10 files changed, 233 insertions, 13 deletions

diff --git a/accounts/gkleen@skadhi/default.nix b/accounts/gkleen@skadhi/default.nix
new file mode 100644
index 00000000..97faf86c
--- /dev/null
+++ b/accounts/gkleen@skadhi/default.nix
@@ -0,0 +1,24 @@
+{ flake, userName, config, lib, ... }:
+let
+  user = config.users.users.${userName};
+in {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh
+  ];
+
+  config = {
+    users.users.gkleen.group = "gkleen";
+    users.groups.gkleen = {};
+    systemd.tmpfiles.settings.home-directories.${user.home} = lib.mkForce {
+      v = {
+        mode = user.homeMode;
+        user = user.name;
+        inherit (user) group;
+      };
+    };
+
+    home-manager.users.${userName} = {
+      home.stateVersion = "26.05";
+    };
+  };
+}
diff --git a/accounts/root@skadhi.nix b/accounts/root@skadhi.nix
new file mode 100644
index 00000000..425d9a04
--- /dev/null
+++ b/accounts/root@skadhi.nix
@@ -0,0 +1,10 @@
+{ flake, userName, ... }:
+{
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh
+  ];
+
+  config.home-manager.users.${userName} = {
+    home.stateVersion = "26.05";
+  };
+}
diff --git a/flake.lock b/flake.lock
index 27cc7f81..9d71635e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -105,6 +105,27 @@
         "type": "github"
       }
     },
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768920986,
+        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "de5708739256238fb912c62f03988815db89ec9a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "latest",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -1312,6 +1333,7 @@
         "backup-utils": "backup-utils",
         "ca-util": "ca-util",
         "deploy-rs": "deploy-rs",
+        "disko": "disko",
         "flake-compat": "flake-compat_3",
         "flake-registry": "flake-registry",
         "flake-utils": "flake-utils",
diff --git a/flake.nix b/flake.nix
index 421bb2c8..f69dd773 100644
--- a/flake.nix
+++ b/flake.nix
@@ -246,6 +246,10 @@
         flake-utils.follows = "flake-utils";
       };
     };
+    disko = {
+      url = "github:nix-community/disko/latest";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, home-manager, sops-nix, deploy-rs, nvfetcher, niri-flake, ... }@inputs:
diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 6e5571b5..5ea9dfd2 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -122,12 +122,6 @@ in {
       useNetworkd = true;
     };
 
-    environment.etc."NetworkManager/dnsmasq.d/dnssec.conf" = {
-      text = ''
-        conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf
-        dnssec
-      '';
-    };
     environment.etc."NetworkManager/dnsmasq.d/libvirt_dnsmasq.conf" = {
       text = ''
         except-interface=virbr0
diff --git a/hosts/skadhi/default.nix b/hosts/skadhi/default.nix
new file mode 100644
index 00000000..e9d5cc59
--- /dev/null
+++ b/hosts/skadhi/default.nix
@@ -0,0 +1,87 @@
+{ flake, flakeInputs, pkgs, config, lib, ... }:
+{
+  imports = with flake.nixosModules.systemProfiles; [
+    ./hw.nix
+    tmpfs-root default-locale openssh niri-unstable networkmanager lanzaboote zswap
+    flakeInputs.nixVirt.nixosModules.default
+  ];
+
+  config = {
+    system.stateVersion = "26.05";
+
+    fileSystems."/persistent".neededForBoot = true;
+    environment.persistence."/persistent" = {
+      hideMounts = true;
+      directories = [
+        "/nix"
+        "/root"
+        "/home"
+        "/var/log"
+        "/var/lib/nixos"
+        "/var/lib/sops-nix"
+        "/var/lib/systemd"
+      ];
+      timezone = true;
+    };
+
+    boot = {
+      initrd.systemd = {
+        emergencyAccess = config.users.users.root.hashedPassword;
+        extraBin = {
+          "vim" = lib.getExe pkgs.vim;
+          "grep" = lib.getExe pkgs.gnugrep;
+        };
+      };
+
+      lanzaboote.configurationLimit = 15;
+      loader = {
+        efi.canTouchEfiVariables = true;
+        timeout = null;
+      };
+
+      plymouth.enable = true;
+
+      kernelPackages = pkgs.linuxPackages_7_2;
+      consoleLogLevel = 3;
+      kernelParams = [
+        "quiet"
+        "boot.shell_on_fail"
+        "udev.log_priority=3"
+        "rd.systemd.show_status=auto"
+        "plymouth.use-simpledrm"
+      ];
+
+      tmp.useTmpfs = true;
+    };
+
+    services.timesyncd.enable = false;
+    services.chrony = {
+      enable = true;
+      enableNTS = true;
+      servers = [];
+      extraConfig = ''
+        pool time.cloudflare.com iburst nts
+        pool nts.netnod.se prefer iburst nts
+        server ptbtime1.ptb.de prefer iburst nts
+        server ptbtime2.ptb.de prefer iburst nts
+        server ptbtime3.ptb.de prefer iburst nts
+        server ptbtime4.ptb.de prefer iburst nts
+        pool ntppool1.time.nl prefer iburst nts
+        pool ntppool2.time.nl prefer iburst nts
+
+        authselectmode require
+        minsources 3
+
+        nocerttimecheck 1
+
+        leapsectz right/UTC
+
+        makestep 0.1 3
+
+        cmdport 0
+      '';
+    };
+
+    services.userborn.importLegacyState = false;
+  };
+}
diff --git a/hosts/skadhi/hw.nix b/hosts/skadhi/hw.nix
new file mode 100644
index 00000000..b95fc24c
--- /dev/null
+++ b/hosts/skadhi/hw.nix
@@ -0,0 +1,72 @@
+{ flake, flakeInputs, pkgs, config, lib, ... }:
+{
+  imports = with flake.nixosModules.systemProfiles; [
+    flakeInputs.nixos-hardware.nixosModules.framework-13-7040-amd
+    disko
+  ];
+
+  config = {
+    hardware.framework.laptop13.audioEnhancement.enable = true;
+    services.fstrim.enable = false;
+
+    nixpkgs.system = "x86_64-linux";
+
+    disko.devices = {
+      disk.nvm = {
+        type = "disk";
+        device = "/dev/nvm0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "fmask=0033" "dmask=0022"
+                ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "nvm";
+                extraFormatArgs = [
+                  "--cipher" "aegis128-random"
+                  "--key-size" "128"
+                  "--integrity" "aead"
+                ];
+                content = {
+                  type = "btrfs";
+                  extraArgs = let
+                    subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/home" "/var/log"];
+                    restricted = map (p: "/persistent/${p}") ["/root"];
+                  in [
+                    "--csum" "blake2"
+                    "--compress" "zstd:15"
+                    "--rootdir" (pkgs.runCommand "rootdir" {
+                    } ''
+                      install -d ${lib.escapeShellArgs (map (p: "$out/${p}") subvols)}
+                      install -m 0700 -d ${lib.escapeShellArgs (map (p: "$out/${p}") restricted)}
+                    '')
+                  ] ++ lib.concatMap (p: ["--subvol" p]) subvols;
+                  subvolumes = {
+                    "/persistent".mountpoint = "/persistent";
+                    "/swap" = {
+                      mountpoint = "/.swap";
+                      swap.swapfile.size = "96G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/system-profiles/disko.nix b/system-profiles/disko.nix
new file mode 100644
index 00000000..52e1f003
--- /dev/null
+++ b/system-profiles/disko.nix
@@ -0,0 +1,5 @@
+{ flakeInputs, ... }: {
+  imports = [
+    flakeInputs.disko.nixosModules.disko
+  ];
+}
diff --git a/system-profiles/networkmanager.nix b/system-profiles/networkmanager.nix
index 7ffd688a..3c6cb24e 100644
--- a/system-profiles/networkmanager.nix
+++ b/system-profiles/networkmanager.nix
@@ -1,21 +1,23 @@
-{ config, lib, ... }:
-
-with lib;
-
+{ config, pkgs, lib, ... }:
 {
   config = {
     networking = {
       networkmanager = {
         enable = true;
         dhcp = "internal";
-        dns = mkForce "dnsmasq";
+        dns = lib.mkForce "dnsmasq";
         logLevel = "INFO";
               settings.connectivity.uri = "https://online.yggdrasil.li";
       };
     };
 
+    environment.etc."NetworkManager/dnsmasq.d/dnssec.conf".text = ''
+      conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf
+      dnssec
+    '';
+
     systemd.services."NetworkManager-wait-online".enable = false;
-    systemd.services."systemd-networkd-wait-online".enable = mkForce false;
+    systemd.services."systemd-networkd-wait-online".enable = lib.mkForce false;
 
     services.resolved.enable = false;
   };
diff --git a/users/gkleen/default.nix b/users/gkleen/default.nix
index 9f606ea4..9aa3b632 100644
--- a/users/gkleen/default.nix
+++ b/users/gkleen/default.nix
@@ -8,7 +8,7 @@ in {
 
   users.users.${userName} = {
     description = "Gregor Kleen";
-    extraGroups = [ "wheel" "networkmanager" "lp" "dialout" "audio" "video" "xmpp" "mail" "ssh" "vboxusers" "libvirtd" "wireshark" "games" "webdav"];
+    extraGroups = [ "users" "wheel" "networkmanager" "lp" "dialout" "audio" "video" "xmpp" "mail" "ssh" "vboxusers" "libvirtd" "wireshark" "games" "webdav"];
     createHome = true;
     home = "/home/${userName}";
     shell = "${pkgs.zsh}/bin/zsh";