first building version of lpt2 as flake

modules_bak/hardware/amd.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  cfg = config.my.hardware.amd;
+in {
+  options.my.hardware.amd = {
+    cpu = lib.mkEnableOption "amd cpu";
+    gpu = lib.mkEnableOption "amd gpu";
+    radeon = lib.mkEnableOption "amd legacy gpu"; # old hardware, dont judge
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.cpu {
+      boot.kernelModules = ["kvm-amd"];
+      hardware.cpu.amd.updateMicrocode = true;
+    })
+
+    (lib.mkIf cfg.gpu {
+      boot.kernelModules = ["amdgpu"];
+      services.xserver.videoDrivers = ["amdgpu"];
+
+      hardware.opengl = {
+        extraPackages = with pkgs; [
+          amdvlk
+        ];
+        extraPackages32 = with pkgs; [
+          driversi686Linux.amdvlk
+        ];
+      };
+
+      environment.systemPackages = with pkgs; [
+        nvtopPackages.amd
+      ];
+    })
+
+    (lib.mkIf cfg.radeon {
+      boot.kernelModules = ["radeon"];
+      services.xserver.videoDrivers = ["radeon"];
+      environment.systemPackages = with pkgs; [
+        radeontop
+      ];
+    })
+  ];
+}

modules_bak/hardware/hetzner-vpn1.nix

@@ -0,0 +1,102 @@
+{
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  config = {
+    nixpkgs = {
+      hostPlatform = "aarch64-linux";
+      system = "aarch64-linux";
+    };
+
+    boot = {
+      tmp.cleanOnBoot = true;
+      loader = {
+        systemd-boot.enable = lib.mkForce false;
+        efi.canTouchEfiVariables = lib.mkForce false;
+        grub = {
+          enable = true;
+          efiSupport = true;
+          efiInstallAsRemovable = true;
+          device = "nodev";
+        };
+      };
+      initrd = {
+        availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
+        kernelModules = ["nvme"];
+      };
+    };
+
+    zramSwap.enable = true;
+    networking.domain = "";
+
+    fileSystems = {
+      "/boot" = {
+        device = "/dev/disk/by-uuid/77CF-345D";
+        fsType = "vfat";
+      };
+      "/" = {
+        device = "/dev/sda1";
+        fsType = "ext4";
+      };
+    };
+
+    # This file was populated at runtime with the networking
+    # details gathered from the active system.
+    networking = {
+      nameservers = ["8.8.8.8"];
+      defaultGateway = "172.31.1.1";
+      defaultGateway6 = {
+        address = "fe80::1";
+        interface = "eth0";
+      };
+      dhcpcd.enable = false;
+      usePredictableInterfaceNames = lib.mkForce false;
+      interfaces = {
+        eth0 = {
+          ipv4 = {
+            addresses = [
+              {
+                address = "157.90.146.125";
+                prefixLength = 32;
+              }
+            ];
+            routes = [
+              {
+                address = "172.31.1.1";
+                prefixLength = 32;
+              }
+            ];
+          };
+          ipv6 = {
+            addresses = [
+              {
+                address = "2a01:4f8:c012:7137::1";
+                prefixLength = 64;
+              }
+              {
+                address = "fe80::9400:2ff:fe87:7fc9";
+                prefixLength = 64;
+              }
+            ];
+            routes = [
+              {
+                address = "fe80::1";
+                prefixLength = 128;
+              }
+            ];
+          };
+        };
+      };
+    };
+
+    services.udev.extraRules = ''
+      ATTR{address}=="96:00:02:87:7f:c9", NAME="eth0"
+
+    '';
+  };
+}

modules_bak/hardware/vinzenz-pc2.nix

@@ -0,0 +1,56 @@
+{...}: {
+  config = {
+    my.hardware = {
+      enableCommonDesktopSettings = true;
+      amd = {
+        cpu = true;
+        gpu = true;
+      };
+    };
+
+    boot = {
+      initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "sd_mod"]; # "usb_storage"
+      loader.efi.efiSysMountPoint = "/boot";
+    };
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvol=@"];
+      };
+
+      "/home" = {
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvol=@home"];
+      };
+
+      "/games" = {
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvol=@games"];
+      };
+
+      "/boot" = {
+        device = "/dev/disk/by-uuid/AF67-8F16";
+        fsType = "vfat";
+      };
+
+      "/mnt/nixos_btrfs_root" = {
+        # subvolume with id 5 is always the root volume
+        # this is convenient for managing the flat subvolume hierarchy
+        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+        fsType = "btrfs";
+        options = ["subvolid=5"];
+      };
+
+      "/mnt/ssd2" = {
+        device = "/dev/disk/by-uuid/6b2a647d-c68e-4c07-85bf-c9bfc5db7e8a";
+        fsType = "ext4";
+      };
+    };
+
+    swapDevices = [];
+  };
+}

modules_bak/hetzner-vpn1.nix

@@ -0,0 +1,88 @@
+{
+  pkgs,
+  lib,
+  ...
+}: let
+  servicesDomain = "services.zerforschen.plus";
+  mkServiceConfig = host: port: {
+    addSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}/";
+      extraConfig = ''
+        # bind to tailscale ip
+        proxy_bind 100.88.118.60;
+        # pam auth
+        limit_except OPTIONS {
+          auth_pam  "Password Required";
+          auth_pam_service_name "nginx";
+        }
+      '';
+    };
+  };
+  lpt2 = "vinzenz-lpt2.donkey-pentatonic.ts.net";
+  pc2 = "vinzenz-pc2.donkey-pentatonic.ts.net";
+in {
+  imports = [
+    (import ./modules {
+      hostName = "hetzner-vpn1";
+      enableHomeManager = false;
+    })
+  ];
+
+  config = {
+    my = {
+      enabledUsers = ["ronja" "vinzenz"];
+      tailscale.enable = true;
+    };
+
+    users.users = {
+      root.openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+      ];
+      vinzenz.openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+      ];
+      ronja.openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
+      ];
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "acme@zerforschen.plus";
+    };
+
+    security.pam.services.nginx.setEnvironment = false;
+    systemd.services.nginx.serviceConfig = {
+      SupplementaryGroups = ["shadow"];
+    };
+
+    services.nginx = {
+      enable = true;
+      additionalModules = [pkgs.nginxModules.pam];
+
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+
+      virtualHosts = {
+        "vscode.${servicesDomain}" = lib.mkMerge [
+          (mkServiceConfig pc2 8542)
+          {locations."/" .proxyWebsockets = true;}
+        ];
+        "preon-app.${servicesDomain}" = mkServiceConfig pc2 8543;
+        "preon-api.${servicesDomain}" = mkServiceConfig pc2 8544;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [80 443];
+  };
+}

modules_bak/vinzenz-pc2.nix

@@ -0,0 +1,57 @@
+{pkgs, ...}: {
+  imports = [
+    (import ./modules {
+      hostName = "vinzenz-pc2";
+      enableHomeManager = true;
+    })
+  ];
+
+  config = {
+    my = {
+      enabledUsers = ["vinzenz" "ronja"];
+      tailscale.enable = true;
+      desktop = {
+        enableGnome = true;
+        enableGaming = true;
+        enablePrinting = true;
+      };
+      buildtools = {
+        native = true;
+        dotnet = true;
+        rust = true;
+        jetbrains-remote-server = true;
+      };
+    };
+
+    users.users.vinzenz.openssh.authorizedKeys.keys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrY6tcgnoC/xbgL7vxSjddEY9MBxRXe9n2cAHt88/TT home roaming''
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+    ];
+
+    users.users.ronja.openssh.authorizedKeys.keys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ssh-host-key''
+    ];
+
+    services.openvscode-server = {
+      enable = true;
+      telemetryLevel = "off";
+      port = 8542;
+      host = "100.125.93.127"; # tailscale
+      withoutConnectionToken = true;
+      extraPackages = with pkgs; [nodejs gitFull gh direnv];
+    };
+
+    virtualisation.podman = {
+      enable = true;
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [8542 8543 8544 80];
+      };
+
+      interfaces.eno1.wakeOnLan.enable = true;
+    };
+  };
+}