Move some stuff to modules

nixos/default.nix

@@ -0,0 +1,168 @@
+{ pkgs, config, lib, inputs, flake, system, ... }: {
+  imports = [
+    inputs.home-manager.nixosModules.home-manager
+    ./lanzaboote.nix
+    ./tidal.nix
+    ./sops.nix
+    ./stylix.nix
+    ./wireguard.nix
+    ./gnome.nix
+    ./tailscale.nix
+  ];
+
+  time.timeZone = "Europe/Amsterdam";
+  i18n.defaultLocale = "en_US.UTF-8";
+  programs.ssh.startAgent = true;
+
+  services = {
+    gnome.gnome-keyring.enable = lib.mkForce false;
+
+    xserver = {
+      enable = true;
+      displayManager.gdm = { enable = true; };
+      excludePackages = with pkgs; [ xterm ];
+    };
+
+    printing = {
+      enable = true;
+      drivers = [ pkgs.hplip pkgs.gutenprint ];
+    };
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      jack.enable = true;
+    };
+  };
+
+  users = {
+    users.pim = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" "docker" "input" "wireshark" "dialout" ];
+    };
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      age
+      borgbackup
+      btop
+      btrfs-progs
+      curl
+      dig
+      exfat
+      f3
+      fastfetch
+      file
+      git
+      jq
+      kubectl
+      nmap
+      poppler_utils # For pdfunite
+      ripgrep
+      sbctl
+      silicon
+      tree
+      units
+      vim
+      wget
+      yq
+      ncdu
+      lshw
+    ];
+  };
+
+  system = {
+    stateVersion = "23.05";
+
+    activationScripts.diff = ''
+      if [[ -e  /run/current-system ]]; then
+        ${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
+      fi
+    '';
+  };
+
+  security = {
+    rtkit.enable = true;
+
+    sudo.extraConfig = ''
+      Defaults        timestamp_timeout=30
+    '';
+  };
+
+  nix = {
+    package = pkgs.nixFlakes;
+    settings.trusted-users = [ "root" "pim" ];
+
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+
+    gc = {
+      automatic = true;
+      persistent = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  networking.useDHCP = lib.mkDefault true;
+
+  virtualisation.docker = {
+    enable = true;
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+  };
+
+  nixpkgs = {
+    hostPlatform = lib.mkDefault "x86_64-linux";
+
+    config = {
+      allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+        "libfprint-2-tod1-goodix"
+      ];
+    };
+
+    overlays = [
+      inputs.nur.overlay
+      (final: _prev: {
+        unstable = import inputs.nixpkgs-unstable {
+          inherit system;
+          config.allowUnfree = true;
+        };
+      })
+    ];
+  };
+
+  boot = {
+    kernelModules = [ "kvm-intel" "cdrom" ];
+    extraModulePackages = [ ];
+
+    initrd = {
+      availableKernelModules = [ "sd_mod" ];
+      kernelModules = [ ];
+    };
+
+    kernel.sysctl = {
+      "net.core.default_qdisc" = "fq";
+      "net.ipv4.tcp_congestion_control" = "bbr";
+    };
+  };
+
+  hardware = {
+    cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+    pulseaudio.enable = false;
+  };
+
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    extraSpecialArgs = { inherit flake inputs; };
+
+    users.pim.imports = [ "${flake}/home-manager" ];
+  };
+}

nixos/gnome.nix

@@ -0,0 +1,34 @@
+{ pkgs, ... }: {
+  services.xserver.desktopManager.gnome.enable = true;
+
+  environment = {
+    systemPackages = [
+      pkgs.gnome.gnome-shell-extensions
+    ] ++ (with pkgs.gnomeExtensions; [
+      pop-shell
+      window-is-ready-remover
+      random-wallpaper
+      workspaces-indicator-by-open-apps
+    ]);
+
+    gnome.excludePackages = (with pkgs; [
+      epiphany
+      gnome-connections
+      gnome-console
+      gnome-tour
+    ]) ++ (with pkgs.gnome; [
+      geary
+      gnome-calendar
+      gnome-clocks
+      gnome-contacts
+      gnome-font-viewer
+      gnome-logs
+      gnome-maps
+      gnome-music
+      seahorse
+      totem
+      yelp
+      gnome-weather
+    ]);
+  };
+}

nixos/lanzaboote.nix

@@ -0,0 +1,36 @@
+{ config, lib, inputs, ... }: {
+  imports = [
+    inputs.lanzaboote.nixosModules.lanzaboote
+  ];
+
+  options = {
+    pim.lanzaboote.enable = lib.mkEnableOption {
+      description = ''
+        Whether to enable lanzaboote
+      '';
+    };
+  };
+
+  config = lib.mkIf config.pim.lanzaboote.enable {
+    boot = {
+      # generate keys first with: `sudo nix run nixpkgs#sbctl create-keys`
+      # switch from lzb to bootspec by adding following line to the system configuration:
+      # bootspec.enable = true;
+
+      loader = {
+        systemd-boot.enable = lib.mkForce false;
+        # Use lanzaboote instead see below, default is:
+        # systemd-boot.enable = true;
+
+        efi = {
+          canTouchEfiVariables = true;
+        };
+      };
+
+      lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+      };
+    };
+  };
+}

nixos/sops.nix

@@ -0,0 +1,10 @@
+{ inputs, pkgs, flake, ... }: {
+  imports = [ inputs.sops-nix.nixosModules.sops ];
+
+  environment.systemPackages = with pkgs; [ sops ];
+
+  sops = {
+    age.keyFile = "/home/pim/.config/sops/age/keys.txt";
+    defaultSopsFile = "${flake}/secrets/secrets.yaml";
+  };
+}

nixos/stylix.nix

@@ -0,0 +1,32 @@
+{ pkgs, inputs, ... }: {
+  imports = [ inputs.stylix.nixosModules.stylix ];
+
+  stylix = {
+    enable = true;
+    base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-dark-medium.yaml";
+    image = "${inputs.nixos-artwork}/wallpapers/nix-wallpaper-binary-blue.png";
+
+    cursor = {
+      package = pkgs.bibata-cursors;
+      name = "Bibata-Modern-Classic";
+      size = 28;
+    };
+
+    fonts = {
+      monospace = {
+        package = pkgs.nerdfonts.override { fonts = [ "JetBrainsMono" ]; };
+        name = "JetBrainsMono Nerd Font Mono";
+      };
+
+      sansSerif = {
+        package = pkgs.dejavu_fonts;
+        name = "DejaVu Sans";
+      };
+
+      serif = {
+        package = pkgs.dejavu_fonts;
+        name = "DejaVu Serif";
+      };
+    };
+  };
+}

nixos/tailscale.nix

@@ -0,0 +1,10 @@
+{pkgs, ...}: {
+  environment.systemPackages = [ pkgs.gnomeExtensions.tailscale-status ];
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+
+  networking.networkmanager.unmanaged = [ "tailscale0" ];
+}

nixos/tidal.nix

@@ -0,0 +1,3 @@
+{ ... }: {
+  users.users.pim.extraGroups = ["audio"];
+}

nixos/wireguard.nix

@@ -0,0 +1,41 @@
+{ lib, config, ... }: {
+  networking = {
+    useDHCP = lib.mkDefault true;
+    networkmanager.unmanaged = [ "tailscale0" ];
+
+    wg-quick.interfaces = {
+      home = {
+        privateKeyFile = config.sops.secrets."wireguard/home/privateKey".path;
+        address = [ "10.225.191.4/24" ];
+        dns = [ "192.168.30.131" ];
+        autostart = false;
+        mtu = 1412;
+        peers = [{
+          presharedKeyFile = config.sops.secrets."wireguard/home/presharedKey".path;
+          endpoint = "wg.kun.is:51820";
+          publicKey = "fa3mQ7ximJbH7cu2ZbWidto5xBGxEEfWvCCiUDk00Hg=";
+          allowedIPs = [ "0.0.0.0/0" ];
+        }];
+      };
+
+      home-no-pihole = {
+        privateKeyFile = config.sops.secrets."wireguard/home/privateKey".path;
+        address = [ "10.225.191.4/24" ];
+        dns = [ "192.168.10.1" ];
+        autostart = false;
+        mtu = 1412;
+        peers = [{
+          presharedKeyFile = config.sops.secrets."wireguard/home/presharedKey".path;
+          endpoint = "wg.kun.is:51820";
+          publicKey = "fa3mQ7ximJbH7cu2ZbWidto5xBGxEEfWvCCiUDk00Hg=";
+          allowedIPs = [ "0.0.0.0/0" ];
+        }];
+      };
+    };
+  };
+
+  sops.secrets = {
+    "wireguard/home/presharedKey" = { };
+    "wireguard/home/privateKey" = { };
+  };
+}