nixos-dogma/configuration.nix

# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{
  config,
  lib,
  pkgs,
  inputs,
  ...
}: {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
  ];

  boot.loader.systemd-boot.enable = true;
  boot.kernelModules = ["kvm-intel"];
  boot.loader.systemd-boot.configurationLimit = 30;
  boot.loader.efi.canTouchEfiVariables = true;

  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
    "net.bridge.bridge-nf-call-iptables" = 1;
    "net.ipv4.conf.all.forwarding" = 1;
    "net.ipv6.conf.all.forwarding" = 1;
    "net.ipv4.conf.all.proxy_arp" = 1;
    "net.ipv4.conf.ens2.proxy_arp" = 1;
  };

  fonts.packages = with pkgs; [
    fira-code
    fira-code-symbols
    nerd-fonts.hack
  ];

  nixpkgs.config.allowUnfree = true;

  fileSystems = {
    "/mnt/games" = {
      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
      fsType = "btrfs";
      options = [
        "users"
        "compress=zstd"
        "subvol=@games"
        "nofail"
      ];
    };
    "/mnt/photo" = {
      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
      fsType = "btrfs";
      options = [
        "users"
        "compress=zstd"
        "subvol=@Pictures"
        "nofail"
      ];
    };

    "/mnt/media" = {
      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
      fsType = "btrfs";
      options = [
        "users"
        "compress=zstd"
        "subvol=@media"
        "nofail"
      ];
    };

    "/mnt/winbackup" = {
      device = "/dev/disk/by-uuid/969eb1a0-fb99-46d1-96cf-57a8644ee2d1";
      fsType = "btrfs";
      options = [
        "users"
        "compress=zstd"
        "subvol=@winbackup"
        "nofail"
      ];
    };

    "/mnt/winhdd" = {
      device = "/dev/sdb1";
      fsType = "ntfs";
      options = [
        "users"
        "windows_names"
        "noatime"
        "nofail"
      ];
    };
  };

  virtualisation.libvirtd = {
    "enable" = true;
    allowedBridges = ["br0"];
  };

  virtualisation.docker.enable = true;
  programs.virt-manager.enable = true;

  programs.zsh.enable = true;

  networking.hostName = "dogma-nixos";

  # Configure network connections interactively with nmcli or nmtui.
  networking.networkmanager.enable = true;
  networking.firewall.trustedInterfaces = ["br0"];
  # Set your time zone.
  time.timeZone = "America/Phoenix";

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    useXkbConfig = true; # use xkb.options in tty.
  };

  # Enable the X11 windowing system.
  services.xserver.enable = true;
  services.xserver.xkb.layout = "us";
  services.xserver.xkb.options = "caps:escape";

  # Enable CUPS to print documents.
  # services.printing.enable = true;

  # Enable sound.
  # services.pulseaudio.enable = true;
  # OR
  nix.settings.experimental-features = ["nix-command" "flakes"];

  sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
  #sops.age.generateKey = true;
  sops.defaultSopsFile = ./secrets/secrets.yaml;

  sops.secrets = {
    "factorio/service_username" = {};
    "factorio/service_token" = {};
    "factorio/gamepassword" = {};
    "backblaze/apikey" = {};
    "google/gmail" = {};
    "caddy/acme_email" = {};
    "dedyn/dnstoken" = {};
    "dedyn/dnsuser" = {};
    "github/token" = {};
    "gitlab/token" = {};
    "mongodb/initial_password" = {};
    "namecheap/ddyn_password" = {
      restartUnits = ["ddclient.service"];
    };
  };

  sops.templates."factorio.json".content = builtins.toJSON {
    service_username = config.sops.placeholder."factorio/service_username";
    service_token = config.sops.placeholder."factorio/service_token";
    gamepassword = config.sops.placeholder."factorio/gamepassword";
  };

  sops.templates."duplicity.env".content =
    builtins.toJSON {
    };

  sops.templates."caddy.env" = {
    owner = "root";
    mode = "0600";
    restartUnits = ["caddy.service"];
    content = ''
      ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
    '';
  };

  services.pipewire = {
    enable = true;
    pulse.enable = true;
  };

  # Enable touchpad support (enabled default in most desktopManager).
  # services.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.defaultUserShell = pkgs.zsh;

  services.getty.autologinUser = "mask";
  users.users.mask = {
    isNormalUser = true;
    shell = pkgs.zsh;

    # Enable ‘sudo’ for the user. packages = with pkgs; [
    #     tree
    extraGroups = [
      "wheel"
      "libvirtd"
      "media"
      "uinput"
    ];
  };
  services.sunshine = {
    enable = true;
    autoStart = true;
    capSysAdmin = true; # only needed for Wayland -- omit this when using with Xorg
    openFirewall = true;
  };

  # List packages installed in system profile.
  # You can use https://search.nixos.org/ to find more packages (and options).

  programs.hyprland.enable = true; # enable Hyprland

  programs.nix-ld = {
    enable = true;
    libraries = with pkgs; [
      zlib
      zstd
      stdenv.cc.cc
      curl
      openssl
      libssh
      bzip2
      libxml2
      acl
      libsodium
      util-linux
      xz
      systemd
    ];
  };

  environment.systemPackages = with pkgs; [
    qbittorrent
    pinentry-qt
    ddclient
    telegram-desktop
    btop
    # ungoogled-chromium
    # opencode
    doas
    lan-mouse
    stylua
    gh
    glab
    gnupg
    duplicity
    wget
    factorio-headless
    dig
    parted
    tor-browser
    jujutsu
    caddy
    clang
    ansible
    exiftool
    gcc
    home-manager
    flaresolverr
    docker-compose
    virtio-win
    spice
    spice-gtk
    OVMF
    pigz
    mpv
    wofi
    wayvnc
    pcmanfm
    htop
    rsync
    tmux
    git
    kitty
    python3
    samba
    deno
    qbittorrent-nox
    sonarr
    radarr
    jackett
    jellyfin
    curl
    p7zip
    dnsmasq
    brave
    keepassxc
    sops
    age
    unzip
  ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = { enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  services.caddy = {
    enable = true;
    environmentFile = config.sops.templates."caddy.env".path;
    # globalConfig = ''
    #   acme_ca https://acme.zerossl.com/v2/DV90
    #   email {$ACME_EMAIL};
    # '';

    #tls ${config.sops.secrets.zerossl_cert.path} ${config.sops.secrets.zerossl_private_key.path}
    virtualHosts."centraldogma.site:".extraConfig = ''

      root * /srv/root/
      file_server
      encode zstd gzip

      redir /jellyfin /jellyfin/
      reverse_proxy /jellyfin/* 127.0.0.1:8096

      redir /sonarr /sonarr/
      reverse_proxy /sonarr/* 127.0.0.1:8989

      redir /radarr /radarr/
      reverse_proxy /radarr/* 127.0.0.1:7878

    '';
    virtualHosts."jellyfin.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 127.0.0.1:8096
    '';
    virtualHosts."jellyfin2.centraldogma.site:".extraConfig = ''
      redir /jellyfin /jellyfin/
      reverse_proxy /jellyfin/* 127.0.0.1:8096
    '';
    virtualHosts."git.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 127.0.0.1:3000
    '';
    virtualHosts."spy.centraldogma.site:".extraConfig = ''
      reverse_proxy /* 192.168.1.78:4444
    '';
    # virtualHosts."blog.centraldogma.dedyn.io:".extraConfig = ''
    #   root * /srv/root/
    #   file_server
    #   encode zstd gzip
    # '';
  };
  services.flaresolverr = {
    enable = true;
  };
  services.samba = {
    enable = true;
    openFirewall = true;
    settings = {
      global = {
        "security" = "user";
        "workgroup" = "WORKGROUP";
        "server string" = "smbnix";
        "netbios name" = "smbnix";
        #"use sendfile" = "yes";
        #"max protocol" = "smb2";
        # note: localhost is the ipv6 localhost ::1
        "hosts allow" = "192.168.1.1/24 127.0.0.1 localhost";
        "guest account" = "nobody";
        "map to guest" = "bad user";
      };

      "games" = {
        "path" = "/mnt/games";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };

      "media" = {
        "path" = "/mnt/media";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };

      "photos" = {
        "path" = "/mnt/photo";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };

      "winhdd" = {
        "path" = "/mnt/winhdd";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };

      "winback" = {
        "path" = "/mnt/winbackup";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };
    };
  };
  services.samba-wsdd = {
    enable = true;
    openFirewall = true;
  };

  services.mongodb = {
    enable = true;
    package = pkgs.mongodb-ce;
    initialRootPasswordFile = config.sops.secrets."mongodb/initial_password".path;
  };

  networking.interfaces.enp6s0.useDHCP = false;
  networking.interfaces.br0.useDHCP = true;
  networking.bridges.br0.interfaces = ["enp6s0"];

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.

  # services.dnsmasq.enable = true;
  # services.resolved.enable = false;
  # networking.nameservers = ["1.1.1.1" "1.1.1.0"];
  #
  # services.dnsmasq.settings = {
  #   interface = "br0";
  #   bind-interface = true;
  #   server = [
  #     "1.1.1.1"
  #     "1.1.1.0"
  #   ];
  #   domain-needed = true;
  #   bogus-priv = true;
  # };

  #Services section
  services.jackett = {
    enable = true;
  };

  # services.duplicity = {
  #   enable = true;
  # };

  services.factorio = {
    enable = true;
    public = true;
    requireUserVerification = true;
    username = "TheMaskedMan95";
    admins = ["TheMaskedMan95"];
    game-name = "Realm of the Masked Men";
    description = "No Dogs allowed";
    extraSettingsFile = config.sops.templates."factorio.json".path;
    saveName = "SPACExxxx";
    openFirewall = true;
  };

  services.radarr = {
    enable = true;
  };

  services.ddclient = {
    enable = true;
    protocol = "namecheap";
    server = "dynamicdns.park-your-domain.com";
    ssl = true;
    username = "centraldogma.site";
    domains = ["@" "www"];
    usev4 = "webv4, webv4=ipify-ipv4";
    passwordFile = config.sops.secrets."namecheap/ddyn_password".path;
    interval = "5mins";
  };

  services.sonarr = {
    enable = true;
  };

  services.transmission = {
    enable = true; #Enable transmission daemon
    openRPCPort = true; #Open firewall for RPC
    settings = {
      #Override default settings
      rpc-bind-address = "0.0.0.0"; #Bind to own IP
      rpc-whitelist = "127.0.0.1,192.168.1.86"; #Whitelist your remote machine (10.0.0.1 in this example)
      download-dir = "/mnt/media/Downloads";
    };
  };

  services.adguardhome = {
    enable = true;
    # You can select any ip and port, just make sure to open firewalls where needed
    host = "0.0.0.0";
    port = 3003;
    settings = {
      allowDHCP = true;
      dns = {
        upstream_dns = [
          # Example config with quad9
          "9.9.9.9#dns.quad9.net"
          "149.112.112.112#dns.quad9.net"
          # Uncomment the following to use a local DNS service (e.g. Unbound)
          # Additionally replace the address & port as needed
          # "127.0.0.1:5335"
        ];
      };
      filtering = {
        protection_enabled = true;
        filtering_enabled = true;

        parental_enabled = true; # Parental control-based DNS requests filtering.
        safe_search = {
          enabled = false; # Enforcing "Safe search" option for search engines, when possible.
        };
      };
      # The following notation uses map
      # to not have to manually create {enabled = true; url = "";} for every filter
      # This is, however, fully optional
      filters =
        map (url: {
          enabled = true;
          url = url;
        }) [
          "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt" # The Big List of Hacked Malware Web Sites
          "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt" # malicious url blocklist
        ];
    };
  };

  #services.jellyfin = {
  #  enable = true;
  #};
  networking.firewall.enable = false;
  #networking.networkmanager.ethernet.mtu = 9000;

  # Copy the NixOS configuration file and link it from the resulting system
  # (/run/current-system/configuration.nix). This is useful in case you
  # accidentally delete configuration.nix.
  # system.copySystemConfiguration = true;

  # This option defines the first version of NixOS you have installed on this particular machine,
  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
  #
  # Most users should NEVER change this value after the initial install, for any reason,
  # even if you've upgraded your system to a new NixOS release.
  #
  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
  # to actually do that.
  #
  # This value being lower than the current NixOS release does NOT mean your system is
  # out of date, out of support, or vulnerable.
  #
  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
  # and migrated your data accordingly.
  #
  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
  system.stateVersion = "25.11"; # Did you read the comment?
}