blob: cf25777b0d7eae457c6f5c4df98179dcff743263 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
{ flake, flakeInputs, pkgs, config, lib, ... }:
{
imports = with flake.nixosModules.systemProfiles; [
./hw.nix ./fs.nix ./networking
tmpfs-root default-locale openssh lanzaboote zswap initrd-all-crypto-modules
];
config = {
system.stateVersion = "26.05";
boot = {
initrd = {
systemd = {
emergencyAccess = config.users.users.root.hashedPassword;
extraBin = {
"vim" = lib.getExe pkgs.vim;
"grep" = lib.getExe pkgs.gnugrep;
};
};
kernelModules = [ "dm-integrity" ];
};
lanzaboote.configurationLimit = 15;
loader = {
efi.canTouchEfiVariables = true;
timeout = null;
};
plymouth.enable = true;
kernelPackages = pkgs.linuxPackages_7_2;
consoleLogLevel = 3;
kernelParams = [
"quiet"
"boot.shell_on_fail"
"udev.log_priority=3"
"rd.systemd.show_status=auto"
"plymouth.use-simpledrm"
];
tmp.useTmpfs = true;
};
services.timesyncd.enable = false;
services.chrony = {
enable = true;
enableNTS = true;
servers = [];
extraConfig = ''
pool time.cloudflare.com iburst nts
pool nts.netnod.se prefer iburst nts
server ptbtime1.ptb.de prefer iburst nts
server ptbtime2.ptb.de prefer iburst nts
server ptbtime3.ptb.de prefer iburst nts
server ptbtime4.ptb.de prefer iburst nts
pool ntppool1.time.nl prefer iburst nts
pool ntppool2.time.nl prefer iburst nts
authselectmode require
minsources 3
nocerttimecheck 1
leapsectz right/UTC
makestep 0.1 3
cmdport 0
'';
};
services.userborn.importLegacyState = false;
services.kmscon = {
enable = true;
config.hwaccel = true;
};
environment.persistence."/persistent".timezone = true;
time.timeZone = null;
systemd.tmpfiles.settings = {
"10-localtime"."/etc/localtime".L.argument = "/persistent/etc/localtime";
};
services.openssh.enable = true;
services.logind.settings.Login = {
HandleLidSwitch = "sleep";
HandleLidSwitchExternalPower = "ignore";
};
systemd.timers.nix-gc = lib.mkForce {
timerConfig = {
RandomizedDelaySec = "12h";
Persistent = true;
OnCalendar = "*-*-* 18:00:00 Europe/Berlin";
};
wantedBy = [ "timers.target" ];
};
systemd.services.nix-gc = lib.mkForce {
description = "Nix Garbage Collector";
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.resholve.writeScript "nix-gc" {
interpreter = lib.getExe pkgs.zsh;
inputs = [ pkgs.coreutils config.nix.package ];
execer = [ "cannot:${lib.getExe' config.nix.package "nix-collect-garbage"}" ];
} ''
max_size=$(($(du -bs /nix/store | cut -f 1) - 1024**4))
[[ $max_size -gt 0 ]] || exit 0
exec nix-collect-garbage -vv --max-freed $max_size --delete-older-than 30d
'';
};
restartIfChanged = false;
};
};
}
|
