Alright this ain't finished cause of the home stuff but I don't wanna lose what I've done. Impermanence, disko, lots of changes. TODO: add modularity to home.

modules/system/services/pc/default.nix

@@ -1,11 +1,11 @@
 { ... }:
 {
   imports = [
-    ./fwupd
     ./gnome-keyring
+    ./gvfs
     ./keyd
     ./mpd
-    ./networkfs
     ./polkit
+    ./snapper
   ];
 }

modules/system/services/pc/fwupd/default.nix

@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-{
-  services.fwupd.enable = true;
-
-  environment.systemPackages = with pkgs; [
-    fwupd
-  ];
-}

modules/system/services/pc/keyd/default.nix

@@ -8,7 +8,6 @@
         main = {
           capslock = "overload(control,esc)";
           leftcontrol = "overload(ctrlmod,noop)";
-
           esc = "`";
           rightcontrol = "esc";
           left = "noop";

modules/system/services/pc/school/default.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./globalprotect
-  ];
-}

modules/system/services/pc/school/globalprotect/default.nix

@@ -1,4 +0,0 @@
-{ ... }:
-{
-  services.globalprotect.enable = true;
-}

modules/system/services/pc/snapper/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  imports = [
+    ./root
+    ./jimbo
+  ];
+
+  services.snapper = {
+    snapshotInterval = "0/6:00:00";
+    cleanupInterval = "12:00:00";
+    persistentTimer = true;
+  };
+}

modules/system/services/pc/snapper/jimbo/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  services.snapper.configs.jimbo = {
+    SUBVOLUME = "/persist/home/jimbo";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 1;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

modules/system/services/pc/snapper/root/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  services.snapper.configs.root = {
+    SUBVOLUME = "/persist";
+    TIMELINE_CREATE = true;
+    TIMELINE_CLEANUP = true;
+    TIMELINE_LIMIT_DAILY = 1;
+    TIMELINE_LIMIT_WEEKLY = 0;
+    TIMELINE_LIMIT_MONTHLY = 0;
+    TIMELINE_LIMIT_YEARLY = 0;
+  };
+}

modules/system/services/pc/sunshine/default.nix

@@ -2,7 +2,6 @@
 {
   services.sunshine = {
     enable = true;
-    settings.port = 57989;
     autoStart = false;
   };
 }

modules/system/services/server/fileserver/local/samba/default.nix

@@ -5,24 +5,25 @@
       enable = true;
       securityType = "user";
       openFirewall = true;
-      extraConfig = ''
-        workgroup = WORKGROUP
-        server string = JimSMB
-        security = user 
-        hosts allow = ${config.ips.localSpan}. 127.0.0.1 localhost
-        hosts deny = 0.0.0.0/0
-        guest account = nobody
-        map to guest = bad user
-      '';
-      shares = {
-        roms = {
-          comment = "Samba share with my ROMs";
-          path = "/export/JimboNFS/Downloads/GameFiles/ROMS";
-          browseable = "yes";
+      settings = {
+        global = {
+          "workgroup" = "WORKGROUP";
+          "server string" = "JimSMB";
+          "security" = "user";
+          "hosts allow" = "${config.ips.localSpan}. 127.0.0.1 localhost";
+          "hosts deny" = "0.0.0.0/0";
+          "guest account" = "nobody";
+          "map to guest" = "bad user";
+        };
+        "roms" = {
+          "path" = "/export/JimboNFS/Downloads/GameFiles/ROMS";
+          "browseable" = "yes";
           "read only" = "no";
-          "guest ok" = "no";
+          "guest ok" = "yes";
           "create mask" = "0644";
           "directory mask" = "0755";
+          "force user" = "username";
+          "force group" = "groupname";
         };
       };
     };

modules/system/services/server/social/matrix/synapse/coturn/default.nix

@@ -12,7 +12,7 @@
       min-port = 49000;
       max-port = 50000;
       use-auth-secret = true;
-      static-auth-secret = "will be world readable for local users :(";
+      static-auth-secret = config.secrets.coturnSecret;
       realm = "turn.${config.domains.jim1}";
       cert = "/var/lib/acme/turn.${config.domains.jim1}.com/fullchain.pem";
       pkey = "/var/lib/acme/turn.${config.domains.jim1}.com/key.pem";
@@ -24,7 +24,7 @@
         "turn:turn.${config.domains.jim1}:3478?transport=udp"
         "turn:turn.${config.domains.jim1}:3478?transport=tcp"
       ];
-      turn_shared_secret = config.services.coturn.static-auth-secret;
+      turn_shared_secret = config.secrets.coturnSecret;
       turn_user_lifetime = "1h";
     };
   };
@@ -32,10 +32,12 @@
   # Open coturn ports
   networking.firewall = {
     allowedUDPPorts = [
-      3478 5349
-    ];
-    allowedUDPPortRanges = [
-      { from = 49000; to = 50000; }
+      3478
+      5349
     ];
+    allowedUDPPortRanges = [{
+      from = config.services.coturn.min-port;
+      to = config.services.coturn.max-port;
+    }];
   };
 }

modules/system/services/server/social/matrix/synapse/default.nix

@@ -13,14 +13,16 @@
       public_baseurl = "https://matrix.${config.domains.jim1}";
       suppress_key_server_warning = true;
 
-      listeners = [{
-        port = 8008;
-        bind_addresses = [ "::" "0.0.0.0" ];
-        resources = [ { compress = false;  names = [ "client" "federation" ]; } ];
-        type = "http";
-        tls = false;
-        x_forwarded = true;
-      }];
+      listeners = [
+        {
+          port = 8008;
+          bind_addresses = [ "::" "0.0.0.0" ];
+          resources = [ { compress = true;  names = [ "client" "federation" ]; } ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+        }
+      ];
 
       email = {
         notif_from = "Jimbo's Matrix <noreply@${config.domains.jim1}>";

modules/system/services/server/transmission/default.nix

@@ -8,8 +8,6 @@
     enable = true;
     credentialsFile = pkgs.writeText "credentials" config.secrets.transmissionCredFile;
     openPeerPorts = true;
-    settings = {
-      rpc-authentication-required = true;
-    };
+    settings.rpc-authentication-required = true;
   };
 }