depot/ops/nixos/laputa/default.nix

# SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0

{ depot, lib, pkgs, config, ... }:
{
  imports = [
    ../lib/zfs.nix
    ../lib/graphical-client-wayland.nix
    ../lib/plasma.nix
    ../lib/whitby-distributed.nix
  ];

  boot.initrd.availableKernelModules = [
    "xhci_pci"
    "ahci"
    "nvme"
    "usbhid"
    "usb_storage"
    "sd_mod"
    "rtsx_pci_sdmmc"
  ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.supportedFilesystems = [ "ntfs" ];
  boot.kernel.sysctl = {
    "abi.vsyscall32" = "0";
  };

  fileSystems = let
    zfs = device: {
      device = device;
      fsType = "zfs";
    };
  in {
    "/" = zfs "zpool/local/root";
    "/nix" = zfs "zpool/local/nix";
    "/tmp" = zfs "zpool/local/tmp";

    "/var" = zfs "zpool/safe/var";
    "/home" = zfs "zpool/safe/home";
    "/persist" = zfs "zpool/safe/persist";

    "/boot" = {
      device = "/dev/disk/by-label/NIXBOOT";
      fsType = "vfat";
    };
  };

  nix.settings.max-jobs = lib.mkDefault 4;
  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
  hardware.enableRedistributableFirmware = true;

  # Laptop, don't autodeploy.
  my.deploy.enable = false;

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # ZFS!
  services.zfs.rollbackOnBoot.enable = true;

  # Enable Podman
  virtualisation.podman = {
    enable = true;
    dockerCompat = true;
  };

  # Enable libvirtd.
  virtualisation.libvirtd = {
    enable = true;
    qemu = {
      swtpm.enable = true;
      ovmf.packages = [
        pkgs.OVMFFull.fd
      ];
    };
  };
  security.polkit.enable = true;

  networking.hostName = "laputa";
  networking.domain = "int.as205479.net";
  networking.hostId = "88b46fc6";

  # Boot faster.
  systemd.services.systemd-udev-settle.enable = false;
  systemd.services.NetworkManager-wait-online.enable = false;

  networking.networkmanager = {
    enable = true;
    wifi.backend = "iwd";
  };
  #my.ip.tailscale = "100.125.26.108";
  #my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:1a6c";

  # Set your time zone.
  time.timeZone = "Europe/London";

  environment.systemPackages = with pkgs; [
    pciutils
    deluge
  ];

  # Enable CUPS to print documents.
  services.printing.enable = true;
  services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ];

  # Enable the X11 windowing system.
  services.xserver = {
    enable = true;
    xkb.layout = "us";
    windowManager.i3.enable = true;
    videoDrivers = [ "modesetting" "fbdev" "intel" ];
  };
  services.libinput.enable = true;
  services.displayManager = {
    sddm = {
      enable = true;
      settings = {
        General.DisplayServer = "wayland";
        Users.HideUsers = "deployer";
      };
    };
    defaultSession = "plasma";
  };

  boot.initrd.systemd.enable = true;

  hardware.graphics.enable32Bit = true;
  hardware.graphics.extraPackages = with pkgs; [
    intel-media-driver libva
    # intel-compute-runtime  # intel gpu
  ];
  hardware.graphics.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
  hardware.acpilight.enable = true;
  hardware.bluetooth.enable = true;

  # Define a user account.
  programs.adb.enable = true;
  users.users.lukegb = {
    extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" "dialout" "adbusers" ];
  };
  my.home-manager.system = {...}: {
    home.packages = lib.mkAfter (with pkgs; [
      iw
      vulkan-tools
    ]);
  };

  # Things to persist.
  services.openssh.hostKeys = [
    {
      path = "/persist/etc/ssh/ssh_host_ed25519_key";
      type = "ed25519";
    }
    {
      path = "/persist/etc/ssh/ssh_host_rsa_key";
      type = "rsa";
      bits = 4096;
    }
  ];
  environment.etc = {
    "nixos" = { source = "/persist/etc/nixos/"; };
  };
  systemd.tmpfiles.rules = [
    "d /var/lib/libvirt 0755 root - - -"
  ];
  systemd.mounts = let
    bindMount' = dir: {
      unitConfig.RequiresMountsFor = dir;
      options = "bind";
      what = "/persist${dir}";
      where = dir;
    };
    bindMountSvc = dir: svc: target: (bindMount' dir) // {
      bindsTo = [svc];
      partOf = [svc];
      before = [svc];
      wantedBy = [target];
    };
    bindMount = dir: (bindMount' dir) // {
      wantedBy = ["multi-user.target"];
    };
  in [
    (bindMountSvc "/var/lib/libvirt" "libvirtd.service" "multi-user.target")
    (bindMountSvc "/etc/NetworkManager/system-connections" "NetworkManager.service" "network.target")
    (bindMount "/root")
  ];

  # Enable Thunderbolt device management.
  services.hardware.bolt.enable = true;

  services.redis.servers."".enable = true;
  services.postgresql.enable = true;
  services.postgresql.ensureDatabases = [ "lukegb" ];
  services.postgresql.ensureUsers = [{
    name = "lukegb";
    ensureDBOwnership = true;
  }];
  services.postgresql.authentication = ''
    local all all              trust
    host  all all 127.0.0.1/32 trust
    host  all all ::1/128      trust
  '';

  my.scrapeJournal.enable = false;  # Laptop, don't pull too much.

  services.avahi = {
    enable = true;
    openFirewall = true;
  };
  services.lldpd = {
    enable = true;
  };

  # This value determines the NixOS release with which your system is to be
  # compatible, in order to avoid breaking some software such as database
  # servers. You should change this only after NixOS release notes say you
  # should.
  system.stateVersion = "23.04"; # Did you read the comment?
}