From 037bee53a4e719ba3ed4ccc48b3c6a2edc52b883 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Tue, 22 Sep 2026 14:43:25 +0200 Subject: skadhi: initial commit --- accounts/gkleen@skadhi/default.nix | 24 +++++++++++ accounts/root@skadhi.nix | 10 +++++ flake.lock | 22 ++++++++++ flake.nix | 4 ++ hosts/sif/default.nix | 6 --- hosts/skadhi/default.nix | 87 ++++++++++++++++++++++++++++++++++++++ hosts/skadhi/hw.nix | 72 +++++++++++++++++++++++++++++++ system-profiles/disko.nix | 5 +++ system-profiles/networkmanager.nix | 14 +++--- users/gkleen/default.nix | 2 +- 10 files changed, 233 insertions(+), 13 deletions(-) create mode 100644 accounts/gkleen@skadhi/default.nix create mode 100644 accounts/root@skadhi.nix create mode 100644 hosts/skadhi/default.nix create mode 100644 hosts/skadhi/hw.nix create mode 100644 system-profiles/disko.nix diff --git a/accounts/gkleen@skadhi/default.nix b/accounts/gkleen@skadhi/default.nix new file mode 100644 index 00000000..97faf86c --- /dev/null +++ b/accounts/gkleen@skadhi/default.nix @@ -0,0 +1,24 @@ +{ flake, userName, config, lib, ... }: +let + user = config.users.users.${userName}; +in { + imports = with flake.nixosModules.userProfiles.${userName}; [ + zsh + ]; + + config = { + users.users.gkleen.group = "gkleen"; + users.groups.gkleen = {}; + systemd.tmpfiles.settings.home-directories.${user.home} = lib.mkForce { + v = { + mode = user.homeMode; + user = user.name; + inherit (user) group; + }; + }; + + home-manager.users.${userName} = { + home.stateVersion = "26.05"; + }; + }; +} diff --git a/accounts/root@skadhi.nix b/accounts/root@skadhi.nix new file mode 100644 index 00000000..425d9a04 --- /dev/null +++ b/accounts/root@skadhi.nix @@ -0,0 +1,10 @@ +{ flake, userName, ... }: +{ + imports = with flake.nixosModules.userProfiles.${userName}; [ + zsh + ]; + + config.home-manager.users.${userName} = { + home.stateVersion = "26.05"; + }; +} diff --git a/flake.lock b/flake.lock index 27cc7f81..9d71635e 100644 --- a/flake.lock +++ b/flake.lock @@ -105,6 +105,27 @@ "type": "github" } }, + "disko": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1768920986, + "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=", + "owner": "nix-community", + "repo": "disko", + "rev": "de5708739256238fb912c62f03988815db89ec9a", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "latest", + "repo": "disko", + "type": "github" + } + }, "flake-compat": { "flake": false, "locked": { @@ -1312,6 +1333,7 @@ "backup-utils": "backup-utils", "ca-util": "ca-util", "deploy-rs": "deploy-rs", + "disko": "disko", "flake-compat": "flake-compat_3", "flake-registry": "flake-registry", "flake-utils": "flake-utils", diff --git a/flake.nix b/flake.nix index 421bb2c8..f69dd773 100644 --- a/flake.nix +++ b/flake.nix @@ -246,6 +246,10 @@ flake-utils.follows = "flake-utils"; }; }; + disko = { + url = "github:nix-community/disko/latest"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = { self, nixpkgs, home-manager, sops-nix, deploy-rs, nvfetcher, niri-flake, ... }@inputs: diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix index 6e5571b5..5ea9dfd2 100644 --- a/hosts/sif/default.nix +++ b/hosts/sif/default.nix @@ -122,12 +122,6 @@ in { useNetworkd = true; }; - environment.etc."NetworkManager/dnsmasq.d/dnssec.conf" = { - text = '' - conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf - dnssec - ''; - }; environment.etc."NetworkManager/dnsmasq.d/libvirt_dnsmasq.conf" = { text = '' except-interface=virbr0 diff --git a/hosts/skadhi/default.nix b/hosts/skadhi/default.nix new file mode 100644 index 00000000..e9d5cc59 --- /dev/null +++ b/hosts/skadhi/default.nix @@ -0,0 +1,87 @@ +{ flake, flakeInputs, pkgs, config, lib, ... }: +{ + imports = with flake.nixosModules.systemProfiles; [ + ./hw.nix + tmpfs-root default-locale openssh niri-unstable networkmanager lanzaboote zswap + flakeInputs.nixVirt.nixosModules.default + ]; + + config = { + system.stateVersion = "26.05"; + + fileSystems."/persistent".neededForBoot = true; + environment.persistence."/persistent" = { + hideMounts = true; + directories = [ + "/nix" + "/root" + "/home" + "/var/log" + "/var/lib/nixos" + "/var/lib/sops-nix" + "/var/lib/systemd" + ]; + timezone = true; + }; + + boot = { + initrd.systemd = { + emergencyAccess = config.users.users.root.hashedPassword; + extraBin = { + "vim" = lib.getExe pkgs.vim; + "grep" = lib.getExe pkgs.gnugrep; + }; + }; + + lanzaboote.configurationLimit = 15; + loader = { + efi.canTouchEfiVariables = true; + timeout = null; + }; + + plymouth.enable = true; + + kernelPackages = pkgs.linuxPackages_7_2; + consoleLogLevel = 3; + kernelParams = [ + "quiet" + "boot.shell_on_fail" + "udev.log_priority=3" + "rd.systemd.show_status=auto" + "plymouth.use-simpledrm" + ]; + + tmp.useTmpfs = true; + }; + + services.timesyncd.enable = false; + services.chrony = { + enable = true; + enableNTS = true; + servers = []; + extraConfig = '' + pool time.cloudflare.com iburst nts + pool nts.netnod.se prefer iburst nts + server ptbtime1.ptb.de prefer iburst nts + server ptbtime2.ptb.de prefer iburst nts + server ptbtime3.ptb.de prefer iburst nts + server ptbtime4.ptb.de prefer iburst nts + pool ntppool1.time.nl prefer iburst nts + pool ntppool2.time.nl prefer iburst nts + + authselectmode require + minsources 3 + + nocerttimecheck 1 + + leapsectz right/UTC + + makestep 0.1 3 + + cmdport 0 + ''; + }; + + services.userborn.importLegacyState = false; + }; +} diff --git a/hosts/skadhi/hw.nix b/hosts/skadhi/hw.nix new file mode 100644 index 00000000..b95fc24c --- /dev/null +++ b/hosts/skadhi/hw.nix @@ -0,0 +1,72 @@ +{ flake, flakeInputs, pkgs, config, lib, ... }: +{ + imports = with flake.nixosModules.systemProfiles; [ + flakeInputs.nixos-hardware.nixosModules.framework-13-7040-amd + disko + ]; + + config = { + hardware.framework.laptop13.audioEnhancement.enable = true; + services.fstrim.enable = false; + + nixpkgs.system = "x86_64-linux"; + + disko.devices = { + disk.nvm = { + type = "disk"; + device = "/dev/nvm0n1"; + content = { + type = "gpt"; + partitions = { + ESP = { + size = "512M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ + "fmask=0033" "dmask=0022" + ]; + }; + }; + luks = { + size = "100%"; + content = { + type = "luks"; + name = "nvm"; + extraFormatArgs = [ + "--cipher" "aegis128-random" + "--key-size" "128" + "--integrity" "aead" + ]; + content = { + type = "btrfs"; + extraArgs = let + subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/home" "/var/log"]; + restricted = map (p: "/persistent/${p}") ["/root"]; + in [ + "--csum" "blake2" + "--compress" "zstd:15" + "--rootdir" (pkgs.runCommand "rootdir" { + } '' + install -d ${lib.escapeShellArgs (map (p: "$out/${p}") subvols)} + install -m 0700 -d ${lib.escapeShellArgs (map (p: "$out/${p}") restricted)} + '') + ] ++ lib.concatMap (p: ["--subvol" p]) subvols; + subvolumes = { + "/persistent".mountpoint = "/persistent"; + "/swap" = { + mountpoint = "/.swap"; + swap.swapfile.size = "96G"; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/system-profiles/disko.nix b/system-profiles/disko.nix new file mode 100644 index 00000000..52e1f003 --- /dev/null +++ b/system-profiles/disko.nix @@ -0,0 +1,5 @@ +{ flakeInputs, ... }: { + imports = [ + flakeInputs.disko.nixosModules.disko + ]; +} diff --git a/system-profiles/networkmanager.nix b/system-profiles/networkmanager.nix index 7ffd688a..3c6cb24e 100644 --- a/system-profiles/networkmanager.nix +++ b/system-profiles/networkmanager.nix @@ -1,21 +1,23 @@ -{ config, lib, ... }: - -with lib; - +{ config, pkgs, lib, ... }: { config = { networking = { networkmanager = { enable = true; dhcp = "internal"; - dns = mkForce "dnsmasq"; + dns = lib.mkForce "dnsmasq"; logLevel = "INFO"; settings.connectivity.uri = "https://online.yggdrasil.li"; }; }; + environment.etc."NetworkManager/dnsmasq.d/dnssec.conf".text = '' + conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf + dnssec + ''; + systemd.services."NetworkManager-wait-online".enable = false; - systemd.services."systemd-networkd-wait-online".enable = mkForce false; + systemd.services."systemd-networkd-wait-online".enable = lib.mkForce false; services.resolved.enable = false; }; diff --git a/users/gkleen/default.nix b/users/gkleen/default.nix index 9f606ea4..9aa3b632 100644 --- a/users/gkleen/default.nix +++ b/users/gkleen/default.nix @@ -8,7 +8,7 @@ in { users.users.${userName} = { description = "Gregor Kleen"; - extraGroups = [ "wheel" "networkmanager" "lp" "dialout" "audio" "video" "xmpp" "mail" "ssh" "vboxusers" "libvirtd" "wireshark" "games" "webdav"]; + extraGroups = [ "users" "wheel" "networkmanager" "lp" "dialout" "audio" "video" "xmpp" "mail" "ssh" "vboxusers" "libvirtd" "wireshark" "games" "webdav"]; createHome = true; home = "/home/${userName}"; shell = "${pkgs.zsh}/bin/zsh"; -- cgit v1.2.3