Merge remote-tracking branch 'origin/main' into chore/remove-default-host

# Conflicts:
#	hosts/default/hardware-configuration.nix

INSTALLATION.md

@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
   { device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
   };
 fileSystems."/home" =
   { device = "/dev/disk/by-label/nixhome";

README.md

@@ -10,7 +10,7 @@ My personal NixOS configurations.
 ├── hosts
 │   ├── argon # desktop
 │   ├── neon # laptop
-│   └── default # test vm
+│   └── krypton # second laptop
 │       ├── configuration.nix # host-specific settings and module imports
 │       ├── hardware-configuration.nix # generated by nixos-generate-config
 │       └── niri.nix # host-specific niri settings (outputs, input)

flake.nix

@@ -53,7 +53,6 @@
     in
     {
       nixosConfigurations = {
-        default = mkHost "default";
         neon = mkHost "neon";
         argon = mkHost "argon";
         krypton = mkHost "krypton";

hosts/argon/configuration.nix

@@ -1,17 +1,7 @@
 # argon: desktop with an amd gpu and three luks-encrypted data drives.
-# The drives are unlocked in the initrd with keyfiles from /etc/nixos/keys.
 
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 
-let
-  # luks name -> partition uuid, mounted at /mnt/<name>
-  drives = {
-    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-  };
-  key = name: "/etc/nixos/keys/${name}.key";
-in
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -19,6 +9,7 @@ in
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
     ../../modules/nixos/certificates.nix
+    ../../modules/nixos/data-drives.nix
     ../../modules/nixos/gnupg.nix
     ../../modules/nixos/greetd.nix
     ../../modules/nixos/locales.nix
@@ -46,22 +37,12 @@ in
   };
   hardware.amdgpu.initrd.enable = true;
 
-  # encrypted data drives
+  # encrypted data drives, see data-drives.nix
-  boot.initrd.secrets = lib.mapAttrs' (name: _: lib.nameValuePair (key name) (key name)) drives;
+  local.dataDrives = {
-  boot.initrd.luks.devices = lib.mapAttrs (name: uuid: {
+    data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
-    device = "/dev/disk/by-uuid/${uuid}";
+    data2 = "8312edae-9247-481b-a313-52a7f848f027";
-    keyFile = key name;
+    nvmecache = "2352250e-4ebe-4f9a-bf66-0d4aaa961bd8";
-    # trim for ssds, ignored by drives without discard support
+  };
-    allowDiscards = true;
-  }) drives;
-  fileSystems = lib.mapAttrs' (
-    name: _:
-    lib.nameValuePair "/mnt/${name}" {
-      device = "/dev/mapper/${name}";
-      fsType = "ext4";
-      options = [ "nofail" ];
-    }
-  ) drives;
 
   environment.systemPackages = with pkgs; [
     amdgpu_top

hosts/argon/hardware-configuration.nix

@@ -39,8 +39,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
+      "fmask=0077"
-      "dmask=0022"
+      "dmask=0077"
     ];
   };
 

hosts/default/configuration.nix

@@ -1,139 +0,0 @@
-# 0x29a nixos config
-
-{ pkgs, ... }:
-
-{
-  # use flakes
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  # configure bootloader
-  boot.loader.systemd-boot.enable = false;
-  boot.loader.grub = {
-    enable = true;
-    device = "nodev";
-    efiSupport = true;
-  };
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelParams = [
-    "quiet"
-    "console.ttyS0,115200n8" # allow terminals on serial console
-  ];
-  # plymouth boot eye candy
-  boot.initrd.systemd.enable = true;
-  boot.plymouth.enable = true;
-  boot.plymouth.theme = "spinner";
-  # use latest kernel
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  # guest agent for proxmox
-  services.qemuGuest.enable = true;
-
-  # networking
-  networking.hostName = "nixos";
-  networking.networkmanager.enable = true;
-
-  # time zone.
-  time.timeZone = "Europe/Amsterdam";
-  # select internationalisation properties
-  i18n.defaultLocale = "en_US.UTF-8";
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
-    LC_NAME = "en_US.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "en_US.UTF-8";
-  };
-  console = {
-    font = "Lat2-Terminus16";
-    keyMap = "de_CH-latin1";
-  };
-
-  # window manager configs
-  services.xserver = {
-    enable = true;
-    xkb.layout = "ch";
-    xkb.options = "eurosign:e,caps:escape";
-
-    windowManager.qtile = {
-      enable = true;
-      extraPackages =
-        python3Packages: with python3Packages; [
-          qtile-extras
-        ];
-    };
-  };
-
-  environment.pathsToLink = [ "/libexec" ];
-  environment.variables.EDITOR = "vim";
-
-  # enable sound
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-  };
-
-  # define a user account
-  users.users.aaron = {
-    isNormalUser = true;
-    group = "users";
-    extraGroups = [ "wheel" ];
-    shell = pkgs.zsh;
-    packages = with pkgs; [
-      tree
-      fastfetch
-    ];
-  };
-
-  # browser
-  programs.firefox.enable = true;
-
-  # zsh config
-  programs.zsh = {
-    enable = true;
-    enableCompletion = true;
-    autosuggestions.enable = true;
-    ohMyZsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "sudo"
-      ];
-      theme = "agnoster";
-    };
-  };
-
-  # system packages
-  environment.systemPackages = with pkgs; [
-    vim
-    neovim
-    git
-    ghostty
-    kitty
-    wget
-    gnupg
-  ];
-
-  # Some programs need SUID wrappers
-  programs.mtr.enable = true;
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-  };
-
-  # enable the OpenSSH daemon
-  services.openssh.enable = true;
-
-  # firewall configs
-  networking.firewall.allowedTCPPorts = [ 22 ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-
-  # install state version
-  system.stateVersion = "25.05"; # Don't change
-}

hosts/default/hardware-configuration.nix

@@ -1,60 +0,0 @@
-# 0x29a nixos hardware configuration
-
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # boot and initrd configs
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [
-    "dm-snapshot"
-    "cryptd"
-  ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
-
-  # file systems
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixroot";
-    fsType = "ext4";
-  };
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-label/nixboot";
-    fsType = "vfat";
-    options = [
-      "fmask=0022"
-      "dmask=0022"
-    ];
-  };
-  fileSystems."/home" = {
-    device = "/dev/disk/by-label/nixhome";
-    fsType = "ext4";
-  };
-  swapDevices = [
-    { device = "/dev/disk/by-label/nixswap"; }
-  ];
-
-  # enable dhcp on all interfaces
-  networking.useDHCP = lib.mkDefault true;
-
-  # set host arch
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/default/home.nix

@@ -1,79 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # user config
-  home.username = "aaron";
-  home.homeDirectory = "/home/aaron";
-
-  # packages
-  home.packages = with pkgs; [
-    fastfetch
-    zip
-    xz
-    unzip
-    p7zip
-    jq
-    mtr
-    iperf3
-    dnsutils
-    ldns
-    socat
-    nmap
-    cowsay
-    file
-    which
-    tree
-    zstd
-    gnupg
-    btop
-    iotop
-    iftop
-    strace
-    lsof
-    sysstat
-    lm_sensors
-    ethtool
-    pciutils
-    usbutils
-  ];
-
-  # configure git
-  programs.git.settings = {
-    enable = true;
-    userName = "aaron";
-    userEmail = "aaron@0x29a.ch";
-  };
-
-  programs.zsh = {
-    enable = true;
-    autosuggestion.enable = true;
-    syntaxHighlighting.enable = true;
-    oh-my-zsh = {
-      enable = true;
-      plugins = [
-        "git"
-        "sudo"
-        "python"
-        "ansible"
-      ];
-      theme = "agnoster";
-    };
-  };
-
-  ## deploy qtile config
-  #home.file."qtile-config" = {
-  #  target = ".config/qtile/config.py";
-  #  source = "${inputs.qtile-config}/qtile_config/config.py";
-  #  force = true;
-  #};
-
-  home.sessionVariables = {
-    EDITOR = "vim";
-  };
-
-  # enable home manager
-  programs.home-manager.enable = true;
-
-  # don't change
-  home.stateVersion = "25.05";
-}

hosts/krypton/hardware-configuration.nix

@@ -40,8 +40,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
+      "fmask=0077"
-      "dmask=0022"
+      "dmask=0077"
     ];
   };
 

hosts/neon/hardware-configuration.nix

@@ -43,8 +43,8 @@
     device = "/dev/disk/by-label/nixboot";
     fsType = "vfat";
     options = [
-      "fmask=0022"
+      "fmask=0077"
-      "dmask=0022"
+      "dmask=0077"
     ];
   };
 

modules/nixos/data-drives.nix

@@ -0,0 +1,37 @@
+# luks-encrypted data drives, unlocked after boot via /etc/crypttab with
+# keyfiles from /etc/nixos/keys/<name>.key on the encrypted root.
+# Not in boot.initrd.luks on purpose: keyfiles there end up in the initrd
+# on the unencrypted /boot.
+
+{ config, lib, ... }:
+
+let
+  drives = config.local.dataDrives;
+in
+{
+  options.local.dataDrives = lib.mkOption {
+    type = lib.types.attrsOf lib.types.str;
+    default = { };
+    example = {
+      data1 = "dfae62cc-bad1-4879-bf9a-461bde833625";
+    };
+    description = "luks name -> luks partition uuid, mounted at /mnt/<name>";
+  };
+
+  config = lib.mkIf (drives != { }) {
+    environment.etc.crypttab.text = lib.concatStrings (
+      lib.mapAttrsToList (
+        name: uuid: "${name} /dev/disk/by-uuid/${uuid} /etc/nixos/keys/${name}.key luks,discard,nofail\n"
+      ) drives
+    );
+
+    fileSystems = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "/mnt/${name}" {
+        device = "/dev/mapper/${name}";
+        fsType = "ext4";
+        options = [ "nofail" ];
+      }
+    ) drives;
+  };
+}