added nix files

desktop.nix

@@ -0,0 +1,384 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+#   services.openssh.settings.PasswordAuthentication = true;
+
+  networking.hostName = "nixos"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "America/New_York";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  # You can disable this if you're only using the Wayland session.
+  services.xserver.enable = true;
+  boot.supportedFilesystems = [ "ntfs" "xfs"];
+
+
+#   fileSystems."/media/backup" = {
+#     device = "/dev/disk/by-uuid/d418fb75-427a-408c-8703-7d8c183b7b51";
+#     fsType = "xfs";
+#     options = [
+#       "nofail"
+#       "x-systemd.automount"
+#       "x-systemd.device-timeout=1s"
+#       "x-systemd.idle-timeout=10min"
+#     ];
+#   };
+
+#   # NTFS: pick ONE of the fsType choices below (see notes)
+#   fileSystems."/media/external" = {
+#     device = "/dev/disk/by-uuid/901E7D2E1E7D0E8A";
+#
+#     # Option A (recommended on modern kernels): in-kernel ntfs3
+#     fsType = "ntfs3";
+#
+#     # Option B: userspace ntfs-3g (more forgiving for some edge cases)
+#     # fsType = "ntfs-3g";
+#
+#     options = [
+#       "rw"
+#       "nofail"
+#       "x-systemd.automount"
+#       "x-systemd.device-timeout=1s"
+#       "x-systemd.idle-timeout=10min"
+#
+#       # Make files owned by your user on mount (adjust if needed)
+#       "uid=1000"
+#       "gid=100"
+#       "umask=022"
+#     ];
+#   };
+
+  # Enable the KDE Plasma Desktop Environment.
+  services.displayManager.sddm.enable = true;
+  services.desktopManager.plasma6.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.thallock = {
+    isNormalUser = true;
+    description = "thallock";
+    extraGroups = [ "networkmanager" "wheel" "docker" ];
+    packages = with pkgs; [
+      kdePackages.kate
+    #  thunderbird
+    ];
+  };
+
+  # Install firefox.
+  programs.firefox.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  vim
+   wget
+   git
+   uv
+   brave
+   fish
+   zellij
+#   lean4
+  elan
+  zed-editor
+  rustup
+  pkg-config
+  openblas
+  gcc
+  alacritty
+  logseq
+  qbittorrent
+  xclip
+  python3
+  playwright-driver.browsers
+  vlc
+  vscode
+  docker-compose
+  ripgrep
+  ntfs3g
+  ffmpeg
+  p7zip
+  claude-code
+  sqlite
+#   tig
+  meld
+  eza
+  tree
+  nmap
+  lazygit
+  nodejs
+  ncdu
+  file
+  fzf
+
+    pkgs.python313Packages.vllm
+  aider-chat
+  # You'll likely want these for the full local experience
+  ollama
+];
+
+  services.ollama = {
+    enable = true;
+    acceleration = "cuda";
+  host = "0.0.0.0";
+  port = 11434;
+  # optional
+  environmentVariables = {
+    OLLAMA_CONTEXT_LENGTH = "32768";
+    OLLAMA_KEEP_ALIVE = "-1";
+  };
+  };
+
+  services.open-webui = {
+    enable = true;
+    environment = {
+      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434/api";
+      OLLAMA_BASE_URL = "http://127.0.0.1:11434";
+    };
+  };
+
+virtualisation.docker = {
+  enable = true;
+};
+
+#   shellHook = ''
+#   export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
+#   export PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS=true
+#   export PLAYWRIGHT_HOST_PLATFORM_OVERRIDE="ubuntu-24.04"
+# '';
+
+  security.sudo.wheelNeedsPassword = false;
+  programs.fish.enable = true;
+
+#   programs.chromium = { enable = true; package = pkgs.brave; };
+
+
+  hardware.bluetooth.enable = true;
+    hardware.graphics = { # or hardware.opengl on older NixOS versions
+    enable = true;
+#     driSupport = true;
+#     driSupport32Bit = true;
+  };
+
+
+  services.xserver.videoDrivers = ["nvidia"];
+
+    hardware.nvidia = {
+    # Modesetting is required
+    modesetting.enable = true;
+    open=true;
+
+    # Power management (experimental, can cause issues)
+    powerManagement.enable = false;
+    # Enable the Nvidia settings menu
+    nvidiaSettings = true;
+
+    # Use the stable driver branch
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+
+
+  networking.firewall.trustedInterfaces = [ "docker0" ];
+/*
+  services.pia-vpn = {
+    enable = true;
+
+    certificateFile = ./ca.rsa.4096.crt;
+
+    environmentFile = "/run/secrets/pia.env";
+
+    portForward = {
+      enable = true;
+      script = ''
+        echo "PIA forwarded port is: $port"
+        # example: write to a file other services can read
+        echo -n "$port" > /run/pia-forwarded-port
+      '';
+    };
+  };
+
+  systemd.services.pia-env-file = {
+    description = "Prepare PIA env file";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "pia-vpn.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.bash}/bin/bash -c 'install -d -m 700 /run/secrets && install -m 600 /etc/pia.env /run/secrets/pia.env'";
+    };
+  };
+
+
+
+  # configuration.nix
+  services.pia-vpn.networkConfig = ''
+    [Match]
+    Name = ''${interface}
+
+    [Network]
+    Description = WireGuard PIA network interface
+    Address = ''${peerip}/32
+
+    [RoutingPolicyRule]
+    To = ''${wg_ip}/32
+    Priority = 1000
+
+    # if port forwarding is required, make an exception for that service
+    # as it's not accessible from inside the VPN
+    [RoutingPolicyRule]
+    To = ''${meta_ip}/32
+    Priority = 1000
+
+    [RoutingPolicyRule]
+    To = 0.0.0.0/0
+    Priority = 2000
+    Table = 42
+
+    [Route]
+    Destination = 0.0.0.0/0
+    Table = 42
+  '';
+
+
+
+  # Make dependent services follow the VPN lifecycle (optional but nice)
+  systemd.services.myapp = {
+    after = [ "pia-vpn.service" ];
+    bindsTo = [ "pia-vpn.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      # ...
+    };
+  };*/
+
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  systemd.network.wait-online.enable = false;
+
+#   This is for pywright:
+programs.nix-ld = {
+  enable = true;
+  libraries = pkgs.steam-run.args.multiPkgs pkgs;
+/*
+    libraries = with pkgs; [
+    stdenv.cc.cc.lib
+    glib
+    gtk3
+    cairo
+    pango
+    atk
+    gdk-pixbuf
+    dbus
+    alsaLib
+    freetype
+    fontconfig
+    xorg.libX11
+    xorg.libX11_xcb
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+  ];*/
+};
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+
+
+
+}

server.nix

@@ -0,0 +1,316 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # systemd.network.enable = true;
+  # systemd.services.systemd-networkd-wait-online.enable = false;
+
+  networking.hostName = "nixerver"; # Define your hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  systemd.network.wait-online.enable = false;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+
+  programs.nix-ld.enable = true;
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "America/New_York";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  boot.supportedFilesystems = ["ntfs" "xfs"];
+
+
+# services.openssh.settings.PasswordAuthentication = true;
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+
+  # Enable the XFCE Desktop Environment.
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.xfce.enable = true;
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+
+  # Enable sound with pipewire.
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+    # If you want to use JACK applications, uncomment this
+    #jack.enable = true;
+
+    # use the example session manager (no others are packaged yet so this is enabled by default,
+    # no need to redefine it in your config for now)
+    #media-session.enable = true;
+  };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.thallock = {
+    isNormalUser = true;
+    description = "thallock";
+    extraGroups = [ "networkmanager" "wheel" "docker"];
+    packages = with pkgs; [
+    #  thunderbird
+    ];
+  };
+
+  # Install firefox.
+  programs.firefox.enable = true;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #  wget
+     kdePackages.kate
+     vim
+     wget
+     git
+     uv
+     fish
+     zellij
+     rustup
+     pkg-config
+     gcc
+     qbittorrent
+     xclip
+     python3
+     docker-compose
+     ripgrep
+     ntfs3g
+     sqlite
+     eza
+     tree
+     nmap
+     rsync
+
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+enable = true;
+ports = [2252];
+settings = {
+PasswordAuthentication = false;
+PermitRootLogin = "no" ; 
+};
+
+};
+  # pograms.fish.enable = true;
+
+
+
+systemd.services.phone-recorder = {
+    description = "Phone Recorder API Server";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    environment = {
+      HOST = "0.0.0.0";
+      PORT = "8000";
+      BASE_DIR = "/work/hosting/clio/clio-api";
+      RECORDINGS_DIR = "/media/external/Hosting/Recordings";
+      DATABASE_PATH = "/work/hosting/recordings/data/recordings.db";
+      KEYS_DIR = "/work/hosting/recordings/data/keys";
+    };
+
+    serviceConfig = {
+      Type = "simple";
+      User = "thallock";
+      Group = "users";
+      WorkingDirectory = "/work/hosting/clio/clio-api";
+      EnvirontmentFile = "/etc/clio/secrets.env";
+      ExecStart = "/run/current-system/sw/bin/uv run python main.py";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+
+services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "recordings.hallocks.xyz" = {
+        extraConfig = ''
+          # API endpoints - must come before file_server
+          handle /api/* {
+            reverse_proxy localhost:8000
+          }
+
+          handle /health {
+            reverse_proxy localhost:8000
+          }
+
+          # React frontend for everything else
+          handle {
+            root * /work/hosting/clio/clio-ui
+            file_server
+            try_files {path} /RecordingsViewer.html
+          }
+        '';
+      };
+
+      "code.hallocks.xyz" = {
+        extraConfig = ''
+          reverse_proxy localhost:3000
+        '';
+      };
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    settings = {
+      server = {
+        DOMAIN = "code.hallocks.xyz";
+        ROOT_URL = "https://code.hallocks.xyz/";
+        HTTP_PORT = 3000;
+      };
+      actions = {
+        ENABLED = true;
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 8000 ];
+        
+  networking.firewall.trustedInterfaces = ["docker0"];
+
+  services.pia-vpn = {
+    enable = true;
+
+    certificateFile = ./ca.rsa.4096.crt;
+
+    environmentFile = "/run/secrets/pia.env";
+
+    portForward = {
+      enable = true;
+      script = ''
+        echo "PIA forwarded port is: $port"
+        # example: write to a file other services can read
+        echo -n "$port" > /run/pia-forwarded-port
+      '';
+    };
+  };
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.default = {
+      enable = true;
+      name = "local-runner";
+      url = "https://code.hallocks.xyz";
+      tokenFile = "/var/lib/forgejo-runner/token";
+      labels = [
+        "ubuntu-latest:docker://node:20-bookworm"
+        "native:host"
+      ];
+    };
+  };
+
+  systemd.services.gitea-runner-default.serviceConfig = {
+    ReadWritePaths = [ "/work/hosting/clio" ];
+  };
+
+  systemd.services.pia-env-file = {
+    description = "Prepare PIA env file";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "pia-vpn.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.bash}/bin/bash -c 'install -d -m 700 /run/secrets && install -m 600 /etc/pia.env /run/secrets/pia.env'";
+    };
+  };
+
+
+ # # Make dependent services follow the VPN lifecycle (optional but nice)
+ # systemd.services.myapp = {
+ #   after = [ "pia-vpn.service" ];
+ #   bindsTo = [ "pia-vpn.service" ];
+ #   wantedBy = [ "multi-user.target" ];
+ #   serviceConfig = {
+ #     # ...
+ #   };
+ # };
+
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  virtualisation.docker.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "25.11"; # Did you read the comment?
+
+}
+