added sunshine and tailscale

9 files changed, 91 insertions, 5 deletions

diff --git a/os/core/default.nix b/os/core/default.nix
index 160e67b..1899553 100644
--- a/os/core/default.nix
+++ b/os/core/default.nix
@@ -17,6 +17,7 @@ in
     ./security.nix
     ./ssh.nix
     ./storage.nix
+    ./tailscale.nix
     ./users.nix
   ];
 
diff --git a/os/core/drivers.nix b/os/core/drivers.nix
index 3764937..ca5ecc4 100644
--- a/os/core/drivers.nix
+++ b/os/core/drivers.nix
@@ -86,7 +86,10 @@ in
             initrd.enable = true;
             overdrive.enable = true;
           };
-          graphics.extraPackages = [ pkgs.rocmPackages.clr.icd ];
+          graphics.extraPackages = with pkgs; [
+            rocmPackages.clr.icd
+            libva-utils
+          ];
         };
       })
       (lib.mkIf (cfg.graphics.enable && cfg.graphics.version == "git") {
diff --git a/os/core/tailscale.nix b/os/core/tailscale.nix
new file mode 100644
index 0000000..795fdbb
--- /dev/null
+++ b/os/core/tailscale.nix
@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.core.tailscale;
+in
+{
+  options.os.core.tailscale.enable = lib.mkEnableOption "enables tailscale vpn";
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "client";
+    };
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
+  };
+}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index 4b5a54a..4f520a5 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -12,6 +12,7 @@
     ./ollama.nix
     ./omnisearch.nix
     ./sops.nix
+    ./sunshine.nix
     ./syncthing.nix
     ./tor.nix
     ./virtualization.nix
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 5de2e26..ca59782 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -35,6 +35,14 @@ in
       programs.gamemode = {
         enable = true;
         enableRenice = true;
+        settings = {
+          general.renice = 10;
+          # gpu = {
+          #   apply_gpu_optimisations = "accept-responsibility";
+          #   gpu_device = 0;
+          #   amd_performance_level = "high";
+          # };
+        };
       };
 
       home-manager.users.${username}.hm.soft.mangohud.enable = true;
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 250b1c7..b5bf3af 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -26,6 +26,7 @@ in
         "syncthing/gui_password".owner = username;
         "syncthing/encryption/game-saves".owner = username;
         "syncthing/encryption/keepass".owner = username;
+        "syncthing/encryption/sync".owner = username;
         "vpn/warp_private_key".owner = "root";
         "obs/websocket_password".owner = username;
         "yggdrasil-private-key" = {
diff --git a/os/srv/sunshine.nix b/os/srv/sunshine.nix
new file mode 100644
index 0000000..f1d4300
--- /dev/null
+++ b/os/srv/sunshine.nix
@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+let
+  cfgSunshine = config.os.srv.sunshine;
+  cfgMoonlight = config.os.srv.moonlight;
+in
+{
+  options.os.srv = {
+    sunshine.enable = lib.mkEnableOption "enables sunshine streaming server";
+    moonlight.enable = lib.mkEnableOption "enables moonlight streaming client";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfgSunshine.enable {
+      services.sunshine = {
+        enable = true;
+        capSysAdmin = true;
+        openFirewall = true;
+      };
+
+      hardware.uinput.enable = true;
+
+      users.users.${username}.extraGroups = [
+        "video"
+        "input"
+        "render"
+      ];
+    })
+
+    (lib.mkIf cfgMoonlight.enable {
+      environment.systemPackages = [
+        pkgs.moonlight-qt
+      ];
+    })
+  ];
+}
diff --git a/os/srv/syncthing.nix b/os/srv/syncthing.nix
index b350428..2234b88 100644
--- a/os/srv/syncthing.nix
+++ b/os/srv/syncthing.nix
@@ -58,6 +58,22 @@ in
               params.keep = "10";
             };
           };
+
+          "sync" = {
+            path = "/home/${username}/sync";
+            id = "sync";
+            devices = [
+              {
+                name = "oci";
+                encryptionPasswordFile = config.sops.secrets."syncthing/encryption/sync".path;
+                compression = "metadata";
+              }
+            ];
+            versioning = {
+              type = "simple";
+              params.keep = "3";
+            };
+          };
         };
       };
     };
diff --git a/os/srv/tor.nix b/os/srv/tor.nix
index 55c779d..8777fba 100644
--- a/os/srv/tor.nix
+++ b/os/srv/tor.nix
@@ -22,10 +22,6 @@ in
           dns.enable = true;
           transparentProxy.enable = true;
         };
-        settings = {
-          Sandbox = true;
-          DisableAllSwap = true;
-        };
       };
     })
     (lib.mkIf cfg.enableBrowser {