nixos/hosts/nb-new.cloonar.com/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:
let
  unstable = import (fetchTarball https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz) {
    config = { allowUnfree = true; };
  };
  impermanence = builtins.fetchTarball "https://github.com/nix-community/impermanence/archive/master.tar.gz";
in {
  nixpkgs.config.allowUnfree = true;

  imports =
    [ # Include the results of the hardware scan.
      "${impermanence}/nixos.nix"
      ./utils/bento.nix
      
      ./utils/modules/sops.nix
      ./utils/modules/nur.nix
      ./modules/sway/sway.nix
      ./modules/printer.nix
      ./modules/nvim/default.nix
      ./utils/modules/autoupgrade.nix

      ./users

      ./hardware-configuration.nix
    ];

  nixpkgs.overlays = [
    (import ./utils/overlays/packages.nix)
  ];

  fonts.packages = with pkgs; [
    open-sans
  ];

  # nixos cross building qemu
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
  boot.supportedFilesystems = [ "ntfs" ];
  boot.plymouth = {
    enable = true;
    theme = "spin";
    themePackages = with pkgs; [
      # By default we would install all themes
      (adi1090x-plymouth-themes.override {
        selected_themes = [ "spin" ];
      })
    ];
  };

  environment.persistence."/nix/persist/system" = {
    hideMounts = true;
    directories = [
      "/etc/nixos"
      "/root/.ssh"
      "/var/bento"
      "/var/log"
      "/var/lib/bluetooth"
      "/var/lib/docker"
      "/var/lib/nixos"
      "/etc/NetworkManager/system-connections"
    ];
    files = [
      "/etc/machine-id"
      { file = "/etc/ssh/ssh_host_ed25519_key"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
      { file = "/etc/ssh/ssh_host_ed25519_key.pub"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
      { file = "/etc/ssh/ssh_host_rsa_key"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
      { file = "/etc/ssh/ssh_host_rsa_key.pub"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
    ];
  };

  services.openssh.enable = true;

  sops.defaultSopsFile = ./secrets.yaml;
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
  sops.age.generateKey = true;

  sops.secrets.epicenter_vpn_ca = {};
  sops.secrets.epicenter_vpn_cert = {};
  sops.secrets.epicenter_vpn_key = {};
  sops.secrets.wg_private_key = {};
  sops.secrets.wg_preshared_key = {};
  sops.secrets.wg-cloonar-key = {};

  virtualisation.docker.enable = true;

  networking.hostName = "nb-01"; # Define your hostname.
  networking.resolvconf.enable = true;
  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
  networking.extraHosts = ''
    10.25.0.25 archive.zeichnemit.at
    127.0.0.1 wohnservice.local mieterhilfe.local wohnpartner.local wohnberatung.local wienbautvor.local wienwohntbesser.local
    127.0.0.1 wohnservice-wien.local mieterhilfe.local wohnpartner-wien.local wohnberatung-wien.local wienbautvor.local wienwohntbesser.local
    127.0.0.1 diabetes.local
    127.0.0.1 test.cloonar.com
  '';

  # Set your time zone.
  time.timeZone = "Europe/Vienna";
  console.keyMap = "de";

  users.users.dominik = {
    isNormalUser = true;
    hashedPassword = "$y$j9T$btz9xel62NjCyLdQRm5ck1$iCm6R7u4wiMeSVfrB6Y.3UwoQJ/rfkXiYSrXI2RTYm/";
    extraGroups = [ "wheel" "disk" "video" "audio" "mysql" "docker" "vboxusers" "networkmanager" "onepassword" "onepassword-cli" "dialout" ]; # Enable ‘sudo’ for the user.
  };

  environment.systemPackages = with pkgs; [
    bento
    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
    wget
    docker-compose
    drone-cli
    wireguard-tools
    wineWowPackages.stable
    wineWowPackages.fonts
    winetricks
    git-filter-repo
    ykfde
    nix-prefetch-git
  ];

  environment.variables = {
    TERMINAL_COMMAND = "alacritty";
  };

  services.blueman.enable = true;

  system.stateVersion = "24.05"; # Did you read the comment?

  security.polkit.enable = true;
  systemd = {
    user.services.polkit-gnome-authentication-agent-1 = {
      description = "polkit-gnome-authentication-agent-1";
      wantedBy = [ "graphical-session.target" ];
      wants = [ "graphical-session.target" ];
      after = [ "graphical-session.target" ];
      serviceConfig = {
          Type = "simple";
          ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
          Restart = "on-failure";
          RestartSec = 1;
          TimeoutStopSec = 10;
        };
    };
  };

  networking.wireguard.interfaces = {
    wg0 = {
      # Determines the IP address and subnet of the client's end of the tunnel interface.
      ips = [ "10.42.98.201/32" ];
      # Path to the private key file.
      #
      # Note: The private key can also be included inline via the privateKey option,
      # but this makes the private key world-readable; thus, using privateKeyFile is
      # recommended.
      # publicKey: YdlRGsjh4hS3OMJI+t6SZ2eGXKbs0wZBXWudHW4NyS8=
      privateKeyFile = config.sops.secrets.wg-cloonar-key.path;

      peers = [
        {
          publicKey = "TKQVDmBnf9av46kQxLQSBDhAeaK8r1zh8zpU64zuc1Q=";
          allowedIPs = [ "10.42.96.0/20" "10.14.0.0/16" "10.25.0.0/16" ];
          endpoint = "vpn.cloonar.com:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
          persistentKeepalive = 25;
        }
      ];
    };
  };

  nix = {
    settings.auto-optimise-store = true;
    # autoOptimiseStore = true;
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 30d";
    };
    # Free up to 1GiB whenever there is less than 100MiB left.
    extraOptions = ''
      min-free = ${toString (100 * 1024 * 1024)}
      max-free = ${toString (1024 * 1024 * 1024)}
    '';
  };


}