nix/modules/nixos/default.nix

1053 lines
23 KiB
Nix

{
disko,
sops-nix,
colors,
flakeInputs,
homeManagerModules,
home-manager,
home-manager-unstable,
helix,
nixosModules,
pubkey,
overlays,
}: {
fallback-hostname = {lib, ...}: {
networking.hostName = lib.mkDefault "set-a-hostname-dingus";
};
no-giant-logs = {lib, ...}: {
services.journald.extraConfig = lib.mkDefault "SystemMaxUse=1G";
};
allow-redistributable-firmware = {lib, ...}: {
hardware.enableRedistributableFirmware = lib.mkDefault true;
};
home-manager-defaults = {
imports = [
# enable home-manager
home-manager.nixosModules.home-manager
];
home-manager.useGlobalPkgs = true;
home-manager.backupFileExtension = "hm-backup";
};
home-manager-unstable-defaults = {
imports = [
# enable home-manager
home-manager-unstable.nixosModules.home-manager
];
home-manager.useGlobalPkgs = true;
home-manager.backupFileExtension = "hm-backup";
};
mdns-and-lan-service-discovery = {
services.avahi = {
enable = true;
reflector = true;
openFirewall = true;
nssmdns4 = true;
};
};
less-pager = {pkgs, ...}: {
environment = {
systemPackages = [
pkgs.less
];
variables = {
PAGER = "less";
MANPAGER = "less";
};
};
};
helix-text-editor = {pkgs, ...}: {
environment = {
systemPackages = [
pkgs.less
helix.packages.${pkgs.system}.helix
];
variables = {
EDITOR = "hx";
SYSTEMD_EDITOR = "hx";
VISUAL = "hx";
};
};
};
zellij-multiplexer = {pkgs, ...}: {
environment.systemPackages = [
pkgs.zellij
];
};
fish-shell = {
pkgs,
lib,
...
}: {
programs.fish = {
enable = true;
};
users = {
defaultUserShell = pkgs.fish;
};
};
nix-index = {
enable = true;
enableBashIntegration = true;
enableFishIntegration = true;
enableZshIntegration = true;
};
my-favorite-default-system-apps = {pkgs, ...}: {
imports = with nixosModules; [
less-pager
helix-text-editor
zellij-multiplexer
fish-shell
];
environment.systemPackages = with pkgs; [
curl
dua
eza # TODO: needs shell aliases
fd
file
iputils
nettools
# nodePackages.bash-language-server # just pull in as needed?
# shellcheck
# shfmt
killall
ripgrep
rsync
sd
];
programs = {
traceroute.enable = true;
git = {
enable = true;
package = pkgs.gitFull;
lfs.enable = true;
};
};
};
mosh = {lib, ...}: {
programs.mosh = {
enable = true;
openFirewall = lib.mkDefault true;
};
};
remote-disk-key-entry-on-boot = {
lib,
pkgs,
...
}: {
# https://nixos.wiki/wiki/Remote_disk_unlocking
# "When using DHCP, make sure your computer is always attached to the network and is able to get an IP adress, or the boot process will hang."
# ^ seems less than ideal
boot.kernelParams = ["ip=dhcp"];
boot.initrd = {
# availableKernelModules = ["r8169"]; # ethernet drivers
systemd.users.root.shell = "/bin/cryptsetup-askpass";
network = {
enable = true;
ssh = {
enable = true;
port = 22;
authorizedKeys = [pubkey];
hostKeys = ["/etc/secrets/initrd/ssh_host_rsa_key"];
};
};
};
};
ssh-server = {lib, ...}: {
# enable an ssh server and provide root access with my primary public key
users.users.root = {
openssh.authorizedKeys.keys = [pubkey];
};
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "prohibit-password";
};
openFirewall = lib.mkDefault true;
# listenAddresses = [
# { addr = "0.0.0.0"; port = 22; }
# ];
};
};
password-manager = {pkgs, ...}: {
# programs.goldwarden = {
# NOTE: This didn't seem to work for me, but would be awesome!
# enable = true;
# };
home-manager.users.daniel = {
imports = with homeManagerModules; [
password-manager
];
};
};
linux = {pkgs, ...}: {
home-manager.users.daniel = {
imports = with homeManagerModules; [
linux
];
};
};
tailscale = {lib, ...}: {
services.tailscale = {
enable = true;
useRoutingFeatures = lib.mkDefault "client";
};
};
default-nix-configuration-and-overlays = {
lib,
config,
...
}: {
nixpkgs = {
overlays = with overlays; [
additions
modifications
unstable-packages
];
config.allowUnfree = true;
};
nix = {
nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}") config.nix.registry;
# registry = lib.mapAttrs (_: value: {flake = value;}) flakeInputs;
settings = {
trusted-users = ["root" "daniel"];
experimental-features = lib.mkDefault ["nix-command" "flakes"];
substituters = [
# TODO: dedupe with flake's config? is that even necessary?
"https://cache.nixos.org/"
"https://helix.cachix.org"
"https://nix-community.cachix.org"
"https://nix.h.lyte.dev"
"https://hyprland.cachix.org"
];
trusted-public-keys = [
# TODO: dedupe with flake's config? is that even necessary?
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"h.lyte.dev:HeVWtne31ZG8iMf+c15VY3/Mky/4ufXlfTpT8+4Xbs0="
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
];
auto-optimise-store = true;
};
};
};
laptop = {pkgs, ...}: {
imports = with nixosModules; [
family-users
wifi
];
services.udev.extraRules = ''
ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chgrp video /sys/class/backlight/%k/brightness"
ACTION=="add", SUBSYSTEM=="backlight", RUN+="${pkgs.coreutils}/bin/chmod g+w /sys/class/backlight/%k/brightness"
'';
};
emacs = {pkgs, ...}: {
environment.systemPackages = with pkgs; [
emacs
];
home-manager.users.daniel = {
imports = with homeManagerModules; [
emacs
];
};
};
development-tools = {pkgs, ...}: {
imports = with nixosModules; [
postgres
podman
troubleshooting-tools
emacs
];
environment.sessionVariables.NIXOS_OZONE_WL = "1";
programs.neovim = {
enable = true;
# plugins = [
# pkgs.vimPlugins.nvim-treesitter.withAllGrammars
# ];
};
environment.systemPackages = with pkgs; [
taplo # toml language server for editing helix configs per repo
pgcli
oil
watchexec
android-tools
kubectl
stern
libresprite
# logseq
audacity
wol
shellcheck
skim
sops
gron
shfmt
vscode-langservers-extracted
nodePackages.bash-language-server
nodePackages.yaml-language-server
xh
curl
google-chrome
];
hardware.gpgSmartcards.enable = true;
services.udev.packages = with pkgs; [
# TODO: I think these get the whole package pulled in... should find out
# if there's a way to get just the rules and not 4 chromes
platformio
openocd
pkgs.yubikey-personalization
via
];
programs.adb.enable = true;
users.users.daniel.extraGroups = ["adbusers"];
home-manager.users.daniel = {
home.packages = with pkgs; [
yubikey-personalization
yubikey-manager
yubico-piv-tool
];
programs.thunderbird = {
enable = true;
profiles = {
daniel = {
isDefault = true;
# name = "daniel";
};
};
};
programs.nushell = {
enable = true;
};
programs.jujutsu = {
enable = true;
};
programs.k9s = {
enable = true;
};
programs.vscode = {
enable = true;
};
programs.jq = {
enable = true;
};
programs.chromium = {
enable = true;
};
programs.btop = {
enable = true;
package = pkgs.btop.override {
rocmSupport = true;
};
};
};
};
troubleshooting-tools = {pkgs, ...}: {
environment.systemPackages = with pkgs; [
bottom
btop
dnsutils
dogdns
htop
inetutils
nmap
pciutils
hexyl
pkgs.unixtools.xxd
usbutils
];
};
music-consumption = {pkgs, ...}: {
environment = {
systemPackages = with pkgs; [
spotube
spotdl
];
};
};
video-tools = {pkgs, ...}: {
environment = {
systemPackages = with pkgs; [
ffmpeg-full
obs-studio
];
};
};
graphical-workstation = {
pkgs,
lib,
options,
config,
...
}: {
imports = with nixosModules; [
plasma6
enable-flatpaks-and-appimages
fonts
development-tools
printing
music-consumption
video-tools
];
xdg.portal.enable = true;
hardware =
if builtins.hasAttr "graphics" options.hardware
then {
graphics = {
enable = true;
# driSupport32Bit = true;
# driSupport = true;
};
}
else {
opengl = {
enable = true;
driSupport32Bit = true;
driSupport = true;
};
};
environment = {
systemPackages = with pkgs; [
libnotify
];
variables = {
# GTK_THEME = "Catppuccin-Mocha-Compact-Sapphire-Dark";
# GTK_USE_PORTAL = "1";
};
};
};
# ewwbar = {};
# gnome = {};
# hyprland = {};
# intel = {};
kde-connect = {
programs.kdeconnect.enable = true;
# networking.firewall = {
# allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
# allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
# };
};
fonts = {pkgs, ...}: {
fonts.packages = with pkgs; [
(nerdfonts.override {fonts = ["NerdFontsSymbolsOnly"];})
pkgs.iosevkaLyteTerm
];
};
plasma6 = {
pkgs,
lib,
...
}: {
imports = with nixosModules; [
kde-connect
pipewire
];
services.xserver.enable = true;
services.displayManager.sddm = {
enable = true;
wayland.enable = true;
};
services.desktopManager.plasma6.enable = true;
programs.dconf.enable = true;
services.xrdp.enable = false;
services.xrdp.defaultWindowManager = "plasma";
services.xrdp.openFirewall = false;
environment.systemPackages = with pkgs; [
wl-clipboard
inkscape
krita
noto-fonts
vlc
wl-clipboard
kdePackages.qtvirtualkeyboard
maliit-keyboard
maliit-framework
kdePackages.kate
# kdePackages.kdenlive
# kdePackages.merkuro
kdePackages.kcalc
# kdePackages.neochat
kdePackages.filelight
kdePackages.krdc
kdePackages.krfb
kdePackages.kclock
kdePackages.kweather
kdePackages.ktorrent
# kdePackages.kdevelop
# kdePackages.kdialog
kdePackages.kdeplasma-addons
unstable-packages.kdePackages.krdp
];
programs.gnupg.agent.pinentryPackage = pkgs.pinentry-tty;
};
lutris = {pkgs, ...}: {
environment = {
systemPackages = with pkgs; [
wineWowPackages.waylandFull
lutris
winetricks
];
};
};
gaming = {
imports = with nixosModules; [
lutris
steam
ludusavi
# ludusavi uses rclone
rclone
];
};
pipewire = {
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
jack.enable = true;
# wireplumber.enable = true; # this is default now
wireplumber.extraConfig = {
"monitor.bluez.properties" = {
"bluez5.enable-sbc-xq" = true;
"bluez5.enable-msbc" = true;
"bluez5.enable-hw-volume" = true;
"bluez5.roles" = ["hsp_hs" "hsp_ag" "hfp_hf" "hfp_ag"];
};
};
extraConfig.pipewire."91-null-sinks" = {
"context.objects" = [
{
# A default dummy driver. This handles nodes marked with the "node.always-driver"
# properyty when no other driver is currently active. JACK clients need this.
factory = "spa-node-factory";
args = {
"factory.name" = "support.node.driver";
"node.name" = "Dummy-Driver";
"priority.driver" = 8000;
};
}
{
factory = "adapter";
args = {
"factory.name" = "support.null-audio-sink";
"node.name" = "Microphone-Proxy";
"node.description" = "Microphone";
"media.class" = "Audio/Source/Virtual";
"audio.position" = "MONO";
};
}
{
factory = "adapter";
args = {
"factory.name" = "support.null-audio-sink";
"node.name" = "Main-Output-Proxy";
"node.description" = "Main Output";
"media.class" = "Audio/Sink";
"audio.position" = "FL,FR";
};
}
];
};
# extraConfig.pipewire."92-low-latency" = {
# context.properties = {
# default.clock.rate = 48000;
# default.clock.quantum = 32;
# default.clock.min-quantum = 32;
# default.clock.max-quantum = 32;
# };
# };
};
# recommended by https://nixos.wiki/wiki/PipeWire
security.rtkit.enable = true;
# services.pipewire = {
# enable = true;
# wireplumber.enable = true;
# pulse.enable = true;
# jack.enable = true;
# alsa = {
# enable = true;
# support32Bit = true;
# };
# };
# hardware = {
# pulseaudio = {
# enable = false;
# support32Bit = true;
# };
# };
# security = {
# # I forget why I need these exactly...
# polkit.enable = true;
# rtkit.enable = true;
# };
};
music-production = {pkgs, ...}: {
# TODO: may want to force nixpkgs-stable for a more-stable music production
# environment?
imports = [
{
environment.systemPackages = with pkgs; [
helvum # pipewire graph/patchbay GUI
ardour # DAW
helm # synth
];
}
];
# TODO: things to look into for music production:
# - https://linuxmusicians.com/viewtopic.php?t=27016
# - KXStudio?
# - falktx (https://github.com/DISTRHO/Cardinal)
# -
};
podman = {pkgs, ...}: {
environment = {
systemPackages = with pkgs; [
podman-compose
];
};
virtualisation = {
podman = {
enable = true;
dockerCompat = true;
dockerSocket.enable = true;
defaultNetwork.settings.dns_enabled = true;
# networkSocket.enable = true;
};
oci-containers = {
backend = "podman";
};
};
};
postgres = {pkgs, ...}: {
# this is really just for development usage
services.postgresql = {
enable = true;
ensureDatabases = ["daniel"];
ensureUsers = [
{
name = "daniel";
ensureDBOwnership = true;
}
];
# enableTCPIP = true;
package = pkgs.postgresql_15;
authentication = pkgs.lib.mkOverride 10 ''
#type database DBuser auth-method
local all postgres peer map=superuser_map
local all daniel peer map=superuser_map
local sameuser all peer map=superuser_map
# lan ipv4
host all all 10.0.0.0/24 trust
host all all 127.0.0.1/32 trust
# tailnet ipv4
host all all 100.64.0.0/10 trust
'';
identMap = ''
# ArbitraryMapName systemUser DBUser
superuser_map root postgres
superuser_map postgres postgres
superuser_map daniel postgres
superuser_map /^(.*)$ \1 # Let other names login as themselves
'';
};
environment.systemPackages = with pkgs; [
pgcli
];
};
printing = {pkgs, ...}: {
services.printing.enable = true;
services.printing.browsing = true;
services.printing.browsedConf = ''
BrowseDNSSDSubTypes _cups,_print
BrowseLocalProtocols all
BrowseRemoteProtocols all
CreateIPPPrinterQueues All
BrowseProtocols all
'';
services.printing.drivers = [pkgs.gutenprint];
};
sway = {};
enable-flatpaks-and-appimages = {
services.flatpak.enable = true;
programs.appimage.binfmt = true;
};
wifi = {lib, ...}: let
inherit (lib) mkDefault;
in {
networking.networkmanager.enable = mkDefault true;
systemd.services.NetworkManager-wait-online.enable = mkDefault false;
# TODO: networking.networkmanager.wifi.backend = "iwd"; ?
# TODO: powersave?
# TODO: can I pre-configure my usual wifi networks with SSIDs and PSKs loaded from secrets?
};
steam = {pkgs, ...}: {
# programs.gamescope.enable = true;
programs.steam = {
enable = true;
# extest.enable = true;
# gamescopeSession.enable = true;
# extraPackages = with pkgs; [
# gamescope
# ];
extraCompatPackages = with pkgs; [
proton-ge-bin
];
localNetworkGameTransfers.openFirewall = true;
remotePlay.openFirewall = true;
};
hardware.steam-hardware.enable = true;
services.udev.packages = with pkgs; [steam];
environment.systemPackages = with pkgs; [
dualsensectl # for interfacing with dualsense controllers programmatically
];
# remote play ports - should be unnecessary due to programs.steam.remotePlay.openFirewall = true;
# networking.firewall.allowedUDPPortRanges = [ { from = 27031; to = 27036; } ];
# networking.firewall.allowedTCPPortRanges = [ { from = 27036; to = 27037; } ];
};
root = {
pkgs,
lib,
...
}: {
users.users.root = {
home = "/root";
createHome = true;
openssh.authorizedKeys.keys = [pubkey];
shell = lib.mkForce pkgs.fish;
};
home-manager.users.root = {
imports = [homeManagerModules.common];
home = {
username = "root";
homeDirectory = "/root";
stateVersion = pkgs.lib.mkDefault "24.05";
};
};
};
daniel = {pkgs, ...}: let
username = "daniel";
in {
users.groups.${username} = {};
users.users.${username} = {
isNormalUser = true;
home = "/home/${username}/.home";
createHome = true;
openssh.authorizedKeys.keys = [pubkey];
group = username;
extraGroups = ["users" "wheel" "video" "dialout" "uucp"];
packages = [];
};
home-manager.users.daniel = {
imports = [homeManagerModules.common];
home = {
username = "daniel";
homeDirectory = "/home/daniel/.home";
stateVersion = pkgs.lib.mkDefault "24.05";
};
accounts.email.accounts = {
primary = {
primary = true;
address = "daniel@lyte.dev";
};
legacy = {
address = "wraithx2@gmail.com";
};
io = {
# TODO: finalize deprecation
address = "daniel@lytedev.io";
};
};
};
};
valerie = let
username = "valerie";
in {
users.groups.${username} = {};
users.users.${username} = {
isNormalUser = true;
home = "/home/${username}";
createHome = true;
openssh.authorizedKeys.keys = [pubkey];
group = username;
extraGroups = ["users" "video"];
packages = [];
};
};
flanfam = let
username = "flanfam";
in {
users.groups.${username} = {};
users.users.${username} = {
isNormalUser = true;
home = "/home/${username}";
createHome = true;
openssh.authorizedKeys.keys = [pubkey];
group = username;
extraGroups = ["users" "video"];
packages = [];
};
};
family-users = {
imports = with nixosModules; [
# daniel # part of common
valerie
flanfam
];
};
# a common module that is intended to be imported by all NixOS systems
common = {
lib,
pkgs,
modulesPath,
...
}: {
imports = with nixosModules; [
(modulesPath + "/installer/scan/not-detected.nix")
default-nix-configuration-and-overlays
# allow any machine to make use of sops secrets
sops-nix.nixosModules.sops
# allow disko modules to manage disk config
disko.nixosModules.disko
fallback-hostname
no-giant-logs
allow-redistributable-firmware
mdns-and-lan-service-discovery
tailscale
ssh-server
my-favorite-default-system-apps
mosh
daniel
root
];
boot.tmp.useTmpfs = true;
systemd.services.nix-daemon = {
environment.TMPDIR = "/var/tmp";
};
boot.tmp.cleanOnBoot = true;
services.irqbalance.enable = true;
services.kanidm = {
enableClient = true;
enablePam = true;
package = pkgs.kanidm;
clientSettings.uri = "https://idm.h.lyte.dev";
unixSettings = {
# hsm_pin_path = "/somewhere/else";
pam_allowed_login_groups = [];
};
};
systemd.tmpfiles.rules = [
"d /etc/kanidm 1755 nobody users -"
];
# module has the incorrect file permissions out of the box
environment.etc = {
# "kanidm" = {
# enable = true;
# user = "nobody";
# group = "users";
# mode = "0755";
# };
"kanidm/unixd" = {
user = "kanidm-unixd";
group = "kanidm-unixd";
mode = "0700";
};
"kanidm/config" = {
user = "nobody";
group = "users";
mode = "0755";
};
};
programs.gnupg.agent = {
enable = true;
pinentryPackage = lib.mkDefault pkgs.pinentry-tty;
};
time = {
timeZone = lib.mkDefault "America/Chicago";
};
i18n = {
defaultLocale = lib.mkDefault "en_US.UTF-8";
};
services = {
xserver.xkb = {
layout = lib.mkDefault "us";
# have the caps-lock key instead be a ctrl key
options = lib.mkDefault "ctrl:nocaps";
};
smartd.enable = true;
fwupd.enable = true;
};
console = {
# font = "Lat2-Terminus16"; # TODO: would like this font for non-hidpi displays, but this is not dynamic enough?
useXkbConfig = lib.mkDefault true;
earlySetup = lib.mkDefault true;
colors = with colors; [
bg
red
green
orange
blue
purple
yellow
fg3
fgdim
red
green
orange
blue
purple
yellow
fg
];
};
networking = {
useDHCP = lib.mkDefault true;
firewall = {
enable = lib.mkDefault true;
allowPing = lib.mkDefault true;
};
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
system.stateVersion = lib.mkDefault "24.05";
};
# intended to be auto-logged in and only run a certain application
# flanfamkiosk = {};
}