Nomarchy/modules/nixos/hardware.nix

# Hardware enablement beyond nixos-hardware.
#
# The nixos-hardware "common-*" profiles the installer selects cover the
# BASICS (microcode, the Intel/AMD VA-API media stack, weekly fstrim), and
# power.nix adds thermald + power-profiles-daemon. This module fills the GAP
# above those: broadly-beneficial bits that default ON when the installer
# detects the vendor (opt-OUT), and heavier/experimental bits behind opt-IN
# toggles. The installer's hardware-db.sh probes what's present and writes the
# matching nomarchy.hardware.* into the generated system.nix.
#
# Audited against the commons so we don't double-set: we add GuC/HuC, the
# amd-pstate governor, the AMD VA-API env, GPU-compute runtimes, fprintd, and
# the NPU driver — none of which the commons turn on.
{ config, lib, pkgs, ... }:

let
  cfg = config.nomarchy.hardware;
in
{
  options.nomarchy.hardware = {
    intel = {
      enable = lib.mkEnableOption ''
        Intel CPU/GPU enablement (the installer turns this on when it detects
        an Intel CPU or GPU). Complements nixos-hardware's common-gpu-intel'';

      guc = lib.mkOption {
        type = lib.types.bool;
        default = cfg.intel.enable;
        defaultText = lib.literalExpression "config.nomarchy.hardware.intel.enable";
        description = ''
          Load the GPU's GuC/HuC firmware (i915.enable_guc=3) — better power
          management and HuC-accelerated media on Gen11+ (Xe) iGPUs. On by
          default with intel.enable; safe on modern Intel graphics.
        '';
      };

      computeRuntime = lib.mkEnableOption ''
        Intel GPU compute: the OpenCL / Level Zero (intel-compute-runtime) and
        oneVPL (vpl-gpu-rt) runtimes for GPU compute and transcode. Opt-in (a
        few hundred MB) — the Intel counterpart to AMD ROCm'';
    };

    amd = {
      enable = lib.mkEnableOption ''
        AMD CPU/GPU enablement (installer-set on an AMD CPU or GPU).
        Complements nixos-hardware's common-cpu-amd / common-gpu-amd'';

      pstate = lib.mkOption {
        type = lib.types.bool;
        default = cfg.amd.enable;
        defaultText = lib.literalExpression "config.nomarchy.hardware.amd.enable";
        description = ''
          Use the amd-pstate EPP driver (amd_pstate=active) — the modern Zen
          power/perf governor that power-profiles-daemon drives per profile.
          On by default with amd.enable (broadly beneficial on Zen 2+).
        '';
      };

      vaapi = lib.mkOption {
        type = lib.types.bool;
        default = cfg.amd.enable;
        defaultText = lib.literalExpression "config.nomarchy.hardware.amd.enable";
        description = ''
          Point VA-API at mesa's radeonsi (LIBVA_DRIVER_NAME=radeonsi) for
          hardware video decode/encode. On by default with amd.enable.
        '';
      };

      rocm = {
        enable = lib.mkEnableOption ''
          AMD ROCm: the HIP / OpenCL GPU-compute stack (multi-GB closure).
          Opt-in — unlocks GPU PyTorch / Ollama on Radeon'';

        gfxOverride = lib.mkOption {
          type = lib.types.str;
          default = "";
          example = "11.0.0";
          description = ''
            HSA_OVERRIDE_GFX_VERSION for GPUs ROCm doesn't officially list
            (e.g. an RDNA3 780M iGPU, gfx1103, needs "11.0.0"). Empty = no
            override.
          '';
        };
      };
    };

    fingerprint = {
      enable = lib.mkEnableOption ''
        a fingerprint reader via fprintd (the installer turns this on when it
        detects a known reader). Enroll with `fprintd-enroll`'';

      pam = lib.mkEnableOption ''
        using the fingerprint for login and sudo (PAM). Opt-in — password-only
        stays the default for the cautious; enroll a finger first'';
    };

    npu.enable = lib.mkEnableOption ''
      the on-die NPU (AI accelerator) kernel driver — amdxdna on AMD (Ryzen
      AI), intel_vpu on Intel (Core Ultra and newer). Opt-in and experimental:
      this loads the in-kernel driver only; the userspace runtime (AMD XRT /
      oneAPI Level Zero NPU) is yours to add'';
  };

  config = lib.mkMerge [
    # ── Intel ──────────────────────────────────────────────────────────
    (lib.mkIf cfg.intel.guc {
      boot.kernelParams = [ "i915.enable_guc=3" ];
    })
    (lib.mkIf cfg.intel.computeRuntime {
      hardware.graphics.extraPackages = with pkgs; [ intel-compute-runtime vpl-gpu-rt ];
    })

    # ── AMD ────────────────────────────────────────────────────────────
    (lib.mkIf cfg.amd.pstate {
      boot.kernelParams = [ "amd_pstate=active" ];
    })
    (lib.mkIf cfg.amd.vaapi {
      # radeonsi itself comes from mesa (via common-gpu-amd); this just steers
      # libva at it. mkDefault so a hand-set value or another module wins.
      environment.sessionVariables.LIBVA_DRIVER_NAME = lib.mkDefault "radeonsi";
      hardware.graphics.extraPackages = [ pkgs.libva ];
    })
    (lib.mkIf cfg.amd.rocm.enable {
      hardware.graphics.extraPackages = [ pkgs.rocmPackages.clr pkgs.rocmPackages.clr.icd ];
      environment.sessionVariables = lib.optionalAttrs (cfg.amd.rocm.gfxOverride != "") {
        HSA_OVERRIDE_GFX_VERSION = cfg.amd.rocm.gfxOverride;
      };
    })

    # ── Fingerprint ────────────────────────────────────────────────────
    (lib.mkIf cfg.fingerprint.enable {
      services.fprintd.enable = true;
    })
    (lib.mkIf (cfg.fingerprint.enable && cfg.fingerprint.pam) {
      security.pam.services.login.fprintAuth = true;
      security.pam.services.sudo.fprintAuth = true;
    })

    # ── NPU (in-kernel driver only; userspace runtime is BYO) ──────────
    (lib.mkIf (cfg.npu.enable && cfg.amd.enable) {
      boot.kernelModules = [ "amdxdna" ];
    })
    (lib.mkIf (cfg.npu.enable && cfg.intel.enable) {
      boot.kernelModules = [ "intel_vpu" ];
    })

    # ── Sanity ─────────────────────────────────────────────────────────
    {
      assertions = [
        {
          assertion = cfg.amd.rocm.enable -> cfg.amd.enable;
          message = "nomarchy.hardware.amd.rocm.enable needs nomarchy.hardware.amd.enable.";
        }
        {
          assertion = cfg.intel.computeRuntime -> cfg.intel.enable;
          message = "nomarchy.hardware.intel.computeRuntime needs nomarchy.hardware.intel.enable.";
        }
        {
          assertion = cfg.npu.enable -> (cfg.amd.enable || cfg.intel.enable);
          message = "nomarchy.hardware.npu.enable needs a detected Intel or AMD platform.";
        }
      ];
    }
  ];
}