#+TITLE: JawZ NixOS main Configuration #+AUTHOR: Danilo Reyes #+PROPERTY: header-args :tangle configuration.nix #+auto_tangle: t * TODO [2/10] - [X] Clean up configuration file - [X] Merge current config - [ ] System configurations [0/7] - [ ] fail2ban - [ ] Bluetooth multiple devices + pass-through - [ ] Automatic updates - [ ] SSH settings - [ ] Automatic garbage collection - [ ] Firewall ports - [ ] Topgrade (perhaps unnecessary) - [-] SystemD services [2/5] - [ ] docker-compose - [ ] snapraid - [X] FStrim - [X] BTRFS scrub - [ ] Personal scripts [0/3] - [ ] download - [ ] Instagram - [ ] startup tasks - [ ] Migrate dotfiles [0/3] - [ ] .config [0/3] - [ ] celluloid [0/2] - [ ] Make sure plugins work - [ ] Declare plugins? - [ ] Firefox [0/7] https://ffprofile.com/#finish - [ ] Extensions - [ ] Settings - [ ] Gnome integration - [ ] Profile - [ ] Bookmarks - [ ] Extra security/privacy config - [ ] gallery-dl integration - [ ] - [ ] .var - [ ] .local/share [0/2] - [ ] beets - [ ] mpd - [-] Migrate apps [1/4] - [X] paru - [ ] pipx - [ ] pip IMPORTANT for beet - [ ] appimages - [ ] Figure out how to get rid of xterm - [ ] Compile missing apps [0/3] - [ ] wine-discord-ipc-bridge https://github.com/fufexan/nix-gaming - [ ] make binaries of my own scripts https://github.com/asimpson/dotfiles/blob/899b45e1586aac04d4e5541d638bbbffc66b4bba/nixos/scripts.nix - [ ] AdwCustomizer [0/1] https://github.com/AdwCustomizerTeam/AdwCustomizer - [ ] Figure out pip - [ ] (optional) adw-gtk3 theme https://github.com/lassekongo83/adw-gtk3#readme I think it can be locally installed, no need for theme, but in case https://github.com/NixOS/nixpkgs/blob/nixos-22.05/pkgs/data/themes/vertex/default.nix#L32 * ABOUT Setting up the document. Also in theory this should allow me to set up variables, and other functions. #+begin_src nix { config, pkgs, ... }: let VERSION = "22.11"; # HOME-MANAGER = builtins.fetchTarball # "https://github.com/nix-community/home-manager/archive/master.tar.gz"; UNSTABLE_TARBALL = builtins.fetchTarball https://github.com/nixos/nixpkgs/tarball/master; unstable = import UNSTABLE_TARBALL { config = config.nixpkgs.config; }; in { # Remember to close this bracket at the end of the document #+end_src ** IMPORTS These are files and modules which get loaded onto the configuration file, in the future I may segment this file into different modules, but for the time being, the two ones I need are hardware and home-manager. #+begin_src nix imports = [ ./hardware-configuration.nix ]; #+end_src * SYSTEM CONFIGURATION ** NETWORKING At the moment, I don't have a wireless card on this computer, however as I build a new system, such setting may come in handy. #+begin_src nix networking.hostName = "workstation"; #+end_src Pick *ONLY ONE* of the below networking options. - *wireless.enable* enables wireless support via wpa_supplicant. - *NetworkManager* it's the default of GNOME, and easiest to use and integrate. #+begin_src nix # networking.wireless.enable = true; networking.networkmanager.enable = true; #+end_src ** TIMEZONE #+begin_src nix time.timeZone = "America/Mexico_City"; #+end_src ** LOCALE For some reason, useXkbConfig throws an error when building the system, either way it is an unnecessary setting as my keyboards are the default en_US, only locale set to Canadian out because I prefer how it displays the date. #+begin_src nix i18n = { defaultLocale = "en_CA.UTF-8"; extraLocaleSettings = { LC_MONETARY = "es_MX.UTF-8"; }; }; console = { font = "Lat2-Terminus16"; keyMap = "us"; # useXkbConfig = true; # use xkbOptions in tty. }; #+end_src * GNOME At the time of writing this file, I require of X11, as the NVIDIA support for Wayland isn't perfect yet. At the time being, the ability to switch through GDM from Wayland to XORG, it's pretty handy, but in the future these settings will require an update. Sets up GNOME as the default desktop environment, while excluding some undesirable packages from installing. #+begin_src nix services = { xserver = { enable = true; videoDrivers = [ "nvidia" ]; displayManager.gdm.enable = true; desktopManager.gnome.enable = true; layout = "us"; libinput.enable = true; # Wacom required? }; }; environment.gnome.excludePackages = (with pkgs; [ gnome-photos gnome-tour gnome-text-editor gnome-connections baobab ]) ++ (with pkgs.gnome; [ totem gedit gnome-music epiphany gnome-characters yelp simple-scan gnome-font-viewer ]); #+end_src * SOUND In order to avoid issues with PipeWire, the wiki recommends to disable /sound.enable/ This is a basic PipeWire configuration, in the future stuff like Bluetooth or latency will require expanding these settings. #+begin_src nix hardware.pulseaudio.enable = false; sound.enable = false; security.rtkit.enable = true; services.pipewire = { enable = true; alsa.enable = true; alsa.support32Bit = true; pulse.enable = true; }; #+end_src * SECURITY Recently, I've gotten frustrated with OpenDoas, as such I've decided to temporarily enable Sudo, but in the future, I plan to revert that decision. ** SUDO Disabled password for commodity, but this is obviously not recommended. #+begin_src nix security.sudo = { enable = true; wheelNeedsPassword = false; }; #+end_src ** OPENDOAS It's mayor advantage over Sudo, is that is being a smaller package, being lessen known means that there is less security risks associated with it, overall a less bloated more secure package. Which comes with the caveat that due to it's age, there is little support for it. Constantly having to resort to hack solutions such as patches or symlinks. #+begin_src nix # security.sudo.enable = false; # security.doas.enable = true; # security.doas.extraRules = [{ # users = [ "jawz" ]; # keepEnv = true; # #persist = true; # noPass = true; # }]; #+end_src * USER Being part of the "wheel" group, means that the user has root privileges. #+begin_src nix users.users.jawz = { isNormalUser = true; extraGroups = [ "wheel" "networkmanager" "docker" ]; initialPassword = "password"; shell = pkgs.fish; packages = with pkgs; [ ]; }; #+end_src * MISC SETTINGS ** NIXPKGS settings this allows to install unfree packages, and also a toggle for installing packages from the unstable repository by preppending "unstable" to the package name. #+begin_src nix nixpkgs.config = { allowUnfree = true; }; #+end_src ** ENABLE FONTCONFIG If enabled, a Fontconfig configuration file will point to a set of default fonts. If you don't care about running X11 applications or any other program that uses Fontconfig, you can turn this option off and prevent a dependency on all those fonts. =tip= once that Wayland is ready for deployment, I probably can remove this setting. #+begin_src nix fonts.fontconfig.enable = true; #+end_src * HOME-MANAGER ** HOME-MANAGER SETTINGS These make it so packages install to '/etc' rather than the user home directory, also allow for upgrades when rebuilding the system. #+begin_src nix home-manager.useUserPackages = true; home-manager.useGlobalPkgs = true; #+end_src ** PACKAGES This section of the document categorizes and organizes all he packages that I want installed, attempting to group them as dependencies of others when necessary. #+begin_src nix home-manager.users.jawz = { config, pkgs, ... }:{ # imports = [ ./dotfiles/dconf.nix ]; home.stateVersion = VERSION; home.packages = (with pkgs; [ #+end_src *** GUI PACKAGES :ATTACH: :PROPERTIES: :ID: d5a59b97-4c99-4813-9583-4bdbc978dbad :END: #+begin_src nix # Art blender # cgi animation and sculpting godot # game development unstable.gdtoolkit # gdscript language server krita # art to your heart desire! drawpile # arty party with friends!! mypaint # not the best art program mypaint-brushes # but it's got some mypaint-brushes1 # nice damn brushes unstable.pureref # create inspiration/reference boards # Gaming lutris # game/emulator manager grapejuice # roblox manager minecraft # minecraft official launcher parsec-bin # remote gaming with friends unstable.protonup-qt # update proton-ge # Productivity libreoffice-fresh # office, but based calibre # ugly af eBook library manager foliate # gtk eBook reader gnome.simple-scan # document scanner gnome-feeds # feed reader, maybe will replace with nextcloud tagger # tag music files # Misc sequeler # friendly SQL client blanket # background noise unstable.czkawka # duplicate finder # pika-backup # backups tilix # terminal gnome-obfuscate # censor private information metadata-cleaner # remove any metadata and geolocation from files # gnome-recipes # migrate these to mealie and delete unstable.denaro # manage your finances unstable.celeste # sync tool for any cloud provider # Multimedia celluloid # video player cozy # audiobooks player gnome-podcasts # podcast player handbrake # video converter, may be unnecessary curtail # image compressor pitivi # video editor unstable.identity # compare images or videos mousai # poor man shazam # bottles # wine prefix manager obs-studio # screen recorder & streamer shortwave # listen to world radio # Web discord # chat google-chrome # web browser with spyware included firefox # web browser that allows to disable spyware librewolf # no spyware web browser tor-browser-bundle-bin # dark web, so dark! # hugo # website engine nicotine-plus # remember Ares? warp # never used, but supposedly cool for sharing files #+end_src *** COMMAND-LINE PACKAGES #+begin_src nix gdu # disk-space utility, somewhat useful gocryptfs # encrypted filesystem! shhh!!! exa # like ls but with colors trash-cli # oop! didn't meant to delete that ffmpeg_5 # coolest video converter! yt-dlp # downloads videos from most video websites unstable.gallery-dl # similar to yt-dlp but for most image gallery websites neofetch # use once for brag, never again rmlint # probably my favourite app, amazing dupe finder that integrates well with BTRFS tldr # man for retards ffmpegthumbnailer # create video thumbnails for nautilus, in absence of totem vcsi # video thumbnails for torrents, can I replace it with ^? mediainfo # technical info about videos, needed by some of my scripts tree-sitter # code parsing, required by Doom emacs xdg-ninja # help declutter $HOME torrenttools # create torrent files from the terminal! #+end_src *** DEVELOPMENT PACKAGES #+begin_src nix # required by doom emacs, but still are rather useful. fd # modern find, faster searches fzf # fuzzy finder! super cool and useful ripgrep # modern grep languagetool # proofreader for English. check if works without the service # development environment nix-direnv # nix implementation of direnv exercism # learn to code # SH bats # testing system, required by Exercism bashdb # autocomplete shellcheck # linting shfmt # a shell parser and formatter nodePackages.bash-language-server # LSP support # NIX nixfmt # linting # PYTHON. python3 # base language pipenv # python development workflow for humans # C# & Rust omnisharp-roslyn # c# linter and code formatter # HASKELL # cabal-install # haskell interface # JS # jq # linting # Node-js # nodePackages.pnpm #+end_src *** GNOME EXTENSIONS #+begin_src nix gnome.gnome-tweaks # tweaks for the gnome desktop environment gnomeExtensions.appindicator gnomeExtensions.gsconnect #+end_src *** HUNSPELL These dictionaries work with Firefox, Doom Emacs and LibreOffice. #+begin_src nix hunspell hunspellDicts.it_IT hunspellDicts.es_MX hunspellDicts.en_CA #+end_src *** CUSTOMIZATION PACKAGES Also, this finishes the packages array, put new modules above. #+begin_src nix # Themes adwaita-qt unstable.adw-gtk3 unstable.gradience # theme customizer, allows you to modify adw-gtk3 themes # Fonts (nerdfonts.override { fonts = [ "Agave" "CascadiaCode" "SourceCodePro" "Ubuntu" "FiraCode" "Iosevka" ]; }) symbola # (papirus-icon-theme.override { # color = "grey"; # }) #+end_src ** PYTHON #+begin_src nix ]) ++ (with pkgs.python310Packages; [ black # Python code formatter flake8 # wraper for pyflakes, pycodestyle and mccabe isort # sort Python imports nose # testing and running python scripts pipx # install python packages in a virtual environment poetry # dependency management made easy pyflakes # checks source code for errors pylint # bug and style checker for python pytest # framework for writing tests speedtest-cli # check internet speed from the comand line #+end_src ** FISH PLUGINS #+begin_src nix ]) ++ (with pkgs.fishPlugins; [ sponge # keep history clean from typos fzf-fish # fish command line with fzf keybindings colored-man-pages # self explanatory autopair-fish # who has time for a closing bracket? bass # integrate bash utilities on fish #+end_src ** NPM #+begin_src nix ]) ++ (with pkgs.nodePackages; [ dockerfile-language-server-nodejs markdownlint-cli prettier pnpm ]); #+end_src ** DOTFILES *** FISH #+begin_src nix programs.starship.enable = true; programs.fish = { enable = true; # useBabelfish = true; This setting doens't work from inside home-manager shellAliases = { ls = "exa --icons --group-directories-first --no-permissions --no-user --no-time"; edit = "emacsclient -t"; comic = "download -u jawz -i (cat $lc | fzf --multi --exact -i)"; gallery = "download -u jawz -i (cat $lw | fzf --multi --exact -i)"; open_gallery = "open (find /mnt/disk2/scrapping/JawZ/gallery-dl -type d | fzf)"; unique_extensions = "find . -type f | string match -r '([^.\/]+)\$' | sort -u"; cp = "cp -i"; mv = "mv -i"; mkdir = "mkdir -p"; rm = "trash"; ".." = "cd .."; "..." = "cd ../.."; ".3" = "cd ../../.."; ".4" = "cd ../../../.."; ".5" = "cd ../../../../.."; }; shellAbbrs = { dl = "download -u jawz -i"; ex = "ls"; e = "edit"; c = "cat"; f = "fzf --multi --exact -i"; sc = "systemctl --user"; jc = "journalctl --user -xeu"; }; interactiveShellInit = '' #+end_src #+begin_src fish set fish_greeting "pika pika chu!!!! also remember fisher!" # Lists set -l list_root ${config.home.homeDirectory}/.config/jawz/lists/jawz set lw $list_root/watch.txt set li $list_root/instant.txt set lc $list_root/comic.txt set GPG_TTY (tty) # Set EMACS/VI mode function fish_user_key_bindings # fish_default_key_bindings fish_vi_key_bindings end #+end_src #+begin_src nix ''; #+end_src #+begin_src nix functions = { nixos-magic = '' #+end_src #+begin_src fish set -l nix_file "$HOME/Development/NixOS/configuration.nix" echo $nix_file nixfmt $nix_file sudo nixos-rebuild switch -I nixos-config=$nix_file #+end_src #+begin_src nix ''; mkcd = '' #+end_src #+begin_src fish mkdir -pv $argv cd $argv #+end_src #+begin_src nix ''; }; }; #+end_src *** BAT #+begin_src nix programs.bat = { enable = true; config = { # map-syntax = [ "*.jenkinsfile:Groovy" "*.props:Java Properties" ]; pager = "less -FR"; theme = "base16"; }; }; #+end_src *** GIT #+begin_src nix programs.git = { enable = true; userName = "Danilo Reyes"; userEmail = "CaptainJawZ@outlook.com"; }; #+end_src *** GNUPG #+begin_src nix programs.gpg = { enable = true; homedir = "${config.xdg.dataHome}/gnupg"; }; #+end_src *** HTOP #+begin_src nix programs.htop = { enable = true; package = pkgs.htop-vim; }; xdg.configFile."htop/htoprc".source = ./dotfiles/htop/htoprc; #+end_src *** XDG #+begin_src nix xdg = { enable = true; }; xdg.userDirs = { enable = true; # createDirectories = true; desktop = "${config.home.homeDirectory}"; documents = "${config.home.homeDirectory}/Documents"; download = "${config.home.homeDirectory}/Downloads"; music = "${config.home.homeDirectory}/Music"; pictures = "${config.home.homeDirectory}/Pictures"; # publicShare = "${config.home.homeDirectory}/.local/hd/Public"; templates = "${config.home.homeDirectory}/.local/share/Templates"; videos = "${config.home.homeDirectory}/Videos"; }; #+end_src *** OTHER #+begin_src nix xdg.configFile = { "wgetrc".source = ./dotfiles/wget/wgetrc; "configstore/update-notifier-npm-check.json".source = ./dotfiles/npm/update-notifier-npm-check.json; "npm/npmrc".source = ./dotfiles/npm/npmrc; "gallery-dl/config.json".source = ./dotfiles/gallery-dl/config.json; }; #+end_src ** USER-SERVICES *** MPD EXTENSIONS #+begin_src nix # services.mpd-discord-rpc.enable = true; # services.mpdris2 = { # enable = true; # multimediaKeys = true; # mpd.host = "localhost"; # }; #+end_src ** CLOSING HOME-MANAGER #+begin_src nix }; #+end_src * ENVIRONMENT PACKAGES These are a MUST to ensure the optimal function of nix, without these, recovery may be challenging. #+begin_src nix environment.systemPackages = with pkgs; [ wget docker-compose ]; #+end_src * ENVIRONMENT VARIABLES #+begin_src nix environment.sessionVariables = rec { # PATH XDG_CACHE_HOME = "\${HOME}/.cache"; XDG_CONFIG_HOME = "\${HOME}/.config"; XDG_BIN_HOME = "\${HOME}/.local/bin"; XDG_DATA_HOME = "\${HOME}/.local/share"; XDG_STATE_HOME = "\${HOME}/.local/state"; SCRIPTS = "\${HOME}/Development/Scripts"; # DEV PATH CABAL_CONFIG = "\${XDG_CONFIG_HOME}/cabal/config"; CABAL_DIR = "\${XDG_CACHE_HOME}/cabal"; CARGO_HOME = "\${XDG_DATA_HOME}/cargo"; GEM_HOME = "\${XDG_DATA_HOME}/ruby/gems"; GEM_PATH = "\${XDG_DATA_HOME}/ruby/gems"; GEM_SPEC_CACHE = "\${XDG_DATA_HOME}/ruby/specs"; GOPATH = "\${XDG_DATA_HOME}/go"; NPM_CONFIG_USERCONFIG = "\${XDG_CONFIG_HOME}/npm/npmrc"; PNPM_HOME = "\${XDG_DATA_HOME}/pnpm"; # OPTIONS LESSHISTFILE = "-"; GHCUP_USE_XDG_DIRS = "true"; RIPGREP_CONFIG_PATH = "\${XDG_CONFIG_HOME}/ripgrep/ripgreprc"; ELECTRUMDIR = "\${XDG_DATA_HOME}/electrum"; VISUAL = "emacsclient -ca emacs"; WGETRC = "\${XDG_CONFIG_HOME}/wgetrc"; "_JAVA_OPTIONS" = "-Djava.util.prefs.userRoot=\${XDG_CONFIG_HOME}/java"; # NVIDIA CUDA_CACHE_PATH = "\${XDG_CACHE_HOME}/nv"; # GBM_BACKEND = "nvidia-drm"; # "__GLX_VENDOR_LIBRARY_NAME" = "nvidia"; # FISH fisher_path = "\${XDG_CONFIG_HOME}/fish/fisher"; # Themes # GTK_THEME = "Adwaita:light"; # QT_QPA_PLATFORMTHEME = "adwaita-dark"; # QT_STYLE_OVERRIDE = "adwaita"; # CALIBRE_USE_SYSTEM_THEME = "1"; PATH = [ "\${XDG_BIN_HOME}" "\${XDG_CONFIG_HOME}/emacs/bin" "\${XDG_DATA_HOME}/npm/bin" "\${PNPM_HOME}" # "\${SCRIPTS}" ]; }; #+end_src * DOCKER Virtualization settings for Docker. NixOS offers an option to declaratively run docker-compose images using [[https://nixos.wiki/wiki/Docker][Arion]]. Could be an interesting thing to try out. #+begin_src nix virtualisation.docker = { enable = true; storageDriver = "btrfs"; enableNvidia = true; }; #+end_src * PROGRAMS & SERVICES Some programs need SUID wrappers. #+begin_src nix programs = { mtr.enable = true; gnupg.agent = { enable = true; enableSSHSupport = true; }; geary = { enable = true; }; steam = { enable = true; remotePlay.openFirewall = true; dedicatedServer.openFirewall = true; }; }; services = { printing.enable = true; emacs = { enable = true; defaultEditor = true; package = pkgs.emacs; }; fstrim.enable = true; btrfs.autoScrub = { enable = true; fileSystems = [ "/" "/mnt/disk1" "/mnt/disk2" ]; }; openssh = { enable = true; ports = [ 25152 ]; }; udev.packages = with pkgs; [ gnome.gnome-settings-daemon ]; }; #+end_src * FIREWALL Open ports in the firewall. =TIP= list what app a port belongs to in a table. #+begin_src nix # networking.firewall.allowedTCPPorts = [ ... ]; # networking.firewall.allowedUDPPorts = [ ... ]; # Or disable the firewall altogether. networking.firewall.enable = false; #+end_src * FINAL SYSTEM CONFIGURATIONS ** CREATE COPY OF NIXOS CONFIGURATION Copy the NixOS configuration file and link it from the resulting system (/run/current-system/configuration.nix). This is useful in case you accidentally delete configuration.nix. #+begin_src nix system.copySystemConfiguration = true; #+end_src ** NIX VERSION This value determines the NixOS release from which the default settings for stateful data, like file locations and database versions on your system. It‘s perfectly fine and recommended to leave this value at the release version of the first install of this system. Before changing this value read the documentation for this option. #+begin_src nix system.stateVersion = VERSION; #+end_src ** CLOSING :D That super pesky closing bracket. #+begin_src nix } #+end_src