Inital commit ;P

14 files changed, 642 insertions, 0 deletions

diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
new file mode 100644
index 0000000..6bf1a22
--- /dev/null
+++ b/hosts/sagittarius/default.nix
@@ -0,0 +1,57 @@
+{ pkgs, ... }: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware.nix
+    ./home.nix
+    ./ssh.nix
+    ./web
+  ];
+
+  boot.loader.grub.device = "/dev/sda";
+  time.timeZone = "Europe/Helsinki";
+
+  networking = {
+    hostName = "sagittarius";
+    useNetworkd = true;
+    firewall.allowedTCPPorts = [ 22 ];
+  };
+  systemd.network = {
+    enable = true;
+    networks."10-wan" = {
+      matchConfig.Name = "enp1s0";
+      networkConfig.DHCP = "ipv4";
+      address = [ "2a01:4f9:c012:c7a7::/64" ];
+      routes = [{ routeConfig.Gateway = "fe80::1"; }];
+    };
+  };
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  users.users = {
+    ascella = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiDCf9LMx9diW5BveEju9w2Xv2kk7qKCyLESLyymzih ihp@ihp-laptop"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOsgD2+McS1+FFMKV9N620ta4DqHCYR1LqyoIR+AwU7 osiris@underworld"
+      ];
+    };
+  };
+
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}
diff --git a/hosts/sagittarius/hardware.nix b/hosts/sagittarius/hardware.nix
new file mode 100644
index 0000000..783b081
--- /dev/null
+++ b/hosts/sagittarius/hardware.nix
@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/34d333d4-2298-47c7-b015-5c3e2fd1a27e";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/hosts/sagittarius/home.nix b/hosts/sagittarius/home.nix
new file mode 100644
index 0000000..4c5999d
--- /dev/null
+++ b/hosts/sagittarius/home.nix
@@ -0,0 +1,23 @@
+{ home-manager, flakeRoot, ... }: {
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+  home-manager.users.ascella = {
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+
+    home.stateVersion = "23.05";
+  };
+
+  home-manager.users.root = {
+    programs.direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+    };
+
+    home.stateVersion = "23.05";
+  };
+}
diff --git a/hosts/sagittarius/ssh.nix b/hosts/sagittarius/ssh.nix
new file mode 100644
index 0000000..8c80a53
--- /dev/null
+++ b/hosts/sagittarius/ssh.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+      AllowUsers = [ "ascella" ];
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/acme.nix b/hosts/sagittarius/web/acme.nix
new file mode 100644
index 0000000..4cde574
--- /dev/null
+++ b/hosts/sagittarius/web/acme.nix
@@ -0,0 +1,10 @@
+{ ... }: {
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "miran.bastaja04@gmail.com";
+      dnsProvider = "porkbun";
+      credentialsFile = "/var/secrets/porkbun.env";
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
new file mode 100644
index 0000000..1226bd7
--- /dev/null
+++ b/hosts/sagittarius/web/blog.nix
@@ -0,0 +1,14 @@
+{ ... }: {
+  imports = [ ./acme.nix ];
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."sorre.xyz" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/blog";
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
new file mode 100644
index 0000000..3fc702e
--- /dev/null
+++ b/hosts/sagittarius/web/default.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+  imports = [
+    ./blog.nix
+    ./matrix.nix
+    ./mediadb.nix
+    # ./git.nix
+  ];
+}
diff --git a/hosts/sagittarius/web/git.nix b/hosts/sagittarius/web/git.nix
new file mode 100644
index 0000000..732f7d0
--- /dev/null
+++ b/hosts/sagittarius/web/git.nix
@@ -0,0 +1,8 @@
+{ ... }: {
+  services.gitDaemon = {
+    enable = true;
+    repositories = [ "/srv/git/" ];
+    exportAll = true;
+    basePath = "/srv/git/";
+  };
+}
diff --git a/hosts/sagittarius/web/matrix.nix b/hosts/sagittarius/web/matrix.nix
new file mode 100644
index 0000000..fc32044
--- /dev/null
+++ b/hosts/sagittarius/web/matrix.nix
@@ -0,0 +1,115 @@
+{ pkgs, config, ... }:
+let
+  server_name = "sorre.xyz";
+  matrix_hostname = "matrix.${server_name}";
+  #admin_email = "gloss_unranked088@simplelogin.com";
+
+  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
+  well_known_server = pkgs.writeText "well-known-matrix-server" ''
+    {
+      "m.server": "${matrix_hostname}"
+    }
+  '';
+
+  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
+  well_known_client = pkgs.writeText "well-known-matrix-client" ''
+    {
+      "m.homeserver": {
+        "base_url": "https://${matrix_hostname}"
+      }
+    }
+  '';
+in
+{
+  imports = [ ./acme.nix ];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+
+  services.matrix-conduit = {
+    enable = true;
+    # Currently conduit seems to have no substituter for the flake, which means
+    # that the compilation would be done on the server, therefore we're using
+    # the (prebuilt) nixpkgs version of it for now.
+    #package = inputs.conduit.packages.${pkgs.system}.default;
+    package = pkgs.matrix-conduit;
+    settings.global.server_name = server_name;
+    settings.global.allow_registration = false;
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+
+    virtualHosts."${matrix_hostname}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+        {
+          addr = "[::]";
+          port = 443;
+          ssl = true;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 8448;
+          ssl = true;
+        }
+        {
+          addr = "[::]";
+          port = 8448;
+          ssl = true;
+        }
+      ];
+      locations."/_matrix/" = {
+        proxyPass = "http://backend_conduit$request_uri";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_buffering off;
+        '';
+      };
+      extraConfig = ''
+        merge_slashes off;
+      '';
+    };
+
+    virtualHosts."${server_name}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations = {
+        "=/.well-known/matrix/server" = {
+          alias = "${well_known_server}";
+          extraConfig = ''
+            # Set the header since by default NGINX thinks it's just bytes
+            default_type application/json;
+          '';
+        };
+        "=/.well-known/matrix/client" = {
+          # Use the contents of the derivation built previously
+          alias = "${well_known_client}";
+
+          extraConfig = ''
+            # Set the header since by default NGINX thinks it's just bytes
+            default_type application/json;
+
+            # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
+            add_header Access-Control-Allow-Origin "*";
+          '';
+        };
+      };
+    };
+
+    upstreams."backend_conduit".servers = {
+      "[::1]:${toString config.services.matrix-conduit.settings.global.port}" =
+        { };
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/mediadb.nix b/hosts/sagittarius/web/mediadb.nix
new file mode 100644
index 0000000..78d76cd
--- /dev/null
+++ b/hosts/sagittarius/web/mediadb.nix
@@ -0,0 +1,19 @@
+{ pkgs, ... }: {
+  networking.firewall.allowedTCPPorts = [ 5432 ];
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_15_jit;
+    enableTCPIP = true;
+    enableJIT = true;
+
+    settings = { password_encryption = "scram-sha-256"; };
+
+    authentication = ''
+      # TYPE  DATABASE  USER        ADDRESS  METHOD
+      local   all       postgres             peer
+      host    all       postgres    all      reject
+      host    all       all         all      scram-sha-256
+    '';
+  }; # end of services.postgreslq
+}
diff --git a/hosts/wonderland/default.nix b/hosts/wonderland/default.nix
new file mode 100644
index 0000000..b78eb4e
--- /dev/null
+++ b/hosts/wonderland/default.nix
@@ -0,0 +1,149 @@
+{ config, pkgs, flakeRoot, ... }: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware.nix
+    ./home.nix
+    ./sops.nix
+    (flakeRoot + /share/system/steam.nix)
+    (flakeRoot + /share/system/hyprland.nix)
+    #(flakeRoot + /share/system/spotifyd.nix)
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+  nix.gc = {
+    dates = "weekly";
+    automatic = true;
+    persistent = true;
+    randomizedDelaySec = "15min";
+  };
+
+  # Use the systemd-boot EFI boot loader.
+  boot = {
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+    initrd.kernelModules = [ "amdgpu" ];
+  };
+
+  networking = {
+    hostName = "wonderland";
+    useNetworkd = true;
+
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 443 34197 ];
+    };
+
+    wireless = {
+      enable = true;
+      environmentFile = config.sops.secrets."wireless.env".path;
+      userControlled.enable = true;
+      networks = {
+        "@HOME_WIFI_SSID@".psk = "@HOME_WIFI_PSK@";
+        "@PHONE_HOTSPOT_SSID@" = {
+          psk = "@PHONE_HOTSPOT_PSK@";
+          hidden = true;
+        };
+        "eduroam" = {
+          authProtocols = [ "WPA-EAP" ];
+          auth = ''
+            pairwise=CCMP TKIP
+            eap=TTLS PEAP TLS
+            group=CCMP TKIP
+            identity="mbastaja@tvz.hr"
+            altsubject_match="DNS:freeradius.tvz.hr"
+            phase1="peaplabel=0"
+            phase2="auth=PAP"
+            password="@EDUROAM_PASS@"
+            anonymous_identity="anonymous@tvz.hr"
+          '';
+        };
+      };
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Zagreb";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  services.xserver = {
+    enable = true;
+    displayManager = {
+      sddm.enable = true;
+      defaultSession = "plasmawayland";
+    };
+    desktopManager.plasma5.enable = true;
+    videoDrivers = [ "amdgpu" ];
+  };
+
+  # Enable sound.
+  sound.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+  };
+
+  services.printing = {
+    enable = true;
+    drivers = with pkgs; [
+      gutenprint
+      gutenprintBin
+      epson_201207w
+      epson-201401w
+    ];
+  };
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  hardware.bluetooth.enable = true;
+  services.mullvad-vpn.enable = true;
+
+  virtualisation.podman = {
+    enable = true;
+    dockerSocket.enable = true;
+    dockerCompat = true;
+    autoPrune.enable = true;
+  };
+
+  users.users = {
+    alice = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" "video" "network" "podman" ];
+    };
+    madhatter = {
+      isNormalUser = true;
+      extraGroups = [ "video" "network" ];
+    };
+    guest = {
+      isNormalUser = true;
+      extraGroups = [ "video" "network" ];
+    };
+  };
+
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+
+  fonts.packages = with pkgs; [
+    noto-fonts
+    noto-fonts-cjk
+    noto-fonts-emoji
+    proggyfonts
+    (nerdfonts.override { fonts = [ "FiraCode" ]; })
+    overpass
+    inter
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+}
diff --git a/hosts/wonderland/hardware.nix b/hosts/wonderland/hardware.nix
new file mode 100644
index 0000000..a99d2a3
--- /dev/null
+++ b/hosts/wonderland/hardware.nix
@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/fc1a2a05-efb0-45e7-83f2-2b9dae515b0a";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/FEB7-A352";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/f16d9af0-4043-4d39-a8d6-e788451f8e9e"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/wonderland/home.nix b/hosts/wonderland/home.nix
new file mode 100644
index 0000000..c29420b
--- /dev/null
+++ b/hosts/wonderland/home.nix
@@ -0,0 +1,136 @@
+{ pkgs
+, flakeRoot
+, ...
+}:
+let
+  desktop-pkgs = with pkgs; [
+    mullvad-vpn
+    bitwarden
+    calibre
+    beekeeper-studio
+    thunderbird
+    brightnessctl
+
+    libsForQt5.plasma-browser-integration
+    libsForQt5.kdeconnect-kde
+    libsForQt5.ark
+    libsForQt5.kate
+    haruna # Video player
+    libreoffice-qt
+    gimp
+    audacity
+    discord
+    whatsapp-for-linux
+    inkscape
+
+    wineWowPackages.full
+    winetricks
+  ];
+in
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+  home-manager.users.alice = {
+    imports =
+      let
+        home = flakeRoot + /share/home;
+      in
+      [
+        # Custom home manager modules
+        (flakeRoot + /share/hm-modules/wpaperd.nix)
+
+        # Config
+        (home + /kitty.nix)
+        (home + /hyprland.nix)
+        (home + /git.nix)
+        (home + /firefox)
+        (home + /wezterm)
+      ];
+    home.packages = with pkgs;
+      [
+        signal-desktop
+        tdesktop # Telegram desktop
+        qbittorrent
+        okteta
+        emacs
+        # spotify-qt librespot
+        nheko # matrix client
+
+        # Various utils
+        # qemu_kvm
+        pijul # alternative vsc system
+        tokei # counts lines of code
+        dua # modern du with interactive mode (dua i)
+        btop # modern top
+
+        # Gaming
+        libsForQt5.kpat # solitare
+        jdk17_headless
+        superTuxKart
+
+        linux-wifi-hotspot
+        qemu_kvm
+      ]
+      ++ desktop-pkgs;
+
+    home.stateVersion = "22.05";
+
+    programs.gallery-dl = {
+      enable = true;
+      settings.extractor = {
+        base-directory = "$XDG_DOWNLOAD_DIR/gallery-dl";
+
+        postprocessors = [
+          {
+            name = "metadata";
+            mode = "json";
+            whitelist = [
+              "danbooru"
+              "moebooru"
+              "gelbooru"
+              "sankaku"
+              "nhentai"
+              "rule34"
+            ];
+          }
+          {
+            name = "zip";
+            compression = "store";
+            extension = "cbz";
+            filter = "extension not in ('zip', 'rar')";
+            whitelist = [ "nhentai" "mangadex" ];
+          }
+        ];
+
+        Danbooru.metadata = true;
+      }; # End of settings.extractor
+    }; # End of programs.gallery-dl
+  }; # End of users.alice
+
+  home-manager.users.madhatter = {
+    home.packages = desktop-pkgs;
+    imports =
+      let
+        home = flakeRoot + /share/home;
+      in
+      [
+        # Config
+        (home + /kitty.nix)
+        (home + /git.nix)
+        (home + /firefox)
+      ];
+
+    home.stateVersion = "23.05";
+  };
+
+  home-manager.users.root = {
+    home.packages = with pkgs; [
+      linux-wifi-hotspot
+      dua # modern du with interactive mode (dua i)
+    ];
+
+    home.stateVersion = "22.05";
+  };
+}
diff --git a/hosts/wonderland/sops.nix b/hosts/wonderland/sops.nix
new file mode 100644
index 0000000..0ac9d3d
--- /dev/null
+++ b/hosts/wonderland/sops.nix
@@ -0,0 +1,23 @@
+{ ... }: {
+  sops = {
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    defaultSopsFile = ../../secrets/credentials.json;
+    secrets = {
+      # FIXME: using mode 444 here is a hack so that spotifyd can cat the
+      # values out, but it obviously exposes the secrets to anyone that knows
+      # they are there. A better solution would be to override the spotifyd
+      # module to make the systemd service run the program with a group, and
+      # then give read priviledges to only that group.
+      #      "spotify/password" = {
+      #        mode = "444";
+      #      };
+      #      "spotify/username" = {
+      #        mode = "444";
+      #      };
+      "wireless.env" = {
+        sopsFile = ../../secrets/wireless.env;
+        format = "dotenv";
+      };
+    };
+  }; # end of sops
+}