1 files changed, 171 insertions, 134 deletions

diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index b90e7162..5ed4e05e 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -1,4 +1,4 @@
-{ flake, pkgs, customUtils, lib, config, path, ... }:
+{ flake, flakeInputs, pkgs, customUtils, lib, config, path, ... }:
 let
   mwnSubnetsPublic =
     [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16"
@@ -13,8 +13,10 @@ in {
   imports = with flake.nixosModules.systemProfiles; [
     ./hw.nix
     ./mail
-    initrd-all-crypto-modules default-locale openssh rebuild-machines
+    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines
     networkmanager
+    flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1
+    flakeInputs.impermanence.nixosModules.impermanence
   ];
 
   config = {
@@ -31,12 +33,12 @@ in {
     boot = {
       initrd = {
         systemd = {
-          enable = true;
+          enable = false;
           emergencyAccess = config.users.users.root.hashedPassword;
         };
         luks.devices = {
-          nvm0 = { device = "/dev/disk/by-uuid/fe641e81-0812-4181-a5f6-382ebba509bb"; bypassWorkqueues = true; };
-          nvm1 = { device = "/dev/disk/by-uuid/43df1ba8-1728-4193-8855-920a82d4494a"; bypassWorkqueues = true; };
+          nvm0 = { device = "/dev/disk/by-uuid/bef17e86-d929-4a60-97cb-6bfa133face7"; bypassWorkqueues = true; };
+          nvm1 = { device = "/dev/disk/by-uuid/2884e98d-5afd-4965-91c9-88ffb5ec58bc"; bypassWorkqueues = true; };
         };
         availableKernelModules = [ "drbg" "nvme" "xhci_pci" "usb_storage" "sd_mod" "sr_mod" "rtsx_pci_sdmmc" ];
         kernelModules = [ "dm-raid" "dm-integrity" "dm-snapshot" "dm-thin-pool" "dm-mod" "dm-crypt" ];
@@ -59,7 +61,6 @@ in {
       plymouth.enable = true;
 
       kernelPackages = pkgs.linuxPackages_latest;
-      kernelParams = [ "i915.fastboot=1" "intel_pstate=no_hwp" "acpi_backlight=vendor" "thinkpad-acpi.brightness_enable=1" "quiet" ];
       extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
       kernelModules = ["v4l2loopback"];
       kernelPatches = [
@@ -187,12 +188,10 @@ in {
             # FirewallMark = 1;
           };
           wireguardPeers = [
-            { wireguardPeerConfig = {
-                AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic;
-                PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI=";
-                PersistentKeepalive = 25;
-                Endpoint = "wg.math.lmu.de:51820";
-              };
+            { AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic;
+              PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI=";
+              PersistentKeepalive = 25;
+              Endpoint = "wg.math.lmu.de:51820";
             }
           ];
         };
@@ -211,43 +210,34 @@ in {
             Name = "wgrz";
           };
           address = ["10.200.116.128/24"];
-          routes = map (Destination: { routeConfig = {
+          routes = map (Destination: {
             inherit Destination;
             Gateway = "10.200.116.1";
             GatewayOnLink = true;
             Table = "wgrz";
-          };}) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]);
+          }) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]);
           routingPolicyRules = [
-            { routingPolicyRuleConfig = {
-                Table = "main";
-                # FirewallMark = 1;
-                To = "129.187.111.225";
-                Priority = 100;
-              };
+            { Table = "main";
+              # FirewallMark = 1;
+              To = "129.187.111.225";
+              Priority = 100;
             }
-            { routingPolicyRuleConfig = {
-                Table = "main";
-                To = "10.153.91.204";
-                Priority = 100;
-              };
+            { Table = "main";
+              To = "10.153.91.204";
+              Priority = 100;
             }
-            { routingPolicyRuleConfig = {
-                Table = "wgrz";
-                From = "10.200.116.128";
-                Priority = 200;
-              };
+            { Table = "wgrz";
+              From = "10.200.116.128";
+              Priority = 200;
             }
-            { routingPolicyRuleConfig = {
-                Table = "wgrz";
-                To = "10.163.88.40";
-                Priority = 200;
-              };
+            { Table = "wgrz";
+              To = "10.163.88.40";
+              Priority = 200;
             }
-          ] ++ map (To: { routingPolicyRuleConfig = {
-                            Table = "wgrz";
-                            inherit To;
-                            Priority = 200;
-                          };}) (mwnSubnetsPrivate ++ mwnSubnetsPublic);
+          ] ++ map (To: { Table = "wgrz";
+                          inherit To;
+                          Priority = 200;
+                        }) (mwnSubnetsPrivate ++ mwnSubnetsPublic);
           linkConfig = {
             RequiredForOnline = false;
           };
@@ -328,7 +318,7 @@ in {
     };
 
     environment.systemPackages = with pkgs; [
-      nvtop brightnessctl config.boot.kernelPackages.v4l2loopback s-tui uhk-agent
+      nvtopPackages.full brightnessctl config.boot.kernelPackages.v4l2loopback s-tui uhk-agent
     ];
 
     services = {
@@ -375,9 +365,27 @@ in {
       xserver = {
         enable = true;
 
-        layout = "us";
-        xkbVariant = "dvp";
-        xkbOptions = "compose:caps";
+        xkb = {
+          layout = "us";
+          variant = "dvp";
+          options = "compose:caps";
+        };
+
+        wacom.enable = true;
+
+        dpi = 282;
+
+        videoDrivers = [ "nvidia" ];
+
+        screenSection = ''
+          Option "metamodes" "nvidia-auto-select +0+0 { ForceCompositionPipeline = On }"
+        '';
+
+        deviceSection = ''
+          Option "TearFree" "True"
+        '';
+
+        exportConfiguration = true;
 
         displayManager.lightdm = {
           enable = true;
@@ -403,26 +411,21 @@ in {
             '';
           };
         };
-
-        wacom.enable = true;
-        libinput.enable = true;
-
-        dpi = 282;
-
-        videoDrivers = [ "nvidia" ];
-
-        screenSection = ''
-          Option "metamodes" "nvidia-auto-select +0+0 { ForceCompositionPipeline = On }"
-        '';
-
-        deviceSection = ''
-          Option "TearFree" "True"
-        '';
-
-        exportConfiguration = true;
       };
+      libinput.enable = true;
     };
 
+    systemd.tmpfiles.rules = [
+      "d /var/lib/lightdm/.cache/lightdm-gtk-greeter 1770 lightdm lightdm -"
+      "L /var/lib/lightdm/.cache/lightdm-gtk-greeter/state - - - - ${pkgs.writeText "state" ''
+        [greeter]
+        last-user=gkleen
+        last-session=none+xmonad
+      ''}"
+
+      "L /etc/localtime - - - - /.bcachefs/etc/localtime"
+    ];
+
     users = {
       users.gkleen.extraGroups = [ "media" "plugdev" "input" "rtkit" ];
       groups.media = {};
@@ -438,72 +441,75 @@ in {
       pulse.enable = true;
       jack.enable = true;
       wireplumber.enable = true;
-    };
-    environment.etc."pipewire/pipewire.conf.d/custom.conf".source = (pkgs.formats.json {}).generate "custom.conf" {
-      "context.properties" = {
-        "log.level" = 2;
-        "core.daemon" = true;
-        "core.name" = "pipewire-0";
-      };
-      "context.modules" = [
-        {
-          name = "libpipewire-module-rtkit";
-          args = {
-            "nice.level" = -15;
-            "rt.prio" = 88;
-            "rt.time.soft" = 200000;
-            "rt.time.hard" = 200000;
+      extraConfig = {
+        pipewire."10-custom" = {
+          "context.properties" = {
+            "log.level" = 2;
+            "core.daemon" = true;
+            "core.name" = "pipewire-0";
+            "module.x11.bell" = false;
           };
-          flags = [ "ifexists" "nofail" ];
-        }
-        # { name = "libpipewire-module-protocol-native"; }
-        { name = "libpipewire-module-profiler"; }
-        # { name = "libpipewire-module-metadata"; }
-        { name = "libpipewire-module-spa-device-factory"; }
-        { name = "libpipewire-module-spa-node-factory"; }
-        # { name = "libpipewire-module-client-node"; }
-        # { name = "libpipewire-module-client-device"; }
-        {
-          name = "libpipewire-module-portal";
-          flags = [ "ifexists" "nofail" ];
-        }
-        {
-          name = "libpipewire-module-access";
-          args = {};
-        }
-        { name = "libpipewire-module-adapter"; }
-        { name = "libpipewire-module-link-factory"; }
-        { name = "libpipewire-module-session-manager"; }
-      ];
-    };
-    environment.etc."pipewire/pipewire-pulse.conf.d/custom.conf".source = (pkgs.formats.json {}).generate "custom.conf" {
-      "context.properties" = {
-        "log.level" = 2;
-      };
-      "context.modules" = [
-        {
-          name = "libpipewire-module-rtkit";
-          args = {
-            "nice.level" = -15;
-            "rt.prio" = 88;
-            "rt.time.soft" = 200000;
-            "rt.time.hard" = 200000;
+          "context.modules" = [
+            {
+              name = "libpipewire-module-rtkit";
+              args = {
+                "nice.level" = -15;
+                "rt.prio" = 88;
+                "rt.time.soft" = 200000;
+                "rt.time.hard" = 200000;
+              };
+              flags = [ "ifexists" "nofail" ];
+            }
+            # { name = "libpipewire-module-protocol-native"; }
+            { name = "libpipewire-module-profiler"; }
+            # { name = "libpipewire-module-metadata"; }
+            { name = "libpipewire-module-spa-device-factory"; }
+            { name = "libpipewire-module-spa-node-factory"; }
+            # { name = "libpipewire-module-client-node"; }
+            # { name = "libpipewire-module-client-device"; }
+            {
+              name = "libpipewire-module-portal";
+              flags = [ "ifexists" "nofail" ];
+            }
+            {
+              name = "libpipewire-module-access";
+              args = {};
+            }
+            { name = "libpipewire-module-adapter"; }
+            { name = "libpipewire-module-link-factory"; }
+            { name = "libpipewire-module-session-manager"; }
+          ];
+        };
+        pipewire-pulse."10-custom" = {
+          "context.properties" = {
+            "log.level" = 2;
           };
-          flags = [ "ifexists" "nofail" ];
-        }
-        # { name = "libpipewire-module-protocol-native"; }
-        # { name = "libpipewire-module-client-node"; }
-        { name = "libpipewire-module-adapter"; }
-        # { name = "libpipewire-module-metadata"; }
-        # {
-        #   name = "libpipewire-module-protocol-pulse";
-        #   args = {
-        #     "server.address" = [ "unix:native" ];
-        #   };
-        # }
-      ];
-      "stream.properties" = {
-        "resample.quality" = 1;
+          "context.modules" = [
+            {
+              name = "libpipewire-module-rtkit";
+              args = {
+                "nice.level" = -15;
+                "rt.prio" = 88;
+                "rt.time.soft" = 200000;
+                "rt.time.hard" = 200000;
+              };
+              flags = [ "ifexists" "nofail" ];
+            }
+            # { name = "libpipewire-module-protocol-native"; }
+            # { name = "libpipewire-module-client-node"; }
+            { name = "libpipewire-module-adapter"; }
+            # { name = "libpipewire-module-metadata"; }
+            # {
+            #   name = "libpipewire-module-protocol-pulse";
+            #   args = {
+            #     "server.address" = [ "unix:native" ];
+            #   };
+            # }
+          ];
+          "stream.properties" = {
+            "resample.quality" = 1;
+          };
+        };
       };
     };
 
@@ -531,14 +537,14 @@ in {
         prime = {
           nvidiaBusId = "PCI:1:0:0";
           intelBusId = "PCI:0:2:0";
-          sync.enable = true;
+          reverseSync.enable = true;
         };
       };
 
-      opengl = {
+      graphics = {
         enable = true;
-        driSupport32Bit = true;
-        setLdLibraryPath = true;
+        enable32Bit = true;
+        # setLdLibraryPath = true;
       };
 
       firmware = [ pkgs.firmwareLinuxNonfree ];
@@ -547,10 +553,13 @@ in {
       nitrokey.enable = true;
     };
 
-    sound.enable = true;
+    # sound.enable = true;
 
     nix = {
-      settings.auto-optimise-store = true;
+      settings = {
+        auto-optimise-store = true;
+        max-jobs = 4;
+      };
       daemonCPUSchedPolicy = "idle";
       daemonIOSchedClass = "idle";
 
@@ -564,6 +573,11 @@ in {
         speedFactor = 4;
       };
     };
+    systemd.services."nix-daemon" = {
+      serviceConfig = {
+        CPUQuota = "400%";
+      };
+    };
 
     environment.etc."X11/xorg.conf.d/50-wacom.conf".source = lib.mkForce ./wacom.conf;
 
@@ -621,7 +635,7 @@ in {
     zramSwap = {
       enable = true;
       algorithm = "zstd";
-      writebackDevice = "/dev/disk/by-uuid/50f3f856-cc17-4614-846a-34a14d5006ec";
+      writebackDevice = "/dev/disk/by-label/swap";
     };
 
     services.pcscd.enable = true;
@@ -633,7 +647,10 @@ in {
       group = "users";
     };
 
-    i18n.inputMethod.enabled = "ibus";
+    i18n.inputMethod = {
+      enable = true;
+      type = "ibus";
+    };
 
     environment.sessionVariables."GTK_USE_PORTAL" = "1";
     xdg.portal = {
@@ -653,6 +670,26 @@ in {
       in [ gtk-portal ];
     };
 
-    system.stateVersion = "20.03";
+    environment.persistence."/.bcachefs" = {
+      hideMounts = true;
+      directories = [
+        "/nix"
+        "/root"
+        "/var/log"
+        "/var/lib/sops-nix"
+        "/var/lib/nixos"
+        "/var/lib/systemd"
+        "/home"
+        "/var/lib/chrony"
+        "/var/lib/fprint"
+        "/var/lib/bluetooth"
+        "/etc/NetworkManager/system-connections"
+      ];
+      files = [
+        "/etc/localtime"
+      ];
+    };
+
+    system.stateVersion = "24.11";
   };
 }