Olympus/system-config/configuration/homebox/default.nix

{ config, pkgs, lib, inputs, ... }:

{
  imports =
    [
      ./hardware-configuration.nix

      inputs.disko.nixosModules.default
      
      (import ./disko.nix { device1 = "/dev/nvme0n1"; device2 = "/dev/nvme1n1"; device3 = "/dev/sda"; })
      
      inputs.sops-nix.nixosModules.sops
      
      inputs.home-manager.nixosModules.default
      
    ];

    boot = {
        kernelPackages = pkgs.linuxKernel.packages.linux_6_16;
        loader = {
            systemd-boot.enable = true;
            efi.canTouchEfiVariables = true;
        };
        binfmt.emulatedSystems = lib.mkIf config.sysconfig.remoteBuildHost [ "aarch64-linux" ];
    };

    nix.settings.trusted-users = lib.mkIf config.sysconfig.remoteBuildHost [ "remote-builder" ];

    users.users."remote-builder" = lib.mkIf config.sysconfig.remoteBuildHost {
        isNormalUser = true;
        createHome = false;
        /*openssh.authorizedKeys.keyFiles = [
            config.sops.secrets."remoteBuildClientKeys/laptop".path
        ];*/
        /*openssh.authorizedKeys.keyFiles = (builtins.map 
            (y: config.sops.secrets.${y}.path) 
            (builtins.partition 
                (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
                (builtins.attrNames config.sops.secrets)
            ).right
        );*/
    };

    sops.templates."remote-builder" = {
        content = builtins.concatStringsSep ''''\n'' (builtins.map 
            (y: config.sops.placeholder.${y}) 
            (builtins.partition 
                (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
                (builtins.attrNames config.sops.secrets)
            ).right
        );
        path = "/etc/ssh/authorized_keys.d/remote-builder";
        owner = "remote-builder";
    };

    #environment.etc."ssh/authorized_keys.d/remote-builder" = {};

  hardware = {
   
   graphics.enable = true;

    nvidia = {
      modesetting.enable = true;
      open = false;
      nvidiaSettings = true;
      package = config.boot.kernelPackages.nvidiaPackages.stable;
    };

    bluetooth.enable = true;

  };

  services = {
    xserver = {
      #enable = true;
      videoDrivers = ["nvidia"];
    };
    displayManager = {
        enable = true;
        defaultSession = "hyprland";
        autoLogin = {
            enable = true;
            user = "nathan";
        };
    };
    pulseaudio.enable = false;
  };

    systemd.extraConfig = "DefaultLimitNOFILE=2048";

  environment.sessionVariables = {
    WLR_BACKENDS = "headless";
    WLR_LIBINPUT_NO_DEVICES = "1";
  };

  programs.zsh.enable = true;
  environment.shells = with pkgs; [ zsh bashInteractive ];

  nixpkgs.config.allowUnfree = true;
  
    services.displayManager.sddm.settings.AutoLogin = {
        User = "nathan";
        Session = "hyprland";
        Relogin = true;
    };

    networking = {
        nameservers = lib.mkDefault [ "1.1.1.1" "1.0.0.1" ];
        networkmanager = {
            enable = true;
            dns = "none";
        };
        
        nftables = {};
        nat = {
            enable = true;
            internalInterfaces = [ "ve-+" ];
            externalInterface = "enp6s0";
        };
    };

  system.stateVersion = "23.05"; # Did you read the comment?

    sops = {
        age.keyFile = "/home/nathan/.config/sops/age/keys.txt";
        defaultSopsFile = ./secrets.yaml;
        defaultSopsFormat = "yaml";

        secrets = {
            "nathan/pass" = {
                neededForUsers = true;
            };
        };
    };

    sysconfig = {
        remoteBuildHost = true;
        host = "homebox";
        graphical = true;
        users = {
            nathan = {
                extraGroups = [ "wheel" "networkmanager" ];
                sshKeys = [
                    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsU69CxfQk58CvItPN426h5Alnpb60SH37wet97Vb57 nathan@laptop"
                ];
                shell = pkgs.zsh;
                hashedPasswordFile = config.sops.secrets."nathan/pass".path;
                home-manager = {
                    enable = true;
                    extraModules = [
                    {
                        homeconfig = {
                            minimal = false;
                            wayvnc.enable = false;
                            hyprland.enable = true;
                            swaylock.enable = true;
                            wal.enable = true;
                            mpd.enable = true;
                            ags.enable = true;
                            calcurse.enable = true;
                            rofi.enable = true;
                            firefox.enable = true;
                            git.enable = true;
                            nh.enable = true;
                        };

                        home.packages = [
                            pkgs.wayvnc
                        ];
                    } 
                    ];
                };
            };
        };

        services = {
            sddm.enable = true;
            openssh.enable = true;
            pipewire.enable = true;
            netbird.enable = true;
            minecraft.enable = false;
        };

        programs = {
            hyprland.enable = true;
            ags.enable = true;
            steam.enable = false;
        };

        virtualization = {
            traefik.enable = true;
            jellyfin.enable = true;
            "blunkall.us".enable = true;
            nextcloud.enable = true;
            ntfy.enable = false;
            gitea.enable = true;
            n8n.enable = true;
            keycloak.enable = true;
            netbird.enable = true;
            ollama.enable = true;
            homeassistant.enable = true;
            wyoming = {
                enable = true;
                piper = true;
                openwakeword = true;
                faster-whisper = true;
            };
            rustdesk.enable = false; #broken
                pihole.enable = false; #broken
                code-server.enable = false;
            novnc.enable = true;
            minecraft.enable = true;

            sandbox.enable = false;
        };
    };

    fonts.packages = with pkgs; [ nerd-fonts.fira-code ];

}