1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60
61. 61
62. 62
63. 63
64. 64
65. 65
66. 66
67. 67
68. 68
69. 69
70. 70
71. 71
72. 72
73. 73
74. 74
75. 75
76. 76
77. 77
78. 78
79. 79
80. 80
81. 81
82. 82
83. 83
84. 84
85. 85
86. 86
87. 87
88. 88
89. 89
90. 90
91. 91
92. 92
93. 93
94. 94
95. 95
96. 96
97. 97
98. 98
99. 99
100. 100
101. 101
102. 102
103. 103
104. 104
105. 105
106. 106
107. 107
108. 108
109. 109
110. 110
111. 111
112. 112
113. 113
114. 114
115. 115
116. 116
117. 117

# Copyright 2025 Shota FUJI <pockawoooh@gmail.com>
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
# OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
#
# SPDX-License-Identifier: 0BSD
#
# NixOS module for queenbee, desktop machine (GMKtec EVO-T1)

{
  config,
  pkgs,
  nixpkgs,
  home-manager,
  agenix,
  disko,
  ...
}:
{
  imports = [
    agenix.nixosModules.default
    disko.nixosModules.default
    ../../../hardwares/gmktec-evo-t1/disko.nix
    ../../../hardwares/gmktec-evo-t1/hardware-configuration.nix
    ../nixos/state-version.nix
    ../home-manager
    ../essentials
    ../shell
    ../hive
    ../wayland-desktop
  ];

  config = {
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;

    networking.hostName = "hive";
    networking.firewall.allowedUDPPorts = [
      # Plac's Roon Server discovery.
      9003
    ];

    time.timeZone = "Asia/Tokyo";

    users.users = {
      queenbee = {
        uid = 1000;
        isNormalUser = true;
        extraGroups = [
          "wheel"
          "incus-admin"
        ];
      };
    };

    services.printing = {
      enable = true;
      drivers = with pkgs; [
        cups-filters
        cups-browsed
        cnijfilter2
      ];
    };

    services.avahi = {
      enable = true;
      nssmdns4 = true;
      openFirewall = true;
    };

    services.openssh = {
      enable = true;

      settings = {
        KbdInteractiveAuthentication = false;
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };

      hostKeys = [
        {
          type = "ed25519";
          comment = "agenix";
          path = "/etc/ssh/ssh_host_ed25519_key";
        }
      ];
    };

    networking.wg-quick.interfaces.wg0 = {
      address = [ "fd33::6/128" ];
      privateKeyFile = config.age.secrets."queenbee/wireguard".path;
      peers = [
        {
          publicKey = "ZMGOs3K8XZUQE8AzepNW380BZZVy1RcOgF+2/B/RUFI=";
          allowedIPs = [ "fd33::/64" ];
          endpoint = "[2400:8500:1302:1176:160:251:72:148]:60545";
        }
      ];
    };

    home-manager.users.queenbee = ../../hm/profiles/nixos-desktop.nix;

    virtualisation.vmVariant = {
      users.users.queenbee.initialPassword = "password";
    };

    age.secrets."queenbee/wireguard".file = ../../../secrets/queenbee/wireguard.age;
  };
}