added groups

This reverts commit 67fda15ca9.

flake.nix

@@ -162,17 +162,17 @@
       # ];
     };
 
-    nixosConfigurations."yshtola" = nixpkgs.lib.nixosSystem {
+    nixosConfigurations."thancred" = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       specialArgs = {
-        inherit userName userEmail;
-        hostname = "yshtola";
+        inherit userName userEmail vintage-story;
+        hostname = "thancred";
         role = "server";
       };
       modules = [
         myOverlays
         ./modules/common
-        ./modules/machine/yshtola
+        ./modules/machine/thancred
 
         home-manager.nixosModules.home-manager
         {

home/packages/linux.nix

@@ -1,4 +1,7 @@
 { lib, pkgs, isNixOS ? true, ... }:
 lib.mkIf pkgs.stdenv.isLinux {
-
+  home.packages = with pkgs; [
+    imv
+    xdg-utils
+  ];
 }

modules/machine/thancred/configuration.nix

@@ -0,0 +1,107 @@
+{
+  pkgs,
+  userName,
+  vintage-story,
+  ...
+}: {
+  imports = [
+    ../../pwrMgmt
+    ../../networking/core.nix
+    ../../virtualization/podman.nix
+  ];
+
+  # Enable flakes for NixOS
+  nix.settings.experimental-features = ["nix-command" "flakes"];
+
+  # Custom kernel/boot stuff
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # Set your timezone
+  time.timeZone = "America/Detroit";
+
+  # Enable OpenSSH
+  services.openssh.enable = true;
+
+  # Enable keyring
+  services.gnome.gnome-keyring.enable = true;
+
+  # Enable GnuPG
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # Enable SUID wrappers (some programs need them)
+  programs.mtr.enable = true;
+
+  # Enable Polkit
+  security.polkit.enable = true;
+
+  # Power management (see ../../pwrMgmt/default.nix)
+  pwrMgmt = {
+    enable = true;
+    cpuFreqGovernor = "performance";
+    powertop.enable = false;
+  };
+
+  network = {
+    firewall = {
+      enable = true;
+      tcpPorts = {
+        allowedPorts = [ 42420 ];
+      };
+      udpPorts = {
+        allowedPorts = [ 42420 ];
+      };
+    };
+    networkManager.enable = true;
+  };
+
+  environment.systemPackages = [
+    vintage-story.packages.${pkgs.system}.default
+  ];
+
+  # Add username to groups "wheel" and "video" - more may be added here later
+  users = {
+    groups.hazel = {};
+    users = {
+      ${userName} = {
+        extraGroups = [ "wheel" "network" ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
+        ];
+      };
+      "hazel" = {
+        home = "/home/hazel";
+        group = "hazel";
+        extraGroups = [ "wheel" ];
+        description = "hazel";
+        isNormalUser = true;
+        openssh.authorizedKeys.keys = [
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZnyiQx+k1ygX8E1lsUCB6aTdMc+OKzlZ4admlzknc5ulj0YrtUyqhbNhkNd6pP0QDBFMnXO/rzUvHp4TAyZXKFfpcBCa4zhK97ufymAfvzAjM4vRBqRNcr2n+2iRzxtolbklfjs3ocBQVxXW+pRT5wWxTgK2fcmP2xviDVldr7qte37x5YkQb5SAhYNH8tqJRnuGPe+Q0A3oN4HyHZFnrMq/HlbL5yg/0VKPTtF/IgHf+2dDz5OQQpBx3/N9u/QLwuIm9lkyOG03s0TGmE7up/i0jX2vIqp2BbGSnwdQEL/eSVZx73qQB/J62VFafg13P5yQWDJ33WSoiwhac6bg26HPmPOnCJp5R3c+7jM8N1F1ZbtsKicHSVsRg1RQSree4lchPy7FOPkCuUrB7LNE71mbpOzZNR767S6UAPaXxRw6QNYGBaDqQBwhlU8ZDF5F7EW6ahSUMOI6ECyoibzIMb56xs9osuNeUhB/BcL5sHSFpJjIbdcDLNkEKggrBl6s="
+        ];
+      };
+    };
+  };
+
+  services.fail2ban = {
+    enable = true;
+    package = pkgs.fail2ban;
+    maxretry = 5;
+    bantime = "3h";
+    bantime-increment = {
+      enable = true;
+      rndtime = "10m";
+    };
+  };
+
+  services.tailscale = {
+    enable = true;
+    package = pkgs.tailscale;
+  };
+
+  system.stateVersion = "24.11";
+}

modules/machine/thancred/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/e2e621c1-0090-472a-99d9-61c6a87bd068";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/663E-15C0";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/60104b1a-4285-4dd1-be5e-3c3dee24515a"; }
+    ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

modules/machine/yshtola/configuration.nix

@@ -1,393 +0,0 @@
-{
-  pkgs,
-  config,
-  userName,
-  ...
-}: let
-  # INFO: set these to your liking
-  matrixFqdn = "chat.wyattjmiller.com";
-  rtcFqdn = "rtc.wyattjmiller.com";
-
-  supportEmail = "wyatt@wyattjmiller.com";
-  livekitKeyFile = "/var/lib/livekit/livekit.key";
-  matrixRegistrationTokenFile = "/var/lib/matrix.key";
-  mastodonFqdn = "social.wyattjmiller.com";
-  mastodonSecretsDir = "/var/lib/mastodon/secrets";
-
-  # After deploying Mastodon, register an OAuth application at
-  # https://social.wyattjmiller.com/settings/applications and write the
-  # client ID / secret to these paths (chmod 400, owned by the tuwunel user):
-  mastodonOauthClientIdFile = "/var/lib/tuwunel/mastodon-oauth-client-id";
-  mastodonOauthClientSecretFile = "/var/lib/tuwunel/mastodon-oauth-client-secret";
-in {
-  imports = [
-    ../../pwrMgmt
-  ];
-
-  # Enable flakes for NixOS
-  nix.settings.experimental-features = ["nix-command" "flakes"];
-
-  nix.settings = {
-    download-buffer-size = 134217728;  # 128 MiB in bytes
-  };
-
-  # Custom kernel/boot stuff
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  # Set your timezone
-  time.timeZone = "America/Detroit";
-
-  # Enable OpenSSH
-  services.openssh = {
-    enable = true;
-    settings.PermitRootLogin = "no";
-    settings.PasswordAuthentication = false;
-  };
-
-  # Enable keyring
-  services.gnome.gnome-keyring.enable = true;
-
-  # Enable GnuPG
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # Enable SUID wrappers (some programs need them)
-  programs.mtr.enable = true;
-
-  # Enable Polkit
-  security.polkit.enable = true;
-
-  # Power management (see ../../pwrMgmt/default.nix)
-  pwrMgmt = {
-    enable = true;
-    cpuFreqGovernor = "performance";
-    powertop.enable = false;
-  };
-
-  # Firewall settings (fallback, upstream way of doing things)
-  networking.firewall = {
-    enable = true;
-
-    allowedTCPPorts = [
-      80
-      443
-      8448
-      3478
-      5349
-      7880
-      7881
-      8080
-      8081
-    ];
-
-    allowedUDPPorts = [
-      3478
-      7881
-      8448
-    ];
-
-    allowedUDPPortRanges =[
-      # TURN UDP relays
-      { 
-        from = 49000;
-        to = 50000;
-      }
-      # 
-      {
-        from = 50100;
-        to = 50200;
-      }
-    ];
-  };
-
-  # Add username to groups "wheel" and "video" - more may be added here later
-  users.users.caddy.extraGroups = [ "mastodon" ];
-
-  users.users.${userName} = {
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
-    ];
-    extraGroups = ["wheel" "video" "network"];
-  };
-
-  # fail2ban
-  services.fail2ban = {
-    enable = true;
-    package = pkgs.fail2ban;
-    maxretry = 5;
-    bantime = "3h";
-    bantime-increment = {
-      enable = true;
-      rndtime = "10m";
-    };
-  };
-
-  # Mastodon service — social.wyattjmiller.com
-  services.mastodon = {
-    enable = true;
-    localDomain = mastodonFqdn;
-    configureNginx = false;
-    secretKeyBaseFile = "${mastodonSecretsDir}/secret_key_base";
-    otpSecretFile = "${mastodonSecretsDir}/otp_secret";
-    vapidPrivateKeyFile = "${mastodonSecretsDir}/vapid_private_key";
-    vapidPublicKeyFile = "${mastodonSecretsDir}/vapid_public_key";
-    # Configure SMTP after initial deploy via mastodonSecretsDir or a separate
-    # NixOS secrets manager (sops-nix / agenix).
-    smtp = {
-      host = "mail.wyattjmiller.com";
-      port = 25;
-      fromAddress = "notifications@${mastodonFqdn}";
-      authenticate = false;
-    };
-  };
-
-  # Matrix server
-  services.matrix-tuwunel = {
-    enable = true;
-    package = pkgs.matrix-tuwunel;
-    settings = {
-      global = {
-        server_name = matrixFqdn;
-        allow_encryption = true;
-        allow_federation = true;
-        allow_registration = true;
-        registration_token = matrixRegistrationTokenFile;
-        allow_unstable_room_versions = false;
-        allow_experimental_room_versions = false;
-        zstd_compression = true;
-        new_user_displayname_suffix = "✨";
-        max_request_size = 1048575600; # 100MB in bytes, for file uploads
-        database_backup_path = "/var/lib/tuwunel/database_backups";
-        database_backups_to_keep = 2;
-
-        address = [
-          "127.0.0.1"
-          "::1"
-        ];
-        port = [ 8008 ];
-
-        well_known = {
-          client = "https://${matrixFqdn}";
-          server = "${matrixFqdn}:443";
-          support_email = supportEmail;
-          support_mxid = "@wymiller:${matrixFqdn}";
-          
-          rtc_transports = [{
-            type = "livekit";
-            livekit_service_url = "https://${rtcFqdn}";
-          }];
-        };
-
-        # Mastodon as OIDC provider for Matrix login.
-        # Mastodon 4.3+ exposes OpenID Connect discovery at
-        # https://<domain>/.well-known/openid-configuration.
-        #
-        # REQUIRED RUNTIME SETUP (once, after first Mastodon deploy):
-        #   1. Visit https://social.wyattjmiller.com/settings/applications
-        #   2. Create a new application with the redirect URI:
-        #        https://chat.wyattjmiller.com/_matrix/client/v3/login/sso/redirect/oidc-mastodon
-        #      and scopes: read:accounts
-        #   3. Write the Application ID  → /var/lib/tuwunel/mastodon-oauth-client-id  (chmod 400, owned by tuwunel)
-        #      Write the Client Secret   → /var/lib/tuwunel/mastodon-oauth-client-secret
-        #   4. nixos-rebuild switch (or restart tuwunel.service)
-        identity_provider= [
-          {
-            brand = "Mastodon";
-            issuer_url = "https://${mastodonFqdn}";
-            id = "oidc-mastodon";
-            client_id = mastodonOauthClientIdFile;
-            client_secret = mastodonOauthClientSecretFile;
-            scope = ["openid" "read:accounts"];
-          }
-        ];
-      };
-    };
-  };
-
-  # LiveKit (Matrix RTC)
-  services.livekit = {
-    enable = true;
-    package = pkgs.livekit;
-    openFirewall = true;
-    keyFile = livekitKeyFile;
-    settings = {
-      port = 7880;
-      room.auto_create = true;
-      rtc = {
-        use_external_ip = true;
-      };
-    };
-  };
-
-  # Reverse proxy
-  services.caddy = {
-    enable = true;
-    package = pkgs.caddy;
-    virtualHosts = {
-      "${mastodonFqdn}" = {
-        extraConfig = ''
-          encode zstd gzip
-
-          root * ${config.services.mastodon.package}/public
-
-          handle /system/* {
-            uri strip_prefix /system
-            root * /var/lib/mastodon/public-system
-            file_server
-          }
-
-          @streaming path /api/v1/streaming*
-          handle @streaming {
-            reverse_proxy localhost:4000
-          }
-
-          handle {
-            @notfile not file
-            handle @notfile {
-              reverse_proxy localhost:3000
-            }
-            file_server
-          }
-        '';
-      };
-      "${matrixFqdn}" = {
-        extraConfig = ''
-          encode zstd gzip
-          reverse_proxy localhost:8008
-        '';
-      };
-      "${matrixFqdn}:8448" = {
-        extraConfig = ''
-          encode zstd gzip
-          reverse_proxy localhost:8008
-        '';
-      };
-      "${rtcFqdn}" = {
-        extraConfig = ''
-          @jwt_service {
-            path /sfu/get* /healthz*
-          }
-
-          handle @jwt_service {
-            reverse_proxy localhost:8080
-          }
-
-          handle {
-            reverse_proxy localhost:7880 {
-              header_up Connection "upgrade"
-              header_up Upgrade {http.request.header.Upgrade}
-            }
-          }
-        '';
-      };
-    };
-  };
-
-  # LiveKit JWT service
-  services.lk-jwt-service = {
-    enable = true;
-    port = 8080;
-    livekitUrl = "wss://rtc.wyattjmiller.com";
-    keyFile = livekitKeyFile;
-  };
-
-  # Generate LiveKit key if it doesn't exist
-  systemd.services = {
-    matrix-registration-token-gen = {
-      before = [ "tuwunel.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ];
-      script = ''
-        set -eu
-
-        if [ -f "${matrixRegistrationTokenFile}" ]; then
-          exit 0
-        fi
-
-        install -d -m 0700 "$(dirname "${matrixRegistrationTokenFile}")"
-
-        TOKEN="$(openssl rand -hex 32)"
-
-        umask 077
-        printf '%s\n' "$TOKEN" > "${matrixRegistrationTokenFile}"
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-      };
-    };
-
-    livekit-key-gen = {
-      before = [ "lk-jwt-service.service" "livekit.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ];
-      script = ''
-        set -eu
-
-        if [ -f "${livekitKeyFile}" ]; then
-          exit 0
-        fi
-
-        install -d -m 0700 "$(dirname "${livekitKeyFile}")"
-
-        API_KEY="$(openssl rand -hex 8)"
-        API_SECRET="$(openssl rand -hex 32)"
-
-        umask 077
-        printf '%s: %s\n' "$API_KEY" "$API_SECRET" > "${livekitKeyFile}"
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-      };
-    };
-
-    mastodon-secrets-gen = {
-      before = [ "mastodon-web.service" "mastodon-sidekiq-0.service" "mastodon-streaming.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ruby_3_4 ];
-      script = ''
-        set -eu
-
-        dir="${mastodonSecretsDir}"
-        install -d -m 0750 -o mastodon -g mastodon "$dir"
-
-        gen_hex() {
-          local f="$1"
-          if [ ! -f "$f" ]; then
-            umask 077
-            openssl rand -hex 64 | install -o mastodon -g mastodon -m 0400 /dev/stdin "$f"
-          fi
-        }
-
-        gen_hex "$dir/secret_key_base"
-        gen_hex "$dir/otp_secret"
-
-        if [ ! -f "$dir/vapid_private_key" ]; then
-          umask 077
-          ruby -ropenssl -rbase64 -e '
-            key = OpenSSL::PKey::EC.generate("prime256v1")
-            priv = Base64.urlsafe_encode64(key.private_key.to_s(2).rjust(32, "\x00"), padding: false)
-            pub  = Base64.urlsafe_encode64(key.public_key.to_bn.to_s(2), padding: false)
-            File.write(ARGV[0], priv)
-            File.write(ARGV[1], pub)
-          ' \
-            "$dir/vapid_private_key" \
-            "$dir/vapid_public_key"
-          chown mastodon:mastodon "$dir/vapid_private_key" "$dir/vapid_public_key"
-          chmod 0400 "$dir/vapid_private_key" "$dir/vapid_public_key"
-        fi
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        RemainAfterExit = true;
-      };
-    };
-  };
-
-  system.stateVersion = "25.11";
-}

modules/machine/yshtola/hardware-configuration.nix

@@ -1,35 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
-  boot.kernelParams = [ "console=ttyS0,19200n8" ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.loader.grub.extraConfig = ''
-    serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
-    terminal_input serial;
-    terminal_output serial;
-  '';
-  boot.loader.grub.forceInstall = true;
-#  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "nodev";
-  boot.loader.timeout = 10;
-
-  fileSystems."/" =
-    { device = "/dev/sda";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/sdb"; }
-    ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}