modularized deployments

demilich/configuration.nix

@@ -12,9 +12,9 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../services.nix
-    ../packages.nix
-    ../security.nix
+    ./services.nix
+    ./packages.nix
+    ./security.nix
   ];
 
   # Enable flakes and nix-command
@@ -30,7 +30,6 @@
     "electron-39.8.10"
   ];
 
-  # Use the systemd-boot EFI boot loader.
   boot = {
     loader = {
       limine = {
@@ -47,7 +46,20 @@
 
   networking = {
     hostName = "demilich";
-    networkmanager.enable = true;
+
+    networkmanager = {
+      enable = true;
+    };
+
+    nftables = {
+      enable = true;
+    };
+
+    firewall = {
+      enable = true;
+      trustedInterfaces = [ config.services.tailscale.interfaceName ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
   };
 
   # Set your time zone.
@@ -56,7 +68,7 @@
   # Select internationalisation properties.
   i18n.defaultLocale = "en_CA.UTF-8";
   console = {
-    # keyMap = "us";
+    keyMap = "us";
     useXkbConfig = true;
   };
 

demilich/hardware-configuration.nix

@@ -1,32 +1,63 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" "iwlwifi" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" "iwlwifi" ];
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "xhci_pci"
+        "nvme"
+        "usb_storage"
+        "sd_mod"
+        "rtsx_pci_sdmmc"
+        "iwlwifi"
+      ];
+      kernelModules = [ ];
+      systemd = {
+        network = {
+          wait-online = {
+            enable = false;
+          };
+        };
+      };
+    };
+  };
+
+  boot.kernelModules = [
+    "kvm-intel"
+    "iwlwifi"
+  ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/e3f1509a-7556-4eb9-ab4d-20dc2d5ff47d";
-      fsType = "xfs";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e3f1509a-7556-4eb9-ab4d-20dc2d5ff47d";
+    fsType = "xfs";
+  };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/6E60-FBDB";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/eaab6975-f924-485a-a84e-9d37973127ca"; }
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/6E60-FBDB";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
     ];
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/eaab6975-f924-485a-a84e-9d37973127ca"; }
+  ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

demilich/packages.nix

@@ -0,0 +1,125 @@
+{ pkgs, ... }:
+
+{
+  nixpkgs.overlays = [
+    (final: prev: {
+      bitwarden-desktop = prev.bitwarden-desktop // {
+        electron_39 = final.electron_39-bin;
+      };
+    })
+  ];
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
+  environment.systemPackages = with pkgs; [
+    # language servers useful on a system level
+    bash-language-server
+    dockerfile-language-server
+    lua-language-server
+    nginx-language-server
+    nixd
+    systemd-language-server
+    yaml-language-server
+
+    # system wide applications
+    bitwarden-cli
+    bitwarden-desktop
+    btop
+    curl
+    direnv
+    eza
+    fd
+    firefox
+    fuzzel
+    fzf
+    ghostscript_headless
+    ghostty
+    git
+    imagemagick
+    lazygit
+    mako
+    mermaid-cli
+    neovide
+    neohtop
+    nixfmt
+    restic
+    ripgrep
+    rsync
+    seafile-client
+    sqlite
+    starship
+    stow
+    swayidle
+    swaylock
+    tectonic
+    trash-cli
+    tree-sitter
+    wl-clipboard
+    xwayland-satellite
+    yazi
+    zoxide
+  ];
+
+  fonts.packages = with pkgs; [
+    nerd-fonts.caskaydia-cove
+    nerd-fonts.caskaydia-mono
+    nerd-fonts.fira-code
+    nerd-fonts.fantasque-sans-mono
+    nerd-fonts.fira-mono
+    nerd-fonts.geist-mono
+    nerd-fonts.go-mono
+    nerd-fonts.hack
+    nerd-fonts.hasklug
+    nerd-fonts.jetbrains-mono
+    nerd-fonts.liberation
+    nerd-fonts.monoid
+    nerd-fonts.mononoki
+    nerd-fonts.noto
+    nerd-fonts.open-dyslexic
+    nerd-fonts.overpass
+    nerd-fonts.profont
+    nerd-fonts.proggy-clean-tt
+    nerd-fonts.recursive-mono
+    nerd-fonts.roboto-mono
+    nerd-fonts.sauce-code-pro
+    nerd-fonts.shure-tech-mono
+    nerd-fonts.space-mono
+    nerd-fonts.symbols-only
+    nerd-fonts.terminess-ttf
+    nerd-fonts.ubuntu
+    nerd-fonts.ubuntu-mono
+    nerd-fonts.ubuntu-sans
+    nerd-fonts.victor-mono
+    nerd-fonts.zed-mono
+  ];
+
+  programs = {
+    waybar = {
+      enable = true;
+    };
+    niri = {
+      enable = true;
+    };
+    neovim = {
+      enable = true;
+      defaultEditor = true;
+      viAlias = true;
+      vimAlias = true;
+      configure = {
+        treesitter = {
+          enable = true;
+          grammarPackages = with pkgs.vimPlugins.nvim-treesitter.builtGrammars; [
+            bash
+            lua
+            nix
+            regex
+          ];
+        };
+        customLuaRC = builtins.readFile ./config/nvim.lua;
+      };
+    };
+    zsh = {
+      enable = true;
+    };
+  };
+
+}

demilich/security.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  security = {
+    polkit.enable = true;
+    pam.services.swaylock = {};
+  };
+}

demilich/services.nix

@@ -0,0 +1,73 @@
+{ config, ... }:
+{
+  systemd = {
+    user = {
+      services = {
+        niri = {
+          enableDefaultPath = false;
+        };
+      };
+    };
+    services = {
+      tailscaled = {
+        serviceConfig = {
+          Environment = [
+            "TS_DEBUG_FIREWALL_MODE=nftables"
+          ];
+        };
+      };
+      NetworkManager-wait-online = {
+        enable = false;
+      };
+    };
+
+    network = {
+      wait-online = {
+        enable = false;
+      };
+    };
+  };
+
+  xdg.portal.config.niri = {
+    "org.freedesktop.impl.portal.FileChooser" = [ "gtk" ];
+  };
+
+  services = {
+    tailscale = {
+      enable = true;
+    };
+
+    displayManager = {
+      enable = true;
+      lemurs = {
+        enable = true;
+      };
+    };
+    xserver = {
+      enable = true;
+      xkb.options = "ctrl:nocaps";
+    };
+    pipewire = {
+      enable = true;
+      pulse.enable = true;
+    };
+    # Enable touchpad support (enabled default in most desktopManager).
+    libinput.enable = true;
+    printing.enable = true;
+
+    greetd = {
+      enable = true;
+      settings = {
+        default_session = {
+          command = "${config.programs.niri.package}/bin/niri-session";
+          user = "stobbsm";
+        };
+      };
+    };
+    gnome = {
+      gnome-keyring = {
+        enable = true;
+      };
+    };
+  };
+}