Add Watt Analytics profile

README.md

@@ -92,20 +92,24 @@ keys:
       age1pq1f7nk5g0hcvy52[...]appfzrumnuawfy5mdlqd
 ```
 
-Then, reference the new key in the default creation rule in `creation_rules.key_groups.age`:
+Then, reference the new key in the default creation rule at the bottom:
 
 ```yaml
 creation_rules:
-  - key_groups:
-      age:
-      # [...]
-      - *tux-ibp-amdgen9-nixos-btw_age
+  # [...]
+
+  # Default group for private devices
+  - pgp:
+    # [...]
+    age:
+    # [...]
+    - *tux-ibp-amdgen9-nixos-btw_age
 ```
 
 Finally, re-encrypt all secrets with the new key by running:
 
 ```sh
-sops updatekeys ./secrets/**.yaml
+find secrets -name '*.yaml' -type f -print0 | xargs -0 -l sops updatekeys --yes
 ```
 
 You should see all relevant secret files updated in the secrets folder. A notable exception may be
@@ -128,21 +132,7 @@ Paste the following template into it.
   ];
 
   networking.hostName = "tux-ibp-amdgen9-nixos-btw";
-  sops.defaultSopsFile = ../../secrets/hosts/tux-ibp-amdgen9-nixos-btw.yaml;
-
-  # If applicable, configure the default screens resolution below.
-  # home-manager.users.rtucek = {
-  #   wayland.windowManager.hyprland.settings = {
-  #     monitor = [
-  #       {
-  #         output = "eDP-1";
-  #         mode = "2880x1800@120.0000";
-  #         position = "0x0";
-  #         scale = 1.5;
-  #       }
-  #     ];
-  #   };
-  # };
+  sops.defaultSopsFile = ../../secrets/private/hosts/tux-ibp-amdgen9-nixos-btw.yaml;
 
   # If applicable, change the default LV size.
   # disko.devices.lvm_vg.volgroup0.lvs = {
@@ -151,6 +141,18 @@ Paste the following template into it.
   #   # 250 GB of available disk space
   #   lv_home.size = "250G";
   # };
+
+  # If applicable, adjust the main monitor's default.
+  # rtucek = {
+  #   hyprland.monitors = [
+  #     {
+  #       output = "eDP-1";
+  #       mode = "1900x1200@59.9500";
+  #       position = "0x0";
+  #       scale = 1;
+  #     }
+  #   ];
+  # };
 }
 ```
 

home/git/git.nix

@@ -70,9 +70,10 @@
           cleanup = "scissors";
         };
 
-        tag = {
-          forceSignAnnotated = true;
-        };
+        # To be set by the importer
+        # tag = {
+        #   forceSignAnnotated = true;
+        # };
 
         format = {
           coverFromDescription = "auto";

home/hyprland/hyprland.nix

@@ -79,7 +79,7 @@
           ########################
 
           # See https://wiki.hypr.land/Configuring/Basics/Monitors/
-          monitor = [
+          monitor = lib.modules.mkAfter [
             {
               # Sensitive default for arbitrary new monitors
               output = "";

hosts/common/default.nix

@@ -1,7 +1,7 @@
 { ... }:
 {
   imports = [
-    ../../networks/private.nix
+    ../../networks/shared.nix
     ./disko.nix
     ./home-manager.nix
   ];

hosts/common/users/rtucek.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  rtucekSopsFile = ../../../secrets/users/rtucek.yaml;
+  rtucekSopsFile = ../../../secrets/private/rtucek.yaml;
 in
 {
   # User config

hosts/default.nix

@@ -18,14 +18,25 @@
       specialArgs = { inherit inputs self; };
     in
     {
-      qemu-nixos-btw = inputs.nixpkgs.lib.nixosSystem {
+      tux-ibp-amdgen9-nixos-btw = inputs.nixpkgs.lib.nixosSystem {
         inherit specialArgs;
 
         modules =
           laptop
           ++ commonCfg
           ++ [
-            ./qemu-nixos-btw
+            ./tux-ibp-amdgen9-nixos-btw
+          ];
+      };
+
+      dell-prec-5570-nixos-btw = inputs.nixpkgs.lib.nixosSystem {
+        inherit specialArgs;
+
+        modules =
+          laptop
+          ++ commonCfg
+          ++ [
+            ./dell-prec-5570-nixos-btw
           ];
       };
 
@@ -40,14 +51,14 @@
           ];
       };
 
-      tux-ibp-amdgen9-nixos-btw = inputs.nixpkgs.lib.nixosSystem {
+      qemu-nixos-btw = inputs.nixpkgs.lib.nixosSystem {
         inherit specialArgs;
 
         modules =
           laptop
           ++ commonCfg
           ++ [
-            ./tux-ibp-amdgen9-nixos-btw
+            ./qemu-nixos-btw
           ];
       };
     };

hosts/dell-prec-5570-nixos-btw/default.nix

@@ -0,0 +1,38 @@
+{ inputs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+    inputs.nixos-hardware.nixosModules.dell-precision-5570
+  ];
+
+  networking.hostName = "dell-prec-5570-nixos-btw";
+  sops.defaultSopsFile = ../../secrets/work/watt-analytics/dell-prec-5570-nixos-btw.yaml;
+
+  disko.devices.lvm_vg.volgroup0.lvs = {
+    # 250 GB of available disk space
+    lv_root.size = "250G";
+    # 250 GB of available disk space
+    lv_home.size = "250G";
+  };
+
+  rtucek = {
+    home = {
+      sops.defaultSopsFile = ../../secrets/work/watt-analytics/rtucek.yaml;
+    };
+
+    git = {
+      user.email = "rudolf.tucek@watt-analytics.com";
+      gpg.signingKey = "0x1044945481B99D3E";
+    };
+
+    hyprland.monitors = [
+      {
+        output = "eDP-1";
+        mode = "1900x1200@59.9500";
+        position = "0x0";
+        scale = 1;
+      }
+    ];
+  };
+}

hosts/dell-prec-5570-nixos-btw/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "uas"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/dell-xps9360-nixos-btw/default.nix

@@ -7,7 +7,7 @@
   ];
 
   networking.hostName = "dell-xps9360-nixos-btw";
-  sops.defaultSopsFile = ../../secrets/hosts/dell-xps9360-nixos-btw.yaml;
+  sops.defaultSopsFile = ../../secrets/private/hosts/dell-xps9360-nixos-btw.yaml;
 
   home-manager.users.rtucek = {
     wayland.windowManager.hyprland.settings = {

hosts/qemu-nixos-btw/default.nix

@@ -6,7 +6,7 @@
   ];
 
   networking.hostName = "qemu-nixos-btw";
-  sops.defaultSopsFile = ../../secrets/hosts/qemu-nixos-btw.yaml;
+  sops.defaultSopsFile = ../../secrets/private/hosts/qemu-nixos-btw.yaml;
 
   disko.devices.lvm_vg.volgroup0.lvs = {
     # 50 % of available disk space

hosts/tux-ibp-amdgen9-nixos-btw/default.nix

@@ -7,7 +7,7 @@
   ];
 
   networking.hostName = "tux-ibp-amdgen9-nixos-btw";
-  sops.defaultSopsFile = ../../secrets/hosts/tux-ibp-amdgen9-nixos-btw.yaml;
+  sops.defaultSopsFile = ../../secrets/private/hosts/tux-ibp-amdgen9-nixos-btw.yaml;
 
   home-manager.users.rtucek = {
     wayland.windowManager.hyprland.settings = {

modules/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./users
+  ];
+}

modules/users/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./rtucek
+  ];
+}

modules/users/rtucek/audit.nix

@@ -0,0 +1,35 @@
+{ pkgs, ... }:
+{
+  # Audit access to age key
+  #
+  # Note: we can't use `security.audit.rules`, as these rules will be merged
+  # into systemd's `audit-rules-nixos.service` unit, which runs immediately
+  # after sysinit.target.
+  #
+  # However, this is too early, as at this time, LVM hasn't yet mounted the
+  # /home directory and therefore, fails to load the unit.
+  #
+  # The workaround is to load rules, referencing paths in /home in a separate systemd unit,
+  # triggered by reaching the `home.mount` target.
+  systemd.services.audit-rules-nixos-home-age =
+    let
+      auditrules = pkgs.writeTextFile {
+        name = "audit-home.rules";
+        text = ''
+          -D -k secrets_dir_user
+          -a always,exit -F arch=b64 -F path=/home/rtucek/.config/sops/age/keys.txt -F perm=rwa -F key=secrets_dir_user
+          -a always,exit -F arch=b32 -F path=/home/rtucek/.config/sops/age/keys.txt -F perm=rwa -F key=secrets_dir_user
+        '';
+      };
+    in
+    {
+      description = "Load Audit Rules after LVM mount";
+      wantedBy = [ "home.mount" ];
+      after = [ "home.mount" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${pkgs.audit}/bin/auditctl -R ${auditrules}";
+      };
+    };
+}

modules/users/rtucek/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./audit.nix
+    ./git.nix
+    ./home.nix
+    ./hyprland.nix
+    ./user.nix
+  ];
+}

modules/users/rtucek/git.nix

@@ -0,0 +1,57 @@
+{ config, lib, ... }:
+let
+  cfg = config.rtucek.git;
+in
+{
+  options.rtucek.git = {
+    user = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "Rudolf Tucek";
+        description = "Sets `user.name` in the global git config";
+      };
+
+      email = lib.mkOption {
+        type = lib.types.str;
+        default = "tucek.rudolf@gmail.com";
+        description = "Sets `user.email` in the global git config";
+      };
+    };
+
+    gpg.signingKey = lib.mkOption {
+      type = lib.types.str;
+      default = "0x49593BD010DE4723";
+      description = ''
+        If string length is > 0, sets `user.signingKey` as well as various signing-related
+        configuration in git's global config.
+      '';
+    };
+  };
+
+  config = {
+    home-manager.users.rtucek.programs.git = {
+      settings = {
+        user = {
+          name = cfg.user.name;
+          email = cfg.user.email;
+        };
+
+        tag = {
+          forceSignAnnotated = cfg.gpg.signingKey != "";
+        };
+      };
+
+      signing =
+        if cfg.gpg.signingKey == "" then
+          {
+            signByDefault = false;
+          }
+        else
+          {
+            format = "openpgp";
+            key = cfg.gpg.signingKey;
+            signByDefault = true;
+          };
+    };
+  };
+}