modularize more

1 files changed, 199 insertions, 0 deletions

diff --git a/modules/common.nix b/modules/common.nix
new file mode 100644
index 0000000..d613bf8
--- /dev/null
+++ b/modules/common.nix
@@ -0,0 +1,199 @@
+{ pkgs, ... }: {
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+  };
+
+  # enable flakes and nix cli
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  # I like my ethX/wlanX names
+  networking.usePredictableInterfaceNames = false;
+
+
+  # use local dns on each host
+  services.unbound = {
+    enable = true;
+    settings = {
+      server = {
+        interface = [
+          "127.0.0.1"
+          "100.64.0.2"
+          #"fd00:b0ba:cafe:babe::2"
+          "::1"
+        ];
+        access-control = [
+          "0.0.0.0/0 allow"
+          "::0/0 allow"
+        ];
+
+        hide-identity = true;
+        hide-version = true;
+
+        # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+        # https://tools.ietf.org/html/rfc8198
+        aggressive-nsec = false;
+
+        module-config = "\"respip validator iterator\"";
+
+        local-data = [
+          "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
+          "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
+          "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
+          "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
+          "\"lab.epistemia. 86400 IN A 100.64.0.5\""
+        ];
+
+        local-zone = [
+          "\"saklas.epistemia.\" redirect"
+          "\"demiurge.epistemia.\" redirect"
+          "\"hastur.epistemia.\" redirect"
+          "\"iphonebob.epistemia.\" redirect"
+          "\"lab.epistemia.\" redirect"
+        ];
+      };
+
+      # hagezi for dns-based adblocking (in addition to others)
+      rpz = {
+        name = "hagezi.ultimate";
+        zonefile = "hagezi.ultimate";
+        url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+      };
+
+      # go through mullvad for regular dns queries
+      forward-zone = {
+        name = ".";
+        forward-addr = [ "194.242.2.2" ];
+      };
+    };
+  };
+  environment.etc."resolv.conf".text = ''
+    nameserver 127.0.0.1
+    search epistemia
+  '';
+
+  # Define a user account.
+  users = {
+    groups.vin = {};
+    users.vin = {
+      isNormalUser = true;
+
+      group = "vin";
+      extraGroups = [
+        "transmission"
+        "wheel"
+      ];
+
+      shell = pkgs.zsh;
+
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
+      ];
+    };
+  };
+
+  # default packages for both me and root
+  environment = {
+    systemPackages = with pkgs; [
+      doas-sudo-shim
+      git
+      wget
+    ];
+
+    pathsToLink = [ "/share/zsh" ];
+  };
+
+  # enable bluetooth and add some udev rules
+  hardware = {
+    bluetooth.enable = true;
+    flipperzero.enable = true;
+    keyboard.qmk.enable = true;
+  };
+
+  programs = {
+    # for gtk in home-manager
+    dconf.enable = true;
+
+    # gpg
+    gnupg.agent = {
+      enable = true;
+      enableSSHSupport = false;
+      pinentryPackage = pkgs.pinentry-rofi;
+      settings.default-cache-ttl = 600;
+    };
+
+    # disable nano. I don't like nano.
+    nano.enable = false;
+
+    # steam, proprietary. I sometimes like playing nonfree games too.
+    steam.enable = true;
+
+    # configuration in home-manager
+    zsh.enable = true;
+    zsh.promptInit = "PS1='$ '";
+  };
+
+  security = {
+    # I prefer doas over sudo for simplicity
+    doas = {
+      enable = true;
+      extraRules = [
+        {
+          users = [ "vin" ];
+          keepEnv = true;
+          persist = true;
+        }
+      ];
+    };
+    sudo.enable = false;
+
+    # needed to give realtime privileges to pipewire
+    rtkit.enable = true;
+
+    # trust certificate for *.demiurge.epistemia
+    pki.certificates = [
+      ''
+        -----BEGIN CERTIFICATE-----
+        MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
+        ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
+        ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
+        QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
+        NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
+        aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
+        AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
+        yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
+        al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
+        GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
+        u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
+        X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
+        Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
+        idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
+        DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
+        /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
+        jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
+        1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
+        ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
+        2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
+        i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
+        vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
+        SivxomFBHWe4CLwWy/mDaC18/g==
+        -----END CERTIFICATE-----
+      ''
+    ];
+  };
+
+  # create caches and use mandoc
+  documentation.man = {
+    enable = true;
+    generateCaches = true;
+    man-db.enable = false;
+    mandoc.enable = true;
+  };
+}