nixos-flake/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, lib, unstable, ... }:

with lib;
with builtins;

let
  # unstableTarball = fetchTarball
  #   "https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz";
  #unstable = import unstableTarball { config = config.nixpkgs.config; };
in {
  imports = [ # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./egirls-qa.nix
    ./postfix.nix
    ./nebula.nix
    #./stalwart.nix
    #./vpn.nix
    #/home/jaina/src/nix-deployments/nordvpn/containers.nix
    #/home/jaina/src/nix-deployments/refactor/nixos-containers.nix
    #/home/jaina/src/nix-deployments/arion/arion.nix
  ];

  # networking.bridges.vpnbr = { interfaces = [ "vpnif0" ]; };
  # networking.interfaces.vpnif0 = {
  #   virtual = true;
  # };
  fileSystems = {
    "/".options = [ "compress=zstd" ];
    "/home".options = [ "compress=zstd" ];
    "/nix".options = [ "compress=zstd" "noatime" ];
  };

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
  };

  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };

  programs.gamemode.enable = true;

  programs.nix-ld = {
    enable = true;
    libraries = with pkgs; [
      glib
      nss
      nspr
      atk
      cups
      dbus
      libdrm

      # hypothesized
      gtk3
      pango
      cairo
      xorg.libX11
      xorg.libXcomposite
      xorg.libXdamage
      xorg.libXext
      xorg.libXfixes
      xorg.libXrandr
      mesa
      expat
      xorg.libxcb
      libxkbcommon
      alsa-lib
      at-spi2-atk
    ]; # For foundryvtt
  };

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  services.thermald.enable = true;

  programs.steam.enable = true;

  services.xserver.videoDrivers = [ "nvidia" "modesetting" ];
  #services.xserver.videoDrivers = [ "modesetting" "nvidia" "displaylink" ];
  #services.xserver.videoDrivers = [ "modesetting" "nouveau" ];
  # specialisation.nouveau.configuration = { ... }: {
  #   services.xserver.videoDrivers = [ "modesetting" "nouveau" ];
  #   boot.blacklistedKernelModules = [ "bbswitch" "nvidia" "nvidia-drm" ];
  # };
  # nixpkgs.overlays = [
  #   (self: prev: {
  #     unstable = import unstableTarball { config = config.nixpkgs.config; };
  #   })

  #   # (self: prev: {
  #   #   sway-unwrapped = prev.sway-unwrapped.override {
  #   #     wlroots_0_16 = self.wlroots_0_16.overrideAttrs {
  #   #       patches = [
  #   #         (prev.fetchpatch {
  #   #           url =
  #   #             "https://gitlab.freedesktop.org/wlroots/wlroots/uploads/b4f932e370ed03d88f202191eaf60965/DisplayLink.patch";
  #   #           sha256 = lib.fakeHash;
  #   #         })
  #   #       ];
  #   #     };
  #   #   };
  #   # })

  # ];
  #nixpkgs.overlays = [ (self: prev: { mesa = prev.unstable.mesa; }) ];

  hardware.opengl = {
    enable = true;
    #package = pkgs.mesa.override { galliumDrivers = [ "zink" "r600" "swrast" "nouveau" "i915" "iris" "auto" ]; };
    driSupport = true;
    driSupport32Bit = true;
    extraPackages = with pkgs; [
      libvdpau-va-gl
      vaapiVdpau
      intel-ocl
      intel-media-driver
      intel-gpu-tools
    ];
  };
  hardware.nvidia.modesetting.enable = true;
  boot.blacklistedKernelModules = [ "nouveau" "bbswitch" ];
  #[ "nvidia" ];
  #boot.kernelParams = [ "i915.force_probe=46a6" ];
  hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.stable;
  # hardware.nvidia.package =
  #   config.boot.kernelPackages.nvidiaPackages.production;
  #hardware.nvidia.package = unstable.linuxKernel.packages.linux_6_1.nvidia_x11;
  hardware.nvidia.open = true;
  environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; };

  networking.hostName = "harrowhark"; # Define your hostname.
  programs.extra-container.enable = true;
  # Pick only one of the below networking options.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
  networking.networkmanager.enable =
    true; # Easiest to use and most distros use this by default.

  hardware.cpu.intel.updateMicrocode = true;

  # Set your time zone.
  #time.timeZone = "America/Los_Angeles";
  # services.geoclue2 = {
  #   enable = true;
  #   submitData = true;
  #   enableModemGPS = false;
  #   enableNmea = false;
  #   enable3G = false;
  #   enableCDMA = false;
  # };
  # services.localtimed.enable = true;
  services.tzupdate.enable = true;

  # specialisation = {
  #   home.configuration = { time.timeZone = "America/Los_Angeles"; };
  #   cest.configuration = { time.timeZone = "Europe/Amsterdam"; };
  # };

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Select internationalisation properties.
  # i18n.defaultLocale = "en_US.UTF-8";
  # console = {
  #   font = "Lat2-Terminus16";
  #   keyMap = "us";
  #   useXkbConfig = true; # use xkbOptions in tty.
  # };

  # Enable the X11 windowing system.
  services.xserver.config = ''
    Section "Device"
      #Identifier "Intel Corporation Alder Lake-P Integrated Graphics"
      Identifier "Intel Graphics"
      #Identifier "Intel(R) Graphics"
      BusID "PCI:0:2:0"
      Driver "Intel"
      Option "DRI" "3"
    EndSection
  '';
  services.xserver.enable = true;
  services.xserver.displayManager.startx.enable = true;

  # Enable the GNOME Desktop Environment.
  #services.xserver.displayManager.gdm.enable = true;
  #services.xserver.desktopManager.gnome.enable = true;

  #services.xserver.displayManager.sddm.enable = true;
  #services.xserver.desktopManager.plasma5.enable = true;

  # Configure keymap in X11
  # services.xserver.layout = "us";
  # services.xserver.xkbOptions = {
  #   "eurosign:e";
  #   "caps:escape" # map caps to escape.
  # };

  # Enable CUPS to print documents.
  # services.printing.enable = true;

  # Enable sound.
  # sound.enable = true;
  # hardware.pulseaudio.enable = true;

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  virtualisation.libvirtd.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.jaina = {
    isNormalUser = true;
    uid = 1000;
    extraGroups = [ "wheel" "networkmanager" "libvirtd" "adbusers" "cdrom" ];
    packages = with pkgs; [ fish ];
    shell = pkgs.fish;
  };
  programs.fish.enable = true;

  programs.adb.enable = true;

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    neovim
    wget
    less
    killall
    python3
    htop
    openssh
    git

    interception-tools

    cifs-utils
    ntfs3g

    tlp

    bridge-utils
    vulkan-tools

    lm_sensors

    gamescope
    intel-gpu-tools

    sshfs

    docker
  ];

  programs.sway.enable = true;
  #programs.sway.package = pkgs.sway;
  # programs.sway.package = pkgs.sway.override {
  #   sway-unwrapped = pkgs.sway-unwrapped.override {
  #     wlroots_0_16 = pkgs.wlroots_0_16.overrideAttrs {
  #       patches = [
  #         (pkgs.fetchpatch {
  #           url =
  #             "https://gitlab.freedesktop.org/wlroots/wlroots/uploads/b4f932e370ed03d88f202191eaf60965/DisplayLink.patch";
  #           sha256 = lib.fakeHash;
  #         })
  #       ];
  #     };
  #   };
  # };

  xdg.portal = {
    enable = true;
    wlr.enable = false;
    extraPortals =
      [ pkgs.xdg-desktop-portal-gtk pkgs.xdg-desktop-portal-hyprland ];
  };

  services.interception-tools = {
    enable = true;
    plugins = [ pkgs.interception-tools-plugins.caps2esc ];
    udevmonConfig = ''
      - JOB: "${pkgs.interception-tools}/bin/intercept -g $DEVNODE | ${pkgs.interception-tools-plugins.caps2esc}/bin/caps2esc | ${pkgs.interception-tools}/bin/uinput -d $DEVNODE"
        DEVICE:
          EVENTS:
            EV_KEY: [KEY_CAPSLOCK, KEY_ESC]
    '';
  };

  security.pam.services.swaylock = {
    name = "swaylock";
    text = "auth include login";
  };

  hardware.bluetooth.enable = true;
  #services.hardware.bolt.enable = true;
  services.upower.enable = true;
  services.logind.extraConfig = ''
    HandlePowerKey=suspend
  '';
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    audio.enable = true;
    pulse.enable = true;
    jack.enable = true;
    alsa.enable = true;

    wireplumber.enable = true;
  };

  services.mullvad-vpn.enable = true;

  programs.hyprland.enable = true;
  programs.dconf.enable = true;

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  # Open ports in the firewall.
  networking.firewall.allowedTCPPorts = [
    22000 # syncthing
  ];
  networking.firewall.allowedUDPPorts = [
    # syncthing
    22000
    21027
  ];

  services.nginx = {
    enable = true;
    package = pkgs.openresty;

    proxyCachePath."media_cache" = {
      enable = true;
      maxSize = "1g";
      inactive = "10m";
      keysZoneName = "media_cache";
    };

    virtualHosts."media.dev.egirls.gay" = {
      listen = [
        {
          port = 443;
          addr = "0.0.0.0";
          ssl = true;
        }
        {
          port = 80;
          addr = "0.0.0.0";
        }
      ];
      useACMEHost = "ANY.dev.egirls.gay";
      forceSSL = true;

      extraConfig = ''

        proxy_cache media_cache;
        proxy_cache_valid 200 10m;
        proxy_cache_lock on;

        add_header X-Cache $upstream_cache_status;
        proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
        proxy_hide_header X-Amz-ID-2;
        proxy_hide_header X-Amz-Request-ID;
        proxy_hide_header X-Wasabi-CM-Reference-ID;

        proxy_hide_header      Set-Cookie;
        proxy_ignore_headers   Set-Cookie;
      '';

      locations."/".extraConfig = "return 404;";

      locations."/misskey/" = {
        #recommendedProxySettings = true;
        extraConfig = ''
          proxy_http_version 1.1;

          include /etc/nixos-secrets/s3-access-nginx.conf;

          set $s3_bucket 'egirls-gay-misskey';
          set $path_full '/$s3_bucket$request_uri';

          set_by_lua $now "return ngx.http_time(ngx.time())";
          set $signature_string "GET\n\n\n\nx-amz-date:''${now}\n$path_full";
          set_hmac_sha1 $s3_signature $s3_secret $signature_string;
          set_encode_base64 $s3_signature_b64 $s3_signature;

          proxy_set_header x-amz-date $now;
          proxy_set_header Authorization "AWS $s3_access:$s3_signature_b64";

          proxy_ssl_session_reuse on;
          rewrite .* $path_full break;
          proxy_pass https://s3.us-west-1.wasabisys.com;
        '';
      };
    };
  };

  # networking.nat = {
  #   enable = true;
  #   internalInterfaces = [ "ve-vpn" ];
  #   externalInterface = "wlp0s20f3";
  #   # Lazy IPv6 connectivity for the container
  #   enableIPv6 = true;
  # };

  # Or disable the firewall altogether.
  # networking.firewall.enable = false;

  # Copy the NixOS configuration file and link it from the resulting system
  # (/run/current-system/configuration.nix). This is useful in case you
  # accidentally delete configuration.nix.
  # system.copySystemConfiguration = true;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "22.11"; # Did you read the comment?

}