init

system/machines/desktop/README.md

@@ -0,0 +1,19 @@
+## Hardware
+
+| Component   | Model                              |
+|-------------|------------------------------------|
+| Motherboard | MSI B760 GAMING PLUS WIFI          |
+| CPU         | Intel Core i7-12700KF (12th Gen)   |
+| GPU         | NVIDIA GeForce GTX 1650            |
+| Storage     | 2x 2TB Crucial MX500 SSD           |
+
+## Memory
+
+| Slot    | Size | Manufacturer   | Part Number | Speed      |
+|---------|------|----------------|-------------|------------|
+| DIMM A1 | -    | -              | -           | -          |
+| DIMM A2 | 16GB | Team Group Inc | UD5-6000    | 4800 MT/s  |
+| DIMM B1 | -    | -              | -           | -          |
+| DIMM B2 | 16GB | Team Group Inc | UD5-6000    | 4800 MT/s  |
+
+**Total: 32GB DDR5**

system/machines/desktop/default.nix

@@ -0,0 +1,16 @@
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+      (import ./modules/disko)
+    inputs.home-manager.nixosModules.home-manager
+    { home-manager.sharedModules = [ inputs.sops-nix.homeManagerModules.sops ]; }
+      (import ./modules/home-manager)
+    ../../../user
+    ../../keys
+    ../../modules/sops
+    ./hardware.nix
+    ./system.nix
+  ];
+}

system/machines/desktop/hardware.nix

@@ -0,0 +1,88 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+with lib;
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  options.monitors = mkOption {
+    type = types.listOf (types.submodule {
+      options = {
+        name = mkOption { type = types.str; example = "HDMI-A-1"; };
+        width = mkOption { type = types.int; };
+        height = mkOption { type = types.int; };
+        x = mkOption { type = types.int; };
+        y = mkOption { type = types.int; };
+        scale = mkOption { type = types.float; };
+        refreshRate = mkOption { type = types.int; };
+      };
+    });
+    default = [];
+    description = "System monitor configuration";
+  };
+
+  config = {
+    monitors = [
+      { name = "HDMI-A-1"; width = 1920; height = 1080; x = 0;    y = 0; scale = 1.0; refreshRate = 60; }
+      { name = "DP-1";     width = 1920; height = 1080; x = 1920; y = 0; scale = 1.0; refreshRate = 60; }
+    ];
+
+    boot = {
+      initrd = {
+        availableKernelModules = [ "vmd" "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+        kernelModules = [ "dm-snapshot" ];
+      };
+      extraModulePackages = [ ];
+      kernelPackages = pkgs.linuxPackages_zen;
+      kernelParams = [ "intel_iommu=on" ];
+      kernelModules = [ "kvm-intel" "virtio" "vfio-pci" "coretemp" ];
+    };
+
+    environment.systemPackages = with pkgs; [
+      linuxHeaders
+
+      vulkan-headers
+      vulkan-loader
+      vulkan-tools
+      vulkan-extension-layer
+
+      mesa
+      mesa-demos
+
+      cudaPackages.cudatoolkit
+      cudaPackages.cudnn
+
+      nvidia-vaapi-driver
+    ];
+
+    hardware = {
+      cpu = {
+        intel = {
+          updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+        };
+      };
+      nvidia = {
+        open = true;
+        modesetting.enable = true;
+        nvidiaSettings = true;
+        package = config.boot.kernelPackages.nvidiaPackages.stable;
+      };
+      graphics = {
+        enable = true;
+        enable32Bit = true;
+      };
+    };
+
+    # Despite confusing name, this configures userspace nvidia libraries
+    services.xserver.videoDrivers = [ "nvidia" ];
+
+    virtualisation.libvirtd = {
+      enable = true;
+      qemu = {
+        runAsRoot = true;
+      };
+    };
+
+    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+    powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
+  };
+}

system/machines/desktop/modules/disko/default.nix

@@ -0,0 +1,57 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/ata-CT2000MX500SSD1_2137E5D2D47D";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            primary = {
+              size = "100%";
+              content = {
+                type = "lvm_pv";
+                vg = "nix";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    lvm_vg = {
+      nix = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "5%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+          home = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/home";
+            };
+          };
+        };
+      };
+    };
+  };
+}

system/machines/desktop/modules/home-manager/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./home.nix
+  ];
+}

system/machines/desktop/modules/home-manager/home.nix

@@ -0,0 +1,73 @@
+{ config, pkgs, ... }:
+
+{
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  home-manager.extraSpecialArgs = {
+    monitors = config.monitors;
+  };
+  home-manager.users.${config.user.name} = {
+    imports = [
+      ../../../../../user
+      ../../../../../user/home.nix
+      ../../../../../user/modules
+    ];
+
+    home.stateVersion = "23.11";
+
+    home.packages = [ pkgs.sshfs ];
+
+    systemd.user.services.nvr-mount = {
+      Unit = {
+        Description = "Mount Frigate recordings via SSHFS";
+        After = [ "network-online.target" ];
+      };
+      Service = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p %h/Media/nvr";
+        ExecStart = "${pkgs.sshfs}/bin/sshfs -o reconnect,ServerAliveInterval=15 server:/var/lib/frigate/recordings %h/Media/nvr";
+        ExecStop = "${pkgs.fuse}/bin/fusermount -u %h/Media/nvr";
+      };
+      Install = {
+        WantedBy = [ "default.target" ];
+      };
+    };
+
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+      matchBlocks = {
+        "*" = {
+          serverAliveInterval = 60;
+          serverAliveCountMax = 3;
+        };
+        "server" = {
+          hostname = "192.168.0.154";
+          user = "bryan";
+        };
+      };
+    };
+
+    # Machine-specific modules
+    modules.user = {
+      vim.enable = false;
+      security.yubikey.enable = true;
+
+      utils = {
+        dev.enable = true;
+        irc.enable = true;
+        writing.enable = true;
+      };
+
+      gui = {
+        wm.hyprland.enable = true;
+        browser.firefox.enable = true;
+        alacritty.enable = true;
+        corn.enable = true;
+        fun.enable = true;
+        utils.enable = true;
+      };
+    };
+  };
+}

system/machines/desktop/system.nix

@@ -0,0 +1,206 @@
+{ pkgs, lib, config, ... }:
+
+let
+  gpgEnabled = lib.any
+    (user: user.modules.user.security.gpg.enable or false)
+    (lib.attrValues config.home-manager.users);
+
+in
+{ system.stateVersion = "23.11";
+
+  modules.system.sops.enable = true;
+
+  # WiFi secrets
+  sops.secrets = let wifi = { sopsFile = ../../../secrets/system/wifi.yaml; }; in {
+    "WIFI_HOME_SSID" = wifi;
+    "WIFI_HOME_PSK" = wifi;
+    "WIFI_CAMS_SSID" = wifi;
+    "WIFI_CAMS_PSK" = wifi;
+  };
+
+  sops.templates."wifi-env".content = ''
+    WIFI_HOME_SSID=${config.sops.placeholder."WIFI_HOME_SSID"}
+    WIFI_HOME_PSK=${config.sops.placeholder."WIFI_HOME_PSK"}
+    WIFI_CAMS_SSID=${config.sops.placeholder."WIFI_CAMS_SSID"}
+    WIFI_CAMS_PSK=${config.sops.placeholder."WIFI_CAMS_PSK"}
+  '';
+
+  users.users = {
+    ${config.user.name} = {
+      isNormalUser = true;
+      extraGroups = config.user.groups
+        ++ [ "video" "audio" "kvm" "libvirtd" "dialout" ];
+      openssh.authorizedKeys.keys = [ "${config.user.keys.ssh.graphone}" ];
+    };
+  };
+
+  nix = {
+    channel.enable = false;
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+      keep-going = true
+    '';
+    settings = {
+      auto-optimise-store = true;
+      trusted-users = [ "${config.user.name}" ];
+      substitute = true;
+      max-jobs = "auto";
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 5;
+      #memtest86.enable = true;
+    };
+
+    efi = {
+      canTouchEfiVariables = true;
+    };
+    #timeout = null;
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      vim
+      git
+      usbutils
+    ];
+    pathsToLink = [
+      "/share/applications"
+      "/share/xdg-desktop-portal"
+    ];
+  };
+
+  fonts.packages = with pkgs; [
+    nerd-fonts.terminess-ttf
+  ];
+
+  security = {
+    sudo = {
+      wheelNeedsPassword = false;
+      execWheelOnly = true;
+    };
+    polkit.enable = true;
+  };
+
+  time = {
+    timeZone = "America/New_York";
+    hardwareClockInLocalTime = true;
+  };
+
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  console = {
+    font = "Lat2-Terminus16";
+    useXkbConfig = true;
+  };
+
+  networking = {
+    hostName = "desktop";
+    useDHCP = lib.mkDefault true;
+    networkmanager = {
+      enable = true;
+      ensureProfiles = {
+        environmentFiles = [ config.sops.templates."wifi-env".path ];
+        profiles.wifi = {
+          connection = {
+            id = "$WIFI_HOME_SSID";
+            type = "wifi";
+            interface-name = "wlo1";
+            autoconnect = false;  # Manual connection via nmcli
+          };
+          wifi = {
+            ssid = "$WIFI_HOME_SSID";
+            mode = "infrastructure";
+          };
+          wifi-security = {
+            key-mgmt = "wpa-psk";
+            psk = "$WIFI_HOME_PSK";
+          };
+          ipv4.method = "auto";
+          ipv6.method = "auto";
+        };
+        profiles.cams = {
+          connection = {
+            id = "$WIFI_CAMS_SSID";
+            type = "wifi";
+            interface-name = "wlo1";
+            autoconnect = false;
+          };
+          wifi = {
+            ssid = "$WIFI_CAMS_SSID";
+            mode = "infrastructure";
+          };
+          wifi-security = {
+            key-mgmt = "wpa-psk";
+            psk = "$WIFI_CAMS_PSK";
+          };
+          ipv4.method = "auto";
+          ipv6.method = "auto";
+        };
+      };
+    };
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 22 80 443 ];
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      # Explicit subdomains -> local server
+      address = [
+        "/git.ramos.codes/192.168.0.154"
+        "/ln.ramos.codes/192.168.0.154"
+        "/photos.ramos.codes/192.168.0.154"
+        "/test.ramos.codes/192.168.0.154"
+        "/electrum.ramos.codes/192.168.0.154"
+        "/immich.ramos.codes/192.168.0.154"
+        "/forgejo.ramos.codes/192.168.0.154"
+        "/frigate.ramos.codes/192.168.0.154"
+      ];
+      server = [ "192.168.0.1" ];
+    };
+  };
+
+  services = {
+    pcscd.enable = gpgEnabled;
+    timesyncd = lib.mkDefault {
+      enable = true;
+      servers = [
+        "0.pool.ntp.org"
+        "1.pool.ntp.org"
+        "2.pool.ntp.org"
+        "3.pool.ntp.org"
+      ];
+    };
+    pipewire = {
+      enable = true;
+      audio.enable = true;
+
+      wireplumber.enable = true;
+
+      pulse.enable = true;
+      jack.enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+    };
+    openssh = {
+      enable = true;
+      startWhenNeeded = false;
+      settings = {
+        X11Forwarding = false;
+        PasswordAuthentication = false;
+      };
+    };
+  };
+}