super massive rewrite

groups/cryde/default.nix

@@ -0,0 +1,140 @@
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}: {
+  imports = [
+    ./programs.nix
+
+    ../../hosts/modules/bashistrans.nix
+    ../../hosts/modules/wm/hyprland.nix
+    ../../hosts/modules/steam.nix
+    ../../hosts/modules/obsidian.nix
+
+    inputs.nix-flatpak.nixosModules.nix-flatpak
+  ];
+
+  boot.loader.grub2-theme = {
+    enable = true;
+    # GitHub: vinceliuice/grub2-themes
+    theme = "whitesur"; # stylish, vimix, or whitesur
+    footer = true;
+    customResolution = "1920x1080";
+  };
+
+  services = {
+    # Set display manager (login screen)
+    displayManager = {
+      # sddm relies on pkgs.libsForQt5.qt5.qtgraphicaleffects
+      sddm = {
+        enable = true;
+        wayland.enable = true; # experimental
+        theme = "corners";
+      };
+      defaultSession =
+        "hyprland"
+        + (
+          if config.programs.hyprland.withUWSM == true
+          then "-uwsm"
+          else null
+        );
+    };
+
+    tumbler.enable = true; # Thunar image thumbnail support
+    gvfs.enable = true; # Thunar mount, trash, and other functionality
+  };
+
+  programs = {
+    zsh.enable = true;
+    fish.enable = true;
+
+    nix-ld.enable = true;
+
+    neovim = {
+      enable = true;
+      defaultEditor = true;
+      viAlias = true;
+      vimAlias = true;
+      configure = {
+        customRC = ''
+          set number
+          set tabstop=4
+          set shiftwidth=4
+        '';
+      };
+    };
+
+    # Thunar also uses: `services.tumbler` & `services.gvfs`
+    thunar = {
+      enable = true;
+      plugins = with pkgs.xfce; [
+        thunar-volman # for removable drives (ie USBs)
+        thunar-archive-plugin # create and extract archives
+        thunar-media-tags-plugin # change metadata for media files
+      ];
+    };
+
+    # mozilla's email client
+    thunderbird.enable = true;
+  };
+
+  # ----- FONTS -----
+  fonts = {
+    enableDefaultPackages = true; # no clue what this line does tbh
+    packages = with pkgs;
+      [
+        geist-font # for my hyprlock theme
+        # texlive maintains a noto-emoji flake
+        texlivePackages.noto-emoji
+      ]
+      ++ builtins.filter lib.attrsets.isDerivation (
+        builtins.attrValues pkgs.nerd-fonts
+      );
+
+    # TODO: change my default fonts
+    fontconfig = {
+      defaultFonts = {
+        serif = ["Geist"]; # TODO: package Iosevka Etoile since Iosevka isn't a serif font
+        sansSerif = ["Geist"];
+        monospace = ["Cousine"];
+        emoji = ["Noto Emoji"];
+      };
+    };
+  };
+
+  # ---- ENVIRONMENT VARIABLES ----
+  environment = {
+    sessionVariables = {
+      # Hint Electrons apps to use Wayland
+      NIXOS_OZONE_WL = "1";
+    };
+    systemPackages = with pkgs; [
+      (callPackage ../sddm-theme-corners.nix {}).sddm-theme-corners
+      # dependencies for my sddm theme:
+      # XXX: add these as a buildInput
+      pkgs.libsForQt5.qt5.qtgraphicaleffects
+    ];
+  };
+
+  # ------- USERS -------
+  users = {
+    users = {
+      # literally me fr (personal account)
+      me = {
+        isNormalUser = true;
+        extraGroups = ["wheel" "netdev" "docker"];
+        shell = pkgs.bash;
+        packages = with pkgs; [
+          firefox
+          nitch
+          starfetch
+
+          colmena-latest
+
+          gitkraken
+        ];
+      };
+    };
+  };
+}

groups/cryde/programs.nix

@@ -0,0 +1,27 @@
+{pkgs, ...}: {
+  # ---- SYSTEM PACKAGES -----
+  environment.systemPackages = with pkgs; [
+    # User Environment
+    swww
+    helvum
+    easyeffects
+    pavucontrol
+    ani-cli
+    bluetui
+    wl-clipboard # clipboard for wayland
+    hyprpicker # color picker
+    hyprshot # screenshot utility
+    wl-screenrec # screen recording utility
+    qbittorrent # torrenting
+    signal-desktop
+    kdePackages.gwenview # image viewer
+    video-trimmer
+
+    # Games
+    prismlauncher # minecraft
+    upkgs.olympus # celeste
+    discord
+    discordo
+    ekphos
+  ];
+}

groups/cryos/default.nix

@@ -0,0 +1,137 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    ./programs.nix
+  ];
+
+  nixpkgs.config.allowUnfreePredicate = let
+    whitelist = with pkgs;
+      map lib.getName [
+        discord
+        steam
+        steamcmd
+        steam-unwrapped
+
+        winbox
+
+        obsidian
+        gitkraken
+      ];
+  in
+    pkg: builtins.elem (lib.getName pkg) whitelist;
+
+  boot.loader = {
+    efi = {
+      canTouchEfiVariables = true;
+      efiSysMountPoint = "/boot/efi";
+    };
+    grub = {
+      efiSupport = true;
+      device = "nodev";
+      # useOSProber = true;
+    };
+  };
+
+  # Enable initrd hook for virtual console customisation
+  # aka cool colours when bootting yay!!
+  console = {
+    enable = true;
+    earlySetup = true; # initrd pre hook
+    keyMap = "us";
+    font = "Lat2-Terminus16";
+    # ANSI 24-bit color definitions (theme: dracula)
+    colors = [
+      "21222c"
+      "ff5555"
+      "50fa7b"
+      "f1fa8c"
+      "bd93f9"
+      "ff79c6"
+      "8be9fd"
+      "f8f8f2"
+      "6272a4"
+      "ff6e6e"
+      "69ff94"
+      "ffffa5"
+      "d6acff"
+      "ff92df"
+      "a4ffff"
+      "ffffff"
+    ];
+  };
+
+  hardware = {
+    graphics = {
+      enable = true;
+      enable32Bit = true;
+    };
+
+    bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+    };
+  };
+
+  virtualisation.docker.enable = true;
+
+  services = {
+    # systemd-resolved provides network name resolution
+    # to local processes via a D-Bus interface.
+    resolved = {
+      enable = true;
+      dnssec = "true";
+      domains = ["~."];
+      # Use CloudFlare's WARP+ 1.1.1.1 DNS service
+      fallbackDns = [
+        "1.1.1.1#one.one.one.one"
+        "1.0.0.1#one.one.one.one"
+      ];
+      dnsovertls = "true";
+    };
+
+    # Multimedia Framework
+    # With backwards compatability for alsa/pulseaudio/jack
+    pipewire = {
+      enable = true;
+      audio.enable = true;
+      wireplumber.enable = true;
+
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+      jack.enable = true;
+    };
+  };
+
+  security = {
+    rtkit.enable = true; # I *think* this is for pipewire
+    sudo.wheelNeedsPassword = lib.mkDefault true;
+  };
+
+  # ---- ENVIRONMENT VARIABLES ----
+  environment = {
+    # always install "dev" derivation outputs
+    extraOutputsToInstall = ["dev" "man"];
+
+    sessionVariables = {
+      # folder names with capitalisation look awful!
+      XDG_DOWNLOAD_DIR = "$HOME/downloads";
+    };
+  };
+
+  documentation = {
+    enable = true;
+    doc.enable = true; # install /share/doc packages
+    man.enable = true; # install manpages
+    info.enable = true; # install GNU info
+    dev.enable = true; # install docs intended for developers
+    nixos = {
+      enable = true; # install NixOS documentation (ie man -k nix, & nixos-help)
+      options.splitBuild = true;
+      includeAllModules = false;
+    };
+  };
+}

groups/cryos/programs.nix

@@ -0,0 +1,114 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    # Shell
+    bash
+    fish
+    shellcheck
+    grc # colorise command outputs
+    moreutils
+
+    # Systems Emulation
+    qemu # Fellice Bellard's Quick Emulator
+    # Binaries
+    binutils
+    strace
+    ltrace
+    perf-tools # ftrace + perf
+    radare2
+    gdb
+    hexyl
+    # ASM
+    nasm
+    x86-manpages
+    # C Family
+    gcc
+    clang
+    clang-tools
+    gnumake
+    cmake
+
+    # Rust
+    cargo
+    rustc
+    rustfmt
+    # Go
+    go
+    # Nim
+    nim
+    nimble
+    # Haskell
+    ghc
+    ghcid
+    ormolu
+
+    # Nix
+    nix-prefetch-git
+    nix-index
+    nix-unit
+    deploy-rs.deploy-rs
+
+    # Python
+    python312 # I use 3.12 since it's in a pretty stable state now
+    python314 # also 3.14 for latest features
+    poetry
+    # Sage
+    sageWithDoc # SageMath + HTML Documentation
+
+    # .NET
+    dotnetCorePackages.dotnet_9.sdk
+    dotnetCorePackages.dotnet_9.aspnetcore
+    dotnetCorePackages.dotnet_9.runtime
+
+    openvpn
+    inetutils
+    wireguard-tools
+
+    # security tools
+    rustscan
+    nmap
+    dig
+    gobuster
+    nth
+    zap
+
+    httpie
+    curlie
+    zoxide
+    doggo
+    tldr
+    btop
+    eza
+    yazi
+    lazygit
+    ripgrep
+    viddy # modern `watch` command
+    timg # terminal image (sixel) viewer
+
+    # Pretty necessary
+    git
+    git-filter-repo
+    brightnessctl
+    acpi
+    # upower
+    vim
+    powertop
+    imagemagick
+
+    # "Standard" Unix Commands
+    file
+    wget
+    tree
+    pstree
+    zip
+    unzip
+    unrar-free
+    lz4
+    man-pages
+    man-pages-posix
+
+    # Cryptography
+    gnupg
+    openssl
+    libargon2
+  ];
+}

groups/default.nix

@@ -0,0 +1,49 @@
+{
+  root,
+  pkgs,
+  upkgs,
+  lib,
+  inputs,
+  config,
+  ...
+}: {
+  nix.settings = {
+    # make wheel group trusted users allows my "ae" user
+    # to import packages not signed by a trusted key
+    # (aka super duper easier to remote deploy)
+    trusted-users = ["root" "@wheel"];
+    experimental-features = [
+      "nix-command"
+      "flakes"
+      "pipe-operators"
+    ];
+    download-buffer-size = 524288000; # 500 MiB
+  };
+
+  time.timeZone = lib.mkDefault "Australia/Brisbane";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+
+  users.defaultUserShell = pkgs.bash;
+
+  home-manager = {
+    users =
+      config.users.users
+      |> builtins.attrNames
+      |> builtins.filter (x: builtins.pathExists (root + "/homes/${x}"))
+      |> lib.genAttrs (x: import (root + "/homes/${x}"));
+
+    extraSpecialArgs = {inherit inputs pkgs upkgs;};
+  };
+
+  environment.systemPackages = with pkgs; [
+    git
+    vim
+    wget
+    tree
+  ];
+}

groups/server/default.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  sshPort ? 22,
+  ...
+}: {
+  networking = {
+    networkmanager.enable = true;
+
+    # Use CloudFlare's WARP+ 1.1.1.1 DNS service
+    nameservers = [
+      "1.1.1.1"
+      "1.0.0.1"
+    ];
+
+    firewall = {
+      enable = lib.mkDefault true;
+      allowedTCPPorts = [
+        sshPort
+      ];
+    };
+  };
+
+  security = {
+    # accept Lets Encrypt's security policy
+    acme = {
+      acceptTerms = true;
+      defaults.email = "them@dobutterfliescry.net";
+    };
+
+    sudo = {
+      enable = true;
+      wheelNeedsPassword = true;
+    };
+    # allow SSH keys for passwordless auth
+    pam = {
+      enableSSHAgentAuth = true;
+      services.sudo.sshAgentAuth = true; # pam_ssh_agent_auth module
+    };
+  };
+
+  services = {
+    openssh = {
+      enable = true;
+      ports = [sshPort];
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        # AllowUsers = ["cry"]; # DO NOT ALLOW ALL
+        UseDns = true;
+        X11Forwarding = false;
+      };
+    };
+  };
+}