flake.lock

@@ -74,22 +74,6 @@
       "inputs": {
         "systems": "systems"
       },
-      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "path": "/nix/store/pgid9c9xfcrbqx2giry0an0bi0df7s5c-source",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "path"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
       "locked": {
         "lastModified": 1681202837,
         "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
@@ -133,11 +117,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1704099619,
+        "lastModified": 1703113038,
-        "narHash": "sha256-QRVMkdxLmv+aKGjcgeEg31xtJEIsYq4i1Kbyw5EPS6g=",
+        "narHash": "sha256-oxkyzjpD+mNT7arzU/zHrkNHLuY9tKwmnD2MNaZiSDw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7e398b3d76bc1503171b1364c9d4a07ac06f3851",
+        "rev": "0c2353d5d930c3d93724df6858aef064a31b3c00",
         "type": "github"
       },
       "original": {
@@ -152,7 +136,7 @@
         "crane": "crane",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs",
         "pre-commit-hooks-nix": "pre-commit-hooks-nix",
         "rust-overlay": "rust-overlay"
@@ -206,11 +190,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1704786394,
+        "lastModified": 1702453208,
-        "narHash": "sha256-aJM0ln9fMGWw1+tjyl5JZWZ3ahxAA2gw2ZpZY/hkEMs=",
+        "narHash": "sha256-0wRi9SposfE2wHqjuKt8WO2izKB/ASDOV91URunIqgo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b34a6075e9e298c4124e35c3ccaf2210c1f3a43b",
+        "rev": "7763c6fd1f299cb9361ff2abf755ed9619ef01d6",
         "type": "github"
       },
       "original": {
@@ -222,11 +206,11 @@
     },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1704538339,
+        "lastModified": 1703013332,
-        "narHash": "sha256-1734d3mQuux9ySvwf6axRWZRBhtcZA9Q8eftD6EZg6U=",
+        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "46ae0210ce163b3cba6c7da08840c1d63de9c701",
+        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
         "type": "github"
       },
       "original": {
@@ -270,11 +254,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1704420045,
+        "lastModified": 1703068421,
-        "narHash": "sha256-C36QmoJd5tdQ5R9MC1jM7fBkZW9zBUqbUCsgwS6j4QU=",
+        "narHash": "sha256-WSw5Faqlw75McIflnl5v7qVD/B3S2sLh+968bpOGrWA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c1be43e8e837b8dbee2b3665a007e761680f0c3d",
+        "rev": "d65bceaee0fb1e64363f7871bc43dc1c6ecad99f",
         "type": "github"
       },
       "original": {
@@ -286,11 +270,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1704840324,
+        "lastModified": 1703159048,
-        "narHash": "sha256-Bt16Bq+o/HgBi4T9bvvFGvQ6IxAZ+w0LD5gQwm5vPnA=",
+        "narHash": "sha256-TcW0kf7nd/OEZwwxPs1y07YU4oZe18ezolScRbXXWZA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "4657978e02a45a3f90dcba0f5a878d8d4ff439a5",
+        "rev": "9ef37017837733a76fe18680264fcd815df1eea6",
         "type": "github"
       },
       "original": {
@@ -332,7 +316,6 @@
     },
     "root": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "logseq-fix-nixpkgs": "logseq-fix-nixpkgs",
@@ -340,8 +323,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixos-unstable": "nixos-unstable",
         "nixpkgs": "nixpkgs_2",
-        "nur": "nur",
+        "nur": "nur"
-        "utils": "utils"
       }
     },
     "rust-overlay": {
@@ -383,54 +365,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems_3"
-      },
-      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -14,7 +14,6 @@
       url = "github:nix-community/lanzaboote/v0.3.0";
       # deliberately do _not_ follow the nixpkgs input here, because paranoia and test coverage
     };
-    utils.url = "github:numtide/flake-utils";
 
       nur.url = "github:nix-community/NUR";
     # TODO: possible make this a flake as well
@@ -26,47 +25,42 @@
   };
 
   outputs = 
-  { self, nixpkgs, nur, lanzaboote, flake-utils, home-manager, ... }@inputs: 
+  { self, nixpkgs, nur, lanzaboote, ... }@inputs: 
   let
-    # FIXME: allow different systems
+    system = "x86_64-linux";
-    systems = flake-utils.lib.system;
+    pkgs = nixpkgs.legacyPackages.${system};
-    # necessary to make the top-level inputs available to system configuration
+  in
-    defaultModules = [
+  {
-      { _module.args = { inherit inputs; }; }
+
-    ];
+    nixosConfigurations.thinknix = nixpkgs.lib.nixosSystem {
-    mkSystem = system: extraModules:
+      inherit system;
-      nixpkgs.lib.nixosSystem rec {
+      modules = [ ./nixos/configuration.nix lanzaboote.nixosModules.lanzaboote ];
-        modules = defaultModules ++ extraModules;
+      # necessary to make the top-level inputs available to system configuration
-        inherit system;
+      specialArgs = {
+        #TODO: for system, consider moving to flake-utils
+        inherit inputs system;
+      };
     };
-    mkHomeManager = confName: user: system:  # unfortunately, home-manager configs are still system-specific
+    homeConfigurations.spiollinux = inputs.home-manager.lib.homeManagerConfiguration {
-    # FIXME: this is thus still linux-x86_64 specific
+      inherit pkgs;
-    home-manager.lib.homeManagerConfiguration {
+
-      pkgs = nixpkgs.legacyPackages.${system};
       modules = [
         {
           imports = [
             nur.hmModules.nur
-            # TODO: $name can be utilised to conditionally load other config files
             ./home/home.nix
           ];
           # extends the home config
-          home.username = user;
+          home.username = "spiollinux";
-          home.homeDirectory = "/home/${user}";
+          home.homeDirectory = "/home/spiollinux";
         }
       ];
       # Optionally use extraSpecialArgs
       # to pass through arguments to home.nix
       extraSpecialArgs = {
+        #TODO: for system, consider moving to flake-utils
         inherit inputs system;
       };
     };
-  in
-  {
-    nixosConfigurations = {
-      thinknix = mkSystem systems.x86_64-linux [ ./hosts/thinknix inputs.nixos-hardware.nixosModules.lenovo-thinkpad-t440s lanzaboote.nixosModules.lanzaboote ];
-      framenix = mkSystem systems.x86_64-linux [ ./hosts/framenix inputs.nixos-hardware.nixosModules.framework-13-7040-amd lanzaboote.nixosModules.lanzaboote ];
-    };
-    homeConfigurations.spiollinux = mkHomeManager "spiollinux" "spiollinux" systems.x86_64-linux;
   };
 }

hosts/thinknix/default.nix

@@ -1,28 +0,0 @@
-{ config, lib, pkgs, inputs, ...}:
-{
-  imports = [
-    ../../common
-
-    ./hardware-configuration.nix
-    ./storage.nix
-    ./swap.nix
-    # FIXME: move this to common, conditional enabling
-    ./secureboot.nix
-  ];
-
-
-  hardware.trackpoint = {
-    enable = true;
-    sensitivity = 180;
-    speed = 180;
-  };
-
-  networking.hostName = "thinknix";
-
-
-  # This value determines the NixOS release with which your system is to be
-  # compatible, in order to avoid breaking some software such as database
-  # servers. You should change this only after NixOS release notes say you
-  # should.
-  system.stateVersion = "18.09"; # Did you read the comment?
-}

hosts/thinknix/hardware-configuration.nix

@@ -1,20 +0,0 @@
-{ config, lib, pkgs, modulesPath, inputs, ... }:
-
-
-{
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [];
-
-  nix.settings.max-jobs = lib.mkDefault 4;
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-
-  # modesetting is always better than intel (legacy)
-  services.xserver.videoDrivers = [ "modesetting" ];
-
-}

hosts/thinknix/secureboot.nix

@@ -1,20 +0,0 @@
-{ config, lib, pkgs, inputs, ...}:
-{  
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # UEFI secure boot
-  environment.systemPackages = [
-    pkgs.sbctl
-  ];
-  # Lanzaboote currently replaces the systemd-boot module.
-  # This setting is usually set to true in configuration.nix
-  # generated at installation time. So we force it to false
-  # for now.
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/etc/secureboot";
-  };
-
-}

hosts/thinknix/storage.nix

@@ -1,67 +0,0 @@
-{ config, lib, pkgs, inputs, ...}:
-let
-  fsOptions = [ "noatime" "ssd" "space_cache" "compress=zstd" ];
-in
-{
-  # encrypted partitions
-  boot.initrd.luks = {
-    devices =
-      # allow discards on all devices
-      builtins.mapAttrs (name: val: val // {allowDiscards = true;})
-      {
-        "system".device = "/dev/disk/by-uuid/85154131-b2a8-4ef5-9d74-47429cb267ef";
-        "cryptswap".device = "/dev/disk/by-uuid/ac586df6-6332-4809-beb1-f51906a2adaa";
-        "ssd2".device = "/dev/disk/by-uuid/cadd4e1f-3642-4faa-8d4e-37dd85465df1";
-      };
-      reusePassphrases = true;
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
-      fsType = "btrfs";
-      options = fsOptions ++ [ "subvol=nixos_root" ];
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/DED9-661B";
-      fsType = "vfat";
-      options = [ "discard" ];
-    };
-
-    "/home" = {
-      device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
-      fsType = "btrfs";
-      options = fsOptions ++ [ "subvol=home" ];
-    };
-
-    "/var/tmp" = {
-      device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
-      fsType = "btrfs";
-      options = fsOptions ++ [ "subvol=vartmp" ];
-    };
-
-    "/var/log" = {
-      device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
-      fsType = "btrfs";
-      options = fsOptions ++ [ "subvol=varlog" ];
-    };
-
-    "/var/cache" = {
-      device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
-      fsType = "btrfs";
-      options = fsOptions ++ [ "subvol=varcache" ];
-    };
-  };
-
-  services.fstrim.enable = true;
-  services.btrfs.autoScrub = {
-    enable = true;
-    fileSystems = [ "/" "/home" ];
-  };
-
-
-  boot.tmp.useTmpfs = true;
-  fileSystems."/tmp".fsType = "tmpfs";
-
-}

hosts/thinknix/swap.nix

@@ -1,12 +0,0 @@
-{
-  swapDevices = [
-    { device = "/dev/disk/by-uuid/bf928178-4e92-4e7e-8df2-18fbd658eecf"; }
-  ];
-
-  zramSwap = {
-    enable = true;
-    memoryPercent = 20;
-  };
-
-  boot.kernel.sysctl."vm.swappiness" = 9;
-}

nixos/configuration.nix

@@ -1,14 +1,21 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running `nixos-help`).
+
 { config, pkgs, lib, inputs, ... }:
 
 let
   unstable = inputs.nixos-unstable;
+  localfork = import /home/spiollinux/src/nixpkgs { };
 
 in
 {
   imports =
     [
-      ./packages.nix
+      # Include the results of the hardware scan.
-      ./nitrokey.nix
+      ./hardware-configuration.nix
+      ./modules/packages.nix
+      ./modules/nitrokey.nix
     ];
 
   services.davfs2.enable = true;
@@ -16,13 +23,45 @@ in
   # try newer kernels
   #boot.kernelPackages = pkgs.linuxPackages_latest;
 
+  services.fstrim.enable = true;
+  services.btrfs.autoScrub =
+    {
+      enable = true;
+      fileSystems = [ "/" "/home" ];
+    };
 
   # exfat support
   #boot.extraModulePackages = [ config.boot.kernelPackages.exfat-nofuse ];
 
+  zramSwap =
+    {
+      enable = true;
+      memoryPercent = 20;
+    };
+  boot.kernel.sysctl."vm.swappiness" = 9;
+
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # UEFI secure boot
+  environment.systemPackages = [
+    pkgs.sbctl
+  ];
+  # Lanzaboote currently replaces the systemd-boot module.
+  # This setting is usually set to true in configuration.nix
+  # generated at installation time. So we force it to false
+  # for now.
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/etc/secureboot";
+  };
+
   # make the boot look good
   boot.plymouth.enable = true;
 
+  networking.hostName = "thinknix";
+
   # configure console
   console = {
     font = "Lat2-Terminus16";
@@ -63,7 +102,6 @@ in
   # networking.firewall.allowedUDPPorts = [ ... ];
   networking.firewall.allowedTCPPortRanges = [{ from = 1714; to = 1764; }];
   networking.firewall.allowedUDPPortRanges = [{ from = 1714; to = 1764; }]; # for KDE connect
-  # FIXME: kdeconnect module
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
 
@@ -145,7 +183,6 @@ in
   };
 
 
-  # FIXME: at some point, hide GUI and sound (desktop vs. server) behind an option
   # Enable the X11 windowing system.
   services.xserver.enable = true;
   services.xserver.layout = "de";
@@ -161,7 +198,7 @@ in
   services.xserver.displayManager.sddm.enable = true;
   services.xserver.desktopManager.plasma5.enable = true;
 
-  # dconf required for several Gnome applications
+  # dconf required for several Gnome applications like Cawbird
   programs.dconf.enable = true;
   
   programs.firefox.enable = true;   # enables support for automatically setting additionsl nativeMessagingHosts
@@ -264,5 +301,10 @@ in
   # stop NetworkManager from managing virtual interfaces
   networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
 
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "18.09"; # Did you read the comment?
 
 }

nixos/hardware-configuration.nix

@@ -0,0 +1,95 @@
+{ config, lib, pkgs, modulesPath, inputs, ... }:
+
+
+let
+  fsOptions = [ "noatime" "ssd" "space_cache" "compress=zstd" ];
+in
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+      (inputs.nixos-hardware + "/lenovo/thinkpad/t440s")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [];
+
+  # encrypted partitions
+  boot.initrd.luks =
+    {
+      devices =
+        # allow discards on all devices
+        builtins.mapAttrs (name: val: val // {allowDiscards = true;})
+        {
+          "system".device = "/dev/disk/by-uuid/85154131-b2a8-4ef5-9d74-47429cb267ef";
+          "cryptswap".device = "/dev/disk/by-uuid/ac586df6-6332-4809-beb1-f51906a2adaa";
+          "ssd2".device = "/dev/disk/by-uuid/cadd4e1f-3642-4faa-8d4e-37dd85465df1";
+        };
+      reusePassphrases = true;
+    };
+
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
+      fsType = "btrfs";
+      options = fsOptions ++ [ "subvol=nixos_root" ];
+    };
+
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/DED9-661B";
+      fsType = "vfat";
+      options = [ "discard" ];
+    };
+
+  fileSystems."/home" =
+    {
+      device = "/dev/disk/by-uuid/cb5998ae-cfc9-447f-8756-1ceaec6ca4c4";
+      fsType = "btrfs";
+      options = fsOptions ++ [ "subvol=home" ];
+    };
+
+    fileSystems."/var/tmp" =
+      {
+        device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
+        fsType = "btrfs";
+        options = fsOptions ++ [ "subvol=vartmp" ];
+      };
+
+    fileSystems."/var/log" =
+      {
+        device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
+        fsType = "btrfs";
+        options = fsOptions ++ [ "subvol=varlog" ];
+      };
+
+    fileSystems."/var/cache" =
+      {
+        device = "/dev/disk/by-uuid/cd6b8f25-c029-49a6-b326-656faec3ce15";
+        fsType = "btrfs";
+        options = fsOptions ++ [ "subvol=varcache" ];
+      };
+
+    boot.tmp.useTmpfs = true;
+    fileSystems."/tmp".fsType = "tmpfs";
+
+  swapDevices =
+    [
+      { device = "/dev/disk/by-uuid/bf928178-4e92-4e7e-8df2-18fbd658eecf"; }
+    ];
+
+  nix.settings.max-jobs = lib.mkDefault 4;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  hardware.trackpoint = {
+    enable = true;
+    sensitivity = 180;
+    speed = 180;
+  };
+
+
+  # modesetting is always better than intel (legacy)
+  services.xserver.videoDrivers = [ "modesetting" ];
+
+}