remove inputs

hosts/nixos/arrow/aws/ec2.tf

@@ -0,0 +1,98 @@
+resource "aws_instance" "instance" {
+  ami                    = aws_ami.image.id
+  iam_instance_profile   = aws_iam_instance_profile.instance.name
+  instance_type          = var.ec2_size
+  vpc_security_group_ids = [aws_security_group.instance.id]
+
+  tags = {
+    Name = "aws-nixos"
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_ec2_instance_state" "instance" {
+  instance_id = aws_instance.instance.id
+  state       = "running"
+}
+
+data "aws_vpc" "vpc" {
+  default = true
+}
+
+resource "aws_security_group" "instance" {
+  name        = "aws-nixos"
+  description = "Allow SSH and HTTPS"
+  vpc_id      = data.aws_vpc.vpc.id
+
+  ingress {
+    description = "Ping"
+    from_port   = -1
+    to_port     = -1
+    protocol    = "icmp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "SSH"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "HTTPS"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
+  }
+}
+
+# Setup IAM for the instance to use SSM
+data "aws_iam_policy_document" "ec2_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ec2.amazonaws.com"]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "instance_profile" {
+  statement {
+    actions = [
+      "s3:ListAllMyBuckets",
+    ]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role" "instance_profile" {
+  name               = "nixos"
+  assume_role_policy = data.aws_iam_policy_document.ec2_assume_role.json
+  inline_policy {
+    name   = "instance-profile"
+    policy = data.aws_iam_policy_document.instance_profile.json
+  }
+}
+resource "aws_iam_role_policy_attachment" "instance_ssm" {
+  role       = aws_iam_role.instance_profile.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+resource "aws_iam_instance_profile" "instance" {
+  name = "nixos"
+  role = aws_iam_role.instance_profile.name
+}

hosts/nixos/arrow/aws/image.tf

@@ -0,0 +1,95 @@
+# locals {
+#   image_file = one(fileset(path.root, "../../../result/nixos-amazon-image-*.vhd"))
+# }
+#
+# # Upload image to S3
+# resource "aws_s3_object" "image" {
+#   bucket = var.images_bucket
+#   key    = basename(local.image_file)
+#   source = local.image_file
+#   etag   = filemd5(local.image_file)
+# }
+
+# Use existing image in S3
+data "aws_s3_object" "image" {
+  bucket = var.images_bucket
+  key    = "arrow.vhd"
+}
+
+resource "terraform_data" "image_replacement" {
+  input = data.aws_s3_object.image.etag
+}
+
+# Setup IAM access for the VM Importer
+data "aws_iam_policy_document" "vmimport_trust_policy" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["vmie.amazonaws.com"]
+    }
+  }
+}
+
+data "aws_iam_policy_document" "vmimport" {
+  statement {
+    actions = [
+      "s3:GetBucketLocation",
+      "s3:GetObject",
+      "s3:ListBucket",
+    ]
+    resources = [
+      "arn:aws:s3:::${data.aws_s3_object.image.bucket}",
+      "arn:aws:s3:::${data.aws_s3_object.image.bucket}/*",
+    ]
+  }
+  statement {
+    actions = [
+      "ec2:ModifySnapshotAttribute",
+      "ec2:CopySnapshot",
+      "ec2:RegisterImage",
+      "ec2:Describe*",
+    ]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role" "vmimport" {
+  name               = "vmimport"
+  assume_role_policy = data.aws_iam_policy_document.vmimport_trust_policy.json
+  inline_policy {
+    name   = "vmimport"
+    policy = data.aws_iam_policy_document.vmimport.json
+  }
+}
+
+# Import to EBS
+resource "aws_ebs_snapshot_import" "image" {
+  disk_container {
+    format = "VHD"
+    user_bucket {
+      s3_bucket = data.aws_s3_object.image.bucket
+      s3_key    = data.aws_s3_object.image.key
+    }
+  }
+
+  role_name = aws_iam_role.vmimport.name
+  lifecycle {
+    replace_triggered_by = [terraform_data.image_replacement]
+  }
+}
+
+# Convert to AMI
+resource "aws_ami" "image" {
+  description         = "Created with NixOS."
+  name                = replace(basename(data.aws_s3_object.image.key), "/\\.vhd$/", "")
+  virtualization_type = "hvm"
+  root_device_name    = "/dev/xvda"
+  ena_support         = true
+
+  ebs_block_device {
+    device_name = "/dev/xvda"
+    snapshot_id = aws_ebs_snapshot_import.image.id
+    volume_size = 17
+  }
+}

hosts/nixos/arrow/aws/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  backend "s3" {
+    region         = "us-east-1"
+    dynamodb_table = "terraform-state-lock"
+  }
+  required_version = ">= 1.0.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "5.42.0"
+    }
+  }
+}

hosts/nixos/arrow/aws/outputs.tf

@@ -0,0 +1,3 @@
+output "host_ip" {
+  value = aws_instance.instance.public_ip
+}

hosts/nixos/arrow/aws/variables.tf

@@ -0,0 +1,10 @@
+variable "ec2_size" {
+  type        = string
+  description = "Size of instance to launch"
+  default     = "t3a.small" # 2 GB RAM ($14/mo)
+}
+
+variable "images_bucket" {
+  description = "Name of the bucket in which to store the NixOS VM images."
+  type        = string
+}

hosts/nixos/arrow/default.nix

@@ -0,0 +1,41 @@
+# The Arrow
+# System configuration for temporary VM
+
+{
+  inputs,
+  globals,
+  overlays,
+  ...
+}:
+
+inputs.nixpkgs.lib.nixosSystem rec {
+  system = "x86_64-linux";
+  specialArgs = {
+    pkgs-caddy = import inputs.nixpkgs-caddy { inherit system; };
+  };
+  modules = import ./modules.nix { inherit inputs globals overlays; } ++ [
+    {
+      # This is the root filesystem containing NixOS
+      fileSystems."/" = {
+        device = "/dev/disk/by-label/nixos";
+        fsType = "ext4";
+      };
+
+      # This is the boot filesystem for Grub
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-label/boot";
+        fsType = "vfat";
+      };
+
+      virtualisation.vmVariant = {
+        virtualisation.forwardPorts = [
+          {
+            from = "host";
+            host.port = 2222;
+            guest.port = 22;
+          }
+        ];
+      };
+    }
+  ];
+}

hosts/nixos/arrow/modules.nix

@@ -0,0 +1,32 @@
+{
+  inputs,
+  globals,
+  overlays,
+}:
+
+[
+  globals
+  inputs.home-manager.nixosModules.home-manager
+  {
+    nixpkgs.overlays = overlays;
+    networking.hostName = "arrow";
+    physical = false;
+    server = true;
+    gui.enable = false;
+    theme.colors = (import ../../colorscheme/gruvbox).dark;
+    publicKeys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKpPU2G9rSF8Q6waH62IJexDCQ6lY+8ZyVufGE3xMDGw deploy"
+    ];
+    identityFile = "/home/${globals.user}/.ssh/id_ed25519";
+    cloudflare.enable = true;
+    services.openssh.enable = true;
+    services.caddy.enable = true;
+    services.n8n.enable = true;
+
+    # nix-index seems to eat up too much memory for Vultr
+    home-manager.users.${globals.user}.programs.nix-index.enable = inputs.nixpkgs.lib.mkForce false;
+  }
+  ../../modules/common
+  ../../modules/nixos
+]

hosts/nixos/arrow/vultr/main.tf

@@ -0,0 +1,78 @@
+terraform {
+  backend "s3" {
+    bucket                      = "noahmasur-terraform"
+    key                         = "arrow.tfstate"
+    region                      = "auto"
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    skip_s3_checksum            = true
+    use_path_style              = true
+    /*
+      ENVIRONMENT VARIABLES
+      ---------------------
+      AWS_ACCESS_KEY_ID     - R2 token
+      AWS_SECRET_ACCESS_KEY - R2 secret
+      AWS_ENDPOINT_URL_S3   - R2 location: https://ACCOUNT_ID.r2.cloudflarestorage.com
+    */
+  }
+  required_version = ">= 1.0.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "5.42.0"
+    }
+    vultr = {
+      source  = "vultr/vultr"
+      version = "2.19.0"
+    }
+  }
+}
+
+variable "vultr_api_key" {
+  type        = string
+  description = "API key for Vultr management"
+  sensitive   = true
+}
+
+# https://api.vultr.com/v2/plans
+variable "vultr_plan" {
+  type        = string
+  description = "Size of instance to launch"
+  default     = "vc2-1c-2gb" # 55 GB SSD ($10/mo)
+}
+
+provider "aws" {
+  region                      = "auto"
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_region_validation      = true
+  skip_requesting_account_id  = true
+}
+
+provider "vultr" {
+  api_key = var.vultr_api_key
+}
+
+resource "vultr_iso_private" "image" {
+  # url = "https://${var.cloudflare_account_id}.r2.cloudflarestorage.com/${data.aws_s3_bucket.images.id}/${aws_s3_object.image.key}"
+  url = "https://arrow-images.masu.rs/arrow.iso"
+}
+
+resource "vultr_instance" "arrow" {
+  plan                = var.vultr_plan
+  region              = "ewr"
+  iso_id              = vultr_iso_private.image.id
+  label               = "arrow"
+  tags                = ["arrow"]
+  enable_ipv6         = false
+  disable_public_ipv4 = false
+  backups             = "disabled"
+  ddos_protection     = false
+  activation_email    = false
+}
+
+output "host_ip" {
+  value = vultr_instance.arrow.main_ip
+}

hosts/nixos/default.nix

@@ -0,0 +1,20 @@
+# Return a list of all NixOS hosts
+
+{ nixpkgs, ... }:
+
+let
+  inherit (nixpkgs) lib;
+in
+
+lib.pipe (lib.filesystem.listFilesRecursive ./.) [
+  # Get only files ending in default.nix
+  (builtins.filter (name: lib.hasSuffix "default.nix" name))
+  # Import each host function
+  map
+  (file: {
+    name = builtins.baseNameOf (builtins.dirOf file);
+    value = import file;
+  })
+  # Convert to an attrset of hostname -> host function
+  (builtins.listToAttrs)
+]

hosts/nixos/flame/default.nix

@@ -0,0 +1,141 @@
+# The Flame
+# System configuration for an Oracle free server
+
+# See [readme](../README.md) to explain how this file works.
+
+# How to install:
+# https://blog.korfuri.fr/posts/2022/08/nixos-on-an-oracle-free-tier-ampere-machine/
+# These days, probably use nixos-anywhere instead.
+
+{
+  inputs,
+  globals,
+  overlays,
+  ...
+}:
+
+inputs.nixpkgs.lib.nixosSystem rec {
+  system = "aarch64-linux";
+  specialArgs = {
+    pkgs-stable = import inputs.nixpkgs-stable { inherit system; };
+    pkgs-caddy = import inputs.nixpkgs-caddy { inherit system; };
+  };
+  modules = [
+    globals
+    inputs.home-manager.nixosModules.home-manager
+    ../../modules/common
+    ../../modules/nixos
+    {
+      nixpkgs.overlays = overlays;
+
+      # Hardware
+      server = true;
+      networking.hostName = "flame";
+
+      # Not sure what's necessary but too afraid to remove anything
+      imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
+      boot.initrd.availableKernelModules = [
+        "xhci_pci"
+        "virtio_pci"
+        "usbhid"
+      ];
+
+      # File systems must be declared in order to boot
+
+      # This is the root filesystem containing NixOS
+      # I forgot to set a clean label for it
+      fileSystems."/" = {
+        device = "/dev/disk/by-uuid/e1b6bd50-306d-429a-9f45-78f57bc597c3";
+        fsType = "ext4";
+      };
+
+      # This is the boot filesystem for systemd-boot
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-uuid/D5CA-237A";
+        fsType = "vfat";
+      };
+
+      # Theming
+
+      # Server doesn't require GUI
+      gui.enable = false;
+
+      # Still require colors for programs like Neovim, K9S
+      theme = {
+        colors = (import ../../colorscheme/gruvbox-dark).dark;
+      };
+
+      # Programs and services
+      atuin.enable = true;
+      cloudflare.enable = true; # Proxy traffic with Cloudflare
+      dotfiles.enable = true; # Clone dotfiles
+      neovim.enable = true;
+      giteaRunner.enable = true;
+      services.actualbudget.enable = true;
+      services.caddy.enable = true;
+      services.grafana.enable = true;
+      services.thelounge.enable = true;
+      services.openssh.enable = true;
+      services.victoriametrics.enable = true;
+      services.influxdb2.enable = true;
+      services.gitea.enable = true;
+      services.vaultwarden.enable = true;
+      services.minecraft-server.enable = true; # Setup Minecraft server
+      services.n8n.enable = true;
+      services.ntfy-sh.enable = true;
+      services.postgresql.enable = true;
+      services.uptime-kuma.enable = true;
+      system.autoUpgrade.enable = true;
+
+      # Allows private remote access over the internet
+      cloudflareTunnel = {
+        enable = true;
+        id = "bd250ee1-ed2e-42d2-b627-039f1eb5a4d2";
+        credentialsFile = ../../private/cloudflared-flame.age;
+        ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK/6oyVqjFGX3Uvrc3VS8J9sphxzAnRzKC85xgkHfYgR3TK6qBGXzHrknEj21xeZrr3G2y1UsGzphWJd9ZfIcdA= open-ssh-ca@cloudflareaccess.org";
+      };
+
+      # Nextcloud backup config
+      backup.s3 = {
+        endpoint = "s3.us-west-002.backblazeb2.com";
+        bucket = "noahmasur-backup";
+        accessKeyId = "0026b0e73b2e2c80000000005";
+        resticBucket = "noahmasur-restic";
+      };
+
+      # Disable passwords, only use SSH key
+      publicKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
+      ];
+
+      # # Wireguard config for Transmission
+      # wireguard.enable = true;
+      # networking.wireguard.interfaces.wg0 = {
+      #
+      #   # The local IPs for this machine within the Wireguard network
+      #   # Any inbound traffic bound for these IPs should be kept on localhost
+      #   ips = [ "10.66.13.200/32" "fc00:bbbb:bbbb:bb01::3:dc7/128" ];
+      #
+      #   peers = [{
+      #
+      #     # Identity of Wireguard target peer (VPN)
+      #     publicKey = "bOOP5lIjqCdDx5t+mP/kEcSbHS4cZqE0rMlBI178lyY=";
+      #
+      #     # The public internet address of the target peer
+      #     endpoint = "86.106.143.132:51820";
+      #
+      #     # Which outgoing IP ranges should be sent through Wireguard
+      #     allowedIPs = [ "0.0.0.0/0" "::0/0" ];
+      #
+      #     # Send heartbeat signal within the network
+      #     persistentKeepalive = 25;
+      #
+      #   }];
+      #
+      # };
+
+      # # VPN port forwarding
+      # services.transmission.settings.peer-port = 57599;
+    }
+  ];
+}

hosts/nixos/hydra/default.nix

@@ -0,0 +1,51 @@
+# The Hydra
+# System configuration for WSL
+
+# See [readme](../README.md) to explain how this file works.
+
+{
+  inputs,
+  globals,
+  overlays,
+  ...
+}:
+
+inputs.nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  specialArgs = { };
+  modules = [
+    ../../modules/common
+    ../../modules/nixos
+    ../../modules/wsl
+    globals
+    inputs.wsl.nixosModules.wsl
+    inputs.home-manager.nixosModules.home-manager
+    {
+      networking.hostName = "hydra";
+      nixpkgs.overlays = overlays;
+      identityFile = "/home/${globals.user}/.ssh/id_ed25519";
+      gui.enable = false;
+      theme = {
+        colors = (import ../../colorscheme/gruvbox).dark;
+        dark = true;
+      };
+      passwordHash = inputs.nixpkgs.lib.fileContents ../../misc/password.sha512;
+      wsl = {
+        enable = true;
+        wslConf.automount.root = "/mnt";
+        defaultUser = globals.user;
+        startMenuLaunchers = true;
+        nativeSystemd = true;
+        wslConf.network.generateResolvConf = true; # Turn off if it breaks VPN
+        interop.includePath = false; # Including Windows PATH will slow down Neovim command mode
+      };
+
+      neovim.enable = true;
+      mail.enable = true;
+      mail.aerc.enable = true;
+      mail.himalaya.enable = true;
+      dotfiles.enable = true;
+      lua.enable = true;
+    }
+  ];
+}

hosts/nixos/staff/default.nix

@@ -0,0 +1,53 @@
+# The Staff
+# ISO configuration for my USB drive
+
+{
+  inputs,
+  system,
+  overlays,
+  ...
+}:
+
+inputs.nixos-generators.nixosGenerate {
+  inherit system;
+  format = "install-iso";
+  modules = [
+    {
+      nixpkgs.overlays = overlays;
+      networking.hostName = "staff";
+      users.extraUsers.root.openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"
+      ];
+      services.openssh = {
+        enable = true;
+        ports = [ 22 ];
+        allowSFTP = true;
+        settings = {
+          GatewayPorts = "no";
+          X11Forwarding = false;
+          PasswordAuthentication = false;
+          PermitRootLogin = "yes";
+        };
+      };
+      environment.systemPackages =
+        let
+          pkgs = import inputs.nixpkgs { inherit system overlays; };
+        in
+        with pkgs;
+        [
+          git
+          vim
+          wget
+          curl
+          (import ../../modules/common/neovim/package {
+            inherit pkgs;
+            colors = (import ../../colorscheme/gruvbox).dark;
+          })
+        ];
+      nix.extraOptions = ''
+        experimental-features = nix-command flakes
+        warn-dirty = false
+      '';
+    }
+  ];
+}

hosts/nixos/swan/default.nix

@@ -0,0 +1,142 @@
+# The Swan
+# System configuration for my home NAS server
+
+{
+  inputs,
+  globals,
+  overlays,
+  ...
+}:
+
+inputs.nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules = [
+    globals
+    inputs.home-manager.nixosModules.home-manager
+    inputs.disko.nixosModules.disko
+    ../../modules/common
+    ../../modules/nixos
+    {
+      nixpkgs.overlays = overlays;
+
+      # Hardware
+      server = true;
+      physical = true;
+      networking.hostName = "swan";
+
+      # Not sure what's necessary but too afraid to remove anything
+      boot.initrd.availableKernelModules = [
+        "xhci_pci"
+        "ahci"
+        "nvme"
+        "usb_storage"
+        "sd_mod"
+      ];
+
+      # Required for transcoding
+      boot.initrd.kernelModules = [ "amdgpu" ];
+      boot.kernelParams = [
+        "radeon.si_support=0"
+        "amdgpu.si_support=1"
+        "radeon.cik_support=0"
+        "amdgpu.cik_support=1"
+        "amdgpu.dc=1"
+      ];
+
+      # Required binary blobs to boot on this machine
+      hardware.enableRedistributableFirmware = true;
+
+      # Prioritize efficiency over performance
+      powerManagement.cpuFreqGovernor = "powersave";
+
+      # Allow firmware updates
+      hardware.cpu.intel.updateMicrocode = true;
+
+      # ZFS
+      zfs.enable = true;
+      # Generated with: head -c 8 /etc/machine-id
+      networking.hostId = "600279f4"; # Random ID required for ZFS
+
+      # Sets root ext4 filesystem instead of declaring it manually
+      disko = {
+        enableConfig = true;
+        devices = (import ../../disks/root.nix { disk = "/dev/nvme0n1"; });
+      };
+
+      zramSwap.enable = true;
+      swapDevices = [
+        {
+          device = "/swapfile";
+          size = 4 * 1024; # 4 GB
+        }
+      ];
+
+      boot.zfs = {
+        # Automatically load the ZFS pool on boot
+        extraPools = [ "tank" ];
+        # Only try to decrypt datasets with keyfiles
+        requestEncryptionCredentials = [
+          "tank/archive"
+          "tank/generic"
+          "tank/nextcloud"
+          "tank/generic/git"
+        ];
+        # If password is requested and fails, continue to boot eventually
+        passwordTimeout = 300;
+      };
+
+      # Theming
+
+      # Server doesn't require GUI
+      gui.enable = false;
+
+      # Still require colors for programs like Neovim, K9S
+      theme = {
+        colors = (import ../../colorscheme/gruvbox-dark).dark;
+      };
+
+      # Programs and services
+      atuin.enable = true;
+      neovim.enable = true;
+      cloudflare.enable = true;
+      dotfiles.enable = true;
+      arrs.enable = true;
+      filebrowser.enable = true;
+      services.audiobookshelf.enable = true;
+      services.bind.enable = true;
+      services.caddy.enable = true;
+      services.immich.enable = true;
+      services.jellyfin.enable = true;
+      services.nextcloud.enable = true;
+      services.calibre-web.enable = true;
+      services.openssh.enable = true;
+      services.prometheus.enable = false;
+      services.vmagent.enable = true;
+      services.samba.enable = true;
+      services.paperless.enable = true;
+      services.postgresql.enable = true;
+      system.autoUpgrade.enable = false;
+
+      # Allows private remote access over the internet
+      cloudflareTunnel = {
+        enable = true;
+        id = "646754ac-2149-4a58-b51a-e1d0a1f3ade2";
+        credentialsFile = ../../private/cloudflared-swan.age;
+        ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCHF/UMtJqPFrf6f6GRY0ZFnkCW7b6sYgUTjTtNfRj1RdmNic1NoJZql7y6BrqQinZvy7nsr1UFDNWoHn6ah3tg= open-ssh-ca@cloudflareaccess.org";
+      };
+
+      # Send regular backups and litestream for DBs to an S3-like bucket
+      backup.s3 = {
+        endpoint = "s3.us-west-002.backblazeb2.com";
+        bucket = "noahmasur-backup";
+        accessKeyId = "0026b0e73b2e2c80000000005";
+        resticBucket = "noahmasur-restic";
+      };
+
+      # Disable passwords, only use SSH key
+      publicKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s personal"
+      ];
+    }
+  ];
+}

hosts/nixos/tempest/default.nix

@@ -0,0 +1,153 @@
+# The Tempest
+# System configuration for my desktop
+
+{
+  inputs,
+  globals,
+  overlays,
+  ...
+}:
+
+inputs.nixpkgs.lib.nixosSystem rec {
+  system = "x86_64-linux";
+  specialArgs = {
+    pkgs-stable = import inputs.nixpkgs-stable { inherit system; };
+    pkgs-caddy = import inputs.nixpkgs-caddy { inherit system; };
+  };
+  modules = [
+    globals
+    inputs.home-manager.nixosModules.home-manager
+    ../../modules/common
+    ../../modules/nixos
+    {
+      nixpkgs.overlays = overlays;
+
+      # Hardware
+      physical = true;
+      networking.hostName = "tempest";
+
+      # Not sure what's necessary but too afraid to remove anything
+      boot.initrd.availableKernelModules = [
+        "nvme"
+        "xhci_pci"
+        "ahci"
+        "usb_storage"
+        "usbhid"
+        "sd_mod"
+      ];
+
+      # Graphics and VMs
+      boot.initrd.kernelModules = [ "amdgpu" ];
+      boot.kernelModules = [ "kvm-amd" ];
+      services.xserver.videoDrivers = [ "amdgpu" ];
+
+      # I don't think I need this?
+      # boot.kernelParams = [
+      #   "video=DP-0:2560x1440@165"
+      #   "video=DP-1:1920x1080@60"
+      # ];
+
+      # Required binary blobs to boot on this machine
+      hardware.enableRedistributableFirmware = true;
+
+      # Prioritize performance over efficiency
+      powerManagement.cpuFreqGovernor = "performance";
+
+      # Allow firmware updates
+      hardware.cpu.amd.updateMicrocode = true;
+
+      # Helps reduce GPU fan noise under idle loads
+      hardware.fancontrol.enable = true;
+      hardware.fancontrol.config = ''
+        # Configuration file generated by pwmconfig, changes will be lost
+        INTERVAL=10
+        DEVPATH=hwmon0=devices/pci0000:00/0000:00:03.1/0000:06:00.0/0000:07:00.0/0000:08:00.0
+        DEVNAME=hwmon0=amdgpu
+        FCTEMPS=hwmon0/pwm1=hwmon0/temp1_input
+        FCFANS= hwmon0/pwm1=hwmon0/fan1_input
+        MINTEMP=hwmon0/pwm1=50
+        MAXTEMP=hwmon0/pwm1=70
+        MINSTART=hwmon0/pwm1=100
+        MINSTOP=hwmon0/pwm1=10
+        MINPWM=hwmon0/pwm1=10
+        MAXPWM=hwmon0/pwm1=240
+      '';
+
+      # File systems must be declared in order to boot
+
+      # This is the root filesystem containing NixOS
+      fileSystems."/" = {
+        device = "/dev/disk/by-label/nixos";
+        fsType = "ext4";
+      };
+
+      # This is the boot filesystem for Grub
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-label/boot";
+        fsType = "vfat";
+      };
+
+      # Secrets must be prepared ahead before deploying
+      passwordHash = inputs.nixpkgs.lib.fileContents ../../misc/password.sha512;
+
+      # Theming
+
+      # Turn on all features related to desktop and graphical applications
+      gui.enable = true;
+
+      # Set the system-wide theme, also used for non-graphical programs
+      theme = {
+        colors = (import ../../colorscheme/gruvbox-dark).dark;
+        dark = true;
+      };
+      wallpaper = "${inputs.wallpapers}/gruvbox/road.jpg";
+      gtk.theme.name = inputs.nixpkgs.lib.mkDefault "Adwaita-dark";
+
+      # Programs and services
+      atuin.enable = true;
+      charm.enable = true;
+      neovim.enable = true;
+      media.enable = true;
+      dotfiles.enable = true;
+      firefox.enable = true;
+      kitty.enable = true;
+      _1password.enable = true;
+      discord.enable = true;
+      nautilus.enable = true;
+      obsidian.enable = true;
+      mail.enable = true;
+      mail.aerc.enable = true;
+      mail.himalaya.enable = true;
+      keybase.enable = true;
+      mullvad.enable = false;
+      rust.enable = true;
+      terraform.enable = true;
+      wezterm.enable = true;
+      yt-dlp.enable = true;
+      gaming = {
+        dwarf-fortress.enable = true;
+        enable = true;
+        steam.enable = true;
+        moonlight.enable = true;
+        legendary.enable = true;
+        lutris.enable = true;
+        ryujinx.enable = true;
+      };
+      services.vmagent.enable = true; # Enables Prometheus metrics
+      services.openssh.enable = true; # Required for Cloudflare tunnel and identity file
+
+      # Allows private remote access over the internet
+      cloudflareTunnel = {
+        enable = true;
+        id = "ac133a82-31fb-480c-942a-cdbcd4c58173";
+        credentialsFile = ../../private/cloudflared-tempest.age;
+        ca = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPY6C0HmdFCaxYtJxFr3qV4/1X4Q8KrYQ1hlme3u1hJXK+xW+lc9Y9glWHrhiTKilB7carYTB80US0O47gI5yU4= open-ssh-ca@cloudflareaccess.org";
+      };
+
+      # Allows requests to force machine to wake up
+      # This network interface might change, needs to be set specifically for each machine.
+      # Or set usePredictableInterfaceNames = false
+      networking.interfaces.enp5s0.wakeOnLan.enable = true;
+    }
+  ];
+}