nix/README.md

# NixOS Configuration Repository
## NOTE:  These configs expect this repo to be cloned to `/etc/nixos/git/`

* Installing a system from the ISO:
```
nixos-install <Hostname> [<Username>]
```
or
```
./docs/install.sh <Hostname> [<Username>]
```
* Post install:
```
nix develop -c /etc/nixos/git/docs/setup.sh
```

![Gruv'd Hyprland](./docs/screenshot.png "Hyprland with a Gruvboxy theme")
---
# framework-server ToDo List
* [x] minio is broken
* [x] No updates on Lemmy
* [x] cannot send email on port 25 - [Link](https://docker-mailserver.github.io/docker-mailserver/latest/config/security/understanding-the-ports/)
* [x] traccar not seeing phone
* [x] duplicati needs database repairs
* [ ] osaka-linode-01 unable to connect to Headscale
* [x] Matrix is unable to send/receive pictures
* [x] Go through old sysctl.io cronjob and import what's neccesary 
* [ ] Back up pass.sysctl.io to memory stick (gpg encrypted csv file)
* [x] Get Gnome Remote Desktop / XRDP working 
* [x] Migrate to Protonmail, use the PM mail bridge docker container (Nix pkg?)
* [x] https://github.com/shenxn/protonmail-bridge-docker#initialization
* [ ] Set up ssh keys for nix builders on forgejo
* [ ] Set up `nixos-rebuild switch --target-host $host` on forgejo actions 
* [ ] Potentially need to set up a new PGP key for use with ProtonMail
* [ ] Try this https://www.ntop.org/products/traffic-analysis/ntop/

# Raspberry Pi ToDo List
* [ ] nixos-rpi4-01 - Replace japan-rpi4
  * crontab entry for rsyncing storage to /mnt/sda,b,c
* [ ] nixos-rpi4-02 - Replace piaware-rpi4
  * Container running piaware software

# To Do List
* [ ] Try Attic - A self-hosted Nix Binary Cache server - [Link](https://discourse.nixos.org/t/introducing-attic-a-self-hostable-nix-binary-cache-server/24343)
* [ ] Try [compose2nix](https://github.com/aksiksi/compose2nix) - Docker Compose to Nix converter
* [ ] Make a dashboard for all Nixified devices (online status)
* [ ] Try deploy-rs - [Link](https://github.com/serokell/deploy-rs)
* [ ] Set up actions/forgejo-release - [Link](https://code.forgejo.org/actions/forgejo-release)
* [ ] Try lazy.vim - [Link](https://www.lazyvim.org/)
* [ ] Look into hosting a binary cache locally - [Link](https://nixos.wiki/wiki/Binary_Cache)
* [x] vscode / emacs
  * Add the nix lsp - [Link](https://github.com/nix-community/rnix-lsp)
* [ ] Find a way to remove all default search engines in Firefox (Google, Amazon, etc)
* [ ] Figure out what the home-manager `account` options are for.
* [ ] Security hardening
* [ ] Edit the hosts file
* [ ] home-manager/common/software/cli/bash.nix - Break this out for theming -- Currently statically set to 'gruvbox'
* [ ] cronjobs
  * [ ] Change wallpaper at a certain time of day
  * [ ] Automatic git pull of this repo
* [ ] emacs
  * [ ] Add bracket auto-completion
  * [ ] Find a way to have magit save login credentials
* [ ] btrfs snapshots?
* [ ] vscodium and user-config.js file?
* [ ] rofi - bitwarden-cli / bitwarden-menu ([Link](https://search.nixos.org/packages?channel=23.05&show=bitwarden-menu&from=0&size=50&sort=relevance&type=packages&query=bitwarden))
* [x] Server migration
  * Do federated things need to be available externally?
    * Pixelfed
    * Mastodon
    * Lemmy
      * Sepearate backend/frontend
    * Matrix
      * Separate baackend/frontend
  * Outbound ports
    * traefik (80, 443)
    * traccar (5055 tcp/udp) 
      * Can probably bring back internally, both devices will be internal to Headscale
    * jitsi-jvb (10000 udp, 4443 tcp)
    * minecraft (25565)
    * vintage-story (42420)
    * mailserver
      - "25:25"     # SMTP  (explicit TLS => STARTTLS)
      - "465:465"   # ESMTP (implicit TLS)
      - "587:587"   # ESMTP (explicit TLS => STARTTLS)
      - "143:143"   # IMAP4 (explicit TLS => STARTTLS)
      - "993:993"   # IMAP4 (implicit TLS)
      - "4190:4190" # Sieve support
    * tor-relay (9001, 9030) - Probably not hosting for legal reasons
    * headscale-derp (3478/udp, 1443/tcp) - Most likely can't host due to limitations of DERP/xinetd 
    * Headscale needs to be available externally


Completed ToDo List [here](docs/complete.md)

---

# Information
### Home Manager
  * Home Manager Documentation - [Link](https://nix-community.github.io/home-manager/index.html)
  * Home Manager Options Search - [Link](https://mipmip.github.io/home-manager-option-search/)

### NixOS
  * NixOS Documentation - Stable - [Link](https://nixos.org/manual/nixos/stable/)
  * NixOS Packages / Options Search - [Link](https://search.nixos.org/)
  * Nix User Repository (NUR) Search - [Link](https://nur.nix-community.org/)
  * ARM NixOS Building - [Link](https://nixos.wiki/wiki/NixOS_on_ARM#NixOS_installation_.26_configuration)
  * NixOS Manual - [Link](https://nixos.org/manual/nix/unstable/introduction)

### Useful Links
  * FlakeHub - [Link](https://flakehub.com)
  * Track a Nixpkgs PR - [Link](https://nixpk.gs/pr-tracker.html)
  * Awesome-Hyprland - [Link](https://github.com/hyprland-community/awesome-hyprland)

### Examples
  * Tons of good examples here - [Link](https://github.com/Mic92/dotfiles/blob/main/nixos/modules/)
  * NixOS Flakes Intro Guide - [Link](https://nixos-and-flakes.thiscute.world/)

### Theming
  * Neofetch Themes - [Link](https://github.com/Chick2D/neofetch-themes/)
  * gruvbox-factory - [Link](https://github.com/paulopacitti/gruvbox-factory)
  * Hyprland Gruvboxy - [Link](https://github.com/0bCdian/Hyprland_dotfiles/tree/gruvboxy)

---
# Theming
* To change system-wide themes, see [theming.md](docs/theming.md)

---
# Lanzaboote / SecureBoot
*  Instructions here - [Link](https://git.sysctl.io/Mirrors/lanzaboote/src/branch/master/docs/QUICK_START.md)
1. Create your keys: `sbctl create-keys`
2.  Verify your machine is ready for SecureBoot:  `sbctl verify` - Everything except `*-bzImage.efi` are signed  
3.  Enter Secureboot Setup mode in your EFI Settings on the motherboard (F10)
    * Security -> SecureBoot -> Set to Enabled and "Reset to Setup Mode" and exit
4.  Enroll the keys:  `sbctl enroll-keys --microsoft` 
    * If you wish, you can select `--tpm-eventlog`, but checksums will change later (ie, at a kernel rebuild)
5.  Reboot and verify you are activated:  `bootctl status`

# Manual:  GPG Keys
1.  Import the user private key: `gpg --import gpg/users/albert/privkey.asc`
2.  Mark it as trusted:  `gpg --edit-key albert@sysctl.io`, then type `trust`, then `5`
3.  On each new machine, run `sudo nix-shell -p ssh-to-pgp --run "ssh-to-pgp -i /etc/ssh/ssh_host_rsa_key -o /etc/nixos/git/keys/hosts/$(hostname).asc"`
    * This will output the identifier you add to `.sops.yaml`
    * Move `HOSTNAME.asc` to `keys/hosts/` and upload to git and rename accordingly.

# Secrets
1.  Run `nix-develop` in `/etc/nixos/git` to import new keys
2.  To edit a file: `sops secrets/file.yml"`
3.  When you add a new machine, you must update the secrets files encryption.  
    * Run `sops updatekeys secrets/file.yaml` and commit the change.

# Troubleshooting
1.  To troubleshoot issues, this command can come in handy:
```
 nix eval .#nixosConfigurations.[CONFIG_NAME].config.disko.devices._config
```


# Directory Structure 
```
├── docs
├── home-manager
│   ├── common
│   │   ├── desktops
│   │   │   ├── gnome
│   │   │   │   ├── common
│   │   │   │   └── themes
│   │   │   │       ├── default
│   │   │   │       └── gruvbox
│   │   │   └── hyprland
│   │   │       ├── common
│   │   │       └── themes
│   │   │           ├── default
│   │   │           └── gruvbox
│   │   └── software
│   │       ├── cli
│   │       │   └── themes
│   │       │       ├── default
│   │       │       └── gruvbox
│   │       └── gui
│   │           └── themes
│   │               ├── default
│   │               └── gruvbox
│   ├── hosts
│   └── users
├── keys
│   ├── hosts
│   ├── ssh
│   └── users
├── lib
├── nixos
│   ├── common
│   │   ├── desktops
│   │   │   ├── gnome
│   │   │   └── hyprland
│   │   ├── modules
│   │   ├── services
│   │   └── software
│   │       ├── cli
│   │       └── gui
│   ├── hosts
│   └── users
├── secrets
└── wallpapers
    ├── default
    └── gruvbox
```

# Other 
* Waybar inspirations
  * https://github.com/Pipshag/dotfiles_nord 
  * https://github.com/hajosattila/dotfiles/
  * https://gist.github.com/toger5/3a509d9a9d7ebba1e02205b00449ccff 


Example of passwordless SSH for deploy-rs:
```
nixosConfigurations.target = {
  # enable passwordless elevation
  security.pam.enableSSHAgentAuth = true;
};
deploy.nodes.target = {
  # ssh as normal user but elevate to root after
  sshUser = "me";
  user = "root";
  sshOpts = [ "-A" ];
};

```