path: root/hosts/demiurge/default.nix

{
  config,
  home-manager,
  lib,
  pkgs,
  inputs,
  llama-cpp,
  ...
}:

{
  imports = [
    ./hardware.nix
    ../../modules/common.nix
    ../../modules/desktop.nix
    home-manager.nixosModules.default
  ];

  # nixpkgs stuff
  nixpkgs = {
    config = {
      # selectively allow unfree packages
      allowUnfreePredicate =
        pkg:
        builtins.elem (lib.getName pkg) [
          "open-webui"
          "steam"
          "steam-unwrapped"
        ];

      # selectively allow insecure packages
      permittedInsecurePackages = [
        "dotnet-sdk-6.0.428"
        "aspnetcore-runtime-6.0.36"
      ];

      cudaSupport = false;
    };

    overlays = [
      (self: super: {
        alvr = super.alvr.overrideAttrs (old: {
          buildInputs = old.buildInputs ++ [
            super.android-tools
            super.usbutils
            super.zenity
          ];
          nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ];
          postInstall = (old.postInstall or "") + ''
            wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
              super.lib.makeBinPath [
                super.android-tools
                super.usbutils
                super.zenity
              ]
            }"
          '';
        });
      })
    ];
  };

  # decrypt agenix secrets
  age.secrets = {
    wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
    wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
  };

  # boot options
  boot = {
    # force monitor to always be connected
    kernelParams = [ "video=DP-4:3440x1440@100e" ];

    zfs.extraPools = [
      "data_nvme"
      "data_hdd"
    ];
  };

  # disable wifi and open some ports
  networking = {
    hostName = "demiurge";
    hostId = "cafebabe";

    wireless.enable = false;

    firewall = {
      allowedTCPPorts = [
        22
        80
        443
        9943
        9944
      ];
      allowedUDPPorts = [ 9943 9944 51413 51820 ];
    };

    interfaces.eth0 = {
      ipv4.addresses = [
        {
          address = "192.168.1.2";
          prefixLength = 24;
        }
      ];
    };
    defaultGateway = {
      address = "192.168.1.1";
      interface = "eth0";
    };

    # mullvad
    wg-quick.interfaces = {
      wg0 = {
        address = [
          "10.68.117.111/32"
          "fc00:bbbb:bbbb:bb01::5:756e/128"
        ];
        privateKeyFile = config.age.secrets.wg0_demiurge.path;

        peers = [
          {
            allowedIPs = [
              "0.0.0.0/0"
              "::0/0"
            ];
            endpoint = "45.134.142.206:51820";
            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
          }
        ];
      };
      wg1 = {
        address = [
          "10.0.13.2/24"
          "fd00:b0ba:cafe:babe::2/64"
        ];
        privateKeyFile = config.age.secrets.wg1_demiurge.path;
        listenPort = 51820;
        mtu = 1420;
        table = null;
        postUp = ''
# IPv4 NAT
iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
# IPv6 NAT
ip6tables -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE

# IPv4 Forwarding Chain
iptables -N WG1-FWD
iptables -I FORWARD 1 -j WG1-FWD
iptables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
iptables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
iptables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# IPv6 Forwarding Chain
ip6tables -N WG1-FWD
ip6tables -I FORWARD 1 -j WG1-FWD
ip6tables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
ip6tables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
ip6tables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
        '';
        preDown = ''
# IPv4 NAT
iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
# IPv6 NAT
ip6tables -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE

# IPv4 Forwarding Chain
iptables -D FORWARD -j WG1-FWD
iptables -F WG1-FWD
iptables -X WG1-FWD

# IPv6 Forwarding Chain
ip6tables -D FORWARD -j WG1-FWD
ip6tables -F WG1-FWD
ip6tables -X WG1-FWD
        '';

        peers = [
          {
            # saklas.epistemia
            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
            endpoint = "157.180.125.215:51820";
            allowedIPs = [ "10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128" ];
            persistentKeepalive = 25;
          }
          {
            # hastur.epistemia
            publicKey = "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=";
            allowedIPs = [ "10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128" ];
            persistentKeepalive = 25;
          }
          {
            # iphonebob.epistemia
            publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
            allowedIPs = [ "10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128" ];
            persistentKeepalive = 25;
          }
          {
            # lab.epistemia
            publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
            allowedIPs = [ "10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128" ];
            persistentKeepalive = 25;
          }
        ];
      };
    };
  };

  users.users = {
    vin.packages = with pkgs; [
      alvr
      bs-manager
      (llama-cpp.packages.x86_64-linux.rocm.override {
        useMetalKit = false;
        useVulkan = true;
      })
      #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
    ];

    radarr.extraGroups = [ "transmission" ];
    sonarr.extraGroups = [ "transmission" ];
  };

  services = {
    # media server
    jellyfin = {
      enable = true;
      openFirewall = true;
    };

    lidarr = {
      enable = true;
      openFirewall = true;
    };

    prowlarr = {
      enable = true;
      openFirewall = true;
    };

    radarr = {
      enable = true;
      openFirewall = true;
    };

    sonarr = {
      enable = true;
      openFirewall = true;
    };

    transmission = {
      enable = true;
	    package = pkgs.transmission_4;
      downloadDirPermissions = "770";
      openPeerPorts = true;
      user = "vin";

      settings = {
        download-dir = "/data_wd/torrents/complete/";
        incomplete-dir = "/data_wd/torrents/incomplete/";
        incomplete-dir-enabled = true;
        peer-port = 51413;
        umask = 2;
      };
    };

    # music streaming to phone
    navidrome = {
      enable = true;
      settings = {
        MusicFolder = "/data_wd/music";
        EnableInsightsCollector = false;
      };
    };

    # reverse proxy
    nginx = {
      enable = true;

      defaultListenAddresses = [
        "100.64.0.2"
        #"10.0.13.2"
        #"fd00:b0ba:cafe:babe::2"
      ];

      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;

      virtualHosts = {
        "searx.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/".proxyPass = "http://127.0.0.1:8081";
        };

        "redlib.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/".proxyPass = "http://127.0.0.1:8085";
        };

        "navidrome.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/".proxyPass = "http://127.0.0.1:4533";
        };

        "sdui.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/" = {
            proxyPass = "http://127.0.0.1:7860";
            proxyWebsockets = true;
          };
        };
      };
    };

    # ssh
    openssh.listenAddresses = [
      { addr = "127.0.0.1"; port = 22; }
      { addr = "192.168.1.2"; port = 22; }
      { addr = "10.0.13.2"; port = 22; }
    ];

    # reddit
    redlib = {
      enable = true;

      address = "127.0.0.1";
      port = 8085;

      settings = {
        # Instance-specific settings
        # Enable SFW-only mode for the instance
        REDLIB_SFW_ONLY = false;
        # Set a banner message for the instance
        REDLIB_BANNER = "";
        # Disable search engine indexing
        REDLIB_ROBOTS_DISABLE_INDEXING = true;
        # Set the Pushshift frontend for "removed" links
        REDLIB_PUSHSHIFT_FRONTEND = "undelete.pullpush.io";

        # Default user settings
        # Set the default theme (options: system, light, dark, black, dracula, nord, laserwave, violet, gold, rosebox, gruvboxdark, gruvboxlight)
        REDLIB_DEFAULT_THEME = "black";
        # Set the default front page (options: default, popular, all)
        REDLIB_DEFAULT_FRONT_PAGE = "default";
        # Set the default layout (options: card, clean, compact)
        REDLIB_DEFAULT_LAYOUT = "compact";
        # Enable wide mode by default
        REDLIB_DEFAULT_WIDE = true;
        # Set the default post sort method (options: hot, new, top, rising, controversial)
        REDLIB_DEFAULT_POST_SORT = "hot";
        # Set the default comment sort method (options: confidence, top, new, controversial, old)
        REDLIB_DEFAULT_COMMENT_SORT = "confidence";
        # Enable blurring Spoiler content by default
        REDLIB_DEFAULT_BLUR_SPOILER = false;
        # Enable showing NSFW content by default
        REDLIB_DEFAULT_SHOW_NSFW = false;
        # Enable blurring NSFW content by default
        REDLIB_DEFAULT_BLUR_NSFW = false;
        # Enable HLS video format by default
        REDLIB_DEFAULT_USE_HLS = false;
        # Hide HLS notification by default
        REDLIB_DEFAULT_HIDE_HLS_NOTIFICATION = false;
        # Disable autoplay videos by default
        REDLIB_DEFAULT_AUTOPLAY_VIDEOS = false;
        # Define a default list of subreddit subscriptions (format: sub1+sub2+sub3)
        REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+elitedangerous";
        # Define a default list of subreddit filters (format: sub1+sub2+sub3)
        REDLIB_DEFAULT_FILTERS = "popular+all+funny+memes";
        # Hide awards by default
        REDLIB_DEFAULT_HIDE_AWARDS = true;
        # Hide sidebar and summary
        REDLIB_DEFAULT_HIDE_SIDEBAR_AND_SUMMARY = false;
        # Disable the confirmation before visiting Reddit
        REDLIB_DEFAULT_DISABLE_VISIT_REDDIT_CONFIRMATION = false;
        # Hide score by default
        REDLIB_DEFAULT_HIDE_SCORE = false;
        # Enable fixed navbar by default
        REDLIB_DEFAULT_FIXED_NAVBAR = true;
      };
    };

    # searching
    searx = {
      enable = true;

      settings = {
        use_default_settings = false;
        general.debug = true;

        search.default_lang = "en";

        server = {
          base_url = "https://searx.demiurge.epistemia";
          bind_address = "127.0.0.1";
          port = 8081;
          secret_key = "sJ8oFeH9sC+wriftl2DqVaPC0QDoBDBpqrcOw4Ixw1M=";
        };

        ui.theme_args.simple_style = "dark";

        enabled_plugins = [
          "Hostnames plugin"
          "Open Access DOI rewrite"
          "Tracker URL remover"
        ];

        hostnames = {
          replace = {
            "(.*\.)?youtube\.com$" = "yewtu.be";
            "(.*\.)?youtu\.be$" = "yewtu.be";
            "(.*\.)?reddit\.com$" = "redlib.demiurge.epistemia";
            "(.*\.)?redd\.it$" = "redlib.demiurge.epistemia";
          };

          remove = [
            "geeksforgeeks.org"
            "tutorialpoint.com"
            "chegg.com"
            "numerade.com"
            "study.com"
          ];
        };

        engines = [
          {
            name = "arch linux wiki";
            engine = "archlinux";
            shortcut = "al";
            categories = "it";
          }

          {
            name = "arxiv";
            engine = "arxiv";
            shortcut = "arx";
            timeout = 4.0;
            categories = "science";
          }

          {
            name = "wikipedia";
            engine = "wikipedia";
            shortcut = "wp";
            # add "list" to the array to get results in the results list
            display_type = "infobox";
            categories = "general";
          }

          {
            name = "btdigg";
            engine = "btdigg";
            shortcut = "bt";
            categories = "files";
          }

          {
            name = "cppreference";
            engine = "cppreference";
            shortcut = "cpp";
            paging = false;
            categories = "it";
          }

          {
            name = "free software directory";
            engine = "mediawiki";
            shortcut = "fsd";
            categories = [
              "it"
              "software wikis"
            ];
            base_url = "https://directory.fsf.org/";
            search_type = "title";
            timeout = 5.0;
            about = {
              website = "https://directory.fsf.org/";
              wikidata_id = "Q2470288";
            };
          }

          {
            name = "gentoo";
            engine = "mediawiki";
            shortcut = "ge";
            categories = [
              "it"
              "software wikis"
            ];
            base_url = "https://wiki.gentoo.org/";
            api_path = "api.php";
            search_type = "text";
            timeout = 10;
          }

          {
            name = "gitlab";
            engine = "gitlab";
            base_url = "https://gitlab.com";
            shortcut = "gl";
            about = {
              website = "https://gitlab.com/";
              wikidata_id = "Q16639197";
            };
          }

          {
            name = "github";
            engine = "github";
            shortcut = "gh";
          }

          {
            name = "codeberg";
            # https://docs.searxng.org/dev/engines/online/gitea.html
            engine = "gitea";
            base_url = "https://codeberg.org";
            shortcut = "cb";
          }

          {
            name = "gitea.com";
            engine = "gitea";
            base_url = "https://gitea.com";
            shortcut = "gitea";
          }

          {
            name = "google images";
            engine = "google_images";
            shortcut = "goi";
          }

          {
            name = "google scholar";
            engine = "google_scholar";
            shortcut = "gos";
          }

          {
            name = "invidious";
            engine = "invidious";
            base_url = [
              "https://invidious.demiurge.epistemia"
            ];
            shortcut = "iv";
            timeout = 3.0;
          }

          {
            name = "library genesis";
            engine = "xpath";
            search_url = "https://libgen.is/search.php?req={query}";
            url_xpath = "//a[contains(@href,\"book/index.php?md5\")]/@href";
            title_xpath = "//a[contains(@href,\"book/\")]/text()[1]";
            content_xpath = "//td/a[1][contains(@href,\"=author\")]/text()";
            categories = "files";
            timeout = 7.0;
            shortcut = "lg";
            about = {
              website = "https://libgen.fun/";
              wikidata_id = "Q22017206";
              official_api_documentation = "";
              use_official_api = false;
              require_api_key = false;
              results = "HTML";
            };
          }

          {
            name = "z-library";
            engine = "zlibrary";
            shortcut = "zlib";
            categories = "files";
            timeout = 7.0;
          }

          {
            name = "nyaa";
            engine = "nyaa";
            shortcut = "nt";
          }

          {
            name = "openlibrary";
            engine = "openlibrary";
            shortcut = "ol";
            timeout = 5;
          }

          {
            name = "stackoverflow";
            engine = "stackexchange";
            shortcut = "st";
            api_site = "stackoverflow";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "askubuntu";
            engine = "stackexchange";
            shortcut = "ubuntu";
            api_site = "askubuntu";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "superuser";
            engine = "stackexchange";
            shortcut = "su";
            api_site = "superuser";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "nixos.discourse";
            engine = "discourse";
            shortcut = "dnos";
            base_url = "https://discourse.nixos.org";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "unsplash";
            engine = "unsplash";
            shortcut = "us";
          }

          {
            name = "wiby";
            engine = "json_engine";
            paging = true;
            weight = 0.5;
            search_url = "https://wiby.me/json/?q={query}&p={pageno}";
            url_query = "URL";
            title_query = "Title";
            content_query = "Snippet";
            categories = [
              "general"
              "web"
            ];
            shortcut = "wib";
            about.website = "https://wiby.me/";
          }

          {
            name = "wikibooks";
            engine = "mediawiki";
            weight = 0.5;
            shortcut = "wb";
            categories = [
              "general"
              "wikimedia"
            ];
            base_url = "https://{language}.wikibooks.org/";
            search_type = "text";
            about = {
              website = "https://www.wikibooks.org/";
              wikidata_id = "Q367";
            };
          }

          {
            name = "wiktionary";
            engine = "mediawiki";
            shortcut = "wt";
            categories = [
              "dictionaries"
              "wikimedia"
            ];
            base_url = "https://{language}.wiktionary.org/";
            search_type = "text";
            about = {
              website = "https://www.wiktionary.org/";
              wikidata_id = "Q151";
            };
          }

          {
            name = "wikiversity";
            engine = "mediawiki";
            weight = 0.5;
            shortcut = "wv";
            categories = [
              "general"
              "wikimedia"
            ];
            base_url = "https://{language}.wikiversity.org/";
            search_type = "text";
            about = {
              website = "https://www.wikiversity.org/";
              wikidata_id = "Q370";
            };
          }

          {
            name = "peertube";
            engine = "peertube";
            shortcut = "ptb";
            paging = true;
            # alternatives see = "https://instances.joinpeertube.org/instances
            # base_url = "https://tube.4aem.com
            categories = "videos";
            timeout = 6.0;
          }

          {
            name = "brave";
            engine = "brave";
            shortcut = "br";
            time_range_support = true;
            paging = true;
            categories = [
              "general"
              "web"
            ];
            brave_category = "search";
          }

          {
            name = "brave.images";
            engine = "brave";
            network = "brave";
            shortcut = "brimg";
            categories = [
              "images"
              "web"
            ];
            brave_category = "images";
          }

          {
            name = "sourcehut";
            shortcut = "srht";
            engine = "xpath";
            paging = true;
            search_url = "https://sr.ht/projects?page={pageno}&search={query}";
            results_xpath = "(//div[@class=\"event-list\"])[1]/div[@class=\"event\"]";
            url_xpath = "./h4/a[2]/@href";
            title_xpath = "./h4/a[2]";
            content_xpath = "./p";
            first_page_num = 1;
            categories = [
              "it"
              "repos"
            ];
            about = {
              website = "https://sr.ht";
              wikidata_id = "Q78514485";
              official_api_documentation = "https://man.sr.ht/";
              use_official_api = false;
              require_api_key = false;
              results = "HTML";
            };
          }
        ];

        doi_resolvers = {
          "oadoi.org" = "https://oadoi.org/";
          "doi.org" = "https://doi.org/";
          "sci-hub.se" = "https://sci-hub.se/";
          "sci-hub.st" = "https://sci-hub.st/";
          "sci-hub.ru" = "https://sci-hub.ru/";
        };

        default_doi_resolver = "sci-hub.st";
      };
    };

    # udev rules
    udev = {
      enable = true;
      extraRules = ''
        # Oculus Quest 2
        SUBSYSTEM=="usb", ATTR{idVendor}=="2833", ATTR{idProduct}=="0186", MODE="0660",
        GROUP="input", SYMLINK+="ocuquest%n"
      '';
    };
  };

  system.stateVersion = "24.05";
}