Migrate aspi host config

This commit is contained in:
Julian Mutter 2025-04-22 22:47:36 +02:00
parent 05350e1c1c
commit 94498a0038
29 changed files with 349 additions and 518 deletions

View File

@ -26,17 +26,21 @@
./hardware-configuration.nix
../common/global
../common/users/gabriel
../common/users/julian
../common/optional/peripherals.nix
../common/optional/greetd.nix
# ../common/optional/greetd.nix
../common/optional/pipewire.nix
../common/optional/quietboot.nix
../common/optional/wireless.nix
../common/optional/lxd.nix
../common/optional/starcitizen-fixes.nix
../common/optional/remote-builder.nix
../common/optional/boot-efi.nix
../common/optional/pcmanfm.nix
../common/optional/i3.nix
../common/optional/gdm.nix
../common/optional/redshift.nix
../common/optional/virtualbox.nix
../common/optional/xdg-portal.nix
../common/optional/polkit.nix # TODO: maybe not needed!
../common/optional/keyring.nix # TODO: maybe not needed!
];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
@ -47,51 +51,22 @@
# networking.networkmanager.dns = "systemd-resolved";
services.resolved.enable = true;
topology.self = {
hardware.info = "ThinkPad L430, 8GB RAM";
};
time.timeZone = "Europe/Berlin";
sops.secrets = {
"password/aspi".neededForUsers = true; # necessary for setting password
};
hardware.graphics.enable = true;
modules = {
sops.enable = true;
nix-settings.enable = true;
xserver-defaults.enable = true;
keymap.enable = true;
builder.enable = true;
system.boot-efi.enable = true;
sound.enable = true;
locales.enable = true;
# thunar.enable = true;
pcmanfm.enable = true;
i3.enable = true;
gdm.enable = true;
# tuigreet.enable = true;
redshift.enable = true;
# wayland.enable = true;
# hyprland.enable = true;
# tuigreet.enable = true;
virtualbox.enable = true;
users-julian.enable = true;
syncthing = {
enable = true;
overrideSettings = false;
};
xdg-portal.enable = true;
polkit.enable = true;
keyring.enable = true;
};
users.mutableUsers = false;
users.users.julian.hashedPasswordFile = config.sops.secrets."password/aspi".path;
services.blueman.enable = true;
services.upower.enable = true;

View File

@ -14,6 +14,7 @@
./openssh.nix
./podman.nix
./sops.nix
./xserver.nix
]
++ [
inputs.home-manager.nixosModules.home-manager

View File

@ -13,4 +13,12 @@
LC_TELEPHONE = "de_DE.UTF-8";
LC_TIME = "de_DE.UTF-8";
};
# Keymap
services.xserver.xkb = {
layout = "de";
variant = "";
};
# Configure console keymap
console.keyMap = "de";
}

View File

@ -0,0 +1,6 @@
{
services.xserver = {
enable = true;
wacom.enable = true;
};
}

View File

@ -0,0 +1,17 @@
{
# Bootloader
# Use this for simple nix boot menu, if no dual boot required
boot.loader.systemd-boot.enable = true;
boot.loader.systemd-boot.configurationLimit = 10;
boot.loader.efi.canTouchEfiVariables = true;
# https://github.com/NixOS/nixpkgs/blob/c32c39d6f3b1fe6514598fa40ad2cf9ce22c3fb7/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix#L66
boot.loader.systemd-boot.editor = false;
boot.supportedFilesystems = [
"btrfs"
"ntfs"
"nfs"
"cifs"
];
}

View File

@ -0,0 +1,16 @@
{
config,
lib,
pkgs,
...
}:
{
services.xserver.displayManager.gdm = {
enable = true;
};
# unlock GPG keyring on login
security.pam.services.gdm.enableGnomeKeyring = true;
}

View File

@ -0,0 +1,49 @@
{
pkgs,
lib,
config,
...
}:
let
homeCfgs = config.home-manager.users;
homeSharePaths = lib.mapAttrsToList (_: v: "${v.home.path}/share") homeCfgs;
vars = ''XDG_DATA_DIRS="$XDG_DATA_DIRS:${lib.concatStringsSep ":" homeSharePaths}" GTK_USE_PORTAL=0'';
julianCfg = homeCfgs.julian;
sway-kiosk =
command:
"${lib.getExe pkgs.sway} --unsupported-gpu --config ${pkgs.writeText "kiosk.config" ''
output * bg #000000 solid_color
xwayland disable
input "type:touchpad" {
tap enabled
}
exec '${vars} ${command}; ${pkgs.sway}/bin/swaymsg exit'
''}";
in
{
users.extraUsers.greeter = {
# For caching and such
home = "/tmp/greeter-home";
createHome = true;
};
programs.regreet = {
enable = true;
iconTheme = julianCfg.gtk.iconTheme;
theme = julianCfg.gtk.theme;
font = julianCfg.fontProfiles.regular;
cursorTheme = {
inherit (julianCfg.gtk.cursorTheme) name package;
};
settings.background = {
path = julianCfg.wallpaper;
fit = "Cover";
};
};
services.greetd = {
enable = true;
settings.default_session.command = sway-kiosk (lib.getExe config.programs.regreet.package);
};
}

View File

@ -0,0 +1,17 @@
{
config,
lib,
pkgs,
...
}:
{
services.xserver.windowManager.i3.enable = true;
services.xserver.windowManager.i3.package = pkgs.i3-gaps;
services.displayManager.defaultSession = "none+i3";
programs.xss-lock = {
# responds to "loginctl lock-session" via dbus
enable = true;
lockerCommand = "${pkgs.i3lock}/bin/i3lock --ignore-empty-password --color=000000";
};
}

View File

@ -0,0 +1,12 @@
{
config,
lib,
pkgs,
...
}:
{
programs.seahorse.enable = true;
services.gnome.gnome-keyring.enable = true;
}

View File

@ -0,0 +1,13 @@
{
pkgs,
...
}:
{
environment.systemPackages = with pkgs; [
shared-mime-info # extended mimetype support
lxde.lxmenu-data # open with "Installed Applications"
pcmanfm
];
services.gvfs.enable = true; # Mount, trash, and other functionalities
}

View File

@ -0,0 +1,19 @@
{
security.rtkit.enable = true;
hardware.pulseaudio.enable = false;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
jack.enable = true;
extraConfig.pipewire = {
"99-no-bell" = {
# Disable bell sound
"context.properties" = {
"module.x11.bell" = false;
};
};
};
};
}

View File

@ -0,0 +1,27 @@
{
config,
lib,
pkgs,
...
}:
{
security.polkit.enable = true;
systemd = {
user.services.polkit-gnome-authentication-agent-1 = {
description = "polkit-gnome-authentication-agent-1";
wantedBy = [ "graphical-session.target" ];
wants = [ "graphical-session.target" ];
after = [ "graphical-session.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
Restart = "on-failure";
RestartSec = 1;
TimeoutStopSec = 10;
};
};
};
}

View File

@ -0,0 +1,32 @@
{
pkgs,
config,
...
}:
{
console = {
useXkbConfig = true;
earlySetup = false;
};
boot = {
plymouth = {
enable = true;
theme = "spinner-monochrome";
themePackages = [
(pkgs.plymouth-spinner-monochrome.override { inherit (config.boot.plymouth) logo; })
];
};
loader.timeout = 0;
kernelParams = [
"quiet"
"loglevel=3"
"systemd.show_status=auto"
"udev.log_level=3"
"rd.udev.log_level=3"
"vt.global_cursor_default=0"
];
consoleLogLevel = 0;
initrd.verbose = false;
};
}

View File

@ -0,0 +1,15 @@
{
config,
lib,
pkgs,
...
}:
{
# Set location used by redshift
location.provider = "manual";
location.latitude = 47.92;
location.longitude = 10.12;
services.redshift.enable = true;
}

View File

@ -0,0 +1,34 @@
{
nix.distributedBuilds = true;
nix.settings.builders-use-substitutes = true;
nix.buildMachines = [
{
hostName = "builder.julian-mutter.de";
protocol = "ssh";
sshUser = "nix";
systems = [
"x86_64-linux"
"aarch64-linux"
];
maxJobs = 4;
speedFactor = 3;
supportedFeatures = [
"nixos-test"
"benchmark"
"big-parallel"
"kvm"
];
mandatoryFeatures = [ ];
}
# {
# hostName = "localhost";
# protocol = null;
# systems = [
# "x86_64-linux"
# ];
# maxJobs = 4;
# speedFactor = 1;
# }
];
}

View File

@ -0,0 +1,15 @@
{
config,
lib,
pkgs,
...
}:
{
virtualisation.virtualbox.host.enable = true;
# virtualisation.virtualbox.host.enableExtensionPack = true;
# virtualisation.virtualbox.guest.enable = true;
# virtualisation.virtualbox.guest.x11 = true;
users.extraGroups.vboxusers.members = [ "julian" ];
}

View File

@ -0,0 +1,13 @@
{
config,
lib,
pkgs,
...
}:
{
xdg.portal.enable = true;
xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
xdg.portal.config.common.default = "*"; # Use first portal implementation found
# hyprland desktop portal added automatically
}

View File

@ -0,0 +1,41 @@
{
pkgs,
config,
lib,
...
}:
let
ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
in
{
users.mutableUsers = false;
users.users.julian = {
description = "Julian";
group = "julian";
isNormalUser = true;
shell = pkgs.fish;
extraGroups = ifTheyExist [
"networkmanager"
"wheel"
"audio"
"network"
"video"
"podman"
"docker"
"git"
];
openssh.authorizedKeys.keys = lib.splitString "\n" (
builtins.readFile ../../../../home/julian/ssh.pub
);
hashedPasswordFile = config.sops.secrets.julian-password.path;
packages = [ pkgs.home-manager ];
};
sops.secrets.julian-password = {
sopsFile = ../../secrets.yaml;
neededForUsers = true;
};
home-manager.users.julian = import ../../../../home/julian/${config.networking.hostName}.nix;
}

View File

@ -1,35 +0,0 @@
{
options,
config,
lib,
...
}:
with lib;
with lib.frajul;
let
cfg = config.modules.system.boot-efi;
in
{
options.modules.system.boot-efi = with types; {
enable = mkBoolOpt false "Whether or not to enable efi booting.";
};
config = mkIf cfg.enable {
# Bootloader
# Use this for simple nix boot menu, if no dual boot required
boot.loader.systemd-boot.enable = true;
boot.loader.systemd-boot.configurationLimit = 10;
boot.loader.efi.canTouchEfiVariables = true;
# https://github.com/NixOS/nixpkgs/blob/c32c39d6f3b1fe6514598fa40ad2cf9ce22c3fb7/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix#L66
boot.loader.systemd-boot.editor = false;
boot.supportedFilesystems = [
"btrfs"
"ntfs"
"nfs"
"cifs"
];
};
}

View File

@ -1,39 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.gdm;
in
{
options.modules.gdm = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
services.xserver.displayManager.gdm = {
enable = true;
};
# unlock GPG keyring on login
security.pam.services.gdm.enableGnomeKeyring = true;
};
}

View File

@ -1,42 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.keymap;
in
{
options.modules.keymap = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
services.xserver = {
xkb.layout = "de";
xkb.variant = "";
};
# Configure console keymap
console.keyMap = "de";
# or use this
# console.useXkbConfig = true;
};
}

View File

@ -1,63 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.nix-settings;
in
{
options.modules.nix-settings = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
nix.settings.auto-optimise-store = true;
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
# Setup binary caches
nix.settings = {
substituters = [
"https://nix-community.cachix.org"
"https://cache.nixos.org/"
"https://hyprland.cachix.org"
"http://binarycache.julian-mutter.de"
];
trusted-public-keys = [
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
"binarycache.julian-mutter.de:oJ67uRFwRhNPKL58CHzy3QQLv38Kx7OA1K+6xlEPu7E="
];
trusted-users = [ "@wheel" ]; # needed for devenv to add custom caches
};
nix.gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
programs.nix-ld.enable = true;
};
}

View File

@ -1,40 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.pcmanfm;
in
{
options.modules.pcmanfm = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; [
shared-mime-info # extended mimetype support
lxde.lxmenu-data # open with "Installed Applications"
pcmanfm
];
services.gvfs.enable = true; # Mount, trash, and other functionalities
};
}

View File

@ -1,51 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.polkit;
in
{
options.modules.polkit = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
security.polkit.enable = true;
systemd = {
user.services.polkit-gnome-authentication-agent-1 = {
description = "polkit-gnome-authentication-agent-1";
wantedBy = [ "graphical-session.target" ];
wants = [ "graphical-session.target" ];
after = [ "graphical-session.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
Restart = "on-failure";
RestartSec = 1;
TimeoutStopSec = 10;
};
};
};
};
}

View File

@ -1,38 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.redshift;
in
{
options.modules.redshift = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
# Set location used by redshift
location.provider = "manual";
location.latitude = 47.92;
location.longitude = 10.12;
services.redshift.enable = true;
};
}

View File

@ -1,53 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.sound;
in
{
options.modules.sound = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
hardware.pulseaudio.enable = false;
hardware.enableAllFirmware = true;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
jack.enable = true;
extraConfig.pipewire = {
"99-no-bell" = {
# Disable bell sound
"context.properties" = {
"module.x11.bell" = false;
};
};
};
};
};
}

View File

@ -1,38 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.virtualbox;
in
{
options.modules.virtualbox = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
virtualisation.virtualbox.host.enable = true;
# virtualisation.virtualbox.host.enableExtensionPack = true;
# virtualisation.virtualbox.guest.enable = true;
# virtualisation.virtualbox.guest.x11 = true;
users.extraGroups.vboxusers.members = [ "julian" ];
};
}

View File

@ -1,37 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.xdg-portal;
in
{
options.modules.xdg-portal = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
xdg.portal.enable = true;
xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
xdg.portal.config.common.default = "*"; # Use first portal implementation found
# hyprland desktop portal added automatically
};
}

View File

@ -1,43 +0,0 @@
{
# Snowfall Lib provides a customized `lib` instance with access to your flake's library
# as well as the libraries available from your flake's inputs.
lib,
# An instance of `pkgs` with your overlays and packages applied is also available.
pkgs,
# You also have access to your flake's inputs.
inputs,
# Additional metadata is provided by Snowfall Lib.
namespace, # The namespace used for your flake, defaulting to "internal" if not set.
system, # The system architecture for this host (eg. `x86_64-linux`).
target, # The Snowfall Lib target for this system (eg. `x86_64-iso`).
format, # A normalized name for the system target (eg. `iso`).
virtual, # A boolean to determine whether this system is a virtual target using nixos-generators.
systems, # An attribute map of your defined hosts.
# All other arguments come from the module system.
config,
...
}:
let
cfg = config.modules.xserver-defaults;
in
{
options.modules.xserver-defaults = {
enable = lib.mkOption { default = false; };
};
config = lib.mkIf cfg.enable {
services.xserver = {
enable = true;
wacom.enable = true;
# Keymap
xkb.layout = "de";
xkb.variant = "";
};
hardware.graphics.enable = true;
};
}