Threshold host and nix flake update.

10 files changed, 327 insertions, 37 deletions

diff --git a/.sops.yaml b/.sops.yaml
index 6bbf5cf..aa2cef4 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -4,6 +4,7 @@ keys:
   - &virtserver_omega_relay age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg
   - &vm_omega_relay age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 
   - &server_omega_relay age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4
+  - &server_threshold age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht
 
 
 creation_rules: 
@@ -22,4 +23,9 @@ creation_rules:
       - *virtserver_omega_relay 
       - *vm_omega_relay 
       - *server_omega_relay 
+  - path_regex: secrets/threshold/[^/]+\.(yaml|json|env|ini)$
+    age: 
+      - *admin_wilkuu 
+      - *server_threshold 
+
 
diff --git a/flake.lock b/flake.lock
index ad0b317..9fac7c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -31,11 +31,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776471108,
-        "narHash": "sha256-kNjiqakXrkk/rgL+Cfz5WvR05XXBYvPkBdjQJIOnKss=",
+        "lastModified": 1777481115,
+        "narHash": "sha256-9YKAG9ErJz4/HpiMpmixKJo+IKkRnXhoaSfkoOyj2o0=",
         "owner": "continuwuity",
         "repo": "continuwuity",
-        "rev": "01f6893c07cfdc4d866abdc8dbe12c2963cf494b",
+        "rev": "e6cae5b8eda99337ca78b1500e913932f966c9f4",
         "type": "github"
       },
       "original": {
@@ -144,11 +144,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775781825,
-        "narHash": "sha256-L5yKTpR+alrZU2XYYvIxCeCP4LBHU5jhwSj7H1VAavg=",
+        "lastModified": 1777476904,
+        "narHash": "sha256-EeLoE8n4+QCbteyAsYXxhfr97RFfWL1ga0xwfL6lpKw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e35c39fca04fee829cecdf839a50eb9b54d8a701",
+        "rev": "8c8e5389e75a36bee53920de8ee24f017b3ae03e",
         "type": "github"
       },
       "original": {
@@ -159,11 +159,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775710090,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
@@ -239,11 +239,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775682595,
-        "narHash": "sha256-0E9PohY/VuESLq0LR4doaH7hTag513sDDW5n5qmHd1Q=",
+        "lastModified": 1777338324,
+        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d2e8438d5886e92bc5e7c40c035ab6cae0c41f76",
+        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index e21d0db..ecc793f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -120,6 +120,21 @@
           ];
 
         };
+        threshold = nixpkgs.lib.nixosSystem {
+          specialArgs = {
+            inherit inputs;
+          };
+          system = "x86_64-linux";
+          modules = [
+            ./modules
+            ./users/wilkuu-server.nix
+            ./hosts/threshold
+            inputs.home-manager.nixosModules.default
+            disko.nixosModules.disko
+            inputs.sops-nix.nixosModules.sops
+          ];
+
+        };
       };
     };
 }
diff --git a/home-modules/apps/nvim/default.nix b/home-modules/apps/nvim/default.nix
index af95c9b..ae284bd 100644
--- a/home-modules/apps/nvim/default.nix
+++ b/home-modules/apps/nvim/default.nix
@@ -45,21 +45,6 @@ in
       [
         lua
         lua-language-server
-        gopls
-        go
-        typescript
-        nodejs_22
-        rustup
-        nil
-        statix
-        nixfmt
-        # phpactor
-        pyright
-        texlive.combined.scheme-medium
-        texlab
-        mermaid-cli
-        ltex-ls
-        deno
       ]
       ++ [
         ts_ls
diff --git a/hosts/threshold/default.nix b/hosts/threshold/default.nix
new file mode 100644
index 0000000..485997b
--- /dev/null
+++ b/hosts/threshold/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  ...
+}:
+{
+
+  imports = [
+    ./network.nix
+    ./disko.nix
+    ./hardware.nix
+  ];
+  addons = {
+    desktop.xfce.enable = lib.mkForce true;
+    gpg.enable = true;
+    virtualisation.host = true;
+  };
+
+  # Bootloader and boot setup.
+  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
+
+  boot.loader.grub = {
+    enable = true;
+    useOSProber = false;
+    device = "nodev";
+    efiSupport = true;
+    default = "saved";
+    memtest86.enable = true;
+  };
+
+  # Networking setup
+  networking.hostName = "threshold";
+  services.resolved = {
+    enable = true;
+    settings.Resolve.DNSOverTLS = "opportunistic";
+  };
+
+  # SSH Access
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    openFirewall = true;
+    allowSFTP = true;
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = [ "wilkuu" ];
+      X11Forwarding = true;
+      PermitRootLogin = "no";
+    };
+  };
+}
diff --git a/hosts/threshold/disko.nix b/hosts/threshold/disko.nix
new file mode 100644
index 0000000..ddbfa11
--- /dev/null
+++ b/hosts/threshold/disko.nix
@@ -0,0 +1,85 @@
+{ config, lib, ... }:
+{
+  options.host-config.disko = with lib; {
+    root_device = mkOption {
+      type = types.path;
+      default = "/dev/nvme0n1";
+      example = "/dev/nvme0n1";
+      description = "Root device for disko and grub";
+    };
+    enable = mkOption {
+      type = types.bool;
+      default = !config.addons.virtualisation.isTestVM;
+      description = "Whenever to enable disko or not.";
+    };
+  };
+
+  config =
+    let
+      cfg = config.host-config.disko;
+    in
+    lib.mkIf (cfg.enable) {
+      services.btrfs.autoScrub = {
+        enable = true;
+        interval = "weekly";
+      };
+
+      disko.devices = {
+        disk = {
+          main-disk = {
+            device = cfg.root_device;
+            type = "disk";
+            content = {
+              type = "gpt";
+              partitions = {
+                ESP = {
+                  type = "EF00";
+                  size = "512M";
+                  content = {
+                    type = "filesystem";
+                    format = "vfat";
+                    mountpoint = "/boot";
+                    mountOptions = [ "umask=0077" ];
+                  };
+                };
+                root = {
+                  size = "100%";
+                  content = {
+                    type = "btrfs";
+                    extraArgs = [ "-f" ];
+                    subvolumes = {
+                      # Subvolume name is different from mountpoint
+                      "/rootfs" = {
+                        mountOptions = [ "compress=zstd" ];
+                        mountpoint = "/";
+                      };
+                      # Subvolume name is the same as the mountpoint
+                      "/home" = {
+                        mountOptions = [ "compress=zstd" ];
+                        mountpoint = "/home";
+                      };
+                      # Parent is not mounted so the mountpoint must be set
+                      "/nix" = {
+                        mountOptions = [
+                          "compress=zstd"
+                          "noatime"
+                        ];
+                        mountpoint = "/nix";
+                      };
+                      # Subvolume for the swapfile
+                      "/swap" = {
+                        mountpoint = "/.swapvol";
+                        swap = {
+                          swapfile.size = "8G";
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+}
diff --git a/hosts/threshold/hardware.nix b/hosts/threshold/hardware.nix
new file mode 100644
index 0000000..f0b2fe7
--- /dev/null
+++ b/hosts/threshold/hardware.nix
@@ -0,0 +1,82 @@
+{
+  config,
+  modulesPath,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  ## Mountpoints:
+
+  # Enable OpenGL
+  hardware.graphics = {
+    enable = true;
+  };
+
+  # Load nvidia driver for Xorg and Wayland
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  #NVIDIA Settings
+  hardware.nvidia = {
+
+    # Modesetting is required.
+    modesetting.enable = true;
+
+    # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
+    # Enable this if you have graphical corruption issues or application crashes after waking
+    # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
+    # of just the bare essentials.
+    powerManagement.enable = false;
+
+    # Fine-grained power management. Turns off GPU when not in use.
+    # Experimental and only works on modern Nvidia GPUs (Turing or newer).
+    powerManagement.finegrained = false;
+
+    # Use the NVidia open source kernel module (not to be confused with the
+    # independent third-party "nouveau" open source driver).
+    # Support is limited to the Turing and later architectures. Full list of
+    # supported GPUs is at:
+    # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
+    # Only available from driver 515.43.04+
+    # Currently alpha-quality/buggy, so false is currently the recommended setting.
+    open = false;
+
+    # Enable the Nvidia settings menu,
+    # accessible via `nvidia-settings`.
+    nvidiaSettings = true;
+
+    # Optionally, you may need to select the appropriate driver version for your specific GPU.
+    package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+
+    # prime = {
+    #   offload = {
+    #     enable = true;
+    #     enableOffloadCmd = true;
+    #   };
+    #
+    #   sync.enable = false;
+
+    #   intelBusId = "PCI:0:2:0";
+    #   nvidiaBusId = "PCI:1:0:0";
+    # };
+  };
+
+}
diff --git a/hosts/threshold/network.nix b/hosts/threshold/network.nix
new file mode 100644
index 0000000..a4d0c03
--- /dev/null
+++ b/hosts/threshold/network.nix
@@ -0,0 +1,61 @@
+{ ... }:
+let
+  baseTCP = [
+    20
+    22
+    25
+    80
+    443
+  ];
+  baseUDP = [
+  ];
+  baseTCPRanges = [ ];
+  baseUDPRanges = [ ];
+in
+{
+  systemd.network = {
+    enable = true;
+    networks."10-uplink" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        DHCP = "ipv4";
+        IPv6AcceptRA = "yes";
+      };
+      linkConfig = {
+        RequiredForOnline = "yes";
+      };
+      ipv6AcceptRAConfig = {
+        UseDNS = "yes";
+        UseDomains = "yes";
+      };
+      dns = [
+        "192.168.88.1"
+        "1.1.1.1"
+        "2606:4700:4700:0000:0000:0000:0000:1002"
+      ];
+    };
+  };
+  networking = {
+    useNetworkd = true;
+    nftables.enable = true;
+    useDHCP = true;
+    firewall = {
+      # check  enable = true;
+      checkReversePath = false;
+      allowedTCPPorts = baseTCP;
+      allowedUDPPorts = baseUDP;
+      allowedUDPPortRanges = baseUDPRanges;
+      allowedTCPPortRanges = baseTCPRanges;
+      # TODO: Figure out how to do FW that allows only on the internal ip range
+      #interfaces = {
+      #  "wg-home" = {
+      #   allowedTCPPorts = secureTCP;
+      #   allowedUDPPorts = secureUDP;
+      #   allowedUDPPortRanges = secureUDPRanges;
+      #   allowedTCPPortRanges = secureTCPRanges;
+      # };
+      #};
+    };
+  };
+
+}
diff --git a/modules/virt.nix b/modules/virt.nix
index 01547b4..ff63155 100644
--- a/modules/virt.nix
+++ b/modules/virt.nix
@@ -37,5 +37,11 @@ in
       services.spice-vdagentd.enable = true;
       services.qemuGuest.enable = true;
     })
+    ({
+      virtualisation.vmVariant = {
+        addons.virtualization.isTestVM = true;
+      };
+    })
   ]);
+
 }
diff --git a/users/wilkuu-server.nix b/users/wilkuu-server.nix
index c1bbc92..5df7867 100644
--- a/users/wilkuu-server.nix
+++ b/users/wilkuu-server.nix
@@ -1,6 +1,7 @@
 {
   pkgs,
   lib,
+  config,
   ...
 }:
 {
@@ -35,17 +36,16 @@
     homeapps.presets = lib.genAttrs [ "base" "utils" "browser" ] (_: {
       enable = true;
     });
-    # homeapps.vnc = true;
 
-    # services.wayvnc = {
-    #   enable = true;
-    #   autoStart = false;
-    #   settings = {
-    #     # Todo, bind to vpn and LAN explicitly somehow
-    #     address = "0.0.0.0";
-    #     port = 5900;
-    #   };
-    # };
+    services.wayvnc = lib.mkIf config.addons.desktop.enable {
+      enable = true;
+      autoStart = false;
+      settings = {
+        # Todo, bind to vpn and LAN explicitly somehow
+        address = "0.0.0.0";
+        port = 5900;
+      };
+    };
 
     home.username = "wilkuu";
     home.homeDirectory = "/home/wilkuu";