feat: add a comfortable Zsh terminal and system diagnostics

README.md

@@ -8,7 +8,8 @@ Flat, explicit NixOS modules, with locked inputs. Required machine setup belongs
 | `configuration.nix` | EC2 base, platform, Nix features, compatibility version, imports |
 | `users.nix` | `dev`, SSH/sudo, Home Manager integration, workspace/repo ownership |
 | `dev-authorized-keys` | Public SSH keys for `dev`—never private keys |
-| `tools.nix` | Git, declarative user Git policy, official Nix formatter |
+| `tools.nix`, `colors.nix` | Zsh, Alacritty, Starship, fzf, Yazi, btop, Git policy and common CLI tools; shared readable palette |
+| `network.nix` | systemd-resolved and network/WireGuard diagnostics; leaves interface management with the host |
 | `neovim.nix` | Editor and deployment of the unchanged upstream dotfiles |
 | [DESKTOP.md](DESKTOP.md) | Dated Hyprland/component research and proposed desktop; not deployed configuration |
 
@@ -19,7 +20,9 @@ Flat, explicit NixOS modules, with locked inputs. Required machine setup belongs
 - `dev` is authorized by the public key in this repo. No private key or password is embedded.
 - `/etc/nixos` is writable by `dev` through a native tmpfiles ownership rule, which does not follow store symlinks.
 - Nix daemon access stays untrusted for ordinary use. Sudo is a separate, explicit administrative capability.
-- Bash is the temporary default; further shell/workflow preferences remain the user's choice.
+- The declared daily shell is Zsh, with completion, suggestions, highlighting, Starship, fzf (`Ctrl-R`, `Ctrl-T`, `Alt-C`), and zoxide (`z`, `zi`). Root/SSM shells are not changed.
+- Alacritty uses an opaque dark background, 13pt JetBrains Mono and generous padding. `Ctrl-Shift-+` / `Ctrl-Shift--` zoom its font; `Ctrl-Shift-0` resets it. `y` opens Yazi with shell-directory integration.
+- `wg` and `wg-quick` are installed without any tunnels, peers, keys or added firewall ports. `resolvectl` is backed by resolved; DHCP remains under the existing host network manager.
 
 Enter from an administrator session with `sudo -iu dev`.
 

colors.nix

@@ -0,0 +1,16 @@
+# Small shared palette, not a theme framework. Hyprland's native Lua uses the
+# same accent/border colors explicitly; wallpaper.svg is original source art.
+{
+  background = "#161616";
+  surface = "#262626";
+  raised = "#393939";
+  border = "#525252";
+  text = "#f2f4f8";
+  muted = "#a2a9b0";
+  blue = "#78a9ff";
+  cyan = "#3ddbd9";
+  purple = "#be95ff";
+  green = "#42be65";
+  yellow = "#f1c21b";
+  red = "#ff6b7a";
+}

configuration.nix

@@ -11,6 +11,7 @@
     "${modulesPath}/virtualisation/amazon-image.nix"
     ./users.nix
     ./tools.nix
+    ./network.nix
     ./neovim.nix
   ];
 

network.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+
+{
+  # Keep each host's existing interface/DHCP owner. On EC2 this is dhcpcd;
+  # NixOS wires its resolvconf hook to resolved's compatibility interface.
+  services.resolved = {
+    enable = true;
+    settings.Resolve = {
+      LLMNR = false;
+      MulticastDNS = false;
+      # Do not force public DNS, DNSSEC or DNS-over-TLS over DHCP/VPN policy.
+    };
+  };
+
+  programs.mtr.enable = true;
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+    dnsutils
+    tcpdump
+    ethtool
+    netcat-openbsd
+    socat
+  ];
+  # wg/wg-quick are available, but no invented peers, keys, routes or ports.
+}

tools.nix

@@ -1,14 +1,249 @@
 { pkgs, ... }:
 
+let
+  c = import ./colors.nix;
+in
 {
   programs.git.enable = true;
-  home-manager.users.dev.programs.git = {
+  programs.zsh.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    nixfmt
+    ripgrep
+    fd
+    eza
+    jq
+    yq-go
+    curl
+    wget
+    file
+    tree
+    unzip
+    zip
+    p7zip
+    rsync
+    openssl
+    lsof
+    strace
+    psmisc
+    pciutils
+    usbutils
+    smartmontools
+    nvme-cli
+    lm_sensors
+    man-pages
+    man-pages-posix
+  ];
+
+  fonts.packages = [ pkgs.nerd-fonts.jetbrains-mono ];
+  fonts.fontconfig.defaultFonts.monospace = [ "JetBrainsMono Nerd Font" ];
+
+  home-manager.users.dev = { config, ... }: {
+    programs.git = {
       enable = true;
       package = null; # The system module supplies Git.
       settings.user.useConfigOnly = true;
     };
 
-  environment.systemPackages = [
+    programs.zsh = {
-    pkgs.nixfmt
+      enable = true;
+      enableCompletion = true;
+      autosuggestion.enable = true;
+      syntaxHighlighting.enable = true;
+      defaultKeymap = "emacs";
+      history = {
+        path = "${config.xdg.stateHome}/zsh/history";
+        size = 50000;
+        save = 50000;
+        ignoreSpace = true;
+        expireDuplicatesFirst = true;
+      };
+      shellAliases = {
+        ll = "eza --long --group-directories-first --icons=auto";
+        la = "eza --long --all --group-directories-first --icons=auto";
+      };
+      initContent = ''
+        bindkey '^[[H' beginning-of-line
+        bindkey '^[[F' end-of-line
+        bindkey '^[[1;5C' forward-word
+        bindkey '^[[1;5D' backward-word
+        ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=244'
+      '';
+    };
+
+    programs.fzf = {
+      enable = true;
+      enableZshIntegration = true;
+      defaultCommand = "fd --type f --hidden --exclude .git";
+      fileWidgetCommand = "fd --type f --hidden --exclude .git";
+      changeDirWidgetCommand = "fd --type d --hidden --exclude .git";
+      defaultOptions = [
+        "--height=45%"
+        "--layout=reverse"
+        "--border=rounded"
       ];
+      fileWidgetOptions = [ "--preview 'bat --color=always --line-range=:200 -- {}'" ];
+      colors = {
+        bg = c.background;
+        fg = c.text;
+        "bg+" = c.surface;
+        "fg+" = c.text;
+        hl = c.cyan;
+        "hl+" = c.cyan;
+        border = c.border;
+        prompt = c.blue;
+        pointer = c.purple;
+        marker = c.green;
+        info = c.muted;
+      };
+    };
+
+    programs.starship = {
+      enable = true;
+      settings = {
+        add_newline = true;
+        format = "$username$hostname$directory$git_branch$git_status$nix_shell$cmd_duration\n$character";
+        directory = {
+          style = "bold ${c.blue}";
+          truncation_length = 4;
+          truncation_symbol = "…/";
+          read_only = " [read-only]";
+        };
+        git_branch = {
+          symbol = "git:";
+          style = c.purple;
+        };
+        git_status.style = c.purple;
+        nix_shell = {
+          format = "[nix:$name]($style) ";
+          style = c.cyan;
+        };
+        cmd_duration = {
+          format = "[$duration]($style) ";
+          style = c.muted;
+        };
+        character = {
+          success_symbol = "[❯](bold ${c.cyan})";
+          error_symbol = "[❯](bold ${c.red})";
+        };
+      };
+    };
+
+    programs.zoxide = {
+      enable = true;
+      enableZshIntegration = true;
+    };
+    programs.bat = {
+      enable = true;
+      config.theme = "base16";
+    };
+    programs.btop = {
+      enable = true;
+      settings = {
+        theme_background = false;
+        rounded_corners = true;
+        update_ms = 1500;
+      };
+    };
+    programs.yazi = {
+      enable = true;
+      enableZshIntegration = true;
+      settings.mgr = {
+        show_hidden = true;
+        sort_by = "natural";
+        sort_dir_first = true;
+      };
+    };
+
+    programs.alacritty = {
+      enable = true;
+      settings = {
+        window = {
+          padding = {
+            x = 16;
+            y = 12;
+          };
+          dynamic_padding = true;
+          decorations = "None";
+          opacity = 1.0;
+        };
+        font = {
+          normal = {
+            family = "JetBrainsMono Nerd Font";
+            style = "Regular";
+          };
+          bold = {
+            family = "JetBrainsMono Nerd Font";
+            style = "Bold";
+          };
+          italic = {
+            family = "JetBrainsMono Nerd Font";
+            style = "Italic";
+          };
+          size = 13.0;
+          offset.y = 2;
+        };
+        cursor = {
+          style = {
+            shape = "Beam";
+            blinking = "Off";
+          };
+          unfocused_hollow = true;
+        };
+        scrolling.history = 20000;
+        selection.save_to_clipboard = false;
+        colors = {
+          primary = {
+            background = c.background;
+            foreground = c.text;
+          };
+          cursor = {
+            text = c.background;
+            cursor = c.cyan;
+          };
+          selection = {
+            text = c.text;
+            background = "#354562";
+          };
+          normal = {
+            black = c.surface;
+            red = c.red;
+            green = c.green;
+            yellow = c.yellow;
+            blue = c.blue;
+            magenta = c.purple;
+            cyan = c.cyan;
+            white = "#dde1e6";
+          };
+          bright = {
+            black = c.muted;
+            red = "#ff99a0";
+            green = "#6fdc8c";
+            yellow = "#f7d75c";
+            blue = "#a6c8ff";
+            magenta = "#d4bbff";
+            cyan = "#82e9de";
+            white = c.text;
+          };
+        };
+        keyboard.bindings = [
+          {
+            key = "Equals";
+            mods = "Control|Shift";
+            action = "IncreaseFontSize";
+          }
+          {
+            key = "Minus";
+            mods = "Control|Shift";
+            action = "DecreaseFontSize";
+          }
+          {
+            key = "Key0";
+            mods = "Control|Shift";
+            action = "ResetFontSize";
+          }
+        ];
+      };
+    };
+  };
 }

users.nix

@@ -1,8 +1,11 @@
+{ pkgs, ... }:
+
 {
   users.users.dev = {
     isNormalUser = true;
     uid = 1001;
     description = "Development user";
+    shell = pkgs.zsh;
     extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keyFiles = [ ./dev-authorized-keys ];
   };