diff options
Diffstat (limited to 'configuration.nix')
| -rw-r--r-- | configuration.nix | 327 |
1 files changed, 327 insertions, 0 deletions
diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 0000000..4ba5769 --- /dev/null +++ b/configuration.nix @@ -0,0 +1,327 @@ +{ config, pkgs, inputs, ... }: + +{ + imports = [ + ./hardware-configuration.nix + inputs.noctalia-greeter.nixosModules.default + ]; + + # Custom EDID firmware loading for monitor + hardware.firmware = [ + (pkgs.runCommand "custom-edid" {} '' + mkdir -p $out/lib/firmware/edid + cp ${./mi_edid.bin} $out/lib/firmware/edid/mi_edid.bin + '') + ]; + + fileSystems."/mnt/giga" = { + device = "/dev/disk/by-uuid/bfed3a37-05e1-465b-a4b7-d74cd31bf937"; + fsType = "ext4"; + options = [ "defaults" "user" "rw" ]; + }; + + # --- Mullvad VPN daemon --- + services.mullvad-vpn = { + enable = true; + package = pkgs.mullvad-vpn; + }; + + services.resolved = { + enable = true; + dnssec = "true"; + dnsovertls = "true"; + domains = [ "~." ]; + settings = { + Resolve = { + DNS = "194.242.2.4#base.dns.mullvad.net 2a07:e340::4#base.dns.mullvad.net"; + FallbackDNS = ""; + }; + }; + }; + # Restrict systemd log size and retention + services.journald.extraConfig = '' + SystemMaxUse=50M + MaxRetentionSec=1month + ''; + # --- AUTOSTART USER SERVICES --- + systemd.user.services.swingmusic = { + description = "Swing Music Local Server"; + wantedBy = [ "graphical-session.target" ]; + after = [ "graphical-session.target" ]; + serviceConfig = { + ExecStart = "/home/seraphim/.swingmusic/swingmusic"; + Restart = "on-failure"; + WorkingDirectory = "/home/seraphim"; + + # --- Systemd Hardening Options --- + NoNewPrivileges = true; # Prevents the app from escalating privileges + PrivateTmp = true; # Gives the app its own isolated temporary directory + ProtectSystem = "strict"; # Mounts vital system folders as read-only for this app + + # NOTE: If swingmusic needs to write data/playlists to your home folder, + # you may need to change ProtectHome to false, or specify exact read/write paths. + ProtectHome = "false"; + + # Limits network protocols (only allows standard IPv4/IPv6, blocks raw sockets) + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + }; + }; + + systemd.user.services.niri.enableDefaultPath = false; + qt = { + enable = true; + platformTheme = "qt5ct"; + style = "breeze"; + }; + + boot.kernelParams = [ + "drm.edid_firmware=DP-1:edid/mi_edid.bin" + "video=DP-1:2560x1440@180" + ]; + + # Bootloader configuration (systemd-boot) + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + # --- NETWORK AND ENCRYPTED DNS --- + networking.hostName = "opus"; + networking.networkmanager.enable = true; + + # --- TIMEZONE AND LOCALIZATION --- + time.timeZone = "Etc/GMT-7"; + i18n.defaultLocale = "en_US.UTF-8"; + + # Forcing all extra locales to English to clear the Perl warnings + i18n.extraLocaleSettings = { + LC_ADDRESS = "en_US.UTF-8"; + LC_IDENTIFICATION = "en_US.UTF-8"; + LC_MEASUREMENT = "en_US.UTF-8"; + LC_MONETARY = "en_US.UTF-8"; + LC_NAME = "en_US.UTF-8"; + LC_NUMERIC = "en_US.UTF-8"; + LC_PAPER = "en_US.UTF-8"; + LC_TELEPHONE = "en_US.UTF-8"; + LC_TIME = "en_US.UTF-8"; + }; + + # Allow unfree packages (NVIDIA, Steam, etc.) + nixpkgs.config.allowUnfree = true; + + # Experimental Nix features + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + + # Dynamic binary execution & FHS environment compatibility + programs.nix-ld.enable = true; + services.envfs.enable = true; + + # Shell and CLI enhancements + programs.starship.enable = true; + + # Throne configuration + programs.throne = { + enable = true; + tunMode.enable = true; + }; + + # Privilege elevation (doas) + security.doas.enable = true; + security.doas.extraRules = [ + { + users = [ "seraphim" ]; + keepEnv = true; + persist = true; + } + ]; + +# boot.initrd.secrets."/root/data.key" = null; + +# boot.initrd.luks.devices."data_crypt" = { +# device = "/dev/disk/by-uuid/58e1e570-4e1e-4cd6-8d9d-ce5210e6f501"; +# keyFile = "/root/data.key"; +# }; + + # --- GRAPHICS AND NVIDIA --- + hardware.graphics.enable = true; + hardware.graphics.enable32Bit = true; + services.xserver.videoDrivers = [ "nvidia" ]; + hardware.nvidia = { + modesetting.enable = true; + powerManagement.enable = false; + open = false; + nvidiaSettings = true; + package = config.boot.kernelPackages.nvidiaPackages.latest; + }; + + # --- NIRI WAYLAND COMPOSITOR --- + programs.niri.enable = true; + + # --- NOCTALIA GREETER --- + programs.noctalia-greeter = { + enable = true; + settings = { + cursor = { + theme = "Bibata-Modern-Ice"; + size = 24; + path = "${pkgs.bibata-cursors}/share/icons"; + }; + }; + }; + + # --- SYSTEM SERVICES FOR FILE MANAGEMENT --- + services.gvfs.enable = true; + services.tumbler.enable = true; + services.gnome.gnome-keyring.enable = true; + programs.dconf.enable = true; + + # --- XDG DESKTOP PORTALS (NIRI / WAYLAND) --- + xdg.portal = { + enable = true; + extraPortals = [ + pkgs.xdg-desktop-portal-gnome + pkgs.xdg-desktop-portal-gtk + ]; + }; + + # --- AUDIO (PIPEWIRE) --- + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + }; + fonts.fontconfig.enable = true; + environment.variables = { + SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt"; + NIX_SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt"; + }; + # --- GAMING (STEAM) --- + programs.steam = { + enable = true; + remotePlay.openFirewall = true; + dedicatedServer.openFirewall = true; + }; + + # --- ENVIRONMENT VARIABLES FOR WAYLAND + NVIDIA --- + environment.sessionVariables = { + LIBVA_DRIVER_NAME = "nvidia"; + XCURSOR_THEME = "Bibata-Modern-Ice"; + XCURSOR_SIZE = "20"; + # GBM_BACKEND = "nvidia-drm"; + __GLX_VENDOR_LIBRARY_NAME = "nvidia"; + NIXOS_OZONE_WL = "1"; + CC = "gcc"; + ELECTRON_OZONE_PLATFORM_HINT = "auto"; + GSK_RENDERER = "ng"; + QT_QPA_PLATFORM = "wayland;xcb"; + QT_ENABLE_HIGHDPI_SCALING = "1"; + QT_AUTO_SCREEN_SCALE_FACTOR = "1"; + QT_SCREEN_SCALE_FACTORS = "1.5"; + }; + + # --- FONTS --- + fonts.packages = with pkgs; + [ + font-awesome + nerd-fonts.jetbrains-mono + nerd-fonts.symbols-only + jetbrains-mono + ]; + + # --- USER CONFIGURATION --- + users.users."seraphim" = { + isNormalUser = true; + description = "seraphim"; + extraGroups = [ "networkmanager" "wheel" ]; + packages = with pkgs; []; + }; + + programs.fish = { + enable = true; + shellAliases = { + # Replicate the exact layout with Ghostty-friendly icons + ls = "eza -al --icons=auto"; + ll = "eza -al --icons=auto"; + }; + }; + + # --- SYSTEM PACKAGES --- + environment.systemPackages = with pkgs; + [ + inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default + (pkgs.btop.override { cudaSupport = true; }) + # Terminals & Shell Utilities + fastfetch + fzf + ghostty + kitty + ghfetch + cacert + # Text Editors + micro + neovim + emacs-pgtk + + # File Managers & Archiving + nautilus + loupe + sushi + file-roller + yazi + + kdePackages.ark + kdePackages.qt6ct + + # Utils + cryptsetup + util-linux + eza + pkgs.yt-dlp + pkgs.caligula + # GStreamer codecs + gst_all_1.gst-plugins-base + gst_all_1.gst-plugins-good + gst_all_1.gst-plugins-bad + gst_all_1.gst-plugins-ugly + + # Wayland & Niri Desktop Tools + cliphist + bibata-cursors + fuzzel + grim + hyprpolkitagent + noctalia-shell + slurp + wl-clipboard + wtype + xwayland-satellite + + # Audio & Brightness Controls + brightnessctl + pamixer + pavucontrol + + # Desktop Applications + keepassxc + telegram-desktop + vesktop + nvidia-vaapi-driver + pkgs.opencode + pkgs.claude-code + # Software Development & Toolchains + black + cargo + clang + clippy + git + pyright + python3 + rust-analyzer + rustc + gnumake + tree-sitter + nodejs + ]; + + system.stateVersion = "26.05"; +} |