System/machines/levitation/configuration.nix

{ config, lib, pkgs, inputs, ... }:
let
  system = pkgs.system;
  unstable = import inputs.nixpkgs-unstable {
    config = { allowUnfree = true; };
    inherit system;
  };
in {
  # Sops setup for this machine
  sops.secrets = {
    "borg-ssh-key" = {
      sopsFile = ../../secrets/levitation/borg.yaml;
      format = "yaml";
    };
    "borg-password" = {
      sopsFile = ../../secrets/levitation/borg.yaml;
      format = "yaml";
    };
    "windows-bitlocker-key" = {
      sopsFile = ../../secrets/levitation/windows.yaml;
      format = "yaml";
    };
    "last.fm" = {
      sopsFile = ../../secrets/levitation/last.fm;
      format = "binary";
      owner = "nathan";
      mode = "0400";
    };
  };
  # Setup system configuration
  nathan = {
    programs = { games = true; };
    services = {
      borg = {
        enable = true;
        extraExcludes = [
          "/home/${config.nathan.config.user}/Music"
          "/var/lib/docker"
          "/var/log"
        ];
        passwordFile = config.sops.secrets."borg-password".path;
        sshKey = config.sops.secrets."borg-ssh-key".path;
      };
      kubo = { enable = true; };
      # resolved = { enable = true; };
    };
    hardware = {
      amdPassthrough = true;
      printing = true;
    };
    config = {
      isDesktop = true;
      setupGrub = true;
      nix.autoUpdate = false;
      harden = false;
      virtualization = {
        docker = false;
        podman = true;
      };
      windows = {
        enable = true;
        mount = {
          device = "/dev/nvme0n1p2";
          mountPoint = "/mnt/windows";
          keyFile = config.sops.secrets."windows-bitlocker-key".path;
        };
      };
    };
  };
  # Configure networking
  networking = {
    domain = "mccarty.io";
    useDHCP = false;
    interfaces.enp6s0.useDHCP = true;
    nat.externalInterface = "enp6s0";
    # Open ports for soulseek and weylus
    firewall = {
      allowedTCPPorts = [ 61377 1701 9001 ];
      allowedUDPPorts = [ 61377 1701 9001 ];
    };
  };
  # GPU passthrough
  boot.kernelParams = [ "amd_iommu=on" ];

  # Setup home manager
  home-manager.users.nathan = import ./home.nix;

  # Disable session persistance
  services.logind.killUserProcesses = true;

  # TPM setup
  security = { tpm2 = { enable = true; }; };

  # Configure nix build
  nix.settings = {
    cores = 16;
    max-jobs = 4;
  };

  # vmware
  virtualisation.vmware.host = {
    enable = true;
    package = unstable.vmware-workstation;
  };
}