chore: initial commit

2026-07-05 15:40:35 +02:00
commit aee4d0aa15
12 changed files with 940 additions and 0 deletions
@@ -0,0 +1,100 @@
+# Generic system-level config. Reusable across hosts — nothing machine- or
+# user-specific here. The user account, hostname and system.stateVersion live in
+# the per-host inventory (hosts/<host>/), not in this module.
+
+{ config, lib, pkgs, ... }:
+
+{
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  # Deduplicate identical store paths via hardlinks.
+  nix.settings.auto-optimise-store = true;
+  # Weekly GC of generations older than 30 days (frees disk + prunes stale boot
+  # entries). Flat age cutoff — Nix has no snapper-style tiered retention.
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+  # Bootloader systemd-boot much simpler than GRUB.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  # Show only the newest 5 generations in the boot menu (display cap only; GC
+  # above does the actual deletion).
+  boot.loader.systemd-boot.configurationLimit = 5;
+
+  # Use latest kernel.
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # Configure network connections interactively with nmcli or nmtui.
+  networking.networkmanager.enable = true;
+
+  networking.firewall = {
+    allowedTCPPorts = [
+      22000  # syncthing sync transport (TCP)
+    ];
+    allowedUDPPorts = [
+      22000  # syncthing sync transport (QUIC)
+      21027  # syncthing LAN discovery
+    ];
+  };
+
+  # Time zone. Template default — override per host/region.
+  time.timeZone = "Europe/Berlin";
+
+  # Internationalisation properties. Template defaults — override per region.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "de";
+  };
+
+  # Programs.
+  programs.zsh.enable = true;
+  programs.hyprland.enable = true;
+  programs.dconf.enable = true;
+
+  # Packages installed in system profile.
+  environment.systemPackages = with pkgs; [
+    curl
+    git
+    neovim
+    wget
+  ];
+  nixpkgs.config.allowUnfree = true;
+
+  # Install nice font.
+  fonts.packages = with pkgs; [
+    nerd-fonts.jetbrains-mono
+  ];
+
+  # Enable sound.
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+  security.rtkit.enable = true;
+
+  # Cache sudo credentials for 30 min per terminal (default 5). Tradeoff: an
+  # unlocked, unattended terminal can sudo without re-auth for that window.
+  security.sudo.extraConfig = "Defaults timestamp_timeout=30";
+
+  # Login manager.
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd start-hyprland";
+        user = "greeter";
+      };
+    };
+  };
+
+  # XDG portals (screen sharing, file pickers, and so on).
+  xdg.portal = {
+    enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
+  };
+}