From c5209b0d905f0922d7c1eae0732140b98191fe5a Mon Sep 17 00:00:00 2001 From: Maaz Khokhar Date: Sat, 11 Jul 2026 23:14:30 -0500 Subject: [PATCH] finally system boots with new config need to add all my stuff btw --- hosts/pc/configuration.nix | 70 +++++++++++++-- hosts/pc/hardware-configuration.nix | 2 +- modules/core/config.nix | 103 ++++++++++++++++++++++ modules/core/default.nix | 108 ++---------------------- modules/core/options.nix | 48 +++++++++++ modules/core/shared.nix | 9 ++ modules/networking/core/default.nix | 58 ++++++------- modules/networking/core/firewall.nix | 17 ++-- modules/networking/default.nix | 4 +- modules/networking/options.nix | 122 +++++++++++++++++++++++++++ modules/networking/tailscale.nix | 49 ++++++----- modules/networking/wireguard.nix | 35 ++++---- modules/virtualization/default.nix | 2 +- modules/virtualization/lima.nix | 18 ++-- modules/virtualization/options.nix | 46 ++++++++++ modules/virtualization/podman.nix | 81 ++++++++++-------- modules/virtualization/qemu.nix | 58 ++++++++----- 17 files changed, 578 insertions(+), 252 deletions(-) create mode 100644 modules/core/config.nix create mode 100644 modules/core/options.nix create mode 100644 modules/core/shared.nix create mode 100644 modules/networking/options.nix create mode 100644 modules/virtualization/options.nix diff --git a/hosts/pc/configuration.nix b/hosts/pc/configuration.nix index fe3b4c0..7f5ecee 100755 --- a/hosts/pc/configuration.nix +++ b/hosts/pc/configuration.nix @@ -27,11 +27,6 @@ ../../desktops/hyprland ]; - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - networking.hostName = "nixos"; - environment.systemPackages = with pkgs; [ libsecret tree @@ -63,6 +58,7 @@ ]; programs.kdeconnect.enable = true; + services.keyd = { enable = false; keyboards.default = { @@ -74,6 +70,68 @@ }; }; + workstation = { + core = { + kernel = "latest"; + allowUnfree = true; + ssh.permitRootLogin = true; + + user = { + name = "river"; + fullName = "Maaz Khokhar"; + shell = "fish"; + }; + }; + + networking = { + core = { + firewall = { + allowPing = true; + ports.tcp = [ + 22 + 80 + 5900 + 16570 + 18789 + ]; + }; + extraHosts = [ + { + ip_address = "192.168.1.60"; + hostname = "laptop"; + } + ]; + nameservers = [ + "192.168.1.193" + "1.1.1.1" + "1.0.0.1" + ]; + }; + tailscale.enable = true; + }; + + virtualization = { + user = "river"; + + qemu = { + enable = true; + containers = true; + spiceUSBRedirection = true; + virtManager = true; + bootModules = [ + "kvm-amd" + ]; + }; + + podman = { + enable = true; + packages.enable = true; + }; + + lima.enable = true; + }; + }; + programs.nix-ld.libraries = with pkgs; [ brotli stdenv.cc.cc.lib @@ -93,6 +151,4 @@ enableAllFirmware = true; enableRedistributableFirmware = true; }; - - system.stateVersion = "25.11"; } diff --git a/hosts/pc/hardware-configuration.nix b/hosts/pc/hardware-configuration.nix index d97a7a7..f2d3c49 100644 --- a/hosts/pc/hardware-configuration.nix +++ b/hosts/pc/hardware-configuration.nix @@ -19,7 +19,7 @@ }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7082-DAFE"; + { device = "/dev/disk/by-uuid/8750-9317"; fsType = "vfat"; options = [ "fmask=0077" "dmask=0077" ]; }; diff --git a/modules/core/config.nix b/modules/core/config.nix new file mode 100644 index 0000000..31bd3e0 --- /dev/null +++ b/modules/core/config.nix @@ -0,0 +1,103 @@ +{ + config, + pkgs, + shared, + ... +}: +let + cfg = config.workstation.core; + allowRootSSH = if cfg.ssh.permitRootLogin then "yes" else "no"; +in +{ + config = { + networking.hostName = cfg.hostname; + + boot = { + kernelPackages = shared.kernelOptions.${cfg.kernel}; + loader = { + systemd-boot = { + enable = true; + editor = true; + }; + efi.canTouchEfiVariables = true; + }; + }; + + time.timeZone = "America/Chicago"; + + programs.${cfg.user.shell}.enable = true; + + users.users.${cfg.user.name} = with cfg.user; { + isNormalUser = true; + description = fullName; + extraGroups = [ + "wheel" + "networkmanager" + "input" + ]; + + shell = pkgs.${shell}; + }; + + nixpkgs.config.allowUnfree = true; + + environment.systemPackages = with pkgs; [ + gitFull + neovim + git-credential-manager + gnupg + ]; + + nix = { + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 7d"; + }; + settings = { + trusted-users = [ + "root" + cfg.user.name + ]; + experimental-features = [ + "nix-command" + "flakes" + ]; + auto-optimise-store = true; + }; + }; + + programs.nix-ld.enable = true; + + i18n = { + defaultLocale = "en_US.UTF-8"; + + extraLocaleSettings = { + LC_ADDRESS = "en_US.UTF-8"; + LC_IDENTIFICATION = "en_US.UTF-8"; + LC_MEASUREMENT = "en_US.UTF-8"; + LC_MONETARY = "en_US.UTF-8"; + LC_NAME = "en_US.UTF-8"; + LC_NUMERIC = "en_US.UTF-8"; + LC_PAPER = "en_US.UTF-8"; + LC_TELEPHONE = "en_US.UTF-8"; + LC_TIME = "en_US.UTF-8"; + }; + }; + + security.rtkit.enable = true; + + services = { + xserver.xkb = { + layout = "us"; + variant = ""; + }; + + openssh = { + enable = true; + settings.PermitRootLogin = allowRootSSH; + }; + }; + system.stateVersion = "26.11"; + }; +} diff --git a/modules/core/default.nix b/modules/core/default.nix index 4ad04ba..2fe6fc3 100644 --- a/modules/core/default.nix +++ b/modules/core/default.nix @@ -1,107 +1,13 @@ -{ pkgs, inputs, ... }: +{ pkgs, ... }: + let - system = pkgs.stdenv.hostPlatform.system; + shared = import ./shared.nix { inherit pkgs; }; in { - boot.kernelPackages = pkgs.linuxPackages_latest; - - time.timeZone = "America/Chicago"; - - programs.fish.enable = true; - - users.users.river = { - isNormalUser = true; - description = "Maaz Khokhar"; - extraGroups = [ - "wheel" - "networkmanager" - "input" - ]; - - shell = pkgs.fish; - }; - - nixpkgs.config.allowUnfree = true; - - environment.systemPackages = with pkgs; [ - gitFull - neovim - btop - unzip - mpv - wl-clipboard - wireplumber - brightnessctl - pulseaudio - pavucontrol - ghostty - git-credential-manager - gnupg - yazi - jujutsu - glow - - inputs.silicate.packages.${system}.default - inputs.herdr.packages.${system}.default + imports = [ + ./options.nix + ./config.nix ]; - nix = { - gc = { - automatic = true; - dates = "weekly"; - options = "--delete-older-than 7d"; - }; - settings = { - trusted-users = [ - "root" - "river" - ]; - experimental-features = [ - "nix-command" - "flakes" - ]; - auto-optimise-store = true; - }; - }; - - programs.nix-ld.enable = true; - - i18n = { - defaultLocale = "en_US.UTF-8"; - - extraLocaleSettings = { - LC_ADDRESS = "en_US.UTF-8"; - LC_IDENTIFICATION = "en_US.UTF-8"; - LC_MEASUREMENT = "en_US.UTF-8"; - LC_MONETARY = "en_US.UTF-8"; - LC_NAME = "en_US.UTF-8"; - LC_NUMERIC = "en_US.UTF-8"; - LC_PAPER = "en_US.UTF-8"; - LC_TELEPHONE = "en_US.UTF-8"; - LC_TIME = "en_US.UTF-8"; - }; - }; - - security.rtkit.enable = true; - - services = { - xserver.xkb = { - layout = "us"; - variant = ""; - }; - - pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - - openssh = { - enable = true; - settings.PermitRootLogin = "no"; - }; - - printing.enable = true; - }; + _module.args.shared = shared; } diff --git a/modules/core/options.nix b/modules/core/options.nix new file mode 100644 index 0000000..121a837 --- /dev/null +++ b/modules/core/options.nix @@ -0,0 +1,48 @@ +{ + lib, + shared, + ... +}: +{ + options.workstation.core = { + hostname = lib.mkOption { + type = lib.types.str; + default = "nixos"; + description = "Hostname of the machine"; + }; + + kernel = lib.mkOption { + type = with lib.types; enum (builtins.attrNames shared.kernelOptions); + default = "lts"; + description = "The kernel of the machine"; + }; + + user = { + name = lib.mkOption { + type = lib.types.str; + default = "river"; + description = "The username of the primary user"; + }; + + fullName = lib.mkOption { + type = lib.types.str; + default = "Maaz Khokhar"; + description = "The full name of the user"; + }; + + shell = lib.mkOption { + type = lib.types.str; + default = "fish"; + description = "The shell the primary user uses"; + }; + }; + + allowUnfree = lib.mkEnableOption "unfree packages" // { + default = true; + }; + + ssh = { + permitRootLogin = lib.mkEnableOption "root SSH login"; + }; + }; +} diff --git a/modules/core/shared.nix b/modules/core/shared.nix new file mode 100644 index 0000000..8ffbc14 --- /dev/null +++ b/modules/core/shared.nix @@ -0,0 +1,9 @@ +{ pkgs, ... }: + +{ + kernelOptions = { + stable = pkgs.linuxPackages; + lts = pkgs.linuxPackages_6_12; + latest = pkgs.linuxPackages_latest; + }; +} diff --git a/modules/networking/core/default.nix b/modules/networking/core/default.nix index e65f50d..4ce4b1a 100644 --- a/modules/networking/core/default.nix +++ b/modules/networking/core/default.nix @@ -1,38 +1,38 @@ -{ ... }: - +{ config, lib, ... }: +let + cfg = config.workstation.networking.core; +in { imports = [ ./firewall.nix ]; - networking = { - networkmanager = { + config = { + networking = { + networkmanager = { + enable = true; + dns = "systemd-resolved"; + }; + + extraHosts = lib.concatMapStringsSep "\n" ( + host: "${host.ip_address} ${host.hostname}" + ) cfg.extraHosts; + + nftables.enable = true; + + nameservers = cfg.nameservers; + }; + + services.resolved = { enable = true; - dns = "systemd-resolved"; + + settings.Resolve = { + dnssec = "true"; + DNSOverTLS = "true"; + domains = [ "~." ]; + fallbackDns = cfg.nameservers; + }; + }; - extraHosts = "192.168.1.60 laptop"; - nftables.enable = true; - - nameservers = [ - "192.168.1.193" # Pi-hole - "1.1.1.1" # Cloudflare - "1.0.0.1" # Cloudflare (Secondary) - ]; - }; - - services.resolved = { - enable = true; - - settings.Resolve = { - dnssec = "true"; - DNSOverTLS = "true"; - domains = [ "~." ]; - fallbackDns = [ - "192.168.1.193" # Pi-hole - "1.1.1.1" # Cloudflare - "1.0.0.1" # Cloudflare (Secondary) - ]; - }; - }; } diff --git a/modules/networking/core/firewall.nix b/modules/networking/core/firewall.nix index 88c1f69..0ce4fd9 100644 --- a/modules/networking/core/firewall.nix +++ b/modules/networking/core/firewall.nix @@ -1,17 +1,14 @@ -{ ... }: - +{ config, ... }: +let + cfg = config.workstation.networking.core.firewall; +in { networking.firewall = { enable = true; - allowPing = true; + allowPing = cfg.allowPing; - allowedTCPPorts = [ - 22 - 80 - ]; - allowedUDPPorts = [ - 53 - ]; + allowedTCPPorts = cfg.ports.tcp; + allowedUDPPorts = cfg.ports.udp; }; } diff --git a/modules/networking/default.nix b/modules/networking/default.nix index 9326373..1301d07 100644 --- a/modules/networking/default.nix +++ b/modules/networking/default.nix @@ -1,8 +1,8 @@ -{ ... }: - { imports = [ + ./options.nix ./core + ./wireguard.nix ./tailscale.nix ]; } diff --git a/modules/networking/options.nix b/modules/networking/options.nix new file mode 100644 index 0000000..22dee57 --- /dev/null +++ b/modules/networking/options.nix @@ -0,0 +1,122 @@ +{ + lib, + ... +}: +{ + options.workstation.networking = { + user = lib.mkOption { + type = lib.types.str; + default = "river"; + description = "The user to run tailscale's services as."; + }; + + # core + core = { + firewall = { + allowPing = lib.mkEnableOption "ICMP pinging" // { + default = true; + }; + + ports = { + tcp = lib.mkOption { + type = with lib.types; listOf number; + default = [ + 22 + 80 + ]; + }; + udp = lib.mkOption { + type = with lib.types; listOf number; + default = [ 53 ]; + }; + }; + }; + + extraHosts = lib.mkOption { + type = + with lib.types; + listOf ( + submodule ( + { ... }: { + options = { + ip_address = lib.mkOption { + type = str; + }; + + hostname = lib.mkOption { + type = str; + }; + }; + } + ) + ); + + default = [ ]; + description = "Additional hosts to add."; + }; + + nameservers = lib.mkOption { + type = with lib.types; listOf str; + + default = [ + "192.168.1.193" + "1.1.1.1" + "1.0.0.1" + ]; + description = "DNS Resolvers for System"; + }; + }; + + # wireguard + wireguard = { + enable = lib.mkEnableOption "Wireguard support"; + + interfaces = lib.mkOption { + type = lib.types.attrsOf ( + lib.types.submodule { + options = { + enable = lib.mkEnableOption "Enable this WG interface"; + + address = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + }; + + privateKeyFile = lib.mkOption { + type = lib.types.str; + }; + + peers = lib.mkOption { + type = lib.types.listOf ( + lib.types.submodule { + options = { + publicKey = lib.mkOption { type = lib.types.str; }; + allowedIPs = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + }; + endpoint = lib.mkOption { + type = lib.types.str; + default = ""; + }; + persistentKeepalive = lib.mkOption { + type = lib.types.nullOr lib.types.int; + default = null; + }; + }; + } + ); + default = [ ]; + }; + }; + } + ); + }; + }; + + # tailscale + tailscale = { + enable = lib.mkEnableOption "Tailscale mesh VPN"; + }; + }; +} diff --git a/modules/networking/tailscale.nix b/modules/networking/tailscale.nix index 57a3e57..4c13a0b 100644 --- a/modules/networking/tailscale.nix +++ b/modules/networking/tailscale.nix @@ -1,25 +1,30 @@ -{ config, ... }: - +{ config, lib, ... }: +let + cfg = config.workstation.networking.tailscale; + user = config.workstation.networking.user; +in { - services.tailscale = { - enable = true; - openFirewall = true; - extraSetFlags = [ "--operator=river" ]; + config = lib.mkIf cfg.enable { + services.tailscale = { + enable = true; + openFirewall = true; + extraSetFlags = [ "--operator=${user}" ]; + }; + + networking.firewall = { + trustedInterfaces = [ config.services.tailscale.interfaceName ]; + allowedUDPPorts = [ config.services.tailscale.port ]; + }; + + systemd.services.tailscaled.serviceConfig.Environment = [ + "TS_DEBUG_FIREWALL_MODE=nftables" + ]; + + systemd.network.wait-online.enable = false; + boot.initrd.systemd.network.wait-online.enable = false; + + users.users.${user}.extraGroups = [ + "tailscale" + ]; }; - - networking.firewall = { - trustedInterfaces = [ config.services.tailscale.interfaceName ]; - allowedUDPPorts = [ config.services.tailscale.port ]; - }; - - systemd.services.tailscaled.serviceConfig.Environment = [ - "TS_DEBUG_FIREWALL_MODE=nftables" - ]; - - systemd.network.wait-online.enable = false; - boot.initrd.systemd.network.wait-online.enable = false; - - users.users.river.extraGroups = [ - "tailscale" - ]; } diff --git a/modules/networking/wireguard.nix b/modules/networking/wireguard.nix index 70f233a..6a0656b 100644 --- a/modules/networking/wireguard.nix +++ b/modules/networking/wireguard.nix @@ -1,22 +1,21 @@ -{ ... }: - +{ config, lib, ... }: +let + cfg = config.workstation.networking.wireguard; +in { - networking.wireguard.interfaces = { - wg0 = { - ips = [ "10.0.0.2/24" ]; - privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store! + config = lib.mkIf cfg.enable { + networking.wg-quick.interfaces = lib.mapAttrs (name: iface: { + address = iface.address; + privateKeyFile = iface.privateKeyFile; + peers = map (p: { + publicKey = p.publicKey; + allowedIPs = p.allowedIPs; + endpoint = p.endpoint; - peers = [ - { - publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY="; - allowedIPs = [ "0.0.0.0/0" ]; - endpoint = "server.maariz.org:51820"; - persistentKeepalive = 25; - } - ]; - }; + persistentKeepalive = if p.persistentKeepalive != null then p.persistentKeepalive else null; + }) iface.peers; + }) (lib.filterAttrs (_: v: v.enable) cfg.interfaces); + + networking.firewall.allowedUDPPorts = [ 51820 ]; }; - - # Ensure the Wireguard UDP port is open if you are hosting the server - networking.firewall.allowedUDPPorts = [ 51820 ]; } diff --git a/modules/virtualization/default.nix b/modules/virtualization/default.nix index a29a57b..cdc829c 100644 --- a/modules/virtualization/default.nix +++ b/modules/virtualization/default.nix @@ -3,6 +3,6 @@ imports = [ ./podman.nix ./qemu.nix - ./lima.nix + ./options.nix ]; } diff --git a/modules/virtualization/lima.nix b/modules/virtualization/lima.nix index 9676f94..f64cdef 100644 --- a/modules/virtualization/lima.nix +++ b/modules/virtualization/lima.nix @@ -1,7 +1,15 @@ -{ pkgs, ... }: - { - environment.systemPackages = with pkgs; [ - lima - ]; + config, + lib, + pkgs, +}: +let + cfg = config.workstation.virtualization.lima; +in +{ + config = lib.mkIf cfg.enable { + environment.systemPackages = with pkgs; [ + lima + ]; + }; } diff --git a/modules/virtualization/options.nix b/modules/virtualization/options.nix new file mode 100644 index 0000000..1b58541 --- /dev/null +++ b/modules/virtualization/options.nix @@ -0,0 +1,46 @@ +{ + lib, + ... +}: +{ + options.workstation.virtualization = { + user = lib.mkOption { + type = lib.types.str; + default = "river"; + description = "The user to run virtualization services as."; + }; + + # podman + podman = { + enable = lib.mkEnableOption "Podman support"; + + packages = { + enable = lib.mkEnableOption "relevant Podman packages"; + }; + }; + + # qemu + qemu = { + enable = lib.mkEnableOption "QEMU support"; + + containers = lib.mkEnableOption "container support for QEMU"; + + spiceUSBRedirection = lib.mkEnableOption "spice USB redirection support for QEMU"; + + virtManager = lib.mkEnableOption "virt-manager support for QEMU"; + + bootModules = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ + "kvm-intel" + "kvm-amd" + ]; + description = "The kernel modules to load for QEMU support."; + }; + }; + + lima = { + enable = lib.mkEnableOption "Lima lite VM"; + }; + }; +} diff --git a/modules/virtualization/podman.nix b/modules/virtualization/podman.nix index efc5fb8..17cbd80 100644 --- a/modules/virtualization/podman.nix +++ b/modules/virtualization/podman.nix @@ -1,42 +1,55 @@ -{ pkgs, ... }: - { - virtualisation = { - oci-containers.backend = "podman"; - containers.registries.search = [ "docker.io" ]; - podman = { - enable = true; + config, + lib, + pkgs, + ... +}: +let + cfg = config.workstation.virtualization; +in +{ + config = lib.mkMerge [ + (lib.mkIf cfg.podman.enable { + virtualisation = { + oci-containers.backend = "podman"; + podman = { - dockerCompat = true; - defaultNetwork.settings.dns_enabled = true; - }; - }; + enable = true; - # For rootless containers - security.unprivilegedUsernsClone = true; + dockerCompat = true; + defaultNetwork.settings.dns_enabled = true; + }; + }; - users.users.river = { - subUidRanges = [ - { - startUid = 100000; - count = 65536; - } - ]; - subGidRanges = [ - { - startGid = 100000; - count = 65536; - } - ]; + # For rootless containers + security.unprivilegedUsernsClone = true; - extraGroups = [ - "podman" - ]; - }; + users.users.${cfg.user} = { + subUidRanges = [ + { + startUid = 100000; + count = 65536; + } + ]; + subGidRanges = [ + { + startGid = 100000; + count = 65536; + } + ]; - environment.systemPackages = with pkgs; [ - podman - podman-compose - podman-desktop + extraGroups = [ + "podman" + ]; + }; + }) + + (lib.mkIf cfg.podman.packages.enable { + environment.systemPackages = with pkgs; [ + podman + podman-compose + podman-desktop + ]; + }) ]; } diff --git a/modules/virtualization/qemu.nix b/modules/virtualization/qemu.nix index 4775e6b..476e4aa 100644 --- a/modules/virtualization/qemu.nix +++ b/modules/virtualization/qemu.nix @@ -1,30 +1,44 @@ -{ pkgs, ... }: - { - virtualisation.spiceUSBRedirection.enable = true; - - virtualisation = { - containers.enable = true; - libvirtd = { - enable = true; - qemu = { - package = pkgs.qemu_kvm; - swtpm.enable = true; + config, + lib, + pkgs, + ... +}: +let + cfg = config.workstation.virtualization; +in +{ + config = lib.mkMerge [ + (lib.mkIf cfg.qemu.enable { + virtualisation = { + libvirtd = { + enable = true; + qemu = { + package = pkgs.qemu_kvm; + swtpm.enable = true; + }; + }; }; - }; - }; + users.users.${cfg.user}.extraGroups = [ + "libvirtd" + "kvm" + ]; + }) - networking.firewall.trustedInterfaces = [ "virbr0" ]; + (lib.mkIf cfg.qemu.spiceUSBRedirection { + virtualisation.spiceUSBRedirection.enable = true; + }) - programs.virt-manager.enable = true; + (lib.mkIf cfg.qemu.virtManager { + programs.virt-manager.enable = true; + }) - users.users.river.extraGroups = [ - "libvirtd" - "kvm" - ]; + (lib.mkIf (cfg.qemu.enable && cfg.qemu.containers) { + virtualisation.containers.enable = true; + }) - boot.kernelModules = [ - "kvm-intel" - "kvm-amd" + (lib.mkIf cfg.qemu.enable { + boot.kernelModules = cfg.qemu.bootModules; + }) ]; }