dennis the formatter (#75)

* dennis the formatter

* changed comment

* fixup

flake.nix

@@ -11,7 +11,6 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     systems.url = "github:nix-systems/default";
-
     nix-index-database = {
       url = "github:Mic92/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -94,7 +93,6 @@
       inherit (nixpkgs) lib;
       systems = [ "x86_64-linux" "aarch64-linux" ];
       forEachSystem = lib.genAttrs systems;
-
       overlayList = [ self.overlays.default nix.overlays.default ];
       pkgsBySystem = forEachSystem (system: import nixpkgs {
         inherit system;
@@ -135,13 +133,13 @@
           {
             repo = "local";
             hooks = [
-              {
+              # {
-                id = "nixfmt check";
+              #   id = "nixfmt check";
-                entry = "${nixpkgs-fmt.legacyPackages.x86_64-linux.nixpkgs-fmt}/bin/nixpkgs-fmt";
+              #   entry = "${nixpkgs-fmt.legacyPackages.x86_64-linux.nixpkgs-fmt}/bin/nixpkgs-fmt";
-                args = [ "--check" ];
+              #   args = [ "--check" ];
-                language = "system";
+              #   language = "system";
-                files = "\\.nix";
+              #   files = "\\.nix";
-              }
+              # }
               {
                 id = "nix-flake-check";
                 entry = "nix flake check";
@@ -175,19 +173,20 @@
               ] else [
                 ./users/${builtins.head users}/systems/${hostname}/configuration.nix
                 ./users/${builtins.head users}/systems/${hostname}/hardware.nix
-              ]) ++ fileList "modules" ++ modules ++ lib.optional home home-manager.nixosModules.home-manager
+              ]) ++ modules
-                ++ (if home then (map (user: { home-manager.users.${user} = import ./users/${user}/home.nix; }) users) else [ ]) ++ map
+              ++ fileList "modules"
-                (user:
+              ++ lib.optional home home-manager.nixosModules.home-manager
-                  { config, lib, pkgs, ... }@args: {
+              ++ (if home then (map (user: { home-manager.users.${user} = import ./users/${user}/home.nix; }) users) else [ ])
-                    users.users.${user} = import ./users/${user} (args // { name = "${user}"; });
+              ++ map (user: { config, lib, pkgs, ... }@args: {
-                    boot.initrd.network.ssh.authorizedKeys = lib.mkIf server config.users.users.${user}.openssh.authorizedKeys.keys;
+                  users.users.${user} = import ./users/${user} (args // { name = "${user}"; });
-                    sops = lib.mkIf sops {
+                  boot.initrd.network.ssh.authorizedKeys = lib.mkIf server config.users.users.${user}.openssh.authorizedKeys.keys;
-                      secrets."${user}/user-password" = {
+                  sops = lib.mkIf sops {
-                        sopsFile = ./users/${user}/secrets.yaml;
+                    secrets."${user}/user-password" = {
-                        neededForUsers = true;
+                      sopsFile = ./users/${user}/secrets.yaml;
-                      };
+                      neededForUsers = true;
                     };
-                  })
+                  };
+                })
                 users;
             };
         in

modules/backup.nix

@@ -52,9 +52,9 @@ in {
       restic.backups =
         let
           commonOpts = {
-            extraBackupArgs = [ "--exclude-file=${pkgs.writeText "restic-exclude-file" (lib.concatMapStrings (x: x + "\n") cfg.exclude)}" ];
-
             initialize = true;
+            extraBackupArgs = [ "--exclude-file=${pkgs.writeText "restic-exclude-file" (lib.concatMapStrings (x: x + "\n") cfg.exclude)}" ];
+            pruneOpts = [ "--group-by host" "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
             passwordFile = config.sops.secrets."restic/password".path;
             paths = [
               "/etc/group"
@@ -85,8 +85,6 @@ in {
               "/var/lib/gitea/data/tmp/"
             ];
 
-            pruneOpts = [ "--group-by host" "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
-
             timerConfig = {
               OnCalendar = "*-*-* ${lib.fixedWidthString 2 "0" (toString cfg.backup_at)}:30:00";
               RandomizedDelaySec = "5m";
@@ -95,31 +93,29 @@ in {
         in
         lib.mkIf cfg.enable {
           local = commonOpts // { repository = "/var/backup"; };
-
           offsite = lib.mkIf (cfg.offsite != [ ]) commonOpts // { repository = "sftp://offsite/${config.networking.hostName}"; };
         };
     };
 
-    sops.secrets = lib.mkIf (cfg.enable && cfg.offsite != [ ])
+    sops.secrets = lib.mkIf (cfg.enable && cfg.offsite != [ ]) {
-      {
+      "restic/offsite/private" = {
-        "restic/offsite/private" = {
+        owner = "root";
-          owner = "root";
+        path = "/root/.ssh/id_offsite-backup";
-          path = "/root/.ssh/id_offsite-backup";
+        sopsFile = ./backup.yaml;
-          sopsFile = ./backup.yaml;
+      };
-        };
 
-        "restic/offsite/public" = {
+      "restic/offsite/public" = {
-          owner = "root";
+        owner = "root";
-          path = "/root/.ssh/id_offsite-backup.pub";
+        path = "/root/.ssh/id_offsite-backup.pub";
-          sopsFile = ./backup.yaml;
+        sopsFile = ./backup.yaml;
-        };
+      };
 
-        "restic/offsite/ssh-config" = {
+      "restic/offsite/ssh-config" = {
-          owner = "root";
+        owner = "root";
-          path = "/root/.ssh/config";
+        path = "/root/.ssh/config";
-          sopsFile = ./backup.yaml;
+        sopsFile = ./backup.yaml;
-        };
+      };
-      } // lib.mkIf cfg.enable { "restic/password".owner = "root"; };
+    } // lib.mkIf cfg.enable { "restic/password".owner = "root"; };
 
     system.activationScripts.linkResticSSHConfigIntoVirtioFS = lib.mkIf (cfg.enable && cfg.offsite != [ ]) ''
       echo "Linking restic ssh config..."
@@ -130,12 +126,11 @@ in {
     '';
 
     systemd = lib.mkIf cfg.enable {
+      timers = lib.mkIf config.services.postgresqlBackup.enable { postgresqlBackup.timerConfig.RandomizedDelaySec = "5m"; };
       services = {
         restic-backups-local.serviceConfig.Environment = "RESTIC_PROGRESS_FPS=0.016666";
         restic-backups-offsite.serviceConfig.Environment = lib.mkIf (cfg.offsite != [ ]) "RESTIC_PROGRESS_FPS=0.016666";
       };
-
-      timers = lib.mkIf config.services.postgresqlBackup.enable { postgresqlBackup.timerConfig.RandomizedDelaySec = "5m"; };
     };
   };
 }

modules/boot.nix

@@ -5,12 +5,15 @@ in {
   options = {
     boot = {
       default = libS.mkOpinionatedOption "enable the boot builder";
+      fullDiskEncryption = libS.mkOpinionatedOption "use luks full disk encrytion";
+      useSystemdBoot = libS.mkOpinionatedOption "use systemd boot";
       cpuType = lib.mkOption {
         type = lib.types.str;
         example = "amd";
         default = "";
         description = "The cpu-type installed on the server.";
       };
+
       amdGPU = libS.mkOpinionatedOption "the system contains a AMD GPU";
       filesystem = lib.mkOption {
         type = lib.types.str;
@@ -18,16 +21,16 @@ in {
         default = "ext4";
         description = "The filesystem installed.";
       };
-      fullDiskEncryption = libS.mkOpinionatedOption "use luks full disk encrytion";
-      useSystemdBoot = libS.mkOpinionatedOption "use systemd boot";
     };
   };
 
   config.boot = lib.mkIf cfg.default {
+    supportedFilesystems = [ cfg.filesystem ];
+    tmp.useTmpfs = true;
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+    kernelParams = [ "nordrand" ] ++ lib.optional (cfg.cpuType == "amd") "kvm-amd" ++ lib.optional cfg.fullDiskEncryption "ip=<ip-addr>::<ip-gateway>:<netmask>";
     initrd = {
-      # networking for netcard kernelModules = [ "e1000e" ];
       kernelModules = lib.mkIf cfg.amdGPU [ "amdgpu" ];
-
       network = lib.mkIf cfg.fullDiskEncryption {
         enable = true;
         ssh = {
@@ -37,11 +40,6 @@ in {
       };
     };
 
-    supportedFilesystems = [ cfg.filesystem ];
-    tmp.useTmpfs = true;
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-    kernelParams = [ "nordrand" ] ++ lib.optional (cfg.cpuType == "amd") "kvm-amd" ++ lib.optional cfg.fullDiskEncryption "ip=<ip-addr>::<ip-gateway>:<netmask>";
-
     zfs = lib.mkIf (cfg.filesystem == "zfs") {
       enableUnstable = true;
       devNodes = "/dev/disk/by-id/";
@@ -49,7 +47,7 @@ in {
     };
 
     loader = {
-      efi = { canTouchEfiVariables = false; };
+      efi.canTouchEfiVariables = false;
       generationsDir.copyKernels = true;
       systemd-boot.enable = lib.mkIf cfg.useSystemdBoot true;
       grub = lib.mkIf (!cfg.useSystemdBoot) {

modules/fail2ban.nix

@@ -2,7 +2,7 @@
 
 let cfg = config.services.fail2ban;
 in {
-  options = { services.fail2ban = { recommendedDefaults = libS.mkOpinionatedOption "use fail2ban with recommended defaults"; }; };
+  options.services.fail2ban.recommendedDefaults = libS.mkOpinionatedOption "use fail2ban with recommended defaults";
 
   config.services.fail2ban = lib.mkIf cfg.recommendedDefaults {
     maxretry = 5;

modules/flake-update-service.nix

@@ -10,38 +10,40 @@ in {
         default = "dotfiles";
         description = "A name for the service which needs to be pulled";
       };
+
       path = lib.mkOption {
         type = lib.types.nullOr lib.types.path;
         default = null;
         description = "Path that needs to be updated via git pull";
       };
+
       frequency = lib.mkOption {
         type = lib.types.str;
         description = "systemd-timer compatible time between pulls";
         default = "1h";
       };
+
       ssh-key = lib.mkOption {
         type = lib.types.str;
         description = "ssh-key used to pull the repository";
       };
+
       triggersRebuild = lib.mkOption {
         type = lib.types.bool;
         default = false;
-        description =
+        description = "Whether or not the rebuild service should be triggered after pulling. Note that system.autoUpgrade must be pointed at the same directory as this service if you'd like to use this option.";
-          "Whether or not the rebuild service should be triggered after pulling. Note that system.autoUpgrade must be pointed at the same directory as this service if you'd like to use this option.";
       };
     };
   };
 
-  # implementation
   config = lib.mkIf (cfg.enable && !(builtins.isNull cfg.path)) {
+    environment.systemPackages = [ pkgs.openssh pkgs.git ];
     systemd.services."autopull@${cfg.name}" = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       description = "Pull the latest data for ${cfg.name}";
       serviceConfig = {
         Type = "oneshot";
-        # TODO: See how we can migrate this to DynamicUser=yes instead
         User = "root";
         WorkingDirectory = cfg.path;
         Environment = lib.mkIf (cfg.ssh-key != "") "GIT_SSH_COMMAND=${pkgs.openssh}/bin/ssh -i ${cfg.ssh-key} -o IdentitiesOnly=yes";
@@ -50,6 +52,7 @@ in {
         Wants = "nixos-upgrade.service";
       };
     };
+
     systemd.timers."autopull@${cfg.name}" = {
       wantedBy = [ "timers.target" ];
       timerConfig = {
@@ -58,6 +61,5 @@ in {
         Unit = "autopull@${cfg.name}.service";
       };
     };
-    environment.systemPackages = [ pkgs.openssh pkgs.git ];
   };
 }

modules/security.nix

@@ -2,7 +2,6 @@
 { config, lib, ... }: {
   config = {
     services = {
-
       openssh = lib.mkIf config.services.gitea.enable {
         extraConfig = ''
           Match User gitea
@@ -22,6 +21,8 @@
       };
     };
 
-    networking.firewall = lib.mkIf config.services.openssh.enable { allowedTCPPorts = config.services.openssh.ports ++ [ 22 ]; };
+    networking.firewall = lib.mkIf config.services.openssh.enable {
+      allowedTCPPorts = config.services.openssh.ports ++ [ 22 ];
+    };
   };
 }

modules/website.nix

@@ -1,7 +1,6 @@
 { config, pkgs, lib, ... }:
 let
   eachSite = config.services.staticpage.sites;
-
   siteOpts = { lib, name, config, ... }: {
     options = {
       package = lib.mkPackageOption pkgs "page" { };
@@ -41,7 +40,6 @@ in
 {
   options.services.staticpage = {
     enable = lib.mkEnableOption "staticpage";
-
     sites = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule siteOpts);
       default = { };
@@ -57,7 +55,6 @@ in
             name = "${(if (cfg.subdomain == null) then "${cfg.domain}" else "${cfg.subdomain}.${cfg.domain}")}";
             value = {
               root = "/var/lib/www/${cfg.root}";
-
               forceSSL = true;
               enableACME = true;
               serverAliases = lib.mkIf (cfg.subdomain == null) [ "www.${cfg.domain}" ];
@@ -68,6 +65,7 @@ in
                   access_log off;
                 '';
               };
+
               locations."= /robots.txt" = {
                 extraConfig = ''
                   allow all;
@@ -75,11 +73,13 @@ in
                   access_log off;
                 '';
               };
+
               locations."~* ^/.well-known/" = {
                 extraConfig = ''
                   allow all;
                 '';
               };
+
               locations."~* .(js|css|png|jpg|jpeg|gif|ico|svg)$" = {
                 extraConfig = ''
                   try_files $uri @rewrite;
@@ -87,6 +87,7 @@ in
                   log_not_found off;
                 '';
               };
+
               locations."~ ^/sites/.*/files/styles/" = {
                 extraConfig = ''
                   try_files $uri @rewrite;
@@ -118,37 +119,44 @@ in
                   return 403;
                 '';
               };
+
               locations."~ ^/sites/.*/private/" = {
                 extraConfig = ''
                   return 403;
                 '';
               };
+
               locations."~ ^/sites/[^/]+/files/.*.php$" = {
                 extraConfig = ''
                   deny all;
                 '';
               };
+
               locations."/" = {
                 extraConfig = ''
                   try_files $uri /index.php?$query_string;
                 '';
               };
+
               locations."@rewrite" = {
                 extraConfig = ''
                   rewrite ^ /index.php;
                 '';
               };
+
               locations."~ /vendor/.*.php$" = {
                 extraConfig = ''
                   deny all;
                   return 404;
                 '';
               };
+
               locations."~ ^/sites/.*/files/styles/" = {
                 extraConfig = ''
                   try_files $uri @rewrite;
                 '';
               };
+
               locations."~ ^(/[a-z-]+)?/system/files/" = {
                 extraConfig = ''
                   try_files $uri /index.php?$query_string;
@@ -171,6 +179,7 @@ in
       (lib.mapAttrs
         (name: cfg: {
           user = "nginx";
+          phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
           settings = {
             "listen.owner" = config.services.nginx.user;
             "pm" = "dynamic";
@@ -183,7 +192,6 @@ in
             "php_admin_flag[log_errors]" = true;
             "catch_workers_output" = true;
           };
-          phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
         })
         (lib.filterAttrs (n: v: v.usePHP) eachSite))
     ];

systems/configuration.nix

@@ -1,4 +1,6 @@
 { lib, pkgs, config, ... }: {
+  security.auditd.enable = true;
+  nixpkgs.config.allowUnfree = true;
   i18n = {
     defaultLocale = "en_US.utf8";
     supportedLocales = [ "en_US.UTF-8/UTF-8" ];
@@ -26,8 +28,6 @@
     };
   };
 
-  security.auditd.enable = true;
-
   services = {
     fail2ban = {
       enable = lib.mkIf config.networking.firewall.enable (lib.mkDefault true);
@@ -55,7 +55,6 @@
         }
       ];
 
-      # all of these setting are recommended by lynis unless otherwise commented
       settings = {
         AllowAgentForwarding = "no";
         AllowTcpForwarding = "no";
@@ -71,14 +70,31 @@
         PermitRootLogin = "no";
         TcpKeepAlive = "no";
         X11Forwarding = lib.mkDefault false;
+        KexAlgorithms = [
+          "curve25519-sha256@libssh.org"
+          "diffie-hellman-group-exchange-sha256"
+        ];
 
-        KexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
+        Ciphers = [
+          "chacha20-poly1305@openssh.com"
+          "aes256-gcm@openssh.com"
+          "aes128-gcm@openssh.com"
+          "aes256-ctr"
+          "aes192-ctr"
+          "aes128-ctr"
+        ];
 
-        Ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes128-gcm@openssh.com" "aes256-ctr" "aes192-ctr" "aes128-ctr" ];
+        Macs = [
-
+          "hmac-sha2-512-etm@openssh.com"
-        Macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "umac-128-etm@openssh.com" "hmac-sha2-512" "hmac-sha2-256" "umac-128@openssh.com" ];
+          "hmac-sha2-256-etm@openssh.com"
+          "umac-128-etm@openssh.com"
+          "hmac-sha2-512"
+          "hmac-sha2-256"
+          "umac-128@openssh.com"
+        ];
       };
     };
+
     autopull = {
       enable = true;
       path = /root/dotfiles;
@@ -86,11 +102,10 @@
     };
   };
 
-  nixpkgs.config.allowUnfree = true;
-
   programs = {
     git = {
       enable = true;
+      lfs.enable = lib.mkDefault true;
       config = {
         interactive.singlekey = true;
         pull.rebase = true;
@@ -116,17 +131,16 @@
 
     zsh = {
       enable = true;
+      syntaxHighlighting.enable = true;
+      zsh-autoenv.enable = true;
+      enableCompletion = true;
+      enableBashCompletion = true;
+      ohMyZsh.enable = true;
       autosuggestions = {
         enable = true;
         strategy = [ "completion" ];
         async = true;
       };
-
-      syntaxHighlighting.enable = true;
-      zsh-autoenv.enable = true;
-      enableCompletion = true;
-      enableBashCompletion = true;
-      ohMyZsh = { enable = true; };
     };
 
     nix-ld = {
@@ -142,6 +156,7 @@
   };
 
   nix = {
+    diffSystem = true;
     settings = {
       experimental-features = [ "nix-command" "flakes" ];
       keep-outputs = true;
@@ -154,8 +169,6 @@
       dates = "weekly";
       options = "--delete-older-than 30d";
     };
-
-    diffSystem = true;
   };
 
   system = {
@@ -163,8 +176,6 @@
       enable = true;
       randomizedDelaySec = "1h";
       persistent = true;
-      # Running this since this is private right now.
-      # Need to set up a ssh-key for github for autoUpgrade
       flake = "git+ssh://git@github.com/RAD-Development/nix-dotfiles";
     };
   };

systems/jeeves-jr/configuration.nix

@@ -1,7 +1,10 @@
 { pkgs, ... }: {
   time.timeZone = "America/New_York";
   console.keyMap = "us";
-  networking.hostId = "1beb3026";
+  networking = {
+    hostId = "1beb3026";
+    firewall.enable = false;
+  };
 
   boot = {
     zfs.extraPools = [ "Main" ];
@@ -14,16 +17,16 @@
       enable = true;
       recommendedDefaults = true;
       logDriver = "local";
+      storageDriver = "overlay2";
       daemon."settings" = {
         experimental = true;
+        data-root = "/var/lib/docker";
         exec-opts = [ "native.cgroupdriver=systemd" ];
         log-opts = {
           max-size = "10m";
           max-file = "5";
         };
-        data-root = "/var/lib/docker";
       };
-      storageDriver = "overlay2";
     };
 
     podman = {
@@ -34,7 +37,6 @@
 
   environment = {
     systemPackages = with pkgs; [ docker-compose ];
-
     etc = {
       # Creates /etc/lynis/custom.prf
       "lynis/custom.prf" = {
@@ -57,11 +59,8 @@
 
   services = {
     nfs.server.enable = true;
-
     openssh.ports = [ 352 ];
-
     smartd.enable = true;
-
     sysstat.enable = true;
 
     usbguard = {
@@ -82,7 +81,5 @@
     };
   };
 
-  networking.firewall.enable = false;
-
   system.stateVersion = "23.05";
 }

systems/jeeves-jr/hardware.nix

@@ -1,35 +1,31 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
+{ config, lib, modulesPath, ... }:
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+  imports = [
-
+    (modulesPath + "/installer/scan/not-detected.nix")
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/c59f7261-ebab-4cc9-8f1d-3f4c2e4b1971";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7295-A442";
-    fsType = "vfat";
-  };
-
-  swapDevices = [{ device = "/dev/disk/by-uuid/9d4ef549-d426-489d-8332-0a49589c6aed"; }];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  networking.useDHCP = lib.mkDefault true;
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  swapDevices = [{ device = "/dev/disk/by-uuid/9d4ef549-d426-489d-8332-0a49589c6aed"; }];
+  boot = {
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+    initrd = {
+      kernelModules = [ ];
+      availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+    };
+  };
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/c59f7261-ebab-4cc9-8f1d-3f4c2e4b1971";
+      fsType = "ext4";
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/7295-A442";
+      fsType = "vfat";
+    };
+  };
 }

systems/palatine-hill/configuration.nix

@@ -1,7 +1,18 @@
 { config, pkgs, ... }: {
   time.timeZone = "America/New_York";
   console.keyMap = "us";
-  networking.hostId = "dc2f9781";
+  systemd.services.hydra-notify.serviceConfig.EnvironmentFile = config.sops.secrets."hydra/environment".path;
+  networking = {
+    hostId = "dc2f9781";
+    firewall.enable = false;
+  };
+
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override {
+      enableHybridCodec = true;
+    };
+  };
+
   boot = {
     zfs.extraPools = [ "ZFS-primary" ];
     loader.grub.device = "/dev/sda";
@@ -25,8 +36,6 @@
     }];
   };
 
-  nixpkgs.config.packageOverrides = pkgs: { vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; }; };
-
   hardware = {
     enableAllFirmware = true;
     opengl = {
@@ -43,6 +52,7 @@
   };
 
   virtualisation = {
+    # Disabling Podman as topgrade apparently prefers podman over docker and now I cant update anything :(
     docker = {
       enable = true;
       recommendedDefaults = true;
@@ -58,17 +68,12 @@
         };
       };
     };
-
-    # Disabling as topgrade apparently prefers podman over docker and now I cant update anything :(
-    # podman = {
-    #   enable = true;
-    #   recommendedDefaults = true;
-    # };
   };
 
-  environment.systemPackages = with pkgs; [ docker-compose jellyfin-ffmpeg ];
+  environment.systemPackages = with pkgs; [
-
+    docker-compose
-  systemd.services.hydra-notify = { serviceConfig.EnvironmentFile = config.sops.secrets."hydra/environment".path; };
+    jellyfin-ffmpeg
+  ];
 
   services = {
     samba.enable = true;
@@ -116,8 +121,6 @@
     };
   };
 
-  networking.firewall.enable = false;
-
   sops = {
     defaultSopsFile = ./secrets.yaml;
     secrets = {

systems/palatine-hill/hardware.nix

@@ -1,37 +1,39 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
+{ config, lib, modulesPath, ... }:
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
 {
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+  imports = [
-
+    (modulesPath + "/installer/scan/not-detected.nix")
-  boot.initrd.availableKernelModules = [ "xhci_pci" "mpt3sas" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
+  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/b3b709ce-fe88-4267-be47-bf991a512cbe";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/4CBA-2451";
-    fsType = "vfat";
-  };
-
-  swapDevices = [{ device = "/dev/disk/by-uuid/2b01e592-2297-4eb1-854b-17a63f1d4cf6"; }];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno2.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp72s0f3u1u2c2.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  networking.useDHCP = lib.mkDefault true;
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  swapDevices = [{ device = "/dev/disk/by-uuid/2b01e592-2297-4eb1-854b-17a63f1d4cf6"; }];
+  boot = {
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+    initrd = {
+      kernelModules = [ ];
+      availableKernelModules = [
+        "ahci"
+        "mpt3sas"
+        "nvme"
+        "sd_mod"
+        "usb_storage"
+        "usbhid"
+        "xhci_pci"
+      ];
+    };
+  };
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/b3b709ce-fe88-4267-be47-bf991a512cbe";
+      fsType = "ext4";
+    };
+
+    "boot" = {
+      device = "/dev/disk/by-uuid/4CBA-2451";
+      fsType = "vfat";
+    };
+  };
 }

users/alice/home.nix

@@ -1,10 +1,7 @@
 { pkgs, ... }:
 
 {
-  home.username = "alice";
+  home = {
-  home.homeDirectory = "/home/alice";
-
-  home.packages = with pkgs; [
     # # Adds the 'hello' command to your environment. It prints a friendly
     # # "Hello, world!" when run.
     # pkgs.hello
@@ -22,37 +19,40 @@
     #   echo "Hello, ${config.home.username}!"
     # '')
 
-    ncdu
+    username = "alice";
+    homeDirectory = "/home/alice";
+    packages = with pkgs; [
+      ncdu
 
-    # Rust packages
+      # Rust packages
-    trunk
+      trunk
-    wasm-pack
+      wasm-pack
-    cargo-watch
+      cargo-watch
-    #pkgs.cargo-tarpaulin
+      #pkgs.cargo-tarpaulin
-    cargo-generate
+      cargo-generate
-    cargo-audit
+      cargo-audit
-    cargo-update
+      cargo-update
-    diesel-cli
+      diesel-cli
-    gitoxide
+      gitoxide
-    tealdeer
+      tealdeer
-    helix
+      helix
 
-    # nix specific packages
+      # nix specific packages
-    nil
+      nil
-    nixfmt
+      nixfmt
 
-    # markdown
+      # markdown
-    nodePackages.markdownlint-cli
+      nodePackages.markdownlint-cli
 
-    # doom emacs dependencies
+      # doom emacs dependencies
-    fd
+      fd
-    ripgrep
+      ripgrep
-    clang
+      clang
-  ];
+    ];
+  };
 
   programs = {
     zsh.enable = true;
-
     starship.enable = true;
     fzf = {
       enable = true;

users/default.nix

@@ -3,6 +3,9 @@
 {
   inherit name;
   isNormalUser = true;
+  shell = lib.mkIf config.programs.${defaultShell}.enable pkgs.${defaultShell};
+  hashedPasswordFile = config.sops.secrets."${name}/user-password".path or null;
+  openssh.authorizedKeys.keys = publicKeys;
   extraGroups = [
     "wheel"
     "media"
@@ -15,7 +18,4 @@
     "plugdev"
     "uaccess"
   ];
-  shell = lib.mkIf config.programs.${defaultShell}.enable pkgs.${defaultShell};
-  hashedPasswordFile = config.sops.secrets."${name}/user-password".path or null;
-  openssh.authorizedKeys.keys = publicKeys;
 }

users/richie/home.nix

@@ -1,39 +1,39 @@
 { pkgs, ... }:
 
 {
-  home.username = "richie";
-  home.homeDirectory = "/home/richie";
-
-  home.packages = with pkgs; [
-    # Rust packages
-    topgrade
-    trunk
-    wasm-pack
-    cargo-watch
-    # pkgs.cargo-tarpaulin
-    cargo-generate
-    cargo-audit
-    cargo-update
-    diesel-cli
-    # gitoxide currently broke 09182023
-    gitoxide
-    tealdeer
-    helix
-
-    # nix specific packages
-    nil
-    nixfmt
-
-    # markdown
-    nodePackages.markdownlint-cli
-
-    # doom emacs dependencies
-    fd
-    ripgrep
-    clang
-  ];
-
   programs.zsh.enable = true;
+  home = {
+    username = "richie";
+    homeDirectory = "/home/richie";
+    packages = with pkgs; [
+      # Rust packages
+      topgrade
+      trunk
+      wasm-pack
+      cargo-watch
+      # pkgs.cargo-tarpaulin
+      cargo-generate
+      cargo-audit
+      cargo-update
+      diesel-cli
+      # gitoxide currently broke 09182023
+      gitoxide
+      tealdeer
+      helix
+
+      # nix specific packages
+      nil
+      nixfmt
+
+      # markdown
+      nodePackages.markdownlint-cli
+
+      # doom emacs dependencies
+      fd
+      ripgrep
+      clang
+    ];
+  };
 
   home.stateVersion = "23.11";
 }