Set up a minimal initial config.
This commit is contained in:
Tom Alexander
parent
48f700b803
commit
6953cdb81f
GPG Key ID:
D3A179C9A53C0EDE
14
nix/configuration/boot.nix
Normal file
14
nix/configuration/boot.nix
Normal file
@ -0,0 +1,14 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [];
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
# TODO: make false on real hardware
|
||||
# TODO: make not write bootx64.efi
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Automatically delete old generations
|
||||
boot.loader.systemd-boot.configurationLimit = 3;
|
||||
}
|
||||
177
nix/configuration/configuration.nix
Normal file
177
nix/configuration/configuration.nix
Normal file
@ -0,0 +1,177 @@
|
||||
{ config, lib, pkgs, pkgs-unstable, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
./hosts/odo
|
||||
"${builtins.fetchTarball {url="https://github.com/nix-community/disko/archive/refs/tags/v1.9.0.tar.gz";sha256="0j76ar4qz320fakdii4659w5lww8wiz6yb7g47npywqvf2lbp388";}}/module.nix"
|
||||
./boot.nix
|
||||
./zfs.nix
|
||||
./network.nix
|
||||
];
|
||||
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
users.mutableUsers = false;
|
||||
users.users.talexander = {
|
||||
isNormalUser = true;
|
||||
createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
|
||||
extraGroups = [ "wheel" ];
|
||||
packages = with pkgs; [
|
||||
tree
|
||||
];
|
||||
# Generate with `mkpasswd -m scrypt`
|
||||
hashedPassword = "$7$CU..../....VXvNQ8za3wSGpdzGXNT50/$HcFtn/yvwPMCw4888BelpiAPLAxe/zU87fD.d/N6U48";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGu+k5lrirokdW5zVdRVBOqEOAvAPlIkG/MdJNc9g5ky"
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEI6mu6I5Jp+Ib0vJxapGHbEShZjyvzV8jz5DnzDrI39AAAABHNzaDo="
|
||||
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAFNcSXwvy+brYTOGo56G93Ptuq2MmZsjvRWAfMqbmMLAAAABHNzaDo="
|
||||
];
|
||||
};
|
||||
|
||||
# Automatic garbage collection
|
||||
nix.gc = {
|
||||
# Runs nix-collect-garbage --delete-older-than 5d
|
||||
automatic = true;
|
||||
randomizedDelaySec = "14m";
|
||||
options = "--delete-older-than 5d";
|
||||
};
|
||||
|
||||
# Use doas instead of sudo
|
||||
security.doas.enable = true;
|
||||
security.doas.wheelNeedsPassword = false;
|
||||
security.sudo.enable = false;
|
||||
security.doas.extraRules = [{
|
||||
# Retain environment (for example NIX_PATH)
|
||||
keepEnv = true;
|
||||
persist = true; # Only ask for a password the first time.
|
||||
}];
|
||||
|
||||
# Do not use default packages (nixos includes some defaults like nano)
|
||||
environment.defaultPackages = lib.mkForce [];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
wget
|
||||
mg
|
||||
rsync
|
||||
libinput
|
||||
htop
|
||||
tmux
|
||||
file
|
||||
usbutils # for lsusb
|
||||
pciutils # for lspci
|
||||
];
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
};
|
||||
hostKeys = [
|
||||
{
|
||||
path = "/persist/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}
|
||||
{
|
||||
path = "/persist/ssh/ssh_host_rsa_key";
|
||||
type = "rsa";
|
||||
bits = 4096;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
networking.firewall.allowedUDPPorts = [ ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Check what will be lost with `zfs diff zroot/linux/root@blank`
|
||||
boot.initrd.systemd.enable = lib.mkDefault true;
|
||||
boot.initrd.systemd.services.zfs-rollback = {
|
||||
description = "Rollback ZFS root dataset to blank snapshot";
|
||||
wantedBy = [
|
||||
"initrd.target"
|
||||
];
|
||||
after = [
|
||||
"zfs-import-zroot.service"
|
||||
];
|
||||
before = [
|
||||
"sysroot.mount"
|
||||
];
|
||||
path = with pkgs; [
|
||||
zfs
|
||||
];
|
||||
unitConfig.DefaultDependencies = "no";
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
zfs rollback -r zroot/linux/root@blank
|
||||
zfs rollback -r zroot/linux/home@blank
|
||||
echo "rollback complete"
|
||||
'';
|
||||
};
|
||||
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/etc/nixos" # Contains system configuration, optional
|
||||
"/etc/NetworkManager/system-connections" # Wifi settings
|
||||
"/var/lib/iwd" # Wifi settings
|
||||
"/var/lib/nixos" # Contains user information (uids/gids)
|
||||
];
|
||||
files = [
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/etc/ssh/ssh_host_rsa_key.pub"
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
];
|
||||
# users.talexander = {
|
||||
# directories = [];
|
||||
# files = [];
|
||||
# };
|
||||
};
|
||||
|
||||
# Write a list of the currently installed packages to /etc/current-system-packages
|
||||
environment.etc."current-system-packages".text =
|
||||
let
|
||||
packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
|
||||
sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
|
||||
formatted = builtins.concatStringsSep "\n" sortedUnique;
|
||||
in
|
||||
formatted;
|
||||
|
||||
# nixpkgs.overlays = [
|
||||
# (final: prev: {
|
||||
# nix = pkgs-unstable.nix;
|
||||
# })
|
||||
# ];
|
||||
|
||||
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||||
#
|
||||
# Most users should NEVER change this value after the initial install, for any reason,
|
||||
# even if you've upgraded your system to a new NixOS release.
|
||||
#
|
||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||||
# to actually do that.
|
||||
#
|
||||
# This value being lower than the current NixOS release does NOT mean your system is
|
||||
# out of date, out of support, or vulnerable.
|
||||
#
|
||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||||
# and migrated your data accordingly.
|
||||
#
|
||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||||
system.stateVersion = "24.11"; # Did you read the comment?
|
||||
|
||||
}
|
||||
66
nix/configuration/flake.nix
Normal file
66
nix/configuration/flake.nix
Normal file
@ -0,0 +1,66 @@
|
||||
{
|
||||
description = "My system configuration";
|
||||
|
||||
inputs = {
|
||||
impermanence.url = "github:nix-community/impermanence";
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
nixpkgs-b93b4e9b5.url = "github:NixOS/nixpkgs/b93b4e9b527904aadf52dba6ca35efde2067cbd4";
|
||||
home-manager.url = "github:nix-community/home-manager/release-24.11";
|
||||
home-manager.inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-b93b4e9b5, impermanence, home-manager, ... }@inputs: let
|
||||
base-system = {};
|
||||
in
|
||||
{
|
||||
nixosConfigurations.odo = nixpkgs.lib.nixosSystem rec {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
pkgs-b93b4e9b5 = import nixpkgs-b93b4e9b5 {
|
||||
inherit system;
|
||||
# config.allowUnfree = true;
|
||||
};
|
||||
pkgs-unstable = import nixpkgs-unstable {
|
||||
inherit system;
|
||||
# config.allowUnfree = true;
|
||||
};
|
||||
};
|
||||
modules = [
|
||||
impermanence.nixosModules.impermanence
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
}
|
||||
./configuration.nix
|
||||
];
|
||||
};
|
||||
nixosConfigurations.odovm = nixpkgs.lib.nixosSystem rec {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = {
|
||||
pkgs-b93b4e9b5 = import nixpkgs-b93b4e9b5 {
|
||||
inherit system;
|
||||
# config.allowUnfree = true;
|
||||
};
|
||||
pkgs-unstable = import nixpkgs-unstable {
|
||||
inherit system;
|
||||
# config.allowUnfree = true;
|
||||
};
|
||||
};
|
||||
modules = [
|
||||
impermanence.nixosModules.impermanence
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
}
|
||||
./configuration.nix
|
||||
({lib, ...}: {
|
||||
networking.dhcpcd.enable = lib.mkForce true;
|
||||
networking.useDHCP = lib.mkForce true;
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
14
nix/configuration/hosts/odo/default.nix
Normal file
14
nix/configuration/hosts/odo/default.nix
Normal file
@ -0,0 +1,14 @@
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./disk-config.nix
|
||||
];
|
||||
|
||||
# Generate with `head -c4 /dev/urandom | od -A none -t x4`
|
||||
networking.hostId = "908cbf04";
|
||||
|
||||
networking.hostName = "odo"; # Define your hostname.
|
||||
|
||||
time.timeZone = "America/New_York";
|
||||
}
|
||||
110
nix/configuration/hosts/odo/disk-config.nix
Normal file
110
nix/configuration/hosts/odo/disk-config.nix
Normal file
@ -0,0 +1,110 @@
|
||||
{
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
type = "disk";
|
||||
device = "/dev/nvme0n1";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" "noatime" "discard" ];
|
||||
};
|
||||
};
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "zroot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
zpool = {
|
||||
zroot = {
|
||||
type = "zpool";
|
||||
# mode = "mirror";
|
||||
# Workaround: cannot import 'zroot': I/O error in disko tests
|
||||
options.cachefile = "none";
|
||||
options = {
|
||||
ashift = "12";
|
||||
compatibility = "openzfs-2.2-freebsd";
|
||||
autotrim = "on";
|
||||
};
|
||||
rootFsOptions = {
|
||||
acltype = "posixacl";
|
||||
atime = "off";
|
||||
relatime = "off";
|
||||
xattr = "sa";
|
||||
mountpoint = "none";
|
||||
compression = "lz4";
|
||||
canmount = "off";
|
||||
utf8only = "on";
|
||||
dnodesize = "auto";
|
||||
normalization = "formD";
|
||||
};
|
||||
|
||||
datasets = {
|
||||
"linux/nix" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "none";
|
||||
options = {
|
||||
encryption = "aes-256-gcm";
|
||||
keyformat = "passphrase";
|
||||
# keylocation = "file:///tmp/secret.key";
|
||||
};
|
||||
};
|
||||
"linux/nix/root" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/";
|
||||
postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/root@blank$' || zfs snapshot zroot/linux/nix/root@blank";
|
||||
};
|
||||
"linux/nix/nix" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/nix";
|
||||
postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/nix@blank$' || zfs snapshot zroot/linux/nix/nix@blank";
|
||||
options = {
|
||||
recordsize = "16MiB";
|
||||
compression = "zstd-19";
|
||||
};
|
||||
};
|
||||
"linux/nix/home" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/home";
|
||||
postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/home@blank$' || zfs snapshot zroot/linux/nix/home@blank";
|
||||
};
|
||||
"linux/nix/persist" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/persist";
|
||||
postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/persist@blank$' || zfs snapshot zroot/linux/nix/persist@blank";
|
||||
};
|
||||
"linux/nix/state" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/state";
|
||||
postCreateHook = "zfs list -t snapshot -H -o name | grep -E '^zroot/linux/nix/state@blank$' || zfs snapshot zroot/linux/nix/state@blank";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Make sure all persistent volumes are marked as neededForBoot
|
||||
#
|
||||
# Also mounts /home so it is mounted before the user home directories are created.
|
||||
fileSystems."/persist".neededForBoot = true;
|
||||
fileSystems."/state".neededForBoot = true;
|
||||
fileSystems."/home".neededForBoot = true;
|
||||
}
|
||||
26
nix/configuration/hosts/odo/hardware-configuration.nix
Normal file
26
nix/configuration/hosts/odo/hardware-configuration.nix
Normal file
@ -0,0 +1,26 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
32
nix/configuration/network.nix
Normal file
32
nix/configuration/network.nix
Normal file
@ -0,0 +1,32 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [];
|
||||
|
||||
networking.dhcpcd.enable = false;
|
||||
networking.useDHCP = false;
|
||||
# networking.nameservers = ["8.8.8.8" "8.8.4.4"];
|
||||
networking.nameservers = [ "194.242.2.2#doh.mullvad.net" "[2a07:e340::2]#doh.mullvad.net" ];
|
||||
# networking.nameservers = [ "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
dnssec = "true";
|
||||
domains = [ "~." ];
|
||||
fallbackDns = [ ];
|
||||
dnsovertls = "true";
|
||||
};
|
||||
networking.wireless.iwd = {
|
||||
enable = true;
|
||||
|
||||
settings = {
|
||||
General = {
|
||||
EnableNetworkConfiguration = true;
|
||||
AddressRandomization = "network";
|
||||
};
|
||||
};
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
iw
|
||||
iwd
|
||||
];
|
||||
}
|
||||
16
nix/configuration/zfs.nix
Normal file
16
nix/configuration/zfs.nix
Normal file
@ -0,0 +1,16 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [];
|
||||
|
||||
boot.zfs.devNodes = "/dev/disk/by-partuuid";
|
||||
|
||||
services.zfs = {
|
||||
autoScrub = {
|
||||
enable = true;
|
||||
interval = "monthly";
|
||||
};
|
||||
trim.enable = true;
|
||||
};
|
||||
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user