A new start

modules/darwin/home/default.nix

@@ -0,0 +1,40 @@
+{ options, config, pkgs, lib, inputs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.home;
+in
+{
+  # imports = with inputs; [
+  #   home-manager.darwinModules.home-manager
+  # ];
+
+  options.metacfg.home = with types; {
+    file = mkOpt attrs { }
+      "A set of files to be managed by home-manager's <option>home.file</option>.";
+    configFile = mkOpt attrs { }
+      "A set of files to be managed by home-manager's <option>xdg.configFile</option>.";
+    extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
+    homeConfig = mkOpt attrs { } "Final config for home-manager.";
+  };
+
+  config = {
+    metacfg.home.extraOptions = {
+      home.stateVersion = mkDefault "23.11";
+      home.file = mkAliasDefinitions options.metacfg.home.file;
+      xdg.enable = true;
+      xdg.configFile = mkAliasDefinitions options.metacfg.home.configFile;
+    };
+
+    snowfallorg.users.${config.metacfg.user.name}.home.config = mkAliasDefinitions options.metacfg.home.extraOptions;
+
+    home-manager = {
+      useUserPackages = true;
+      useGlobalPkgs = true;
+
+      # users.${config.metacfg.user.name} = args:
+      #   mkAliasDefinitions options.metacfg.home.extraOptions;
+    };
+  };
+}

modules/darwin/nix/default.nix

@@ -0,0 +1,74 @@
+{ options
+, config
+, pkgs
+, lib
+, ...
+}:
+with lib;
+with lib.metacfg; let
+  cfg = config.metacfg.nix;
+in
+{
+  options.metacfg.nix = with types; {
+    enable = mkBoolOpt true "Whether or not to manage nix configuration.";
+    package = mkOpt package pkgs.nixUnstable "Which nix package to use.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      deploy-rs
+      nixfmt
+      nix-index
+      nix-prefetch-git
+    ];
+
+    nix =
+      let
+        users = [ "root" config.metacfg.user.name ];
+      in
+      {
+        package = cfg.package;
+
+        settings = {
+          experimental-features = "nix-command flakes";
+          http-connections = 50;
+          warn-dirty = false;
+          log-lines = 50;
+
+          # Large builds apparently fail due to an issue with darwin:
+          # https://github.com/NixOS/nix/issues/4119
+          sandbox = false;
+
+          # This appears to break on darwin
+          # https://github.com/NixOS/nix/issues/7273
+          auto-optimise-store = false;
+
+          allow-import-from-derivation = true;
+
+          trusted-users = users;
+          allowed-users = users;
+
+          # NOTE: This configuration is generated by nix-installer so I'm adding it here in
+          # case it becomes important.
+          extra-nix-path = "nixpkgs=flake:nixpkgs";
+          build-users-group = "nixbld";
+        };
+        #// (lib.optionalAttrs config.metacfg.tools.direnv.enable {
+        #  keep-outputs = true;
+        #  keep-derivations = true;
+        #});
+
+        gc = {
+          automatic = true;
+          interval = { Day = 7; };
+          options = "--delete-older-than 30d";
+          user = config.metacfg.user.name;
+        };
+
+        # flake-utils-plus
+        generateRegistryFromInputs = true;
+        generateNixPathFromInputs = true;
+        linkInputs = true;
+      };
+  };
+}

modules/darwin/security/gpg/default.nix

@@ -0,0 +1,122 @@
+{ lib, config, pkgs, inputs, ... }:
+
+let
+  inherit (lib) types mkEnableOption mkIf;
+  inherit (lib.metacfg) mkOpt;
+
+  cfg = config.metacfg.security.gpg;
+  gpgConf = "${inputs.gpg-base-conf}/gpg.conf";
+
+  gpgAgentConf = ''
+    enable-ssh-support
+    default-cache-ttl 60
+    max-cache-ttl 120
+  '';
+
+in
+{
+  options.metacfg.security.gpg = {
+    enable = mkEnableOption "GPG";
+    agentTimeout = mkOpt types.int 5 "The amount of time to wait before continuing with shell init.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      gnupg
+    ];
+
+    environment.shellInit = ''
+      export GPG_TTY="$(tty)"
+      export SSH_AUTH_SOCK=$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)
+
+      ${pkgs.coreutils}/bin/timeout ${builtins.toString cfg.agentTimeout} ${pkgs.gnupg}/bin/gpgconf --launch gpg-agent
+      gpg_agent_timeout_status=$?
+
+      if [ "$gpg_agent_timeout_status" = 124 ]; then
+        # Command timed out...
+        echo "GPG Agent timed out..."
+        echo 'Run "gpgconf --launch gpg-agent" to try and launch it again.'
+      fi
+    '';
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+    };
+
+    metacfg.home.file = {
+      ".gnupg/.keep".text = "";
+
+      ".gnupg/gpg.conf".text = ''
+        # https://github.com/drduh/config/blob/master/gpg.conf
+        # https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html
+        # https://www.gnupg.org/documentation/manuals/gnupg/GPG-Esoteric-Options.html
+        # 'gpg --version' to get capabilities
+        # Use AES256, 192, or 128 as cipher
+        personal-cipher-preferences AES256 AES192 AES
+        # Use SHA512, 384, or 256 as digest
+        personal-digest-preferences SHA512 SHA384 SHA256
+        # Use ZLIB, BZIP2, ZIP, or no compression
+        personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed
+        # Default preferences for new keys
+        default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed
+        # SHA512 as digest to sign keys
+        cert-digest-algo SHA512
+        # SHA512 as digest for symmetric ops
+        s2k-digest-algo SHA512
+        # AES256 as cipher for symmetric ops
+        s2k-cipher-algo AES256
+        # UTF-8 support for compatibility
+        charset utf-8
+        # No comments in messages
+        no-comments
+        # No version in output
+        no-emit-version
+        # Disable banner
+        no-greeting
+        # Long key id format
+        keyid-format 0xlong
+        # Display UID validity
+        list-options show-uid-validity
+        verify-options show-uid-validity
+        # Display all keys and their fingerprints
+        with-fingerprint
+        # Display key origins and updates
+        #with-key-origin
+        # Cross-certify subkeys are present and valid
+        require-cross-certification
+        # Disable caching of passphrase for symmetrical ops
+        no-symkey-cache
+        # Enable smartcard
+        use-agent
+        # Disable recipient key ID in messages (breaks Mailvelope)
+        throw-keyids
+        # Default key ID to use (helpful with throw-keyids)
+        #default-key 0xFF3E7D88647EBCDB
+        #trusted-key 0xFF3E7D88647EBCDB
+        # Group recipient keys (preferred ID last)
+        #group keygroup = 0xFF00000000000001 0xFF00000000000002 0xFF3E7D88647EBCDB
+        # Keyserver URL
+        #keyserver hkps://keys.openpgp.org
+        #keyserver hkps://keys.mailvelope.com
+        #keyserver hkps://keyserver.ubuntu.com:443
+        #keyserver hkps://pgpkeys.eu
+        #keyserver hkps://pgp.circl.lu
+        #keyserver hkp://zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion
+        # Keyserver proxy
+        #keyserver-options http-proxy=http://127.0.0.1:8118
+        #keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050
+        # Enable key retrieval using WKD and DANE
+        #auto-key-locate wkd,dane,local
+        #auto-key-retrieve
+        # Trust delegation mechanism
+        #trust-model tofu+pgp
+        # Show expired subkeys
+        #list-options show-unusable-subkeys
+        # Verbose output
+        #verbose
+      '';
+      ".gnupg/gpg-agent.conf".text = gpgAgentConf;
+    };
+  };
+}

modules/darwin/services/nix-daemon/default.nix

@@ -0,0 +1,17 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) types mkIf;
+  inherit (lib.metacfg) mkOpt enabled;
+
+  cfg = config.metacfg.services.nix-daemon;
+in
+{
+  options.metacfg.services.nix-daemon = {
+    enable = mkOpt types.bool true "Whether to enable the Nix daemon.";
+  };
+
+  config = mkIf cfg.enable {
+    services.nix-daemon = enabled;
+  };
+}

modules/darwin/suites/common/default.nix

@@ -0,0 +1,30 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.suites.common;
+in
+{
+  options.metacfg.suites.common = with types; {
+    enable = mkBoolOpt false "Whether or not to enable common configuration.";
+  };
+
+  config = mkIf cfg.enable {
+    programs.fish = enabled;
+
+    metacfg = {
+      nix = enabled;
+
+      system = {
+        fonts = enabled;
+        #input = enabled;
+        interface = enabled;
+      };
+
+      security = {
+        gpg = enabled;
+      };
+    };
+  };
+}

modules/darwin/system/fonts/default.nix

@@ -0,0 +1,32 @@
+{ options, config, pkgs, lib, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.system.fonts;
+in
+{
+  options.metacfg.system.fonts = with types; {
+    enable = mkBoolOpt false "Whether or not to manage fonts.";
+    fonts = mkOpt (listOf package) [ ] "Custom font packages to install.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.variables = {
+      # Enable icons in tooling since we have nerdfonts.
+      LOG_ICONS = "true";
+    };
+
+    fonts = {
+      fontDir = enabled;
+
+      fonts = with pkgs;
+        [
+          noto-fonts
+          noto-fonts-cjk-sans
+          noto-fonts-cjk-serif
+          noto-fonts-emoji
+          (nerdfonts.override { fonts = [ "Hack" ]; })
+        ] ++ cfg.fonts;
+    };
+  };
+}

modules/darwin/system/interface/default.nix

@@ -0,0 +1,29 @@
+{ options, config, pkgs, lib, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.system.interface;
+in
+{
+  options.metacfg.system.interface = with types; {
+    enable = mkEnableOption "macOS interface";
+  };
+
+  config = mkIf cfg.enable {
+    system.defaults = {
+      dock.autohide = true;
+
+      finder = {
+        AppleShowAllExtensions = true;
+        FXEnableExtensionChangeWarning = false;
+      };
+
+      NSGlobalDomain = {
+        _HIHideMenuBar = true;
+        AppleShowScrollBars = "Always";
+      };
+    };
+
+    metacfg.home.file.".hushlogin".text = "";
+  };
+}

modules/darwin/user/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  inherit (lib) types mkIf mkDefault;
+  inherit (lib.metacfg) mkOpt;
+
+  cfg = config.metacfg.user;
+
+  is-linux = pkgs.stdenv.isLinux;
+  is-darwin = pkgs.stdenv.isDarwin;
+in
+{
+  options.metacfg.user = {
+    name = mkOpt types.str "harald" "The user account.";
+
+    fullName = mkOpt types.str "Harald Hoyer" "The full name of the user.";
+    email = mkOpt types.str "harald@hoyer.xyz" "The email of the user.";
+
+    uid = mkOpt (types.nullOr types.int) 501 "The uid for the user account.";
+  };
+
+  config = {
+    users.users.${cfg.name} = {
+      # NOTE: Setting the uid here is required for another
+      # module to evaluate successfully since it reads
+      # `users.users.${metacfg.user.name}.uid`.
+      uid = mkIf (cfg.uid != null) cfg.uid;
+    };
+
+    snowfallorg.users.${config.metacfg.user.name}.home.config = {
+      home = {
+        file = {
+          ".profile".text = ''
+            # The default file limit is far too low and throws an error when rebuilding the system.
+            # See the original with: ulimit -Sa
+            ulimit -n 4096
+          '';
+        };
+      };
+    };
+  };
+}

modules/home/cli-apps/bash/default.nix

@@ -0,0 +1,28 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.metacfg.cli-apps.bash;
+in
+{
+  options.metacfg.cli-apps.bash = {
+    enable = mkEnableOption "BASH shell";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      bashInteractive
+    ];
+    programs.bash = {
+      enable = true;
+      initExtra = ''
+        function msh() { mosh "$@" -- bash -c 'if type -f tmux; then tmux new-session -A -s 0; else screen -R; fi;' ; };
+        function tsh() { ssh -t "$@" -- bash -c 'if type -f tmux; then tmux new-session -A -s 0; else screen -R; fi;' ; };
+      '';
+    };
+  };
+}

modules/home/cli-apps/bat/default.nix

@@ -0,0 +1,22 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+with lib;
+with lib.metacfg; let
+  cfg = config.metacfg.cli-apps.bat;
+in
+{
+  options.metacfg.cli-apps.bat = {
+    enable = mkEnableOption "bat";
+  };
+
+  config = mkIf cfg.enable {
+    programs.bat = {
+      enable = true;
+      config.theme = "ansi";
+      extraPackages = with pkgs.bat-extras; [ batdiff batman batgrep batwatch ];
+    };
+  };
+}

modules/home/cli-apps/fish/default.nix

@@ -0,0 +1,60 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.metacfg.cli-apps.fish;
+in
+{
+  options.metacfg.cli-apps.fish = {
+    enable = mkEnableOption "FISH shell";
+  };
+
+  config = mkIf cfg.enable {
+    programs.fish = {
+      enable = true;
+      interactiveShellInit = ''
+        function msh --wraps mosh --description 'mosh with tmux'
+          if not set -q argv[1]
+            echo 'Usage: msh [user@]host [command]'
+          else
+            ${pkgs.mosh}/bin/mosh $argv -- tmux new-session -A -s 0
+          end
+        end
+        function tsh --wraps ssh --description 'ssh with tmux'
+          if not set -q argv[1]
+            echo 'Usage: tsh [user@]host [command]'
+          else
+            ${pkgs.openssh}/bin/ssh -t $argv -- tmux new-session -A -s 0
+          end
+        end
+      '';
+
+      plugins = [{
+        name = "foreign-env";
+        src = pkgs.fetchFromGitHub {
+          owner = "oh-my-fish";
+          repo = "plugin-foreign-env";
+          rev = "dddd9213272a0ab848d474d0cbde12ad034e65bc";
+          sha256 = "00xqlyl3lffc5l0viin1nyp819wf81fncqyz87jx8ljjdhilmgbs";
+        };
+      }];
+
+      #      shellInit =
+      #        ''
+      #          # nix
+      #          if test -e /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+      #              fenv source /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+      #          end
+      #
+      #          # home-manager
+      #          if test -e $HOME/.nix-profile/etc/profile.d/hm-session-vars.sh
+      #              fenv source $HOME/.nix-profile/etc/profile.d/hm-session-vars.sh
+      #          end
+      #        '';
+    };
+  };
+}

modules/home/cli-apps/home-manager/default.nix

@@ -0,0 +1,31 @@
+{ lib, config, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkIf;
+  inherit (lib.metacfg) enabled;
+
+  cfg = config.metacfg.cli-apps.home-manager;
+in
+{
+  options.metacfg.cli-apps.home-manager = {
+    enable = mkEnableOption "home-manager";
+  };
+
+  config = mkIf cfg.enable {
+    programs.home-manager = enabled;
+    home.sessionVariables = {
+      EDITOR = "${pkgs.vim}/bin/vim";
+      BATDIFF_USE_DELTA = "true";
+    };
+
+    home.shellAliases = {
+      cat = "${pkgs.bat}/bin/bat --decorations never";
+      less = ''${pkgs.bat}/bin/bat --decorations never --paging=always --pager "${pkgs.less}/bin/less -RF"'';
+      man = "${pkgs.bat-extras.batman}/bin/batman";
+    };
+
+    home.packages = with pkgs; [
+      vim
+    ];
+  };
+}

modules/home/cli-apps/neovim/default.nix

@@ -0,0 +1,230 @@
+{ lib, config, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.metacfg.cli-apps.neovim;
+in
+{
+  options.metacfg.cli-apps.neovim = {
+    enable = mkEnableOption "Neovim";
+  };
+
+  config = mkIf cfg.enable {
+    programs.neovim-flake = {
+      enable = true;
+      # your settings need to go into the settings attrset
+      settings = {
+        vim = {
+          viAlias = false;
+          vimAlias = false;
+          debugMode = {
+            enable = false;
+            level = 20;
+            logFile = "/tmp/nvim.log";
+          };
+        };
+
+        vim.lsp = {
+          formatOnSave = true;
+          lspkind.enable = false;
+          lightbulb.enable = true;
+          lspsaga.enable = false;
+          nvimCodeActionMenu.enable = true;
+          trouble.enable = true;
+          lspSignature.enable = true;
+          lsplines.enable = true;
+        };
+
+        vim.debugger = {
+          nvim-dap = {
+            enable = true;
+            ui.enable = true;
+          };
+        };
+
+        vim.languages = {
+          enableLSP = true;
+          enableFormat = true;
+          enableTreesitter = true;
+          enableExtraDiagnostics = true;
+
+          nix = {
+            enable = true;
+            format.type = "nixpkgs-fmt";
+          };
+          html.enable = true;
+          clang = {
+            enable = true;
+            lsp.server = "clangd";
+          };
+          sql.enable = false;
+          rust = {
+            enable = true;
+            crates.enable = true;
+          };
+          java.enable = true;
+          ts.enable = true;
+          svelte.enable = true;
+          go.enable = true;
+          zig.enable = true;
+          python.enable = true;
+          dart.enable = true;
+          elixir.enable = false;
+        };
+
+        vim.visuals = {
+          enable = true;
+          nvimWebDevicons.enable = true;
+          scrollBar.enable = true;
+          smoothScroll.enable = true;
+          cellularAutomaton.enable = true;
+          fidget-nvim.enable = true;
+          indentBlankline = {
+            enable = true;
+            fillChar = null;
+            eolChar = null;
+            showCurrContext = true;
+          };
+          cursorline = {
+            enable = true;
+            lineTimeout = 0;
+          };
+        };
+
+        vim.statusline = {
+          lualine = {
+            enable = true;
+            theme = "catppuccin";
+          };
+        };
+
+        vim.theme = {
+          enable = true;
+          name = "catppuccin";
+          style = "mocha";
+          transparent = false;
+        };
+
+        vim.autopairs.enable = true;
+
+        vim.autocomplete = {
+          enable = true;
+          type = "nvim-cmp";
+        };
+
+        vim.filetree = {
+          nvimTree = {
+            enable = true;
+          };
+        };
+
+        vim.tabline = {
+          nvimBufferline.enable = true;
+        };
+
+        vim.treesitter.context.enable = true;
+
+        vim.binds = {
+          whichKey.enable = true;
+          cheatsheet.enable = true;
+        };
+
+        vim.telescope.enable = true;
+
+        vim.git = {
+          enable = true;
+          gitsigns.enable = true;
+          gitsigns.codeActions = false; # throws an annoying debug message
+        };
+
+        vim.minimap = {
+          minimap-vim.enable = false;
+          codewindow.enable = true; # lighter, faster, and uses lua for configuration
+        };
+
+        vim.dashboard = {
+          dashboard-nvim.enable = false;
+          alpha.enable = true;
+        };
+
+        vim.notify = {
+          nvim-notify.enable = true;
+        };
+
+        vim.projects = {
+          project-nvim.enable = true;
+        };
+
+        vim.utility = {
+          ccc.enable = true;
+          vim-wakatime.enable = false;
+          icon-picker.enable = true;
+          surround.enable = true;
+          diffview-nvim.enable = true;
+          motion = {
+            hop.enable = true;
+            leap.enable = true;
+          };
+        };
+
+        vim.notes = {
+          obsidian.enable = false; # FIXME neovim fails to build if obsidian is enabled
+          orgmode.enable = false;
+          mind-nvim.enable = true;
+          todo-comments.enable = true;
+        };
+
+        vim.terminal = {
+          toggleterm = {
+            enable = true;
+            lazygit.enable = true;
+          };
+        };
+
+        vim.ui = {
+          borders.enable = true;
+          noice.enable = true;
+          colorizer.enable = true;
+          modes-nvim.enable = false; # the theme looks terrible with catppuccin
+          illuminate.enable = true;
+          breadcrumbs = {
+            enable = true;
+            navbuddy.enable = true;
+          };
+          smartcolumn = {
+            enable = true;
+            columnAt.languages = {
+              # this is a freeform module, it's `buftype = int;` for configuring column position
+              nix = 110;
+              ruby = 120;
+              java = 130;
+              go = [ 90 130 ];
+            };
+          };
+        };
+
+        vim.assistant = {
+          copilot = {
+            enable = true;
+            cmp.enable = true;
+          };
+        };
+
+        vim.session = {
+          nvim-session-manager.enable = false;
+        };
+
+        vim.gestures = {
+          gesture-nvim.enable = false;
+        };
+
+        vim.comments = {
+          comment-nvim.enable = true;
+        };
+
+        vim.spellChecking.languages = [ "en" "de" ];
+      };
+    };
+  };
+}

modules/home/cli-apps/starship/default.nix

@@ -0,0 +1,32 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.metacfg.cli-apps.starship;
+in
+{
+  options.metacfg.cli-apps.starship = {
+    enable = mkEnableOption "starship";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+    ];
+    programs.starship = {
+      enable = true;
+      settings = {
+        container.format = "[\\[$name\\]]($style) ";
+        git_status = {
+          ahead = "⇡$\{count}";
+          diverged = "⇕⇡$\{ahead_count}⇣$\{behind_count}";
+          behind = "⇣$\{count}";
+        };
+      };
+    };
+  };
+}

modules/home/cli-apps/tmux/default.nix

@@ -0,0 +1,20 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+with lib;
+with lib.metacfg; let
+  cfg = config.metacfg.cli-apps.tmux;
+in
+{
+  options.metacfg.cli-apps.tmux = {
+    enable = mkEnableOption "Tmux";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      tmux
+    ];
+  };
+}

modules/home/host/default.nix

@@ -0,0 +1,11 @@
+{ lib, config, pkgs, host ? null, format ? "unknown", ... }:
+
+let
+  inherit (lib) types;
+  inherit (lib.metacfg) mkOpt;
+in
+{
+  options.metacfg.host = {
+    name = mkOpt (types.nullOr types.str) host "The host name.";
+  };
+}

modules/home/tools/alacritty/default.nix

@@ -0,0 +1,22 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  inherit (lib) mkEnableOption mkIf;
+
+  cfg = config.metacfg.tools.alacritty;
+in
+{
+  options.metacfg.tools.alacritty = {
+    enable = mkEnableOption "alacritty";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      alacritty
+      (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+    ];
+  };
+}

modules/home/tools/direnv/default.nix

@@ -0,0 +1,18 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.tools.direnv;
+in
+{
+  options.metacfg.tools.direnv = with types; {
+    enable = mkBoolOpt false "Whether or not to enable direnv.";
+  };
+
+  config = mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      nix-direnv = enabled;
+    };
+  };
+}

modules/home/tools/git/default.nix

@@ -0,0 +1,66 @@
+{ lib, config, pkgs, ... }:
+
+let
+  inherit (lib) types mkEnableOption mkIf;
+  inherit (lib.metacfg) mkOpt enabled;
+
+  cfg = config.metacfg.tools.git;
+  user = config.metacfg.user;
+in
+{
+  options.metacfg.tools.git = {
+    enable = mkEnableOption "Git";
+    userName = mkOpt types.str user.fullName "The name to configure git with.";
+    userEmail = mkOpt types.str user.email "The email to configure git with.";
+    signingKey =
+      mkOpt types.str "7F3D64824AC0B6B8009E50504BC0896FB5693595" "The key ID to sign commits with.";
+    signByDefault = mkOpt types.bool false "Whether to sign commits by default.";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      git-delete-merged-branches
+      delta
+    ];
+    programs.git = {
+      enable = true;
+      inherit (cfg) userName userEmail;
+      lfs = enabled;
+      signing = {
+        key = cfg.signingKey;
+        inherit (cfg) signByDefault;
+      };
+      extraConfig = {
+        init = { defaultBranch = "main"; };
+        pull = { rebase = true; };
+        push = { autoSetupRemote = true; };
+        core = { whitespace = "trailing-space,space-before-tab"; };
+        safe = {
+          directory = "${user.home}/git";
+        };
+        "credential \"https://github.com\"" = {
+          helper = "!gh auth git-credential";
+        };
+        alias = {
+          co = "checkout";
+          ci = "commit --signoff";
+        };
+        pull.ff = "only";
+        core.pager = "${pkgs.delta}/bin/delta";
+        delta = {
+          features = "decorations";
+          syntax-theme = "DarkNeon";
+          light = "false";
+          navigate = "true";
+        };
+        interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
+        merge.conflictStyle = "diff3";
+        diff.colorMoved = "default";
+        filter.rot8000 = {
+          clean = "${pkgs.metacfg.rot8000}/bin/rot8000";
+          smudge = "${pkgs.metacfg.rot8000}/bin/rot8000";
+        };
+      };
+    };
+  };
+}

modules/home/tools/jetbrains/default.nix

@@ -0,0 +1,21 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.tools.jetbrains;
+in
+{
+  options.metacfg.tools.jetbrains = with types; {
+    enable = mkBoolOpt false "Whether or not to enable jetbrains.";
+  };
+
+  config = mkIf cfg.enable {
+    home.sessionPath = [
+      "$HOME/.local/share/JetBrains/Toolbox/scripts"
+    ];
+    home.packages = with pkgs; [
+      jetbrains-toolbox
+      (pkgs.nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+    ];
+  };
+}

modules/home/tools/ssh/default.nix

@@ -0,0 +1,24 @@
+{ lib, config, pkgs, ... }:
+
+let
+  inherit (lib) types mkEnableOption mkIf;
+  cfg = config.metacfg.tools.ssh;
+in
+{
+  options.metacfg.tools.ssh = {
+    enable = mkEnableOption "SSH";
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      mosh
+    ];
+    programs.ssh = {
+      enable = true;
+      extraConfig = ''
+        Host *
+          HostKeyAlgorithms +ssh-rsa
+      '';
+    };
+  };
+}

modules/home/user/default.nix

@@ -0,0 +1,50 @@
+{ lib, config, pkgs, osConfig ? { }, ... }:
+
+let
+  inherit (lib) types mkIf mkDefault mkMerge;
+  inherit (lib.metacfg) mkOpt;
+
+  cfg = config.metacfg.user;
+
+  is-linux = pkgs.stdenv.isLinux;
+  is-darwin = pkgs.stdenv.isDarwin;
+
+  home-directory =
+    if cfg.name == null then
+      null
+    else if is-darwin then
+      "/Users/${cfg.name}"
+    else
+      "/home/${cfg.name}";
+in
+{
+  options.metacfg.user = {
+    enable = mkOpt types.bool false "Whether to configure the user account.";
+    name = mkOpt (types.nullOr types.str) config.snowfallorg.user.name "The user account.";
+
+    fullName = mkOpt types.str "Harald Hoyer" "The full name of the user.";
+    email = mkOpt types.str "harald@hoyer.xyz" "The email of the user.";
+
+    home = mkOpt (types.nullOr types.str) home-directory "The user's home directory.";
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.name != null;
+          message = "metacfg.user.name must be set";
+        }
+        {
+          assertion = cfg.home != null;
+          message = "metacfg.user.home must be set";
+        }
+      ];
+
+      home = {
+        username = mkDefault cfg.name;
+        homeDirectory = mkDefault cfg.home;
+      };
+    }
+  ]);
+}

modules/nixos/home/default.nix

@@ -0,0 +1,32 @@
+{ options, config, pkgs, lib, inputs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.home;
+in
+{
+  options.metacfg.home = with types; {
+    file = mkOpt attrs { }
+      (mdDoc "A set of files to be managed by home-manager's `home.file`.");
+    configFile = mkOpt attrs { }
+      (mdDoc "A set of files to be managed by home-manager's `xdg.configFile`.");
+    extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
+  };
+
+  config = {
+    metacfg.home.extraOptions = {
+      home.stateVersion = config.system.stateVersion;
+      home.file = mkAliasDefinitions options.metacfg.home.file;
+      xdg.enable = true;
+      xdg.configFile = mkAliasDefinitions options.metacfg.home.configFile;
+    };
+
+    home-manager = {
+      useUserPackages = true;
+      useGlobalPkgs = true;
+
+      users.${config.metacfg.user.name} =
+        mkAliasDefinitions options.metacfg.home.extraOptions;
+    };
+  };
+}

modules/nixos/nix-ld/default.nix

@@ -0,0 +1,135 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.nix-ld;
+in
+{
+  options.metacfg.nix-ld = with types; {
+    enable = mkBoolOpt false "Whether or not to enable nix-ld.";
+  };
+
+  config = mkIf cfg.enable {
+
+    programs.nix-ld.enable = true;
+
+    # Sets up all the libraries to load
+    programs.nix-ld.libraries = with pkgs; [
+      SDL
+      SDL2
+      SDL2_image
+      SDL2_mixer
+      SDL2_ttf
+      SDL_image
+      SDL_mixer
+      SDL_ttf
+      alsa-lib
+      at-spi2-atk
+      at-spi2-core
+      atk
+      bzip2
+      cairo
+      cups
+      curlWithGnuTls
+      dbus
+      dbus-glib
+      desktop-file-utils
+      e2fsprogs
+      expat
+      flac
+      fontconfig
+      freeglut
+      freetype
+      fribidi
+      fuse
+      fuse3
+      gdk-pixbuf
+      glew110
+      glib
+      gmp
+      gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-ugly
+      gst_all_1.gstreamer
+      gtk2
+      harfbuzz
+      icu
+      keyutils.lib
+      libGL
+      libGLU
+      libappindicator-gtk2
+      libcaca
+      libcanberra
+      libcap
+      libclang.lib
+      libdbusmenu
+      libdrm
+      libgcrypt
+      libgpg-error
+      libidn
+      libjack2
+      libjpeg
+      libmikmod
+      libogg
+      libpng12
+      libpulseaudio
+      librsvg
+      libsamplerate
+      libsecret
+      libthai
+      libtheora
+      libtiff
+      libudev0-shim
+      libusb1
+      libuuid
+      libvdpau
+      libvorbis
+      libvpx
+      libxcrypt-legacy
+      libxkbcommon
+      libxml2
+      mesa
+      nspr
+      nss
+      openssl
+      p11-kit
+      pango
+      pixman
+      python3
+      speex
+      stdenv.cc.cc
+      tbb
+      udev
+      vulkan-loader
+      wayland
+      xorg.libICE
+      xorg.libSM
+      xorg.libX11
+      xorg.libXScrnSaver
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXft
+      xorg.libXi
+      xorg.libXinerama
+      xorg.libXmu
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXt
+      xorg.libXtst
+      xorg.libXxf86vm
+      xorg.libpciaccess
+      xorg.libxcb
+      xorg.xcbutil
+      xorg.xcbutilimage
+      xorg.xcbutilkeysyms
+      xorg.xcbutilrenderutil
+      xorg.xcbutilwm
+      xorg.xkeyboardconfig
+      xz
+      zlib
+    ];
+
+  };
+}

modules/nixos/nix/default.nix

@@ -0,0 +1,94 @@
+{ options, config, pkgs, lib, inputs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.nix;
+
+  substituters-submodule = types.submodule ({ name, ... }: {
+    options = with types; {
+      key = mkOpt (nullOr str) null "The trusted public key for this substituter.";
+    };
+  });
+in
+{
+  options.metacfg.nix = with types; {
+    enable = mkBoolOpt false "Whether or not to manage nix configuration.";
+    package = mkOpt package pkgs.nix "Which nix package to use.";
+
+    default-substituter = {
+      url = mkOpt str "https://cache.nixos.org" "The url for the substituter.";
+      key = mkOpt str "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "The trusted public key for the substituter.";
+    };
+
+    extra-substituters = mkOpt (attrsOf substituters-submodule) { } "Extra substituters to configure.";
+  };
+
+  config = mkIf cfg.enable {
+    assertions = mapAttrsToList
+      (name: value: {
+        assertion = value.key != null;
+        message = "metacfg.nix.extra-substituters.${name}.key must be set";
+      })
+      cfg.extra-substituters;
+
+    environment.systemPackages = with pkgs; [
+      metacfg.nixos-revision
+      (metacfg.nixos-hosts.override {
+        hosts = inputs.self.nixosConfigurations;
+      })
+      deploy-rs
+      nixfmt
+      nix-index
+      nix-prefetch-git
+      nix-output-monitor
+    ];
+
+    nix =
+      let
+        users = [ "root" config.metacfg.user.name ] ++
+          optional config.services.hydra.enable "hydra";
+        extra-substituters = cfg.extra-substituters // {
+          "https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
+        };
+      in
+      {
+        package = cfg.package;
+
+        settings = {
+          experimental-features = "nix-command flakes";
+          http-connections = 50;
+          warn-dirty = false;
+          log-lines = 50;
+          sandbox = "relaxed";
+          auto-optimise-store = true;
+          trusted-users = users;
+          allowed-users = users;
+
+          substituters =
+            [ cfg.default-substituter.url ]
+              ++
+              (mapAttrsToList (name: value: name) extra-substituters);
+          trusted-public-keys =
+            [ cfg.default-substituter.key ]
+              ++
+              (mapAttrsToList (name: value: value.key) extra-substituters);
+
+        } // (lib.optionalAttrs config.metacfg.tools.direnv.enable {
+          keep-outputs = true;
+          keep-derivations = true;
+        });
+
+        gc = {
+          automatic = true;
+          dates = "weekly";
+          options = "--delete-older-than 30d";
+        };
+
+        # flake-utils-plus
+        generateRegistryFromInputs = true;
+        generateNixPathFromInputs = true;
+        linkInputs = true;
+      };
+  };
+}

modules/nixos/services/base/default.nix

@@ -0,0 +1,159 @@
+{ options
+, config
+, lib
+, pkgs
+, ...
+}:
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.base;
+  gitconfig = pkgs.writeText "gitconfig" ''
+    [filter "rot8000"]
+        smudge = ${pkgs.metacfg.rot8000}/bin/rot8000
+        clean = ${pkgs.metacfg.rot8000}/bin/rot8000
+  '';
+in
+{
+  options.metacfg.base = with types; {
+    enable = mkBoolOpt false "Whether or not to enable the base config.";
+
+  };
+
+  config = mkIf cfg.enable {
+    # Configure console keymap
+    console.keyMap = lib.mkDefault "us";
+
+    # Select internationalisation properties.
+    i18n.defaultLocale = "en_US.UTF-8";
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_MESSAGES = "en_US.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_TIME = "de_DE.UTF-8";
+    };
+
+    environment = {
+      sessionVariables = { PATH = "$HOME/bin:$HOME/.cargo/bin"; };
+      systemPackages = with pkgs; [
+        age
+        bash
+        cifs-utils
+        clevis
+        delta
+        efibootmgr
+        git
+        git-crypt
+        git-delete-merged-branches
+        home-manager
+        htop
+        mosh
+        nixpkgs-fmt
+        openssl
+        restic
+        rrsync
+        sbctl
+        sops
+        strace
+        tmux
+        tpm2-pkcs11
+        tpm2-pkcs11.out
+        tpm2-tools
+        vim
+        virt-manager
+        wget
+      ];
+      shells = [ pkgs.fish pkgs.bash ];
+    };
+
+    hardware = {
+      cpu = {
+        amd.updateMicrocode = lib.mkDefault true;
+        intel.updateMicrocode = lib.mkDefault true;
+      };
+      enableRedistributableFirmware = lib.mkDefault true;
+      enableAllFirmware = true;
+      opengl.extraPackages = with pkgs; [ intel-compute-runtime ];
+    };
+
+    programs = {
+      dconf.enable = true;
+      bash = {
+        ## shellInit = ''
+        interactiveShellInit = ''
+          bind '"\e[A": history-search-backward'
+          bind '"\e[B": history-search-forward'
+        '';
+      };
+      starship.enable = true;
+      mosh.enable = true;
+      vim.defaultEditor = true;
+      fish.enable = true;
+    };
+
+    # powerManagement.cpuFreqGovernor = "ondemand";
+
+    services = {
+      dbus.implementation = "broker";
+      dbus.packages = [ pkgs.gcr ];
+      fwupd.enable = true;
+      openssh = {
+        enable = true;
+        settings.PermitRootLogin = "prohibit-password";
+        settings.X11Forwarding = true;
+      };
+    };
+
+    security = {
+      tpm2.enable = lib.mkDefault true;
+      tpm2.abrmd.enable = lib.mkDefault true;
+      sudo = {
+        enable = true;
+        wheelNeedsPassword = false;
+      };
+    };
+
+    time.timeZone = "Europe/Berlin";
+
+    users.users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
+      "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
+    ];
+
+    boot = {
+      tmp.cleanOnBoot = true;
+      loader = {
+        systemd-boot.enable = lib.mkDefault true;
+        efi.canTouchEfiVariables = true;
+        timeout = 2;
+      };
+      initrd.systemd.enable = true;
+      kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
+    };
+
+    system.autoUpgrade = {
+      flags = [
+        "--update-input"
+        "nixpkgs"
+        "--update-input"
+        "unstable"
+        "--no-write-lock-file"
+        "-L"
+      ];
+      flake = "git+https://git.hoyer.xyz/harald/nixcfg";
+    };
+    systemd.services.nixos-upgrade = {
+      path = [ pkgs.metacfg.rot8000 ];
+      environment.GIT_CONFIG_GLOBAL = toString gitconfig;
+    };
+
+    virtualisation.libvirtd.enable = true;
+
+  };
+}

modules/nixos/services/gui/default.nix

@@ -0,0 +1,138 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.gui;
+in
+{
+  options.metacfg.gui = with types; {
+    enable = mkBoolOpt false "Whether or not to enable a GUI.";
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      gnome.tracker-miners.enable = lib.mkForce false;
+
+      flatpak.enable = true;
+
+      pcscd.enable = lib.mkDefault false;
+
+      # Enable CUPS to print documents.
+      printing.enable = true;
+
+      pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;
+        pulse.enable = true;
+        # If you want to use JACK applications, uncomment this
+        #jack.enable = true;
+
+        # use the example session manager (no others are packaged yet so this is enabled by default,
+        # no need to redefine it in your config for now)
+        #media-session.enable = true;
+      };
+
+      udev.packages = [
+        pkgs.libu2f-host
+        pkgs.yubikey-personalization
+      ];
+
+      xserver = {
+        layout = lib.mkDefault "de+us";
+        enable = true;
+        displayManager.gdm.enable = true;
+        desktopManager.gnome.enable = true;
+      };
+    };
+    #security.pam.p11.control = "sufficient";
+    #security.pam.p11.control = "required";
+    #security.pam.p11.enable = true;
+    #  services.fprintd.enable = true;
+    #security.pam.yubico.enable = true;
+    #security.pam.yubico.control = "sufficient";
+    #security.pam.yubico.mode = "challenge-response";
+
+    #security.tpm2.pkcs11.enable = true;
+
+    # Enable sound with pipewire.
+    sound.enable = true;
+    hardware.pulseaudio.enable = false;
+
+    security.rtkit.enable = true;
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      enableBrowserSocket = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      bat
+      cardpeek
+      ccache
+      clang
+      dive
+      file
+      firefox
+      gh
+      git
+      gimp
+      gnome.gnome-software
+      gnomeExtensions.appindicator
+      gnomeExtensions.dash-to-panel
+      gnomeExtensions.hibernate-status-button
+      gnomeExtensions.vitals
+      gnupg
+      go
+      jetbrains-toolbox
+      jq
+      kbfs
+      libu2f-host
+      mosh
+      mosh
+      nixpkgs-fmt
+      opensc
+      pasystray
+      #pcsctools
+      pinentry-gnome
+      pkg-config
+      ripgrep
+      slack
+      spotify
+      statix
+      thunderbird
+      tmux
+      vim
+      wl-clipboard
+      yubikey-personalization
+      yubikey-manager-qt
+      zellij
+      rustup
+    ];
+
+    #----=[ Fonts ]=----#
+    fonts = {
+      enableDefaultPackages = false;
+      packages = with pkgs; [
+        noto-fonts-emoji
+        liberation_ttf
+        freefont_ttf
+        (nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+      ];
+
+      fontconfig = {
+        enable = true;
+        defaultFonts = {
+          serif = [ "Liberation" ];
+          sansSerif = [ "Liberation" ];
+          monospace = [ "JetBrainsMono" ];
+          emoji = [ "Noto Color Emoji" ];
+        };
+      };
+    };
+
+    # remote desktop
+    networking.firewall.allowedTCPPorts = [ 3389 ];
+  };
+}

modules/nixos/services/podman/default.nix

@@ -0,0 +1,25 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.podman;
+in
+{
+  options.metacfg.podman = with types; {
+    enable = mkBoolOpt false "Whether or not to enable podman.";
+  };
+
+  config = mkIf cfg.enable {
+    virtualisation = {
+      podman = {
+        enable = true;
+
+        # Create a `docker` alias for podman, to use it as a drop-in replacement
+        dockerCompat = lib.mkDefault true;
+
+        # For Nixos version > 22.11
+        defaultNetwork.settings = { dns_enabled = true; };
+      };
+    };
+  };
+}

modules/nixos/services/secureboot/default.nix

@@ -0,0 +1,21 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.secureboot;
+in
+{
+  options.metacfg.secureboot = with types; {
+    enable = mkBoolOpt false "Whether or not to enable secureboot.";
+  };
+
+  config = mkIf cfg.enable {
+    boot = {
+      lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+      };
+      loader.systemd-boot.enable = lib.mkForce false;
+    };
+  };
+}

modules/nixos/sgx/aesmd_dcap/default.nix

@@ -0,0 +1,30 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.aesmd_dcap;
+in
+{
+  options.metacfg.aesmd_dcap = with types; {
+    enable = mkBoolOpt false "Whether or not to enable aesmd in dcap mode.";
+  };
+
+  config = mkIf cfg.enable {
+    metacfg = {
+      nix.extra-substituters = {
+        "https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
+      };
+    };
+    services.aesmd = {
+      enable = true;
+      quoteProviderLibrary = pkgs.nixsgx.sgx-dcap.default_qpl;
+    };
+    systemd.services.aesmd = {
+      environment.LD_LIBRARY_PATH = lib.mkForce (lib.makeLibraryPath [ pkgs.nixsgx.sgx-dcap.default_qpl pkgs.curl.out ]);
+      serviceConfig.BindReadOnlyPaths = [
+        "/etc/sgx_default_qcnl.conf"
+      ];
+    };
+  };
+}

modules/nixos/sgx/pccs/default.nix

@@ -0,0 +1,69 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.pccs;
+  cfg_podman = config.metacfg.podman;
+in
+{
+  options.metacfg.pccs = with types; {
+    enable = mkBoolOpt false "Whether or not to enable a SGX-DCAP.";
+    secret = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = literalExpression "config.sops.secrets.pccs.path";
+      description = lib.mdDoc "path to the pccs secret file";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.secret != null;
+        message = "path to the pccs secret file is required when pccs is enabled";
+      }
+      {
+        assertion = cfg_podman.enable;
+        message = "podman must be enabled when pccs is enabled";
+      }
+    ];
+
+    metacfg = {
+      nix.extra-substituters = {
+        "https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
+      };
+    };
+
+    virtualisation.oci-containers.backend = "podman";
+    virtualisation.oci-containers.containers = {
+      # podman run --pull=always --name pccs -it --rm -v /dev/log:/dev/log --secret PCCS_CONFIG,type=mount -p 8081:8081 registry.gitlab.com/haraldh/pccs:pccs_1_19
+      pccs = {
+        image = "docker.io/backslashhh/pccs:dcap_1_19";
+        autoStart = true;
+        ports = [ "8081:8081" ];
+        extraOptions = [
+          "--volume=/dev/log:/dev/log"
+          "--secret=PCCS_CONFIG,type=mount"
+        ];
+      };
+    };
+
+    systemd.services.pccs-secret =
+      {
+        description = "Inject pccs secret";
+        wantedBy = [ "multi-user.target" ];
+        before = [ "podman-pccs.service" ];
+
+        serviceConfig = {
+          EnvironmentFile = cfg.secret;
+          ExecStart = ''
+            -${pkgs.podman}/bin/podman secret create --env PCCS_CONFIG PCCS_CONFIG
+          '';
+          RemainAfterExit = true;
+        };
+      };
+
+
+  };
+}

modules/nixos/tools/direnv/default.nix

@@ -0,0 +1,20 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.tools.direnv;
+in
+{
+  options.metacfg.tools.direnv = with types; {
+    enable = mkBoolOpt false "Whether or not to enable direnv.";
+  };
+
+  config = mkIf cfg.enable {
+    metacfg.home.extraOptions = {
+      programs.direnv = {
+        enable = true;
+        nix-direnv = enabled;
+      };
+    };
+  };
+}

modules/nixos/tools/git/default.nix

@@ -0,0 +1,61 @@
+{ options, config, pkgs, lib, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.tools.git;
+  gpg = config.metacfg.security.gpg;
+  user = config.metacfg.user;
+in
+{
+  options.metacfg.tools.git = with types; {
+    enable = mkBoolOpt false "Whether or not to install and configure git.";
+    userName = mkOpt types.str user.fullName "The name to configure git with.";
+    userEmail = mkOpt types.str user.email "The email to configure git with.";
+    signingKey =
+      mkOpt types.str "9762169A1B35EA68" "The key ID to sign commits with.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [ git ];
+
+    metacfg.home.extraOptions = {
+      programs.git = {
+        enable = true;
+        inherit (cfg) userName userEmail;
+        lfs = enabled;
+        signing = {
+          key = cfg.signingKey;
+          signByDefault = mkIf gpg.enable true;
+        };
+        extraConfig = {
+          init = { defaultBranch = "main"; };
+          pull = { rebase = true; };
+          push = { autoSetupRemote = true; };
+          core = { whitespace = "trailing-space,space-before-tab"; };
+          safe = {
+            directory = "${user.home}/git";
+          };
+          "credential \"https://github.com\"" = {
+            helper = "!gh auth git-credential";
+          };
+          alias = {
+            co = "checkout";
+            ci = "commit --signoff";
+          };
+          pull.ff = "only";
+          core.pager = "${pkgs.delta}/bin/delta";
+          delta = {
+            features = "decorations";
+            syntax-theme = "DarkNeon";
+            light = "false";
+            navigate = "true";
+          };
+          interactive.diffFilter = "${pkgs.delta}/bin/delta --color-only";
+          merge.conflictStyle = "diff3";
+          diff.colorMoved = "default";
+        };
+      };
+    };
+  };
+}

modules/nixos/user/default.nix

@@ -0,0 +1,104 @@
+{ options
+, config
+, pkgs
+, lib
+, ...
+}:
+with lib;
+with lib.metacfg; let
+  cfg = config.metacfg.user;
+  defaultIconFileName = "profile.jpg";
+  defaultIcon = pkgs.stdenvNoCC.mkDerivation {
+    name = "default-icon";
+    src = ./. + "/${defaultIconFileName}";
+
+    dontUnpack = true;
+
+    installPhase = ''
+      cp $src $out
+    '';
+
+    passthru = { fileName = defaultIconFileName; };
+  };
+  propagatedIcon =
+    pkgs.runCommandNoCC "propagated-icon"
+      { passthru = { fileName = cfg.icon.fileName; }; }
+      ''
+        local target="$out/share/metacfg-icons/user/${cfg.name}"
+        mkdir -p "$target"
+
+        cp ${cfg.icon} "$target/${cfg.icon.fileName}"
+      '';
+in
+{
+  options.metacfg.user = with types; {
+    name = mkOpt str "harald" "The name to use for the user account.";
+    fullName = mkOpt str "Harald Hoyer" "The full name of the user.";
+    email = mkOpt str "harald@hoyer.xyz" "The email of the user.";
+    initialPassword =
+      mkOpt str "password"
+        "The initial password to use when the user is first created.";
+    icon =
+      mkOpt (nullOr package) defaultIcon
+        "The profile picture to use for the user.";
+    prompt-init = mkBoolOpt true "Whether or not to show an initial message when opening a new shell.";
+    extraGroups = mkOpt (listOf str) [ ] "Groups for the user to be assigned.";
+    sshKeys = mkOpt (listOf str) [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
+      "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAYbUTKpy4QR3s944/hjJ1UK05asFEs/SmWeUbtS0cdA660sT4xHnRfals73FicOoz+uIucJCwn/SCM804j+wtM="
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
+    ] "ssh keys";
+    extraOptions =
+      mkOpt attrs { }
+        (mdDoc "Extra options passed to `users.users.<name>`.");
+  };
+
+  config = {
+    environment.systemPackages = with pkgs; [
+    ];
+
+    metacfg.home = {
+      file = {
+        "Desktop/.keep".text = "";
+        "Documents/.keep".text = "";
+        "Downloads/.keep".text = "";
+        "Music/.keep".text = "";
+        "Pictures/.keep".text = "";
+        "Videos/.keep".text = "";
+        "work/.keep".text = "";
+        ".face".source = cfg.icon;
+        "Pictures/${
+          cfg.icon.fileName or (builtins.baseNameOf cfg.icon)
+        }".source =
+          cfg.icon;
+      };
+      extraOptions.programs.bash.initExtra = ''
+        [[ $WANT_BASH ]] || ${pkgs.fish}/bin/fish -l
+      '';
+    };
+
+    users.users.${cfg.name} =
+      {
+        isNormalUser = true;
+
+        # inherit (cfg) name initialPassword;
+
+        openssh.authorizedKeys.keys = cfg.sshKeys;
+        home = "/home/${cfg.name}";
+        group = "users";
+
+        shell = pkgs.bash;
+
+        # Arbitrary user ID to use for the user. Since I only
+        # have a single user on my machines this won't ever collide.
+        # However, if you add multiple users you'll need to change this
+        # so each user has their own unique uid (or leave it out for the
+        # system to select).
+        uid = 1000;
+
+        extraGroups = [ ] ++ cfg.extraGroups;
+      }
+      // cfg.extraOptions;
+  };
+}