path: root/sys/default.nix

selfFlake:
{ lib, config, pkgs, modulesPath, ... }:
with lib; let
  cfg = config.local;
in {
  imports = [ "${modulesPath}/installer/scan/not-detected.nix" ];

  options.local = with lib.types; {
    hostname = mkOption {
      type = str;
    };

    portable = mkOption {
      type = bool;
    };

    loader = mkOption {
      type = enum [ "grub" "systemd-boot" ];
    };

    canTouchEfiVariables = mkOption {
      type = bool;
    };

    dhcpInterface = mkOption {
      type = nullOr str;
      default = null;
    };

    videoDrivers = mkOption {
      type = listOf str;
    };

    initrdModules = mkOption {
      type = listOf str;
    };

    snapperSubvols = mkOption {
      type = attrsOf str;
      default = {};
    };

    crypt = mkOption {
      type = submodule {
        options = {
          toplevel = mkOption {
            type = submodule {
              options = {
                device = mkOption {
                  type = str;
                };

                target = mkOption {
                  type = str;
                };

                headerFromBoot = mkOption {
                  type = str;
                };
              };
            };
          };

          aux = mkOption {
            default = [];
            type = listOf (submodule {
              options = {
                device = mkOption {
                  type = str;
                };

                target = mkOption {
                  type = str;
                };

                header = mkOption {
                  type = str;
                };

                keyfile = mkOption {
                  type = str;
                };
              };
            });
          };
        };
      };
    };

    fs = mkOption {
      type = submodule {
        options = {
          boot = mkOption {
            type = submodule {
              options = {
                device = mkOption {
                  type = str;
                };
              };
            };
          };

          sys = mkOption {
            type = submodule {
              options = {
                device = mkOption {
                  type = str;
                };

                ssd = mkOption {
                  type = bool;
                };

                root = mkOption {
                  type = str;
                };

                toplevel = mkOption {
                  type = str;
                };
              };
            };
          };

          hdd = mkOption {
            type = submodule {
              options = {
                device = mkOption {
                  type = str;
                };

                home = mkOption {
                  type = str;
                };
              };
            };
          };
        };
      };
    };
  };

  config = {
    nixpkgs.overlays = [ selfFlake.overlay ];

    # This value determines the NixOS release from which the default
    # settings for stateful data, like file locations and database versions
    # on your system were taken. It‘s perfectly fine and recommended to leave
    # this value at the release version of the first install of this system.
    # Before changing this value read the documentation for this option
    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
    system.stateVersion = "21.11"; # Did you read the comment?

    nix = {
      package = pkgs.nixFlakes;
      extraOptions = ''
        experimental-features = nix-command flakes
      '';
    };

    boot = {
      # !!!
      tmpOnTmpfs = true;

      loader = (if cfg.loader == "grub" then {
        grub = {
          enable = true;
          device = "nodev";
          efiSupport = true;
        };
      } else {
        systemd-boot.enable = true;
      }) // {
        efi = {
          inherit (cfg) canTouchEfiVariables;
        };
      };

      initrd = let
        crypt = cfg.crypt.toplevel;
        headerPathEscaped = escapeShellArg "/initrd-boot/${crypt.headerFromBoot}";
      in {
        availableKernelModules = cfg.initrdModules;
        supportedFilesystems = [ "vfat" ];

        preDeviceCommands = ''
          mkdir -p `dirname ${headerPathEscaped}`
          touch ${headerPathEscaped}
        '';
 
        preLVMCommands = optionalString cfg.portable ''
          sleep 2 #TODO
        '';

        postMountCommands = let
          fromRoot = path: escapeShellArg "/mnt-root/${path}";
          auxOpen = aux: ''
            cryptsetup -v open \
              --header ${fromRoot aux.header} \
              --key-file ${fromRoot aux.keyfile} \
              ${aux.device} ${aux.target}
          '';
        in concatStringsSep "\n" (map auxOpen cfg.crypt.aux);

        luks.devices."${crypt.target}" = {
          inherit (crypt) device;
          header = "/initrd-boot/${crypt.headerFromBoot}";
          preLVM = false;

          preOpenCommands = ''
            mount -o ro -t vfat ${escapeShellArg cfg.fs.boot.device} /initrd-boot
          '';

          postOpenCommands = ''
            umount /initrd-boot
          '';
        };

        #network = {
        #  enable = true;

        #  ssh = {
        #    enable = true;
        #    port = 2234;
        #  };
        #};
      };
    };

    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

    fileSystems = let
      inherit (cfg) fs;
      btrfs = { device, subvol, isSys }: {
        inherit device;
        fsType = "btrfs";
        options = let
          ssd = optional (isSys && fs.sys.ssd) "ssd";
        in [ "noatime" "compress=zstd" "subvol=${subvol}" ] ++ ssd;
      };
    in {
      "/" = btrfs {
        inherit (fs.sys) device;
        subvol = fs.sys.root;
        isSys = true;
      };

      "/toplevel" = btrfs {
        inherit (fs.sys) device;
        subvol = fs.sys.toplevel;
        isSys = true;
      };

      "/hdd" = btrfs {
        inherit (fs.hdd) device;
        subvol = "/";
        isSys = false;
      };

      "/home" = btrfs {
        inherit (fs.hdd) device;
        subvol = fs.hdd.home;
        isSys = false;
      };

      "/boot" = {
        inherit (fs.boot) device;
        fsType = "vfat";
        options = [ "noatime" "umask=027" ];
      };
    };

    time.timeZone = "America/Costa_Rica";

    networking = {
      hostName = cfg.hostname;
      useDHCP = false;

      interfaces = mkIf (cfg.dhcpInterface != null) {
        "${cfg.dhcpInterface}".useDHCP = true;
      };

      wireguard.enable = true;
    };

    i18n.defaultLocale = "es_CR.UTF-8";

    sound.enable = true;
    hardware.pulseaudio.enable = true;

    services.xserver = {
      enable = true;
      videoDrivers = cfg.videoDrivers ++ [ "modesetting" "fbdev" ];
      libinput.enable = true;
      displayManager.startx.enable = true;
    };

    services.udev.packages = [
      pkgs.android-udev-rules
    ];

    security.pam = {
      oath = {
        usersFile = "/var/trust/users.oath";
        digits = 6;
        window = 30;
      };

      services.sshd.oathAuth = true;
    };

    services.openssh = {
      enable = true;
      openFirewall = false;
      ports = [ 2234 ];

      forwardX11 = true;
      permitRootLogin = "no";
      passwordAuthentication = false;

      hostKeys = [
        {
          bits = 4096;
          path = "/etc/ssh/ssh_host_rsa_key";
          type = "rsa";
        }
        {
          path = "/etc/ssh/ssh_host_ed25519_key";
          type = "ed25519";
        }
        #TODO: Desfasar, inseguro
        {
          path = "/etc/ssh/ssh_host_ecdsa_key";
          type = "ecdsa";
        }
      ];
    };

    local.snapperSubvols.home = "/home";

    services.snapper.configs = let
      snapperConfig = _: subvolume: {
        inherit subvolume;

        extraConfig = ''
          # btrfs qgroup for space aware cleanup algorithms
          QGROUP=""

          # fraction of the filesystems space the snapshots may use
          SPACE_LIMIT="0.5"

          # fraction of the filesystems space that should be free
          FREE_LIMIT="0.2"

          # users and groups allowed to work with config
          ALLOW_USERS=""
          ALLOW_GROUPS=""

          # sync users and groups from ALLOW_USERS and ALLOW_GROUPS to .snapshots
          # directory
          SYNC_ACL="no"

          # start comparing pre- and post-snapshot in background after creating
          # post-snapshot
          BACKGROUND_COMPARISON="yes"

          # run daily number cleanup
          NUMBER_CLEANUP="yes"

          # limit for number cleanup
          NUMBER_MIN_AGE="1800"
          NUMBER_LIMIT="100"
          NUMBER_LIMIT_IMPORTANT="10"

          # create hourly snapshots
          TIMELINE_CREATE="yes"

          # cleanup hourly snapshots after some time
          TIMELINE_CLEANUP="yes"

          # limits for timeline cleanup
          TIMELINE_MIN_AGE="1800"
          TIMELINE_LIMIT_HOURLY="24"
          TIMELINE_LIMIT_DAILY="7"
          TIMELINE_LIMIT_WEEKLY="4"
          TIMELINE_LIMIT_MONTHLY="12"
          TIMELINE_LIMIT_YEARLY="10"

          # cleanup empty pre-post-pairs
          EMPTY_PRE_POST_CLEANUP="yes"

          # limits for empty pre-post-pair cleanup
          EMPTY_PRE_POST_MIN_AGE="1800"
        '';
      };
    in mapAttrs snapperConfig cfg.snapperSubvols;

    networking.firewall.allowedTCPPorts = [ 2234 ];

    programs = {
      dconf.enable = true;
      zsh.enable = true;
    };

    environment.pathsToLink = [ "/share/zsh" ];

    users.users = {
      ale = {
        isNormalUser = true;
        uid = 1000;
        group = "ale";
        extraGroups = [ "users" "wheel" "adbusers" ];
        shell = pkgs.zsh;
      };

      tutorias = {
        isNormalUser = true;
        uid = 1004;
        group = "tutorias";
        extraGroups = [ "users" ];
        shell = pkgs.zsh;
      };
    };

    users.groups = {
      ale.gid = 1001;
      tutorias.gid = 1007;
      adbusers.gid = 1008;
    };
  };
}