Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 aaron
|
1796969682
|
||
|
aaron
|
21e7e68ad4
|
||
|
aaron
|
499f15ce56
|
||
|
aaron
|
2e32024350
|
+1
-89
@@ -102,96 +102,8 @@ nixos-install
|
||||
|
||||
## how to deploy the initial config
|
||||
- Don't forget to install the bootloader, if you changed it since `nixos-install`
|
||||
- The fresh install has no flakes and no git yet, a temporary shell is enough
|
||||
- If the installer iso is older than the flake's nixpkgs, `--no-reexec` keeps
|
||||
`nixos-rebuild` from re-executing a newer version of itself, which can fail
|
||||
against the older systemd of the fresh install (only needed once)
|
||||
- Set a password for the user before rebooting, `users.nix` doesn't set one
|
||||
```bash
|
||||
$ export NIX_CONFIG="experimental-features = nix-command flakes"
|
||||
$ nix-shell -p git
|
||||
$ sudo nixos-rebuild --install-bootloader boot --flake .#host_name --no-reexec
|
||||
$ sudo passwd aaron
|
||||
```
|
||||
|
||||
## how to enable secure boot
|
||||
Secure Boot uses lanzaboote with our own keys, see `modules/nixos/lanzaboote.nix`.
|
||||
Do this after the initial config is deployed and boots.
|
||||
|
||||
1. create the keys, before the first rebuild with the lanzaboote module
|
||||
```bash
|
||||
# the keys end up in /var/lib/sbctl, they never leave the host
|
||||
$ sudo nix run nixpkgs#sbctl -- create-keys
|
||||
```
|
||||
|
||||
2. import `modules/nixos/lanzaboote.nix` in the host's `configuration.nix`, rebuild and check the signatures
|
||||
```bash
|
||||
$ sudo nixos-rebuild switch --flake .#host_name
|
||||
# EFI/Linux/*.efi and the bootloader must be signed, kernels in EFI/nixos
|
||||
# are not, lanzaboote checks them by hash
|
||||
$ sudo sbctl verify
|
||||
```
|
||||
|
||||
3. reboot once with Secure Boot still disabled, to make sure the new entries boot
|
||||
|
||||
4. in the firmware (F2), erase all Secure Boot keys, then boot nixos again
|
||||
```bash
|
||||
# "Setup Mode: ✗ Enabled", the ✗ only means the state is insecure
|
||||
$ sudo sbctl status
|
||||
```
|
||||
|
||||
5. enroll the keys
|
||||
```bash
|
||||
# only our own keys, no microsoft keys
|
||||
$ sudo sbctl enroll-keys
|
||||
```
|
||||
- sbctl refuses if the TPM eventlog shows option ROMs (e.g. a dedicated gpu).
|
||||
Don't force it, either trust exactly those with `--tpm-eventlog` or
|
||||
microsoft's keys with `--microsoft`. Without either, the firmware may not
|
||||
start the device, in the worst case the machine doesn't boot at all.
|
||||
- Check what sbctl found first, a real option ROM has a PCI device path:
|
||||
```bash
|
||||
$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
|
||||
```
|
||||
- Paths starting with `0407` (firmware volume) are drivers from the firmware
|
||||
itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
|
||||
exactly those, after a firmware update they may need to be enrolled again
|
||||
(disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
|
||||
- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
|
||||
setup too, use `--microsoft` there, a refused gpu means no picture at all
|
||||
- On the Framework (krypton), keep the firmware's built-in OEM certificates
|
||||
with `--firmware-builtin`, vendor firmware updates may need them. If an
|
||||
update fails or the keys were enrolled without them, erase the keys in the
|
||||
firmware again (Setup Mode) and re-enroll:
|
||||
```bash
|
||||
$ sudo sbctl enroll-keys --firmware-builtin
|
||||
```
|
||||
|
||||
6. enable Secure Boot in the firmware and set a firmware password, then check
|
||||
```bash
|
||||
$ bootctl status | grep "Secure Boot" # enabled (user)
|
||||
$ sudo sbctl status # Secure Boot: ✓ Enabled
|
||||
```
|
||||
- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
|
||||
- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
|
||||
|
||||
## how to unlock the disk with the tpm (laptops)
|
||||
Needs Secure Boot first. The TPM releases the key only with the PIN and while
|
||||
the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
|
||||
|
||||
1. enroll the TPM with a PIN as an additional key slot
|
||||
```bash
|
||||
# asks for the current passphrase, then the new PIN
|
||||
$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
|
||||
```
|
||||
|
||||
2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
|
||||
|
||||
- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
|
||||
state changed. After a firmware update that's expected, otherwise investigate
|
||||
before typing the passphrase. To re-enroll:
|
||||
```bash
|
||||
$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
|
||||
$ sudo nixos-rebuild --install-bootloader switch --flake .#host_name
|
||||
```
|
||||
|
||||
## how to upgrade the system
|
||||
|
||||
Generated
+19
-397
@@ -1,120 +1,5 @@
|
||||
{
|
||||
"nodes": {
|
||||
"base16": {
|
||||
"inputs": {
|
||||
"fromYaml": "fromYaml"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1755819240,
|
||||
"narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
|
||||
"owner": "SenchoPens",
|
||||
"repo": "base16.nix",
|
||||
"rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "SenchoPens",
|
||||
"repo": "base16.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"base16-fish": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1765809053,
|
||||
"narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
|
||||
"owner": "tomyun",
|
||||
"repo": "base16-fish",
|
||||
"rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tomyun",
|
||||
"repo": "base16-fish",
|
||||
"rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"base16-helix": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1776754714,
|
||||
"narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-helix",
|
||||
"rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-helix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"base16-vim": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1732806396,
|
||||
"narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-vim",
|
||||
"rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-vim",
|
||||
"rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"crane": {
|
||||
"locked": {
|
||||
"lastModified": 1789760033,
|
||||
"narHash": "sha256-jtT4yxZpR8seYnlCMMWSSPlFN92zO6ICuZ8pJrmi86k=",
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"rev": "73b980519cefc727a5f6cc8e5c0947a2f9be6edd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"firefox-gnome-theme": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1783570805,
|
||||
"narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
|
||||
"owner": "rafaelmardojai",
|
||||
"repo": "firefox-gnome-theme",
|
||||
"rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "rafaelmardojai",
|
||||
"repo": "firefox-gnome-theme",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1767039857,
|
||||
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
|
||||
"owner": "NixOS",
|
||||
"repo": "flake-compat",
|
||||
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
@@ -123,11 +8,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790898470,
|
||||
"narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
|
||||
"lastModified": 1788450739,
|
||||
"narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
|
||||
"rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -136,62 +21,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"stylix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782949081,
|
||||
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"fromYaml": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1731966426,
|
||||
"narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
|
||||
"owner": "SenchoPens",
|
||||
"repo": "fromYaml",
|
||||
"rev": "106af9e2f715e2d828df706c386a685698f3223b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "SenchoPens",
|
||||
"repo": "fromYaml",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gnome-shell": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"host": "gitlab.gnome.org",
|
||||
"lastModified": 1776175984,
|
||||
"narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
|
||||
"owner": "GNOME",
|
||||
"repo": "gnome-shell",
|
||||
"rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
"host": "gitlab.gnome.org",
|
||||
"owner": "GNOME",
|
||||
"ref": "50.1",
|
||||
"repo": "gnome-shell",
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -199,11 +28,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791642191,
|
||||
"narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
|
||||
"lastModified": 1790819692,
|
||||
"narHash": "sha256-rvubAPbh3QCliic3sAK+CXTrPCGgJstY52OTs/5H1J4=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
|
||||
"rev": "c8ecc29e5175452bee4a2aa1ba2383856d795338",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -212,30 +41,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"lanzaboote": {
|
||||
"inputs": {
|
||||
"crane": "crane",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"pre-commit": "pre-commit",
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790423250,
|
||||
"narHash": "sha256-sr4Kfp6yaXUeyKL6n0Y8/ElcR3momIRC20HFc+LF22s=",
|
||||
"owner": "nix-community",
|
||||
"repo": "lanzaboote",
|
||||
"rev": "c1c5edd31802d181c8aa2c71588995d93425d650",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "v1.2.0",
|
||||
"repo": "lanzaboote",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -243,11 +48,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791721963,
|
||||
"narHash": "sha256-BYhx89XJltnRyQeuDKHVL5eSqbbfAcOKuDts7QRsrxQ=",
|
||||
"lastModified": 1790948122,
|
||||
"narHash": "sha256-fDMYyzY1lI5b8RuCMrvoaIgTeRwNnTG4dNk1ucROlQE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "60a624466c08787ee8303393b7d4752d1826f14f",
|
||||
"rev": "0953bb1a609df63013176e3463393f8df993d3ef",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -258,11 +63,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1791594108,
|
||||
"narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
|
||||
"lastModified": 1790689126,
|
||||
"narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
|
||||
"rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -281,11 +86,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791769517,
|
||||
"narHash": "sha256-OVx8OKPdW1fLfDi1oemFkfSvF354UwU5I0GXnNAGygw=",
|
||||
"lastModified": 1790541651,
|
||||
"narHash": "sha256-/496IQz8qNWHHLnc3Zvr0l4uxJ34igNhJhn7ZKAefFk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "84e901ee80e6523068dc3baf86cbf7cdcbf16902",
|
||||
"rev": "5980a626794486abad69fca7667f9c11dfbc3bd7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -301,11 +106,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791817518,
|
||||
"narHash": "sha256-DGVFzc0YXy38vCuS43PZPIkTVKaKxpNgzkNmJsHouP8=",
|
||||
"lastModified": 1790718664,
|
||||
"narHash": "sha256-LWil4xgSyqIFZ9sydvL1glFOoiqAOknWUwykC4sqxuY=",
|
||||
"owner": "noctalia-dev",
|
||||
"repo": "noctalia-shell",
|
||||
"rev": "02cb10745d6274e4a696a00308c8ef4cefa7416d",
|
||||
"rev": "fd9759c892fe5034b682c185695f1bee121cd5b3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -314,136 +119,17 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nur": {
|
||||
"inputs": {
|
||||
"flake-parts": [
|
||||
"stylix",
|
||||
"flake-parts"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"stylix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785549842,
|
||||
"narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789514889,
|
||||
"narHash": "sha256-PFD1nxptCXJyJoiYO1gf/5Vv43yqGpHtMC6LUhl9/pQ=",
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"rev": "59f4ca0d063a1a3ec722c88b51a33004862e5379",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"home-manager": "home-manager",
|
||||
"lanzaboote": "lanzaboote",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixvim": "nixvim",
|
||||
"noctalia": "noctalia",
|
||||
"stylix": "stylix"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"lanzaboote",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789889921,
|
||||
"narHash": "sha256-aL/ogiN7qZCGeNovS1f9hX73jwYIKb4Pcq6AZm57WtY=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "1fb104a12a8667045559b2575d6d448ae2fbd99b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"stylix": {
|
||||
"inputs": {
|
||||
"base16": "base16",
|
||||
"base16-fish": "base16-fish",
|
||||
"base16-helix": "base16-helix",
|
||||
"base16-vim": "base16-vim",
|
||||
"firefox-gnome-theme": "firefox-gnome-theme",
|
||||
"flake-parts": "flake-parts_2",
|
||||
"gnome-shell": "gnome-shell",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nur": "nur",
|
||||
"systems": "systems_2",
|
||||
"tinted-kitty": "tinted-kitty",
|
||||
"tinted-schemes": "tinted-schemes",
|
||||
"tinted-tmux": "tinted-tmux",
|
||||
"tinted-zed": "tinted-zed"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791574276,
|
||||
"narHash": "sha256-UMnLnZ3JlA7UTBNNNx1rNsXYoPP/cirXLCKGiQ/yDx8=",
|
||||
"owner": "nix-community",
|
||||
"repo": "stylix",
|
||||
"rev": "2856c4c6a845b9bec98828ef197abe176e4806bb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "stylix",
|
||||
"type": "github"
|
||||
"noctalia": "noctalia"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1791244623,
|
||||
"narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"ref": "future-26.11",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1774449309,
|
||||
"narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
|
||||
@@ -458,70 +144,6 @@
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-kitty": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1735730497,
|
||||
"narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-kitty",
|
||||
"rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-kitty",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-schemes": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1785153830,
|
||||
"narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "schemes",
|
||||
"rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "schemes",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-tmux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1785031658,
|
||||
"narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-tmux",
|
||||
"rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-tmux",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-zed": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1785030526,
|
||||
"narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-zed",
|
||||
"rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-zed",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
@@ -11,10 +11,6 @@
|
||||
url = "github:noctalia-dev/noctalia-shell";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
lanzaboote = {
|
||||
url = "github:nix-community/lanzaboote/v1.2.0";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
nixos-hardware = {
|
||||
url = "github:NixOS/nixos-hardware";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
@@ -23,10 +19,6 @@
|
||||
url = "github:nix-community/nixvim";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
stylix = {
|
||||
url = "github:nix-community/stylix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
@@ -34,7 +26,6 @@
|
||||
nixpkgs,
|
||||
home-manager,
|
||||
nixvim,
|
||||
stylix,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
@@ -54,7 +45,6 @@
|
||||
home-manager.extraSpecialArgs = { inherit inputs; };
|
||||
home-manager.users.aaron.imports = [
|
||||
nixvim.homeModules.nixvim
|
||||
stylix.homeModules.stylix
|
||||
./users/aaron/home.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -10,13 +10,11 @@
|
||||
../../modules/nixos/bootloader.nix
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/data-drives.nix
|
||||
../../modules/nixos/docker.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/greetd.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
../../modules/nixos/noctalia-greeter.nix
|
||||
../../modules/nixos/noctalia.nix
|
||||
../../modules/nixos/openssh.nix
|
||||
../../modules/nixos/packages.nix
|
||||
@@ -25,7 +23,6 @@
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/thunar.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/docker.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -24,7 +23,6 @@
|
||||
../../modules/nixos/services.nix
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
@@ -32,13 +30,6 @@
|
||||
# host-specific niri config (input devices, laptop binds)
|
||||
home-manager.users.aaron.imports = [ ./niri.nix ];
|
||||
|
||||
# hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
|
||||
services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
|
||||
|
||||
# bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
|
||||
# what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
|
||||
boot.lanzaboote.settings.console-mode = "6";
|
||||
|
||||
networking.hostName = "krypton";
|
||||
system.stateVersion = "26.05"; # don't change
|
||||
}
|
||||
|
||||
@@ -17,7 +17,6 @@
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/docker.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -29,7 +28,6 @@
|
||||
../../modules/nixos/services.nix
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
|
||||
@@ -4,10 +4,13 @@
|
||||
settings = {
|
||||
clipboard-paste-protection = false;
|
||||
clipboard-read = "allow";
|
||||
font-family = "0xProto Nerd Font Mono";
|
||||
font-size = 12;
|
||||
gtk-titlebar = false;
|
||||
scrollback-limit = 100000;
|
||||
shell-integration = "zsh";
|
||||
shell-integration-features = "ssh-env,ssh-terminfo";
|
||||
theme = "noctalia"; # generated by noctalia-shell
|
||||
window-decoration = "auto";
|
||||
window-padding-x = 10;
|
||||
window-padding-y = 10;
|
||||
|
||||
@@ -14,7 +14,6 @@ let
|
||||
signingKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
|
||||
];
|
||||
in
|
||||
{
|
||||
|
||||
@@ -2,12 +2,7 @@
|
||||
# come from modules/nixos/niri.nix. Outputs and input devices that differ
|
||||
# per machine live in hosts/<host>/niri.nix.
|
||||
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
osConfig,
|
||||
...
|
||||
}:
|
||||
{ lib, osConfig, ... }:
|
||||
|
||||
let
|
||||
# Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there
|
||||
@@ -23,9 +18,6 @@ let
|
||||
_props.allow-when-locked = true;
|
||||
spawn-sh = cmd;
|
||||
};
|
||||
|
||||
# niri has no stylix target, so the colors are picked here
|
||||
colors = config.lib.stylix.colors.withHashtag;
|
||||
in
|
||||
{
|
||||
wayland.windowManager.niri = {
|
||||
@@ -42,7 +34,6 @@ in
|
||||
input = {
|
||||
keyboard = {
|
||||
xkb.layout = "ch";
|
||||
xkb.variant = "de_nodeadkeys";
|
||||
numlock = { };
|
||||
};
|
||||
mouse = {
|
||||
@@ -70,9 +61,9 @@ in
|
||||
focus-ring = {
|
||||
on = { };
|
||||
width = 2;
|
||||
active-color = colors.base03;
|
||||
inactive-color = colors.base00;
|
||||
urgent-color = colors.base0B;
|
||||
active-color = "#4c566a";
|
||||
inactive-color = "#2e3440";
|
||||
urgent-color = "#a3be8c";
|
||||
};
|
||||
|
||||
border.off = { };
|
||||
|
||||
@@ -23,7 +23,7 @@
|
||||
|
||||
# nvim mapleader for all command below
|
||||
globals.mapleader = " ";
|
||||
# set colorscheme to nord, stylix's base16 version is disabled in stylix.nix
|
||||
# set colorscheme to nord
|
||||
colorschemes.nord.enable = true;
|
||||
|
||||
# nvim plugins
|
||||
|
||||
@@ -14,7 +14,13 @@
|
||||
|
||||
# settings is rendered to ~/.config/noctalia/config.toml
|
||||
settings = {
|
||||
# theme / colors come from stylix, see stylix.nix
|
||||
# theme / colors
|
||||
theme = {
|
||||
source = "builtin";
|
||||
builtin = "Nord";
|
||||
mode = "dark";
|
||||
templates.builtin_ids = [ "ghostty" ];
|
||||
};
|
||||
|
||||
# general
|
||||
shell = {
|
||||
@@ -70,8 +76,6 @@
|
||||
radius = 0;
|
||||
scale = 1.2;
|
||||
widget_spacing = 20;
|
||||
# no dark gradient on the seam between the bar and attached panels (e.g. control center)
|
||||
contact_shadow = false;
|
||||
start = [
|
||||
"control-center"
|
||||
"cpu"
|
||||
|
||||
@@ -7,8 +7,6 @@
|
||||
discord
|
||||
fastfetch
|
||||
keepassxc
|
||||
signal-desktop
|
||||
tea
|
||||
teamspeak6-client
|
||||
typst
|
||||
zathura
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
gtk = {
|
||||
enable = true;
|
||||
theme = {
|
||||
name = "Adwaita-dark";
|
||||
package = pkgs.gnome-themes-extra;
|
||||
};
|
||||
gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
|
||||
gtk4.theme = null;
|
||||
gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
|
||||
};
|
||||
|
||||
qt = {
|
||||
enable = true;
|
||||
platformTheme.name = "qt6";
|
||||
style = {
|
||||
name = "adwaita-dark";
|
||||
package = pkgs.adwaita-qt;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
# One Nord palette for everything stylix has a target for: gtk, qt,
|
||||
# noctalia, ghostty. Niri has no target and reads the colors in niri.nix.
|
||||
# Only the home-manager module is used, so boot, console and sddm are left alone.
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
stylix = {
|
||||
enable = true;
|
||||
base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
|
||||
polarity = "dark";
|
||||
|
||||
fonts = {
|
||||
monospace = {
|
||||
name = "0xProto Nerd Font Mono";
|
||||
package = pkgs.nerd-fonts._0xproto;
|
||||
};
|
||||
sizes.terminal = 12;
|
||||
};
|
||||
|
||||
# its overlays (nixos-icons, gtksourceview) clash with useGlobalPkgs
|
||||
overlays.enable = false;
|
||||
|
||||
targets = {
|
||||
# profiles aren't managed by home-manager, declaring one here would
|
||||
# take over the existing profile
|
||||
firefox.enable = false;
|
||||
# the bar keeps 0xProto instead of the sans-serif font
|
||||
noctalia.fonts.enable = false;
|
||||
# nord.nvim is calmer than the base16 palette, e.g. no line number
|
||||
# background, see nixvim.nix
|
||||
nixvim.enable = false;
|
||||
# the hand-built status line in tmux.nix uses ANSI color names, which
|
||||
# already follow the terminal palette
|
||||
tmux.enable = false;
|
||||
# rofi isn't used, and the target still sets the renamed
|
||||
# programs.rofi.font, which warns on every evaluation
|
||||
rofi.enable = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,8 +4,6 @@
|
||||
# set bootloader to systemd
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
# no kernel command line editing at the boot menu (e.g. init=/bin/sh)
|
||||
systemd-boot.editor = false;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -8,14 +8,8 @@
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
log-driver = "local";
|
||||
log-driver = "journald";
|
||||
registry-mirrors = [ "https://mirror.gcr.io" ];
|
||||
};
|
||||
};
|
||||
|
||||
# k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
|
||||
systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
|
||||
|
||||
# let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
|
||||
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
|
||||
}
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
|
||||
# installs it signed and writes signed boot entries instead of the nixos module.
|
||||
# The keys are created once per host with `sudo sbctl create-keys` before the
|
||||
# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.
|
||||
|
||||
{
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
|
||||
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
|
||||
boot.lanzaboote = {
|
||||
enable = true;
|
||||
pkiBundle = "/var/lib/sbctl";
|
||||
};
|
||||
|
||||
# key management and verification
|
||||
environment.systemPackages = [ pkgs.sbctl ];
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{
|
||||
# greetd display manager with the graphical noctalia greeter, replaces greetd.nix.
|
||||
# The nixpkgs module enables greetd, accountsservice (avatars) and polkit, and
|
||||
# launches noctalia-greeter-session. Sessions (niri) are discovered from
|
||||
# wayland-sessions, the last one picked is remembered.
|
||||
# See https://docs.noctalia.dev/greeter/
|
||||
services.displayManager.noctalia-greeter = {
|
||||
enable = true;
|
||||
|
||||
# lets the shell's "Sync Now" / auto-sync copy wallpaper, palette and monitor
|
||||
# layout to the greeter without an admin prompt (appearance only)
|
||||
passwordlessSyncUsers = [ "aaron" ];
|
||||
|
||||
# rendered to /var/lib/noctalia-greeter/greeter.toml, wins over synced values
|
||||
settings = {
|
||||
user.default = "aaron";
|
||||
# same layout as niri, otherwise the password is typed on a us keymap
|
||||
keyboard.layout = "ch";
|
||||
keyboard.variant = "de_nodeadkeys";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
|
||||
# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
|
||||
# so this needs lanzaboote.nix. Enrolled once per host with
|
||||
# `systemd-cryptenroll`, see INSTALLATION.md.
|
||||
|
||||
{
|
||||
boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
../../modules/home-manager/noctalia.nix
|
||||
../../modules/home-manager/programs.nix
|
||||
../../modules/home-manager/shell.nix
|
||||
../../modules/home-manager/stylix.nix
|
||||
../../modules/home-manager/styling.nix
|
||||
../../modules/home-manager/tmux.nix
|
||||
];
|
||||
|
||||
|
||||
Reference in New Issue
Block a user