Initial commit

modules/additionalUsers/aariz.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  users.users.aariz = {
+    isNormalUser = true;
+    description = "Aariz Khokhar";
+    packages = with pkgs; [ google-chrome ];
+    shell = pkgs.bash;
+  };
+}

modules/bluetooth/default.nix

@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+
+{
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General = {
+        Experimental = true;
+      };
+      Policy = {
+        AutoEnable = true;
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    bluez
+    bluez-tools
+    blueman
+  ];
+
+  services.blueman.enable = true;
+}

modules/core/default.nix

@@ -0,0 +1,100 @@
+{ pkgs, ... }:
+
+{
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  time.timeZone = "America/Chicago";
+
+  programs.fish.enable = true;
+
+  users.users.river = {
+    isNormalUser = true;
+    description = "Maaz Khokhar";
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "input"
+    ];
+
+    shell = pkgs.fish;
+  };
+
+  nixpkgs.config.allowUnfree = true;
+
+  environment.systemPackages = with pkgs; [
+    gitFull
+    neovim
+    btop
+    unzip
+    mpv
+    wl-clipboard
+    wireplumber
+    brightnessctl
+    pulseaudio
+    pavucontrol
+    ghostty
+    git-credential-manager
+    gnupg
+    yazi
+  ];
+
+  nix = {
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+    settings = {
+      trusted-users = [
+        "root"
+        "river"
+      ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+  };
+
+  programs.nix-ld.enable = true;
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+
+    extraLocaleSettings = {
+      LC_ADDRESS = "en_US.UTF-8";
+      LC_IDENTIFICATION = "en_US.UTF-8";
+      LC_MEASUREMENT = "en_US.UTF-8";
+      LC_MONETARY = "en_US.UTF-8";
+      LC_NAME = "en_US.UTF-8";
+      LC_NUMERIC = "en_US.UTF-8";
+      LC_PAPER = "en_US.UTF-8";
+      LC_TELEPHONE = "en_US.UTF-8";
+      LC_TIME = "en_US.UTF-8";
+    };
+  };
+
+  security.rtkit.enable = true;
+
+  services = {
+    xserver.xkb = {
+      layout = "us";
+      variant = "";
+    };
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+
+    openssh = {
+      enable = true;
+      settings.PermitRootLogin = "no";
+    };
+
+    printing.enable = true;
+  };
+}

modules/development/clang.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    gcc
+    cmake
+    clang
+  ];
+}

modules/development/claude.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    claude-code
+  ];
+}

modules/development/default.nix

@@ -0,0 +1,30 @@
+{ inputs, pkgs, ... }:
+
+{
+  imports = [
+    ./rust.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    # General
+    git
+    neovim
+    nixfmt
+    nixd
+    kubectl
+    jq
+    tmux
+    vscode
+    devenv
+    xh
+    nodejs
+  ];
+
+  # Nix LSP
+  nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+
+  fonts.packages = with pkgs; [
+    nerd-fonts.fira-code
+    nerd-fonts.jetbrains-mono
+  ];
+}

modules/development/python.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    python313
+
+    # package tooling
+    python313Packages.uv
+    python313Packages.virtualenv
+
+    # dev tools
+    ruff
+    black
+    mypy
+
+    # optional data science base tools
+    python313Packages.numpy
+    python313Packages.pandas
+  ];
+}

modules/development/rust.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    cargo
+    rustc
+    rustfmt
+    clippy
+  ];
+
+  environment.variables = {
+    RUST_BACKTRACE = "1";
+  };
+}

modules/development/typescript.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    bun
+
+    # TS tooling (optional but common)
+    typescript
+    nodePackages.typescript-language-server
+    nodePackages.eslint
+    nodePackages.prettier
+  ];
+
+  environment.variables = {
+    NODE_OPTIONS = "--max-old-space-size=4096";
+  };
+}

modules/networking/core/default.nix

@@ -0,0 +1,38 @@
+{ ... }:
+
+{
+  imports = [
+    ./firewall.nix
+  ];
+
+  networking = {
+    networkmanager = {
+      enable = true;
+      dns = "systemd-resolved";
+    };
+    extraHosts = "192.168.1.60 laptop";
+    nftables.enable = true;
+
+    nameservers = [
+      "192.168.1.193" # Pi-hole
+      "1.1.1.1" # Cloudflare
+      "1.0.0.1" # Cloudflare (Secondary)
+    ];
+  };
+
+  services.resolved = {
+    enable = true;
+
+    settings.Resolve = {
+      dnssec = "true";
+      DNSOverTLS = "true";
+      domains = [ "~." ];
+      fallbackDns = [
+        "192.168.1.193" # Pi-hole
+        "1.1.1.1" # Cloudflare
+        "1.0.0.1" # Cloudflare (Secondary)
+      ];
+    };
+
+  };
+}

modules/networking/core/firewall.nix

@@ -0,0 +1,17 @@
+{ ... }:
+
+{
+  networking.firewall = {
+    enable = true;
+
+    allowPing = true;
+
+    allowedTCPPorts = [
+      22
+      80
+    ];
+    allowedUDPPorts = [
+      53
+    ];
+  };
+}

modules/networking/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  imports = [
+    ./core
+    ./tailscale.nix
+  ];
+}

modules/networking/tailscale.nix

@@ -0,0 +1,25 @@
+{ config, ... }:
+
+{
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    extraSetFlags = [ "--operator=river" ];
+  };
+
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+
+  systemd.network.wait-online.enable = false;
+  boot.initrd.systemd.network.wait-online.enable = false;
+
+  users.users.river.extraGroups = [
+    "tailscale"
+  ];
+}

modules/networking/wireguard.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.0.0.2/24" ];
+      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+
+      peers = [
+        {
+          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "server.maariz.org:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+  # Ensure the Wireguard UDP port is open if you are hosting the server
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+}

modules/virtualization/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./podman.nix
+    ./qemu.nix
+    ./lima.nix
+  ];
+}

modules/virtualization/lima.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    lima
+  ];
+}

modules/virtualization/podman.nix

@@ -0,0 +1,38 @@
+{ pkgs, ... }:
+
+{
+  virtualisation.podman = {
+    enable = true;
+
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  # For rootless containers
+  security.unprivilegedUsernsClone = true;
+
+  users.users.river = {
+    subUidRanges = [
+      {
+        startUid = 100000;
+        count = 65536;
+      }
+    ];
+    subGidRanges = [
+      {
+        startGid = 100000;
+        count = 65536;
+      }
+    ];
+
+    extraGroups = [
+      "podman"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    podman
+    podman-compose
+    podman-desktop
+  ];
+}

modules/virtualization/qemu.nix

@@ -0,0 +1,28 @@
+{ pkgs, ... }:
+
+{
+  virtualisation.spiceUSBRedirection.enable = true;
+
+  virtualisation = {
+    containers.enable = true;
+    libvirtd = {
+      enable = true;
+      qemu = {
+        package = pkgs.qemu_kvm;
+        swtpm.enable = true;
+      };
+    };
+  };
+
+  programs.virt-manager.enable = true;
+
+  users.users.river.extraGroups = [
+    "libvirtd"
+    "kvm"
+  ];
+
+  boot.kernelModules = [
+    "kvm-intel"
+    "kvm-amd"
+  ];
+}