more work

modules/nixos/boot/default.nix

@@ -25,23 +25,27 @@ in
 
   config = mkMerge [
     ({
-      boot.loader = {
-        systemd-boot.enable = false;
-        grub.enable = true;
+      boot = {
+        kernelPackages = pkgs.linuxPackages_latest;
+        
+        loader = {
+          systemd-boot.enable = false;
+          grub.enable = true;
 
-        grub2-theme = {
-          enable = true;
-          theme = "vimix";
-          footer = true;
+          grub2-theme = {
+            enable = true;
+            theme = "vimix";
+            footer = true;
+          };
         };
       };
     })
 
-    (mkIf cfg.type == "bios" {
+    (mkIf (cfg.type == "bios") {
       boot.loader.grub.efiSupport = false;
     })
 
-    (mkIf cfg.type == "uefi" {
+    (mkIf (cfg.type == "uefi") {
       boot.loader = {
         efi.canTouchEfiVariables = true;
         grub = {

modules/nixos/default.nix

@@ -16,7 +16,7 @@ in
   };
 
   config = mkMerge [
-    (mkIf cfg.preset == "desktop" {
+    (mkIf (cfg.preset == "desktop") {
       ${namespace} = mkDefault {
         hardware.has = {
           audio = true;
@@ -31,8 +31,8 @@ in
       };
     })
 
-    (mkIf cfg.preset == "desktop" {
-      "${namespace}" = mkDefault {
+    (mkIf (cfg.preset == "server") {
+      ${namespace} = mkDefault {
         services = {
           ssh.enable = true;
         };

modules/nixos/desktop/default.nix

@@ -1,5 +1,6 @@
-{ lib, config, namespace, ... }:let
-  inherit (lib) mkIf mkOption mkEnableOption mkMerge attrNames filterAttrs readDir;
+{ lib, config, namespace, ... }:
+let
+  inherit (lib) mkIf mkOption mkEnableOption mkMerge;
   inherit (lib.types) nullOr enum;
 
   cfg = config.${namespace}.desktop;
@@ -7,7 +8,7 @@ in
 {
   options.${namespace}.desktop = {
     use = mkOption {
-      type = nullOr enum (attrNames (filterAttrs (n: type: type == "directory") (readDir ./.)));
+      type = nullOr (enum [ "plasma" "gamescope" "gnome" ]);
       default = null;
       example = "plasma";
       description = "Which desktop to enable";
@@ -17,9 +18,7 @@ in
   };
 
   config = mkMerge [
-    (mkIf cfg.desktop != null {
-      "${namespace}".desktop.${cfg.use}.enable = true;
-
+    ({
       services.displayManager = {
         enable = true;
 
@@ -28,5 +27,9 @@ in
         };
       };
     })
+
+    (mkIf (cfg.use != null) {
+      ${namespace}.desktop.${cfg.use}.enable = true;
+    })
   ];
 }

modules/nixos/shells/zsh.nix

@@ -0,0 +1,14 @@
+{ inputs, config, lib, pkgs, namespace, ... }:
+let
+  inherit (lib) mkIf mkEnableOption;
+
+  cfg = config.${namespace}.shell.zsh;
+in
+{
+  options.${namespace}.shell.zsh = {
+    enable = mkEnableOption "enable zsh shell";
+  };
+
+  config = mkIf cfg.enable {
+  };
+}

modules/nixos/system/networking.nix

@@ -0,0 +1,25 @@
+{ config, lib, pkgs, namespace, ... }: 
+let
+  inherit (lib) mkDefault;
+
+  cfg = config.${namespace}.system.networking;
+in 
+{
+  options.${namespace}.system.networking = {};
+
+  config = {
+    systemd.services.NetworkManager-wait-online.enable = false;
+
+    networking = {
+      enableIPv6 = true;
+      useDHCP = mkDefault true;
+
+      firewall.enable = true;
+
+      networkmanager = {
+        enable = true;
+        wifi.backend = "wpa_supplicant";
+      };
+    };
+  };
+}

modules/nixos/system/security/boot.nix

@@ -0,0 +1,46 @@
+{ config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security.boot;
+in
+{
+  options.${namespace}.system.security.boot = {};
+
+  config = {
+    boot = {
+      kernelModules = [ "tcp_bbr" ];
+      kernel.sysctl = {
+        ## TCP hardening
+        # Prevent bogus ICMP errors from filling up logs.
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+        # Reverse path filtering causes the kernel to do source validation of
+        # packets received from all interfaces. This can mitigate IP spoofing.
+        "net.ipv4.conf.default.rp_filter" = 1;
+        "net.ipv4.conf.all.rp_filter" = 1;
+        # Do not accept IP source route packets (we're not a router)
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        # Don't send ICMP redirects (again, we're on a router)
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.default.send_redirects" = 0;
+        # Refuse ICMP redirects (MITM mitigations)
+        "net.ipv4.conf.all.accept_redirects" = 0;
+        "net.ipv4.conf.default.accept_redirects" = 0;
+        "net.ipv4.conf.all.secure_redirects" = 0;
+        "net.ipv4.conf.default.secure_redirects" = 0;
+        "net.ipv6.conf.all.accept_redirects" = 0;
+        "net.ipv6.conf.default.accept_redirects" = 0;
+        # Protects against SYN flood attacks
+        "net.ipv4.tcp_syncookies" = 1;
+        # Incomplete protection again TIME-WAIT assassination
+        "net.ipv4.tcp_rfc1337" = 1;
+
+        ## TCP optimization
+        # Enable TCP Fast Open for incoming and outgoing connections
+        "net.ipv4.tcp_fastopen" = 3;
+        # Bufferbloat mitigations + slight improvement in throughput & latency
+        "net.ipv4.tcp_congestion_control" = "bbr";
+        "net.core.default_qdisc" = "cake";
+      };
+    };
+  };
+}

modules/nixos/system/security/default.nix

@@ -0,0 +1,23 @@
+{ config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security;
+in
+{
+  options.${namespace}.system.security = {};
+
+  config = {
+    security = {
+      acme.acceptTerms = true;
+      polkit.enable = true;
+
+      pam = {
+        u2f = {
+          enable = true;
+          settings.cue = true;
+        };
+      };
+    };
+
+    programs.gnupg.agent.enable = true;
+  };
+}

modules/nixos/system/security/sops.nix

@@ -0,0 +1,22 @@
+{ pkgs, config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security.sops;
+in
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  options.${namespace}.system.security.sops = {};
+
+  config = {
+    environment.systemPackages = with pkgs; [ sops ];
+
+    sops = {
+      defaultSopsFile = ../../../../secrets/secrets.yaml;
+      defaultSopsFormat = "yaml";
+
+      age.keyFile = "/home/";
+    };
+  };
+}

modules/nixos/system/security/sudo.nix

@@ -0,0 +1,23 @@
+{ config, namespace, ... }:
+let
+  cfg = config.${namespace}.system.security.sudo;
+in
+{
+  options.${namespace}.system.security.sudo = {};
+
+  config = {
+    security = {
+      sudo = {
+        enable = false;
+        execWheelOnly = true;
+      };
+      
+      sudo-rs = {
+        enable = true;
+        extraConfig = ''
+          Defaults env_keep += "EDITOR PATH DISPLAY"
+        '';
+      };
+    };
+  };
+}

modules/nixos/theming.nix

@@ -0,0 +1,48 @@
+{ inputs, config, lib, pkgs, namespace, ... }:
+let
+  inherit (lib) mkIf mkEnableOption;
+
+  cfg = config.${namespace}.theming;
+in
+{
+  imports = [
+    inputs.stylix.nixosModules.stylix
+  ];
+
+  options.${namespace}.theming = {
+    enable = mkEnableOption "enable theming";
+  };
+
+  config = mkIf cfg.enable {
+    stylix = {
+      enable = true;
+      autoEnable = true;
+
+      # base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme}.yaml";
+      # image = ./${cfg.theme}.jpg;
+      # polarity = cfg.polarity;
+
+      fonts = {
+        serif = {
+          package = pkgs.dejavu_fonts;
+          name = "DejaVu Serif";
+        };
+
+        sansSerif = {
+          package = pkgs.dejavu_fonts;
+          name = "DejaVu Sans";
+        };
+
+        monospace = {
+          package = pkgs.nerd-fonts.jetbrains-mono;
+          name = "JetBrainsMono Nerd Font Mono";
+        };
+
+        emoji = {
+          package = pkgs.noto-fonts-emoji;
+          name = "Noto Color Emoji";
+        };
+      };
+    };
+  };
+}