goals.

removed the bootloader from the core table in markdown

cheatsheet.md

@@ -0,0 +1,217 @@
+You’ll also need to import the modules in your host config (they aren’t wired in `flake.nix` yet), e.g.:
+
+```nix
+imports = [
+  ./hardware-configuration.nix
+  ../../modules/core
+  ../../modules/networking
+  ../../modules/virtualization
+];
+```
+
+---
+
+## `homelab.core`
+
+Base system setup: kernel, bootloader, primary user, SSH, unfree packages.
+
+| Option                | Type                                             | Default          | Notes                                                                |
+| --------------------- | ------------------------------------------------ | ---------------- | -------------------------------------------------------------------- |
+| `kernel`              | `"stable"` \| `"lts"` \| `"latest"`              | `"lts"`          | Maps to `linuxPackages`, `linuxPackages_lts`, `linuxPackages_latest` |
+|  |
+| `user.name`           | string                                           | `"river"`        |                                                                      |
+| `user.fullName`       | string                                           | `"Maaz Khokhar"` |                                                                      |
+| `user.shell`          | string (typed as list in options — likely a bug) | `"fish"`         | Used as `programs.${shell}.enable`                                   |
+| `allowUnfree`         | bool                                             | `true`           |                                                                      |
+| `ssh.permitRootLogin` | bool                                             | `false`          |                                                                      |
+
+**Minimal core block:**
+
+```nix
+homelab.core = {
+  kernel = "lts";
+ # user / allowUnfree / ssh all have sensible defaults
+};
+```
+
+**What you actually need to set:** bootloader details for your hardware (`grub.device` or `systemd.enable`). Everything else can stay default.
+
+---
+
+## `homelab.networking`
+
+Split into `core` (always active when module is imported), `wireguard`, and `tailscale`.
+
+### Top-level
+
+| Option | Type   | Default   |
+| ------ | ------ | --------- | --------------------------------- |
+| `user` | string | `"river"` | Used by Tailscale as `--operator` |
+
+### `homelab.networking.core` (always on)
+
+| Option               | Type                               | Default                                 |
+| -------------------- | ---------------------------------- | --------------------------------------- |
+| `firewall.allowPing` | bool                               | `true`                                  |
+| `firewall.ports.tcp` | list of ints                       | `[ 22 80 ]`                             |
+| `firewall.ports.udp` | list of ints                       | `[ 53 ]`                                |
+| `extraHosts`         | list of `{ ip_address, hostname }` | `[]`                                    |
+| `nameservers`        | list of strings                    | `["192.168.1.193" "1.1.1.1" "1.0.0.1"]` |
+
+**Required only when you add `extraHosts` entries:** `ip_address` and `hostname` (no defaults on those sub-options).
+
+**Minimal core block:**
+
+```nix
+homelab.networking = {
+  core = {
+    nameservers = [ "1.1.1.1" "1.0.0.1" ];
+    # firewall defaults are usually fine
+  };
+};
+```
+
+### `homelab.networking.wireguard` (optional)
+
+| Option       | Type                         | Default                                       |
+| ------------ | ---------------------------- | --------------------------------------------- |
+| `enable`     | bool                         | `false`                                       |
+| `interfaces` | attrset of interface configs | _(no default — use `{}` or omit if disabled)_ |
+
+**Per interface** (`interfaces.<name>`):
+
+| Option           | Required?                        | Default |
+| ---------------- | -------------------------------- | ------- |
+| `enable`         | no                               | `false` |
+| `address`        | no                               | `[]`    |
+| `privateKeyFile` | **yes** (when interface enabled) | —       |
+| `peers`          | no                               | `[]`    |
+
+**Per peer:**
+
+| Option                | Required? | Default |
+| --------------------- | --------- | ------- |
+| `publicKey`           | **yes**   | —       |
+| `allowedIPs`          | no        | `[]`    |
+| `endpoint`            | no        | `""`    |
+| `persistentKeepalive` | no        | `null`  |
+
+**Example when enabled:**
+
+```nix
+homelab.networking.wireguard = {
+  enable = true;
+  interfaces.wg0 = {
+    enable = true;
+    address = [ "10.0.0.2/24" ];
+    privateKeyFile = "/path/to/private.key";
+    peers = [{
+      publicKey = "...";
+      allowedIPs = [ "0.0.0.0/0" ];
+      endpoint = "vpn.example.com:51820";
+    }];
+  };
+};
+```
+
+**Note:** `wireguard.nix` exists but is **not** imported in `modules/networking/default.nix` — only `core` and `tailscale` are. You’d need to add `./wireguard.nix` to that imports list for WireGuard to work.
+
+### `homelab.networking.tailscale` (optional)
+
+| Option   | Type | Default |
+| -------- | ---- | ------- |
+| `enable` | bool | `false` |
+
+**Minimal:**
+
+```nix
+homelab.networking.tailscale.enable = true;
+# uses homelab.networking.user (default "river") as operator
+```
+
+---
+
+## `homelab.virtualization`
+
+Split into `podman` and `qemu`.
+
+### Top-level
+
+| Option | Type   | Default   |
+| ------ | ------ | --------- | ----------------------------------------- |
+| `user` | string | `"river"` | Added to `libvirtd`/`kvm`/`podman` groups |
+
+### `homelab.virtualization.podman`
+
+| Option            | Type | Default |
+| ----------------- | ---- | ------- | ----------------------------------------------------- |
+| `enable`          | bool | `false` |
+| `packages.enable` | bool | `false` | Installs `podman`, `podman-compose`, `podman-desktop` |
+
+**Minimal:**
+
+```nix
+homelab.virtualization.podman = {
+  enable = true;
+  packages.enable = true;  # optional
+};
+```
+
+### `homelab.virtualization.qemu`
+
+| Option                | Type            | Default                     |
+| --------------------- | --------------- | --------------------------- | ----------------------------------------------------------------------------------------------- |
+| `enable`              | bool            | `false`                     |
+| `containers.enable`   | bool            | `false`                     | _(defined in options but not wired in `qemu.nix` — containers are always enabled when qemu is)_ |
+| `spiceUSBRedirection` | bool            | `false`                     |
+| `virtManager`         | bool            | `false`                     |
+| `bootModules`         | list of strings | `[ "kvm-intel" "kvm-amd" ]` |
+
+**Minimal:**
+
+```nix
+homelab.virtualization.qemu = {
+  enable = true;
+  virtManager = true;  # optional GUI
+};
+```
+
+When `qemu.enable = true`, the module sets up `libvirtd`, adds your user to `libvirtd`/`kvm`, and loads KVM modules.
+
+---
+
+## Full skeleton for `hosts/test/configuration.nix`
+
+```nix
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/core
+    ../../modules/networking
+    ../../modules/virtualization
+  ];
+
+  homelab.core = {
+    kernel = "lts";
+    bootloader = {
+      type = "systemd";
+      systemd.enable = true;
+    };
+  };
+
+  homelab.networking = {
+    core.nameservers = [ "1.1.1.1" "1.0.0.1" ];
+    tailscale.enable = true;
+  };
+
+  homelab.virtualization = {
+    podman.enable = true;
+    qemu = {
+      enable = true;
+      virtManager = true;
+    };
+  };
+}
+```

disks/normal.nix

@@ -0,0 +1,35 @@
+{ disk, ... }:
+
+{
+  disko.devices = {
+    disk = {
+      ${disk} = {
+        device = "/dev/disk/by-id/${disk}";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              type = "EF00";
+              size = "2G";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

flake.lock

@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782358560,
-        "narHash": "sha256-vCcLh9pw3XO/+Lxk8r6xv6QnoCrTfGqiACcI7O637Wg=",
+        "lastModified": 1783388784,
+        "narHash": "sha256-w+YU5vatysjLZIg1wOKSzo/RL9Z66eBQuIjVnBM/1Zg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3a70e333f2950c302e875c44cfcfaff3f80f36bc",
+        "rev": "63d02d1c19f1c2b47a5bc7e55c620b6af7b218a6",
         "type": "github"
       },
       "original": {
@@ -42,12 +42,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781577229,
-        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
-        "type": "github"
+        "lastModified": 1783224372,
+        "narHash": "sha256-FGQ8TfSm9WviNE/fQAWsKs+y4GkX8fU4EScewpw54Y8=",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1027867.d407951447dc/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",

flake.nix

@@ -23,27 +23,30 @@
       system = "x86_64-linux";
     in
     {
-      # nixosConfigurations.pc = nixpkgs.lib.nixosSystem {
-      #   inherit system;
-      #   specialArgs = { inherit inputs; };
-      #   modules = [
-      #     ./hosts/pc/configuration.nix
-      #     home-manager.nixosModules.default
+      nixosConfigurations.test = nixpkgs.lib.nixosSystem {
+        inherit system;
+        specialArgs = {
+          inherit inputs;
+          disk = "nvme-SAMSUNG_MZVLB256HBHQ-000H1_S4GNNX2RC66163";
+        };
+        modules = [
+          ./hosts/test/configuration.nix
+          home-manager.nixosModules.default
 
-      #     {
-      #       home-manager = {
-      #         useGlobalPkgs = true;
-      #         useUserPackages = true;
+          {
+            home-manager = {
+              useGlobalPkgs = true;
+              useUserPackages = true;
 
-      #         backupFileExtension = "backup";
+              backupFileExtension = "backup";
 
-      #         users = {
-      #           river = import ./home/river;
-      #           aariz = import ./home/aariz;
-      #         };
-      #       };
-      #     }
-      #   ];
-      # };
+              users.river = import ./home;
+            };
+          }
+
+          inputs.disko.nixosModules.disko
+          ./disks/normal.nix
+        ];
+      };
     };
 }