Threshold host and nix flake update.

4 files changed, 278 insertions, 0 deletions

diff --git a/hosts/threshold/default.nix b/hosts/threshold/default.nix
new file mode 100644
index 0000000..485997b
--- /dev/null
+++ b/hosts/threshold/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  ...
+}:
+{
+
+  imports = [
+    ./network.nix
+    ./disko.nix
+    ./hardware.nix
+  ];
+  addons = {
+    desktop.xfce.enable = lib.mkForce true;
+    gpg.enable = true;
+    virtualisation.host = true;
+  };
+
+  # Bootloader and boot setup.
+  boot.loader.efi.canTouchEfiVariables = lib.mkDefault true;
+
+  boot.loader.grub = {
+    enable = true;
+    useOSProber = false;
+    device = "nodev";
+    efiSupport = true;
+    default = "saved";
+    memtest86.enable = true;
+  };
+
+  # Networking setup
+  networking.hostName = "threshold";
+  services.resolved = {
+    enable = true;
+    settings.Resolve.DNSOverTLS = "opportunistic";
+  };
+
+  # SSH Access
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    openFirewall = true;
+    allowSFTP = true;
+    settings = {
+      PasswordAuthentication = false;
+      AllowUsers = [ "wilkuu" ];
+      X11Forwarding = true;
+      PermitRootLogin = "no";
+    };
+  };
+}
diff --git a/hosts/threshold/disko.nix b/hosts/threshold/disko.nix
new file mode 100644
index 0000000..ddbfa11
--- /dev/null
+++ b/hosts/threshold/disko.nix
@@ -0,0 +1,85 @@
+{ config, lib, ... }:
+{
+  options.host-config.disko = with lib; {
+    root_device = mkOption {
+      type = types.path;
+      default = "/dev/nvme0n1";
+      example = "/dev/nvme0n1";
+      description = "Root device for disko and grub";
+    };
+    enable = mkOption {
+      type = types.bool;
+      default = !config.addons.virtualisation.isTestVM;
+      description = "Whenever to enable disko or not.";
+    };
+  };
+
+  config =
+    let
+      cfg = config.host-config.disko;
+    in
+    lib.mkIf (cfg.enable) {
+      services.btrfs.autoScrub = {
+        enable = true;
+        interval = "weekly";
+      };
+
+      disko.devices = {
+        disk = {
+          main-disk = {
+            device = cfg.root_device;
+            type = "disk";
+            content = {
+              type = "gpt";
+              partitions = {
+                ESP = {
+                  type = "EF00";
+                  size = "512M";
+                  content = {
+                    type = "filesystem";
+                    format = "vfat";
+                    mountpoint = "/boot";
+                    mountOptions = [ "umask=0077" ];
+                  };
+                };
+                root = {
+                  size = "100%";
+                  content = {
+                    type = "btrfs";
+                    extraArgs = [ "-f" ];
+                    subvolumes = {
+                      # Subvolume name is different from mountpoint
+                      "/rootfs" = {
+                        mountOptions = [ "compress=zstd" ];
+                        mountpoint = "/";
+                      };
+                      # Subvolume name is the same as the mountpoint
+                      "/home" = {
+                        mountOptions = [ "compress=zstd" ];
+                        mountpoint = "/home";
+                      };
+                      # Parent is not mounted so the mountpoint must be set
+                      "/nix" = {
+                        mountOptions = [
+                          "compress=zstd"
+                          "noatime"
+                        ];
+                        mountpoint = "/nix";
+                      };
+                      # Subvolume for the swapfile
+                      "/swap" = {
+                        mountpoint = "/.swapvol";
+                        swap = {
+                          swapfile.size = "8G";
+                        };
+                      };
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+}
diff --git a/hosts/threshold/hardware.nix b/hosts/threshold/hardware.nix
new file mode 100644
index 0000000..f0b2fe7
--- /dev/null
+++ b/hosts/threshold/hardware.nix
@@ -0,0 +1,82 @@
+{
+  config,
+  modulesPath,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  ## Mountpoints:
+
+  # Enable OpenGL
+  hardware.graphics = {
+    enable = true;
+  };
+
+  # Load nvidia driver for Xorg and Wayland
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  #NVIDIA Settings
+  hardware.nvidia = {
+
+    # Modesetting is required.
+    modesetting.enable = true;
+
+    # Nvidia power management. Experimental, and can cause sleep/suspend to fail.
+    # Enable this if you have graphical corruption issues or application crashes after waking
+    # up from sleep. This fixes it by saving the entire VRAM memory to /tmp/ instead
+    # of just the bare essentials.
+    powerManagement.enable = false;
+
+    # Fine-grained power management. Turns off GPU when not in use.
+    # Experimental and only works on modern Nvidia GPUs (Turing or newer).
+    powerManagement.finegrained = false;
+
+    # Use the NVidia open source kernel module (not to be confused with the
+    # independent third-party "nouveau" open source driver).
+    # Support is limited to the Turing and later architectures. Full list of
+    # supported GPUs is at:
+    # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
+    # Only available from driver 515.43.04+
+    # Currently alpha-quality/buggy, so false is currently the recommended setting.
+    open = false;
+
+    # Enable the Nvidia settings menu,
+    # accessible via `nvidia-settings`.
+    nvidiaSettings = true;
+
+    # Optionally, you may need to select the appropriate driver version for your specific GPU.
+    package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
+
+    # prime = {
+    #   offload = {
+    #     enable = true;
+    #     enableOffloadCmd = true;
+    #   };
+    #
+    #   sync.enable = false;
+
+    #   intelBusId = "PCI:0:2:0";
+    #   nvidiaBusId = "PCI:1:0:0";
+    # };
+  };
+
+}
diff --git a/hosts/threshold/network.nix b/hosts/threshold/network.nix
new file mode 100644
index 0000000..a4d0c03
--- /dev/null
+++ b/hosts/threshold/network.nix
@@ -0,0 +1,61 @@
+{ ... }:
+let
+  baseTCP = [
+    20
+    22
+    25
+    80
+    443
+  ];
+  baseUDP = [
+  ];
+  baseTCPRanges = [ ];
+  baseUDPRanges = [ ];
+in
+{
+  systemd.network = {
+    enable = true;
+    networks."10-uplink" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        DHCP = "ipv4";
+        IPv6AcceptRA = "yes";
+      };
+      linkConfig = {
+        RequiredForOnline = "yes";
+      };
+      ipv6AcceptRAConfig = {
+        UseDNS = "yes";
+        UseDomains = "yes";
+      };
+      dns = [
+        "192.168.88.1"
+        "1.1.1.1"
+        "2606:4700:4700:0000:0000:0000:0000:1002"
+      ];
+    };
+  };
+  networking = {
+    useNetworkd = true;
+    nftables.enable = true;
+    useDHCP = true;
+    firewall = {
+      # check  enable = true;
+      checkReversePath = false;
+      allowedTCPPorts = baseTCP;
+      allowedUDPPorts = baseUDP;
+      allowedUDPPortRanges = baseUDPRanges;
+      allowedTCPPortRanges = baseTCPRanges;
+      # TODO: Figure out how to do FW that allows only on the internal ip range
+      #interfaces = {
+      #  "wg-home" = {
+      #   allowedTCPPorts = secureTCP;
+      #   allowedUDPPorts = secureUDP;
+      #   allowedUDPPortRanges = secureUDPRanges;
+      #   allowedTCPPortRanges = secureTCPRanges;
+      # };
+      #};
+    };
+  };
+
+}