~ajhalili2006's personal configuration for NixOS

configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];

  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.efi.efiSysMountPoint = "/boot/efi";

  networking.hostName = "badtimeswithscar"; # Define your hostname.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking via NetworkManager
  networking.networkmanager.enable = true;
  networking.wireless.enable = false;  # Currently conflicts with NetworkManager.

  # Set your time zone.
  time.timeZone = "Asia/Manila";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_PH.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_PH.UTF-8";
    LC_IDENTIFICATION = "en_PH.UTF-8";
    LC_MEASUREMENT = "en_PH.UTF-8";
    LC_MONETARY = "en_PH.UTF-8";
    LC_NAME = "en_PH.UTF-8";
    LC_NUMERIC = "en_PH.UTF-8";
    LC_PAPER = "en_PH.UTF-8";
    LC_TELEPHONE = "en_PH.UTF-8";
    LC_TIME = "en_PH.UTF-8";
  };

  # Enable the X11 windowing system.
  services.xserver.enable = true;

  # Enable the KDE Plasma Desktop Environment.
  services.xserver.displayManager.sddm.enable = true;
  services.xserver.desktopManager.plasma5.enable = true;

  # Configure keymap in X11
  services.xserver = {
    layout = "us";
    xkbVariant = "";
  };

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable sound with pipewire.
  sound.enable = true;
  hardware.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;

    # use the example session manager (no others are packaged yet so this is enabled by default,
    # no need to redefine it in your config for now)
    #media-session.enable = true;
  };

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.ajhalili2006 = {
      isNormalUser = true;
      description = "Andrei Jiroh Halili";
      #email = "ajhalili2006@andreijiroh.eu.org"
      extraGroups = [ "networkmanager" "wheel" ];
      packages = with pkgs; [
        libsForQt5.kate
        thunderbird
      ];
      home = "/home/ajhalili2006";
      uid = 1000;
    };
  users.users.sandbox = {
      description = "Development Sandbox Kit";
      #email = "sandbox@andreijiroh.eu.org"
      isNormalUser = true;
    };

  # Don't make my life harder on password resets
  users.mutableUsers = true;

  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
    wget
    keychain
    nano
    #git # uses pkgs.gitFull instead
    pinentry-qt
    tailscale
    firefox
    keybase
    keybase-gui
    kbfs
  ];

  # install the full Git package
  programs.git.package = pkgs.gitFull;

  # enable htop
  programs.htop.enable = true;

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  programs.mtr.enable = true;
  programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;
     pinentryFlavor = "qt"; # https://discourse.nixos.org/t/cant-get-gnupg-to-work-no-pinentry/15373/?u=ajhalili2006
  };

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  # https://discourse.nixos.org/t/cant-get-gnupg-to-work-no-pinentry/15373/4?u=ajhalili2006
  services.dbus.packages = [ pkgs.gcr ];

  # make sure tailscale is enabled
  services.tailscale = { enable = true; };

  # Keybase specifics needed for GUI to work
  services.keybase.enable = true;
  services.kbfs.enable = true;
  services.kbfs.enableRedirector = true;
  services.kbfs.mountPoint = "/keybase";

  # Open ports in the firewall.
  networking.firewall = {
    enable = true;
    trustedInterfaces = [ "tailscale0" ];

    # Strict reverse path filtering breaks Tailscale exit node use and some subnet routing setups.
    checkReversePath = "loose";

    allowedTCPPorts = [
      22 # friendly reminder: use pubkey authentication instead OR ramp up password requirements
      3000
      8000
      8456 # custom port for QBitorrent remote admin page for fun
      8080
    ];
    allowedUDPPorts = [
      3000
      8000
      8080
      config.services.tailscale.port
   ];
  };

  # nix settings
  nix = {
    settings = {
      allowed-users = [ "@wheel" ];
      trusted-users = [ "root" "@wheel" ];
      experimental-features = [ "nix-command" "flakes" ];
    };
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "22.11"; # Did you read the comment?

}

hardware-configuration.nix

# Do not modify this file!  It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations.  Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:

{
  imports =
    [ (modulesPath + "/installer/scan/not-detected.nix")
    ];

  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" ];
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];
  boot.supportedFilesystems = [ "ntfs" ];

  fileSystems."/" = {
      device = "/dev/disk/by-uuid/87d46439-e31f-486c-b69a-55bb3b9f14fb";
      fsType = "ext4";
    };
   fileSystems."/boot/efi" ={
      device = "/dev/disk/by-uuid/7A5E-8E07";
      fsType = "vfat";
    };
   fileSystems."/home" ={
      device = "/dev/disk/by-uuid/3a579aa7-c081-4e22-87bc-93d2d9b9d281";
      fsType = "ext4";
    };
  fileSystems."/mnt/windows" =
    { device = "/dev/disk/by-uuid/443A79033A78F2F2";
      fsType = "ntfs3";
      options = [ "rw" "uid=1000"];
    };

  swapDevices = [ ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
  # networking.interfaces.wlp0s20u1.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}