unexplrd/nixos-blueprint
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modules/config: init new module

Browse Source 
Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
unexplrd
2025-05-04 16:58:22 +03:00
parent 6ae0a38f62
commit b55a50ada8
42 changed files with 220 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
hosts/dunamis/boot/default.nix
View File

@ -1,38 +0,0 @@
{
inputs,
pkgs,
...
}: {
imports = with inputs;
[
chaotic.nixosModules.default
lanzaboote.nixosModules.lanzaboote
]
++ [
./loader.nix
];
boot = {
plymouth.enable = true;
consoleLogLevel = 0;
kernelPackages = pkgs.linuxPackages_cachyos;
kernelParams = [
"amd_iommu=force_isolation"
"debugfs=off"
"efi=disable_early_pci_dma"
"gather_data_sampling=force"
"intel_iommu=on"
"iommu.passthrough=0"
"iommu.strict=1"
"iommu=force"
"page_alloc.shuffle=1"
"vsyscall=none"
# "ia32_emulation=0"
# "lockdown=confidentiality"
# "module.sig_enforce=1"
];
initrd = {
systemd.enable = true; # needed for auto-unlocking with TPM
systemd.tpm2.enable = true;
};
};
}

15
hosts/dunamis/boot/loader.nix
View File

@ -1,15 +0,0 @@
{config, ...}: {
boot = {
lanzaboote = {
enable = true;
pkiBundle = "/var/lib/sbctl";
};
loader = {
efi.canTouchEfiVariables = true;
systemd-boot = {
enable = !config.boot.lanzaboote.enable;
consoleMode = "auto";
};
};
};
}

33
hosts/dunamis/configuration.nix
View File

@ -1,34 +1,35 @@
{inputs, ...}: {
imports = with inputs; [
self.nixosModules.config
self.nixosModules.desktop
self.nixosModules.system
./boot
./disko
./hardware
./minecraft.nix
./networking
./nix
./programs.nix
./services.nix
./sops.nix
./users.nix
];
desktop.niri.enable = true;
networking = {
hostId = "c7f6c4a1";
hostName = "dunamis";
};
environment.memoryAllocator.provider = "mimalloc";
locale.ukrainian.enable = true;
system.stateVersion = "25.05";
time.timeZone = "Europe/Kyiv";
desktop.niri.enable = true;
module.config = {
secureBoot = true;
tpmDiskUnlock = true;
};
module.stylix = {
enable = true;
theme = "helios";
};
locale.ukrainian.enable = true;
opentabletdriver.enable = false;
qmk-vial.enable = true;
security.basic.enable = true;
system.stateVersion = "25.05";
time.timeZone = "Europe/Kyiv";
virtual.libvirt.enable = true;
wireless = {
bluetooth.enable = true;
bluetooth.enableBlueman = false;
};
}

6
hosts/dunamis/hardware/default.nix
View File

@ -1,6 +0,0 @@
{
imports = [
./facter.nix
./vaapi/intel-media-driver.nix
];
}

14
hosts/dunamis/hardware/facter.nix
View File

@ -1,14 +0,0 @@
{
config,
inputs,
...
}: let
inherit (inputs) mysecrets;
inherit (config.networking) hostName;
in {
imports = with inputs; [
nixos-facter-modules.nixosModules.facter
];
facter.reportPath = "${mysecrets}/facter/${hostName}.json";
systemd.network.wait-online.enable = false;
}

7
hosts/dunamis/hardware/vaapi/intel-media-driver.nix
View File

@ -1,7 +0,0 @@
{pkgs, ...}: {
hardware.graphics.extraPackages = with pkgs; [
intel-compute-runtime
intel-media-driver
vpl-gpu-rt
];
}

9
hosts/dunamis/networking/default.nix
View File

@ -1,9 +0,0 @@
{
imports = [
./network-manager.nix
./host-name-id.nix
];
networking = {
hosts = import ./hosts.nix;
};
}

6
hosts/dunamis/networking/host-name-id.nix
View File

@ -1,6 +0,0 @@
{
networking = {
hostId = "c7f6c4a1";
hostName = "dunamis";
};
}

3
hosts/dunamis/networking/hosts.nix
View File

@ -1,3 +0,0 @@
{
"192.168.1.42" = ["dunamis"];
}

7
hosts/dunamis/networking/network-manager.nix
View File

@ -1,7 +0,0 @@
{
networking.networkmanager = {
enable = true;
ethernet.macAddress = "stable";
};
};
}

11
hosts/dunamis/nix/common.nix
View File

@ -1,11 +0,0 @@
{pkgs, ...}: {
nix = {
package = pkgs.lixPackageSets.latest.lix;
channel.enable = false;
daemonCPUSchedPolicy = "idle";
settings = {
experimental-features = ["nix-command" "flakes"];
builders-use-substitutes = true;
};
};
}

7
hosts/dunamis/nix/default.nix
View File

@ -1,7 +0,0 @@
{
imports = [
./common.nix
./substituters.nix
./ssh-serve.nix
];
}

30
hosts/dunamis/nix/distributed-build.nix
View File

@ -1,30 +0,0 @@
{
config,
inputs,
...
}: let
inherit (builtins) readFile;
inherit (config.networking) hostName;
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
pubHost = readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
in {
nix = {
distributedBuilds = true;
buildMachines = [
{
hostName = "dunamis";
publicHostKey = pubHost;
sshKey = secrets."ssh-${hostName}-user".path;
sshUser = "nix-ssh";
supportedFeatures = [
"benchmark"
"big-parallel"
"kvm"
"nixos-test"
];
system = "x86_64-linux";
}
];
};
}

11
hosts/dunamis/nix/ssh-serve.nix
View File

@ -1,11 +0,0 @@
{config, ...}: let
inherit (builtins) readFile;
inherit (config.users.users) user;
in {
nix.settings.trusted-users = ["nix-ssh"];
nix.sshServe = {
enable = true;
write = true;
keys = map (f: readFile f) user.openssh.authorizedKeys.keyFiles;
};
}

16
hosts/dunamis/nix/substituters.nix
View File

@ -1,16 +0,0 @@
{
nix.settings = {
substituters = [
"https://cache.nixos.org/"
"https://chaotic-nyx.cachix.org/"
"https://cosmic.cachix.org/"
"https://nix-community.cachix.org/"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"chaotic-nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
"cosmic.cachix.org-1:Dya9IyXD4xdBehWjrkPv6rtxpmMdRel02smYzA85dPE="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
};
}

20
hosts/dunamis/programs.nix
View File

@ -1,20 +0,0 @@
{
pkgs,
lib,
...
}: {
programs = {
fish.enable = true;
mosh.enable = true;
nix-ld.enable = true;
nh = {
enable = true;
flake = "/home/user/.config/nixos";
};
};
environment.systemPackages = with pkgs; [
(lib.hiPrio uutils-coreutils-noprefix)
helix
nushell
];
}

35
hosts/dunamis/services.nix
View File

@ -1,35 +0,0 @@
{
services = {
# hardware.openrgb.enable = true;
flatpak.enable = true;
fwupd.enable = true;
openssh.enable = true;
syncthing.openDefaultPorts = true;
userborn.enable = true;
dnscrypt-proxy2 = {
enable = true;
settings = {
require_dnssec = true;
server_names = ["mullvad-doh"];
bootstrap_resolvers = ["9.9.9.11:53" "9.9.9.9:53"];
};
};
opensnitch = {
enable = false;
settings = {
DefaultAaction = "deny";
Firewall = "iptables";
InterceptUnknown = true;
ProcMonitorMethod = "ebpf";
};
};
scx = {
enable = true;
scheduler = "scx_flash";
};
logind = {
lidSwitch = "ignore";
powerKey = "suspend";
};
};
}

61
hosts/dunamis/sops.nix
View File

@ -1,61 +0,0 @@
{
config,
inputs,
...
}: let
inherit (inputs) mysecrets;
inherit (config.networking) hostName;
dotSsh = name: "/home/user/.ssh/" + name;
sopsFile = mysecrets + "/hosts/${hostName}.yaml";
sshKey = {
mode = "0400";
owner = "user";
};
in {
imports = with inputs; [
sops-nix.nixosModules.sops
];
sops = {
age = {
sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
keyFile = "/var/lib/sops-nix/key.txt";
generateKey = true;
};
defaultSopsFile = mysecrets + "/common.yaml";
secrets = {
"user-password-hashed".neededForUsers = true;
"ssh-config" = {
path = dotSsh "config";
mode = "0400";
owner = "user";
};
"ssh-${hostName}-user" = {
inherit sopsFile;
inherit (sshKey) mode owner;
path = dotSsh "id_ed25519";
};
"ssh-${hostName}-user.pub" = {
inherit sopsFile;
inherit (sshKey) mode owner;
path = dotSsh "id_ed25519.pub";
};
"ssh-unexplrd" = {
inherit (sshKey) mode owner;
path = dotSsh "id_unexplrd_ed25519";
};
"ssh-unexplrd.pub" = {
inherit (sshKey) mode owner;
path = dotSsh "id_unexplrd_ed25519.pub";
};
"ssh-uni" = {
inherit (sshKey) mode owner;
path = dotSsh "id_uni_ed25519";
};
"ssh-uni.pub" = {
inherit (sshKey) mode owner;
path = dotSsh "id_uni_ed25519.pub";
};
};
};
}

26
hosts/dunamis/users.nix
View File

@ -1,26 +0,0 @@
{
inputs,
config,
pkgs,
...
}: let
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
sshKeys = f: "${mysecrets}/ssh/user/id_${f}_ed25519.pub";
in {
users.mutableUsers = false;
users.users = {
user = {
hashedPasswordFile = secrets."user-password-hashed".path;
extraGroups = ["wheel" "video" "libvirtd" "dialout"];
isNormalUser = true;
shell = pkgs.fish;
openssh.authorizedKeys.keyFiles = map sshKeys [
"dunamis"
"eldrid"
"sarien"
"legion"
];
};
};
}