path: root/hosts/hastur/default.nix

# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).

{
  config,
  home-manager,
  lib,
  pkgs,
  inputs,
  ...
}:

{
  imports = [
    ./hardware.nix
    home-manager.nixosModules.default
  ];

  # decrypt agenix secrets
  age.secrets = {
    tailscale_hastur = {
      file = ../../secrets/tailscale_hastur.age;
      owner = "root";
      group = "root";
    };
  };

  # boot options
  boot.loader.grub = {
    enable = true;
    zfsSupport = true;
    efiSupport = true;
    efiInstallAsRemovable = true;
    mirroredBoots = [
      {
        devices = [ "nodev" ];
        path = "/boot";
      }
    ];
  };

  # disable wifi and open some ports
  networking = {
    hostName = "hastur";
    hostId = "deadcafe";

    wireless = {
      enable = true;

      networks = {
        OpenDyna.pskRaw = "***REDACTED_PSK***";

        FloridaPoly = {
          authProtocols = [ "WPA-EAP" ];
          auth = ''
            eap=PEAP
            phase2="auth=MSCHAPv2"
            identity="***REDACTED_EMAIL***"
            password="***REDACTED_PASSWORD***"
          '';
        };

        USF-Guest = { };

        iphonebob.pskRaw = "***REDACTED_PSK***";
        Retreat_86WiFi.pskRaw = "***REDACTED_PSK***";
        Orbi-1.pskRaw = "***REDACTED_PSK***";
        SETUP-E55E.pskRaw = "***REDACTED_PSK***";
      };
    };

    firewall = {
      #      allowedTCPPorts = [ ];
      #      allowedUDPPorts = [ ];
    };

    # mullvad to miami
    wg-quick.interfaces.us-mia-wg-001 = {
      address = [
        "10.70.235.16/32"
        "fc00:bbbb:bbbb:bb01::7:eb0f/128"
      ];
      privateKey = "***REDACTED_WG_KEY***=";

      # supposed to be done by tailscale instead \_(:/)_/
      postUp = ''
        ip route add 100.64.0.0/24 dev tailscale0
        ip route add 100.100.100.100/32 dev tailscale0
      '';
      postDown = ''
        ip route del 100.64.0.0/24 dev tailscale0
        ip route del 100.100.100.100/32 dev tailscale0
      '';

      peers = [
        {
          allowedIPs = [
            "0.0.0.0/0"
            "::0/0"
          ];
          endpoint = "45.134.142.219:51820";
          publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
        }
      ];
    };
  };

  # Set your time zone.
  time.timeZone = "America/Toronto";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
  };

  # enable flakes and nix cli
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  # Define a user account.
  users.users.vin = {
    isNormalUser = true;

    extraGroups = [
      "kvm"
      "libvirtd"
      "transmission"
      "wheel"
    ];

    shell = pkgs.zsh;

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
    ];
  };

  # default packages for both me and root
  environment = {
    systemPackages = with pkgs; [
      distrobox
      doas-sudo-shim
      git
      wget
    ];

    pathsToLink = [ "/share/zsh" ];
  };

  # enable bluetooth and add some udev rules
  hardware = {
    bluetooth.enable = true;
    flipperzero.enable = true;
    keyboard.qmk.enable = true;
  };

  programs = {
    # for gtk in home-manager
    dconf.enable = true;

    # gpg
    gnupg.agent = {
      enable = true;
      enableSSHSupport = false;
      pinentryPackage = pkgs.pinentry-rofi;
      settings.default-cache-ttl = 600;
    };

    # disable nano. I don't like nano.
    nano.enable = false;

    # configuration in home-manager
    zsh.enable = true;
  };

  security = {
    # I prefer doas over sudo for simplicity
    doas = {
      enable = true;
      extraRules = [
        {
          users = [ "vin" ];
          keepEnv = true;
          persist = true;
        }
      ];
    };

    pki.certificates = [
      ''
        -----BEGIN CERTIFICATE-----
        MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
        MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
        MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
        ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
        AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
        E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
        HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
        BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
        LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
        -----END CERTIFICATE-----
      ''
    ];

    sudo.enable = false;
  };

  services = {
    # dns
    dnsmasq = {
      enable = true;
      settings = {
        server = [
          "/epistemia/100.100.100.100"
          "9.9.9.9"
        ];

        interface = "lo";
        listen-address = "127.0.0.1";
        bind-interfaces = true;
        no-resolv = true;
      };
    };

    # graphical input
    libinput = {
      enable = true;

      mouse.accelProfile = "flat";

      touchpad = {
        accelProfile = "flat";
        tapping = true;
        tappingButtonMap = "lrm";
      };
    };

    # ssh
    openssh = {
      enable = true;

      settings = {
        KbdInteractiveAuthentication = false;
        PasswordAuthentication = false;
        PermitRootLogin = "no";
        X11Forwarding = true;
      };
    };

    # for yubikey
    pcscd.enable = true;

    # sound. for some reason, pipewire enabled itself when I tried
    # using pulseaudio and home-manager, so had to disable pulseaudio.
    pipewire = {
      enable = true;
      pulse.enable = true;
    };

    # vpn
    tailscale = {
      enable = true;
      authKeyFile = config.age.secrets.tailscale_hastur.path;
      extraDaemonFlags = [ "--no-logs-no-support" ];
      extraUpFlags = [
        "--login-server=https://headscale.13f0.net"
        "--advertise-exit-node"
      ];
      openFirewall = true;
    };

    # enable better power management
    tlp.enable = true;

    # udev rules
    udev = {
      enable = true;
      extraRules = ''
        # ST-Link v2.1
        SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666"
      '';
    };

    # to get startx and use amdgpu driver
    # WM in home-manager
    xserver = {
      enable = true;
      autorun = false;
      displayManager.startx.enable = true;
      videoDrivers = [ "modesetting" ];
    };
  };

  # create caches and use mandoc
  documentation.man = {
    enable = true;
    generateCaches = true;
    man-db.enable = false;
    mandoc.enable = true;
  };

  # virtualization stuff
  virtualisation.podman = {
    enable = true;
    dockerCompat = true;
  };

  system.stateVersion = "24.05";
}