BlakesFlakes/hosts/nixos/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

let
  hyprlandPkg = pkgs.hyprland;
  hyprlandPortalPkg = pkgs.xdg-desktop-portal-hyprland;
  wordreaper = pkgs.callPackage ../../packages/wordreaper.nix { };
in
{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ./defenk-ca.nix
      ./ssh-scripts.nix
      ./hyprland.nix # Modularized Hyprland config
    ];

  home-manager.backupFileExtension = "backup";
  home-manager.users.blake = { pkgs, ... }: {
    home.stateVersion = "25.11";

    programs.kitty = {
      enable = true;
      font = {
        name = "JetBrainsMono Nerd Font";
        size = 12.0;
      };
      settings = {
        confirm_os_window_close = 0;
        touch_scroll_multiplier = "5.0";
        background_opacity = "0.85";
        window_padding_width = 4;
        cursor_trail = 1;
        dynamic_background_opacity = true;
        bold_font = "auto";
        italic_font = "auto";
        bold_italic_font = "auto";
      };
      extraConfig = ''
        include current-theme.conf
      '';
    };

    services.easyeffects.enable = true;
  };

  boot.supportedFilesystems = [ "ntfs" "exfat" ];

  # Bootloader.
  boot.loader.systemd-boot.enable = false;
  boot.loader.grub = {
    enable = true;
    efiSupport = true;
    devices = [ "nodev" ];
    useOSProber = false;
    copyKernels = true;
    theme = pkgs.fetchFromGitHub {
      owner = "Lxtharia";
      repo = "minegrub-theme";
      rev = "main";
      hash = "sha256-GvlAAIpM/iZtl/EtI+LTzEsQ2qlUkex9i4xRUZXmadM=";
    } + "/minegrub";# The theme files are inside the 'minegrub' folder of the repo
  };
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "nixos"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
  networking.firewall.allowedUDPPorts = [ config.services.tailscale.port ];
  services.tailscale.enable = true;
  services.tailscale.extraSetFlags = [ "--operator=blake" ];
  networking.firewall.trustedInterfaces = [ "tailscale0" "waydroid0" ];

  # Enable networking
  networking.networkmanager.enable = true;

  # Set your time zone.
  time.timeZone = "America/Chicago";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_US.UTF-8";
    LC_IDENTIFICATION = "en_US.UTF-8";
    LC_MEASUREMENT = "en_US.UTF-8";
    LC_MONETARY = "en_US.UTF-8";
    LC_NAME = "en_US.UTF-8";
    LC_NUMERIC = "en_US.UTF-8";
    LC_PAPER = "en_US.UTF-8";
    LC_TELEPHONE = "en_US.UTF-8";
    LC_TIME = "en_US.UTF-8";

  };

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
  services.xserver.enable = true;

  # Enable the KDE Plasma Desktop Environment.
  services.displayManager.sddm.enable = true;
  services.displayManager.defaultSession = "hyprland-uwsm";
  services.desktopManager.plasma6.enable = true;
  environment.shellAliases = {
  conf = "vim /home/blake/nixos-config/hosts/nixos/configuration.nix";
  nix-guide = "vim /home/blake/nixos-config/README.md";
  hypr = "vim /home/blake/nixos-config/hosts/nixos/hyprland.nix";
  rebuild = "sudo nixos-rebuild switch --flake '/home/blake/nixos-config#nixos'";
  ls = "eza";
  la = "eza --all";
  ll = "eza --long --icons";
  };
  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "us";
    variant = "";
    options = "caps:escape";
  };
  console.useXkbConfig = true;

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable sound with pipewire.
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;

    # use the example session manager (no others are packaged yet so this is enabled by default,
    # no need to redefine it in your config for now)
    #media-session.enable = true;

    #wireplumber.extraConfig = {
    #  "10-bluez" = {
    #    "monitor.bluez.properties" = {
    #      "bluez5.enable-sbc-xq" = true;
    #      "bluez5.enable-msbc" = true;
    #      "bluez5.enable-hw-volume" = true;
    #      "bluez5.roles" = [ "a2dp_sink" "a2dp_source" "headset_head_unit" "headset_audio_gateway" ];
    #    };
    #  };
    #  "11-bluetooth-policy" = {
    #    "monitor.bluez.rules" = [
    #      {
    #        matches = [
    #          { "device.name" = "~bluez_card.3C_B0_ED_D2_F1_6C"; }
    #        ];
    #        actions = {
    #          update-props = {
    #            "bluez5.codecs" = [ "aac" "sbc" "sbc_xq" ];
    #            "bluez5.default-codec" = "aac";
    #          };
    #        };
    #      }
    #    ];
    #  };
    #};
  };

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.blake = {
    isNormalUser = true;
    description = "Blake";
    shell = pkgs.zsh;
    extraGroups = [ "networkmanager" "wheel" "docker" "libvirtd" ];
    packages = with pkgs; [
      kdePackages.kate
    ];
  };

  # Install firefox.
  programs.firefox.enable = true;
  programs.zsh.enable = true;
  # Allow NixOS to run the upstream browser and desktop-control helpers Hermes uses.
  programs.nix-ld.enable = true;
  programs.nix-ld.libraries = with pkgs; [
    libx11
    libxi
    libxkbcommon
  ];
  programs.kdeconnect.enable = true;
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;

  virtualisation.docker.enable = true;
  virtualisation.waydroid.enable = true;
  # Persistent local Windows VM support. QEMU supplies UEFI; swtpm provides
  # the TPM 2.0 Windows 11 expects; SPICE handles display, clipboard, and USB.
  virtualisation.libvirtd = {
    enable = true;
    qemu.swtpm.enable = true;
  };
  virtualisation.spiceUSBRedirection.enable = true;
  programs.virt-manager.enable = true;

  programs.steam = {
    enable = true;
    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
    localNetworkGameTransfers.openFirewall = true; # Open ports in the firewall for Steam Local Network Game Transfers
  };

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    wordreaper
    freetube
    (wordlists.override { lists = [ rockyou ]; })
    appimage-run
    rpi-imager
  exiftool
  nodejs_22
  zfs
  hyprpaper
  nwg-displays
  spotify
  obsidian
  nh
  vim
  openvpn
  prusa-slicer
  wget
  brave
  git
  fcrackzip
  gcc
  gnumake
  nmap
  cmake
  pkg-config
  expat
  hyprland-protocols
  codex
cewl
openconnect
  chromium
  ipscan
  volatility3
  wireguard-tools
  wl-clicker
  hyprcursor
  libglvnd
  ripgrep
  fd
  gocryptfs
  neovim
	pciutils
  ghidra
	vscodium
	vesktop
	jellyfin-media-player
	unzip
  aircrack-ng
  openssl
  rustscan
  inetutils
	libarchive
	btop
  kdePackages.gwenview
  lmstudio
	samba
	kubectl
	thc-hydra
  rockyou
  metasploit
  foundry
  pipx
  file
  binutils
  binwalk
  sleuthkit
  autopsy
  tldr
 # kitty
  kittysay
  oh-my-zsh
  oh-my-posh
  fzf
  eza
  ntfs3g
  gobuster
  exfatprogs
  p7zip
  extundelete
  testdisk
  sage
  hashid
  hashcat
  john
  (ophcrack.overrideAttrs (old: {
    buildInputs = (old.buildInputs or []) ++ [ expat ];
  }))
  chntpw
  qbittorrent
  vlc
  flatpak
  openlinkhub
  proton-vpn
  wl-clipboard
  grim
  slurp
  ncdu
  fw-fanctrl
  nvtopPackages.full
  wireshark
	taskwarrior3
  noctalia-shell
  codex
  quickshell
  hyprshell
  udiskie
  hyprpolkitagent
  vicinae
  kdePackages.dolphin
  qutebrowser
  playerctl
  brightnessctl
  libnotify
  jq
  libreoffice-still
  sendme
  typst
  zathura
  tinymist
  steghide
  hexedit
  stegseek
  tmux
(python3.withPackages(ps: with ps; [
    web3
    pycryptodome
    pwntools
    requests
    tqdm
    pynput
    keyboard
  ]))
  ];

	hardware.graphics = {
    enable = true;
    enable32Bit = true;
    extraPackages = with pkgs; [
      rocmPackages.clr.icd
    ];
  };

	hardware.bluetooth.enable = true;
	hardware.bluetooth.powerOnBoot = true;
	services.blueman.enable = true;
  services.fprintd.enable = true;
  services.fprintd.tod.enable = true;
  services.fprintd.tod.driver = pkgs.libfprint-2-tod1-goodix;
  security.pam.services.sudo.fprintAuth = true;
  security.pam.services.polkit-1.fprintAuth = true;
  security.pam.services.sddm.fprintAuth = false;
  # Allow fprintd to disable USB persist for Goodix sensors
  systemd.services.fprintd.serviceConfig = {
    ProtectKernelTunables = false;
    ReadWritePaths = [ "/sys/bus/usb/devices" ];
  };

  services.flatpak.enable = true;
  programs.hyprland = {
    enable = true;
    package = hyprlandPkg;
    portalPackage = hyprlandPortalPkg;
    withUWSM = true;
  };
  xdg.portal.config.common.default = "*";
  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };
  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  # services.openssh.enable = true;

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;
  hardware.ckb-next = {
      enable = true;
      package = pkgs.ckb-next.overrideAttrs (old: {
        cmakeFlags = (old.cmakeFlags or [ ]) ++ [ "-DUSE_DBUS_MENU=0" ];
      });
    };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "26.05"; # Did you read the comment?
  #oh-my-zsh = {
  #  enable = true;
  #}
  # KWallet Auto-unlock
  security.pam.services.sddm.enableKwallet = true;
  security.pam.services.login.fprintAuth = false;
  security.pam.services.hyprland.enableKwallet = true;
  services.gnome.gnome-keyring.enable = true;

environment.variables = {
  ZDOTDIR = "$HOME/.config/zsh";
};

  fileSystems."/mnt/wordlists" = {
    device = "/dev/disk/by-label/wordlists";
    fsType = "ext4";
    options = [ "nofail" "x-systemd.automount" "x-systemd.device-timeout=5" ];
  };
}