From 1eba5398fd09f98bd11cbf8c3b80f20bb9ce1f2d Mon Sep 17 00:00:00 2001 From: adikro Date: Fri, 12 Jun 2026 00:53:25 +0200 Subject: microvm and dns stuff --- os/core/audio.nix | 90 +++++++++++++++++++++++++++++++++++++++++++++++--- os/core/drivers.nix | 17 ---------- os/core/greet.nix | 18 +++++----- os/core/networking.nix | 86 ++++++++++++++++++++++++++++++++++++++++++----- os/core/security.nix | 4 +-- os/core/users.nix | 2 +- 6 files changed, 175 insertions(+), 42 deletions(-) (limited to 'os/core') diff --git a/os/core/audio.nix b/os/core/audio.nix index 1e8985a..a7fb5db 100644 --- a/os/core/audio.nix +++ b/os/core/audio.nix @@ -24,24 +24,104 @@ in config = lib.mkMerge [ (lib.mkIf cfg.enable { + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services = { pipewire = { enable = true; audio.enable = true; pulse.enable = true; - alsa.enable = true; - alsa.support32Bit = true; + alsa = { + enable = true; + support32Bit = true; + }; jack.enable = true; - wireplumber.enable = true; + wireplumber = { + enable = true; + extraConfig = { + "99-lock-microphone-gain" = { + "pulse.rules" = [ + { + matches = [ + { "application.name" = "~*cord*"; } + ]; + actions = { + quirks = [ "no-source-volume" ]; + }; + } + ]; + }; + "99-disable-suspend" = { + "monitor.alsa.rules" = [ + { + matches = [ + { "node.name" = "~alsa_input.*"; } + { "node.name" = "~alsa_output.*"; } + ]; + actions.update-props = { + "session.suspend-timeout-seconds" = 0; + }; + } + ]; + }; + "10-bluetooth-policy" = { + "wireplumber.profiles" = { + "main" = { + "policy.bluetooth" = "enabled"; + }; + }; + "monitor.bluez.properties" = { + "bluez5.roles" = [ + "a2dp_sink" + "a2dp_source" + "bap_sink" + "bap_source" + "hfp_hf" + "hsp_hs" + ]; + "bluez5.codecs" = [ + "sbc" + "sbc_xq" + "aac" + "ldac" + "aptx" + "aptx_hd" + ]; + }; + }; + }; + }; }; playerctld.enable = true; - spotifyd.enable = true; }; - security.rtkit.enable = true; + systemd.user.services.pipewire-quantum = { + description = "Set strict low-latency PipeWire quantum"; + after = [ "wireplumber.service" ]; + bindsTo = [ "pipewire.service" ]; + wantedBy = [ "wireplumber.service" ]; + serviceConfig = { + Type = "oneshot"; + ExecStart = [ + "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.quantum 512" + "${pkgs.pipewire}/bin/pw-metadata -n settings 0 clock.min-quantum 512" + ]; + }; + }; + + programs.noisetorch.enable = true; + + systemd.user.services.pipewire-pulse = { + serviceConfig = { + Environment = [ "LADSPA_PATH=/tmp" ]; + }; + }; + environment.systemPackages = with pkgs; [ toggleMuteNotify pulsemixer + pavucontrol crosspipe alsa-utils ]; diff --git a/os/core/drivers.nix b/os/core/drivers.nix index d6b2cec..e6e2814 100644 --- a/os/core/drivers.nix +++ b/os/core/drivers.nix @@ -9,7 +9,6 @@ let cfg = config.os.core.drivers; in { - imports = [ inputs.nix-gaming-edge.nixosModules.default ]; options.os.core.drivers = { enable = lib.mkEnableOption "enables hardware drivers"; @@ -25,14 +24,6 @@ in graphics = { enable = lib.mkEnableOption "graphics support"; - version = lib.mkOption { - type = lib.types.enum [ - "stable" - "git" - ]; - default = "stable"; - description = "Which Mesa version to use. 'git' uses the mesa-git overlay."; - }; amdgpu.enable = lib.mkEnableOption "amd specific gpu features"; }; @@ -92,14 +83,6 @@ in ]; }; }) - (lib.mkIf (cfg.graphics.enable && cfg.graphics.version == "git") { - nixpkgs.overlays = [ inputs.nix-gaming-edge.overlays.mesa-git ]; - drivers.mesa-git = { - enable = true; - # cacheCleanup.enable = true; - # steamOrphanCleanup.enable = true; - }; - }) { boot.kernelPackages = let diff --git a/os/core/greet.nix b/os/core/greet.nix index 67457e3..1c01b68 100644 --- a/os/core/greet.nix +++ b/os/core/greet.nix @@ -15,15 +15,15 @@ in settings = { default_session = { user = "greeter"; - command = '' - ${pkgs.tuigreet}/bin/tuigreet \ - --sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions \ - --remember \ - --remember-user-session \ - --asterisks \ - --greeting 'Welcome to NixOS!' \ - --time - ''; + command = lib.concatStringsSep " " [ + "${pkgs.tuigreet}/bin/tuigreet" + "--sessions ${config.services.displayManager.sessionData.desktops}/share/xsessions:${config.services.displayManager.sessionData.desktops}/share/wayland-sessions" + "--remember" + "--remember-user-session" + "--asterisks" + "--greeting 'Welcome to NixOS!'" + "--time" + ]; }; }; }; diff --git a/os/core/networking.nix b/os/core/networking.nix index 22fc206..d50d899 100644 --- a/os/core/networking.nix +++ b/os/core/networking.nix @@ -19,21 +19,72 @@ in default = "client"; description = "Which networking profile configuration to apply"; }; + + lan = lib.mkOption { + description = "Physical Home Local Area Network configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.0.0.2"; + description = "The local static or leased IP assigned to this machine on the home network."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.0.0.0/8"; + description = "The broader subnet block representing the physical home network."; + }; + }; + }; + }; + + wg = lib.mkOption { + description = "Standard WireGuard VPN tunnel configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.3.0.1"; + description = "The explicit tunnel IP address assigned to this machine's WireGuard interface."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.3.0.0/24"; + description = "The total addressable IP space assigned to the WireGuard network pool."; + }; + }; + }; + }; + + hs = lib.mkOption { + description = "Headscale mesh overlay network configuration parameters."; + type = lib.types.submodule { + options = { + ip = lib.mkOption { + type = lib.types.str; + default = "10.4.0.1"; + description = "The explicit mesh network IP address assigned to this machine via Headscale."; + }; + range = lib.mkOption { + type = lib.types.str; + default = "10.4.0.0/24"; + description = "The full mesh overlay allocation subnet block."; + }; + }; + }; + }; }; config = lib.mkIf cfg.enable ( lib.mkMerge [ { - networking.networkmanager = { - enable = true; - dns = "systemd-resolved"; - }; - services.resolved.enable = true; } (lib.mkIf (cfg.profile == "client") { networking.networkmanager = { + enable = true; + dns = "systemd-resolved"; wifi.macAddress = "random"; wifi.backend = "iwd"; ethernet.macAddress = "random"; @@ -47,9 +98,28 @@ in }) (lib.mkIf (cfg.profile == "server") { - networking.networkmanager = { - wifi.macAddress = "keep"; - ethernet.macAddress = "keep"; + networking = { + useNetworkd = true; + useDHCP = false; + }; + systemd.network = { + enable = true; + + netdevs."10-br-srv" = { + netdevConfig = { + Name = "br-srv"; + Kind = "bridge"; + }; + }; + networks."20-host-management" = { + matchConfig.Name = "br-srv"; + address = [ "10.0.0.2/24" ]; + gateway = [ "10.0.0.1" ]; + networkConfig.LinkLocalAddressing = "no"; + }; + }; + boot.kernel.sysctl = { + "net.ipv4.ip_nonlocal_bind" = 1; }; }) ] diff --git a/os/core/security.nix b/os/core/security.nix index f69ab1f..33aa919 100644 --- a/os/core/security.nix +++ b/os/core/security.nix @@ -30,13 +30,13 @@ in } ]; }; - sudo.enable = false; + # sudo.enable = false; pam.services = { swaylock = { }; login.enableGnomeKeyring = true; }; }; - environment.systemPackages = [ pkgs.doas-sudo-shim ]; + # environment.systemPackages = [ pkgs.doas-sudo-shim ]; } (lib.mkIf cfg.sandboxing.enable { security.apparmor = { diff --git a/os/core/users.nix b/os/core/users.nix index 1ba471f..494406b 100644 --- a/os/core/users.nix +++ b/os/core/users.nix @@ -21,7 +21,7 @@ in sops.secrets = { "users/root_password".neededForUsers = true; "users/main_password".neededForUsers = true; - "users/opc_password".neededForUsers = true; + # "users/opc_password".neededForUsers = true; }; users = { mutableUsers = false; -- cgit v1.3