From b978d3406df70995fbbbedad5101450f5a5c4fdb Mon Sep 17 00:00:00 2001 From: vin Date: Fri, 3 Oct 2025 21:55:19 -0400 Subject: modularize more --- flake.lock | 16 +-- hosts/demiurge/default.nix | 335 +++------------------------------------------ modules/common.nix | 199 +++++++++++++++++++++++++++ modules/desktop.nix | 129 +++++++++++++++++ 4 files changed, 358 insertions(+), 321 deletions(-) create mode 100644 modules/common.nix create mode 100644 modules/desktop.nix diff --git a/flake.lock b/flake.lock index 91080d6..ff49e7e 100644 --- a/flake.lock +++ b/flake.lock @@ -163,11 +163,11 @@ ] }, "locked": { - "lastModified": 1759043321, - "narHash": "sha256-Efi3THvsIS6Qd97s52/PSSHWybDlSbtUZXP8l3AR9Ps=", + "lastModified": 1759536080, + "narHash": "sha256-0aXlKPxm2M+F5oywX2TTbY0e6h+tQ+6OYyx7UZn3A4A=", "owner": "nix-community", "repo": "home-manager", - "rev": "c75fd8e300b79502b8eecdacd8a426b12fadb460", + "rev": "edafd6da1936426708f1be0b1a4288007f16639a", "type": "github" }, "original": { @@ -184,8 +184,8 @@ ] }, "locked": { - "lastModified": 1759087372, - "narHash": "sha256-AKIAHHbLn4Jrz0qeeKtO1cP/+e31Uok1NBPQMgh4lU0=", + "lastModified": 1759197167, + "narHash": "sha256-AwyoFll5dXyxLtipAdfthKSPKaL0nifDEhAKQ8baV1c=", "path": "/data/src/clones/llm/llama.cpp", "type": "path" }, @@ -211,11 +211,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1758690382, - "narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=", + "lastModified": 1759381078, + "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=", "owner": "nixos", "repo": "nixpkgs", - "rev": "e643668fd71b949c53f8626614b21ff71a07379d", + "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee", "type": "github" }, "original": { diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix index 749191a..75885e3 100644 --- a/hosts/demiurge/default.nix +++ b/hosts/demiurge/default.nix @@ -11,6 +11,8 @@ { imports = [ ./hardware.nix + ../../modules/common.nix + ../../modules/desktop.nix home-manager.nixosModules.default ]; @@ -63,39 +65,16 @@ }; # boot options - boot = { - kernel.sysctl = { - "net.ipv4.ip_forward" = true; - "net.ipv6.conf.all.forwarding" = true; - }; - - kernelPackages = pkgs.linuxPackages_6_12; - - loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - }; - - supportedFilesystems = [ "zfs" ]; - - zfs = { - devNodes = "/dev/disk/by-partuuid"; - extraPools = [ - "data_nvme" - "data_wd" - ]; - forceImportRoot = false; - }; - }; + boot.zfs.extraPools = [ + "data_nvme" + "data_wd" + ]; # disable wifi and open some ports networking = { hostName = "demiurge"; hostId = "cafebabe"; - # I like my ethX/wlanX names - usePredictableInterfaceNames = false; - wireless.enable = false; firewall = { @@ -151,216 +130,29 @@ }; }; - # Set your time zone. - time.timeZone = "America/Toronto"; - - # Select internationalisation properties. - i18n.defaultLocale = "en_US.UTF-8"; - console = { - font = "Lat2-Terminus16"; - }; - - # enable flakes and nix cli - nix.settings.experimental-features = [ - "nix-command" - "flakes" - ]; - - # Define a user account. users.users = { - vin = { - isNormalUser = true; - - extraGroups = [ - "transmission" - "wheel" - ]; - - shell = pkgs.zsh; - - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge" - ]; - - packages = with pkgs; [ - alvr - bs-manager - (llama-cpp.packages.x86_64-linux.rocm.override { - useMetalKit = false; - useVulkan = true; - }) - #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; }) - ]; - }; + vin.packages = with pkgs; [ + alvr + bs-manager + (llama-cpp.packages.x86_64-linux.rocm.override { + useMetalKit = false; + useVulkan = true; + }) + #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; }) + ]; radarr.extraGroups = [ "transmission" ]; sonarr.extraGroups = [ "transmission" ]; }; - # default packages for both me and root - environment = { - systemPackages = with pkgs; [ - doas-sudo-shim - git - wget - ]; - - pathsToLink = [ "/share/zsh" ]; - }; - - # enable bluetooth and add some udev rules - hardware = { - bluetooth.enable = true; - flipperzero.enable = true; - keyboard.qmk.enable = true; - }; - - programs = { - # for gtk in home-manager - dconf.enable = true; - - # gpg - gnupg.agent = { - enable = true; - enableSSHSupport = false; - pinentryPackage = pkgs.pinentry-rofi; - settings.default-cache-ttl = 600; - }; - - # disable nano. I don't like nano. - nano.enable = false; - - # steam, proprietary. I sometimes like playing nonfree games too. - steam.enable = true; - - # configuration in home-manager - zsh.enable = true; - zsh.promptInit = "PS1='$ '"; - }; - - security = { - # I prefer doas over sudo for simplicity - doas = { - enable = true; - extraRules = [ - { - users = [ "vin" ]; - keepEnv = true; - persist = true; - } - ]; - }; - sudo.enable = false; - - # needed to give realtime privileges to pipewire - rtkit.enable = true; - - # trust certificate for *.demiurge.epistemia - pki.certificates = [ - '' - -----BEGIN CERTIFICATE----- - MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw - ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A - ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu - QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y - NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0 - aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF - AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G - yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr - al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8 - GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl - u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM - X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B - Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ - idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw - DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d - /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr - jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL - 1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf - ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw - 2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt - i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9 - vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF - SivxomFBHWe4CLwWy/mDaC18/g== - -----END CERTIFICATE----- - '' - ]; - }; - services = { - # dns - unbound = { - enable = true; - settings = { - server = { - interface = [ - "127.0.0.1" - "100.64.0.2" - #"fd00:b0ba:cafe:babe::2" - "::1" - ]; - access-control = [ - "0.0.0.0/0 allow" - "::0/0 allow" - ]; - - hide-identity = true; - hide-version = true; - - # Synthesize NXDOMAINs from DNSSEC NSEC chains. - # https://tools.ietf.org/html/rfc8198 - aggressive-nsec = false; - - module-config = "\"respip validator iterator\""; - - local-data = [ - "\"saklas.epistemia. 86400 IN A 100.64.0.1\"" - "\"demiurge.epistemia. 86400 IN A 100.64.0.2\"" - "\"hastur.epistemia. 86400 IN A 100.64.0.3\"" - "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\"" - "\"lab.epistemia. 86400 IN A 100.64.0.5\"" - ]; - - local-zone = [ - "\"saklas.epistemia.\" redirect" - "\"demiurge.epistemia.\" redirect" - "\"hastur.epistemia.\" redirect" - "\"iphonebob.epistemia.\" redirect" - "\"lab.epistemia.\" redirect" - ]; - }; - - # hagezi for dns-based adblocking (in addition to others) - rpz = { - name = "hagezi.ultimate"; - zonefile = "hagezi.ultimate"; - url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"; - }; - - # go through mullvad for regular dns queries - forward-zone = { - name = "."; - forward-addr = [ "194.242.2.2" ]; - }; - }; - }; - # vpn + # TODO replace with wireguard again tailscale = { - enable = true; authKeyFile = config.age.secrets.tailscale_demiurge.path; - disableTaildrop = true; - disableUpstreamLogging = true; extraSetFlags = [ "--advertise-exit-node" ]; - #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ]; - extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ]; - openFirewall = true; - useRoutingFeatures = "both"; }; - # automatically scrub zfs pools (every week by default) - zfs.autoScrub.enable = true; - # media server jellyfin = { enable = true; @@ -402,19 +194,6 @@ }; }; - # graphical input - libinput = { - enable = true; - - mouse.accelProfile = "flat"; - - touchpad = { - accelProfile = "flat"; - tapping = true; - tappingButtonMap = "lrm"; - }; - }; - # music streaming to phone navidrome = { enable = true; @@ -484,22 +263,11 @@ }; # ssh - openssh = { - enable = true; - - listenAddresses = [ - { addr = "127.0.0.1"; port = 22; } - { addr = "192.168.1.2"; port = 22; } - { addr = "100.64.0.2"; port = 22; } - ]; - - settings = { - KbdInteractiveAuthentication = false; - PasswordAuthentication = true; - PermitRootLogin = "no"; - X11Forwarding = true; - }; - }; + openssh.listenAddresses = [ + { addr = "127.0.0.1"; port = 22; } + { addr = "192.168.1.2"; port = 22; } + { addr = "100.64.0.2"; port = 22; } + ]; # llm open-webui = { @@ -511,44 +279,6 @@ port = 8083; }; - # for yubikey - pcscd.enable = true; - - # sound. for some reason, pipewire enabled itself when I tried - # using pulseaudio and home-manager, so had to disable pulseaudio. - pipewire = { - enable = true; - alsa.enable = true; - audio.enable = true; - pulse.enable = true; - wireplumber = { - enable = true; - extraConfig = { - "51-set-default-eq.conf" = { - text = '' - monitor.rules = [ - { - matches = [ - { - # This rule matches the node with the name of your sink (node 35) - "node.name" = "effect_input.eq6" - } - ] - actions = { - update-props = { - # This sets a very high priority, making it the default. - # Standard hardware is usually around 1000. - "priority.session" = 2001 - } - } - } - ] - ''; - }; - }; - }; - }; - # reddit redlib = { enable = true; @@ -1023,31 +753,10 @@ GROUP="input", SYMLINK+="ocuquest%n" ''; }; - - # to get startx and use amdgpu driver - # WM in home-manager - xserver = { - enable = true; - autorun = false; - displayManager.startx.enable = true; - modules = [ pkgs.xf86_input_wacom ]; - videoDrivers = [ "amdgpu" ]; - wacom.enable = true; - }; }; # extra systemd stuff - systemd.services = { - nginx.after = [ "tailscaled-autoconnect.service" ]; - }; - - # create caches and use mandoc - documentation.man = { - enable = true; - generateCaches = true; - man-db.enable = false; - mandoc.enable = true; - }; + systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ]; system.stateVersion = "24.05"; } diff --git a/modules/common.nix b/modules/common.nix new file mode 100644 index 0000000..d613bf8 --- /dev/null +++ b/modules/common.nix @@ -0,0 +1,199 @@ +{ pkgs, ... }: { + # Set your time zone. + time.timeZone = "America/Toronto"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + console = { + font = "Lat2-Terminus16"; + }; + + # enable flakes and nix cli + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; + + # I like my ethX/wlanX names + networking.usePredictableInterfaceNames = false; + + + # use local dns on each host + services.unbound = { + enable = true; + settings = { + server = { + interface = [ + "127.0.0.1" + "100.64.0.2" + #"fd00:b0ba:cafe:babe::2" + "::1" + ]; + access-control = [ + "0.0.0.0/0 allow" + "::0/0 allow" + ]; + + hide-identity = true; + hide-version = true; + + # Synthesize NXDOMAINs from DNSSEC NSEC chains. + # https://tools.ietf.org/html/rfc8198 + aggressive-nsec = false; + + module-config = "\"respip validator iterator\""; + + local-data = [ + "\"saklas.epistemia. 86400 IN A 100.64.0.1\"" + "\"demiurge.epistemia. 86400 IN A 100.64.0.2\"" + "\"hastur.epistemia. 86400 IN A 100.64.0.3\"" + "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\"" + "\"lab.epistemia. 86400 IN A 100.64.0.5\"" + ]; + + local-zone = [ + "\"saklas.epistemia.\" redirect" + "\"demiurge.epistemia.\" redirect" + "\"hastur.epistemia.\" redirect" + "\"iphonebob.epistemia.\" redirect" + "\"lab.epistemia.\" redirect" + ]; + }; + + # hagezi for dns-based adblocking (in addition to others) + rpz = { + name = "hagezi.ultimate"; + zonefile = "hagezi.ultimate"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"; + }; + + # go through mullvad for regular dns queries + forward-zone = { + name = "."; + forward-addr = [ "194.242.2.2" ]; + }; + }; + }; + environment.etc."resolv.conf".text = '' + nameserver 127.0.0.1 + search epistemia + ''; + + # Define a user account. + users = { + groups.vin = {}; + users.vin = { + isNormalUser = true; + + group = "vin"; + extraGroups = [ + "transmission" + "wheel" + ]; + + shell = pkgs.zsh; + + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge" + ]; + }; + }; + + # default packages for both me and root + environment = { + systemPackages = with pkgs; [ + doas-sudo-shim + git + wget + ]; + + pathsToLink = [ "/share/zsh" ]; + }; + + # enable bluetooth and add some udev rules + hardware = { + bluetooth.enable = true; + flipperzero.enable = true; + keyboard.qmk.enable = true; + }; + + programs = { + # for gtk in home-manager + dconf.enable = true; + + # gpg + gnupg.agent = { + enable = true; + enableSSHSupport = false; + pinentryPackage = pkgs.pinentry-rofi; + settings.default-cache-ttl = 600; + }; + + # disable nano. I don't like nano. + nano.enable = false; + + # steam, proprietary. I sometimes like playing nonfree games too. + steam.enable = true; + + # configuration in home-manager + zsh.enable = true; + zsh.promptInit = "PS1='$ '"; + }; + + security = { + # I prefer doas over sudo for simplicity + doas = { + enable = true; + extraRules = [ + { + users = [ "vin" ]; + keepEnv = true; + persist = true; + } + ]; + }; + sudo.enable = false; + + # needed to give realtime privileges to pipewire + rtkit.enable = true; + + # trust certificate for *.demiurge.epistemia + pki.certificates = [ + '' + -----BEGIN CERTIFICATE----- + MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw + ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A + ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu + QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y + NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0 + aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G + yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr + al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8 + GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl + u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM + X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B + Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ + idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw + DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d + /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr + jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL + 1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf + ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw + 2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt + i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9 + vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF + SivxomFBHWe4CLwWy/mDaC18/g== + -----END CERTIFICATE----- + '' + ]; + }; + + # create caches and use mandoc + documentation.man = { + enable = true; + generateCaches = true; + man-db.enable = false; + mandoc.enable = true; + }; +} diff --git a/modules/desktop.nix b/modules/desktop.nix new file mode 100644 index 0000000..fb153e7 --- /dev/null +++ b/modules/desktop.nix @@ -0,0 +1,129 @@ +{ + config, + home-manager, + lib, + pkgs, + inputs, + llama-cpp, + ... +}: + +{ + imports = [ + home-manager.nixosModules.default + ]; + + # boot options + boot = { + kernel.sysctl = { + "net.ipv4.ip_forward" = true; + "net.ipv6.conf.all.forwarding" = true; + }; + + kernelPackages = pkgs.linuxPackages_6_16; + + loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + + supportedFilesystems = [ "zfs" ]; + + zfs = { + devNodes = "/dev/disk/by-partuuid"; + forceImportRoot = false; + }; + }; + + services = { + # vpn + # TODO replace with wireguard again + tailscale = { + enable = true; + disableTaildrop = true; + disableUpstreamLogging = true; + extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ]; + openFirewall = true; + useRoutingFeatures = "both"; + }; + + # automatically scrub zfs pools (every week by default) + zfs.autoScrub.enable = true; + + # graphical input + libinput = { + enable = true; + + mouse.accelProfile = "flat"; + + touchpad = { + accelProfile = "flat"; + tapping = true; + tappingButtonMap = "lrm"; + }; + }; + + # ssh + openssh = { + enable = true; + + settings = { + KbdInteractiveAuthentication = false; + PasswordAuthentication = true; + PermitRootLogin = "no"; + X11Forwarding = true; + }; + }; + + # for yubikey + pcscd.enable = true; + + # sound. for some reason, pipewire enabled itself when I tried + # using pulseaudio and home-manager, so had to disable pulseaudio. + pipewire = { + enable = true; + alsa.enable = true; + audio.enable = true; + pulse.enable = true; + wireplumber = { + enable = true; + extraConfig = { + "51-set-default-eq.conf" = { + text = '' + monitor.rules = [ + { + matches = [ + { + # This rule matches the node with the name of your sink (node 35) + "node.name" = "effect_input.eq6" + } + ] + actions = { + update-props = { + # This sets a very high priority, making it the default. + # Standard hardware is usually around 1000. + "priority.session" = 2001 + } + } + } + ] + ''; + }; + }; + }; + }; + + # to get startx and use amdgpu driver + # WM in home-manager + xserver = { + enable = true; + autorun = false; + displayManager.startx.enable = true; + modules = [ pkgs.xf86_input_wacom ]; + wacom.enable = true; + }; + }; + + # extra systemd stuff + systemd.services.sshd.after = [ "tailscaled-autoconnect.service" ]; +} -- cgit v1.2.3