Nix-Vibe public snapshot (squashed history)

modules/core/common.nix

@@ -0,0 +1,79 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  imports = [
+    ./settings.nix
+    ./fonts.nix
+    ./sops.nix
+    ./users.nix
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  programs.zsh.enable = true;
+
+  # SSH is key-only on all hosts. petere (the only SSH user) authenticates with
+  # an authorized key; GUI users keep their local password for console/GUI login
+  # but cannot use it over SSH. Root SSH is fully disabled.
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Passwordless sudo for the admin/agent user only. Other wheel members
+  # (e.g. caitlin, mary) must enter their password for sudo.
+  security.sudo.extraRules = [
+    {
+      users = [ "petere" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
+  system.activationScripts.exportAgeKey = {
+    text = ''
+      if [ -f /root/.config/sops/age/keys.txt ]; then
+        ${pkgs.age}/bin/age-keygen -y < /root/.config/sops/age/keys.txt > /tmp/age-public-key.txt
+        chmod 644 /tmp/age-public-key.txt
+      fi
+    '';
+    deps = [ ];
+  };
+
+  # Automatic Nix store garbage collection and optimisation to prevent disk
+  # creep. Runs every 2 hours; persistent ensures missed runs are caught up on boot.
+  nix.gc = {
+    automatic = true;
+    dates = "*-*-* 0/2:00:00";
+    persistent = true;
+  };
+
+  # Keep the last 5 system generations (regardless of age), then collect garbage.
+  # nix.gc.options only accepts nix-collect-garbage flags (age-based), so we
+  # override the service to add count-based generation pruning.
+  systemd.services.nix-gc.script = lib.mkForce ''
+    ${pkgs.nix}/bin/nix-env --profile /nix/var/nix/profiles/system --delete-generations +5
+    exec ${pkgs.nix}/bin/nix-collect-garbage
+  '';
+
+  nix.optimise.automatic = true;
+
+  environment.systemPackages = with pkgs; [
+    # Antigravity removed - no longer used
+  ];
+
+  system.stateVersion = "23.11";
+}

modules/core/dev.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  # nixfmt is the standard Nix formatter (faster, stricter, future-proof).
+  # The flake formatter is also set to nixfmt.
+  environment.systemPackages = with pkgs; [
+    nixfmt
+    python3
+    flutter
+    uv
+    sops
+  ];
+}

modules/core/fonts.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+
+{
+  fonts.fontconfig.enable = true;
+  fonts.fontDir.enable = true;
+
+  fonts.packages = with pkgs; [
+    fira-code
+    fira-code-symbols
+    nerd-fonts.fira-code
+    corefonts
+    vista-fonts
+  ];
+  systemd.tmpfiles.rules = [
+    "L+ /usr/share/fonts - - - - /run/current-system/sw/share/X11/fonts"
+  ];
+}

modules/core/known-hosts.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.my.knownHosts;
+in
+{
+  options.my.knownHosts = {
+    mcfServer = lib.mkEnableOption "mcf-server SSH host key";
+    richmondServer = lib.mkEnableOption "richmond-server SSH host key";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.mcfServer {
+      services.openssh.knownHosts."mcf-server".publicKey =
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINOeOgD+GNQw5Isw/AumZcDFzdzO6YnKJEFWcuUcKPI2";
+    })
+    (lib.mkIf cfg.richmondServer {
+      services.openssh.knownHosts."richmond-server".publicKey =
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEqDXL9w8QwUcqxtW3kyHW/LUDqCGqf6JQ3ZZw52vRQY";
+    })
+  ];
+}

modules/core/management.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  # Common admin/monitoring tools available on every host.
+  environment.systemPackages = with pkgs; [
+    htop
+    bottom
+    iotop
+    ncdu
+    ripgrep
+    fd
+    jq
+    lsof
+    tmux
+  ];
+
+  # Firmware updates for all machines (laptops AND servers).
+  services.fwupd.enable = true;
+}

modules/core/podman.nix

@@ -0,0 +1,17 @@
+{ pkgs, config, ... }:
+
+{
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+    defaultNetwork.settings.dns_enabled = false;
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
+}

modules/core/settings.nix

@@ -0,0 +1,34 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  # Set your time zone
+  time.timeZone = "Europe/London";
+
+  # Configure console keyboard layout
+  console.keyMap = "uk";
+
+  # Configure X server keyboard layout if X server is enabled
+  services.xserver.xkb.layout = lib.mkIf config.services.xserver.enable "gb";
+
+  services.tailscale.enable = true;
+
+  users.mutableUsers = false;
+
+  nix.settings = {
+    accept-flake-config = true;
+    trusted-users = [ "petere" ];
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    # gemini-cli
+    kitty.terminfo
+  ];
+}

modules/core/sops.nix

@@ -0,0 +1,20 @@
+{ config
+, pkgs
+, inputs
+, ...
+}:
+
+{
+  sops = {
+    age = {
+      keyFile = "/root/.config/sops/age/keys.txt";
+      generateKey = false;
+    };
+    defaultSopsFile = ../../secrets.yaml;
+    secrets."gemini-api-key" = {
+      owner = "petere";
+      group = "users";
+      mode = "0440";
+    };
+  };
+}

modules/core/users.nix

@@ -0,0 +1,67 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+let
+  cfg = config.my.users.petere;
+in
+{
+  options.my.users.petere = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to create the petere admin user.";
+    };
+
+    description = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Optional GECOS description for petere.";
+    };
+
+    hashedPasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Path to the hashed password file, or null for SSH-key-only access.";
+    };
+
+    subUidStart = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
+      default = null;
+      description = "Start UID for petere's rootless subuid range, or null to disable.";
+    };
+
+    subGidStart = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
+      default = null;
+      description = "Start GID for petere's rootless subgid range, or null to disable.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.petere = {
+      isNormalUser = true;
+      shell = pkgs.zsh;
+      extraGroups = [ "wheel" ];
+      description = lib.mkIf (cfg.description != null) cfg.description;
+      hashedPasswordFile = lib.mkIf (cfg.hashedPasswordFile != null) cfg.hashedPasswordFile;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJiCtkYDBfieK3i4TbVomeyXa185yCFZUvrbMamR4bqs petere@x1carbon"
+      ];
+      subUidRanges = lib.mkIf (cfg.subUidStart != null) [
+        {
+          startUid = cfg.subUidStart;
+          count = 65536;
+        }
+      ];
+      subGidRanges = lib.mkIf (cfg.subGidStart != null) [
+        {
+          startGid = cfg.subGidStart;
+          count = 65536;
+        }
+      ];
+    };
+  };
+}