A new start

modules/nixos/services/base/default.nix

@@ -0,0 +1,159 @@
+{ options
+, config
+, lib
+, pkgs
+, ...
+}:
+with lib;
+with lib.metacfg;
+let
+  cfg = config.metacfg.base;
+  gitconfig = pkgs.writeText "gitconfig" ''
+    [filter "rot8000"]
+        smudge = ${pkgs.metacfg.rot8000}/bin/rot8000
+        clean = ${pkgs.metacfg.rot8000}/bin/rot8000
+  '';
+in
+{
+  options.metacfg.base = with types; {
+    enable = mkBoolOpt false "Whether or not to enable the base config.";
+
+  };
+
+  config = mkIf cfg.enable {
+    # Configure console keymap
+    console.keyMap = lib.mkDefault "us";
+
+    # Select internationalisation properties.
+    i18n.defaultLocale = "en_US.UTF-8";
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_MESSAGES = "en_US.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_TIME = "de_DE.UTF-8";
+    };
+
+    environment = {
+      sessionVariables = { PATH = "$HOME/bin:$HOME/.cargo/bin"; };
+      systemPackages = with pkgs; [
+        age
+        bash
+        cifs-utils
+        clevis
+        delta
+        efibootmgr
+        git
+        git-crypt
+        git-delete-merged-branches
+        home-manager
+        htop
+        mosh
+        nixpkgs-fmt
+        openssl
+        restic
+        rrsync
+        sbctl
+        sops
+        strace
+        tmux
+        tpm2-pkcs11
+        tpm2-pkcs11.out
+        tpm2-tools
+        vim
+        virt-manager
+        wget
+      ];
+      shells = [ pkgs.fish pkgs.bash ];
+    };
+
+    hardware = {
+      cpu = {
+        amd.updateMicrocode = lib.mkDefault true;
+        intel.updateMicrocode = lib.mkDefault true;
+      };
+      enableRedistributableFirmware = lib.mkDefault true;
+      enableAllFirmware = true;
+      opengl.extraPackages = with pkgs; [ intel-compute-runtime ];
+    };
+
+    programs = {
+      dconf.enable = true;
+      bash = {
+        ## shellInit = ''
+        interactiveShellInit = ''
+          bind '"\e[A": history-search-backward'
+          bind '"\e[B": history-search-forward'
+        '';
+      };
+      starship.enable = true;
+      mosh.enable = true;
+      vim.defaultEditor = true;
+      fish.enable = true;
+    };
+
+    # powerManagement.cpuFreqGovernor = "ondemand";
+
+    services = {
+      dbus.implementation = "broker";
+      dbus.packages = [ pkgs.gcr ];
+      fwupd.enable = true;
+      openssh = {
+        enable = true;
+        settings.PermitRootLogin = "prohibit-password";
+        settings.X11Forwarding = true;
+      };
+    };
+
+    security = {
+      tpm2.enable = lib.mkDefault true;
+      tpm2.abrmd.enable = lib.mkDefault true;
+      sudo = {
+        enable = true;
+        wheelNeedsPassword = false;
+      };
+    };
+
+    time.timeZone = "Europe/Berlin";
+
+    users.users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNsmP15vH8BVKo7bdvIiiEjiQboPGcRPqJK0+bH4jKD harald@lenovo.fritz.box"
+      "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBACLgT81iB1iWWVuXq6PdQ5GAAGhaZhSKnveQCvcNnAOZ5WKH80bZShKHyAYzrzbp8IGwLWJcZQ7TqRK+qZdfagAAAAEc3NoOg== harald@hoyer.xyz"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDsb/Tr69YN5MQLweWPuJaRGm+h2kOyxfD6sqKEDTIwoAAAABHNzaDo= harald@fedora.fritz.box"
+    ];
+
+    boot = {
+      tmp.cleanOnBoot = true;
+      loader = {
+        systemd-boot.enable = lib.mkDefault true;
+        efi.canTouchEfiVariables = true;
+        timeout = 2;
+      };
+      initrd.systemd.enable = true;
+      kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
+    };
+
+    system.autoUpgrade = {
+      flags = [
+        "--update-input"
+        "nixpkgs"
+        "--update-input"
+        "unstable"
+        "--no-write-lock-file"
+        "-L"
+      ];
+      flake = "git+https://git.hoyer.xyz/harald/nixcfg";
+    };
+    systemd.services.nixos-upgrade = {
+      path = [ pkgs.metacfg.rot8000 ];
+      environment.GIT_CONFIG_GLOBAL = toString gitconfig;
+    };
+
+    virtualisation.libvirtd.enable = true;
+
+  };
+}

modules/nixos/services/gui/default.nix

@@ -0,0 +1,138 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.gui;
+in
+{
+  options.metacfg.gui = with types; {
+    enable = mkBoolOpt false "Whether or not to enable a GUI.";
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      gnome.tracker-miners.enable = lib.mkForce false;
+
+      flatpak.enable = true;
+
+      pcscd.enable = lib.mkDefault false;
+
+      # Enable CUPS to print documents.
+      printing.enable = true;
+
+      pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;
+        pulse.enable = true;
+        # If you want to use JACK applications, uncomment this
+        #jack.enable = true;
+
+        # use the example session manager (no others are packaged yet so this is enabled by default,
+        # no need to redefine it in your config for now)
+        #media-session.enable = true;
+      };
+
+      udev.packages = [
+        pkgs.libu2f-host
+        pkgs.yubikey-personalization
+      ];
+
+      xserver = {
+        layout = lib.mkDefault "de+us";
+        enable = true;
+        displayManager.gdm.enable = true;
+        desktopManager.gnome.enable = true;
+      };
+    };
+    #security.pam.p11.control = "sufficient";
+    #security.pam.p11.control = "required";
+    #security.pam.p11.enable = true;
+    #  services.fprintd.enable = true;
+    #security.pam.yubico.enable = true;
+    #security.pam.yubico.control = "sufficient";
+    #security.pam.yubico.mode = "challenge-response";
+
+    #security.tpm2.pkcs11.enable = true;
+
+    # Enable sound with pipewire.
+    sound.enable = true;
+    hardware.pulseaudio.enable = false;
+
+    security.rtkit.enable = true;
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+      enableBrowserSocket = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      bat
+      cardpeek
+      ccache
+      clang
+      dive
+      file
+      firefox
+      gh
+      git
+      gimp
+      gnome.gnome-software
+      gnomeExtensions.appindicator
+      gnomeExtensions.dash-to-panel
+      gnomeExtensions.hibernate-status-button
+      gnomeExtensions.vitals
+      gnupg
+      go
+      jetbrains-toolbox
+      jq
+      kbfs
+      libu2f-host
+      mosh
+      mosh
+      nixpkgs-fmt
+      opensc
+      pasystray
+      #pcsctools
+      pinentry-gnome
+      pkg-config
+      ripgrep
+      slack
+      spotify
+      statix
+      thunderbird
+      tmux
+      vim
+      wl-clipboard
+      yubikey-personalization
+      yubikey-manager-qt
+      zellij
+      rustup
+    ];
+
+    #----=[ Fonts ]=----#
+    fonts = {
+      enableDefaultPackages = false;
+      packages = with pkgs; [
+        noto-fonts-emoji
+        liberation_ttf
+        freefont_ttf
+        (nerdfonts.override { fonts = [ "FiraCode" "DroidSansMono" "JetBrainsMono" ]; })
+      ];
+
+      fontconfig = {
+        enable = true;
+        defaultFonts = {
+          serif = [ "Liberation" ];
+          sansSerif = [ "Liberation" ];
+          monospace = [ "JetBrainsMono" ];
+          emoji = [ "Noto Color Emoji" ];
+        };
+      };
+    };
+
+    # remote desktop
+    networking.firewall.allowedTCPPorts = [ 3389 ];
+  };
+}

modules/nixos/services/podman/default.nix

@@ -0,0 +1,25 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.podman;
+in
+{
+  options.metacfg.podman = with types; {
+    enable = mkBoolOpt false "Whether or not to enable podman.";
+  };
+
+  config = mkIf cfg.enable {
+    virtualisation = {
+      podman = {
+        enable = true;
+
+        # Create a `docker` alias for podman, to use it as a drop-in replacement
+        dockerCompat = lib.mkDefault true;
+
+        # For Nixos version > 22.11
+        defaultNetwork.settings = { dns_enabled = true; };
+      };
+    };
+  };
+}

modules/nixos/services/secureboot/default.nix

@@ -0,0 +1,21 @@
+{ options, config, lib, pkgs, ... }:
+
+with lib;
+with lib.metacfg;
+let cfg = config.metacfg.secureboot;
+in
+{
+  options.metacfg.secureboot = with types; {
+    enable = mkBoolOpt false "Whether or not to enable secureboot.";
+  };
+
+  config = mkIf cfg.enable {
+    boot = {
+      lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+      };
+      loader.systemd-boot.enable = lib.mkForce false;
+    };
+  };
+}