1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60
61. 61
62. 62
63. 63
64. 64
65. 65
66. 66
67. 67
68. 68
69. 69
70. 70
71. 71
72. 72
73. 73
74. 74
75. 75
76. 76
77. 77
78. 78
79. 79
80. 80
81. 81
82. 82
83. 83
84. 84
85. 85
86. 86
87. 87
88. 88
89. 89
90. 90
91. 91
92. 92
93. 93
94. 94
95. 95
96. 96

# Copyright 2025 Shota FUJI <pockawoooh@gmail.com>
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
# OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
#
# SPDX-License-Identifier: 0BSD
#
# NixOS module for queenbee, desktop machine (GMKtec EVO-T1)

{
  config,
  pkgs,
  nixpkgs,
  home-manager,
  agenix,
  disko,
  ...
}:
{
  imports = [
    agenix.nixosModules.default
    disko.nixosModules.default
    ../../../hardwares/gmktec-evo-t1/disko.nix
    ../../../hardwares/gmktec-evo-t1/hardware-configuration.nix
    ../nixos/state-version.nix
    ../home-manager
    ../essentials
    ../shell
    ../hive
    ../wayland-desktop
  ];

  config = {
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;

    networking.hostName = "hive";

    users.users = {
      queenbee = {
        uid = 1000;
        isNormalUser = true;
        extraGroups = [
          "wheel"
          "incus-admin"
        ];
      };
    };

    services.openssh = {
      enable = true;

      settings = {
        KbdInteractiveAuthentication = false;
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };

      hostKeys = [
        {
          type = "ed25519";
          comment = "agenix";
          path = "/etc/ssh/ssh_host_ed25519_key";
        }
      ];
    };

    networking.wg-quick.interfaces.wg0 = {
      address = [ "fd33::6/128" ];
      privateKeyFile = config.age.secrets."queenbee/wireguard".path;
      peers = [
        {
          publicKey = "ZMGOs3K8XZUQE8AzepNW380BZZVy1RcOgF+2/B/RUFI=";
          allowedIPs = [ "fd33::/64" ];
          endpoint = "[2400:8500:1302:1176:160:251:72:148]:60545";
        }
      ];
    };

    home-manager.users.queenbee = ../../hm/profiles/nixos-desktop.nix;

    virtualisation.vmVariant = {
      users.users.queenbee.initialPassword = "password";
    };

    age.secrets."queenbee/wireguard".file = ../../../secrets/queenbee/wireguard.age;
  };
}