...

12 files changed, 157 insertions, 65 deletions

diff --git a/os/core/audio.nix b/os/core/audio.nix
index 2454a89..5b9607c 100644
--- a/os/core/audio.nix
+++ b/os/core/audio.nix
@@ -2,14 +2,18 @@
   config,
   lib,
   pkgs,
+  username,
   ...
-}: let
+}:
+let
   cfg = config.os.core.audio;
-in {
+in
+{
   options.os.core.audio = {
     enable = lib.mkEnableOption "audio support";
     disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up";
   };
+
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
       services = {
@@ -21,10 +25,27 @@ in {
           alsa.support32Bit = true;
           jack.enable = true;
           wireplumber.enable = true;
+
+          # wireplumber.extraConfig."10-force-input-awake" = {
+          #   "monitor.alsa.rules" = [
+          #     {
+          #       matches = [
+          #         { "node.name" = "~alsa_input.*HyperX.*"; }
+          #         { "node.name" = "~alsa_output.*HyperX.*"; }
+          #       ];
+          #       actions.update-props = {
+          #         "session.suspend-on-idle" = false;
+          #       };
+          #     }
+          #   ];
+          # };
         };
         playerctld.enable = true;
         spotifyd.enable = true;
       };
+
+      users.users.${username}.linger = true;
+
       security.rtkit.enable = true;
       hardware.enableAllFirmware = true;
 
@@ -32,30 +53,26 @@ in {
         helvum
         alsa-utils
       ];
+
+      # boot.kernelParams = [ "usbcore.autosuspend=-1" ];
+      # boot.extraModprobeConfig = ''
+      #   options snd-usb-audio power_save=0
+      # '';
     })
+
     (lib.mkIf cfg.disable-devices.enable {
       services.pipewire.wireplumber.extraConfig = {
-        "10-keep-hyperx-alive"."monitor.alsa.rules" = [
+        "99-disable-useless-devices"."monitor.alsa.rules" = [
           {
             matches = [
-              {"device.description" = "~HyperX*";}
+              { "device.name" = "~alsa_card.pci-0000_03_00.1*"; }
+              { "device.description" = "~USB Audio*"; }
             ];
             actions.update-props = {
-              "device.disabled" = false;
-              "session.suspend-on-idle" = false;
+              "device.disabled" = true;
             };
           }
         ];
-
-        "99-disable-useless-devices"."monitor.alsa.rules" = [
-          {
-            matches = [
-              {"device.name" = "~alsa_card.pci-0000_03_00.1*";}
-              {"device.description" = "~USB Audio*";}
-            ];
-            actions.update-props = {"device.disabled" = true;};
-          }
-        ];
       };
     })
   ];
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index dfd9101..aae167e 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -1,10 +1,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
   cfg = config.os.core.bootloader;
+  gpgHome = "/root/.gnupg";
 in
 {
   options.os.core.bootloader = {
@@ -12,6 +14,7 @@ in
       type = lib.types.enum [
         "systemd-boot"
         "grub"
+        "none"
       ];
       default = "systemd-boot";
       description = "Which bootloader to use";
@@ -19,7 +22,7 @@ in
 
     efi = lib.mkOption {
       type = lib.types.bool;
-      default = true;
+      default = if cfg.grub.device == "nodev" then true else false;
       description = "Whether the system uses UEFI or Legacy BIOS";
     };
 
@@ -45,6 +48,13 @@ in
         default = 0;
         description = "Index of the default boot entry";
       };
+      signing = {
+        enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
+        keyId = lib.mkOption {
+          type = lib.types.str;
+          description = "The GPG Key ID used to sign the boot files";
+        };
+      };
     };
 
     luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -56,7 +66,7 @@ in
       boot = {
         loader = {
           timeout = cfg.timeout;
-          efi.canTouchEfiVariables = cfg.efi;
+          efi.canTouchEfiVariables = lib.mkDefault cfg.efi;
         };
         supportedFilesystems = [
           "ntfs"
@@ -92,10 +102,38 @@ in
         efiSupport = cfg.efi;
         useOSProber = cfg.grub.useOSProber;
         default = cfg.grub.defaultEntry;
-
         enableCryptodisk = cfg.luks.enable;
         copyKernels = true;
+
+        extraConfig = lib.mkIf cfg.grub.signing.enable ''
+          set check_signatures=enforce
+          terminal_input console
+          terminal_output console
+        '';
+
+        extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
+          echo "Signing with keys from ${gpgHome}"
+
+          SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
+
+          $SIGN_CMD /boot/grub/grub.cfg
+
+          for f in /boot/nixos/*; do
+            if [[ "$f" != *.sig ]]; then
+              $SIGN_CMD "$f"
+            fi
+          done
+        '';
       };
+      environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
     })
+    {
+      assertions = [
+        {
+          assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
+          message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
+        }
+      ];
+    }
   ];
 }
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 830f475..4835cb8 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -6,6 +6,7 @@ in
   options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
   config = lib.mkIf cfg.enable {
     networking = {
+      useDHCP = lib.mkDefault true;
       networkmanager = {
         enable = true;
         wifi.macAddress = "stable-ssid";
diff --git a/os/core/ssh.nix b/os/core/ssh.nix
index 4069d31..d41c116 100644
--- a/os/core/ssh.nix
+++ b/os/core/ssh.nix
@@ -10,21 +10,32 @@ let
 in
 {
   options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+
   config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.rclone ];
     services.tailscale = {
       enable = true;
       openFirewall = true;
     };
 
-    services.openssh.enable = true;
+    services.openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
 
     programs.gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
       pinentryPackage = pkgs.pinentry-curses;
     };
-    users.users.${username}.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5/Mr4PLMDflZ+SoaYP9N3kRbkkh1qL5NLSgW6C7sAu adikro@disroot.org"
-    ];
+
+    users.users = {
+      ${username}.openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5/Mr4PLMDflZ+SoaYP9N3kRbkkh1qL5NLSgW6C7sAu adikro@disroot.org"
+      ];
+    };
   };
 }
diff --git a/os/srv/docker.nix b/os/srv/docker.nix
deleted file mode 100644
index a87ea5d..0000000
--- a/os/srv/docker.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ config, lib, pkgs, username, ... }:
-let
-  cfg = config.os.srv.docker;
-in
-{
-  options.os.srv.docker.enable = lib.mkEnableOption "enables the docker container engine";
-  config = lib.mkIf cfg.enable {
-    virtualisation.docker.enable = true;
-
-    environment.systemPackages = [ pkgs.docker-compose ];
-
-    users.users.${username}.extraGroups = [ "docker" ];
-  };
-}
diff --git a/os/srv/files.nix b/os/srv/files.nix
index 875a825..719642c 100644
--- a/os/srv/files.nix
+++ b/os/srv/files.nix
@@ -10,13 +10,19 @@ in
 {
   options.os.srv.files = {
     enable = lib.mkEnableOption "enables general file management stuff";
+    localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally";
     krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh";
   };
   config = lib.mkMerge [
-    {
+    (lib.mkIf cfg.enable {
       programs.thunar = {
         enable = true;
         plugins = with pkgs; [
+          ffmpegthumbnailer
+          libgsf
+          poppler
+          freetype
+          webp-pixbuf-loader
           thunar-volman
           thunar-archive-plugin
         ];
@@ -31,8 +37,13 @@ in
         pxz
         pigz
       ];
-    }
-
+    })
+    (lib.mkIf cfg.localsend.enable {
+      programs.localsend = {
+        enable = true;
+        openFirewall = true;
+      };
+    })
     (lib.mkIf cfg.krusader.enable {
       environment.systemPackages = with pkgs; [
         krusader
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 912a252..3e2eea4 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -77,6 +77,7 @@ in
           proton-ge-bin
         ];
       };
+      environment.systemPackages = with pkgs; [ steamtinkerlaunch ];
     })
 
     # --- VR SUPPORT ---
diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix
index 0bb819a..5e5e133 100644
--- a/os/srv/nix-helper.nix
+++ b/os/srv/nix-helper.nix
@@ -28,9 +28,9 @@ in
       clean.extraArgs = "--keep 5";
     };
 
-    # environment.sessionVariables = {
-    #   NH_OS_FLAKE = "/etc/nixos";
-    # };
+    environment.sessionVariables = {
+      NH_OS_FLAKE = "/etc/nixos";
+    };
 
     environment.systemPackages = with pkgs; [
       nix-output-monitor
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 3c9f0a9..40f9c74 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -12,26 +12,31 @@ in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix secret storing";
+  options.os.srv.sops = {
+    enable = lib.mkEnableOption "enables sops-nix";
+    diskEncryption = lib.mkEnableOption "enables initrd decryption key (LUKS)";
+  };
   config = lib.mkIf cfg.enable {
     sops = {
-      defaultSopsFile = ../../secrets/secrets.yaml;
+      defaultSopsFile = ../../secrets/common.yaml;
       defaultSopsFormat = "yaml";
       age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
       secrets = {
-        "syncthing/gui_password".owner = username;
+        "syncthing/gui_password" = {
+          owner = username;
+          sopsFile = ../../secrets/oci.yaml;
+        };
         "obs/websocket_password".owner = username;
         root_password.neededForUsers = true;
         user_password.neededForUsers = true;
-#        crypt_key = { };
+        oracler_password = {
+          neededForUsers = true;
+          sopsFile = ../../secrets/oci.yaml;
+        };
       };
     };
 
-#    boot.initrd.secrets = {
-#      "/tmp/crypt.key" = config.sops.secrets.crypt_key.path;
-#    };
-
     environment.systemPackages = with pkgs; [
       sops
       age
diff --git a/os/srv/srv.nix b/os/srv/srv.nix
index 0e2a4f7..8ee895b 100644
--- a/os/srv/srv.nix
+++ b/os/srv/srv.nix
@@ -5,7 +5,6 @@
     ./sops.nix
     ./bluetooth.nix
     ./compat.nix
-    ./docker.nix
     ./files.nix
     ./gaming.nix
     ./virtualization.nix
diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix
index f32737b..143e9da 100644
--- a/os/srv/virtualization.nix
+++ b/os/srv/virtualization.nix
@@ -2,23 +2,46 @@
   config,
   lib,
   pkgs,
+  username,
   ...
 }:
 let
   cfg = config.os.srv.virtualization;
 in
 {
-  options.os.srv.virtualization.enable =
-    lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
-  config = lib.mkIf cfg.enable {
-    virtualisation.libvirtd = {
-      enable = true;
-      qemu.package = pkgs.qemu_kvm;
-      qemu.swtpm.enable = true;
-    };
-    systemd.services.libvirt-guests.enable = false;
-    programs.virt-manager.enable = true;
-
-    boot.initrd.kernelModules = lib.optional (config.os.core.drivers.amd.enable or false) "kvm-amd";
+  options.os.srv.virtualization = {
+    kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
+    docker.enable = lib.mkEnableOption "Docker Container Virtualization";
+    waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization";
   };
+  config = lib.mkMerge [
+    (lib.mkIf cfg.kvm.enable {
+      virtualisation.libvirtd = {
+        enable = true;
+        qemu.package = pkgs.qemu_kvm;
+        qemu.swtpm.enable = true;
+      };
+      systemd.services.libvirt-guests.enable = false;
+      programs.virt-manager.enable = true;
+
+      boot.initrd.kernelModules =
+        (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd")
+        ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel");
+    })
+    (lib.mkIf cfg.docker.enable {
+      virtualisation.docker.enable = true;
+      environment.systemPackages = [ pkgs.docker-compose ];
+      users.users.${username}.extraGroups = [ "docker" ];
+    })
+    (lib.mkIf cfg.waydroid.enable {
+      virtualisation.waydroid = {
+        enable = true;
+        package = pkgs.waydroid-nftables;
+      };
+
+      environment.systemPackages = with pkgs; [
+        waydroid-helper
+      ];
+    })
+  ];
 }
diff --git a/os/wm/niri.nix b/os/wm/niri.nix
index 58d27af..587f543 100644
--- a/os/wm/niri.nix
+++ b/os/wm/niri.nix
@@ -19,7 +19,7 @@ in
 
     programs.niri = {
       enable = true;
-      package = pkgs.niri-unstable;
+      # package = pkgs.niri-unstable;
     };
 
     os.srv.compat.enable = true;