Merge remote-tracking branch 'origin/main' into feature/secure_boot
This commit is contained in:
@@ -1,17 +1,7 @@
|
||||
# argon: desktop with an amd gpu and three luks-encrypted data drives.
|
||||
# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
|
||||
|
||||
{ lib, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
let
|
||||
# luks name -> partition uuid, mounted at /mnt/<name>
|
||||
drives = {
|
||||
data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
|
||||
data2 = "8312edae-9247-481b-a313-52a7f848f027";
|
||||
nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
|
||||
};
|
||||
key = name: "/etc/nixos/keys/${name}.key";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../../modules/nixos/appimage.nix
|
||||
@@ -19,6 +9,7 @@ in
|
||||
../../modules/nixos/audio.nix
|
||||
../../modules/nixos/bootloader.nix
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/data-drives.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/greetd.nix
|
||||
../../modules/nixos/locales.nix
|
||||
@@ -46,22 +37,12 @@ in
|
||||
};
|
||||
hardware.amdgpu.initrd.enable = true;
|
||||
|
||||
# encrypted data drives
|
||||
boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
|
||||
boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
|
||||
device = "/dev/disk/by-uuid/${uuid}";
|
||||
keyFile = key name;
|
||||
# trim for ssds, ignored by drives without discard support
|
||||
allowDiscards = true;
|
||||
}) drives;
|
||||
fileSystems = lib.mapAttrs' (
|
||||
name: _:
|
||||
lib.nameValuePair "/mnt/${name}" {
|
||||
device = "/dev/mapper/${name}";
|
||||
fsType = "ext4";
|
||||
options = [ "nofail" ];
|
||||
}
|
||||
) drives;
|
||||
# encrypted data drives, see data-drives.nix
|
||||
local.dataDrives = {
|
||||
data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
|
||||
data2 = "8312edae-9247-481b-a313-52a7f848f027";
|
||||
nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
amdgpu_top
|
||||
|
||||
@@ -39,8 +39,8 @@
|
||||
device = "/dev/disk/by-label/nixboot";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
@@ -1,139 +0,0 @@
|
||||
# 0x29a nixos config
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# use flakes
|
||||
nix.settings.experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
|
||||
# configure bootloader
|
||||
boot.loader.systemd-boot.enable = false;
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
efiSupport = true;
|
||||
};
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.kernelParams = [
|
||||
"quiet"
|
||||
"console.ttyS0,115200n8" # allow terminals on serial console
|
||||
];
|
||||
# plymouth boot eye candy
|
||||
boot.initrd.systemd.enable = true;
|
||||
boot.plymouth.enable = true;
|
||||
boot.plymouth.theme = "spinner";
|
||||
# use latest kernel
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
# guest agent for proxmox
|
||||
services.qemuGuest.enable = true;
|
||||
|
||||
# networking
|
||||
networking.hostName = "nixos";
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
# time zone.
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
# select internationalisation properties
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_US.UTF-8";
|
||||
LC_IDENTIFICATION = "en_US.UTF-8";
|
||||
LC_MEASUREMENT = "en_US.UTF-8";
|
||||
LC_MONETARY = "en_US.UTF-8";
|
||||
LC_NAME = "en_US.UTF-8";
|
||||
LC_NUMERIC = "en_US.UTF-8";
|
||||
LC_PAPER = "en_US.UTF-8";
|
||||
LC_TELEPHONE = "en_US.UTF-8";
|
||||
LC_TIME = "en_US.UTF-8";
|
||||
};
|
||||
console = {
|
||||
font = "Lat2-Terminus16";
|
||||
keyMap = "de_CH-latin1";
|
||||
};
|
||||
|
||||
# window manager configs
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
xkb.layout = "ch";
|
||||
xkb.options = "eurosign:e,caps:escape";
|
||||
|
||||
windowManager.qtile = {
|
||||
enable = true;
|
||||
extraPackages =
|
||||
python3Packages: with python3Packages; [
|
||||
qtile-extras
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
environment.pathsToLink = [ "/libexec" ];
|
||||
environment.variables.EDITOR = "vim";
|
||||
|
||||
# enable sound
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
|
||||
# define a user account
|
||||
users.users.aaron = {
|
||||
isNormalUser = true;
|
||||
group = "users";
|
||||
extraGroups = [ "wheel" ];
|
||||
shell = pkgs.zsh;
|
||||
packages = with pkgs; [
|
||||
tree
|
||||
fastfetch
|
||||
];
|
||||
};
|
||||
|
||||
# browser
|
||||
programs.firefox.enable = true;
|
||||
|
||||
# zsh config
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
enableCompletion = true;
|
||||
autosuggestions.enable = true;
|
||||
ohMyZsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"sudo"
|
||||
];
|
||||
theme = "agnoster";
|
||||
};
|
||||
};
|
||||
|
||||
# system packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
neovim
|
||||
git
|
||||
ghostty
|
||||
kitty
|
||||
wget
|
||||
gnupg
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers
|
||||
programs.mtr.enable = true;
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# enable the OpenSSH daemon
|
||||
services.openssh.enable = true;
|
||||
|
||||
# firewall configs
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
|
||||
# install state version
|
||||
system.stateVersion = "25.05"; # Don't change
|
||||
}
|
||||
@@ -1,60 +0,0 @@
|
||||
# 0x29a nixos hardware configuration
|
||||
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
# boot and initrd configs
|
||||
boot.initrd.availableKernelModules = [
|
||||
"uhci_hcd"
|
||||
"ehci_pci"
|
||||
"ahci"
|
||||
"virtio_pci"
|
||||
"virtio_scsi"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [
|
||||
"dm-snapshot"
|
||||
"cryptd"
|
||||
];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
|
||||
|
||||
# file systems
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/nixroot";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/nixboot";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
fileSystems."/home" = {
|
||||
device = "/dev/disk/by-label/nixhome";
|
||||
fsType = "ext4";
|
||||
};
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-label/nixswap"; }
|
||||
];
|
||||
|
||||
# enable dhcp on all interfaces
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
|
||||
# set host arch
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
@@ -1,79 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# user config
|
||||
home.username = "aaron";
|
||||
home.homeDirectory = "/home/aaron";
|
||||
|
||||
# packages
|
||||
home.packages = with pkgs; [
|
||||
fastfetch
|
||||
zip
|
||||
xz
|
||||
unzip
|
||||
p7zip
|
||||
jq
|
||||
mtr
|
||||
iperf3
|
||||
dnsutils
|
||||
ldns
|
||||
socat
|
||||
nmap
|
||||
cowsay
|
||||
file
|
||||
which
|
||||
tree
|
||||
zstd
|
||||
gnupg
|
||||
btop
|
||||
iotop
|
||||
iftop
|
||||
strace
|
||||
lsof
|
||||
sysstat
|
||||
lm_sensors
|
||||
ethtool
|
||||
pciutils
|
||||
usbutils
|
||||
];
|
||||
|
||||
# configure git
|
||||
programs.git.settings = {
|
||||
enable = true;
|
||||
userName = "aaron";
|
||||
userEmail = "aaron@0x29a.ch";
|
||||
};
|
||||
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
autosuggestion.enable = true;
|
||||
syntaxHighlighting.enable = true;
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
"git"
|
||||
"sudo"
|
||||
"python"
|
||||
"ansible"
|
||||
];
|
||||
theme = "agnoster";
|
||||
};
|
||||
};
|
||||
|
||||
## deploy qtile config
|
||||
#home.file."qtile-config" = {
|
||||
# target = ".config/qtile/config.py";
|
||||
# source = "${inputs.qtile-config}/qtile_config/config.py";
|
||||
# force = true;
|
||||
#};
|
||||
|
||||
home.sessionVariables = {
|
||||
EDITOR = "vim";
|
||||
};
|
||||
|
||||
# enable home manager
|
||||
programs.home-manager.enable = true;
|
||||
|
||||
# don't change
|
||||
home.stateVersion = "25.05";
|
||||
}
|
||||
@@ -40,8 +40,8 @@
|
||||
device = "/dev/disk/by-label/nixboot";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
@@ -43,8 +43,8 @@
|
||||
device = "/dev/disk/by-label/nixboot";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
Reference in New Issue
Block a user