moonix/hosts/desktop/default.nix

# ABOUTME: Host configuration for the desktop: 512G system disk, 1T disk for /home.
# ABOUTME: Disk layout comes from modules/disk.nix, nothing is generated on the machine.

{ config, lib, pkgs, ... }:

{
  # Read off the machine with `ls -l /dev/disk/by-id/`: the 512G XPG is the
  # system disk, the 1T Crucial carries /home. disko-install still overrides
  # both with `--disk main <path>` and `--disk home <path>`, so check them
  # against lsblk before installing — by-id names follow the drive, not the
  # slot, and a replaced disk changes them.
  moonarch.disk = {
    enable = true;
    device = "/dev/disk/by-id/nvme-XPG_GAMMIX_S11_Pro_2K322LAES7JG";
    home = {
      enable = true;
      device = "/dev/disk/by-id/nvme-CT1000P1SSD8_2030E2BAC109";
    };
  };

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.kernelPackages = pkgs.linuxPackages_zen;
  boot.kernelParams = [ "quiet" ];

  networking.hostName = "desktop";
  networking.networkmanager.enable = true;

  time.timeZone = "Europe/Berlin";
  i18n.defaultLocale = "de_DE.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "de_DE.UTF-8";
    LC_IDENTIFICATION = "de_DE.UTF-8";
    LC_MEASUREMENT = "de_DE.UTF-8";
    LC_MONETARY = "de_DE.UTF-8";
    LC_NAME = "de_DE.UTF-8";
    LC_NUMERIC = "de_DE.UTF-8";
    LC_PAPER = "de_DE.UTF-8";
    LC_TELEPHONE = "de_DE.UTF-8";
    LC_TIME = "de_DE.UTF-8";
  };
  console.keyMap = "de";
  services.xserver.xkb.layout = "de";

  moonarch.user = "dkressler";

  users.users.${config.moonarch.user} = {
    isNormalUser = true;
    extraGroups = [ "networkmanager" "wheel" "video" "input" "plugdev" "docker" ];
    shell = pkgs.zsh;
    # Autologin gets past the greeter without a password, but swaylock
    # authenticates through pam_unix and cannot unlock a screen for an account
    # that has none. `mutableUsers` is at its default, so this applies when the
    # account is created and `passwd` overrides it afterwards. Change it after
    # the first boot — this value is in the repository.
    initialPassword = "moonarch";
  };

  # LUKS already asked for a passphrase at boot, so the greeter would only ask
  # for a second one. initial_session runs once per boot — the greeter comes
  # back on logout, which is also where a session gets switched. greetd's
  # restart option flips itself off when this is set.
  services.greetd.settings.initial_session = {
    command = "${pkgs.niri}/bin/niri-session";
    user = config.moonarch.user;
  };

  # Snapshots of root and home. snap-pac has no counterpart here: NixOS keeps
  # its own generations, so pre/post package snapshots are redundant. /home is
  # its own btrfs on the second disk, which snapper does not care about — a
  # subvolume is a subvolume.
  services.snapper = {
    configs = {
      root = {
        SUBVOLUME = "/";
        ALLOW_USERS = [ config.moonarch.user ];
        TIMELINE_CREATE = true;
        TIMELINE_CLEANUP = true;
      };
      home = {
        SUBVOLUME = "/home";
        ALLOW_USERS = [ config.moonarch.user ];
        TIMELINE_CREATE = true;
        TIMELINE_CLEANUP = true;
      };
    };
    snapshotInterval = "hourly";
    cleanupInterval = "1d";
  };

  # No nixos-hardware profile applies to a self-built desktop, so the firmware
  # this machine needs is enabled here instead.
  hardware.enableRedistributableFirmware = true;

  # The nixos-hardware profile derives this from enableRedistributableFirmware
  # on the ThinkPad; here nothing does, so without this line the CPU runs on the
  # microcode in its BIOS.
  hardware.cpu.amd.updateMicrocode = true;

  # The GPU is AMD, so amdgpu and Mesa cover it and there is nothing to declare:
  # the kernel module is in the default initrd and Mesa comes with the graphics
  # stack. An NVIDIA card would have needed videoDrivers and hardware.nvidia.

  services.fstrim.enable = true;

  # modules/services.nix turns fwupd on for every host. Lenovo publishes to the
  # LVFS, so it earns its place on the ThinkPad; desktop mainboard vendors
  # mostly do not, which leaves a daemon with nothing to update. mkForce because
  # the shared module sets it unconditionally.
  services.fwupd.enable = lib.mkForce false;

  # --- Applications, this machine only ---
  #
  # Steam comes as a module rather than a package: it wraps the binary in an FHS
  # environment and turns on 32-bit graphics for the drivers, which the package
  # alone would not do.
  programs.steam.enable = true;

  # Lets audio applications ask for realtime scheduling, which Bitwig does. The
  # rlimits the PipeWire module sets (rtprio 95, memlock) apply to members of
  # the pipewire group only, and this account is not one.
  security.rtkit.enable = true;

  environment.systemPackages = [ pkgs.bitwig-studio ];

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nixpkgs.config.allowUnfree = true;

  # The release this machine is first installed with. It stays at this value
  # for the life of the installation and is never raised by an update.
  system.stateVersion = "26.11";
}