pc: add openclaw

a

flake.lock

@@ -1,5 +1,76 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1781825982,
+        "narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -7,11 +78,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749178927,
+        "lastModified": 1790742230,
-        "narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
+        "narHash": "sha256-5399J1/O3DyLSsYGVa950JtOUDB9Reqvy7FhfDuTVzk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
+        "rev": "0aefa652eb6fd8b7396af25e8c81cb0790f12cc2",
         "type": "github"
       },
       "original": {
@@ -20,6 +91,74 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1782141370,
+        "narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v1.1.0",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
+    "nix-openclaw": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "home-manager": [
+          "home-manager"
+        ],
+        "nix-openclaw-tools": "nix-openclaw-tools",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "qmd": "qmd"
+      },
+      "locked": {
+        "lastModified": 1790163937,
+        "narHash": "sha256-oSsWtQ8mAH9KZkJKHeS3RedhrfDaMs1Ktrqs8rTP8PU=",
+        "owner": "openclaw",
+        "repo": "nix-openclaw",
+        "rev": "f62d33f760bcbdbc6a52ac589eae22bf99201f90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "openclaw",
+        "repo": "nix-openclaw",
+        "type": "github"
+      }
+    },
+    "nix-openclaw-tools": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1790151707,
+        "narHash": "sha256-buJkQpTHNMawudMv2p00KwPAIuHMtK4CZXk7DgfHkx0=",
+        "owner": "openclaw",
+        "repo": "nix-openclaw-tools",
+        "rev": "8b674893eb3dfddc55ac76fa532a3b11b4330575",
+        "type": "github"
+      },
+      "original": {
+        "owner": "openclaw",
+        "repo": "nix-openclaw-tools",
+        "type": "github"
+      }
+    },
     "nixlib": {
       "locked": {
         "lastModified": 1736643958,
@@ -43,11 +182,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747663185,
+        "lastModified": 1769813415,
-        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
         "type": "github"
       },
       "original": {
@@ -58,11 +197,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748929857,
+        "lastModified": 1790055231,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "narHash": "sha256-QpXotokGh5eeMG1Njiuh27oP0rK6t5+cMp7ymXSs7mc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "rev": "b6c98e9e6633ee64753b594ff4a5febf0367fc00",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1790578696,
+        "narHash": "sha256-ZoxIApko70jCdbH3l20HWXOBaT2HZd87orzd2yJ9dVE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7a0f122f5090cf4c2ade2a13a0e229d4e19ba71f",
         "type": "github"
       },
       "original": {
@@ -82,11 +237,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748196248,
+        "lastModified": 1785762349,
-        "narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
+        "narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "b7697abe89967839b273a863a3805345ea54ab56",
+        "rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
         "type": "github"
       },
       "original": {
@@ -95,15 +250,87 @@
         "type": "github"
       }
     },
+    "pre-commit": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "qmd": {
+      "inputs": {
+        "flake-utils": [
+          "nix-openclaw",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nix-openclaw",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786919312,
+        "narHash": "sha256-/7Z94r/9rXqzKlz/YkB6/nToSCPamV4Dnxm8EhelTDo=",
+        "owner": "tobi",
+        "repo": "qmd",
+        "rev": "facd35e01359e59d938bc9418e93fb9318addee3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tobi",
+        "ref": "v2.8.3",
+        "repo": "qmd",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
+        "nix-openclaw": "nix-openclaw",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "plasma-manager": "plasma-manager",
         "secrix": "secrix"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782012058,
+        "narHash": "sha256-9mWUnReOUXfKjZuJAL/bAFH3LUyECTRtXgSNVjRw3UY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "8534567325bd8a8d2928e6afd81e0a87d19efd3c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "secrix": {
       "inputs": {
         "nixpkgs": [
@@ -111,11 +338,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746643487,
+        "lastModified": 1787124737,
-        "narHash": "sha256-dcB/DArJObCvqE/ZEdQSDW2BZMeDyF83Se5KPfJvz60=",
+        "narHash": "sha256-EnQcFCdcQs1agb8U/h3kn7+A3c3uorANCPP2WakZjAk=",
         "owner": "Platonic-Systems",
         "repo": "secrix",
-        "rev": "4c64203fa5b377953b1fb6d5388187df8b60c6d5",
+        "rev": "9c0a7db4e355c28fe67643656821b06161b4df61",
         "type": "github"
       },
       "original": {
@@ -123,6 +350,21 @@
         "repo": "secrix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -22,21 +22,48 @@
       url = "github:Platonic-Systems/secrix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.1.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nix-openclaw = {
+      url = "github:openclaw/nix-openclaw";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
   };
 
-  outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix }:
+  outputs = { self, nixpkgs, home-manager, plasma-manager, nixos-generators, secrix, lanzaboote, nix-openclaw }:
   let
     hmModule = file: {
       imports = [ home-manager.nixosModules.home-manager ];
 
+      nixpkgs.overlays = [ nix-openclaw.overlays.default ];
+
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
-      home-manager.sharedModules = [ plasma-manager.homeManagerModules.plasma-manager ];
+      home-manager.sharedModules = [
+        plasma-manager.homeModules.plasma-manager
+        nix-openclaw.homeManagerModules.openclaw
+      ];
 
       home-manager.users.cazzzer = import file;
       # Optionally, use home-manager.extraSpecialArgs to pass
       # arguments to home.nix
     };
+
+    mkRouter = hostFile: nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        secrix.nixosModules.default
+        ./modules
+        ./modules/router
+        ./hosts/common.nix
+        hostFile
+        ./users/cazzzer
+        (hmModule ./home/common.nix)
+      ];
+    };
   in
   {
     apps.x86_64-linux.secrix = secrix.secrix self;
@@ -57,6 +84,7 @@
       Yura-TPX13 = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
+          lanzaboote.nixosModules.lanzaboote
           ./modules
           ./hosts/common.nix
           ./hosts/common-desktop.nix
@@ -77,17 +105,9 @@
           (hmModule ./home/cazzzer-pc.nix)
         ];
       };
-      router = nixpkgs.lib.nixosSystem {
+      router = mkRouter ./hosts/router;
-        system = "x86_64-linux";
+      router-1 = mkRouter ./hosts/router-1;
-        modules = [
+      router-2 = mkRouter ./hosts/router-2;
-          secrix.nixosModules.default
-          ./modules
-          ./hosts/common.nix
-          ./hosts/router
-          ./users/cazzzer
-          (hmModule ./home/common.nix)
-        ];
-      };
     };
     # https://github.com/nix-community/nixos-generators?tab=readme-ov-file#using-in-a-flake
     packages.x86_64-linux = {

home/modules/fish.nix

@@ -5,11 +5,11 @@
     enable = true;
     shellInit = "set fish_greeting";
     shellAliases = {
-      # Replace ls with exa
+      # Replace ls with eza
-      ls = "exa -al --color=always --group-directories-first --icons"; # preferred listing
+      ls = "eza -al --color=always --group-directories-first --icons=always"; # preferred listing
-      la = "exa -a --color=always --group-directories-first --icons";  # all files and dirs
+      la = "eza -a --color=always --group-directories-first --icons=always";  # all files and dirs
-      ll = "exa -l --color=always --group-directories-first --icons";  # long format
+      ll = "eza -l --color=always --group-directories-first --icons=always";  # long format
-      lt = "exa -aT --color=always --group-directories-first --icons"; # tree listing
+      lt = "eza -aT --color=always --group-directories-first --icons=always"; # tree listing
       "l." = "exa -a | rg '^\.'";                                      # show only dotfiles
 
       # Replace cat with bat

home/modules/git.nix

@@ -8,21 +8,23 @@ in
   programs.git = {
     enable = true;
     
-    userName = name;
-    userEmail = email;
-
     signing = {
       key = signingKey;
       signByDefault = true;
       format = "ssh";
     };
 
-    aliases = {
+    settings = {
-      co = "checkout";
+      user = {
-      s = "switch";
+        name = name;
-    };
+        email = email;
+      };
+      
+      alias = {
+        co = "checkout";
+        s = "switch";
+      };
       
-    extraConfig = {
       url = {
         "https://gitea.cazzzer.com/" = {
           insteadOf = "caztea:";

home/modules/plasma.nix

@@ -55,6 +55,8 @@
         activities-icons."809dc779-bf5b-49e6-8e3f-cbe283cb05b6" = "keyboard";
         activities-icons."b34a506d-ac4f-4797-8c08-6ef45bc49341" = "preferences-desktop-gaming";
       };
+      baloofilerc.General."exclude folders".persistent = true;
+      systemsettingsrc.systemsettings_sidebar_mode.HighlightNonDefaultSettings=true;
     };
   };
 

hosts/Yura-PC/default.nix

@@ -31,6 +31,11 @@
     intel-media-driver # LIBVA_DRIVER_NAME=iHD
   ];
 
+  environment.systemPackages = with pkgs; [
+    lmstudio
+    openclaw
+  ];
+
   networking.hostName = "Yura-PC"; # Define your hostname.
   networking.hostId = "110a2814"; # Required for ZFS.
 

hosts/Yura-PC/hardware-configuration.nix

@@ -18,6 +18,11 @@
       fsType = "zfs";
     };
 
+  fileSystems."/nix" =
+    { device = "zroot/data/nix";
+      fsType = "zfs";
+    };
+
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/970C-6A15";
       fsType = "vfat";

hosts/Yura-TPX13/default.nix

@@ -11,10 +11,18 @@
     "sysrq_always_enabled=1"
   ];
 
+  boot.loader.systemd-boot.enable = false;
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+
   networking.hostName = "Yura-TPX13"; # Define your hostname.
   networking.hostId = "8425e349"; # Required for ZFS.
 
   services.fprintd.enable = true;
+  security.pam.services.login.fprintAuth = false;
+
 
   # Install firefox.
   programs.firefox.enable = true;

hosts/common-desktop.nix

@@ -7,15 +7,20 @@
     "sysrq_always_enabled=1"
   ];
 
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_7_2;
   boot.loader = {
     efi.canTouchEfiVariables = true;
     timeout = 3;
-    systemd-boot = {
+    systemd-boot.enable = lib.mkDefault true;
-      enable = true;
-      configurationLimit = 5;
-    };
   };
+  boot.kernel.sysctl = {
+    # https://wiki.archlinux.org/title/Zram#Optimizing_swap_on_zram
+    "vm.swappiness" = 180;
+    "vm.watermark_boost_factor" = 0;
+    "vm.watermark_scale_factor" = 125;
+    "vm.page-cluster" = 0;
+  };
+  zramSwap.enable = true;
 
   # https://nixos.wiki/wiki/Accelerated_Video_Playback
   hardware.graphics.enable = true;
@@ -24,14 +29,16 @@
 
   # Enable networking
   networking.networkmanager.enable = true;
+  networking.networkmanager.plugins = [
+    pkgs.networkmanager-openvpn
+  ];
 
   # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
   services.xserver.enable = false;
 
   # Enable the KDE Plasma Desktop Environment.
-  services.displayManager.sddm.enable = true;
+  services.displayManager.plasma-login-manager.enable = true;
-  services.displayManager.sddm.wayland.enable = true;
   services.desktopManager.plasma6.enable = true;
 
   # Enable CUPS to print documents.
@@ -58,28 +65,28 @@
   programs.git.enable = true;
   programs.git.lfs.enable = true;
   # https://nixos.wiki/wiki/Git
-  programs.git.package = pkgs.git.override { withLibsecret = true; };
+  programs.git.package = pkgs.git.override { withLibsecret = true; doInstallCheck = false; };
   programs.lazygit.enable = true;
   programs.neovim.enable = true;
   programs.wireshark.enable = true;
   programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
   programs.bat.enable = true;
   programs.htop.enable = true;
+  programs.nix-ld.enable = true;
+  # programs.steam.enable = true;
 
   # https://nixos.wiki/wiki/Docker
   virtualisation.docker.enable = true;
   virtualisation.docker.enableOnBoot = false;
-  virtualisation.docker.package = pkgs.docker_28;
 
   # https://github.com/flatpak/flatpak/issues/2861
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
-  workarounds.flatpak.enable = true;
   fonts.packages = with pkgs; [
     fantasque-sans-mono
     nerd-fonts.fantasque-sans-mono
     noto-fonts
-    noto-fonts-emoji
+    noto-fonts-color-emoji
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif
     jetbrains-mono
@@ -107,12 +114,13 @@
     jq
     ldns
     mediainfo
+    powertop
     rbw
     restic
-    resticprofile
     rclone
     ripgrep-all
     rustscan
+    unrar
     whois
     wireguard-tools
     yt-dlp
@@ -120,48 +128,88 @@
     bitwarden-desktop
     darkman
     host-spawn # for flatpaks
+    jellyfin-mpv-shim
     kdePackages.filelight
     kdePackages.flatpak-kcm
     kdePackages.kate
     kdePackages.yakuake
-    mpv
+    (mpv.override {
+      scripts = with pkgs.mpvScripts; [
+        mpris
+        videoclip
+      ];
+    })
     nextcloud-client
+    # lutris
     lxqt.pavucontrol-qt
-    pinentry
+    pinentry-all
     tela-circle-icon-theme
+    typst
     virt-viewer
     waypipe
   ] ++ [
     # jetbrains.rust-rover
     # jetbrains.goland
     jetbrains.clion
-    jetbrains.idea-ultimate
+    # jetbrains.idea
-    jetbrains.pycharm-professional
+    jetbrains.pycharm
     jetbrains.webstorm
     android-studio
     rustup
     zed-editor
+    package-version-server # for zed
+    antigravity-cli
+    antigravity-ide-fhs
+    codex
+    # codex-acp
+    # github-copilot-cli
+    # opencode
+    # opencode-desktop
   ] ++ [
+    # C
+    gcc
+    valgrind
+    
     # Python
     python3
     poetry
 
     # Haskell
+    cabal-install
+    haskell-language-server
+    # haskellPackages.hls-cabal-plugin
     haskellPackages.ghc
     haskellPackages.stack
 
     # Node
-    nodejs_22
+    nodejs_24
     pnpm
     bun
 
     # Nix
     nil
     nixd
-    nixfmt-rfc-style
+    nixfmt
 
     # Gleam
     gleam
-    beamMinimal26Packages.erlang
+    beamMinimal28Packages.erlang
+    
+    # Racket
+    racket
+    
+    # Ruby
+    ruby
+
+    # Java
+    zulu
+
+    # spacetimedb
+  ] ++ [
+    jujutsu
+    lazyjj
+    jjui
+    # jj-fzf
+    gg-jj
   ];
 }

hosts/router-1/default.nix

@@ -0,0 +1,24 @@
+{
+  imports = [
+    ../hw-vm.nix
+  ];
+
+  router = {
+    enableDesktop = false;
+    enableDhcpClient = false;
+    wanMAC = "bc:24:11:af:bd:84";
+    lanMAC = "bc:24:11:38:b1:91";
+    wanLL = "fe80::be24:11ff:feaf:bd84";
+    lanLL = "fe80::be24:11ff:fe38:b191";
+    defaultToken = 251;
+
+    pdFromWan = "fd46:fbbe:ca55:100";
+    wanAddr4 = "192.168.1.63";
+    wanGw4 = "192.168.1.254";
+  };
+
+  networking.hostName = "grouty";
+
+  # override hw-vm.nix default
+  networking.useDHCP = false;
+}

hosts/router-2/default.nix

@@ -0,0 +1,24 @@
+{
+  imports = [
+    ../hw-vm.nix
+  ];
+
+  router = {
+    enableDesktop = false;
+    enableDhcpClient = false;
+    wanMAC = "bc:24:11:bc:db:c1";
+    lanMAC = "bc:24:11:19:2a:96";
+    wanLL = "fe80::be24:11ff:febc:dbc1";
+    lanLL = "fe80::be24:11ff:fe19:2a96";
+    defaultToken = 252;
+
+    pdFromWan = "fd46:fbbe:ca55:100";
+    wanAddr4 = "192.168.1.64";
+    wanGw4 = "192.168.1.254";
+  };
+
+  networking.hostName = "grouta";
+
+  # override hw-vm.nix default
+  networking.useDHCP = false;
+}

hosts/router/default.nix

@@ -1,93 +1,18 @@
-{ config, lib, pkgs, ... }:
-let
-  vars = import ./vars.nix;
-  enableDesktop = true;
-in
 {
-  imports =
+  imports = [
-    [ # Include the results of the hardware scan.
+    ./hardware-configuration.nix
-      ./hardware-configuration.nix
+    ./private.nix
-      ./ifconfig.nix
-      ./wireguard.nix
-      ./firewall.nix
-      ./dns.nix
-      ./kea.nix
-      ./glance.nix
-      ./services.nix
-    ];
-  # Secrix for secrets management
-  secrix.hostPubKey = vars.pubkey;
-
-  # Bootloader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = false;
-  boot.kernelParams = [
-    "sysrq_always_enabled=1"
   ];
 
-  boot.loader.timeout = 2;
+  router = {
-  boot.loader.systemd-boot.configurationLimit = 5;
+    enableDesktop = false;
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+    enableDhcpClient = true;
-  boot.growPartition = true;
+    wanMAC = "bc:24:11:4f:c9:c4";
+    lanMAC = "bc:24:11:83:d8:de";
+    wanLL = "fe80::be24:11ff:fe4f:c9c4";
+    lanLL = "fe80::be24:11ff:fe83:d8de";
+    defaultToken = 1;
+  };
 
   networking.hostName = "grouter";
-
-  # Enable the X11 windowing system.
-  # You can disable this if you're only using the Wayland session.
-  services.xserver.enable = false;
-
-  # Enable the KDE Plasma Desktop Environment.
-  # Useful for debugging with wireshark.
-  hardware.graphics.enable = true;
-  services.xserver.desktopManager.xfce.enable = enableDesktop;
-  services.xserver.desktopManager.xfce.enableWaylandSession = enableDesktop;
-  # services.displayManager.sddm.enable = enableDesktop;
-  # services.displayManager.sddm.wayland.enable = enableDesktop;
-  # services.desktopManager.plasma6.enable = enableDesktop;
-  # No need for audio in VM
-  services.pipewire.enable = false;
-
-  # VM services
-  services.qemuGuest.enable = true;
-  services.spice-vdagentd.enable = true;
-
-  security.sudo.wheelNeedsPassword = false;
-
-  programs.firefox.enable = true;
-  programs.fish.enable = true;
-  programs.git.enable = true;
-  programs.neovim.enable = true;
-  programs.bat.enable = true;
-  programs.htop.enable = true;
-  programs.wireshark.enable = true;
-  programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
-
-  environment.systemPackages = with pkgs; [
-    dust
-    eza
-    fastfetch
-    fd
-    kdePackages.kate
-    ldns
-    lsof
-    micro
-    mpv
-    openssl
-    ripgrep
-    rustscan
-    starship
-    tealdeer
-    transcrypt
-    waypipe
-    whois
-    wireguard-tools
-  ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.11"; # Did you read the comment?
 }

hosts/router/private.nix

@@ -1,3 +1,3 @@
-U2FsdGVkX1/MGwxIMmhbZuPqJUZzex9v5tTuiOrEvDVldI7xY0edUy9Ii5udFLXt
+U2FsdGVkX1+eMFkQxarJDGLkX0zXyMRPukeRNvzd/BJ0XDAUZ2EeZvQnZw8U53Xz
-AbxShsH43FH1ucgygKDlKTB/yXZWDoDVhjdgLFjaBtAt0xyAL9Doet844oDVhbbO
+W97X4rvT+K/NQ7FVCYfOg1XpQhzlSiC9z1M4WLmPRutUgsDY5n5RFJu2R8K5DAfi
-FqOwXHMd+PE23rgqiCscsA==
+sAPcxiQUGVKrmDUva16yNqoR2Dkx2XE9iW1hpkfGFYVUK+QKIBkUEowQQlJJ1Wg1

hosts/router/secrets/cf-api-key.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A Kj69kavxx+ATNHP5pX0JtGggU76f9uRwkZp2HbjwiWc
-SbU3jIcQzUzaQjRHzVSoW1WKiUj+1ijbkUKqVb406fY
---- vMV0TcchFvxw1xetQQZ0xVi2KwjLFRfZBM1gl7BGbGI
-Âä1�£ÃéKò<¯␍–fNGL½ÍÉ­¶ Ké5c‰é�uǶ6Ï-�¢,!H'¹Ð¦Î™4Y»‹c]<%”ßÞ˜Î;B¹ÛÎnŒRb— �Œ

hosts/vm/default.nix

@@ -70,7 +70,6 @@
   # https://github.com/flatpak/flatpak/issues/2861
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
-#  workarounds.flatpak.enable = true;
   fonts.packages = with pkgs; [
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif

modules/default.nix

@@ -1,6 +1,5 @@
 { ... }: {
   imports = [
     ./opts
-    ./workarounds
   ];
 }

modules/opts/kb-input/default.nix

@@ -45,7 +45,7 @@ in {
       enable = true;
       type = "fcitx5";
       fcitx5.waylandFrontend = true;
-      fcitx5.plasma6Support = true;
+      # fcitx5.plasma6Support = true;
       fcitx5.addons = [ pkgs.fcitx5-mozc ];
     };
   };

modules/router/default.nix

@@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+let
+  vars = import ./vars.nix config;
+  enableDesktop = config.router.enableDesktop;
+in
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./opts.nix
+      ./ifconfig.nix
+      ./wireguard.nix
+      ./firewall.nix
+      ./dns.nix
+      ./kea.nix
+      ./glance.nix
+      ./services.nix
+    ];
+  # Secrix for secrets management
+  secrix.hostPubKey = vars.pubkey;
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = false;
+  boot.kernelParams = [
+    "sysrq_always_enabled=1"
+  ];
+
+  boot.loader.timeout = 2;
+  boot.loader.systemd-boot.configurationLimit = 5;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+  boot.growPartition = true;
+
+  # Enable the X11 windowing system.
+  # You can disable this if you're only using the Wayland session.
+  services.xserver.enable = false;
+
+  # Enable the KDE Plasma Desktop Environment.
+  # Useful for debugging with wireshark.
+  hardware.graphics.enable = true;
+  services.xserver.desktopManager.xfce.enable = enableDesktop;
+  services.xserver.desktopManager.xfce.enableWaylandSession = enableDesktop;
+  # services.displayManager.sddm.enable = enableDesktop;
+  # services.displayManager.sddm.wayland.enable = enableDesktop;
+  # services.desktopManager.plasma6.enable = enableDesktop;
+  # No need for audio in VM
+  services.pipewire.enable = false;
+
+  # VM services
+  services.qemuGuest.enable = true;
+  services.spice-vdagentd.enable = true;
+
+  security.sudo.wheelNeedsPassword = false;
+
+  programs.firefox.enable = true;
+  programs.fish.enable = true;
+  programs.git.enable = true;
+  programs.neovim.enable = true;
+  programs.bat.enable = true;
+  programs.htop.enable = true;
+  programs.wireshark.enable = true;
+  programs.wireshark.package = pkgs.wireshark; # wireshark-cli by default
+
+  environment.systemPackages = with pkgs; [
+    dust
+    eza
+    fastfetch
+    fd
+    kdePackages.kate
+    ldns
+    lsof
+    micro
+    mpv
+    openssl
+    ripgrep
+    rustscan
+    starship
+    tealdeer
+    transcrypt
+    wakeonlan
+    waypipe
+    whois
+    wireguard-tools
+  ];
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.11"; # Did you read the comment?
+}

modules/router/dns.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  vars = import ./vars.nix config;
   domain = vars.domain;
   ldomain = vars.ldomain;
   sysdomain = vars.sysdomain;
@@ -28,6 +28,8 @@ let
     "|woodpecker."
     "||pgrok."
     "|sync."
+    "|minecruft."
+    "|n8n."
   ];
 in
 {
@@ -80,11 +82,14 @@ in
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
+      "|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
+
       # Lab DNS rewrites
       "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
+      "@@||stats.grafana.org"
     ]
       # Alpina DNS rewrites
       ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;

modules/router/firewall.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  vars = import ./vars.nix config;
   links = vars.links;
   ifs = vars.ifs;
   pdFromWan = vars.pdFromWan;
@@ -56,6 +56,12 @@ in
               udp . 45608 : ${vars.extra.opnsense.addr4} . 45608,
               udp . 35848 : ${vars.extra.opnsense.addr4} . 35848,
               udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
+              # Amnezia VPN server
+              udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
+              # Minecruft server
+              tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
+              udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
+              udp . 24454 : ${vars.extra.minecruft.addr4} . 24454,
           }
       }
 

modules/router/glance.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  vars = import ./vars.nix config;
   domain = vars.domain;
 in
 {

modules/router/ifconfig.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  cfg = config.router;
+  vars = import ./vars.nix config;
   links = vars.links;
   ifs = vars.ifs;
   pdFromWan = vars.pdFromWan;
@@ -57,7 +58,7 @@ in
   # https://github.com/systemd/systemd/issues/22571
   # https://github.com/systemd/systemd/issues/22571#issuecomment-2094905496
   # https://gist.github.com/csamsel/0f8cca3b2e64d7e4cc47819ec5ba9396
-  networking.dhcpcd.enable = true;
+  networking.dhcpcd.enable = cfg.enableDhcpClient;
   networking.dhcpcd.allowInterfaces = [ ifs.wan.name ];
   networking.dhcpcd.extraConfig = ''
     debug

modules/router/kea.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  vars = import ./vars.nix config;
   ldomain = vars.ldomain;
   ifs = vars.ifs;
 

modules/router/opts.nix

@@ -0,0 +1,69 @@
+{ lib, config, ... }:
+
+with lib;
+
+{
+  options = {
+    router = {
+      enableDesktop = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable desktop environment for debugging";
+      };
+
+      enableDhcpClient = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable DHCP client (should only be set on the main router)";
+      };
+
+      wanMAC = mkOption {
+        type = types.str;
+        example = "bc:24:11:4f:c9:c4";
+        description = "WAN interface MAC address";
+      };
+
+      lanMAC = mkOption {
+        type = types.str;
+        example = "bc:24:11:83:d8:de";
+        description = "LAN interface MAC address";
+      };
+
+      wanLL = mkOption {
+          type = types.str;
+          example = "fe80::be24:11ff:fe4f:c9c4";
+          description = "WAN IPv6 link-local address";
+      };
+
+      lanLL = mkOption {
+          type = types.str;
+          example = "fe80::be24:11ff:fe83:d8de";
+          description = "LAN IPv6 link-local address";
+      };
+
+      defaultToken = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Default token for interface addressing";
+      };
+
+      wanAddr4 = mkOption {
+        type = types.str;
+        example = "192.168.1.61";
+        description = "WAN IPv4 address";
+      };
+
+      wanGw4 = mkOption {
+        type = types.str;
+        example = "192.168.1.254";
+        description = "WAN IPv4 gateway";
+      };
+
+      pdFromWan = mkOption {
+        type = types.str;
+        example = "2001:db8:0:000";
+        description = "IPv6 prefix delegation from ISP (/60)";
+      };
+    };
+  };
+}

modules/router/services.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  vars = import ./vars.nix config;
   domain = vars.domain;
 in
 {
@@ -58,27 +58,36 @@ in
     enable = true;
     package = pkgs.caddy.withPlugins {
       plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
+      hash = "sha256-F7d4HwM4oCkQrFMr4SFSC0r52ONxY+PW6z5BJawW8Ok=";
     };
-    virtualHosts."grouter.${domain}".extraConfig = ''
+    virtualHosts."*.${domain}".extraConfig = ''
       encode
       tls {
           dns cloudflare {env.CF_API_KEY}
           resolvers 1.1.1.1
       }
-      @grafana path /grafana /grafana/*
+
-      handle @grafana {
+      @grouter host grouter.${domain}
-          reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
+      handle @grouter {
-      }
+          @grafana path /grafana /grafana/*
-      redir /adghome /adghome/
+          handle @grafana {
-      handle_path /adghome/* {
+              reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
-          reverse_proxy localhost:${toString config.services.adguardhome.port}
+          }
-          basic_auth {
+          redir /adghome /adghome/
-              Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
+          handle_path /adghome/* {
+              reverse_proxy localhost:${toString config.services.adguardhome.port}
+              basic_auth {
+                  Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
+              }
+          }
+          handle /* {
+              reverse_proxy localhost:${toString config.services.glance.settings.server.port}
           }
       }
-      handle /* {
+
-          reverse_proxy localhost:${toString config.services.glance.settings.server.port}
+      @hass host hass.${domain}
+      handle @hass {
+          reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
       }
     '';
   };

modules/router/vars.nix

@@ -1,6 +1,6 @@
+config:
 let
-  private = import ./private.nix;
+  cfg = config.router;
-
   mkIfConfig = {
     name_,
     domain_,
@@ -10,7 +10,7 @@ let
     p6Size_ ? 64,
     ulaPrefix_,  # /64
     ulaSize_ ? 64,
-    token? 1,
+    token? cfg.defaultToken,
     ip6Token_? "::${toString token}",
     ulaToken_? "::${toString token}",
     }: rec {
@@ -41,21 +41,21 @@ rec {
   ldomain = "l.${domain}";
   sysdomain = "sys.${domain}";
   links = {
-    wanMAC = "bc:24:11:4f:c9:c4";
+    wanMAC = cfg.wanMAC;
-    lanMAC = "bc:24:11:83:d8:de";
+    lanMAC = cfg.lanMAC;
-    wanLL = "fe80::be24:11ff:fe4f:c9c4";
+    wanLL = cfg.wanLL;
-    lanLL = "fe80::be24:11ff:fe83:d8de";
+    lanLL = cfg.lanLL;
   };
 
   p4 = "10.17";                      # .0.0/16
-  pdFromWan = private.pdFromWan;  # ::/60
+  pdFromWan = cfg.pdFromWan;         # ::/60
   ulaPrefix = "fdab:07d3:581d";      # ::/48
   ifs = rec {
     wan = rec {
       name = "wan";
-      addr4 = private.wanAddr4;
+      addr4 = cfg.wanAddr4;
-      addr4Sized = "${addr4}/23";
+      addr4Sized = "${addr4}/24";
-      gw4 = private.wanGw4;
+      gw4 = cfg.wanGw4;
     };
     lan = mkIfConfig {
       name_ = "lan";
@@ -77,7 +77,7 @@ rec {
       p4_ = "${p4}.20";                  # .0/24
       p6_ = "${pdFromWan}0";             # ::/64 managed by Att box
       ulaPrefix_ = "${ulaPrefix}:0020";  # ::/64
-      ip6Token_ = "::1:1";  # override ipv6 for lan20, since the Att box uses ::1 here
+      ip6Token_ = "::1:${toString cfg.defaultToken}";  # override ipv6 for lan20, since the Att box uses ::1 here
     };
     lan30 = mkIfConfig {
       name_ = "${lan.name}.30";
@@ -135,5 +135,7 @@ rec {
         }
       ];
     };
+    amnezia.addr4 = "${ifs.lan10.p4}.31";
+    minecruft.addr4 = "${ifs.lan.p4}.11";
   };
 }

modules/router/wireguard.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  vars = import ./vars.nix;
+  vars = import ./vars.nix config;
   wg0 = vars.ifs.wg0;
 
   peerIps = ifObj: token: [

modules/workarounds/default.nix

@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./flatpak.nix
-  ];
-}

modules/workarounds/flatpak.nix

@@ -1,44 +0,0 @@
-# https://github.com/knightpp/nixos-cfg/blob/main/modules/workarounds/flatpak.nix
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.workarounds.flatpak;
-in {
-  options = {
-    workarounds.flatpak = {
-      enable = lib.mkEnableOption "flatpak workaround";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    system.fsPackages = [pkgs.bindfs];
-    fileSystems = let
-      mkRoSymBind = path: {
-        device = path;
-        fsType = "fuse.bindfs";
-        options = ["ro" "resolve-symlinks" "x-gvfs-hide"];
-      };
-      aggregated = pkgs.buildEnv {
-        name = "system-fonts-and-icons";
-        paths = builtins.attrValues {
-          inherit (pkgs.kdePackages) breeze;
-          inherit
-            (pkgs)
-            noto-fonts
-            noto-fonts-emoji
-            noto-fonts-cjk-sans
-            noto-fonts-cjk-serif
-            ;
-        };
-        pathsToLink = ["/share/fonts" "/share/icons"];
-      };
-    in {
-      # Create an FHS mount to support flatpak host icons/fonts
-      "/usr/share/icons" = mkRoSymBind "${aggregated}/share/icons";
-      "/usr/share/fonts" = mkRoSymBind "${aggregated}/share/fonts";
-    };
-  };
-}

users/cazzzer/default.nix

@@ -5,7 +5,7 @@
     isNormalUser = true;
     description = "Yura";
     group = "cazzzer";
-    extraGroups = [ "wheel" ]
+    extraGroups = [ "wheel" "dialout" ]
       ++ lib.optionals config.networking.networkmanager.enable [ "networkmanager" ]
       ++ lib.optionals config.virtualisation.docker.enable [ "docker" ]
       ++ lib.optionals config.programs.wireshark.enable [ "wireshark" ]