aboutsummaryrefslogtreecommitdiff
path: root/hosts/wonderland
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/wonderland')
-rw-r--r--hosts/wonderland/default.nix149
-rw-r--r--hosts/wonderland/hardware.nix39
-rw-r--r--hosts/wonderland/home.nix136
-rw-r--r--hosts/wonderland/sops.nix23
4 files changed, 347 insertions, 0 deletions
diff --git a/hosts/wonderland/default.nix b/hosts/wonderland/default.nix
new file mode 100644
index 0000000..b78eb4e
--- /dev/null
+++ b/hosts/wonderland/default.nix
@@ -0,0 +1,149 @@
+{ config, pkgs, flakeRoot, ... }: {
+ imports = [
+ # Include the results of the hardware scan.
+ ./hardware.nix
+ ./home.nix
+ ./sops.nix
+ (flakeRoot + /share/system/steam.nix)
+ (flakeRoot + /share/system/hyprland.nix)
+ #(flakeRoot + /share/system/spotifyd.nix)
+ ];
+
+ nixpkgs.config.allowUnfree = true;
+ nix.gc = {
+ dates = "weekly";
+ automatic = true;
+ persistent = true;
+ randomizedDelaySec = "15min";
+ };
+
+ # Use the systemd-boot EFI boot loader.
+ boot = {
+ loader.systemd-boot.enable = true;
+ loader.efi.canTouchEfiVariables = true;
+ initrd.kernelModules = [ "amdgpu" ];
+ };
+
+ networking = {
+ hostName = "wonderland";
+ useNetworkd = true;
+
+ nftables.enable = true;
+ firewall = {
+ enable = true;
+ allowedTCPPorts = [ 80 443 34197 ];
+ };
+
+ wireless = {
+ enable = true;
+ environmentFile = config.sops.secrets."wireless.env".path;
+ userControlled.enable = true;
+ networks = {
+ "@HOME_WIFI_SSID@".psk = "@HOME_WIFI_PSK@";
+ "@PHONE_HOTSPOT_SSID@" = {
+ psk = "@PHONE_HOTSPOT_PSK@";
+ hidden = true;
+ };
+ "eduroam" = {
+ authProtocols = [ "WPA-EAP" ];
+ auth = ''
+ pairwise=CCMP TKIP
+ eap=TTLS PEAP TLS
+ group=CCMP TKIP
+ identity="mbastaja@tvz.hr"
+ altsubject_match="DNS:freeradius.tvz.hr"
+ phase1="peaplabel=0"
+ phase2="auth=PAP"
+ password="@EDUROAM_PASS@"
+ anonymous_identity="anonymous@tvz.hr"
+ '';
+ };
+ };
+ };
+ };
+
+ # Set your time zone.
+ time.timeZone = "Europe/Zagreb";
+
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+
+ services.xserver = {
+ enable = true;
+ displayManager = {
+ sddm.enable = true;
+ defaultSession = "plasmawayland";
+ };
+ desktopManager.plasma5.enable = true;
+ videoDrivers = [ "amdgpu" ];
+ };
+
+ # Enable sound.
+ sound.enable = true;
+ services.pipewire = {
+ enable = true;
+ alsa.enable = true;
+ pulse.enable = true;
+ };
+
+ services.printing = {
+ enable = true;
+ drivers = with pkgs; [
+ gutenprint
+ gutenprintBin
+ epson_201207w
+ epson-201401w
+ ];
+ };
+
+ programs.gnupg.agent = {
+ enable = true;
+ enableSSHSupport = true;
+ };
+
+ hardware.bluetooth.enable = true;
+ services.mullvad-vpn.enable = true;
+
+ virtualisation.podman = {
+ enable = true;
+ dockerSocket.enable = true;
+ dockerCompat = true;
+ autoPrune.enable = true;
+ };
+
+ users.users = {
+ alice = {
+ isNormalUser = true;
+ extraGroups = [ "wheel" "video" "network" "podman" ];
+ };
+ madhatter = {
+ isNormalUser = true;
+ extraGroups = [ "video" "network" ];
+ };
+ guest = {
+ isNormalUser = true;
+ extraGroups = [ "video" "network" ];
+ };
+ };
+
+ programs.zsh.enable = true;
+ users.defaultUserShell = pkgs.zsh;
+
+ fonts.packages = with pkgs; [
+ noto-fonts
+ noto-fonts-cjk
+ noto-fonts-emoji
+ proggyfonts
+ (nerdfonts.override { fonts = [ "FiraCode" ]; })
+ overpass
+ inter
+ ];
+
+ # This value determines the NixOS release from which the default
+ # settings for stateful data, like file locations and database versions
+ # on your system were taken. It‘s perfectly fine and recommended to leave
+ # this value at the release version of the first install of this system.
+ # Before changing this value read the documentation for this option
+ # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+ system.stateVersion = "22.05"; # Did you read the comment?
+}
diff --git a/hosts/wonderland/hardware.nix b/hosts/wonderland/hardware.nix
new file mode 100644
index 0000000..a99d2a3
--- /dev/null
+++ b/hosts/wonderland/hardware.nix
@@ -0,0 +1,39 @@
+# Do not modify this file! It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations. Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+ imports =
+ [ (modulesPath + "/installer/scan/not-detected.nix")
+ ];
+
+ boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod" ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ "kvm-amd" ];
+ boot.extraModulePackages = [ ];
+
+ fileSystems."/" =
+ { device = "/dev/disk/by-uuid/fc1a2a05-efb0-45e7-83f2-2b9dae515b0a";
+ fsType = "ext4";
+ };
+
+ fileSystems."/boot" =
+ { device = "/dev/disk/by-uuid/FEB7-A352";
+ fsType = "vfat";
+ };
+
+ swapDevices =
+ [ { device = "/dev/disk/by-uuid/f16d9af0-4043-4d39-a8d6-e788451f8e9e"; }
+ ];
+
+ # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+ # (the default) this is the recommended approach. When using systemd-networkd it's
+ # still possible to use this option, but it's recommended to use it in conjunction
+ # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+ networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+ # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+ hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/wonderland/home.nix b/hosts/wonderland/home.nix
new file mode 100644
index 0000000..c29420b
--- /dev/null
+++ b/hosts/wonderland/home.nix
@@ -0,0 +1,136 @@
+{ pkgs
+, flakeRoot
+, ...
+}:
+let
+ desktop-pkgs = with pkgs; [
+ mullvad-vpn
+ bitwarden
+ calibre
+ beekeeper-studio
+ thunderbird
+ brightnessctl
+
+ libsForQt5.plasma-browser-integration
+ libsForQt5.kdeconnect-kde
+ libsForQt5.ark
+ libsForQt5.kate
+ haruna # Video player
+ libreoffice-qt
+ gimp
+ audacity
+ discord
+ whatsapp-for-linux
+ inkscape
+
+ wineWowPackages.full
+ winetricks
+ ];
+in
+{
+ home-manager.useGlobalPkgs = true;
+ home-manager.useUserPackages = true;
+ home-manager.sharedModules = [{ imports = [ (flakeRoot + /share/home) ]; }];
+
+ home-manager.users.alice = {
+ imports =
+ let
+ home = flakeRoot + /share/home;
+ in
+ [
+ # Custom home manager modules
+ (flakeRoot + /share/hm-modules/wpaperd.nix)
+
+ # Config
+ (home + /kitty.nix)
+ (home + /hyprland.nix)
+ (home + /git.nix)
+ (home + /firefox)
+ (home + /wezterm)
+ ];
+ home.packages = with pkgs;
+ [
+ signal-desktop
+ tdesktop # Telegram desktop
+ qbittorrent
+ okteta
+ emacs
+ # spotify-qt librespot
+ nheko # matrix client
+
+ # Various utils
+ # qemu_kvm
+ pijul # alternative vsc system
+ tokei # counts lines of code
+ dua # modern du with interactive mode (dua i)
+ btop # modern top
+
+ # Gaming
+ libsForQt5.kpat # solitare
+ jdk17_headless
+ superTuxKart
+
+ linux-wifi-hotspot
+ qemu_kvm
+ ]
+ ++ desktop-pkgs;
+
+ home.stateVersion = "22.05";
+
+ programs.gallery-dl = {
+ enable = true;
+ settings.extractor = {
+ base-directory = "$XDG_DOWNLOAD_DIR/gallery-dl";
+
+ postprocessors = [
+ {
+ name = "metadata";
+ mode = "json";
+ whitelist = [
+ "danbooru"
+ "moebooru"
+ "gelbooru"
+ "sankaku"
+ "nhentai"
+ "rule34"
+ ];
+ }
+ {
+ name = "zip";
+ compression = "store";
+ extension = "cbz";
+ filter = "extension not in ('zip', 'rar')";
+ whitelist = [ "nhentai" "mangadex" ];
+ }
+ ];
+
+ Danbooru.metadata = true;
+ }; # End of settings.extractor
+ }; # End of programs.gallery-dl
+ }; # End of users.alice
+
+ home-manager.users.madhatter = {
+ home.packages = desktop-pkgs;
+ imports =
+ let
+ home = flakeRoot + /share/home;
+ in
+ [
+ # Config
+ (home + /kitty.nix)
+ (home + /git.nix)
+ (home + /firefox)
+ ];
+
+ home.stateVersion = "23.05";
+ };
+
+ home-manager.users.root = {
+ home.packages = with pkgs; [
+ linux-wifi-hotspot
+ dua # modern du with interactive mode (dua i)
+ ];
+
+ home.stateVersion = "22.05";
+ };
+}
diff --git a/hosts/wonderland/sops.nix b/hosts/wonderland/sops.nix
new file mode 100644
index 0000000..0ac9d3d
--- /dev/null
+++ b/hosts/wonderland/sops.nix
@@ -0,0 +1,23 @@
+{ ... }: {
+ sops = {
+ age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+ defaultSopsFile = ../../secrets/credentials.json;
+ secrets = {
+ # FIXME: using mode 444 here is a hack so that spotifyd can cat the
+ # values out, but it obviously exposes the secrets to anyone that knows
+ # they are there. A better solution would be to override the spotifyd
+ # module to make the systemd service run the program with a group, and
+ # then give read priviledges to only that group.
+ # "spotify/password" = {
+ # mode = "444";
+ # };
+ # "spotify/username" = {
+ # mode = "444";
+ # };
+ "wireless.env" = {
+ sopsFile = ../../secrets/wireless.env;
+ format = "dotenv";
+ };
+ };
+ }; # end of sops
+}
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-27 13:46:37 +0000