add a yubikey module

Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

.vscode/settings.json

@@ -115,7 +115,6 @@
     "keyserver",
     "keyservers",
     "KRNL",
-    "kubnet",
     "kuma",
     "libexec",
     "libglvnd",
@@ -133,7 +132,6 @@
     "markdownlint",
     "mechatroner",
     "mediainfo",
-    "microvm",
     "modesetting",
     "mousewheel",
     "mpris",
@@ -167,6 +165,7 @@
     "optimumwifi",
     "optoutstudies",
     "overscroll",
+    "overseerr",
     "oxalica",
     "pavucontrol",
     "pbmode",

flake.lock

@@ -73,27 +73,6 @@
         "type": "github"
       }
     },
-    "fenix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-analyzer-src": "rust-analyzer-src"
-      },
-      "locked": {
-        "lastModified": 1722925878,
-        "narHash": "sha256-/wuVEbsqQnaNAYKqe/7CXm8cQXMAfsQYg9Mtkm2Aetg=",
-        "owner": "nix-community",
-        "repo": "fenix",
-        "rev": "aefb786b6a2924f684ba9ecd8fcad4628b214ffe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "fenix",
-        "type": "github"
-      }
-    },
     "firefox-addons": {
       "inputs": {
         "flake-utils": [
@@ -250,80 +229,6 @@
         "type": "github"
       }
     },
-    "libgit2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1715853528,
-        "narHash": "sha256-J2rCxTecyLbbDdsyBWn9w7r3pbKRMkI9E7RvRgAqBdY=",
-        "owner": "libgit2",
-        "repo": "libgit2",
-        "rev": "36f7e21ad757a3dacc58cf7944329da6bc1d6e96",
-        "type": "github"
-      },
-      "original": {
-        "owner": "libgit2",
-        "ref": "v1.8.1",
-        "repo": "libgit2",
-        "type": "github"
-      }
-    },
-    "microvm": {
-      "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "spectrum": "spectrum"
-      },
-      "locked": {
-        "lastModified": 1716382614,
-        "narHash": "sha256-dwUYl8jyMNKidPEM9gTafcRe+3pUh2rH3ZlBrUpsvnw=",
-        "owner": "astro",
-        "repo": "microvm.nix",
-        "rev": "a59c3167f673ce29b65c674deb2bee73d151a96c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "astro",
-        "repo": "microvm.nix",
-        "type": "github"
-      }
-    },
-    "nix": {
-      "inputs": {
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-parts": [
-          "flake-parts"
-        ],
-        "git-hooks-nix": [
-          "pre-commit-hooks"
-        ],
-        "libgit2": "libgit2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-23-11": "nixpkgs-23-11",
-        "nixpkgs-regression": "nixpkgs-regression"
-      },
-      "locked": {
-        "lastModified": 1722501671,
-        "narHash": "sha256-3yFEvUDPB7GlCMI9I5VV+HXMVOT38h3lnw01nIXU2F4=",
-        "owner": "NixOS",
-        "repo": "nix",
-        "rev": "0a167ffd1f57864ce042d83f9d1f17ef5126c442",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "latest-release",
-        "repo": "nix",
-        "type": "github"
-      }
-    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -479,22 +384,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-23-11": {
-      "locked": {
-        "lastModified": 1717159533,
-        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
-        "type": "github"
-      }
-    },
     "nixpkgs-lib": {
       "locked": {
         "lastModified": 1722555339,
@@ -507,22 +396,6 @@
         "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
       }
     },
-    "nixpkgs-regression": {
-      "locked": {
-        "lastModified": 1643052045,
-        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
-        "type": "github"
-      }
-    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1722869614,
@@ -626,15 +499,12 @@
       "inputs": {
         "arch_mirror": "arch_mirror",
         "attic": "attic",
-        "fenix": "fenix",
         "firefox-addons": "firefox-addons",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils_2",
         "home-manager": "home-manager",
         "hyprland-contrib": "hyprland-contrib",
-        "microvm": "microvm",
-        "nix": "nix",
         "nix-index-database": "nix-index-database",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
@@ -649,23 +519,6 @@
         "wired-notify": "wired-notify"
       }
     },
-    "rust-analyzer-src": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1722868550,
-        "narHash": "sha256-Z708uZsfcP6IprVtw1AwjN0zjUX5+6lbneYiin58umc=",
-        "owner": "rust-lang",
-        "repo": "rust-analyzer",
-        "rev": "4a99d795d06970accb46bd594f473999818b2fa8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "rust-lang",
-        "ref": "nightly",
-        "repo": "rust-analyzer",
-        "type": "github"
-      }
-    },
     "rust-overlay": {
       "inputs": {
         "nixpkgs": [
@@ -758,22 +611,6 @@
         "type": "github"
       }
     },
-    "spectrum": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1708358594,
-        "narHash": "sha256-e71YOotu2FYA67HoC/voJDTFsiPpZNRwmiQb4f94OxQ=",
-        "ref": "refs/heads/main",
-        "rev": "6d0e73864d28794cdbd26ab7b37259ab0e1e044c",
-        "revCount": 614,
-        "type": "git",
-        "url": "https://spectrum-os.org/git/spectrum"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://spectrum-os.org/git/spectrum"
-      }
-    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -44,11 +44,6 @@
       };
     };
 
-    fenix = {
-      url = "github:nix-community/fenix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     firefox-addons = {
       url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
       inputs = {
@@ -72,28 +67,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    microvm = {
-      url = "github:astro/microvm.nix";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
-
-    nix = {
-      url = "github:NixOS/nix/latest-release";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        flake-parts.follows = "flake-parts";
-        git-hooks-nix.follows = "pre-commit-hooks";
-      };
-    };
-
     nix-index-database = {
       url = "github:Mic92/nix-index-database";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";

lib/default.nix

@@ -3,7 +3,6 @@
   # create rad-dev namespace for lib
   rad-dev = rec {
     systems = import ./systems.nix { inherit lib; };
-    microvm = import ./microvms.nix { inherit lib; };
 
     # any(), but checks if any value in the list is true
     #
@@ -57,30 +56,5 @@
     # type:
     # fileList :: Path -> String -> [Path]
     fileList = dir: map (file: dir + "/${file}") (ls dir);
-
-    # constructs a mac address from a string's hash
-    #
-    # args:
-    # hashable: the string to hash
-    #
-    # type:
-    # strToMac :: String -> String
-    strToMac =
-      hashable:
-      let
-        # computes sha512 hash of input
-        hashStr = builtins.hashString "sha512" hashable;
-        # grabs first 12 letters of hash
-        hashSub = start: builtins.substring start 2 (builtins.substring 0 12 hashStr);
-        # joins list of strings with a delimiter between
-        joiner =
-          delim: arr:
-          builtins.foldl' (
-            a: b: lib.concatStrings ([ a ] ++ (lib.optionals (a != "") [ delim ]) ++ [ b ])
-          ) "" arr;
-        # generates a list of indexes for the hash
-        starts = builtins.genList (x: x * 2) 6;
-      in
-      joiner ":" (map hashSub starts);
   };
 }

lib/microvms.nix

@@ -1,116 +0,0 @@
-{ lib, ... }:
-rec {
-  genK3SVM =
-    server-config: agent-config: vms:
-    lib.mapAttrs (
-      host:
-      {
-        address,
-        gateway,
-        machine-id,
-        server ? false,
-      }:
-      genMicroVM host address gateway "x86_64-linux" machine-id (
-        if server then server-config else agent-config
-      )
-    ) vms;
-
-  genMicroVM =
-    hostName: address: gateway: _system: machine-id: vm-config:
-    # microvm refers to microvm.nixosModules
-
-    # {
-    #   config,
-    #   pkgs,
-    #   lib,
-    #   ...
-    # }:
-    {
-      # The package set to use for the microvm. This also determines the microvm's architecture.
-      # Defaults to the host system's package set if not given.
-      # pkgs = import pkgs { inherit system; };
-
-      # (Optional) A set of special arguments to be passed to the MicroVM's NixOS modules.
-      #specialArgs = {};
-
-      # The configuration for the MicroVM.
-      # Multiple definitions will be merged as expected.
-      config = {
-        imports = [ vm-config ];
-        # It is highly recommended to share the host's nix-store
-        # with the VMs to prevent building huge images.
-
-        system.stateVersion = "24.05";
-
-        environment.etc."machine-id" = {
-          mode = "0644";
-          text = machine-id + "\n";
-        };
-
-        networking.hostName = hostName;
-
-        microvm = {
-          interfaces = [
-            {
-              type = "tap";
-              # bridge = "ztkubnet";
-              id = "vm-${hostName}";
-              mac = lib.rad-dev.strToMac hostName;
-            }
-          ];
-          shares = [
-            {
-              source = "/nix/store";
-              mountPoint = "/nix/.ro-store";
-              tag = "ro-store";
-              proto = "virtiofs";
-            }
-            {
-              # On the host
-              source = "/var/lib/microvms/${hostName}/journal";
-              # In the MicroVM
-              mountPoint = "/var/log/journal";
-              tag = "journal";
-              proto = "virtiofs";
-              socket = "journal.sock";
-            }
-          ];
-        };
-
-        systemd.network.enable = true;
-
-        systemd.network.networks."20-lan" = {
-          matchConfig.Type = "ether";
-          networkConfig = {
-            Address = address;
-            Gateway = gateway;
-            DNS = [ "9.9.9.9" ];
-            IPv6AcceptRA = true;
-            DHCP = "no";
-          };
-        };
-
-        services.openssh = {
-          enable = true;
-          openFirewall = true;
-        };
-        users.users.alice = {
-          openssh.authorizedKeys.keys = [
-            # photon
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOGcqhLaKsjwAnb6plDavAhEyQHNvFS9Uh5lMTuwMhGF alice@parthenon-7588"
-            # gh
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGoaEmzaS9vANckvBmqrYSHdFR0sPL4Xgeonbh9KcgFe gitlab keypair"
-            # janus
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfcO9p5opG8Tym6tcLkat6YGCcE6vwg0+V4MTC5WKop alice@parthenon-7588"
-            # palatine
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP59pDsx34k2ikrKa0eVacj0APSGivaij3lP9L0Zd9au alice@parthenon-7588"
-            # jeeves
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDgkUndkfns6f779T5ckHOVhyOKP8GttQ9RfaO9uJdx alice@parthenon-7588"
-          ];
-          isNormalUser = true;
-        };
-        # Any other configuration for your MicroVM
-        # [...]
-      };
-    };
-}

lib/systems.nix

@@ -160,12 +160,7 @@ rec {
     lib.nixosSystem {
       inherit system;
       specialArgs = {
-        inherit
+        inherit inputs server system;
-          inputs
-          server
-          system
-          src
-          ;
       };
       modules =
         [
@@ -213,7 +208,7 @@ rec {
               inherit inputs src configPath;
               hostname = name;
             }
-            // import configPath { inherit inputs src; }
+            // import configPath { inherit inputs; }
           );
         }
       ) (lib.rad-dev.lsdir path)

modules/kub_net.nix

@@ -20,13 +20,13 @@ in
       echo "ebe7fbd44565ba9d=ztkubnet" > /var/lib/zerotier-one/devicemap 
     '';
 
-    services.zerotierone = {
+    services.zerotierone = lib.mkDefault {
-      enable = lib.mkDefault true;
+      enable = true;
       joinNetworks = [ "ebe7fbd44565ba9d" ];
     };
 
-    systemd.network = {
+    systemd.network = lib.mkDefault {
-      enable = lib.mkDefault true;
+      enable = true;
       wait-online.anyInterface = true;
       netdevs = {
         "20-brkubnet" = {
@@ -38,27 +38,15 @@ in
       };
       networks = {
         "30-ztkubnet" = {
-          matchConfig.Name = [ "ztkubnet" ];
+          matchConfig.Name = "ztkubnet";
           networkConfig.Bridge = "brkubnet";
           linkConfig.RequiredForOnline = "enslaved";
         };
         "40-brkubnet" = {
           matchConfig.Name = "brkubnet";
           bridgeConfig = { };
-          networkConfig.LinkLocalAddressing = "no";
           linkConfig.RequiredForOnline = "no";
         };
-        "41-vms" = {
-          matchConfig.Name = [ "vm-*" ];
-          networkConfig.Bridge = "brkubnet";
-          linkConfig.RequiredForOnline = "enslaved";
-        };
-        "42-kubnet-accuse" = {
-          matchConfig.Name = "kubnet-accuse";
-          networkConfig.Bridge = "brkubnet";
-          linkConfig.RequiredForOnline = "enslaved";
-          address = [ "192.168.69.20/24" ];
-        };
       };
     };
 

modules/opt/default.nix

@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-
-}

modules/opt/k3s-agent.nix

@@ -1,5 +0,0 @@
-{ ... }:
-{
-  imports = [ ./k3s-common.nix ];
-  services.k3s.role = "agent";
-}

modules/opt/k3s-common.nix

@@ -1,15 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  services.k3s = {
-    enable = true;
-    extraFlags = "--cluster-cidr 192.168.69.0/24";
-    # tokenFile = #TODO: set this up after building the first node lol
-    # serverAddr =
-  };
-}

modules/opt/k3s-server.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  # imports = [ ./k3s-common.nix ];
-
-  services.k3s.role = "server";
-}

modules/opt/microvm-host.nix

@@ -1,34 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  ...
-}:
-let
-  cfg = config.rad-dev.microvm-host;
-  microvm = inputs.microvm.nixosModules;
-in
-{
-  imports = [ microvm.host ];
-  options.rad-dev.microvm-host = {
-    vms = lib.mkOption {
-      type = lib.types.attrs;
-      default = { };
-      description = "A list of VMs to construct on the host";
-    };
-  };
-  config = {
-    networking.useNetworkd = true;
-    microvm.vms = cfg.vms;
-
-    # TODO: deprecate this once we have syslog forwarders
-    systemd.tmpfiles.rules = map (
-      vmHost:
-      let
-        machineId = cfg.vms.${vmHost}.config.environment.etc."machine-id".text;
-      in
-      # creates a symlink of each MicroVM's journal under the host's /var/log/journal
-      "L+ /var/log/journal/${machineId} - - - - /var/lib/microvms/${vmHost}/journal/${machineId}"
-    ) (builtins.attrNames cfg.vms);
-  };
-}

modules/yubikey.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.rad-dev.yubikey;
+in
+{
+  options = {
+    services.rad-dev.yubikey = {
+      enable = lib.mkEnableOption "enable yubikey defaults";
+      enable-desktop-app = lib.mkEnableOption "installs desktop application";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable the smart card daemon for certain yubikey operations
+    services.pcscd.enable = true;
+
+    environment.systemPackages = lib.optionals cfg.enable-desktop-app [ pkgs.yubioath-flutter ];
+  };
+}

statix.toml

@@ -1,4 +1,4 @@
 disabled = ["empty_pattern"]
-nix_version = '2.4'
+nix_version = '2.23'
 ignore = ['.direnv']
 

systems/artemision/configuration.nix

@@ -84,6 +84,10 @@
       };
       #systemd.services.spotifyd.serviceConfig = systemd.services.spotifyd.
     };
+    rad-dev.yubikey = {
+      enable = true;
+      enable-desktop-app = true;
+    };
   };
 
   users.users.alice.extraGroups = [ "calibre-web" ];

systems/artemision/programs.nix

@@ -12,7 +12,7 @@
     calibre
     # calibre dedrm?
     candy-icons
-    cinnamon.nemo-with-extensions
+    nemo-with-extensions
     croc
     deadnix
     direnv
@@ -93,7 +93,6 @@
     wget
     wl-clipboard
     xboxdrv
-    yubioath-flutter
     zoom-us
     zoxide
     zoom

systems/jeeves/docker/internal.nix

@@ -112,6 +112,23 @@ in
       ];
       autoStart = true;
     };
+    overseerr = {
+      image = "ghcr.io/linuxserver/overseerr";
+      environment = {
+        PUID = "600";
+        PGID = "100";
+        TZ = "America/New_York";
+      };
+      volumes = [ "${vars.media_docker_configs}/overseerr:/config" ];
+      # TODO: remove ports later since this is going through web
+      ports = [ "5055:5055" ];
+      dependsOn = [
+        "radarr"
+        "sonarr"
+      ];
+      extraOptions = [ "--network=web" ];
+      autoStart = true;
+    };
     whisper = {
       image = "ghcr.io/linuxserver/faster-whisper:latest";
       ports = [ "10300:10300" ];

systems/palatine-hill/configuration.nix

@@ -9,13 +9,11 @@
     ./attic.nix
     ./docker.nix
     ./hydra.nix
-    ./microvms.nix
     ./minio.nix
     ./networking.nix
     ./nextcloud.nix
     ./services.nix
     ./zfs.nix
-    ./networking.nix
   ];
 
   programs.git.lfs.enable = false;

systems/palatine-hill/default.nix

@@ -1,11 +1,8 @@
-{ inputs, src, ... }:
+{ inputs, ... }:
 {
   users = [
     "alice"
     "richie"
   ];
-  modules = [
+  modules = [ inputs.attic.nixosModules.atticd ];
-    inputs.attic.nixosModules.atticd
-    (src + "/modules/opt/microvm-host.nix")
-  ];
 }

systems/palatine-hill/microvms.nix

@@ -1,27 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  src,
-  ...
-}:
-let
-  inherit (lib.rad-dev.microvm) genK3SVM;
-in
-
-{
-  # rad-dev.microvm-host.enable = true;
-  rad-dev.microvm-host.vms =
-    genK3SVM (src + "/modules/opt/k3s-server.nix") (src + "/modules/opt/k3s-agent.nix")
-      {
-        "ph-server-1" = {
-          address = [ "192.168.69.10/24" ];
-          gateway = "192.168.69.1";
-          machine-id = "d694ad1e88b356887bb204ac665263f7";
-          server = true;
-        };
-        # "ph-agent-1" = {
-        #   ipv4 = "192.168.69.30";
-        # };
-      };
-}

users/richie/home/gui/default.nix

@@ -8,8 +8,8 @@
   home.packages = with pkgs; [
     beeper
     candy-icons
-    cinnamon.nemo
+    nemo
-    cinnamon.nemo-fileroller
+    nemo-fileroller
     discord-canary
     gimp
     gparted