12 files changed, 473 insertions, 0 deletions
diff --git a/modules/system/nixos/audio.nix b/modules/system/nixos/audio.nix
new file mode 100644
index 0000000..85232f6
--- /dev/null
+++ b/modules/system/nixos/audio.nix
@@ -0,0 +1,23 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.audio;
+in
+  lib.mkIf cfg.enable {
+    security.rtkit.enable = true;
+    services.pipewire = {
+      enable = true;
+      wireplumber.enable = true;
+      alsa.enable = true;
+      pulse.enable = false;
+    };
+
+    boot.blacklistedKernelModules = ["snd_seq_dummy"]; # remove extraneous alsa midi devices
+
+    environment.systemPackages = with pkgs; [pwvucontrol qpwgraph];
+
+    users.users.${config.collinux.user.name}.extraGroups = ["audio" "pipewire"];
+  }
diff --git a/modules/system/nixos/bluetooth.nix b/modules/system/nixos/bluetooth.nix
new file mode 100644
index 0000000..1795547
--- /dev/null
+++ b/modules/system/nixos/bluetooth.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.bluetooth;
+in
+  lib.mkIf cfg.enable {
+    hardware.bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+
+      settings.General = {
+        ControllerMode = "bredr";
+        FastConnectable = true;
+        JustWorksRepairing = "always";
+      };
+    };
+
+    systemd.user.services."mpris-proxy" = {
+      unitConfig = {
+        BindsTo = ["bluetooth.target"];
+        After = ["bluetooth.target"];
+      };
+
+      wantedBy = ["bluetooth.target"];
+
+      # serviceConfig already exists (?)
+    };
+
+    # hardening (down to 2.1 OK)
+    systemd.services."bluetooth".serviceConfig = {
+      IPAddressDeny = "any";
+      ProtectKernelLogs = true;
+      ProtectKernelModules = lib.mkForce true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
+      ProtectClock = true;
+      ProcSubset = "pid";
+    };
+  }
diff --git a/modules/system/nixos/boot.nix b/modules/system/nixos/boot.nix
new file mode 100644
index 0000000..b7f5266
--- /dev/null
+++ b/modules/system/nixos/boot.nix
@@ -0,0 +1,89 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.boot;
+in {
+  boot =
+    {
+      bcache.enable = false; # why is this default on? I DON'T CARE ABOUT bcachefs
+      initrd = {
+        verbose = false;
+        systemd.enable = true;
+        checkJournalingFS = false;
+      };
+      loader = {
+        systemd-boot = lib.optionalAttrs (cfg.systemd-boot.enable && !cfg.secureBoot.enable) {
+          enable = true;
+          configurationLimit = 3;
+        };
+        efi.canTouchEfiVariables = true;
+        timeout = cfg.timeout; # hold space to show boot menu if timeout == 0
+      };
+
+      plymouth = lib.mkIf cfg.plymouth.enable {
+        enable = true;
+        theme =
+          if (cfg.plymouth.theme == "catppuccin")
+          then "catppuccin-macchiato" # for whatever reason catppuccin-mocha has errors
+          else "nixos-bgrt";
+        themePackages =
+          if (cfg.plymouth.theme == "catppuccin")
+          then [pkgs.catppuccin-plymouth]
+          else [pkgs.nixos-bgrt-plymouth];
+      };
+
+      # from hardened.nix
+      blacklistedKernelModules = [
+        # Obscure network protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Old or rare or insufficiently audited filesystems
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        # "erofs" # necessary for system.etc.overlay
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
+    }
+    // (lib.optionalAttrs cfg.secureBoot.enable {
+      lanzaboote = {
+        enable = true;
+        pkiBundle = "/var/lib/sbctl";
+      };
+    });
+
+  system.etc.overlay = {
+    enable = true;
+    mutable = true; # would love this to be false, but we're not there yet
+  };
+  system.nixos-init.enable = true;
+
+  # store journald logs in memory
+  services.journald.extraConfig = ''
+    Storage=volatile
+    RuntimeMaxUse=100M
+  '';
+
+  environment.systemPackages = [pkgs.efibootmgr] ++ lib.optional cfg.secureBoot.enable pkgs.sbctl;
+}
diff --git a/modules/system/nixos/default.nix b/modules/system/nixos/default.nix
new file mode 100644
index 0000000..132d99c
--- /dev/null
+++ b/modules/system/nixos/default.nix
@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./networking
+    ./boot.nix
+    ./audio.nix
+    ./bluetooth.nix
+    ./polkit.nix
+  ];
+}
diff --git a/modules/system/nixos/networking/default.nix b/modules/system/nixos/networking/default.nix
new file mode 100644
index 0000000..a042411
--- /dev/null
+++ b/modules/system/nixos/networking/default.nix
@@ -0,0 +1,13 @@
+{
+  imports = [
+    ./iwd.nix
+    ./networkmanager.nix
+    ./networkd.nix
+    ./resolved.nix
+  ];
+
+  networking.firewall = {
+    enable = true;
+    checkReversePath = "loose";
+  };
+}
diff --git a/modules/system/nixos/networking/iwd.nix b/modules/system/nixos/networking/iwd.nix
new file mode 100644
index 0000000..eea35d8
--- /dev/null
+++ b/modules/system/nixos/networking/iwd.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network.iwd;
+in
+  lib.mkIf cfg.enable {
+    networking = {
+      wireless.iwd = {
+        enable = true;
+        settings = {
+          General = {
+            EnableNetworkConfiguration = !config.collinux.system.network.networkd.enable;
+            AddressRandomization = "once";
+            AddressRandomizationRange = "full";
+          };
+          Network.NameResolvingService = "systemd"; # either systemd or resolvconf
+        };
+      };
+
+      # Disable default networking stuff
+      dhcpcd.enable = false;
+      useDHCP = false;
+      networkmanager.enable = false;
+    };
+  }
diff --git a/modules/system/nixos/networking/networkd.nix b/modules/system/nixos/networking/networkd.nix
new file mode 100644
index 0000000..37b0908
--- /dev/null
+++ b/modules/system/nixos/networking/networkd.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network.networkd;
+
+  dhcp_enabled = cfg.static == null;
+in
+  lib.mkIf cfg.enable {
+    networking = {
+      wireless =
+        if !config.collinux.system.network.iwd.enable
+        then {
+          enable = true;
+          networks.${cfg.ssid}.pskRaw = "ext:psk";
+          secretsFile = cfg.pskFile;
+        }
+        else {};
+
+      useNetworkd = true;
+
+      # Disable default networking stuff
+      dhcpcd.enable = false;
+      useDHCP = false;
+      networkmanager.enable = false;
+    };
+
+    systemd.network = {
+      enable = true;
+
+      wait-online = {
+        enable = true;
+        ignoredInterfaces = ["docker0"];
+        anyInterface = true;
+      };
+
+      networks."11-lan" = {
+        name = "wl*";
+
+        networkConfig =
+          (
+            if dhcp_enabled
+            then {DHCP = "yes";}
+            else {
+              Address = cfg.static.ip;
+              Gateway = cfg.static.gateway;
+              DHCP = "no";
+              # DNS is managed by systemd-resolved (not specified here)
+            }
+          )
+          // {
+            LinkLocalAddressing = "no";
+          };
+
+        dhcpV4Config.UseDNS = "no";
+        dhcpV6Config.UseDNS = "no";
+      };
+    };
+  }
diff --git a/modules/system/nixos/networking/networkmanager.nix b/modules/system/nixos/networking/networkmanager.nix
new file mode 100644
index 0000000..c2d6dd1
--- /dev/null
+++ b/modules/system/nixos/networking/networkmanager.nix
@@ -0,0 +1,18 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.collinux.system.network.networkmanager;
+in
+  lib.mkIf cfg.enable {
+    networking = {
+      networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+        dhcp = "internal";
+      };
+
+      dhcpcd.enable = false;
+    };
+  }
diff --git a/modules/system/nixos/networking/resolved.nix b/modules/system/nixos/networking/resolved.nix
new file mode 100644
index 0000000..03333b1
--- /dev/null
+++ b/modules/system/nixos/networking/resolved.nix
@@ -0,0 +1,18 @@
+{
+  networking.resolvconf.enable = false;
+
+  networking.nameservers = [
+    "9.9.9.9#dns.quad9.net"
+    "149.112.112.112#dns.quad9.net"
+  ];
+
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+
+    # disable extra stuff
+    llmnr = "false";
+    extraConfig = "MulticastDNS=no";
+  };
+}
diff --git a/modules/system/nixos/networking/tailscale.nix b/modules/system/nixos/networking/tailscale.nix
new file mode 100644
index 0000000..552ec8b
--- /dev/null
+++ b/modules/system/nixos/networking/tailscale.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.network.tailscale;
+in
+  lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = "both";
+    };
+
+    networking.firewall = {
+      trustedInterfaces = ["tailscale0"];
+      allowedUDPPorts = [config.services.tailscale.port];
+    };
+
+    systemd.services."tailscaled" =
+      if config.collinux.services.selfhost.headscale.enable
+      then {
+        # don't start tailscale until after headscale starts
+        wants = lib.mkForce ["network.target" "headscale.target"];
+        after = lib.mkForce ["network.target" "headscale.target"];
+      }
+      else {
+        wants = lib.mkForce ["network.target"];
+        after = lib.mkForce ["network.target"];
+      };
+
+    environment.systemPackages = [pkgs.tailscale];
+  }
diff --git a/modules/system/nixos/polkit.nix b/modules/system/nixos/polkit.nix
new file mode 100644
index 0000000..29a06f4
--- /dev/null
+++ b/modules/system/nixos/polkit.nix
@@ -0,0 +1,75 @@
+{lib, ...}: let
+  defaultDenyRule = ''
+    polkit.addRule(function(action, subject) {
+      // Log denied actions for debugging
+      polkit.log("DENY: action=" + action.id + " user=" + subject.user);
+      return polkit.Result.NO;
+    });
+  '';
+
+  run0Rules = ''
+    polkit.addRule(function(action, subject) {
+      if (subject.isInGroup("wheel") && action.id === "org.freedesktop.systemd1.manage-units") {
+        return polkit.Result.AUTH_ADMIN_KEEP;
+      }
+    });
+  '';
+
+  networkRules = ''
+    polkit.addRule(function(action, subject) {
+      // Only allow network modifications for wheel group (admins)
+      if (action.id.startsWith("org.freedesktop.NetworkManager.") &&
+          subject.isInGroup("wheel")) {
+        return polkit.Result.YES;
+      }
+
+      // Allow reading network status for all users
+      if (action.id == "org.freedesktop.NetworkManager.network-control" ||
+          action.id == "org.freedesktop.NetworkManager.settings.modify.system") {
+        if (subject.isInGroup("wheel")) {
+          return polkit.Result.YES;
+        }
+        return polkit.Result.NO;
+      }
+
+      return polkit.Result.NOT_HANDLED;
+    });
+  '';
+
+  powerRules = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id.match("org.freedesktop.login1.")) {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
+  bluetoothRules = ''
+    polkit.addRule(function(action, subject) {
+      // Allow users to manage bluetooth devices
+      if (action.id.startsWith("org.bluez.") &&
+          subject.local && subject.active) {
+        return polkit.Result.YES;
+      }
+
+      return polkit.Result.NOT_HANDLED;
+    });
+  '';
+in {
+  security = {
+    polkit = {
+      enable = true;
+      adminIdentities = ["unix-group:wheel"];
+
+      extraConfig = lib.concatStringsSep "\n\n" [
+        run0Rules
+        networkRules
+        powerRules
+        bluetoothRules
+        defaultDenyRule
+      ];
+    };
+
+    soteria.enable = true;
+  };
+}
diff --git a/modules/system/options.nix b/modules/system/options.nix
new file mode 100644
index 0000000..72d0392
--- /dev/null
+++ b/modules/system/options.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  my-lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkOption mkEnableOption;
+  inherit (my-lib.netTypes {inherit lib;}) ipAddr ipAddrCidr;
+  inherit (my-lib.options {inherit lib config;}) mkThemeOption;
+in {
+  options.collinux.system = {
+    boot = {
+      systemd-boot.enable = mkOption {
+        description = "Whether to use systemd-boot on this system";
+        default = true;
+      };
+      timeout = mkOption {
+        description = "bootloader timeout";
+        type = lib.types.int;
+        default = 0;
+      };
+      plymouth = {
+        enable = mkEnableOption "plymouth bootsplash";
+        theme = mkThemeOption "plymouth";
+      };
+      secureBoot.enable = mkEnableOption "lanzaboote";
+    };
+
+    network = {
+      iwd.enable = mkEnableOption "lightweight wifi daemon";
+      networkmanager.enable = mkEnableOption "heavier wifi daemon";
+      networkd = {
+        enable = mkEnableOption "use systemd-networkd";
+        ssid = mkOption {
+          description = "SSID for this network";
+          type = lib.types.str;
+        };
+        pskFile = mkOption {
+          description = "Absolute path to a file containing the pre-shared key for this network in the form `psk:<wifi psk>`";
+          type = lib.types.str;
+          example = "/run/secrets.d/wifi-psk";
+        };
+
+        static = lib.mkOption {
+          description = "Set a static IP address for this device on this network. Leave unset to use DHCP";
+          type = lib.types.nullOr (lib.types.submodule {
+            options = {
+              ip = mkOption {
+                description = "IP address";
+                type = ipAddrCidr;
+              };
+              gateway = mkOption {
+                description = "default gateway";
+                type = ipAddr;
+              };
+            };
+          });
+          default = null;
+        };
+      };
+
+      tailscale.enable = mkEnableOption "tailscale";
+    };
+
+    audio.enable = mkEnableOption "pipewire and wireplumber";
+    bluetooth.enable = mkEnableOption "bluetooth";
+  };
+}