chore: hostname AZLT124-L changed to AZ-LT-NIX

hosts/AZ-LT-NIX/configuration.nix

@@ -0,0 +1,165 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+{
+  config,
+  pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+  ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.initrd.kernelModules = ["amdgpu" "hid_asus"];
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelParams = ["pcie_aspm=off" "pcie_port_pm=off"];
+  boot.extraModprobeConfig = ''
+    options hid_asus enable_touchpad=1
+    options mt7925e disable_aspm=1
+    options mt7925_common disable_clc=1
+  '';
+  services.xserver.videoDrivers = ["amdgpu"];
+  security.polkit.enable = true;
+  security.pam.services.gdm.enableGnomeKeyring = true;
+  networking = {
+    wireless.iwd = {
+      enable = true;
+      settings = {
+        Settings = {
+          Timers = "DefaultRoamThreshold=30";
+        };
+        General = {
+          AddressRandomization = "network";
+        };
+      };
+    };
+    networkmanager = {
+      enable = true;
+      wifi = {
+        backend = "iwd";
+        powersave = false;
+      };
+    };
+    hostName = "AZ-LT-NIX";
+  };
+  systemd.services.disable-wifi-powersave = {
+    description = "Disable WiFi power save";
+    after = ["network-online.target" "iwd.service"];
+    wants = ["network-online.target"];
+    wantedBy = ["multi-user.target"];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = ''
+        ${pkgs.bash}/bin/bash -c 'for i in {1..30}; do \
+          ${pkgs.iw}/bin/iw dev wlan0 set power_save off 2>/dev/null && exit 0; \
+          sleep 1; \
+        done; exit 1'
+      '';
+      Restart = "on-failure";
+      RestartSec = "10s";
+    };
+  };
+  # Define your hostname.
+  # warp-terminal update fix
+  # networking.extraHosts = ''
+  #   127.0.0.1 releases.warp.dev
+  #   127.0.0.1 app.warp.dev
+  # '';
+  # Pick only one of the below networking options.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "de_DE.UTF-8";
+
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Enable the GNOME Desktop Environment.
+  # services.xserver.displayManager.gdm.enable = true;
+  # services.xserver.desktopManager.gnome.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # hardware.pulseaudio.enable = true;
+  # OR
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [asusctl git];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+    settings = {
+      PasswordAuthentication = true;
+    };
+  };
+  services.fstrim.enable = true;
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [8080];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/AZ-LT-NIX/default.nix

@@ -0,0 +1,102 @@
+{
+  inputs,
+  outputs,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    # Import only the parts we need from common, avoiding Home Manager conflicts
+    ../common/extraServices
+    ./configuration.nix
+    ./hardware.nix
+    ./programs.nix
+    ./secrets.nix
+    ./services
+    # Import unstable Home Manager directly
+    inputs.home-manager-unstable.nixosModules.home-manager
+  ];
+
+  # Create the user directly here
+  users.users."sascha.koenig" = {
+    hashedPassword = "$y$j9T$ORX4btVZgs9Xjq2oIvzJm0$lXiPwaa0D6t.eMDIx1UBesEAMOkWXBoGwpeI7X0aS8D";
+    isNormalUser = true;
+    shell = pkgs.nushell;
+    group = "sascha.koenig";
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "libvirtd"
+      "flatpak"
+      "plugdev"
+      "input"
+      "kvm"
+      "qemu-libvirtd"
+    ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml sascha.koenig@azintec.com"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@MBP-Sascha.fritz.box"
+    ];
+    packages = [inputs.home-manager-unstable.packages.${pkgs.stdenv.hostPlatform.system}.default];
+  };
+  users.groups."sascha.koenig" = {};
+
+  # Configure Home Manager with unstable
+  home-manager = {
+    useUserPackages = true;
+    extraSpecialArgs = {
+      inherit inputs outputs;
+      system = "x86_64-linux";
+    };
+    users."sascha.koenig" = import ../../home/users/sascha.koenig/AZ-LT-NIX.nix;
+  };
+
+  # Configure nixpkgs to use unstable
+  nixpkgs = {
+    overlays = [
+      outputs.overlays.additions
+      outputs.overlays.modifications
+      # Add stable as an overlay since base is unstable
+      (final: _prev: {
+        stable = import inputs.nixpkgs {
+          system = final.stdenv.hostPlatform.system;
+          config.allowUnfree = true;
+        };
+      })
+    ];
+    config = {
+      allowUnfree = true;
+    };
+  };
+
+  # Copy nix settings from common
+  nix = {
+    settings = {
+      experimental-features = "nix-command flakes";
+      trusted-users = [
+        "root"
+        "sascha.koenig"
+      ];
+    };
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 30d";
+    };
+    optimise.automatic = true;
+    registry =
+      (lib.mapAttrs (_: flake: {inherit flake;}))
+      ((lib.filterAttrs (_: lib.isType "flake")) (inputs
+        // {
+          # Use unstable nixpkgs in registry
+          nixpkgs = inputs.nixpkgs-unstable;
+        }));
+    nixPath = ["/etc/nix/path"];
+  };
+
+  extraServices = {
+    flatpak.enable = true;
+    ollama.enable = true;
+    podman.enable = true;
+    virtualisation.enable = true;
+  };
+}

hosts/AZ-LT-NIX/hardware-configuration.nix

@@ -0,0 +1,68 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "thunderbolt" "usbhid" "usb_storage" "sd_mod" "sdhci_pci"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=root" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=home" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=nix" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=persist" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/var/log" = {
+    device = "/dev/disk/by-uuid/9fcbe547-12dc-467d-a0e2-cefeedaf28d9";
+    fsType = "btrfs";
+    options = ["subvol=log" "compress=zstd" "noatime" "ssd" "discard=async"];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/89EE-C4CE";
+    fsType = "vfat";
+    options = ["fmask=0022" "dmask=0022"];
+  };
+
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/7e78ee33-a051-439a-80aa-635d0ab698e4";}
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp194s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/AZ-LT-NIX/hardware.nix

@@ -0,0 +1,8 @@
+{
+  hardware = {
+    amdgpu.opencl.enable = true;
+    bluetooth.enable = true;
+    keyboard.zsa.enable = true;
+    graphics.enable = true;
+  };
+}

hosts/AZ-LT-NIX/programs.nix

@@ -0,0 +1,42 @@
+{pkgs, ...}: {
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    # Add any missing dynamic libraries for unpackaged programs
+    # here, NOT in environment.systemPackages
+  ];
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+    withUWSM = true;
+  };
+  programs.fish.enable = true;
+  programs.thunar = {
+    enable = true;
+    plugins = with pkgs; [thunar-archive-plugin thunar-volman];
+  };
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-gnome3;
+    settings = {default-cache-ttl = 10800;};
+  };
+  programs.obs-studio = {
+    enable = true;
+    enableVirtualCamera = true;
+    plugins = with pkgs.obs-studio-plugins; [
+      obs-composite-blur
+      obs-vaapi
+      # obs-vertical-canvas
+      obs-vkcapture
+      wlrobs
+    ];
+  };
+  programs.nh = {
+    enable = true;
+    clean.enable = true;
+    clean.extraArgs = "--keep-since 4d --keep 3";
+    flake = "/home/m3tam3re/p/nixos/nixos-config";
+  };
+  services.netbird.enable = true;
+  environment.systemPackages = [pkgs.netbird-ui];
+}

hosts/AZ-LT-NIX/secrets.nix

@@ -0,0 +1,22 @@
+{
+  age = {
+    secrets = {
+      outline-key = {
+        file = ../../secrets/outline-key.age;
+        owner = "sascha.koenig";
+      };
+      ref-key = {
+        file = ../../secrets/ref-key.age;
+        owner = "sascha.koenig";
+      };
+      exa-key = {
+        file = ../../secrets/exa-key.age;
+        owner = "sascha.koenig";
+      };
+      kestractl-env = {
+        file = ../../secrets/kestractl-env.age;
+        owner = "sascha.koenig";
+      };
+    };
+  };
+}

hosts/AZ-LT-NIX/services/ad.nix

@@ -0,0 +1,114 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    adcli # Helper library and tools for Active Directory client operations
+    oddjob # Odd Job Daemon
+    samba4Full # Standard Windows interoperability suite of programs for Linux and Unix
+    sssd # System Security Services Daemon
+    krb5 # MIT Kerberos 5
+    realmd # DBus service for configuring Kerberos and other
+  ];
+
+  #
+  # Security
+  #
+  security = {
+    krb5 = {
+      enable = true;
+      settings = {
+        libdefaults = {
+          udp_preference_limit = 0;
+          default_realm = "AZ-GROUP";
+        };
+      };
+    };
+
+    pam = {
+      makeHomeDir.umask = "077";
+      services.login.makeHomeDir = true;
+      services.sshd.makeHomeDir = true;
+    };
+
+    sudo = {
+      extraConfig = ''
+        %domain\ admins ALL=(ALL:ALL) NOPASSWD: ALL
+        Defaults:%domain\ admins env_keep+=TERMINFO_DIRS
+        Defaults:%domain\ admins env_keep+=TERMINFO
+      '';
+
+      # Use extraConfig because of blank space in 'domain admins'.
+      # Alternatively, you can use the GID.
+      # extraRules = [
+      #   { groups = [ "domain admins" ];
+      #     commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; }  ]; }
+      # ];
+    };
+  };
+
+  #
+  # Services
+  #
+  services = {
+    nscd = {
+      enable = true;
+      config = ''
+        server-user nscd
+        enable-cache hosts yes
+        positive-time-to-live hosts 0
+        negative-time-to-live hosts 0
+        shared hosts yes
+        enable-cache passwd no
+        enable-cache group no
+        enable-cache netgroup no
+        enable-cache services no
+      '';
+    };
+
+    sssd = {
+      enable = true;
+      config = ''
+        [sssd]
+        domains = az-group
+        config_file_version = 2
+        services = nss, pam
+
+        [domain/az-group]
+        override_shell = /run/current-system/sw/bin/zsh
+        krb5_store_password_if_offline = True
+        cache_credentials = True
+        krb5_realm = AZ-GROUP
+        realmd_tags = manages-system joined-with-samba
+        id_provider = ad
+        fallback_homedir = /home/%u
+        ad_domain = your_domain_lowercase
+        use_fully_qualified_names = false
+        ldap_id_mapping = false
+        auth_provider = ad
+        access_provider = ad
+        chpass_provider = ad
+        ad_gpo_access_control = permissive
+        enumerate = true
+      '';
+    };
+  };
+
+  #
+  # Systemd
+  #
+  systemd = {
+    services.realmd = {
+      description = "Realm Discovery Service";
+      wantedBy = ["multi-user.target"];
+      after = ["network.target"];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "org.freedesktop.realmd";
+        ExecStart = "${pkgs.realmd}/libexec/realmd";
+        User = "root";
+      };
+    };
+  };
+}

hosts/AZ-LT-NIX/services/default.nix

@@ -0,0 +1,43 @@
+{pkgs, ...}: {
+  imports = [
+    # ./ad.nix
+    ./mem0.nix
+    ./n8n.nix
+    ./netbird.nix
+    ./sound.nix
+    ./udev.nix
+  ];
+  services = {
+    espanso = {
+      enable = true;
+      package = pkgs.espanso-wayland;
+    };
+    hypridle.enable = true;
+    printing.enable = true;
+    gvfs.enable = true;
+    gnome.gnome-keyring.enable = true;
+    qdrant = {
+      enable = true;
+      settings = {
+        service = {
+          host = "0.0.0.0";
+        };
+      };
+    };
+    upower.enable = true;
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      publish = {
+        addresses = true;
+        workstation = true;
+        userServices = true;
+      };
+    };
+    asusd = {
+      enable = true;
+    };
+    desktopManager.gnome.enable = true;
+    displayManager.gdm.enable = true;
+  };
+}

hosts/AZ-LT-NIX/services/mem0.nix

@@ -0,0 +1,23 @@
+{
+  m3ta.mem0 = {
+    enable = false;
+    port = 8000;
+    host = "127.0.0.1";
+
+    # LLM Configuration
+    llm = {
+      provider = "openai";
+      apiKeyFile = "/var/lib/mem0/openai-api-key-1"; # Use agenix or sops-nix
+    };
+
+    # Vector Storage Configuration
+    vectorStore = {
+      provider = "qdrant"; # or "chroma", "pinecone", etc.
+      config = {
+        host = "localhost";
+        port = 6333;
+        collection_name = "mem0_alice";
+      };
+    };
+  };
+}

hosts/AZ-LT-NIX/services/n8n.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  serviceName = "n8n";
+  portUtils = import ../../../lib/port-utils.nix {inherit lib;};
+  servicePort = portUtils.getPort serviceName "AZLTNIX";
+in {
+  services.${serviceName} = {
+    enable = true;
+    openFirewall = true;
+  };
+  systemd.services.n8n = {
+    environment = {
+      N8N_SECURE_COOKIE = "false";
+      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS = "false";
+    };
+  };
+}

hosts/AZ-LT-NIX/services/netbird.nix

@@ -0,0 +1,28 @@
+{pkgs, ...}: {
+  services.netbird.enable = true;
+
+  systemd.services.netbird = {
+    environment = {
+      NB_DISABLE_SSH_CONFIG = "true";
+    };
+    path = [
+      pkgs.shadow
+      pkgs.util-linux
+    ];
+  };
+
+  programs.ssh.extraConfig = ''
+    Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
+        PreferredAuthentications password,publickey,keyboard-interactive
+        PasswordAuthentication yes
+        PubkeyAuthentication yes
+        BatchMode no
+        ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
+        StrictHostKeyChecking no
+        UserKnownHostsFile /dev/null
+        CheckHostIP no
+        LogLevel ERROR
+  '';
+
+  networking.firewall.checkReversePath = "loose";
+}

hosts/AZ-LT-NIX/services/sound.nix

@@ -0,0 +1,11 @@
+{
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    jack.enable = false;
+    wireplumber.enable = true;
+  };
+}

hosts/AZ-LT-NIX/services/udev.nix

@@ -0,0 +1,8 @@
+{pkgs, ...}: {
+  services.udev.extraRules = ''
+    SUBSYSTEM=="usb", MODE="0666"
+  '';
+  environment.systemPackages = with pkgs; [
+    zsa-udev-rules
+  ];
+}