hosts: move to new structure

Signed-off-by: unexplrd <unexplrd@linerds.us>

hosts/dunamis/boot/default.nix

@@ -1,6 +1,6 @@
 {
-  pkgs,
   inputs,
+  pkgs,
   ...
 }: {
   imports = with inputs;
@@ -12,7 +12,6 @@
       ./loader.nix
     ];
   boot = {
-    # kernelPackages = pkgs.linuxPackages_latest;
     plymouth.enable = true;
     consoleLogLevel = 0;
     kernelPackages = pkgs.linuxPackages_cachyos;
@@ -33,6 +32,7 @@
     ];
     initrd = {
       systemd.enable = true; # needed for auto-unlocking with TPM
+      systemd.tpm2.enable = true;
     };
   };
 }

hosts/dunamis/configuration.nix

@@ -1,21 +1,17 @@
-{
+{inputs, ...}: {
-  inputs,
-  pkgs,
-  ...
-}: {
   imports = with inputs; [
     self.nixosModules.desktop
     self.nixosModules.system
     ./boot
     ./disko
-    ./facter
+    ./hardware
-    ./networking.nix
+    ./minecraft.nix
+    ./networking
     ./nix
     ./programs.nix
     ./services.nix
     ./sops.nix
     ./users.nix
-    ./minecraft.nix
   ];
 
   desktop.niri.enable = true;
@@ -35,9 +31,4 @@
     bluetooth.enable = true;
     bluetooth.enableBlueman = false;
   };
-  hardware.graphics.extraPackages = with pkgs; [
-    intel-compute-runtime
-    intel-media-driver
-    vpl-gpu-rt
-  ];
 }

hosts/dunamis/hardware.nix

@@ -1,17 +0,0 @@
-{
-  lib,
-  inputs,
-  modulesPath,
-  ...
-}: {
-  imports = with inputs.nixos-hardware.nixosModules; [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    common-cpu-amd-pstate
-    common-gpu-intel
-    common-hidpi
-    common-pc-ssd
-  ];
-  hardware.enableRedistributableFirmware = true;
-  hardware.intelgpu.vaapiDriver = "intel-media-driver";
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/dunamis/hardware/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./facter.nix
+    ./vaapi/intel-media-driver.nix
+  ];
+}

hosts/dunamis/hardware/vaapi/intel-media-driver.nix

@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  hardware.graphics.extraPackages = with pkgs; [
+    intel-compute-runtime
+    intel-media-driver
+    vpl-gpu-rt
+  ];
+}

hosts/dunamis/networking.nix

@@ -1,10 +0,0 @@
-{
-  networking = {
-    hostId = "c7f6c4a1";
-    hostName = "dunamis";
-    networkmanager = {
-      enable = true;
-      ethernet.macAddress = "stable";
-    };
-  };
-}

hosts/dunamis/networking/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./network-manager.nix
+    ./host-name-id.nix
+  ];
+  networking = {
+    hosts = import ./hosts.nix;
+  };
+}

hosts/dunamis/networking/host-name-id.nix

@@ -0,0 +1,6 @@
+{
+  networking = {
+    hostId = "c7f6c4a1";
+    hostName = "dunamis";
+  };
+}

hosts/dunamis/networking/hosts.nix

@@ -0,0 +1,3 @@
+{
+  "192.168.1.42" = ["dunamis"];
+}

hosts/dunamis/networking/network-manager.nix

@@ -0,0 +1,7 @@
+{
+  networking.networkmanager = {
+      enable = true;
+      ethernet.macAddress = "stable";
+    };
+  };
+}

hosts/dunamis/programs.nix

@@ -6,6 +6,7 @@
   programs = {
     fish.enable = true;
     mosh.enable = true;
+    nix-ld.enable = true;
     nh = {
       enable = true;
       flake = "/home/user/.config/nixos";

hosts/dunamis/sops.nix

@@ -4,12 +4,9 @@
   ...
 }: let
   inherit (inputs) mysecrets;
-  hostName =
+  inherit (config.networking) hostName;
-    if (config.networking.hostName == "vylxae")
-    then "sarien"
-    else config.networking.hostName;
-  sopsFile = mysecrets + "/hosts/${hostName}.yaml";
   dotSsh = name: "/home/user/.ssh/" + name;
+  sopsFile = mysecrets + "/hosts/${hostName}.yaml";
   sshKey = {
     mode = "0400";
     owner = "user";

hosts/eldrid/boot.nix

@@ -1,36 +0,0 @@
-{
-  pkgs,
-  config,
-  inputs,
-  ...
-}: {
-  imports = with inputs; [
-    chaotic.nixosModules.default
-    lanzaboote.nixosModules.lanzaboote
-  ];
-  boot = {
-    # kernelPackages = pkgs.linuxPackages_latest;
-    kernelPackages = pkgs.linuxPackages_cachyos;
-    loader.efi.canTouchEfiVariables = true;
-    loader.systemd-boot = {
-      enable = !config.boot.lanzaboote.enable;
-      consoleMode = "auto";
-    };
-    plymouth.enable = true;
-    initrd = {
-      availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" "xe" "i915"];
-      kernelModules = [];
-    };
-    kernelModules = ["kvm-intel"];
-    extraModulePackages = [];
-    lanzaboote = {
-      enable = true;
-      pkiBundle = "/var/lib/sbctl";
-    };
-  };
-  console = {
-    earlySetup = true;
-    packages = [pkgs.terminus_font];
-    font = "${pkgs.terminus_font}/share/consolefonts/ter-c18n.psf.gz";
-  };
-}

hosts/eldrid/boot/default.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  inputs,
+  ...
+}: {
+  imports = with inputs;
+    [
+      chaotic.nixosModules.default
+      lanzaboote.nixosModules.lanzaboote
+    ]
+    ++ [
+      ./loader.nix
+    ];
+  boot = {
+    # kernelPackages = pkgs.linuxPackages_latest;
+    plymouth.enable = true;
+    consoleLogLevel = 0;
+    kernelPackages = pkgs.linuxPackages_cachyos;
+    kernelParams = [
+      "amd_iommu=force_isolation"
+      "debugfs=off"
+      "efi=disable_early_pci_dma"
+      "gather_data_sampling=force"
+      "intel_iommu=on"
+      "iommu.passthrough=0"
+      "iommu.strict=1"
+      "iommu=force"
+      "page_alloc.shuffle=1"
+      "vsyscall=none"
+      # "ia32_emulation=0"
+      # "lockdown=confidentiality"
+      # "module.sig_enforce=1"
+    ];
+    initrd = {
+      systemd.enable = true; # needed for auto-unlocking with TPM
+      systemd.tpm2.enable = false; # no TPM
+    };
+  };
+}

hosts/eldrid/boot/loader.nix

@@ -0,0 +1,15 @@
+{config, ...}: {
+  boot = {
+    lanzaboote = {
+      enable = false;
+      pkiBundle = "/var/lib/sbctl";
+    };
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot = {
+        enable = !config.boot.lanzaboote.enable;
+        consoleMode = "auto";
+      };
+    };
+  };
+}

hosts/eldrid/configuration.nix

@@ -2,12 +2,11 @@
   imports = with inputs; [
     self.nixosModules.desktop
     self.nixosModules.system
-    ./boot.nix
+    ./boot
-    ./disko.nix
+    ./disko
-    ./hardware.nix
+    ./hardware
     ./networking.nix
-    ./nix.nix
+    ./nix
-    ./power-saving.nix
     ../dunamis/programs.nix
     ./services.nix
     ./sops.nix
@@ -23,10 +22,6 @@
     theme = "nord";
   };
 
-  opentabletdriver.enable = false;
-
-  # qmk-vial.enable = true;
-
   security.basic.enable = true;
 
   system.stateVersion = "25.05";
@@ -41,10 +36,4 @@
   time.timeZone = "Europe/Kyiv";
 
   # virtual.libvirt.enable = true;
-
-  # wireless = {
-  #   wifi.enable = true;
-  #   bluetooth.enable = true;
-  #   bluetooth.enableBlueman = true;
-  # };
 }

hosts/eldrid/disko.nix

@@ -1,94 +0,0 @@
-{inputs, ...}: {
-  imports = with inputs; [
-    disko.nixosModules.disko
-  ];
-  disko.devices.nodev = {
-    "/tmp" = {
-      fsType = "tmpfs";
-      mountOptions = ["rw" "nosuid" "nodev"];
-    };
-  };
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/nvme0n1";
-    content = {
-      type = "gpt";
-      partitions = {
-        ESP = {
-          size = "1G";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [
-              "umask=0077"
-              "fmask=0022"
-              "dmask=0022"
-              "noexec"
-            ];
-          };
-        };
-        luks = {
-          size = "100%";
-          content = {
-            type = "luks";
-            name = "lukscrypted";
-            initrdUnlock = true;
-            settings.allowDiscards = true;
-            content = {
-              type = "btrfs";
-              extraArgs = ["-f"];
-              subvolumes = {
-                "@nixos" = {
-                  mountpoint = "/";
-                  mountOptions = [
-                    "compress=zstd"
-                    "noatime"
-                    # "noexec"
-                  ];
-                };
-                "@home" = {
-                  mountpoint = "/home";
-                  mountOptions = [
-                    "compress=zstd"
-                    "noatime"
-                  ];
-                };
-                "@flatpak" = {
-                  mountpoint = "/var/lib/flatpak";
-                  mountOptions = [
-                    "compress=zstd"
-                    "noatime"
-                  ];
-                };
-                "@storage" = {
-                  mountpoint = "/storage";
-                  mountOptions = [
-                    "compress=zstd"
-                    "noatime"
-                  ];
-                };
-                "@swap" = {
-                  mountpoint = "/swap";
-                  mountOptions = [
-                    "compress=zstd"
-                    "noatime"
-                    # "noexec"
-                  ];
-                };
-                # "@nix" = {
-                #   mountpoint = "/nix";
-                #   mountOptions = [
-                #     "compress=zstd"
-                #     "noatime"
-                #   ];
-                # };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/eldrid/disko/default.nix

@@ -0,0 +1,14 @@
+{inputs, ...}: let
+  disk = "/dev/nvme0n1";
+in {
+  imports = with inputs; [
+    disko.nixosModules.disko
+  ];
+  disko.devices.nodev = {
+    "/tmp" = {
+      fsType = "tmpfs";
+      mountOptions = ["rw" "nosuid" "nodev"];
+    };
+  };
+  disko.devices.disk.main = import ./disk-main.nix {inherit disk;};
+}

hosts/eldrid/disko/disk-main.nix

@@ -0,0 +1,85 @@
+{disk, ...}: {
+  type = "disk";
+  device = disk;
+  content = {
+    type = "gpt";
+    partitions = {
+      ESP = {
+        size = "1G";
+        type = "EF00";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+          mountOptions = [
+            "umask=0077"
+            "fmask=0022"
+            "dmask=0022"
+            "noexec"
+            "nosuid"
+            "nodev"
+          ];
+        };
+      };
+      luks = {
+        size = "100%";
+        content = {
+          type = "luks";
+          name = "luks-main";
+          initrdUnlock = true;
+          settings.allowDiscards = true;
+          content = {
+            type = "btrfs";
+            extraArgs = ["-f"];
+            subvolumes = {
+              "@nixos" = {
+                mountpoint = "/";
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                  # "noexec"
+                ];
+              };
+              "@home" = {
+                mountpoint = "/home";
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                ];
+              };
+              "@flatpak" = {
+                mountpoint = "/var/lib/flatpak";
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                ];
+              };
+              "@storage" = {
+                mountpoint = "/storage";
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                ];
+              };
+              "@swap" = {
+                mountpoint = "/swap";
+                mountOptions = [
+                  "compress=zstd"
+                  "noatime"
+                  # "noexec"
+                ];
+              };
+              # "@nix" = {
+              #   mountpoint = "/nix";
+              #   mountOptions = [
+              #     "compress=zstd"
+              #     "noatime"
+              #   ];
+              # };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/eldrid/hardware/default.nix

@@ -0,0 +1,13 @@
+{
+  imports = [
+    ./facter.nix
+    ./laptop
+    ./vaapi/intel-media-driver.nix
+  ];
+  services = {
+    logind = {
+      lidSwitch = "ignore";
+      powerKey = "suspend";
+    };
+  };
+}

hosts/eldrid/hardware/laptop/cb-audio-fix.nix

@@ -0,0 +1,46 @@
+{pkgs, ...}: let
+  cb-ucm-conf = pkgs.alsa-ucm-conf.overrideAttrs {
+    wttsrc = pkgs.fetchFromGitHub {
+      owner = "WeirdTreeThing";
+      repo = "chromebook-ucm-conf";
+      rev = "b6ce2a7";
+      hash = "sha256-QRUKHd3RQmg1tnZU8KCW0AmDtfw/daOJ/H3XU5qWTCc=";
+    };
+    postInstall = ''
+      cp -R $wttsrc/common/* $out/share/alsa/ucm2/common
+      cp -R $wttsrc/codecs/* $out/share/alsa/ucm2/codecs
+      cp -R $wttsrc/platforms/* $out/share/alsa/ucm2/platforms
+      cp -R $wttsrc/sof-rt5682 $out/share/alsa/ucm2/conf.d
+      cp -R $wttsrc/sof-cs42l42 $out/share/alsa/ucm2/conf.d
+    '';
+  };
+in {
+  system.replaceDependencies.replacements = [
+    {
+      original = pkgs.alsa-ucm-conf;
+      replacement = cb-ucm-conf;
+    }
+  ];
+
+  services.pipewire.wireplumber.configPackages = [
+    (pkgs.writeTextDir "share/wireplumber/main.lua.d/51-increase-headroom.lua" ''
+      rule = {
+        matches = {
+          {
+            { "node.name", "matches", "alsa_output.*" },
+          },
+        },
+        apply_properties = {
+          ["api.alsa.headroom"] = 4096,
+        },
+      }
+
+      table.insert(alsa_monitor.rules,rule)
+    '')
+  ];
+  boot = {
+    extraModprobeConfig = ''
+      options snd-intel-dspcfg dsp_driver=3
+    '';
+  };
+}

hosts/eldrid/hardware/laptop/cb-keyboard.nix

@@ -1,50 +1,4 @@
 {
-  config,
-  lib,
-  pkgs,
-  # modulesPath,
-  ...
-}: let
-  cb-ucm-conf = pkgs.alsa-ucm-conf.overrideAttrs {
-    wttsrc = pkgs.fetchFromGitHub {
-      owner = "WeirdTreeThing";
-      repo = "chromebook-ucm-conf";
-      rev = "b6ce2a7";
-      hash = "sha256-QRUKHd3RQmg1tnZU8KCW0AmDtfw/daOJ/H3XU5qWTCc=";
-    };
-    postInstall = ''
-      cp -R $wttsrc/common/* $out/share/alsa/ucm2/common
-      cp -R $wttsrc/codecs/* $out/share/alsa/ucm2/codecs
-      cp -R $wttsrc/platforms/* $out/share/alsa/ucm2/platforms
-      cp -R $wttsrc/sof-rt5682 $out/share/alsa/ucm2/conf.d
-      cp -R $wttsrc/sof-cs42l42 $out/share/alsa/ucm2/conf.d
-    '';
-  };
-in {
-  hardware.graphics = {
-    enable = true;
-    extraPackages = with pkgs; [
-      intel-media-driver
-      vaapiIntel
-      vpl-gpu-rt
-    ];
-  };
-
-  # intel ax201 wifi card firmware
-  hardware.enableRedistributableFirmware = true;
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
-  services = {
-    logind = {
-      lidSwitch = "ignore";
-      powerKey = "suspend";
-    };
-  };
-
-  # physically broken touchscreen
-  services.udev.extraRules = "ACTION==\"add|change\", KERNELS==\"input[0-9]*\", SUBSYSTEMS==\"input\", ATTRS{id/vendor}==\"27c6\", ATTRS{id/product}==\"0e84\", ENV{LIBINPUT_IGNORE_DEVICE}=\"1\"";
-
   services.keyd = {
     enable = true;
     keyboards.internal = {
@@ -137,33 +91,4 @@ in {
       };
     };
   };
-
-  system.replaceDependencies.replacements = [
-    {
-      original = pkgs.alsa-ucm-conf;
-      replacement = cb-ucm-conf;
-    }
-  ];
-
-  services.pipewire.wireplumber.configPackages = [
-    (pkgs.writeTextDir "share/wireplumber/main.lua.d/51-increase-headroom.lua" ''
-      rule = {
-        matches = {
-          {
-            { "node.name", "matches", "alsa_output.*" },
-          },
-        },
-        apply_properties = {
-          ["api.alsa.headroom"] = 4096,
-        },
-      }
-
-      table.insert(alsa_monitor.rules,rule)
-    '')
-  ];
-  boot = {
-    extraModprobeConfig = ''
-      options snd-intel-dspcfg dsp_driver=3
-    '';
-  };
 }

hosts/eldrid/hardware/laptop/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./cb-audio-fix.nix
+    ./cb-keyboard.nix
+    ./home-row-mods.nix
+    ./power-saving.nix
+    ./touchscreen-fix.nix
+  ];
+}

hosts/eldrid/hardware/laptop/home-row-mods.nix

@@ -0,0 +1,20 @@
+{
+  services.keyd = {
+    enable = true;
+    keyboards = {
+      default = {
+        ids = ["0001:0001"];
+        settings.main = {
+          a = "lettermod(alt, a, 200, 150)";
+          s = "lettermod(meta, s, 200, 150)";
+          d = "lettermod(control, d, 200, 150)";
+          f = "lettermod(shift, f, 200, 150)";
+          j = "lettermod(shift, j, 200, 150)";
+          k = "lettermod(control, k, 200, 150)";
+          l = "lettermod(meta, l, 200, 150)";
+          ";" = "lettermod(alt, ;, 200, 150)";
+        };
+      };
+    };
+  };
+}

hosts/eldrid/hardware/laptop/touchscreen-fix.nix

@@ -0,0 +1,3 @@
+{
+  services.udev.extraRules = "ACTION==\"add|change\", KERNELS==\"input[0-9]*\", SUBSYSTEMS==\"input\", ATTRS{id/vendor}==\"27c6\", ATTRS{id/product}==\"0e84\", ENV{LIBINPUT_IGNORE_DEVICE}=\"1\"";
+}

hosts/eldrid/hardware/vaapi/intel-media-driver.nix

@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  hardware.graphics.extraPackages = with pkgs; [
+    intel-compute-runtime
+    intel-media-driver
+    vpl-gpu-rt
+  ];
+}

hosts/eldrid/minecraft.nix

@@ -1,23 +0,0 @@
-{
-  networking.firewall.allowedTCPPorts = [25565];
-  networking.firewall.allowedUDPPorts = [25565];
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers.minecraft = {
-      image = "docker.io/itzg/minecraft-server:java17-alpine";
-      volumes = ["/storage/minecraft:/data"];
-      ports = ["25565:25565"];
-      environment = {
-        DIFFICULTY = "easy";
-        EULA = "true";
-        GUI = "false";
-        INIT_MEMORY = "6G";
-        MAX_MEMORY = "6G";
-        ONLINE_MODE = "false";
-        TYPE = "forge";
-        VERSION = "1.20.1";
-        VIEW_DISTANCE = "8";
-      };
-    };
-  };
-}

hosts/eldrid/networking.nix

@@ -1,9 +0,0 @@
-{
-  networking = {
-    networkmanager.enable = true;
-    hostName = "eldrid";
-    hosts = {
-      "192.168.1.42" = ["dunamis"];
-    };
-  };
-}

hosts/eldrid/networking/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./network-manager.nix
+    ./host-name-id.nix
+  ];
+  networking = {
+    hosts = import ./hosts.nix;
+  };
+}

hosts/eldrid/networking/host-name-id.nix

@@ -0,0 +1,6 @@
+{
+  networking = {
+    # hostId = "";
+    hostName = "eldrid";
+  };
+}

hosts/eldrid/networking/hosts.nix

@@ -0,0 +1,3 @@
+{
+  "192.168.1.42" = ["dunamis"];
+}

hosts/eldrid/networking/network-manager.nix

@@ -0,0 +1,20 @@
+{
+  networking = {
+    networkmanager = {
+      enable = true;
+      ethernet.macAddress = "stable";
+      networkmanager.wifi = {
+        backend = "iwd";
+        macAddress = "random";
+        scanRandMacAddress = true;
+      };
+    };
+    wireless.iwd = {
+      enable = true;
+      settings = {
+        General.AddressRandomization = "network";
+        Settings.AlwaysRandomizeAddress = true;
+      };
+    };
+  };
+}

hosts/eldrid/nix.nix

@@ -1,35 +0,0 @@
-# TODO: better file name
-{
-  config,
-  inputs,
-  pkgs,
-  ...
-}: let
-  hostName =
-    if (config.networking.hostName == "vylxae")
-    then "sarien"
-    else config.networking.hostName;
-  inherit (config.sops) secrets;
-  inherit (inputs) mysecrets;
-in {
-  nix = {
-    package = pkgs.lix;
-    channel.enable = false;
-    daemonCPUSchedPolicy = "idle";
-    settings = {
-      experimental-features = ["nix-command" "flakes"];
-      builders-use-substitutes = true;
-    };
-    distributedBuilds = true;
-    buildMachines = [
-      {
-        hostName = "dunamis";
-        sshUser = "nix-ssh";
-        system = "x86_64-linux";
-        sshKey = secrets."ssh-${hostName}-user".path;
-        supportedFeatures = ["nixos-test" "big-parallel" "kvm" "benchmark"];
-        publicHostKey = builtins.readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
-      }
-    ];
-  };
-}

hosts/eldrid/nix/common.nix

@@ -0,0 +1,11 @@
+{pkgs, ...}: {
+  nix = {
+    package = pkgs.lixPackageSets.latest.lix;
+    channel.enable = false;
+    daemonCPUSchedPolicy = "idle";
+    settings = {
+      experimental-features = ["nix-command" "flakes"];
+      builders-use-substitutes = true;
+    };
+  };
+}

hosts/eldrid/nix/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./common.nix
+    ./substituters.nix
+    ./distributed-build.nix
+  ];
+}

hosts/eldrid/nix/distributed-build.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  inputs,
+  ...
+}: let
+  inherit (builtins) readFile;
+  inherit (config.networking) hostName;
+  inherit (config.sops) secrets;
+  inherit (inputs) mysecrets;
+  pubHost = readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
+in {
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "dunamis";
+        publicHostKey = pubHost;
+        sshKey = secrets."ssh-${hostName}-user".path;
+        sshUser = "nix-ssh";
+        supportedFeatures = [
+          "benchmark"
+          "big-parallel"
+          "kvm"
+          "nixos-test"
+        ];
+        system = "x86_64-linux";
+      }
+    ];
+  };
+}

hosts/eldrid/nix/ssh-serve.nix

@@ -0,0 +1,10 @@
+{config, ...}: let
+  inherit (builtins) readFile;
+  inherit (config.users.users) user;
+in {
+  nix.sshServe = {
+    enable = true;
+    write = true;
+    keys = map (f: readFile f) user.openssh.authorizedKeys.keyFiles;
+  };
+}

hosts/eldrid/nix/substituters.nix

@@ -0,0 +1,16 @@
+{
+  nix.settings = {
+    substituters = [
+      "https://cache.nixos.org/"
+      "https://chaotic-nyx.cachix.org/"
+      "https://cosmic.cachix.org/"
+      "https://nix-community.cachix.org/"
+    ];
+    trusted-public-keys = [
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "chaotic-nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
+      "cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+    ];
+  };
+}

hosts/sarien/configuration.nix

@@ -8,14 +8,12 @@
     self.nixosModules.system
     ./boot
     ./disko
-    ./facter
+    ./hardware
-    ./hardware.nix
+    ./networking
-    ./networking.nix
     ./nix
-    ./power-saving.nix
     ../dunamis/programs.nix
-    ./services.nix
+    ../dunamis/services.nix
-    ./sops.nix
+    ../dunamis/sops.nix
     ./users.nix
   ];
 

hosts/sarien/hardware.nix

@@ -1,55 +0,0 @@
-{
-  lib,
-  inputs,
-  modulesPath,
-  ...
-}: {
-  # imports = with inputs.nixos-hardware.nixosModules; [
-  #   (modulesPath + "/installer/scan/not-detected.nix")
-  #   common-cpu-intel
-  #   common-gpu-intel-kaby-lake
-  #   common-hidpi
-  #   common-pc-laptop-ssd
-  # ];
-  # nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  # hardware.enableRedistributableFirmware = true;
-
-  services = {
-    logind = {
-      lidSwitch = "ignore";
-      powerKey = "suspend";
-    };
-
-    udev.extraHwdb = ''
-      evdev:input:b0011v0001p0001eAB83*
-        KEYBOARD_KEY_d5=sysrq
-        KEYBOARD_KEY_d4=leftmeta
-        KEYBOARD_KEY_95=brightnessdown
-        KEYBOARD_KEY_91=brightnessup
-    '';
-
-    keyd = {
-      enable = true;
-      keyboards = {
-        default = {
-          ids = ["0001:0001"];
-          settings = {
-            main = {
-              camera = "brightnessdown";
-              prog1 = "brightnessup";
-              # home row mods
-              a = "lettermod(alt, a, 200, 150)";
-              s = "lettermod(meta, s, 200, 150)";
-              d = "lettermod(control, d, 200, 150)";
-              f = "lettermod(shift, f, 200, 150)";
-              j = "lettermod(shift, j, 200, 150)";
-              k = "lettermod(control, k, 200, 150)";
-              l = "lettermod(meta, l, 200, 150)";
-              ";" = "lettermod(alt, ;, 200, 150)";
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/sarien/hardware/default.nix

@@ -0,0 +1,13 @@
+{
+  imports = [
+    ./facter.nix
+    ./laptop
+    ./vaapi/intel-media-driver.nix
+  ];
+  services = {
+    logind = {
+      lidSwitch = "ignore";
+      powerKey = "suspend";
+    };
+  };
+}

hosts/sarien/hardware/facter.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  inputs,
+  ...
+}: let
+  inherit (inputs) mysecrets;
+  inherit (config.networking) hostName;
+in {
+  imports = with inputs; [
+    nixos-facter-modules.nixosModules.facter
+  ];
+  facter.reportPath = "${mysecrets}/facter/${hostName}.json";
+  systemd.network.wait-online.enable = false;
+}

hosts/sarien/hardware/laptop/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./home-row-mods.nix
+    ./keyboard-fix.nix
+    ./power-saving.nix
+  ];
+}

hosts/sarien/hardware/laptop/home-row-mods.nix

@@ -0,0 +1,20 @@
+{
+  services.keyd = {
+    enable = true;
+    keyboards = {
+      default = {
+        ids = ["0001:0001"];
+        settings.main = {
+          a = "lettermod(alt, a, 200, 150)";
+          s = "lettermod(meta, s, 200, 150)";
+          d = "lettermod(control, d, 200, 150)";
+          f = "lettermod(shift, f, 200, 150)";
+          j = "lettermod(shift, j, 200, 150)";
+          k = "lettermod(control, k, 200, 150)";
+          l = "lettermod(meta, l, 200, 150)";
+          ";" = "lettermod(alt, ;, 200, 150)";
+        };
+      };
+    };
+  };
+}

hosts/sarien/hardware/laptop/keyboard-fix.nix

@@ -0,0 +1,21 @@
+{
+  services = {
+    udev.extraHwdb = ''
+      evdev:input:b0011v0001p0001eAB83*
+        KEYBOARD_KEY_d5=sysrq
+        KEYBOARD_KEY_d4=leftmeta
+        KEYBOARD_KEY_95=brightnessdown
+        KEYBOARD_KEY_91=brightnessup
+    '';
+    keyd = {
+      enable = true;
+      keyboards.default = {
+        ids = ["0001:0001"];
+        settings.main = {
+          camera = "brightnessdown";
+          prog1 = "brightnessup";
+        };
+      };
+    };
+  };
+}

hosts/sarien/hardware/vaapi/intel-media-driver.nix

@@ -0,0 +1,7 @@
+{pkgs, ...}: {
+  hardware.graphics.extraPackages = with pkgs; [
+    intel-compute-runtime
+    intel-media-driver
+    vpl-gpu-rt
+  ];
+}

hosts/sarien/networking.nix

@@ -1,10 +0,0 @@
-{
-  networking = {
-    networkmanager.enable = true;
-    hostId = "31150fae";
-    hostName = "sarien";
-    hosts = {
-      "192.168.1.42" = ["dunamis"];
-    };
-  };
-}

hosts/sarien/networking/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./network-manager.nix
+    ./host-name-id.nix
+  ];
+  networking = {
+    hosts = import ./hosts.nix;
+  };
+}

hosts/sarien/networking/host-name-id.nix

@@ -0,0 +1,6 @@
+{
+  networking = {
+    hostId = "31150fae";
+    hostName = "sarien";
+  };
+}

hosts/sarien/networking/hosts.nix

@@ -0,0 +1,3 @@
+{
+  "192.168.1.42" = ["dunamis"];
+}

hosts/sarien/networking/network-manager.nix

@@ -0,0 +1,20 @@
+{
+  networking = {
+    networkmanager = {
+      enable = true;
+      ethernet.macAddress = "stable";
+      networkmanager.wifi = {
+        backend = "iwd";
+        macAddress = "random";
+        scanRandMacAddress = true;
+      };
+    };
+    wireless.iwd = {
+      enable = true;
+      settings = {
+        General.AddressRandomization = "network";
+        Settings.AlwaysRandomizeAddress = true;
+      };
+    };
+  };
+}