commit 3c74ae65e1fd56e145f920fd05e8a248861b78ff
parent 9bf05a500ba9c81420dca40efdc5bda439177172
Author: vin <vin@vineetk.net>
Date: Mon, 13 Jan 2025 23:06:26 -0500
update lappy to config based on demiurge
Diffstat:
2 files changed, 227 insertions(+), 128 deletions(-)
diff --git a/hosts/lappy/default.nix b/hosts/lappy/default.nix
@@ -6,98 +6,161 @@
{
imports =
- [ # Include the results of the hardware scan.
+ [
./hardware.nix
home-manager.nixosModules.default
];
- # Use the systemd-boot EFI boot loader.
- boot.loader.systemd-boot.enable = true;
- boot.loader.efi.canTouchEfiVariables = true;
+ # boot options
+ boot.loader.grub = {
+ enable = true;
+ zfsSupport = true;
+ efiSupport = true;
+ efiInstallAsRemovable = true;
+ mirroredBoots = [{
+ devices = [ "nodev" ];
+ path = "/boot";
+ }];
+ };
- networking.hostName = "lappy"; # Define your hostname.
- # Pick only one of the below networking options.
- networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
- # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+
- # Set your time zone.
- time.timeZone = "America/Toronto";
+ # disable wifi and open some ports
+ networking = {
+ hostName = "lappy";
+ hostId = "deadcafe";
- # Configure network proxy if necessary
- # networking.proxy.default = "http://user:password@proxy:port/";
- # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+ wireless = {
+ enable = true;
- # Select internationalisation properties.
- i18n.defaultLocale = "en_US.UTF-8";
- console = {
- font = "Lat2-Terminus16";
- # keyMap = "us";
- useXkbConfig = true; # use xkb.options in tty.
- };
+ networks = {
+ OpenDyna.pskRaw = "***REDACTED_PSK***";
- # Enable the X11 windowing system.
- services.xserver = {
- enable = true;
- displayManager.startx.enable = true;
- videoDrivers = [ "modesetting" ];
- windowManager.i3.enable = true;
- xkb = {
- layout = "us";
- variant = "workman";
+ FloridaPoly = {
+ authProtocols = [ "WPA-EAP" ];
+ auth = ''
+ eap=PEAP
+ phase2="auth=MSCHAPv2"
+ identity="***REDACTED_EMAIL***"
+ password="***REDACTED_PASSWORD***"
+ '';
+ };
+
+ FloridaPoly_BYOD = {};
+
+ iphonebob.pskRaw = "***REDACTED_PSK***";
+ Retreat_86WiFi.pskRaw = "***REDACTED_PSK***";
+ Orbi-1.pskRaw = "***REDACTED_PSK***";
+ SETUP-E55E.pskRaw = "***REDACTED_PSK***";
+ };
};
- };
- services.picom = {
- enable = true;
- fade = false;
- inactiveOpacity = 0.75;
- shadow = true;
- };
+ firewall = {
+# allowedTCPPorts = [ ];
+# allowedUDPPorts = [ ];
+ };
- # Configure keymap in X11
- # services.xserver.xkb.layout = "us";
- # services.xserver.xkb.options = "eurosign:e,caps:escape";
+ wg-quick.interfaces = {
+ # vpn to vps
+ wg0 = {
+ address = [ "10.0.13.3/24" ];
- # Enable CUPS to print documents.
- services.printing.enable = true;
+ peers = [{
+ allowedIPs = [ "10.0.13.0/24" ];
+ endpoint = "vineetk.net:51820";
+ publicKey = "x3O4wISSau3DCrPRSplgGfSAizasbZAHzVqMR+WLzW4=";
+ presharedKey = "***REMOVED***";
+ persistentKeepalive = 25;
+ }];
- # Enable sound.
- hardware.pulseaudio.enable = true;
- # OR
- # services.pipewire = {
- # enable = true;
- # pulse.enable = true;
- # };
+ privateKey = "***REMOVED***";
+ };
+
+ # mullvad to miami
+ us-mia-wg-001 = {
+ address = [
+ "10.70.235.16/32"
+ "fc00:bbbb:bbbb:bb01::7:eb0f/128"
+ ];
+
+ peers = [{
+ allowedIPs = [ "0.0.0.0/0" "::0/0" ];
+ endpoint = "45.134.142.219:51820";
+ publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
+ }];
+
+ privateKey = "***REDACTED_WG_KEY***=";
+ };
+ };
+ };
- # Enable touchpad support (enabled default in most desktopManager).
- services.libinput.enable = true;
+ # Set your time zone.
+ time.timeZone = "America/Toronto";
+
+ # Select internationalisation properties.
+ i18n.defaultLocale = "en_US.UTF-8";
+ console = {
+ font = "Lat2-Terminus16";
+ };
# enable flakes and nix cli
nix.settings.experimental-features = [ "nix-command" "flakes" ];
- # Define a user account. Don't forget to set a password with ‘passwd’.
+ # Define a user account.
users.users.vin = {
isNormalUser = true;
- extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+
+ extraGroups = [
+ "kvm"
+ "libvirtd"
+ "transmission"
+ "wheel"
+ ];
+
shell = pkgs.zsh;
- openssh.authorizedKeys.keys =
- [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge" ];
+
+ openssh.authorizedKeys.keys = [
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
+ ];
};
- # List packages installed in system profile. To search, run:
- # $ nix search wget
- environment.systemPackages = with pkgs; [
- git
- emacs
- wget
- inputs.everblush-gtk.packages.x86_64-linux.default
- ];
- environment.pathsToLink = [ "/share/zsh" ];
+ # default packages for both me and root
+ environment = {
+ systemPackages = with pkgs; [
+ doas-sudo-shim
+ emacs
+ git
+ wget
+ ];
+
+ pathsToLink = [ "/share/zsh" ];
+ };
+
+ # enable bluetooth and add some udev rules
+ hardware = {
+ bluetooth.enable = true;
+ flipperzero.enable = true;
+ keyboard.qmk.enable = true;
+ };
+
+ programs = {
+ # for gtk in home-manager
+ dconf.enable = true;
+
+ # gpg
+ gnupg.agent = {
+ enable = true;
+ enableSSHSupport = true;
+ pinentryPackage = pkgs.pinentry-rofi;
+ settings.default-cache-ttl = 600;
+ };
- programs.zsh.enable = true;
+ # disable nano. I don't like nano.
+ nano.enable = false;
- # for gtk in home-manager
- programs.dconf.enable = true;
+ # configuration in home-manager
+ zsh.enable = true;
+ };
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
@@ -107,72 +170,89 @@
# enableSSHSupport = true;
# };
- security.sudo.enable = false;
- security.doas.enable = true;
- security.doas.extraRules = [{
- users = ["vin"];
- keepEnv = true;
- persist = true;
- }];
+ security = {
+ sudo.enable = false;
- # List services that you want to enable:
+ # I prefer doas over sudo for simplicity
+ doas = {
+ enable = true;
+ extraRules = [{
+ users = ["vin"];
+ keepEnv = true;
+ persist = true;
+ }];
+ };
+ };
- # Enable the OpenSSH daemon.
- services.openssh.enable = true;
+ services = {
+ # dns
+ dnsmasq = {
+ enable = true;
+ settings = {
+ server = [
+ "9.9.9.9"
+ "/vpn/10.0.13.1"
+ ];
- services.tlp = {
- enable = true;
- settings = {
- CPU_SCALING_GOVERNOR_ON_AC = "performance";
- CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+ interface = "lo";
+ listen-address = "127.0.0.1";
+ bind-interfaces = true;
+ no-resolv = true;
+ };
+ };
+
+ # graphical input
+ libinput = {
+ enable = true;
- CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
- CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
+ mouse.accelProfile = "flat";
- CPU_MIN_PERF_ON_AC = 0;
- CPU_MAX_PERF_ON_AC = 100;
- CPU_MIN_PERF_ON_BAT = 0;
- CPU_MAX_PERF_ON_BAT = 20;
+ touchpad = {
+ accelProfile = "flat";
+ tapping = true;
+ tappingButtonMap = "lrm";
+ };
};
- };
- powerManagement.powertop.enable = true;
+ # ssh
+ openssh = {
+ enable = true;
- # Open ports in the firewall.
- # networking.firewall.allowedTCPPorts = [ ... ];
- # networking.firewall.allowedUDPPorts = [ ... ];
- # Or disable the firewall altogether.
- # networking.firewall.enable = false;
+ settings = {
+ KbdInteractiveAuthentication = false;
+ PasswordAuthentication = false;
+ PermitRootLogin = "no";
+ X11Forwarding = true;
+ };
+ };
- networking.wireless.networks = {
- OpenDyna = {
- pskRaw = "***REDACTED_PSK***";
+ # sound. for some reason, pipewire enabled itself when I tried
+ # using pulseaudio and home-manager, so had to disable pulseaudio.
+ pipewire = {
+ enable = true;
+ pulse.enable = true;
+ };
+
+ # enable better power management
+ tlp.enable = true;
+
+ # to get startx and use amdgpu driver
+ # WM in home-manager
+ xserver = {
+ enable = true;
+ autorun = false;
+ displayManager.startx.enable = true;
+ videoDrivers = [ "modesetting" ];
};
- FloridaPoly-BYOD = {};
};
- # Copy the NixOS configuration file and link it from the resulting system
- # (/run/current-system/configuration.nix). This is useful in case you
- # accidentally delete configuration.nix.
- # system.copySystemConfiguration = true;
-
- # This option defines the first version of NixOS you have installed on this particular machine,
- # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
- #
- # Most users should NEVER change this value after the initial install, for any reason,
- # even if you've upgraded your system to a new NixOS release.
- #
- # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
- # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
- # to actually do that.
- #
- # This value being lower than the current NixOS release does NOT mean your system is
- # out of date, out of support, or vulnerable.
- #
- # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
- # and migrated your data accordingly.
- #
- # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
- system.stateVersion = "24.05"; # Did you read the comment?
+ # create caches and use mandoc
+ documentation.man = {
+ enable = true;
+ generateCaches = true;
+ man-db.enable = false;
+ mandoc.enable = true;
+ };
+ system.stateVersion = "24.05";
}
diff --git a/hosts/lappy/hardware.nix b/hosts/lappy/hardware.nix
@@ -8,26 +8,44 @@
[ (modulesPath + "/installer/scan/not-detected.nix")
];
- boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "rtsx_pci_sdmmc" ];
+ boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
- { device = "/dev/disk/by-uuid/ca781a71-db87-42ec-9387-bfb4f84f9fc3";
- fsType = "f2fs";
+ { device = "zroot/root";
+ fsType = "zfs";
};
- boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/d7eaeae5-f442-49ea-b32f-1b1bb061273a";
+ fileSystems."/nix" =
+ { device = "zroot/nix";
+ fsType = "zfs";
+ };
+
+ fileSystems."/var" =
+ { device = "zroot/var";
+ fsType = "zfs";
+ };
+
+ fileSystems."/home" =
+ { device = "zroot/home";
+ fsType = "zfs";
+ };
+
+ fileSystems."/data" =
+ { device = "zroot/data";
+ fsType = "zfs";
+ };
fileSystems."/boot" =
- { device = "/dev/disk/by-uuid/73C9-F112";
+ { device = "/dev/disk/by-uuid/BCF1-95FF";
fsType = "vfat";
- options = [ "fmask=0077" "dmask=0077" ];
+ options = [ "fmask=0022" "dmask=0022" ];
};
swapDevices =
- [ { device = "/dev/disk/by-uuid/37426a26-2a30-4ac6-b83e-94b2179c0148"; }
+ [ { device = "/dev/disk/by-uuid/7e66a653-5438-486f-99c6-0a1a51ef7d96"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
@@ -35,6 +53,7 @@
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp0s13f0u3u4.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
