Rename some hostnames

hosts/cyberspark/home/default.nix

@@ -1,15 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ../../../modules/home/users
-    ../../../modules/home/settings/nix
-    ../../../modules/home/programs/misc/headless
-    ../../../modules/home/programs/terminal/fastfetch
-    ../../../modules/home/programs/terminal/git
-    ../../../modules/home/programs/terminal/neovim
-    ../../../modules/home/programs/terminal/ranger
-    ../../../modules/home/programs/terminal/tmux
-    ../../../modules/home/programs/terminal/zsh
-    ../../../variables/domains
-  ];
-}

hosts/extern/boot/default.nix

@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 {
   boot = {
-    kernelPackages = pkgs.unstable.linuxPackages_latest;
+    kernelPackages = pkgs.linuxPackages_5_10;
     kernel.sysctl."vm.max_map_count" = 2147483642;
     kernelParams = [
       "nvidia_drm.fbdev=1"
@@ -13,8 +13,8 @@
       services.root-reset = {
         description = "Reset root and snapshot last boot";
         wantedBy = [ "initrd.target" ];
-        after = [ "dev-${config.networking.hostName}-root.device" ];
         before = [ "sysroot.mount" ];
+        after = [ "dev-${config.networking.hostName}-root.device" ];
         unitConfig.DefaultDependencies = "no";
         serviceConfig.Type = "oneshot";
         script = ''

hosts/extern/default.nix

@@ -4,12 +4,12 @@
     ./boot
     ./disko
     ./hardware
+    ./wireguard
     ../../modules/system
   ];
 
   system.lanzaboote.enable = true;
-  system.wireguard.client.enable = false;
   system.video.nvidia.enable = true;
 
-  networking.hostName = "leash";
+  networking.hostName = "extern";
 }

hosts/extern/disko/default.nix

@@ -6,11 +6,12 @@
     disk = {
       "${config.networking.hostName}" = {
         type = "disk";
-        device = "/dev/sdi";
+        device = "/dev/sdh";
         content = {
           type = "gpt";
           partitions = {
             ESP = {
+              priority = 1;
               size = "2G";
               type = "EF00";
               content = {

hosts/extern/hardware/default.nix

@@ -1,5 +1,7 @@
 { config, lib, modulesPath, ... }:
 {
+  imports = [ (modulesPath + "/profiles/all-hardware.nix") ];
+
   boot = {
     initrd = {
       availableKernelModules = [
@@ -7,15 +9,12 @@
         "xhci_pci"
         "ahci"
         "usbhid"
+        "uas"
         "usb_storage"
         "sd_mod"
       ];
       kernelModules = [
         "dm-snapshot"
-        "vfio"
-        "vfio_pci"
-        "vfio_iommu_type1"
-        "kvm-amd"
       ];
     };
   };
@@ -23,7 +22,7 @@
   fileSystems = {
     # Remote
     "/home/jimbo/JimboNFS" = {
-      device = "${config.ips.wgSpan}.1:/export/JimboNFS";
+      device = "10.100.0.1:/export/JimboNFS";
       fsType = "nfs4";
       options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ];
     };

hosts/extern/wireguard/default.nix

@@ -0,0 +1,23 @@
+{ lib, config, ... }:
+{
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 51820 ];
+      trustedInterfaces = [ "wgc" ];
+    };
+
+    wireguard.interfaces.wgc = {
+      ips = [ "10.100.0.20/24" ];
+      listenPort = 51820;
+      privateKey = config.secrets.wgClientPriv;
+      peers = [
+        { # Cyberspark Server
+          publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
+          allowedIPs = [ "10.100.0.0/24" ];
+          endpoint = "sv.${config.domains.jim1}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

hosts/kitty/default.nix

@@ -21,5 +21,5 @@
     ../../../variables
   ];
 
-  networking.hostName = "cyberspark";
+  networking.hostName = "kitty";
 }

hosts/kitty/firewall/default.nix

@@ -0,0 +1,45 @@
+{ lib, config, ... }:
+{
+  networking = {
+    firewall = {
+      allowPing = false;
+      extraInputRules = ''
+        ip saddr { ${config.ips.localSpan}.0/24, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS"
+        ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
+      '';
+    };
+
+    # Nftables configuration only if server is enabled
+    nftables.tables.forwarding = {
+      family = "ip";
+      content = ''
+        chain PREROUTING {
+          type nat hook prerouting priority dstnat; policy accept;
+          tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
+          tcp dport 2222 dnat to 10.100.0.19:22 comment "SSH to Oracle VM"
+          
+          udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
+          
+          tcp dport { 48010, 47989, 47984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
+          udp dport { 47998, 47999, 48000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
+          
+          tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
+          udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
+          
+          udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
+          
+          ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP"
+          ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP"
+        }
+
+        chain POSTROUTING {
+          type nat hook postrouting priority 100; policy accept;
+          oifname "${config.ips.netInt}" masquerade
+        }
+      '';
+    };
+  };
+
+  # Enable IP forwarding for the server configuration
+  boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkIf config.system.firewall.server.enable 1;
+}

hosts/kitty/wireguard/default.nix

@@ -0,0 +1,28 @@
+{ lib, config, ... }:
+{
+  networking = {
+    firewall.allowedUDPPorts = [ 51820 ];
+
+    nat = {
+      enable = config.system.wireguard.server.enable;
+      externalInterface = "eno1";
+      internalInterfaces = [ "wgs" ];
+    };
+
+    wireguard.interfaces.wgs = {
+      ips = [ "10.100.0.1/24" ];
+      listenPort = 51820;
+      privateKey = config.secrets.wgServerPriv;
+      peers = [
+        { # NixOS Config Key
+          publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
+          allowedIPs = [ "10.100.0.16/28" ];
+        }
+        { # Pixel 9
+          publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
+          allowedIPs = [ "10.100.0.2/32" ];
+        }
+      ];
+    };
+  };
+}

hosts/lacros/default.nix

@@ -1,8 +1,10 @@
-{ config, lib, ... }:
+{ lib, ... }:
 {
   imports = [
-    ./hardware
     ./boot
+    ./disko
+    ./hardware
+    ./wireguard
 
     # Apps and programs
     ../../../modules/system
@@ -30,5 +32,4 @@
   };
 
   networking.hostName = "lacros";
-  networking.wireguard.interfaces."${config.ips.wgInt}".ips = [ "${config.ips.wgSpan}.18/24" ];
 }

hosts/lacros/wireguard/default.nix

@@ -0,0 +1,23 @@
+{ lib, config, ... }:
+{
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 51820 ];
+      trustedInterfaces = [ "wgc" ];
+    };
+
+    wireguard.interfaces.wgc = {
+      ips = [ "${config.ips.wgSpan}.18/24" ];
+      listenPort = 51820;
+      privateKey = config.secrets.wgClientPriv;
+      peers = [
+        { # Cyberspark Server
+          publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
+          allowedIPs = [ "10.100.0.0/24" ];
+          endpoint = "sv.${config.domains.jim1}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

hosts/shuttle/home/default.nix

@@ -1,9 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [
-    ../../../modules/home
-    ../../../modules/home/programs/misc/remote-desktop
-  ];
-
-  wayland.windowManager.sway.config.output.${config.displays.dI}.scale = "1.3";
-}

hosts/shuttle/id_ed25519.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+L723mCLy9/9UAXwkY3+06Oq22dOj+lDnA0lMLbrsR

hosts/shuttle/system/boot/default.nix

@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-{
-  boot = {
-    kernelPackages = pkgs.linuxPackages_latest;
-    kernel.sysctl."vm.max_map_count" = 2147483642;       
-  };
-}

hosts/shuttle/system/default.nix

@@ -1,32 +0,0 @@
-{ config, lib, hardware, ... }:
-{
-  imports = [
-    ./hardware
-    ./boot
-
-    # Apps and programs
-    ../../../modules/system
-    ../../../modules/system/accounts
-    ../../../modules/system/desktop
-    ../../../modules/system/programs
-    ../../../modules/system/services
-
-    # Devices and hardware
-    ../../../modules/system/devices
-    ../../../modules/system/devices/boot/extlinux
-    ../../../modules/system/devices/networking/wireless
-    ../../../modules/system/devices/networking/firewall/pc
-    ../../../modules/system/devices/networking/wireguard/pc
-
-    # Extras
-    ../../../overlays
-    ../../../variables
-
-    # Imports
-    hardware.nixosModules.pine64-pinebook-pro
-  ];
-
-  networking.hostName = "shuttle";
-  hardware.opengl.driSupport32Bit = lib.mkForce false;
-  networking.wireguard.interfaces."${config.ips.wgInt}".ips = [ "${config.ips.wgSpan}.17/24" ];
-}

hosts/shuttle/system/hardware/default.nix

@@ -1,40 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }:
-{
-  boot = {
-    initrd = {
-      availableKernelModules = [ ];
-      kernelModules = [ ];
-    };
-    blacklistedKernelModules = [
-      "pcspkr"
-    ];               
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-uuid/25738e24-385e-4bcf-bff5-d0e6274003b6";
-      fsType = "btrfs";
-    };
-    "/boot" = {
-      device = "/dev/disk/by-uuid/01D2-E962";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-    "/home/jimbo/Downloads" = {
-      device = "/dev/disk/by-uuid/f0b6cf4e-9576-4ab5-96ae-2a7e57599a35";
-      fsType = "btrfs";
-    };
-    "/home/jimbo/JimboNFS" = {
-      device = "${config.ips.wgSpan}.1:/export/JimboNFS";
-      fsType = "nfs4";
-      options = [ "x-systemd.automount" "_netdev" "nofail" "noauto" ];
-    };
-  };
-
-  swapDevices = [
-    { device = "/dev/disk/by-uuid/95c43e5a-b53d-41fd-99a3-54181510070e"; }
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}

hosts/tower/boot/default.nix

@@ -30,8 +30,8 @@ in {
       services.root-reset = {
         description = "Reset root and snapshot last boot";
         wantedBy = [ "initrd.target" ];
-        after = [ "dev-${config.networking.hostName}-root.device" ];
         before = [ "sysroot.mount" ];
+        after = [ "dev-${config.networking.hostName}-root.device" ];
         unitConfig.DefaultDependencies = "no";
         serviceConfig.Type = "oneshot";
         script = ''

hosts/tower/default.nix

@@ -3,17 +3,17 @@
   imports = [
     ./boot
     ./disko
+    ./firewall
     ./hardware
     ../../modules/system
   ];
 
   system.lanzaboote.enable = true;
   system.wireless.enable = false;
-  system.wireguard.client.enable = false;
   system.video.nvidia.enable = true;
   system.libvirtd.enable = true;
 
   environment.sessionVariables.NIXOS_OZONE_WL = "1";
 
-  networking.hostName = "firefly";
+  networking.hostName = "tower";
 }

hosts/tower/disko/default.nix

@@ -11,6 +11,7 @@
           type = "gpt";
           partitions = {
             ESP = {
+              priority = 1;
               size = "2G";
               type = "EF00";
               content = {

hosts/tower/firewall/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  networking.firewall = {
+    allowedUDPPorts = [
+      27015 # Half-Life
+      7777 # Lethal Company
+    ];
+  };
+}