depot/ops/nixos/porcorosso/default.nix

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0

{ depot, lib, pkgs, config, ... }:
let
  inherit (depot.ops) secrets;
  nvidia-offload-profile = ''
    export __NV_PRIME_RENDER_OFFLOAD=1
    export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
    export __GLX_VENDOR_LIBRARY_NAME=nvidia
    export __VK_LAYER_NV_optimus=NVIDIA_only
  '';
  nvidia-offload = pkgs.writeShellScriptBin "nvidia-offload"
    (nvidia-offload-profile + ''
      exec -a "$0" "$@"
    '');

  setup-display = pkgs.writeShellScriptBin "setup-display-porcorosso" ''
    ${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource modesetting NVIDIA-0
    ${pkgs.xorg.xrandr}/bin/xrandr --auto
    ${pkgs.autorandr}/bin/autorandr -c
  '';
in {
  imports = [
    ../lib/zfs.nix
    ../lib/graphical-client-x11.nix
    ../lib/whitby-distributed.nix
  ];

  boot.initrd.availableKernelModules = [
    "xhci_pci"
    "ahci"
    "nvme"
    "usbhid"
    "usb_storage"
    "sd_mod"
    "rtsx_pci_sdmmc"
  ];
  boot.initrd.kernelModules = [ "nvidia" "nvidia_uvm" "nvidia_drm" "nvidia_modeset" "i2c_nvidia_gpu" ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.supportedFilesystems = [ "ntfs" ];
  boot.kernel.sysctl = {
    "abi.vsyscall32" = "0";
  };

  boot.blacklistedKernelModules = [
    # TODO(lukegb): remove this again
    # For reasons unknown, at the moment, the firmware keeps getting reloaded every 10 seconds or so, resulting in a brief stutter and
    # "r8152 6-2.4:1.0: load rtl8153b-2 v1 10/23/19 successfully"
    # This driver is used for the Ethernet port on my USB4 dock, so let's drop this for now.
    "r8153_ecm" "r8152"
  ];

  my.rundeck.expectedOnline = false;

  fileSystems = let
    zfs = device: {
      device = device;
      fsType = "zfs";
    };
  in {
    "/" = zfs "zpool/local/root";
    "/nix" = zfs "zpool/local/nix";
    "/tmp" = zfs "zpool/local/tmp";

    "/var" = zfs "zpool/safe/var";
    "/home" = zfs "zpool/safe/home";
    "/persist" = zfs "zpool/safe/persist";

    "/boot" = {
      device = "/dev/disk/by-label/NIXBOOT";
      fsType = "vfat";
    };
    "/data" = {
      device = "/dev/disk/by-label/BULKDATA";
      fsType = "ntfs";
      options = [ "rw" "uid=1000" "gid=100" "dmask=022" "fmask=024" "windows_names" ];
    };
  };

  nix.settings.max-jobs = lib.mkDefault 12;
  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
  hardware.enableRedistributableFirmware = true;

  # Laptop, don't autodeploy.
  my.deploy.enable = false;

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # ZFS!
  services.zfs.rollbackOnBoot.enable = true;

  # Enable Podman
  virtualisation.podman = {
    enable = true;
    dockerCompat = true;
  };

  # Enable LXD
  virtualisation.lxd = {
    enable = false;
    zfsSupport = true;
    recommendedSysctlSettings = true;
  };
  systemd.services.lxd.serviceConfig.path = lib.mkAfter (with pkgs; [
    iptables
    ebtables
  ]);

  # Enable libvirtd.
  virtualisation.libvirtd = {
    enable = true;
    qemu = {
      swtpm.enable = true;
      ovmf.packages = [
        pkgs.OVMFFull.fd
      ];
    };
  };
  security.polkit.enable = true;

  networking.hostName = "porcorosso";
  networking.hostId = "1ee729a4";

  # Boot faster.
  systemd.services.systemd-udev-settle.enable = false;
  systemd.services.NetworkManager-wait-online.enable = false;

  networking.networkmanager = {
    enable = true;
    wifi.backend = "iwd";
  };
  my.ip.tailscale = "100.125.26.108";
  my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:1a6c";

  # Set your time zone.
  time.timeZone = "Europe/London";

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    pciutils
    nvidia-offload
    deluge
    (writeShellScriptBin "windows" ''
      set -ue
      if [[ $EUID -ne 0 ]]; then
        exec sudo "$0" "$@"
      fi

      efibootmgr -n 0001
      systemctl reboot
    '')
  ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };

  # List services that you want to enable:

  # Enable CUPS to print documents.
  services.printing.enable = true;
  services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ];

  # Enable the X11 windowing system.
  services.xserver = {
    enable = true;
    layout = "us";
    libinput.enable = true;
    windowManager.i3.enable = true;
    videoDrivers = [ "nvidia" ];
  };
  specialisation.intelGraphics.configuration = {
    my.specialisationName = "intelGraphics";
    services.xserver.videoDrivers = lib.mkForce [ "intel" ];
    hardware.nvidia.modesetting.enable = lib.mkForce false;
    hardware.nvidia.prime.offload.enable = lib.mkForce false;
    boot.initrd.kernelModules = lib.mkForce [];
  };
  services.xserver.displayManager.gdm = {
    enable = true;
    wayland = false;
  };

  hardware.nvidia = {
    modesetting.enable = true;
    prime = {
      # PRIME sync enables using Intel non-muxed outputs (i.e. the internal display)
      sync.enable = true;
      nvidiaBusId = "PCI:1:0:0";
      intelBusId = "PCI:0:2:0";
    };
  };

  hardware.opengl.driSupport32Bit = true;
  hardware.opengl.extraPackages = with pkgs; [
    intel-media-driver libva
  ];
  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
  hardware.acpilight.enable = true;
  hardware.bluetooth.enable = true;

  # Define a user account.
  users.users.lukegb = {
    extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" "dialout" ];
  };
  my.home-manager.system = {...}: {
    xsession.windowManager.i3.config.startup = lib.mkAfter [
      { command = "${setup-display}/bin/setup-display-porcorosso"; notification = false; }
    ];
    programs.autorandr = {
      enable = true;
      profiles.standard = {
        config = {
          "eDP-1-1" = {
            enable = true;
            mode = "1920x1080";
            position = "0x0";
            rate = "59.98";
          };
          "DP-0.2" = {
            enable = true;
            mode = "3840x2160";
            primary = true;
            position = "1920x0";
            rate = "60.00";
          };
          "DP-0.1" = {
            enable = true;
            mode = "3840x2160";
            position = "5760x0";
            rate = "60.00";
          };
        };
        fingerprint = {
          "DP-0.2" = "00ffffffffffff0005e36828e70100001b180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c001010101e5ca0038f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a20202020202020014d020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013";
          "DP-0.1" = "00ffffffffffff0005e368283302000016180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c00101010125cc0050f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a2020202020202001ab020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013";
          "eDP-1-1" = "00ffffffffffff0030e41a0600000000001c0104a522137802e0b5a3544e9b260c505400000001010101010101010101010101010101243680a070381f403020350058c21000001a502b80a070381f403020350058c21000001a000000fe003150564d35803135365746430a00000000000141319e001000000a010a2020007a";
        };
      };
    };

    home.packages = lib.mkAfter (with pkgs; [
      (steam.override { extraProfile = nvidia-offload-profile; })
      (writeScriptBin "javaws" ''
        #!/bin/sh
        exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
      '')
      factorio-experimental
      (depot.nix.pkgs.secretsync.configure {
        workingDir = "/home/lukegb/depot";
        gitlabAccessToken = secrets.deployer.gitlabAccessToken;
        manifestVariable = "SECRETS_MANIFEST";
        variablesToFile = {
          "OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix";
        };
      })
      efibootmgr
      iw
      obs-studio
      vulkan-tools
      setup-display
    ]);
  };

  # github.com/target/lorri
  services.lorri.enable = true;

  # Things to persist.
  services.openssh.hostKeys = [
    {
      path = "/persist/etc/ssh/ssh_host_ed25519_key";
      type = "ed25519";
    }
    {
      path = "/persist/etc/ssh/ssh_host_rsa_key";
      type = "rsa";
      bits = 4096;
    }
  ];
  environment.etc = {
    "nixos" = { source = "/persist/etc/nixos/"; };
  };
  systemd.tmpfiles.rules = [
    #"L /etc/nixos - - - - /persist/etc/nixos"
    "d /var/lib/libvirt 0755 root - - -"
  ];
  systemd.mounts = let
    bindMount' = dir: {
      unitConfig.RequiresMountsFor = dir;
      options = "bind";
      what = "/persist${dir}";
      where = dir;
    };
    bindMountSvc = dir: svc: (bindMount' dir) // {
      bindsTo = [svc];
      partOf = [svc];
    };
    bindMount = dir: (bindMount' dir) // {
      wantedBy = ["multi-user.target"];
    };
  in [
    (bindMountSvc "/var/lib/libvirt" "libvirtd.service")
    (bindMountSvc "/etc/NetworkManager/system-connections" "NetworkManager.service")
    (bindMount "/root")
  ];

  # Enable Thunderbolt device management.
  services.hardware.bolt.enable = true;

  services.redis.servers."".enable = true;
  services.postgresql.enable = true;
  services.postgresql.ensureDatabases = [ "lukegb" ];
  services.postgresql.ensureUsers = [{
    name = "lukegb";
    ensurePermissions = {
      "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
      "DATABASE lukegb" = "ALL PRIVILEGES";
    };
  }];
  services.postgresql.authentication = ''
    local all all              trust
    host  all all 127.0.0.1/32 trust
    host  all all ::1/128      trust
  '';

  nix.buildMachines = [ {
    hostName = "totoro";
    system = "x86_64-linux";
    maxJobs = 4;
    speedFactor = 2;
    supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
    mandatoryFeatures = [ ];
  }];

  services.tlp = {
    enable = true;
    settings = {
      DISK_DEVICES = "nvme0n1 nvme1n1 nvme2n1";
      DISK_IOSCHED = "mq-deadline mq-deadline mq-deadline";
    };
  };

  my.scrapeJournal.enable = false;  # Laptop, don't pull too much.

  services.avahi = {
    enable = true;
    openFirewall = true;
  };
  services.lldpd = {
    enable = true;
  };

  # This value determines the NixOS release with which your system is to be
  # compatible, in order to avoid breaking some software such as database
  # servers. You should change this only after NixOS release notes say you
  # should.
  system.stateVersion = "22.11"; # Did you read the comment?
}