nixos/configurations/server.nix

# Host: "sapphira" (device: server)
#
# The host record lives in configurations/default.nix; this file is only the
# module body. `xlib` (identity, dirs, helpers) arrives as a module argument.
{
  lib,
  pkgs,
  xlib,
  inputs,
  ...
}:
{
  imports = [
    ./hardware/server.nix
    inputs.self.nixosModules.default
  ];

  boot = {
    # kernelPackages = pkgs.linuxPackages_xanmod_stable;
    hardwareScan = true;
    loader = {
      systemd-boot.enable = lib.mkDefault true;
      efi.canTouchEfiVariables = lib.mkDefault true;
    };
  };

  hardware = {
    bluetooth.enable = true;
    graphics = {
      enable = true;
      extraPackages = with pkgs; [
        intel-media-driver
        intel-ocl
        intel-vaapi-driver
      ];
    };
    intel-gpu-tools.enable = true;
  };

  fileSystems =
    (xlib.helpers.mkExfatMount {
      path = xlib.dirs.archive-drive;
      label = "archive";
    })
    // (xlib.helpers.mkExfatMount {
      path = xlib.dirs.mobile-drive;
      uuid = "7EB1-DC99";
    })
    // (xlib.helpers.mkBindMount {
      what = xlib.dirs.services-folder;
      where = xlib.dirs.services-mnt-folder;
    })
    // {
      # External drive
      "${xlib.dirs.server-home}" = {
        device = "/dev/disk/by-uuid/37e53ebc-5343-a94d-9fe2-0ca39e13a8de";
        fsType = "ext4";
      };
    };

  systemd.tmpfiles.rules = [
    "z ${xlib.dirs.services-mnt-folder} 0777 root root -"
  ];

  host.ssh.enable = true;

  # Offload Nix builds to the WSL2 NixOS instance running on vetymae
  # (Windows 11 host). Sapphira only has 2 logical cores; the WSL exposes
  # 24 cores + 14 GiB. The matchBlock with ProxyCommand is generated by
  # modules/server/builder.nix, the other side of the same option lives in
  # modules/wsl/builder.nix.
  #
  # `proxyCommand` is what marks this builder as needing the SSH matchBlock
  # (see modules/server/builder.nix). A builder reachable directly would
  # omit it.
  #
  # ---- DISABLED 2026-10-04 ----
  # Remote building temporarily turned off coordinator-side. `host.builder.clients`
  # falls back to its default `[]` (declared in modules/options.nix), so
  # modules/server/builder.nix's `lib.mkIf (clients != [])` never fires and no
  # buildMachines / SSH blocks / distributedBuilds override get generated.
  # All builds run locally on sapphira's 2 cores. Re-enable by removing the
  # Nix comments on the block below (and on `host.builder.enable = true;`
  # in configurations/wsl.nix).
  #
  # host.builder.clients = [
  #   {
  #     hostName = "vetymae-nix";
  #     sshUser = "oqyude";
  #     sshKey = "/root/.ssh/id_ed25519";
  #     # NixOS calls this `systems` (plural), not `systemTypes`. The
  #     # default is empty — every derivation is rejected. The WSL NixOS
  #     # runs on x86_64-linux, matching sapphira.
  #     systems = [ "x86_64-linux" ];
  #     # vetymae-nix drops kvm + nixos-test from its advertised
  #     # system-features (see modules/wsl/builder.nix). Listing them here
  #     # would not break anything (Nix intersects), but listing the
  #     # features the WSL actually has is the documented contract.
  #     supportedFeatures = [
  #       "benchmark"
  #       "big-parallel"
  #     ];
  #     mandatoryFeatures = [ ];
  #     maxJobs = 24;
  #     speedFactor = 0.5;
  #     # Keep the SSH session alive across many small builds in one daemon
  #     # session — compile-heavy workloads spam the daemon with hundreds of
  #     # derivations and ControlMaster collapses those into one Windows hop.
  #     # NB: `nix.buildMachines` has no `sshOptions` attribute, so the
  #     # ControlMaster directive lives in the SSH matchBlock instead (see
  #     # modules/server/builder.nix).
  #     #
  #     # The OpenSSH alias for this host (matches the user's
  #     # ~/.ssh/config so known_hosts entries do not collide with the
  #     # Windows OpenSSH entry on 127.0.0.1/vetymae) is consumed only by
  #     # the SSH matchBlock below — not by `nix.buildMachines`, which has
  #     # no such attribute.
  #     hostKeyAlias = "wsl-nixos-on-vetymae";
  #     # Use the Windows host's IP directly so the nix-daemon (running as
  #     # root, without the user's ~/.ssh/config) does not need a separate
  #     # `vetymae` host alias. With StrictHostKeyChecking=accept-new the
  #     # first connection adds the Windows host key to /root/.ssh/known_hosts.
  #     proxyCommand = "ssh oqyude@192.168.1.100 'wsl -d NixOS -- nc 127.0.0.1 22'";
  #   }
  # ];

  networking = {
    networkmanager.enable = true;
    firewall.enable = false;
    # nameservers = [
    #   "192.168.1.1"
    #   "127.0.0.1"
    # ];
  };

  system = {
    stateVersion = "25.05";
  };
}