Major config overhaul: use custom modules, setup for multi-host config, and less boilerplate
This commit is contained in:
Emmet K
197
flake.lock
generated
197
flake.lock
generated
@ -389,39 +389,18 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager-stable": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs-stable"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726989464,
|
||||
"narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "release-24.05",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager-unstable": {
|
||||
"home-manager_2": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1738275749,
|
||||
"narHash": "sha256-PM+cGduJ05EZ+YXulqAwUFjvfKpPmW080mcuN6R1POw=",
|
||||
"lastModified": 1739044880,
|
||||
"narHash": "sha256-l+bzq9rsBIQQnBtGayJeOS30L53+mYPjgfQALi20XDg=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "a8159195bfaef3c64df75d3b1e6a68d49d392be9",
|
||||
"rev": "bf9a1a068919ccdfa7d130873936c5fd4c826e85",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -431,7 +410,7 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager_2": {
|
||||
"home-manager_3": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"stylix",
|
||||
@ -749,32 +728,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-formatter-pack": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-on-droid",
|
||||
"nixpkgs"
|
||||
],
|
||||
"nmd": [
|
||||
"nix-on-droid",
|
||||
"nmd"
|
||||
],
|
||||
"nmt": "nmt"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705252799,
|
||||
"narHash": "sha256-HgSTREh7VoXjGgNDwKQUYcYo13rPkltW7IitHrTPA5c=",
|
||||
"owner": "Gerschtli",
|
||||
"repo": "nix-formatter-pack",
|
||||
"rev": "2de39dedd79aab14c01b9e2934842051a160ffa5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Gerschtli",
|
||||
"repo": "nix-formatter-pack",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-github-actions": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@ -798,34 +751,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-on-droid": {
|
||||
"inputs": {
|
||||
"home-manager": [
|
||||
"home-manager-unstable"
|
||||
],
|
||||
"nix-formatter-pack": "nix-formatter-pack",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-docs": "nixpkgs-docs",
|
||||
"nixpkgs-for-bootstrap": "nixpkgs-for-bootstrap",
|
||||
"nmd": "nmd"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1725658585,
|
||||
"narHash": "sha256-P29z4Gt89n5ps1U7+qmIrj0BuRXGZQSIaOe2+tsPgfw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nix-on-droid",
|
||||
"rev": "5d88ff2519e4952f8d22472b52c531bb5f1635fc",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "master",
|
||||
"repo": "nix-on-droid",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1737929020,
|
||||
@ -842,38 +767,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-docs": {
|
||||
"locked": {
|
||||
"lastModified": 1705957679,
|
||||
"narHash": "sha256-Q8LJaVZGJ9wo33wBafvZSzapYsjOaNjP/pOnSiKVGHY=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9a333eaa80901efe01df07eade2c16d183761fa3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-23.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-for-bootstrap": {
|
||||
"locked": {
|
||||
"lastModified": 1720244366,
|
||||
"narHash": "sha256-WrDV0FPMVd2Sq9hkR5LNHudS3OSMmUrs90JUTN+MXpA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "49ee0e94463abada1de470c9c07bfc12b36dcf40",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "49ee0e94463abada1de470c9c07bfc12b36dcf40",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1738163270,
|
||||
@ -953,6 +846,18 @@
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 0,
|
||||
"narHash": "sha256-NGqpVVxNAHwIicXpgaVqJEJWeyqzoQJ9oc8lnK9+WC4=",
|
||||
"path": "/nix/store/pgg4vm83q0kr4hxzcwhdgdiv2yfnh3dw-source",
|
||||
"type": "path"
|
||||
},
|
||||
"original": {
|
||||
"id": "nixpkgs",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"nixpkgs_5": {
|
||||
"locked": {
|
||||
"lastModified": 1736798957,
|
||||
"narHash": "sha256-qwpCtZhSsSNQtK4xYGzMiyEDhkNzOCz/Vfu4oL2ETsQ=",
|
||||
@ -968,44 +873,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nmd": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nix-on-droid",
|
||||
"nixpkgs-docs"
|
||||
],
|
||||
"scss-reset": "scss-reset"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705050560,
|
||||
"narHash": "sha256-x3zzcdvhJpodsmdjqB4t5mkVW22V3wqHLOun0KRBzUI=",
|
||||
"owner": "~rycee",
|
||||
"repo": "nmd",
|
||||
"rev": "66d9334933119c36f91a78d565c152a4fdc8d3d3",
|
||||
"type": "sourcehut"
|
||||
},
|
||||
"original": {
|
||||
"owner": "~rycee",
|
||||
"repo": "nmd",
|
||||
"type": "sourcehut"
|
||||
}
|
||||
},
|
||||
"nmt": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1648075362,
|
||||
"narHash": "sha256-u36WgzoA84dMVsGXzml4wZ5ckGgfnvS0ryzo/3zn/Pc=",
|
||||
"owner": "rycee",
|
||||
"repo": "nmt",
|
||||
"rev": "d83601002c99b78c89ea80e5e6ba21addcfe12ae",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
"owner": "rycee",
|
||||
"repo": "nmt",
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
@ -1035,15 +902,14 @@
|
||||
"blocklist-hosts": "blocklist-hosts",
|
||||
"chaotic": "chaotic",
|
||||
"emacs-overlay": "emacs-overlay",
|
||||
"home-manager-stable": "home-manager-stable",
|
||||
"home-manager-unstable": "home-manager-unstable",
|
||||
"home-manager": "home-manager_2",
|
||||
"hyprland": "hyprland",
|
||||
"hyprlock": "hyprlock",
|
||||
"hyprutils": "hyprutils",
|
||||
"nix-on-droid": "nix-on-droid",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-stable": "nixpkgs-stable_3",
|
||||
"rust-overlay": "rust-overlay",
|
||||
"secrets": "secrets",
|
||||
"stylix": "stylix"
|
||||
}
|
||||
},
|
||||
@ -1082,20 +948,19 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"scss-reset": {
|
||||
"flake": false,
|
||||
"secrets": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1631450058,
|
||||
"narHash": "sha256-muDlZJPtXDIGevSEWkicPP0HQ6VtucbkMNygpGlBEUM=",
|
||||
"owner": "andreymatin",
|
||||
"repo": "scss-reset",
|
||||
"rev": "0cf50e27a4e95e9bb5b1715eedf9c54dee1a5a91",
|
||||
"type": "github"
|
||||
"lastModified": 1739133600,
|
||||
"narHash": "sha256-5xe63u5z/+yauwl/e++ZTDelVK0CBF32GborYfCuBl8=",
|
||||
"path": "/etc/nixos.secrets",
|
||||
"type": "path"
|
||||
},
|
||||
"original": {
|
||||
"owner": "andreymatin",
|
||||
"repo": "scss-reset",
|
||||
"type": "github"
|
||||
"path": "/etc/nixos.secrets",
|
||||
"type": "path"
|
||||
}
|
||||
},
|
||||
"stylix": {
|
||||
@ -1109,8 +974,8 @@
|
||||
"flake-utils": "flake-utils",
|
||||
"git-hooks": "git-hooks",
|
||||
"gnome-shell": "gnome-shell",
|
||||
"home-manager": "home-manager_2",
|
||||
"nixpkgs": "nixpkgs_4",
|
||||
"home-manager": "home-manager_3",
|
||||
"nixpkgs": "nixpkgs_5",
|
||||
"systems": "systems_4",
|
||||
"tinted-foot": "tinted-foot",
|
||||
"tinted-kitty": "tinted-kitty",
|
||||
|
||||
219
flake.nix
219
flake.nix
@ -3,57 +3,11 @@
|
||||
|
||||
outputs = inputs@{ self, ... }:
|
||||
let
|
||||
# ---- SYSTEM SETTINGS ---- #
|
||||
systemSettings = {
|
||||
system = "x86_64-linux"; # system arch
|
||||
hostname = "snowfire"; # hostname
|
||||
profile = "personal"; # select a profile defined from my profiles directory
|
||||
timezone = "America/Chicago"; # select timezone
|
||||
locale = "en_US.UTF-8"; # select locale
|
||||
bootMode = "uefi"; # uefi or bios
|
||||
bootMountPath = "/boot"; # mount path for efi boot partition; only used for uefi boot mode
|
||||
grubDevice = ""; # device identifier for grub; only used for legacy (bios) boot mode
|
||||
gpuType = "amd"; # amd, intel or nvidia; only makes some slight mods for amd at the moment
|
||||
};
|
||||
|
||||
# ----- USER SETTINGS ----- #
|
||||
userSettings = rec {
|
||||
username = "emmet"; # username
|
||||
name = "Emmet"; # name/identifier
|
||||
email = "emmet@librephoenix.com"; # email (used for certain configurations)
|
||||
dotfilesDir = "~/.dotfiles"; # absolute path of the local repo
|
||||
theme = "io"; # selcted theme from my themes directory (./themes/)
|
||||
wm = "hyprland"; # Selected window manager or desktop environment; must select one in both ./user/wm/ and ./system/wm/
|
||||
# window manager type (hyprland or x11) translator
|
||||
wmType = if (wm == "hyprland") then "wayland" else "x11";
|
||||
browser = "qutebrowser"; # Default browser; must select one from ./user/app/browser/
|
||||
spawnBrowser = if ((browser == "qutebrowser") && (wm == "hyprland")) then "qutebrowser-hyprprofile" else (if (browser == "qutebrowser") then "qutebrowser --qt-flag ignore-gpu-blacklist --qt-flag enable-gpu-rasterization --qt-flag enable-native-gpu-memory-buffers --qt-flag enable-accelerated-2d-canvas --qt-flag num-raster-threads=4" else browser); # Browser spawn command must be specail for qb, since it doesn't gpu accelerate by default (why?)
|
||||
defaultRoamDir = "Personal.p"; # Default org roam directory relative to ~/Org
|
||||
term = "alacritty"; # Default terminal command;
|
||||
font = "Intel One Mono"; # Selected font
|
||||
fontPkg = pkgs.intel-one-mono; # Font package
|
||||
editor = "emacsclient"; # Default editor;
|
||||
# editor spawning translator
|
||||
# generates a command that can be used to spawn editor inside a gui
|
||||
# EDITOR and TERM session variables must be set in home.nix or other module
|
||||
# I set the session variable SPAWNEDITOR to this in my home.nix for convenience
|
||||
spawnEditor = if (editor == "emacsclient") then
|
||||
"emacsclient -c -a 'emacs'"
|
||||
else
|
||||
(if ((editor == "vim") ||
|
||||
(editor == "nvim") ||
|
||||
(editor == "nano")) then
|
||||
"exec " + term + " -e " + editor
|
||||
else
|
||||
(if (editor == "neovide") then
|
||||
"neovide -- --listen /tmp/nvimsocket"
|
||||
else
|
||||
editor));
|
||||
};
|
||||
system = "x86_64-linux";
|
||||
|
||||
# create patched nixpkgs
|
||||
nixpkgs-patched =
|
||||
(import inputs.nixpkgs { system = systemSettings.system; }).applyPatches {
|
||||
(import inputs.nixpkgs { inherit system; }).applyPatches {
|
||||
name = "nixpkgs-patched";
|
||||
src = inputs.nixpkgs;
|
||||
patches = [ ];
|
||||
@ -62,135 +16,63 @@
|
||||
# configure pkgs
|
||||
# use nixpkgs if running a server (homelab or worklab profile)
|
||||
# otherwise use patched nixos-unstable nixpkgs
|
||||
pkgs = (if ((systemSettings.profile == "homelab") || (systemSettings.profile == "worklab"))
|
||||
then
|
||||
pkgs-stable
|
||||
else
|
||||
(import nixpkgs-patched {
|
||||
system = systemSettings.system;
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
allowUnfreePredicate = (_: true);
|
||||
};
|
||||
overlays = [ inputs.rust-overlay.overlays.default
|
||||
inputs.emacs-overlay.overlays.default
|
||||
];
|
||||
}));
|
||||
|
||||
pkgs-stable = import inputs.nixpkgs-stable {
|
||||
system = systemSettings.system;
|
||||
pkgs = import nixpkgs-patched {
|
||||
inherit system;
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
allowUnfreePredicate = (_: true);
|
||||
};
|
||||
overlays = [ inputs.rust-overlay.overlays.default inputs.emacs-overlay.overlays.default ];
|
||||
};
|
||||
|
||||
pkgs-unstable = import inputs.nixpkgs-patched {
|
||||
system = systemSettings.system;
|
||||
pkgs-stable = import inputs.nixpkgs-stable {
|
||||
inherit system;
|
||||
config = {
|
||||
allowUnfree = true;
|
||||
allowUnfreePredicate = (_: true);
|
||||
};
|
||||
overlays = [ inputs.rust-overlay.overlays.default ];
|
||||
};
|
||||
|
||||
# configure lib
|
||||
# use nixpkgs if running a server (homelab or worklab profile)
|
||||
# otherwise use patched nixos-unstable nixpkgs
|
||||
lib = (if ((systemSettings.profile == "homelab") || (systemSettings.profile == "worklab"))
|
||||
then
|
||||
inputs.nixpkgs-stable.lib
|
||||
else
|
||||
inputs.nixpkgs.lib);
|
||||
lib = inputs.nixpkgs.lib;
|
||||
|
||||
# use home-manager-stable if running a server (homelab or worklab profile)
|
||||
# otherwise use home-manager-unstable
|
||||
home-manager = (if ((systemSettings.profile == "homelab") || (systemSettings.profile == "worklab"))
|
||||
then
|
||||
inputs.home-manager-stable
|
||||
else
|
||||
inputs.home-manager-unstable);
|
||||
|
||||
# Systems that can run tests:
|
||||
supportedSystems = [ "aarch64-linux" "i686-linux" "x86_64-linux" ];
|
||||
|
||||
# Function to generate a set based on supported systems:
|
||||
forAllSystems = inputs.nixpkgs.lib.genAttrs supportedSystems;
|
||||
|
||||
# Attribute set of nixpkgs for each system:
|
||||
nixpkgsFor =
|
||||
forAllSystems (system: import inputs.nixpkgs { inherit system; });
|
||||
# create a list of all directories inside of ./hosts
|
||||
# every directory in ./hosts has config for that machine
|
||||
hosts = builtins.filter (x: x != null) (lib.mapAttrsToList (name: value: if (value == "directory") then name else null) (builtins.readDir ./hosts));
|
||||
|
||||
in {
|
||||
homeConfigurations = {
|
||||
user = home-manager.lib.homeManagerConfiguration {
|
||||
inherit pkgs;
|
||||
modules = [
|
||||
(./. + "/profiles" + ("/" + systemSettings.profile) + "/home.nix") # load home.nix from selected PROFILE
|
||||
inputs.chaotic.homeManagerModules.default
|
||||
];
|
||||
extraSpecialArgs = {
|
||||
# pass config variables from above
|
||||
inherit pkgs-stable;
|
||||
inherit pkgs-unstable;
|
||||
inherit systemSettings;
|
||||
inherit userSettings;
|
||||
inherit inputs;
|
||||
# generate a nixos configuration for every host in ./hosts
|
||||
nixosConfigurations = builtins.listToAttrs
|
||||
(map (host: {
|
||||
name = host;
|
||||
value = lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
# host specific config
|
||||
{ config.networking.hostName = host; }
|
||||
(./hosts + "/${host}")
|
||||
|
||||
# my modules
|
||||
./modules/system
|
||||
|
||||
# home manager
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
{ home-manager.extraSpecialArgs = {
|
||||
inherit pkgs;
|
||||
inherit pkgs-stable;
|
||||
inherit inputs;
|
||||
};
|
||||
}
|
||||
|
||||
# chaos... control!
|
||||
inputs.chaotic.nixosModules.default
|
||||
];
|
||||
specialArgs = {
|
||||
inherit pkgs-stable;
|
||||
inherit inputs;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
nixosConfigurations = {
|
||||
system = lib.nixosSystem {
|
||||
system = systemSettings.system;
|
||||
modules = [
|
||||
(./. + "/profiles" + ("/" + systemSettings.profile) + "/configuration.nix")
|
||||
./system/bin/phoenix.nix
|
||||
inputs.chaotic.nixosModules.default
|
||||
]; # load configuration.nix from selected PROFILE
|
||||
specialArgs = {
|
||||
# pass config variables from above
|
||||
inherit pkgs-stable;
|
||||
inherit pkgs-unstable;
|
||||
inherit systemSettings;
|
||||
inherit userSettings;
|
||||
inherit inputs;
|
||||
};
|
||||
};
|
||||
};
|
||||
nixOnDroidConfigurations = {
|
||||
inherit pkgs;
|
||||
default = inputs.nix-on-droid.lib.nixOnDroidConfiguration {
|
||||
modules = [ ./profiles/nix-on-droid/configuration.nix ];
|
||||
};
|
||||
extraSpecialArgs = {
|
||||
# pass config variables from above
|
||||
inherit pkgs-stable;
|
||||
inherit systemSettings;
|
||||
inherit userSettings;
|
||||
inherit inputs;
|
||||
};
|
||||
};
|
||||
|
||||
packages = forAllSystems (system:
|
||||
let pkgs = nixpkgsFor.${system};
|
||||
in {
|
||||
default = self.packages.${system}.install;
|
||||
|
||||
install = pkgs.writeShellApplication {
|
||||
name = "install";
|
||||
runtimeInputs = with pkgs; [ git ]; # I could make this fancier by adding other deps
|
||||
text = ''${./install.sh} "$@"'';
|
||||
};
|
||||
});
|
||||
|
||||
apps = forAllSystems (system: {
|
||||
default = self.apps.${system}.install;
|
||||
|
||||
install = {
|
||||
type = "app";
|
||||
program = "${self.packages.${system}.install}/bin/install";
|
||||
};
|
||||
});
|
||||
}) hosts);
|
||||
};
|
||||
|
||||
inputs = {
|
||||
@ -198,17 +80,8 @@
|
||||
nixpkgs-stable.url = "nixpkgs/nixos-24.11";
|
||||
chaotic.url = "github:chaotic-cx/nyx/5071a4037c634d41a57926521fef2e179abe3bd9";
|
||||
|
||||
home-manager-unstable.url = "github:nix-community/home-manager/master";
|
||||
home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
home-manager-stable.url = "github:nix-community/home-manager/release-24.05";
|
||||
home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
|
||||
|
||||
nix-on-droid = {
|
||||
url = "github:nix-community/nix-on-droid/master";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
inputs.home-manager.follows = "home-manager-unstable";
|
||||
};
|
||||
home-manager.url = "github:nix-community/home-manager/master";
|
||||
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
hyprland = {
|
||||
type = "git";
|
||||
@ -247,5 +120,9 @@
|
||||
url = "github:StevenBlack/hosts";
|
||||
flake = false;
|
||||
};
|
||||
|
||||
secrets = {
|
||||
url = "path:/etc/nixos.secrets";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
50
hosts/snowfire/configuration.nix
Normal file
50
hosts/snowfire/configuration.nix
Normal file
@ -0,0 +1,50 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
config = {
|
||||
systemSettings = {
|
||||
# users
|
||||
users = [ "emmet" ];
|
||||
adminUsers = [ "emmet" ];
|
||||
|
||||
# hardware
|
||||
cachy.enable = true;
|
||||
bluetooth.enable = true;
|
||||
tlp.enable = true;
|
||||
printing.enable = true;
|
||||
|
||||
# software
|
||||
flatpak.enable = false;
|
||||
gaming.enable = true;
|
||||
virtualization = {
|
||||
docker.enable = true;
|
||||
virtualMachines.enable = true;
|
||||
};
|
||||
|
||||
# wm
|
||||
hyprland.enable = true;
|
||||
|
||||
# dotfiles
|
||||
dotfilesDir = "/etc/nixos";
|
||||
|
||||
# security
|
||||
security = {
|
||||
automount.enable = true;
|
||||
blocklist.enable = true;
|
||||
doas.enable = true;
|
||||
firejail.enable = false; # TODO setup firejail profiles
|
||||
firewall.enable = true;
|
||||
gpg.enable = true;
|
||||
openvpn.enable = true;
|
||||
sshd.enable = false;
|
||||
};
|
||||
|
||||
# style
|
||||
stylix = {
|
||||
enable = true;
|
||||
theme = "io";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
14
hosts/snowfire/default.nix
Normal file
14
hosts/snowfire/default.nix
Normal file
@ -0,0 +1,14 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
home-manager.users = builtins.listToAttrs
|
||||
(map (user: { name = user; value =
|
||||
({ imports = [ ./home.nix ../../modules/user ]; });}) config.systemSettings.users);
|
||||
};
|
||||
}
|
||||
@ -16,6 +16,7 @@
|
||||
boot.blacklistedKernelModules = [ "k10temp" ];
|
||||
boot.kernelParams = [ "amd_pstate=active" "acpi_osi=Linux" "acpi_wake=USB0" ];
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [ zenpower rtl8812au ];
|
||||
hardware.opengl.enable = true;
|
||||
hardware.opengl.extraPackages = [ pkgs.rocmPackages.clr.icd ];
|
||||
hardware.opengl.extraPackages32 = [ ];
|
||||
|
||||
44
hosts/snowfire/home.nix
Normal file
44
hosts/snowfire/home.nix
Normal file
@ -0,0 +1,44 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
config = {
|
||||
|
||||
userSettings = {
|
||||
# setup
|
||||
shell = {
|
||||
enable = true;
|
||||
apps.enable = true;
|
||||
extraApps.enable = true;
|
||||
};
|
||||
xdg.enable = true;
|
||||
|
||||
# programs
|
||||
browser = "qutebrowser";
|
||||
brave.enable = true;
|
||||
editor = "emacs";
|
||||
ranger.enable = true;
|
||||
git.enable = true;
|
||||
engineering.enable = true;
|
||||
art.enable = true;
|
||||
flatpak.enable = false;
|
||||
godot.enable = true;
|
||||
keepass.enable = true;
|
||||
media.enable = true;
|
||||
music.enable = true;
|
||||
office.enable = true;
|
||||
recording.enable = true;
|
||||
virtualization = {
|
||||
virtualMachines.enable = true;
|
||||
};
|
||||
|
||||
# wm
|
||||
hyprland.enable = true;
|
||||
|
||||
# style
|
||||
stylix.enable = true;
|
||||
|
||||
# hardware
|
||||
bluetooth.enable = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
16
modules/system/bluetooth/default.nix
Normal file
16
modules/system/bluetooth/default.nix
Normal file
@ -0,0 +1,16 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.bluetooth;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.bluetooth = {
|
||||
enable = lib.mkEnableOption "Enable bluetooth";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
hardware.bluetooth.enable = true;
|
||||
services.blueman.enable = true;
|
||||
};
|
||||
}
|
||||
85
modules/system/configuration.nix
Normal file
85
modules/system/configuration.nix
Normal file
@ -0,0 +1,85 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
config = {
|
||||
# Journal
|
||||
services.journald.extraConfig = "SystemMaxUse=50M\nSystemMaxFiles=5";
|
||||
services.journald.rateLimitBurst = 500;
|
||||
services.journald.rateLimitInterval = "30s";
|
||||
|
||||
# Locale and TZ
|
||||
time.timeZone = "America/Chicago";
|
||||
services.timesyncd.enable = true;
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = config.i18n.defaultLocale;
|
||||
LC_IDENTIFICATION = config.i18n.defaultLocale;
|
||||
LC_MEASUREMENT = config.i18n.defaultLocale;
|
||||
LC_MONETARY = config.i18n.defaultLocale;
|
||||
LC_NAME = config.i18n.defaultLocale;
|
||||
LC_NUMERIC = config.i18n.defaultLocale;
|
||||
LC_PAPER = config.i18n.defaultLocale;
|
||||
LC_TELEPHONE = config.i18n.defaultLocale;
|
||||
LC_TIME = config.i18n.defaultLocale;
|
||||
};
|
||||
|
||||
# Use zsh
|
||||
programs.zsh.enable = true;
|
||||
environment.shells = with pkgs; [ zsh ];
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
|
||||
# Fix nix path
|
||||
nix.nixPath = [ "nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos"
|
||||
"nixos-config=$HOME/dotfiles/system/configuration.nix"
|
||||
"/nix/var/nix/profiles/per-user/root/channels"
|
||||
];
|
||||
|
||||
# Ensure nix flakes are enabled
|
||||
nix.extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
|
||||
# Substituters
|
||||
nix.settings = {
|
||||
substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
};
|
||||
|
||||
# wheel group gets trusted access to nix daemon
|
||||
nix.settings.trusted-users = [ "@wheel" ];
|
||||
|
||||
# Bootloader
|
||||
# Use systemd-boot if uefi, default to grub otherwise
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.systemd-boot.editor = false;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
|
||||
# Silent Boot
|
||||
# https://wiki.archlinux.org/title/Silent_boot
|
||||
boot.kernelParams = [
|
||||
"quiet"
|
||||
"splash"
|
||||
"vga=current"
|
||||
"rd.systemd.show_status=false"
|
||||
"rd.udev.log_level=3"
|
||||
"udev.log_priority=3"
|
||||
];
|
||||
boot.initrd.systemd.enable = true;
|
||||
boot.initrd.verbose = false;
|
||||
boot.plymouth.enable = true;
|
||||
|
||||
# Networking
|
||||
networking.networkmanager.enable = true; # Use networkmanager
|
||||
|
||||
# Remove bloat
|
||||
programs.nano.enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
}
|
||||
29
modules/system/default.nix
Normal file
29
modules/system/default.nix
Normal file
@ -0,0 +1,29 @@
|
||||
{ lib, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
# Recursively constructs an attrset of a given folder, recursing on directories, value of attrs is the filetype
|
||||
getDir = dir: mapAttrs
|
||||
(file: type:
|
||||
if type == "directory" then getDir "${dir}/${file}" else type
|
||||
)
|
||||
(builtins.readDir dir);
|
||||
|
||||
# Collects all files of a directory as a list of strings of paths
|
||||
files = dir: collect isString (mapAttrsRecursive (path: type: concatStringsSep "/" path) (getDir dir));
|
||||
|
||||
# Filters out directories that don't end with .nix or are this file, also makes the strings absolute
|
||||
importAll = dir: map
|
||||
(file: ./. + "/${file}")
|
||||
(filter
|
||||
(file: hasSuffix ".nix" file && file != "default.nix" &&
|
||||
! lib.hasPrefix "x/taffybar/" file &&
|
||||
! lib.hasSuffix "-hm.nix" file)
|
||||
(files dir));
|
||||
|
||||
in
|
||||
{
|
||||
|
||||
imports = importAll ./.;
|
||||
|
||||
}
|
||||
16
modules/system/flatpak/default.nix
Normal file
16
modules/system/flatpak/default.nix
Normal file
@ -0,0 +1,16 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.flatpak;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.flatpak = {
|
||||
enable = lib.mkEnableOption "Enable flatpaks";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.flatpak.enable = true;
|
||||
xdg.portal.enable = true;
|
||||
};
|
||||
}
|
||||
20
modules/system/gaming/default.nix
Normal file
20
modules/system/gaming/default.nix
Normal file
@ -0,0 +1,20 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.gaming;
|
||||
in {
|
||||
|
||||
options = {
|
||||
systemSettings.gaming = {
|
||||
enable = lib.mkEnableOption "Enable Steam and games";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "steam" "steam-unwrapped" ];
|
||||
hardware.opengl.driSupport32Bit = true;
|
||||
programs.steam.enable = true;
|
||||
environment.systemPackages = with pkgs; [ pkgs.steam gamemode prismlauncher ];
|
||||
programs.gamemode.enable = true;
|
||||
};
|
||||
}
|
||||
98
modules/system/hyprland/default.nix
Normal file
98
modules/system/hyprland/default.nix
Normal file
@ -0,0 +1,98 @@
|
||||
{ inputs, pkgs, pkgs-stable, config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.hyprland;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
systemSettings.hyprland = {
|
||||
enable = lib.mkEnableOption "Enable hyprland";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Hyprland
|
||||
programs = {
|
||||
hyprland = {
|
||||
enable = true;
|
||||
package = inputs.hyprland.packages.${pkgs.system}.hyprland;
|
||||
xwayland = {
|
||||
enable = true;
|
||||
};
|
||||
portalPackage = pkgs.xdg-desktop-portal-hyprland;
|
||||
};
|
||||
};
|
||||
|
||||
# Necessary packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
jq
|
||||
(sddm-chili-theme.override {
|
||||
themeConfig = {
|
||||
background = config.stylix.image;
|
||||
ScreenWidth = 1920;
|
||||
ScreenHeight = 1080;
|
||||
blur = true;
|
||||
recursiveBlurLoops = 3;
|
||||
recursiveBlurRadius = 5;
|
||||
# TODO fix icons with svgs patched from stylix colors
|
||||
};})
|
||||
];
|
||||
|
||||
# Display manager
|
||||
services.xserver.displayManager.sddm = {
|
||||
enable = true;
|
||||
wayland.enable = true;
|
||||
enableHidpi = true;
|
||||
theme = "chili";
|
||||
package = pkgs.sddm;
|
||||
};
|
||||
|
||||
# xwayland
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
xkb = {
|
||||
layout = "us";
|
||||
variant = "";
|
||||
options = "caps:escape";
|
||||
};
|
||||
excludePackages = [ pkgs.xterm ];
|
||||
};
|
||||
|
||||
# Keyring
|
||||
security.pam.services.login.enableGnomeKeyring = true;
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Dbus
|
||||
services.dbus = {
|
||||
enable = true;
|
||||
packages = [ pkgs.dconf ];
|
||||
};
|
||||
|
||||
programs.dconf.enable = true;
|
||||
|
||||
# Pipewire
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
};
|
||||
|
||||
# Some fancy fonts
|
||||
fonts.packages = with pkgs-stable; [
|
||||
# Fonts
|
||||
nerdfonts
|
||||
powerline
|
||||
];
|
||||
|
||||
# Auto rotate screen
|
||||
programs.iio-hyprland = {
|
||||
enable = true;
|
||||
package = pkgs.iio-hyprland.overrideAttrs {
|
||||
patches = [ ./iio-hyprland-hyprpaper.patch ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
29
modules/system/kernel/default.nix
Normal file
29
modules/system/kernel/default.nix
Normal file
@ -0,0 +1,29 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.cachy;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
systemSettings.cachy = {
|
||||
enable = lib.mkEnableOption "Enable cachyos kernel";
|
||||
variant = lib.mkOption {
|
||||
default = null;
|
||||
type = lib.types.nullOr (lib.types.enum ["lto" "server" "hardened"]);
|
||||
description = ''
|
||||
This option determines the CachyOS kernel variant to use.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
boot.kernelPackages = lib.mkMerge [
|
||||
(lib.mkIf (cfg.variant == null) pkgs.linuxPackages_cachyos)
|
||||
(lib.mkIf (cfg.variant == "lto") pkgs.linuxPackages_cachyos-lto)
|
||||
(lib.mkIf (cfg.variant == "server") pkgs.linuxPackages_cachyos-server)
|
||||
(lib.mkIf (cfg.variant == "hardened") pkgs.linuxPackages_cachyos-hardened)
|
||||
];
|
||||
boot.consoleLogLevel = 0;
|
||||
};
|
||||
}
|
||||
31
modules/system/nix/default.nix
Normal file
31
modules/system/nix/default.nix
Normal file
@ -0,0 +1,31 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
|
||||
let
|
||||
caches = import inputs.secrets.caches;
|
||||
in {
|
||||
config = {
|
||||
nix = {
|
||||
package = pkgs.nix;
|
||||
settings = {
|
||||
substituters =
|
||||
(lib.optionals (caches ? urls) caches.urls) ++
|
||||
[
|
||||
"https://cache.nixos.org"
|
||||
"https://hyprland.cachix.org"
|
||||
"https://nix-community.cachix.org"
|
||||
];
|
||||
trusted-public-keys =
|
||||
(lib.optionals (caches ? publicKeys) caches.publicKeys) ++
|
||||
[
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
];
|
||||
trusted-users = config.systemSettings.adminUsers ++ [ "@wheel" ];
|
||||
auto-optimise-store = true;
|
||||
download-buffer-size = 500000000;
|
||||
};
|
||||
};
|
||||
system.stateVersion = "22.11";
|
||||
};
|
||||
}
|
||||
80
modules/system/phoenix/default.nix
Normal file
80
modules/system/phoenix/default.nix
Normal file
@ -0,0 +1,80 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
options = {
|
||||
systemSettings.dotfilesDir = lib.mkOption {
|
||||
default = "/etc/nixos";
|
||||
description = "Absolute path to the dotfiles directory";
|
||||
type = lib.types.path;
|
||||
};
|
||||
};
|
||||
# TODO disabled for debugging
|
||||
# config = {
|
||||
# environment.systemPackages = [
|
||||
# # TODO update script for config schema change
|
||||
# (pkgs.writeScriptBin "phoenix" ''
|
||||
# if [ "$1" = "sync" ]; then
|
||||
# if [ "$#" = 1 ]; then
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/sync.sh;
|
||||
# exit 0;
|
||||
# elif [ "$2" = "user" ]; then
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/sync-user.sh;
|
||||
# exit 0;
|
||||
# elif [ "$2" = "system" ]; then
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/sync-system.sh;
|
||||
# exit 0;
|
||||
# else
|
||||
# echo "Please pass 'system' or 'user' if supplying a second argument"
|
||||
# fi
|
||||
# elif [ "$1" = "refresh" ]; then
|
||||
# if [ "$#" -gt 1 ]; then
|
||||
# echo "Warning: The 'refresh' command has no subcommands (no $2 subcommand)";
|
||||
# fi
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/sync-posthook.sh;
|
||||
# exit 0;
|
||||
# elif [ "$1" = "update" ]; then
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/update.sh "''${@:2}";
|
||||
# exit 0;
|
||||
# elif [ "$1" = "upgrade" ]; then
|
||||
# if [ "$#" -gt 1 ]; then
|
||||
# echo "Warning: The 'upgrade' command has no subcommands (no $2 subcommand)";
|
||||
# fi
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/upgrade.sh;
|
||||
# exit 0;
|
||||
# elif [ "$1" = "pull" ]; then
|
||||
# if [ "$#" -gt 1 ]; then
|
||||
# echo "Warning: The 'pull' command has no subcommands (no $2 subcommand)";
|
||||
# fi
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/pull.sh;
|
||||
# exit 0;
|
||||
# elif [ "$1" = "harden" ]; then
|
||||
# if [ "$#" -gt 1 ]; then
|
||||
# echo "Warning: The 'harden' command has no subcommands (no $2 subcommand)";
|
||||
# fi
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/harden.sh;
|
||||
# exit 0;
|
||||
# elif [ "$1" = "soften" ]; then
|
||||
# if [ "$#" -gt 1 ]; then
|
||||
# echo "Warning: The 'soften' command has no subcommands (no $2 subcommand)";
|
||||
# fi
|
||||
# ''+config.systemSettings.dotfilesDir+''/scripts/soften.sh;
|
||||
# exit 0;
|
||||
# elif [ "$1" = "gc" ]; then
|
||||
# if [ "$#" -gt 2 ]; then
|
||||
# echo "Warning: The 'gc' command only accepts one argument (collect_older_than)";
|
||||
# fi
|
||||
# if [ "$2" = "full" ]; then
|
||||
# sudo nix-collect-garbage --delete-old;
|
||||
# nix-collect-garbage --delete-old;
|
||||
# elif [ "$2" ]; then
|
||||
# sudo nix-collect-garbage --delete-older-than $2;
|
||||
# nix-collect-garbage --delete-older-than $2;
|
||||
# else
|
||||
# sudo nix-collect-garbage --delete-older-than 30d;
|
||||
# nix-collect-garbage --delete-older-than 30d;
|
||||
# fi
|
||||
# fi
|
||||
# '')
|
||||
# ];
|
||||
# };
|
||||
}
|
||||
20
modules/system/printing/default.nix
Normal file
20
modules/system/printing/default.nix
Normal file
@ -0,0 +1,20 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.printing;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.printing = {
|
||||
enable = lib.mkEnableOption "Enable printing";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Enable printing
|
||||
services.printing.enable = true;
|
||||
services.avahi.enable = true;
|
||||
services.avahi.nssmdns4 = true;
|
||||
services.avahi.openFirewall = true;
|
||||
environment.systemPackages = [ pkgs.cups-filters ];
|
||||
};
|
||||
}
|
||||
17
modules/system/security/automount/default.nix
Normal file
17
modules/system/security/automount/default.nix
Normal file
@ -0,0 +1,17 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.automount;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.automount = {
|
||||
enable = lib.mkEnableOption "Enable automount";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.devmon.enable = true;
|
||||
services.gvfs.enable = true;
|
||||
services.udisks2.enable = true;
|
||||
};
|
||||
}
|
||||
18
modules/system/security/blocklist/default.nix
Normal file
18
modules/system/security/blocklist/default.nix
Normal file
@ -0,0 +1,18 @@
|
||||
{ config, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
blocklist = builtins.readFile "${inputs.blocklist-hosts}/alternates/gambling-porn/hosts";
|
||||
cfg = config.systemSettings.security.blocklist;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.blocklist = {
|
||||
enable = lib.mkEnableOption "Enable basic host blocking for bad websites";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.extraHosts = ''
|
||||
"${blocklist}"
|
||||
'';
|
||||
};
|
||||
}
|
||||
42
modules/system/security/doas/default.nix
Normal file
42
modules/system/security/doas/default.nix
Normal file
@ -0,0 +1,42 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.doas;
|
||||
adminUsers = config.systemSettings.adminUsers;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.doas = {
|
||||
enable = lib.mkEnableOption "Replace sudo with doas";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Doas instead of sudo
|
||||
security.doas.enable = true;
|
||||
security.sudo.enable = false;
|
||||
security.doas.extraRules = [
|
||||
{
|
||||
users = adminUsers;
|
||||
cmd = "nix";
|
||||
noPass = true;
|
||||
keepEnv = true;
|
||||
}
|
||||
{
|
||||
users = adminUsers;
|
||||
cmd = "nixos-rebuild";
|
||||
noPass = true;
|
||||
keepEnv = true;
|
||||
}
|
||||
{
|
||||
users = adminUsers;
|
||||
cmd = "nix-collect-garbage";
|
||||
noPass = true;
|
||||
keepEnv = true;
|
||||
}
|
||||
];
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.doas-sudo-shim
|
||||
];
|
||||
};
|
||||
}
|
||||
30
modules/system/security/firejail/default.nix
Normal file
30
modules/system/security/firejail/default.nix
Normal file
@ -0,0 +1,30 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.firejail;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.firejail = {
|
||||
enable = lib.mkEnableOption "Use firejail on some apps for extra security";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [ firejail ];
|
||||
programs.firejail.enable = true;
|
||||
programs.firejail.wrappedBinaries = {
|
||||
#prismlauncher = {
|
||||
# executable = "${pkgs.prismlauncher}/bin/prismlauncher";
|
||||
# profile = ./firejail-profiles/prismlauncher.profile;
|
||||
#};
|
||||
#steam = {
|
||||
# executable = "${pkgs.steam}/bin/steam";
|
||||
# profile = "${pkgs.firejail}/etc/firejail/steam.profile";
|
||||
#};
|
||||
#steam-run = {
|
||||
# executable = "${pkgs.steam}/bin/steam-run";
|
||||
# profile = "${pkgs.firejail}/etc/firejail/steam.profile";
|
||||
#};
|
||||
};
|
||||
};
|
||||
}
|
||||
22
modules/system/security/firewall/default.nix
Normal file
22
modules/system/security/firewall/default.nix
Normal file
@ -0,0 +1,22 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.firewall;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.firewall = {
|
||||
# TODO make this more granular and better :|
|
||||
enable = lib.mkEnableOption "Actvate firewall with ports open only for syncthing";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Firewall
|
||||
networking.firewall.enable = true;
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [ 22000 21027 ]; # syncthing
|
||||
networking.firewall.allowedUDPPorts = [ 22000 21027 ]; # syncthing
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
};
|
||||
}
|
||||
18
modules/system/security/gpg/default.nix
Normal file
18
modules/system/security/gpg/default.nix
Normal file
@ -0,0 +1,18 @@
|
||||
{ lib, config, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.gpg;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.gpg = {
|
||||
enable = lib.mkEnableOption "Enable gpg";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
16
modules/system/security/openvpn/default.nix
Normal file
16
modules/system/security/openvpn/default.nix
Normal file
@ -0,0 +1,16 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.openvpn;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.openvpn = {
|
||||
enable = lib.mkEnableOption "Enable openvpn";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = [ pkgs.openvpn ];
|
||||
environment.etc.openvpn.source = "${pkgs.update-resolv-conf}/libexec/openvpn";
|
||||
};
|
||||
}
|
||||
25
modules/system/security/sshd/default.nix
Normal file
25
modules/system/security/sshd/default.nix
Normal file
@ -0,0 +1,25 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.security.sshd;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.security.sshd = {
|
||||
enable = lib.mkEnableOption "Enable incoming ssh connections";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# Enable incoming ssh
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "no";
|
||||
};
|
||||
};
|
||||
# Don't forget to set:
|
||||
# users.users.${username}.openssh.authorizedKeys.keys = "myAuthorizedKey";
|
||||
};
|
||||
}
|
||||
56
modules/system/stylix/default.nix
Normal file
56
modules/system/stylix/default.nix
Normal file
@ -0,0 +1,56 @@
|
||||
{ lib, config, pkgs, inputs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.stylix;
|
||||
theme = import (./. + "../../../themes"+("/"+config.systemSettings.stylix.theme));
|
||||
in
|
||||
{
|
||||
options = {
|
||||
systemSettings.stylix = {
|
||||
enable = lib.mkEnableOption "Enable stylix theming";
|
||||
};
|
||||
systemSettings.stylix.theme = lib.mkOption {
|
||||
default = "io";
|
||||
type = lib.types.enum (builtins.attrNames (lib.filterAttrs (name: type: type == "directory") (builtins.readDir ../../themes)));
|
||||
description = "Theme for stylix to use system wide. A list of themes can be found in the `themes` directory.";
|
||||
};
|
||||
};
|
||||
|
||||
imports = [ inputs.stylix.nixosModules.stylix ];
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
stylix.enable = true;
|
||||
stylix.autoEnable = false;
|
||||
stylix.polarity = theme.polarity;
|
||||
stylix.image = pkgs.fetchurl {
|
||||
url = theme.backgroundUrl;
|
||||
sha256 = theme.backgroundSha256;
|
||||
};
|
||||
stylix.base16Scheme = theme;
|
||||
stylix.fonts = {
|
||||
# TODO abstract fonts into an option
|
||||
monospace = {
|
||||
name = "FiraCode Nerd Font";
|
||||
package = pkgs.nerd-fonts.fira-code;
|
||||
};
|
||||
serif = {
|
||||
name = "FiraCode Nerd Font";
|
||||
package = pkgs.nerd-fonts.fira-code;
|
||||
};
|
||||
sansSerif = {
|
||||
name = "FiraCode Nerd Font";
|
||||
package = pkgs.nerd-fonts.fira-code;
|
||||
};
|
||||
emoji = {
|
||||
name = "Noto Color Emoji";
|
||||
package = pkgs.noto-fonts-emoji-blob-bin;
|
||||
};
|
||||
};
|
||||
|
||||
stylix.targets.console.enable = true;
|
||||
|
||||
environment.sessionVariables = {
|
||||
QT_QPA_PLATFORMTHEME = "qt5ct";
|
||||
};
|
||||
};
|
||||
}
|
||||
58
modules/system/tlp/default.nix
Normal file
58
modules/system/tlp/default.nix
Normal file
@ -0,0 +1,58 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.tlp;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.tlp = {
|
||||
enable = lib.mkEnableOption "Enable tlp power management";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tlp = {
|
||||
enable = true;
|
||||
settings = {
|
||||
CPU_SCALING_GOVERNOR_ON_AC = "performance";
|
||||
CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
|
||||
CPU_ENERGY_PERF_POLICY_ON_BAT = "balance";
|
||||
CPU_ENERGY_PERF_POLICY_ON_AC = "balance_performance";
|
||||
CPU_DRIVER_OPMODE_ON_AC = "active";
|
||||
CPU_DRIVER_OPMODE_ON_BAT = "active";
|
||||
|
||||
WIFI_PWR_ON_AC = "on";
|
||||
WIFI_PWR_ON_BAT = "on";
|
||||
RUNTIME_PM_ON_AC = "auto";
|
||||
RUNTIME_PM_ON_BAT = "auto";
|
||||
|
||||
CPU_MIN_PERF_ON_AC = 10;
|
||||
CPU_MAX_PERF_ON_AC = 90;
|
||||
CPU_MIN_PERF_ON_BAT = 10;
|
||||
CPU_MAX_PERF_ON_BAT = 50;
|
||||
|
||||
CPU_BOOST_ON_AC = 1;
|
||||
CPU_BOOST_ON_BAT = 0;
|
||||
CPU_HWP_DYN_BOOST_ON_AC = 1;
|
||||
CPU_HWP_DYN_BOOST_ON_BAT = 0;
|
||||
|
||||
START_CHARGE_THRESH_BAT0 = 75;
|
||||
STOP_CHARGE_THRESH_BAT0 = 80;
|
||||
|
||||
MEM_SLEEP_ON_AC = "deep";
|
||||
MEM_SLEEP_ON_BAT = "deep";
|
||||
|
||||
PLATFORM_PROFILE_ON_AC = "performance";
|
||||
PLATFORM_PROFILE_ON_BAT = "low-power";
|
||||
|
||||
RADEON_DPM_STATE_ON_AC = "performance";
|
||||
RADEON_DPM_STATE_ON_BAT = "battery";
|
||||
RADEON_POWER_PROFILE_ON_AC = "high";
|
||||
RADEON_POWER_PROFILE_ON_BAT = "low";
|
||||
|
||||
INTEL_GPU_MIN_FREQ_ON_AC = 600;
|
||||
INTEL_GPU_MIN_FREQ_ON_BAT = 600;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
41
modules/system/users/default.nix
Normal file
41
modules/system/users/default.nix
Normal file
@ -0,0 +1,41 @@
|
||||
{ config, lib, inputs, ... }:
|
||||
let
|
||||
userInfo = import inputs.secrets.userInfo;
|
||||
in {
|
||||
options = {
|
||||
systemSettings = {
|
||||
users = lib.mkOption {
|
||||
description = "List of desktop users to create on the system";
|
||||
type = lib.types.listOf lib.types.str;
|
||||
};
|
||||
adminUsers = lib.mkOption {
|
||||
description = "List of desktop users to grant admin (sudo) access on the system";
|
||||
type = lib.types.listOf lib.types.str;
|
||||
};
|
||||
};
|
||||
};
|
||||
config = {
|
||||
|
||||
users.users = builtins.listToAttrs
|
||||
(map (user: {
|
||||
name = user;
|
||||
value = {
|
||||
description = userInfo.${user}.name;
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "networkmanager" "input" "dialout" "video" "render" ] ++ (lib.optionals (lib.any (x: x == user) config.systemSettings.adminUsers) [ "wheel" ]);
|
||||
createHome = true;
|
||||
};
|
||||
}) config.systemSettings.users);
|
||||
|
||||
home-manager.users = builtins.listToAttrs
|
||||
(map (user: {
|
||||
name = user;
|
||||
value = {
|
||||
home.username = user;
|
||||
home.homeDirectory = "/home/"+user;
|
||||
userSettings.name = lib.mkIf (userInfo.${user} ? name) userInfo.${user}.name;
|
||||
userSettings.email = lib.mkIf (userInfo.${user} ? email ) userInfo.${user}.email;
|
||||
};
|
||||
}) config.systemSettings.users);
|
||||
};
|
||||
}
|
||||
26
modules/system/virtualization/docker/default.nix
Normal file
26
modules/system/virtualization/docker/default.nix
Normal file
@ -0,0 +1,26 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.systemSettings.virtualization.docker;
|
||||
adminUsers = config.systemSettings.adminUsers;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.virtualization.docker = {
|
||||
enable = lib.mkEnableOption "Enable docker";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
enableOnBoot = true;
|
||||
autoPrune.enable = true;
|
||||
};
|
||||
users.users = builtins.listToAttrs (map (user: { name = user; value = { extraGroups = [ "docker" ];};}) adminUsers);
|
||||
environment.systemPackages = with pkgs; [
|
||||
docker
|
||||
docker-compose
|
||||
lazydocker
|
||||
];
|
||||
};
|
||||
}
|
||||
23
modules/system/virtualization/virtual-machines/default.nix
Normal file
23
modules/system/virtualization/virtual-machines/default.nix
Normal file
@ -0,0 +1,23 @@
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
let cfg = config.systemSettings.virtualization.virtualMachines;
|
||||
in {
|
||||
options = {
|
||||
systemSettings.virtualization.virtualMachines = {
|
||||
enable = lib.mkEnableOption "Enable qemu virtual machines, distrobox, and waydroid";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [ virt-manager distrobox ];
|
||||
virtualisation.libvirtd = {
|
||||
allowedBridges = [
|
||||
"nm-bridge"
|
||||
"virbr0"
|
||||
];
|
||||
enable = true;
|
||||
qemu.runAsRoot = false;
|
||||
};
|
||||
virtualisation.waydroid.enable = true;
|
||||
};
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user