nixos-configuration/machines/hafnium/configuration.nix

{ config, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix
    ../../home-manager/users/jal.nix
  ];

  networking = {
    hostName = "hafnium";
    networkmanager = {
      enable = true;
    };
    useDHCP = false;
    interfaces = {
      enp2s0f0.useDHCP = false;
      enp5s0.useDHCP = false;
      wlp3s0.useDHCP = false;
    };
    firewall = {
      allowedUDPPorts = [
        53
      ];
      allowedTCPPorts = [
        53
      ];
    };
    extraHosts = ''
      #10.10.10.10 example.com
      #10.158.228.70 support.demo.core.tradebyte.com 
      #10.158.228.28 demo.core.tradebyte.com
      #10.158.227.210 supporttest.tradebyte.com
      #10.158.227.132 test.tradebyte.com
      #10.158.227.23 sandbox.tradebyte.com
      #10.158.227.89 supportsandbox.tradebyte.com
      10.158.226.157 staging.tradebyte.com
      10.158.226.209 supportstaging.tradebyte.com
    '';
  };

  # Use the systemd-boot EFI boot loader.
  boot = {
    loader = {
      systemd-boot.enable = true;
      efi = {
        efiSysMountPoint = "/boot/efi";
        canTouchEfiVariables = true;
      };
    };
  };

  environment.systemPackages = with pkgs; [
    brightnessctl
    file
    firefox-wayland
    fzf
    git
    gnome3.adwaita-icon-theme
    htop
    ike
    jq
    neovim
    openconnect
    pavucontrol
    redir
    ripgrep
    spice-gtk
    tcpdump
    usbutils
    virt-manager
  ];

  environment.variables.EDITOR = "nvim";

  nixpkgs.overlays = [
    (self: super: {
      neovim = super.neovim.override {
        viAlias = true;
        vimAlias = true;
      };
    })
  ];

  programs.mtr.enable = true;

  programs.gnupg.agent = {
    enable = true;
    pinentryFlavor = "gnome3";
  };

  hardware.bluetooth.enable = true;
  services.blueman.enable = true;
  services.ofono.enable = true;

  services.udisks2.enable = true;

  services.openssh.enable = true;

  services.udev.extraRules = ''
    # mute indicator
    SUBSYSTEM=="tty", ATTRS{idVendor}=="1eaf", ATTRS{idProduct}=="6d75", SYMLINK+="mute-indicator"
  '';

  virtualisation = {
    docker.enable = true;
    libvirtd = {
      enable = true;
      qemuOvmf = true;
      onBoot = "ignore";
      onShutdown = "shutdown";
    };
  };

  #virtualisation.docker.extraOptions = "--dns 172.17.0.1";

  # https://github.com/NixOS/nixpkgs/issues/60594
  security.wrappers.spice-client-glib-usb-acl-helper.source = "${pkgs.spice-gtk}/bin/spice-client-glib-usb-acl-helper";

  security.polkit.enable = true;

  myConfig = {
    gui.enable = true;
    autologin.enable = true;
    autologin.username = "jal";
    tradebyte.enable = true;
  };

  networking.wg-quick.interfaces.tbcore = {
    address = [
      "172.27.27.16/32"
    ];
    privateKeyFile = "/root/wireguard-keys/tradebyte-core";
    listenPort = 51930;

    peers = [
      {
        publicKey = "K5vF/yTag6NnWjZsMug63DERdCFRfHoqxVkgKH55oFE=";
        endpoint = "194.33.184.175:51930";
        #endpoint = "ccs-emergency-vpn.core.tradebyte.com:51930";
        persistentKeepalive = 25;
        allowedIPs = [
          "10.18.0.0/16"
          "10.158.128.0/23"
          "10.158.224.0/20"
        ];
      }
    ];
  };

  services.dnsmasq = {
    enable = true;
    resolveLocalQueries = true;
    servers = [
      "194.150.168.168" # dns.as250.net Berlin/Frankfurt
      "195.160.173.53" # dnscache.berlin.ccc.de
      "46.182.19.48" # digitalcourage
      "/sys.tradebyte.com/10.10.7.64"
      "/core.tradebyte.com/10.170.254.30"
      "/instance.tradebyte.com/10.170.254.30"
      "/corp.ad.zalando.net/10.160.19.100"
      "/7.10.10.in-addr.arpa/10.10.7.64"
      "/develop.sys.tradebyte.com/10.0.3.1"
      "/internal.production.core.tradebyte.com/10.158.224.2"
    ];
    extraConfig = ''
      no-resolv
      interface=lo
      listen-address=::1
      listen-address=127.0.0.1
      bind-interfaces
      dns-loop-detect
      neg-ttl=5
    '';
  };

  services.actkbd = {
    enable = true;
    bindings = [
      { keys = [ 232 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s -5%"; }
      { keys = [ 233 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s +5%"; }
    ];
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "21.05"; # Did you read the comment?

}