Compare commits
26
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 aaron
|
a8aefcbfdd
|
||
|
aaron
|
1883b6cb05 | ||
|
aaron
|
e9b3e5961c
|
||
|
aaron
|
3b961d447b | ||
|
aaron
|
edcc71b435
|
||
|
aaron
|
88aeea31f8 | ||
|
aaron
|
8f86bcb365
|
||
|
aaron
|
2b55ec9873
|
||
|
aaron
|
6a5eaca649 | ||
|
aaron
|
4409e2a9e6
|
||
|
aaron
|
441d954b85 | ||
|
aaron
|
e602ba9df1
|
||
|
aaron
|
863c496400
|
||
|
aaron
|
20bf806666 | ||
|
aaron
|
e35311dfd5
|
||
|
aaron
|
beb520a615
|
||
|
aaron
|
4eb3e27f8b | ||
|
aaron
|
8c56b00247
|
||
|
aaron
|
ff2e4d2f69 | ||
|
aaron
|
318e17ac27
|
||
|
aaron
|
c66549f3bf | ||
|
aaron
|
620c415be9
|
||
|
aaron
|
472f359f80
|
||
|
aaron
|
ad494d1209 | ||
|
aaron
|
d26bd424cc
|
||
|
aaron
|
a7bba82b5b |
@@ -149,6 +149,23 @@ $ sudo sbctl enroll-keys
|
||||
Don't force it, either trust exactly those with `--tpm-eventlog` or
|
||||
microsoft's keys with `--microsoft`. Without either, the firmware may not
|
||||
start the device, in the worst case the machine doesn't boot at all.
|
||||
- Check what sbctl found first, a real option ROM has a PCI device path:
|
||||
```bash
|
||||
$ sudo nix shell nixpkgs#tpm2-tools -c tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements | grep -A14 "EV_EFI_BOOT_SERVICES_DRIVER"
|
||||
```
|
||||
- Paths starting with `0407` (firmware volume) are drivers from the firmware
|
||||
itself, not option ROMs (e.g. on the ThinkPad). `--tpm-eventlog` trusts
|
||||
exactly those, after a firmware update they may need to be enrolled again
|
||||
(disable Secure Boot, `sbctl enroll-keys --tpm-eventlog`)
|
||||
- Without an integrated gpu (argon), the gpu's option ROM draws the firmware
|
||||
setup too, use `--microsoft` there, a refused gpu means no picture at all
|
||||
- On the Framework (krypton), keep the firmware's built-in OEM certificates
|
||||
with `--firmware-builtin`, vendor firmware updates may need them. If an
|
||||
update fails or the keys were enrolled without them, erase the keys in the
|
||||
firmware again (Setup Mode) and re-enroll:
|
||||
```bash
|
||||
$ sudo sbctl enroll-keys --firmware-builtin
|
||||
```
|
||||
|
||||
6. enable Secure Boot in the firmware and set a firmware password, then check
|
||||
```bash
|
||||
@@ -158,6 +175,25 @@ $ sudo sbctl status # Secure Boot: ✓ Enabled
|
||||
- If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
|
||||
- Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
|
||||
|
||||
## how to unlock the disk with the tpm (laptops)
|
||||
Needs Secure Boot first. The TPM releases the key only with the PIN and while
|
||||
the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
|
||||
|
||||
1. enroll the TPM with a PIN as an additional key slot
|
||||
```bash
|
||||
# asks for the current passphrase, then the new PIN
|
||||
$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
|
||||
```
|
||||
|
||||
2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
|
||||
|
||||
- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
|
||||
state changed. After a firmware update that's expected, otherwise investigate
|
||||
before typing the passphrase. To re-enroll:
|
||||
```bash
|
||||
$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
|
||||
```
|
||||
|
||||
## how to upgrade the system
|
||||
```bash
|
||||
$ cd /path/to/repo
|
||||
|
||||
Generated
+298
-19
@@ -1,5 +1,73 @@
|
||||
{
|
||||
"nodes": {
|
||||
"base16": {
|
||||
"inputs": {
|
||||
"fromYaml": "fromYaml"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1755819240,
|
||||
"narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
|
||||
"owner": "SenchoPens",
|
||||
"repo": "base16.nix",
|
||||
"rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "SenchoPens",
|
||||
"repo": "base16.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"base16-fish": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1765809053,
|
||||
"narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
|
||||
"owner": "tomyun",
|
||||
"repo": "base16-fish",
|
||||
"rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tomyun",
|
||||
"repo": "base16-fish",
|
||||
"rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"base16-helix": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1776754714,
|
||||
"narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-helix",
|
||||
"rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-helix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"base16-vim": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1732806396,
|
||||
"narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-vim",
|
||||
"rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-vim",
|
||||
"rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"crane": {
|
||||
"locked": {
|
||||
"lastModified": 1789760033,
|
||||
@@ -15,6 +83,22 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"firefox-gnome-theme": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1783570805,
|
||||
"narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
|
||||
"owner": "rafaelmardojai",
|
||||
"repo": "firefox-gnome-theme",
|
||||
"rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "rafaelmardojai",
|
||||
"repo": "firefox-gnome-theme",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
@@ -39,11 +123,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1788450739,
|
||||
"narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
|
||||
"lastModified": 1790898470,
|
||||
"narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
|
||||
"rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -52,6 +136,62 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts_2": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
"stylix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782949081,
|
||||
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"fromYaml": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1731966426,
|
||||
"narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
|
||||
"owner": "SenchoPens",
|
||||
"repo": "fromYaml",
|
||||
"rev": "106af9e2f715e2d828df706c386a685698f3223b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "SenchoPens",
|
||||
"repo": "fromYaml",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gnome-shell": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"host": "gitlab.gnome.org",
|
||||
"lastModified": 1776175984,
|
||||
"narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
|
||||
"owner": "GNOME",
|
||||
"repo": "gnome-shell",
|
||||
"rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
"host": "gitlab.gnome.org",
|
||||
"owner": "GNOME",
|
||||
"ref": "50.1",
|
||||
"repo": "gnome-shell",
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -59,11 +199,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790819692,
|
||||
"narHash": "sha256-rvubAPbh3QCliic3sAK+CXTrPCGgJstY52OTs/5H1J4=",
|
||||
"lastModified": 1791642191,
|
||||
"narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "c8ecc29e5175452bee4a2aa1ba2383856d795338",
|
||||
"rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -103,11 +243,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790948122,
|
||||
"narHash": "sha256-fDMYyzY1lI5b8RuCMrvoaIgTeRwNnTG4dNk1ucROlQE=",
|
||||
"lastModified": 1791721963,
|
||||
"narHash": "sha256-BYhx89XJltnRyQeuDKHVL5eSqbbfAcOKuDts7QRsrxQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "0953bb1a609df63013176e3463393f8df993d3ef",
|
||||
"rev": "60a624466c08787ee8303393b7d4752d1826f14f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -118,11 +258,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1790689126,
|
||||
"narHash": "sha256-ilerN1WLSvF+HMjziC/Wv99J5y02maDH+6hZPwsORKg=",
|
||||
"lastModified": 1791594108,
|
||||
"narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "b4fd65b198c599cbe814fcb9f42d25d021595ec9",
|
||||
"rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -141,11 +281,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790541651,
|
||||
"narHash": "sha256-/496IQz8qNWHHLnc3Zvr0l4uxJ34igNhJhn7ZKAefFk=",
|
||||
"lastModified": 1791769517,
|
||||
"narHash": "sha256-OVx8OKPdW1fLfDi1oemFkfSvF354UwU5I0GXnNAGygw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "5980a626794486abad69fca7667f9c11dfbc3bd7",
|
||||
"rev": "84e901ee80e6523068dc3baf86cbf7cdcbf16902",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -161,11 +301,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1790718664,
|
||||
"narHash": "sha256-LWil4xgSyqIFZ9sydvL1glFOoiqAOknWUwykC4sqxuY=",
|
||||
"lastModified": 1791817518,
|
||||
"narHash": "sha256-DGVFzc0YXy38vCuS43PZPIkTVKaKxpNgzkNmJsHouP8=",
|
||||
"owner": "noctalia-dev",
|
||||
"repo": "noctalia-shell",
|
||||
"rev": "fd9759c892fe5034b682c185695f1bee121cd5b3",
|
||||
"rev": "02cb10745d6274e4a696a00308c8ef4cefa7416d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -174,6 +314,31 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nur": {
|
||||
"inputs": {
|
||||
"flake-parts": [
|
||||
"stylix",
|
||||
"flake-parts"
|
||||
],
|
||||
"nixpkgs": [
|
||||
"stylix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1785549842,
|
||||
"narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
@@ -203,7 +368,8 @@
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"nixvim": "nixvim",
|
||||
"noctalia": "noctalia"
|
||||
"noctalia": "noctalia",
|
||||
"stylix": "stylix"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
@@ -227,8 +393,57 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"stylix": {
|
||||
"inputs": {
|
||||
"base16": "base16",
|
||||
"base16-fish": "base16-fish",
|
||||
"base16-helix": "base16-helix",
|
||||
"base16-vim": "base16-vim",
|
||||
"firefox-gnome-theme": "firefox-gnome-theme",
|
||||
"flake-parts": "flake-parts_2",
|
||||
"gnome-shell": "gnome-shell",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nur": "nur",
|
||||
"systems": "systems_2",
|
||||
"tinted-kitty": "tinted-kitty",
|
||||
"tinted-schemes": "tinted-schemes",
|
||||
"tinted-tmux": "tinted-tmux",
|
||||
"tinted-zed": "tinted-zed"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1791574276,
|
||||
"narHash": "sha256-UMnLnZ3JlA7UTBNNNx1rNsXYoPP/cirXLCKGiQ/yDx8=",
|
||||
"owner": "nix-community",
|
||||
"repo": "stylix",
|
||||
"rev": "2856c4c6a845b9bec98828ef197abe176e4806bb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "stylix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1791244623,
|
||||
"narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"ref": "future-26.11",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1774449309,
|
||||
"narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
|
||||
@@ -243,6 +458,70 @@
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-kitty": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1735730497,
|
||||
"narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-kitty",
|
||||
"rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-kitty",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-schemes": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1785153830,
|
||||
"narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "schemes",
|
||||
"rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "schemes",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-tmux": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1785031658,
|
||||
"narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-tmux",
|
||||
"rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "tinted-tmux",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tinted-zed": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1785030526,
|
||||
"narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-zed",
|
||||
"rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "tinted-theming",
|
||||
"repo": "base16-zed",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
@@ -23,6 +23,10 @@
|
||||
url = "github:nix-community/nixvim";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
stylix = {
|
||||
url = "github:nix-community/stylix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
@@ -30,6 +34,7 @@
|
||||
nixpkgs,
|
||||
home-manager,
|
||||
nixvim,
|
||||
stylix,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
@@ -49,6 +54,7 @@
|
||||
home-manager.extraSpecialArgs = { inherit inputs; };
|
||||
home-manager.users.aaron.imports = [
|
||||
nixvim.homeModules.nixvim
|
||||
stylix.homeModules.stylix
|
||||
./users/aaron/home.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -12,6 +12,7 @@
|
||||
../../modules/nixos/data-drives.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/greetd.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -23,6 +24,7 @@
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/thunar.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
|
||||
@@ -24,6 +24,7 @@
|
||||
../../modules/nixos/services.nix
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
@@ -31,6 +32,13 @@
|
||||
# host-specific niri config (input devices, laptop binds)
|
||||
home-manager.users.aaron.imports = [ ./niri.nix ];
|
||||
|
||||
# hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
|
||||
services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
|
||||
|
||||
# bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
|
||||
# what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
|
||||
boot.lanzaboote.settings.console-mode = "6";
|
||||
|
||||
networking.hostName = "krypton";
|
||||
system.stateVersion = "26.05"; # don't change
|
||||
}
|
||||
|
||||
@@ -17,6 +17,7 @@
|
||||
../../modules/nixos/certificates.nix
|
||||
../../modules/nixos/docker.nix
|
||||
../../modules/nixos/gnupg.nix
|
||||
../../modules/nixos/lanzaboote.nix
|
||||
../../modules/nixos/locales.nix
|
||||
../../modules/nixos/networking.nix
|
||||
../../modules/nixos/niri.nix
|
||||
@@ -28,6 +29,7 @@
|
||||
../../modules/nixos/services.nix
|
||||
../../modules/nixos/settings.nix
|
||||
../../modules/nixos/steam.nix
|
||||
../../modules/nixos/tpm-unlock.nix
|
||||
../../modules/nixos/users.nix
|
||||
../../modules/nixos/vial.nix
|
||||
];
|
||||
|
||||
@@ -4,13 +4,10 @@
|
||||
settings = {
|
||||
clipboard-paste-protection = false;
|
||||
clipboard-read = "allow";
|
||||
font-family = "0xProto Nerd Font Mono";
|
||||
font-size = 12;
|
||||
gtk-titlebar = false;
|
||||
scrollback-limit = 100000;
|
||||
shell-integration = "zsh";
|
||||
shell-integration-features = "ssh-env,ssh-terminfo";
|
||||
theme = "noctalia"; # generated by noctalia-shell
|
||||
window-decoration = "auto";
|
||||
window-padding-x = 10;
|
||||
window-padding-y = 10;
|
||||
|
||||
@@ -14,6 +14,7 @@ let
|
||||
signingKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
|
||||
];
|
||||
in
|
||||
{
|
||||
|
||||
@@ -2,7 +2,12 @@
|
||||
# come from modules/nixos/niri.nix. Outputs and input devices that differ
|
||||
# per machine live in hosts/<host>/niri.nix.
|
||||
|
||||
{ lib, osConfig, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
osConfig,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
# Mod+1..9 focus a workspace, Mod+Ctrl+1..9 move the column there
|
||||
@@ -18,6 +23,9 @@ let
|
||||
_props.allow-when-locked = true;
|
||||
spawn-sh = cmd;
|
||||
};
|
||||
|
||||
# niri has no stylix target, so the colors are picked here
|
||||
colors = config.lib.stylix.colors.withHashtag;
|
||||
in
|
||||
{
|
||||
wayland.windowManager.niri = {
|
||||
@@ -61,9 +69,9 @@ in
|
||||
focus-ring = {
|
||||
on = { };
|
||||
width = 2;
|
||||
active-color = "#4c566a";
|
||||
inactive-color = "#2e3440";
|
||||
urgent-color = "#a3be8c";
|
||||
active-color = colors.base03;
|
||||
inactive-color = colors.base00;
|
||||
urgent-color = colors.base0B;
|
||||
};
|
||||
|
||||
border.off = { };
|
||||
|
||||
@@ -23,7 +23,7 @@
|
||||
|
||||
# nvim mapleader for all command below
|
||||
globals.mapleader = " ";
|
||||
# set colorscheme to nord
|
||||
# set colorscheme to nord, stylix's base16 version is disabled in stylix.nix
|
||||
colorschemes.nord.enable = true;
|
||||
|
||||
# nvim plugins
|
||||
|
||||
@@ -14,13 +14,7 @@
|
||||
|
||||
# settings is rendered to ~/.config/noctalia/config.toml
|
||||
settings = {
|
||||
# theme / colors
|
||||
theme = {
|
||||
source = "builtin";
|
||||
builtin = "Nord";
|
||||
mode = "dark";
|
||||
templates.builtin_ids = [ "ghostty" ];
|
||||
};
|
||||
# theme / colors come from stylix, see stylix.nix
|
||||
|
||||
# general
|
||||
shell = {
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
discord
|
||||
fastfetch
|
||||
keepassxc
|
||||
signal-desktop
|
||||
teamspeak6-client
|
||||
typst
|
||||
zathura
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
gtk = {
|
||||
enable = true;
|
||||
theme = {
|
||||
name = "Adwaita-dark";
|
||||
package = pkgs.gnome-themes-extra;
|
||||
};
|
||||
gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
|
||||
gtk4.theme = null;
|
||||
gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
|
||||
};
|
||||
|
||||
qt = {
|
||||
enable = true;
|
||||
platformTheme.name = "qt6";
|
||||
style = {
|
||||
name = "adwaita-dark";
|
||||
package = pkgs.adwaita-qt;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
# One Nord palette for everything stylix has a target for: gtk, qt,
|
||||
# noctalia, ghostty. Niri has no target and reads the colors in niri.nix.
|
||||
# Only the home-manager module is used, so boot, console and sddm are left alone.
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
stylix = {
|
||||
enable = true;
|
||||
base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
|
||||
polarity = "dark";
|
||||
|
||||
fonts = {
|
||||
monospace = {
|
||||
name = "0xProto Nerd Font Mono";
|
||||
package = pkgs.nerd-fonts._0xproto;
|
||||
};
|
||||
sizes.terminal = 12;
|
||||
};
|
||||
|
||||
# its overlays (nixos-icons, gtksourceview) clash with useGlobalPkgs
|
||||
overlays.enable = false;
|
||||
|
||||
targets = {
|
||||
# profiles aren't managed by home-manager, declaring one here would
|
||||
# take over the existing profile
|
||||
firefox.enable = false;
|
||||
# the bar keeps 0xProto instead of the sans-serif font
|
||||
noctalia.fonts.enable = false;
|
||||
# nord.nvim is calmer than the base16 palette, e.g. no line number
|
||||
# background, see nixvim.nix
|
||||
nixvim.enable = false;
|
||||
# the hand-built status line in tmux.nix uses ANSI color names, which
|
||||
# already follow the terminal palette
|
||||
tmux.enable = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,6 +4,8 @@
|
||||
# set bootloader to systemd
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
# no kernel command line editing at the boot menu (e.g. init=/bin/sh)
|
||||
systemd-boot.editor = false;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -12,4 +12,10 @@
|
||||
registry-mirrors = [ "https://mirror.gcr.io" ];
|
||||
};
|
||||
};
|
||||
|
||||
# k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
|
||||
systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
|
||||
|
||||
# let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
|
||||
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
|
||||
# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
|
||||
# so this needs lanzaboote.nix. Enrolled once per host with
|
||||
# `systemd-cryptenroll`, see INSTALLATION.md.
|
||||
|
||||
{
|
||||
boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
../../modules/home-manager/noctalia.nix
|
||||
../../modules/home-manager/programs.nix
|
||||
../../modules/home-manager/shell.nix
|
||||
../../modules/home-manager/styling.nix
|
||||
../../modules/home-manager/stylix.nix
|
||||
../../modules/home-manager/tmux.nix
|
||||
];
|
||||
|
||||
|
||||
Reference in New Issue
Block a user