diff --git a/flake.lock b/flake.lock index 34c8b7a..b009d4e 100644 --- a/flake.lock +++ b/flake.lock @@ -1,49 +1,28 @@ { "nodes": { - "disko": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1730135292, - "narHash": "sha256-CI27qHAbc3/tIe8sb37kiHNaeCqGxNimckCMj0lW5kg=", - "owner": "nix-community", - "repo": "disko", - "rev": "ab58501b2341bc5e0fc88f2f5983a679b075ddf5", - "type": "github" - }, - "original": { - "owner": "nix-community", - "ref": "latest", - "repo": "disko", - "type": "github" - } - }, "nixpkgs": { "locked": { - "lastModified": 1730983001, - "narHash": "sha256-YdFJZ/u9HnEfEPHYt9GEayi2dQhyBq0cmKhgAm8z1aE=", + "lastModified": 1731951205, + "narHash": "sha256-9YhDFPy6K7vUA9NVvlIrV0dFxrARqKgTFhst94yblkM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "341fc858d538bc19c41d4743719a915474301642", + "rev": "0054a256665f0df8d61b4df921280d6994f2c284", "type": "github" }, "original": { "owner": "nixos", - "ref": "release-24.05", + "ref": "release-24.11", "repo": "nixpkgs", "type": "github" } }, "pkgsUnstable": { "locked": { - "lastModified": 1730831018, - "narHash": "sha256-2S0HwIFRxYp+afuoFORcZA9TjryAf512GmE0MTfEOPU=", + "lastModified": 1731890469, + "narHash": "sha256-D1FNZ70NmQEwNxpSSdTXCSklBH1z2isPR84J6DQrJGs=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8c4dc69b9732f6bbe826b5fbb32184987520ff26", + "rev": "5083ec887760adfe12af64830a66807423a859a7", "type": "github" }, "original": { @@ -55,7 +34,6 @@ }, "root": { "inputs": { - "disko": "disko", "nixpkgs": "nixpkgs", "pkgsUnstable": "pkgsUnstable" } diff --git a/flake.nix b/flake.nix index 18a54c3..e34a62f 100755 --- a/flake.nix +++ b/flake.nix @@ -2,13 +2,11 @@ description = "my nixos setup"; inputs = { - nixpkgs.url = "github:nixos/nixpkgs/release-24.05"; + nixpkgs.url = "github:nixos/nixpkgs/release-24.11"; pkgsUnstable.url = "github:nixos/nixpkgs/nixpkgs-unstable"; - disko.url = "github:nix-community/disko/latest"; - disko.inputs.nixpkgs.follows = "nixpkgs"; }; - outputs = { self, nixpkgs, pkgsUnstable, disko, ... }: + outputs = { self, nixpkgs, pkgsUnstable, ... }: let system = "x86_64-linux"; lib = nixpkgs.lib; @@ -23,6 +21,13 @@ ./system/vincents-hp/configuration.nix ]; }; + vincents-old-hp = lib.nixosSystem { + inherit system; + specialArgs = { inherit unstable; }; + modules = [ + ./system/vincents-old-hp/configuration.nix + ]; + }; susans-hp = lib.nixosSystem { inherit system; specialArgs = { inherit unstable; }; @@ -41,8 +46,6 @@ inherit system; specialArgs = { inherit unstable; }; modules = [ - disko.nixosModules.disko - ./system/susans-vm/disk.nix ./system/susans-vm/configuration.nix ]; }; diff --git a/system/vincents-hp/configuration.nix b/system/vincents-hp/configuration.nix index a7aafb9..d205100 100755 --- a/system/vincents-hp/configuration.nix +++ b/system/vincents-hp/configuration.nix @@ -89,7 +89,6 @@ services.printing.drivers = [ pkgs.hplip ]; # Enable sound with pipewire. - sound.enable = true; hardware.pulseaudio.enable = false; security.rtkit.enable = true; services.pipewire = { diff --git a/system/vincents-old-hp/configuration.nix b/system/vincents-old-hp/configuration.nix new file mode 100755 index 0000000..d205100 --- /dev/null +++ b/system/vincents-old-hp/configuration.nix @@ -0,0 +1,324 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, unstable, lib, ... }: + + +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # legacy boot + #boot.loader.grub.enable = true; + #boot.loader.grub.device = "/dev/vda"; + #boot.loader.grub.useOSProber = true; + + # UEFI boot + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + #boot.loader.efi.efiSysMountPoint = "/boot/efi"; + + boot.binfmt.registrations.appimage = { + interpreter = "${pkgs.appimage-run}/bin/appimage-run"; + recognitionType = "magic"; + offset = 0; + mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff''; + magicOrExtension = ''\x7fELF....AI\x02''; + }; + + # boot logo + boot.plymouth.enable = true; + + # ZRAM + zramSwap.enable = true; + zramSwap.memoryPercent = 50; + boot.kernel.sysctl = { + "vm.swappiness" = 10; + "vm.vsf_cache_pressure" = 50; + }; + + boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; + + #boot.kernelPackages = pkgs.linuxPackages_xanmod_stable; + boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ]; + + networking.hostName = "vincents-hp"; # Define your hostname. + networking.networkmanager.enable = true; + + # Set your time zone. + time.timeZone = "America/New_York"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + console = { + font = "Lat2-Terminus16"; + useXkbConfig = true; + }; + fonts.packages = [ pkgs.corefonts ]; + + # Enable the X11 windowing system. + services.xserver.enable = true; + + # displaylink + #services.xserver.videoDrivers = [ "displaylink" "modesetting" ]; + + # waydroid + #virtualisation.waydroid.enable = true; + + # Enable the Cinnamon Desktop Environment. + services.displayManager.sddm.enable = true; + services.desktopManager.plasma6.enable = true; + programs.kdeconnect.enable = true; + + # Configure keymap in X11 + services.xserver = { + xkb.layout = "us"; + xkb.variant = "colemak"; + #xkb.model = "chromebook"; + }; + services.xserver.xkb.options = "grp:win_space_toggle"; + + # Enable CUPS to print documents. + services.printing.enable = true; + services.avahi.enable = true; + services.avahi.nssmdns4 = true; + services.avahi.openFirewall = true; + services.printing.drivers = [ pkgs.hplip ]; + + # Enable sound with pipewire. + hardware.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + jack.enable = true; + + # use the example session manager (no others are packaged yet so this is en> + # no need to redefine it in your config for now) + wireplumber.enable = true; + }; + programs.noisetorch.enable = true; + + # Enable touchpad support (enabled default in most desktopManager). + services.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.vincent = { + isNormalUser = true; + shell = pkgs.fish; + initialHashedPassword = "$y$j9T$0PPbSXGEwyGq6ZFvJMhmE/$D5ZlKOwR/4NCDD8eaxWiQiG1TTRSK4PfbQe/Tm60Id/"; + extraGroups = [ "wheel" "networkmanager" "lp" "audio" "video" "cdrom" "input" "libvirtd" "dialout" ]; + }; + programs.fish.enable = true; + + nix.extraOptions = ''experimental-features = nix-command flakes''; + + nixpkgs.config.permittedInsecurePackages = [ + "electron-12.2.3" + "electron-27.3.11" + ]; + + nixpkgs.config.allowUnfree = true; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment = { + systemPackages = with pkgs; [ + tailscale + bleachbit + btop + neofetch + clamtk + trayscale + topgrade + appimage-run + unstable.gearlever + # kde apps + kdePackages.discover + kdePackages.sddm-kcm + kdePackages.kwayland + kdePackages.ark + kdePackages.qtmultimedia + # editors + kdePackages.kate + nano + # vm + quickemu + quickgui + # containers + podman + podman-compose + distrobox + boxbuddy + # office apps + bottles + libreoffice-qt + logseq + zoom-us + orca-slicer + unstable.freecad-wayland + gpodder + # package manager + wget + # web browser + librewolf + ungoogled-chromium + ]; + }; + + services = { + syncthing = { + enable = true; + user = "vincent"; + openDefaultPorts = true; + dataDir = "/home/vincent/logseq"; # Default folder for new synced folders + configDir = "/home/vincent/Documents/.config/syncthing"; # Folder for Syncthing's settings and keys + }; + }; + + # flatpak + xdg.portal.enable = true; + services.flatpak.enable = true; + systemd.services.configure-flathub-repo = { + wantedBy = ["multi-user.target"]; + path = [ pkgs.flatpak ]; + script = '' + flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo + ''; + }; + + # podman + virtualisation.containers.enable = true; + virtualisation = { + podman = { + enable = true; + + # Create a `docker` alias for podman, to use it as a drop-in replacement + dockerCompat = true; + + # Required for containers under podman-compose to be able to talk to each other. + defaultNetwork.settings.dns_enabled = true; + }; + }; + + # bluetooth + hardware.bluetooth.enable = true; + + # dconf + programs.dconf.enable = true; + + # enable the tailscale service + services.tailscale.enable = true; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + programs.mtr.enable = true; + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + # List services that you want to enable: + + # preload + services.preload.enable = true; + + # schedualer + services.system76-scheduler.enable = true; + + # Enable the OpenSSH daemon. + services.openssh.enable = false; + + # auto clean + nix.optimise.automatic = true; + + # enable fwupd + services.fwupd.enable = true; + + # captive browser + programs.captive-browser.enable = true; + programs.captive-browser.bindInterface = false; + + + # auto update + system.autoUpgrade.enable = true; + system.autoUpgrade.allowReboot = true; + system.autoUpgrade.rebootWindow = { + lower = "01:00"; + upper = "05:00"; + }; + + #clamav + services.clamav.updater.enable = true; + services.clamav.daemon.enable = true; + + + # audit + security.auditd.enable = true; + security.audit.enable = true; + security.audit.rules = [ + "-a exit,always -F arch=b64 -S execve" + ]; + + + # Open ports in the firewall. + networking.firewall.allowedTCPPorts = [ + 22 + 8384 + 22000 + 24800 + 21116 + 7236 + 7250 + 47984 + 47989 + 47990 + 48010 + ]; + networking.firewall.allowedUDPPorts = [ + 22000 + 21027 + 24800 + 5353 + 5900 + 3689 + 5353 + 7236 + 47998 + 47999 + 48000 + 48002 + ]; + networking.firewall.allowedTCPPortRanges = [ + { + from = 1714; + to = 1764; + } + ]; + networking.firewall.allowedUDPPortRanges = [ + { + from = 1714; + to = 1764; + } + ]; + networking.firewall.rejectPackets = true; + # networking.firewall.allowedUDPPorts = [ 21116 ]; + # Or disable the firewall altogether. + networking.firewall.trustedInterfaces = [ "tailscale0" ]; + + services.fail2ban.enable = true; + networking.firewall.enable = true; + + # This value determines the NixOS release from which the default settings for stateful data, like file locations and database versions on your system were + # taken. It‘s perfectly fine and recommended to leave this value at the release version of the first install of this system. Before changing this value read + # the documentation for this option (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.05"; # Did you read the comment? + +} + diff --git a/system/vincents-old-hp/disk.nix b/system/vincents-old-hp/disk.nix new file mode 100755 index 0000000..76f99c6 --- /dev/null +++ b/system/vincents-old-hp/disk.nix @@ -0,0 +1,73 @@ +{ + disko.devices = { + disk = { + nvme0n1 = { + type = "disk"; + device = "/dev/nvme0n1"; + content = { + type = "gpt"; + partitions = { + ESP = { + label = "boot"; + name = "ESP"; + size = "512M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ + "defaults" + ]; + }; + }; + luks = { + size = "100%"; + label = "luks"; + content = { + type = "luks"; + name = "cryptroot"; + extraOpenArgs = [ + "--allow-discards" + "--perf-no_read_workqueue" + "--perf-no_write_workqueue" + ]; + # https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html + settings = {crypttabExtraOpts = ["fido2-device=auto" "token-timeout=10"];}; + content = { + type = "btrfs"; + extraArgs = ["-L" "nixos" "-f"]; + subvolumes = { + "/root" = { + mountpoint = "/"; + mountOptions = ["subvol=root" "compress=zstd" "noatime"]; + }; + "/home" = { + mountpoint = "/home"; + mountOptions = ["subvol=home" "compress=zstd" "noatime"]; + }; + "/nix" = { + mountpoint = "/nix"; + mountOptions = ["subvol=nix" "compress=zstd" "noatime"]; + }; + "/persist" = { + mountpoint = "/persist"; + mountOptions = ["subvol=persist" "compress=zstd" "noatime"]; + }; + "/log" = { + mountpoint = "/var/log"; + mountOptions = ["subvol=log" "compress=zstd" "noatime"]; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; + + fileSystems."/persist".neededForBoot = true; + fileSystems."/var/log".neededForBoot = true; +} diff --git a/system/vincents-old-hp/hardware-configuration.nix b/system/vincents-old-hp/hardware-configuration.nix new file mode 100644 index 0000000..6a1d84e --- /dev/null +++ b/system/vincents-old-hp/hardware-configuration.nix @@ -0,0 +1,52 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "firewire_ohci" "xhci_pci" "usb_storage" "sd_mod" "sr_mod" "sdhci_pci" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/sda2"; + fsType = "btrfs"; + options = [ "subvol=root" "ssd" "defaults" "noatime" "compress=zstd:5" ]; + }; + + fileSystems."/home" = + { device = "/dev/sda2"; + fsType = "btrfs"; + options = [ "subvol=home" "ssd" "defaults" "noatime" "compress=zstd:5" ]; + }; + + fileSystems."/nix" = + { device = "/dev/sda2"; + fsType = "btrfs"; + options = [ "subvol=nix" "ssd" "defaults" "noatime" "compress=zstd:5" ]; + }; + + fileSystems."/boot" = + { device = "/dev/sda1"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp0s25.useDHCP = lib.mkDefault true; + # networking.interfaces.wlo1.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +}