+AZ-LPT-100

hosts/AZ-LPT-100/configuration.nix

@@ -0,0 +1,127 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+{
+  config,
+  pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.initrd.kernelModules = ["amdgpu" "hid_asus"];
+  boot.kernelPackages = pkgs.linuxPackages_6_16;
+  boot.extraModprobeConfig = ''
+    options hid_asus enable_touchpad=1
+  '';
+  services.xserver.videoDrivers = ["amdgpu"];
+  security.polkit.enable = true;
+  security.pam.services.gdm.enableGnomeKeyring = true;
+  networking.hostName = "AZ-LPT-100";
+
+  # Define your hostname.
+  # warp-terminal update fix
+  # networking.extraHosts = ''
+  #   127.0.0.1 releases.warp.dev
+  #   127.0.0.1 app.warp.dev
+  # '';
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable =
+    true; # Easiest to use and most distros use this by default.
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "de_DE.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Enable the GNOME Desktop Environment.
+  # services.xserver.displayManager.gdm.enable = true;
+  # services.xserver.desktopManager.gnome.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # hardware.pulseaudio.enable = true;
+  # OR
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [asusctl git];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+    settings = {
+      PasswordAuthentication = true;
+    };
+  };
+  services.fstrim.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/AZ-LPT-100/default.nix

@@ -0,0 +1,98 @@
+{
+  inputs,
+  outputs,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    # Import only the parts we need from common, avoiding Home Manager conflicts
+    ../common/extraServices
+    ./configuration.nix
+    ./hardware.nix
+    ./programs.nix
+    ./secrets.nix
+    ./services
+    # Import unstable Home Manager directly
+    inputs.home-manager-unstable.nixosModules.home-manager
+  ];
+
+  # Create the user directly here
+  users.users."sascha.koenig" = {
+    hashedPassword = "$y$j9T$ORX4btVZgs9Xjq2oIvzJm0$lXiPwaa0D6t.eMDIx1UBesEAMOkWXBoGwpeI7X0aS8D";
+    isNormalUser = true;
+    group = "sascha.koenig";
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "libvirtd"
+      "flatpak"
+      "plugdev"
+      "input"
+      "kvm"
+      "qemu-libvirtd"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml sascha.koenig@azintec.com"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@MBP-Sascha.fritz.box"
+    ];
+    packages = [inputs.home-manager-unstable.packages.${pkgs.system}.default];
+  };
+  users.groups."sascha.koenig" = {};
+
+  # Configure Home Manager with unstable
+  home-manager = {
+    useUserPackages = true;
+    extraSpecialArgs = {inherit inputs outputs;};
+    users."sascha.koenig" = import ../../home/sascha.koenig/AZ-LPT-100.nix;
+  };
+
+  # Configure nixpkgs to use unstable
+  nixpkgs = {
+    overlays = [
+      outputs.overlays.additions
+      outputs.overlays.modifications
+      # Add stable as an overlay since base is unstable
+      (final: _prev: {
+        stable = import inputs.nixpkgs {
+          system = final.system;
+          config.allowUnfree = true;
+        };
+      })
+    ];
+    config = {
+      allowUnfree = true;
+    };
+  };
+
+  # Copy nix settings from common
+  nix = {
+    settings = {
+      experimental-features = "nix-command flakes";
+      trusted-users = [
+        "root"
+        "sascha.koenig"
+      ];
+    };
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 30d";
+    };
+    optimise.automatic = true;
+    registry =
+      (lib.mapAttrs (_: flake: {inherit flake;}))
+      ((lib.filterAttrs (_: lib.isType "flake")) (inputs
+        // {
+          # Use unstable nixpkgs in registry
+          nixpkgs = inputs.nixpkgs-unstable;
+        }));
+    nixPath = ["/etc/nix/path"];
+  };
+
+  extraServices = {
+    flatpak.enable = true;
+    ollama.enable = true;
+    podman.enable = true;
+    virtualisation.enable = true;
+  };
+}

hosts/AZ-LPT-100/hardware-configuration.nix

@@ -0,0 +1,68 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "thunderbolt" "usbhid" "usb_storage" "sd_mod" "sdhci_pci"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=root" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=home" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=nix" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=persist" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/var/log" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=log" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/89EE-C4CE";
+    fsType = "vfat";
+    options = ["fmask=0022" "dmask=0022"];
+  };
+
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/7e78ee33-a051-439a-80aa-635d0ab698e4";}
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp194s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/AZ-LPT-100/hardware.nix

@@ -0,0 +1,8 @@
+{
+  hardware = {
+    amdgpu.opencl.enable = true;
+    bluetooth.enable = true;
+    keyboard.zsa.enable = true;
+    graphics.enable = true;
+  };
+}

hosts/AZ-LPT-100/programs.nix

@@ -0,0 +1,41 @@
+{pkgs, ...}: {
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    # Add any missing dynamic libraries for unpackaged programs
+    # here, NOT in environment.systemPackages
+  ];
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+    withUWSM = true;
+  };
+  programs.fish.enable = true;
+  programs.thunar = {
+    enable = true;
+    plugins = with pkgs.xfce; [thunar-archive-plugin thunar-volman];
+  };
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-gnome3;
+    settings = {default-cache-ttl = 10800;};
+  };
+  programs.obs-studio = {
+    enable = true;
+    enableVirtualCamera = true;
+    plugins = with pkgs.obs-studio-plugins; [
+      obs-composite-blur
+      obs-vaapi
+      # obs-vertical-canvas
+      obs-vkcapture
+      obs-webkitgtk
+      wlrobs
+    ];
+  };
+  programs.nh = {
+    enable = true;
+    clean.enable = true;
+    clean.extraArgs = "--keep-since 4d --keep 3";
+    flake = "/home/m3tam3re/p/nixos/nixos-config";
+  };
+}

hosts/AZ-LPT-100/secrets.nix

@@ -0,0 +1 @@
+{}

hosts/AZ-LPT-100/services/ad.nix

@@ -0,0 +1,99 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    adcli # Helper library and tools for Active Directory client operations
+    realmd # Diagnostic command; Does not configure AD client on NixOS
+    samba # Standard Windows interoperability suite of programs for Linux and Unix
+  ];
+
+  #
+  # Security
+  #
+  security = {
+    krb5 = {
+      enable = true;
+      settings = {
+        libdefaults = {
+          udp_preference_limit = 0;
+          default_realm = "AZ-GROUP";
+        };
+      };
+    };
+
+    pam = {
+      makeHomeDir.umask = "077";
+      services.login.makeHomeDir = true;
+      services.sshd.makeHomeDir = true;
+    };
+
+    sudo = {
+      extraConfig = ''
+        %domain\ admins ALL=(ALL:ALL) NOPASSWD: ALL
+        Defaults:%domain\ admins env_keep+=TERMINFO_DIRS
+        Defaults:%domain\ admins env_keep+=TERMINFO
+      '';
+
+      # Use extraConfig because of blank space in 'domain admins'.
+      # Alternatively, you can use the GID.
+      # extraRules = [
+      #   { groups = [ "domain admins" ];
+      #     commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; }  ]; }
+      # ];
+    };
+  };
+
+  #
+  # Services
+  #
+  services = {
+    nscd = {
+      enable = true;
+      config = ''
+        server-user nscd
+        enable-cache hosts yes
+        positive-time-to-live hosts 0
+        negative-time-to-live hosts 0
+        shared hosts yes
+        enable-cache passwd no
+        enable-cache group no
+        enable-cache netgroup no
+        enable-cache services no
+      '';
+    };
+
+    sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        domains = az-group
+        config_file_version = 2
+        services = nss, pam
+
+        [pam]
+        offline_credentials_expiration = 365
+
+        [domain/az-group]
+        override_shell = /run/current-system/sw/bin/zsh
+        krb5_store_password_if_offline = true
+        cache_credentials = true
+        account_cache_expiration = 365
+        entry_cache_timeout = 14400
+        krb5_realm = AZ-GROUP
+        realmd_tags = manages-system joined-with-samba
+        id_provider = ad
+        fallback_homedir = /home/%u
+        ad_domain = az-group
+        use_fully_qualified_names = false
+        ldap_id_mapping = false
+        auth_provider = ad
+        access_provider = ad
+        chpass_provider = ad
+        ad_gpo_access_control = permissive
+        enumerate = true
+      '';
+    };
+  };
+}

hosts/AZ-LPT-100/services/default.nix

@@ -0,0 +1,37 @@
+{
+  imports = [
+    # ./ad.nix
+    ./sound.nix
+    ./udev.nix
+  ];
+  services = {
+    hypridle.enable = true;
+    printing.enable = true;
+    gvfs.enable = true;
+    gnome.gnome-keyring.enable = true;
+    qdrant = {
+      enable = true;
+      settings = {
+        service = {
+          host = "0.0.0.0";
+        };
+      };
+    };
+    upower.enable = true;
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      publish = {
+        addresses = true;
+        workstation = true;
+        userServices = true;
+      };
+    };
+    asusd = {
+      enable = true;
+      enableUserService = true;
+    };
+    desktopManager.gnome.enable = true;
+    displayManager.gdm.enable = true;
+  };
+}

hosts/AZ-LPT-100/services/sound.nix

@@ -0,0 +1,11 @@
+{
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = false;
+    wireplumber.enable = true;
+  };
+}

hosts/AZ-LPT-100/services/udev.nix

@@ -0,0 +1,8 @@
+{pkgs, ...}: {
+  services.udev.extraRules = ''
+    SUBSYSTEM=="usb", MODE="0666"
+  '';
+  environment.systemPackages = with pkgs; [
+    zsa-udev-rules
+  ];
+}