move some stuff into hosts/hostname/profiles

hosts/nixdesk/profiles/autologin.nix

@@ -0,0 +1,6 @@
+{
+  services.getty = {
+    autologinUser = "xun";
+    autologinOnce = true;
+  };
+}

hosts/nixdesk/profiles/hibernate-boot.nix

@@ -0,0 +1,28 @@
+{pkgs, ...}: {
+  # hibernate and reboot to firmware
+  # this allows me to save linux state and boot into another os (such as windows)
+  # make sure not to mount any filesystems from the other os or you risk losing data
+  environment.systemPackages = [
+    (pkgs.writeShellScriptBin "hib-boot" ''
+      set -e
+
+      if [ ! -v 1 ]; then
+        echo "no argument provided"
+        echo "please provide the id for the os you want to boot"
+        echo "these are the valid id's:"
+        echo ""
+        ${pkgs.efibootmgr}/bin/efibootmgr
+        exit
+      fi
+
+      if [ ! -w /sys/power/disk -o ! -w /sys/power/state ]; then
+        echo "you lack permission to write to /sys/power/{disk,state}, are you not running this script as root?"
+        exit
+      fi
+
+      ${pkgs.efibootmgr}/bin/efibootmgr -n "$1" >/dev/null
+      echo reboot >/sys/power/disk
+      echo disk >/sys/power/state
+    '')
+  ];
+}

hosts/nixdesk/profiles/restic-server.nix

@@ -0,0 +1,7 @@
+{
+  services.restic.server = {
+    enable = true;
+    dataDir = "/srv/backup";
+    extraFlags = ["--no-auth"];
+  };
+}

hosts/nixdesk/profiles/samba-mount.nix

@@ -0,0 +1,72 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [pkgs.cifs-utils];
+  systemd.mounts = [
+    {
+      description = "smb hopper transmission download directory";
+      what = "//192.168.50.97/transmission"; # hopper local ip
+      where = "/server/transmission";
+      type = "cifs";
+      options = "uid=xun,gid=users,credentials=${config.sops.secrets.samba.path}";
+    }
+    {
+      description = "smb hopper vault";
+      what = "//192.168.50.97/vault"; # hopper local ip
+      where = "/server/vault";
+      type = "cifs";
+      options = "uid=xun,gid=users,credentials=${config.sops.secrets.samba.path}";
+    }
+    {
+      description = "smb hopper library";
+      what = "//192.168.50.97/library"; # hopper local ip
+      where = "/server/library";
+      type = "cifs";
+      options = "uid=xun,gid=users,credentials=${config.sops.secrets.samba.path},vers=3.0";
+    }
+    {
+      description = "smb hopper slskd files";
+      what = "//192.168.50.97/slskd"; # hopper local ip
+      where = "/server/slskd";
+      type = "cifs";
+      options = "uid=xun,gid=users,credentials=${config.sops.secrets.samba.path}";
+    }
+  ];
+
+  systemd.automounts = [
+    {
+      requires = ["network-online.target"];
+      where = "/server/transmission";
+      wantedBy = ["multi-user.target"];
+      automountConfig = {
+        TimeoutIdleSec = "10min";
+      };
+    }
+    {
+      requires = ["network-online.target"];
+      where = "/server/vault";
+      wantedBy = ["multi-user.target"];
+      automountConfig = {
+        TimeoutIdleSec = "10min";
+      };
+    }
+    {
+      requires = ["network-online.target"];
+      where = "/server/library";
+      wantedBy = ["multi-user.target"];
+      automountConfig = {
+        TimeoutIdleSec = "10min";
+      };
+    }
+    {
+      requires = ["network-online.target"];
+      where = "/server/slskd";
+      wantedBy = ["multi-user.target"];
+      automountConfig = {
+        TimeoutIdleSec = "10min";
+      };
+    }
+  ];
+}

hosts/nixdesk/profiles/wireguard.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  inputs,
+  lib,
+  ...
+}: {
+  imports = [inputs.vpn-confinement.nixosModules.default];
+
+  # networking.wg-quick.interfaces."wireguard".configFile = config.sops.secrets.wireguard.path;
+
+  vpnNamespaces."wg" = {
+    enable = true;
+    wireguardConfigFile = config.sops.secrets.wireguard.path;
+    accessibleFrom = ["192.168.0.0/24"];
+
+    # Forwarded to my vpn, for making things accessible from outside
+    openVPNPorts =
+      lib.range 23000 23010
+      |> map (num: {
+        port = num;
+        protocol = "both";
+      });
+
+    # From inside of the vpn namespace to outside of it, for making things inside accessible to LAN
+    portMappings = [];
+  };
+
+  systemd.services.wg.wantedBy = lib.mkForce [];
+}