Init commit with shit that does it

12 files changed, 350 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..febbc25
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+*.private.nix
diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..0d6376f
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+set -euo pipefail
+
+SSH_TARGET="bacchus@192.168.0.117"
+
+config_sync() {
+  sshpass -p password rsync -r "$SSH_TARGET:~/nixos/flake.lock" .
+  sshpass -p password rsync -r . "$SSH_TARGET:~/nixos"
+  # sshpass -p password ssh "$SSH_TARGET" sh -c "nixos-rebuild build --flake 'path:/home/bacchus/nixos#bacchus'"
+}
+
+cmd="$1"; shift;
+case "$cmd" in
+  sync) config_sync ;;
+  *) echo "foo" && exit 1 ;;
+esac
+
diff --git a/configuration.nix b/configuration.nix
new file mode 100644
index 0000000..65b4910
--- /dev/null
+++ b/configuration.nix
@@ -0,0 +1,55 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./modules/hardware.nix
+    ./modules/users.nix
+    ./modules/network/default.nix
+    ./modules/media/default.nix
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  environment.systemPackages = with pkgs; [
+    bottom
+    mtm
+    neovim
+    lf
+    util-linux
+  ];
+
+  systemd.extraConfig = ''DefaultLimitNOFILE=65536'';
+  systemd.user.extraConfig = ''DefaultLimitNOFILE=65536'';
+  boot.kernel.sysctl."fs.inotify.max_user_instances" = 8192;
+  security.pam.loginLimits = [
+    { domain = "*"; type = "-"; item = "nofile"; value = "65536"; }
+  ];
+
+  time.timeZone = "Asia/Kolkata";
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  # services.logind = {
+  #   powerKey = "ignore";
+  #   rebootKey = "ignore";
+  #   lidSwitch = "ignore";
+  #   lidSwitchDocked = "ignore";
+  #   lidSwitchExternalPower = "ignore";
+  #   hibernateKey = "ignore";
+  #   suspendKey = "ignore";
+  # };
+
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+  };
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+  };
+
+  system.stateVersion = "25.05";
+}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..1b18fec
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,43 @@
+{
+  "nodes": {
+    "nixos-hardware": {
+      "locked": {
+        "lastModified": 1749195551,
+        "narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixos-hardware",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1749143949,
+        "narHash": "sha256-QuUtALJpVrPnPeozlUG/y+oIMSLdptHxb3GK6cpSVhA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d3d2d80a2191a73d1e86456a751b83aa13085d7d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixos-hardware": "nixos-hardware",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..d7154c2
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,16 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
+  };
+
+  outputs = { self, nixpkgs, nixos-hardware, ... }: {
+    nixosConfigurations.bacchus = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        "${nixos-hardware}/lenovo/ideapad"
+        ./configuration.nix
+      ];
+    };
+  };
+}
diff --git a/modules/hardware.nix b/modules/hardware.nix
new file mode 100644
index 0000000..f936109
--- /dev/null
+++ b/modules/hardware.nix
@@ -0,0 +1,54 @@
+{ lib, pkgs, modulesPath, ... }:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd = {
+    availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" ];
+    kernelModules = [ ];
+  };
+  boot.kernelModules = [
+    "kvm-intel"
+    "sd_mod"
+  ];
+  hardware = {
+    enableAllFirmware = true;
+    cpu.intel.updateMicrocode = true;
+  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  # Bootloader
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      configurationLimit = 30;
+    };
+    timeout = 1;
+    efi.canTouchEfiVariables = true;
+  };
+
+  # File system
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+    };
+    "/boot" = {
+      device = "/dev/disk/by-label/boot";
+      fsType = "vfat";
+    };
+    "/media" = {
+      device = "/dev/disk/by-label/media";
+      fsType = "ext4";
+      options = [ "rw" "nofail" "x-systemd.automount" "x-systemd.mount-timeout=30s" ];
+    };
+  };
+  swapDevices = [{ device = "/dev/disk/by-label/swap"; }];
+
+  networking.useDHCP = lib.mkDefault true;
+  powerManagement = {
+    enable = true;
+    cpuFreqGovernor = "powersave";
+  };
+}
diff --git a/modules/media/config.nix b/modules/media/config.nix
new file mode 100644
index 0000000..1703901
--- /dev/null
+++ b/modules/media/config.nix
@@ -0,0 +1,15 @@
+rec {
+  mediaBaseDir = "/media";
+  downloadsDir = "${mediaBaseDir}/_downloads";
+  incompleteDownloadsDir = "${downloadsDir}/_incomplete";
+
+  tvDownloads = "${mediaBaseDir}/tv";
+  moviesDownloads = "${mediaBaseDir}/movies";
+
+  radarrPort = 7878;
+  sonarrPort = 8989;
+  prowlarrPort = 9696;
+  jellyfinPort = 8096;
+
+  group = "multimedia";
+}
diff --git a/modules/media/default.nix b/modules/media/default.nix
new file mode 100644
index 0000000..0708d8e
--- /dev/null
+++ b/modules/media/default.nix
@@ -0,0 +1,73 @@
+{ pkgs, ... }:
+let
+  config = import ./config.nix;
+in
+{
+  systemd.tmpfiles.rules = [
+    "d ${config.mediaBaseDir} 0770 - ${config.group} - -"
+    "d ${config.downloadsDir} 0770 - ${config.group} - -"
+    "d ${config.tvDownloads} 0770 - ${config.group} - -"
+    "d ${config.moviesDownloads} 0770 - ${config.group} - -"
+  ];
+  users.groups."${config.group}" = { };
+  users.users.bacchus.extraGroups = [ config.group ];
+
+  services.sonarr = {
+    enable = true;
+    openFirewall = true;
+    group = config.group;
+    settings = {
+      server.port = config.sonarrPort;
+      auth.enabled = false;
+    };
+  };
+
+  services.radarr = {
+    enable = true;
+    openFirewall = true;
+    group = config.group;
+    settings = {
+      server.port = config.radarrPort;
+      auth.enabled = false;
+    };
+  };
+
+  services.prowlarr = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      server.port = config.prowlarrPort;
+    };
+  };
+
+  services.jellyfin = {
+    enable = true;
+    openFirewall = true;
+    group = config.group;
+  };
+
+  services.transmission = {
+    enable = true;
+    group = config.group;
+    settings = {
+      "download-dir" = config.downloadsDir;
+      "download-queue-enabled" = true;
+      "download-queue-size" = 5;
+      "peer-port" = 51413;
+      "peer-port-random-high" = 65535;
+      "peer-port-random-low" = 49152;
+      "prefetch-enabled" = true;
+      "rename-partial-files" = true;
+      "rpc-authentication-required" = false;
+      "rpc-bind-address" = "127.0.0.1";
+      "rpc-enabled" = true;
+      "rpc-port" = 9091;
+      "rpc-whitelist-enabled" = true;
+      "script-torrent-done-enabled" = false;
+      "start-added-torrents" = true;
+      "trash-original-torrent-files" = false;
+      "umask" = 18;
+      "utp-enabled" = true;
+    };
+  };
+}
diff --git a/modules/network/default.nix b/modules/network/default.nix
new file mode 100644
index 0000000..444f53c
--- /dev/null
+++ b/modules/network/default.nix
@@ -0,0 +1,37 @@
+{ ... }:
+let
+  private = import ../../config.private.nix;
+in {
+  imports = [ ./ssh.nix ];
+
+  networking = {
+    hostName = "bacchus";
+
+    firewall = {
+      enable = true;
+    };
+
+    networkmanager = {
+      enable = true;
+      # wifi.powersave = true;
+      ensureProfiles.profiles = {
+        home-wifi = {
+          connection = {
+            id = "home-wifi";
+            type = "wifi";
+            autoconnect = true;
+          };
+          wifi = {
+            mode = "infrastructure";
+            ssid = private.wireless.ssid;
+          };
+          wifi-security = {
+            auth-alg = "open";
+            key-mgmt = "wpa-psk";
+            psk = private.wireless.password;
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/modules/network/ssh.nix b/modules/network/ssh.nix
new file mode 100644
index 0000000..e4e5b2a
--- /dev/null
+++ b/modules/network/ssh.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+let
+  private = import ../../config.private.nix;
+in {
+  services.sshd.enable = true;
+
+  # Auth
+  # TODO: dont allow via password
+  # openssh.authorizedKeys.keys = private.ssh.authorizedKeys;
+  services.openssh.settings.PermitRootLogin = "yes"; 
+}
diff --git a/modules/users.nix b/modules/users.nix
new file mode 100644
index 0000000..0a08c2c
--- /dev/null
+++ b/modules/users.nix
@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+let
+  private = import ../config.private.nix;
+in {
+  users.users.root.password = private.passwords.root;
+
+  users.users.bacchus = {
+    isNormalUser = true;
+    shell = pkgs.bash;
+    extraGroups = [
+      "wheel"
+      "input"
+      "networkmanager"
+      "git"
+      "docker"
+      "transmission"
+      "multimedia"
+    ];
+  };
+}
diff --git a/scripts/init.sh b/scripts/init.sh
new file mode 100644
index 0000000..a0e1eab
--- /dev/null
+++ b/scripts/init.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+set -euo pipefail
+
+sudo chown -R bacchus:multimedia /media
+sudo chown -R sonarr:multimedia /media/tv
+sudo chown -R radarr:multimedia /media/movies
+sudo chown -R transmission:multimedia /media/_downloads
+