oops thats a lot of stuff
This commit is contained in:
parent
8e44992e00
commit
87e6a239d5
GPG key ID:
0FF5B8826803F895
23 changed files with 2012 additions and 390 deletions
|
|
@ -2,11 +2,44 @@
|
|||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with pkgs; {
|
||||
with lib // pkgs // inputs; {
|
||||
imports = [./hardware.nix];
|
||||
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults lecture = never, pwfeedback
|
||||
'';
|
||||
|
||||
security.pam.loginLimits = [
|
||||
{
|
||||
domain = "*";
|
||||
item = "nofile";
|
||||
type = "-";
|
||||
value = "32768";
|
||||
}
|
||||
{
|
||||
domain = "*";
|
||||
item = "memlock";
|
||||
type = "-";
|
||||
value = "32768";
|
||||
}
|
||||
];
|
||||
|
||||
console.catppuccin.enable = true;
|
||||
|
||||
systemd.user.extraConfig = let
|
||||
path = lib.concatStringsSep ":" [
|
||||
"/run/wrappers/bin"
|
||||
"/etc/profiles/per-user/%u/bin"
|
||||
"/nix/var/nix/profiles/default/bin"
|
||||
"/run/current-system/sw/bin"
|
||||
];
|
||||
in ''
|
||||
DefaultEnvironment="PATH=${path}"
|
||||
'';
|
||||
|
||||
age = {
|
||||
secrets.passwd.file = /etc/secrets/passwd.age;
|
||||
identityPaths = [
|
||||
|
|
@ -26,23 +59,41 @@ with pkgs; {
|
|||
];
|
||||
};
|
||||
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.podman.enableNvidia = true;
|
||||
virtualisation = {
|
||||
spiceUSBRedirection.enable = true;
|
||||
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
qemu = {
|
||||
package = qemu_kvm;
|
||||
swtpm.enable = true;
|
||||
ovmf.enable = true;
|
||||
ovmf.packages = [OVMFFull.fd];
|
||||
};
|
||||
};
|
||||
|
||||
podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment = {
|
||||
sessionVariables = {
|
||||
NIXOS_OZONE_WL = "1";
|
||||
EDITOR = "nvim";
|
||||
DIRENV_WARN_TIMEOUT = "100s";
|
||||
};
|
||||
|
||||
systemPackages =
|
||||
[
|
||||
kde-rounded-corners
|
||||
]
|
||||
++ (with inputs; [
|
||||
agenix.packages.${system}.default
|
||||
kwin-effects-forceblur.packages.${system}.default
|
||||
]);
|
||||
systemPackages = [
|
||||
agenix.packages.${system}.default
|
||||
gnome.nautilus
|
||||
internal.lightly-boehs-qt6
|
||||
snowfallorg.flake
|
||||
sound-theme-freedesktop
|
||||
xclip
|
||||
yt-dlp
|
||||
];
|
||||
|
||||
persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
|
|
@ -53,73 +104,151 @@ with pkgs; {
|
|||
"/var/lib/bluetooth"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd/coredump"
|
||||
"/etc/NetworkManager/system-connections"
|
||||
{
|
||||
directory = "/var/lib/colord";
|
||||
user = "colord";
|
||||
group = "colord";
|
||||
mode = "u=rwx,g=rx,o=";
|
||||
}
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
{
|
||||
file = "/var/keys/secret_file";
|
||||
parentDirectory = {mode = "u=rwx,g=,o=";};
|
||||
}
|
||||
"/etc/NetworkManager"
|
||||
];
|
||||
files = ["/etc/machine-id"];
|
||||
};
|
||||
};
|
||||
|
||||
boot = {
|
||||
#initrd.systemd.enable = true;
|
||||
#plymouth.enable = true;
|
||||
|
||||
blacklistedKernelModules = ["i915"];
|
||||
blacklistedKernelModules = ["nouveau"];
|
||||
kernelPackages = linuxPackages_cachyos;
|
||||
kernelParams = ["module_blacklist=i915" "quiet"];
|
||||
supportedFilesystems = ["btrfs" "ntfs"];
|
||||
|
||||
binfmt.registrations.appimage = {
|
||||
wrapInterpreterInShell = false;
|
||||
interpreter = "${appimage-run}/bin/appimage-run";
|
||||
recognitionType = "magic";
|
||||
offset = 0;
|
||||
mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff'';
|
||||
magicOrExtension = ''\x7fELF....AI\x02'';
|
||||
};
|
||||
|
||||
initrd.systemd = {
|
||||
enable = true;
|
||||
emergencyAccess = true; # No password needed bc of LUKS
|
||||
};
|
||||
|
||||
plymouth = {
|
||||
enable = true;
|
||||
catppuccin.enable = true;
|
||||
};
|
||||
|
||||
extraModprobeConfig =
|
||||
"options nvidia "
|
||||
+ concatStringsSep " " [
|
||||
"NVreg_UsePageAttributeTable=1"
|
||||
"NVreg_EnablePCIeGen3=1"
|
||||
"NVreg_RegistryDwords=RMUseSwI2c=0x01;RMI2cSpeed=100"
|
||||
];
|
||||
|
||||
kernelParams = [
|
||||
"intel_iommu=on"
|
||||
"iommu=pt"
|
||||
"kvm.ignore_msrs=1"
|
||||
"modprobe.blacklist=nouveau"
|
||||
];
|
||||
|
||||
loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 20;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
package = nixVersions.git;
|
||||
nix = let
|
||||
mappedRegistry = pipe inputs [
|
||||
(filterAttrs (_: isType "flake"))
|
||||
(mapAttrs (_: flake: {inherit flake;}))
|
||||
(x: x // {nixpkgs.flake = nixpkgs;})
|
||||
];
|
||||
in {
|
||||
package = mkForce nixSuper;
|
||||
registry = mappedRegistry // optionalAttrs (config.nix.package == nixSuper) {default = mappedRegistry.nixpkgs;};
|
||||
nixPath = mapAttrsToList (key: _: "${key}=flake:${key}") config.nix.registry;
|
||||
|
||||
daemonCPUSchedPolicy = "batch";
|
||||
daemonIOSchedClass = "idle";
|
||||
daemonIOSchedPriority = 7;
|
||||
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "Sat *-*-* 03:00";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
optimise = {
|
||||
automatic = true;
|
||||
dates = ["04:00"];
|
||||
};
|
||||
|
||||
settings = {
|
||||
trusted-users = ["marshall"];
|
||||
auto-optimise-store = true;
|
||||
builders-use-substitutes = true;
|
||||
flake-registry = "/etc/nix/registry.json";
|
||||
keep-going = true;
|
||||
log-lines = 30;
|
||||
max-jobs = "auto";
|
||||
sandbox-fallback = false;
|
||||
sandbox = true;
|
||||
system-features = ["nixos-test" "kvm" "recursive-nix" "big-parallel"];
|
||||
use-cgroups = true;
|
||||
use-xdg-base-directories = true;
|
||||
warn-dirty = false;
|
||||
|
||||
allowed-users = ["root" "@wheel" "nix-builder"];
|
||||
trusted-users = ["root" "@wheel" "nix-builder"];
|
||||
|
||||
min-free = "${toString (5 * 1024 * 1024 * 1024)}";
|
||||
max-free = "${toString (10 * 1024 * 1024 * 1024)}";
|
||||
|
||||
extra-experimental-features = [
|
||||
"flakes" # flakes
|
||||
"nix-command" # experimental nix commands
|
||||
"recursive-nix" # let nix invoke itself
|
||||
"ca-derivations" # content addressed nix
|
||||
"auto-allocate-uids" # allow nix to automatically pick UIDs, rather than creating nixbld* user accounts
|
||||
"cgroups" # allow nix to execute builds inside cgroups
|
||||
];
|
||||
|
||||
substituters = [
|
||||
"https://cache.nixos.org"
|
||||
"https://nix-community.cachix.org"
|
||||
"https://cache.iog.io"
|
||||
"https://nyx.chaotic.cx/"
|
||||
"https://cuda-maintainers.cachix.org"
|
||||
"https://cache.privatevoid.net"
|
||||
];
|
||||
|
||||
trusted-substituters = [
|
||||
"cache.nixos.org"
|
||||
"nix-community.cachix.org"
|
||||
"cache.iog.io"
|
||||
"nyx.chaotic.cx"
|
||||
"cuda-maintainers.cachix.org"
|
||||
"cache.privatevoid.net"
|
||||
];
|
||||
|
||||
trusted-public-keys = [
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
"hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
|
||||
"nyx.chaotic.cx-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
|
||||
"chaotic-nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8="
|
||||
"cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
|
||||
"cache.privatevoid.net:SErQ8bvNWANeAvtsOESUwVYr2VJynfuc9JRwlzTTkVg="
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
dconf.enable = true;
|
||||
fish.enable = true;
|
||||
gamemode.enable = true;
|
||||
nix-ld.enable = true;
|
||||
steam.enable = true;
|
||||
gnupg.agent.enable = true;
|
||||
virt-manager.enable = true;
|
||||
|
||||
nh = {
|
||||
enable = true;
|
||||
|
|
@ -131,8 +260,10 @@ with pkgs; {
|
|||
|
||||
networking = {
|
||||
hostName = "navis";
|
||||
networkmanager.enable = true;
|
||||
firewall.enable = false;
|
||||
nameservers = ["1.1.1.1" "1.0.0.1"];
|
||||
networkmanager.dns = "none";
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
time.timeZone = "America/New_York";
|
||||
|
|
@ -141,17 +272,50 @@ with pkgs; {
|
|||
|
||||
services = {
|
||||
btrfs.autoScrub.enable = true;
|
||||
desktopManager.plasma6.enable = true;
|
||||
displayManager.sddm.enable = true;
|
||||
flatpak.enable = true;
|
||||
libinput.enable = true;
|
||||
libinput.touchpad.naturalScrolling = true;
|
||||
gnome.gnome-keyring.enable = true;
|
||||
mullvad-vpn.enable = true;
|
||||
ollama.enable = true;
|
||||
openssh.enable = true;
|
||||
spice-vdagentd.enable = true;
|
||||
|
||||
displayManager.autoLogin = {
|
||||
enable = true;
|
||||
user = "marshall";
|
||||
};
|
||||
|
||||
libinput = {
|
||||
enable = true;
|
||||
touchpad.naturalScrolling = true;
|
||||
};
|
||||
|
||||
xserver = {
|
||||
enable = true;
|
||||
videoDrivers = ["nvidia"];
|
||||
xkb.layout = "us";
|
||||
|
||||
displayManager.startx = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
xrandrHeads = [
|
||||
{
|
||||
output = "DP-0";
|
||||
monitorConfig = ''
|
||||
Option "PreferredMode" "2560x1440_165.08"
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
windowManager.xmonad = {
|
||||
enable = true;
|
||||
enableContribAndExtras = true;
|
||||
enableConfiguredRecompile = true;
|
||||
flake = {
|
||||
enable = true;
|
||||
compiler = "ghc982";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
pipewire = {
|
||||
|
|
@ -165,29 +329,52 @@ with pkgs; {
|
|||
|
||||
users.marshall = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel" "gamemode"];
|
||||
extraGroups = ["wheel" "gamemode" "libvirtd" "networkmanager"];
|
||||
shell = fish;
|
||||
hashedPasswordFile = config.age.secrets.passwd.path;
|
||||
packages = [
|
||||
firefox
|
||||
neovim
|
||||
telegram-desktop
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = true;
|
||||
|
||||
opengl = {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
extraPackages = [
|
||||
vaapiVdpau
|
||||
nvidia-vaapi-driver
|
||||
];
|
||||
};
|
||||
|
||||
nvidia-container-toolkit.enable = true;
|
||||
|
||||
nvidia = {
|
||||
package = config.boot.kernelPackages.nvidiaPackages.latest;
|
||||
modesetting.enable = true;
|
||||
powerManagement.enable = true;
|
||||
|
||||
prime = {
|
||||
sync.enable = true;
|
||||
|
||||
intelBusId = "PCI:0:2:0";
|
||||
nvidiaBusId = "PCI:1:0:0";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
config.common.default = "*";
|
||||
xdgOpenUsePortal = true;
|
||||
|
||||
extraPortals = [
|
||||
kdePackages.xdg-desktop-portal-kde
|
||||
xdg-desktop-portal-gtk
|
||||
xdg-desktop-portal-shana
|
||||
];
|
||||
};
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -22,30 +22,35 @@
|
|||
options = ["subvol=root"];
|
||||
};
|
||||
|
||||
boot.initrd.postDeviceCommands = lib.mkAfter ''
|
||||
mkdir /btrfs_tmp
|
||||
mount /dev/disk/by-uuid/d375c3a3-63a3-47f8-8b77-58fabbb8f67b /btrfs_tmp
|
||||
if [[ -e /btrfs_tmp/root ]]; then
|
||||
mkdir -p /btrfs_tmp/old_roots
|
||||
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
|
||||
mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
|
||||
fi
|
||||
boot.initrd.systemd.services.wipe-root = {
|
||||
requires = ["dev-mapper-enc.device"];
|
||||
after = ["dev-mapper-enc.device"];
|
||||
wantedBy = ["initrd.target"];
|
||||
script = lib.mkAfter ''
|
||||
mkdir /btrfs_tmp
|
||||
mount /dev/disk/by-uuid/d375c3a3-63a3-47f8-8b77-58fabbb8f67b /btrfs_tmp
|
||||
if [[ -e /btrfs_tmp/root ]]; then
|
||||
mkdir -p /btrfs_tmp/old_roots
|
||||
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
|
||||
mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
|
||||
fi
|
||||
|
||||
delete_subvolume_recursively() {
|
||||
IFS=$'\n'
|
||||
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
|
||||
delete_subvolume_recursively "/btrfs_tmp/$i"
|
||||
done
|
||||
btrfs subvolume delete "$1"
|
||||
}
|
||||
delete_subvolume_recursively() {
|
||||
IFS=$'\n'
|
||||
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
|
||||
delete_subvolume_recursively "/btrfs_tmp/$i"
|
||||
done
|
||||
btrfs subvolume delete "$1"
|
||||
}
|
||||
|
||||
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
|
||||
delete_subvolume_recursively "$i"
|
||||
done
|
||||
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
|
||||
delete_subvolume_recursively "$i"
|
||||
done
|
||||
|
||||
btrfs subvolume create /btrfs_tmp/root
|
||||
umount /btrfs_tmp
|
||||
'';
|
||||
btrfs subvolume create /btrfs_tmp/root
|
||||
umount /btrfs_tmp
|
||||
'';
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/9952fcd1-46eb-4c9c-ab7d-361d31fdb9a2";
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue