From a537f5236daec159ec524c3e77f2170c99d7c1f2 Mon Sep 17 00:00:00 2001 From: Maaz Khokhar Date: Sun, 21 Jun 2026 21:19:52 -0500 Subject: [PATCH] basic modules --- home/default.nix | 13 +++++++ home/programs/bash.nix | 44 +++++++++++++++++++++++ home/programs/eza.nix | 8 +++++ home/programs/git.nix | 8 +++++ home/programs/starship.nix | 8 +++++ home/programs/zoxide.nix | 8 +++++ hosts/laptop/configuration.nix | 54 ++++------------------------ modules/core/default.nix | 39 ++++++++++++++++++++ modules/development/clang.nix | 9 +++++ modules/development/default.nix | 14 ++++++++ modules/development/python.nix | 20 +++++++++++ modules/development/rust.nix | 14 ++++++++ modules/development/typescript.nix | 17 +++++++++ modules/networking/core/default.nix | 28 +++++++++++++++ modules/networking/core/firewall.nix | 17 +++++++++ modules/networking/default.nix | 9 +++++ modules/networking/tailscale.nix | 16 +++++++++ modules/networking/wireguard.nix | 22 ++++++++++++ modules/virtualization/default.nix | 7 ++++ modules/virtualization/podman.nix | 37 +++++++++++++++++++ modules/virtualization/qemu.nix | 25 +++++++++++++ 21 files changed, 369 insertions(+), 48 deletions(-) create mode 100644 home/programs/bash.nix create mode 100644 home/programs/eza.nix create mode 100644 home/programs/git.nix create mode 100644 home/programs/starship.nix create mode 100644 home/programs/zoxide.nix create mode 100644 modules/core/default.nix create mode 100644 modules/development/clang.nix create mode 100644 modules/development/default.nix create mode 100644 modules/development/python.nix create mode 100644 modules/development/rust.nix create mode 100644 modules/development/typescript.nix create mode 100644 modules/networking/core/default.nix create mode 100644 modules/networking/core/firewall.nix create mode 100644 modules/networking/default.nix create mode 100644 modules/networking/tailscale.nix create mode 100644 modules/networking/wireguard.nix create mode 100644 modules/virtualization/default.nix create mode 100644 modules/virtualization/podman.nix create mode 100644 modules/virtualization/qemu.nix diff --git a/home/default.nix b/home/default.nix index e69de29..eb95d72 100644 --- a/home/default.nix +++ b/home/default.nix @@ -0,0 +1,13 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./programs/bash.nix + ./programs/git.nix + ]; + + home.username = "river"; + home.homeDirectory = "/home/river"; + + home.stateVersion = "26.05"; +} diff --git a/home/programs/bash.nix b/home/programs/bash.nix new file mode 100644 index 0000000..35b6e6f --- /dev/null +++ b/home/programs/bash.nix @@ -0,0 +1,44 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./eza.nix + ./starship.nix + ./zoxide.nix + ]; + + home.packages = with pkgs; [ + bash + bat + fzf + fd + zoxide + ripgrep + neovim + ]; + + programs.bash = { + enable = true; + + shellAliases = { + ll = "eza -lah"; + ls = "eza"; + cat = "bat"; + grep = "grep --color=auto"; + }; + + historyControl = [ + "ignoredups" + "ignorespace" + ]; + + historySize = 10000; + + initExtra = '' + eval "$(zoxide init bash)" + source ${pkgs.carapace}/share/bash/carapace.bash + + export EDITOR=nvim + ''; + }; +} diff --git a/home/programs/eza.nix b/home/programs/eza.nix new file mode 100644 index 0000000..844b278 --- /dev/null +++ b/home/programs/eza.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + programs.eza = { + enable = true; + withIcons = true; + }; +} diff --git a/home/programs/git.nix b/home/programs/git.nix new file mode 100644 index 0000000..462094d --- /dev/null +++ b/home/programs/git.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + programs.git = { + enable = true; + withDelta = true; + }; +} diff --git a/home/programs/starship.nix b/home/programs/starship.nix new file mode 100644 index 0000000..2a21f25 --- /dev/null +++ b/home/programs/starship.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + programs.starship = { + enable = true; + enableBashIntegration = true; + }; +} diff --git a/home/programs/zoxide.nix b/home/programs/zoxide.nix new file mode 100644 index 0000000..19e30f3 --- /dev/null +++ b/home/programs/zoxide.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + programs.zoxide = { + enable = true; + enableBashIntegration = true; + }; +} diff --git a/hosts/laptop/configuration.nix b/hosts/laptop/configuration.nix index e7303d4..6e47f0f 100644 --- a/hosts/laptop/configuration.nix +++ b/hosts/laptop/configuration.nix @@ -4,6 +4,12 @@ imports = [ ./hardware-configuration.nix ./disko.nix + + # Modules + ../../modules/virtualization + ../../modules/core + ../../modules/networking + ../../modules/development ]; boot = { @@ -35,62 +41,14 @@ sudo.wheelNeedsPassword = false; }; - networking = { - hostName = "laptop"; - networkmanager.enable = true; - - firewall = { - enable = true; - - allowPing = true; - - allowedTCPPorts = [ 22 80 ]; - allowedUDPPorts = [ 51820 ]; - } - }; - - time.timeZone = "America/Chicago"; - services.zfs.autoScrub.enable = true; services.zfs.autoSnapshot.enable = true; networking.hostId = "8425e349"; - users.users.river = { - isNormalUser = true; - extraGroups = [ - "wheel" - "networkmanager" - "podman" - ]; - }; - environment.systemPackages = with pkgs; [ - git - neovim - btop - unzip tpm2-tools ]; - nix.gc = { - automatic = true; - dates = "weekly"; - options = "--delete-older-than 7d"; - }; - - nix.settings.auto-optimise-store = true; - - services.openssh = { - enable = true; - settings.PermitRootLogin = "no"; - }; - - services.pipewire = { - enable = true; - pulse.enable = true; - alsa.enable = true; - }; - system.stateVersion = "26.05"; } diff --git a/modules/core/default.nix b/modules/core/default.nix new file mode 100644 index 0000000..b1c6ee9 --- /dev/null +++ b/modules/core/default.nix @@ -0,0 +1,39 @@ +{ config, pkgs, ... }: + +{ + time.timeZone = "America/Chicago"; + + users.users.river = { + isNormalUser = true; + extraGroups = [ + "wheel" + "networkmanager" + ]; + }; + + environment.systemPackages = with pkgs; [ + git + neovim + btop + unzip + ]; + + nix.gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 7d"; + }; + + nix.settings.auto-optimise-store = true; + + services.pipewire = { + enable = true; + pulse.enable = true; + alsa.enable = true; + }; + + services.openssh = { + enable = true; + settings.PermitRootLogin = "no"; + }; +} \ No newline at end of file diff --git a/modules/development/clang.nix b/modules/development/clang.nix new file mode 100644 index 0000000..eb9c9e4 --- /dev/null +++ b/modules/development/clang.nix @@ -0,0 +1,9 @@ +{ pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + gcc + cmake + clang + ]; +} diff --git a/modules/development/default.nix b/modules/development/default.nix new file mode 100644 index 0000000..e2a5e8e --- /dev/null +++ b/modules/development/default.nix @@ -0,0 +1,14 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./rust.nix + ]; + + environment.systemPackages = with pkgs; [ + # General + git + neovim + nixfmt + ]; +} diff --git a/modules/development/python.nix b/modules/development/python.nix new file mode 100644 index 0000000..e72d19f --- /dev/null +++ b/modules/development/python.nix @@ -0,0 +1,20 @@ +{ pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + python313 + + # package tooling + python313Packages.uv + python313Packages.virtualenv + + # dev tools + ruff + black + mypy + + # optional data science base tools + python313Packages.numpy + python313Packages.pandas + ]; +} diff --git a/modules/development/rust.nix b/modules/development/rust.nix new file mode 100644 index 0000000..b493370 --- /dev/null +++ b/modules/development/rust.nix @@ -0,0 +1,14 @@ +{ pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + cargo + rustc + rustfmt + clippy + ]; + + environment.variables = { + RUST_BACKTRACE = "1"; + }; +} diff --git a/modules/development/typescript.nix b/modules/development/typescript.nix new file mode 100644 index 0000000..b6f79a4 --- /dev/null +++ b/modules/development/typescript.nix @@ -0,0 +1,17 @@ +{ pkgs, ... }: + +{ + environment.systemPackages = with pkgs; [ + bun + + # TS tooling (optional but common) + typescript + nodePackages.typescript-language-server + nodePackages.eslint + nodePackages.prettier + ]; + + environment.variables = { + NODE_OPTIONS = "--max-old-space-size=4096"; + }; +} diff --git a/modules/networking/core/default.nix b/modules/networking/core/default.nix new file mode 100644 index 0000000..ade2877 --- /dev/null +++ b/modules/networking/core/default.nix @@ -0,0 +1,28 @@ +{ ... }: + +{ + imports = [ + ./firewall.nix + ]; + + networking = { + hostName = "laptop"; + networkmanager.enable = true; + }; + + services.resolved = { + enable = true; + dnssec = "true"; + domains = [ "~." ]; + fallbackDns = [ + "192.168.1.193" # Pi-hole + "1.1.1.1" # Cloudflare + "1.0.0.1" # Cloudflare (Secondary) + ]; + extraConfig = '' + DNSOverTLS=yes + ''; + }; + + networking.nftables.enable = true; +} diff --git a/modules/networking/core/firewall.nix b/modules/networking/core/firewall.nix new file mode 100644 index 0000000..88c1f69 --- /dev/null +++ b/modules/networking/core/firewall.nix @@ -0,0 +1,17 @@ +{ ... }: + +{ + networking.firewall = { + enable = true; + + allowPing = true; + + allowedTCPPorts = [ + 22 + 80 + ]; + allowedUDPPorts = [ + 53 + ]; + }; +} diff --git a/modules/networking/default.nix b/modules/networking/default.nix new file mode 100644 index 0000000..feb09ca --- /dev/null +++ b/modules/networking/default.nix @@ -0,0 +1,9 @@ +{ ... }: + +{ + imports = [ + ./core + ./tailscale.nix + ./wireguard.nix + ]; +} diff --git a/modules/networking/tailscale.nix b/modules/networking/tailscale.nix new file mode 100644 index 0000000..3dd9a7e --- /dev/null +++ b/modules/networking/tailscale.nix @@ -0,0 +1,16 @@ +{ ... }: + +{ + services.tailscale.enable = true; + networking.firewall = { + trustedInterfaces = [ config.services.tailscale.interfaceName ]; + allowedUDPPorts = [ config.services.tailscale.port ]; + }; + + systemd.services.tailscaled.serviceConfig.Environment = [ + "TS_DEBUG_FIREWALL_MODE=nftables" + ]; + + systemd.network.wait-online.enable = false; + boot.initrd.systemd.network.wait-online.enable = false; +} diff --git a/modules/networking/wireguard.nix b/modules/networking/wireguard.nix new file mode 100644 index 0000000..70f233a --- /dev/null +++ b/modules/networking/wireguard.nix @@ -0,0 +1,22 @@ +{ ... }: + +{ + networking.wireguard.interfaces = { + wg0 = { + ips = [ "10.0.0.2/24" ]; + privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store! + + peers = [ + { + publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY="; + allowedIPs = [ "0.0.0.0/0" ]; + endpoint = "server.maariz.org:51820"; + persistentKeepalive = 25; + } + ]; + }; + }; + + # Ensure the Wireguard UDP port is open if you are hosting the server + networking.firewall.allowedUDPPorts = [ 51820 ]; +} diff --git a/modules/virtualization/default.nix b/modules/virtualization/default.nix new file mode 100644 index 0000000..151214d --- /dev/null +++ b/modules/virtualization/default.nix @@ -0,0 +1,7 @@ +{ ... }: +{ + imports = [ + ./podman.nix + ./qemu.nix + ]; +} diff --git a/modules/virtualization/podman.nix b/modules/virtualization/podman.nix new file mode 100644 index 0000000..240516a --- /dev/null +++ b/modules/virtualization/podman.nix @@ -0,0 +1,37 @@ +{ pkgs, ... }: + +{ + virtualisation.podman = { + enable = true; + + dockerCompat = true; + defaultNetwork.settings.dns_enabled = true; + }; + + # For rootless containers + security.unprivilegedUsernsClone = true; + + users.users.river = { + subUidRanges = [ + { + startUid = 100000; + count = 65536; + } + ]; + subGidRanges = [ + { + startGid = 100000; + count = 65536; + } + ]; + + extraGroups = [ + "podman" + ]; + }; + + environment.systemPackages = with pkgs; [ + podman + podman-compose + ]; +} diff --git a/modules/virtualization/qemu.nix b/modules/virtualization/qemu.nix new file mode 100644 index 0000000..8905a2e --- /dev/null +++ b/modules/virtualization/qemu.nix @@ -0,0 +1,25 @@ +{ ... }: + +{ + virtualisation.spiceUSBRedirection.enable = true; + + virtualisation.libvirtd = { + enable = true; + qemu = { + ovmf.enable = true; + swtpm.enable = true; + }; + }; + + programs.virt-manager.enable = true; + + users.users.river.extraGroups = [ + "libvirtd" + "kvm" + ]; + + boot.kernelModules = [ + "kvm-intel" + "kvm-amd" + ]; +}