adding modgud global config for testing

flake.lock

@@ -1,5 +1,57 @@
 {
   "nodes": {
+    "cachix": {
+      "inputs": {
+        "devenv": [
+          "devenv"
+        ],
+        "flake-compat": [
+          "devenv"
+        ],
+        "git-hooks": [
+          "devenv"
+        ],
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1728672398,
+        "narHash": "sha256-KxuGSoVUFnQLB2ZcYODW7AVPAh9JqRlD5BrfsC/Q4qs=",
+        "owner": "cachix",
+        "repo": "cachix",
+        "rev": "aac51f698309fd0f381149214b7eee213c66ef0a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "latest",
+        "repo": "cachix",
+        "type": "github"
+      }
+    },
+    "devenv": {
+      "inputs": {
+        "cachix": "cachix",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nix": "nix",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737999381,
+        "narHash": "sha256-Vi53EAQ9LOon0boDA2AhtTi2/CKz+rWbXAv+EXMxR9I=",
+        "owner": "cachix",
+        "repo": "devenv",
+        "rev": "b6eaeaca6233887e7db51a2cc7b6ada81c7fadb7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "devenv",
+        "type": "github"
+      }
+    },
     "devshell": {
       "inputs": {
         "nixpkgs": [
@@ -21,7 +73,43 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737038063,
+        "narHash": "sha256-rMEuiK69MDhjz1JgbaeQ9mBDXMJ2/P8vmOYRbFndXsk=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "bf0abfde48f469c256f2b0f481c6281ff04a5db2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
       "locked": {
         "lastModified": 1696426674,
         "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
@@ -36,6 +124,28 @@
       }
     },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "devenv",
+          "nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvim",
@@ -75,12 +185,37 @@
       }
     },
     "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "devenv"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "devenv",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737301351,
+        "narHash": "sha256-2UNmLCKORvdBRhPGI8Vx0b6l7M8/QBey/nHLIxOl4jE=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "15a87cedeb67e3dbc8d2f7b9831990dffcf4e69f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "git-hooks_2": {
       "inputs": {
         "flake-compat": [
           "nixvim",
           "flake-compat"
         ],
-        "gitignore": "gitignore",
+        "gitignore": "gitignore_2",
         "nixpkgs": [
           "nixvim",
           "nixpkgs"
@@ -101,6 +236,28 @@
       }
     },
     "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "devenv",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
       "inputs": {
         "nixpkgs": [
           "nixvim",
@@ -193,6 +350,55 @@
         "type": "github"
       }
     },
+    "libgit2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1697646580,
+        "narHash": "sha256-oX4Z3S9WtJlwvj0uH9HlYcWv+x1hqp8mhXl7HsLu2f0=",
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "rev": "45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "type": "github"
+      }
+    },
+    "nix": {
+      "inputs": {
+        "flake-compat": [
+          "devenv"
+        ],
+        "flake-parts": "flake-parts",
+        "libgit2": "libgit2",
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-23-11": [
+          "devenv"
+        ],
+        "nixpkgs-regression": [
+          "devenv"
+        ],
+        "pre-commit-hooks": [
+          "devenv"
+        ]
+      },
+      "locked": {
+        "lastModified": 1727438425,
+        "narHash": "sha256-X8ES7I1cfNhR9oKp06F6ir4Np70WGZU5sfCOuNBEwMg=",
+        "owner": "domenkozar",
+        "repo": "nix",
+        "rev": "f6c5ae4c1b2e411e6b1e6a8181cc84363d6a7546",
+        "type": "github"
+      },
+      "original": {
+        "owner": "domenkozar",
+        "ref": "devenv-2.24",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -217,16 +423,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737672001,
-        "narHash": "sha256-YnHJJ19wqmibLQdUeq9xzE6CjrMA568KN/lFPuSVs4I=",
-        "owner": "nixos",
+        "lastModified": 1730531603,
+        "narHash": "sha256-Dqg6si5CqIzm87sp57j5nTaeBbWhHFaVyG7V6L8k3lY=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "035f8c0853c2977b24ffc4d0a42c74f00b182cd8",
+        "rev": "7ffd9ae656aec493492b44d0ddfb28e79a1ea25d",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-24.11",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -263,12 +469,44 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1717432640,
+        "narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-24.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1737672001,
+        "narHash": "sha256-YnHJJ19wqmibLQdUeq9xzE6CjrMA568KN/lFPuSVs4I=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "035f8c0853c2977b24ffc4d0a42c74f00b182cd8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixvim": {
       "inputs": {
         "devshell": "devshell",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "git-hooks": "git-hooks",
+        "flake-compat": "flake-compat_2",
+        "flake-parts": "flake-parts_2",
+        "git-hooks": "git-hooks_2",
         "home-manager": "home-manager_2",
         "nix-darwin": "nix-darwin",
         "nixpkgs": [
@@ -317,8 +555,10 @@
     },
     "root": {
       "inputs": {
+        "devenv": "devenv",
+        "disko": "disko",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3",
         "nixpkgs-darwin": "nixpkgs-darwin",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim"

flake.nix

@@ -6,6 +6,12 @@
     nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-24.11-darwin";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
 
+    devenv.url = "github:cachix/devenv";
+    devenv.inputs.nixpkgs.follows = "nixpkgs-unstable";
+
+    disko.url = "github:nix-community/disko";
+    disko.inputs.nixpkgs.follows = "nixpkgs";
+
     home-manager.url = "github:nix-community/home-manager/release-24.11";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
@@ -22,7 +28,18 @@
     in
     {
 
-      homeManagerModules = import ./modules;
+
+      modules = {
+        home-manager = import ./modules/home-manager;
+        global = import ./modules/global;
+      };
+
+      nixosConfigurations = {
+        modgud = nixpkgs.lib.nixosSystem {
+          specialArgs = { inherit inputs; inherit outputs; };
+          modules = [ ./hosts/modgud ];
+        };
+      };
 
       packages = forAllSystems (system:
         let
@@ -31,7 +48,6 @@
             else
               nixpkgs.legacyPackages.${system};
         in {
-
           homeConfigurations = {
             "thomas@meili" = home-manager.lib.homeManagerConfiguration {
               inherit pkgs;
@@ -52,7 +68,6 @@
               ];
             };
           };
-
         }
       );
     };

hosts/common/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, outputs, ... }:
+{
+  imports = [
+    outputs.modules.global
+
+    ./home-manager.nix
+  ];
+
+  environment = {
+    systemPackages = with pkgs; [
+      git
+      ripgrep
+      jq
+    ];
+  };
+}

hosts/common/home-manager.nix

@@ -0,0 +1,17 @@
+{ inputs, outputs, ... }:
+let
+  home-manager-module =
+    if builtins.runCommand "uname" ''{ outFile = "/dev/stdout"; }'' == "Darwin" then
+      inputs.home-manager.darwinModules.home-manager
+    else
+      inputs.home-manager.nixosModules.home-manager;
+in
+{
+  imports = [ home-manager-module ];  
+  home-manager = {
+    # INFO: since we also use home-manager standalone, we don't want to mix up packages.
+    # useGlobalPkgs = true;
+    # useUserPackages = true;
+    extraSpecialArgs = { inherit inputs; inherit outputs; };
+  };
+}

hosts/common/nix.nix

@@ -0,0 +1,53 @@
+{ lib, pkgs, config, outputs, ... }:
+{
+  nix = {
+    settings = {
+      substituters = [
+        "https://cache.nixos.org/"
+        "https://devenv.cachix.org"
+        "https://nix-community.cachix.org"
+      ];
+
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+
+      trusted-users = [ "root" "@wheel" "@admin" ];
+    };
+
+    optimise.automatic = lib.mkDefault true;
+
+    extraOptions = ''
+      warn-dirty = false
+      experimental-features = nix-command flakes impure-derivations
+      auto-optimise-store = true
+    '' + lib.optionalString (pkgs.system == "aarch64-darwin") ''
+      extra-platforms = x86_64-darwin aarch64-darwin x86_64-linux aarch64-linux
+    '';
+
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 7d";
+    };
+
+    # Map registries to channels
+    # Very useful when using legacy commands
+    nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}")
+      config.nix.registry;
+  };
+
+  nixpkgs = {
+    overlays = [
+      outputs.overlays.additions
+      outputs.overlays.modifications
+      outputs.overlays.unstable-packages
+    ];
+
+    config = {
+      allowUnfree = true;
+      allowUnsupportedSystem = true;
+    };
+  };
+}

hosts/modgud/README.md

@@ -0,0 +1,15 @@
+# Modgud (Móðguðr)
+
+> In Norse mythology, Móðguðr (Old Norse: [ˈmoːðˌɡuðz̠], "Furious Battler"; also Modgud) refers to the female guardian of the bridge over the river Gjöll ("Noisy"), Gjallarbrú. She allowed the newly dead to use the bridge to cross from one side of the river Gjöll to the other if the soul stated their name and business and possibly in turn prevented the dead beyond the river from crossing back over Gjöll into the lands of the living.
+
+## Installation
+
+```bash
+nix run github:nix-community/nixos-anywhere -- --flake .#modgud [email protected]
+```
+
+## Services
+
+### Reverse Proxy (Treafik)
+### Idenity Provider (Authentik)
+### Private Peer to Peer Mesh Network (Netbird)

hosts/modgud/default.nix

@@ -0,0 +1,29 @@
+{ outputs, ... }:
+{
+  imports = [
+    ./hardware.nix
+
+    outputs.modules.global.gnupg
+    outputs.modules.global.locale
+    outputs.modules.global.fish
+    outputs.modules.global.nix-config
+    outputs.modules.global.openssh
+
+    # ../common/users/thomas
+    # ../common/users/thomas/authorized_keys.nix
+    # ../common/users/thomas/groups.nix
+    # ../common/users/thomas/nixos.nix
+  ];
+
+  security.sudo.extraConfig = ''
+    # rollback results in sudo lectures after each reboot
+    Defaults lecture = never
+  '';
+
+  documentation.enable = false;
+  documentation.man.enable = false;
+
+  networking.hostName = "modgud";
+  time.timeZone = "Europe/Amsterdam";
+  system.stateVersion = "25.05";
+}

hosts/modgud/disk.nix

@@ -0,0 +1,59 @@
+{ lib, inputs, ... }:
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+  ];
+
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/vda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [
+                "defaults"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/modgud/hardware.nix

@@ -0,0 +1,22 @@
+{ lib, modulesPath, ... }:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+
+    ./disk.nix
+  ];
+
+  boot.loader.grub = {
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform.system = "x86_64-linux";
+  networking.useDHCP = lib.mkDefault true;
+}

modules/default.nix

@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./programs/ghostty.nix
-  ];
-}

modules/global/cachix.nix

@@ -0,0 +1,10 @@
+{
+  nix.settings.substituters = [
+    "https://cachix.cachix.org"
+  ];
+  nix.settings.trusted-public-keys = [
+    "cachix.cachix.org-1:eWNHQldwUO7G2VkjpnjDbWwy4KQ/HNxht7H4SSoMckM="
+  ];
+
+  services.cachix-agent.enable = true;
+}

modules/global/colima.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    colima
+    docker-client
+    docker-compose
+  ];
+
+  services.colima = {
+    enable = true;
+    createDockerSocket = true;
+
+    groupMembers = [ "thomas" ];
+    architectue = "x86_64";
+    extraFlags = [
+      "--cpu-type max"
+      "--vz-rosetta"
+    ];
+  };
+}

modules/global/default.nix

@@ -0,0 +1,11 @@
+{
+  cachix = import ./cachix.nix;
+  colima = import ./colima.nix;
+  devenv = import ./devenv.nix;
+  fish = import ./fish.nix;
+  fonts = import ./fonts.nix;
+  gnupg = import ./gnupg.nix;
+  locale = import ./locale.nix;
+  nix-config = import ./nix-config.nix;
+  openssh = import ./openssh.nix;
+}

modules/global/devenv.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.unstable.devenv
+  ];
+}

modules/global/fish.nix

@@ -0,0 +1,10 @@
+{
+  programs.fish = {
+    enable = true;
+    vendor = {
+      completions.enable = true;
+      config.enable = true;
+      functions.enable = true;
+    };
+  };
+}

modules/global/fonts.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  fonts.packages = with pkgs; [
+    (nerdfonts.override { fonts = [ "FiraCode" ]; })
+    liberation_ttf
+  ];
+}

modules/global/gnupg.nix

@@ -0,0 +1,5 @@
+{ pkgs, ... }:
+{
+  programs.gnupg.agent.enable = true;
+  environment.systemPackages = with pkgs; [ gnupg ];
+}

modules/global/locale.nix

@@ -0,0 +1,13 @@
+{ lib, ... }:
+{
+  i18n = {
+    defaultLocale = lib.mkDefault "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_TIME = lib.mkDefault "en_US.UTF-8";
+    };
+    supportedLocales = lib.mkDefault [
+      "en_US.UTF-8/UTF-8"
+      "de_AT.UTF-8/UTF-8"
+    ];
+  };
+}

modules/global/nix-config.nix

@@ -0,0 +1,61 @@
+{ lib, pkgs, config, ... }:
+{
+  nix = {
+    package = pkgs.nix;
+
+    settings = {
+      substituters = [
+        "https://cache.nixos.org/"
+        "https://devenv.cachix.org"
+        "https://nix-community.cachix.org"
+      ];
+
+      trusted-public-keys = [
+        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+        "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      ];
+
+      trusted-users = [ "root" "@wheel" "@admin" ];
+    };
+
+
+    extraOptions = ''
+      warn-dirty = false
+      experimental-features = nix-command flakes impure-derivations
+      auto-optimise-store = true
+    '' + lib.optionalString (pkgs.system == "aarch64-darwin") ''
+      extra-platforms = x86_64-darwin aarch64-darwin x86_64-linux aarch64-linux
+    '';
+
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 7d";
+    };
+
+    # Map registries to channels
+    # Very useful when using legacy commands
+    nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}")
+      config.nix.registry;
+
+  # TODO: Conditionally add the optimise attribute if it exists
+  # } // lib.mkIf (lib.hasAttr "nix.optimise.automatic" config) {
+  #   optimise = {
+  #     automatic = lib.mkDefault true;
+  #   };
+  };
+
+  nixpkgs = {
+    # TODO: re-enable overlays when we bring them back here
+    # overlays = [
+    #   outputs.overlays.additions
+    #   outputs.overlays.modifications
+    #   outputs.overlays.unstable-packages
+    # ];
+
+    config = {
+      allowUnfree = true;
+      allowUnsupportedSystem = true;
+    };
+  };
+}

modules/global/openssh.nix

@@ -0,0 +1,22 @@
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+    extraConfig = ''
+      StreamLocalBindUnlink yes
+    '';
+  };
+
+  # programs.ssh.knownHostsFiles = [
+  #   ../../../keys/github.keys
+  #   ../../../keys/thor.keys
+  #   ../../../keys/penguin.keys
+  #   ../../../keys/vault.keys
+  # ];
+
+  # Passwordless sudo when SSH'ing with keys
+  security.pam.sshAgentAuth.enable = true;
+}

modules/home-manager/default.nix

@@ -0,0 +1,6 @@
+{
+  ghostty = import ./programs/ghostty.nix;
+  # imports = [
+  #   ./programs/ghostty.nix
+  # ];
+}

users/thomas/default.nix

@@ -5,9 +5,9 @@ let
 in
 {
   imports = [
-    outputs.homeManagerModules
+    outputs.modules.global.nix-config
+    outputs.modules.home-manager.ghostty
 
-    ./nix.nix
     ./cli
   ];