From 26379c87ed2e46e27b899b0f6987c586da382a35 Mon Sep 17 00:00:00 2001
From: Don Harper <duck@duckland.org>
Date: Sat, 6 Jan 2024 10:07:26 -0600
Subject: [PATCH] server | cleanup

---
 server/default.nix | 159 ++++++---------------------------------------
 1 file changed, 21 insertions(+), 138 deletions(-)

diff --git a/server/default.nix b/server/default.nix
index 660667c..010f9dd 100644
--- a/server/default.nix
+++ b/server/default.nix
@@ -31,41 +31,22 @@ in
       ./upgrade-diff.nix
     ];
 
-  # Enable networking
   networking.networkmanager.enable = true;
   networking.enableIPv6 = true;
-  networking.networkmanager.wifi.powersave = true;
   networking.useDHCP = false;
 
-  # Set your time zone.
   time = {
     timeZone = "America/Chicago";
     hardwareClockInLocalTime = false;
   };
 
-
-  # Select internationalisation properties.
   i18n.defaultLocale = "en_US.utf8";
-  i18n.inputMethod = {
-    enabled = "fcitx5";
-    fcitx5.addons = with pkgs; [
-      fcitx5-mozc
-      fcitx5-gtk
-    ];
-  };
 
-  # Bootloader.
   boot = {
-    kernelPackages = pkgs.linuxPackages_latest;
     kernelParams = [ "consoleblank=60" ];
     loader = {
-      grub = {
-        enable = true;
-        configurationLimit = 10;
-        device = "/dev/sda";
-      };
       systemd-boot = {
-        enable = false;
+        enable = true;
       };
       efi = {
         canTouchEfiVariables = true;
@@ -82,9 +63,6 @@ in
   };
 
   security = {
-    polkit = {
-      enable = true;
-    };
     sudo.enable = false;
     doas = {
       enable = true;
@@ -97,47 +75,18 @@ in
   };
 
   services = {
-    #udev = {
-      #extraRules = ''
-        #KERNEL=="card0", SUBSYSTEM=="drm", RUN+=""${pkgs.kanshi-fix}"/bin/kanshi-fix"
-      #'';
-    #};
     pcscd = {
       enable = true;
     };
-    avahi = {
-      enable = true;
-      nssmdns4 = true;
-    };
-    printing = {
-      enable = true;
-    };
     udisks2 = {
       enable = true;
     };
     nscd = {
       enableNsncd = true;
     };
-    flatpak = {
-      enable = true;
-    };
-    pipewire = {
-      enable = true;
-      alsa = {
-        enable = true;
-        support32Bit = true;
-      };
-      pulse = {
-        enable = true;
-      };
-    };
     tailscale = {
       enable = true;
     };
-    logind = {
-      lidSwitchExternalPower = "ignore";
-      lidSwitchDocked = "ignore";
-    };
     locate = {
       enable = true;
       package = pkgs.mlocate;
@@ -148,98 +97,60 @@ in
       settings = {
         PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
-        #permitRootLogin = "yes";
+        permitRootLogin = "yes";
       };
     };
   };
 
-  # Enable sound with pipewire.
-  sound.enable = true;
-  hardware.bluetooth.enable = true;
-  hardware.pulseaudio.enable = false;
-  hardware.sane = {
-    enable = true;
-    extraBackends = [ pkgs.sane-airscan ];
-  };
   security.rtkit.enable = true;
 
-  xdg.portal = {
-    enable = true;
-    wlr.enable = true;
-    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
-    #gtkUsePortal = true;
+  users.users = {
+    don = {
+      isNormalUser = true;
+      initialPassword = "changeme";
+      description = "Don Harper";
+      extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+      ];
+    };
+    root = {
+      initialPassword = "changeme";
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+      ];
+    };
   };
 
-  users.users.don = {
-    isNormalUser = true;
-    description = "Don Harper";
-    extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
-    ];
-  };
-
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" "electron-25.9.0" ];
+  #nixpkgs.config.allowUnfree = true;
 
   environment.systemPackages = with pkgs; [
-    #(callPackage ../mypackages/kanshi-fix/default.nix {})
     python-with-my-packages
-    acpi
     aspell
     aspellDicts.en
     bash-completion
     nix-bash-completions
     btop
-    espeak-classic
-    # fwup
-    # fwupd
-    # fwupd-efi
     git-crypt
     gitFull
-    headsetcontrol
     home-manager
     hunspell
     hunspellDicts.en_US
-    imagemagick
     isync
-    libsForQt5.qtkeychain
     lsb-release
     pkg-config
-    playerctl
     poppler_utils
-    pulseaudio
     ruby
-    steam
     udiskie
-    wireplumber
-    wlsunset
-    xdg-utils
-    xfce.thunar
-    zathura
   ];
 
   programs = {
-    steam = {
-      enable = true;
-      # Open ports in the firewall for Steam Remote Play
-      remotePlay.openFirewall = true;
-      # Open ports in the firewall for Source Dedicated Server
-      dedicatedServer.openFirewall = true;
-    };
     dconf = {
       enable = true;
     };
-    light = {
-      enable = true;
-    };
     mtr = {
       enable = true;
     };
-    kdeconnect = {
-      enable = true;
-    };
     gnupg = {
       agent = {
         enable = true;
@@ -251,39 +162,20 @@ in
 
 
   nixpkgs.overlays = [
-    (final: prev: { qutebrowser = prev.qutebrowser.override     { enableWideVine = true; }; })
     (final: super:{ khal        = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
   ];
 
   # Open ports in the firewall.
   networking.firewall = {
-    enable = true;
-    # always allow traffic from your Tailscale network
+    enable = false;
     trustedInterfaces = [ "tailscale0" ];
     checkReversePath = "loose";
-
-    # allow the Tailscale UDP port through the firewall
     allowedUDPPorts = [ config.services.tailscale.port ];
-    #allowedUDPPortRanges = [ { from = 1714 ; to = 1764; }];
-
-    # allow you to SSH in over the public internet
     allowedTCPPorts = [ 22 ];
-    #allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
-    interfaces = {
-      "tailscale0" = {
-        allowedTCPPorts = [ 22 8080 8443 ];
-      };
-    };
   };
 
 
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.11"; # Did you read the comment?
+  system.stateVersion = "23.11";
   programs.msmtp = {
     enable = true;
     accounts = {
@@ -298,13 +190,4 @@ in
       };
     };
   };
-  xdg.mime.enable = true;
-  xdg.mime.defaultApplications = {
-    "text/html" = "org.qutebrowser.qutebrowser.desktop";
-    "x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
-    "x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
-    "x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
-    "x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
-  };
-  environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
 }