modularize more

4 files changed, 358 insertions, 321 deletions

diff --git a/flake.lock b/flake.lock
index 91080d6..ff49e7e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -163,11 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759043321,
-        "narHash": "sha256-Efi3THvsIS6Qd97s52/PSSHWybDlSbtUZXP8l3AR9Ps=",
+        "lastModified": 1759536080,
+        "narHash": "sha256-0aXlKPxm2M+F5oywX2TTbY0e6h+tQ+6OYyx7UZn3A4A=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c75fd8e300b79502b8eecdacd8a426b12fadb460",
+        "rev": "edafd6da1936426708f1be0b1a4288007f16639a",
         "type": "github"
       },
       "original": {
@@ -184,8 +184,8 @@
         ]
       },
       "locked": {
-        "lastModified": 1759087372,
-        "narHash": "sha256-AKIAHHbLn4Jrz0qeeKtO1cP/+e31Uok1NBPQMgh4lU0=",
+        "lastModified": 1759197167,
+        "narHash": "sha256-AwyoFll5dXyxLtipAdfthKSPKaL0nifDEhAKQ8baV1c=",
         "path": "/data/src/clones/llm/llama.cpp",
         "type": "path"
       },
@@ -211,11 +211,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1758690382,
-        "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+        "lastModified": 1759381078,
+        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
         "type": "github"
       },
       "original": {
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 749191a..75885e3 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -11,6 +11,8 @@
 {
   imports = [
     ./hardware.nix
+    ../../modules/common.nix
+    ../../modules/desktop.nix
     home-manager.nixosModules.default
   ];
 
@@ -63,39 +65,16 @@
   };
 
   # boot options
-  boot = {
-    kernel.sysctl = {
-      "net.ipv4.ip_forward" = true;
-      "net.ipv6.conf.all.forwarding" = true;
-    };
-
-    kernelPackages = pkgs.linuxPackages_6_12;
-
-    loader = {
-      systemd-boot.enable = true;
-      efi.canTouchEfiVariables = true;
-    };
-
-    supportedFilesystems = [ "zfs" ];
-
-    zfs = {
-      devNodes = "/dev/disk/by-partuuid";
-      extraPools = [
-        "data_nvme"
-        "data_wd"
-      ];
-      forceImportRoot = false;
-    };
-  };
+  boot.zfs.extraPools = [
+    "data_nvme"
+    "data_wd"
+  ];
 
   # disable wifi and open some ports
   networking = {
     hostName = "demiurge";
     hostId = "cafebabe";
 
-    # I like my ethX/wlanX names
-    usePredictableInterfaceNames = false;
-
     wireless.enable = false;
 
     firewall = {
@@ -151,216 +130,29 @@
     };
   };
 
-  # Set your time zone.
-  time.timeZone = "America/Toronto";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-  console = {
-    font = "Lat2-Terminus16";
-  };
-
-  # enable flakes and nix cli
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  # Define a user account.
   users.users = {
-    vin = {
-      isNormalUser = true;
-
-      extraGroups = [
-        "transmission"
-        "wheel"
-      ];
-
-      shell = pkgs.zsh;
-
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
-      ];
-
-      packages = with pkgs; [
-        alvr
-        bs-manager
-        (llama-cpp.packages.x86_64-linux.rocm.override {
-          useMetalKit = false;
-          useVulkan = true;
-        })
-        #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
-      ];
-    };
+    vin.packages = with pkgs; [
+      alvr
+      bs-manager
+      (llama-cpp.packages.x86_64-linux.rocm.override {
+        useMetalKit = false;
+        useVulkan = true;
+      })
+      #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
+    ];
 
     radarr.extraGroups = [ "transmission" ];
     sonarr.extraGroups = [ "transmission" ];
   };
 
-  # default packages for both me and root
-  environment = {
-    systemPackages = with pkgs; [
-      doas-sudo-shim
-      git
-      wget
-    ];
-
-    pathsToLink = [ "/share/zsh" ];
-  };
-
-  # enable bluetooth and add some udev rules
-  hardware = {
-    bluetooth.enable = true;
-    flipperzero.enable = true;
-    keyboard.qmk.enable = true;
-  };
-
-  programs = {
-    # for gtk in home-manager
-    dconf.enable = true;
-
-    # gpg
-    gnupg.agent = {
-      enable = true;
-      enableSSHSupport = false;
-      pinentryPackage = pkgs.pinentry-rofi;
-      settings.default-cache-ttl = 600;
-    };
-
-    # disable nano. I don't like nano.
-    nano.enable = false;
-
-    # steam, proprietary. I sometimes like playing nonfree games too.
-    steam.enable = true;
-
-    # configuration in home-manager
-    zsh.enable = true;
-    zsh.promptInit = "PS1='$ '";
-  };
-
-  security = {
-    # I prefer doas over sudo for simplicity
-    doas = {
-      enable = true;
-      extraRules = [
-        {
-          users = [ "vin" ];
-          keepEnv = true;
-          persist = true;
-        }
-      ];
-    };
-    sudo.enable = false;
-
-    # needed to give realtime privileges to pipewire
-    rtkit.enable = true;
-
-    # trust certificate for *.demiurge.epistemia
-    pki.certificates = [
-      ''
-        -----BEGIN CERTIFICATE-----
-        MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
-        ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
-        ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
-        QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
-        NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
-        aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
-        AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
-        yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
-        al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
-        GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
-        u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
-        X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
-        Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
-        idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
-        DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
-        /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
-        jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
-        1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
-        ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
-        2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
-        i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
-        vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
-        SivxomFBHWe4CLwWy/mDaC18/g==
-        -----END CERTIFICATE-----
-      ''
-    ];
-  };
-
   services = {
-    # dns
-    unbound = {
-      enable = true;
-      settings = {
-        server = {
-          interface = [
-            "127.0.0.1"
-            "100.64.0.2"
-            #"fd00:b0ba:cafe:babe::2"
-            "::1"
-          ];
-          access-control = [
-            "0.0.0.0/0 allow"
-            "::0/0 allow"
-          ];
-
-          hide-identity = true;
-          hide-version = true;
-
-          # Synthesize NXDOMAINs from DNSSEC NSEC chains.
-          # https://tools.ietf.org/html/rfc8198
-          aggressive-nsec = false;
-
-          module-config = "\"respip validator iterator\"";
-
-          local-data = [
-            "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
-            "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
-            "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
-            "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
-            "\"lab.epistemia. 86400 IN A 100.64.0.5\""
-          ];
-
-          local-zone = [
-            "\"saklas.epistemia.\" redirect"
-            "\"demiurge.epistemia.\" redirect"
-            "\"hastur.epistemia.\" redirect"
-            "\"iphonebob.epistemia.\" redirect"
-            "\"lab.epistemia.\" redirect"
-          ];
-        };
-
-        # hagezi for dns-based adblocking (in addition to others)
-        rpz = {
-          name = "hagezi.ultimate";
-          zonefile = "hagezi.ultimate";
-          url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
-        };
-
-        # go through mullvad for regular dns queries
-        forward-zone = {
-          name = ".";
-          forward-addr = [ "194.242.2.2" ];
-        };
-      };
-    };
-
     # vpn
+    # TODO replace with wireguard again
     tailscale = {
-      enable = true;
       authKeyFile = config.age.secrets.tailscale_demiurge.path;
-      disableTaildrop = true;
-      disableUpstreamLogging = true;
       extraSetFlags = [ "--advertise-exit-node" ];
-      #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
-      extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
-      openFirewall = true;
-      useRoutingFeatures = "both";
     };
 
-    # automatically scrub zfs pools (every week by default)
-    zfs.autoScrub.enable = true;
-
     # media server
     jellyfin = {
       enable = true;
@@ -402,19 +194,6 @@
       };
     };
 
-    # graphical input
-    libinput = {
-      enable = true;
-
-      mouse.accelProfile = "flat";
-
-      touchpad = {
-        accelProfile = "flat";
-        tapping = true;
-        tappingButtonMap = "lrm";
-      };
-    };
-
     # music streaming to phone
     navidrome = {
       enable = true;
@@ -484,22 +263,11 @@
     };
 
     # ssh
-    openssh = {
-      enable = true;
-
-      listenAddresses = [
-        { addr = "127.0.0.1"; port = 22; }
-        { addr = "192.168.1.2"; port = 22; }
-        { addr = "100.64.0.2"; port = 22; }
-      ];
-
-      settings = {
-        KbdInteractiveAuthentication = false;
-        PasswordAuthentication = true;
-        PermitRootLogin = "no";
-        X11Forwarding = true;
-      };
-    };
+    openssh.listenAddresses = [
+      { addr = "127.0.0.1"; port = 22; }
+      { addr = "192.168.1.2"; port = 22; }
+      { addr = "100.64.0.2"; port = 22; }
+    ];
 
     # llm
     open-webui = {
@@ -511,44 +279,6 @@
       port = 8083;
     };
 
-    # for yubikey
-    pcscd.enable = true;
-
-    # sound. for some reason, pipewire enabled itself when I tried
-    # using pulseaudio and home-manager, so had to disable pulseaudio.
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      audio.enable = true;
-      pulse.enable = true;
-      wireplumber = {
-        enable = true;
-        extraConfig = {
-          "51-set-default-eq.conf" = {
-            text = ''
-              monitor.rules = [
-                {
-                  matches = [
-                    {
-                      # This rule matches the node with the name of your sink (node 35)
-                      "node.name" = "effect_input.eq6"
-                    }
-                  ]
-                  actions = {
-                    update-props = {
-                      # This sets a very high priority, making it the default.
-                      # Standard hardware is usually around 1000.
-                      "priority.session" = 2001
-                    }
-                  }
-                }
-              ]
-            '';
-          };
-        };
-      };
-    };
-
     # reddit
     redlib = {
       enable = true;
@@ -1023,31 +753,10 @@
         GROUP="input", SYMLINK+="ocuquest%n"
       '';
     };
-
-    # to get startx and use amdgpu driver
-    # WM in home-manager
-    xserver = {
-      enable = true;
-      autorun = false;
-      displayManager.startx.enable = true;
-      modules = [ pkgs.xf86_input_wacom ];
-      videoDrivers = [ "amdgpu" ];
-      wacom.enable = true;
-    };
   };
 
   # extra systemd stuff
-  systemd.services = {
-    nginx.after = [ "tailscaled-autoconnect.service" ];
-  };
-
-  # create caches and use mandoc
-  documentation.man = {
-    enable = true;
-    generateCaches = true;
-    man-db.enable = false;
-    mandoc.enable = true;
-  };
+  systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ];
 
   system.stateVersion = "24.05";
 }
diff --git a/modules/common.nix b/modules/common.nix
new file mode 100644
index 0000000..d613bf8
--- /dev/null
+++ b/modules/common.nix
@@ -0,0 +1,199 @@
+{ pkgs, ... }: {
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+  };
+
+  # enable flakes and nix cli
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  # I like my ethX/wlanX names
+  networking.usePredictableInterfaceNames = false;
+
+
+  # use local dns on each host
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        interface = [
+          "127.0.0.1"
+          "100.64.0.2"
+          #"fd00:b0ba:cafe:babe::2"
+          "::1"
+        ];
+        access-control = [
+          "0.0.0.0/0 allow"
+          "::0/0 allow"
+        ];
+
+        hide-identity = true;
+        hide-version = true;
+
+        # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+        # https://tools.ietf.org/html/rfc8198
+        aggressive-nsec = false;
+
+        module-config = "\"respip validator iterator\"";
+
+        local-data = [
+          "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
+          "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
+          "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
+          "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
+          "\"lab.epistemia. 86400 IN A 100.64.0.5\""
+        ];
+
+        local-zone = [
+          "\"saklas.epistemia.\" redirect"
+          "\"demiurge.epistemia.\" redirect"
+          "\"hastur.epistemia.\" redirect"
+          "\"iphonebob.epistemia.\" redirect"
+          "\"lab.epistemia.\" redirect"
+        ];
+      };
+
+      # hagezi for dns-based adblocking (in addition to others)
+      rpz = {
+        name = "hagezi.ultimate";
+        zonefile = "hagezi.ultimate";
+        url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+      };
+
+      # go through mullvad for regular dns queries
+      forward-zone = {
+        name = ".";
+        forward-addr = [ "194.242.2.2" ];
+      };
+    };
+  };
+  environment.etc."resolv.conf".text = ''
+    nameserver 127.0.0.1
+    search epistemia
+  '';
+
+  # Define a user account.
+  users = {
+    groups.vin = {};
+    users.vin = {
+      isNormalUser = true;
+
+      group = "vin";
+      extraGroups = [
+        "transmission"
+        "wheel"
+      ];
+
+      shell = pkgs.zsh;
+
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
+      ];
+    };
+  };
+
+  # default packages for both me and root
+  environment = {
+    systemPackages = with pkgs; [
+      doas-sudo-shim
+      git
+      wget
+    ];
+
+    pathsToLink = [ "/share/zsh" ];
+  };
+
+  # enable bluetooth and add some udev rules
+  hardware = {
+    bluetooth.enable = true;
+    flipperzero.enable = true;
+    keyboard.qmk.enable = true;
+  };
+
+  programs = {
+    # for gtk in home-manager
+    dconf.enable = true;
+
+    # gpg
+    gnupg.agent = {
+      enable = true;
+      enableSSHSupport = false;
+      pinentryPackage = pkgs.pinentry-rofi;
+      settings.default-cache-ttl = 600;
+    };
+
+    # disable nano. I don't like nano.
+    nano.enable = false;
+
+    # steam, proprietary. I sometimes like playing nonfree games too.
+    steam.enable = true;
+
+    # configuration in home-manager
+    zsh.enable = true;
+    zsh.promptInit = "PS1='$ '";
+  };
+
+  security = {
+    # I prefer doas over sudo for simplicity
+    doas = {
+      enable = true;
+      extraRules = [
+        {
+          users = [ "vin" ];
+          keepEnv = true;
+          persist = true;
+        }
+      ];
+    };
+    sudo.enable = false;
+
+    # needed to give realtime privileges to pipewire
+    rtkit.enable = true;
+
+    # trust certificate for *.demiurge.epistemia
+    pki.certificates = [
+      ''
+        -----BEGIN CERTIFICATE-----
+        MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
+        ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
+        ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
+        QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
+        NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
+        aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
+        AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
+        yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
+        al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
+        GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
+        u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
+        X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
+        Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
+        idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
+        DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
+        /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
+        jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
+        1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
+        ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
+        2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
+        i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
+        vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
+        SivxomFBHWe4CLwWy/mDaC18/g==
+        -----END CERTIFICATE-----
+      ''
+    ];
+  };
+
+  # create caches and use mandoc
+  documentation.man = {
+    enable = true;
+    generateCaches = true;
+    man-db.enable = false;
+    mandoc.enable = true;
+  };
+}
diff --git a/modules/desktop.nix b/modules/desktop.nix
new file mode 100644
index 0000000..fb153e7
--- /dev/null
+++ b/modules/desktop.nix
@@ -0,0 +1,129 @@
+{
+  config,
+  home-manager,
+  lib,
+  pkgs,
+  inputs,
+  llama-cpp,
+  ...
+}:
+
+{
+  imports = [
+    home-manager.nixosModules.default
+  ];
+
+  # boot options
+  boot = {
+    kernel.sysctl = {
+      "net.ipv4.ip_forward" = true;
+      "net.ipv6.conf.all.forwarding" = true;
+    };
+
+    kernelPackages = pkgs.linuxPackages_6_16;
+
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+
+    supportedFilesystems = [ "zfs" ];
+
+    zfs = {
+      devNodes = "/dev/disk/by-partuuid";
+      forceImportRoot = false;
+    };
+  };
+
+  services = {
+    # vpn
+    # TODO replace with wireguard again
+    tailscale = {
+      enable = true;
+      disableTaildrop = true;
+      disableUpstreamLogging = true;
+      extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
+      openFirewall = true;
+      useRoutingFeatures = "both";
+    };
+
+    # automatically scrub zfs pools (every week by default)
+    zfs.autoScrub.enable = true;
+
+    # graphical input
+    libinput = {
+      enable = true;
+
+      mouse.accelProfile = "flat";
+
+      touchpad = {
+        accelProfile = "flat";
+        tapping = true;
+        tappingButtonMap = "lrm";
+      };
+    };
+
+    # ssh
+    openssh = {
+      enable = true;
+
+      settings = {
+        KbdInteractiveAuthentication = false;
+        PasswordAuthentication = true;
+        PermitRootLogin = "no";
+        X11Forwarding = true;
+      };
+    };
+
+    # for yubikey
+    pcscd.enable = true;
+
+    # sound. for some reason, pipewire enabled itself when I tried
+    # using pulseaudio and home-manager, so had to disable pulseaudio.
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      audio.enable = true;
+      pulse.enable = true;
+      wireplumber = {
+        enable = true;
+        extraConfig = {
+          "51-set-default-eq.conf" = {
+            text = ''
+              monitor.rules = [
+                {
+                  matches = [
+                    {
+                      # This rule matches the node with the name of your sink (node 35)
+                      "node.name" = "effect_input.eq6"
+                    }
+                  ]
+                  actions = {
+                    update-props = {
+                      # This sets a very high priority, making it the default.
+                      # Standard hardware is usually around 1000.
+                      "priority.session" = 2001
+                    }
+                  }
+                }
+              ]
+            '';
+          };
+        };
+      };
+    };
+
+    # to get startx and use amdgpu driver
+    # WM in home-manager
+    xserver = {
+      enable = true;
+      autorun = false;
+      displayManager.startx.enable = true;
+      modules = [ pkgs.xf86_input_wacom ];
+      wacom.enable = true;
+    };
+  };
+
+  # extra systemd stuff
+  systemd.services.sshd.after = [ "tailscaled-autoconnect.service" ];
+}