feature(boot): restrict access for /boot to root only

README.md

@@ -10,7 +10,7 @@ My personal NixOS configurations.
 ├── hosts
 │   ├── argon # desktop
 │   ├── neon # laptop
-│   └── krypton # second laptop
+│   └── default # test vm
 │       ├── configuration.nix # host-specific settings and module imports
 │       ├── hardware-configuration.nix # generated by nixos-generate-config
 │       └── niri.nix # host-specific niri settings (outputs, input)

flake.nix

@@ -53,6 +53,7 @@
     in
     {
       nixosConfigurations = {
+        default = mkHost "default";
         neon = mkHost "neon";
         argon = mkHost "argon";
         krypton = mkHost "krypton";

hosts/default/configuration.nix

@@ -0,0 +1,139 @@
+# 0x29a nixos config
+
+{ pkgs, ... }:
+
+{
+  # use flakes
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  # configure bootloader
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    device = "nodev";
+    efiSupport = true;
+  };
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelParams = [
+    "quiet"
+    "console.ttyS0,115200n8" # allow terminals on serial console
+  ];
+  # plymouth boot eye candy
+  boot.initrd.systemd.enable = true;
+  boot.plymouth.enable = true;
+  boot.plymouth.theme = "spinner";
+  # use latest kernel
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # guest agent for proxmox
+  services.qemuGuest.enable = true;
+
+  # networking
+  networking.hostName = "nixos";
+  networking.networkmanager.enable = true;
+
+  # time zone.
+  time.timeZone = "Europe/Amsterdam";
+  # select internationalisation properties
+  i18n.defaultLocale = "en_US.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "en_US.UTF-8";
+    LC_IDENTIFICATION = "en_US.UTF-8";
+    LC_MEASUREMENT = "en_US.UTF-8";
+    LC_MONETARY = "en_US.UTF-8";
+    LC_NAME = "en_US.UTF-8";
+    LC_NUMERIC = "en_US.UTF-8";
+    LC_PAPER = "en_US.UTF-8";
+    LC_TELEPHONE = "en_US.UTF-8";
+    LC_TIME = "en_US.UTF-8";
+  };
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "de_CH-latin1";
+  };
+
+  # window manager configs
+  services.xserver = {
+    enable = true;
+    xkb.layout = "ch";
+    xkb.options = "eurosign:e,caps:escape";
+
+    windowManager.qtile = {
+      enable = true;
+      extraPackages =
+        python3Packages: with python3Packages; [
+          qtile-extras
+        ];
+    };
+  };
+
+  environment.pathsToLink = [ "/libexec" ];
+  environment.variables.EDITOR = "vim";
+
+  # enable sound
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+
+  # define a user account
+  users.users.aaron = {
+    isNormalUser = true;
+    group = "users";
+    extraGroups = [ "wheel" ];
+    shell = pkgs.zsh;
+    packages = with pkgs; [
+      tree
+      fastfetch
+    ];
+  };
+
+  # browser
+  programs.firefox.enable = true;
+
+  # zsh config
+  programs.zsh = {
+    enable = true;
+    enableCompletion = true;
+    autosuggestions.enable = true;
+    ohMyZsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "sudo"
+      ];
+      theme = "agnoster";
+    };
+  };
+
+  # system packages
+  environment.systemPackages = with pkgs; [
+    vim
+    neovim
+    git
+    ghostty
+    kitty
+    wget
+    gnupg
+  ];
+
+  # Some programs need SUID wrappers
+  programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # enable the OpenSSH daemon
+  services.openssh.enable = true;
+
+  # firewall configs
+  networking.firewall.allowedTCPPorts = [ 22 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+
+  # install state version
+  system.stateVersion = "25.05"; # Don't change
+}

hosts/default/hardware-configuration.nix

@@ -0,0 +1,60 @@
+# 0x29a nixos hardware configuration
+
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  # boot and initrd configs
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "cryptd"
+  ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
+
+  # file systems
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
+
+  # enable dhcp on all interfaces
+  networking.useDHCP = lib.mkDefault true;
+
+  # set host arch
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/default/home.nix

@@ -0,0 +1,79 @@
+{ pkgs, ... }:
+
+{
+  # user config
+  home.username = "aaron";
+  home.homeDirectory = "/home/aaron";
+
+  # packages
+  home.packages = with pkgs; [
+    fastfetch
+    zip
+    xz
+    unzip
+    p7zip
+    jq
+    mtr
+    iperf3
+    dnsutils
+    ldns
+    socat
+    nmap
+    cowsay
+    file
+    which
+    tree
+    zstd
+    gnupg
+    btop
+    iotop
+    iftop
+    strace
+    lsof
+    sysstat
+    lm_sensors
+    ethtool
+    pciutils
+    usbutils
+  ];
+
+  # configure git
+  programs.git.settings = {
+    enable = true;
+    userName = "aaron";
+    userEmail = "aaron@0x29a.ch";
+  };
+
+  programs.zsh = {
+    enable = true;
+    autosuggestion.enable = true;
+    syntaxHighlighting.enable = true;
+    oh-my-zsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "sudo"
+        "python"
+        "ansible"
+      ];
+      theme = "agnoster";
+    };
+  };
+
+  ## deploy qtile config
+  #home.file."qtile-config" = {
+  #  target = ".config/qtile/config.py";
+  #  source = "${inputs.qtile-config}/qtile_config/config.py";
+  #  force = true;
+  #};
+
+  home.sessionVariables = {
+    EDITOR = "vim";
+  };
+
+  # enable home manager
+  programs.home-manager.enable = true;
+
+  # don't change
+  home.stateVersion = "25.05";
+}