ft (wip): big initial config

hosts/nixbook/default.nix

@@ -0,0 +1,47 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ../../modules
+    ];
+
+  networking.hostName = "nixbook"; 
+  system.stateVersion = "26.05"; 
+
+  boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";
+
+  services.power-profiles-daemon.enable = true;
+
+  hardware.bluetooth.powerOnBoot = false;
+
+  users.users.djai.packages = with pkgs; [
+    steam
+  ];
+
+  # BELOW IS OLD!! remove as we make more modular
+  # custom certificates
+  # TODO: move certs to secrets, make this a module not a host based thing
+  security.pki.certificateFiles = [
+    ./certs/npm-caddy-private.crt
+    ./certs/npm-caddy-public.crt
+    ./certs/npm-caddy-shared.crt
+  ];
+
+  # TODO: move to secrets
+  # tunnel
+  networking.wg-quick.interfaces = {
+    npm = {
+      address = ["10.8.0.3/32"];
+      privateKeyFile = "/root/wireguard-keys/npm";
+      peers = [{
+        publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
+        presharedKeyFile = "/root/wireguard-keys/npm_preshared";
+        allowedIPs = ["10.9.11.0/24" "10.8.0.0/24"];
+        endpoint = "wg-easy.u.djairo.dev:51820";
+        persistentKeepalive = 25;
+      }];
+    };
+  };
+}