flake.nix

@@ -82,21 +82,21 @@
         inherit userName userEmail;
         hostname = "valefor";
       };
-      modules = [
+      # modules = [
-        nix-ld.nixosModules.nix-ld
+      #   nix-ld.nixosModules.nix-ld
-        ./modules/common
+      #   ./modules/nix-core.nix
-        ./modules/machine/valefor
+      #   ./modules/host-users.nix
-
+      #
-        home-manager.nixosModules.home-manager
+      #   home-manager.nixosModules.home-manager
-        {
+      #   {
-          home-manager.useGlobalPkgs = true;
+      #     home-manager.useGlobalPkgs = true;
-          home-manager.useUserPackages = true;
+      #     home-manager.useUserPackages = true;
-          home-manager.extraSpecialArgs = extraSpecialArgs;
+      #     home-manager.extraSpecialArgs = extraSpecialArgs;
-          home-manager.users.${userName}.imports = [
+      #     home-manager.users.${userName}.imports = [
-            ./home
+      #       ./home
-          ];
+      #     ];
-        }
+      #   }
-      ];
+      # ];
     };
 
     # Storage, status, game, and media server

home/git.nix

@@ -3,6 +3,10 @@
   userEmail,
   ...
 }: {
+  # `programs.git` will generate the config file: ~/.config/git/config
+  # to make git use this config file, `~/.gitconfig` should not exist!
+  #
+  #    https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
   home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
     rm -f ~/.gitconfig
   '';
@@ -26,8 +30,6 @@
 
     aliases = {
       # common aliases
-      a = "add";
-      ap = "add -p";
       br = "branch";
       co = "checkout";
       st = "status -sb";

modules/machine/cloud/configuration.nix

@@ -23,7 +23,6 @@ in {
     ../../apps/gaming.nix
     ../../graphics
     ../../pwrMgmt
-    ../../networking/core.nix
     ../../sound/pipewire.nix
     ../../sound/shairport.nix
     ../../virtualization/podman.nix
@@ -85,7 +84,7 @@ in {
   # Graphics module (../../graphics/default.nix)
   graphics = {
     enable = true;
-    gpuVendor = "amd"; # or "amd" or "intel"
+    gpuVendor = "nvidia"; # or "amd" or "intel"
     wayland.enable = true;
     vulkan.enable = true;
   };
@@ -141,7 +140,7 @@ in {
   };
 
   # Core networking module (see ../../networking/core.nix)
-  network = {
+  networking = {
     firewall.enable = true;
     networkmanager.enable = true;
   };

modules/machine/sephiroth/apps.nix

@@ -8,11 +8,17 @@
 
   homebrew = {
     enable = true;
+
     onActivation = {
       autoUpdate = false;
+      # 'zap': uninstalls all formulae(and related files) not listed here.
       cleanup = "zap";
     };
 
+    # Applications to install from Mac App Store using mas.
+    # You need to install all these Apps manually first so that your apple account have records for them.
+    # otherwise Apple Store will refuse to install them.
+    # For details, see https://github.com/mas-cli/mas
     masApps = {
       Xcode = 497799835;
       "Reeder 5." = 1529448980;
@@ -28,7 +34,6 @@
     ];
 
     casks = [
-      "ghostty"
       "raycast"
       "jordanbaird-ice"
     ];

modules/machine/sephiroth/configuration.nix

@@ -167,7 +167,7 @@
 
   system.stateVersion = 5;
 
-  podman = {
+  containers.podman = {
     enable = true;
     extraPackages = with pkgs; [
       docker-credential-helpers

modules/machine/valefor/configuration.nix

@@ -1,102 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  userName,
-  ...
-}: {
-  imports = [
-    ../../graphics
-    ../../pwrMgmt
-    ../../networking/core.nix
-    ../../networking/dns.nix
-    ../../virtualization/podman.nix
-  ];
-
-  # Enable flakes for NixOS
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-
-  # Custom kernel/boot stuff
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # Enable Bluetooth if present
-  hardware.bluetooth.enable = true;
-
-  # Set your timezone
-  time.timeZone = "America/Detroit";
-
-  # Install packages to be installed system-wide
-  environment.systemPackages = with pkgs; [
-    vim
-    neovim
-    git
-    patchelf
-  ];
-
-  # Set the EDITOR global environment variable to neovim
-  environment.variables.EDITOR = "nvim";
-
-  # Enable OpenSSH
-  services.openssh.enable = true;
-
-  # Enable keyring
-  services.gnome.gnome-keyring.enable = true;
-
-  # Enable GnuPG
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # Enable SUID wrappers (some programs need them)
-  programs.mtr.enable = true;
-
-  # Enable Polkit
-  security.polkit.enable = true;
-
-  # Graphics module (../../graphics/default.nix)
-  graphics = {
-    enable = true;
-    gpuVendor = "intel";
-    wayland.enable = true;
-    vulkan.enable = true;
-  };
-
-  # Power management (see ../../pwrMgmt/default.nix)
-  pwrMgmt = {
-    enable = true;
-    cpuFreqGovernor = "performance";
-    powertop.enable = false;
-  };
-
-  # Podman module (see ../../virtualization/podman.nix)
-  podman = {
-    enable = true;
-    extraPackages = with pkgs; [
-      docker-credential-helpers
-      toolbox
-      cosign
-      crane
-      podman-tui
-      podman-desktop
-    ];
-  };
-
-  # Core networking module (see ../../networking/core.nix)
-  network = {
-    firewall.enable = true;
-    networkManager.enable = true;
-  };
-
-  # DNS module (see ../../networking/dns.nix)
-  dns = {
-    technitium.enable = true;
-  };
-
-  # Add username to groups "wheel" and "video" - more may be added here later
-  users.users.${userName}.extraGroups = ["wheel" "podman" "network"];
-
-  system.stateVersion = "24.11";
-}

modules/machine/valefor/default.nix

@@ -1,6 +0,0 @@
-{...}: {
-  imports = [
-    ./configuration.nix
-    ./hardware-configuration.nix
-  ];
-}

modules/machine/valefor/hardware-configuration.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ff89bde1-4b33-4277-b649-b92700b2406c";
-      fsType = "xfs";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/3A4B-6866";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

modules/networking/core.nix

@@ -3,28 +3,90 @@
   lib,
   ...
 }: let
-  cfg = config.network;
+  cfg = config.networking;
 in {
-  options.network = {
+  options.networking = {
+    # Firewall Configuration
     firewall = {
-      enable = lib.mkEnableOption "system firewall";
+      enable = lib.mkEnableOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable system firewall";
+      };
+
       tcpPorts = {
-        ssh.enable = lib.mkEnableOption "SSH service port (22)";
+        # Predefined, default common service ports
-        web.enable = lib.mkEnableOption "common web service ports (80, 443)";
+        ssh = {
-        smtp.enable = lib.mkEnableOption "SMTP service ports (25, 465, 587)";
+          enable = lib.mkEnableOption {
-        imap.enable = lib.mkEnableOption "IMAP service ports (143, 993)";
+            type = lib.types.bool;
-        mysql.enable = lib.mkEnableOption "MySQL service port (3306)";
+            default = false;
-        mssql.enable = lib.mkEnableOption "Microsoft SQL Server service port (1433)";
+            description = "Open SSH service port (22)";
-        postgres.enable = lib.mkEnableOption "Postgres service port (5432)";
+          };
+        };
+        web = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open common web service ports (80, 443)";
+          };
+        };
+        smtp = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open SMTP service ports (25, 465, 587)";
+          };
+        };
+        imap = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open IMAP service ports (143, 993)";
+          };
+        };
+        mysql = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open MySQL service port (3306)";
+          };
+        };
+        mssql = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open Microsoft SQL Server service port (1433)";
+          };
+        };
+        postgres = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open Postgres service port (5432)";
+          };
+        };
         allowedPorts = lib.mkOption {
           type = lib.types.listOf lib.types.port;
           default = [];
           description = "List of custom TCP ports to open";
         };
       };
+
       udpPorts = {
-        dns.enable = lib.mkEnableOption "DNS service port (53)";
+        dns = {
-        ntp.enable = lib.mkEnableOption "NTP service port (123)";
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open DNS service port (53)";
+          };
+        };
+        ntp = {
+          enable = lib.mkEnableOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Open NTP service port (123)";
+          };
+        };
         allowedPorts = lib.mkOption {
           type = lib.types.listOf lib.types.port;
           default = [];
@@ -32,8 +94,14 @@ in {
         };
       };
     };
+
     networkManager = {
-      enable = lib.mkEnableOption "NetworkManager for network connection management";
+      enable = lib.mkEnableOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Enable NetworkManager for network connection management";
+      };
+
       extraPlugins = lib.mkOption {
         type = lib.types.listOf lib.types.package;
         default = [];
@@ -41,27 +109,35 @@ in {
       };
     };
   };
+
   config = {
     networking.firewall = {
       enable = cfg.firewall.enable;
-      allowedTCPPorts = lib.flatten [
+
-        (lib.optionals cfg.firewall.tcpPorts.ssh.enable [22])
+      allowedTCPPorts =
-        (lib.optionals cfg.firewall.tcpPorts.web.enable [80 443])
+        (
-        (lib.optionals cfg.firewall.tcpPorts.smtp.enable [25 465 587])
+          lib.optionals
-        (lib.optionals cfg.firewall.tcpPorts.imap.enable [143 993])
+          cfg.firewall.tcpPorts.ssh.enable [22]
-        (lib.optionals cfg.firewall.tcpPorts.mysql.enable [3306])
+          cfg.firewall.tcpPorts.web.enable [80 443]
-        (lib.optionals cfg.firewall.tcpPorts.mssql.enable [1433])
+          cfg.firewall.tcpPorts.smtp.enable [25 465 587]
-        (lib.optionals cfg.firewall.tcpPorts.postgres.enable [5432])
+          cfg.firewall.tcpPorts.imap.enable [143 993]
-        cfg.firewall.tcpPorts.allowedPorts
+          cfg.firewall.tcpPorts.mysql.enable [3306]
-      ];
+          cfg.firewall.tcpPorts.mssql.enable [1433]
-      allowedUDPPorts = lib.flatten [
+          cfg.firewall.tcpPorts.postgres.enable [5432]
-        (lib.optionals cfg.firewall.udpPorts.dns.enable [53])
+        )
-        (lib.optionals cfg.firewall.udpPorts.ntp.enable [123])
+        ++ cfg.firewall.tcpPorts.allowedPorts;
-        cfg.firewall.udpPorts.allowedPorts
+
-      ];
+      allowedUDPPorts =
+        (
+          lib.optionals
+          cfg.firewall.udpPorts.dns.enable [53]
+          cfg.firewall.udpPorts.ntp.enable [123]
+        )
+        ++ cfg.firewall.udpPorts.allowedPorts;
     };
+
     networking.networkmanager = {
-      enable = lib.mkForce cfg.networkManager.enable;
+      enable = cfg.networkManager.enable;
       packages = cfg.networkManager.extraPlugins;
     };
   };

modules/networking/dns.nix

@@ -13,13 +13,7 @@ in {
         interfaces = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           default = ["127.0.0.1"];
-          description = "Network interfaces BIND should listen on (IPv4)";
+          description = "Network interfaces BIND should listen on";
-        };
-
-        interfaces6 = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = ["::1"];
-          description = "Network interfaces BIND should listen on (IPv6)";
         };
 
         zones = lib.mkOption {
@@ -75,12 +69,18 @@ in {
     };
   };
 
+  # Validate that only one DNS server is enabled
+  imports = [
+    (lib.mkIf (cfg.bind.enable && cfg.technitium.enable) (throw "Only one DNS server can be enabled at a time"))
+  ];
+
+  # Implementation of the configuration
   config = lib.mkMerge [
+    # BIND DNS Server Configuration
     (lib.mkIf cfg.bind.enable {
-      services.bind = {
+      services.named = {
         enable = true;
-        listenOn = cfg.bind.settings.interfaces;
+        interfaces = cfg.bind.settings.interfaces;
-        listenOnIpv6 = cfg.bind.settings.interfaces6;
         zones =
           map (zone: {
             name = zone.name;
@@ -97,13 +97,37 @@ in {
       environment.systemPackages = [pkgs.bind];
     })
 
+    # Technitium DNS Server Configuration
     (lib.mkIf cfg.technitium.enable {
-      services.technitium-dns-server = {
+      # Create a systemd service for Technitium
-        enable = true;
+      systemd.services.technitium-dns = {
-        openFirewall = true;
+        description = "Technitium DNS Server";
-        firewallTCPPorts = [53 5380 53443];
+        wantedBy = ["multi-user.target"];
-        firewallUDPPorts = [53];
+
+        serviceConfig = {
+          ExecStart = "${pkgs.technitium}/bin/dns-server-start.sh";
+          Restart = "on-failure";
+        };
+
+        # Environment configuration
+        environment =
+          {
+            DNS_LISTEN_ADDRESS = cfg.technitium.settings.address;
+            DNS_LISTEN_PORT = toString cfg.technitium.settings.port;
+          }
+          // lib.mapAttrs' (
+            name: value:
+              lib.nameValuePair "DNS_${lib.toUpper name}" (toString value)
+          )
+          cfg.technitium.settings.extraOptions;
       };
+
+      networking.firewall = {
+        allowedTCPPorts = [cfg.technitium.settings.port];
+        allowedUDPPorts = [cfg.technitium.settings.port];
+      };
+
+      environment.systemPackages = [pkgs.technitium];
     })
   ];
 }