System/machines/levitation/configuration.nix

{ config, lib, pkgs, inputs, ... }:

{
  # Sops setup for this machine
  sops.secrets = {
    "borg-ssh-key" = {
      sopsFile = ../../secrets/levitation/borg.yaml;
      format = "yaml";
    };
    "borg-password" = {
      sopsFile = ../../secrets/levitation/borg.yaml;
      format = "yaml";
    };
    "windows-bitlocker-key" = {
      sopsFile = ../../secrets/levitation/windows.yaml;
      format = "yaml";
    };
  };
  # Setup system configuration
  nathan = {
    programs = { games = true; };
    services = {
      borg = {
        enable = true;
        extraExcludes = [
          "/home/${config.nathan.config.user}/Music"
          "/var/lib/docker"
          "/var/log"
        ];
        passwordFile = config.sops.secrets."borg-password".path;
        sshKey = config.sops.secrets."borg-ssh-key".path;
      };
      kubo = { enable = true; };
      # resolved = { enable = true; };
    };
    hardware = {
      amdPassthrough = true;
      printing = true;
    };
    config = {
      isDesktop = true;
      setupGrub = true;
      nix.autoUpdate = false;
      harden = false;
      windows = {
        enable = true;
        mount = {
          device = "/dev/nvme0n1p3";
          mountPoint = "/mnt/windows";
          keyFile = config.sops.secrets."windows-bitlocker-key".path;
        };
      };
    };
  };
  # Configure networking
  networking = {
    domain = "mccarty.io";
    useDHCP = false;
    interfaces.enp6s0.useDHCP = true;
    nat.externalInterface = "enp6s0";
    # Open ports for soulseek
    firewall = {
      allowedTCPPorts = [ 61377 ];
      allowedUDPPorts = [ 61377 ];
    };
  };

  # Setup home manager
  home-manager.users.nathan = import ./home.nix;

  # TPM setup
  security = { tpm2 = { enable = true; }; };

  # Configure nix build
  nix.settings = {
    cores = 8;
    max-jobs = 6;
    system-features = [ "gccarch-znver3" ];
  };

  # Calibre
  services.calibre-web = {
    enable = true;
    user = "nathan";
    group = "users";
    openFirewall = true;
    listen = { ip = "100.95.223.6"; };
    options = {
      calibreLibrary = "/home/nathan/Books";
      enableBookConversion = true;
      enableBookUploading = true;
    };
  };

  nixpkgs = {
    # Native opts go nyoom
    localSystem = {
      gcc = {
        arch = "znver3";
        tune = "znver3";
      };
      system = "x86_64-linux";
    };
    # Fix some packages that are broken on nixos-21.11 with march=znver3
    # We'll substitute these with the version from a second import of nixpkgs without the gcc
    # configuration.
    overlays = [
      (self: super:
        let
          vanilla-pkgs = import inputs.nixpkgs-unstable {
            system = "x86_64-linux";
            config = {
              localSystem = {
                gcc = {
                  arch = null;
                  tune = null;
                };
              };
            };
          };
        in {
          libxcrypt = vanilla-pkgs.libxcrypt;
          perl = vanilla-pkgs.perl;
        })
    ];
  };
}