Finally switch to flakes.

nixos/common/ips.nix

@@ -0,0 +1,7 @@
+rec {
+  netInt = "eno1";
+  localSpan = "10.0.0";
+  server = "${localSpan}.2";
+  pc = "${localSpan}.3";
+  vm = "${localSpan}.4";
+}

nixos/desktop.nix

@@ -0,0 +1,36 @@
+{
+  imports = [
+    # Base configs
+    ./modules/base.nix
+    ./users/jimbo.nix
+
+    # Desktop only
+    ./desktop/misc.nix
+    ./desktop/sway.nix
+    ./desktop/printing.nix
+    ./desktop/gaming.nix
+    ./desktop/pipewire.nix
+    ./desktop/bluetooth.nix
+    ./desktop/firewall.nix
+    ./desktop/fonts.nix
+
+    # Modules
+    ./modules/security.nix
+    ./modules/networking.nix
+
+    # Hardware
+    ./hardware/machines/desktop.nix
+    ./hardware/nvidia.nix
+    ./hardware/opengl.nix
+
+    # Services
+    ./services/openssh.nix
+    ./services/virtualisation.nix
+    ./services/udev.nix
+    ./services/sunshine.nix
+    ./services/mpd.nix
+  ];
+
+  services.openssh.ports = [2211];
+  networking.hostName = "JimNixDesktop";
+}

nixos/desktop/bluetooth.nix

@@ -0,0 +1,15 @@
+{
+  # Enable Bluetooth
+  hardware.bluetooth = {
+    enable = true;
+    settings = {
+      General.Experimental = "true";
+      Policy.AutoEnable = "true";
+    };
+  };
+
+  # Enable lingering for Bluetooth
+  systemd.tmpfiles.rules = [
+    "f /var/lib/systemd/linger/jimbo"
+  ];
+}

nixos/desktop/firewall.nix

@@ -0,0 +1,12 @@
+{
+  # Networking settings
+  networking = {
+    # Enable firewall
+    firewall = {
+      allowPing = false;
+      extraInputRules = ''
+        ip saddr 10.0.0.2 accept comment "Accept Server Connections"
+      '';
+    };
+  };
+}

nixos/desktop/fonts.nix

@@ -0,0 +1,15 @@
+{pkgs, ...}: {
+  # Fonts
+  fonts = {
+    packages = with pkgs; [
+      liberation_ttf
+      twitter-color-emoji
+      ubuntu_font_family
+      noto-fonts
+      sarasa-gothic
+      orbitron
+      (nerdfonts.override {fonts = ["UbuntuMono"];})
+    ];
+    fontconfig.defaultFonts.emoji = ["Twitter Color Emoji"];
+  };
+}

nixos/desktop/gaming.nix

@@ -0,0 +1,23 @@
+{pkgs, ...}: {
+  # Enable Gamemode to boost games
+  programs.gamemode = {
+    enable = true;
+    settings.general.renice = 10;
+  };
+
+  # Enable hardware like the Steam Controller
+  hardware.steam-hardware.enable = true;
+
+  # Enable the Steam client
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+    extraPackages = with pkgs; [
+      steam-run heroic prismlauncher
+    ];
+    extraCompatPackages = with pkgs; [
+      proton-ge-bin
+    ];
+  };
+}

nixos/desktop/misc.nix

@@ -0,0 +1,25 @@
+{pkgs, ...}: {
+  # Enable AppImages
+  programs.appimage = {
+    enable = true;
+    binfmt = true;
+  };
+
+  # Network mounts, automounts, and battery saver
+  services = {
+    gvfs.enable = true;
+    udisks2.enable = true;
+    tlp.enable = true;
+  };
+
+  # Security that only makes sense with a GUI
+  security = {
+    polkit.enable = true;
+    rtkit.enable = true;
+  };
+
+  # Install programs system-wide
+  environment.systemPackages = with pkgs; [
+    cifs-utils
+  ];
+}

nixos/desktop/pipewire.nix

@@ -0,0 +1,26 @@
+{pkgs, ...}: {
+  # Enabling sound
+  sound.enable = true;
+
+  # Enable Pipewire
+  services = {
+    pipewire = {
+      enable = true;
+      audio.enable = true;
+      wireplumber = {
+        enable = true;
+        configPackages = [
+          (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
+            wireplumber.settings = { bluetooth.autoswitch-to-headset-profile = false }
+          '')
+        ];
+      };
+      alsa = {
+        enable = true;
+        support32Bit = true;
+      };
+      pulse.enable = true;
+      #jack.enable = true;
+    };
+  };
+}

nixos/desktop/printing.nix

@@ -0,0 +1,20 @@
+{pkgs, ...}: {
+  # Enable printing
+  services = {
+    printing = {
+      enable = true;
+      drivers = with pkgs; [hplip];
+      webInterface = false;
+    };
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
+  };
+
+  # Install programs system-wide
+  environment.systemPackages = with pkgs; [
+    system-config-printer
+  ];
+}

nixos/desktop/school.nix

@@ -0,0 +1,13 @@
+{pkgs, ...}: {
+  # Install programs system-wide
+  environment.systemPackages = with pkgs; [
+    remmina
+    freerdp
+    globalprotect-openconnect
+    python3
+    zoom-us
+  ];
+
+  # Enable Globalprotect VPN
+  services.globalprotect.enable = true;
+}

nixos/desktop/sway.nix

@@ -0,0 +1,32 @@
+{pkgs, ...}: {
+  imports = [
+    ./wayland.nix
+  ];
+
+  programs.sway = {
+    enable = true;
+    xwayland.enable = true;
+    extraPackages = with pkgs; [
+      swaylock
+      swaybg
+    ];
+  };
+
+  # Allow swaylock to function
+  security.pam.services.swaylock = {};
+
+  # Enable desktop portals for screengrab
+  xdg.portal = {
+    wlr = {
+      enable = true;
+      settings.screencast = {
+        max_fps = 60;
+        chooser_type = "simple";
+        chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or -B 00000066 -b 00000099";
+      };
+    };
+    extraPortals = with pkgs; [
+      xdg-desktop-portal-gtk
+    ];
+  };
+}

nixos/desktop/wayland.nix

@@ -0,0 +1,63 @@
+{pkgs, ...}: {
+  services = {
+    # Configure greetd for "auto" login (single user only)
+    greetd = let
+      startSway = pkgs.writeScript "startsway" ''
+        # Use NVIDIA variables if drivers are in use
+        if lspci -k | grep "Kernel driver in use: nvidia" &> /dev/null; then
+          # NVIDIA/AMD variables
+          export LIBVA_DRIVER_NAME=nvidia
+          export GBM_BACKEND=nvidia-drm
+          export __GLX_VENDOR_LIBRARY_NAME=nvidia
+          export WLR_NO_HARDWARE_CURSORS=1
+        else
+          :
+        fi
+
+        # Sway/Wayland
+        export XDG_CURRENT_DESKTOP=sway
+        export QT_QPA_PLATFORM="wayland;xcb"
+
+        # Start Sway
+        sway --unsupported-gpu
+      '';
+    in {
+      enable = true;
+      restart = true;
+      settings = {
+        terminal = {
+          vt = 2;
+          switch = true;
+        };
+        default_session = {
+          command = "${startSway}";
+          user = "jimbo";
+        };
+      };
+    };
+    dbus.enable = true;
+  };
+
+  programs.xwayland = {
+    enable = true;
+  };
+
+  # Enable backlight and theme control
+  programs = {
+    dconf.enable = true;
+    light.enable = true;
+  };
+
+  # Packages needed for Wayland
+  environment.systemPackages = with pkgs; [
+    wl-clipboard
+    wdisplays
+    clipman
+    libnotify
+    grim
+    slurp
+    swappy
+    jq
+    lm_sensors
+  ];
+}

nixos/groups/nfs-share.nix

@@ -0,0 +1,6 @@
+{
+  # Define group for NFS access
+  users.groups = {
+    nfsShare = {};
+  };
+}

nixos/hardware/machines/desktop.nix

@@ -0,0 +1,136 @@
+# This file was initially made by 'nixos-generate-config', try not to edit too much
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: let
+  # Set common boot paramaters
+  commonKernelParams = [
+    # Nvidia settings
+    "nvidia_drm.fbdev=1"
+
+    # VM/GPU passthrough
+    "amd_iommu=on"
+    "iommu=pt"
+    "nested=1"
+
+    # Virtualization nonsense
+    "transparent_hugepage=never"
+
+    # Isolate devices into IOMMU groups
+    "pcie_acs_override=downstream,multifunction"
+    "pci=routeirq"
+  ];              
+in {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  # Set all boot options
+  boot = {
+    # Set a kernel version and load/blacklist drivers    
+    kernelPackages = pkgs.unstable.linuxPackages_zen;    
+    blacklistedKernelModules = [
+      "pcspkr"
+    ];               
+    kernel.sysctl."vm.max_map_count" = 2147483642;       
+    kernelParams = commonKernelParams ++ [
+      "vfio-pci.ids=10de:1f82,10de:10fa"
+    ];
+    initrd = {
+      availableKernelModules = [
+        "nvme"
+	"xhci_pci"
+	"ahci"
+	"usbhid"
+	"usb_storage"
+	"sd_mod"
+      ];
+      kernelModules = [
+        "vfio"
+	"vfio_pci"
+	"vfio_iommu_type1"
+	"kvm-amd"
+      ];
+    };
+                                                         
+    # Manage supported filesystems                       
+    supportedFilesystems = {                             
+      ntfs = true;
+      zfs = lib.mkForce false;
+    };
+
+    # Modprobe settings
+    extraModprobeConfig = ''
+      options hid_apple fnmode=2
+    '';
+
+    # Use the Systemd-Boot bootloader
+    loader.systemd-boot = {
+      enable = true;
+      netbootxyz.enable = true;
+    };
+  };
+
+  # Additional entry to boot from the second GPU
+  specialisation = {
+    gputwo.configuration = {
+      boot.kernelParams = commonKernelParams ++ ["vfio-pci.ids=10de:2504,10de:228e"];
+    };
+  };
+
+  # Mount everything as necessary
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/f0786b07-8303-416f-87ff-276bfd696387";
+      fsType = "bcachefs";
+    };
+    "/boot" = {
+      device = "/dev/disk/by-uuid/EF6D-9009";
+      fsType = "vfat";
+    };
+    "/etc/libvirt" = {
+      device = "/dev/disk/by-label/Qemu";
+      options = ["nosuid" "nodev" "nofail"];
+    };
+    "/var/lib/libvirt" = {
+      depends = ["/etc/libvirt"];
+      device = "/etc/libvirt/varlibvirt";
+      options = ["bind" "rw"];
+    };
+    "/mnt/Linux1" = {
+      device = "/dev/disk/by-label/Linux1";
+      options = ["nosuid" "nodev" "nofail" "x-gvfs-show"];
+    };
+    "/mnt/Linux2" = {
+      device = "/dev/disk/by-label/Linux2";
+      options = ["nosuid" "nodev" "nofail" "x-gvfs-show"];
+    };
+    "/mnt/Windows1" = {
+      device = "/dev/disk/by-label/Windows1";
+      options = ["nosuid" "nodev" "noauto"];
+    };
+    "/mnt/Windows2" = {
+      device = "/dev/disk/by-label/Windows2";
+      options = ["nosuid" "nodev" "noauto"];
+    };
+    "/home/jimbo/JimboNFS" = {
+      device = "server:/export/JimboNFS";
+      fsType = "nfs4";
+      options = ["x-systemd.automount" "_netdev" "nofail" "noauto"];
+    };
+  };
+
+  # Set the swap partition
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/2e4c5120-716d-4cdc-84a0-c9e6391760db";}
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface.
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/hardware/machines/server.nix

@@ -0,0 +1,112 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  # Set all boot options
+  boot = {
+    blacklistedKernelModules = [
+      "pcspkr"
+    ];               
+    initrd = {
+      availableKernelModules = [
+        "xhci_pci"
+	"ehci_pci"
+	"ahci"
+	"nvme"
+	"usbhid"
+	"sd_mod"
+	"sr_mod"
+      ];
+      kernelModules = [
+        "kvm-intel"
+      ];
+    };
+
+    # Use the Systemd-Boot bootloader
+    loader.systemd-boot = {
+      enable = true;
+      netbootxyz.enable = true;
+    };
+  };
+
+  # Mounting options
+  fileSystems = {
+    "/" = { 
+      device = "/dev/disk/by-uuid/8f81cab7-9381-4950-b77f-b85c5fdbad16";
+      fsType = "ext4";
+    };
+    "/boot" = {
+      device = "/dev/disk/by-uuid/2034-754A";
+      fsType = "vfat";
+    };
+    "/export/JimboNFS" = {
+      device = "/dev/disk/by-uuid/713fcd92-534c-4153-8e04-e0c6fe5f6a51";
+      fsType = "ext4";
+      noCheck = true;
+    };
+    "/home/jimbo/JimboNFS" = {
+      device = "/export/JimboNFS";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+
+    # Atrocity of var bindmounts
+    "/mnt/nextcloud/data/JimboNFS" = {
+      device = "/export/JimboNFS";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/bitwarden_rs" = {
+      device = "/export/JimboNFS/System/var/lib/bitwarden_rs";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/gitea" = {
+      device = "/export/JimboNFS/System/var/lib/gitea";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/matrix-synapse" = {
+      device = "/export/JimboNFS/System/var/lib/matrix-synapse";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/nextcloud" = {
+      device = "/export/JimboNFS/System/var/lib/nextcloud";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/owncast" = {
+      device = "/export/JimboNFS/System/var/lib/owncast";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/docker/volumes/azuracast_station_data/_data/jimbops/media/Music" = {
+      device = "/export/JimboNFS/Music";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/private/pufferpanel/servers" = {
+      device = "/export/JimboNFS/System/var/lib/pufferpanel/servers";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/var/lib/mastodon" = {
+      device = "/export/JimboNFS/System/var/lib/mastodon";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+  };
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/ec422cad-bf93-4b15-b989-2c807f1073a4"; }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface.
+  networking.useDHCP = lib.mkDefault true;
+
+  # Hardware settings
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  boot.swraid.enable = true;
+}

nixos/hardware/nvidia.nix

@@ -0,0 +1,11 @@
+{config, ... }: {
+  # Enable video drivers                              
+  services.xserver.videoDrivers = ["nvidia"];         
+
+  hardware.nvidia = {                                 
+    modesetting.enable = true;
+    nvidiaSettings = false;
+    package = config.boot.kernelPackages.nvidiaPackages.beta;
+    open = true;
+  };
+}

nixos/hardware/opengl.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Enable OpenGL
+  hardware.opengl = {
+    enable = true;
+    driSupport = true;
+    driSupport32Bit = true;
+    extraPackages = with pkgs; [
+      vulkan-loader
+      vulkan-validation-layers
+      vulkan-extension-layer
+    ];
+  };
+}

nixos/hardware/wireless.nix

@@ -0,0 +1,7 @@
+{
+  # Enable wireless networkmanager
+  networking = {
+    networkmanager.enable = true;
+    enableB43Firmware = true;
+  };
+}

nixos/modules/base.nix

@@ -0,0 +1,106 @@
+# This is your system's configuration file.
+# Use this to configure your system environment (it replaces /etc/nixos/configuration.nix)
+{
+  inputs,
+  outputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  # You can import other NixOS modules here
+  imports = [
+    # My modules
+  ];
+
+  nixpkgs = {
+    # You can add overlays here
+    overlays = [
+      # Add overlays your own flake exports (from overlays and pkgs dir):
+      outputs.overlays.additions
+      outputs.overlays.modifications
+      outputs.overlays.unstable-packages
+    ];
+
+    # Configure your nixpkgs instance
+    config = {
+      allowUnfree = true;
+    };
+  };
+
+  # This will add each flake input as a registry
+  # To make nix commands consistent with your flake
+  nix.registry = (lib.mapAttrs (_: flake: {inherit flake;})) ((lib.filterAttrs (_: lib.isType "flake")) inputs);
+
+  # This will additionally add your inputs to the system's legacy channels
+  # Making legacy nix commands consistent as well, awesome!
+  nix.nixPath = ["/etc/nix/path"];
+  environment.etc =
+    lib.mapAttrs'
+    (name: value: {
+      name = "nix/path/${name}";
+      value.source = value.flake;
+    })
+    config.nix.registry;
+
+  # Enable flakes and garbage collection
+  nix = {
+    settings = {
+      # Enable flakes and new 'nix' command
+      experimental-features = "nix-command flakes";
+      # Deduplicate and optimize nix store
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 14d";
+    };
+  };
+
+  # Set timezone
+  time.timeZone = let
+    secrets = import ../common/secrets.nix;
+  in secrets.timeZone;
+
+  # Select internationalisation properties.
+  console = {
+    earlySetup = true;
+    font = "${pkgs.kbd}/share/consolefonts/Lat2-Terminus16.psfu.gz";
+    packages = with pkgs; [
+      terminus_font
+      kbd
+    ];
+    useXkbConfig = true;
+  };
+
+  # Enable git
+  programs.git = {
+    enable = true;
+    lfs.enable = true;
+  };
+
+  # Basic firewall settings
+  networking.nftables.enable = true;
+
+  # Enable the ZSH shell
+  programs.zsh.enable = true;
+
+  # Disable Nano
+  programs.nano.enable = false;
+
+  # Disable the HTML documentation link
+  documentation = {
+    nixos.enable = false;
+    info.enable = false;
+  };
+
+  # Allow binary firmware
+  hardware.enableRedistributableFirmware = true;
+
+  # Force Electron to use Wayland
+  environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+  # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
+  system.stateVersion = "24.05";
+}

nixos/modules/networking.nix

@@ -0,0 +1,17 @@
+{
+  # Networking settings
+  networking = {
+    # Choose networking method
+    wireless.enable = false;
+    dhcpcd.enable = true;
+
+    # Set hostnames
+    hosts = let
+      ips = import ../common/ips.nix;
+    in {
+      "${ips.server}" = ["server"];
+      "${ips.pc}" = ["pc"];
+      "${ips.vm}" = ["vm"];
+    };
+  };
+}

nixos/modules/security.nix

@@ -0,0 +1,18 @@
+{
+  # Enable AppArmor
+  security = {
+    sudo.enable = false;
+    doas = {
+      enable = true;
+      extraRules = [
+        # Give wheel root access, allow persistant session
+        {
+          groups = ["wheel"];
+          keepEnv = true;
+          persist = true;
+        }
+      ];
+    };
+    apparmor.enable = true;
+  };
+}

nixos/server.nix

@@ -0,0 +1,44 @@
+{
+  imports = [
+    # Base configs
+    ./modules/base.nix
+    ./users/jimbo.nix
+
+    # Import more users
+    ./users/nextcloud.nix
+    ./users/nginx.nix
+
+    # Modules
+    ./modules/security.nix
+    ./modules/networking.nix
+
+    # Hardware
+    ./hardware/machines/server.nix
+
+    # Services
+    ./services/openssh.nix
+    ./server/acme.nix
+    ./server/ddclient.nix
+    ./server/docker.nix
+    ./server/element.nix
+    ./server/firewall.nix
+    ./server/gitea.nix
+    ./server/lemmy.nix
+    ./server/mailserver.nix
+    ./server/mariadb.nix
+    ./server/mastodon.nix
+    ./server/misc.nix
+    ./server/nextcloud.nix
+    ./server/nfs.nix
+    ./server/nginx.nix
+    ./server/owncast.nix
+    ./server/pufferpanel.nix
+    ./server/server-misc.nix
+    ./server/synapse.nix
+    ./server/tandoor.nix
+    ./server/vaultwarden.nix
+  ];
+
+  services.openssh.ports = [ 2222 ];
+  networking.hostName = "JimNixServer";
+}

nixos/server/acme.nix

@@ -0,0 +1,14 @@
+{
+  security.acme = let
+    secrets = import ../common/secrets.nix;
+  in { 
+    acceptTerms = true;
+    defaults.email = secrets.jimEmail;
+    certs = {       
+      "turn.${secrets.jimDomain}" = {
+        group = "turnserver";
+        postRun = "systemctl restart coturn.service";
+      };
+    };
+  };
+}

nixos/server/ddclient.nix

@@ -0,0 +1,24 @@
+{pkgs, ...}: {
+  # DDClient for Dynamic IPs
+  services.ddclient = let
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    protocol = "cloudflare";
+    use = "web, web=https://ipinfo.io/ip";
+    zone = "${secrets.jimDomain}";
+    username = "token";
+    passwordFile = "${pkgs.writeText "cloudflareapikey" secrets.flareApiKey}";
+    domains = [
+      "${secrets.jimDomain}"
+      "*.${secrets.jimDomain}"
+      "beta.${secrets.jimDomain}"
+      "git.${secrets.jimDomain}"
+      "john.${secrets.jimDomain}"
+      "mc.${secrets.jimDomain}"
+      "mx.${secrets.jimDomain}"
+      "panel.${secrets.jimDomain}"
+      "rtmp.${secrets.jimDomain}"
+    ];
+  };
+}

nixos/server/docker.nix

@@ -0,0 +1,6 @@
+{
+  virtualisation.docker = {
+    enable = true;
+    daemon.settings.log-driver = "json-file";
+  };
+}

nixos/server/element.nix

@@ -0,0 +1,23 @@
+{
+  # Configure the Element web server
+  nixpkgs.config.element-web.conf = let
+    secrets = import ../common/secrets.nix;
+  in {
+    default_server_config = {
+      "m.homeserver" = {
+        base_url = "https://matrix.${secrets.jimDomain}";
+        server_name = "matrix.${secrets.jimDomain}";
+      };
+    };
+    branding = {
+      #welcome_background_url = "https://staging.${secrets.jimDomain}/images/backgrounds/bloxelcom-sunset.jpg";
+      #auth_header_logo_url = "https://staging.${secrets.jimDomain}/images/logos/bloxelcom.png";
+    };
+    embedded_pages = {
+      home_url = "https://www.${secrets.jimDomain}/";
+    };
+    disable_custom_urls = true;
+    disable_guests = true;
+    default_theme = "dark";
+  };
+}

nixos/server/firewall.nix

@@ -0,0 +1,67 @@
+{
+  # Allow forwarding
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  # Configure firewall
+  networking = let
+    ips = import ../common/ips.nix;
+    secrets = import ../common/secrets.nix;
+  in {
+    firewall = {
+      allowPing = false;
+      allowedTCPPorts = [
+        80 443 # Nginx
+        25565 19132 5657 # Pufferpanel
+        2299 # Gitea SSH
+        3478 5349 # Coturn
+      ];
+      allowedTCPPortRanges = [
+        { from = 8100; to = 8150; } # Azuracast
+      ];
+      allowedUDPPorts = [
+        25565 19132 # Minecraft Voicechat and Bedrock
+        3478 5349 # Coturn UDP
+      ];
+      allowedUDPPortRanges = [
+        { from = 49000; to = 50000; } # Coturn range
+      ];
+  
+      # Add extra input rules using nftables
+      extraInputRules = ''
+        ip saddr ${ips.localSpan}.0/24 tcp dport 2049 accept comment "Accept NFS"
+        ip saddr ${ips.localSpan}.0/24 udp dport 53 accept comment "Accept DNS"
+        ip saddr { ${ips.pc}, ${secrets.lunaIP}, ${secrets.cornIP}, ${secrets.vertIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
+      '';
+    };
+  
+    # Enable nftables and forwarding
+    nftables = {
+      enable = true;
+      tables = {
+        forwarding = {
+          family = "ip";
+          content = ''
+            chain PREROUTING {
+              type nat hook prerouting priority dstnat; policy accept;
+              tcp dport 2211 dnat to ${ips.pc}:22 comment "SSH to PC"
+              udp dport { 27005, 27015, 7777 } dnat to ${ips.pc} comment "Games to PC"
+            
+              tcp dport { 58010, 57989, 57984 } dnat to ${ips.pc} comment "Sunshine TCP to PC"
+              udp dport { 57998, 57999, 58000 } dnat to ${ips.pc} comment "Sunshine UDP to PC"
+            
+              tcp dport { 38010, 37989, 37984 } dnat to ${ips.vm} comment "Sunshine TCP to VM"
+              udp dport { 37998, 37999, 38000 } dnat to ${ips.vm} comment "Sunshine UDP to VM"
+            
+              ip saddr ${secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${ips.vm} comment "ALVR TCP to VM"
+              ip saddr ${secrets.cornIP} udp dport { 9943, 9944 } dnat to ${ips.vm} comment "ALVR UDP to VM"
+            }
+            chain POSTROUTING {
+              type nat hook postrouting priority 100; policy accept;
+              oifname "${ips.netInt}" masquerade
+            }
+          '';
+        };
+      };
+    };
+  };
+}

nixos/server/gitea.nix

@@ -0,0 +1,25 @@
+{
+  services.gitea = let
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    settings = {
+      server = {
+        DOMAIN = "git.${secrets.jimDomain}";
+        ROOT_URL = "https://git.${secrets.jimDomain}:443";
+        HTTP_PORT = 3110;
+        SSH_PORT = 2299;
+        START_SSH_SERVER = true;
+      };
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "mx.${secrets.jimDomain}";
+        FROM = "Jimbo's Git <noreply@${secrets.jimDomain}>";
+        USER = "noreply@${secrets.jimDomain}";
+        PASSWD = secrets.noreplyPassword;
+        PROTOCOL = "smtps";
+      };
+      service.REGISTER_EMAIL_CONFIRM = true;
+    };
+  };
+}

nixos/server/lemmy.nix

@@ -0,0 +1,19 @@
+{
+  services.lemmy = let
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    nginx.enable = true;
+    database.createLocally = true;
+    settings = {
+      hostname = "lemmy.${secrets.jimDomain}";
+      email = {
+        smtp_server = "mx.${secrets.jimDomain}:587";
+        smtp_login = "noreply@${secrets.jimDomain}";
+        smtp_from_address = "Jimbo's Lemmy <noreply@${secrets.jimDomain}>";
+        smtp_password = secrets.noreplyPassword;
+        tls_type = "starttls";
+      };
+    };
+  };
+}

nixos/server/mailserver.nix

@@ -0,0 +1,54 @@
+{pkgs, ...}: let
+  secrets = import ../common/secrets.nix;
+in rec {
+  # Mail server
+  mailserver = rec {
+    enable = true;
+    enableManageSieve = true;
+    domains = [ "${secrets.jimDomain}" ];
+    fqdn = "mx.${secrets.jimDomain}";
+    certificateScheme = "acme-nginx";
+    localDnsResolver = false;
+    redis.port = 1515;
+        
+    # A list of accounts, passwords generated with nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
+    loginAccounts = {
+      "noreply@${secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "noreply" secrets.noreplyMailHash;
+        sendOnly = true;
+      };    
+      "jimbo@${secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "jimbo" secrets.jimboMailHash;
+        aliases = [ "canada@${secrets.jimDomain}" "contact@${secrets.jimDomain}" ];
+      };
+      "lunamoonlight@${secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "luna" secrets.lunaMailHash;
+        aliases = [ "us@${secrets.jimDomain}" "contact@${secrets.jimDomain}" ];
+      };
+      "freecorn1854@${secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "freecorn" secrets.freecornMailHash;
+        aliases = [ "canada@${secrets.jimDomain}" "contact@${secrets.jimDomain}" ];
+      };
+      "tinyattack09@${secrets.jimDomain}" = {
+        hashedPasswordFile = pkgs.writeText "tiny" secrets.tinyMailHash;
+      };
+    };
+  };
+
+  # Related services
+  services = {
+    # Roundcube mail server
+    roundcube = {
+     enable = true;
+     hostName = "mail.${secrets.jimDomain}";
+     extraConfig = ''
+       $config['smtp_server'] = "tls://${mailserver.fqdn}";
+       $config['smtp_user'] = "%u";
+       $config['smtp_pass'] = "%p";
+     '';
+    };
+
+    # Force the mailserver to use a different redis port
+    redis.servers.rspamd.port = 1515;
+  };
+}

nixos/server/mariadb.nix

@@ -0,0 +1,18 @@
+{pkgs, ...}: {
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+    dataDir = "/var/lib/mysql";
+    initialDatabases = [
+      { name = "minecraft"; }
+    ];
+    ensureUsers = [
+      {
+        name = "minecraft";
+        ensurePermissions = {
+          "minecraft.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+}

nixos/server/mastodon.nix

@@ -0,0 +1,19 @@
+{pkgs, ...}: {
+  services.mastodon = let 
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    localDomain = "social.${secrets.jimDomain}";
+    streamingProcesses = 4;
+    configureNginx = true;
+    smtp = {
+      createLocally = false;
+      host = "mx.${secrets.jimDomain}";
+      port = 587;
+      authenticate = true;
+      fromAddress = "Jimbo's Mastodon <noreply@${secrets.jimDomain}>";
+      user = "noreply@${secrets.jimDomain}";
+      passwordFile = pkgs.writeText "smtp_pass.txt" secrets.noreplyPassword;
+    };
+  };
+}

nixos/server/misc.nix

@@ -0,0 +1,6 @@
+{
+  services = {
+    snowflake-proxy.enable = true;
+    logrotate.checkConfig = false;
+  };
+}

nixos/server/nextcloud.nix

@@ -0,0 +1,30 @@
+{pkgs, ...}: let
+  secrets = import ../common/secrets.nix;
+in {
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud29;
+    hostName = "cloud.${secrets.jimDomain}";
+    datadir = "/mnt/nextcloud";
+    https = true;
+    config = {
+      adminuser = "jimbo";
+      adminpassFile = "/mnt/nextcloud/password.txt";
+    };
+    settings = {
+      trusted_proxies = [ "127.0.0.1" ];
+      trusted_domains = [ "cloud.${secrets.jimDomain}" ];
+      overwriteprotocol = "https";
+
+      # Mailserver settings
+      mail_smtphost = "mx.${secrets.jimDomain}";
+      mail_domain = "${secrets.jimDomain}";
+      mail_from_address = "noreply";
+      mail_smtpauth = "true";
+      mail_smtpname = "noreply@${secrets.jimDomain}";
+      mail_smtppassword = secrets.noreplyPassword;
+      mail_smtpmode = "smtp";
+      mail_smtpport = 587;
+    };
+  };
+}

nixos/server/nfs.nix

@@ -0,0 +1,11 @@
+{
+  # NFS server
+  services.nfs.server = let 
+    ips = import ../common/ips.nix;
+  in {
+    enable = true;
+    exports = ''
+      /export/JimboNFS ${ips.localSpan}.0/24(rw,no_subtree_check)
+    '';
+  };
+}

nixos/server/nginx.nix

@@ -0,0 +1,206 @@
+{pkgs, ...}: {
+  services.nginx = let
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    package = (pkgs.nginx.override {
+      modules = with pkgs.nginxModules; [ rtmp ];
+    });
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      # Homepage redirect
+      "${secrets.jimDomain}" =  {
+        enableACME = true;
+        addSSL = true;
+       root = "/var/www/jimweb";
+        locations = {
+         "/.well-known/matrix/client" = {
+           extraConfig = ''
+              default_type application/json;
+              return 200 '
+              {
+                "m.homeserver": {
+                  "base_url": "https://matrix.${secrets.jimDomain}"
+                },
+                "m.identity_server": {
+                  "base_url": "https://matrix.org"
+                },
+                "org.matrix.msc3575.proxy": {
+                  "url": "https://matrix.${secrets.jimDomain}"
+                }
+              }';
+           '';
+         };
+         "/.well-known/matrix/server" = {
+           extraConfig = ''
+             default_type application/json;
+             return 200 '{"m.server": "matrix.${secrets.jimDomain}:443"}';
+           '';
+         };
+       };
+      };
+
+      # Nextcloud Proxy
+      "cloud.${secrets.jimDomain}" =  {
+        enableACME = true;
+        addSSL = true;
+        locations."/" = {
+          proxyWebsockets = true;
+          extraConfig = "
+           location /.well-known/carddav {
+              return 301 $scheme://$host/remote.php/dav;
+            }
+            location /.well-known/caldav {
+              return 301 $scheme://$host/remote.php/dav;
+            }
+         ";
+        };
+      };
+
+      # Vaultwarden Proxy
+      "warden.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8222";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Recipes Proxy
+      "recipes.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:5030";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Bluemap Proxy
+      "bluemap.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:31010";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Gitea Proxy
+      "git.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:3110";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Pufferpanel Proxy
+      "panel.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:5010";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Matrix Proxy
+      "matrix.${secrets.jimDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+       locations = {
+         "/".extraConfig = ''return 403;'';
+          "/client".proxyPass = "http://127.0.0.1:8009";
+          "/_matrix".proxyPass = "http://127.0.0.1:8008";
+         "/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://127.0.0.1:8009";
+          "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+       };
+      };
+
+      # Element Proxy
+      "chat.${secrets.jimDomain}" = {
+        enableACME = true;
+        addSSL = true;
+        root = "${pkgs.element-web}";
+      };
+
+      # Coturn Proxy
+      "turn.${secrets.jimDomain}" = {
+        enableACME = true;
+        forceSSL = true;
+        listen = [
+          { addr = "0.0.0.0"; port = 80; ssl = false; }
+        ];
+        locations."/".proxyPass = "http://127.0.0.1:1380";
+      };
+
+      # Radio Proxy
+      "radio.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:255";
+          proxyWebsockets = true;
+       };
+      };
+
+      # Streaming proxy
+      "live.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8060";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Mail certificate proxy
+      "mx.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:1390";
+          proxyWebsockets = true;
+        };
+      };
+
+      # Add SSL to Lemmy
+      "lemmy.${secrets.jimDomain}" =  {
+        enableACME = true;
+        forceSSL = true;
+      };
+    };
+    appendConfig = ''
+      rtmp {
+        server {
+          listen 1935;
+          chunk_size 4096;
+          allow publish all;
+          application stream {
+            record off;
+            live on;
+           allow play all;
+            hls on;
+            hls_path /var/www/jimweb/streams/hls;
+           hls_fragment_naming system;
+           hls_fragment 3;
+            hls_playlist_length 40;
+          }
+        }
+      }
+    '';
+  };
+
+  # Force Nginx to work and be able to read+write the hls path
+  security.pam.services.nginx.setEnvironment = false;
+  systemd.services.nginx.serviceConfig = {
+    SupplementaryGroups = [ "shadow" ];
+    ReadWritePaths = [ "/var/www/jimweb/streams/hls/" ];
+  };
+}

nixos/server/owncast.nix

@@ -0,0 +1,8 @@
+{
+  services.owncast = {
+    enable = true;
+    port = 8060;
+    rtmp-port = 1945;
+    listen = "0.0.0.0";
+  };
+}

nixos/server/pufferpanel.nix

@@ -0,0 +1,23 @@
+{pkgs, lib, ...}: {
+  services.pufferpanel = let
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    environment = {
+      PUFFER_WEB_HOST = ":5010";
+      PUFFER_PANEL_SETTINGS_MASTERURL = "https://panel.${secrets.jimDomain}";
+      PUFFER_PANEL_EMAIL_PROVIDER = "smtp";
+      PUFFER_PANEL_EMAIL_HOST = "mx.${secrets.jimDomain}:587";
+      PUFFER_PANEL_EMAIL_FROM = "noreply@${secrets.jimDomain}";
+      PUFFER_PANEL_EMAIL_USERNAME = "noreply@${secrets.jimDomain}";
+      PUFFER_PANEL_EMAIL_PASSWORD = secrets.noreplyPassword;
+    };
+    extraPackages = with pkgs; [ bash curl gawk gnutar gzip ];
+    package = pkgs.buildFHSEnv {
+      name = "pufferpanel-fhs";
+      meta.mainProgram = "pufferpanel-fhs";
+      runScript = lib.getExe pkgs.pufferpanel;
+      targetPkgs = pkgs': with pkgs'; [ icu openssl zlib ];
+    };
+  };
+}

nixos/server/server-misc.nix

@@ -0,0 +1,6 @@
+{pkgs, ...}: {
+  # Install programs system-wide
+  environment.systemPackages = with pkgs; [
+    mdadm
+  ];
+}

nixos/server/synapse.nix

@@ -0,0 +1,96 @@
+{pkgs, config, ...}: {
+  services = let
+    secrets = import ../common/secrets.nix;
+  in {
+    # Synapse Matrix server
+    matrix-synapse = with config.services.coturn; {
+      enable = true;
+      settings = {
+        server_name = "${secrets.jimDomain}";
+        public_baseurl = "https://matrix.${secrets.jimDomain}";
+        suppress_key_server_warning = true;
+
+        # Set the network config
+        listeners = [{
+          # Client config
+          port = 8008;
+          bind_addresses = [ "::" "0.0.0.0" ];
+          resources = [ { compress = false;  names = [ "client" "federation" ]; } ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+        }];
+
+        # Enable smtp for password resets
+        email = {
+          notif_from = "Jimbo's Matrix <noreply@${secrets.jimDomain}>";
+          smtp_host = "mx.${secrets.jimDomain}";
+          smtp_user = "noreply@${secrets.jimDomain}";
+          smtp_pass = secrets.noreplyPassword;
+          enable_tls = true;
+          smtp_port = 587;
+          require_transport_security = true;
+        };
+
+        # Disable registration without email
+        registrations_require_3pid = [ "email" ];
+
+        # Allow only this range of emails
+        allowed_local_3pids = [{
+          medium = "email";
+          pattern = "^[^@]+@jimbosfiles\\.com$";
+        }];
+
+        # Set the type of database
+        database.name = "sqlite3";
+
+        # Allow account registration
+        enable_registration = true;
+
+        # General settings
+        url_preview_enabled = true;
+        max_upload_size = "50M";
+        report_stats = false;
+
+        # Turn settings
+        turn_uris = [
+          "turn:turn.${secrets.jimDomain}:3478?transport=udp"
+          "turn:turn.${secrets.jimDomain}:3478?transport=tcp"
+        ];
+        turn_shared_secret = static-auth-secret;
+        turn_user_lifetime = "1h";
+
+        # Ratelimiting
+        burst_count = 15;
+      };
+    };
+
+    # Sliding sync proxy for Matrix
+    matrix-sliding-sync = let
+      matrixSecretFile = pkgs.writeText "matrixsecret" ''
+        SYNCV3_SECRET=${secrets.matrixSecret}
+      '';
+    in {
+      enable = true;
+      settings = {
+        SYNCV3_SERVER = "https://matrix.${secrets.jimDomain}";
+        SYNCV3_BINDADDR = "0.0.0.0:8009";
+      };
+      environmentFile = "${matrixSecretFile}";
+    };
+
+    # Coturn for VC
+    coturn = rec {
+      enable = true;
+      no-cli = true;
+      no-tcp-relay = true;
+      min-port = 49000;
+      max-port = 50000;
+      use-auth-secret = true;
+      static-auth-secret = "will be world readable for local users :(";
+      realm = "turn.${secrets.jimDomain}";
+      cert = "/var/lib/acme/turn.${secrets.jimDomain}.com/fullchain.pem";
+      pkey = "/var/lib/acme/turn.${secrets.jimDomain}.com/key.pem";
+    };
+  };
+}

nixos/server/tandoor.nix

@@ -0,0 +1,6 @@
+{
+  services.tandoor-recipes = {
+    enable = true;
+    port = 5030;
+  };
+}

nixos/server/vaultwarden.nix

@@ -0,0 +1,24 @@
+{
+  services.vaultwarden = let
+    secrets = import ../common/secrets.nix;
+  in {
+    enable = true;
+    config = {
+      DOMAIN = "https://warden.${secrets.jimDomain}";
+      SIGNUPS_ALLOWED = false;
+      ROCKET_ADDRESS = "127.0.0.1";
+      ROCKET_PORT = 8222;
+      ROCKET_LOG = "critical";
+
+      # Smtp email
+      SMTP_HOST = "mx.${secrets.jimDomain}";
+      SMTP_FROM = "Jimbo's Vaultwarden <noreply@${secrets.jimDomain}>";
+      SMTP_FROM_NAME = "Vaultwarden";
+      SMTP_USERNAME = "noreply@${secrets.jimDomain}";
+      SMTP_PASSWORD = secrets.noreplyPassword;
+      SMTP_SECURITY = "starttls";
+      SMTP_PORT = 587;
+      SMTP_TIMEOUT = 15;
+    };
+  };
+}

nixos/services/mpd.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Enable MPD
+  services.mpd = {
+    enable = true;
+    user = "jimbo";
+    group = "users";
+    musicDirectory = "/home/jimbo/JimboNFS/Music";
+    playlistDirectory = "/home/jimbo/JimboNFS/Music/Playlists";
+    extraConfig = ''
+      audio_output {
+        type "pipewire"
+        name "Local Pipewire"
+      }
+    '';
+  };
+  systemd.services.mpd.environment = {
+    XDG_RUNTIME_DIR = "/run/user/${toString config.users.users.jimbo.uid}";
+  };
+}

nixos/services/openssh.nix

@@ -0,0 +1,21 @@
+{
+  # Enable SSH
+  services = {
+    openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PrintLastLog = "no";
+        PasswordAuthentication = false;
+      };
+    };
+
+    # Block nefarious SSH connections
+    fail2ban = {
+      enable = true;
+      maxretry = 5;
+      bantime = "5m";
+      ignoreIP = [ "10.0.0.0/24" ];
+    };
+  };
+}

nixos/services/sunshine.nix

@@ -0,0 +1,8 @@
+{
+  # Enable Sunshine as a service
+  services.sunshine = {
+    enable = true;
+    settings.port = 57989;
+    autoStart = false;
+  };
+}

nixos/services/udev.nix

@@ -0,0 +1,21 @@
+{pkgs, ...}: {
+  # Make udev rules to make PDP controller and Oculus Rift CV1 work
+  services.udev = let
+    oculusRules = pkgs.writeTextFile {
+      name = "10-oculus.rules";
+      text = ''
+        KERNEL=="hidraw*", ATTRS{idVendor}=="0e6f", ATTRS{idProduct}=="0184", MODE="0660", TAG+="uaccess"
+      '';
+      destination = "/etc/udev/rules.d/10-oculus.rules";
+    };
+    pdpRules = pkgs.writeTextFile {
+      name = "10-pdp.rules";
+      text = ''
+        SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0666"
+      '';
+      destination = "/etc/udev/rules.d/10-pdp.rules";
+    };
+  in {
+    packages = [oculusRules pdpRules];
+  };
+}

nixos/services/virtualisation.nix

@@ -0,0 +1,36 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  # Enable virtualization
+  virtualisation = {
+    libvirtd = {
+      enable = true;
+      onBoot = "ignore";
+      onShutdown = "shutdown";
+      qemu = {
+        ovmf = {
+          enable = true;
+          packages = [pkgs.OVMFFull.fd];
+        };
+        swtpm.enable = true;
+      };
+    };
+    spiceUSBRedirection.enable = true;
+  };
+
+  # Install programs system-wide
+  environment.systemPackages = with pkgs; [
+    virt-manager
+    virtiofsd
+    dnsmasq
+    spice-vdagent
+    looking-glass-client
+  ];
+
+  # Allow Looking-Glass permissions
+  systemd.tmpfiles.rules = [
+    "f /dev/shm/looking-glass 0660 jimbo libvirtd -"
+  ];
+}

nixos/users/jimbo.nix

@@ -0,0 +1,29 @@
+{pkgs, ...}: {
+  users.users = {
+    jimbo = let
+      secrets = import ../common/secrets.nix;
+    in {
+      description = "Jimbo";
+      hashedPassword = secrets.jimboAccPass;
+      isNormalUser = true;
+      openssh.authorizedKeys.keys = secrets.jimKeys;
+      extraGroups = [
+        "wheel"
+        "audio"
+        "video"
+        "input"
+        "disk"
+        "dialout"
+        "networkmanager"
+        "rtkit"
+        "kvm"
+        "libvirtd"
+        "qemu-libvirtd"
+        "docker"
+        "nfsShare"
+      ];
+      uid = 1000;
+      shell = pkgs.zsh;
+    };
+  };
+}

nixos/users/nextcloud.nix

@@ -0,0 +1,9 @@
+{
+  # Add service users to extra groups
+  users.users = { 
+    nextcloud = {
+      extraGroups = [ "nfsShare" ];
+      isSystemUser = true;
+    };
+  };
+}

nixos/users/nginx.nix

@@ -0,0 +1,9 @@
+{
+  # Add service users to extra groups
+  users.users = { 
+    nginx = {
+      extraGroups = [ "turnserver" "virtualMail" ];
+      isSystemUser = true;
+    };
+  };
+}