phase 3: new flake.nix + extract common-{nix,doas,shell-fish}; rewire imports
- New unified flake with two nixpkgs channels (unstable for desktops, 25.11 for muffin)
- modules/common-{doas,shell-fish,nix}.nix extracted from duplicated blocks
- modules/desktop-common.nix: renamed from system/common.nix; secret paths point to secrets/desktop/
- hosts/{mreow,yarn}/default.nix import desktop-common; yarn imports modules/no-rgb.nix
- hosts/muffin/default.nix imports common-* + server-prefixed modules + services/; duplicate doas/fish/nix blocks removed; gc retention preserved as mkForce override
- modules/age-secrets.nix: file paths → ../secrets/server/*.age
- services/{minecraft,matrix/livekit}: secret paths → ../secrets/server/
- home/profiles/*.nix: ./progs/ → ../progs/
- hosts/{mreow,yarn}/home.nix: imports rewired to ../../home/profiles/ and ../../home/progs/
- home/progs/pi.nix and hosts/yarn/home.nix: secret reads → ../../secrets/home/
- tests/*.nix: ../modules/security.nix → ../modules/server-security.nix; ../modules/overlays.nix → ../lib/overlays.nix
- lib/default.nix: takes explicit lib param (defaults to nixpkgs-stable.lib)
This commit is contained in:
primary
459
modules/desktop-common.nix
Normal file
459
modules/desktop-common.nix
Normal file
@@ -0,0 +1,459 @@
|
||||
{
|
||||
config,
|
||||
options,
|
||||
pkgs,
|
||||
lib,
|
||||
username,
|
||||
inputs,
|
||||
niri-package,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
# shared across all hosts
|
||||
./common-doas.nix
|
||||
./common-shell-fish.nix
|
||||
./common-nix.nix
|
||||
|
||||
# desktop-only modules
|
||||
./desktop-vm.nix
|
||||
./desktop-steam.nix
|
||||
./desktop-networkmanager.nix
|
||||
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.lanzaboote.nixosModules.lanzaboote
|
||||
|
||||
inputs.nixos-hardware.nixosModules.common-cpu-amd-pstate
|
||||
inputs.nixos-hardware.nixosModules.common-cpu-amd-zenpower
|
||||
inputs.nixos-hardware.nixosModules.common-pc-ssd
|
||||
];
|
||||
|
||||
# allow overclocking (I actually underclock but lol)
|
||||
hardware.amdgpu.overdrive.ppfeaturemask = "0xFFFFFFFF";
|
||||
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
hardware.cpu.amd.updateMicrocode = true;
|
||||
|
||||
services.kmscon.enable = true;
|
||||
|
||||
# Add niri to display manager session packages
|
||||
services.displayManager.sessionPackages = [ niri-package ];
|
||||
|
||||
programs = {
|
||||
gamescope = {
|
||||
enable = true;
|
||||
capSysNice = true;
|
||||
};
|
||||
steam = {
|
||||
enable = true;
|
||||
gamescopeSession.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
system.activationScripts = {
|
||||
# FIX: https://github.com/NixOS/nix/issues/2982
|
||||
"profile-channel-dummy".text = ''
|
||||
#!/bin/sh
|
||||
mkdir -p /nix/var/nix/profiles/per-user/root/channels
|
||||
'';
|
||||
|
||||
# extract all my secureboot keys
|
||||
# TODO! proper secrets management
|
||||
"secureboot-keys".text = ''
|
||||
#!/usr/bin/env sh
|
||||
rm -fr ${config.boot.lanzaboote.pkiBundle} || true
|
||||
mkdir -p ${config.boot.lanzaboote.pkiBundle}
|
||||
${lib.getExe pkgs.gnutar} xf ${../secrets/desktop/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
|
||||
chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
|
||||
chmod -R 500 ${config.boot.lanzaboote.pkiBundle}
|
||||
'';
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Desktop-specific Nix cache — muffin serves it, desktops consume.
|
||||
# Base nix settings (optimise, gc, experimental-features) come from common-nix.nix.
|
||||
nix.settings = {
|
||||
substituters = [ "https://nix-cache.sigkill.computer" ];
|
||||
trusted-public-keys = [
|
||||
"nix-cache.sigkill.computer-1:ONtQC9gUjL+2yNgMWB68NudPySXhyzJ7I3ra56/NPgk="
|
||||
];
|
||||
netrc-file = "${../secrets/desktop/nix-cache-netrc}";
|
||||
};
|
||||
|
||||
# cachyos kernel overlay
|
||||
nixpkgs.overlays = [ inputs.nix-cachyos-kernel.overlays.default ];
|
||||
|
||||
# kernel options
|
||||
boot = {
|
||||
|
||||
# cachyos kernel: bore scheduler, full lto, x86_64-v3 (common to zen 3 + zen 5)
|
||||
kernelPackages =
|
||||
let
|
||||
helpers = pkgs.callPackage "${inputs.nix-cachyos-kernel}/helpers.nix" { };
|
||||
kernel = pkgs.cachyosKernels.linux-cachyos-bore-lto.override {
|
||||
lto = "full";
|
||||
processorOpt = "x86_64-v3";
|
||||
};
|
||||
in
|
||||
helpers.kernelModuleLLVMOverride (pkgs.linuxKernel.packagesFor kernel);
|
||||
|
||||
# disable legacy subsystems neither host will ever use
|
||||
kernelPatches = [
|
||||
{
|
||||
name = "disable-legacy-subsystems";
|
||||
patch = null;
|
||||
structuredExtraConfig = with lib.kernel; {
|
||||
# ancient bus/card standards
|
||||
PCMCIA = lib.mkForce no;
|
||||
PCCARD = lib.mkForce no;
|
||||
PARPORT = lib.mkForce no;
|
||||
GAMEPORT = lib.mkForce module;
|
||||
FIREWIRE = lib.mkForce no;
|
||||
AGP = lib.mkForce no;
|
||||
|
||||
# legacy networking
|
||||
ATM = lib.mkForce no;
|
||||
FDDI = lib.mkForce no;
|
||||
ISDN = lib.mkForce no;
|
||||
CAN = lib.mkForce no;
|
||||
NFC = lib.mkForce no;
|
||||
INFINIBAND = lib.mkForce no;
|
||||
|
||||
# amateur radio (HAMRADIO is the umbrella but these are separate symbols)
|
||||
HAMRADIO = lib.mkForce no;
|
||||
AX25 = lib.mkForce no;
|
||||
NETROM = lib.mkForce no;
|
||||
ROSE = lib.mkForce no;
|
||||
|
||||
# dead protocols
|
||||
PHONET = lib.mkForce no;
|
||||
IEEE802154 = lib.mkForce no;
|
||||
"6LOWPAN" = lib.mkForce no;
|
||||
NET_9P = lib.mkForce no;
|
||||
BATMAN_ADV = lib.mkForce no;
|
||||
|
||||
# tv tuners / digital video broadcasting
|
||||
MEDIA_ANALOG_TV_SUPPORT = lib.mkForce no;
|
||||
MEDIA_DIGITAL_TV_SUPPORT = lib.mkForce no;
|
||||
DVB_CORE = lib.mkForce no;
|
||||
|
||||
# hypervisor guest support (bare metal only)
|
||||
HYPERV = lib.mkForce no;
|
||||
XEN = lib.mkForce no;
|
||||
VMWARE_VMCI = lib.mkForce no;
|
||||
VMWARE_BALLOON = lib.mkForce no;
|
||||
VMWARE_PVSCSI = lib.mkForce no;
|
||||
VMWARE_VMCI_VSOCKETS = lib.mkForce no;
|
||||
VMXNET3 = lib.mkForce no;
|
||||
DRM_VMWGFX = lib.mkForce no;
|
||||
VBOXGUEST = lib.mkForce no;
|
||||
VBOXSF_FS = lib.mkForce no;
|
||||
|
||||
# staging drivers (experimental/unmaintained)
|
||||
STAGING = lib.mkForce no;
|
||||
# SND_PCI stays — SND_HDA_INTEL (AMD HDA audio) lives under it
|
||||
ACCESSIBILITY = lib.mkForce no;
|
||||
MTD = lib.mkForce no;
|
||||
MEDIA_RC_SUPPORT = lib.mkForce no;
|
||||
|
||||
# legacy storage (AHCI for modern SATA is independent)
|
||||
ATA_SFF = lib.mkForce no;
|
||||
SCSI_LOWLEVEL = lib.mkForce no;
|
||||
FUSION = lib.mkForce no;
|
||||
|
||||
# misc legacy
|
||||
MOST = lib.mkForce no;
|
||||
PPDEV = lib.mkForce no;
|
||||
PHANTOM = lib.mkForce no;
|
||||
X86_ANDROID_TABLETS = lib.mkForce no;
|
||||
# CHROME_PLATFORMS stays — Framework laptops use CrOS EC
|
||||
SURFACE_PLATFORMS = lib.mkForce no;
|
||||
MCTP = lib.mkForce no;
|
||||
GPIB = lib.mkForce no;
|
||||
SIOX = lib.mkForce no;
|
||||
SLIMBUS = lib.mkForce no;
|
||||
WWAN = lib.mkForce no;
|
||||
|
||||
# nvidia gpu
|
||||
DRM_NOUVEAU = lib.mkForce no;
|
||||
|
||||
# other gpus not present
|
||||
DRM_RADEON = lib.mkForce no;
|
||||
DRM_GMA500 = lib.mkForce no;
|
||||
DRM_AST = lib.mkForce no;
|
||||
DRM_MGAG200 = lib.mkForce no;
|
||||
DRM_HISI_HIBMC = lib.mkForce no;
|
||||
DRM_APPLETBDRM = lib.mkForce no;
|
||||
|
||||
# intel gpu
|
||||
DRM_I915 = lib.mkForce no;
|
||||
DRM_XE = lib.mkForce no;
|
||||
|
||||
# intel cpu / platform
|
||||
INTEL_IOMMU = lib.mkForce no;
|
||||
INTEL_IDLE = lib.mkForce no;
|
||||
INTEL_HFI_THERMAL = lib.mkForce no;
|
||||
INTEL_TCC_COOLING = lib.mkForce no;
|
||||
INTEL_SOC_DTS_THERMAL = lib.mkForce no;
|
||||
INTEL_PCH_THERMAL = lib.mkForce no;
|
||||
INTEL_POWERCLAMP = lib.mkForce no;
|
||||
X86_PKG_TEMP_THERMAL = lib.mkForce no;
|
||||
X86_INTEL_LPSS = lib.mkForce no;
|
||||
INTEL_MEI = lib.mkForce no;
|
||||
INTEL_TH = lib.mkForce no;
|
||||
INTEL_VSEC = lib.mkForce no;
|
||||
INTEL_IDXD = lib.mkForce no;
|
||||
INTEL_IOATDMA = lib.mkForce no;
|
||||
EDAC_E752X = lib.mkForce no;
|
||||
EDAC_I82975X = lib.mkForce no;
|
||||
EDAC_I3000 = lib.mkForce no;
|
||||
EDAC_I3200 = lib.mkForce no;
|
||||
EDAC_IE31200 = lib.mkForce no;
|
||||
EDAC_X38 = lib.mkForce no;
|
||||
EDAC_I5400 = lib.mkForce no;
|
||||
EDAC_I7CORE = lib.mkForce no;
|
||||
EDAC_I5100 = lib.mkForce no;
|
||||
EDAC_I7300 = lib.mkForce no;
|
||||
EDAC_SBRIDGE = lib.mkForce no;
|
||||
EDAC_SKX = lib.mkForce no;
|
||||
EDAC_I10NM = lib.mkForce no;
|
||||
EDAC_IMH = lib.mkForce no;
|
||||
EDAC_PND2 = lib.mkForce no;
|
||||
EDAC_IGEN6 = lib.mkForce no;
|
||||
|
||||
# intel audio
|
||||
SND_SOC_SOF_INTEL_TOPLEVEL = lib.mkForce no;
|
||||
SND_SOC_INTEL_SST_TOPLEVEL = lib.mkForce no;
|
||||
|
||||
# mellanox networking
|
||||
MLX4_CORE = lib.mkForce no;
|
||||
MLX5_CORE = lib.mkForce no;
|
||||
MLXSW_CORE = lib.mkForce no;
|
||||
MLX_PLATFORM = lib.mkForce no;
|
||||
|
||||
# fpga
|
||||
FPGA = lib.mkForce no;
|
||||
|
||||
# old x86 cpufreq / platform (both systems are modern Zen)
|
||||
AMD_NUMA = lib.mkForce no;
|
||||
X86_POWERNOW_K8 = lib.mkForce no;
|
||||
X86_P4_CLOCKMOD = lib.mkForce no;
|
||||
X86_SPEEDSTEP_LIB = lib.mkForce no;
|
||||
|
||||
# cxl (datacenter memory expansion)
|
||||
CXL_BUS = lib.mkForce no;
|
||||
|
||||
# embedded SoC peripherals (not present on desktop/laptop)
|
||||
INPUT_TOUCHSCREEN = lib.mkForce no;
|
||||
INPUT_TABLET = lib.mkForce no;
|
||||
INPUT_JOYSTICK = lib.mkForce no;
|
||||
MEDIA_PLATFORM_DRIVERS = lib.mkForce no;
|
||||
MEDIA_TEST_SUPPORT = lib.mkForce no;
|
||||
|
||||
# deprecated userland compat
|
||||
SGETMASK_SYSCALL = lib.mkForce no;
|
||||
UID16 = lib.mkForce no;
|
||||
X86_X32_ABI = lib.mkForce no;
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
# aes_generic is built-in as of linux 7.0, no longer a loadable module
|
||||
initrd.luks.cryptoModules = lib.mkForce (
|
||||
lib.filter (m: m != "aes_generic") options.boot.initrd.luks.cryptoModules.default
|
||||
);
|
||||
|
||||
# some default initrd modules (ata_piix etc) don't exist with ATA_SFF=n
|
||||
initrd.allowMissingModules = true;
|
||||
|
||||
lanzaboote = {
|
||||
enable = true;
|
||||
# TODO: proper secrets management so this is not stored in nix store
|
||||
pkiBundle = "/var/lib/sbctl";
|
||||
};
|
||||
|
||||
# Bootloader.
|
||||
loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
|
||||
timeout = 1;
|
||||
/*
|
||||
Lanzaboote currently replaces the systemd-boot module.
|
||||
This setting is usually set to true in configuration.nix
|
||||
generated at installation time. So we force it to false
|
||||
for now.
|
||||
*/
|
||||
systemd-boot.enable = lib.mkForce false;
|
||||
systemd-boot.configurationLimit = 10;
|
||||
};
|
||||
|
||||
initrd = {
|
||||
systemd.enable = true;
|
||||
compressor = "zstd";
|
||||
availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"thunderbolt"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"amdgpu"
|
||||
];
|
||||
};
|
||||
|
||||
kernelModules = [
|
||||
"kvm-amd"
|
||||
"ip_tables"
|
||||
"iptable_nat"
|
||||
"msr"
|
||||
"btusb"
|
||||
];
|
||||
|
||||
kernelParams = [
|
||||
# 1gb huge pages
|
||||
"hugepagesz=1G"
|
||||
"hugepages=3"
|
||||
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
environment.etc = {
|
||||
# override default nixos /etc/issue
|
||||
"issue".text = "";
|
||||
};
|
||||
|
||||
services = {
|
||||
# fwupd for updating firmware
|
||||
fwupd = {
|
||||
enable = true;
|
||||
extraRemotes = [ "lvfs-testing" ];
|
||||
};
|
||||
|
||||
# auto detect network printers
|
||||
avahi = {
|
||||
enable = true;
|
||||
nssmdns4 = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
printing = {
|
||||
enable = true;
|
||||
drivers = with pkgs; [ hplip ];
|
||||
};
|
||||
|
||||
# I don't want fingerprint login
|
||||
fprintd.enable = false;
|
||||
|
||||
# Making sure mullvad works on boot
|
||||
mullvad-vpn.enable = true;
|
||||
|
||||
# power statistics
|
||||
upower.enable = true;
|
||||
|
||||
# power profiles for noctalia shell
|
||||
power-profiles-daemon.enable = true;
|
||||
|
||||
# geolocation (uses beacondb.net by default)
|
||||
geoclue2 = {
|
||||
enable = true;
|
||||
appConfig.zen-twilight = {
|
||||
isAllowed = true;
|
||||
isSystem = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# EST
|
||||
time.timeZone = "America/New_York";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
# Enable Bluetooth
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
powerOnBoot = true;
|
||||
|
||||
# Enable experimental features for battery % of bluetooth devices
|
||||
settings.General.Experimental = true;
|
||||
};
|
||||
|
||||
# Apply gtk themes by enabling dconf
|
||||
programs.dconf.enable = true;
|
||||
|
||||
# Enable sound with pipewire.
|
||||
services.pulseaudio.enable = false; # pipewire >>>>>>> pulseaudio
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
|
||||
# Define my user account (the rest of the configuration if found in `~/.config/home-manager/...`)
|
||||
users.users.${username} = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
"video"
|
||||
"camera"
|
||||
"adbusers"
|
||||
];
|
||||
# TODO! this is really bad :( I should really figure out how to do proper secrets management
|
||||
hashedPasswordFile = "${../secrets/desktop/password-hash}";
|
||||
};
|
||||
|
||||
services.gvfs.enable = true;
|
||||
programs.gphoto2.enable = true;
|
||||
|
||||
# Enable thermal data
|
||||
services.thermald.enable = true;
|
||||
|
||||
services.pcscd.enable = true;
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
pinentryPackage = pkgs.pinentry-curses;
|
||||
enableSSHSupport = false;
|
||||
};
|
||||
|
||||
# System packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
# mullvad-vpn is provided by services.mullvad-vpn.enable
|
||||
|
||||
#secureboot ctl
|
||||
sbctl
|
||||
|
||||
dmidecode
|
||||
|
||||
doas-sudo-shim
|
||||
|
||||
glib
|
||||
usbutils
|
||||
libmtp
|
||||
man-pages
|
||||
man-pages-posix
|
||||
|
||||
# needed for home-manager
|
||||
git
|
||||
|
||||
tmux
|
||||
android-tools
|
||||
];
|
||||
|
||||
# wayland with electron/chromium applications
|
||||
environment.sessionVariables.NIXOS_OZONE_WL = "1";
|
||||
|
||||
# port 53317 for localsend
|
||||
networking.firewall.allowedUDPPorts = [ 53317 ];
|
||||
networking.firewall.allowedTCPPorts = [ 53317 ];
|
||||
|
||||
system.stateVersion = "25.05";
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
|
||||
documentation.enable = true;
|
||||
documentation.man.enable = true;
|
||||
documentation.dev.enable = true;
|
||||
}
|
||||
Reference in New Issue
Block a user