Basic configuration for nki-home

nki-home tinc working

Don't route tinc through vpn

Don't do it lol

Integrate home-manager

Merge nki-home/flake into main flake

Add MacOS clipboard compat

Make VPN input a secret

nki-home/.gitignore

@@ -0,0 +1 @@
+/result

nki-home/configuration.nix

@@ -0,0 +1,246 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ lib, config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      # secret management
+      ./secrets
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot = {
+      plymouth.enable = true;
+      loader.timeout = 60;
+      loader.systemd-boot.enable = true;
+      loader.efi.canTouchEfiVariables = true;
+  };
+  ## Encryption
+  # Kernel modules needed for mounting USB VFAT devices in initrd stage
+  boot.initrd.kernelModules = [ "usb_storage" ];
+  boot.initrd.luks.devices = {
+      root = {
+          keyFile = "/dev/disk/by-id/usb-090c___B1608112001295-0:0";
+          keyFileSize = 4096;
+          fallbackToPassword = true;
+          device = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
+          preLVM = true;
+          allowDiscards = true;
+      };
+  };
+
+  networking.hostName = "kagamiPC"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.enp8s0.useDHCP = true;
+  networking.interfaces.wlp7s0.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  nix = {
+    package = pkgs.nixUnstable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+  # Select internationalisation properties.
+  i18n.defaultLocale = "ja_JP.UTF-8";
+  i18n.inputMethod.enabled = "ibus";
+  i18n.inputMethod.ibus.engines = (with pkgs.ibus-engines; [bamboo mozc libpinyin]);
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  # };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+ 
+  # Configure keymap in X11
+  services.xserver.layout = "jp";
+  # services.xserver.xkbOptions = "";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  sound.enable = true;
+  hardware.pulseaudio = {
+    enable = true;
+    extraModules = [ pkgs.pulseaudio-modules-bt ];
+    package = pkgs.pulseaudioFull;
+  };
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.nki = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  };
+
+  # Allow all packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    kakoune # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    wget
+    fish
+    firefox
+
+    ## System monitoring tools
+    busybox
+
+    ## Security stuff
+    qtkeychain
+
+    ## Enable nix-flakes
+    # (pkgs.writeShellScriptBin "nixFlakes" ''
+    #   exec ${pkgs.nixUnstable}/bin/nix --experimental-features "nix-command flakes" "$@"
+    # '')
+  ];
+
+  # Nix config
+  nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
+  nix.binaryCaches = [ "https://hydra.iohk.io" ];
+
+  
+  # Terminal 
+  programs.gnome-terminal.enable = true;
+
+  # Environment variables
+  environment.variables = {
+      # Input method overrides
+      GTK_IM_MODULE = "ibus";
+      QT_IM_MODULE = "ibus";
+      "XMODIFIERS=@im" = "ibus";
+
+      # Basic editor setup
+      EDITOR = "kak";
+      VISUAL = "kak";
+  };
+
+  # Fonts
+  fonts = {
+      enableDefaultFonts = false;
+      fonts = with pkgs; [
+          noto-fonts-emoji-blob-bin
+          ibm-plex
+          (nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
+          noto-fonts
+          noto-fonts-cjk
+      ];
+      fontconfig = {
+          defaultFonts = {
+              emoji = lib.mkBefore [ "Blobmoji" ];
+              serif = lib.mkBefore [ "IBM Plex Serif" ];
+              sansSerif = lib.mkBefore [ "IBM Plex Sans" ];
+              monospace = lib.mkBefore [ "IBM Plex Mono" ];
+          };
+      };
+  };
+
+  # Enable Desktop Environment.
+  services.xserver.displayManager = {
+      lightdm.enable = true;
+  };
+  services.xserver.desktopManager.cinnamon.enable = true;
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # List services that you want to enable:
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  networking.firewall.allowedUDPPorts = [ 22 ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+  #
+
+  ## Bluetooth
+  #
+  hardware.bluetooth.enable = true;
+
+  # Peripherals
+  hardware.opentabletdriver.enable = true;
+
+  # VPN
+  sops.secrets."windscribe/privateKey" = { mode = "0755"; };
+  sops.secrets."windscribe/presharedKey" = { mode = "0755"; };
+  networking.wg-quick.interfaces = {
+      windscribe = {
+          privateKeyFile = config.sops.secrets."windscribe/privateKey".path;
+          address = [ "100.70.42.56/32" ];
+          dns = [ "10.255.255.2" ];
+          peers = [
+              {
+                  allowedIPs = [ "0.0.0.0/0" ];
+                  endpoint = "yyz-197-wg.whiskergalaxy.com:443";
+                  presharedKeyFile = config.sops.secrets."windscribe/presharedKey".path;
+                  publicKey = "U5s7Yy/2fCqlaFcI96dFKupqEVCn+BYF04LRLD1zOhg=";
+              }
+          ];
+      };
+  };
+
+  
+
+  # PAM
+  security.pam.services.lightdm.enableKwallet = true;
+  security.pam.services.lightdm.enableGnomeKeyring = true;
+  
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+  system.autoUpgrade.channel = "https://nixos.org/channels/nixos-21.05/";
+
+  # tinc network
+  sops.secrets."tinc/ed25519-private-key" = {};
+  sops.secrets."tinc/rsa-private-key" = {};
+  services.my-tinc = {
+    enable = true;
+    hostName = "home";
+    rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
+    ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
+    bindPort = 6565;
+  };
+
+  # extra host for my personal server
+  sops.secrets.hosts = {
+      mode = "0755";
+  };
+  services.dnsmasq.enable = true;
+  services.dnsmasq.extraConfig = ''
+    addn-hosts=${config.sops.secrets.hosts.path}
+  '';
+}
+

nki-home/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/32a74827-4624-43ef-b066-b52e1f11793d";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/549C-7877";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/e08ed857-e553-4af1-9239-40f13d8ea854"; }
+    ];
+
+  # high-resolution display
+  hardware.video.hidpi.enable = lib.mkDefault true;
+}

nki-home/secrets/default.nix

@@ -0,0 +1,6 @@
+{ config, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+}