1 files changed, 73 insertions, 0 deletions

diff --git a/users/ryan/linux/guix.nix b/users/ryan/linux/guix.nix
new file mode 100644
index 0000000..acee0f3
--- /dev/null
+++ b/users/ryan/linux/guix.nix
@@ -0,0 +1,73 @@
+{ pkgs, inputs, ... }:
+
+# Workarounds specific to running home-manager on top of Guix System (as
+# opposed to NixOS, or some other foreign distro). Keep this narrow -
+# anything that would also apply to e.g. WSL belongs in ./foreign.nix
+# instead.
+{
+  # Guix doesn't run a systemd user session the way home-manager expects,
+  # so activation shouldn't try to start/restart systemd user units.
+  systemd.user.startServices = false;
+
+  # Guix Home's login shell (bash, via /etc/passwd) sources ~/.bash_profile
+  # -> ~/.profile, which runs ~/.guix-home/setup-environment and
+  # ~/.guix-home/on-first-login. The latter is what actually starts this
+  # user's shepherd instance (which manages pipewire/pulseaudio and other
+  # home services) if it isn't running yet. zsh has no equivalent of
+  # ~/.profile, so with zsh as the login shell that chain never runs and
+  # shepherd (and anything it starts, e.g. audio) never comes up. Replicate
+  # it in .zprofile, which - like .bash_profile - only runs for login shells.
+  programs.zsh.profileExtra = ''
+    if [ -f "$HOME/.guix-home/setup-environment" ]; then
+      HOME_ENVIRONMENT="$HOME/.guix-home"
+      . "$HOME_ENVIRONMENT/setup-environment"
+      "$HOME_ENVIRONMENT/on-first-login"
+      unset HOME_ENVIRONMENT
+    fi
+  '';
+
+  # gtk3.nix (see ../linux.nix's gtk.* config) mirrors GTK settings into
+  # dconf, which needs a session D-Bus during activation. This host has no
+  # /etc/dbus-1/session.conf and no session bus running at switch time, so
+  # dconf's dbus-run-session activation step fails. GTK is still themed via
+  # gtk-3.0/gtk-4.0 settings.ini; dconf mainly matters for GNOME/libadwaita
+  # apps, which aren't in play here.
+  dconf.enable = false;
+
+  # Guix Home used to run gpg-agent as a shepherd service and export
+  # SSH_AUTH_SOCK into the whole session before Hyprland started. That
+  # service is disabled now, and zsh's SSH_AUTH_SOCK export (see
+  # programs.zsh in common.nix) only reaches shells, not apps Hyprland
+  # spawns directly - so launch the agent and push the socket path into
+  # Hyprland's own env here instead. A NixOS host would have a real
+  # systemd --user session doing this via gpg-agent.socket activation,
+  # so this only belongs on Guix.
+  wayland.windowManager.hyprland.extraConfig = ''
+    exec-once = sh -c 'gpgconf --launch gpg-agent; hyprctl setenv SSH_AUTH_SOCK "$(gpgconf --list-dirs agent-ssh-socket)"'
+  '';
+
+  # base-system.scm enables pcscd-service-type, so pcscd already owns the
+  # Yubikey's USB CCID interface. scdaemon's internal libusb CCID driver
+  # then fails to open the device (`ccid open error: skip`) and doesn't
+  # fall back to PC/SC on its own, so `gpg --card-status`/`--edit-card`
+  # report "No such device". Force scdaemon through pcscd instead. A NixOS
+  # host would only need this if it also runs services.pcscd itself.
+  programs.gpg.scdaemonSettings.disable-ccid = true;
+
+  home.packages = [
+    # hyprlock built by nix needs Guix's PAM libs preloaded to authenticate
+    # against Guix's PAM stack. Don't also preload Guix's libfontconfig.so
+    # here: it's a "fontconfig-minimal" build that lacks symbols (e.g.
+    # FcConfigSetDefaultSubstitute) which nix's pango expects, causing a
+    # symbol lookup error at startup. Let hyprlock use nix's own fontconfig
+    # from its normal closure instead.
+    (pkgs.writeScriptBin "hyprlock" ''
+      #! ${pkgs.bash}/bin/bash
+      export LD_PRELOAD="/run/current-system/profile/lib/libpam.so.0:$LD_PRELOAD"
+      exec ${pkgs.hyprlock}/bin/hyprlock "$@"
+    '')
+
+    # Guix's mesa doesn't match nixpkgs', so GL apps built by nix need nixGL.
+    inputs.nixgl.packages.${pkgs.stdenv.hostPlatform.system}.nixGLIntel
+  ];
+}