nixos-config/hosts/ytnix/default.nix

303 lines
6.7 KiB
Nix
Raw Normal View History

2024-11-22 00:58:04 -05:00
{
2024-12-12 23:35:10 -05:00
inputs,
outputs,
lib,
config,
pkgs,
...
}: {
imports = [
./hardware-configuration.nix
2024-12-13 22:26:27 -05:00
../common.nix
2024-12-12 23:35:10 -05:00
];
sops.secrets = {
"services/borg/yt" = {
sopsFile = ../../secrets/services/borg/yt.yaml;
};
"services/ntfy" = {
sopsFile = ../../secrets/services/ntfy.yaml;
};
"wireguard/yt/private" = {
sopsFile = ../../secrets/wireguard/yt.yaml;
};
"wireguard/yt/psk" = {
sopsFile = ../../secrets/wireguard/yt.yaml;
};
};
2024-11-23 21:41:28 -05:00
2024-11-26 01:09:13 -05:00
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
2024-11-29 20:12:35 -05:00
tmp.cleanOnBoot = true;
2024-11-26 01:09:13 -05:00
kernelPackages = pkgs.linuxPackages_latest;
2024-11-28 01:49:43 -05:00
extraModulePackages = with config.boot.kernelPackages; [
rtl8821ce
];
2024-11-26 01:09:13 -05:00
};
2024-11-22 00:58:04 -05:00
2024-11-25 20:10:53 -05:00
networking = {
hostName = "ytnix";
wireless.iwd = {
enable = true;
settings = {
Rank = {
# disable 2.4 GHz cause i have a shitty wireless card
# that interferes with bluetooth otherwise
BandModifier2_4GHz = 0.0;
};
2024-11-22 00:58:04 -05:00
};
};
2024-11-25 20:10:53 -05:00
networkmanager = {
enable = true;
dns = "none";
wifi.backend = "iwd";
};
nameservers = ["31.59.129.225" "2a0f:85c1:840:2bfb::1"];
2024-11-25 20:10:53 -05:00
resolvconf.enable = true;
firewall = {
allowedUDPPorts = [51820]; # for wireguard
2024-12-15 01:59:29 -05:00
trustedInterfaces = ["wg0"];
2024-11-25 20:10:53 -05:00
};
2024-11-22 00:58:04 -05:00
};
2024-11-25 20:10:53 -05:00
programs.nm-applet.enable = true;
2024-11-22 00:58:04 -05:00
security.rtkit.enable = true;
2024-11-22 00:58:04 -05:00
services.pipewire = {
enable = true;
pulse.enable = true;
alsa.enable = true;
alsa.support32Bit = true;
2024-11-25 20:10:53 -05:00
wireplumber.extraConfig.bluetoothEnhancements = {
"wireplumber.settings" = {
"bluetooth.autoswitch-to-headset-profile" = false;
};
"monitor.bluez.properties" = {
"bluez5.enable-sbc-xq" = true;
"bluez5.enable-msbc" = true;
"bluez5.enable-hw-volume" = true;
2024-12-13 11:28:27 -05:00
"bluez5.roles" = ["a2dp_sink" "a2dp_source"];
2024-11-25 20:10:53 -05:00
};
};
2024-12-15 21:14:57 -05:00
# https://wiki.archlinux.org/title/Bluetooth_headset#Connecting_works,_sound_plays_fine_until_headphones_become_idle,_then_stutters
wireplumber.extraConfig.disableSuspend = {
"monitor.bluez.rules" = {
matches = [
{
"node.name" = "bluez_output.*";
}
];
2024-12-16 11:40:19 -05:00
};
actions = {
2024-12-15 21:14:57 -05:00
update-props = {
"session.suspend-timeout-seconds" = 0;
};
2024-12-16 11:40:19 -05:00
};
2024-12-15 21:14:57 -05:00
};
2024-11-22 00:58:04 -05:00
};
services.libinput.enable = true;
users.users.yt = {
isNormalUser = true;
2024-12-13 11:28:27 -05:00
extraGroups = ["wheel" "libvirtd" "docker"];
2024-11-22 00:58:04 -05:00
shell = pkgs.zsh;
};
2024-12-13 23:31:56 -05:00
programs.zsh.enable = true;
2024-11-22 00:58:04 -05:00
environment.systemPackages = with pkgs; [
tmux
vim
wget
neovim
2024-12-09 02:14:11 -05:00
git
python3
wl-clipboard
mako
2024-11-22 00:58:04 -05:00
tree
kitty
borgbackup
brightnessctl
alsa-utils
nixd
veracrypt
bluetuith
libimobiledevice
2024-11-22 01:39:38 -05:00
pass-wayland
2024-11-22 19:18:02 -05:00
htop
file
2024-11-23 14:40:08 -05:00
dnsutils
age
compsize
wireguard-tools
2024-11-23 20:47:43 -05:00
traceroute
2024-11-23 21:41:28 -05:00
sops
restic
2024-12-16 02:07:54 -05:00
haskell-language-server
ghc
2024-11-22 00:58:04 -05:00
];
2024-12-08 14:19:35 -05:00
environment.sessionVariables = {
NIXOS_OZONE_WL = "1";
ANKI_WAYLAND = "1";
};
2024-11-25 20:10:53 -05:00
2024-11-22 00:58:04 -05:00
system.stateVersion = "24.05";
services.gnome.gnome-keyring.enable = true;
programs.gnupg.agent.enable = true;
2024-12-04 22:53:37 -05:00
services.displayManager.defaultSession = "sway";
2024-11-22 00:58:04 -05:00
services.displayManager.sddm = {
enable = true;
wayland.enable = true;
};
2024-11-22 19:18:02 -05:00
# security.sudo.wheelNeedsPassword = false;
2024-11-22 00:58:04 -05:00
fonts.packages = with pkgs; [
nerd-fonts.roboto-mono
2024-11-22 00:58:04 -05:00
];
2024-11-28 01:49:43 -05:00
hardware.enableAllFirmware = true;
2024-11-22 00:58:04 -05:00
hardware.bluetooth = {
enable = true;
powerOnBoot = true;
};
services.blueman.enable = true;
2024-12-04 22:53:37 -05:00
programs.sway.enable = true;
2024-11-22 00:58:04 -05:00
services.borgbackup.jobs.ytnixRsync = {
2024-12-13 11:28:27 -05:00
paths = ["/root" "/home" "/var/lib" "/var/log" "/opt" "/etc"];
exclude = [
"**/.cache"
"**/node_modules"
"**/cache"
"**/Cache"
"/var/lib/docker"
2024-12-12 15:53:17 -05:00
"/var/lib/private/ollama"
"/home/**/Downloads"
"**/.steam"
"**/.rustup"
"**/.docker"
"**/borg"
];
repo = "de3911@de3911.rsync.net:borg/yt";
encryption = {
mode = "repokey-blake2";
passCommand = ''cat ${config.sops.secrets."borg/yt/rsyncnet".path}"'';
};
environment = {
BORG_RSH = "ssh -i /home/yt/.ssh/id_ed25519";
BORG_REMOTE_PATH = "borg1";
};
compression = "auto,zstd";
startAt = "daily";
2024-12-13 11:28:27 -05:00
extraCreateArgs = ["--stats"];
# warnings are often not that serious
failOnWarnings = false;
postHook = ''
${pkgs.curl}/bin/curl -u $(cat ${config.sops.secrets."services/ntfy/ntfy".path}) -d "ytnixRsync: backup completed with exit code: $exitStatus
2024-12-09 02:14:11 -05:00
$(journalctl -u borgbackup-job-ytnixRsync.service|tail -n 5)" \
https://ntfy.cything.io/chunk
'';
};
2024-12-09 02:14:11 -05:00
2024-11-25 20:10:53 -05:00
services.btrbk.instances.local = {
onCalendar = "hourly";
settings = {
snapshot_preserve = "2w";
2024-11-25 20:10:53 -05:00
snapshot_preserve_min = "2d";
snapshot_dir = "/snapshots";
2024-11-22 19:18:02 -05:00
subvolume = {
2024-12-13 11:28:27 -05:00
"/home" = {};
"/" = {};
2024-11-22 19:18:02 -05:00
};
};
};
2024-11-22 02:09:31 -05:00
programs.steam.enable = true;
2024-11-22 19:18:02 -05:00
services.logind = {
lidSwitch = "hibernate";
2024-11-23 20:47:43 -05:00
powerKey = "hibernate";
2024-11-22 02:09:31 -05:00
};
2024-11-22 20:46:58 -05:00
xdg.mime.defaultApplications = {
"application/pdf" = "okular.desktop";
"image/*" = "gwenview.desktop";
2024-12-08 14:19:35 -05:00
"*/html" = "chromium-browser.desktop";
2024-11-22 20:46:58 -05:00
};
programs.thunar = {
enable = true;
plugins = with pkgs.xfce; [
thunar-archive-plugin
thunar-volman
];
};
# preference changes don't work in thunar without this
programs.xfconf.enable = true;
# mount, trash and stuff in thunar
services.gvfs.enable = true;
# thumbnails in thunar
2024-12-09 02:14:11 -05:00
services.tumbler.enable = true;
2024-11-23 14:40:08 -05:00
2024-11-26 01:53:01 -05:00
virtualisation = {
libvirtd.enable = true;
docker.enable = true;
};
2024-11-23 14:40:08 -05:00
programs.virt-manager.enable = true;
2024-11-26 13:31:57 -05:00
services.usbmuxd.enable = true;
2024-11-26 17:27:35 -05:00
programs.nix-ld.enable = true;
programs.evolution.enable = true;
# this is true by default and mutually exclusive with
# programs.nix-index
programs.command-not-found.enable = false;
programs.nix-index = {
enable = true;
enableZshIntegration = true;
};
xdg.portal = {
enable = true;
wlr.enable = true;
};
2024-12-07 03:29:15 -05:00
programs.obs-studio = {
enable = true;
plugins = with pkgs.obs-studio-plugins; [
wlrobs
];
};
hardware.graphics = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver
intel-media-sdk
];
};
2024-12-12 15:53:17 -05:00
services.ollama.enable = true;
2024-12-14 18:22:05 -05:00
# wireguard setup
networking.wg-quick.interfaces.wg0 = {
address = ["10.0.0.2/24" "fdc9:281f:04d7:9ee9::2/64"];
privateKeyFile = config.sops.secrets."wireguard/yt/private".path;
peers = [
{
publicKey = "a16/F/wP7HQIUtFywebqPSXQAktPsLgsMLH9ZfevMy0=";
allowedIPs = ["0.0.0.0/0" "::/0"];
endpoint = "31.59.129.225:51820";
persistentKeepalive = 25;
presharedKeyFile = config.sops.secrets."wireguard/yt/psk".path;
}
];
2024-12-14 18:22:05 -05:00
};
2024-11-22 01:39:38 -05:00
}