wip

systems/aarch64-linux/mbp-asahi.nix

@@ -0,0 +1,83 @@
+{ pkgs, lib, ... }:
+
+# let
+#   home-manager = builtins.fetchTarball {
+#     url = "https://github.com/nix-community/home-manager/archive/release-24.11.tar.gz";
+#     sha256 = "156hc11bb6xiypj65q6gzkhw1gw31dwv6dfh6rnv20hgig1sbfld";
+#   };
+# in
+{
+  # imports = [
+  #   "${home-manager}/nixos"
+  # ];
+
+  # Generic Config
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+  time.timeZone = "America/New_York";
+
+  # Boot Loader Config
+  boot.loader = {
+    systemd-boot.enable = true;
+    efi.canTouchEfiVariables = false;
+  };
+
+  # Networking Config
+  networking = {
+    firewall.enable = true;
+    hostName = "mpb-nixos";
+    networkmanager.enable = true;
+    networkmanager.wifi.backend = "iwd";
+    useDHCP = lib.mkDefault true;
+    wireless.iwd.enable = true;
+  };
+
+  # Hardware Config
+  hardware = {
+    asahi = {
+      peripheralFirmwareDirectory = ./firmware;
+      useExperimentalGPUDriver = true;
+    };
+
+    # graphics = {
+    #   enable = true;
+    #   enable32Bit = true;
+    # };
+
+    bluetooth.enable = true;
+    bluetooth.powerOnBoot = true;
+  };
+
+  # # User Config
+  # users.users.evanreichard = {
+  #   isNormalUser = true;
+  #   home = "/home/evanreichard";
+  #   extraGroups = [ "wheel" "networkmanager" "video" ];
+  #   shell = pkgs.bash;
+  # };
+
+  # # Home Manager Config
+  # home-manager = {
+  #   useGlobalPkgs = true;
+  #   useUserPackages = true;
+  #   users.evanreichard = import ../home-manager/home.nix;
+  # };
+
+  # HyprLand Config
+  programs.hyprland.enable = true;
+  # environment.sessionVariables.NIXOS_OZONE_WL = "1";
+  # environment.sessionVariables.WLR_NO_HARDWARE_CURSORS = "1";
+
+  # System Packages
+  environment.systemPackages = with pkgs; [
+    ghostty
+    firefox
+    htop
+    tmux
+    vim
+    wget
+
+    hyprlock
+    hypridle
+  ];
+}

systems/x86_64-linux/nixos-builder/default.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+
+{
+  # User Authorized Keys
+  users.users.root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIe1n9l9pVF5+kjWJCOt3AvBVf1HOSZkEDZxCWVPSIkr evan@reichard"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGGGpRpDQRstoqnCAQioSnh6PZRzNQL7lGJHksIkcoF builder"
+    ];
+    hashedPassword = null;
+  };
+
+  # System Packages
+  environment.systemPackages = with pkgs; [
+    htop
+    tmux
+    vim
+  ];
+}

systems/x86_64-linux/office-server/default.nix

@@ -0,0 +1,175 @@
+{ config, pkgs, ... }:
+
+let
+  cuda-llama = (pkgs.llama-cpp.override {
+    cudaSupport = true;
+  }).overrideAttrs (oldAttrs: {
+    cmakeFlags = oldAttrs.cmakeFlags ++ [
+      "-DGGML_CUDA_ENABLE_UNIFIED_MEMORY=1"
+
+      # Disable CPU Instructions - Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
+      "-DLLAMA_FMA=OFF"
+      "-DLLAMA_AVX2=OFF"
+      "-DLLAMA_AVX512=OFF"
+      "-DGGML_FMA=OFF"
+      "-DGGML_AVX2=OFF"
+      "-DGGML_AVX512=OFF"
+    ];
+  });
+
+  # Define Model Vars
+  modelDir = "/models";
+
+  # 7B
+  # modelName = "qwen2.5-coder-7b-q8_0.gguf";
+  # modelUrl = "https://huggingface.co/ggml-org/Qwen2.5-Coder-7B-Q8_0-GGUF/resolve/main/${modelName}?download=true";
+
+  # 3B
+  modelName = "qwen2.5-coder-3b-q8_0.gguf";
+  modelUrl = "https://huggingface.co/ggml-org/Qwen2.5-Coder-3B-Q8_0-GGUF/resolve/main/${modelName}?download=true";
+
+  modelPath = "${modelDir}/${modelName}";
+in
+
+{
+  # Allow Nvidia & CUDA
+  nixpkgs.config.allowUnfree = true;
+
+  # Enable Graphics
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+    extraPackages = [ pkgs.cudatoolkit ];
+  };
+
+  # Load Nvidia Driver Module
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  # Nvidia Package Configuration
+  hardware.nvidia = {
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+    modesetting.enable = true;
+    powerManagement.enable = true;
+    open = false;
+    nvidiaSettings = true;
+  };
+
+  # Networking Configuration
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      1234 # RTL-TCP
+      8080 # LLama API
+    ];
+  };
+
+  # RTL-SDR
+  hardware.rtl-sdr.enable = true;
+
+  systemd.services = {
+    # LLama Download Model
+    download-model = {
+      description = "Download Model";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "llama-cpp.service" ];
+      path = [ pkgs.curl pkgs.coreutils ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = "root";
+        Group = "root";
+      };
+      script = ''
+        set -euo pipefail
+
+        if [ ! -f "${modelPath}" ]; then
+          mkdir -p "${modelDir}"
+          # Add -f flag to follow redirects and -L for location
+          # Add --fail flag to exit with error on HTTP errors
+          # Add -C - to resume interrupted downloads
+          curl -f -L -C - \
+            -H "Accept: application/octet-stream" \
+            --retry 3 \
+            --retry-delay 5 \
+            --max-time 1800 \
+            "${modelUrl}" \
+            -o "${modelPath}.tmp" && \
+          mv "${modelPath}.tmp" "${modelPath}"
+        fi
+      '';
+    };
+
+    # RTL-SDR TCP Server Service
+    rtl-tcp = {
+      description = "RTL-SDR TCP Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = "${pkgs.rtl-sdr}/bin/rtl_tcp -a 0.0.0.0 -f 1090000000 -s 2400000";
+        Restart = "on-failure";
+        RestartSec = "10s";
+        User = "root";
+        Group = "root";
+      };
+    };
+  };
+
+  # Setup LLama API Service
+  systemd.services.llama-cpp = {
+    after = [ "download-model.service" ];
+    requires = [ "download-model.service" ];
+  };
+
+  # Enable LLama API
+  services.llama-cpp = {
+    enable = true;
+    host = "0.0.0.0";
+    package = cuda-llama;
+    model = modelPath;
+    port = 8080;
+    openFirewall = true;
+
+    # 7B
+    # extraFlags = [
+    #   "-ngl"
+    #   "99"
+    #   "-fa"
+    #   "-ub"
+    #   "512"
+    #   "-b"
+    #   "512"
+    #   "-dt"
+    #   "0.1"
+    #   "--ctx-size"
+    #   "4096"
+    #   "--cache-reuse"
+    #   "256"
+    # ];
+
+    # 3B
+    extraFlags = [
+      "-ngl"
+      "99"
+      "-fa"
+      "-ub"
+      "1024"
+      "-b"
+      "1024"
+      "--ctx-size"
+      "0"
+      "--cache-reuse"
+      "256"
+    ];
+  };
+
+  # System Packages
+  environment.systemPackages = with pkgs; [
+    htop
+    nvtopPackages.full
+    rtl-sdr
+    tmux
+    vim
+    wget
+  ];
+}

systems/x86_64-linux/utility-desktop/default.nix

@@ -0,0 +1,57 @@
+{ pkgs, ... }:
+
+let
+  home-manager = builtins.fetchTarball {
+    url = "https://github.com/nix-community/home-manager/archive/release-24.11.tar.gz";
+    sha256 = "156hc11bb6xiypj65q6gzkhw1gw31dwv6dfh6rnv20hgig1sbfld";
+  };
+in
+{
+  imports = [
+    "${home-manager}/nixos"
+  ];
+
+  # Enable Graphics
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+    extraPackages = with pkgs; [ vaapiIntel intel-media-driver ];
+  };
+
+  # User Configuration
+  users.users.evanreichard = {
+    isNormalUser = true;
+    home = "/home/evanreichard";
+    group = "evanreichard";
+    extraGroups = [ "wheel" "networkmanager" "video" ];
+    shell = pkgs.bash;
+  };
+  users.groups.evanreichard = { };
+
+  # Home Manager
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    users.evanreichard = import ../home-manager/home.nix;
+  };
+
+  # Enable HyprLand
+  programs.hyprland = {
+    enable = true;
+    withUWSM = true;
+  };
+
+  # Networking Configuration
+  networking.firewall = {
+    enable = true;
+  };
+
+  # System Packages
+  environment.systemPackages = with pkgs; [
+    ghostty
+    htop
+    tmux
+    vim
+    wget
+  ];
+}

systems/x86_64-virtual/rke2-image.nix

@@ -0,0 +1,189 @@
+{ pkgs, lib, modulesPath, ... }:
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+  config = {
+    # Basic System
+    system.stateVersion = "24.11";
+    nix.settings.experimental-features = [ "nix-command" "flakes" ];
+    time.timeZone = "UTC";
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+      autoResize = true;
+    };
+
+    boot = {
+      initrd = {
+        availableKernelModules = [
+          # Xen
+          "xen_blkfront"
+          "xen_netfront"
+        ];
+        kernelModules = [ "xen_netfront" "xen_blkfront" ];
+        supportedFilesystems = [ "ext4" "xenfs" ];
+      };
+      kernelModules = [
+        # Xen VM Requirements
+        "xen_netfront"
+        "xen_blkfront"
+        "xenfs"
+
+        # iSCSI
+        "iscsi_tcp"
+      ];
+    };
+
+    # Add Intel Arc A310 GPU Drivers
+    nixpkgs.config.allowUnfree = true;
+    hardware.enableRedistributableFirmware = true;
+    hardware.graphics = {
+      enable = true;
+      extraPackages = with pkgs; [
+        libvdpau-va-gl
+        intel-vaapi-driver
+        intel-media-driver
+        intel-compute-runtime
+        intel-ocl
+      ];
+    };
+
+    # Network Configuration
+    networking = {
+      hostName = lib.mkForce "";
+      useNetworkd = true;
+      useDHCP = false;
+
+      firewall = {
+        enable = true;
+
+        allowedTCPPorts = [
+          # RKE2 Ports - https://docs.rke2.io/install/requirements#networking
+          6443 # Kubernetes API
+          9345 # RKE2 supervisor API
+          2379 # etcd Client Port
+          2380 # etcd Peer Port
+          2381 # etcd Metrics Port
+          10250 # kubelet metrics
+          9099 # Canal CNI health checks
+        ];
+
+        allowedUDPPorts = [
+          # RKE2 Ports - https://docs.rke2.io/install/requirements#networking
+          8472 # Canal CNI with VXLAN
+          # 51820 # Canal CNI with WireGuard IPv4 (if using encryption)
+          # 51821 # Canal CNI with WireGuard IPv6 (if using encryption)
+        ];
+
+        # Allow Multicast
+        extraCommands = ''
+          iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
+        '';
+      };
+    };
+
+    services = {
+      # Enable Xen Guest Utilities
+      xe-guest-utilities.enable = true;
+
+      # Enable iSCSI
+      openiscsi = {
+        enable = true;
+        name = "iqn.2025.placeholder:initiator"; # Overridden @ Runtime
+      };
+
+      # Cloud Init
+      cloud-init = {
+        enable = true;
+        network.enable = true;
+        settings = {
+          datasource_list = [ "NoCloud" ];
+          preserve_hostname = false;
+          system_info.distro = "nixos";
+          system_info.network.renderers = [ "networkd" ];
+        };
+      };
+
+      # Enable SSH
+      openssh = {
+        enable = true;
+        settings = {
+          PasswordAuthentication = false;
+          PermitRootLogin = "prohibit-password";
+        };
+      };
+
+      # Enable RKE2
+      rke2 = {
+        enable = true;
+        disable = [ "rke2-ingress-nginx" ];
+      };
+    };
+
+    systemd.services = {
+      # RKE2 - Wait Cloud Init
+      rke2-server = {
+        after = [ "cloud-final.service" ];
+        requires = [ "cloud-final.service" ];
+      };
+
+      # Runtime iSCSI Initiator Setup
+      iscsi-initiator-setup = {
+        description = "Setup iSCSI Initiator Name";
+        requires = [ "cloud-final.service" ];
+        before = [ "iscsid.service" ];
+        after = [ "cloud-final.service" ];
+        wantedBy = [ "multi-user.target" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+
+        path = [ pkgs.hostname pkgs.util-linux ];
+        script = ''
+          mkdir -p /run/iscsi
+          echo "InitiatorName=iqn.2025.org.nixos:$(hostname)" > /run/iscsi/initiatorname.iscsi
+          mount --bind /run/iscsi/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi
+        '';
+      };
+    };
+
+    # User Authorized Keys
+    users.users.root = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIe1n9l9pVF5+kjWJCOt3AvBVf1HOSZkEDZxCWVPSIkr evan@reichard"
+      ];
+      hashedPassword = null;
+    };
+
+    # Add Symlinks Expected by Democratic
+    system.activationScripts = {
+      iscsi-initiator = ''
+        mkdir -p /usr/bin
+        ln -sf ${pkgs.openiscsi}/bin/iscsiadm /usr/bin/iscsiadm
+        ln -sf ${pkgs.openiscsi}/bin/iscsid /usr/bin/iscsid
+      '';
+    };
+
+    # System Packages
+    environment = {
+      systemPackages = with pkgs; [
+        htop
+        intel-gpu-tools
+        k9s
+        kubectl
+        kubernetes-helm
+        nfs-utils
+        openiscsi
+        tmux
+        vim
+      ];
+
+      # Don't Manage - Runtime Generation
+      etc."iscsi/initiatorname.iscsi".enable = false;
+    };
+  };
+}

systems/x86_64-virtual/usb-image.nix

@@ -0,0 +1,46 @@
+{ pkgs, ... }:
+
+{
+  # Basic System
+  system.stateVersion = "24.11";
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  time.timeZone = "UTC";
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+    autoResize = true;
+  };
+
+  # SSH
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "prohibit-password";
+    };
+  };
+
+  # Firewall Configuration
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      22
+    ];
+  };
+
+  # User Authorized Keys
+  users.users.root = {
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIe1n9l9pVF5+kjWJCOt3AvBVf1HOSZkEDZxCWVPSIkr evan@reichard"
+    ];
+    hashedPassword = null;
+  };
+
+  # System Packages
+  environment.systemPackages = with pkgs; [
+    htop
+    tmux
+    vim
+  ];
+}