summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--hosts/skadhi/default.nix38
-rw-r--r--hosts/skadhi/fs.nix82
-rw-r--r--hosts/skadhi/hw.nix59
-rw-r--r--system-profiles/default-locale.nix1
-rw-r--r--system-profiles/initrd-all-crypto-modules.nix14
-rw-r--r--system-profiles/tmpfs-root.nix37
6 files changed, 130 insertions, 101 deletions
diff --git a/hosts/skadhi/default.nix b/hosts/skadhi/default.nix
index 66aa58d7..96be2e5b 100644
--- a/hosts/skadhi/default.nix
+++ b/hosts/skadhi/default.nix
@@ -1,36 +1,25 @@
1{ flake, flakeInputs, pkgs, config, lib, ... }: 1{ flake, flakeInputs, pkgs, config, lib, ... }:
2{ 2{
3 imports = with flake.nixosModules.systemProfiles; [ 3 imports = with flake.nixosModules.systemProfiles; [
4 ./hw.nix 4 ./hw.nix ./fs.nix
5 tmpfs-root default-locale openssh niri-unstable networkmanager lanzaboote zswap 5 tmpfs-root default-locale openssh niri-unstable networkmanager lanzaboote zswap initrd-all-crypto-modules
6 flakeInputs.nixVirt.nixosModules.default 6 flakeInputs.nixVirt.nixosModules.default
7 ]; 7 ];
8 8
9 config = { 9 config = {
10 system.stateVersion = "26.05"; 10 system.stateVersion = "26.05";
11 11
12 fileSystems."/persistent".neededForBoot = true;
13 environment.persistence."/persistent" = {
14 hideMounts = true;
15 directories = [
16 "/nix"
17 "/root"
18 "/var/log"
19 "/var/lib/nixos"
20 "/var/lib/sops-nix"
21 "/var/lib/systemd"
22 config.boot.lanzaboote.pkiBundle
23 ];
24 timezone = true;
25 };
26
27 boot = { 12 boot = {
28 initrd.systemd = { 13 initrd = {
29 emergencyAccess = config.users.users.root.hashedPassword; 14 systemd = {
30 extraBin = { 15 emergencyAccess = config.users.users.root.hashedPassword;
31 "vim" = lib.getExe pkgs.vim; 16 extraBin = {
32 "grep" = lib.getExe pkgs.gnugrep; 17 "vim" = lib.getExe pkgs.vim;
18 "grep" = lib.getExe pkgs.gnugrep;
19 };
33 }; 20 };
21
22 kernelModules = [ "dm-integrity" ];
34 }; 23 };
35 24
36 lanzaboote.configurationLimit = 15; 25 lanzaboote.configurationLimit = 15;
@@ -83,5 +72,10 @@
83 }; 72 };
84 73
85 services.userborn.importLegacyState = false; 74 services.userborn.importLegacyState = false;
75
76 services.kmscon = {
77 enable = true;
78 config.hwaccel = true;
79 };
86 }; 80 };
87} 81}
diff --git a/hosts/skadhi/fs.nix b/hosts/skadhi/fs.nix
new file mode 100644
index 00000000..cbeef6f9
--- /dev/null
+++ b/hosts/skadhi/fs.nix
@@ -0,0 +1,82 @@
1{ flake, flakeInputs, pkgs, config, lib, ... }:
2{
3 imports = with flake.nixosModules.systemProfiles; [
4 disko
5 ];
6
7 config = {
8 fileSystems."/persistent".neededForBoot = true;
9 environment.persistence."/persistent" = {
10 hideMounts = true;
11 directories = [
12 "/nix"
13 "/root"
14 "/var/log"
15 "/var/lib/nixos"
16 "/var/lib/sops-nix"
17 "/var/lib/systemd"
18 config.boot.lanzaboote.pkiBundle
19 ];
20 timezone = true;
21 };
22
23 disko.devices = {
24 disk.nvm = {
25 type = "disk";
26 device = "/dev/nvme0n1";
27 content = {
28 type = "gpt";
29 partitions = {
30 ESP = {
31 size = "512M";
32 type = "EF00";
33 content = {
34 type = "filesystem";
35 format = "vfat";
36 mountpoint = "/boot";
37 mountOptions = [
38 "fmask=0033" "dmask=0022"
39 ];
40 };
41 };
42 luks = {
43 size = "100%";
44 content = {
45 type = "luks";
46 name = "nvm";
47 extraFormatArgs = [
48 "--cipher" "aegis128-random"
49 "--key-size" "128"
50 "--integrity" "aead"
51 ];
52 content = {
53 type = "btrfs";
54 extraArgs = let
55 subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/var/log"];
56 restricted = map (p: "/persistent/${p}") ["/root"];
57 in [
58 "--csum" "blake2"
59 "--compress" "zstd:15"
60 "--rootdir" (toString (pkgs.runCommand "rootdir" {
61 } ''
62 mkdir $out
63 install -d ${lib.concatMapStringsSep " " (p: "$out/${p}") subvols}
64 install -m 0700 -d ${lib.concatMapStringsSep " " (p: "$out/${p}") restricted}
65 ''))
66 ] ++ lib.concatMap (p: ["--subvol" p]) subvols;
67 subvolumes = {
68 "/persistent".mountpoint = "/persistent";
69 "/swap" = {
70 mountpoint = "/.swap";
71 swap.swapfile.size = "96G";
72 };
73 };
74 };
75 };
76 };
77 };
78 };
79 };
80 };
81 };
82}
diff --git a/hosts/skadhi/hw.nix b/hosts/skadhi/hw.nix
index 0eb16b7a..02fb5c0e 100644
--- a/hosts/skadhi/hw.nix
+++ b/hosts/skadhi/hw.nix
@@ -16,64 +16,5 @@
16 ''; 16 '';
17 17
18 nixpkgs.system = "x86_64-linux"; 18 nixpkgs.system = "x86_64-linux";
19
20 disko.devices = {
21 disk.nvm = {
22 type = "disk";
23 device = "/dev/nvme0n1";
24 content = {
25 type = "gpt";
26 partitions = {
27 ESP = {
28 size = "512M";
29 type = "EF00";
30 content = {
31 type = "filesystem";
32 format = "vfat";
33 mountpoint = "/boot";
34 mountOptions = [
35 "fmask=0033" "dmask=0022"
36 ];
37 };
38 };
39 luks = {
40 size = "100%";
41 content = {
42 type = "luks";
43 name = "nvm";
44 extraFormatArgs = [
45 "--cipher" "aegis128-random"
46 "--key-size" "128"
47 "--integrity" "aead"
48 ];
49 content = {
50 type = "btrfs";
51 extraArgs = let
52 subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/var/log"];
53 restricted = map (p: "/persistent/${p}") ["/root"];
54 in [
55 "--csum" "blake2"
56 "--compress" "zstd:15"
57 "--rootdir" (toString (pkgs.runCommand "rootdir" {
58 } ''
59 mkdir $out
60 install -d ${lib.concatMapStringsSep " " (p: "$out/${p}") subvols}
61 install -m 0700 -d ${lib.concatMapStringsSep " " (p: "$out/${p}") restricted}
62 ''))
63 ] ++ lib.concatMap (p: ["--subvol" p]) subvols;
64 subvolumes = {
65 "/persistent".mountpoint = "/persistent";
66 "/swap" = {
67 mountpoint = "/.swap";
68 swap.swapfile.size = "96G";
69 };
70 };
71 };
72 };
73 };
74 };
75 };
76 };
77 };
78 }; 19 };
79} 20}
diff --git a/system-profiles/default-locale.nix b/system-profiles/default-locale.nix
index de2db1d7..cc103c9e 100644
--- a/system-profiles/default-locale.nix
+++ b/system-profiles/default-locale.nix
@@ -6,6 +6,7 @@
6 i18n.defaultLocale = "en_DK.UTF-8"; 6 i18n.defaultLocale = "en_DK.UTF-8";
7 console.keyMap = lib.mkDefault "dvorak-programmer"; 7 console.keyMap = lib.mkDefault "dvorak-programmer";
8 time.timeZone = lib.mkDefault "Europe/Berlin"; 8 time.timeZone = lib.mkDefault "Europe/Berlin";
9 services.kmscon.extraOptions = "--xkb-layout=us --xkb-variant=dvp --no-mouse";
9 } 10 }
10 ] ++ (lib.optional (options ? i18n.extraLocales) { 11 ] ++ (lib.optional (options ? i18n.extraLocales) {
11 i18n.extraLocales = [ "C.UTF-8/UTF-8" "en_US.UTF-8/UTF-8" ]; 12 i18n.extraLocales = [ "C.UTF-8/UTF-8" "en_US.UTF-8/UTF-8" ];
diff --git a/system-profiles/initrd-all-crypto-modules.nix b/system-profiles/initrd-all-crypto-modules.nix
index da6c781e..84f2129a 100644
--- a/system-profiles/initrd-all-crypto-modules.nix
+++ b/system-profiles/initrd-all-crypto-modules.nix
@@ -14,11 +14,11 @@ in {
14 boot.initrd.luks.cryptoModules = moduleList ++ [ 14 boot.initrd.luks.cryptoModules = moduleList ++ [
15 "encrypted_keys" "trusted" "rng" 15 "encrypted_keys" "trusted" "rng"
16 ]; 16 ];
17 boot.kernelPatches = [ 17 # boot.kernelPatches = [
18 { 18 # {
19 name = "encrypted_key"; 19 # name = "encrypted_keys";
20 patch = null; 20 # patch = null;
21 structuredExtraConfig.ENCRYPTED_KEYS = lib.kernel.yes; 21 # structuredExtraConfig.ENCRYPTED_KEYS = lib.kernel.yes;
22 } 22 # }
23 ]; 23 # ];
24} 24}
diff --git a/system-profiles/tmpfs-root.nix b/system-profiles/tmpfs-root.nix
index 23939c2e..7840dadf 100644
--- a/system-profiles/tmpfs-root.nix
+++ b/system-profiles/tmpfs-root.nix
@@ -1,14 +1,25 @@
1{ ... }: { 1{ options, lib, ... }: {
2 config = { 2 config = lib.mkMerge
3 # system.etc.overlay.enable = true; 3 [ (lib.mkIf (options ? disko) {
4 4 disko.devices.nodev = {
5 fileSystems."/" = { 5 "/" = {
6 fsType = "tmpfs"; 6 fsType = "tmpfs";
7 options = [ "mode=0755" ]; 7 mountOptions = [
8 }; 8 "mode=0755"
9 9 ];
10 security.sudo.extraConfig = '' 10 };
11 Defaults lecture = never 11 };
12 ''; 12 })
13 }; 13 (lib.mkIf (!(options ? disko)) {
14 fileSystems."/" = {
15 fsType = "tmpfs";
16 options = [ "mode=0755" ];
17 };
18 })
19 {
20 security.sudo.extraConfig = ''
21 Defaults lecture = never
22 '';
23 }
24 ];
14} 25}
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-23 11:25:31 +0000