summaryrefslogtreecommitdiff
path: root/os
diff options
context:
space:
mode:
Diffstat (limited to 'os')
-rw-r--r--os/core/audio.nix49
-rw-r--r--os/core/bootloader.nix44
-rw-r--r--os/core/networking.nix1
-rw-r--r--os/core/ssh.nix19
-rw-r--r--os/srv/docker.nix14
-rw-r--r--os/srv/files.nix17
-rw-r--r--os/srv/gaming.nix1
-rw-r--r--os/srv/nix-helper.nix6
-rw-r--r--os/srv/sops.nix21
-rw-r--r--os/srv/srv.nix1
-rw-r--r--os/srv/virtualization.nix47
-rw-r--r--os/wm/niri.nix2
12 files changed, 157 insertions, 65 deletions
diff --git a/os/core/audio.nix b/os/core/audio.nix
index 2454a89..5b9607c 100644
--- a/os/core/audio.nix
+++ b/os/core/audio.nix
@@ -2,14 +2,18 @@
config,
lib,
pkgs,
+ username,
...
-}: let
+}:
+let
cfg = config.os.core.audio;
-in {
+in
+{
options.os.core.audio = {
enable = lib.mkEnableOption "audio support";
disable-devices.enable = lib.mkEnableOption "disables some random devices cluttering up";
};
+
config = lib.mkMerge [
(lib.mkIf cfg.enable {
services = {
@@ -21,10 +25,27 @@ in {
alsa.support32Bit = true;
jack.enable = true;
wireplumber.enable = true;
+
+ # wireplumber.extraConfig."10-force-input-awake" = {
+ # "monitor.alsa.rules" = [
+ # {
+ # matches = [
+ # { "node.name" = "~alsa_input.*HyperX.*"; }
+ # { "node.name" = "~alsa_output.*HyperX.*"; }
+ # ];
+ # actions.update-props = {
+ # "session.suspend-on-idle" = false;
+ # };
+ # }
+ # ];
+ # };
};
playerctld.enable = true;
spotifyd.enable = true;
};
+
+ users.users.${username}.linger = true;
+
security.rtkit.enable = true;
hardware.enableAllFirmware = true;
@@ -32,30 +53,26 @@ in {
helvum
alsa-utils
];
+
+ # boot.kernelParams = [ "usbcore.autosuspend=-1" ];
+ # boot.extraModprobeConfig = ''
+ # options snd-usb-audio power_save=0
+ # '';
})
+
(lib.mkIf cfg.disable-devices.enable {
services.pipewire.wireplumber.extraConfig = {
- "10-keep-hyperx-alive"."monitor.alsa.rules" = [
+ "99-disable-useless-devices"."monitor.alsa.rules" = [
{
matches = [
- {"device.description" = "~HyperX*";}
+ { "device.name" = "~alsa_card.pci-0000_03_00.1*"; }
+ { "device.description" = "~USB Audio*"; }
];
actions.update-props = {
- "device.disabled" = false;
- "session.suspend-on-idle" = false;
+ "device.disabled" = true;
};
}
];
-
- "99-disable-useless-devices"."monitor.alsa.rules" = [
- {
- matches = [
- {"device.name" = "~alsa_card.pci-0000_03_00.1*";}
- {"device.description" = "~USB Audio*";}
- ];
- actions.update-props = {"device.disabled" = true;};
- }
- ];
};
})
];
diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index dfd9101..aae167e 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -1,10 +1,12 @@
{
config,
lib,
+ pkgs,
...
}:
let
cfg = config.os.core.bootloader;
+ gpgHome = "/root/.gnupg";
in
{
options.os.core.bootloader = {
@@ -12,6 +14,7 @@ in
type = lib.types.enum [
"systemd-boot"
"grub"
+ "none"
];
default = "systemd-boot";
description = "Which bootloader to use";
@@ -19,7 +22,7 @@ in
efi = lib.mkOption {
type = lib.types.bool;
- default = true;
+ default = if cfg.grub.device == "nodev" then true else false;
description = "Whether the system uses UEFI or Legacy BIOS";
};
@@ -45,6 +48,13 @@ in
default = 0;
description = "Index of the default boot entry";
};
+ signing = {
+ enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
+ keyId = lib.mkOption {
+ type = lib.types.str;
+ description = "The GPG Key ID used to sign the boot files";
+ };
+ };
};
luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -56,7 +66,7 @@ in
boot = {
loader = {
timeout = cfg.timeout;
- efi.canTouchEfiVariables = cfg.efi;
+ efi.canTouchEfiVariables = lib.mkDefault cfg.efi;
};
supportedFilesystems = [
"ntfs"
@@ -92,10 +102,38 @@ in
efiSupport = cfg.efi;
useOSProber = cfg.grub.useOSProber;
default = cfg.grub.defaultEntry;
-
enableCryptodisk = cfg.luks.enable;
copyKernels = true;
+
+ extraConfig = lib.mkIf cfg.grub.signing.enable ''
+ set check_signatures=enforce
+ terminal_input console
+ terminal_output console
+ '';
+
+ extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
+ echo "Signing with keys from ${gpgHome}"
+
+ SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
+
+ $SIGN_CMD /boot/grub/grub.cfg
+
+ for f in /boot/nixos/*; do
+ if [[ "$f" != *.sig ]]; then
+ $SIGN_CMD "$f"
+ fi
+ done
+ '';
};
+ environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
})
+ {
+ assertions = [
+ {
+ assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
+ message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
+ }
+ ];
+ }
];
}
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 830f475..4835cb8 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -6,6 +6,7 @@ in
options.os.core.network.enable = lib.mkEnableOption "system-wide networking setup";
config = lib.mkIf cfg.enable {
networking = {
+ useDHCP = lib.mkDefault true;
networkmanager = {
enable = true;
wifi.macAddress = "stable-ssid";
diff --git a/os/core/ssh.nix b/os/core/ssh.nix
index 4069d31..d41c116 100644
--- a/os/core/ssh.nix
+++ b/os/core/ssh.nix
@@ -10,21 +10,32 @@ let
in
{
options.os.core.ssh.enable = lib.mkEnableOption "enables ssh server setup";
+
config = lib.mkIf cfg.enable {
+ environment.systemPackages = [ pkgs.rclone ];
services.tailscale = {
enable = true;
openFirewall = true;
};
- services.openssh.enable = true;
+ services.openssh = {
+ enable = true;
+ settings = {
+ PasswordAuthentication = false;
+ KbdInteractiveAuthentication = false;
+ };
+ };
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
pinentryPackage = pkgs.pinentry-curses;
};
- users.users.${username}.openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5/Mr4PLMDflZ+SoaYP9N3kRbkkh1qL5NLSgW6C7sAu adikro@disroot.org"
- ];
+
+ users.users = {
+ ${username}.openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5/Mr4PLMDflZ+SoaYP9N3kRbkkh1qL5NLSgW6C7sAu adikro@disroot.org"
+ ];
+ };
};
}
diff --git a/os/srv/docker.nix b/os/srv/docker.nix
deleted file mode 100644
index a87ea5d..0000000
--- a/os/srv/docker.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ config, lib, pkgs, username, ... }:
-let
- cfg = config.os.srv.docker;
-in
-{
- options.os.srv.docker.enable = lib.mkEnableOption "enables the docker container engine";
- config = lib.mkIf cfg.enable {
- virtualisation.docker.enable = true;
-
- environment.systemPackages = [ pkgs.docker-compose ];
-
- users.users.${username}.extraGroups = [ "docker" ];
- };
-}
diff --git a/os/srv/files.nix b/os/srv/files.nix
index 875a825..719642c 100644
--- a/os/srv/files.nix
+++ b/os/srv/files.nix
@@ -10,13 +10,19 @@ in
{
options.os.srv.files = {
enable = lib.mkEnableOption "enables general file management stuff";
+ localsend.enable = lib.mkEnableOption "enables localsend for sharing files locally";
krusader.enable = lib.mkEnableOption "enables krusader for easier file moving using ssh";
};
config = lib.mkMerge [
- {
+ (lib.mkIf cfg.enable {
programs.thunar = {
enable = true;
plugins = with pkgs; [
+ ffmpegthumbnailer
+ libgsf
+ poppler
+ freetype
+ webp-pixbuf-loader
thunar-volman
thunar-archive-plugin
];
@@ -31,8 +37,13 @@ in
pxz
pigz
];
- }
-
+ })
+ (lib.mkIf cfg.localsend.enable {
+ programs.localsend = {
+ enable = true;
+ openFirewall = true;
+ };
+ })
(lib.mkIf cfg.krusader.enable {
environment.systemPackages = with pkgs; [
krusader
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 912a252..3e2eea4 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -77,6 +77,7 @@ in
proton-ge-bin
];
};
+ environment.systemPackages = with pkgs; [ steamtinkerlaunch ];
})
# --- VR SUPPORT ---
diff --git a/os/srv/nix-helper.nix b/os/srv/nix-helper.nix
index 0bb819a..5e5e133 100644
--- a/os/srv/nix-helper.nix
+++ b/os/srv/nix-helper.nix
@@ -28,9 +28,9 @@ in
clean.extraArgs = "--keep 5";
};
- # environment.sessionVariables = {
- # NH_OS_FLAKE = "/etc/nixos";
- # };
+ environment.sessionVariables = {
+ NH_OS_FLAKE = "/etc/nixos";
+ };
environment.systemPackages = with pkgs; [
nix-output-monitor
diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 3c9f0a9..40f9c74 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -12,26 +12,31 @@ in
{
imports = [ inputs.sops-nix.nixosModules.sops ];
- options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix secret storing";
+ options.os.srv.sops = {
+ enable = lib.mkEnableOption "enables sops-nix";
+ diskEncryption = lib.mkEnableOption "enables initrd decryption key (LUKS)";
+ };
config = lib.mkIf cfg.enable {
sops = {
- defaultSopsFile = ../../secrets/secrets.yaml;
+ defaultSopsFile = ../../secrets/common.yaml;
defaultSopsFormat = "yaml";
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets = {
- "syncthing/gui_password".owner = username;
+ "syncthing/gui_password" = {
+ owner = username;
+ sopsFile = ../../secrets/oci.yaml;
+ };
"obs/websocket_password".owner = username;
root_password.neededForUsers = true;
user_password.neededForUsers = true;
-# crypt_key = { };
+ oracler_password = {
+ neededForUsers = true;
+ sopsFile = ../../secrets/oci.yaml;
+ };
};
};
-# boot.initrd.secrets = {
-# "/tmp/crypt.key" = config.sops.secrets.crypt_key.path;
-# };
-
environment.systemPackages = with pkgs; [
sops
age
diff --git a/os/srv/srv.nix b/os/srv/srv.nix
index 0e2a4f7..8ee895b 100644
--- a/os/srv/srv.nix
+++ b/os/srv/srv.nix
@@ -5,7 +5,6 @@
./sops.nix
./bluetooth.nix
./compat.nix
- ./docker.nix
./files.nix
./gaming.nix
./virtualization.nix
diff --git a/os/srv/virtualization.nix b/os/srv/virtualization.nix
index f32737b..143e9da 100644
--- a/os/srv/virtualization.nix
+++ b/os/srv/virtualization.nix
@@ -2,23 +2,46 @@
config,
lib,
pkgs,
+ username,
...
}:
let
cfg = config.os.srv.virtualization;
in
{
- options.os.srv.virtualization.enable =
- lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
- config = lib.mkIf cfg.enable {
- virtualisation.libvirtd = {
- enable = true;
- qemu.package = pkgs.qemu_kvm;
- qemu.swtpm.enable = true;
- };
- systemd.services.libvirt-guests.enable = false;
- programs.virt-manager.enable = true;
-
- boot.initrd.kernelModules = lib.optional (config.os.core.drivers.amd.enable or false) "kvm-amd";
+ options.os.srv.virtualization = {
+ kvm.enable = lib.mkEnableOption "KVM/QEMU virtualization with Virt-Manager";
+ docker.enable = lib.mkEnableOption "Docker Container Virtualization";
+ waydroid.enable = lib.mkEnableOption "Waydroid Container Virtualization";
};
+ config = lib.mkMerge [
+ (lib.mkIf cfg.kvm.enable {
+ virtualisation.libvirtd = {
+ enable = true;
+ qemu.package = pkgs.qemu_kvm;
+ qemu.swtpm.enable = true;
+ };
+ systemd.services.libvirt-guests.enable = false;
+ programs.virt-manager.enable = true;
+
+ boot.initrd.kernelModules =
+ (lib.optional (config.os.core.drivers.cpu == "amd") "kvm-amd")
+ ++ (lib.optional (config.os.core.drivers.cpu == "intel") "kvm-intel");
+ })
+ (lib.mkIf cfg.docker.enable {
+ virtualisation.docker.enable = true;
+ environment.systemPackages = [ pkgs.docker-compose ];
+ users.users.${username}.extraGroups = [ "docker" ];
+ })
+ (lib.mkIf cfg.waydroid.enable {
+ virtualisation.waydroid = {
+ enable = true;
+ package = pkgs.waydroid-nftables;
+ };
+
+ environment.systemPackages = with pkgs; [
+ waydroid-helper
+ ];
+ })
+ ];
}
diff --git a/os/wm/niri.nix b/os/wm/niri.nix
index 58d27af..587f543 100644
--- a/os/wm/niri.nix
+++ b/os/wm/niri.nix
@@ -19,7 +19,7 @@ in
programs.niri = {
enable = true;
- package = pkgs.niri-unstable;
+ # package = pkgs.niri-unstable;
};
os.srv.compat.enable = true;
generated by cgit v1.3 (git 2.53.0) at 2026-08-17 02:23:11 +0000