modularize more

1 files changed, 22 insertions, 313 deletions

diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 749191a..75885e3 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -11,6 +11,8 @@
 {
   imports = [
     ./hardware.nix
+    ../../modules/common.nix
+    ../../modules/desktop.nix
     home-manager.nixosModules.default
   ];
 
@@ -63,39 +65,16 @@
   };
 
   # boot options
-  boot = {
-    kernel.sysctl = {
-      "net.ipv4.ip_forward" = true;
-      "net.ipv6.conf.all.forwarding" = true;
-    };
-
-    kernelPackages = pkgs.linuxPackages_6_12;
-
-    loader = {
-      systemd-boot.enable = true;
-      efi.canTouchEfiVariables = true;
-    };
-
-    supportedFilesystems = [ "zfs" ];
-
-    zfs = {
-      devNodes = "/dev/disk/by-partuuid";
-      extraPools = [
-        "data_nvme"
-        "data_wd"
-      ];
-      forceImportRoot = false;
-    };
-  };
+  boot.zfs.extraPools = [
+    "data_nvme"
+    "data_wd"
+  ];
 
   # disable wifi and open some ports
   networking = {
     hostName = "demiurge";
     hostId = "cafebabe";
 
-    # I like my ethX/wlanX names
-    usePredictableInterfaceNames = false;
-
     wireless.enable = false;
 
     firewall = {
@@ -151,216 +130,29 @@
     };
   };
 
-  # Set your time zone.
-  time.timeZone = "America/Toronto";
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-  console = {
-    font = "Lat2-Terminus16";
-  };
-
-  # enable flakes and nix cli
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  # Define a user account.
   users.users = {
-    vin = {
-      isNormalUser = true;
-
-      extraGroups = [
-        "transmission"
-        "wheel"
-      ];
-
-      shell = pkgs.zsh;
-
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
-      ];
-
-      packages = with pkgs; [
-        alvr
-        bs-manager
-        (llama-cpp.packages.x86_64-linux.rocm.override {
-          useMetalKit = false;
-          useVulkan = true;
-        })
-        #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
-      ];
-    };
+    vin.packages = with pkgs; [
+      alvr
+      bs-manager
+      (llama-cpp.packages.x86_64-linux.rocm.override {
+        useMetalKit = false;
+        useVulkan = true;
+      })
+      #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
+    ];
 
     radarr.extraGroups = [ "transmission" ];
     sonarr.extraGroups = [ "transmission" ];
   };
 
-  # default packages for both me and root
-  environment = {
-    systemPackages = with pkgs; [
-      doas-sudo-shim
-      git
-      wget
-    ];
-
-    pathsToLink = [ "/share/zsh" ];
-  };
-
-  # enable bluetooth and add some udev rules
-  hardware = {
-    bluetooth.enable = true;
-    flipperzero.enable = true;
-    keyboard.qmk.enable = true;
-  };
-
-  programs = {
-    # for gtk in home-manager
-    dconf.enable = true;
-
-    # gpg
-    gnupg.agent = {
-      enable = true;
-      enableSSHSupport = false;
-      pinentryPackage = pkgs.pinentry-rofi;
-      settings.default-cache-ttl = 600;
-    };
-
-    # disable nano. I don't like nano.
-    nano.enable = false;
-
-    # steam, proprietary. I sometimes like playing nonfree games too.
-    steam.enable = true;
-
-    # configuration in home-manager
-    zsh.enable = true;
-    zsh.promptInit = "PS1='$ '";
-  };
-
-  security = {
-    # I prefer doas over sudo for simplicity
-    doas = {
-      enable = true;
-      extraRules = [
-        {
-          users = [ "vin" ];
-          keepEnv = true;
-          persist = true;
-        }
-      ];
-    };
-    sudo.enable = false;
-
-    # needed to give realtime privileges to pipewire
-    rtkit.enable = true;
-
-    # trust certificate for *.demiurge.epistemia
-    pki.certificates = [
-      ''
-        -----BEGIN CERTIFICATE-----
-        MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
-        ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
-        ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
-        QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
-        NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
-        aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
-        AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
-        yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
-        al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
-        GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
-        u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
-        X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
-        Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
-        idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
-        DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
-        /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
-        jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
-        1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
-        ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
-        2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
-        i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
-        vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
-        SivxomFBHWe4CLwWy/mDaC18/g==
-        -----END CERTIFICATE-----
-      ''
-    ];
-  };
-
   services = {
-    # dns
-    unbound = {
-      enable = true;
-      settings = {
-        server = {
-          interface = [
-            "127.0.0.1"
-            "100.64.0.2"
-            #"fd00:b0ba:cafe:babe::2"
-            "::1"
-          ];
-          access-control = [
-            "0.0.0.0/0 allow"
-            "::0/0 allow"
-          ];
-
-          hide-identity = true;
-          hide-version = true;
-
-          # Synthesize NXDOMAINs from DNSSEC NSEC chains.
-          # https://tools.ietf.org/html/rfc8198
-          aggressive-nsec = false;
-
-          module-config = "\"respip validator iterator\"";
-
-          local-data = [
-            "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
-            "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
-            "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
-            "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
-            "\"lab.epistemia. 86400 IN A 100.64.0.5\""
-          ];
-
-          local-zone = [
-            "\"saklas.epistemia.\" redirect"
-            "\"demiurge.epistemia.\" redirect"
-            "\"hastur.epistemia.\" redirect"
-            "\"iphonebob.epistemia.\" redirect"
-            "\"lab.epistemia.\" redirect"
-          ];
-        };
-
-        # hagezi for dns-based adblocking (in addition to others)
-        rpz = {
-          name = "hagezi.ultimate";
-          zonefile = "hagezi.ultimate";
-          url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
-        };
-
-        # go through mullvad for regular dns queries
-        forward-zone = {
-          name = ".";
-          forward-addr = [ "194.242.2.2" ];
-        };
-      };
-    };
-
     # vpn
+    # TODO replace with wireguard again
     tailscale = {
-      enable = true;
       authKeyFile = config.age.secrets.tailscale_demiurge.path;
-      disableTaildrop = true;
-      disableUpstreamLogging = true;
       extraSetFlags = [ "--advertise-exit-node" ];
-      #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
-      extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
-      openFirewall = true;
-      useRoutingFeatures = "both";
     };
 
-    # automatically scrub zfs pools (every week by default)
-    zfs.autoScrub.enable = true;
-
     # media server
     jellyfin = {
       enable = true;
@@ -402,19 +194,6 @@
       };
     };
 
-    # graphical input
-    libinput = {
-      enable = true;
-
-      mouse.accelProfile = "flat";
-
-      touchpad = {
-        accelProfile = "flat";
-        tapping = true;
-        tappingButtonMap = "lrm";
-      };
-    };
-
     # music streaming to phone
     navidrome = {
       enable = true;
@@ -484,22 +263,11 @@
     };
 
     # ssh
-    openssh = {
-      enable = true;
-
-      listenAddresses = [
-        { addr = "127.0.0.1"; port = 22; }
-        { addr = "192.168.1.2"; port = 22; }
-        { addr = "100.64.0.2"; port = 22; }
-      ];
-
-      settings = {
-        KbdInteractiveAuthentication = false;
-        PasswordAuthentication = true;
-        PermitRootLogin = "no";
-        X11Forwarding = true;
-      };
-    };
+    openssh.listenAddresses = [
+      { addr = "127.0.0.1"; port = 22; }
+      { addr = "192.168.1.2"; port = 22; }
+      { addr = "100.64.0.2"; port = 22; }
+    ];
 
     # llm
     open-webui = {
@@ -511,44 +279,6 @@
       port = 8083;
     };
 
-    # for yubikey
-    pcscd.enable = true;
-
-    # sound. for some reason, pipewire enabled itself when I tried
-    # using pulseaudio and home-manager, so had to disable pulseaudio.
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      audio.enable = true;
-      pulse.enable = true;
-      wireplumber = {
-        enable = true;
-        extraConfig = {
-          "51-set-default-eq.conf" = {
-            text = ''
-              monitor.rules = [
-                {
-                  matches = [
-                    {
-                      # This rule matches the node with the name of your sink (node 35)
-                      "node.name" = "effect_input.eq6"
-                    }
-                  ]
-                  actions = {
-                    update-props = {
-                      # This sets a very high priority, making it the default.
-                      # Standard hardware is usually around 1000.
-                      "priority.session" = 2001
-                    }
-                  }
-                }
-              ]
-            '';
-          };
-        };
-      };
-    };
-
     # reddit
     redlib = {
       enable = true;
@@ -1023,31 +753,10 @@
         GROUP="input", SYMLINK+="ocuquest%n"
       '';
     };
-
-    # to get startx and use amdgpu driver
-    # WM in home-manager
-    xserver = {
-      enable = true;
-      autorun = false;
-      displayManager.startx.enable = true;
-      modules = [ pkgs.xf86_input_wacom ];
-      videoDrivers = [ "amdgpu" ];
-      wacom.enable = true;
-    };
   };
 
   # extra systemd stuff
-  systemd.services = {
-    nginx.after = [ "tailscaled-autoconnect.service" ];
-  };
-
-  # create caches and use mandoc
-  documentation.man = {
-    enable = true;
-    generateCaches = true;
-    man-db.enable = false;
-    mandoc.enable = true;
-  };
+  systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ];
 
   system.stateVersion = "24.05";
 }