nixos-configuration/machines/hafnium/configuration.nix

{ lib, config, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix
    ../../home-manager/users/jal.nix
  ];

  networking = {
    hostName = "hafnium";
    networkmanager = {
      enable = true;
    };
    useDHCP = false;
    interfaces = {
      enp2s0f0.useDHCP = false;
      enp5s0.useDHCP = false;
      wlp3s0.useDHCP = false;
    };
    firewall = {
      allowedUDPPorts = [
        53
      ];
      allowedTCPPorts = [
        53
      ];
    };
    extraHosts = ''
      #10.10.10.10 example.com
    '';
  };

  environment.systemPackages = with pkgs; [
    brightnessctl
    file
    firefox-wayland
    fzf
    git
    gnome3.adwaita-icon-theme
    htop
    jq
    neovim
    openconnect
    pavucontrol
    redir
    ripgrep
    tcpdump
    usbutils
  ];

  environment.variables.EDITOR = "nvim";

  nixpkgs.overlays = [
    (self: super: {
      neovim = super.neovim.override {
        viAlias = true;
        vimAlias = true;
      };
    })
  ];

  programs.mtr.enable = true;

  hardware.bluetooth.enable = true;
  services.blueman.enable = true;
  services.ofono.enable = true;

  services.udisks2.enable = true;

  myConfig = {
    bootloader = "systemd-boot";
    uefi.enable = true;
    gui.enable = true;
    sdr.enable = false;
    libvirt.enable = true;
    autologin.enable = true;
    autologin.username = "jal";
    tradebyte.enable = true;
  };


  sops.secrets = (
    lib.listToAttrs (map
      (name: lib.nameValuePair "wireguard_key_${name}" {
        sopsFile = ./secrets.yaml;
      })
      [
        "tbcore"
        "ops-testing"
      ]
    )
  );

  networking.wireguard.interfaces = {
    tbcore = {
      ips = [ "172.27.27.16/32" ];
      privateKeyFile = config.sops.secrets.wireguard_key_tbcore.path;
      listenPort = 51930;

      peers = [{
        publicKey = "K5vF/yTag6NnWjZsMug63DERdCFRfHoqxVkgKH55oFE=";
        endpoint = "194.33.184.175:51930";
        #endpoint = "ccs-emergency-vpn.core.tradebyte.com:51930";
        persistentKeepalive = 25;
        allowedIPs = [
          "10.158.128.0/23"
          "10.158.224.0/20"
          "10.18.0.0/16"
          "10.64.64.0/20" # CPS
          "172.31.1.0/24"
        ];
      }];
    };
    ops-testing = {
      ips = [ "10.254.254.2/30" ];
      privateKeyFile = config.sops.secrets.wireguard_key_ops-testing.path;
      peers = [{
        publicKey = "+jZETJfwaRiM+7ys5eYjgiWEAtxP47RzZSCx0w4l2nI=";
        endpoint = "3.68.138.217:2048";
        persistentKeepalive = 25;
        allowedIPs = [
          "10.254.254.0/30"
          "10.250.0.0/16"
        ];
      }];
    };
  };

  services.dnsmasq.servers = [
    "/7.10.10.in-addr.arpa/10.10.7.64"
    "/ccs.tradebyte.com/10.170.254.30"
    "/core.tradebyte.com/10.170.254.30"
    "/corp.ad.zalando.net/10.160.19.100"
    "/develop.sys.tradebyte.com/10.0.3.1"
    "/instance.tradebyte.com/10.170.254.30"
    "/internal.production.core.tradebyte.com/10.158.224.2"
    "/rds.amazonaws.com/9.9.9.9"
    "/tradebyte.com/9.9.9.9"
    "/tradebyte.org/9.9.9.9"
  ];

  services.actkbd = {
    enable = true;
    bindings = [
      { keys = [ 232 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s -5%"; }
      { keys = [ 233 ]; events = [ "key" ]; command = "/run/current-system/sw/bin/brightnessctl s +5%"; }
    ];
  };

  environment.etc."NetworkManager/system-connections/TB.VPN.nmconnection" = {
    mode = "0400";
    source = pkgs.tradebyte-vpn.passthru.networkManagerConfig;
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "21.05"; # Did you read the comment?

}