Inital commit ;P

4 files changed, 347 insertions, 0 deletions

diff --git a/hosts/wonderland/default.nix b/hosts/wonderland/default.nix
new file mode 100644
index 0000000..b78eb4e
--- /dev/null
+++ b/hosts/wonderland/default.nix
@@ -0,0 +1,149 @@
+{ config, pkgs, flakeRoot, ... }: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware.nix
+    ./home.nix
+    ./sops.nix
+    (flakeRoot + /share/system/steam.nix)
+    (flakeRoot + /share/system/hyprland.nix)
+    #(flakeRoot + /share/system/spotifyd.nix)
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+  nix.gc = {
+    dates = "weekly";
+    automatic = true;
+    persistent = true;
+    randomizedDelaySec = "15min";
+  };
+
+  # Use the systemd-boot EFI boot loader.
+  boot = {
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+    initrd.kernelModules = [ "amdgpu" ];
+  };
+
+  networking = {
+    hostName = "wonderland";
+    useNetworkd = true;
+
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 34197 ];
+    };
+
+    wireless = {
+      enable = true;
+      environmentFile = config.sops.secrets."wireless.env".path;
+      userControlled.enable = true;
+      networks = {
+        "@HOME_WIFI_SSID@".psk = "@HOME_WIFI_PSK@";
+        "@PHONE_HOTSPOT_SSID@" = {
+          psk = "@PHONE_HOTSPOT_PSK@";
+          hidden = true;
+        };
+        "eduroam" = {
+          authProtocols = [ "WPA-EAP" ];
+          auth = ''
+            pairwise=CCMP TKIP
+            eap=TTLS PEAP TLS
+            group=CCMP TKIP
+            identity="mbastaja@tvz.hr"
+            altsubject_match="DNS:freeradius.tvz.hr"
+            phase1="peaplabel=0"
+            phase2="auth=PAP"
+            password="@EDUROAM_PASS@"
+            anonymous_identity="anonymous@tvz.hr"
+          '';
+        };
+      };
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Zagreb";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  services.xserver = {
+    enable = true;
+    displayManager = {
+      sddm.enable = true;
+      defaultSession = "plasmawayland";
+    };
+    desktopManager.plasma5.enable = true;
+    videoDrivers = [ "amdgpu" ];
+  };
+
+  # Enable sound.
+  sound.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  services.printing = {
+    enable = true;
+    drivers = with pkgs; [
+      gutenprint
+      gutenprintBin
+      epson_201207w
+      epson-201401w
+    ];
+  };
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  hardware.bluetooth.enable = true;
+  services.mullvad-vpn.enable = true;
+
+  virtualisation.podman = {
+    enable = true;
+    dockerSocket.enable = true;
+    dockerCompat = true;
+    autoPrune.enable = true;
+  };
+
+  users.users = {
+    alice = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" "video" "network" "podman" ];
+    };
+    madhatter = {
+      isNormalUser = true;
+      extraGroups = [ "video" "network" ];
+    };
+    guest = {
+      isNormalUser = true;
+      extraGroups = [ "video" "network" ];
+    };
+  };
+
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+
+  fonts.packages = with pkgs; [
+    noto-fonts
+    noto-fonts-cjk
+    noto-fonts-emoji
+    proggyfonts
+    (nerdfonts.override { fonts = [ "FiraCode" ]; })
+    overpass
+    inter
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+}
diff --git a/hosts/wonderland/hardware.nix b/hosts/wonderland/hardware.nix
new file mode 100644
index 0000000..a99d2a3
--- /dev/null
+++ b/hosts/wonderland/hardware.nix
@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/fc1a2a05-efb0-45e7-83f2-2b9dae515b0a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/FEB7-A352";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/f16d9af0-4043-4d39-a8d6-e788451f8e9e"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/wonderland/home.nix b/hosts/wonderland/home.nix
new file mode 100644
index 0000000..c29420b
--- /dev/null
+++ b/hosts/wonderland/home.nix
@@ -0,0 +1,136 @@
+{ pkgs
+, flakeRoot
+, ...
+}:
+let
+  desktop-pkgs = with pkgs; [
+    mullvad-vpn
+    bitwarden
+    calibre
+    beekeeper-studio
+    thunderbird
+    brightnessctl
+
+    libsForQt5.plasma-browser-integration
+    libsForQt5.kdeconnect-kde
+    libsForQt5.ark
+    libsForQt5.kate
+    haruna # Video player
+    libreoffice-qt
+    gimp
+    audacity
+    discord
+    whatsapp-for-linux
+    inkscape
+
+    wineWowPackages.full
+    winetricks
+  ];
+in
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+  home-manager.users.alice = {
+    imports =
+      let
+        home = flakeRoot + /share/home;
+      in
+      [
+        # Custom home manager modules
+        (flakeRoot + /share/hm-modules/wpaperd.nix)
+
+        # Config
+        (home + /kitty.nix)
+        (home + /hyprland.nix)
+        (home + /git.nix)
+        (home + /firefox)
+        (home + /wezterm)
+      ];
+    home.packages = with pkgs;
+      [
+        signal-desktop
+        tdesktop # Telegram desktop
+        qbittorrent
+        okteta
+        emacs
+        # spotify-qt librespot
+        nheko # matrix client
+
+        # Various utils
+        # qemu_kvm
+        pijul # alternative vsc system
+        tokei # counts lines of code
+        dua # modern du with interactive mode (dua i)
+        btop # modern top
+
+        # Gaming
+        libsForQt5.kpat # solitare
+        jdk17_headless
+        superTuxKart
+
+        linux-wifi-hotspot
+        qemu_kvm
+      ]
+      ++ desktop-pkgs;
+
+    home.stateVersion = "22.05";
+
+    programs.gallery-dl = {
+      enable = true;
+      settings.extractor = {
+        base-directory = "$XDG_DOWNLOAD_DIR/gallery-dl";
+
+        postprocessors = [
+          {
+            name = "metadata";
+            mode = "json";
+            whitelist = [
+              "danbooru"
+              "moebooru"
+              "gelbooru"
+              "sankaku"
+              "nhentai"
+              "rule34"
+            ];
+          }
+          {
+            name = "zip";
+            compression = "store";
+            extension = "cbz";
+            filter = "extension not in ('zip', 'rar')";
+            whitelist = [ "nhentai" "mangadex" ];
+          }
+        ];
+
+        Danbooru.metadata = true;
+      }; # End of settings.extractor
+    }; # End of programs.gallery-dl
+  }; # End of users.alice
+
+  home-manager.users.madhatter = {
+    home.packages = desktop-pkgs;
+    imports =
+      let
+        home = flakeRoot + /share/home;
+      in
+      [
+        # Config
+        (home + /kitty.nix)
+        (home + /git.nix)
+        (home + /firefox)
+      ];
+
+    home.stateVersion = "23.05";
+  };
+
+  home-manager.users.root = {
+    home.packages = with pkgs; [
+      linux-wifi-hotspot
+      dua # modern du with interactive mode (dua i)
+    ];
+
+    home.stateVersion = "22.05";
+  };
+}
diff --git a/hosts/wonderland/sops.nix b/hosts/wonderland/sops.nix
new file mode 100644
index 0000000..0ac9d3d
--- /dev/null
+++ b/hosts/wonderland/sops.nix
@@ -0,0 +1,23 @@
+{ ... }: {
+  sops = {
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    defaultSopsFile = ../../secrets/credentials.json;
+    secrets = {
+      # FIXME: using mode 444 here is a hack so that spotifyd can cat the
+      # values out, but it obviously exposes the secrets to anyone that knows
+      # they are there. A better solution would be to override the spotifyd
+      # module to make the systemd service run the program with a group, and
+      # then give read priviledges to only that group.
+      #      "spotify/password" = {
+      #        mode = "444";
+      #      };
+      #      "spotify/username" = {
+      #        mode = "444";
+      #      };
+      "wireless.env" = {
+        sopsFile = ../../secrets/wireless.env;
+        format = "dotenv";
+      };
+    };
+  }; # end of sops
+}