initialized flake

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &primary age1y98w2zgrc8f8l2sw632g697nqkcudvsknjmm85ajehpnnjtvvv6sx5670e
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+      - age:
+        - *primary

flake.lock

@@ -0,0 +1,100 @@
+{
+  "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709988192,
+        "narHash": "sha256-qxwIkl85P0I1/EyTT+NJwzbXdOv86vgZxcv4UKicjK8=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "b0b0c3d94345050a7f86d1ebc6c56eea4389d030",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1709884566,
+        "narHash": "sha256-NSYJg2sfdO/XS3L8XN/59Zhzn0dqWm7XtVnKI2mHq3w=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "2be119add7b37dc535da2dd4cba68e2cf8d1517e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1710033658,
+        "narHash": "sha256-yiZiVKP5Ya813iYLho2+CcFuuHpaqKc/CoxOlANKcqM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b17375d3bb7c79ffc52f3538028b2ec06eb79ef8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1709968316,
+        "narHash": "sha256-4rZEtEDT6jcgRaqxsatBeds7x1PoEiEjb6QNGb4mNrk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0e7f98a5f30166cbed344569426850b21e4091d4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "home-manager": "home-manager",
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1710039806,
+        "narHash": "sha256-vC2fo/phnetp6ub/nRv6mgAi5LbhJ6ujGQWrRD2VgNs=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f8d5c8baa83fe620a28c0db633be9db3e34474b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,32 @@
+{
+  description = "Nixos config flake";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
+
+    sops-nix.url = "github:Mic92/sops-nix";
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, ... }@inputs:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+    in
+    {
+    
+      nixosConfigurations = {
+        horizon = nixpkgs.lib.nixosSystem {
+          specialArgs = {inherit inputs;};
+          modules = [ 
+            ./hosts/horizon/configuration.nix
+            inputs.home-manager.nixosModules.default
+          ];
+        };
+      };
+    };
+}

hosts/emergent/configuration.nix

@@ -0,0 +1,5 @@
+# eve desktop
+{}: 
+{
+
+}

hosts/hesperium/configuration.nix

@@ -0,0 +1,5 @@
+# nas
+{}: 
+{
+
+}

hosts/horizon/configuration.nix

@@ -0,0 +1,291 @@
+# leyla laptop
+{ config, pkgs, inputs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      inputs.home-manager.nixosModules.default
+      inputs.sops-nix.nixosModules.sops
+    ];
+
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+  sops.defaultSopsFormat = "yaml";
+
+  sops.age.keyFile = "/home/leyla/.config/sops/age/keys.txt";
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  
+  boot.kernelModules = [ "sg" ];
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  networking.hostName = "leyla-laptop"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "America/Chicago";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the GNOME Desktop Environment.
+  services.xserver.displayManager.gdm.enable = true;
+  services.xserver.desktopManager.gnome.enable = true;
+  services.xserver.desktopManager.xterm.enable = false; 
+
+  # Get rid of xTerm
+  services.xserver.excludePackages = [ pkgs.xterm ];
+
+  # Configure keymap in X11
+  services.xserver = {
+    layout = "us";
+    xkbVariant = "";
+  };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  sound.enable = true;
+  hardware.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # enabled virtualisation for docker
+  virtualisation.docker.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Disables creating or editing users though methods not defined in this file
+  users.mutableUsers = false;
+
+  nixpkgs.config.permittedInsecurePackages = [
+    "electron-25.9.0"
+  ];
+
+  nixpkgs.overlays = [
+    (self: super: {
+      # idea is too out of date for android gradle things
+      jetbrains = {
+        jdk = super.jdk17;
+        idea-community = super.jetbrains.idea-community.overrideAttrs (oldAttrs: rec {
+          version = "2023.3.3";
+          name = "idea-community-${version}";
+          src = super.fetchurl {
+            sha256 = "sha256-3BI97Tx+3onnzT1NXkb62pa4dj9kjNDNvFt9biYgP9I=";
+            url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
+          };
+        });
+      };
+      # ui is broken on 1.84
+      vscodium = super.vscodium.overrideAttrs (oldAttrs: rec {
+        version = "1.85.2.24019";
+        src = super.fetchurl {
+          sha256 = "sha256-OBGFXOSN+Oq9uj/5O6tF0Kp7rxTY1AzNbhLK8G+EqVk=";
+          url = "https://github.com/VSCodium/vscodium/releases/download/${version}/VSCodium-linux-x64-${version}.tar.gz";
+        };
+      });
+    })
+  ];
+
+  sops.secrets."passwords/leyla".neededForUsers = true;
+  sops.secrets."passwords/ester".neededForUsers = true;
+  sops.secrets."passwords/eve".neededForUsers = true;
+
+  # Define user accounts
+  users.users = {
+    leyla = {
+      isNormalUser = true;
+      uid = 1000;
+      description = "Leyla";
+      extraGroups = [ "networkmanager" "wheel" "docker" ];
+
+      hashedPasswordFile = config.sops.secrets."passwords/leyla".path;
+      
+      packages = with pkgs; [
+        iputils
+        dnsutils
+        git
+        firefox
+        signal-desktop
+        obsidian
+        bitwarden
+#        vscode
+        vscodium
+        nextcloud-client
+        inkscape
+        steam
+        discord
+        rhythmbox
+        makemkv
+        protonvpn-gui
+        transmission-gtk
+        freecad
+        mupen64plus
+        dbeaver
+        easytag
+        cura
+        kicad-small
+#        jdk
+#        android-tools
+#        android-studio
+        androidStudioPackages.canary
+        jetbrains.idea-community
+        ungoogled-chromium
+	      nodejs
+        exiftool
+        libreoffice
+        # N64 Emulator
+        mupen64plus
+        # GameCube Emulator and Wii Emulator
+        dolphin-emu
+        # Switch Emulator
+        yuzu-mainline
+        # Atari 2600 Emulator
+        stella
+        # mame Emulator
+        mame
+        # Game Boy Advanced Emulator
+        vbam
+        # NES Emulator
+        fceux
+        # SNES Emulator
+        zsnes
+        # DS Emulator
+        desmume
+      ];
+    };
+
+    eve = {
+      isNormalUser = true;
+      uid = 1001;
+      description = "Eve";
+      extraGroups = [ "networkmanager" ];
+
+      hashedPasswordFile = config.sops.secrets."passwords/eve".path;
+
+      packages = with pkgs; [
+        firefox
+        bitwarden
+        discord
+        makemkv
+        signal-desktop
+      ];
+    };
+
+    ester = {
+      isNormalUser = true;
+      uid = 1002;
+      description = "Ester";
+      extraGroups = [ "networkmanager" ];
+
+      hashedPasswordFile = config.sops.secrets."passwords/ester".path;
+
+      packages = with pkgs; [
+        firefox
+        bitwarden
+        discord
+      ];
+    };
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    # resilio-sync
+    yt-dlp
+    spotdl
+    ffmpeg
+    chromaprint
+    docker
+    aileron
+#    sox
+#    songrec
+#    csvkit
+#    losslessaudiochecker
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # # List services that you want to enable:
+  # systemd.services = {
+  #   # Start resilio sync on boot
+  #   resilio-sync = {
+  #     description = "Resilio Sync service";
+      
+  #     serviceConfig = {
+  #       Type = "forking";
+  #       Restart = "on-failure";
+  #       ExecStart = "${pkgs.resilio-sync}/bin/rslsync";
+  #     };
+
+  #     after = [ "network.target" "network-online.target" ];
+  #     wantedBy = [ "multi-user.target" ];
+  #   };
+  # };
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}

hosts/horizon/hardware-configuration.nix

@@ -0,0 +1,62 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/866d422b-f816-4ad9-9846-791839cb9337";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/E138-65B5";
+      fsType = "vfat";
+    };
+
+  fileSystems."/mnt/leyla_home" =
+    {
+      device = "server.arpa:/home/leyla";
+      fsType = "nfs";
+      options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
+    };
+
+  fileSystems."/mnt/share_home" =
+    {
+      device = "server.arpa:/home/share";
+      fsType = "nfs";
+      options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
+    };
+
+  fileSystems."/mnt/docker_home" =
+    {
+      device = "server.arpa:/home/docker";
+      fsType = "nfs";
+      options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/be98e952-a072-4c3a-8c12-69500b5a2fff"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s20f0u1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp170s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/threshold/configuration.nix

@@ -0,0 +1,5 @@
+# eve laptop
+{}: 
+{
+
+}

hosts/twilight/configuration.nix

@@ -0,0 +1,5 @@
+# leyla desktop
+{}: 
+{
+
+}

secrets/secrets.yaml

@@ -0,0 +1,24 @@
+passwords:
+    leyla: ENC[AES256_GCM,data:2sTuJTlW9JQv+SDSkyaYEc/CjyBhzJe9FHHvacL2SEVilnHyVKi1XpBnn9WJxsRha2UEUad9wn0iw0vu04O2dN+jZO7iLBawyg==,iv:FacSTQ3LV+An9hzYj7veeIQdZUgUZO3/RDGa+5rqo1I=,tag:PH3G1oedpe8Mh6kmm4qDIw==,type:str]
+    ester: ENC[AES256_GCM,data:4TkuZr9hCskJZNnTeARz8f6jFWmsEKatoi/jpWrK2JGdvJBdqcodP119p1zfTqaFGA6O67YGhXQVAPVceIxAMplUL0UfV3tK6A==,iv:kmozFDwgtHeS02avCk40Ic0EUEJXvYbE5bl4lHX80pk=,tag:r3gmve2678RbJxeF5qdM8A==,type:str]
+    eve: ENC[AES256_GCM,data:3xXOvblJkUaX+lcL+jgibng49PnTHldMsObE6VMwyWuGaUbZh0psRZKU8TfojW7TCgVEF93aOTc+DWxVqy8ZrfN4gN7CSudCfQ==,iv:LngLHLPXNgc33xH8WniJFnqoExhytnnEvNVBKKSnCTA=,tag:dQ7sVsMHHus39DTXpiBS+A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1y98w2zgrc8f8l2sw632g697nqkcudvsknjmm85ajehpnnjtvvv6sx5670e
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLeFdXWDJ1SGNpNEw5b0NZ
+            U0xjU0Q0N2krdWRUS0w5SkQwNUVUd2FHRFZjCmpkZDZxSE9laC9RbDZhTG83UjVL
+            UWM0S2wvUWhJRkpQMER2UGphZWhsU2sKLS0tIHFoQ3Jic2RURXNtK1NYWlBxdnJy
+            WTluMWJsYUxLRVpVeHQ2N0VicUhtWTAKtMgsEkDABJLQi3Wa4NnzMmW5qQw6ExoO
+            g6AsAMTAN/eOuxNTA6+aMP3M0hMlO07f4UHwvYGifAfHHLidDlgc2g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-10T03:20:40Z"
+    mac: ENC[AES256_GCM,data:iqLZeEEb0PNKkCppho3BMx4rAKNco7y1aa81cvAcjim5lHvYiPKPzod4A6sd2ioc+uTVXbQO2Jt/zetYpld5YQ+lCgAyaaJ9oqI4gMruqpEYE+kQEO5e0+G84SVeMmp4DyRklCFfvsXATwPjkvpIixKASdJC+MLzqGuLkXUmueA=,iv:8h+d/gNxb3tbWdHZCtdXyTswOApjV3n9cuosHxscQu8=,tag:50mmDQcVwPJ7Ns9pkn6esQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1