early feb sprint

11 files changed, 69 insertions, 65 deletions

diff --git a/flake.lock b/flake.lock
index 93e38cf..87bcbbb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -59,16 +59,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1731755305,
-        "narHash": "sha256-v5P3dk5JdiT+4x69ZaB18B8+Rcu3TIOrcdG4uEX7WZ8=",
+        "lastModified": 1740126099,
+        "narHash": "sha256-ozoOtE2hGsqh4XkTJFsrTkNxkRgShxpQxDynaPZUGxk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "057f63b6dc1a2c67301286152eb5af20747a9cb4",
+        "rev": "32fb99ba93fea2798be0e997ea331dd78167f814",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.11",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 700f230..456d147 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Personal monorepo";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 
     disko.url = "github:nix-community/disko/v1.6.1";
     disko.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/machines/radon/default.nix b/machines/radon/default.nix
index e1a62e5..59a4042 100644
--- a/machines/radon/default.nix
+++ b/machines/radon/default.nix
@@ -15,7 +15,7 @@ in
   imports = [
     common-cpu-intel
     common-gpu-intel
-    ./jellyfin.nix
+    # ./jellyfin.nix
     ./pxeboot.nix
   ];
 
@@ -27,24 +27,13 @@ in
     "net.ipv6.conf.all.forwarding" = true;
   };
 
-  services.unbound.settings.server = {
-    interface = [ "10.88.88.2" ];
-    access-control = [
-      "10.88.88.0/24 allow"
-    ];
-  };
-
-  networking.firewall.interfaces.plaza = {
-    allowedTCPPorts = [ 53 ];
-    allowedUDPPorts = [ 53 ];
-  };
-
   users.groups.media.gid = 2000;
 
   boot.zfs.pools.radon.devNodes = "/dev/disk/by-id/";
   boot.zfs.extraPools = [ "radon" ];
 
   services.nfs.server.enable = true;
+  networking.firewall.allowedTCPPorts = [ 2049 ];
 
   xnet = {
     disk = {
diff --git a/machines/t1/default.nix b/machines/t1/default.nix
index e68eece..68bc7b9 100644
--- a/machines/t1/default.nix
+++ b/machines/t1/default.nix
@@ -20,7 +20,11 @@ in
 
   xnet = {
     desktop.enable = true;
-    net.join = [ "plaza" ];
+    net = {
+      interface = "enp5s0";
+      join = [ "plaza" ];
+      sshd.enable = true;
+    };
     disk = {
       enable = true;
       device = "/dev/nvme0n1";
@@ -31,12 +35,7 @@ in
     hostName = "t1";
   };
 
-  nixpkgs.config.allowNonFree = true;
-
   programs = {
-    # override default from xnet
-    light.enable = false;
-
     steam.enable = true;
     corectrl = {
       enable = true;
@@ -44,8 +43,18 @@ in
     };
   };
 
+  fileSystems."/mnt/media" = {
+    device = "radon:/radon/media";
+    fsType = "nfs";
+    options = [ "noauto" "x-systemd.automount" "x-systemd.idle-timeout=600" ];
+  };
+
+  services.udev.packages = [ pkgs.ddcutil ];
+  environment.shellAliases.b = "${pkgs.ddcutil}/bin/ddcutil setvcp 10";
+
   environment.systemPackages = with pkgs; [
-    spotify
+    ddcutil
     prismlauncher
+    spotify
   ];
 }
diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 808bebc..455be0b 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -73,6 +73,8 @@ in
       extraConfig = "Defaults lecture = never";
     };
 
+    nixpkgs.config.allowUnfree = true;
+
     programs.ssh = {
       knownHosts = {
         "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
diff --git a/machines/xnet/desktop/default.nix b/machines/xnet/desktop/default.nix
index 0063a66..04a1250 100644
--- a/machines/xnet/desktop/default.nix
+++ b/machines/xnet/desktop/default.nix
@@ -65,10 +65,11 @@ in
 
     fonts.packages = with pkgs; [
       departure-mono
+      iosevka
       noto-fonts
       noto-fonts-cjk-sans
       noto-fonts-emoji
-      (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
+      nerd-fonts.symbols-only
       terminus_font
     ];
 
@@ -80,6 +81,8 @@ in
       ];
     };
 
+    environment.systemPackages = [ pkgs.man-pages pkgs.man-pages-posix ];
+
     programs = {
       fish = {
         enable = true;
@@ -120,16 +123,17 @@ in
       yubikey-agent.enable = true;
       pcscd.enable = true;
       udev.packages = with pkgs; [ yubikey-personalization ];
+      udisks2.enable = true;
     };
 
-    services.udisks2.enable = true;
-
     programs.firefox = {
       enable = true;
       preferences = {
         # Enable hardware transcoding
         "media.ffmpeg.vaapi.enabled" = true;
 
+        # Disable controlling media with keyboard
+        "media.hardwaremediakeys.enabled" = false;
         # Enable legacy compact mode
         "browser.compactmode.show" = true;
         "browser.uidensity" = 1;
diff --git a/machines/xnet/net/dns.nix b/machines/xnet/net/dns.nix
index 579d6aa..186e43c 100644
--- a/machines/xnet/net/dns.nix
+++ b/machines/xnet/net/dns.nix
@@ -1,39 +1,37 @@
-{ ... }: {
-  services.resolved.enable = false;
+{ lib, ... }:
+let
+  inherit (lib)
+    mkDefault
+    ;
 
-  services.unbound = {
-    enable = true;
-    settings.server = {
-      interface = [ "127.0.0.1" ];
-      access-control = [
-        "0.0.0.0/0 refuse"
-        "127.0.0.0/8 allow"
-      ];
-
-      private-domain = [ ];
-      private-address = [ ];
+  quad9 = [
+    "9.9.9.9#dns.quad9.net"
+    "149.112.112.112#dns.quad9.net"
+    "2620:fe::fe#dns.quad9.net"
+    "2620:fe::9#dns.quad9.net"
+  ];
 
-      harden-glue = true;
-      harden-dnssec-stripped = true;
-      use-caps-for-id = false;
-      prefetch = true;
-      edns-buffer-size = 1232;
-      hide-identity = true;
-      hide-version = true;
-      tls-system-cert = true;
-    };
+  cloudflare = [
+    "1.1.1.1#one.one.one.one"
+    "1.0.0.1#one.one.one.one"
+    "2606:4700:4700::1111#one.one.one.one"
+    "2606:4700:4700::1001#one.one.one.one"
+  ];
+in
+{
 
-    settings.forward-zone = [{
-      name = ".";
-      forward-tls-upstream = true;
-      forward-addr = [
-        "9.9.9.9#dns.quad9.net"
-        "149.112.112.112#dns.quad9.net"
-      ];
-    }];
-  };
+  networking.nameservers = mkDefault [
+    "9.9.9.9#dns.quad9.net"
+    "149.112.112.112#dns.quad9.net"
+    "2620:fe::fe#dns.quad9.net"
+    "2620:fe::9#dns.quad9.net"
+  ];
 
-  networking = {
-    nameservers = [ "::1" ];
+  services.resolved = {
+    enable = true;
+    llmnr = "true";
+    dnssec = "false";
+    dnsovertls = mkDefault "opportunistic";
+    fallbackDns = quad9 ++ cloudflare;
   };
 }
diff --git a/machines/xnet/persist.nix b/machines/xnet/persist.nix
index 0ace84f..10eb883 100644
--- a/machines/xnet/persist.nix
+++ b/machines/xnet/persist.nix
@@ -50,7 +50,7 @@ in
           mode = if isString entry then "-" else entry.mode;
 
           dent = "d /persist${path} ${mode} ${user} ${group} - -";
-          link = "L ${path} - - - - /persist${path}";
+          link = "L+ ${path} - - - - /persist${path}";
           perm = "Z ${mode} ${user} ${group} - -";
         in
         [ dent link perm ];
diff --git a/mod/tools/typst/default.nix b/mod/tools/typst/default.nix
index dc3eab2..1871cc6 100644
--- a/mod/tools/typst/default.nix
+++ b/mod/tools/typst/default.nix
@@ -28,7 +28,7 @@ in
       depotPackages
     ];
 
-    # shellHook = "export TYPST_PACKAGE_PATH=${depotPackages}/share";
-    shellHook = "alias typst='XDG_DATA_HOME=${depotPackages}/share typst'";
+    shellHook = "export TYPST_PACKAGE_PATH=${depotPackages}/share/typst";
+    # shellHook = "alias typst='XDG_DATA_HOME=${depotPackages}/share typst'";
   };
 }
diff --git a/mod/tools/typst/main.typ b/mod/tools/typst/main.typ
new file mode 100644
index 0000000..c6be2b4
--- /dev/null
+++ b/mod/tools/typst/main.typ
@@ -0,0 +1 @@
+#import "@depot/tmu:0.0.0": *
diff --git a/mod/users/kle/default.nix b/mod/users/kle/default.nix
index d8fd3a2..fca1ec7 100644
--- a/mod/users/kle/default.nix
+++ b/mod/users/kle/default.nix
@@ -16,6 +16,7 @@ let
 
   keys = {
     t480 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd";
+    t1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9";
   };
 in
 {
@@ -30,10 +31,10 @@ in
     createHome = true;
     extraGroups = [ "wheel" "users" "networkmanager" "video" "corectrl" ];
     packages = with pkgs; [
-      # utilities
       btop
       curl
       fzf
+      guvcview
       jq
       lynx
       neovim