#+TITLE: Crows Nest Configuration
* Crows Nest Configuration
Configuration for Crows nest, an automation platform featuring Portainer, Ansible, and Gitlab

#+begin_src nix :noweb yes :tangle /home/shawnb/Development/falcon_nest/crows_nest/configuration.nix
{ config, pkgs, modulesPath, lib, system, ... }:

{
  imports = [
    <<import-paths>>
  ];

  config = {
    <<boot-settings>>

    <<nix-settings>>

    <<networking-config>>

    <<timey-wimey-stuff>>

    <<services-config>>

    # Some sane packages we need on every system
    environment.systemPackages = with pkgs; [
      vim # for emergencies
      git # for pulling nix flakes
      <<system-packages>>
    ];

    <<shell-configuration>>

    <<file-system>>

    <<system-information>>

    <<user-config>>
  };
}
#+end_src
** Imports
#+NAME: imports
#+begin_src nix :noweb-ref import-paths
(modulesPath + "/profiles/qemu-guest.nix")
(modulesPath + "/profiles/minimal.nix")
# If for some reason "minimal" fails...
#(modulesPath + "/profiles/base.nix")
../virtualization/podman-utils.nix
../virtualization/nebula-sync-oci.nix
#+end_src
** ISO Information
#+NAME: iso-config
#+begin_src nix
# Let's get it booted in here
(modulesPath + "/installer/cd-dvd/iso-image.nix")
(modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")

# Provide an initial copy of the NixOS channel so that the user
# doesn't need to run "nix-channel --update" first.
(modulesPath + "/installer/cd-dvd/channel.nix")
# EFI + USB bootable
isoImage.makeEfiBootable = true;
isoImage.makeUsbBootable = true;
#+end_src
** Boot Settings
#+NAME: boot-settings
#+begin_src nix :noweb-ref boot-settings
boot.kernelPackages = pkgs.linuxPackages_latest;

# Use the boot drive for grub
boot.loader.grub.enable = lib.mkDefault true;
boot.loader.grub.devices = [ "nodev" ];

boot.growPartition = lib.mkDefault true;

# Workaround for busted ZFS kernels
boot.supportedFilesystems = {
  zfs = lib.mkForce false;
};
#+end_src
** Nix Settings
#+NAME: nix-settings
#+begin_src nix :noweb-ref nix-settings
# Allow remote updates with flakes and non-root users
nix.settings.trusted-users = [ "root" "@wheel" ];
nix.settings.experimental-features = [ "nix-command" "flakes" ];
#+end_src
** Networking and Time Settings
#+NAME: networking-config
#+begin_src nix :var ports=network-ports :noweb-ref networking-config
# Provide a default hostname
networking.hostName = lib.mkDefault "crowsnest";

# Activate firewall
networking.firewall.enable = true;

# Open firewall ports for Portainer
networking.firewall.allowedTCPPorts = [80 443 2112 8000];
#+end_src

#+NAME: timey-wimey-stuff
#+begin_src nix :noweb-ref timey-wimey-stuff
# Time Zone
time.timeZone = "America/Chicago";
#+end_src
** System Packages
#+NAME: system-packages
#+begin_src nix :noweb-ref system-packages
zsh
bat
eza
podman-tui
#+end_src
** Shell Configuration
#+NAME: shell-configuration
#+begin_src nix :noweb-ref shell-configuration
environment.shells = with pkgs; [ zsh ];
users.defaultUserShell = pkgs.zsh;

programs.zsh = {
  shellAliases = {
    #.. = "cd ..";
    h = "cd ~";
    ls = "eza --icons -l -T -L=1";
    cat = "bat";
  };
  enable = lib.mkDefault true;
  autosuggestions.enable = lib.mkDefault true;
};

#oh-my-zsh
programs.zsh.ohMyZsh = {
  enable = lib.mkDefault true;
  theme = lib.mkDefault "jtriley";
};
#+end_src
** File System
#+NAME: file-system
#+begin_src nix :noweb-ref file-system
# Default filesystem
fileSystems."/" = lib.mkDefault {
  device = "/dev/disk/by-label/nixos";
  autoResize = true;
  fsType = "ext4";
};

fileSystems."/mnt/gitlab" = {
  device = "//10.0.0.49/Gitlab";
  fsType = "cifs";
  # options = [ "username=eddie" "password=yoursambapassword" "x-systemd.automount" "noauto" ];
  options = [ "x-systemd.automount" "noauto" ];
}
#+end_src
** System Information
#+NAME: system-information
#+begin_src nix :noweb-ref system-information
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
system.stateVersion = lib.mkDefault "25.05";

# Let the VM take care of its own upgrades.
system.autoUpgrade.enable = true;

# Clean Nix up after upgrades.
programs.nh = {
  enable = true;
  clean.enable = true;
  clean.extraArgs = "--keep 5";
};
#+end_src
** Users
#+NAME: user-config
#+begin_src nix :noweb-ref user-config
# Add an admin user
users.users.shawnb = lib.mkDefault {
  isNormalUser = true;
  hashedPassword = "";
  description = "Shawn Borton";
  extraGroups = [ "networkmanager" "wheel" ];
  openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
  ];
};
#+end_src
** Services
#+NAME: services-config
#+begin_src nix :noweb-ref services-config
# Enable QEMU Guest for Proxmox
services.qemuGuest.enable = lib.mkDefault true;

#OpenSSH
security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
services.openssh = {
  enable = true;
  settings.PasswordAuthentication = false;
  settings.KbdInteractiveAuthentication = false;
  ports = [ 2112 ];
};
programs.ssh.startAgent = true;

#SOPS
sops.defaultSopsFile = ../secrets/secrets.yaml;
sops.defaultSopsFormat = "yaml";
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 # sops.secrets."nebula-sync-primary" = {
   # owner = "nebula";
 # };
 # sops.secrets."nebula-sync-replicas" = {
   # owner = "nebula";
 # };
#sops.age.keyFile = "/home/shawnb/Development/falcon_nest/sops/age/keys.txt";
#sops.secrets."nebula-sync" = {
#  owner = config.users.users.nebula.name;
#};
#+end_src
** OLD CONFIG :noexport:
#+NAME: old_config
#+begin_src nix
{ config, pkgs, modulesPath, lib, system, ... }:

{
  #imports = [
  #  (modulesPath + "/profiles/qemu-guest.nix")
  #  (modulesPath + "/profiles/minimal.nix")
  #  ../virtualization/podman-utils.nix
  #  ../virtualization/portainer.nix
  #];

  config = {
    #Provide a default hostname
    #networking.hostName = lib.mkDefault "crowsnest";

    # Activate firewall
    #networking.firewall.enable = true;

    # Open firewall ports for Portainer
    #networking.firewall.allowedTCPPorts = [ 2112 8000 9443 9000 ];

    # Time Zone
    #time.timeZone = "America/Chicago";

    # Enable QEMU Guest for Proxmox
    # services.qemuGuest.enable = lib.mkDefault true;

    # Use the boot drive for grub
    # boot.loader.grub.enable = lib.mkDefault true;
    # boot.loader.grub.devices = [ "nodev" ];

    # boot.growPartition = lib.mkDefault true;

    # Allow remote updates with flakes and non-root users
    # nix.settings.trusted-users = [ "root" "@wheel" ];
    # nix.settings.experimental-features = [ "nix-command" "flakes" ];

    # Some sane packages we need on every system
    # environment.systemPackages = with pkgs; [
    #   vim # for emergencies
    #   git # for pulling nix flakes
    #   zsh
    #   bat
    #   eza
    # ];

    # environment.shells = with pkgs; [ zsh ];
    # users.defaultUserShell = pkgs.zsh;
    # programs.zsh = {
    #   shellAliases = {
    #     #.. = "cd ..";
    #     h = "cd ~";
    #     ls = "eza --icons -l -T -L=1";
    #     cat = "bat";
    #   };
    #   enable = lib.mkDefault true;
    #   autosuggestions.enable = lib.mkDefault true;
    # };

    # #oh-my-zsh
    # programs.zsh.ohMyZsh = {
    #   enable = lib.mkDefault true;
    #   theme = lib.mkDefault "jtriley";
    # };

    # Default filesystem
    # fileSystems."/" = lib.mkDefault {
    #   device = "/dev/disk/by-label/nixos";
    #   autoResize = true;
    #   fsType = "ext4";
    # };

    # system.stateVersion = lib.mkDefault "25.05";

    # # Let the VM take care of its own upgrades.
    # system.autoUpgrade.enable = true;

    # # Clean Nix up after upgrades.
    # programs.nh = {
    #   enable = true;
    #   clean.enable = true;
    #   clean.extraArgs = "--keep 5";
    # };

    #security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
    #services.openssh = {
    #  enable = true;
    #  settings.PasswordAuthentication = false;
    #  settings.KbdInteractiveAuthentication = false;
    #  ports = [ 2112 ];
    #};
    #programs.ssh.startAgent = true;

    # Add an admin user
    #users.users.shawnb = lib.mkDefault {
    #  isNormalUser = true;
    #  hashedPassword = "";
    #  description = "Shawn Borton";
    #  extraGroups = [ "networkmanager" "wheel" ];
    #  openssh.authorizedKeys.keys = [
    #    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
    #  ];
    #};
  };
}

#+end_src