age1dtdquu63vrxag5pgs4yrqaarjywuksnw4nz2dq5t44v8tv24cy8qz7yfcn";
     desktop = "age1v6lnkm7prm0dpmcdpvn44v50rpfkzsed5uv3znxt4grsd5y6sv5qjru9qq";
     sjc1 = "age1lcvusytmzf9h776njea7qnyfs3pn37rj0ngxvr7er6pgk3tm3a5qm2j9nd";
+    laptop = "age1kgcxdnuy9fxtcf6fp7camk6tqm0fset0jvvh9760rqmrkmx99v0q2c7w8e";
   };
 in
 {

nixos/hosts/laptop/hardware.nix

@@ -0,0 +1,30 @@
+{
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/hardware/cpu/intel-npu.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "usbhid"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  hardware.cpu.intel.npu.enable = true;
+  hardware.enableRedistributableFirmware = true;
+  hardware.cpu.intel.updateMicrocode = true;
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [ intel-media-driver ];
+  };
+}

nixos/hosts/laptop/state.nix

@@ -0,0 +1,3 @@
+{
+  system.stateVersion = "26.05";
+}

nixos/system/disko.nix

@@ -58,5 +58,12 @@ in
         legacyBoot = true;
       };
     })
+
+    (lib.mkIf (name == "laptop") {
+      profiles.system.disko = {
+        devices = [ "/dev/disk/by-path/pci-0000:55:00.0-nvme-1" ];
+        swapSize = "32G";
+      };
+    })
   ];
 }

secrets/hosts/laptop.yaml

@@ -0,0 +1,19 @@
+sing-box:
+    config.json: ENC[AES256_GCM,data:lUSWbcNQUdHM+XSZ6F4XktVd1h4YGhQ0+qcq+PSJKKQK8GchLdqfNhIAprnqIKDA7oV41IMm8yqp+4AuRcy2uTyakpY6n7sIKv51LO1rw7nAf9M5BqJ4462yBjFozW4CflRiRWKxfFCXiVAHmcD5eApqB5vnPWfLPGbTgopF+ti1gRj42gz0vfk6aFZI/kEKWT0q9SU05Ninw31oEixeaPeh5fkpthbrl8D101iOktys10/Eq6P/fWELl4UGRLNUTFeOkpq4ggl/3IzHCod8YoPzDYOaCks4iC+vWeZUfMf2UeeK++SKbXwppYj+uQzWSGyUYoFuf6FYv7j8ypNER9yGP3dtGw8Z0veU1WcKBVT/RBB5Umf1pGe9PatnHCZhjwPR4bU/NQdpd/i7K8CUUSYAuOftBOoPMJZHTZwSEM6uDALrYvkZGgezQmOttPlPFUws2sNncAEBgnwhTVuOTsKQUEuVZLxt9rnM+78HiYIKQwT7pSLX1fp7MjAAXGfVXDuPQMva8C2CP8FyxsHRohbpiH8d8W1GeAoZCAERp1+ZGqo9HAGqIJmbZN29Mcm3u1dvLw4+euunH/XmbrCfP7zPt5/aLdiCbcePNhgigG9hrkrIJFZP6ihktlG0wWBW2PWq/ILaMyFZZCOTJYAWU5j8JofBbS75ynhgoXCf6s5DfztxOZQdugYncTSfbzCRJvnY6w0RXzYtdvEvs+37Cvwg/j2cxRb5EYHdRGEYRfq5wqBHsdV3iG+XI+37vXVcEO/xL49HyUL0l37+RKo5ehtXQWQwdw6+gbn5WIj6v/T/2WKAHQVwwn/TxMqQzPM7AIzRYDzqppcPatnAXj8bwCCdVqn6KPoUcOfasoqEECx8SRm9T8EEUnjMmLaDy8H3Ko107NgUmPbxoV45HmVqI7B5KMGjcdsqnEb4xRXqwpydw+5l6M8Os9Ky2ty6DSJifYO20cSoC9m2NLfCCLT7mxQiDz0pgL9FGEEDuqdrdsQ1UI3migSzO6xpa/er4WlBRuiQGRbvHv02bc+203jegcfip9FPq6GbTRhqIigNXr0Z+YdkGVkT4z1mqxbLtpTmpV3DTF7zP29WMCllfW+PkeQj40TteaZM8++ERdFP2zzwY4nMF6321aIEzDpLZHCHpGoE9zVvXeJZrEni21qORmX9RCrAfUPhSJZcoha77st8Xj8OypALrRPP9dcq8WM9TvqQPetczOC6tQzdmXsGBmwOdrDYY1eQ8l1iLSlkLVvaAJUdj1+ytXitwg9bcJgW9dYBLpiANJ30YmdmYko3vGmLzEUVVlZm26cEFc3p9Cxag+qaiti3TJGD19BmzqZCGtAko1dJThLDUD8BE71AXohHjBeX8ldFKpQjPIeABtPEN55ahdBp7kAVIvx1/z5UZDF/yY+g8FHKhL+SXBQrsPIYXZY7Rzos+IMBD+ib7nPrLax0DaBH+AnEOM//zpIRLHC1Tn/OfcdVK5AUt2pqwf1FvyyZOLcF633fZHKCXQTxTqg5YTlMzxSanf3ud7bKE8iaF1u0+bvde0svLVVND6iWqVwi893vpDu4TvFI1FOrAeJ+8ob8tnyDxIIwW/4cdua0ynmG4d2Va0cJ0vUaTd49jBnZ0AkHltIZ1IEByG25Jpbs5C772mwD9Ym5V6AfF2gf8bIVeyLDVHEDE1xmOAgr+kWf2exv9fp/vi6ZSMD1zzbF/fojZtiiYgvR60YnDMCp7vofZBJDKPoN21g5+NrxAC/NdaFQb+BXHz5DO65En8l15pO41BccfJXo6uQKlZVXFvZbwNxfXF1fsROts/FQL7yf9aQ8Jbm1y7SiBcv7Hekug93qMc0ilapYluzsUD4ISKaigX4Ps39/t7q+d+zLrzvDMr9CHhcSus/UGivXc3X5iRIr4bxGznmFzH3XSHQ0IeEZ5CnuNiYFq5FVS/8+DkiIRjDytSHMhqhNYND8qPRi1iFtpxIENNdx2+qhxT9g0nVeCwgVBqmIsdB6Au37Wqa0gBYdrDJuk8hClv7yrQdHQ3x5W6fVwAGBf4FP1Z1UKcQoFN5cupS0EBcqNZ8fLGRvXgw5OelyaNqsJIZabZ9AZMnL10dTj9NzwZeptIN1gcK+ikNk2lEAVQCw3/bVrBPYErVXkZrwfu9mjJYFRZHOV6MKJ/O/Cy9ohUzKICrd9Qa7ztAdAlKqICjNoYmq+z8IAPkYeqvXBvmOABYnowQZA5kvtmpr0s7sc32h/8NwEzdL5G875KsTGhmcrjwa+vsvKKku+ZjLEg8/tQZm7xFRHX8TJ9wRCC/djE6ZXUpt1f4qixUraLnNKLza+VQw+jWu7CPkeBr+LMbYFHu15lDYZWleEnWOuW0j3k6Iisr1iFv80OWXYWnJoeGI+fZz/fsVDqLtN7sk0WvpDg08KnEM/lRvwM5cDYx3Lil+FHeVWOXCuF30Vw8vjyW1Mjrj8FSnuanOrmfTUOksBmeAtK03WR14zQ9fGSBlVPXDK7OYdTT+NnZh6Vmtr/qKAt5yDRQWaWGgLRwWUZGH/co9JXZgMVjC4t3JS7X3vg3C6J+NFucBB/Cdo3qrcyqP58BwFQ0qaDSWrmZbSv5DJAk78NsnlwEqvXT9g+ZhqcHN1oXMPquwidFbGVYAzANfekDwv87jU1fJv3CIKUNteBWLqrRraWw22vHna+AhABm9oW210FBwDbH2kv0tE1uXilPIR33KD4A7xCllN4SWoWJKqabwcxVezar/goMOeDAqapblkteVvK97MqcVF+oj3FX6CUO/UfIm+tG2/zyvm7NsZRWeMR99Dh/SYazE3GyESY/FIiGcFk9I9DLTEj903nIx+JBwhyOCFIRxMEws4cK5zkwuDTA98l3nl30C2sXVIv1suPL3RGmkqzK21IQaLCX3Yz3+zfmlPqewS4Dqxqi3GbHCpL3QltVqlSuaritg8EB1UJKb9P3ViVicmnvVk8K/Ih3RM3ArdCIyhDucJwurorGtRWIoj33zM2Hnmkfbt743ds6HZ9fXZXY=,iv:zg0tDARgSZvl5hD+vyk81auCnjEVqBF+gGWy1aOTOaQ=,tag:g2kmgRazyrT/hss4EH2K8Q==,type:str]
+user-password:
+    sun: ENC[AES256_GCM,data:cMBim9UQbslfqdmHRduIHMYRrdkmF22jw29UTvIpfKnHK4HKhufK0+Py4SNoC8bfvrneOOvB5hZnMsXQ7ISoOF1QJiyitXKW1A==,iv:DceJ7kV00MM4xFYTSblgjXMTNGDWz42CkZnFLWt1KSU=,tag:Y8IdFdm7qOnwEs/ib7mp3A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEWFFCaWJWNFFLNnZQcjRU
+            R1pLRHY1bFM5UC8rTUl2UElKdy8vSjNDdUE4CjNBbDd4SStyNDM1ZFg5Z2ZIU0JN
+            OWYwS2lSYkhrb1F2ZTN4WVFRYlBqK28KLS0tIGRHWFJRMkJPUEo2YUZnemhGUnh5
+            eWZBNW5QbnFnVk41SHlJSDFMRC9HYU0KvxS3O8IeAmzuShakyPdWaZ1TrqMT2wss
+            bsT8RL5oEnBxtq4bpeZmDh5Rzq30kg8QTmlst4+dX6sP6uK4hFK0EQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1kgcxdnuy9fxtcf6fp7camk6tqm0fset0jvvh9760rqmrkmx99v0q2c7w8e
+    lastmodified: "2026-06-17T15:34:30Z"
+    mac: ENC[AES256_GCM,data:6f2SNiaD2zND5BpoAQA6XMmJ/Iy29TGlVAlln6qG3HRGLzLX5opPvCPOJSdlMEjVSvfkAfayI3dNteipyLKkEPFF68G+dZEiQwDQ3iHZuFSNEZsSLXAj3NKvWVRqRn3lWbXa+7AKOV3/fhkyunQoMCpgMJkXDfsvY2JiRDUiLlA=,iv:BtVwNO9chLtnIHLv24E3ddpSmvPmNcB+ytkc8Rr+fGo=,tag:F6ZBZPbGgLI1cMNnd/IHfw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1