transform the other hosts to flake

common/globalinstalls.nix

@@ -22,14 +22,11 @@
       zsh.enable = true;
       htop.enable = true;
       iotop.enable = true;
+      git.enable = true;
       nano = {
         enable = true;
         syntaxHighlight = true;
       };
-      git = {
-        enable = true;
-        package = pkgs.gitFull;
-      };
     };
   };
 }

flake.nix

@@ -19,7 +19,6 @@
   }: let
     common-modules = [
       lix-module.nixosModules.default
-      home-manager.nixosModules.home-manager
       ./common
     ];
   in {
@@ -29,9 +28,32 @@
         modules =
           common-modules
           ++ [
+            home-manager.nixosModules.home-manager
             ./hosts/vinzenz-lpt2
           ];
       };
+      vinzenz-pc2 = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules =
+          common-modules
+          ++ [
+            home-manager.nixosModules.home-manager
+            ./hosts/vinzenz-pc2
+          ];
+      };
+      hetzner-vpn1 = nixpkgs.lib.nixosSystem {
+        system = "aarch64-linux";
+        modules =
+          common-modules
+          ++ [
+            ./hosts/hetzner-vpn1
+
+            {
+              # uncomment for build check on non arm system (requires --impure)
+              # nixpkgs.buildPlatform = builtins.currentSystem;
+            }
+          ];
+      };
     };
   };
 }

hosts/hetzner-vpn1/default.nix

@@ -0,0 +1,9 @@
+{...}: {
+  imports = [
+    ./hardware.nix
+    ./environment.nix
+  ];
+  config = {
+    networking.hostName = "hetzner-vpn1";
+  };
+}

hosts/hetzner-vpn1/environment.nix

@@ -0,0 +1,81 @@
+{
+  pkgs,
+  lib,
+  ...
+}: let
+  servicesDomain = "services.zerforschen.plus";
+  mkServiceConfig = host: port: {
+    addSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}/";
+      extraConfig = ''
+        # bind to tailscale ip
+        proxy_bind 100.88.118.60;
+        # pam auth
+        limit_except OPTIONS {
+          auth_pam  "Password Required";
+          auth_pam_service_name "nginx";
+        }
+      '';
+    };
+  };
+  lpt2 = "vinzenz-lpt2.donkey-pentatonic.ts.net";
+  pc2 = "vinzenz-pc2.donkey-pentatonic.ts.net";
+in {
+  imports = [
+    ../../users/vinzenz.nix
+    ../../users/ronja.nix
+  ];
+
+  config = {
+    users.users = {
+      root.openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+      ];
+      vinzenz.openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+      ];
+      ronja.openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
+      ];
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "acme@zerforschen.plus";
+    };
+
+    security.pam.services.nginx.setEnvironment = false;
+    systemd.services.nginx.serviceConfig = {
+      SupplementaryGroups = ["shadow"];
+    };
+
+    services.nginx = {
+      enable = true;
+      additionalModules = [pkgs.nginxModules.pam];
+
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+
+      virtualHosts = {
+        "vscode.${servicesDomain}" = lib.mkMerge [
+          (mkServiceConfig pc2 8542)
+          {locations."/" .proxyWebsockets = true;}
+        ];
+        "preon-app.${servicesDomain}" = mkServiceConfig pc2 8543;
+        "preon-api.${servicesDomain}" = mkServiceConfig pc2 8544;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [80 443];
+  };
+}

hosts/hetzner-vpn1/hardware.nix

@@ -0,0 +1,101 @@
+{
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  config = {
+    nixpkgs = {
+      hostPlatform = "aarch64-linux";
+      system = "aarch64-linux";
+    };
+
+    boot = {
+      tmp.cleanOnBoot = true;
+      loader = {
+        systemd-boot.enable = lib.mkForce false;
+        efi.canTouchEfiVariables = lib.mkForce false;
+        grub = {
+          enable = true;
+          efiSupport = true;
+          efiInstallAsRemovable = true;
+          device = "nodev";
+        };
+      };
+      initrd = {
+        availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
+        kernelModules = ["nvme"];
+      };
+    };
+
+    zramSwap.enable = true;
+    networking.domain = "";
+
+    fileSystems = {
+      "/boot" = {
+        device = "/dev/disk/by-uuid/77CF-345D";
+        fsType = "vfat";
+      };
+      "/" = {
+        device = "/dev/sda1";
+        fsType = "ext4";
+      };
+    };
+
+    # This file was populated at runtime with the networking
+    # details gathered from the active system.
+    networking = {
+      nameservers = ["8.8.8.8"];
+      defaultGateway = "172.31.1.1";
+      defaultGateway6 = {
+        address = "fe80::1";
+        interface = "eth0";
+      };
+      dhcpcd.enable = false;
+      usePredictableInterfaceNames = lib.mkForce false;
+      interfaces = {
+        eth0 = {
+          ipv4 = {
+            addresses = [
+              {
+                address = "157.90.146.125";
+                prefixLength = 32;
+              }
+            ];
+            routes = [
+              {
+                address = "172.31.1.1";
+                prefixLength = 32;
+              }
+            ];
+          };
+          ipv6 = {
+            addresses = [
+              {
+                address = "2a01:4f8:c012:7137::1";
+                prefixLength = 64;
+              }
+              {
+                address = "fe80::9400:2ff:fe87:7fc9";
+                prefixLength = 64;
+              }
+            ];
+            routes = [
+              {
+                address = "fe80::1";
+                prefixLength = 128;
+              }
+            ];
+          };
+        };
+      };
+    };
+
+    services.udev.extraRules = ''
+      ATTR{address}=="96:00:02:87:7f:c9", NAME="eth0"
+    '';
+  };
+}

hosts/vinzenz-lpt2/default.nix

@@ -5,5 +5,7 @@
   ];
   config = {
     networking.hostName = "vinzenz-lpt2";
+
+    nix.settings.extra-platforms = ["aarch64-linux"];
   };
 }

hosts/vinzenz-lpt2/environment.nix

@@ -27,11 +27,11 @@
       ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
       ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
     ];
-    #
+
     #users.users.ronja.openssh.authorizedKeys.keys = [
     #  ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
     #];
-    #
+
     services.nginx = {
       enable = true;
 

hosts/vinzenz-pc2/default.nix

@@ -0,0 +1,9 @@
+{...}: {
+  imports = [
+    ./hardware.nix
+    ./environment.nix
+  ];
+  config = {
+    networking.hostName = "vinzenz-pc2";
+  };
+}

hosts/vinzenz-pc2/environment.nix

@@ -0,0 +1,49 @@
+{pkgs, ...}: {
+  imports = [
+    ../../home
+    ../../home/gnome.nix
+    ../../users/vinzenz.nix
+    ../../modules/desktop-environment.nix
+    ../../modules/gnome.nix
+    ../../modules/gaming.nix
+    ../../modules/printing.nix
+  ];
+
+  config = {
+    home-manager.users = {
+      vinzenz = import ../../home/vinzenz;
+      ronja = import ../../home/ronja;
+    };
+
+    users.users.vinzenz.openssh.authorizedKeys.keys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrY6tcgnoC/xbgL7vxSjddEY9MBxRXe9n2cAHt88/TT home roaming''
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+    ];
+
+    users.users.ronja.openssh.authorizedKeys.keys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ssh-host-key''
+    ];
+
+    services.openvscode-server = {
+      enable = true;
+      telemetryLevel = "off";
+      port = 8542;
+      host = "100.125.93.127"; # tailscale
+      withoutConnectionToken = true;
+      extraPackages = with pkgs; [nodejs git gh direnv];
+    };
+
+    virtualisation.podman = {
+      enable = true;
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [8542 8543 8544 80];
+      };
+
+      interfaces.eno1.wakeOnLan.enable = true;
+    };
+  };
+}

hosts/vinzenz-pc2/hardware.nix

@@ -0,0 +1,56 @@
+{...}: {
+  imports = [
+    ../../modules/desktop-hardware.nix
+    ../../modules/amd-graphics.nix
+  ];
+  config = {
+    # amd cpu
+    boot.kernelModules = ["kvm-amd"];
+    hardware.cpu.amd.updateMicrocode = true;
+
+    boot = {
+      initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "sd_mod"]; # "usb_storage"
+      loader.efi.efiSysMountPoint = "/boot";
+    };
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvol=@"];
+      };
+
+      "/home" = {
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvol=@home"];
+      };
+
+      "/games" = {
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvol=@games"];
+      };
+
+      "/boot" = {
+        device = "/dev/disk/by-uuid/AF67-8F16";
+        fsType = "vfat";
+      };
+
+      "/mnt/nixos_btrfs_root" = {
+        # subvolume with id 5 is always the root volume
+        # this is convenient for managing the flat subvolume hierarchy
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvolid=5"];
+      };
+
+      "/mnt/ssd2" = {
+        device = "/dev/disk/by-uuid/6b2a647d-c68e-4c07-85bf-c9bfc5db7e8a";
+        fsType = "ext4";
+      };
+    };
+
+    swapDevices = [];
+  };
+}

modules/amd-graphics.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  config = {
+    boot.kernelModules = ["amdgpu"];
+    services.xserver.videoDrivers = ["amdgpu"];
+
+    hardware.opengl = {
+      extraPackages = with pkgs; [
+        amdvlk
+      ];
+      extraPackages32 = with pkgs; [
+        driversi686Linux.amdvlk
+      ];
+    };
+
+    environment.systemPackages = with pkgs; [
+      nvtopPackages.amd
+    ];
+  };
+}

modules_bak/hardware/amd.nix

@@ -1,47 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}: let
-  cfg = config.my.hardware.amd;
-in {
-  options.my.hardware.amd = {
-    cpu = lib.mkEnableOption "amd cpu";
-    gpu = lib.mkEnableOption "amd gpu";
-    radeon = lib.mkEnableOption "amd legacy gpu"; # old hardware, dont judge
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.cpu {
-      boot.kernelModules = ["kvm-amd"];
-      hardware.cpu.amd.updateMicrocode = true;
-    })
-
-    (lib.mkIf cfg.gpu {
-      boot.kernelModules = ["amdgpu"];
-      services.xserver.videoDrivers = ["amdgpu"];
-
-      hardware.opengl = {
-        extraPackages = with pkgs; [
-          amdvlk
-        ];
-        extraPackages32 = with pkgs; [
-          driversi686Linux.amdvlk
-        ];
-      };
-
-      environment.systemPackages = with pkgs; [
-        nvtopPackages.amd
-      ];
-    })
-
-    (lib.mkIf cfg.radeon {
-      boot.kernelModules = ["radeon"];
-      services.xserver.videoDrivers = ["radeon"];
-      environment.systemPackages = with pkgs; [
-        radeontop
-      ];
-    })
-  ];
-}