path: root/hosts/demiurge/default.nix

{
  config,
  home-manager,
  lib,
  pkgs,
  inputs,
  llama-cpp,
  ...
}:

{
  imports = [
    ./hardware.nix
    home-manager.nixosModules.default
  ];

  # nixpkgs stuff
  nixpkgs = {
    config = {
      # selectively allow unfree packages
      allowUnfreePredicate =
        pkg:
        builtins.elem (lib.getName pkg) [
          "open-webui"
          "steam"
          "steam-unwrapped"
        ];

      # selectively allow insecure packages
      permittedInsecurePackages = [
        "dotnet-sdk-6.0.428"
        "aspnetcore-runtime-6.0.36"
      ];

      cudaSupport = false;
    };

    overlays = [
      (self: super: {
        alvr = super.alvr.overrideAttrs (old: {
          buildInputs = old.buildInputs ++ [
            super.android-tools
            super.usbutils
          ];
          nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ];
          postInstall = (old.postInstall or "") + ''
            wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
              super.lib.makeBinPath [
                super.android-tools
                super.usbutils
              ]
            }"
          '';
        });
      })
    ];
  };

  # decrypt agenix secrets
  age.secrets = {
    wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
    tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age;
  };

  # boot options
  boot = {
    kernel.sysctl = {
      "net.ipv4.ip_forward" = true;
      "net.ipv6.conf.all.forwarding" = true;
    };

    kernelPackages = pkgs.linuxPackages_6_12;

    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
    };

    supportedFilesystems = [ "zfs" ];

    zfs = {
      devNodes = "/dev/disk/by-partuuid";
      extraPools = [
        "data_nvme"
        "data_wd"
      ];
      forceImportRoot = false;
    };
  };

  # disable wifi and open some ports
  networking = {
    hostName = "demiurge";
    hostId = "cafebabe";

    # I like my ethX/wlanX names
    usePredictableInterfaceNames = false;

    wireless.enable = false;

    firewall = {
      allowedTCPPorts = [
        22
        80
        443
      ];
      allowedUDPPorts = [ 51413 ];
    };

    interfaces.eth0 = {
      ipv4.addresses = [
        {
          address = "192.168.1.2";
          prefixLength = 24;
        }
      ];
    };
    defaultGateway = {
      address = "192.168.1.1";
      interface = "eth0";
    };

    # mullvad
    wg-quick.interfaces.wg0 = {
      address = [
        "10.68.117.111/32"
        "fc00:bbbb:bbbb:bb01::5:756e/128"
      ];
      privateKeyFile = config.age.secrets.wg0_demiurge.path;

      # supposed to be done by tailscale instead \_(:/)_/
      postUp = ''
        ip route add 100.64.0.0/24 dev tailscale0
        ip route add 100.100.100.100/32 dev tailscale0
      '';
      postDown = ''
        ip route del 100.64.0.0/24 dev tailscale0
        ip route del 100.100.100.100/32 dev tailscale0
      '';

      peers = [
        {
          allowedIPs = [
            "0.0.0.0/0"
            "::0/0"
          ];
          endpoint = "45.134.142.206:51820";
          publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
        }
      ];
    };
  };

  # Set your time zone.
  time.timeZone = "America/Toronto";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
  };

  # enable flakes and nix cli
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  # Define a user account.
  users.users = {
    vin = {
      isNormalUser = true;

      extraGroups = [
        "transmission"
        "wheel"
      ];

      shell = pkgs.zsh;

      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
      ];

      packages = with pkgs; [
        alvr
        bs-manager
        (llama-cpp.packages.x86_64-linux.rocm.override { useMetalKit = false; useVulkan = true; })
        #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
      ];
    };

    radarr.extraGroups = [ "transmission" ];
    sonarr.extraGroups = [ "transmission" ];
  };

  # default packages for both me and root
  environment = {
    systemPackages = with pkgs; [
      doas-sudo-shim
      git
      wget
    ];

    pathsToLink = [ "/share/zsh" ];
  };

  # enable bluetooth and add some udev rules
  hardware = {
    bluetooth.enable = true;
    flipperzero.enable = true;
    keyboard.qmk.enable = true;
  };

  programs = {
    # for gtk in home-manager
    dconf.enable = true;

    # gpg
    gnupg.agent = {
      enable = true;
      enableSSHSupport = false;
      pinentryPackage = pkgs.pinentry-rofi;
      settings.default-cache-ttl = 600;
    };

    # disable nano. I don't like nano.
    nano.enable = false;

    # steam, proprietary. I sometimes like playing nonfree games too.
    steam.enable = true;

    # configuration in home-manager
    zsh.enable = true;
    zsh.promptInit = "PS1='$ '";
  };

  security = {
    # I prefer doas over sudo for simplicity
    doas = {
      enable = true;
      extraRules = [
        {
          users = [ "vin" ];
          keepEnv = true;
          persist = true;
        }
      ];
    };
    sudo.enable = false;

    # needed to give realtime privileges to pipewire
    rtkit.enable = true;
  };

  services = {
    # dns
    unbound = {
      enable = true;
      settings = {
        server = {
          interface = [
            "127.0.0.1"
            "100.64.0.2"
            #"fd00:b0ba:cafe:babe::2"
            "::1"
          ];
          access-control = [
            "0.0.0.0/0 allow"
            "::0/0 allow"
          ];

          hide-identity = true;
          hide-version = true;

          # Synthesize NXDOMAINs from DNSSEC NSEC chains.
          # https://tools.ietf.org/html/rfc8198
          aggressive-nsec = false;

          module-config = "\"respip validator iterator\"";

          local-data = [
            "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
            "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
            "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
            "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
            "\"lab.epistemia. 86400 IN A 100.64.0.5\""
          ];

          local-zone = [
            "\"saklas.epistemia.\" redirect"
            "\"demiurge.epistemia.\" redirect"
            "\"hastur.epistemia.\" redirect"
            "\"iphonebob.epistemia.\" redirect"
            "\"lab.epistemia.\" redirect"
          ];
        };

        # hagezi for dns-based adblocking (in addition to others)
        rpz = {
          name = "hagezi.ultimate";
          zonefile = "hagezi.ultimate";
          url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
        };

        # go through mullvad for regular dns queries
        forward-zone = {
          name = ".";
          forward-addr = [ "194.242.2.2" ];
        };
      };
    };

    # vpn
    tailscale = {
      enable = true;
      authKeyFile = config.age.secrets.tailscale_demiurge.path;
      disableTaildrop = true;
      disableUpstreamLogging = true;
      extraSetFlags = [ "--advertise-exit-node" ];
      #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
      extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
      openFirewall = true;
      useRoutingFeatures = "both";
    };

    # automatically scrub zfs pools (every week by default)
    zfs.autoScrub.enable = true;

    # media server
    jellyfin = {
      enable = true;
      openFirewall = true;
    };

    lidarr = {
      enable = true;
      openFirewall = true;
    };

    prowlarr = {
      enable = true;
      openFirewall = true;
    };

    radarr = {
      enable = true;
      openFirewall = true;
    };

    sonarr = {
      enable = true;
      openFirewall = true;
    };

    transmission = {
      enable = true;
      downloadDirPermissions = "770";
      openPeerPorts = true;
      user = "vin";

      settings = {
        download-dir = "/data_wd/torrents/complete/";
        incomplete-dir = "/data_wd/torrents/incomplete/";
        incomplete-dir-enabled = true;
        peer-port = 51413;
        umask = 2;
      };
    };

    # graphical input
    libinput = {
      enable = true;

      mouse.accelProfile = "flat";

      touchpad = {
        accelProfile = "flat";
        tapping = true;
        tappingButtonMap = "lrm";
      };
    };

    # music streaming to phone
    navidrome = {
      enable = true;
      settings = {
        MusicFolder = "/data_wd/music";
        EnableInsightsCollector = false;
      };
    };

    # reverse proxy
    nginx = {
      enable = true;

      defaultListenAddresses = [
        "100.64.0.2"
        #"10.0.13.2"
        #"fd00:b0ba:cafe:babe::2"
      ];

      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;

      virtualHosts = {
        "searx.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/".proxyPass = "http://127.0.0.1:8081";
        };

        "redlib.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/".proxyPass = "http://127.0.0.1:8085";
        };

        "llm.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/" = {
            proxyPass = "http://127.0.0.1:8083";
            proxyWebsockets = true;
          };
        };

        "navidrome.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/".proxyPass = "http://127.0.0.1:4533";
        };

        "sdui.demiurge.epistemia" = {
          addSSL = true;
          sslCertificate = "/var/demiurge.epistemia.crt";
          sslCertificateKey = "/var/demiurge.epistemia.key";
          locations."/" = {
            proxyPass = "http://127.0.0.1:7860";
            proxyWebsockets = true;
          };
        };
      };
    };

    # ssh
    openssh = {
      enable = true;

      listenAddresses = [
        { addr = "127.0.0.1"; port = 22; }
        { addr = "192.168.1.2"; port = 22; }
        { addr = "100.64.0.2"; port = 22; }
      ];

      settings = {
        KbdInteractiveAuthentication = false;
        PasswordAuthentication = true;
        PermitRootLogin = "no";
        X11Forwarding = true;
      };
    };

    # llm
    open-webui = {
      enable = true;
      environment = {
        REQUESTS_CA_BUNDLE = "/etc/ssl/certs/ca-bundle.crt";
        WEBUI_AUTH = "False";
      };
      port = 8083;
    };

    # for yubikey
    pcscd.enable = true;

    # sound. for some reason, pipewire enabled itself when I tried
    # using pulseaudio and home-manager, so had to disable pulseaudio.
    pipewire = {
      enable = true;
      alsa.enable = true;
      audio.enable = true;
      pulse.enable = true;
      wireplumber = {
        enable = true;
        extraConfig = {
          "51-set-default-eq.conf" = {
            text = ''
              monitor.rules = [
                {
                  matches = [
                    {
                      # This rule matches the node with the name of your sink (node 35)
                      "node.name" = "effect_input.eq6"
                    }
                  ]
                  actions = {
                    update-props = {
                      # This sets a very high priority, making it the default.
                      # Standard hardware is usually around 1000.
                      "priority.session" = 2001
                    }
                  }
                }
              ]
            '';
          };
        };
      };
    };

    # reddit
    redlib = {
      enable = true;

      address = "127.0.0.1";
      port = 8085;

      settings = {
        # Instance-specific settings
        # Enable SFW-only mode for the instance
        REDLIB_SFW_ONLY = false;
        # Set a banner message for the instance
        REDLIB_BANNER = "";
        # Disable search engine indexing
        REDLIB_ROBOTS_DISABLE_INDEXING = true;
        # Set the Pushshift frontend for "removed" links
        REDLIB_PUSHSHIFT_FRONTEND = "undelete.pullpush.io";

        # Default user settings
        # Set the default theme (options: system, light, dark, black, dracula, nord, laserwave, violet, gold, rosebox, gruvboxdark, gruvboxlight)
        REDLIB_DEFAULT_THEME = "black";
        # Set the default front page (options: default, popular, all)
        REDLIB_DEFAULT_FRONT_PAGE = "default";
        # Set the default layout (options: card, clean, compact)
        REDLIB_DEFAULT_LAYOUT = "compact";
        # Enable wide mode by default
        REDLIB_DEFAULT_WIDE = true;
        # Set the default post sort method (options: hot, new, top, rising, controversial)
        REDLIB_DEFAULT_POST_SORT = "hot";
        # Set the default comment sort method (options: confidence, top, new, controversial, old)
        REDLIB_DEFAULT_COMMENT_SORT = "confidence";
        # Enable blurring Spoiler content by default
        REDLIB_DEFAULT_BLUR_SPOILER = false;
        # Enable showing NSFW content by default
        REDLIB_DEFAULT_SHOW_NSFW = false;
        # Enable blurring NSFW content by default
        REDLIB_DEFAULT_BLUR_NSFW = false;
        # Enable HLS video format by default
        REDLIB_DEFAULT_USE_HLS = false;
        # Hide HLS notification by default
        REDLIB_DEFAULT_HIDE_HLS_NOTIFICATION = false;
        # Disable autoplay videos by default
        REDLIB_DEFAULT_AUTOPLAY_VIDEOS = false;
        # Define a default list of subreddit subscriptions (format: sub1+sub2+sub3)
        REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+elitedangerous";
        # Define a default list of subreddit filters (format: sub1+sub2+sub3)
        REDLIB_DEFAULT_FILTERS = "popular+all+funny+memes";
        # Hide awards by default
        REDLIB_DEFAULT_HIDE_AWARDS = true;
        # Hide sidebar and summary
        REDLIB_DEFAULT_HIDE_SIDEBAR_AND_SUMMARY = false;
        # Disable the confirmation before visiting Reddit
        REDLIB_DEFAULT_DISABLE_VISIT_REDDIT_CONFIRMATION = false;
        # Hide score by default
        REDLIB_DEFAULT_HIDE_SCORE = false;
        # Enable fixed navbar by default
        REDLIB_DEFAULT_FIXED_NAVBAR = true;
      };
    };

    # monero node
    monero = {
      enable = true;
      dataDir = "/data_wd/monero";
    };

    # searching
    searx = {
      enable = true;

      settings = {
        use_default_settings = false;
        general.debug = true;

        search.default_lang = "en";

        server = {
          base_url = "https://searx.demiurge.epistemia";
          bind_address = "127.0.0.1";
          port = 8081;
          secret_key = "sJ8oFeH9sC+wriftl2DqVaPC0QDoBDBpqrcOw4Ixw1M=";
        };

        ui.theme_args.simple_style = "dark";

        enabled_plugins = [
          "Hostnames plugin"
          "Open Access DOI rewrite"
          "Tracker URL remover"
        ];

        hostnames = {
          replace = {
            "(.*\.)?youtube\.com$" = "yewtu.be";
            "(.*\.)?youtu\.be$" = "yewtu.be";
            "(.*\.)?reddit\.com$" = "redlib.demiurge.epistemia";
            "(.*\.)?redd\.it$" = "redlib.demiurge.epistemia";
          };

          remove = [
            "geeksforgeeks.org"
            "tutorialpoint.com"
            "chegg.com"
            "numerade.com"
            "study.com"
          ];
        };

        engines = [
          {
            name = "arch linux wiki";
            engine = "archlinux";
            shortcut = "al";
            categories = "it";
          }

          {
            name = "arxiv";
            engine = "arxiv";
            shortcut = "arx";
            timeout = 4.0;
            categories = "science";
          }

          {
            name = "wikipedia";
            engine = "wikipedia";
            shortcut = "wp";
            # add "list" to the array to get results in the results list
            display_type = "infobox";
            categories = "general";
          }

          {
            name = "btdigg";
            engine = "btdigg";
            shortcut = "bt";
            categories = "files";
          }

          {
            name = "cppreference";
            engine = "cppreference";
            shortcut = "cpp";
            paging = false;
            categories = "it";
          }

          {
            name = "free software directory";
            engine = "mediawiki";
            shortcut = "fsd";
            categories = [
              "it"
              "software wikis"
            ];
            base_url = "https://directory.fsf.org/";
            search_type = "title";
            timeout = 5.0;
            about = {
              website = "https://directory.fsf.org/";
              wikidata_id = "Q2470288";
            };
          }

          {
            name = "gentoo";
            engine = "mediawiki";
            shortcut = "ge";
            categories = [
              "it"
              "software wikis"
            ];
            base_url = "https://wiki.gentoo.org/";
            api_path = "api.php";
            search_type = "text";
            timeout = 10;
          }

          {
            name = "gitlab";
            engine = "gitlab";
            base_url = "https://gitlab.com";
            shortcut = "gl";
            about = {
              website = "https://gitlab.com/";
              wikidata_id = "Q16639197";
            };
          }

          {
            name = "github";
            engine = "github";
            shortcut = "gh";
          }

          {
            name = "codeberg";
            # https://docs.searxng.org/dev/engines/online/gitea.html
            engine = "gitea";
            base_url = "https://codeberg.org";
            shortcut = "cb";
          }

          {
            name = "gitea.com";
            engine = "gitea";
            base_url = "https://gitea.com";
            shortcut = "gitea";
          }

          {
            name = "google images";
            engine = "google_images";
            shortcut = "goi";
          }

          {
            name = "google scholar";
            engine = "google_scholar";
            shortcut = "gos";
          }

          {
            name = "invidious";
            engine = "invidious";
            base_url = [
              "https://invidious.demiurge.epistemia"
            ];
            shortcut = "iv";
            timeout = 3.0;
          }

          {
            name = "library genesis";
            engine = "xpath";
            search_url = "https://libgen.is/search.php?req={query}";
            url_xpath = "//a[contains(@href,\"book/index.php?md5\")]/@href";
            title_xpath = "//a[contains(@href,\"book/\")]/text()[1]";
            content_xpath = "//td/a[1][contains(@href,\"=author\")]/text()";
            categories = "files";
            timeout = 7.0;
            shortcut = "lg";
            about = {
              website = "https://libgen.fun/";
              wikidata_id = "Q22017206";
              official_api_documentation = "";
              use_official_api = false;
              require_api_key = false;
              results = "HTML";
            };
          }

          {
            name = "z-library";
            engine = "zlibrary";
            shortcut = "zlib";
            categories = "files";
            timeout = 7.0;
          }

          {
            name = "nyaa";
            engine = "nyaa";
            shortcut = "nt";
          }

          {
            name = "openlibrary";
            engine = "openlibrary";
            shortcut = "ol";
            timeout = 5;
          }

          {
            name = "stackoverflow";
            engine = "stackexchange";
            shortcut = "st";
            api_site = "stackoverflow";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "askubuntu";
            engine = "stackexchange";
            shortcut = "ubuntu";
            api_site = "askubuntu";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "superuser";
            engine = "stackexchange";
            shortcut = "su";
            api_site = "superuser";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "nixos.discourse";
            engine = "discourse";
            shortcut = "dnos";
            base_url = "https://discourse.nixos.org";
            categories = [
              "it"
              "q&a"
            ];
          }

          {
            name = "unsplash";
            engine = "unsplash";
            shortcut = "us";
          }

          {
            name = "wiby";
            engine = "json_engine";
            paging = true;
            weight = 0.5;
            search_url = "https://wiby.me/json/?q={query}&p={pageno}";
            url_query = "URL";
            title_query = "Title";
            content_query = "Snippet";
            categories = [
              "general"
              "web"
            ];
            shortcut = "wib";
            about.website = "https://wiby.me/";
          }

          {
            name = "wikibooks";
            engine = "mediawiki";
            weight = 0.5;
            shortcut = "wb";
            categories = [
              "general"
              "wikimedia"
            ];
            base_url = "https://{language}.wikibooks.org/";
            search_type = "text";
            about = {
              website = "https://www.wikibooks.org/";
              wikidata_id = "Q367";
            };
          }

          {
            name = "wiktionary";
            engine = "mediawiki";
            shortcut = "wt";
            categories = [
              "dictionaries"
              "wikimedia"
            ];
            base_url = "https://{language}.wiktionary.org/";
            search_type = "text";
            about = {
              website = "https://www.wiktionary.org/";
              wikidata_id = "Q151";
            };
          }

          {
            name = "wikiversity";
            engine = "mediawiki";
            weight = 0.5;
            shortcut = "wv";
            categories = [
              "general"
              "wikimedia"
            ];
            base_url = "https://{language}.wikiversity.org/";
            search_type = "text";
            about = {
              website = "https://www.wikiversity.org/";
              wikidata_id = "Q370";
            };
          }

          {
            name = "peertube";
            engine = "peertube";
            shortcut = "ptb";
            paging = true;
            # alternatives see = "https://instances.joinpeertube.org/instances
            # base_url = "https://tube.4aem.com
            categories = "videos";
            timeout = 6.0;
          }

          {
            name = "brave";
            engine = "brave";
            shortcut = "br";
            time_range_support = true;
            paging = true;
            categories = [
              "general"
              "web"
            ];
            brave_category = "search";
          }

          {
            name = "brave.images";
            engine = "brave";
            network = "brave";
            shortcut = "brimg";
            categories = [
              "images"
              "web"
            ];
            brave_category = "images";
          }

          {
            name = "sourcehut";
            shortcut = "srht";
            engine = "xpath";
            paging = true;
            search_url = "https://sr.ht/projects?page={pageno}&search={query}";
            results_xpath = "(//div[@class=\"event-list\"])[1]/div[@class=\"event\"]";
            url_xpath = "./h4/a[2]/@href";
            title_xpath = "./h4/a[2]";
            content_xpath = "./p";
            first_page_num = 1;
            categories = [
              "it"
              "repos"
            ];
            about = {
              website = "https://sr.ht";
              wikidata_id = "Q78514485";
              official_api_documentation = "https://man.sr.ht/";
              use_official_api = false;
              require_api_key = false;
              results = "HTML";
            };
          }
        ];

        doi_resolvers = {
          "oadoi.org" = "https://oadoi.org/";
          "doi.org" = "https://doi.org/";
          "sci-hub.se" = "https://sci-hub.se/";
          "sci-hub.st" = "https://sci-hub.st/";
          "sci-hub.ru" = "https://sci-hub.ru/";
        };

        default_doi_resolver = "sci-hub.st";
      };
    };

    # udev rules
    udev = {
      enable = true;
      extraRules = ''
        # Oculus Quest 2
        SUBSYSTEM=="usb", ATTR{idVendor}=="2833", ATTR{idProduct}=="0186", MODE="0660",
        GROUP="input", SYMLINK+="ocuquest%n"
      '';
    };

    # to get startx and use amdgpu driver
    # WM in home-manager
    xserver = {
      enable = true;
      autorun = false;
      displayManager.startx.enable = true;
      modules = [ pkgs.xf86_input_wacom ];
      videoDrivers = [ "amdgpu" ];
      wacom.enable = true;
    };
  };

  # extra systemd stuff
  systemd.services = {
    nginx.after = [ "tailscaled-autoconnect.service" ];
  };

  # create caches and use mandoc
  documentation.man = {
    enable = true;
    generateCaches = true;
    man-db.enable = false;
    mandoc.enable = true;
  };

  system.stateVersion = "24.05";
}