Merge branch 'plasma_bigscreen'

mediabox/configuration.nix

@@ -1,19 +1,22 @@
-# Edit this configuration file to define what should be installed on
+{ config
-# your system.  Help is available in the configuration.nix(5) man page
+, nvim
-# and in the NixOS manual (accessible by running ‘nixos-help’).
+, pkgs
-{
+, system
-  config,
+, zremap
-  pkgs,
+, ...
-  zremap,
-  system,
-  nvim,
-  ...
 }:
+let
+  USER = "akill";
+in
 {
   imports = [ ];
 
   system.stateVersion = "23.05";
   system.autoUpgrade.enable = false;
+  system.switch = {
+    enable = true;
+    enableNg = true;
+  };
 
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
   sops.secrets."peerix/private" = {
@@ -74,29 +77,35 @@
     readOnlyNixStore = true;
     supportedFilesystems = [ "btrfs" ];
     tmp.useTmpfs = true;
-    tmp.tmpfsSize = "80%";
   };
 
   security = {
     rtkit.enable = true;
-    acme = {
+    allowSimultaneousMultithreading = true;
-      acceptTerms = true;
+    sudo.enable = true;
-      defaults.email = "aasmir@gmx.com";
+    doas.enable = true;
-    };
+    doas.extraRules = [
+      {
+        users = [ USER ];
+        keepEnv = true;
+        persist = true;
+      }
+    ];
   };
 
   powerManagement = {
     enable = true;
-    cpuFreqGovernor = "ondemand";
   };
 
   networking = {
+    nftables.enable = true;
     firewall = {
       enable = true;
       allowedTCPPorts = [
         80
         443
         51820
+        8020
       ];
     };
 
@@ -111,14 +120,16 @@
       "::1"
     ];
     dhcpcd.extraConfig = "nohook resolv.conf";
-    networkmanager.dns = "none";
+
     extraHosts = ''
       192.168.1.173 nixy.lan
       192.168.88.171 jellyfin.mediabox.lan
+      192.168.88.171 jellyseerr.mediabox.lan
       192.168.88.171 mediabox.lan
       192.168.88.171 qbittorrent.mediabox.lan
       192.168.88.1   router.lan
       192.168.88.231 workstation.lan
+      192.168.88.121 ender.lan
     '';
 
     wireguard.interfaces = {
@@ -149,44 +160,47 @@
     };
   };
 
-  programs.gnupg.agent = {
+  programs = {
+    steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+      dedicatedServer.openFirewall = false;
+      localNetworkGameTransfers.openFirewall = true;
+    };
+    gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
     };
-  programs.zsh.enable = true;
+    appimage = {
-  programs.light.enable = true;
+      enable = true;
-  programs.firejail.enable = true;
+      binfmt = true;
-  programs.adb.enable = false;
+    };
-  programs.wireshark.enable = true;
+    nix-ld = {
-  programs.sway.enable = true;
+      enable = false;
+      libraries = with pkgs; [
+        stdenv.cc.cc.lib
+        zlib
+      ];
+    };
+    zsh.enable = true;
+    firejail.enable = true;
+  };
 
   # List services that you want to enable:
   systemd = {
     services = {
-      "macchanger-wireless" = {
+      "zremap@" = {
-        after = [ "sys-subsystem-net-devices-wlp3s0.device" ];
+        enable = true;
-        before = [ "network-pre.target" ];
+        restartIfChanged = true;
-        bindsTo = [ "sys-subsystem-net-devices-wlp3s0.device" ];
-        description = "Changes MAC of my wireless interface for privacy reasons";
-        stopIfChanged = false;
-        wantedBy = [ "multi-user.target" ];
-        wants = [ "network-pre.target" ];
-        script = ''
-          ${pkgs.macchanger}/bin/macchanger -e wlp3s0 || true
-        '';
-        serviceConfig.Type = "oneshot";
-      };
-
-      "zremap" = {
-        description = "Intercepts keyboard udev events";
-        wants = [ "systemd-udevd.service" ];
-        wantedBy = [ "multi-user.target" ];
         serviceConfig.Nice = -20;
-        script = ''
+        unitConfig = {
-          sleep 1
+          Description = "zremap on %I";
-          ${zremap.defaultPackage.${system}}/bin/zremap \
+          ConditionPathExists = "%I";
-          /dev/input/by-path/platform-i8042-serio-0-event-kbd
+        };
-        '';
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${zremap.defaultPackage.${system}}/bin/zremap %I";
+        };
       };
 
       "wakeonlan" = {
@@ -202,27 +216,21 @@
           "shutdown.target"
         ];
       };
+    };
 
-      /*
+    coredump.enable = false;
-        "cpu_setting" = {
+    extraConfig = ''
-          description = "Enable turboot boost and undervolt cpu after suspend";
+      DefaultTimeoutStartSec=30s
-          wantedBy = ["post-resume.target" "multi-user.target"];
+      DefaultTimeoutStopSec=30s
-          after = ["post-resume.target"];
-          script = ''
-                   echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo
-                   echo 0 > /sys/devices/system/cpu/intel_pstate/no_turbo
-            ${pkgs.undervolt}/bin/undervolt --core -105 --cache -105 --uncore -105 --gpu -15 -p1 47 28 -p2 57 0.0025
     '';
-          serviceConfig.Type = "oneshot";
-        };
-      */
-    };
   };
 
   services = {
     acpid.enable = true;
     btrfs.autoScrub.enable = true;
     dbus.enable = true;
+    dbus.implementation = "broker";
+    envfs.enable = true;
     fstrim.enable = true;
     fwupd.enable = true;
     ntp.enable = true;
@@ -240,13 +248,13 @@
     };
 
     jellyfin = {
-      enable = true;
+      enable = false;
       user = "akill";
       openFirewall = true;
     };
 
     jellyseerr = {
-      enable = true;
+      enable = false;
       openFirewall = true;
     };
 
@@ -257,144 +265,95 @@
       pulse.enable = true;
     };
 
-    deluge = {
+    avahi = {
       enable = false;
-      user = "akill";
+      nssmdns4 = false;
       openFirewall = true;
-      dataDir = "/home/akill/.config/deluge";
-      web = {
-        enable = true;
-        openFirewall = false;
-      };
-      config = {
-        download_location = "/media";
-        allow_remote = true;
-        daemon_port = 58846;
-      };
     };
 
-    transmission = {
+    libinput.enable = true;
-      enable = false;
-      openFirewall = true;
-      settings = {
-        rpc-whitelist = "192.168.88.*";
-        download-dir = "/media";
-      };
-    };
-
-    qbittorrent = {
-      enable = true;
-      user = "akill";
-      openFirewall = true;
-      dataDir = "/home/akill/.config/qbittorrent";
-      port = 8081;
-    };
-
-    nginx = {
-      enable = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-
-      virtualHosts."deluge.mediabox.lan" = {
-        locations."/".proxyPass = "http://localhost:8112/";
-      };
-      virtualHosts."qbittorrent.mediabox.lan" = {
-        locations."/".proxyPass = "http://localhost:8081/";
-      };
-      virtualHosts."jellyfin.mediabox.lan" = {
-        locations."/".proxyPass = "http://localhost:8096/";
-      };
-      virtualHosts."jellyseerr.mediabox.lan" = {
-        locations."/".proxyPass = "http://localhost:5055/";
-      };
-    };
-
-    journald.extraConfig = ''
-      SystemMaxUse=50M
-    '';
-
-    logind.extraConfig = ''
-      KillUserProcesses=yes
-    '';
-
     xserver = {
       enable = true;
-      libinput.enable = true;
+      dpi = 144;
       desktopManager.xterm.enable = false;
-      displayManager.lightdm.enable = false;
+      desktopManager.plasma5.bigscreen.enable = true;
-      displayManager.defaultSession = "none+icewm";
+      #desktopManager.plasma6.enable = true;
-      windowManager.icewm.enable = true;
+      displayManager = {
+        lightdm.enable = false;
+        startx.enable = true;
+        sddm.enable = true;
+        sddm.wayland.enable = true;
+      };
+      windowManager.i3.enable = false;
     };
 
-    udev.packages = [ ];
+    udev = {
+      packages = [ ];
+      extraRules = ''
+        #zremap on new keyboard
+        ACTION=="add", SUBSYSTEM=="input", ATTRS{phys}!="", KERNEL=="event[0-9]*", ENV{ID_INPUT_KEY}=="1", ENV{ID_INPUT_KEYBOARD}=="1", TAG+="systemd", ENV{SYSTEMD_WANTS}+="zremap@$env{DEVNAME}.service"
+      '';
+    };
 
     tlp = {
-      enable = true;
+      enable = false;
-      settings = { };
+    };
+
+    batteryNotifier = {
+      enable = false;
+      notifyCapacity = 20;
+      suspendCapacity = 10;
     };
 
     actkbd = {
       enable = true;
       bindings = [
         {
-          keys = [ 121 ];
+          keys = [ 115 ];
           events = [ "key" ];
-          command = "${pkgs.alsaUtils}/bin/amixer -q set Master toggle";
+          command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+";
         }
+
         {
-          keys = [ 122 ];
+          keys = [ 114 ];
           events = [
             "key"
             "rep"
           ];
-          command = "${pkgs.alsaUtils}/bin/amixer -q set Master ${config.sound.mediaKeys.volumeStep}- unmute";
+          command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-";
         }
+
         {
-          keys = [ 123 ];
+          keys = [ 113 ];
           events = [
             "key"
             "rep"
           ];
-          command = "${pkgs.alsaUtils}/bin/amixer -q set Master ${config.sound.mediaKeys.volumeStep}+ unmute";
+          command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
         }
+
         {
           keys = [ 224 ];
           events = [ "key" ];
-          command = "/run/current-system/sw/bin/light -U 5";
+          command = "${pkgs.light}/bin/light -U 5";
         }
+
         {
           keys = [ 225 ];
           events = [ "key" ];
-          command = "/run/current-system/sw/bin/light -A 5";
+          command = "${pkgs.light}/bin/light -A 5";
         }
       ];
     };
 
-    mpd = {
-      musicDirectory = "/home/mpd/music";
-      enable = false;
-      extraConfig = ''
-        audio_output {
-          type "pulse"
-          name "pulsee srv"
-          server "127.0.0.1"
-        }
-      '';
-    };
-
-    batteryNotifier = {
-      enable = true;
-      notifyCapacity = 20;
-      suspendCapacity = 10;
-    };
-
     dnscrypt-proxy2 = {
       enable = true;
       settings = {
         ipv6_servers = true;
         require_dnssec = true;
+        require_nolog = true;
+        require_nofilter = true;
+        http3 = true;
 
         sources.public-resolvers = {
           urls = [
@@ -406,33 +365,62 @@
         };
       };
     };
+
+    journald.extraConfig = ''
+      SystemMaxUse=50M
+    '';
+
+    logind.extraConfig = ''
+      KillUserProcesses=yes
+    '';
+
   };
 
-  fonts.packages = with pkgs; [
+  fonts = {
+    fontconfig = {
+      cache32Bit = true;
+      allowBitmaps = true;
+      useEmbeddedBitmaps = true;
+      defaultFonts = {
+        monospace = [ "JetBrainsMono" ];
+      };
+    };
+
+    packages = with pkgs; [
+      dejavu_fonts
       dina-font
       fira-code
       fira-code-symbols
-    font-awesome
+      font-awesome_6
-    font-awesome_4
+      inconsolata
       iosevka
       jetbrains-mono
       liberation_ttf
+      libertine
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-color-emoji
+      noto-fonts-emoji
       proggyfonts
       siji
+      terminus_font
+      terminus_font_ttf
+      ubuntu_font_family
+      vistafonts
     ];
+  };
 
   virtualisation = {
     podman = {
-      enable = true;
+      enable = false;
+      autoPrune.enable = true;
       dockerCompat = true;
     };
   };
 
-  sound.enable = true;
-
   hardware = {
     bluetooth = {
-      enable = false;
+      enable = true;
       settings = {
         General = {
           Enable = "Source,Sink,Media,Socket";
@@ -440,14 +428,9 @@
       };
     };
 
-    opengl = {
+    graphics = {
       enable = true;
-      driSupport = true;
+      extraPackages = [ ];
-      driSupport32Bit = true;
-      extraPackages = with pkgs; [
-        intel-media-driver
-        vaapiIntel
-      ];
     };
   };
 
@@ -456,18 +439,14 @@
     algorithm = "zstd";
   };
 
-  users.users.akill = {
+  users.users.${USER} = {
     isNormalUser = true;
     shell = pkgs.zsh;
     extraGroups = [
-      "wireshark"
       "wheel"
-      "kvm"
       "tty"
       "audio"
       "sound"
-      "adbusers"
-      "transmission"
     ];
     openssh.authorizedKeys.keys = [
       (builtins.readFile ../nixy/ssh_pubkey)
@@ -478,14 +457,10 @@
     isNormalUser = true;
     shell = pkgs.zsh;
     extraGroups = [
-      "wireshark"
       "wheel"
-      "kvm"
       "tty"
       "audio"
       "sound"
-      "adbusers"
-      "transmission"
     ];
   };