Rename pkgs to packages

.sops.yaml

@@ -1,7 +1,6 @@
 keys:
   - &primary age1ee5udznhadk6m7jtglu4709rep080yjyd2ukzdl8jma4mm92y3psv0slpg
   - &aspi-ssh age1q8lc5340gz5xw2f57nglrss68wv0j0hf36py2pdtrl6ky3yrq9qqk0njr4
-  - &pianonix-ssh age1tguyu2yd5xv8rgjjl50cq6dq5rr7umqgv098dgre4u9wyj30ea7sexw62c
   - &builder-ssh age1kw4kmdm45zprvdkrrpvgq966l7585vhusmum083qlwnr0xxgd3uqatcyja
   - &kardorf-ssh age15lxw97z03q40xrdscnxqqugh5ky5aqrerg2t2rphkcqm6rnllurq8v98q5
 
@@ -11,7 +10,6 @@ creation_rules:
     - age:
       - *primary
       - *aspi-ssh
-      - *pianonix-ssh
       - *kardorf-ssh
 
   - path_regex: hosts/builder/secrets.yaml$
@@ -19,9 +17,3 @@ creation_rules:
     - age:
       - *primary
       - *builder-ssh
-
-  - path_regex: hosts/pianonix/secrets*
-    key_groups:
-    - age:
-      - *primary
-      - *pianonix-ssh

features-nixos/base/auto-upgrade.nix

@@ -1,18 +0,0 @@
-{
-  flake.nixosModules.base = {
-    inputs,
-    config,
-    ...
-  }: {
-    system.hydraAutoUpgrade = {
-      # Only enable if not dirty
-      enable = inputs.self ? rev;
-      dates = "*:0/10"; # Every 10 minutes
-      instance = "http://hydra.julian-mutter.de";
-      project = "dotfiles";
-      jobset = "main";
-      job = "hosts.${config.networking.hostName}";
-      oldFlakeRef = "self";
-    };
-  };
-}

features-nixos/base/default.nix

@@ -1,40 +0,0 @@
-# Common config for all hosts
-{
-  flake.nixosModules.base = {
-    inputs,
-    outputs,
-    pkgs,
-    lib,
-    ...
-  }: {
-    imports = [
-      inputs.home-manager.nixosModules.home-manager
-    ];
-
-    # Replaces the (modulesPath + "/installer/scan/not-detected.nix") from default hardware-configuration.nix
-    # Enables non-free firmware
-    hardware.enableRedistributableFirmware = true;
-
-    # Networking
-    networking.networkmanager = {
-      enable = true;
-      plugins = with pkgs; [
-        networkmanager-openconnect
-      ];
-    };
-    services.resolved.enable = false;
-    # MDNS Taken by avahi
-    # networking.networkmanager.dns = "none";
-    networking.nameservers = lib.mkDefault [
-      "1.1.1.1"
-      "8.8.8.8"
-    ];
-
-    # HM module
-    home-manager.useGlobalPkgs = true; # hm module uses the pkgs of the nixos config
-    home-manager.backupFileExtension = "hm-backup"; # backup conflicting files. So hm activation never fails
-    home-manager.extraSpecialArgs = {
-      inherit inputs outputs;
-    };
-  };
-}

features-nixos/base/fish.nix

@@ -1,12 +0,0 @@
-{
-  flake.nixosModules.base = {
-    programs.fish = {
-      enable = true;
-      vendor = {
-        completions.enable = true;
-        config.enable = true;
-        functions.enable = true;
-      };
-    };
-  };
-}

features-nixos/base/locale.nix

@@ -1,28 +0,0 @@
-{
-  flake.nixosModules.base = {
-    # Select internationalisation properties.
-    i18n.defaultLocale = "en_US.UTF-8";
-
-    i18n.extraLocaleSettings = {
-      LC_ADDRESS = "de_DE.UTF-8";
-      LC_IDENTIFICATION = "de_DE.UTF-8";
-      LC_MEASUREMENT = "de_DE.UTF-8";
-      LC_MONETARY = "de_DE.UTF-8";
-      LC_NAME = "de_DE.UTF-8";
-      LC_NUMERIC = "en_US.UTF-8";
-      LC_PAPER = "de_DE.UTF-8";
-      LC_TELEPHONE = "de_DE.UTF-8";
-      LC_TIME = "de_DE.UTF-8";
-    };
-
-    # Keymap
-    services.xserver.xkb = {
-      layout = "de";
-      variant = "";
-    };
-
-    console.keyMap = "de";
-
-    time.timeZone = "Europe/Berlin";
-  };
-}

features-nixos/base/nix.nix

@@ -1,48 +0,0 @@
-{
-  flake.nixosModules.base = {outputs, ...}: {
-    # Apply overlays
-    nixpkgs = {
-      # TODO: apply this to hm and nixos without duplicate code
-      overlays = builtins.attrValues outputs.overlays;
-      config = {
-        nvidia.acceptLicense = true;
-        allowUnfree = true;
-        allowUnfreePredicate = _: true; # TODO: what is this
-        warn-dirty = false;
-        permittedInsecurePackages = [
-          "olm-3.2.16"
-        ];
-      };
-    };
-
-    # optimize at every build, slows down builds
-    # better to do optimise.automatic for regular optimising
-    # nix.settings.auto-optimise-store = lib.mkDefault true;
-    nix.settings.experimental-features = [
-      "nix-command"
-      "flakes"
-      "ca-derivations"
-    ];
-    # warn-dirty = false;
-
-    nix.gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 30d";
-      persistent = true;
-    };
-    nix.optimise = {
-      automatic = true;
-      dates = ["weekly"]; # Optional; allows customizing optimisation schedule
-      persistent = true;
-    };
-
-    programs.nix-ld.enable = true;
-
-    # TODO: is this useful?, what does it do?
-    # nix.settings.flake-registry = ""; # Disable global flake registry
-    # Add each flake input as a registry and nix_path
-    # registry = lib.mapAttrs (_: flake: { inherit flake; }) flakeInputs;
-    # nixPath = lib.mapAttrsToList (n: _: "${n}=flake:${n}") flakeInputs;
-  };
-}

features-nixos/base/root.nix

@@ -1,11 +0,0 @@
-{
-  flake.nixosModules.base = {pkgs, ...}: {
-    # Packages needed as root
-    environment.systemPackages = with pkgs; [
-      vim
-      htop
-      mc
-      gparted-xhost # needs to be installed as system package so it can be actually opened
-    ];
-  };
-}

features-nixos/base/sops/sops.nix

@@ -1,24 +0,0 @@
-{
-  flake.nixosModules.base = {
-    inputs,
-    config,
-    ...
-  }: let
-    isEd25519 = k: k.type == "ed25519";
-    getKeyPath = k: k.path;
-    keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
-  in {
-    imports = [inputs.sops-nix.nixosModules.sops];
-
-    sops.age = {
-      sshKeyPaths = map getKeyPath keys;
-
-      # TODO: remove? only rely on ssh or pgp keys (e.g. ubikey like misterio is using!!!)
-      # keyFile = "/home/julian/.config/sops/age/keys.txt";
-      # Generate key if none of the above worked. With this, building will still work, just without secrets
-      generateKey = false; # TODO: building should not work without secrets!?
-    };
-
-    sops.defaultSopsFile = ./secrets.yaml;
-  };
-}

features-nixos/optional/authentication.nix

@@ -1,31 +0,0 @@
-{
-  flake.nixosModules.authentication = {
-    pkgs,
-    lib,
-    ...
-  }: {
-    # Make programs like nextcloud client access saved passwords
-    services.gnome.gnome-keyring.enable = true;
-
-    programs.seahorse.enable = true;
-    programs.ssh.askPassword = lib.mkForce "${pkgs.seahorse}/libexec/seahorse/ssh-askpass"; # Solve conflicting definition in seahorse and plasma6
-
-    # Make authentication work for e.g. gparted
-    security.polkit.enable = true;
-    systemd = {
-      user.services.polkit-gnome-authentication-agent-1 = {
-        description = "polkit-gnome-authentication-agent-1";
-        wantedBy = ["graphical-session.target"];
-        wants = ["graphical-session.target"];
-        after = ["graphical-session.target"];
-        serviceConfig = {
-          Type = "simple";
-          ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
-          Restart = "on-failure";
-          RestartSec = 1;
-          TimeoutStopSec = 10;
-        };
-      };
-    };
-  };
-}

features-nixos/optional/avahi.nix

@@ -1,14 +0,0 @@
-{
-  flake.nixosModules.avahi = {
-    # MDNS on local network
-    services.avahi = {
-      enable = true;
-      nssmdns4 = true;
-      nssmdns6 = true;
-      publish.enable = true;
-      publish.addresses = true;
-      ipv4 = true;
-      ipv6 = true;
-    };
-  };
-}

features-nixos/optional/binarycaches.nix

@@ -1,33 +0,0 @@
-{
-  flake.nixosModules.binarycaches = {
-    lib,
-    outputs,
-    ...
-  }: {
-    # Setup binary caches
-    nix.settings = {
-      substituters = [
-        "https://nix-community.cachix.org"
-        "https://cache.nixos.org/"
-        "https://hyprland.cachix.org"
-        "http://binarycache.julian-mutter.de"
-        "https://devenv.cachix.org"
-      ];
-      trusted-public-keys = [
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-        "binarycache.julian-mutter.de:oJ67uRFwRhNPKL58CHzy3QQLv38Kx7OA1K+6xlEPu7E="
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
-      ];
-
-      trusted-users = [
-        "root"
-        "@wheel"
-      ]; # needed for devenv to add custom caches
-
-      # Ensure we can still build when missing-server is not accessible
-      fallback = true;
-    };
-  };
-}

features-nixos/optional/boot-efi.nix

@@ -1,19 +0,0 @@
-{
-  flake.nixosModules.boot-efi = {
-    # Bootloader
-    # Use this for simple nix boot menu, if no dual boot required
-    boot.loader.systemd-boot.enable = true;
-    boot.loader.systemd-boot.configurationLimit = 10;
-    boot.loader.efi.canTouchEfiVariables = true;
-
-    # https://github.com/NixOS/nixpkgs/blob/c32c39d6f3b1fe6514598fa40ad2cf9ce22c3fb7/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix#L66
-    boot.loader.systemd-boot.editor = false;
-
-    boot.supportedFilesystems = [
-      "btrfs"
-      "ntfs"
-      "nfs"
-      "cifs"
-    ];
-  };
-}

features-nixos/optional/docker.nix

@@ -1,7 +0,0 @@
-{
-  flake.nixosModules.docker = {
-    virtualisation.docker = {
-      enable = true;
-    };
-  };
-}

features-nixos/optional/flatpak.nix

@@ -1,8 +0,0 @@
-{
-  flake.nixosModules.flatpak = {pkgs, ...}: {
-    services.flatpak.enable = true;
-    xdg.portal.enable = true;
-    xdg.portal.extraPortals = [pkgs.xdg-desktop-portal-gtk];
-    xdg.portal.config.common.default = "*"; # Use first portal implementation found
-  };
-}

features-nixos/optional/gamemode.nix

@@ -1,23 +0,0 @@
-{
-  flake.nixosModules.gamemode = {pkgs, ...}: {
-    programs.gamemode = {
-      enable = true;
-      settings = {
-        general = {
-          softrealtime = "auto";
-          inhibit_screensaver = 1;
-          renice = 5;
-        };
-        # gpu = {
-        #   apply_gpu_optimisations = "accept-responsibility";
-        #   gpu_device = 1;
-        #   amd_performance_level = "high";
-        # };
-        custom = {
-          start = "${pkgs.libnotify}/bin/notify-send 'GameMode started'";
-          end = "${pkgs.libnotify}/bin/notify-send 'GameMode ended'";
-        };
-      };
-    };
-  };
-}

features-nixos/optional/gdm.nix

@@ -1,15 +0,0 @@
-{
-  flake.nixosModules.gdm = {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: {
-    services.xserver.displayManager.gdm = {
-      enable = true;
-    };
-
-    # unlock GPG keyring on login
-    security.pam.services.gdm.enableGnomeKeyring = true;
-  };
-}

features-nixos/optional/greetd.nix

@@ -1,39 +0,0 @@
-{
-  flake.nixosModules.greetd = {config, ...}: let
-    homeCfgs = config.home-manager.users;
-    julianCfg = homeCfgs.julian;
-  in {
-    users.extraUsers.greeter = {
-      # For caching
-      home = "/tmp/greeter-home";
-      createHome = true;
-    };
-
-    programs.regreet = {
-      enable = true;
-      iconTheme = julianCfg.gtk.iconTheme;
-      theme = julianCfg.gtk.theme;
-      # font = julianCfg.fontProfiles.regular; # TODO: do
-      cursorTheme = {
-        inherit (julianCfg.gtk.cursorTheme) name package;
-      };
-      cageArgs = [
-        "-s"
-        "-m"
-        "last"
-      ]; # multimonitor use last monitor
-      # settings.background = {
-      #   path = julianCfg.wallpaper;
-      #   fit = "Cover";
-      # }; # TODO: fix
-
-      # TODO: setting keyboard language does not work
-      # settings = {
-      #   env = {
-      #     XKB_DEFAULT_LAYOUT = "de";
-      #     # XKB_DEFAULT_VARIANT = "altgr-intl";
-      #   };
-      # };
-    };
-  };
-}

features-nixos/optional/i3.nix

@@ -1,18 +0,0 @@
-{
-  flake.nixosModules.i3 = {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: {
-    services.xserver.windowManager.i3.enable = true;
-    services.xserver.windowManager.i3.package = pkgs.i3-gaps;
-    services.displayManager.defaultSession = "none+i3";
-
-    programs.xss-lock = {
-      # responds to "loginctl lock-session" via dbus
-      enable = true;
-      lockerCommand = "${pkgs.i3lock}/bin/i3lock --ignore-empty-password --color=000000";
-    };
-  };
-}

features-nixos/optional/kerberos.nix

@@ -1,25 +0,0 @@
-{
-  flake.nixosModules.kerberos = {
-    security.krb5.enable = true;
-    security.krb5.settings = {
-      # domain_realm = {
-      #   ".julian-mutter.de" = "julian-mutter.de";
-      #   "julian-mutter.de" = "julian-mutter.de";
-      # };
-      libdefaults = {
-        default_realm = "julian-mutter.de";
-        #   dns_lookup_realm = true;
-        #   dns_lookup_kdc = true;
-        #   ticket_lifetime = "24h";
-        #   renew_lifetime = "7d";
-      };
-      realms = {
-        "julian-mutter.de" = {
-          kdc = ["kerberos.julian-mutter.de"];
-          admin_server = "kerberos-admin.julian-mutter.de";
-          default_domain = "julian-mutter.de";
-        };
-      };
-    };
-  };
-}

features-nixos/optional/openssh.nix

@@ -1,51 +0,0 @@
-{
-  flake.nixosModules.openssh = {
-    outputs,
-    lib,
-    config,
-    ...
-  }: let
-    hosts = lib.attrNames outputs.nixosConfigurations;
-  in {
-    services.openssh = {
-      enable = true;
-      settings = {
-        # Harden
-        PasswordAuthentication = false;
-        PermitRootLogin = "no";
-
-        # TODO: what does this do
-        # Let WAYLAND_DISPLAY be forwarded
-        AcceptEnv = "WAYLAND_DISPLAY";
-        X11Forwarding = true;
-      };
-
-      hostKeys = [
-        {
-          path = "/etc/ssh/ssh_host_ed25519_key";
-          type = "ed25519";
-        }
-      ];
-    };
-
-    # TODO: is automatic known hosts file even necessary?
-    # programs.ssh = {
-    #   # Each hosts public key
-    #   knownHosts = lib.genAttrs hosts (hostname: {
-    #     publicKeyFile = ../../${hostname}/ssh_host_ed25519_key.pub;
-    #     extraHostNames =
-    #       [
-    #         # "${hostname}.m7.rs"
-    #       ]
-    #       ++
-    #         # Alias for localhost if it's the same host
-    #         (lib.optional (hostname == config.networking.hostName) "localhost")
-    #       # Alias to m7.rs and git.m7.rs if it's alcyone
-    #       ++ (lib.optionals (hostname == "alcyone") [
-    #         "m7.rs"
-    #         "git.m7.rs"
-    #       ]);
-    #   });
-    # };
-  };
-}

features-nixos/optional/pcmanfm.nix

@@ -1,11 +0,0 @@
-{
-  flake.nixosModules.pcmanfm = {pkgs, ...}: {
-    environment.systemPackages = with pkgs; [
-      shared-mime-info # extended mimetype support
-      lxmenu-data # open with "Installed Applications"
-      pcmanfm
-    ];
-
-    services.gvfs.enable = true; # Mount, trash, and other functionalities
-  };
-}

features-nixos/optional/pipewire.nix

@@ -1,30 +0,0 @@
-{
-  flake.nixosModules.pipewire = {
-    security.rtkit.enable = true;
-    services.pulseaudio.enable = false;
-    services.pipewire = {
-      enable = true;
-      wireplumber.enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      jack.enable = true;
-      extraConfig.pipewire = {
-        "99-no-bell" = {
-          # Disable bell sound
-          "context.properties" = {
-            "module.x11.bell" = false;
-          };
-        };
-        "10-increase-buffer" = {
-          "context.properties" = {
-            "default.clock.rate" = 48000;
-            "default.clock.quantum" = 1024;
-            "default.clock.min-quantum" = 1024;
-            "default.clock.max-quantum" = 2048;
-          };
-        };
-      };
-    };
-  };
-}

features-nixos/optional/podman.nix

@@ -1,12 +0,0 @@
-{
-  flake.nixosModules.podman = {config, ...}: let
-    dockerEnabled = config.virtualisation.docker.enable;
-  in {
-    virtualisation.podman = {
-      enable = true;
-      dockerCompat = !dockerEnabled;
-      dockerSocket.enable = !dockerEnabled;
-      defaultNetwork.settings.dns_enabled = true;
-    };
-  };
-}

features-nixos/optional/redshift.nix

@@ -1,14 +0,0 @@
-{
-  flake.nixosModules.redshift = {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: {
-    # Set location used by redshift
-    location.provider = "manual";
-    location.latitude = 47.92;
-    location.longitude = 10.12;
-    services.redshift.enable = true;
-  };
-}

features-nixos/optional/remote-builder.nix

@@ -1,36 +0,0 @@
-{
-  flake.nixosModules.remote-builder = {
-    nix.distributedBuilds = true;
-    nix.settings.builders-use-substitutes = true;
-
-    nix.buildMachines = [
-      {
-        hostName = "builder.julian-mutter.de";
-        protocol = "ssh";
-        sshUser = "nix";
-        systems = [
-          "x86_64-linux"
-          "aarch64-linux"
-        ];
-        maxJobs = 4;
-        speedFactor = 3;
-        supportedFeatures = [
-          "nixos-test"
-          "benchmark"
-          "big-parallel"
-          "kvm"
-        ];
-        mandatoryFeatures = [];
-      }
-      # {
-      #   hostName = "localhost";
-      #   protocol = null;
-      #   systems = [
-      #     "x86_64-linux"
-      #   ];
-      #   maxJobs = 4;
-      #   speedFactor = 1;
-      # }
-    ];
-  };
-}

features-nixos/optional/thunar.nix

@@ -1,18 +0,0 @@
-{
-  flake.nixosModules.thunar = {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: {
-    programs.thunar.enable = true;
-    programs.xfconf.enable = true; # Persist saved preferences
-    programs.thunar.plugins = with pkgs.xfce; [
-      thunar-archive-plugin
-      thunar-volman
-      thunar-media-tags-plugin
-    ];
-    services.gvfs.enable = true; # Mount, trash, and other functionalities
-    services.tumbler.enable = true; # Thumbnail support for images
-  };
-}

features-nixos/optional/virtualbox.nix

@@ -1,14 +0,0 @@
-{
-  flake.nixosModules.virtualbox = {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: {
-    virtualisation.virtualbox.host.enable = true;
-    # virtualisation.virtualbox.host.enableExtensionPack = true;
-    # virtualisation.virtualbox.guest.enable = true;
-    # virtualisation.virtualbox.guest.x11 = true;
-    users.extraGroups.vboxusers.members = ["julian"];
-  };
-}

features-nixos/optional/wireguard.nix

@@ -1,14 +0,0 @@
-{
-  flake.nixosModules.wireguard = {
-    networking.wg-quick.interfaces = {
-      julian = {
-        configFile = "/etc/wireguard/julian.conf";
-        autostart = true; # This interface is started on boot
-      };
-      comu = {
-        configFile = "/etc/wireguard/comu.conf";
-        autostart = false;
-      };
-    };
-  };
-}

features-nixos/optional/wireshark.nix

@@ -1,11 +0,0 @@
-{
-  flake.nixosModules.wireshark = {
-    programs.wireshark = {
-      enable = true;
-      dumpcap.enable = true;
-      usbmon.enable = true;
-    };
-
-    users.users.julian.extraGroups = ["wireshark"];
-  };
-}

features-nixos/optional/xserver.nix

@@ -1,8 +0,0 @@
-{
-  flake.nixosModules.xserver = {
-    services.xserver = {
-      enable = true;
-      wacom.enable = true;
-    };
-  };
-}

features-nixos/users/julian/default.nix

@@ -1,52 +0,0 @@
-{
-  flake.nixosModules.users.julian = {
-    pkgs,
-    config,
-    lib,
-    ...
-  }: let
-    ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
-  in {
-    users.mutableUsers = false;
-    users.users.julian = {
-      description = "Julian";
-      group = "julian";
-      isNormalUser = true;
-      uid = 1000;
-      shell = pkgs.fish;
-      extraGroups = ifTheyExist [
-        "networkmanager"
-        "wheel"
-        "audio"
-        "realtime"
-        "rtkit"
-        "network"
-        "video"
-        "podman"
-        "docker"
-        "git"
-        "gamemode"
-        "dialout"
-      ];
-
-      openssh.authorizedKeys.keys = lib.splitString "\n" (
-        builtins.readFile ../../../../homes/julian/ssh.pub
-      );
-      # hashedPasswordFile = config.sops.secrets.julian-password.path;
-      hashedPassword = "$y$j9T$N33kLJQbV8soUoCbDkpwA1$r/yahJDgOPo4GGOrAi6BUG5zLTzmaBrA5NQ4nno561A";
-      packages = [pkgs.home-manager];
-    };
-    users.groups.julian = {
-      gid = 1000;
-    };
-
-    sops.secrets.julian-password = {
-      sopsFile = ../../secrets.yaml;
-      neededForUsers = true;
-    };
-
-    home-manager.users.julian = import ../../../../homes/julian/${config.networking.hostName}.nix;
-
-    security.pam.services.swaylock = {}; # Make swaylock unlocking work
-  };
-}

features-nixos/users/pob/default.nix

@@ -1,30 +0,0 @@
-{
-  flake.nixosModules.users.pob = {
-    pkgs,
-    config,
-    ...
-  }: let
-    ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
-  in {
-    users.mutableUsers = false;
-    users.users.pob = {
-      description = "A helper user to use another profile for some applications";
-      group = "pob";
-      isNormalUser = true;
-      shell = pkgs.fish;
-      extraGroups = ifTheyExist [
-        "networkmanager"
-      ];
-      packages = with pkgs; [
-        firefox
-        wineWowPackages.stable # 32-bit and 64-bit wine
-        winetricks
-      ];
-    };
-    users.groups.pob = {};
-
-    security.sudo.extraConfig = ''
-      julian ALL=(pob) NOPASSWD: ALL
-    '';
-  };
-}

features-nixos/users/wolfi/default.nix

@@ -1,32 +0,0 @@
-{
-  flake.nixosModules.users.wolfi = {
-    pkgs,
-    config,
-    ...
-  }: let
-    ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
-  in {
-    users.mutableUsers = false;
-    users.users.wolfi = {
-      description = "Wolfi";
-      group = "wolfi";
-      isNormalUser = true;
-      shell = pkgs.fish;
-      extraGroups = ifTheyExist [
-        "networkmanager"
-        "wheel"
-        "audio"
-        "network"
-        "video"
-        "podman"
-        "docker"
-        "git"
-        "gamemode"
-      ];
-
-      hashedPassword = "$y$j9T$ifzWjoZaRtPUOOfMYnbJ20$uFOO1EyDApL52vRUicZYgupaTA/a6sGNUj3imZ/lcb6";
-      packages = [pkgs.home-manager];
-    };
-    users.groups.wolfi = {};
-  };
-}

features-nixos/users/yukari/default.nix

@@ -1,99 +0,0 @@
-{
-  flake.nixosModules.users.yukari = {
-    pkgs,
-    config,
-    lib,
-    outputs,
-    ...
-  }: let
-    ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
-  in {
-    users.mutableUsers = false;
-    users.users.yukari = {
-      description = "Yukari";
-      group = "yukari";
-      isNormalUser = true;
-      shell = pkgs.fish;
-      extraGroups = ifTheyExist [
-        "networkmanager"
-        "audio"
-        "network"
-        "video"
-        "podman"
-        "docker"
-        "git"
-        "gamemode"
-      ];
-
-      createHome = true;
-      hashedPassword = "$y$j9T$rGuTL0rfiy7ht8L58BGCw0$fN.KwHjYlIitFEPHndKvV06ezgeWzP3/58o1kkviZwB";
-      packages = [pkgs.home-manager];
-    };
-    users.groups.yukari = {};
-
-    home-manager.users.yukari = {
-      imports =
-        [
-          ../../../../homes/julian/features/fonts
-          ../../../../homes/julian/features/suites/cli
-        ]
-        ++ (builtins.attrValues outputs.homeManagerModules);
-
-      home = {
-        username = lib.mkDefault "yukari";
-        homeDirectory = lib.mkDefault "/home/${config.home.username}";
-        stateVersion = lib.mkDefault "23.11";
-
-        sessionPath = ["$HOME/.local/bin"];
-
-        packages = with pkgs; [
-          arandr
-          calibre # ebook manager and viewer
-          # digikam
-          discord
-          discord-ptb # in case discord updates take their time
-          # dvdisaster
-          # element-desktop
-          # rocketchat-desktop
-          thunderbird
-          telegram-desktop # telegram
-          # schildichat-desktop # not updated regularly
-          nheko
-          evince # Simple pdf reader, good for focusing on document content
-          firefox
-          vivaldi
-          # geogebra
-          cheese
-          handbrake
-          # kitty # Terminal, already available as feature
-          libnotify
-          libreoffice
-          mate.engrampa
-          nomacs # Image viewer
-          kdePackages.okular # Pdf reader with many features, good for commenting documents
-          pavucontrol
-          qalculate-gtk # Nice gui calculator
-          qpdfview
-          # qutebrowser
-          # realvnc-vnc-viewer
-          # rustdesk
-          tor-browser
-          # frajul.pob-dev-version # Path of Building
-          vlc
-          wineWowPackages.stable # 32-bit and 64-bit wine
-          winetricks
-          xclip # x11 clipboard access from terminal
-          xfce.mousepad # simple text editor
-          xournalpp # Edit pdf files
-          zoom-us # Video conferencing
-          zotero # Manage papers and other sources
-          pdfpc # Present slides in pdf form
-        ];
-      };
-      programs = {
-        home-manager.enable = true;
-        git.enable = true;
-      };
-    };
-  };
-}

flake.nix

@@ -36,9 +36,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    flake-parts.url = "github:hercules-ci/flake-parts";
-    import-tree.url = "github:vic/import-tree";
-
     # Various flakes
     yazi-flavors = {
       url = "github:yazi-rs/flavors";
@@ -64,163 +61,120 @@
     };
   };
 
-  outputs = inputs:
+  outputs = {
-    inputs.flake-parts.lib.mkFlake {inherit inputs;} (inputs.import-tree
+    self,
-      [
+    nixpkgs,
-        ./hosts
+    home-manager,
-        ./features-nixos
+    systems,
-        ./homes
+    ...
-        ./features-home-manager
+  } @ inputs: let
-        # ./modules
+    inherit (self) outputs;
-        # ./overlays
+    lib = nixpkgs.lib // home-manager.lib;
-        # ./packages
+    forEachSystem = f: lib.genAttrs (import systems) (system: f pkgsFor.${system});
-      ]);
+    pkgsFor = lib.genAttrs (import systems) (
-  # let
+      system:
-  #   inherit (self) outputs;
+        import nixpkgs {
-  #   lib = nixpkgs.lib // home-manager.lib;
+          inherit system;
-  #   forEachSystem = f: lib.genAttrs (import systems) (system: f pkgsFor.${system});
+          config.allowUnfree = true;
-  #   pkgsFor = lib.genAttrs (import systems) (
+          config.permittedInsecurePackages = [
-  #     system:
+            "olm-3.2.16"
-  #       import nixpkgs {
+          ];
-  #         inherit system;
+          warn-dirty = false;
-  #         config.allowUnfree = true;
+        }
-  #         config.permittedInsecurePackages = [
+    );
-  #           "olm-3.2.16"
+  in {
-  #         ];
+    inherit lib;
-  #         warn-dirty = false;
-  #       }
-  #   );
-  # in {
-  #   inherit lib;
 
-  #   nixosModules = import ./modules/nixos;
+    nixosModules = import ./modules/nixos;
-  #   homeManagerModules = import ./modules/home-manager;
+    homeManagerModules = import ./modules/home-manager;
 
-  #   overlays = import ./overlays {inherit inputs outputs;};
+    overlays = import ./overlays {inherit inputs outputs;};
-  #   # hydraJobs = import ./hydra.nix { inherit inputs outputs; }; # TODO add hydra jobs here?
+    # hydraJobs = import ./hydra.nix { inherit inputs outputs; }; # TODO add hydra jobs here?
 
-  #   packages = forEachSystem (pkgs: import ./pkgs {inherit pkgs;});
+    packages = forEachSystem (pkgs: import ./packages {inherit pkgs;});
-  #   devShells = forEachSystem (pkgs: import ./shell.nix {inherit pkgs;});
+    devShells = forEachSystem (pkgs: import ./shell.nix {inherit pkgs;});
-  #   formatter = forEachSystem (pkgs: pkgs.alejandra); # nix fmt *
+    formatter = forEachSystem (pkgs: pkgs.alejandra); # nix fmt *
 
-  #   nixosConfigurations = {
+    nixosConfigurations = {
-  #     # Main laptop
+      # Main laptop
-  #     aspi = lib.nixosSystem {
+      aspi = lib.nixosSystem {
-  #       modules = [
+        modules = [
-  #         ./hosts/aspi
+          ./hosts/aspi
-  #       ];
+        ];
-  #       specialArgs = {
+        specialArgs = {
-  #         inherit inputs outputs;
+          inherit inputs outputs;
-  #       };
+        };
-  #     };
+      };
-  #     # Piano raspberry pi
+      kardorf = lib.nixosSystem {
-  #     # pianonix = lib.nixosSystem {
+        modules = [./hosts/kardorf];
-  #     #   modules = [./hosts/pianonix];
+        specialArgs = {
-  #     #   specialArgs = {
+          inherit inputs outputs;
-  #     #     inherit inputs outputs;
+        };
-  #     #   };
+      };
-  #     # };
+      builder = lib.nixosSystem {
-  #     kardorf = lib.nixosSystem {
+        modules = [./hosts/builder];
-  #       modules = [./hosts/kardorf];
+        specialArgs = {
-  #       specialArgs = {
+          inherit inputs outputs;
-  #         inherit inputs outputs;
+        };
-  #       };
+      };
-  #     };
+    };
-  #     builder = lib.nixosSystem {
-  #       modules = [./hosts/builder];
-  #       specialArgs = {
-  #         inherit inputs outputs;
-  #       };
-  #     };
-  #   };
 
-  #   # Standalone HM
+    # Standalone HM
-  #   homeConfigurations = {
+    homeConfigurations = {
-  #     # Main laptop
+      # Main laptop
-  #     "julian@aspi" = lib.homeManagerConfiguration {
+      "julian@aspi" = lib.homeManagerConfiguration {
-  #       modules = [
+        modules = [
-  #         ./homes/julian/aspi.nix
+          ./homes/julian/aspi.nix
-  #         ./homes/julian/hm-standalone-config.nix
+          ./homes/julian/hm-standalone-config.nix
-  #       ];
+        ];
-  #       pkgs = pkgsFor.x86_64-linux;
+        pkgs = pkgsFor.x86_64-linux;
-  #       extraSpecialArgs = {
+        extraSpecialArgs = {
-  #         inherit inputs outputs;
+          inherit inputs outputs;
-  #       };
+        };
-  #     };
+      };
-  #     # Media server (RPi)
+      "julian@kardorf" = lib.homeManagerConfiguration {
-  #     # "julian@pianonix" = lib.homeManagerConfiguration {
+        modules = [
-  #     #   modules = [
+          ./homes/julian/kardorf.nix
-  #     #     ./homes/julian/pianonix.nix
+          ./homes/julian/hm-standalone-config.nix
-  #     #     ./homes/julian/hm-standalone-config.nix
+        ];
-  #     #   ];
+        pkgs = pkgsFor.x86_64-linux;
-  #     #   pkgs = pkgsFor.aarch64-linux;
+        extraSpecialArgs = {
-  #     #   extraSpecialArgs = {
+          inherit inputs outputs;
-  #     #     inherit inputs outputs;
+        };
-  #     #   };
+      };
-  #     # };
+      "julian@v3ms" = lib.homeManagerConfiguration {
-  #     "julian@kardorf" = lib.homeManagerConfiguration {
+        modules = [
-  #       modules = [
+          ./homes/julian/v3ms
-  #         ./homes/julian/kardorf.nix
+          ./homes/julian/hm-standalone-config.nix
-  #         ./homes/julian/hm-standalone-config.nix
+        ];
-  #       ];
+        pkgs = pkgsFor.x86_64-linux;
-  #       pkgs = pkgsFor.x86_64-linux;
+        extraSpecialArgs = {
-  #       extraSpecialArgs = {
+          inherit inputs outputs;
-  #         inherit inputs outputs;
+        };
-  #       };
+      };
-  #     };
+      "julian@quickstart" = lib.homeManagerConfiguration {
-  #     "julian@v3ms" = lib.homeManagerConfiguration {
+        modules = [
-  #       modules = [
+          ./homes/julian/quickstart.nix
-  #         ./homes/julian/v3ms
+          ./homes/julian/hm-standalone-config.nix
-  #         ./homes/julian/hm-standalone-config.nix
+        ];
-  #       ];
+        pkgs = pkgsFor.x86_64-linux;
-  #       pkgs = pkgsFor.x86_64-linux;
+        extraSpecialArgs = {
-  #       extraSpecialArgs = {
+          inherit inputs outputs;
-  #         inherit inputs outputs;
+        };
-  #       };
+      };
-  #     };
+    };
-  #     "julian@quickstart" = lib.homeManagerConfiguration {
-  #       modules = [
-  #         ./homes/julian/quickstart.nix
-  #         ./homes/julian/hm-standalone-config.nix
-  #       ];
-  #       pkgs = pkgsFor.x86_64-linux;
-  #       extraSpecialArgs = {
-  #         inherit inputs outputs;
-  #       };
-  #     };
-  #   };
 
-  #   # deploy-rs node configuration
+    # deploy-rs node configuration
-  #   deploy.nodes = {
+    deploy.nodes = {
-  #     # pianonix = {
+      builder = {
-  #     #   hostname = "pianonix.local";
+        hostname = "builder.julian-mutter.de";
-  #     #   profiles.system = {
+        profiles.system = {
-  #     #     sshUser = "root";
+          sshUser = "root";
-  #     #     user = "root";
+          user = "root";
-  #     #     path = inputs.deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.pianonix;
+          path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.builder;
-  #     #     confirmTimeout = 90; # default: 30s; raspberrypi takes a little longer restarting services
+          remoteBuild = true;
-  #     #   };
+        };
-  #     # };
+      };
-
+    };
-  #     builder = {
+  };
-  #       hostname = "builder.julian-mutter.de";
-  #       profiles.system = {
-  #         sshUser = "root";
-  #         user = "root";
-  #         path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.builder;
-  #         remoteBuild = true;
-  #       };
-  #     };
-  #   };
-
-  #   # substitutes: nixos-generate --flake .#pianonix -f sd-aarch64 --system aarch64-linux
-  #   pianonix-image = inputs.nixos-generators.nixosGenerate {
-  #     system = "aarch64-linux";
-  #     format = "sd-aarch64";
-  #     modules = [./hosts/pianonix];
-  #     specialArgs = {
-  #       inherit inputs outputs;
-  #     };
-  #   };
-  # };
 }

homes/julian/features/suites/desktop/default.nix

@@ -52,7 +52,6 @@
     # rustdesk
     tor-browser
     rusty-path-of-building # Path of Building for poe1 and poe2
-    # frajul.pob-dev-version # Path of Building
     vlc
     wineWowPackages.stable # 32-bit and 64-bit wine
     winetricks
@@ -69,6 +68,5 @@
     ## My scripts
     frajul.open-messaging
     frajul.xwacomcalibrate
-    frajul.pob2-frajul
   ];
 }

homes/julian/pianonix.nix

@@ -1,62 +0,0 @@
-{pkgs, ...}: {
-  imports = [
-    ./global
-
-    ./features/fish
-    ./features/topgrade
-    ./features/neovim
-    ./features/wezterm
-    ./features/yazi
-    ./features/gtk
-  ];
-
-  hostName = "pianonix";
-  is-nixos = true;
-  terminal = "wezterm";
-
-  # services.syncthing.tray.enable = true;
-  # services.syncthing.tray.command = "syncthingtray --wait"; # Wait for tray to become available
-
-  home.packages = with pkgs; [
-    music-reader
-    sheet-organizer
-
-    xournalpp
-    musescore
-
-    onboard
-  ];
-
-  programs.firefox = {
-    enable = true;
-
-    profiles.default = {
-      isDefault = true;
-
-      settings = {
-        "browser.startup.homepage" = "https://sheets.julian-mutter.de";
-        "browser.startup.page" = 1; # 0=blank, 1=home page, 3=restore previous session
-      };
-    };
-  };
-
-  programs.chromium = {
-    enable = true;
-
-    # commandLineArgs = [
-    #   "--homepage=https://sheets.julian-mutter.de"
-    #   "--no-first-run"
-    # ];
-  };
-
-  # Autostart link
-  home.file = {
-    # ".config/autostart/sheet-organizer.desktop".source = "${pkgs.sheet-organizer}/share/applications/sheet-organizer.desktop";
-    ".config/autostart/firefox.desktop".source = "${pkgs.firefox}/share/applications/firefox.desktop";
-    ".config/autostart/onboard.desktop".source = "${pkgs.onboard}/share/applications/onboard.desktop";
-    # ".config/autostart/chromium.desktop".source = "${pkgs.chromium}/share/applications/chromium.desktop";
-    ".config/sheet-organizer/config.toml".text = ''
-      working_directory = "/home/julian/Klavier"
-    '';
-  };
-}

hosts/aspi/default.nix

@@ -1,72 +1,60 @@
 {
-  inputs,
+  imports = [
-  self,
+    ./hardware-configuration.nix
-  ...
-}: {
-  flake.nixosConfigurations.aspi = inputs.nixpkgs.lib.nixosSystem {
-    modules = [
-      self.nixosModules.hosts.aspi
-    ];
-  };
 
-  flake.nixosModules.hosts.aspi = {
+    ../common/global
-    imports = [
+    ../common/users/julian
-      ../common/global
+    ../common/optional/binarycaches.nix
-      ../common/users/julian
-      ../common/users/yukari
-      ../common/users/pob
-      ../common/optional/binarycaches.nix
 
-      ../common/optional/remote-builder.nix
+    ../common/optional/remote-builder.nix
-      ../common/optional/boot-efi.nix
+    ../common/optional/boot-efi.nix
 
-      ../common/optional/greetd.nix
+    ../common/optional/greetd.nix
-      ../common/optional/authentication.nix
+    ../common/optional/authentication.nix
-      ../common/optional/pcmanfm.nix
+    ../common/optional/pcmanfm.nix
-      ../common/optional/pipewire.nix
+    ../common/optional/pipewire.nix
 
-      ../common/optional/gamemode.nix
+    ../common/optional/gamemode.nix
-      ../common/optional/virtualbox.nix
+    ../common/optional/virtualbox.nix
 
-      ../common/optional/podman.nix
+    ../common/optional/podman.nix
-      ../common/optional/wireguard.nix
+    ../common/optional/wireguard.nix
-      ../common/optional/wireshark.nix
+    ../common/optional/wireshark.nix
-      ../common/optional/flatpak.nix
+    ../common/optional/flatpak.nix
 
-      ../common/optional/avahi.nix
+    ../common/optional/avahi.nix
-    ];
+  ];
 
-    networking.hostName = "aspi";
+  networking.hostName = "aspi";
-    system.stateVersion = "24.05";
+  system.stateVersion = "24.05";
 
-    # networking.firewall.checkReversePath = false; # Makes wg interface with all ips work
+  # networking.firewall.checkReversePath = false; # Makes wg interface with all ips work
 
-    modules = {
+  modules = {
-      syncthing = {
+    syncthing = {
-        enable = true;
+      enable = true;
-        overrideSettings = false;
+      overrideSettings = false;
-      };
+    };
-      frajulAutoUpgrade = {
+    frajulAutoUpgrade = {
-        enable = true;
+      enable = true;
-        flakePath = "/home/julian/.dotfiles";
+      flakePath = "/home/julian/.dotfiles";
-      };
     };
-
-    programs.hyprland.enable = true;
-    services.desktopManager.plasma6.enable = true;
-
-    services.blueman.enable = true;
-    services.upower.enable = true;
-
-    programs.steam.enable = true;
-
-    # TODO: not working
-    # services.logind.lidSwitch = "lock";
-    # services.logind.lidSwitchDocked = "lock";
-
-    programs.kdeconnect.enable = true;
-
-    # Enable touchpad support
-    services.libinput.enable = true;
   };
+
+  programs.hyprland.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+  services.blueman.enable = true;
+  services.upower.enable = true;
+
+  programs.steam.enable = true;
+
+  # TODO: not working
+  # services.logind.lidSwitch = "lock";
+  # services.logind.lidSwitchDocked = "lock";
+
+  programs.kdeconnect.enable = true;
+
+  # Enable touchpad support
+  services.libinput.enable = true;
 }

hosts/aspi/hardware-configuration.nix

@@ -1,80 +1,78 @@
 {
-  flake.nixosModules.hosts.aspi = {
+  config,
-    config,
+  lib,
-    lib,
+  ...
-    ...
+}: {
-  }: {
+  boot.initrd.availableKernelModules = [
-    boot.initrd.availableKernelModules = [
+    "vmd"
-      "vmd"
+    "xhci_pci"
-      "xhci_pci"
+    "ahci"
-      "ahci"
+    "nvme"
-      "nvme"
+    "usb_storage"
-      "usb_storage"
+    "usbhid"
-      "usbhid"
+    "sd_mod"
-      "sd_mod"
+  ];
-    ];
+  boot.initrd.kernelModules = ["dm-snapshot"];
-    boot.initrd.kernelModules = ["dm-snapshot"];
+  boot.kernelModules = ["kvm-intel"];
-    boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
-    boot.extraModulePackages = [];
+  boot.blacklistedKernelModules = ["pcspkr"]; # Disables "beep"
-    boot.blacklistedKernelModules = ["pcspkr"]; # Disables "beep"
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
-    boot.binfmt.emulatedSystems = ["aarch64-linux"];
 
-    boot.initrd.luks.devices = {
+  boot.initrd.luks.devices = {
-      root = {
+    root = {
-        device = "/dev/disk/by-uuid/a4dc9a2c-725b-4252-8fbb-093a271c31ba";
+      device = "/dev/disk/by-uuid/a4dc9a2c-725b-4252-8fbb-093a271c31ba";
-        preLVM = true;
+      preLVM = true;
-        allowDiscards = true;
+      allowDiscards = true;
-      };
     };
-
-    fileSystems."/" = {
-      device = "/dev/disk/by-uuid/bbc45be3-75f5-40c5-8427-2a425de8422c";
-      fsType = "btrfs";
-      options = [
-        "subvol=root"
-        "compress=zstd"
-      ];
-    };
-
-    fileSystems."/home" = {
-      device = "/dev/disk/by-uuid/bbc45be3-75f5-40c5-8427-2a425de8422c";
-      fsType = "btrfs";
-      options = [
-        "subvol=home"
-        "compress=zstd"
-      ];
-    };
-
-    fileSystems."/nix" = {
-      device = "/dev/disk/by-uuid/bbc45be3-75f5-40c5-8427-2a425de8422c";
-      fsType = "btrfs";
-      options = [
-        "subvol=nix"
-        "compress=zstd"
-        "noatime"
-      ];
-    };
-
-    fileSystems."/boot" = {
-      device = "/dev/disk/by-uuid/7040-F37C";
-      fsType = "vfat";
-    };
-
-    swapDevices = [
-      {device = "/dev/disk/by-uuid/26140b4a-0579-406d-a484-35aa31b32e80";}
-    ];
-
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-    hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-    hardware.nvidia.open = false;
   };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/bbc45be3-75f5-40c5-8427-2a425de8422c";
+    fsType = "btrfs";
+    options = [
+      "subvol=root"
+      "compress=zstd"
+    ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/bbc45be3-75f5-40c5-8427-2a425de8422c";
+    fsType = "btrfs";
+    options = [
+      "subvol=home"
+      "compress=zstd"
+    ];
+  };
+
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/bbc45be3-75f5-40c5-8427-2a425de8422c";
+    fsType = "btrfs";
+    options = [
+      "subvol=nix"
+      "compress=zstd"
+      "noatime"
+    ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/7040-F37C";
+    fsType = "vfat";
+  };
+
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/26140b4a-0579-406d-a484-35aa31b32e80";}
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.nvidia.open = false;
 }

hosts/builder/default.nix

@@ -2,362 +2,352 @@
 # or
 # deploy .#builder
 {
-  inputs,
+  config,
-  self,
+  pkgs,
   ...
 }: {
-  flake.nixosConfigurations.builder = inputs.nixpkgs.lib.nixosSystem {
+  imports = [
-    modules = [
+    ./hardware-configuration.nix
-      self.nixosModules.hosts.builder
+
+    ../common/global/fish.nix # fish for admin
+    ../common/global/locale.nix
+    ../common/global/nix.nix
+    ../common/global/sops.nix
+    ../common/global/root.nix
+  ];
+
+  networking.hostName = "builder";
+  system.stateVersion = "23.11";
+
+  networking.networkmanager.enable = true;
+  networking.nameservers = [
+    "192.168.3.252"
+    "172.30.20.10"
+    "1.1.1.1"
+  ];
+
+  users.mutableUsers = false;
+  users.users.nix = {
+    isNormalUser = true;
+    description = "Nix";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+      "docker"
     ];
   };
 
-  flake.nixosModules.hosts.builder = {
+  nix.settings.experimental-features = [
-    config,
+    "nix-command"
-    pkgs,
+    "flakes"
-    ...
+  ];
-  }: {
+
-    imports = [
+  # Setup binary caches
-      ../common/global/fish.nix # fish for admin
+  nix.settings = {
-      ../common/global/locale.nix
+    substituters = [
-      ../common/global/nix.nix
+      "https://nix-community.cachix.org"
-      ../common/global/sops.nix
+      "https://cache.nixos.org/"
-      ../common/global/root.nix
+      "https://hyprland.cachix.org"
+      "https://devenv.cachix.org"
+    ];
+    trusted-public-keys = [
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+      "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
     ];
 
-    networking.hostName = "builder";
+    trusted-users = ["nix"];
-    system.stateVersion = "23.11";
+    max-jobs = "auto";
+    cores = 0;
 
-    networking.networkmanager.enable = true;
+    # Ensure we can still build when missing-server is not accessible
-    networking.nameservers = [
+    fallback = true;
-      "192.168.3.252"
+  };
-      "172.30.20.10"
+
-      "1.1.1.1"
+  # system.autoUpgrade = {
+  #   enable = true;
+  #   flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
+  #   flags = [
+  #     "--recreate-lock-file" # update lock file
+  #   ];
+  #   dates = "02:13";
+  # };
+
+  # optimize store by hardlinking store files
+  nix.optimise.automatic = true;
+  nix.optimise.dates = ["03:15"];
+
+  # nix.gc.automatic = true;
+  # nix.gc.dates = "daily";
+  # nix.gc.options = "--delete-old";
+
+  # nix.settings.keep-derivations = false;
+  # nix.settings.keep-outputs = true;
+
+  # Garbage collect up to 100 GiB when only 20 GiB storage left
+  nix.extraOptions = ''
+    min-free = ${toString (20 * 1024 * 1024 * 1024)}
+    max-free = ${toString (100 * 1024 * 1024 * 1024)}
+  '';
+
+  nix.nrBuildUsers = 64;
+
+  # prevent memory to get filled
+  systemd.services.nix-daemon.serviceConfig = {
+    MemoryAccounting = true;
+    MemoryMax = "90%";
+    OOMScoreAdjust = 500;
+  };
+
+  # Ollama used by open-webui as llm backend
+  services.ollama = {
+    enable = true;
+    # acceleration = "rocm";
+    openFirewall = true;
+  };
+
+  services.nextjs-ollama-llm-ui = {
+    enable = true;
+    hostname = "192.168.3.118";
+    port = 3001;
+  };
+  # services.open-webui = {
+  #   enable = true;
+  #   port = 8080;
+  #   openFirewall = true;
+  #   host = "builder.julian-mutter.de";
+  # };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    3001 # ollama-ui
+  ];
+
+  services.openssh = {
+    enable = true;
+    # require public key authentication for better security
+    settings.PasswordAuthentication = false;
+    settings.KbdInteractiveAuthentication = false;
+    settings.PermitRootLogin = "yes";
+    # Add older algorithms for jenkins ssh-agents-plugin to be compatible
+    settings.Macs = [
+      "hmac-sha2-512-etm@openssh.com"
+      "hmac-sha2-256-etm@openssh.com"
+      "umac-128-etm@openssh.com"
+      "hmac-sha2-512"
+      "hmac-sha2-256"
+      "umac-128@openssh.com"
     ];
+    settings.KexAlgorithms = [
+      "diffie-hellman-group-exchange-sha1"
+      "diffie-hellman-group14-sha1"
+      "mlkem768x25519-sha256"
+      "sntrup761x25519-sha512"
+      "sntrup761x25519-sha512@openssh.com"
+      "curve25519-sha256"
+      "curve25519-sha256@libssh.org"
+      "diffie-hellman-group-exchange-sha256"
+    ];
+  };
+  users.users."root".openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFcS+3d1tNgHmYCjueymCV9Bd2LcJcKGhVobrDe3r0s julian@kardorf"
+  ];
+  users.users."nix".openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAIQ+qMuXvyoxO1DuCR3/x+IQRfSA2WyMuzuotWZjCye root@aspi"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHnfLJnS2SKUs47J0qpLTkk0LQA5quOuAhnxE6yppUDm root@kardorf"
+  ];
 
-    users.mutableUsers = false;
+  # security.pam.sshAgentAuth.enable = true; # enable sudo via ssh
-    users.users.nix = {
+
-      isNormalUser = true;
+  services.hydra = {
-      description = "Nix";
+    enable = true;
-      extraGroups = [
+    hydraURL = "http://hydra.julian-mutter.de"; # externally visible URL
-        "networkmanager"
+    port = 3000;
-        "wheel"
+    notificationSender = "hydra@julian-mutter.de"; # e-mail of hydra service
-        "docker"
+    # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+    # buildMachinesFiles = [ ];
+    # you will probably also want, otherwise *everything* will be built from scratch
+    useSubstitutes = true;
+
+    minimumDiskFree = 5; # in GB
+    minimumDiskFreeEvaluator = 4; # in GB
+  };
+
+  # add builder itself as build machine so system emulation is properly supported
+  # nix.distributedBuilds = true;
+  nix.buildMachines = [
+    {
+      hostName = "localhost";
+      protocol = null;
+      # sshUser = "nix";
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
       ];
-    };
+      maxJobs = 4;
-
+      speedFactor = 3;
-    nix.settings.experimental-features = [
+      supportedFeatures = [
-      "nix-command"
+        "nixos-test"
-      "flakes"
+        "benchmark"
-    ];
+        "big-parallel"
-
+        "kvm"
-    # Setup binary caches
-    nix.settings = {
-      substituters = [
-        "https://nix-community.cachix.org"
-        "https://cache.nixos.org/"
-        "https://hyprland.cachix.org"
-        "https://devenv.cachix.org"
-      ];
-      trusted-public-keys = [
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
       ];
+    }
+  ];
 
-      trusted-users = ["nix"];
+  # Uris allowed as flake inputs, otherwise hydra does not fetch them
-      max-jobs = "auto";
+  nix.settings.allowed-uris = [
-      cores = 0;
+    "github:"
+    "gitlab:"
+    "git+https://github.com/hyprwm/Hyprland"
+    "https://github.com/hyprwm/Hyprland"
+    "https://github"
+    "https://gitlab"
+    "https://gitlab.julian-mutter.de"
+    "git+https://gitlab.julian-mutter.de"
+  ];
 
-      # Ensure we can still build when missing-server is not accessible
+  services.nginx = {
-      fallback = true;
+    enable = true;
-    };
+    recommendedProxySettings = true;
-
+    # recommendedTlsSettings = true;
-    # system.autoUpgrade = {
+    # other Nginx options
-    #   enable = true;
+    virtualHosts."hydra.julian-mutter.de" = {
-    #   flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
+      # enableACME = true;
-    #   flags = [
+      # forceSSL = true;
-    #     "--recreate-lock-file" # update lock file
+      locations."/" = {
-    #   ];
+        proxyPass = "http://127.0.0.1:3000";
-    #   dates = "02:13";
+        # proxyWebsockets = true; # needed if you need to use WebSocket
-    # };
+        # extraConfig =
-
+        #   # required when the target is also TLS server with multiple hosts
-    # optimize store by hardlinking store files
+        #   "proxy_ssl_server_name on;" +
-    nix.optimise.automatic = true;
+        #   # required when the server wants to use HTTP Authentication
-    nix.optimise.dates = ["03:15"];
+        #   "proxy_pass_header Authorization;"
-
+        #   ;
-    # nix.gc.automatic = true;
-    # nix.gc.dates = "daily";
-    # nix.gc.options = "--delete-old";
-
-    # nix.settings.keep-derivations = false;
-    # nix.settings.keep-outputs = true;
-
-    # Garbage collect up to 100 GiB when only 20 GiB storage left
-    nix.extraOptions = ''
-      min-free = ${toString (20 * 1024 * 1024 * 1024)}
-      max-free = ${toString (100 * 1024 * 1024 * 1024)}
-    '';
-
-    nix.nrBuildUsers = 64;
-
-    # prevent memory to get filled
-    systemd.services.nix-daemon.serviceConfig = {
-      MemoryAccounting = true;
-      MemoryMax = "90%";
-      OOMScoreAdjust = 500;
-    };
-
-    # Ollama used by open-webui as llm backend
-    services.ollama = {
-      enable = true;
-      # acceleration = "rocm";
-      openFirewall = true;
-    };
-
-    services.nextjs-ollama-llm-ui = {
-      enable = true;
-      hostname = "192.168.3.118";
-      port = 3001;
-    };
-    # services.open-webui = {
-    #   enable = true;
-    #   port = 8080;
-    #   openFirewall = true;
-    #   host = "builder.julian-mutter.de";
-    # };
-
-    networking.firewall.allowedTCPPorts = [
-      80
-      3001 # ollama-ui
-    ];
-
-    services.openssh = {
-      enable = true;
-      # require public key authentication for better security
-      settings.PasswordAuthentication = false;
-      settings.KbdInteractiveAuthentication = false;
-      settings.PermitRootLogin = "yes";
-      # Add older algorithms for jenkins ssh-agents-plugin to be compatible
-      settings.Macs = [
-        "hmac-sha2-512-etm@openssh.com"
-        "hmac-sha2-256-etm@openssh.com"
-        "umac-128-etm@openssh.com"
-        "hmac-sha2-512"
-        "hmac-sha2-256"
-        "umac-128@openssh.com"
-      ];
-      settings.KexAlgorithms = [
-        "diffie-hellman-group-exchange-sha1"
-        "diffie-hellman-group14-sha1"
-        "mlkem768x25519-sha256"
-        "sntrup761x25519-sha512"
-        "sntrup761x25519-sha512@openssh.com"
-        "curve25519-sha256"
-        "curve25519-sha256@libssh.org"
-        "diffie-hellman-group-exchange-sha256"
-      ];
-    };
-    users.users."root".openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFcS+3d1tNgHmYCjueymCV9Bd2LcJcKGhVobrDe3r0s julian@kardorf"
-    ];
-    users.users."nix".openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFjSZYdoF/51F+ykcBAYVCzCPTF5EEigWBL1APiR0h+H julian@aspi"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAIQ+qMuXvyoxO1DuCR3/x+IQRfSA2WyMuzuotWZjCye root@aspi"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHnfLJnS2SKUs47J0qpLTkk0LQA5quOuAhnxE6yppUDm root@kardorf"
-    ];
-
-    # security.pam.sshAgentAuth.enable = true; # enable sudo via ssh
-
-    services.hydra = {
-      enable = true;
-      hydraURL = "http://hydra.julian-mutter.de"; # externally visible URL
-      port = 3000;
-      notificationSender = "hydra@julian-mutter.de"; # e-mail of hydra service
-      # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
-      # buildMachinesFiles = [ ];
-      # you will probably also want, otherwise *everything* will be built from scratch
-      useSubstitutes = true;
-
-      minimumDiskFree = 5; # in GB
-      minimumDiskFreeEvaluator = 4; # in GB
-    };
-
-    # add builder itself as build machine so system emulation is properly supported
-    # nix.distributedBuilds = true;
-    nix.buildMachines = [
-      {
-        hostName = "localhost";
-        protocol = null;
-        # sshUser = "nix";
-        systems = [
-          "x86_64-linux"
-          "aarch64-linux"
-        ];
-        maxJobs = 4;
-        speedFactor = 3;
-        supportedFeatures = [
-          "nixos-test"
-          "benchmark"
-          "big-parallel"
-          "kvm"
-        ];
-      }
-    ];
-
-    # Uris allowed as flake inputs, otherwise hydra does not fetch them
-    nix.settings.allowed-uris = [
-      "github:"
-      "gitlab:"
-      "git+https://github.com/hyprwm/Hyprland"
-      "https://github.com/hyprwm/Hyprland"
-      "https://github"
-      "https://gitlab"
-      "https://gitlab.julian-mutter.de"
-      "git+https://gitlab.julian-mutter.de"
-    ];
-
-    services.nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      # recommendedTlsSettings = true;
-      # other Nginx options
-      virtualHosts."hydra.julian-mutter.de" = {
-        # enableACME = true;
-        # forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:3000";
-          # proxyWebsockets = true; # needed if you need to use WebSocket
-          # extraConfig =
-          #   # required when the target is also TLS server with multiple hosts
-          #   "proxy_ssl_server_name on;" +
-          #   # required when the server wants to use HTTP Authentication
-          #   "proxy_pass_header Authorization;"
-          #   ;
-        };
-      };
-
-      virtualHosts."binarycache.julian-mutter.de" = {
-        locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
-      };
-
-      clientMaxBodySize = "2G";
-      virtualHosts."cache.julian-mutter.de" = {
-        locations."/".proxyPass = "http://127.0.0.1:8080";
       };
     };
 
-    # =========== Gitea actions ==========
+    virtualHosts."binarycache.julian-mutter.de" = {
-    services.gitea-actions-runner.instances."builder" = {
+      locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
-      enable = true;
-      url = "https://gitlab.julian-mutter.de";
-      name = "builder";
-      tokenFile = config.sops.secrets."gitea_token".path;
-      labels = [
-        # provide a debian base with nodejs for actions
-        "debian-latest:docker://node:18-bullseye"
-        # fake the ubuntu name, because node provides no ubuntu builds
-        "ubuntu-latest:docker://node:18-bullseye"
-        # devenv
-        "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
-        # provide native execution on the host
-        "nixos:host"
-      ];
     };
 
-    virtualisation.docker.enable = true;
+    clientMaxBodySize = "2G";
-
+    virtualHosts."cache.julian-mutter.de" = {
-    # TODO: podman fails with: "cannot resolve hostname"
+      locations."/".proxyPass = "http://127.0.0.1:8080";
-    # virtualisation.podman = {
-    #   enable = true;
-    #   dockerCompat = true;
-    #   defaultNetwork.settings.dns_enabled = true;
-    # };
-
-    sops.secrets."gitea_token" = {
-      owner = config.users.users.nix.name;
-      sopsFile = ./secrets.yaml;
     };
+  };
 
-    # =========== Binary Cache ==========
+  # =========== Gitea actions ==========
-    services.nix-serve = {
+  services.gitea-actions-runner.instances."builder" = {
-      enable = true;
+    enable = true;
-      secretKeyFile = "/var/cache-priv-key.pem";
+    url = "https://gitlab.julian-mutter.de";
-    };
+    name = "builder";
+    tokenFile = config.sops.secrets."gitea_token".path;
+    labels = [
+      # provide a debian base with nodejs for actions
+      "debian-latest:docker://node:18-bullseye"
+      # fake the ubuntu name, because node provides no ubuntu builds
+      "ubuntu-latest:docker://node:18-bullseye"
+      # devenv
+      "devenv:docker://ghcr.io/cachix/devenv/devenv:latest"
+      # provide native execution on the host
+      "nixos:host"
+    ];
+  };
 
-    # =========== Binary Cache with attic ==========
+  virtualisation.docker.enable = true;
-    sops.secrets."attic_token".sopsFile = ./secrets.yaml;
 
-    services.atticd = {
+  # TODO: podman fails with: "cannot resolve hostname"
-      enable = true;
+  # virtualisation.podman = {
-      environmentFile = config.sops.secrets."attic_token".path;
+  #   enable = true;
-      settings = {
+  #   dockerCompat = true;
-        listen = "[::]:8080";
+  #   defaultNetwork.settings.dns_enabled = true;
+  # };
 
-        jwt = {};
+  sops.secrets."gitea_token" = {
+    owner = config.users.users.nix.name;
+    sopsFile = ./secrets.yaml;
+  };
 
-        # Data chunking
+  # =========== Binary Cache ==========
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = "/var/cache-priv-key.pem";
+  };
+
+  # =========== Binary Cache with attic ==========
+  sops.secrets."attic_token".sopsFile = ./secrets.yaml;
+
+  services.atticd = {
+    enable = true;
+    environmentFile = config.sops.secrets."attic_token".path;
+    settings = {
+      listen = "[::]:8080";
+
+      jwt = {};
+
+      # Data chunking
+      #
+      # Warning: If you change any of the values here, it will be
+      # difficult to reuse existing chunks for newly-uploaded NARs
+      # since the cutpoints will be different. As a result, the
+      # deduplication ratio will suffer for a while after the change.
+      chunking = {
+        # The minimum NAR size to trigger chunking
         #
-        # Warning: If you change any of the values here, it will be
+        # If 0, chunking is disabled entirely for newly-uploaded NARs.
-        # difficult to reuse existing chunks for newly-uploaded NARs
+        # If 1, all NARs are chunked.
-        # since the cutpoints will be different. As a result, the
+        nar-size-threshold = 64 * 1024; # 64 KiB
-        # deduplication ratio will suffer for a while after the change.
-        chunking = {
-          # The minimum NAR size to trigger chunking
-          #
-          # If 0, chunking is disabled entirely for newly-uploaded NARs.
-          # If 1, all NARs are chunked.
-          nar-size-threshold = 64 * 1024; # 64 KiB
 
-          # The preferred minimum size of a chunk, in bytes
+        # The preferred minimum size of a chunk, in bytes
-          min-size = 16 * 1024; # 16 KiB
+        min-size = 16 * 1024; # 16 KiB
 
-          # The preferred average size of a chunk, in bytes
+        # The preferred average size of a chunk, in bytes
-          avg-size = 64 * 1024; # 64 KiB
+        avg-size = 64 * 1024; # 64 KiB
 
-          # The preferred maximum size of a chunk, in bytes
+        # The preferred maximum size of a chunk, in bytes
-          max-size = 256 * 1024; # 256 KiB
+        max-size = 256 * 1024; # 256 KiB
-        };
       };
     };
+  };
 
-    services.gitlab-runner.enable = true;
+  services.gitlab-runner.enable = true;
-    # runner for everything else
+  # runner for everything else
-    #
+  #
-    sops.secrets."gitlab_runner_token".sopsFile = ./secrets.yaml;
+  sops.secrets."gitlab_runner_token".sopsFile = ./secrets.yaml;
-    services.gitlab-runner.services.default = {
+  services.gitlab-runner.services.default = {
-      # File should contain at least these two variables:
+    # File should contain at least these two variables:
-      authenticationTokenConfigFile = config.sops.secrets."gitlab_runner_token".path;
+    authenticationTokenConfigFile = config.sops.secrets."gitlab_runner_token".path;
-      dockerImage = "alpine:latest";
+    dockerImage = "alpine:latest";
-      dockerVolumes = [
+    dockerVolumes = [
-        "/var/run/docker.sock:/var/run/docker.sock"
+      "/var/run/docker.sock:/var/run/docker.sock"
-      ];
+    ];
-    };
+  };
 
-    ### Jenkins node
+  ### Jenkins node
-    users.users.jenkins = {
+  users.users.jenkins = {
-      createHome = true;
+    createHome = true;
-      home = "/var/lib/jenkins";
+    home = "/var/lib/jenkins";
-      group = "jenkins";
+    group = "jenkins";
-      isNormalUser = true;
+    isNormalUser = true;
-      openssh.authorizedKeys.keys = [
+    openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ36sQhVz3kUEi8754G7r3rboihhG4iqFK/UvQm6SING jenkins@home"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ36sQhVz3kUEi8754G7r3rboihhG4iqFK/UvQm6SING jenkins@home"
-      ];
+    ];
-      packages = with pkgs; [
+    packages = with pkgs; [
-        git
+      git
-        devenv
+      devenv
-      ];
+    ];
-      extraGroups = [
+    extraGroups = [
-        "docker"
+      "docker"
-      ];
+    ];
-    };
+  };
 
-    users.groups.jenkins = {};
+  users.groups.jenkins = {};
-    programs.java = {
+  programs.java = {
-      enable = true;
+    enable = true;
-      package = pkgs.jdk21; # Same as jenkins version on home
+    package = pkgs.jdk21; # Same as jenkins version on home
-    };
   };
 }

hosts/builder/hardware-configuration.nix

@@ -1,52 +1,50 @@
-{
+{lib, ...}: {
-  flake.nixosModules.hosts.builder = {lib, ...}: {
+  boot.initrd.availableKernelModules = [
-    boot.initrd.availableKernelModules = [
+    "ata_piix"
-      "ata_piix"
+    "uhci_hcd"
-      "uhci_hcd"
+    "virtio_pci"
-      "virtio_pci"
+    "virtio_scsi"
-      "virtio_scsi"
+    "sd_mod"
-      "sd_mod"
+    "sr_mod"
-      "sr_mod"
+  ];
-    ];
+  # boot.initrd.kernelModules = [ "amdgpu" ]; # GPU support
-    # boot.initrd.kernelModules = [ "amdgpu" ]; # GPU support
+  boot.kernelModules = [];
-    boot.kernelModules = [];
+  boot.extraModulePackages = [];
-    boot.extraModulePackages = [];
 
-    fileSystems."/" = {
+  fileSystems."/" = {
-      device = "/dev/disk/by-uuid/f088fe8e-bf3d-4a89-98bd-ead9852d381f";
+    device = "/dev/disk/by-uuid/f088fe8e-bf3d-4a89-98bd-ead9852d381f";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
-
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
-
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
-    # hardware.graphics = {
-    #   enable = true;
-    #   extraPackages = with pkgs; [
-    #     rocmPackages.clr.icd
-    #     linuxPackages.amdgpu-pro
-    #   ];
-    # };
-
-    # boot.kernelParams = [
-    #   "radeon.si_support=0"
-    #   "radeon.cik_support=1"
-    #   "amdgpu.si_support=0"
-    #   "amdgpu.cik_support=1"
-    # ];
-    # boot.extraModulePackages = with config.boot.kernelPackages; [ amdgpu-pro ];
-    # boot.blacklistedKernelModules = [ "radeon" ];
-
-    boot.loader.grub.enable = true;
-    boot.loader.grub.device = "/dev/sda";
-
-    # Emulated systems used as alternative to cross-compiling
-    boot.binfmt.emulatedSystems = ["aarch64-linux"];
   };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  # hardware.graphics = {
+  #   enable = true;
+  #   extraPackages = with pkgs; [
+  #     rocmPackages.clr.icd
+  #     linuxPackages.amdgpu-pro
+  #   ];
+  # };
+
+  # boot.kernelParams = [
+  #   "radeon.si_support=0"
+  #   "radeon.cik_support=1"
+  #   "amdgpu.si_support=0"
+  #   "amdgpu.cik_support=1"
+  # ];
+  # boot.extraModulePackages = with config.boot.kernelPackages; [ amdgpu-pro ];
+  # boot.blacklistedKernelModules = [ "radeon" ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+
+  # Emulated systems used as alternative to cross-compiling
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
 }