xin/hosts/europa/default.nix
2024-09-23 07:08:58 -06:00

442 lines
11 KiB
Nix

{ inputs
, config
, pkgs
, lib
, xinlib
, ...
}:
let
inherit (inputs.stable.legacyPackages.${pkgs.system}) chirp beets quodlibet-full;
inherit (xinlib) jobToUserService prIsOpen;
thunderbird = import ../../configs/thunderbird.nix { inherit pkgs; };
jobs = [
{
name = "brain";
script = "cd ~/Brain && git sync";
startAt = "*:0/2";
path = [ pkgs.git pkgs.git-sync ];
}
{
name = "org";
script = "(cd ~/org && git sync)";
startAt = "*:0/5";
path = [ pkgs.git pkgs.git-sync ];
}
{
name = "org-roam";
script = "(cd ~/org-roam && git sync)";
startAt = "*:0/5";
path = [ pkgs.git pkgs.git-sync ];
}
];
in
{
_module.args.isUnstable = true;
imports = [ ./hardware-configuration.nix ../../pkgs ];
sops.secrets = {
rkvm_cert = {
sopsFile = config.xin-secrets.europa.secrets.qbit;
owner = "root";
group = "wheel";
mode = "400";
};
rkvm_key = {
sopsFile = config.xin-secrets.europa.secrets.qbit;
owner = "root";
group = "wheel";
mode = "400";
};
fastmail = {
sopsFile = config.xin-secrets.europa.secrets.qbit;
owner = "qbit";
group = "wheel";
mode = "400";
};
fastmail_user = {
sopsFile = config.xin-secrets.europa.secrets.qbit;
owner = "qbit";
group = "wheel";
mode = "400";
};
nix_review = {
sopsFile = config.xin-secrets.europa.secrets.qbit;
owner = "qbit";
group = "wheel";
mode = "400";
};
netrc = {
sopsFile = config.xin-secrets.europa.secrets.qbit;
owner = "qbit";
group = "wheel";
mode = "400";
};
restic_password_file = {
sopsFile = config.xin-secrets.europa.secrets.services;
owner = "root";
mode = "400";
};
restic_env_file = {
sopsFile = config.xin-secrets.europa.secrets.services;
owner = "root";
mode = "400";
};
restic_remote_password_file = {
sopsFile = config.xin-secrets.europa.secrets.services;
owner = "root";
mode = "400";
};
restic_remote_env_file = {
sopsFile = config.xin-secrets.europa.secrets.services;
owner = "root";
mode = "400";
};
restic_remote_repo_file = {
sopsFile = config.xin-secrets.europa.secrets.services;
owner = "root";
mode = "400";
};
};
nixpkgs.config = {
allowUnfree = true;
allowUnsupportedSystem = true;
};
boot = {
binfmt.emulatedSystems = [ "aarch64-linux" "riscv64-linux" ];
initrd.systemd.enable = true;
initrd.luks.devices."luks-4d7bf115-cdfd-486b-a2fd-ee620d81060c".device = "/dev/disk/by-uuid/4d7bf115-cdfd-486b-a2fd-ee620d81060c";
loader = {
systemd-boot = {
enable = true;
memtest86.enable = true;
};
efi = {
canTouchEfiVariables = true;
};
};
kernelParams = [
"boot.shell_on_fail"
# https://gitlab.freedesktop.org/upower/power-profiles-daemon#panel-power-savings
"amdgpu.abmlevel=0"
];
kernelPackages = pkgs.linuxPackages_latest;
};
nixManager = {
enable = lib.mkDefault true;
user = "qbit";
};
kde.enable = lib.mkDefault true;
kdeConnect.enable = true;
virtualisation = {
libvirtd.enable = lib.mkDefault true;
podman.enable = true;
};
networking = {
hostName = "europa";
hostId = "87703c3e";
hosts = {
"192.168.122.6" = [ "chubs" ];
};
wireless.userControlled.enable = true;
networkmanager.enable = true;
firewall = {
enable = true;
allowedTCPPorts = [ 22 ];
};
};
programs = {
nix-ld.enable = lib.mkIf config.programs.ladybird.enable true;
steam.enable = true;
_1password.enable = true;
_1password-gui = {
enable = true;
polkitPolicyOwners = [ "qbit" ];
};
dconf.enable = true;
zsh = {
shellInit = ''
export OP_PLUGIN_ALIASES_SOURCED=1
'';
shellAliases = {
"gh" = "op plugin run -- gh";
"nixpkgs-review" = "env GITHUB_TOKEN=$(op item get nixpkgs-review --field token) nixpkgs-review";
"godeps" = "go list -m -f '{{if not (or .Indirect .Main)}}{{.Path}}{{end}}' all";
"sync-music" = "rsync -av --progress --delete ~/Music/ suah.dev:/var/lib/music/";
"load-agent" = ''op item get signer --field 'private key' --reveal | sed '/"/d; s/\r//' | ssh-add -'';
};
};
} // thunderbird.programs;
services.xinCA = { enable = false; };
services = {
ollama = {
enable = false;
acceleration = prIsOpen.str 306375 "rocm";
};
rkvm.server = {
enable = true;
settings = {
listen = "127.0.0.1:24800";
switch-keys = [
"caps-lock"
"left-alt"
];
certificate = "${config.sops.secrets.rkvm_cert.path}";
key = "${config.sops.secrets.rkvm_key.path}";
password = "fake";
};
};
logind = {
lidSwitch = "suspend-then-hibernate";
lidSwitchExternalPower = "lock";
extraConfig = ''
HandlePowerKey=suspend-then-hibernate
HandlePowerKeyLongPress=poweroff
IdleAction=suspend-then-hibernate
IdleActionSec=300
'';
};
fprintd = {
enable = true;
};
avahi = {
enable = true;
openFirewall = true;
};
printing.enable = true;
backups =
let
paths = [ "/home/qbit" "/etc" ];
pruneOpts = [ "--keep-hourly 12" "--keep-daily 7" "--keep-weekly 5" "--keep-yearly 4" ];
timerConfig = { OnCalendar = "*-*-* 00:30:00"; };
in
{
remote = {
enable = true;
passwordFile = "${config.sops.secrets.restic_remote_password_file.path}";
repositoryFile = "${config.sops.secrets.restic_remote_repo_file.path}";
# Don't send libvirt over the air-wire
inherit paths pruneOpts timerConfig;
};
local = {
enable = true;
repository = "/run/media/qbit/backup/${config.networking.hostName}";
environmentFile = "${config.sops.secrets.restic_env_file.path}";
passwordFile = "${config.sops.secrets.restic_password_file.path}";
paths = paths ++ [ "/var/lib/libvirt" ];
inherit pruneOpts;
timerConfig = { OnCalendar = "hourly"; };
};
};
pcscd.enable = true;
vnstat.enable = true;
# clamav.updater.enable = true;
tor = {
enable = true;
client.enable = true;
};
fwupd = {
enable = true;
};
udev.extraRules = ''
SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="5bf0", GROUP="users", TAG+="uaccess"
'';
};
security.pki.certificates = [
''
-----BEGIN CERTIFICATE-----
MIIDPTCCAiWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAiMSAwHgYDVQQDExdPYnNp
ZGlhbiBMb2NhbCBSRVNUIEFQSTAeFw0yMzAyMDcwMTQ3NDVaFw0yNDAyMDcwMTQ3
NDVaMCIxIDAeBgNVBAMTF09ic2lkaWFuIExvY2FsIFJFU1QgQVBJMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiRr4708X1QMmQMG3+M7UoefV+9gq+jNR
bM5HCOlBuB16LrhRiR/6ROaDnB3OJBP4NToCVY6+tJvWOqJe9FVyzviWzGaFkZGF
eBF32QvYLZRbPTIVWADl+KabXm1TXtLos1GpPKnIjU9m+5Jt1ob8i4eTKjjarpSG
u4kvKBQiQYxxYXA+miuqxPWD/mkIySvx50EVzrO5X8u/M4MQqPlpMvL6W6AxMXQ+
WU5KWUkP3kU/CMB377GjqTfdwRMVqCFhKq0jzFueKrqY0qXnbLoTePFBV2HsPAhv
Xup15Yx7G5pLROYkvmxvxzgP6mycB3SOiPDwj9UsFk41+KZV9cm6pQIDAQABo34w
fDAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIC9DA7BgNVHSUENDAyBggrBgEFBQcD
AQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUHAwgwEQYJYIZI
AYb4QgEBBAQDAgD3MA8GA1UdEQQIMAaHBH8AAAEwDQYJKoZIhvcNAQELBQADggEB
AHfjsIJpQlQcSP1Gy0gcrnBt9PhcA5TAqKlafKXVs0z60gVFDd/8d9PU3QxuTa4m
uQGLtFiMSudaoZoGhyEZ4kk5upqjfANppJj4R5UgPmfhp24AUvPjf2bVXczdIbvY
MNrXMtOq4+zD8QdZ25aPXT17LDIGx3TSM4HQzpu9YQdVt6fGgqPKFo3U9HGsBCja
lXsQ+lw4Hfi50HqLFRmLA50AP5m+EGdgIkVktAm7v8x0H8wHjd2Ysy8oRRAYtf2i
tynaHjsc6x3jDd5HiGuShRNHV9r3Q+IG1+SikALFk0nhKfB4DpYTz/fSQsw9hEj5
5wYD1VN/zBzPsHUUwCujYOs=
-----END CERTIFICATE-----
''
];
systemd = {
user.services =
lib.listToAttrs (builtins.map jobToUserService jobs);
services = {
ollama = {
environment = {
OLLAMA_ORIGINS = "*";
};
};
"whytailscalewhy" = {
description = "Tailscale restart on resume";
wantedBy = [ "post-resume.target" ];
after = [ "post-resume.target" ];
script = ''
. /etc/profile;
${pkgs.systemd}/bin/systemctl restart tailscaled.service
'';
serviceConfig.Type = "oneshot";
};
};
};
users.users.qbit.extraGroups = [
"dialout"
"libvirtd"
"plugdev"
"cdrom"
];
environment = {
sessionVariables = {
XDG_BIN_HOME = "\${HOME}/.local/bin";
XDG_CACHE_HOME = "\${HOME}/.cache";
XDG_CONFIG_HOME = "\${HOME}/.config";
XDG_DATA_HOME = "\${HOME}/.local/share";
STEAM_EXTRA_COMPAT_TOOLS_PATHS = "\${HOME}/.steam/root/compatibilitytools.d";
PATH = [ "\${XDG_BIN_HOME}" ];
MUHOME = "\${HOME}/.config/mu";
};
systemPackages = with pkgs; [
#deltachat-desktop
arduino
beets # stable
calibre
chirp # stable
deadbeef-with-plugins
deluge
direwolf
element-desktop
element-desktop-wayland
elmPackages.elm
elmPackages.elm-format
elmPackages.elm-language-server
elmPackages.elm-live
elmPackages.elm-test
entr
ferdium
fossil
gh
gimp
git-annex
gqrx
hackrf
inkscape
intiface-central
isync
jan
jujutsu
klavaro
koreader
linphone
ltunify
minicom
mu
nix-index
nixpkgs-review
nmap
obsidian
ollama
openscad
picocom
proton-caller
protonup-ng
prusa-slicer
python3Packages.nomadnet
python3Packages.rns
qdmr
# Don't do it, don't switch to another music player. They all suck!
# this one works the least sucky!
quodlibet-full #stable
# Don't do it! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
#
rex
rsibreak
rtl-sdr
sdrpp
signal-desktop
signal-desktop-beta
tcpdump
tea
tigervnc
tncattach
unzip
veilid
virt-manager
w3m
workrave
yt-dlp
zig
(callPackage ../../pkgs/ttfs.nix { })
(callPackage ../../pkgs/kobuddy.nix {
inherit pkgs;
inherit
(pkgs.python39Packages)
buildPythonPackage
fetchPypi
setuptools-scm
pytz
banal
sqlalchemy
alembic
;
})
(callPackage ../../pkgs/gokrazy.nix { })
(callPackage ../../pkgs/mvoice.nix { })
(callPackage ../../pkgs/zutty.nix { })
#(python3Packages.callPackage ../../pkgs/watchmap.nix { })
(python3Packages.callPackage ../../pkgs/ble-serial.nix { })
restic
];
};
# for Pharo
security.pam.loginLimits = [
{
domain = "qbit";
type = "hard";
item = "rtprio";
value = "2";
}
{
domain = "qbit";
type = "soft";
item = "rtprio";
value = "2";
}
];
system = {
autoUpgrade.allowReboot = false;
stateVersion = "21.11";
};
}