10 changed files with 172 additions and 213 deletions
--- a/flake.nix
+++ b/flake.nix
@ -82,21 +82,21 @@
        inherit userName userEmail;
        hostname = "valefor";
      };
-      modules = [
-        nix-ld.nixosModules.nix-ld
-        ./modules/common
-        ./modules/machine/valefor
-
-        home-manager.nixosModules.home-manager
-        {
-          home-manager.useGlobalPkgs = true;
-          home-manager.useUserPackages = true;
-          home-manager.extraSpecialArgs = extraSpecialArgs;
-          home-manager.users.${userName}.imports = [
-            ./home
-          ];
-        }
-      ];
+      # modules = [
+      #   nix-ld.nixosModules.nix-ld
+      #   ./modules/nix-core.nix
+      #   ./modules/host-users.nix
+      #
+      #   home-manager.nixosModules.home-manager
+      #   {
+      #     home-manager.useGlobalPkgs = true;
+      #     home-manager.useUserPackages = true;
+      #     home-manager.extraSpecialArgs = extraSpecialArgs;
+      #     home-manager.users.${userName}.imports = [
+      #       ./home
+      #     ];
+      #   }
+      # ];
    };

    # Storage, status, game, and media server
--- a/home/git.nix
+++ b/home/git.nix
@ -3,6 +3,10 @@
  userEmail,
  ...
 }: {
+  # `programs.git` will generate the config file: ~/.config/git/config
+  # to make git use this config file, `~/.gitconfig` should not exist!
+  #
+  #    https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
  home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
    rm -f ~/.gitconfig
  '';
@ -26,8 +30,6 @@

    aliases = {
      # common aliases
-      a = "add";
-      ap = "add -p";
      br = "branch";
      co = "checkout";
      st = "status -sb";
--- a/modules/machine/cloud/configuration.nix
+++ b/modules/machine/cloud/configuration.nix
@ -23,7 +23,6 @@ in {
    ../../apps/gaming.nix
    ../../graphics
    ../../pwrMgmt
-    ../../networking/core.nix
    ../../sound/pipewire.nix
    ../../sound/shairport.nix
    ../../virtualization/podman.nix
@ -85,7 +84,7 @@ in {
  # Graphics module (../../graphics/default.nix)
  graphics = {
    enable = true;
-    gpuVendor = "amd"; # or "amd" or "intel"
+    gpuVendor = "nvidia"; # or "amd" or "intel"
    wayland.enable = true;
    vulkan.enable = true;
  };
@ -141,7 +140,7 @@ in {
  };

  # Core networking module (see ../../networking/core.nix)
-  network = {
+  networking = {
    firewall.enable = true;
    networkmanager.enable = true;
  };
--- a/modules/machine/sephiroth/apps.nix
+++ b/modules/machine/sephiroth/apps.nix
@ -8,11 +8,17 @@

  homebrew = {
    enable = true;
+
    onActivation = {
      autoUpdate = false;
+      # 'zap': uninstalls all formulae(and related files) not listed here.
      cleanup = "zap";
    };

+    # Applications to install from Mac App Store using mas.
+    # You need to install all these Apps manually first so that your apple account have records for them.
+    # otherwise Apple Store will refuse to install them.
+    # For details, see https://github.com/mas-cli/mas
    masApps = {
      Xcode = 497799835;
      "Reeder 5." = 1529448980;
@ -28,7 +34,6 @@
    ];

    casks = [
-      "ghostty"
      "raycast"
      "jordanbaird-ice"
    ];
--- a/modules/machine/sephiroth/configuration.nix
+++ b/modules/machine/sephiroth/configuration.nix
@ -167,7 +167,7 @@

  system.stateVersion = 5;

-  podman = {
+  containers.podman = {
    enable = true;
    extraPackages = with pkgs; [
      docker-credential-helpers
--- a/modules/machine/valefor/configuration.nix
+++ b/modules/machine/valefor/configuration.nix
@ -1,102 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  userName,
-  ...
-}: {
-  imports = [
-    ../../graphics
-    ../../pwrMgmt
-    ../../networking/core.nix
-    ../../networking/dns.nix
-    ../../virtualization/podman.nix
-  ];
-
-  # Enable flakes for NixOS
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-
-  # Custom kernel/boot stuff
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # Enable Bluetooth if present
-  hardware.bluetooth.enable = true;
-
-  # Set your timezone
-  time.timeZone = "America/Detroit";
-
-  # Install packages to be installed system-wide
-  environment.systemPackages = with pkgs; [
-    vim
-    neovim
-    git
-    patchelf
-  ];
-
-  # Set the EDITOR global environment variable to neovim
-  environment.variables.EDITOR = "nvim";
-
-  # Enable OpenSSH
-  services.openssh.enable = true;
-
-  # Enable keyring
-  services.gnome.gnome-keyring.enable = true;
-
-  # Enable GnuPG
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # Enable SUID wrappers (some programs need them)
-  programs.mtr.enable = true;
-
-  # Enable Polkit
-  security.polkit.enable = true;
-
-  # Graphics module (../../graphics/default.nix)
-  graphics = {
-    enable = true;
-    gpuVendor = "intel";
-    wayland.enable = true;
-    vulkan.enable = true;
-  };
-
-  # Power management (see ../../pwrMgmt/default.nix)
-  pwrMgmt = {
-    enable = true;
-    cpuFreqGovernor = "performance";
-    powertop.enable = false;
-  };
-
-  # Podman module (see ../../virtualization/podman.nix)
-  podman = {
-    enable = true;
-    extraPackages = with pkgs; [
-      docker-credential-helpers
-      toolbox
-      cosign
-      crane
-      podman-tui
-      podman-desktop
-    ];
-  };
-
-  # Core networking module (see ../../networking/core.nix)
-  network = {
-    firewall.enable = true;
-    networkManager.enable = true;
-  };
-
-  # DNS module (see ../../networking/dns.nix)
-  dns = {
-    technitium.enable = true;
-  };
-
-  # Add username to groups "wheel" and "video" - more may be added here later
-  users.users.${userName}.extraGroups = ["wheel" "podman" "network"];
-
-  system.stateVersion = "24.11";
-}
--- a/modules/machine/valefor/default.nix
+++ b/modules/machine/valefor/default.nix
@ -1,6 +0,0 @@
-{...}: {
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-  ];
-}
--- a/modules/machine/valefor/hardware-configuration.nix
+++ b/modules/machine/valefor/hardware-configuration.nix
@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ff89bde1-4b33-4277-b649-b92700b2406c";
-      fsType = "xfs";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/3A4B-6866";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/modules/networking/core.nix
+++ b/modules/networking/core.nix
@ -3,28 +3,90 @@
  lib,
  ...
 }: let
-  cfg = config.network;
+  cfg = config.networking;
 in {
-  options.network = {
+  options.networking = {
+    # Firewall Configuration
    firewall = {
-      enable = lib.mkEnableOption "system firewall";
+      enable = lib.mkEnableOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable system firewall";
+      };
+
      tcpPorts = {
-        ssh.enable = lib.mkEnableOption "SSH service port (22)";
-        web.enable = lib.mkEnableOption "common web service ports (80, 443)";
-        smtp.enable = lib.mkEnableOption "SMTP service ports (25, 465, 587)";
-        imap.enable = lib.mkEnableOption "IMAP service ports (143, 993)";
-        mysql.enable = lib.mkEnableOption "MySQL service port (3306)";
-        mssql.enable = lib.mkEnableOption "Microsoft SQL Server service port (1433)";
-        postgres.enable = lib.mkEnableOption "Postgres service port (5432)";
+        # Predefined, default common service ports
+        ssh = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open SSH service port (22)";
+          };
+        };
+        web = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open common web service ports (80, 443)";
+          };
+        };
+        smtp = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open SMTP service ports (25, 465, 587)";
+          };
+        };
+        imap = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open IMAP service ports (143, 993)";
+          };
+        };
+        mysql = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open MySQL service port (3306)";
+          };
+        };
+        mssql = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open Microsoft SQL Server service port (1433)";
+          };
+        };
+        postgres = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open Postgres service port (5432)";
+          };
+        };
        allowedPorts = lib.mkOption {
          type = lib.types.listOf lib.types.port;
          default = [];
          description = "List of custom TCP ports to open";
        };
      };
+
      udpPorts = {
-        dns.enable = lib.mkEnableOption "DNS service port (53)";
-        ntp.enable = lib.mkEnableOption "NTP service port (123)";
+        dns = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open DNS service port (53)";
+          };
+        };
+        ntp = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open NTP service port (123)";
+          };
+        };
        allowedPorts = lib.mkOption {
          type = lib.types.listOf lib.types.port;
          default = [];
@ -32,8 +94,14 @@ in {
        };
      };
    };
+
    networkManager = {
-      enable = lib.mkEnableOption "NetworkManager for network connection management";
+      enable = lib.mkEnableOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable NetworkManager for network connection management";
+      };
+
      extraPlugins = lib.mkOption {
        type = lib.types.listOf lib.types.package;
        default = [];
@ -41,27 +109,35 @@ in {
      };
    };
  };
+
  config = {
    networking.firewall = {
      enable = cfg.firewall.enable;
-      allowedTCPPorts = lib.flatten [
-        (lib.optionals cfg.firewall.tcpPorts.ssh.enable [22])
-        (lib.optionals cfg.firewall.tcpPorts.web.enable [80 443])
-        (lib.optionals cfg.firewall.tcpPorts.smtp.enable [25 465 587])
-        (lib.optionals cfg.firewall.tcpPorts.imap.enable [143 993])
-        (lib.optionals cfg.firewall.tcpPorts.mysql.enable [3306])
-        (lib.optionals cfg.firewall.tcpPorts.mssql.enable [1433])
-        (lib.optionals cfg.firewall.tcpPorts.postgres.enable [5432])
-        cfg.firewall.tcpPorts.allowedPorts
-      ];
-      allowedUDPPorts = lib.flatten [
-        (lib.optionals cfg.firewall.udpPorts.dns.enable [53])
-        (lib.optionals cfg.firewall.udpPorts.ntp.enable [123])
-        cfg.firewall.udpPorts.allowedPorts
-      ];
+
+      allowedTCPPorts =
+        (
+          lib.optionals
+          cfg.firewall.tcpPorts.ssh.enable [22]
+          cfg.firewall.tcpPorts.web.enable [80 443]
+          cfg.firewall.tcpPorts.smtp.enable [25 465 587]
+          cfg.firewall.tcpPorts.imap.enable [143 993]
+          cfg.firewall.tcpPorts.mysql.enable [3306]
+          cfg.firewall.tcpPorts.mssql.enable [1433]
+          cfg.firewall.tcpPorts.postgres.enable [5432]
+        )
+        ++ cfg.firewall.tcpPorts.allowedPorts;
+
+      allowedUDPPorts =
+        (
+          lib.optionals
+          cfg.firewall.udpPorts.dns.enable [53]
+          cfg.firewall.udpPorts.ntp.enable [123]
+        )
+        ++ cfg.firewall.udpPorts.allowedPorts;
    };
+
    networking.networkmanager = {
-      enable = lib.mkForce cfg.networkManager.enable;
+      enable = cfg.networkManager.enable;
      packages = cfg.networkManager.extraPlugins;
    };
  };
--- a/modules/networking/dns.nix
+++ b/modules/networking/dns.nix
@ -13,13 +13,7 @@ in {
        interfaces = lib.mkOption {
          type = lib.types.listOf lib.types.str;
          default = ["127.0.0.1"];
-          description = "Network interfaces BIND should listen on (IPv4)";
-        };
-
-        interfaces6 = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = ["::1"];
-          description = "Network interfaces BIND should listen on (IPv6)";
+          description = "Network interfaces BIND should listen on";
        };

        zones = lib.mkOption {
@ -75,12 +69,18 @@ in {
    };
  };

+  # Validate that only one DNS server is enabled
+  imports = [
+    (lib.mkIf (cfg.bind.enable && cfg.technitium.enable) (throw "Only one DNS server can be enabled at a time"))
+  ];
+
+  # Implementation of the configuration
  config = lib.mkMerge [
+    # BIND DNS Server Configuration
    (lib.mkIf cfg.bind.enable {
-      services.bind = {
+      services.named = {
        enable = true;
-        listenOn = cfg.bind.settings.interfaces;
-        listenOnIpv6 = cfg.bind.settings.interfaces6;
+        interfaces = cfg.bind.settings.interfaces;
        zones =
          map (zone: {
            name = zone.name;
@ -97,13 +97,37 @@ in {
      environment.systemPackages = [pkgs.bind];
    })

+    # Technitium DNS Server Configuration
    (lib.mkIf cfg.technitium.enable {
-      services.technitium-dns-server = {
-        enable = true;
-        openFirewall = true;
-        firewallTCPPorts = [53 5380 53443];
-        firewallUDPPorts = [53];
+      # Create a systemd service for Technitium
+      systemd.services.technitium-dns = {
+        description = "Technitium DNS Server";
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig = {
+          ExecStart = "${pkgs.technitium}/bin/dns-server-start.sh";
+          Restart = "on-failure";
+        };
+
+        # Environment configuration
+        environment =
+          {
+            DNS_LISTEN_ADDRESS = cfg.technitium.settings.address;
+            DNS_LISTEN_PORT = toString cfg.technitium.settings.port;
+          }
+          // lib.mapAttrs' (
+            name: value:
+              lib.nameValuePair "DNS_${lib.toUpper name}" (toString value)
+          )
+          cfg.technitium.settings.extraOptions;
      };
+
+      networking.firewall = {
+        allowedTCPPorts = [cfg.technitium.settings.port];
+        allowedUDPPorts = [cfg.technitium.settings.port];
+      };
+
+      environment.systemPackages = [pkgs.technitium];
    })
  ];
 }