From 6bfbea2195f91dc0328fb9678a6f06e0d174b10f Mon Sep 17 00:00:00 2001
From: Jan-Bulthuis <git@bulthuis.dev>
Date: Fri, 23 Oct 2026 01:07:53 +0200
Subject: [PATCH] feat: home automation server

---
 hosts/ws-home/configuration.nix          | 37 +++++++++++
 hosts/ws-home/hardware-configuration.nix | 18 ++++++
 profiles/disko/ws-home.nix               | 65 +++++++++++++++++++
 profiles/nixos/server.nix                | 80 ++++++++++++++++++++++++
 profiles/nixos/vm.nix                    | 62 +-----------------
 5 files changed, 202 insertions(+), 60 deletions(-)
 create mode 100644 hosts/ws-home/configuration.nix
 create mode 100644 hosts/ws-home/hardware-configuration.nix
 create mode 100644 profiles/disko/ws-home.nix
 create mode 100644 profiles/nixos/server.nix

diff --git a/hosts/ws-home/configuration.nix b/hosts/ws-home/configuration.nix
new file mode 100644
index 0000000..7501d5f
--- /dev/null
+++ b/hosts/ws-home/configuration.nix
@@ -0,0 +1,37 @@
+{
+  ...
+}:
+
+{
+  # State version
+  system.stateVersion = "25.05";
+
+  # Machine hostname
+  networking.hostName = "ws-home";
+
+  # Enabled modules
+  modules = {
+    profiles.server.enable = true;
+    disko.profile = "ws-home";
+  };
+
+  # Matter controller
+  services.matterjs-server = {
+    enable = true;
+    listenAddress = "::";
+    openFirewall = true;
+  };
+  modules.impermanence.directories = [
+    "/var/lib/private/matterjs-server"
+  ];
+  systemd.tmpfiles.rules = [
+    "d /var/lib/private 0700 root root -"
+  ];
+  networking.firewall.allowedUDPPorts = [
+    5353 # mDNS
+    5540 # Matter
+  ];
+
+  # Set up hardware
+  imports = [ ./hardware-configuration.nix ];
+}
diff --git a/hosts/ws-home/hardware-configuration.nix b/hosts/ws-home/hardware-configuration.nix
new file mode 100644
index 0000000..f97505c
--- /dev/null
+++ b/hosts/ws-home/hardware-configuration.nix
@@ -0,0 +1,18 @@
+{ ... }:
+
+# TODO: Replace with output of `nixos-generate-config --show-hardware-config`
+{
+  # Hardware configuration
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+  boot.zfs.forceImportRoot = false;
+  hardware.cpu.intel.updateMicrocode = true;
+}
diff --git a/profiles/disko/ws-home.nix b/profiles/disko/ws-home.nix
new file mode 100644
index 0000000..8d32852
--- /dev/null
+++ b/profiles/disko/ws-home.nix
@@ -0,0 +1,65 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/sda"; # TODO: Verify on the actual machine (may be /dev/nvme0n1)
+        imageSize = "32G"; # For test VMs
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            zfs = {
+              end = "-4G";
+              content = {
+                type = "zfs";
+                pool = "tank";
+              };
+            };
+            swap = {
+              size = "100%";
+              content = {
+                type = "swap";
+                discardPolicy = "both";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      tank = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+        };
+        mountpoint = null;
+        postCreateHook = "zfs snapshot -r tank@blank && zfs hold -r blank tank@blank";
+
+        datasets = {
+          root = {
+            type = "zfs_fs";
+            mountpoint = "/";
+          };
+          nix = {
+            type = "zfs_fs";
+            mountpoint = "/nix";
+          };
+          persist = {
+            type = "zfs_fs";
+            mountpoint = "/persist";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/profiles/nixos/server.nix b/profiles/nixos/server.nix
new file mode 100644
index 0000000..e7939ef
--- /dev/null
+++ b/profiles/nixos/server.nix
@@ -0,0 +1,80 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+with lib;
+let
+  cfg = config.modules.profiles.server;
+in
+{
+  options.modules.profiles.server = {
+    enable = mkEnableOption "Base server profile";
+  };
+
+  config = mkIf cfg.enable {
+    # Enabled modules
+    modules = {
+      profiles.base.enable = true;
+      disko.enable = true;
+      impermanence = {
+        enable = true;
+        resetScript = ''
+          # Revert to the blank state for the root directory
+          zfs rollback -r tank/root@blank
+        '';
+      };
+      domain = {
+        enable = true;
+        join = {
+          userFile = config.sops.secrets."vm-join/user".path;
+          passwordFile = config.sops.secrets."vm-join/password".path;
+          domainOUFile = config.sops.secrets."vm-join/ou".path;
+        };
+      };
+      ssh.enable = true;
+    };
+
+    # Initialize domain join secrets
+    sops.secrets."vm-join/user" = { };
+    sops.secrets."vm-join/password" = { };
+    sops.secrets."vm-join/ou" = { };
+
+    # Local user
+    sops.secrets."passwords/local-hashed".neededForUsers = true;
+    users.mutableUsers = false;
+    users.users.local = {
+      isNormalUser = true;
+      group = "local";
+      hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Admin"
+      ];
+    };
+    users.groups.local = { };
+    home-manager.users.local =
+      { ... }:
+      {
+        home.stateVersion = "24.11";
+        modules.profiles.base.enable = true;
+      };
+
+    # System packages
+    environment.systemPackages = with pkgs; [
+      # TODO: Make module for utilities/scripts
+      (writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
+    ];
+
+    # Machine platform
+    nixpkgs.hostPlatform = mkDefault "x86_64-linux";
+
+    # Set hostid (required for ZFS)
+    networking.hostId = "deadbeef";
+
+    # Hardware configuration
+    hardware.enableRedistributableFirmware = true;
+  };
+}
diff --git a/profiles/nixos/vm.nix b/profiles/nixos/vm.nix
index 100be23..3393fa0 100644
--- a/profiles/nixos/vm.nix
+++ b/profiles/nixos/vm.nix
@@ -1,5 +1,4 @@
 {
-  pkgs,
   lib,
   config,
   ...
@@ -17,74 +16,17 @@ in
   config = mkIf cfg.enable {
     # Enabled modules
     modules = {
-      profiles.base.enable = true;
-      disko = {
-        enable = true;
-        profile = mkDefault "vm";
-      };
-      impermanence = {
-        enable = true;
-        resetScript = ''
-          # Revert to the blank state for the root directory
-          zfs rollback -r tank/root@blank
-        '';
-      };
-      domain = {
-        enable = true;
-        join = {
-          userFile = config.sops.secrets."vm-join/user".path;
-          passwordFile = config.sops.secrets."vm-join/password".path;
-          domainOUFile = config.sops.secrets."vm-join/ou".path;
-        };
-      };
-      ssh.enable = true;
+      profiles.server.enable = true;
+      disko.profile = mkDefault "vm";
     };
 
-    # Initialize domain join secrets
-    sops.secrets."vm-join/user" = { };
-    sops.secrets."vm-join/password" = { };
-    sops.secrets."vm-join/ou" = { };
-
     # Autologin to root for access from hypervisor
     services.getty.autologinUser = "root";
 
-    # Local user
-    sops.secrets."passwords/local-hashed".neededForUsers = true;
-    users.mutableUsers = false;
-    users.users.local = {
-      isNormalUser = true;
-      group = "local";
-      hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
-      extraGroups = [ "wheel" ];
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Admin"
-      ];
-    };
-    users.groups.local = { };
-    home-manager.users.local =
-      { ... }:
-      {
-        home.stateVersion = "24.11";
-        modules.profiles.base.enable = true;
-      };
-
-    # System packages
-    environment.systemPackages = with pkgs; [
-      # TODO: Make module for utilities/scripts
-      (writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
-    ];
-
     # Enable qemu guest agent
     services.qemuGuest.enable = true;
 
-    # Machine platform
-    nixpkgs.hostPlatform = "x86_64-linux";
-
-    # Set hostid (required for ZFS)
-    networking.hostId = "deadbeef";
-
     # Hardware configuration
-    hardware.enableRedistributableFirmware = true;
     boot.initrd.availableKernelModules = [
       "ata_piix"
       "uhci_hcd"