petersweb-infra/nixos/linux.nix

{
  config,
  username,
  hostname,
  pkgs,
  lib,
  nix-index-database,
  inputs,
  specialArgs,
  ...
}: let
  ddnsPkg = import ./invoke-ddns {inherit pkgs;};

  startSeq = builtins.fromJSON ''"\u001b[7m"''; # Start inverted color
  endSeq = builtins.fromJSON ''"\u001b[27m"''; # End inverted color
  motd = "${startSeq} Welcome to the Peterson Mainframe! Look, touch, but DO NOT LICK. ${endSeq}";

  nixPkgs = specialArgs.nixPkgs;
  ourRustVersion = pkgs.rust-bin.selectLatestNightlyWith (toolchain: toolchain.complete);

  ourRustPlatform = nixPkgs.makeRustPlatform {
    rustc = ourRustVersion;
    cargo = ourRustVersion;
  };

  pullomaticPkg = import ./pullomatic {
    inherit lib pkgs;
    rustPlatform = ourRustPlatform;
    specialArgs = {};
  };

  pullomatic = "${pullomaticPkg}/bin/pullomatic";

in {
  imports = [
    (import ./cloned_repos {inherit pkgs pullomatic lib;})
    (import ./firewall.nix {inherit pkgs;})
    (import ./nginx.nix {inherit pkgs lib config;})
    (import ./system/users.nix {inherit pkgs config lib nix-index-database;})
  ];

  time.timeZone = "America/Anchorage";

  age.secrets = {
    nearlyfreespeech = {
      file = ./secrets/nearlyfreespeech.age;
      owner = "root";
    };

    webdav = {
      file = ./secrets/webdav.age;
      owner = "root";
    };

    anthropic-api-key = {
      file = ./secrets/anthropic-api-key.age;
      owner = "root";
    };

    postmark = {
      file = ./secrets/postmark.age;
      owner = "root";
    };

    forgejo-runner-token = {
      file = ./secrets/forgejo-runner-token.age;
      owner = "root";
    };

    vnc-password = {
      file = ./secrets/vnc-password.age;
      owner = "root";
    };

    vnc-htpasswd = {
      file = ./secrets/vnc-htpasswd.age;
      owner = "nginx";
    };

    paperless = {
      file = ./secrets/paperless.age;
      owner = "root";
    };

    coldairnetworks = {
      file = ./secrets/coldairnetworks.age;
      owner = "root";
    };

    openai-api-key = {
      file = ./secrets/openai-api-key.age;
      owner = "root";
    };

    coldairnetworks-db-postgres = {
      file = ./secrets/coldairnetworks-db-postgres.age;
      owner = "root";
    };

    coldairnetworks-db-pgadmin = {
      file = ./secrets/coldairnetworks-db-pgadmin.age;
      owner = "root";
    };
  };

  environment.systemPackages = [
    ddnsPkg
    pullomaticPkg
    pkgs.vim
    pkgs.php
    pkgs.rustc
    pkgs.cargo
    pkgs.util-linux
    pkgs.iotop
    pkgs.rust-bin.stable.latest.default
    pkgs.wget
    pkgs.tmux

    pkgs.unstable.claude-code

  ];

  swapDevices = [
    {
      device = "/swapfile";
      size = 1 * 1024; # 1GB
    }
  ];

  # KDE Plasma on the host — the novnc systemd service (websockify) proxies
  # WebSocket traffic from nginx to the VNC server started here.
  services.xserver = {
    enable = true;
    desktopManager.plasma5.enable = true;
  };
  # Don't start X via a display manager; the vnc-kde service owns the session.
  services.displayManager.sddm.enable = lib.mkForce false;

  systemd.services.vnc-kde = {
    description = "KDE Plasma desktop accessible over VNC";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" "agenix.service" ];

    path = with pkgs; [
      tigervnc
      dbus
      xorg.xauth
      plasma5Packages.plasma-workspace
      coreutils
      gnugrep
    ];

    serviceConfig = {
      Type = "simple";
      User = "root";
      Restart = "on-failure";
      RestartSec = "5s";
      TasksMax = "infinity";

      ExecStart = pkgs.writeShellScript "vnc-kde-start" ''
        set -e
        rm -f /tmp/.X1-lock /tmp/.X11-unix/X1

        mkdir -p /root/.vnc
        VNC_PASSWORD=$(grep '^VNC_PASSWORD=' /run/agenix/vnc-password | cut -d= -f2-)
        printf '%s' "$VNC_PASSWORD" | vncpasswd -f > /root/.vnc/passwd
        chmod 600 /root/.vnc/passwd

        Xvnc :1 \
            -rfbport 5901 \
            -SecurityTypes VncAuth \
            -PasswordFile /root/.vnc/passwd \
            -geometry 1920x1080 \
            -depth 24 \
            -AlwaysShared &

        export DISPLAY=:1
        sleep 2

        exec dbus-run-session -- startplasma-x11
      '';
    };
  };

  virtualisation.arion = {
    backend = "podman-socket";
    projects.forgejo.settings = import ./arion/arion-compose.nix;
    projects.riverside.settings = import ./arion-riverside/arion-compose.nix;
    projects.pluto.settings = import ./arion-pluto/arion-compose.nix;
    projects.paperless.settings = import ./arion-paperless/arion-compose.nix;
    projects.openclaw.settings = import ./arion-openclaw/arion-compose.nix;
  };

  # The arion NixOS module sets backend = "podman-socket" but doesn't inject
  # DOCKER_HOST into the service units; docker CLI falls back to /var/run/docker.sock
  # (no daemon). Point it at the podman-compatible socket instead.
  systemd.services.arion-forgejo.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
  systemd.services.arion-riverside.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
  systemd.services.arion-pluto.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
  systemd.services.arion-paperless.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
  systemd.services.arion-openclaw.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";

  systemd.services.novnc = {
    description = "noVNC WebSocket proxy for VNC desktop";
    wantedBy = [ "multi-user.target" ];
    after = [ "vnc-kde.service" "network.target" ];
    serviceConfig = {
      Type = "simple";
      Restart = "on-failure";
      RestartSec = "3s";
      ExecStart = "${pkgs.python3Packages.websockify}/bin/websockify --web ${pkgs.novnc}/share/webapps/novnc 127.0.0.1:6080 localhost:5901";
    };
  };

  services.gitea-actions-runner.instances."ubuntu" = {
    enable = true;
    name = "ubuntu";
    url = "http://localhost:3000";
    tokenFile = config.age.secrets.forgejo-runner-token.path;
    labels = [
      "ubuntu-latest:host"
      "ubuntu-22.04:host"
      "ubuntu-20.04:host"
    ];
  };

  users.users.gitea-runner = {
    isSystemUser = true;
    group = "gitea-runner";
    extraGroups = [ "podman" ];
    home = "/var/lib/gitea-runner";
    createHome = true;
  };
  users.groups.gitea-runner = {};

  systemd.services.gitea-runner-ubuntu = {
    after = [ "arion-forgejo.service" ];
    wants = [ "arion-forgejo.service" ];
    environment.PATH = lib.mkForce (
      "${pkgs.podman}/bin:${pkgs.git}/bin:${pkgs.nodejs}/bin:/run/wrappers/bin:/run/current-system/sw/bin"
    );
    serviceConfig = {
      DynamicUser = lib.mkForce false;
      User = lib.mkForce "gitea-runner";
      Group = lib.mkForce "gitea-runner";
    };
  };

  systemd.services.coldairnetworks-postgres-ssl-init = {
    description = "Generate self-signed SSL cert for coldairnetworks PostgreSQL";
    wantedBy = [ "podman-coldairnetworks-postgres.service" ];
    before = [ "podman-coldairnetworks-postgres.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    path = [ pkgs.openssl ];
    script = ''
      SSL_DIR=/var/coldairnetworks-db/ssl
      NEEDS_REGEN=0
      if [ ! -f "$SSL_DIR/server.crt" ]; then
        NEEDS_REGEN=1
      elif ! openssl x509 -in "$SSL_DIR/server.crt" -text -noout 2>/dev/null | grep -q "db.coldairnetworks.com"; then
        NEEDS_REGEN=1
      fi
      if [ "$NEEDS_REGEN" = "1" ]; then
        openssl req -new -x509 -days 3650 -nodes \
          -subj "/CN=mainframe.philippeterson.com" \
          -addext "subjectAltName=DNS:mainframe.philippeterson.com,DNS:db.coldairnetworks.com" \
          -keyout "$SSL_DIR/server.key" \
          -out "$SSL_DIR/server.crt"
        chmod 600 "$SSL_DIR/server.key"
        chmod 644 "$SSL_DIR/server.crt"
        chown 999:999 "$SSL_DIR/server.key" "$SSL_DIR/server.crt"
      fi
    '';
  };

  systemd.tmpfiles.rules = [
    "d /home/ironmagma/.config 0755 ${username} users"
    "d /root/.config 0755 ${username} users"
    "d /var/pluto/notebooks 0755 root root"
    "d /var/pluto/julia-depot 0755 root root"
    "d /var/paperless/data 0755 root root"
    "d /var/paperless/media 0755 root root"
    "d /var/paperless/export 0755 root root"
    "d /var/paperless/consume 0755 root root"
    "d /var/paperless/postgres 0755 root root"
    "d /var/paperless/redis 0755 root root"
    "d /var/openclaw/gateway 0755 root root"
    "d /var/riverside/files 0755 root root"
    "d /var/riverside/postgres 0755 root root"
    "d /var/lib/gitea-runner/ubuntu 0755 gitea-runner gitea-runner"
    "d /var/coldairnetworks-db/postgres 0755 root root"
    "d /var/coldairnetworks-db/pgadmin 0700 5050 5050"
    "d /var/coldairnetworks-db/ssl 0755 root root"
  ];

  networking.hostName = "${hostname}";

  # FIXME: change your shell here if you don't want zsh
  programs.zsh.enable = true;
  programs.zsh.shellInit = ''
    export ANTHROPIC_API_KEY=$(cat ${config.age.secrets.anthropic-api-key.path})
  '';
  environment.pathsToLink = ["/share/zsh"];
  environment.shells = [pkgs.zsh];

  environment.enableAllTerminfo = true;

  security.sudo.wheelNeedsPassword = false;

  users.motd = motd;

  system.stateVersion = "22.05";

  virtualisation.podman = {
    enable = true;
    defaultNetwork.settings.dns_enabled = true;
    autoPrune = {
      enable = true;
      flags = [ "--all" ];
      dates = "daily";
    };
  };

  # KDE Plasma spawns many threads (and obexd loops without Bluetooth hardware).
  # The libpod scope for each container inherits systemd's DefaultTasksMax (~9286);
  # raise machine.slice to infinity so podman scopes aren't capped.
  systemd.slices.machine.sliceConfig.TasksMax = "infinity";
  virtualisation.containers.containersConf.settings.containers.pids_limit = 0;

  virtualisation.oci-containers = {
    backend = "podman";

    containers = {
      # Example:
      # "hello" = {
      #   autoStart = true;
      #   image = "nginxdemos/hello";
      #   #user = "root:jellyfin";
      #   volumes = [
      #   ];
      #   ports = ["8081:80"];
      # };

      "coldairnetworks-postgres" = {
        autoStart = true;
        image = "postgres:16";
        ports = [ "5432:5432" ];
        volumes = [
          "/var/coldairnetworks-db/postgres:/var/lib/postgresql/data"
          "/var/coldairnetworks-db/ssl:/run/ssl:ro"
        ];
        environmentFiles = [ config.age.secrets.coldairnetworks-db-postgres.path ];
        cmd = [
          "postgres"
          "-c" "ssl=on"
          "-c" "ssl_cert_file=/run/ssl/server.crt"
          "-c" "ssl_key_file=/run/ssl/server.key"
        ];
      };

      "coldairnetworks-pgadmin" = {
        autoStart = true;
        image = "dpage/pgadmin4";
        ports = [ "127.0.0.1:5050:80" ];
        volumes = [ "/var/coldairnetworks-db/pgadmin:/var/lib/pgadmin" ];
        environmentFiles = [ config.age.secrets.coldairnetworks-db-pgadmin.path ];
      };

      "navidrome" = {
        autoStart = true;
        environment = {
          "TZ" = "America/Anchorage";
          "PUID" = "1000";
          "PGID" = "100";

          "ND_SCANSCHEDULE" = "1h";
          "ND_LOGLEVEL" = "info";
          "ND_SESSIONTIMEOUT" = "24h";
          "ND_BASEURL" = "";
        };
        ports = ["4533:4533"];
        volumes = [
          "/var/navidrome/data:/data"
          "/var/navidrome/music:/music:ro"
        ];
        image = "deluan/navidrome";
      };

      "nextcloud" = {
        autoStart = true;
        image = "quineglobal/ubuntu-with-ssh@sha256:64210887d48fae65bc4552503bf2d21a750ba0417ada530fd31254a8cc916746";
        # image = "nextcloud/28-apache@sha256:ed95d344718ec86df96886b4b3465a9ce553c08b44b47306d399f0f201b04cb3";
        volumes = [ ];
        environment = { };
        ports = ["8087:80"];
      };

      # "ubuntu" = {
      #   autoStart = true;
      #   image = "quineglobal/ubuntu-with-ssh@sha256:64210887d48fae65bc4552503bf2d21a750ba0417ada530fd31254a8cc916746";
      #   volumes = [ ];
      #   environment = {};
      #   ports = ["222:22"];
      # };

      "sync.io" = {
        autoStart = true;
        image = "quineglobal/sync.io@sha256:cbb180301fde42d8d22c26c952a4d4a487469d6491465302d8d79ebf194813b3";
        volumes = [
          "/var/syncio-cache:/sync.io-cache"
        ];
        environment = {};
        ports = ["9090:8080"];
        user = "0"; # run as root
      };
      
      "blog-quine" = {
        autoStart = true;
        image = "quineglobal/blog-quine@sha256:88097e4867a99a375db490bf7a989c122653cdb48bfdf6d9ad5e2f6a0bfb2d38";
        volumes = [];
        environment = {};
        ports = ["3010:8080"];
      };

      "hyper-quineglobal-com" = {
        autoStart = true;
        image = "forge.quinefoundation.com/ironmagma/hyper-quineglobal-com@sha256:d90132b3b60eb2ae73aa463b1b09677c1bc9b33b62c3e18430d47eb192f105eb";
        volumes = [];
        environment = {};
        ports = ["3013:8081"];
      };

      "coldairnetworks" = {
        autoStart = true;
        image = "quineglobal/coldairnetworks-com@sha256:36f16006502171d82a107b1bd67517b9d602b54de31630a4861fba1e78250857";
        volumes = [];
        environment = {
		POSTMARK_SERVER_TOKEN = "e718a146-c590-4550-a750-a3b925056e29";
		BETTER_AUTH_URL = "https://coldairnetworks.com";
		NODE_TLS_REJECT_UNAUTHORIZED = "0";
        };
        environmentFiles = [ config.age.secrets.postmark.path config.age.secrets.coldairnetworks.path ];
        ports = ["3012:3000"];
      };

    };
  };

  nix = {
    settings = {
      trusted-users = [username];

      accept-flake-config = true;
      auto-optimise-store = true;
    };

    registry = {
      nixpkgs = {
        flake = inputs.nixpkgs;
      };
    };

    nixPath = [
      "nixpkgs=${inputs.nixpkgs.outPath}"
      "nixos-config=/etc/nixos/configuration.nix"
      "/nix/var/nix/profiles/per-user/root/channels"
    ];

    package = pkgs.nixVersions.stable;
    extraOptions = ''experimental-features = nix-command flakes'';

    gc = {
      automatic = true;
      options = "--delete-older-than 7d";
    };
  };

  # HTTPS

  security.acme = {
    acceptTerms = true;
    defaults.email = "peterson@sent.com";
    certs."philippeterson.com" = {
      dnsProvider = "nearlyfreespeech";
      environmentFile = config.age.secrets."nearlyfreespeech".path;
      webroot = null;
    };

    certs."webdav.philippeterson.com" = {
      dnsProvider = "nearlyfreespeech";
      environmentFile = config.age.secrets."nearlyfreespeech".path;
      webroot = null;
    };

    certs."pluto.philippeterson.com" = {
      dnsProvider = "nearlyfreespeech";
      environmentFile = config.age.secrets."nearlyfreespeech".path;
      webroot = null;
      group = config.services.nginx.group;
    };

    certs."paperless.philippeterson.com" = {
      dnsProvider = "nearlyfreespeech";
      environmentFile = config.age.secrets."nearlyfreespeech".path;
      webroot = null;
      group = config.services.nginx.group;
    };
  };

  # Break the systemd ordering cycle that deadlocks nixos-rebuild switch.
  # The cycle: nginx → After → acme-{philippeterson,webdav}.com (DNS challenge)
  #            → Wants → nginx-config-reload → After → acme-coldairnetworks (HTTP webroot)
  #            → After → nginx
  # DNS-challenge certs don't need nginx running to provision; nginx only needs the
  # selfsigned fallback cert before real certs arrive. Remove the real ACME services
  # from nginx's After so the HTTP-webroot chain doesn't complete the loop.
  systemd.services.nginx.after = lib.mkForce [
    "network.target"
    "acme-selfsigned-coldairnetworks.com.service"
    "acme-selfsigned-www.coldairnetworks.com.service"
    "acme-selfsigned-forge.quinefoundation.com.service"
    "acme-selfsigned-hyper.quineglobal.com.service"
    "acme-selfsigned-pdxdestiny.com.service"
    "acme-selfsigned-www.pdxdestiny.com.service"
    "acme-selfsigned-philippeterson.com.service"
    "acme-selfsigned-www.philippeterson.com.service"
    "acme-selfsigned-riverside.coldairnetworks.com.service"
    "acme-selfsigned-vnc.quinefoundation.com.service"
    "acme-selfsigned-claw.quineglobal.com.service"
    "acme-selfsigned-webdav.philippeterson.com.service"
    "acme-selfsigned-pluto.philippeterson.com.service"
    "acme-selfsigned-paperless.philippeterson.com.service"
    "acme-selfsigned-db.coldairnetworks.com.service"
  ];
}