A new start

modules/darwin/home/default.nix

@@ -0,0 +1,40 @@
+{ options, config, pkgs, lib, inputs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.home;
+in
+{
+  # imports = with inputs; [
+  #   home-manager.darwinModules.home-manager
+  # ];
+
+  options.metacfg.home = with types; {
+    file = mkOpt attrs { }
+      "A set of files to be managed by home-manager's <option>home.file</option>.";
+    configFile = mkOpt attrs { }
+      "A set of files to be managed by home-manager's <option>xdg.configFile</option>.";
+    extraOptions = mkOpt attrs { } "Options to pass directly to home-manager.";
+    homeConfig = mkOpt attrs { } "Final config for home-manager.";
+  };
+
+  config = {
+    metacfg.home.extraOptions = {
+      home.stateVersion = mkDefault "23.11";
+      home.file = mkAliasDefinitions options.metacfg.home.file;
+      xdg.enable = true;
+      xdg.configFile = mkAliasDefinitions options.metacfg.home.configFile;
+    };
+
+    snowfallorg.users.${config.metacfg.user.name}.home.config = mkAliasDefinitions options.metacfg.home.extraOptions;
+
+    home-manager = {
+      useUserPackages = true;
+      useGlobalPkgs = true;
+
+      # users.${config.metacfg.user.name} = args:
+      #   mkAliasDefinitions options.metacfg.home.extraOptions;
+    };
+  };
+}

modules/darwin/nix/default.nix

@@ -0,0 +1,74 @@
+{ options
+, config
+, pkgs
+, lib
+, ...
+}:
+with lib;
+with lib.metacfg; let
+  cfg = config.metacfg.nix;
+in
+{
+  options.metacfg.nix = with types; {
+    enable = mkBoolOpt true "Whether or not to manage nix configuration.";
+    package = mkOpt package pkgs.nixUnstable "Which nix package to use.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      deploy-rs
+      nixfmt
+      nix-index
+      nix-prefetch-git
+    ];
+
+    nix =
+      let
+        users = [ "root" config.metacfg.user.name ];
+      in
+      {
+        package = cfg.package;
+
+        settings = {
+          experimental-features = "nix-command flakes";
+          http-connections = 50;
+          warn-dirty = false;
+          log-lines = 50;
+
+          # Large builds apparently fail due to an issue with darwin:
+          # https://github.com/NixOS/nix/issues/4119
+          sandbox = false;
+
+          # This appears to break on darwin
+          # https://github.com/NixOS/nix/issues/7273
+          auto-optimise-store = false;
+
+          allow-import-from-derivation = true;
+
+          trusted-users = users;
+          allowed-users = users;
+
+          # NOTE: This configuration is generated by nix-installer so I'm adding it here in
+          # case it becomes important.
+          extra-nix-path = "nixpkgs=flake:nixpkgs";
+          build-users-group = "nixbld";
+        };
+        #// (lib.optionalAttrs config.metacfg.tools.direnv.enable {
+        #  keep-outputs = true;
+        #  keep-derivations = true;
+        #});
+
+        gc = {
+          automatic = true;
+          interval = { Day = 7; };
+          options = "--delete-older-than 30d";
+          user = config.metacfg.user.name;
+        };
+
+        # flake-utils-plus
+        generateRegistryFromInputs = true;
+        generateNixPathFromInputs = true;
+        linkInputs = true;
+      };
+  };
+}

modules/darwin/security/gpg/default.nix

@@ -0,0 +1,122 @@
+{ lib, config, pkgs, inputs, ... }:
+
+let
+  inherit (lib) types mkEnableOption mkIf;
+  inherit (lib.metacfg) mkOpt;
+
+  cfg = config.metacfg.security.gpg;
+  gpgConf = "${inputs.gpg-base-conf}/gpg.conf";
+
+  gpgAgentConf = ''
+    enable-ssh-support
+    default-cache-ttl 60
+    max-cache-ttl 120
+  '';
+
+in
+{
+  options.metacfg.security.gpg = {
+    enable = mkEnableOption "GPG";
+    agentTimeout = mkOpt types.int 5 "The amount of time to wait before continuing with shell init.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      gnupg
+    ];
+
+    environment.shellInit = ''
+      export GPG_TTY="$(tty)"
+      export SSH_AUTH_SOCK=$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)
+
+      ${pkgs.coreutils}/bin/timeout ${builtins.toString cfg.agentTimeout} ${pkgs.gnupg}/bin/gpgconf --launch gpg-agent
+      gpg_agent_timeout_status=$?
+
+      if [ "$gpg_agent_timeout_status" = 124 ]; then
+        # Command timed out...
+        echo "GPG Agent timed out..."
+        echo 'Run "gpgconf --launch gpg-agent" to try and launch it again.'
+      fi
+    '';
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+    };
+
+    metacfg.home.file = {
+      ".gnupg/.keep".text = "";
+
+      ".gnupg/gpg.conf".text = ''
+        # https://github.com/drduh/config/blob/master/gpg.conf
+        # https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration-Options.html
+        # https://www.gnupg.org/documentation/manuals/gnupg/GPG-Esoteric-Options.html
+        # 'gpg --version' to get capabilities
+        # Use AES256, 192, or 128 as cipher
+        personal-cipher-preferences AES256 AES192 AES
+        # Use SHA512, 384, or 256 as digest
+        personal-digest-preferences SHA512 SHA384 SHA256
+        # Use ZLIB, BZIP2, ZIP, or no compression
+        personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed
+        # Default preferences for new keys
+        default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed
+        # SHA512 as digest to sign keys
+        cert-digest-algo SHA512
+        # SHA512 as digest for symmetric ops
+        s2k-digest-algo SHA512
+        # AES256 as cipher for symmetric ops
+        s2k-cipher-algo AES256
+        # UTF-8 support for compatibility
+        charset utf-8
+        # No comments in messages
+        no-comments
+        # No version in output
+        no-emit-version
+        # Disable banner
+        no-greeting
+        # Long key id format
+        keyid-format 0xlong
+        # Display UID validity
+        list-options show-uid-validity
+        verify-options show-uid-validity
+        # Display all keys and their fingerprints
+        with-fingerprint
+        # Display key origins and updates
+        #with-key-origin
+        # Cross-certify subkeys are present and valid
+        require-cross-certification
+        # Disable caching of passphrase for symmetrical ops
+        no-symkey-cache
+        # Enable smartcard
+        use-agent
+        # Disable recipient key ID in messages (breaks Mailvelope)
+        throw-keyids
+        # Default key ID to use (helpful with throw-keyids)
+        #default-key 0xFF3E7D88647EBCDB
+        #trusted-key 0xFF3E7D88647EBCDB
+        # Group recipient keys (preferred ID last)
+        #group keygroup = 0xFF00000000000001 0xFF00000000000002 0xFF3E7D88647EBCDB
+        # Keyserver URL
+        #keyserver hkps://keys.openpgp.org
+        #keyserver hkps://keys.mailvelope.com
+        #keyserver hkps://keyserver.ubuntu.com:443
+        #keyserver hkps://pgpkeys.eu
+        #keyserver hkps://pgp.circl.lu
+        #keyserver hkp://zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion
+        # Keyserver proxy
+        #keyserver-options http-proxy=http://127.0.0.1:8118
+        #keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050
+        # Enable key retrieval using WKD and DANE
+        #auto-key-locate wkd,dane,local
+        #auto-key-retrieve
+        # Trust delegation mechanism
+        #trust-model tofu+pgp
+        # Show expired subkeys
+        #list-options show-unusable-subkeys
+        # Verbose output
+        #verbose
+      '';
+      ".gnupg/gpg-agent.conf".text = gpgAgentConf;
+    };
+  };
+}

modules/darwin/services/nix-daemon/default.nix

@@ -0,0 +1,17 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) types mkIf;
+  inherit (lib.metacfg) mkOpt enabled;
+
+  cfg = config.metacfg.services.nix-daemon;
+in
+{
+  options.metacfg.services.nix-daemon = {
+    enable = mkOpt types.bool true "Whether to enable the Nix daemon.";
+  };
+
+  config = mkIf cfg.enable {
+    services.nix-daemon = enabled;
+  };
+}

modules/darwin/suites/common/default.nix

@@ -0,0 +1,30 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.suites.common;
+in
+{
+  options.metacfg.suites.common = with types; {
+    enable = mkBoolOpt false "Whether or not to enable common configuration.";
+  };
+
+  config = mkIf cfg.enable {
+    programs.fish = enabled;
+
+    metacfg = {
+      nix = enabled;
+
+      system = {
+        fonts = enabled;
+        #input = enabled;
+        interface = enabled;
+      };
+
+      security = {
+        gpg = enabled;
+      };
+    };
+  };
+}

modules/darwin/system/fonts/default.nix

@@ -0,0 +1,32 @@
+{ options, config, pkgs, lib, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.system.fonts;
+in
+{
+  options.metacfg.system.fonts = with types; {
+    enable = mkBoolOpt false "Whether or not to manage fonts.";
+    fonts = mkOpt (listOf package) [ ] "Custom font packages to install.";
+  };
+
+  config = mkIf cfg.enable {
+    environment.variables = {
+      # Enable icons in tooling since we have nerdfonts.
+      LOG_ICONS = "true";
+    };
+
+    fonts = {
+      fontDir = enabled;
+
+      fonts = with pkgs;
+        [
+          noto-fonts
+          noto-fonts-cjk-sans
+          noto-fonts-cjk-serif
+          noto-fonts-emoji
+          (nerdfonts.override { fonts = [ "Hack" ]; })
+        ] ++ cfg.fonts;
+    };
+  };
+}

modules/darwin/system/interface/default.nix

@@ -0,0 +1,29 @@
+{ options, config, pkgs, lib, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.system.interface;
+in
+{
+  options.metacfg.system.interface = with types; {
+    enable = mkEnableOption "macOS interface";
+  };
+
+  config = mkIf cfg.enable {
+    system.defaults = {
+      dock.autohide = true;
+
+      finder = {
+        AppleShowAllExtensions = true;
+        FXEnableExtensionChangeWarning = false;
+      };
+
+      NSGlobalDomain = {
+        _HIHideMenuBar = true;
+        AppleShowScrollBars = "Always";
+      };
+    };
+
+    metacfg.home.file.".hushlogin".text = "";
+  };
+}

modules/darwin/user/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  inherit (lib) types mkIf mkDefault;
+  inherit (lib.metacfg) mkOpt;
+
+  cfg = config.metacfg.user;
+
+  is-linux = pkgs.stdenv.isLinux;
+  is-darwin = pkgs.stdenv.isDarwin;
+in
+{
+  options.metacfg.user = {
+    name = mkOpt types.str "harald" "The user account.";
+
+    fullName = mkOpt types.str "Harald Hoyer" "The full name of the user.";
+    email = mkOpt types.str "harald@hoyer.xyz" "The email of the user.";
+
+    uid = mkOpt (types.nullOr types.int) 501 "The uid for the user account.";
+  };
+
+  config = {
+    users.users.${cfg.name} = {
+      # NOTE: Setting the uid here is required for another
+      # module to evaluate successfully since it reads
+      # `users.users.${metacfg.user.name}.uid`.
+      uid = mkIf (cfg.uid != null) cfg.uid;
+    };
+
+    snowfallorg.users.${config.metacfg.user.name}.home.config = {
+      home = {
+        file = {
+          ".profile".text = ''
+            # The default file limit is far too low and throws an error when rebuilding the system.
+            # See the original with: ulimit -Sa
+            ulimit -n 4096
+          '';
+        };
+      };
+    };
+  };
+}