nix-config/systems/x86_64-linux/navis/default.nix

{
  pkgs,
  config,
  inputs,
  lib,
  ...
}:
with lib // pkgs // inputs; {
  imports = [./hardware.nix];

  security.sudo.extraConfig = ''
    Defaults lecture = never, pwfeedback
  '';

  security.pam.loginLimits = [
    {
      domain = "*";
      item = "nofile";
      type = "-";
      value = "32768";
    }
    {
      domain = "*";
      item = "memlock";
      type = "-";
      value = "32768";
    }
  ];

  console.catppuccin.enable = true;

  systemd.user.extraConfig = let
    path = lib.concatStringsSep ":" [
      "/run/wrappers/bin"
      "/etc/profiles/per-user/%u/bin"
      "/nix/var/nix/profiles/default/bin"
      "/run/current-system/sw/bin"
    ];
  in ''
    DefaultEnvironment="PATH=${path}"
  '';

  age = {
    secrets.passwd.file = /etc/secrets/passwd.age;
    identityPaths = [
      "/persist/root/.ssh/id_ed25519"
    ];
  };

  chaotic = {
    scx = {
      enable = true;
      scheduler = "scx_rusty";
    };

    steam.extraCompatPackages = [
      luxtorpeda
      proton-ge-custom
    ];
  };

  virtualisation = {
    spiceUSBRedirection.enable = true;

    libvirtd = {
      enable = true;
      qemu = {
        package = qemu_kvm;
        swtpm.enable = true;
        ovmf.enable = true;
        ovmf.packages = [OVMFFull.fd];
      };
    };

    podman = {
      enable = true;
      dockerCompat = true;
      dockerSocket.enable = true;
    };
  };

  environment = {
    sessionVariables = {
      EDITOR = "nvim";
      DIRENV_WARN_TIMEOUT = "100s";
    };

    systemPackages = [
      agenix.packages.${system}.default
      gnome.nautilus
      internal.lightly-boehs-qt6
      snowfallorg.flake
      sound-theme-freedesktop
      xclip
      yt-dlp
    ];

    persistence."/persist" = {
      hideMounts = true;
      directories = [
        "/etc/NetworkManager"
        "/etc/secrets"
        "/etc/ssh"
        "/root/.ssh"
        "/var/lib/bluetooth"
        "/var/lib/nixos"
        "/var/lib/systemd/coredump"
      ];
      files = [
        "/etc/machine-id"
        "/etc/git-credentials"
      ];
    };
  };

  boot = {
    blacklistedKernelModules = ["nouveau"];
    kernelPackages = linuxPackages_cachyos;
    supportedFilesystems = ["btrfs" "ntfs"];

    binfmt.registrations.appimage = {
      wrapInterpreterInShell = false;
      interpreter = "${appimage-run}/bin/appimage-run";
      recognitionType = "magic";
      offset = 0;
      mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff'';
      magicOrExtension = ''\x7fELF....AI\x02'';
    };

    initrd.systemd = {
      enable = true;
      emergencyAccess = true; # No password needed bc of LUKS
    };

    plymouth = {
      enable = true;
      catppuccin.enable = true;
    };

    extraModprobeConfig =
      "options nvidia "
      + concatStringsSep " " [
        "NVreg_UsePageAttributeTable=1"
        "NVreg_EnablePCIeGen3=1"
        "NVreg_RegistryDwords=RMUseSwI2c=0x01;RMI2cSpeed=100"
      ];

    kernelParams = [
      "intel_iommu=on"
      "iommu=pt"
      "kvm.ignore_msrs=1"
      "modprobe.blacklist=nouveau"
    ];

    loader = {
      efi.canTouchEfiVariables = true;

      systemd-boot = {
        enable = true;
        configurationLimit = 20;
      };
    };
  };

  nix = let
    mappedRegistry = pipe inputs [
      (filterAttrs (_: isType "flake"))
      (mapAttrs (_: flake: {inherit flake;}))
      (x: x // {nixpkgs.flake = nixpkgs;})
    ];
  in {
    package = mkForce nixSuper;
    registry = mappedRegistry // optionalAttrs (config.nix.package == nixSuper) {default = mappedRegistry.nixpkgs;};
    nixPath = mapAttrsToList (key: _: "${key}=flake:${key}") config.nix.registry;

    daemonCPUSchedPolicy = "batch";
    daemonIOSchedClass = "idle";
    daemonIOSchedPriority = 7;

    gc = {
      automatic = true;
      dates = "Sat *-*-* 03:00";
      options = "--delete-older-than 30d";
    };

    optimise = {
      automatic = true;
      dates = ["04:00"];
    };

    settings = {
      auto-optimise-store = true;
      builders-use-substitutes = true;
      flake-registry = "/etc/nix/registry.json";
      keep-going = true;
      log-lines = 30;
      max-jobs = "auto";
      sandbox-fallback = false;
      sandbox = true;
      system-features = ["nixos-test" "kvm" "recursive-nix" "big-parallel"];
      use-cgroups = true;
      use-xdg-base-directories = true;
      warn-dirty = false;

      allowed-users = ["root" "@wheel" "nix-builder"];
      trusted-users = ["root" "@wheel" "nix-builder"];

      min-free = "${toString (5 * 1024 * 1024 * 1024)}";
      max-free = "${toString (10 * 1024 * 1024 * 1024)}";

      extra-experimental-features = [
        "flakes" # flakes
        "nix-command" # experimental nix commands
        "recursive-nix" # let nix invoke itself
        "ca-derivations" # content addressed nix
        "auto-allocate-uids" # allow nix to automatically pick UIDs, rather than creating nixbld* user accounts
        "cgroups" # allow nix to execute builds inside cgroups
      ];

      substituters = [
        "https://cache.nixos.org"
        "https://nix-community.cachix.org"
        "https://nyx.chaotic.cx/"
        "https://cuda-maintainers.cachix.org"
        "https://cache.privatevoid.net"
      ];

      trusted-substituters = [
        "cache.nixos.org"
        "nix-community.cachix.org"
        "nyx.chaotic.cx"
        "cuda-maintainers.cachix.org"
        "cache.privatevoid.net"
      ];

      trusted-public-keys = [
        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
        "nyx.chaotic.cx-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
        "chaotic-nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
        "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
        "cache.privatevoid.net:SErQ8bvNWANeAvtsOESUwVYr2VJynfuc9JRwlzTTkVg="
      ];
    };
  };

  programs = {
    dconf.enable = true;
    fish.enable = true;
    gamemode.enable = true;
    nix-ld.enable = true;
    steam.enable = true;
    gnupg.agent.enable = true;
    virt-manager.enable = true;

    nh = {
      enable = true;
      clean.enable = true;
      clean.extraArgs = "--keep-since 4d --keep 3";
      flake = "/home/marshall/nix-config";
    };
  };

  networking = {
    hostName = "navis";
    firewall.enable = false;
    nameservers = ["1.1.1.1" "1.0.0.1"];
    networkmanager.dns = "none";
    networkmanager.enable = true;
  };

  time.timeZone = "America/New_York";

  i18n.defaultLocale = "en_US.UTF-8";

  services = {
    btrfs.autoScrub.enable = true;
    flatpak.enable = true;
    gnome.gnome-keyring.enable = true;
    mullvad-vpn.enable = true;
    ollama.enable = true;
    openssh.enable = true;
    spice-vdagentd.enable = true;

    displayManager.autoLogin = {
      enable = true;
      user = "marshall";
    };

    libinput = {
      enable = true;
      touchpad.naturalScrolling = true;
    };

    xserver = {
      enable = true;
      videoDrivers = ["nvidia"];
      xkb.layout = "us";

      displayManager.startx = {
        enable = true;
      };

      xrandrHeads = [
        {
          output = "DP-0";
          monitorConfig = ''
            Option "PreferredMode" "2560x1440_165.08"
          '';
        }
      ];

      windowManager.xmonad = {
        enable = true;
        enableContribAndExtras = true;
        enableConfiguredRecompile = true;
        flake = {
          enable = true;
          compiler = "ghc982";
        };
      };
    };

    pipewire = {
      enable = true;
      pulse.enable = true;
    };
  };

  users = {
    mutableUsers = false;

    users.marshall = {
      isNormalUser = true;
      extraGroups = ["wheel" "gamemode" "libvirtd" "networkmanager"];
      shell = fish;
      hashedPasswordFile = config.age.secrets.passwd.path;
    };
  };

  hardware = {
    bluetooth.enable = true;

    opengl = {
      enable = true;
      driSupport = true;
      driSupport32Bit = true;
      extraPackages = [
        vaapiVdpau
        nvidia-vaapi-driver
      ];
    };

    nvidia-container-toolkit.enable = true;

    nvidia = {
      package = config.boot.kernelPackages.nvidiaPackages.latest;
      modesetting.enable = true;
      powerManagement.enable = true;

      prime = {
        sync.enable = true;

        intelBusId = "PCI:0:2:0";
        nvidiaBusId = "PCI:1:0:0";
      };
    };
  };

  xdg.portal = {
    enable = true;
    config.common.default = "*";
    xdgOpenUsePortal = true;

    extraPortals = [
      kdePackages.xdg-desktop-portal-kde
      xdg-desktop-portal-gtk
      xdg-desktop-portal-shana
    ];
  };

  system.stateVersion = "24.05";
}