Mostly security changes, add nouveau as a boot option, simplify settings and prepare for home-manager options

hosts/extern/boot/default.nix

@@ -1,36 +1,8 @@
-{ config, pkgs, ... }:
-let
-  commonKernelParams = [
-    # VM/GPU passthrough
-    "amd_iommu=on"
-    "iommu=pt"
-    "nested=1"
-
-    # Virtualization nonsense
-    "transparent_hugepage=never"
-
-    # Isolate devices into IOMMU groups
-    "pcie_acs_override=downstream,multifunction"
-    "pci=routeirq"
-  ];
-in {
+{ pkgs, ... }:
+{
   boot = {
-    # Must be Zen for IOMMU isolation
-    kernelPackages = pkgs.unstable.linuxPackages_zen;
+    kernelPackages = pkgs.unstable.linuxPackages_latest;
     kernel.sysctl."vm.max_map_count" = 2147483642;
-    kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:1f82,10de:10fa" ];
     blacklistedKernelModules = [ "pcspkr" ];
-
-    # Needed for GPU passthrough
-    initrd.kernelModules = [
-      "vfio"
-      "vfio_pci"
-      "vfio_iommu_type1"
-    ];
-  };
-
-  # Use second GPU on boot
-  specialisation.gputwo.configuration = {
-    boot.kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:2504,10de:228e" ];
   };
 }

hosts/extern/default.nix

@@ -1,17 +1,20 @@
-{ lib, ... }:
+{ ... }:
 {
   imports = [
     ./boot
     ./disko
     ./filesystems
     ./hardware
-    ./wireguard
+    ./modules
     ../../modules/system
   ];
 
-  services.btrfs.autoScrub.enable = lib.mkForce false;
+  system.wireless.enable = false;
 
-  system.video.nvidia.enable = true;
+  system.wireguard.client.enable = true;
+  networking.wireguard.interfaces.wgc.ips = [ "10.100.0.21/24" ];
+
+  boot.binfmt.emulatedSystems = [ "x86_64-linux" ];
 
   networking.hostName = "extern";
 }

hosts/extern/disko/default.nix

@@ -6,7 +6,7 @@
     disk = {
       "${config.networking.hostName}" = {
         type = "disk";
-        device = "/dev/sdg";
+        device = "/dev/nvme0n1";
         content = {
           type = "gpt";
           partitions = {
@@ -39,13 +39,6 @@
       };
     };
 
-    nodev = {
-      "/" = {
-        fsType = "tmpfs";
-        mountOptions = [ "size=4G" ];
-      };
-    };
-
     lvm_vg = {
       "${config.networking.hostName}" = {
         type = "lvm_vg";
@@ -56,6 +49,14 @@
               type = "btrfs";
               extraArgs = [ "-f" ];
               subvolumes = {
+                "/root" = {
+                  mountpoint = "/";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
+                "/prev" = {
+                  mountpoint = "/prev";
+                  mountOptions = [ "compress=zstd" "noatime" "ssd" ];
+                };
                 "/nix" = {
                   mountpoint = "/nix";
                   mountOptions = [ "compress=zstd" "noatime" "ssd" ];
@@ -77,7 +78,7 @@
             };
           };
           swap = {
-            size = "8G";
+            size = "4G";
             content = {
               type = "swap";
               discardPolicy = "both";

hosts/extern/filesystems/default.nix

@@ -1,7 +1,7 @@
 { config, ... }:
 {
   fileSystems = {
-    # Remote
+    # Network mounts
     "/home/jimbo/JimboNFS" = {
       device = "10.100.0.1:/export/JimboNFS";
       fsType = "nfs4";

hosts/extern/hardware/default.nix

@@ -1,9 +1,10 @@
-{ config, lib, modulesPath, ... }:
+# nixos-generate-config --root ./ --no-filesystems
+{ config, lib, ... }:
 {
-  boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.kernelModules = [ "dm-snapshot" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
 
   networking.useDHCP = lib.mkDefault true;
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/extern/id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC2lMkUd+BbXITE5LTg94hEzmA6UKsIIbaf5YOjGoLzl

hosts/extern/modules/default.nix

@@ -0,0 +1,4 @@
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+}

hosts/extern/wireguard/default.nix

@@ -1,23 +0,0 @@
-{ lib, config, ... }:
-{
-  networking = {
-    firewall = {
-      allowedUDPPorts = [ 51820 ];
-      trustedInterfaces = [ "wgc" ];
-    };
-
-    wireguard.interfaces.wgc = {
-      ips = [ "10.100.0.20/24" ];
-      listenPort = 51820;
-      privateKey = config.secrets.wgClientPriv;
-      peers = [
-        { # Cyberspark Server
-          publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
-          allowedIPs = [ "10.100.0.0/24" ];
-          endpoint = "sv.${config.domains.jim1}:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-}

hosts/jupiter/default.nix

@@ -1,4 +1,4 @@
-{ jovian, ... }:
+{ ... }:
 {
   imports = [
     ./boot
@@ -7,13 +7,10 @@
     ./hardware
     ./wireguard
     ../../modules/system
-    jovian.nixosModules.default
   ];
 
   system.lanzaboote.enable = true;
   system.libvirtd.enable = true;
 
-  jovian.steamos.useSteamOSConfig = true;
-
   networking.hostName = "jupiter";
 }

hosts/tower/boot/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 let
   commonKernelParams = [
     # VM/GPU passthrough
@@ -21,6 +21,9 @@ in {
     kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:1f82,10de:10fa" ];
     blacklistedKernelModules = [ "pcspkr" ];
 
+    # Enable cross-compilation
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
+
     # Needed for GPU passthrough
     initrd.kernelModules = [
       "vfio"
@@ -33,4 +36,14 @@ in {
   specialisation.gputwo.configuration = {
     boot.kernelParams = commonKernelParams ++ [ "vfio-pci.ids=10de:2504,10de:228e" ];
   };
+
+  # Use Nouveau
+  specialisation.nouveau.configuration.config = {
+    environment.sessionVariables = {
+      NIXOS_OZONE_WL = lib.mkForce "0";
+      WLR_RENDERER = lib.mkForce "vulkan";
+    };
+    system.video.nvidia.enable = lib.mkForce false;
+    system.video.nouveau.enable = lib.mkForce true;
+  };
 }

hosts/tower/users/jimbo/default.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  home-manager.users.jimbo = {
+    
+  };
+}