WIP

hosts/common/core/default.nix

@@ -3,8 +3,10 @@
   imports = [
     ./disko.nix
     ./locale.nix
+    ./netbird.nix
     ./nix.nix
     ./packages.nix
     ./sops.nix
+    ./zsh.nix
   ];
 }

hosts/common/core/disko.nix

@@ -2,7 +2,6 @@
   config,
   disko,
   lib,
-  inputs,
   ...
 }:
 with lib;
@@ -11,7 +10,7 @@ let
 in
 {
   imports = [
-    inputs.disko.nixosModules.disko
+    disko.nixosModules.disko
   ];
 
   options.disko.cfg = {

hosts/common/core/netbird.nix

@@ -0,0 +1,4 @@
+{ config, ... }:
+{
+  services.netbird.enable = true;
+}

hosts/common/core/packages.nix

@@ -1,8 +1,13 @@
 { congif, pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
+    age
+    bind
+    btop
     git
-    neovim
+    jq
+    openssl
     tmux
+    tree
   ];
 }

hosts/common/core/sops.nix

@@ -10,7 +10,7 @@
     validateSopsFiles = false;
     secrets = {
       benq-password = {
-          neededForUsers = true;
+        neededForUsers = true;
       };
     };
   };

hosts/common/core/zsh.nix

@@ -0,0 +1,5 @@
+{ config, ... }:
+{
+  # programs.zsh.enable = true;
+  programs.nix-ld.enable = true;
+}

hosts/common/optional/docker.nix

@@ -1,18 +0,0 @@
-{ config, pkgs, ... }:
-{
-  virtualisation.docker = {
-    enable = true;
-    rootless = {
-      enable = true;
-      setSocketVariable = true;
-    };
-  };
-  security.wrappers = {
-    docker-rootlesskit = {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_net_bind_service+ep";
-      source = "${pkgs.rootlesskit}/bin/rootlesskit";
-    };
-  };
-}

hosts/common/users/benq.nix

@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  inputs,
+  pkgs,
   ...
 }:
 with lib;
@@ -9,11 +9,16 @@ with lib;
   users = {
     mutableUsers = false;
     users.benq = {
+      shell = pkgs.zsh;
       isNormalUser = true;
+      ignoreShellProgramCheck = true;
       hashedPasswordFile = config.sops.secrets.benq-password.path;
       openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAeIuJzR68xA4ugJjtWbwvaWEU852Hg9FAAhXNw8ou43 benq"
       ];
+      linger = true;
+      subUidRanges = [ { startUid = 100000; count = 65536; } ];
+      subGidRanges = [ { startGid = 100000; count = 65536; } ];
       extraGroups =
         let
         ifTheyExist = groups: filter (group: hasAttr group config.users.groups) groups;
@@ -21,7 +26,6 @@ with lib;
         flatten [
         "wheel"
           (ifTheyExist [
-           "docker"
            "git"
            "networkmanager"
            "video"

hosts/homelab/boot.nix

@@ -1,7 +1,10 @@
 { config, ... }:
 {
   boot.loader = {
-    systemd-boot.enable = true;
+    systemd-boot = { 
+      enable = true;
+      configurationLimit = 5;
+    };
     efi.canTouchEfiVariables = true;
   };
 }

hosts/homelab/configuration.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 {
@@ -16,7 +17,6 @@
       ]
       ++ (map (f: "hosts/common/optional/${f}") [
         "bbr.nix"
-        "docker.nix"
         "endlessh.nix"
         "fail2ban.nix"
         "openssh.nix"
@@ -25,5 +25,6 @@
   ];
 
   disko.cfg.mainDevice = "/dev/disk/by-id/ata-AMD_R5M120G8_07092225C0040";
+  environment.shells = [ pkgs.zsh ];
   system.stateVersion = "26.05";
 }

hosts/homelab/network.nix

@@ -2,25 +2,13 @@
 {
   networking = {
     hostName = "homelab";
-    useDHCP = false;
-    dhcpcd.enable = false;
-    defaultGateway = "192.168.88.1";
-    nameservers = [ "192.168.88.1" ];
-
-    interfaces.enp7s0.ipv4.addresses = [
-    {
-      address = "192.168.88.5";
-      prefixLength = 24;
-    }
-    ];
-
     firewall = {
-      allowedTCPPorts = [
-        22
-        80
-        443
-      ];
-      allowedUDPPorts = [ ];
+      allowedTCPPorts = [ 22 80 443 6969 ];
+      allowedUDPPorts = [ 3478 ];
     };
   };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_unprivileged_port_start" = 80;
+  };
 }