What a clusterfuck

modules/system/devices/bluetooth/default.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  hardware.bluetooth = {
+    enable = true;
+    settings = {
+      General.Experimental = "true";
+      Policy.AutoEnable = "true";
+    };
+  };
+
+  # Lingering helps keep headphones connected
+  systemd.tmpfiles.rules = [
+    "f /var/lib/systemd/linger/jimbo"
+  ];
+}

modules/system/devices/boot/extlinux/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  boot.loader = {
+    generic-extlinux-compatible.enable = true;
+    grub.enable = false;
+  };
+}

modules/system/devices/boot/lanzaboote/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/etc/secureboot";
+  };
+}

modules/system/devices/boot/systemd/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  boot.loader.systemd-boot = {
+    enable = true;
+    netbootxyz.enable = true;
+  };
+}

modules/system/devices/default.nix

@@ -0,0 +1,13 @@
+{ ... }:
+{
+  imports = [
+    ./bluetooth
+    ./filesystems
+    ./networking
+    ./pipewire
+    ./printing
+    ./security
+    ./udev
+    ./video
+  ];
+}

modules/system/devices/filesystems/default.nix

@@ -0,0 +1,7 @@
+{ lib, ... }:
+{
+  boot.supportedFilesystems = {                             
+    ntfs = true;
+    zfs = lib.mkForce false;
+  };
+}

modules/system/devices/networking/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  networking = {
+    wireless.enable = false;
+    dhcpcd.enable = true;
+    nftables.enable = true;
+  };
+}

modules/system/devices/networking/firewall/pc/default.nix

@@ -0,0 +1,9 @@
+{ outputs, ... }:
+{
+  networking.firewall = {
+    allowPing = false;
+    extraInputRules = ''
+      ip saddr { ${outputs.ips.server}, ${outputs.ips.wgSpan}.1 } accept comment "Accept Server"
+    '';
+  };
+}

modules/system/devices/networking/firewall/server/default.nix

@@ -0,0 +1,56 @@
+{ outputs, ... }:
+{
+  # Allow forwarding
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  # Configure firewall
+  networking = let
+    mailPorts = "{ 25, 143, 465, 587, 993, 4190 }";
+  in {
+    firewall = {
+      allowPing = false;
+  
+      # Add extra input rules using nftables
+      extraInputRules = ''
+        ip saddr { ${outputs.ips.localSpan}.0/24, ${outputs.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
+        ip saddr { ${outputs.ips.pc}, ${outputs.secrets.lunaIP}, ${outputs.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
+        ip saddr ${outputs.ips.wgSpan}.3 tcp dport ${mailPorts} accept comment "Accept mail"
+      '';
+    };
+  
+    # Enable nftables and forwarding
+    nftables = {
+      tables = {
+        forwarding = {
+          family = "ip";
+          content = ''
+            chain PREROUTING {
+              type nat hook prerouting priority dstnat; policy accept;
+              tcp dport 2211 dnat to ${outputs.ips.pc}:22 comment "SSH to PC"
+              tcp dport 2233 dnat to ${outputs.ips.wgSpan}.3:22 comment "SSH to Oracle VM"
+              
+              udp dport { 27005, 27015, 7777 } dnat to ${outputs.ips.pc} comment "PC Hosted Games"
+              
+              tcp dport { 58010, 57989, 57984 } dnat to ${outputs.ips.pc} comment "PC Sunshine TCP"
+              udp dport { 57998, 57999, 58000 } dnat to ${outputs.ips.pc} comment "PC Sunshine UDP"
+              
+              tcp dport { 38010, 37989, 37984 } dnat to ${outputs.ips.vm} comment "VM Sunshine TCP"
+              udp dport { 37998, 37999, 38000 } dnat to ${outputs.ips.vm} comment "VM Sunshine UDP"
+              
+              udp dport { 7790, 7791, 7792 } dnat to ${outputs.ips.hx} comment "Deus Ex"
+              
+              ip saddr ${outputs.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${outputs.ips.vm} comment "VM ALVR TCP"
+              ip saddr ${outputs.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${outputs.ips.vm} comment "VM ALVR UDP"
+            }
+            chain POSTROUTING {
+              type nat hook postrouting priority 100; policy accept;
+              oifname "${outputs.ips.netInt}" masquerade
+	      iifname "${outputs.ips.netInt}" oifname "${outputs.ips.wgInt}" masquerade comment "Traffic from public to WireGuard"
+	      tcp dport ${mailPorts} oifname != "${outputs.ips.wgInt}" drop comment "Send mail"
+            }
+          '';
+        };
+      };
+    };
+  };
+}

modules/system/devices/networking/wireguard/client/default.nix

@@ -0,0 +1,22 @@
+{ outputs, ... }:
+{
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard.interfaces = {
+    "${outputs.ips.wgInt}" = {
+      # Define IP of client in per device config
+      listenPort = 51820;
+      privateKey = outputs.secrets.wgClientPriv;
+      peers = [
+        { # 0.0.0.0 makes wg act like a traditional VPN
+          publicKey = outputs.secrets.wgServerPub;
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "sv.${outputs.secrets.jimDomain}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

modules/system/devices/networking/wireguard/host/default.nix

@@ -0,0 +1,36 @@
+{ outputs, ... }:
+{
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "${outputs.ips.netInt}";
+      internalInterfaces = [ "${outputs.ips.wgInt}" ];
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      "${outputs.ips.wgInt}" = {
+        ips = [ "${outputs.ips.wgSpan}.1/24" ];
+        listenPort = 51820;
+        privateKey = outputs.secrets.wgServerPriv;
+        peers = [
+          { # Jimbo Pixel 9
+            publicKey = outputs.secrets.wgPixel9Pub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.2/32" ];
+          }
+          { # Oracle VM
+            publicKey = outputs.secrets.wgOraclePub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.3/32" ];
+          }
+          { # General Nix
+            publicKey = outputs.secrets.wgClientPub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.16/28" ];
+          }
+        ];
+      };
+    };
+  };
+}

modules/system/devices/networking/wireless/default.nix

@@ -0,0 +1,7 @@
+{ lib, config, ... }:
+{
+  networking = {
+    wireless.iwd.enable = true;
+    enableB43Firmware = true;
+  };
+}

modules/system/devices/pipewire/default.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  services = {
+    pipewire = {
+      enable = true;
+      audio.enable = true;
+      wireplumber = {
+        enable = true;
+        configPackages = [
+          (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/11-bluetooth-policy.conf" ''
+            wireplumber.settings = { bluetooth.autoswitch-to-headset-profile = false }
+          '')
+        ];
+      };
+      alsa = {
+        enable = true;
+        support32Bit = true;
+      };
+      pulse.enable = true;
+      #jack.enable = true;
+    };
+  };
+}

modules/system/devices/printing/default.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+{
+  services = {
+    printing = {
+      enable = true;
+      drivers = with pkgs; [hplip];
+      webInterface = false;
+    };
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    system-config-printer
+  ];
+}

modules/system/devices/udev/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./pdp
+    ./oculus
+  ];
+}

modules/system/devices/udev/oculus/default.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+{
+  services.udev = let
+    oculusRules = pkgs.writeTextFile {
+      name = "10-oculus.rules";
+      text = ''KERNEL=="hidraw*", ATTRS{idVendor}=="0e6f", ATTRS{idProduct}=="0184", MODE="0660", TAG+="uaccess"'';
+      destination = "/etc/udev/rules.d/10-oculus.rules";
+    };
+  in {
+    packages = [
+      oculusRules
+    ];
+  };
+}

modules/system/devices/udev/pdp/default.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+{
+  services.udev = let
+    pdpRules = pkgs.writeTextFile {
+      name = "10-pdp.rules";
+      text = ''SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0666"'';
+      destination = "/etc/udev/rules.d/10-pdp.rules";
+    };
+  in {
+    packages = [
+      pdpRules
+    ];
+  };
+}

modules/system/devices/video/default.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  hardware.opengl = {
+    enable = true;
+    driSupport32Bit = true;
+    extraPackages = with pkgs; [
+      vulkan-loader
+      vulkan-validation-layers
+      vulkan-extension-layer
+    ];
+  };
+}

modules/system/devices/video/nouveau/default.nix

@@ -0,0 +1,4 @@
+{ config, lib, ... }:
+{
+  services.xserver.videoDrivers = [ "nouveau" ];
+}

modules/system/devices/video/nvidia/default.nix

@@ -0,0 +1,10 @@
+{ pkgs, config, lib, ... }:
+{
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    modesetting.enable = true;
+    nvidiaSettings = false;
+    package = config.boot.kernelPackages.nvidiaPackages.beta;
+    open = false;
+  };
+}