From 9b0c6fdb8781d0edeeb26fc3e10309052cf3ea30 Mon Sep 17 00:00:00 2001
From: seraphim <18ycm9tx@anonaddy.me>
Date: Fri, 24 Jul 2026 23:36:54 +0700
Subject: frst

---
 nixos/configuration.nix | 402 +++++++++++++++++++++++++-----------------------
 1 file changed, 211 insertions(+), 191 deletions(-)

(limited to 'nixos/configuration.nix')

diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index ef7adc9..cdf6754 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -1,11 +1,33 @@
 { config, pkgs, inputs, ... }:
 
 {
+  # =========================================================================
+  # IMPORTS & NIX CONFIGURATION
+  # =========================================================================
   imports = [
     ./hardware-configuration.nix
     inputs.noctalia-greeter.nixosModules.default
   ];
 
+  # Nix & Flakes Settings
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nixpkgs.config.allowUnfree = true;
+
+  # Dynamic binary execution & FHS compatibility
+  programs.nix-ld.enable = true;
+  services.envfs.enable = true;
+
+  # =========================================================================
+  # BOOT & KERNEL CONFIGURATION
+  # =========================================================================
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.kernelParams = [
+    "drm.edid_firmware=DP-1:edid/mi_edid.bin"
+    "video=DP-1:2560x1440@180"
+  ];
+
   # Custom EDID firmware loading for monitor
   hardware.firmware = [
     (pkgs.runCommand "custom-edid" {} ''
@@ -14,91 +36,61 @@
     '')
   ];
 
+  # =========================================================================
+  # HARDWARE & FILESYSTEMS
+  # =========================================================================
   fileSystems."/mnt/giga" = {
     device = "/dev/disk/by-uuid/bfed3a37-05e1-465b-a4b7-d74cd31bf937";
     fsType = "ext4";
     options = [ "defaults" "user" "rw" ];
   };
 
-  # --- Mullvad VPN daemon ---
-  services.mullvad-vpn = {
+  # Graphics & NVIDIA Configuration
+  hardware.graphics = {
     enable = true;
-    package = pkgs.mullvad-vpn;
+    enable32Bit = true;
   };
 
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    open = false;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.latest;
+  };
+
+  # =========================================================================
+  # NETWORKING & DNS
+  # =========================================================================
+  networking.hostName = "opus";
+  networking.networkmanager.enable = true;
+
+  # Systemd-Resolved (Encrypted DNS)
   services.resolved = {
     enable = true;
-    dnssec = "true";
-    dnsovertls = "true";
-    domains = [ "~." ];
     settings = {
       Resolve = {
+        DNSOverTLS = "true";
+        DNSSEC = "true";
+        Domains = [ "~." ];
         DNS = "194.242.2.4#base.dns.mullvad.net 2a07:e340::4#base.dns.mullvad.net";
         FallbackDNS = "";
       };
     };
   };
 
-  # Restrict systemd log size and retention
-  services.journald.extraConfig = ''
-    SystemMaxUse=50M
-    MaxRetentionSec=1month
-  '';
-
-  # --- AUTOSTART USER SERVICES ---
-  systemd.user.services.swingmusic = {
-    description = "Swing Music Local Server";
-    wantedBy = [ "graphical-session.target" ];
-    after = [ "graphical-session.target" ];
-    serviceConfig = {
-      ExecStart = "/home/seraphim/.swingmusic/swingmusic";
-      Restart = "on-failure";
-      WorkingDirectory = "/home/seraphim";
-      # --- Systemd Hardening Options ---
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = "false";    
-      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-    };
-  };
-
-  # --- MPD-MPRIS (Для работы Waybar) ---
-  systemd.user.services.mpd-mpris = {
-    description = "MPD MPRIS Service for Waybar";
-    wantedBy = [ "default.target" ];
-    after = [ "graphical-session.target" ];
-    serviceConfig = {
-      ExecStart = "${pkgs.mpd-mpris}/bin/mpd-mpris -network tcp -host 127.0.0.1 -port 6600";
-      Restart = "on-failure";
-    };
-  };
-
-  systemd.user.services.niri.enableDefaultPath = false;
-  qt = {
+  # Mullvad VPN Daemon
+  services.mullvad-vpn = {
     enable = true;
-    platformTheme = "qt5ct";
-    style = "breeze";
+    package = pkgs.mullvad-vpn;
   };
 
-  boot.kernelParams = [
-    "drm.edid_firmware=DP-1:edid/mi_edid.bin"
-    "video=DP-1:2560x1440@180"
-  ];
-
-  # Bootloader configuration (systemd-boot)
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # --- NETWORK AND ENCRYPTED DNS ---
-  networking.hostName = "opus";
-  networking.networkmanager.enable = true;
-
-  # --- TIMEZONE AND LOCALIZATION ---
+  # =========================================================================
+  # LOCALIZATION & TIMEZONE
+  # =========================================================================
   time.timeZone = "Etc/GMT-7";
   i18n.defaultLocale = "en_US.UTF-8";
-
-  # Forcing all extra locales to English to clear the Perl warnings
   i18n.extraLocaleSettings = {
     LC_ADDRESS = "en_US.UTF-8";
     LC_IDENTIFICATION = "en_US.UTF-8";
@@ -111,51 +103,44 @@
     LC_TIME = "en_US.UTF-8";
   };
 
-  # Allow unfree packages (NVIDIA, Steam, etc.)
-  nixpkgs.config.allowUnfree = true;
-
-  # Experimental Nix features
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-
-  # Dynamic binary execution & FHS environment compatibility
-  programs.nix-ld.enable = true;
-  services.envfs.enable = true;
-
-  # Shell and CLI enhancements
-  programs.starship.enable = true;
+  # =========================================================================
+  # USER ACCOUNTS & SHELL CONFIGURATION
+  # =========================================================================
+  users.users."seraphim" = {
+    isNormalUser = true;
+    description = "seraphim";
+    extraGroups = [ "networkmanager" "wheel" ];
+    packages = with pkgs; [];
+  };
 
-  # Throne configuration
-  programs.throne = {
+  # Privilege Elevation (doas)
+  security.doas = {
     enable = true;
-    tunMode.enable = true;
+    extraRules = [
+      {
+        users = [ "seraphim" ];
+        keepEnv = true;
+        persist = true;
+      }
+    ];
   };
 
-  # Privilege elevation (doas)
-  security.doas.enable = true;
-  security.doas.extraRules = [
-    {
-      users = [ "seraphim" ];
-      keepEnv = true;
-      persist = true;
-    }
-  ];
-
-  # --- GRAPHICS AND NVIDIA ---
-  hardware.graphics.enable = true;
-  hardware.graphics.enable32Bit = true;
-  services.xserver.videoDrivers = [ "nvidia" ];
-  hardware.nvidia = {
-    modesetting.enable = true;
-    powerManagement.enable = false;
-    open = false;
-    nvidiaSettings = true;
-    package = config.boot.kernelPackages.nvidiaPackages.latest;
+  # Shell Enhancements
+  programs.fish = {
+    enable = true;
+    shellAliases = {
+      ls = "eza -al --icons=auto";
+      ll = "eza -al --icons=auto";
+    };
   };
 
-  # --- NIRI WAYLAND COMPOSITOR ---
+  programs.starship.enable = true;
+
+  # =========================================================================
+  # DISPLAY, WAYLAND & DESKTOP ENVIRONMENT
+  # =========================================================================
   programs.niri.enable = true;
 
-  # --- NOCTALIA GREETER ---
   programs.noctalia-greeter = {
     enable = true;
     settings = {
@@ -163,17 +148,16 @@
         theme = "Bibata-Modern-Ice";
         size = 24;
         path = "${pkgs.bibata-cursors}/share/icons";
-       };
-     };
-   };
+      };
+    };
+  };
 
-  # --- SYSTEM SERVICES FOR FILE MANAGEMENT ---
-  services.gvfs.enable = true;
-  services.tumbler.enable = true;
-  services.gnome.gnome-keyring.enable = true;
-  programs.dconf.enable = true;
+  qt = {
+    enable = true;
+    platformTheme = "qt5ct";
+    style = "breeze";
+  };
 
-  # --- XDG DESKTOP PORTALS (NIRI / WAYLAND) ---
   xdg.portal = {
     enable = true;
     extraPortals = [
@@ -182,34 +166,16 @@
     ];
   };
 
-  # --- AUDIO (PIPEWIRE) ---
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-  };
-  fonts.fontconfig.enable = true;
-
+  # Environment Variables
   environment.variables = {
     SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
     NIX_SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
   };
 
-  # --- GAMING (STEAM) ---
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = true;
-    dedicatedServer.openFirewall = true;
-  };
-
-  # --- ENVIRONMENT VARIABLES FOR WAYLAND + NVIDIA ---
   environment.sessionVariables = {
     LIBVA_DRIVER_NAME = "nvidia";
     XCURSOR_THEME = "Bibata-Modern-Ice";
     XCURSOR_SIZE = "20";
-    # GBM_BACKEND = "nvidia-drm";
     __GLX_VENDOR_LIBRARY_NAME = "nvidia";
     NIXOS_OZONE_WL = "1";
     CC = "gcc";
@@ -221,109 +187,168 @@
     QT_SCREEN_SCALE_FACTORS = "1.5";
   };
 
-  # --- FONTS ---
-  fonts.packages = with pkgs;
-  [
+  # Fonts Configuration
+  fonts.fontconfig.enable = true;
+  fonts.packages = with pkgs; [
     font-awesome
     nerd-fonts.jetbrains-mono
     nerd-fonts.symbols-only
     jetbrains-mono
   ];
 
-  # --- USER CONFIGURATION ---
-  users.users."seraphim" = {
-    isNormalUser = true;
-    description = "seraphim";
-    extraGroups = [ "networkmanager" "wheel" ];
-    packages = with pkgs; [];
-  };
-
-  programs.fish = {
+  # =========================================================================
+  # AUDIO (PIPEWIRE) & MPD
+  # =========================================================================
+  security.rtkit.enable = true;
+  services.pipewire = {
     enable = true;
-    shellAliases = {
-      ls = "eza -al --icons=auto";
-      ll = "eza -al --icons=auto";
-    };
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
   };
 
-# --- MPD SERVER ---
+  # MPD Server
   services.mpd = {
     enable = true;
     user = "seraphim";
-    musicDirectory = "/mnt/giga/music";
-    network.listenAddress = "any";
-    network.port = 6600;
-    
+    openFirewall = false;
     settings = {
+      music_directory = "/mnt/giga/music";
+      bind_to_address = "any";
+      port = 6600;
       auto_update = "yes";
-      
       audio_output = [
         {
-          type = "pulse";              # Возвращаем pulse
+          type = "pulse";
           name = "PipeWire Output";
-          mixer_type = "hardware";     # Моментальная регулировка потока!
+          mixer_type = "hardware";
         }
       ];
     };
   };
 
-  # Разрешаем системному MPD видеть звук пользователя seraphim
+  # Allow system MPD to access user PipeWire session
   systemd.services.mpd.environment = {
-      XDG_RUNTIME_DIR = "/run/user/1000"; # 1000 — это ID твоего пользователя
+    XDG_RUNTIME_DIR = "/run/user/1000";
+  };
+
+  # =========================================================================
+  # SYSTEM SERVICES & PROGRAM CONFIGURATIONS
+  # =========================================================================
+  services.gvfs.enable = true;
+  services.tumbler.enable = true;
+  services.gnome.gnome-keyring.enable = true;
+  programs.dconf.enable = true;
+
+  # Journald Log Restraints
+  services.journald.extraConfig = ''
+    SystemMaxUse=50M
+    MaxRetentionSec=1month
+  '';
+
+  # Gaming (Steam)
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+  };
+
+  # Throne Configuration
+  programs.throne = {
+    enable = true;
+    tunMode.enable = true;
   };
 
- # --- SYSTEM PACKAGES ---
-  environment.systemPackages = with pkgs;
-  [
+  # =========================================================================
+  # AUTOSTART USER SERVICES
+  # =========================================================================
+  systemd.user.services.swingmusic = {
+    description = "Swing Music Local Server";
+    wantedBy = [ "graphical-session.target" ];
+    after = [ "graphical-session.target" ];
+    serviceConfig = {
+      ExecStart = "/home/seraphim/.swingmusic/swingmusic";
+      Restart = "on-failure";
+      WorkingDirectory = "/home/seraphim";
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = "false";
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+    };
+  };
+
+  systemd.user.services.mpd-mpris = {
+    description = "MPD MPRIS Service for Waybar";
+    wantedBy = [ "default.target" ];
+    after = [ "graphical-session.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.mpd-mpris}/bin/mpd-mpris -network tcp -host 127.0.0.1 -port 6600";
+      Restart = "on-failure";
+    };
+  };
+
+  systemd.user.services.niri.enableDefaultPath = false;
+
+  # =========================================================================
+  # SYSTEM PACKAGES
+  # =========================================================================
+  environment.systemPackages = with pkgs; [
+    # Flake Inputs & Hardware Overrides
     inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default
     (pkgs.btop.override { cudaSupport = true; })
-    
-    # Terminals & Shell Utilities
+
+    # Terminals & CLI Utilities
+    cacert
+    eza
     fastfetch
     fzf
+    ghfetch
     ghostty
     kitty
-    ghfetch
-    cacert
-    
-    # Music
-    pkgs.mpd
-    pkgs.rmpc
+    stow
+    util-linux
+
+    # Music & Audio Controls
+    brightnessctl
     mpc
+    pamixer
+    pavucontrol
     playerctl
-    pkgs.mpd-mpris # <-- ДОБАВЛЕНО СЮДА
-    
+    pkgs.mpd
+    pkgs.mpd-mpris
+    pkgs.rmpc
+
     # Text Editors
     micro
     neovim
     (pkgs.emacs-pgtk.override {
       withNativeCompilation = true;
     })
-    # File Managers & Archiving
-    nautilus
-    loupe
-    sushi
+
+    # File Managers, Viewing & Archiving
     file-roller
-    yazi
     kdePackages.ark
     kdePackages.qt6ct
-    stow
-    # Utils
+    loupe
+    nautilus
+    sushi
+    yazi
+
+    # Utilities & Disk Tools
     cryptsetup
-    util-linux
-    eza
-    pkgs.yt-dlp
     pkgs.caligula
-    
-    # GStreamer codecs
+    pkgs.yt-dlp
+
+    # GStreamer Codecs
+    gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-ugly
 
-    # Wayland & Niri Desktop Tools
-    cliphist
+    # Wayland, Niri Desktop & System UI
     bibata-cursors
+    cliphist
     fuzzel
     grim
     hyprpolkitagent
@@ -333,32 +358,27 @@
     wtype
     xwayland-satellite
 
-    # Audio & Brightness Controls
-    brightnessctl
-    pamixer
-    pavucontrol
-
     # Desktop Applications
     keepassxc
-    telegram-desktop
-    vesktop
     nvidia-vaapi-driver
-    pkgs.opencode
     pkgs.claude-code
-    
+    pkgs.opencode
+    telegram-desktop
+    vesktop
+
     # Software Development & Toolchains
     black
     cargo
     clang
     clippy
     git
+    gnumake
+    nodejs
     pyright
     python3
     rust-analyzer
     rustc
-    gnumake
     tree-sitter
-    nodejs
   ];
 
   system.stateVersion = "26.05";
-- 
cgit v1.2.3