configuration.nix-valak

# -*- nix -*-
{ config, pkgs, lib, ... }:

{
  imports = [
    ./profile/server.nix
    ./users/binarin.nix
    # ./profile/emacs.nix
    ./profile/workstation.nix
    # ./profile/bkng-kerberos.nix
    ./hardware/vfio.nix
  ];

  boot.kernelPackages = pkgs.linuxPackages_6_6;
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "amdgpu" ];
  boot.supportedFilesystems = [ "zfs" ];
  virtualization.vfio = {
    enable = true;
    devices = [
      "0000:0a:00.0" # pci-e usb
      "0000:0e:00.0" # NVMe
      "0000:0f:00.0" # RTX
      "0000:0f:00.1"
    ];
  };

  hardware.bluetooth.disabledPlugins = ["sap"];

  specialisation.headless.configuration = {
    virtualization.vfio = {
      devices = [
        "0000:12:00.0" # Radeon
        "0000:12:00.1"
        "0000:12:00.2"
        "0000:12:00.3"
      ];
    };
  };

  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-amd"  ];
  boot.kernelParams = [ "amd_iommu=on" "iommu=pt" "pcie_aspm=off" "video=efifb:off" "pci=realloc" "usbcore.autosuspend=-1" ];
  boot.extraModulePackages = [ ];

  virtualisation.libvirtd = {
    enable = true;
    qemu.ovmf.enable = true;
    qemu.runAsRoot = false;
    onBoot = "ignore";
    onShutdown = "shutdown";
  };

  services.xserver = {
    deviceSection = ''
      BusID "PCI:18:0:0"
    '';
  };

  # fileSystems."/" =
  #   { device = "valak-rpool/root/nixos";
  #     fsType = "zfs";
  #   };

  # fileSystems."/home" =
  #   { device = "valak-rpool/home";
  #     fsType = "zfs";
  #   };

  # fileSystems."/boot" =
  #   { device = "/dev/disk/by-label/VALAK-BOOT";
  #     fsType = "vfat";
  #   };

  # swapDevices =
  #   [ { device = "/dev/disk/by-label/valak-swap"; }
  #   ];

  fileSystems."/" =
    { device = "/dev/disk/by-uuid/ac216764-ac4b-4a69-aa4e-22051798e14d";
      fsType = "ext4";
    };

  fileSystems."/boot" =
    { device = "/dev/disk/by-uuid/DC51-7F5A";
      fsType = "vfat";
    };

  swapDevices =
    [ { device = "/dev/disk/by-uuid/27420222-5cdb-440f-9b32-0f2668db7d68"; }
    ];

  nix.settings.max-jobs = lib.mkDefault 8;

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "valak"; # Define your hostname.
  networking.hostId = "55f9cd65";

  networking.useDHCP = false;

  networking.bridges.br0.interfaces = [ "enp8s0" ];

  networking.defaultGateway = {
    address = "192.168.2.1";
    interface = "br0";
  };

  networking.nameservers = [ "192.168.2.23" "192.168.2.1" ];

  networking.interfaces = {
    br0 = {
      ipv4 = {
        addresses = [
          {
            address = "192.168.2.26";
            prefixLength = 24;
          }
        ];
      };
    };
  };
  # networking.interfaces.enp8s0.useDHCP = true;
  # networking.interfaces.br0.useDHCP = true;
  # networking.bridges = {
  #   "br0" = {
  #     interfaces = [ "enp8s0" ];
  #   };
  # };


  networking.bridges.smb-sketchup.interfaces = [];
  networking.interfaces.smb-sketchup.ipv4.addresses = [{ address = "172.16.242.2"; prefixLength = 24; } ];

  services.samba = {
    enable = true;
    extraConfig = ''
      bind interfaces only = yes
      interfaces = lo smb-sketchup
    '';
    shares = {
      public = {
        path = "/home/vm-shared/sketchup";
        "guest ok" = "yes";
        writeable = "yes";
        public = "yes";
        "hosts allow" = "172.16.242.*";
      };
    };
  };

  networking.firewall.extraCommands = ''
    iptables -A INPUT -i smb-sketchup -p tcp -m multiport --dports 139,445 -j ACCEPT || true
    iptables -A INPUT -i smb-sketchup -p udp -m multiport --dports 137,138 -j ACCEPT || true
    iptables -A INPUT -i virbr0 -p tcp -m multiport --dports 24800 -j ACCEPT || true
  '';

  networking.firewall.extraStopCommands = ''
    iptables -D INPUT -i smb-sketchup -p tcp -m multiport --dports 139,445 -j ACCEPT || true
    iptables -D INPUT -i smb-sketchup -p udp -m multiport --dports 137,138 -j ACCEPT || true
    iptables -D INPUT -i virbr0 -p tcp -m multiport --dports 24800 -j ACCEPT || true
  '';

  # '--exclude-prefix=/dev' is everywhere, kick off looking-glass manually
  system.activationScripts.looking-glass = ''
    ${pkgs.systemd}/bin/systemd-tmpfiles --create --prefix=/dev/shm/
  '';

  services.logind.extraConfig = ''
    HandlePowerKey=poweroff
  '';

  systemd.tmpfiles.rules = [
    "f /dev/shm/looking-glass 0660 binarin qemu-libvirtd -"
  ];

  system.stateVersion = "20.09";

  # systemd.services."borgbackup-job-rsync-net".serviceConfig.ExecStartPre = ''${pkgs.coreutils}/bin/sleep 30'';
  # systemd.timers."borgbackup-job-rsync-net".timerConfig.Persistent = true;

  # services.borgbackup.jobs.rsync-net = {
  #   paths = [ "/home/vm-shared/sketchup/models" "/home/binarin" ];
  #   exclude = [
  #     "/home/binarin/.litecoin"
  #     "/home/binarin/booking-workspace"
  #     "**/*.qcow2.bz2"
  #     "**/.cache"
  #     "/home/binarin/Downloads"
  #     "**/.cabal"
  #     "**/.ivy2"
  #     "/home/binarin/tmp"
  #     "/home/binarin/.config/Slack"
  #     "/home/binarin/.config/google-chrome"
  #     "/home/binarin/.config/skypeforlinux"
  #     "/home/binarin/.cabal"
  #     "/home/binarin/.mozilla"
  #     "/home/binarin/.ivy2"
  #     "/home/binarin/.sbt"
  #     "/home/binarin/.cargo"
  #     "/home/binarin/.tabnine"
  #   ];
  #   repo = "18830@ch-s011.rsync.net:valak";
  #   doInit = false;
  #   encryption = {
  #     mode = "repokey";
  #     passCommand = "cat /root/.borg-pass";
  #   };
  #   environment = { BORG_RSH = "ssh -i /root/.ssh/rsync.net"; };
  #   extraArgs = "--remote-path=borg1";
  #   compression = "zstd,22";
  #   startAt = "daily";
  #   prune.keep = {
  #     within = "1d"; # Keep all archives from the last day
  #     daily = 7;
  #     weekly = 5;
  #     monthly = 12;
  #     yearly = -1;
  #   };
  # };

  programs.sway = {
    enable = true;
    inherit (config.home-manager.users.binarin.wayland.windowManager.sway) extraSessionCommands wrapperFeatures extraOptions;
  };
}