nixos-config/machines/loki/configuration.nix

{ nixos-hardware, ... }:
{ pkgs, config, ... }:
{
  imports = [
    nixos-hardware.nixosModules.common-cpu-amd
    nixos-hardware.nixosModules.common-cpu-amd-pstate
    nixos-hardware.nixosModules.common-gpu-amd
    nixos-hardware.nixosModules.common-pc-ssd

    ../../users/erwin
    ../../users/root
    ../../users/builder
  ];

  eboskma = {
    users = {
      erwin = {
        enable = true;
        home = true;
      };
      builder.enable = true;
    };
    # backscrub.enable = true;
    base = {
      plymouth.enable = true;
      work = false;
      udev-rules = {
        qmk = true;
        solo2 = true;
        picotool = true;
        blink1 = true;
        probe-rs = true;
      };
    };
    bluetooth.enable = true;
    desktop = {
      enable = true;
      wayland = true;
    };
    docker.enable = true;
    element-web.enable = false;
    fonts.enable = true;
    gnome.enable = true;
    greetd = {
      enable = true;
      sway = true;
    };
    libvirtd.enable = false;
    livebook = {
      enable = false;
      dataDir = "/home/erwin/workspace/livebook";
      userMapping = "1000:100";
    };
    lxd.enable = true;
    networking = {
      enable = true;
    };
    nix-common = {
      enable = true;
      cross-systems = [ "aarch64-linux" ];
    };
    tablet.enable = false;
    sound.enable = true;
    systemd.enable = true;
  };


  fileSystems."/" = {
    device = "/dev/disk/by-uuid/42065c7e-d0aa-4de8-a913-014cf59d48ac";
    fsType = "ext4";
  };

  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/4064-A1BE";
    fsType = "vfat";
  };

  fileSystems."/home" = {
    device = "/dev/disk/by-uuid/082ec5d2-238e-4713-9c37-31b1cb0fb8c3";
    fsType = "ext4";
  };

  swapDevices = [{ device = "/dev/disk/by-uuid/d93788f7-1b94-4687-8313-055d17f42b7e"; }];

  # high-resolution display
  # hardware.video.hidpi.enable = lib.mkDefault true;

  # Enable firmware
  hardware.enableAllFirmware = true;

  # i2c support
  hardware.i2c.enable = true;

  boot = {
    initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
    initrd.kernelModules = [ ];

    kernelPackages = pkgs.linuxPackages_6_4;
    kernelModules = [ "kvm-amd" "apple-mfi-fastcharge" "zenpower" "nf_nat_ftp" ];
    kernelParams = [ "amd_pstate.shared_mem=1" ];
    extraModulePackages = [ ] ++
      (with config.boot.kernelPackages; [ zenpower cpupower ]);

    loader = {
      systemd-boot = {
        enable = true;
        configurationLimit = 10;
      };
      efi.canTouchEfiVariables = true;
    };
  };

  security = {
    tpm2 = {
      enable = true; # Broken, see https://github.com/NixOS/nixpkgs/issues/244107
      pkcs11.enable = true;
      abrmd.enable = true;
      tctiEnvironment.enable = true;
    };
  };

  users.users.erwin.extraGroups = [ "tss" ];

  time.timeZone = "Europe/Amsterdam";

  networking = {
    hostName = "loki";
    useDHCP = false;
    networkmanager.enable = false;
    useNetworkd = true;

    hosts = {
      "10.0.0.252" = [ "pve.datarift.nl" ];
    };

    firewall = {
      trustedInterfaces = [ "lo" ];
      allowedTCPPorts = [
        # NFS
        111
        2049
        4100
        4101
        4102
        20048

        # Horus System V2
        12345
        5555
        5556

        # Elixir/Phoenix dev environment
        4000

        # SteamLink
        27036
        27037

        # Sunshine
        48010
      ];

      allowedUDPPorts = [
        # NFS
        111
        2049
        4100
        4101
        4102
        20048

        # SteamLink
        27031
        27036

        # WireGuard
        51820
      ];

      allowedTCPPortRanges = [
        # Sunshine
        { from = 47984; to = 47990; }
        # Sonos / noson
        { from = 1400; to = 1410; }
      ];

      allowedUDPPortRanges = [
        # Sunshine
        { from = 47998; to = 48000; }
        # Sonos / noson / pulseaudio
        { from = 1400; to = 1410; }
      ];
    };
  };

  systemd.network = {
    enable = true;

    wait-online = {
      anyInterface = true;
    };

    netdevs = {
      "10-wghorus" = {
        netdevConfig = {
          Kind = "wireguard";
          MTUBytes = "1420";
          Name = "wghorus";
        };

        wireguardConfig = {
          PrivateKeyFile = config.sops.secrets.wireguard-horus-privkey.path;
          ListenPort = 51820;
        };

        wireguardPeers = [
          {
            wireguardPeerConfig = {
              PublicKey = "6faxlUG8+F7uVrKk/OJqqy5k2+OzrhXc/cV6Zsfbl0c=";
              AllowedIPs = [ "192.168.4.0/23" "192.168.6.0/24" "192.168.7.0/24" "192.168.8.0/24" ];
              Endpoint = "212.45.34.195:51820";
              PersistentKeepalive = 25;
            };
          }
        ];
      };
    };

    networks = {
      "40-enp4s0" = {
        matchConfig = {
          Name = "enp4s0";
        };

        networkConfig = {
          DHCP = "yes";
        };
      };
      "40-wghorus" = {
        matchConfig = {
          Name = "wghorus";
        };

        linkConfig = {
          ActivationPolicy = "manual";
        };

        networkConfig = {
          DHCP = "no";
          DNS = "192.168.4.1";
          Domains = [ "bedum.horus.nu" "internal.horus.nu" ];
        };

        address = [
          "10.10.4.2/24"
        ];

        routes = [
          {
            routeConfig =
              {
                Destination = "192.168.4.0/23";
                Scope = "link";
              };
          }
          {
            routeConfig = {
              Destination = "192.168.6.0/24";
              Scope = "link";
            };
          }
          {
            routeConfig =
              {
                Destination = "192.168.7.0/24";
                Scope = "link";
              };
          }
          {
            routeConfig =
              {
                Destination = "192.168.8.0/24";
                Scope = "link";
              };
          }
        ];
      };
    };

    links = {
      "40-enp4s0" = {
        matchConfig = {
          Name = "enp4s0";
        };
        linkConfig = {
          WakeOnLan = "magic";
        };
      };
    };
  };

  services.openssh.enable = true;
  # programs.ssh.startAgent = true;

  services.envfs.enable = true;
  services.cpupower-gui.enable = true;
  services.tailscale.enable = true;

  programs.gamemode = {
    enable = true;
    settings = {
      general = {
        renice = 5;
      };
      custom = {
        start = "${pkgs.libnotify}/bin/notify-send 'GameMode started'";
        end = "${pkgs.libnotify}/bin/notify-send 'GameMode ended'";
      };
    };
  };

  services.sunshine = {
    enable = true;
    user = "erwin";
    openFirewall = true;
  };

  powerManagement = {
    cpuFreqGovernor = "ondemand";
  };

  services.nfs.server = {
    enable = true;
    exports = ''
      /home/erwin/proxmox-backup 10.0.0.0/24(rw,sync,no_subtree_check,anonuid=1000,anongid=100,all_squash)
    '';
    lockdPort = 4101;
    mountdPort = 4102;
    statdPort = 4100;
  };

  environment.systemPackages = with pkgs; [
    appimage-run
    tailscale
  ];

  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets = {
    ha_now_playing_token = {
      owner = "erwin";
    };
    gh_token = {
      owner = "erwin";
    };
    renovate_env = {
      owner = "erwin";
    };
    livebook_cookie = {
      owner = "erwin";
    };
    livebook-password = {
      owner = "erwin";
    };
    wireguard-horus-privkey = {
      owner = "systemd-network";
    };
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "22.05"; # Did you read the comment?
}