From f35599a59a080f0e7a173e21cae3d51dc230a212 Mon Sep 17 00:00:00 2001 From: Grisha Shipunov Date: Fri, 15 Aug 2025 18:34:37 +0200 Subject: Revert "retire toaster" This reverts commit 1baa256be04a8b4e711a7d48a76197b5ffad6637. --- flake.lock | 301 +++++++++++++++++++++++++++++-- flake.nix | 46 +++++ hosts/toaster/0xa-home.nix | 21 +++ hosts/toaster/amd.nix | 22 +++ hosts/toaster/default.nix | 80 ++++++++ hosts/toaster/hardware-configuration.nix | 85 +++++++++ hosts/toaster/irc.nix | 10 + hosts/toaster/network/default.nix | 45 +++++ hosts/toaster/network/dumpdvb.nix | 38 ++++ hosts/toaster/network/full-networkd.nix | 71 ++++++++ hosts/toaster/network/mullvad.nix | 98 ++++++++++ hosts/toaster/network/zw.nix | 61 +++++++ hosts/toaster/secrets.yaml | 51 ++++++ hosts/toaster/secure-boot.nix | 13 ++ hosts/toaster/zfs.nix | 25 +++ modules/chromium.nix | 40 ++++ modules/desktop-software.nix | 31 ++++ modules/emacs.nix | 60 ++++++ modules/fonts.nix | 48 +++++ modules/gnome.nix | 63 +++++++ modules/mail/default.nix | 138 ++++++++++++++ modules/mail/mbsyncrc | 97 ++++++++++ modules/niri.nix | 127 +++++++++++++ modules/plasma.nix | 52 ++++++ modules/radio.nix | 39 ++++ modules/science.nix | 8 + modules/tlp.nix | 14 ++ modules/wg/mgmt.nix | 1 - 28 files changed, 1668 insertions(+), 17 deletions(-) create mode 100644 hosts/toaster/0xa-home.nix create mode 100644 hosts/toaster/amd.nix create mode 100644 hosts/toaster/default.nix create mode 100644 hosts/toaster/hardware-configuration.nix create mode 100644 hosts/toaster/irc.nix create mode 100644 hosts/toaster/network/default.nix create mode 100644 hosts/toaster/network/dumpdvb.nix create mode 100644 hosts/toaster/network/full-networkd.nix create mode 100644 hosts/toaster/network/mullvad.nix create mode 100644 hosts/toaster/network/zw.nix create mode 100644 hosts/toaster/secrets.yaml create mode 100644 hosts/toaster/secure-boot.nix create mode 100644 hosts/toaster/zfs.nix create mode 100644 modules/chromium.nix create mode 100644 modules/desktop-software.nix create mode 100644 modules/emacs.nix create mode 100644 modules/fonts.nix create mode 100644 modules/gnome.nix create mode 100644 modules/mail/default.nix create mode 100644 modules/mail/mbsyncrc create mode 100644 modules/niri.nix create mode 100644 modules/plasma.nix create mode 100644 modules/radio.nix create mode 100644 modules/science.nix create mode 100644 modules/tlp.nix diff --git a/flake.lock b/flake.lock index 660bfbb..1484432 100644 --- a/flake.lock +++ b/flake.lock @@ -44,6 +44,21 @@ "type": "github" } }, + "crane": { + "locked": { + "lastModified": 1731098351, + "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=", + "owner": "ipetkov", + "repo": "crane", + "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -60,6 +75,22 @@ "type": "github" } }, + "flake-compat_2": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, "flake-parts": { "inputs": { "nixpkgs-lib": "nixpkgs-lib" @@ -78,6 +109,27 @@ "type": "github" } }, + "flake-parts_2": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1730504689, + "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "506278e768c2a08bec68eb62932193e341f55c90", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": [ @@ -135,6 +187,24 @@ "type": "github" } }, + "flake-utils_4": { + "inputs": { + "systems": "systems_4" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "flakey-profile": { "locked": { "lastModified": 1712898590, @@ -150,6 +220,69 @@ "type": "github" } }, + "flakey-profile_2": { + "locked": { + "lastModified": 1712898590, + "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=", + "owner": "lf-", + "repo": "flakey-profile", + "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d", + "type": "github" + }, + "original": { + "owner": "lf-", + "repo": "flakey-profile", + "type": "github" + } + }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", + "nixpkgs": [ + "nixpkgs-unstable" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1737639419, + "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.4.2", + "repo": "lanzaboote", + "type": "github" + } + }, "lix": { "flake": false, "locked": { @@ -164,6 +297,20 @@ "url": "https://git.lix.systems/lix-project/lix/archive/release-2.93.tar.gz" } }, + "lix-main": { + "flake": false, + "locked": { + "lastModified": 1755264387, + "narHash": "sha256-8mMQ1E/769Zpdh/otiVXAtVX1IYss4QKP31x8EzfYGU=", + "rev": "c3bfb6fe17a9f768afc3d9c3fc24929d44570e72", + "type": "tarball", + "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/c3bfb6fe17a9f768afc3d9c3fc24929d44570e72.tar.gz?rev=c3bfb6fe17a9f768afc3d9c3fc24929d44570e72" + }, + "original": { + "type": "tarball", + "url": "https://git.lix.systems/lix-project/lix/archive/main.tar.gz" + } + }, "lix-module": { "inputs": { "flake-utils": "flake-utils_3", @@ -185,6 +332,29 @@ "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.93.1.tar.gz" } }, + "lix-module-main": { + "inputs": { + "flake-utils": "flake-utils_4", + "flakey-profile": "flakey-profile_2", + "lix": [ + "lix-main" + ], + "nixpkgs": [ + "nixpkgs-unstable" + ] + }, + "locked": { + "lastModified": 1751909859, + "narHash": "sha256-gbpuESxl/An4GTh7QEbQRYJozVIxWkwVGbWK0/0GoRc=", + "rev": "4d4c2b8f0a801c91ce5b717c77fe3a17efa1402f", + "type": "tarball", + "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/4d4c2b8f0a801c91ce5b717c77fe3a17efa1402f.tar.gz?rev=4d4c2b8f0a801c91ce5b717c77fe3a17efa1402f" + }, + "original": { + "type": "tarball", + "url": "https://git.lix.systems/lix-project/nixos-module/archive/main.tar.gz" + } + }, "microvm": { "inputs": { "flake-utils": [ @@ -196,11 +366,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1753388547, - "narHash": "sha256-zbjlS9sa2BbtE80YA9C9DMXwCADba3NjUROw/7Rpt7Y=", + "lastModified": 1755102374, + "narHash": "sha256-v6xhTSgnGQoF1a51BB6OQWN8HXiYbZtVL+54TRuk9zk=", "owner": "astro", "repo": "microvm.nix", - "rev": "9694139d7c761e857ac9d025f9110a92cd8f7686", + "rev": "0a5cda80e48191959cf5a9c0552532599ef2cee4", "type": "github" }, "original": { @@ -235,6 +405,22 @@ "type": "github" } }, + "nixos-hardware": { + "locked": { + "lastModified": 1754564048, + "narHash": "sha256-dz303vGuzWjzOPOaYkS9xSW+B93PSAJxvBd6CambXVA=", + "owner": "NixOS", + "repo": "nixos-hardware", + "rev": "26ed7a0d4b8741fe1ef1ee6fa64453ca056ce113", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "master", + "repo": "nixos-hardware", + "type": "github" + } + }, "nixpkgs": { "locked": { "lastModified": 1750776420, @@ -266,13 +452,29 @@ "type": "github" } }, + "nixpkgs-stable": { + "locked": { + "lastModified": 1730741070, + "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-24.05", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs-unstable": { "locked": { - "lastModified": 1754725699, - "narHash": "sha256-iAcj9T/Y+3DBy2J0N+yF9XQQQ8IEb5swLFzs23CdP88=", + "lastModified": 1755186698, + "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=", "owner": "nixos", "repo": "nixpkgs", - "rev": "85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054", + "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c", "type": "github" }, "original": { @@ -284,11 +486,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1754689972, - "narHash": "sha256-eogqv6FqZXHgqrbZzHnq43GalnRbLTkbBbFtEfm1RSc=", + "lastModified": 1755078291, + "narHash": "sha256-Hu/gTDoi4uy6TAKISPHQusSMy8U6xUbLSDjKBYdhDIY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "fc756aa6f5d3e2e5666efcf865d190701fef150a", + "rev": "3385ca0cd7e14c1a1eb80401fe011705ff012323", "type": "github" }, "original": { @@ -298,6 +500,33 @@ "type": "github" } }, + "pre-commit-hooks-nix": { + "inputs": { + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable" + }, + "locked": { + "lastModified": 1731363552, + "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "pyproject-build-systems": { "inputs": { "nixpkgs": [ @@ -352,8 +581,12 @@ "inputs": { "authentik-nix": "authentik-nix", "flake-utils": "flake-utils_2", + "lanzaboote": "lanzaboote", + "lix-main": "lix-main", "lix-module": "lix-module", + "lix-module-main": "lix-module-main", "microvm": "microvm", + "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs_2", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix", @@ -361,6 +594,27 @@ "website": "website" } }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1731897198, + "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "sops-nix": { "inputs": { "nixpkgs": [ @@ -368,11 +622,11 @@ ] }, "locked": { - "lastModified": 1754328224, - "narHash": "sha256-glPK8DF329/dXtosV7YSzRlF4n35WDjaVwdOMEoEXHA=", + "lastModified": 1754988908, + "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=", "owner": "Mic92", "repo": "sops-nix", - "rev": "49021900e69812ba7ddb9e40f9170218a7eca9f4", + "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48", "type": "github" }, "original": { @@ -384,11 +638,11 @@ "spectrum": { "flake": false, "locked": { - "lastModified": 1751265943, - "narHash": "sha256-XoHSo6GEElzRUOYAEg/jlh5c8TDsyDESFIux3nU/NMc=", + "lastModified": 1754675037, + "narHash": "sha256-afS08F7lfMUBR4qrBxinN1kuxu+DoHQ5TPNVp9VS/OA=", "ref": "refs/heads/main", - "rev": "37c8663fab86fdb202fece339ef7ac7177ffc201", - "revCount": 904, + "rev": "586577f3015397afacd83bc185454f4cc3c8028f", + "revCount": 955, "type": "git", "url": "https://spectrum-os.org/git/spectrum" }, @@ -442,6 +696,21 @@ "type": "github" } }, + "systems_4": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tmux-yank": { "flake": false, "locked": { diff --git a/flake.nix b/flake.nix index 959240a..e10259a 100644 --- a/flake.nix +++ b/flake.nix @@ -8,6 +8,17 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + lix-main = { + url = "https://git.lix.systems/lix-project/lix/archive/main.tar.gz"; + flake = false; + }; + + lix-module-main = { + url = "https://git.lix.systems/lix-project/nixos-module/archive/main.tar.gz"; + inputs.nixpkgs.follows = "nixpkgs-unstable"; + inputs.lix.follows = "lix-main"; + }; + flake-utils.url = "github:numtide/flake-utils"; sops-nix = { @@ -15,6 +26,8 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + nixos-hardware.url = "github:NixOS/nixos-hardware?ref=master"; + microvm = { url = "github:astro/microvm.nix"; inputs = { @@ -23,6 +36,11 @@ }; }; + lanzaboote = { + url = "github:nix-community/lanzaboote?ref=v0.4.2"; + inputs.nixpkgs.follows = "nixpkgs-unstable"; + }; + authentik-nix = { url = "github:nix-community/authentik-nix"; }; @@ -41,8 +59,11 @@ outputs = inputs@{ + lanzaboote, lix-module, + lix-module-main, microvm, + nixos-hardware, nixpkgs, nixpkgs-unstable, sops-nix, @@ -90,6 +111,31 @@ in microvms // { + toaster = nixpkgs-unstable.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lanzaboote.nixosModules.lanzaboote + nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 + lix-module-main.nixosModules.default + + ./hosts/toaster + + ./modules/basic-tools + ./modules/binary-caches.nix + ./modules/devtools.nix + ./modules/emacs.nix + ./modules/gnome.nix + ./modules/gnupg.nix + ./modules/mail + ./modules/radio.nix + ./modules/science.nix + ./modules/tlp.nix + ./modules/virtualization.nix + ./modules/wg + ]; + }; cloud = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; }; diff --git a/hosts/toaster/0xa-home.nix b/hosts/toaster/0xa-home.nix new file mode 100644 index 0000000..b3ff5eb --- /dev/null +++ b/hosts/toaster/0xa-home.nix @@ -0,0 +1,21 @@ +{ pkgs, ... }: +{ + home.stateVersion = "24.11"; + + home.pointerCursor = { + name = "Banana"; + size = 32; + package = pkgs.banana-cursor; + x11.enable = true; + gtk.enable = true; + }; + + gtk = { + enable = true; + cursorTheme = { + name = "Banana"; + size = 32; + package = pkgs.banana-cursor; + }; + }; +} diff --git a/hosts/toaster/amd.nix b/hosts/toaster/amd.nix new file mode 100644 index 0000000..b58784f --- /dev/null +++ b/hosts/toaster/amd.nix @@ -0,0 +1,22 @@ +{ ... }: +{ + boot.initrd.kernelModules = [ "amdgpu" ]; + + boot.kernelParams = [ + # use new amd pstate driver + "amd_pstate=active" + # fix flicker + "amdgpu.dcdebugmask=0x10" + ]; + + # hardware.graphics = { + # extraPackages = with pkgs; [ + # rocm-opencl-icd + # rocm-opencl-runtime + # amdvlk + # ]; + # extraPackages32 = with pkgs; [ + # driversi686Linux.amdvlk + # ]; + # }; +} diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix new file mode 100644 index 0000000..2b8577b --- /dev/null +++ b/hosts/toaster/default.nix @@ -0,0 +1,80 @@ +{ pkgs, config, ... }: +{ + imports = [ + ./amd.nix + ./hardware-configuration.nix + ./irc.nix + ./network + ./secure-boot.nix + ./zfs.nix + ]; + + sops.defaultSopsFile = ./secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + sops.secrets = { + "wg/zw" = { + owner = config.users.users.systemd-network.name; + }; + "wg/dvb" = { + owner = config.users.users.systemd-network.name; + }; + "wg/mullvad" = { + owner = config.users.users.systemd-network.name; + }; + "wg/0xa-mgmt" = { + owner = config.users.users.systemd-network.name; + }; + }; + + nixpkgs.config.allowUnfree = true; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + hardware.enableAllFirmware = true; + + # update the firmware + services.fwupd.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Amsterdam"; + + # Select internationalisation properties. + i18n = { + defaultLocale = "en_US.UTF-8"; + supportedLocales = [ "all" ]; + }; + + # support ddc brigtness control + hardware.i2c.enable = true; + boot.kernelModules = [ "i2c-dev" ]; + environment.systemPackages = [ pkgs.ddcutil ]; + + users.users."0xa" = { + extraGroups = [ + "wheel" + "video" + "plugdev" + "dialout" + "bluetooth" + "libvirtd" + "qemu-libvirtd" + "i2c" + ]; + group = "users"; + home = "/home/0xa"; + isNormalUser = true; + uid = 1000; + shell = pkgs.zsh; + }; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.11"; # Did you read the comment? + +} diff --git a/hosts/toaster/hardware-configuration.nix b/hosts/toaster/hardware-configuration.nix new file mode 100644 index 0000000..318ff03 --- /dev/null +++ b/hosts/toaster/hardware-configuration.nix @@ -0,0 +1,85 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ + config, + lib, + modulesPath, + ... +}: + +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ + "nvme" + "xhci_pci" + "usb_storage" + "usbhid" + "sd_mod" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + boot.zfs.extraPools = [ "zpool" ]; + + fileSystems."/" = { + device = "zpool/root"; + fsType = "zfs"; + options = [ "zfsutil" ]; + }; + + fileSystems."/nix" = { + device = "zpool/nix"; + fsType = "zfs"; + options = [ "zfsutil" ]; + }; + + fileSystems."/home" = { + device = "zpool/data/home"; + fsType = "zfs"; + options = [ "zfsutil" ]; + }; + + fileSystems."/var" = { + device = "zpool/data/var"; + fsType = "zfs"; + options = [ "zfsutil" ]; + }; + + fileSystems."/tmp" = { + device = "zpool/nocomp/tmp"; + fsType = "zfs"; + options = [ "zfsutil" ]; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/A170-F83D"; + fsType = "vfat"; + options = [ + "fmask=0022" + "dmask=0022" + ]; + }; + + swapDevices = [ + { + device = "/dev/disk/by-partuuid/037518f2-9fa0-44f0-9550-745e27bf1c1f"; + randomEncryption = true; + } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp5s0f4u1u1.useDHCP = lib.mkDefault true; + # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/toaster/irc.nix b/hosts/toaster/irc.nix new file mode 100644 index 0000000..ecdac88 --- /dev/null +++ b/hosts/toaster/irc.nix @@ -0,0 +1,10 @@ +{ config, pkgs, ... }: +{ + environment.systemPackages = [ pkgs.senpai ]; + + sops.secrets = { + "senpai" = { + owner = config.users.users."0xa".name; + }; + }; +} diff --git a/hosts/toaster/network/default.nix b/hosts/toaster/network/default.nix new file mode 100644 index 0000000..6504dbb --- /dev/null +++ b/hosts/toaster/network/default.nix @@ -0,0 +1,45 @@ +{ lib, config, ... }: +{ + imports = [ + ./mullvad.nix + ./dumpdvb.nix + ./zw.nix + ]; + + # Networkmanager shouldn't interfere with systemd managed interfaces + networking.networkmanager = { + enable = true; + unmanaged = + let + systemd_netdevs = lib.attrsets.attrValues ( + lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs + ); + in + systemd_netdevs; + }; + + systemd.network = { + enable = true; + wait-online.enable = false; # uplink is managed by networkmanager + }; + + users.users."0xa".extraGroups = [ "networkmanager" ]; + + networking = { + hostName = "toaster"; + firewall.enable = true; + wireguard.enable = true; + }; + + services.resolved = { + enable = true; + dnssec = "false"; + fallbackDns = [ + "9.9.9.9" + "2620:fe::fe" + "149.112.112.112" + "2620:fe::9" + ]; + }; + +} diff --git a/hosts/toaster/network/dumpdvb.nix b/hosts/toaster/network/dumpdvb.nix new file mode 100644 index 0000000..d3fba93 --- /dev/null +++ b/hosts/toaster/network/dumpdvb.nix @@ -0,0 +1,38 @@ +{ config, ... }: +{ + systemd.network = { + # Wireguard + # Dump-dvb + netdevs."30-wg-dumpdvb" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-dumpdvb"; + Description = "dvb.solutions enterprise network"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/dvb".path; + }; + wireguardPeers = [ + { + PublicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY="; + Endpoint = "academicstrokes.com:51820"; + AllowedIPs = [ "10.13.37.0/24" ]; + PersistentKeepalive = 25; + } + ]; + }; + networks."30-wg-dumpdvb" = { + matchConfig.Name = "wg-dumpdvb"; + networkConfig = { + Address = "10.13.37.3/24"; + IPv6AcceptRA = true; + }; + routes = [ + { + Gateway = "10.13.37.1"; + Destination = "10.13.37.0/24"; + } + ]; + }; + }; +} diff --git a/hosts/toaster/network/full-networkd.nix b/hosts/toaster/network/full-networkd.nix new file mode 100644 index 0000000..ee0bdbe --- /dev/null +++ b/hosts/toaster/network/full-networkd.nix @@ -0,0 +1,71 @@ +{ lib, pkgs, ... }: +{ + imports = [ + ./mullvad.nix + ./dumpdvb.nix + ./zw.nix + ]; + + environment.systemPackages = with pkgs; [ + iwgtk + impala + ]; + + # kick out networkmanager + networking.networkmanager.enable = lib.mkForce false; + networking.useNetworkd = true; + systemd.network.enable = true; + + networking = { + hostName = "toaster"; + firewall.enable = true; + wireguard.enable = true; + wireless.iwd.enable = true; + }; + + services.resolved = { + enable = true; + dnssec = "false"; + fallbackDns = [ + "9.9.9.9" + "2620:fe::fe" + "149.112.112.112" + "2620:fe::9" + ]; + }; + + # we might have no interwebs at all + systemd.network.wait-online.enable = false; + + # uplinks + systemd.network.networks = { + "10-ether-uplink" = { + matchConfig.Name = "enp1s0f0"; + networkConfig = { + DHCP = "yes"; + IPv6AcceptRA = true; + }; + }; + "10-dock-uplink" = { + matchConfig.Name = "enp5s0f4u1u1"; + networkConfig = { + DHCP = "yes"; + IPv6AcceptRA = true; + }; + dhcpV4Config = { + RouteMetric = 666; + }; + dhcpV6Config = { + RouteMetric = 666; + }; + }; + "wlan-uplink" = { + matchConfig.Name = "wlan0"; + networkConfig = { + DHCP = "yes"; + IPv6AcceptRA = true; + }; + }; + }; + +} diff --git a/hosts/toaster/network/mullvad.nix b/hosts/toaster/network/mullvad.nix new file mode 100644 index 0000000..54fec8d --- /dev/null +++ b/hosts/toaster/network/mullvad.nix @@ -0,0 +1,98 @@ +{ + config, + ... +}: +{ + systemd.network = + let + pubkey = "xpZ3ZDEukbqKQvdHwaqKMUhsYhcYD3uLPUh1ACsVr1s="; + endpoint = "185.65.134.86"; + port = "51820"; + addr = [ + "10.74.16.48/32" + "fc00:bbbb:bbbb:bb01::b:102f/128" + ]; + in + { + netdevs."10-wg-mullvad" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-mullvad"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/mullvad".path; + FirewallMark = 34952; # 0x8888 + RouteTable = "off"; + }; + wireguardPeers = [ + { + PublicKey = pubkey; + Endpoint = "${endpoint}:${port}"; + AllowedIPs = [ + "0.0.0.0/0" + "::0/0" + ]; + } + ]; + }; + networks."10-wg-mullvad" = { + matchConfig.Name = "wg-mullvad"; + address = addr; + networkConfig = { + DNS = "10.64.0.1"; + DNSDefaultRoute = true; + Domains = [ "~." ]; + }; + routes = + map + (gate: { + Gateway = gate; + Table = 1000; + }) + [ + "0.0.0.0" + "::" + ]; + + routingPolicyRules = + [ + { + Family = "both"; + FirewallMark = 34952; # 0x8888 + InvertRule = true; + Table = "1000"; + Priority = 100; + } + { + Family = "both"; + SuppressPrefixLength = 0; + Table = "main"; + Priority = 90; + } + ] + ++ map + (net: { + # only route global addresses over VPN + Priority = 80; + To = net; + }) + [ + # Mullvad endpoint + "${endpoint}/32" + # zw endpoint + "81.201.149.152/32" + # oxalab/oxa endpoint + "188.245.196.27/32" + # "10.0.0.0/8" + "10.13.37.0/24" + # 0xa-mgmt + "10.89.87.0/24" + # "172.16.0.0/12" + "172.16.0.0/12" + # "182.168.0.0/16" + "182.168.0.0/16" + # "fc00::/7" + ]; + }; + }; +} diff --git a/hosts/toaster/network/zw.nix b/hosts/toaster/network/zw.nix new file mode 100644 index 0000000..71e75be --- /dev/null +++ b/hosts/toaster/network/zw.nix @@ -0,0 +1,61 @@ +{ config, ... }: +{ + # zentralwerk + systemd.network = { + netdevs."10-wg-zentralwerk" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-zentralwerk"; + Description = "Tunnel to the best basement in Dresden"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets."wg/zw".path; + RouteTable = "off"; + }; + wireguardPeers = [ + { + PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo="; + Endpoint = "81.201.149.152:1337"; + AllowedIPs = [ + "172.20.72.0/21" + "172.22.90.0/24" + "172.22.99.0/24" + ]; + PersistentKeepalive = 25; + } + ]; + }; + networks."10-wg-zentralwerk" = { + matchConfig.Name = "wg-zentralwerk"; + networkConfig = { + Address = "172.20.76.226/21"; + IPv6AcceptRA = true; + DNS = "172.20.73.8"; + Domains = [ + "~hq.c3d2.de" + "~serv.zentralwerk.org" + "~hq.zentralwerk.org" + "~cluster.zentralwerk.org" + ]; + }; + routes = [ + { + Gateway = "172.20.76.225"; + Destination = "172.20.72.0/21"; + Metric = 1023; + } + { + Gateway = "172.20.76.225"; + Destination = "172.20.90.0/24"; + Metric = 1023; + } + { + Gateway = "172.20.76.225"; + Destination = "172.22.99.0/24"; + Metric = 1023; + } + + ]; + }; + }; +} diff --git a/hosts/toaster/secrets.yaml b/hosts/toaster/secrets.yaml new file mode 100644 index 0000000..701733d --- /dev/null +++ b/hosts/toaster/secrets.yaml @@ -0,0 +1,51 @@ +wg: + mullvad: ENC[AES256_GCM,data:P9acMXooRll8i81RIBVb0OxFdzx2WsGgVKqX+BoV7cvPGWJK5FRIF8KAcqg=,iv:kq+3guPx2+reDqmfHuhWEvUsKNynG+t7LYRNp5kFLoQ=,tag:Aj0P7IrrTdRK59aBMjPx5Q==,type:str] + zw: ENC[AES256_GCM,data:CXrLvV+b9DUfmr+CwH8dBTHvDHtgVmiF9g+QpzFqMcc91yQDzQqT1d4AQSk=,iv:Wdj11qlGWGm2XSieFZ4csqdIyR0epzPCkeWyUUmjJbk=,tag:UO07WUwr138B5TtMGujvew==,type:str] + 0xa-mgmt: ENC[AES256_GCM,data:THKgWJs4bxNYwnl1FQzXSC0xIuv1r0jSByQgwoKau34sddgTzztRHbSztGs=,iv:wn08l8hlSORlyD8XpF6pk6F3HTsT345xp8XxkJVUKcY=,tag:oP+5+cunkQ5KVf6PB5Rirw==,type:str] + dvb: ENC[AES256_GCM,data:1+IM6ORPtlIroeekaJSkOwYArh0fN6ycJNaXo680pE2Xv4DUBrIlh8q3V2A=,iv:btf3IpM4Wntkf3RYPwUdhH+4WUUqZp0zYp0aj2sdGM0=,tag:MDvS4CWYQLdp2YGs3/5Htw==,type:str] +mail: + oxapentane.com: ENC[AES256_GCM,data:HW1xcclr5CiUFVF8As79ZZH1c14sl4T0l18=,iv:leAVYaQkMuJewkCZc3fTUUNzZ9BDjV5CuT84bzvhrrs=,tag:Mm8OB8gLbmUwKSLugTR6GA==,type:str] + shipunov.xyz: ENC[AES256_GCM,data:cg+P+FrZ2icjfhwDGKGyUH9DejSZHpNs2bcSBPyz8g==,iv:XZFaSXnGmTL9j2sEyt5Q7+pe6rr+WA/0UGq/2Gl5DTI=,tag:oq+5EuJWJKwK3h0/e6Uozw==,type:str] + dvb.solutions: ENC[AES256_GCM,data:GSjPIPA5TGMWfhdRzTsiHPfXFVGLVSpJvJG+I++i,iv:EBlk00wqADCuYTzuVcuX9kSn6TVBfN12UlcXyps6TtE=,tag:G7rKTngN4v2FtuhQEMdUQQ==,type:str] + tlm.solutions: ENC[AES256_GCM,data:ncTMh/jw+YmcmcVU/c1I36vV1CwtmtYwfyDUx9w9,iv:vPnmdvDnEJ9FF4rDkSfPnLWebleSgI/yG7qOgJfq5ic=,tag:z4w4LOGf2v0TBSxrHULBsw==,type:str] +senpai: ENC[AES256_GCM,data:nLMlw+Gw5p9pcyElvHy/d+GV0/dbTj3+Et+lzBs1YEUcsYT2lM7sN+5+4PEF6weJgHUreTl007fh8+FO8S+mUg==,iv:+5szUWaARn93RTQvY13JGn2zJ3y8iyjv09i3KtbhaTQ=,tag:OsD4IoRv8wGuUbEnsld7Dg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1avaphjah4k8n80jrnraeqh9r94fu6awd6k37z4zfjssl5ft07qkqmuehcm + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibGw3UTUzNHg2dDJGYmYx + Vis5WlhqeXUybmtxTU9XWEFLcjc1VEErOTN3CmZYa2kzcUdNQURVTG5NeUpSb0I0 + STdQb1NqSWJoK1pmYXA5UXM5NDRFWVUKLS0tIDNWTmVTcDdneUEwemtWZVNZVFdz + bDRBWjJJSDl3bDkxenR1S2NMZW91dW8Kzhc/6HeEJfLGDaKdRSbpaMdR7XaBxdQI + jnAySJCGsXxCPebRtCIdDnoLjdqdzEggEhRh27JOpeOiEukLmakPMA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-02-05T19:41:58Z" + mac: ENC[AES256_GCM,data:5u2hJYMHwpFd5fcHXKzOblHfgnRTjNIEL+glBsHct3xZ+G1APQg9WdgZbRWc+ypdYPFfhqXKV9RBl/UHtFEyljL7JQV0U8EfumP1WNjPaMgnWftm5qLOe0PxmrPbwsYYBdotO9GVoplghrNd1euvMsxd3F+YtU+MnY+u4dcr4C8=,iv:A61rDNajtU/NOqcemmCN348STdMI9qqPRvdd6n/EuKg=,tag:Y1zi86LNX1xlXpjbslmRAA==,type:str] + pgp: + - created_at: "2025-01-02T22:57:16Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7zUOKwzpAE7AQ//fH+XzwM0ARlUGFK0/WDVXb4fR8364JdtrWp1njqYQBme + rRtIuyYWg7b4c1K9frX+3Ftei6EhZTejgyoSulQkOD5X7L726iik8kaJxtkH0Ubl + Hmak4viT9r4cCBYBBCsDQgojAImgNvaW+DyX4UFOyr0asnUEVj4N1/eejxPteXfj + c4+PzKKkliRpwUj4OZufmxcZvFi3XBy1AIgji9EpZkG6mGeeRpchJdA7kFWlO0fl + wUuDjudqSMr2hOySfOI/AW+4QgWo1t6uZwIi4VWMmI2h3hlAbsWfYiLMXqIB8RpF + lx30HdcFmZwfmVyT5n+oFlV4kPWPNvc0lLDvoZdKpsXIeuhMWKdrRZ2XmDE6F+rQ + PE4tT46vR4uCHNSAiLYhAY+yr2ic5w+Damv80mxsnGBrFhh93/5grJRSQ+iZcr1D + hu4nMAiw7xdkjgVHJrZZ0YEh9cXD74oUfvE7T201h2ppFEAzYaDrwuIuFqJmFew/ + /meRImzoCpp2H2cAsol90kxVdNc+yQerNqknkNBU6TCWB5HkcEa1xM5PER2s8cHd + KK5ej1DzNgQHN41N3zv1xyd2HXOOgVXYwITkHU0BNFBowpf2JScUcVMWYtuZ2Mlh + izVM0pJwx7bJgZqVnpZsxyzSOD3I6ufS61VMp5RVOS/58qih2BNsTys3DtmaFcvS + XgFD1Mr9Ul4xIyF2akUeGU5n+fRZnIwtM7JmcJGjlg1nQPvRFZSLrYBs83TPrftS + zQv+xyb6mPo91iHqe/ey3JbB/+/uSkVSZsBL05thYNLucQJ0L3r0qhc6gnQxNNo= + =DYwa + -----END PGP MESSAGE----- + fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix new file mode 100644 index 0000000..9d934e1 --- /dev/null +++ b/hosts/toaster/secure-boot.nix @@ -0,0 +1,13 @@ +{ pkgs, lib, ... }: +{ + boot = { + bootspec.enable = true; + loader.systemd-boot.enable = lib.mkForce false; + lanzaboote = { + enable = true; + pkiBundle = "/var/lib/sbctl"; + }; + }; + + environment.systemPackages = [ pkgs.sbctl ]; +} diff --git a/hosts/toaster/zfs.nix b/hosts/toaster/zfs.nix new file mode 100644 index 0000000..1970bbf --- /dev/null +++ b/hosts/toaster/zfs.nix @@ -0,0 +1,25 @@ +{ + pkgs, + ... +}: +{ + services.fstrim.enable = true; + services.zfs = { + autoSnapshot.enable = true; + trim.enable = true; + autoScrub = { + enable = true; + pools = [ "zpool" ]; + }; + }; + networking.hostId = "dca22577"; + boot = { + kernelPackages = pkgs.linuxKernel.packages.linux_6_12; + zfs.package = pkgs.zfs_2_3; + supportedFilesystems = [ "zfs" ]; + kernelParams = [ "nohibernate" ]; + plymouth.enable = false; + tmp.useTmpfs = false; + tmp.cleanOnBoot = true; + }; +} diff --git a/modules/chromium.nix b/modules/chromium.nix new file mode 100644 index 0000000..4cdf16a --- /dev/null +++ b/modules/chromium.nix @@ -0,0 +1,40 @@ +{ pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + (chromium.override { enableWideVine = true; }) + ]; + + nixpkgs.config.chromium.commandLineArgs = "--enable-features=UseOzonePlatform --ozone-platform=wayland --ignore-gpu-blocklist --enable-gpu-rasterization --enable-zero-copy --enable-features=VaapiVideoDecoder,VaapiVideoEncoder,CanvasOopRasterization,WebUIDarkMode"; + + programs.chromium = { + enable = true; + extensions = [ + "ekhagklcjbdpajgpjgmbionohlpdbjgc" # zotero connector + "nngceckbapebfimnlniiiahkandclblb" # bitwarden + "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite + "mnjggcdmjocbbbhaepdhchncahnbgone" # sponsorblock + "khncfooichmfjbepaaaebmommgaepoid" # unhook + ]; + extraOpts = { + "BrowserSignin" = 0; + "SyncDisabled" = true; + "PasswordManagerEnabled" = false; + "TranslateEnabled" = false; + "AutofillAddressEnabled" = false; + "AutofillCreditCardEnabled" = false; + "AutoplayAllowed" = false; + "DefaultNotificationSetting" = 2; + "BackgroundModeEnabled" = false; + # "DefaultSearchProviderEnabled" = true; + # "DefaultSearchProviderSearchURL" = "https://google.com/search?q={searchTerms}"; + # "DefaultSearchProviderSearchURL" = "https://duckduckgo.com/?q={searchTerms}"; + "SearchSuggestEnable" = false; + "BlockThirdPartyCookies" = true; + "PrivacySandboxAdMeasurementEnabled" = false; + "PrivacySandboxAdTopicsEnabled" = false; + "PrivacySandboxPromptEnabled" = false; + "PrivacySandboxSiteEnabledAdsEnabled" = false; + }; + }; +} diff --git a/modules/desktop-software.nix b/modules/desktop-software.nix new file mode 100644 index 0000000..af73ea5 --- /dev/null +++ b/modules/desktop-software.nix @@ -0,0 +1,31 @@ +{ pkgs, ... }: +{ + imports = [ + ./chromium.nix + ]; + environment.systemPackages = with pkgs; [ + audacity + blender + dino + discord + element-desktop + ffmpeg-full + ghostty + gimp + inkscape + lapce + libreoffice + mpv + obs-studio + qbittorrent + signal-desktop + spotify + telegram-desktop + tor-browser + transmission_4-gtk + wl-clipboard + yt-dlp + ]; + programs.steam.enable = true; + programs.firefox.enable = true; +} diff --git a/modules/emacs.nix b/modules/emacs.nix new file mode 100644 index 0000000..39c2db8 --- /dev/null +++ b/modules/emacs.nix @@ -0,0 +1,60 @@ +{ + pkgs, + lib, + ... +}: + +{ + environment.systemPackages = + let + # https://wiki.nixos.org/wiki/TexLive + # minimal set of latex packages for orgmode + # emacs config: + # (setq org-latex-complier "lualatex") + # (setq org-preview-latex-default-process 'dvisvgm) + orgmode-tex = ( + pkgs.texlive.combine { + inherit (pkgs.texlive) + scheme-basic + dvisvgm + dvipng + wrapfig + amsmath + ulem + hyperref + capt-of + ; + } + ); + in + with pkgs; + [ + mu + orgmode-tex + ]; + + services.emacs = { + install = true; + enable = true; + package = + with pkgs; + ( + (emacsPackagesFor ( + emacs-pgtk.overrideAttrs (old: { + passthru = old.passthru // { + treeSitter = true; + }; + }) + )).emacsWithPackages + ( + epkgs: with epkgs; [ + treesit-grammars.with-all-grammars + vterm + pdf-tools + mu4e + ] + ) + ); + defaultEditor = lib.mkForce true; + }; +} diff --git a/modules/fonts.nix b/modules/fonts.nix new file mode 100644 index 0000000..96236cb --- /dev/null +++ b/modules/fonts.nix @@ -0,0 +1,48 @@ +{ pkgs, ... }: +{ + fonts.packages = with pkgs; [ + adwaita-fonts + monoid + font-awesome + dejavu_fonts + julia-mono + uw-ttyp0 + gohufont + spleen + terminus_font + creep + corefonts + dina-font + fira + fira-mono + hack-font + liberation_ttf + noto-fonts + noto-fonts-cjk-sans + noto-fonts-color-emoji + noto-fonts-monochrome-emoji + noto-fonts-emoji + noto-fonts-extra + proggyfonts + symbola + open-sans + twemoji-color-font + twitter-color-emoji + iosevka-bin + cozette + nerd-fonts.hack + ibm-plex + ]; + + fonts.enableDefaultPackages = true; + fonts.fontconfig = { + enable = true; + allowBitmaps = true; + useEmbeddedBitmaps = true; + defaultFonts.emoji = [ + "Twitter Color Emoji" + "Noto Color Emoji" + ]; + }; + +} diff --git a/modules/gnome.nix b/modules/gnome.nix new file mode 100644 index 0000000..5743283 --- /dev/null +++ b/modules/gnome.nix @@ -0,0 +1,63 @@ +{ pkgs, ... }: +{ + + imports = [ + ./desktop-software.nix + ./fonts.nix + ]; + environment.systemPackages = with pkgs; [ + amberol + celluloid + ddcutil + gnome-console + gnome-obfuscate + gnome-boxes + gnome-tweaks + gnomeExtensions.caffeine + gnomeExtensions.brightness-control-using-ddcutil + fractal + ]; + + environment.gnome.excludePackages = with pkgs; [ + totem + geary + gnome-music + ]; + + services.gnome = { + evolution-data-server.enable = true; + gnome-keyring.enable = true; + gnome-online-accounts.enable = true; + }; + + programs = { + seahorse.enable = true; + gnupg.agent.pinentryPackage = pkgs.pinentry-gnome3; + evolution = { + enable = true; + plugins = [ pkgs.evolution-ews ]; + }; + }; + + services = { + desktopManager.gnome.enable = true; + displayManager.gdm = { + enable = true; + wayland = true; + }; + }; + + # Enable sound. + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + pulse.enable = true; + }; + + programs.zsh.vteIntegration = true; + programs.bash.vteIntegration = true; + + hardware.bluetooth.enable = true; + +} diff --git a/modules/mail/default.nix b/modules/mail/default.nix new file mode 100644 index 0000000..ba65f2c --- /dev/null +++ b/modules/mail/default.nix @@ -0,0 +1,138 @@ +{ config, pkgs, ... }: +let + mbsyncConf = ./mbsyncrc; +in +{ + environment.systemPackages = with pkgs; [ + isync + msmtp + neomutt + notmuch + alot + w3m + links2 + ]; + + environment.shellAliases = { + mutt = "neomutt"; + }; + + sops.secrets = { + "mail/oxapentane.com" = { + owner = config.users.users."0xa".name; + }; + "mail/shipunov.xyz" = { + owner = config.users.users."0xa".name; + }; + "mail/dvb.solutions" = { + owner = config.users.users."0xa".name; + }; + "mail/tlm.solutions" = { + owner = config.users.users."0xa".name; + }; + }; + + programs.msmtp = { + enable = true; + setSendmail = true; + extraConfig = '' + account mail@oxapentane.com + host smtp.migadu.com + port 587 + from *@oxapentane.com + user mail@oxapentane.com + passwordeval cat ${config.sops.secrets."mail/oxapentane.com".path} + auth on + tls on + tls_trust_file /etc/ssl/certs/ca-certificates.crt + logfile ~/.msmtp.log + + account grigory@shipunov.xyz + host smtp.migadu.com + port 587 + from *@shipunov.xyz + user grigory@shipunov.xyz + passwordeval cat ${config.sops.secrets."mail/shipunov.xyz".path} + auth on + tls on + tls_trust_file /etc/ssl/certs/ca-certificates.crt + logfile ~/.msmtp.log + + account dump@dvb.solutions + host smtp.migadu.com + port 587 + from dump@dvb.solutions + user dump@dvb.solutions + passwordeval cat ${config.sops.secrets."mail/dvb.solutions".path} + auth on + tls on + tls_trust_file /etc/ssl/certs/ca-certificates.crt + logfile ~/.msmtp.log + + account grigory@tlm.solutions + host smtp.migadu.com + port 587 + from grigory@tlm.solutions + user grigory@tlm.solutions + passwordeval cat ${config.sops.secrets."mail/tlm.solutions".path} + auth on + tls on + tls_trust_file /etc/ssl/certs/ca-certificates.crt + logfile ~/.msmtp.log + ''; + }; + + systemd.user = { + + # Service and timer to sync imap to local maildir + services.mbsync = { + enable = true; + after = [ + "graphical.target" + "network-online.target" + ]; + script = '' + ${pkgs.isync}/bin/mbsync -q -a --config=${mbsyncConf} + ''; + serviceConfig = { + Type = "oneshot"; + }; + }; + + timers.mbsync = { + enable = true; + wantedBy = [ "timers.target" ]; + timerConfig = { + Unit = "mbsync.service"; + OnBootSec = "5m"; + OnUnitInactiveSec = "11m"; + }; + }; + + # service and timer to flush the msmtp queue + services.flush-msmtpq = { + enable = true; + after = [ + "graphical.target" + "network-online.target" + ]; + script = '' + ${pkgs.msmtp}/bin/msmtp-queue -r + ''; + serviceConfig = { + Type = "oneshot"; + }; + }; + + timers.flush-msmtpq = { + enable = true; + wantedBy = [ "timers.target" ]; + timerConfig = { + Unit = "flush-msmtpq.service"; + OnBootSec = "11m"; + OnUnitInactiveSec = "13m"; + }; + }; + + }; +} diff --git a/modules/mail/mbsyncrc b/modules/mail/mbsyncrc new file mode 100644 index 0000000..fd2bc5b --- /dev/null +++ b/modules/mail/mbsyncrc @@ -0,0 +1,97 @@ +IMAPStore mail@oxapentane.com-remote +Host imap.migadu.com +Port 993 +User mail@oxapentane.com +PassCmd "cat /run/secrets/mail/oxapentane.com" +AuthMechs LOGIN +SSLType IMAPS + +MaildirStore mail@oxapentane.com-local +Subfolders Verbatim +Path /home/0xa/mail/mail@oxapentane.com/ +Inbox /home/0xa/mail/mail@oxapentane.com/INBOX + +Channel mail@oxapentane.com +Expunge Both +Master :mail@oxapentane.com-remote: +Slave :mail@oxapentane.com-local: +Create Both +SyncState * +Patterns * +MaxMessages 0 +ExpireUnread no +# End profile + + +IMAPStore grigory@shipunov.xyz-remote +Host imap.migadu.com +Port 993 +User grigory@shipunov.xyz +PassCmd "cat /run/secrets/mail/shipunov.xyz" +AuthMechs LOGIN +SSLType IMAPS + +MaildirStore grigory@shipunov.xyz-local +Subfolders Verbatim +Path /home/0xa/mail/grigory@shipunov.xyz/ +Inbox /home/0xa/mail/grigory@shipunov.xyz/INBOX + +Channel grigory@shipunov.xyz +Expunge Both +Master :grigory@shipunov.xyz-remote: +Slave :grigory@shipunov.xyz-local: +Create Both +SyncState * +Patterns * +MaxMessages 0 +ExpireUnread no +# End profile + + +IMAPStore dump@dvb.solutions-remote +Host imap.migadu.com +Port 993 +User dump@dvb.solutions +PassCmd "cat /run/secrets/mail/dvb.solutions" +AuthMechs LOGIN +SSLType IMAPS + +MaildirStore dump@dvb.solutions-local +Subfolders Verbatim +Path /home/0xa/mail/dump@dvb.solutions/ +Inbox /home/0xa/mail/dump@dvb.solutions/INBOX + +Channel dump@dvb.solutions +Expunge Both +Master :dump@dvb.solutions-remote: +Slave :dump@dvb.solutions-local: +Create Both +SyncState * +Patterns * +MaxMessages 0 +ExpireUnread no +# End profile + +IMAPStore grigory@tlm.solutions-remote +Host imap.migadu.com +Port 993 +User grigory@tlm.solutions +PassCmd "cat /run/secrets/mail/tlm.solutions" +AuthMechs LOGIN +SSLType IMAPS + +MaildirStore grigory@tlm.solutions-local +Subfolders Verbatim +Path /home/0xa/mail/grigory@tlm.solutions/ +Inbox /home/0xa/mail/grigory@tlm.solutions/INBOX + +Channel grigory@tlm.solutions +Expunge Both +Master :grigory@tlm.solutions-remote: +Slave :grigory@tlm.solutions-local: +Create Both +SyncState * +Patterns * +MaxMessages 0 +ExpireUnread no +# End profile diff --git a/modules/niri.nix b/modules/niri.nix new file mode 100644 index 0000000..441c55b --- /dev/null +++ b/modules/niri.nix @@ -0,0 +1,127 @@ +{ pkgs, ... }: +{ + programs.niri.enable = true; + + imports = [ + ./desktop-software.nix + ./fonts.nix + ]; + environment.systemPackages = with pkgs; [ + screen-message + qbittorrent + gajim + imv + mpv + evince + brightnessctl + pulsemixer + cmus + termusic + gsettings-desktop-schemas + xdg-utils + qt5.qtwayland + bashmount + audacity + spotify-player + zathura + ncdu + adwaita-icon-theme + bluetui + gammastep + graphicsmagick + i3status-rust + impala + kanshi + pamixer + swayidle + swaylock + wl-clipboard + xfce.thunar + banana-cursor + yofi + alacritty + i3bar-river + mako + swww + wbg + oculante + xwayland-satellite + foot + fuzzel + ]; + + # Enable sound. + security.rtkit.enable = true; + + services.pipewire = { + enable = true; + alsa.enable = true; + pulse.enable = true; + }; + + hardware.bluetooth = { + enable = true; + package = pkgs.bluez; + }; + + programs.zsh.vteIntegration = true; + programs.bash.vteIntegration = true; + services.upower.enable = true; + + services.acpid.enable = true; + programs.light.enable = true; + + programs.xwayland.enable = true; + + environment.sessionVariables = { + GTK_THEME = "Adwaita:dark"; + }; + xdg.portal = { + enable = true; + wlr.enable = true; + extraPortals = [ pkgs.xdg-desktop-portal-gnome ]; + }; + + services.udisks2.enable = true; + environment.shellAliases = { + # mounting shit + mnt = "udisksctl mount -b"; + umnt = "udisksctl unmount -b"; + unlock = "udisksctl unlock -b"; + lock = "udisksctl lock -b"; + # easier navigation + pwc = "pwd|wl-copy"; + cdp = "cd $(wl-paste)"; + }; + + qt = { + enable = true; + platformTheme = "gnome"; + style = "adwaita-dark"; + }; + + services.gnome.gnome-keyring.enable = true; + programs.seahorse.enable = true; + + # https://github.com/JohnRTitor/nix-conf/commit/53bc83aef18849976d5a42cc727d38dd0e38c5b0 + security.pam.services = { + greetd.enableGnomeKeyring = true; + greetd-password.enableGnomeKeyring = true; + login.enableGnomeKeyring = true; + }; + services.dbus.packages = with pkgs; [ + gnome-keyring + gcr + ]; + + services.greetd = { + enable = true; + settings = { + default_session = { + command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --greeting \"$(${pkgs.fortune}/bin/fortune -s)\" --cmd ${pkgs.niri}/bin/niri-session"; + }; + }; + }; + + programs.gnupg.agent.pinentryPackage = pkgs.pinentry-curses; +} diff --git a/modules/plasma.nix b/modules/plasma.nix new file mode 100644 index 0000000..1a7a170 --- /dev/null +++ b/modules/plasma.nix @@ -0,0 +1,52 @@ +{ pkgs, ... }: +{ + imports = [ + ./desktop-software.nix + ./fonts.nix + ]; + + environment.systemPackages = with pkgs; [ + kaidan + kdePackages.filelight + kdePackages.okular + vlc + ]; + + programs.kde-pim = { + enable = true; + kmail = true; + kontact = true; + merkuro = true; + }; + + # Enable sound. + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + pulse.enable = true; + }; + + programs.zsh.vteIntegration = true; + programs.bash.vteIntegration = true; + + hardware.bluetooth.enable = true; + + services.displayManager.sddm = { + enable = true; + wayland.enable = true; + }; + + services.desktopManager.plasma6.enable = true; + + programs.ssh = { + startAgent = true; + enableAskPassword = false; + extraConfig = '' + AddKeysToAgent yes + ''; + }; + programs.firefox.nativeMessagingHosts.packages = with pkgs.kdePackages; [ + plasma-browser-integration + ]; +} diff --git a/modules/radio.nix b/modules/radio.nix new file mode 100644 index 0000000..391e98b --- /dev/null +++ b/modules/radio.nix @@ -0,0 +1,39 @@ +{ pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + gnuradio + gqrx + cubicsdr + sdrangel + multimon-ng + sox + + libusb1 + rtl-sdr + hackrf + soapyhackrf + + sigdigger + suscan + sigutils + ]; + + hardware = { + rtl-sdr.enable = true; + hackrf.enable = true; + }; + + services.udev.extraRules = '' + # MCH2022 Badge + SUBSYSTEM=="usb", ATTR{idVendor}=="16d0", ATTR{idProduct}=="0f9a", MODE="0666" + + #Flipper Zero serial port + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="5740", ATTRS{manufacturer}=="Flipper Devices Inc.", TAG+="uaccess" + #Flipper Zero DFU + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", ATTRS{manufacturer}=="STMicroelectronics", TAG+="uaccess" + #Flipper ESP32s2 BlackMagic + SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="40??", ATTRS{manufacturer}=="Flipper Devices Inc.", TAG+="uaccess" + ''; + +} diff --git a/modules/science.nix b/modules/science.nix new file mode 100644 index 0000000..ff7eaa3 --- /dev/null +++ b/modules/science.nix @@ -0,0 +1,8 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + gnuplot + zotero + numbat + ]; +} diff --git a/modules/tlp.nix b/modules/tlp.nix new file mode 100644 index 0000000..5606ab2 --- /dev/null +++ b/modules/tlp.nix @@ -0,0 +1,14 @@ +{ ... }: + +{ + powerManagement.cpuFreqGovernor = null; + services.power-profiles-daemon.enable = false; + services.tlp = { + enable = true; + settings = { + USB_BLACKLIST = "1d50:604b 1d50:6089 1d50:cc15 1fc9:000c"; + CPU_SCALING_GOVERNOR_ON_AC = "performance"; + CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; + }; + }; +} diff --git a/modules/wg/mgmt.nix b/modules/wg/mgmt.nix index cfec996..64a55fd 100644 --- a/modules/wg/mgmt.nix +++ b/modules/wg/mgmt.nix @@ -26,7 +26,6 @@ }; "toaster" = { - # for now it's a non-nixos system address = [ "10.89.87.100/24" "fd31:185d:722e::100/48" -- cgit v1.3.1