...

4 files changed, 90 insertions, 23 deletions

diff --git a/os/core/audio.nix b/os/core/audio.nix
index 2454a89..5b9607c 100644
--- a/os/core/audio.nix
+++ b/os/core/audio.nix
@@ -2,14 +2,18 @@
   config,
   lib,
   pkgs,
+  username,
   ...
-}: let
+}:
+let
   cfg = config.os.core.audio;
-in {
+in
+{
   options.os.core.audio = {
     enable = lib.mkEnableOption "audio support";
     disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up";
   };
+
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
       services = {
@@ -21,10 +25,27 @@ in {
           alsa.support32Bit = true;
           jack.enable = true;
           wireplumber.enable = true;
+
+          # wireplumber.extraConfig."10-force-input-awake" = {
+          #   "monitor.alsa.rules" = [
+          #     {
+          #       matches = [
+          #         { "node.name" = "~alsa_input.*HyperX.*"; }
+          #         { "node.name" = "~alsa_output.*HyperX.*"; }
+          #       ];
+          #       actions.update-props = {
+          #         "session.suspend-on-idle" = false;
+          #       };
+          #     }
+          #   ];
+          # };
         };
         playerctld.enable = true;
         spotifyd.enable = true;
       };
+
+      users.users.${username}.linger = true;
+
       security.rtkit.enable = true;
       hardware.enableAllFirmware = true;
 
@@ -32,30 +53,26 @@ in {
         helvum
         alsa-utils
       ];
+
+      # boot.kernelParams = [ "usbcore.autosuspend=-1" ];
+      # boot.extraModprobeConfig = ''
+      #   options snd-usb-audio power_save=0
+      # '';
     })
+
     (lib.mkIf cfg.disable-devices.enable {
       services.pipewire.wireplumber.extraConfig = {
-        "10-keep-hyperx-alive"."monitor.alsa.rules" = [
+        "99-disable-useless-devices"."monitor.alsa.rules" = [
           {
             matches = [
-              {"device.description" = "~HyperX*";}
+              { "device.name" = "~alsa_card.pci-0000_03_00.1*"; }
+              { "device.description" = "~USB Audio*"; }
             ];
             actions.update-props = {
-              "device.disabled" = false;
-              "session.suspend-on-idle" = false;
+              "device.disabled" = true;
             };
           }
         ];
-
-        "99-disable-useless-devices"."monitor.alsa.rules" = [
-          {
-            matches = [
-              {"device.name" = "~alsa_card.pci-0000_03_00.1*";}
-              {"device.description" = "~USB Audio*";}
-            ];
-            actions.update-props = {"device.disabled" = true;};
-          }
-        ];
       };
     })
   ];
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index dfd9101..aae167e 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -1,10 +1,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
   cfg = config.os.core.bootloader;
+  gpgHome = "/root/.gnupg";
 in
 {
   options.os.core.bootloader = {
@@ -12,6 +14,7 @@ in
       type = lib.types.enum [
         "systemd-boot"
         "grub"
+        "none"
       ];
       default = "systemd-boot";
       description = "Which bootloader to use";
@@ -19,7 +22,7 @@ in
 
     efi = lib.mkOption {
       type = lib.types.bool;
-      default = true;
+      default = if cfg.grub.device == "nodev" then true else false;
       description = "Whether the system uses UEFI or Legacy BIOS";
     };
 
@@ -45,6 +48,13 @@ in
         default = 0;
         description = "Index of the default boot entry";
       };
+      signing = {
+        enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
+        keyId = lib.mkOption {
+          type = lib.types.str;
+          description = "The GPG Key ID used to sign the boot files";
+        };
+      };
     };
 
     luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -56,7 +66,7 @@ in
       boot = {
         loader = {
           timeout = cfg.timeout;
-          efi.canTouchEfiVariables = cfg.efi;
+          efi.canTouchEfiVariables = lib.mkDefault cfg.efi;
         };
         supportedFilesystems = [
           "ntfs"
@@ -92,10 +102,38 @@ in
         efiSupport = cfg.efi;
         useOSProber = cfg.grub.useOSProber;
         default = cfg.grub.defaultEntry;
-
         enableCryptodisk = cfg.luks.enable;
         copyKernels = true;
+
+        extraConfig = lib.mkIf cfg.grub.signing.enable ''
+          set check_signatures=enforce
+          terminal_input console
+          terminal_output console
+        '';
+
+        extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
+          echo "Signing with keys from ${gpgHome}"
+
+          SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
+
+          $SIGN_CMD /boot/grub/grub.cfg
+
+          for f in /boot/nixos/*; do
+            if [[ "$f" != *.sig ]]; then
+              $SIGN_CMD "$f"
+            fi
+          done
+        '';
       };
+      environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
     })
+    {
+      assertions = [
+        {
+          assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
+          message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
+        }
+      ];
+    }
   ];
 }
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 830f475..4835cb8 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -6,6 +6,7 @@ in
   options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
   config = lib.mkIf cfg.enable {
     networking = {
+      useDHCP = lib.mkDefault true;
       networkmanager = {
         enable = true;
         wifi.macAddress = "stable-ssid";
diff --git a/os/core/ssh.nix b/os/core/ssh.nix
index 4069d31..d41c116 100644
--- a/os/core/ssh.nix
+++ b/os/core/ssh.nix
@@ -10,21 +10,32 @@ let
 in
 {
   options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+
   config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.rclone ];
     services.tailscale = {
       enable = true;
       openFirewall = true;
     };
 
-    services.openssh.enable = true;
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
 
     programs.gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
       pinentryPackage = pkgs.pinentry-curses;
     };
-    users.users.${username}.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5/Mr4PLMDflZ+SoaYP9N3kRbkkh1qL5NLSgW6C7sAu adikro@disroot.org"
-    ];
+
+    users.users = {
+      ${username}.openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5/Mr4PLMDflZ+SoaYP9N3kRbkkh1qL5NLSgW6C7sAu adikro@disroot.org"
+      ];
+    };
   };
 }