summaryrefslogtreecommitdiff
path: root/os/core
diff options
context:
space:
mode:
Diffstat (limited to 'os/core')
-rw-r--r--os/core/audio.nix90
-rw-r--r--os/core/drivers.nix17
-rw-r--r--os/core/greet.nix18
-rw-r--r--os/core/networking.nix86
-rw-r--r--os/core/security.nix4
-rw-r--r--os/core/users.nix2
6 files changed, 175 insertions, 42 deletions
diff --git a/os/core/audio.nix b/os/core/audio.nix
index 1e8985a..a7fb5db 100644
--- a/os/core/audio.nix
+++ b/os/core/audio.nix
@@ -24,24 +24,104 @@ in
config = lib.mkMerge [
(lib.mkIf cfg.enable {
+ services.pulseaudio.enable = false;
+ security.rtkit.enable = true;
+
services = {
pipewire = {
enable = true;
audio.enable = true;
pulse.enable = true;
- alsa.enable = true;
- alsa.support32Bit = true;
+ alsa = {
+ enable = true;
+ support32Bit = true;
+ };
jack.enable = true;
- wireplumber.enable = true;
+ wireplumber = {
+ enable = true;
+ extraConfig = {
+ "99-lock-microphone-gain" = {
+ "pulse.rules" = [
+ {
+ matches = [
+ { "application.name" = "~*cord*"; }
+ ];
+ actions = {
+ quirks = [ "no-source-volume" ];
+ };
+ }
+ ];
+ };
+ "99-disable-suspend" = {
+ "monitor.alsa.rules" = [
+ {
+ matches = [
+ { "node.name" = "~alsa_input.*"; }
+ { "node.name" = "~alsa_output.*"; }
+ ];
+ actions.update-props = {
+ "session.suspend-timeout-seconds" = 0;
+ };
+ }
+ ];
+ };
+ "10-bluetooth-policy" = {
+ "wireplumber.profiles" = {
+ "main" = {
+ "policy.bluetooth" = "enabled";
+ };
+ };
+ "monitor.bluez.properties" = {
+ "bluez5.roles" = [
+ "a2dp_sink"
+ "a2dp_source"
+ "bap_sink"
+ "bap_source"
+ "hfp_hf"
+ "hsp_hs"
+ ];
+ "bluez5.codecs" = [
+ "sbc"
+ "sbc_xq"
+ "aac"
+ "ldac"
+ "aptx"
+ "aptx_hd"
+ ];
+ };
+ };
+ };
+ };
};
playerctld.enable = true;
- spotifyd.enable = true;
};
- security.rtkit.enable = true;
+ systemd.user.services.pipewire-quantum = {
+ description = "Set strict low-latency PipeWire quantum";
+ after = [ "wireplumber.service" ];
+ bindsTo = [ "pipewire.service" ];
+ wantedBy = [ "wireplumber.service" ];
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = [
+ "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.quantum 512"
+ "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.min-quantum 512"
+ ];
+ };
+ };
+
+ programs.noisetorch.enable = true;
+
+ systemd.user.services.pipewire-pulse = {
+ serviceConfig = {
+ Environment = [ "LADSPA_PATH=/tmp" ];
+ };
+ };
+
environment.systemPackages = with pkgs; [
toggleMuteNotify
pulsemixer
+ pavucontrol
crosspipe
alsa-utils
];
diff --git a/os/core/drivers.nix b/os/core/drivers.nix
index d6b2cec..e6e2814 100644
--- a/os/core/drivers.nix
+++ b/os/core/drivers.nix
@@ -9,7 +9,6 @@ let
cfg = config.os.core.drivers;
in
{
- imports = [ inputs.nix-gaming-edge.nixosModules.default ];
options.os.core.drivers = {
enable = lib.mkEnableOption "enables hardware drivers";
@@ -25,14 +24,6 @@ in
graphics = {
enable = lib.mkEnableOption "graphics support";
- version = lib.mkOption {
- type = lib.types.enum [
- "stable"
- "git"
- ];
- default = "stable";
- description = "Which Mesa version to use. 'git' uses the mesa-git overlay.";
- };
amdgpu.enable = lib.mkEnableOption "amd specific gpu features";
};
@@ -92,14 +83,6 @@ in
];
};
})
- (lib.mkIf (cfg.graphics.enable && cfg.graphics.version == "git") {
- nixpkgs.overlays = [ inputs.nix-gaming-edge.overlays.mesa-git ];
- drivers.mesa-git = {
- enable = true;
- # cacheCleanup.enable = true;
- # steamOrphanCleanup.enable = true;
- };
- })
{
boot.kernelPackages =
let
diff --git a/os/core/greet.nix b/os/core/greet.nix
index 67457e3..1c01b68 100644
--- a/os/core/greet.nix
+++ b/os/core/greet.nix
@@ -15,15 +15,15 @@ in
settings = {
default_session = {
user = "greeter";
- command = ''
- ${pkgs.tuigreet}/bin/tuigreet \
- --sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions \
- --remember \
- --remember-user-session \
- --asterisks \
- --greeting 'Welcome to NixOS!' \
- --time
- '';
+ command = lib.concatStringsSep " " [
+ "${pkgs.tuigreet}/bin/tuigreet"
+ "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions"
+ "--remember"
+ "--remember-user-session"
+ "--asterisks"
+ "--greeting 'Welcome to NixOS!'"
+ "--time"
+ ];
};
};
};
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 22fc206..d50d899 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -19,21 +19,72 @@ in
default = "client";
description = "Which networking profile configuration to apply";
};
+
+ lan = lib.mkOption {
+ description = "Physical Home Local Area Network configuration parameters.";
+ type = lib.types.submodule {
+ options = {
+ ip = lib.mkOption {
+ type = lib.types.str;
+ default = "10.0.0.2";
+ description = "The local static or leased IP assigned to this machine on the home network.";
+ };
+ range = lib.mkOption {
+ type = lib.types.str;
+ default = "10.0.0.0/8";
+ description = "The broader subnet block representing the physical home network.";
+ };
+ };
+ };
+ };
+
+ wg = lib.mkOption {
+ description = "Standard WireGuard VPN tunnel configuration parameters.";
+ type = lib.types.submodule {
+ options = {
+ ip = lib.mkOption {
+ type = lib.types.str;
+ default = "10.3.0.1";
+ description = "The explicit tunnel IP address assigned to this machine's WireGuard interface.";
+ };
+ range = lib.mkOption {
+ type = lib.types.str;
+ default = "10.3.0.0/24";
+ description = "The total addressable IP space assigned to the WireGuard network pool.";
+ };
+ };
+ };
+ };
+
+ hs = lib.mkOption {
+ description = "Headscale mesh overlay network configuration parameters.";
+ type = lib.types.submodule {
+ options = {
+ ip = lib.mkOption {
+ type = lib.types.str;
+ default = "10.4.0.1";
+ description = "The explicit mesh network IP address assigned to this machine via Headscale.";
+ };
+ range = lib.mkOption {
+ type = lib.types.str;
+ default = "10.4.0.0/24";
+ description = "The full mesh overlay allocation subnet block.";
+ };
+ };
+ };
+ };
};
config = lib.mkIf cfg.enable (
lib.mkMerge [
{
- networking.networkmanager = {
- enable = true;
- dns = "systemd-resolved";
- };
-
services.resolved.enable = true;
}
(lib.mkIf (cfg.profile == "client") {
networking.networkmanager = {
+ enable = true;
+ dns = "systemd-resolved";
wifi.macAddress = "random";
wifi.backend = "iwd";
ethernet.macAddress = "random";
@@ -47,9 +98,28 @@ in
})
(lib.mkIf (cfg.profile == "server") {
- networking.networkmanager = {
- wifi.macAddress = "keep";
- ethernet.macAddress = "keep";
+ networking = {
+ useNetworkd = true;
+ useDHCP = false;
+ };
+ systemd.network = {
+ enable = true;
+
+ netdevs."10-br-srv" = {
+ netdevConfig = {
+ Name = "br-srv";
+ Kind = "bridge";
+ };
+ };
+ networks."20-host-management" = {
+ matchConfig.Name = "br-srv";
+ address = [ "10.0.0.2/24" ];
+ gateway = [ "10.0.0.1" ];
+ networkConfig.LinkLocalAddressing = "no";
+ };
+ };
+ boot.kernel.sysctl = {
+ "net.ipv4.ip_nonlocal_bind" = 1;
};
})
]
diff --git a/os/core/security.nix b/os/core/security.nix
index f69ab1f..33aa919 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -30,13 +30,13 @@ in
}
];
};
- sudo.enable = false;
+ # sudo.enable = false;
pam.services = {
swaylock = { };
login.enableGnomeKeyring = true;
};
};
- environment.systemPackages = [ pkgs.doas-sudo-shim ];
+ # environment.systemPackages = [ pkgs.doas-sudo-shim ];
}
(lib.mkIf cfg.sandboxing.enable {
security.apparmor = {
diff --git a/os/core/users.nix b/os/core/users.nix
index 1ba471f..494406b 100644
--- a/os/core/users.nix
+++ b/os/core/users.nix
@@ -21,7 +21,7 @@ in
sops.secrets = {
"users/root_password".neededForUsers = true;
"users/main_password".neededForUsers = true;
- "users/opc_password".neededForUsers = true;
+ # "users/opc_password".neededForUsers = true;
};
users = {
mutableUsers = false;
generated by cgit v1.3 (git 2.53.0) at 2026-08-17 01:32:30 +0000