commit b978d3406df70995fbbbedad5101450f5a5c4fdb
parent d52dba106ba98dc9bd8e04d289050122e3e3b690
Author: vin <vin@vineetk.net>
Date: Fri, 3 Oct 2025 21:55:19 -0400
modularize more
Diffstat:
4 files changed, 358 insertions(+), 321 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -163,11 +163,11 @@
]
},
"locked": {
- "lastModified": 1759043321,
- "narHash": "sha256-Efi3THvsIS6Qd97s52/PSSHWybDlSbtUZXP8l3AR9Ps=",
+ "lastModified": 1759536080,
+ "narHash": "sha256-0aXlKPxm2M+F5oywX2TTbY0e6h+tQ+6OYyx7UZn3A4A=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "c75fd8e300b79502b8eecdacd8a426b12fadb460",
+ "rev": "edafd6da1936426708f1be0b1a4288007f16639a",
"type": "github"
},
"original": {
@@ -184,8 +184,8 @@
]
},
"locked": {
- "lastModified": 1759087372,
- "narHash": "sha256-AKIAHHbLn4Jrz0qeeKtO1cP/+e31Uok1NBPQMgh4lU0=",
+ "lastModified": 1759197167,
+ "narHash": "sha256-AwyoFll5dXyxLtipAdfthKSPKaL0nifDEhAKQ8baV1c=",
"path": "/data/src/clones/llm/llama.cpp",
"type": "path"
},
@@ -211,11 +211,11 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1758690382,
- "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
+ "lastModified": 1759381078,
+ "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "e643668fd71b949c53f8626614b21ff71a07379d",
+ "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
"type": "github"
},
"original": {
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -11,6 +11,8 @@
{
imports = [
./hardware.nix
+ ../../modules/common.nix
+ ../../modules/desktop.nix
home-manager.nixosModules.default
];
@@ -63,39 +65,16 @@
};
# boot options
- boot = {
- kernel.sysctl = {
- "net.ipv4.ip_forward" = true;
- "net.ipv6.conf.all.forwarding" = true;
- };
-
- kernelPackages = pkgs.linuxPackages_6_12;
-
- loader = {
- systemd-boot.enable = true;
- efi.canTouchEfiVariables = true;
- };
-
- supportedFilesystems = [ "zfs" ];
-
- zfs = {
- devNodes = "/dev/disk/by-partuuid";
- extraPools = [
- "data_nvme"
- "data_wd"
- ];
- forceImportRoot = false;
- };
- };
+ boot.zfs.extraPools = [
+ "data_nvme"
+ "data_wd"
+ ];
# disable wifi and open some ports
networking = {
hostName = "demiurge";
hostId = "cafebabe";
- # I like my ethX/wlanX names
- usePredictableInterfaceNames = false;
-
wireless.enable = false;
firewall = {
@@ -151,216 +130,29 @@
};
};
- # Set your time zone.
- time.timeZone = "America/Toronto";
-
- # Select internationalisation properties.
- i18n.defaultLocale = "en_US.UTF-8";
- console = {
- font = "Lat2-Terminus16";
- };
-
- # enable flakes and nix cli
- nix.settings.experimental-features = [
- "nix-command"
- "flakes"
- ];
-
- # Define a user account.
users.users = {
- vin = {
- isNormalUser = true;
-
- extraGroups = [
- "transmission"
- "wheel"
- ];
-
- shell = pkgs.zsh;
-
- openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
- ];
-
- packages = with pkgs; [
- alvr
- bs-manager
- (llama-cpp.packages.x86_64-linux.rocm.override {
- useMetalKit = false;
- useVulkan = true;
- })
- #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
- ];
- };
+ vin.packages = with pkgs; [
+ alvr
+ bs-manager
+ (llama-cpp.packages.x86_64-linux.rocm.override {
+ useMetalKit = false;
+ useVulkan = true;
+ })
+ #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
+ ];
radarr.extraGroups = [ "transmission" ];
sonarr.extraGroups = [ "transmission" ];
};
- # default packages for both me and root
- environment = {
- systemPackages = with pkgs; [
- doas-sudo-shim
- git
- wget
- ];
-
- pathsToLink = [ "/share/zsh" ];
- };
-
- # enable bluetooth and add some udev rules
- hardware = {
- bluetooth.enable = true;
- flipperzero.enable = true;
- keyboard.qmk.enable = true;
- };
-
- programs = {
- # for gtk in home-manager
- dconf.enable = true;
-
- # gpg
- gnupg.agent = {
- enable = true;
- enableSSHSupport = false;
- pinentryPackage = pkgs.pinentry-rofi;
- settings.default-cache-ttl = 600;
- };
-
- # disable nano. I don't like nano.
- nano.enable = false;
-
- # steam, proprietary. I sometimes like playing nonfree games too.
- steam.enable = true;
-
- # configuration in home-manager
- zsh.enable = true;
- zsh.promptInit = "PS1='$ '";
- };
-
- security = {
- # I prefer doas over sudo for simplicity
- doas = {
- enable = true;
- extraRules = [
- {
- users = [ "vin" ];
- keepEnv = true;
- persist = true;
- }
- ];
- };
- sudo.enable = false;
-
- # needed to give realtime privileges to pipewire
- rtkit.enable = true;
-
- # trust certificate for *.demiurge.epistemia
- pki.certificates = [
- ''
- -----BEGIN CERTIFICATE-----
- MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
- ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
- ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
- QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
- NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
- aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
- AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
- yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
- al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
- GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
- u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
- X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
- Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
- idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
- DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
- /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
- jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
- 1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
- ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
- 2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
- i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
- vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
- SivxomFBHWe4CLwWy/mDaC18/g==
- -----END CERTIFICATE-----
- ''
- ];
- };
-
services = {
- # dns
- unbound = {
- enable = true;
- settings = {
- server = {
- interface = [
- "127.0.0.1"
- "100.64.0.2"
- #"fd00:b0ba:cafe:babe::2"
- "::1"
- ];
- access-control = [
- "0.0.0.0/0 allow"
- "::0/0 allow"
- ];
-
- hide-identity = true;
- hide-version = true;
-
- # Synthesize NXDOMAINs from DNSSEC NSEC chains.
- # https://tools.ietf.org/html/rfc8198
- aggressive-nsec = false;
-
- module-config = "\"respip validator iterator\"";
-
- local-data = [
- "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
- "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
- "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
- "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
- "\"lab.epistemia. 86400 IN A 100.64.0.5\""
- ];
-
- local-zone = [
- "\"saklas.epistemia.\" redirect"
- "\"demiurge.epistemia.\" redirect"
- "\"hastur.epistemia.\" redirect"
- "\"iphonebob.epistemia.\" redirect"
- "\"lab.epistemia.\" redirect"
- ];
- };
-
- # hagezi for dns-based adblocking (in addition to others)
- rpz = {
- name = "hagezi.ultimate";
- zonefile = "hagezi.ultimate";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
- };
-
- # go through mullvad for regular dns queries
- forward-zone = {
- name = ".";
- forward-addr = [ "194.242.2.2" ];
- };
- };
- };
-
# vpn
+ # TODO replace with wireguard again
tailscale = {
- enable = true;
authKeyFile = config.age.secrets.tailscale_demiurge.path;
- disableTaildrop = true;
- disableUpstreamLogging = true;
extraSetFlags = [ "--advertise-exit-node" ];
- #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
- extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
- openFirewall = true;
- useRoutingFeatures = "both";
};
- # automatically scrub zfs pools (every week by default)
- zfs.autoScrub.enable = true;
-
# media server
jellyfin = {
enable = true;
@@ -402,19 +194,6 @@
};
};
- # graphical input
- libinput = {
- enable = true;
-
- mouse.accelProfile = "flat";
-
- touchpad = {
- accelProfile = "flat";
- tapping = true;
- tappingButtonMap = "lrm";
- };
- };
-
# music streaming to phone
navidrome = {
enable = true;
@@ -484,22 +263,11 @@
};
# ssh
- openssh = {
- enable = true;
-
- listenAddresses = [
- { addr = "127.0.0.1"; port = 22; }
- { addr = "192.168.1.2"; port = 22; }
- { addr = "100.64.0.2"; port = 22; }
- ];
-
- settings = {
- KbdInteractiveAuthentication = false;
- PasswordAuthentication = true;
- PermitRootLogin = "no";
- X11Forwarding = true;
- };
- };
+ openssh.listenAddresses = [
+ { addr = "127.0.0.1"; port = 22; }
+ { addr = "192.168.1.2"; port = 22; }
+ { addr = "100.64.0.2"; port = 22; }
+ ];
# llm
open-webui = {
@@ -511,44 +279,6 @@
port = 8083;
};
- # for yubikey
- pcscd.enable = true;
-
- # sound. for some reason, pipewire enabled itself when I tried
- # using pulseaudio and home-manager, so had to disable pulseaudio.
- pipewire = {
- enable = true;
- alsa.enable = true;
- audio.enable = true;
- pulse.enable = true;
- wireplumber = {
- enable = true;
- extraConfig = {
- "51-set-default-eq.conf" = {
- text = ''
- monitor.rules = [
- {
- matches = [
- {
- # This rule matches the node with the name of your sink (node 35)
- "node.name" = "effect_input.eq6"
- }
- ]
- actions = {
- update-props = {
- # This sets a very high priority, making it the default.
- # Standard hardware is usually around 1000.
- "priority.session" = 2001
- }
- }
- }
- ]
- '';
- };
- };
- };
- };
-
# reddit
redlib = {
enable = true;
@@ -1023,31 +753,10 @@
GROUP="input", SYMLINK+="ocuquest%n"
'';
};
-
- # to get startx and use amdgpu driver
- # WM in home-manager
- xserver = {
- enable = true;
- autorun = false;
- displayManager.startx.enable = true;
- modules = [ pkgs.xf86_input_wacom ];
- videoDrivers = [ "amdgpu" ];
- wacom.enable = true;
- };
};
# extra systemd stuff
- systemd.services = {
- nginx.after = [ "tailscaled-autoconnect.service" ];
- };
-
- # create caches and use mandoc
- documentation.man = {
- enable = true;
- generateCaches = true;
- man-db.enable = false;
- mandoc.enable = true;
- };
+ systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ];
system.stateVersion = "24.05";
}
diff --git a/modules/common.nix b/modules/common.nix
@@ -0,0 +1,199 @@
+{ pkgs, ... }: {
+ # Set your time zone.
+ time.timeZone = "America/Toronto";
+
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+ console = {
+ font = "Lat2-Terminus16";
+ };
+
+ # enable flakes and nix cli
+ nix.settings.experimental-features = [
+ "nix-command"
+ "flakes"
+ ];
+
+ # I like my ethX/wlanX names
+ networking.usePredictableInterfaceNames = false;
+
+
+ # use local dns on each host
+ services.unbound = {
+ enable = true;
+ settings = {
+ server = {
+ interface = [
+ "127.0.0.1"
+ "100.64.0.2"
+ #"fd00:b0ba:cafe:babe::2"
+ "::1"
+ ];
+ access-control = [
+ "0.0.0.0/0 allow"
+ "::0/0 allow"
+ ];
+
+ hide-identity = true;
+ hide-version = true;
+
+ # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+ # https://tools.ietf.org/html/rfc8198
+ aggressive-nsec = false;
+
+ module-config = "\"respip validator iterator\"";
+
+ local-data = [
+ "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
+ "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
+ "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
+ "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
+ "\"lab.epistemia. 86400 IN A 100.64.0.5\""
+ ];
+
+ local-zone = [
+ "\"saklas.epistemia.\" redirect"
+ "\"demiurge.epistemia.\" redirect"
+ "\"hastur.epistemia.\" redirect"
+ "\"iphonebob.epistemia.\" redirect"
+ "\"lab.epistemia.\" redirect"
+ ];
+ };
+
+ # hagezi for dns-based adblocking (in addition to others)
+ rpz = {
+ name = "hagezi.ultimate";
+ zonefile = "hagezi.ultimate";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+ };
+
+ # go through mullvad for regular dns queries
+ forward-zone = {
+ name = ".";
+ forward-addr = [ "194.242.2.2" ];
+ };
+ };
+ };
+ environment.etc."resolv.conf".text = ''
+ nameserver 127.0.0.1
+ search epistemia
+ '';
+
+ # Define a user account.
+ users = {
+ groups.vin = {};
+ users.vin = {
+ isNormalUser = true;
+
+ group = "vin";
+ extraGroups = [
+ "transmission"
+ "wheel"
+ ];
+
+ shell = pkgs.zsh;
+
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
+ ];
+ };
+ };
+
+ # default packages for both me and root
+ environment = {
+ systemPackages = with pkgs; [
+ doas-sudo-shim
+ git
+ wget
+ ];
+
+ pathsToLink = [ "/share/zsh" ];
+ };
+
+ # enable bluetooth and add some udev rules
+ hardware = {
+ bluetooth.enable = true;
+ flipperzero.enable = true;
+ keyboard.qmk.enable = true;
+ };
+
+ programs = {
+ # for gtk in home-manager
+ dconf.enable = true;
+
+ # gpg
+ gnupg.agent = {
+ enable = true;
+ enableSSHSupport = false;
+ pinentryPackage = pkgs.pinentry-rofi;
+ settings.default-cache-ttl = 600;
+ };
+
+ # disable nano. I don't like nano.
+ nano.enable = false;
+
+ # steam, proprietary. I sometimes like playing nonfree games too.
+ steam.enable = true;
+
+ # configuration in home-manager
+ zsh.enable = true;
+ zsh.promptInit = "PS1='$ '";
+ };
+
+ security = {
+ # I prefer doas over sudo for simplicity
+ doas = {
+ enable = true;
+ extraRules = [
+ {
+ users = [ "vin" ];
+ keepEnv = true;
+ persist = true;
+ }
+ ];
+ };
+ sudo.enable = false;
+
+ # needed to give realtime privileges to pipewire
+ rtkit.enable = true;
+
+ # trust certificate for *.demiurge.epistemia
+ pki.certificates = [
+ ''
+ -----BEGIN CERTIFICATE-----
+ MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
+ ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
+ ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
+ QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
+ NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
+ aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
+ AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
+ yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
+ al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
+ GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
+ u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
+ X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
+ Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
+ idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
+ DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
+ /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
+ jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
+ 1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
+ ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
+ 2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
+ i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
+ vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
+ SivxomFBHWe4CLwWy/mDaC18/g==
+ -----END CERTIFICATE-----
+ ''
+ ];
+ };
+
+ # create caches and use mandoc
+ documentation.man = {
+ enable = true;
+ generateCaches = true;
+ man-db.enable = false;
+ mandoc.enable = true;
+ };
+}
diff --git a/modules/desktop.nix b/modules/desktop.nix
@@ -0,0 +1,129 @@
+{
+ config,
+ home-manager,
+ lib,
+ pkgs,
+ inputs,
+ llama-cpp,
+ ...
+}:
+
+{
+ imports = [
+ home-manager.nixosModules.default
+ ];
+
+ # boot options
+ boot = {
+ kernel.sysctl = {
+ "net.ipv4.ip_forward" = true;
+ "net.ipv6.conf.all.forwarding" = true;
+ };
+
+ kernelPackages = pkgs.linuxPackages_6_16;
+
+ loader = {
+ systemd-boot.enable = true;
+ efi.canTouchEfiVariables = true;
+ };
+
+ supportedFilesystems = [ "zfs" ];
+
+ zfs = {
+ devNodes = "/dev/disk/by-partuuid";
+ forceImportRoot = false;
+ };
+ };
+
+ services = {
+ # vpn
+ # TODO replace with wireguard again
+ tailscale = {
+ enable = true;
+ disableTaildrop = true;
+ disableUpstreamLogging = true;
+ extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
+ openFirewall = true;
+ useRoutingFeatures = "both";
+ };
+
+ # automatically scrub zfs pools (every week by default)
+ zfs.autoScrub.enable = true;
+
+ # graphical input
+ libinput = {
+ enable = true;
+
+ mouse.accelProfile = "flat";
+
+ touchpad = {
+ accelProfile = "flat";
+ tapping = true;
+ tappingButtonMap = "lrm";
+ };
+ };
+
+ # ssh
+ openssh = {
+ enable = true;
+
+ settings = {
+ KbdInteractiveAuthentication = false;
+ PasswordAuthentication = true;
+ PermitRootLogin = "no";
+ X11Forwarding = true;
+ };
+ };
+
+ # for yubikey
+ pcscd.enable = true;
+
+ # sound. for some reason, pipewire enabled itself when I tried
+ # using pulseaudio and home-manager, so had to disable pulseaudio.
+ pipewire = {
+ enable = true;
+ alsa.enable = true;
+ audio.enable = true;
+ pulse.enable = true;
+ wireplumber = {
+ enable = true;
+ extraConfig = {
+ "51-set-default-eq.conf" = {
+ text = ''
+ monitor.rules = [
+ {
+ matches = [
+ {
+ # This rule matches the node with the name of your sink (node 35)
+ "node.name" = "effect_input.eq6"
+ }
+ ]
+ actions = {
+ update-props = {
+ # This sets a very high priority, making it the default.
+ # Standard hardware is usually around 1000.
+ "priority.session" = 2001
+ }
+ }
+ }
+ ]
+ '';
+ };
+ };
+ };
+ };
+
+ # to get startx and use amdgpu driver
+ # WM in home-manager
+ xserver = {
+ enable = true;
+ autorun = false;
+ displayManager.startx.enable = true;
+ modules = [ pkgs.xf86_input_wacom ];
+ wacom.enable = true;
+ };
+ };
+
+ # extra systemd stuff
+ systemd.services.sshd.after = [ "tailscaled-autoconnect.service" ];
+}
