schmittlauch/nixconfigs
2
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Compare commits

base: schmittlauch:0639633b0d46d08dfbf4b095b90490f1d1c827c6
Branches Tags
schmittlauch:mainline
schmittlauch:darwin-patch-nodejs_20
schmittlauch:workmac
schmittlauch:amd-pmf-debugging
schmittlauch:modularise-config
schmittlauch:flake-conversion
...
compare: schmittlauch:317aeb248e87bd1e1df3f660fd1af13ebd910250
Branches Tags
schmittlauch:mainline
schmittlauch:darwin-patch-nodejs_20
schmittlauch:workmac
schmittlauch:amd-pmf-debugging
schmittlauch:modularise-config
schmittlauch:flake-conversion

3 commits
0639633b0d ... 317aeb248e

Author SHA1 Message Date
Trolli Schmittlauch 317aeb248e [flake lock update] 2024-01-10 13:28:53 +01:00
Trolli Schmittlauch 27100bacb7 modularise flake config: fix and modularise home-manager config generation 
unfortunately, homeConfigurations do not follow the pattern of having system-specific sub-attrs and thus are dependent on a specific system per-se.
 2024-01-10 13:28:52 +01:00
Trolli Schmittlauch 993308a2d3 start modularising NixOS config for several hosts 
First step in modularising the NixOS config, with a focus on separation of host-specific and common configs.
Common modules still need to be split up and refined, several TODOs and FIXUPs remain in code. But the config builds fine on thinknix.

Roughly based on/ inspired by https://johns.codes/blog/organizing-system-configs-with-nixos#using-nixos
 2024-01-10 13:24:48 +01:00
11 changed files with 261 additions and 179 deletions
Show stats Expand all files Collapse all files

52
nixos/configuration.nix → common/default.nix
View file

@ -1,21 +1,14 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running `nixos-help`).
{ config, pkgs, lib, inputs, ... }:
let
unstable = inputs.nixos-unstable;
localfork = import /home/spiollinux/src/nixpkgs { };
in
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./modules/packages.nix
./modules/nitrokey.nix
./packages.nix
./nitrokey.nix
];
services.davfs2.enable = true;
@ -23,45 +16,13 @@ in
# try newer kernels
#boot.kernelPackages = pkgs.linuxPackages_latest;
services.fstrim.enable = true;
services.btrfs.autoScrub =
{
enable = true;
fileSystems = [ "/" "/home" ];
};
# exfat support
#boot.extraModulePackages = [ config.boot.kernelPackages.exfat-nofuse ];
zramSwap =
{
enable = true;
memoryPercent = 20;
};
boot.kernel.sysctl."vm.swappiness" = 9;
boot.loader.efi.canTouchEfiVariables = true;
# UEFI secure boot
environment.systemPackages = [
pkgs.sbctl
];
# Lanzaboote currently replaces the systemd-boot module.
# This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false
# for now.
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
# make the boot look good
boot.plymouth.enable = true;
networking.hostName = "thinknix";
# configure console
console = {
font = "Lat2-Terminus16";
@ -102,6 +63,7 @@ in
# networking.firewall.allowedUDPPorts = [ ... ];
networking.firewall.allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
networking.firewall.allowedUDPPortRanges = [{ from = 1714; to = 1764; }]; # for KDE connect
# FIXME: kdeconnect module
# Or disable the firewall altogether.
# networking.firewall.enable = false;
@ -183,6 +145,7 @@ in
};
# FIXME: at some point, hide GUI and sound (desktop vs. server) behind an option
# Enable the X11 windowing system.
services.xserver.enable = true;
services.xserver.layout = "de";
@ -198,7 +161,7 @@ in
services.xserver.displayManager.sddm.enable = true;
services.xserver.desktopManager.plasma5.enable = true;
# dconf required for several Gnome applications like Cawbird
# dconf required for several Gnome applications
programs.dconf.enable = true;
programs.firefox.enable = true; # enables support for automatically setting additionsl nativeMessagingHosts
@ -301,10 +264,5 @@ in
# stop NetworkManager from managing virtual interfaces
networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you
# should.
system.stateVersion = "18.09"; # Did you read the comment?
}

0
nixos/modules/nitrokey.nix → common/nitrokey.nix
View file

0
nixos/modules/packages.nix → common/packages.nix
View file

100
flake.lock
View file

@ -74,6 +74,22 @@
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1701680307,
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
"path": "/nix/store/pgid9c9xfcrbqx2giry0an0bi0df7s5c-source",
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
"type": "path"
},
"original": {
"id": "flake-utils",
"type": "indirect"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1681202837,
"narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
@ -117,11 +133,11 @@
]
},
"locked": {
"lastModified": 1703113038,
"narHash": "sha256-oxkyzjpD+mNT7arzU/zHrkNHLuY9tKwmnD2MNaZiSDw=",
"lastModified": 1704099619,
"narHash": "sha256-QRVMkdxLmv+aKGjcgeEg31xtJEIsYq4i1Kbyw5EPS6g=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "0c2353d5d930c3d93724df6858aef064a31b3c00",
"rev": "7e398b3d76bc1503171b1364c9d4a07ac06f3851",
"type": "github"
},
"original": {
@ -136,7 +152,7 @@
"crane": "crane",
"flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"flake-utils": "flake-utils",
"flake-utils": "flake-utils_2",
"nixpkgs": "nixpkgs",
"pre-commit-hooks-nix": "pre-commit-hooks-nix",
"rust-overlay": "rust-overlay"
@ -190,11 +206,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1702453208,
"narHash": "sha256-0wRi9SposfE2wHqjuKt8WO2izKB/ASDOV91URunIqgo=",
"lastModified": 1704786394,
"narHash": "sha256-aJM0ln9fMGWw1+tjyl5JZWZ3ahxAA2gw2ZpZY/hkEMs=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "7763c6fd1f299cb9361ff2abf755ed9619ef01d6",
"rev": "b34a6075e9e298c4124e35c3ccaf2210c1f3a43b",
"type": "github"
},
"original": {
@ -206,11 +222,11 @@
},
"nixos-unstable": {
"locked": {
"lastModified": 1703013332,
"narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
"lastModified": 1704538339,
"narHash": "sha256-1734d3mQuux9ySvwf6axRWZRBhtcZA9Q8eftD6EZg6U=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
"rev": "46ae0210ce163b3cba6c7da08840c1d63de9c701",
"type": "github"
},
"original": {
@ -254,11 +270,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1703068421,
"narHash": "sha256-WSw5Faqlw75McIflnl5v7qVD/B3S2sLh+968bpOGrWA=",
"lastModified": 1704420045,
"narHash": "sha256-C36QmoJd5tdQ5R9MC1jM7fBkZW9zBUqbUCsgwS6j4QU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d65bceaee0fb1e64363f7871bc43dc1c6ecad99f",
"rev": "c1be43e8e837b8dbee2b3665a007e761680f0c3d",
"type": "github"
},
"original": {
@ -270,11 +286,11 @@
},
"nur": {
"locked": {
"lastModified": 1703159048,
"narHash": "sha256-TcW0kf7nd/OEZwwxPs1y07YU4oZe18ezolScRbXXWZA=",
"lastModified": 1704840324,
"narHash": "sha256-Bt16Bq+o/HgBi4T9bvvFGvQ6IxAZ+w0LD5gQwm5vPnA=",
"owner": "nix-community",
"repo": "NUR",
"rev": "9ef37017837733a76fe18680264fcd815df1eea6",
"rev": "4657978e02a45a3f90dcba0f5a878d8d4ff439a5",
"type": "github"
},
"original": {
@ -316,6 +332,7 @@
},
"root": {
"inputs": {
"flake-utils": "flake-utils",
"home-manager": "home-manager",
"lanzaboote": "lanzaboote",
"logseq-fix-nixpkgs": "logseq-fix-nixpkgs",
@ -323,7 +340,8 @@
"nixos-hardware": "nixos-hardware",
"nixos-unstable": "nixos-unstable",
"nixpkgs": "nixpkgs_2",
"nur": "nur"
"nur": "nur",
"utils": "utils"
}
},
"rust-overlay": {
@ -365,6 +383,54 @@
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_3": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": {
"inputs": {
"systems": "systems_3"
},
"locked": {
"lastModified": 1701680307,
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
}
},
"root": "root",

46
flake.nix
View file

@ -14,6 +14,7 @@
url = "github:nix-community/lanzaboote/v0.3.0";
# deliberately do _not_ follow the nixpkgs input here, because paranoia and test coverage
};
utils.url = "github:numtide/flake-utils";
nur.url = "github:nix-community/NUR";
# TODO: possible make this a flake as well
@ -25,42 +26,47 @@
};
outputs =
{ self, nixpkgs, nur, lanzaboote, ... }@inputs:
{ self, nixpkgs, nur, lanzaboote, flake-utils, home-manager, ... }@inputs:
let
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
in
{
nixosConfigurations.thinknix = nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./nixos/configuration.nix lanzaboote.nixosModules.lanzaboote ];
# necessary to make the top-level inputs available to system configuration
specialArgs = {
#TODO: for system, consider moving to flake-utils
inherit inputs system;
};
# FIXME: allow different systems
systems = flake-utils.lib.system;
# necessary to make the top-level inputs available to system configuration
defaultModules = [
{ _module.args = { inherit inputs; }; }
];
mkSystem = system: extraModules:
nixpkgs.lib.nixosSystem rec {
modules = defaultModules ++ extraModules;
inherit system;
};
homeConfigurations.spiollinux = inputs.home-manager.lib.homeManagerConfiguration {
inherit pkgs;
mkHomeManager = confName: user: system: # unfortunately, home-manager configs are still system-specific
# FIXME: this is thus still linux-x86_64 specific
home-manager.lib.homeManagerConfiguration {
pkgs = nixpkgs.legacyPackages.${system};
modules = [
{
imports = [
nur.hmModules.nur
# TODO: $name can be utilised to conditionally load other config files
./home/home.nix
];
# extends the home config
home.username = "spiollinux";
home.homeDirectory = "/home/spiollinux";
home.username = user;
home.homeDirectory = "/home/${user}";
}
];
# Optionally use extraSpecialArgs
# to pass through arguments to home.nix
extraSpecialArgs = {
#TODO: for system, consider moving to flake-utils
inherit inputs system;
};
};
in
{
nixosConfigurations = {
thinknix = mkSystem systems.x86_64-linux [ ./hosts/thinknix inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t440s lanzaboote.nixosModules.lanzaboote ];
framenix = mkSystem systems.x86_64-linux [ ./hosts/framenix inputs.nixos-hardware.nixosModules.framework-13-7040-amd lanzaboote.nixosModules.lanzaboote ];
};
homeConfigurations.spiollinux = mkHomeManager "spiollinux" "spiollinux" systems.x86_64-linux;
};
}

28
hosts/thinknix/default.nix Normal file
View file

@ -0,0 +1,28 @@
{ config, lib, pkgs, inputs, ...}:
{
imports = [
../../common
./hardware-configuration.nix
./storage.nix
./swap.nix
# FIXME: move this to common, conditional enabling
./secureboot.nix
];
hardware.trackpoint = {
enable = true;
sensitivity = 180;
speed = 180;
};
networking.hostName = "thinknix";
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you
# should.
system.stateVersion = "18.09"; # Did you read the comment?
}

20
hosts/thinknix/hardware-configuration.nix Normal file
View file

@ -0,0 +1,20 @@
{ config, lib, pkgs, modulesPath, inputs, ... }:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [];
nix.settings.max-jobs = lib.mkDefault 4;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
# modesetting is always better than intel (legacy)
services.xserver.videoDrivers = [ "modesetting" ];
}

20
hosts/thinknix/secureboot.nix Normal file
View file

@ -0,0 +1,20 @@
{ config, lib, pkgs, inputs, ...}:
{
boot.loader.efi.canTouchEfiVariables = true;
# UEFI secure boot
environment.systemPackages = [
pkgs.sbctl
];
# Lanzaboote currently replaces the systemd-boot module.
# This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false
# for now.
boot.loader.systemd-boot.enable = lib.mkForce false;
boot.lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
}

67
hosts/thinknix/storage.nix Normal file
View file

@ -0,0 +1,67 @@
{ config, lib, pkgs, inputs, ...}:
let
fsOptions = [ "noatime" "ssd" "space_cache" "compress=zstd" ];
in
{
# encrypted partitions
boot.initrd.luks = {
devices =
# allow discards on all devices
builtins.mapAttrs (name: val: val // {allowDiscards = true;})
{
"system".device = "/dev/disk/by-uuid/85154131-b2a8-4ef5-9d74-47429cb267ef";
"cryptswap".device = "/dev/disk/by-uuid/ac586df6-6332-4809-beb1-f51906a2adaa";
"ssd2".device = "/dev/disk/by-uuid/cadd4e1f-3642-4faa-8d4e-37dd85465df1";
};
reusePassphrases = true;
};
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=nixos_root" ];
};
"/boot" = {
device = "/dev/disk/by-uuid/DED9-661B";
fsType = "vfat";
options = [ "discard" ];
};
"/home" = {
device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=home" ];
};
"/var/tmp" = {
device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=vartmp" ];
};
"/var/log" = {
device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=varlog" ];
};
"/var/cache" = {
device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=varcache" ];
};
};
services.fstrim.enable = true;
services.btrfs.autoScrub = {
enable = true;
fileSystems = [ "/" "/home" ];
};
boot.tmp.useTmpfs = true;
fileSystems."/tmp".fsType = "tmpfs";
}

12
hosts/thinknix/swap.nix Normal file
View file

@ -0,0 +1,12 @@
{
swapDevices = [
{ device = "/dev/disk/by-uuid/bf928178-4e92-4e7e-8df2-18fbd658eecf"; }
];
zramSwap = {
enable = true;
memoryPercent = 20;
};
boot.kernel.sysctl."vm.swappiness" = 9;
}

95
nixos/hardware-configuration.nix
View file

@ -1,95 +0,0 @@
{ config, lib, pkgs, modulesPath, inputs, ... }:
let
fsOptions = [ "noatime" "ssd" "space_cache" "compress=zstd" ];
in
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
(inputs.nixos-hardware + "/lenovo/thinkpad/t440s")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [];
# encrypted partitions
boot.initrd.luks =
{
devices =
# allow discards on all devices
builtins.mapAttrs (name: val: val // {allowDiscards = true;})
{
"system".device = "/dev/disk/by-uuid/85154131-b2a8-4ef5-9d74-47429cb267ef";
"cryptswap".device = "/dev/disk/by-uuid/ac586df6-6332-4809-beb1-f51906a2adaa";
"ssd2".device = "/dev/disk/by-uuid/cadd4e1f-3642-4faa-8d4e-37dd85465df1";
};
reusePassphrases = true;
};
fileSystems."/" =
{
device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=nixos_root" ];
};
fileSystems."/boot" =
{
device = "/dev/disk/by-uuid/DED9-661B";
fsType = "vfat";
options = [ "discard" ];
};
fileSystems."/home" =
{
device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=home" ];
};
fileSystems."/var/tmp" =
{
device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=vartmp" ];
};
fileSystems."/var/log" =
{
device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=varlog" ];
};
fileSystems."/var/cache" =
{
device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
fsType = "btrfs";
options = fsOptions ++ [ "subvol=varcache" ];
};
boot.tmp.useTmpfs = true;
fileSystems."/tmp".fsType = "tmpfs";
swapDevices =
[
{ device = "/dev/disk/by-uuid/bf928178-4e92-4e7e-8df2-18fbd658eecf"; }
];
nix.settings.max-jobs = lib.mkDefault 4;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.trackpoint = {
enable = true;
sensitivity = 180;
speed = 180;
};
# modesetting is always better than intel (legacy)
services.xserver.videoDrivers = [ "modesetting" ];
}