start of server setup

server/default.nix

@@ -0,0 +1,305 @@
+{ config, pkgs, ... }:
+
+let
+  my-python-packages = python-packages: with python-packages; [
+    pip
+    pipx
+    python-dateutil
+    setuptools
+    requests
+  ];
+  python-with-my-packages = pkgs.python3Full.withPackages my-python-packages;
+in
+{
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      warn-dirty = false;
+      auto-optimise-store = true;
+      trusted-users = [ "root" "don" ];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 7d";
+    };
+  };
+  imports =
+    [
+      ./detect-reboot-needed.nix
+      ./systemd.nix
+      ./upgrade-diff.nix
+    ];
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.enableIPv6 = true;
+  networking.networkmanager.wifi.powersave = true;
+  networking.useDHCP = false;
+
+  # Set your time zone.
+  time = {
+    timeZone = "America/Chicago";
+    hardwareClockInLocalTime = false;
+  };
+
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.utf8";
+  i18n.inputMethod = {
+    enabled = "fcitx5";
+    fcitx5.addons = with pkgs; [
+      fcitx5-mozc
+      fcitx5-gtk
+    ];
+  };
+
+  # Bootloader.
+  boot = {
+    kernelPackages = pkgs.linuxPackages_latest;
+    kernelParams = [ "consoleblank=60" ];
+    loader = {
+      systemd-boot = {
+        enable = true;
+      };
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+    };
+    plymouth = {
+      enable = true;
+      theme = "breeze";
+    };
+    kernel = {
+      sysctl = { "vm.swappiness" = 10;};
+    };
+  };
+
+  security = {
+    polkit = {
+      enable = true;
+    };
+    sudo.enable = false;
+    doas = {
+      enable = true;
+      extraRules = [{
+        users = [ "don" ];
+        keepEnv = true;
+        noPass = true;
+      }];
+    };
+  };
+
+  services = {
+    #udev = {
+      #extraRules = ''
+        #KERNEL=="card0", SUBSYSTEM=="drm", RUN+=""${pkgs.kanshi-fix}"/bin/kanshi-fix"
+      #'';
+    #};
+    pcscd = {
+      enable = true;
+    };
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+    };
+    printing = {
+      enable = true;
+    };
+    udisks2 = {
+      enable = true;
+    };
+    nscd = {
+      enableNsncd = true;
+    };
+    flatpak = {
+      enable = true;
+    };
+    pipewire = {
+      enable = true;
+      alsa = {
+        enable = true;
+        support32Bit = true;
+      };
+      pulse = {
+        enable = true;
+      };
+    };
+    tailscale = {
+      enable = true;
+    };
+    logind = {
+      lidSwitchExternalPower = "ignore";
+      lidSwitchDocked = "ignore";
+    };
+    locate = {
+      enable = true;
+      package = pkgs.mlocate;
+      localuser = null;
+    };
+    openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        #permitRootLogin = "yes";
+      };
+    };
+  };
+
+  # Enable sound with pipewire.
+  sound.enable = true;
+  hardware.bluetooth.enable = true;
+  hardware.pulseaudio.enable = false;
+  hardware.sane = {
+    enable = true;
+    extraBackends = [ pkgs.sane-airscan ];
+  };
+  security.rtkit.enable = true;
+
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
+    #gtkUsePortal = true;
+  };
+
+  users.users.don = {
+    isNormalUser = true;
+    description = "Don Harper";
+    extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
+    openssh.authorizedKeys.keys = [
+      "git ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+    ];
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" "electron-25.9.0" ];
+
+  environment.systemPackages = with pkgs; [
+    #(callPackage ../mypackages/kanshi-fix/default.nix {})
+    python-with-my-packages
+    acpi
+    aspell
+    aspellDicts.en
+    bash-completion
+    nix-bash-completions
+    btop
+    espeak-classic
+    # fwup
+    # fwupd
+    # fwupd-efi
+    git-crypt
+    gitFull
+    headsetcontrol
+    home-manager
+    hunspell
+    hunspellDicts.en_US
+    imagemagick
+    isync
+    libsForQt5.qtkeychain
+    lsb-release
+    pkg-config
+    playerctl
+    poppler_utils
+    pulseaudio
+    ruby
+    steam
+    udiskie
+    wireplumber
+    wlsunset
+    xdg-utils
+    xfce.thunar
+    zathura
+  ];
+
+  programs = {
+    steam = {
+      enable = true;
+      # Open ports in the firewall for Steam Remote Play
+      remotePlay.openFirewall = true;
+      # Open ports in the firewall for Source Dedicated Server
+      dedicatedServer.openFirewall = true;
+    };
+    dconf = {
+      enable = true;
+    };
+    light = {
+      enable = true;
+    };
+    mtr = {
+      enable = true;
+    };
+    kdeconnect = {
+      enable = true;
+    };
+    gnupg = {
+      agent = {
+        enable = true;
+        pinentryFlavor = "curses";
+        enableSSHSupport = true;
+      };
+    };
+  };
+
+
+  nixpkgs.overlays = [
+    (final: prev: { qutebrowser = prev.qutebrowser.override     { enableWideVine = true; }; })
+    (final: super:{ khal        = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
+  ];
+
+  # Open ports in the firewall.
+  networking.firewall = {
+    enable = true;
+    # always allow traffic from your Tailscale network
+    trustedInterfaces = [ "tailscale0" ];
+    checkReversePath = "loose";
+
+    # allow the Tailscale UDP port through the firewall
+    allowedUDPPorts = [ config.services.tailscale.port ];
+    #allowedUDPPortRanges = [ { from = 1714 ; to = 1764; }];
+
+    # allow you to SSH in over the public internet
+    allowedTCPPorts = [ 22 ];
+    #allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
+    interfaces = {
+      "tailscale0" = {
+        allowedTCPPorts = [ 22 8080 8443 ];
+      };
+    };
+  };
+
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.11"; # Did you read the comment?
+  programs.msmtp = {
+    enable = true;
+    accounts = {
+      default = {
+        auth = true;
+        tls = true;
+        port = 587;
+        from = "duck@duckland.org";
+        host = "smtp.gmail.com";
+        user = "duckunix@gmail.com";
+        passwordeval = "cat /home/don/.smtp_password.txt";
+      };
+    };
+  };
+  xdg.mime.enable = true;
+  xdg.mime.defaultApplications = {
+    "text/html" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
+    "x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
+  };
+  environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
+}