configuration/common.nix

@@ -1,10 +1,4 @@
-{
+{ pkgs, ... }:
-  pkgs,
-  lib,
-  user,
-  ...
-}:
-with lib;
 {
   # NixOS version.
   system.stateVersion = "25.05";
@@ -18,9 +12,6 @@ with lib;
   # Allow unfree packages.
   nixpkgs.config.allowUnfree = true;
 
-  # Enable redistributable firmware.
-  hardware.enableRedistributableFirmware = true;
-
   # Set time zone.
   time.timeZone = "Australia/Perth";
 
@@ -45,19 +36,6 @@ with lib;
     variant = "";
   };
 
-  # Enable networking.
-  networking.networkmanager.enable = true;
-
-  # Define a user account.
-  users.users.${user} = {
-    isNormalUser = true;
-    description = mkIf (user == "fern") "Fern Garden";
-    extraGroups = [
-      "wheel"
-      "networkmanager"
-    ];
-  };
-
   # Use fish shell
   programs.fish = {
     enable = true;

configuration/desktop.nix

@@ -5,14 +5,14 @@
   fluffychat2,
   ...
 }:
-with lib;
+
 {
   # Configure the bootloader.
   boot = {
     # Enable secure boot.
     bootspec.enable = true;
     initrd.systemd.enable = true;
-    loader.systemd-boot.enable = mkForce false;
+    loader.systemd-boot.enable = lib.mkForce false;
     loader.efi.canTouchEfiVariables = true;
 
     lanzaboote = {
@@ -43,6 +43,19 @@ with lib;
   # Enable smart card support (for YubiKey).
   services.pcscd.enable = true;
 
+  # Enable networking.
+  networking.networkmanager.enable = true;
+
+  # Define a user account.
+  users.users.fern = {
+    isNormalUser = true;
+    description = "Fern Garden";
+    extraGroups = [
+      "networkmanager"
+      "wheel"
+    ];
+  };
+
   # Encrypt user's home with fscrypt
   security.pam.enableFscrypt = true;
 
@@ -107,7 +120,6 @@ with lib;
   environment.systemPackages = with pkgs; [
     adwsteamgtk
     ansible
-    caligula
     celluloid
     discord
     feishin0_17.feishin
@@ -166,7 +178,7 @@ with lib;
   };
 
   # Enable CPU frequency scaling management.
-  services.power-profiles-daemon.enable = mkForce false; # enabled by gnome
+  services.power-profiles-daemon.enable = lib.mkForce false; # enabled by gnome
   services.tlp.enable = lib.mkForce false; # enabled by nixos-hardware
   services.auto-cpufreq.enable = true;
-}
+}

configuration/server/common.nix

@@ -0,0 +1,10 @@
+{
+  # Passwordless sudo
+  security.sudo.wheelNeedsPassword = false;
+
+  # Enable all terminfo (for ghostty)
+  environment.enableAllTerminfo = true;
+
+  # Enable SSH server
+  services.openssh.enable = true;
+}

configuration/server/containers/common.nix

@@ -1,10 +1,8 @@
+{ modulesPath, ... }:
 {
-  modulesPath,
+  # Import Proxmox LXC configuration.
-  ...
-}:
-{
   imports = [
     (modulesPath + "/virtualisation/proxmox-lxc.nix")
-    ./server.nix
   ];
-}
+}
+

configuration/server/containers/firefox-syncserver.nix

@@ -7,7 +7,7 @@
     secrets."firefox_syncserver/sync_master_secret" = {};
   };
 
-  # Enable Firefox sync service.
+  # syncserver-rs service.
   services.mysql.package = pkgs.mariadb;
 
   services.firefox-syncserver = {
@@ -22,6 +22,5 @@
     };
   };
 
-  # Open Firefox sync service port.
   networking.firewall.allowedTCPPorts = [ 5000 ];
 }

configuration/server/containers/technitium.nix

@@ -1,5 +1,4 @@
 {
-  # Enable Technitium DNS server.
   services.technitium-dns-server = {
     enable = true;
     openFirewall = true;

configuration/server/docker.nix

@@ -1,25 +1,23 @@
-{ user, lib, ... }:
-with lib;
 {
-  # Passwordless sudo
+  # Define a user account.
-  security.sudo.wheelNeedsPassword = false;
+  users.users.docker = {
-
+    isNormalUser = true;
-  # Enable all terminfo (for ghostty)
+    linger = true;
-  environment.enableAllTerminfo = true;
+    extraGroups = [
-
+      "wheel"
-  # Enable SSH server
+      "docker"
-  services.openssh.enable = true;
+    ];
-
-  users.users.${user} = {
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIETPyuxUVEmYyEW6PVC6BXqkhULHd/RvMm8fMbYhjTMV fern@muskduck"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzW4epTmK01kGVXcuAXUNJQPltnogf4uab9FA5m8S3n fern@pardalote"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEJYq1fMxVOzCMfE/td6DtWS8nUk76U9seYD3Z9RYAz u0_a399@fairywren"
       "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIMoJvPcUJDVVzO4dHROCFNlgJdDZSP5xyPx2s40zcx5QAAAABHNzaDo= YubiKey5NFC"
     ];
-    extraGroups = mkIf (user == "docker") [ "docker" ];
   };
 
-  # Enable docker.
+  # Auto login
-  virtualisation.docker.enable = mkIf (user == "docker") true;
+  services.getty.autologinUser = "docker";
-}
+
+  # Enable docker
+  virtualisation.docker.enable = true;
+}

configuration/server/vm.nix

@@ -1,13 +1,8 @@
+{ lib, modulesPath, ... }:
 {
-  modulesPath,
+  # Import qemu guest configuration.
-  lib,
-  ...
-}:
-with lib;
-{
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
-    ./server.nix
   ];
 
   # Load kernel modules.
@@ -22,7 +17,7 @@ with lib;
   boot.kernelModules = [ "kvm-intel" ];
 
   # Enable DHCP.
-  networking.useDHCP = mkDefault true;
+  networking.useDHCP = lib.mkDefault true;
 
   # Configure the bootloader.
   boot.loader.grub = {

flake.nix

@@ -6,12 +6,11 @@
     lanzaboote.url = "github:nix-community/lanzaboote"; # Secure boot.
     nixos-hardware.url = "github:NixOS/nixos-hardware"; # Hardware specific config.
     sops-nix.url = "github:Mic92/sops-nix"; # Secrets management.
-    # Secrets repo.
     secrets = {
       url = "git+ssh://git@docker.local:222/fern/secrets?ref=main";
       flake = false;
-    };
+    }; # Secrets repo.
-    
+
     # Updated packages.
     fluffychat2.url = "github:NixOS/nixpkgs?ref=pull/419632/head"; # FluffyChat 2.0.0
     feishin0_17.url = "github:NixOS/nixpkgs?ref=pull/414929/head"; # Feishin 0.17.0
@@ -28,88 +27,97 @@
       feishin0_17,
       ...
     }:
-    let
-      mkHost =
-        with nixpkgs.lib;
-        {
-          hostname,
-          suite,
-          platform,
-          user ? "fern",
-          extraModules ? [ ],
-        }:
-        nixosSystem rec {
-          system = platform;
-
-          specialArgs = {
-            inherit user;
-            secrets = builtins.toString inputs.secrets;
-            fluffychat2 = import fluffychat2 { inherit system; };
-            feishin0_17 = import feishin0_17 { inherit system; };
-          };
-
-          modules = [
-            ./suites/common.nix
-            ./suites/${suite}.nix
-            ./hosts/${suite}/${hostname}.nix
-            { networking.hostName = hostname; }
-          ] ++ extraModules;
-        };
-    in
     {
-      nixosConfigurations = {
+      # ThinkPad T480
-        # Laptops.
+      nixosConfigurations.muskduck = nixpkgs.lib.nixosSystem rec {
-        muskduck = mkHost {
+        system = "x86_64-linux";
-          hostname = "muskduck";
+
-          suite = "laptop";
+        specialArgs = {
-          platform = "x86_64-linux";
+          fluffychat2 = import fluffychat2 { inherit system; };
-          extraModules = [
+          feishin0_17 = import feishin0_17 { inherit system; };
-            lanzaboote.nixosModules.lanzaboote
-            nixos-hardware.nixosModules.lenovo-thinkpad-t480
-          ];
         };
 
-        # Servers.
+        modules = [
-        weebill = mkHost {
+          { networking.hostName = "muskduck"; }
-          hostname = "weebill";
+
-          suite = "server";
+          lanzaboote.nixosModules.lanzaboote
-          platform = "aarch64-linux";
+          nixos-hardware.nixosModules.lenovo-thinkpad-t480
-          user = "docker";
+
-          extraModules = [
+          ./configuration/common.nix
-            nixos-hardware.nixosModules.raspberry-pi-4
+          ./configuration/desktop.nix
-          ];
+          
+          ./hosts/muskduck.nix # Include the results of the hardware scan.
+        ];
+      };
+
+      ### Proxmox Guests ###
+
+      nixosConfigurations.vm-minecraft = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+
+        modules = [
+          { networking.hostName = "minecraft"; }
+
+          ./configuration/common.nix
+          
+          ./configuration/server/common.nix
+          ./configuration/server/vm.nix
+          ./configuration/server/docker.nix
+          
+          ./hosts/vm-minecraft.nix # Include the results of the hardware scan.
+        ];
+      };
+
+      nixosConfigurations.vm-docker = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+
+        modules = [
+          { networking.hostName = "docker"; }
+
+          ./configuration/common.nix
+          
+          ./configuration/server/common.nix
+          ./configuration/server/vm.nix
+          ./configuration/server/docker.nix
+
+          ./hosts/vm-docker.nix # Include the results of the hardware scan.
+        ];
+      };
+
+      nixosConfigurations.lxc-technitium = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+
+        modules = [
+          { networking.hostName = "technitium"; }
+          
+          ./configuration/common.nix
+
+          ./configuration/server/common.nix
+          ./configuration/server/containers/common.nix
+
+          ./configuration/server/containers/technitium.nix
+        ];
+      };
+
+      nixosConfigurations.lxc-firefox-syncserver = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        
+        specialArgs = {
+          secrets = builtins.toString inputs.secrets;
         };
 
-        # Virtual machines.
+        modules = [
-        vm-docker = mkHost {
+          sops-nix.nixosModules.sops
-          hostname = "docker";
+          
-          suite = "vm";
+          { networking.hostName = "firefox-syncserver"; }
-          user = "docker";
+          
-          platform = "x86_64-linux";
+          ./configuration/common.nix
-        };
 
-        vm-minecraft = mkHost {
+          ./configuration/server/common.nix
-          hostname = "minecraft";
+          ./configuration/server/containers/common.nix
-          suite = "vm";
-          user = "docker";
-          platform = "x86_64-linux";
-        };
 
-        # LXC containers.
+          ./configuration/server/containers/firefox-syncserver.nix
-        lxc-technitium = mkHost {
+        ];
-          hostname = "technitium";
-          suite = "lxc";
-          platform = "x86_64-linux";
-        };
-
-        lxc-firefox-syncserver = mkHost {
-          hostname = "firefox-syncserver";
-          suite = "lxc";
-          platform = "x86_64-linux";
-          extraModules = [
-            sops-nix.nixosModules.sops
-          ];
-        };
       };
     };
 }

hosts/muskduck.nix

@@ -1,12 +1,24 @@
 {
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
   boot.initrd.availableKernelModules = [
     "xhci_pci"
     "nvme"
     "usb_storage"
     "sd_mod"
   ];
-
+  boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/63d79656-aa5b-466a-b369-be5eac3f51ab";
@@ -25,5 +37,10 @@
     ];
   };
 
-  hardware.cpu.intel.updateMicrocode = true;
+  swapDevices = [ ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/server/weebill.nix

@@ -1,26 +0,0 @@
-{ pkgs, ... }:
-{
-  boot = {
-    kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "usbhid"
-      "usb_storage"
-    ];
-    loader = {
-      grub.enable = false;
-      generic-extlinux-compatible.enable = true;
-    };
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-      options = [ "noatime" ];
-    };
-  };
-
-  # Open ports for DHCP server. 
-  networking.firewall.allowedUDPPorts = [ 53 67 ];
-}