basic modules

home/default.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./programs/bash.nix
+    ./programs/git.nix
+  ];
+
+  home.username = "river";
+  home.homeDirectory = "/home/river";
+
+  home.stateVersion = "26.05";
+}

home/programs/bash.nix

@@ -0,0 +1,44 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./eza.nix
+    ./starship.nix
+    ./zoxide.nix
+  ];
+
+  home.packages = with pkgs; [
+    bash
+    bat
+    fzf
+    fd
+    zoxide
+    ripgrep
+    neovim
+  ];
+
+  programs.bash = {
+    enable = true;
+
+    shellAliases = {
+      ll = "eza -lah";
+      ls = "eza";
+      cat = "bat";
+      grep = "grep --color=auto";
+    };
+
+    historyControl = [
+      "ignoredups"
+      "ignorespace"
+    ];
+
+    historySize = 10000;
+
+    initExtra = ''
+      eval "$(zoxide init bash)"
+      source ${pkgs.carapace}/share/bash/carapace.bash
+
+      export EDITOR=nvim
+    '';
+  };
+}

home/programs/eza.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  programs.eza = {
+    enable = true;
+    withIcons = true;
+  };
+}

home/programs/git.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  programs.git = {
+    enable = true;
+    withDelta = true;
+  };
+}

home/programs/starship.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  programs.starship = {
+    enable = true;
+    enableBashIntegration = true;
+  };
+}

home/programs/zoxide.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  programs.zoxide = {
+    enable = true;
+    enableBashIntegration = true;
+  };
+}

hosts/laptop/configuration.nix

@@ -4,6 +4,12 @@
   imports = [
     ./hardware-configuration.nix
     ./disko.nix
+
+    # Modules
+    ../../modules/virtualization
+    ../../modules/core
+    ../../modules/networking
+    ../../modules/development
   ];
 
   boot = {
@@ -35,62 +41,14 @@
     sudo.wheelNeedsPassword = false;
   };
 
-  networking = {
-    hostName = "laptop";
-    networkmanager.enable = true;
-
-    firewall = {
-      enable = true;
-
-      allowPing = true;
-
-      allowedTCPPorts = [ 22 80 ];
-      allowedUDPPorts = [ 51820 ];
-    }
-  };
-
-  time.timeZone = "America/Chicago";
-
   services.zfs.autoScrub.enable = true;
   services.zfs.autoSnapshot.enable = true;
 
   networking.hostId = "8425e349";
 
-  users.users.river = {
-    isNormalUser = true;
-    extraGroups = [
-      "wheel"
-      "networkmanager"
-      "podman"
-    ];
-  };
-
   environment.systemPackages = with pkgs; [
-    git
-    neovim
-    btop
-    unzip
     tpm2-tools
   ];
 
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 7d";
-  };
-
-  nix.settings.auto-optimise-store = true;
-
-  services.openssh = {
-    enable = true;
-    settings.PermitRootLogin = "no";
-  };
-
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-    alsa.enable = true;
-  };
-
   system.stateVersion = "26.05";
 }

modules/core/default.nix

@@ -0,0 +1,39 @@
+{ config, pkgs, ... }:
+
+{
+  time.timeZone = "America/Chicago";
+
+  users.users.river = {
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    git
+    neovim
+    btop
+    unzip
+  ];
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+
+  nix.settings.auto-optimise-store = true;
+
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+    alsa.enable = true;
+  };
+
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+  };
+}

modules/development/clang.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    gcc
+    cmake
+    clang
+  ];
+}

modules/development/default.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./rust.nix
+  ];
+
+  environment.systemPackages = with pkgs; [
+    # General
+    git
+    neovim
+    nixfmt
+  ];
+}

modules/development/python.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    python313
+
+    # package tooling
+    python313Packages.uv
+    python313Packages.virtualenv
+
+    # dev tools
+    ruff
+    black
+    mypy
+
+    # optional data science base tools
+    python313Packages.numpy
+    python313Packages.pandas
+  ];
+}

modules/development/rust.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    cargo
+    rustc
+    rustfmt
+    clippy
+  ];
+
+  environment.variables = {
+    RUST_BACKTRACE = "1";
+  };
+}

modules/development/typescript.nix

@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    bun
+
+    # TS tooling (optional but common)
+    typescript
+    nodePackages.typescript-language-server
+    nodePackages.eslint
+    nodePackages.prettier
+  ];
+
+  environment.variables = {
+    NODE_OPTIONS = "--max-old-space-size=4096";
+  };
+}

modules/networking/core/default.nix

@@ -0,0 +1,28 @@
+{ ... }:
+
+{
+  imports = [
+    ./firewall.nix
+  ];
+
+  networking = {
+    hostName = "laptop";
+    networkmanager.enable = true;
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = [ "~." ];
+    fallbackDns = [
+      "192.168.1.193" # Pi-hole
+      "1.1.1.1" # Cloudflare
+      "1.0.0.1" # Cloudflare (Secondary)
+    ];
+    extraConfig = ''
+      DNSOverTLS=yes
+    '';
+  };
+
+  networking.nftables.enable = true;
+}

modules/networking/core/firewall.nix

@@ -0,0 +1,17 @@
+{ ... }:
+
+{
+  networking.firewall = {
+    enable = true;
+
+    allowPing = true;
+
+    allowedTCPPorts = [
+      22
+      80
+    ];
+    allowedUDPPorts = [
+      53
+    ];
+  };
+}

modules/networking/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  imports = [
+    ./core
+    ./tailscale.nix
+    ./wireguard.nix
+  ];
+}

modules/networking/tailscale.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  services.tailscale.enable = true;
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
+  systemd.services.tailscaled.serviceConfig.Environment = [
+    "TS_DEBUG_FIREWALL_MODE=nftables"
+  ];
+
+  systemd.network.wait-online.enable = false;
+  boot.initrd.systemd.network.wait-online.enable = false;
+}

modules/networking/wireguard.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.0.0.2/24" ];
+      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+
+      peers = [
+        {
+          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "server.maariz.org:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+  # Ensure the Wireguard UDP port is open if you are hosting the server
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+}

modules/virtualization/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./podman.nix
+    ./qemu.nix
+  ];
+}

modules/virtualization/podman.nix

@@ -0,0 +1,37 @@
+{ pkgs, ... }:
+
+{
+  virtualisation.podman = {
+    enable = true;
+
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  # For rootless containers
+  security.unprivilegedUsernsClone = true;
+
+  users.users.river = {
+    subUidRanges = [
+      {
+        startUid = 100000;
+        count = 65536;
+      }
+    ];
+    subGidRanges = [
+      {
+        startGid = 100000;
+        count = 65536;
+      }
+    ];
+
+    extraGroups = [
+      "podman"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    podman
+    podman-compose
+  ];
+}

modules/virtualization/qemu.nix

@@ -0,0 +1,25 @@
+{ ... }:
+
+{
+  virtualisation.spiceUSBRedirection.enable = true;
+
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu = {
+      ovmf.enable = true;
+      swtpm.enable = true;
+    };
+  };
+
+  programs.virt-manager.enable = true;
+
+  users.users.river.extraGroups = [
+    "libvirtd"
+    "kvm"
+  ];
+
+  boot.kernelModules = [
+    "kvm-intel"
+    "kvm-amd"
+  ];
+}