383 lines
9.7 KiB
Nix
Executable File
383 lines
9.7 KiB
Nix
Executable File
{ config, pkgs, inputs, outputs, ... }:
|
|
let
|
|
be = import ../../configs/borg-exclude.nix;
|
|
in
|
|
{
|
|
nixpkgs = {
|
|
overlays = [
|
|
(self: super: {
|
|
linuxPackages_cachyos-rc = super.linuxPackages_cachyos-rc.extend (lpself: lpsuper: {
|
|
xone = super.linuxPackages_cachyos-rc.xone.overrideAttrs (oldAttrs: rec {
|
|
version = "0-unstable-latest";
|
|
patches = [
|
|
# Fix build on kernel 6.11
|
|
# https://github.com/medusalix/xone/pull/48
|
|
(pkgs.fetchpatch {
|
|
name = "kernel-6.11.patch";
|
|
url = "https://github.com/medusalix/xone/commit/28df566c38e0ee500fd5f74643fc35f21a4ff696.patch";
|
|
hash = "sha256-X14oZmxqqZJoBZxPXGZ9R8BAugx/hkSOgXlGwR5QCm8=";
|
|
})
|
|
|
|
(pkgs.fetchpatch {
|
|
name = "kernel-6.12.patch";
|
|
url = "https://github.com/medusalix/xone/commit/d88ea1e8b430d4b96134e43ca1892ac48334578e.patch";
|
|
hash = "sha256-zQK1tuxu2ZmKxPO0amkfcT/RFBSkU2pWD0qhGyCCHXI=";
|
|
})
|
|
];
|
|
|
|
});
|
|
});
|
|
})
|
|
];
|
|
|
|
config = {
|
|
allowUnfree = true;
|
|
};
|
|
};
|
|
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
../../configs/browser.nix
|
|
../../configs/common.nix
|
|
../../configs/docker.nix
|
|
../../configs/games.nix
|
|
../../configs/develop.nix
|
|
../../configs/virtualisation.nix
|
|
../../configs/plasma-wayland.nix
|
|
../../configs/user-gui.nix
|
|
../../configs/user.nix
|
|
];
|
|
|
|
sops = {
|
|
defaultSopsFile = ../../secrets.yaml;
|
|
validateSopsFiles = true;
|
|
age = {
|
|
sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
|
|
keyFile = "/persist/var/lib/sops-nix/key.txt";
|
|
generateKey = true;
|
|
};
|
|
|
|
secrets = {
|
|
borg-key = {
|
|
sopsFile = ../../secrets-desktop.yaml;
|
|
owner = config.users.users.alex.name;
|
|
group = config.users.users.alex.group;
|
|
};
|
|
|
|
hashedPassword = {
|
|
neededForUsers = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
nix.settings = {
|
|
system-features = [
|
|
"nixos-test"
|
|
"benchmark"
|
|
"big-parallel"
|
|
"kvm"
|
|
"gccarch-znver3"
|
|
];
|
|
trusted-substituters = [ "https://ai.cachix.org" ];
|
|
trusted-public-keys = [ "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" ];
|
|
};
|
|
|
|
chaotic.nyx.cache.enable = false;
|
|
|
|
# nixpkgs.localSystem = {
|
|
# gcc.arch = "znver3";
|
|
# gcc.tune = "znver3";
|
|
# system = "x86_64-linux";
|
|
# };
|
|
|
|
boot = {
|
|
loader = {
|
|
grub = {
|
|
enable = true;
|
|
efiSupport = true;
|
|
device = "nodev";
|
|
configurationLimit = 5;
|
|
useOSProber = true;
|
|
};
|
|
efi = { canTouchEfiVariables = true; };
|
|
};
|
|
|
|
tmp.useTmpfs = false;
|
|
supportedFilesystems = [ "btrfs" ];
|
|
kernelPackages = pkgs.pkgs.linuxPackages_cachyos;
|
|
kernelModules = [ "nct6775" ];
|
|
extraModulePackages = with pkgs.pkgs.linuxPackages_cachyos; [ ryzen-smu ];
|
|
# kernelParams = [ "clearcpuid=514" ];
|
|
# kernelParams = [ "amdgpu.ppfeaturemask=0xffffffff" ];
|
|
# kernelPatches = [{
|
|
# name = "fix problems with netfilter in 6.11.4";
|
|
# patch = ../../kernelpatches/fix-netfilter-6.11.4.patch;
|
|
# }];
|
|
|
|
initrd = {
|
|
luks.devices = {
|
|
root = {
|
|
# Use https://nixos.wiki/wiki/Full_Disk_Encryption
|
|
device = "/dev/disk/by-uuid/cc43f1eb-49c3-41a6-9279-6766de3659e7";
|
|
allowDiscards = true;
|
|
preLVM = true;
|
|
};
|
|
};
|
|
|
|
postDeviceCommands = pkgs.lib.mkBefore ''
|
|
mkdir -p /mnt
|
|
|
|
# We first mount the btrfs root to /mnt
|
|
# so we can manipulate btrfs subvolumes.
|
|
mount -o subvol=/ /dev/mapper/lvm-root /mnt
|
|
|
|
# While we're tempted to just delete /root and create
|
|
# a new snapshot from /root-blank, /root is already
|
|
# populated at this point with a number of subvolumes,
|
|
# which makes `btrfs subvolume delete` fail.
|
|
# So, we remove them first.
|
|
#
|
|
# /root contains subvolumes:
|
|
# - /root/var/lib/portables
|
|
# - /root/var/lib/machines
|
|
#
|
|
# I suspect these are related to systemd-nspawn, but
|
|
# since I don't use it I'm not 100% sure.
|
|
# Anyhow, deleting these subvolumes hasn't resulted
|
|
# in any issues so far, except for fairly
|
|
# benign-looking errors from systemd-tmpfiles.
|
|
btrfs subvolume list -o /mnt/root |
|
|
cut -f9 -d' ' |
|
|
while read subvolume; do
|
|
echo "deleting /$subvolume subvolume..."
|
|
btrfs subvolume delete "/mnt/$subvolume"
|
|
done &&
|
|
echo "deleting /root subvolume..." &&
|
|
btrfs subvolume delete /mnt/root
|
|
|
|
echo "restoring blank /root subvolume..."
|
|
btrfs subvolume snapshot /mnt/root-blank /mnt/root
|
|
|
|
# Once we're done rolling back to a blank snapshot,
|
|
# we can unmount /mnt and continue on the boot process.
|
|
umount /mnt
|
|
'';
|
|
};
|
|
};
|
|
|
|
systemd.services = {
|
|
monitor = {
|
|
description = "AMDGPU Control Daemon";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "multi-user.target" ];
|
|
serviceConfig = { ExecStart = "${pkgs.lact}/bin/lact daemon"; };
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = "desktop";
|
|
useDHCP = false;
|
|
};
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
environment = {
|
|
systemPackages = with pkgs; [
|
|
inputs.kwin-effects-forceblur.packages.${pkgs.system}.default
|
|
lact
|
|
amdgpu_top
|
|
|
|
python3
|
|
python311Packages.tkinter
|
|
|
|
snapraid
|
|
mergerfs
|
|
gimp
|
|
|
|
clinfo
|
|
gparted
|
|
mission-center
|
|
resources
|
|
stressapptest
|
|
ryzen-monitor-ng
|
|
qdiskinfo
|
|
# fan2go
|
|
# unigine-superposition
|
|
|
|
jdk
|
|
];
|
|
persistence."/persist" = {
|
|
directories = [
|
|
"/etc/coolercontrol"
|
|
"/etc/NetworkManager/system-connections"
|
|
"/etc/nixos"
|
|
"/var/lib/bluetooth"
|
|
"/var/lib/docker"
|
|
"/var/lib/nixos"
|
|
"/var/lib/samba"
|
|
"/var/lib/sddm"
|
|
"/var/lib/systemd/rfkill"
|
|
"/var/lib/tailscale"
|
|
"/var/lib/tuptime"
|
|
"/var/lib/vnstat"
|
|
];
|
|
files = [
|
|
# "/etc/machine-id"
|
|
"/etc/NIXOS"
|
|
"/etc/ssh/ssh_host_ed25519_key"
|
|
"/etc/ssh/ssh_host_ed25519_key.pub"
|
|
"/etc/ssh/ssh_host_rsa_key"
|
|
"/etc/ssh/ssh_host_rsa_key.pub"
|
|
];
|
|
};
|
|
};
|
|
|
|
hardware = {
|
|
keyboard.qmk.enable = true;
|
|
enableAllFirmware = true;
|
|
xone.enable = true;
|
|
|
|
bluetooth.enable = true;
|
|
graphics = {
|
|
enable = true;
|
|
enable32Bit = true;
|
|
};
|
|
|
|
pulseaudio.enable = false;
|
|
};
|
|
|
|
programs = {
|
|
coolercontrol.enable = true;
|
|
corectrl = {
|
|
enable = true;
|
|
gpuOverclock.enable = true;
|
|
};
|
|
};
|
|
|
|
# powerManagement = {
|
|
# enable = true;
|
|
# powertop.enable = true;
|
|
# };
|
|
|
|
services = {
|
|
power-profiles-daemon.enable = true;
|
|
# netdata.enable = true;
|
|
# printing.enable = true;
|
|
fwupd.enable = true;
|
|
|
|
pipewire = {
|
|
enable = true;
|
|
alsa.enable = true;
|
|
alsa.support32Bit = true;
|
|
pulse.enable = true;
|
|
};
|
|
|
|
sunshine = {
|
|
enable = true;
|
|
capSysAdmin = true;
|
|
};
|
|
|
|
samba = {
|
|
enable = true;
|
|
settings = {
|
|
global = {
|
|
workgroup = "WORKGROUP";
|
|
"server string" = "server";
|
|
"netbios name" = "server";
|
|
security = "user";
|
|
"guest account" = "nobody";
|
|
"map to guest" = "bad user";
|
|
logging = "systemd";
|
|
"max log size" = 50;
|
|
"invalid users" = [
|
|
"root"
|
|
];
|
|
"passwd program" = "/run/wrappers/bin/passwd %u";
|
|
};
|
|
shares = {
|
|
browseable = "yes";
|
|
"guest ok" = "no";
|
|
path = "/home/alex/shared/storage";
|
|
"read only" = "no";
|
|
"create mask" = "0644";
|
|
"directory mask" = "0755";
|
|
|
|
};
|
|
};
|
|
};
|
|
|
|
# jellyfin = {
|
|
# enable = true;
|
|
# user = "alex";
|
|
# group = "users";
|
|
# };
|
|
|
|
tailscale.enable = true;
|
|
|
|
borgbackup.jobs = {
|
|
home = rec {
|
|
compression = "auto,zstd";
|
|
encryption = {
|
|
mode = "repokey-blake2";
|
|
passCommand = "cat ${config.sops.secrets.borg-key.path}";
|
|
};
|
|
extraCreateArgs = "--checkpoint-interval 600 --exclude-caches";
|
|
environment.BORG_RSH = "ssh -i ~/.ssh/id_borg_ed25519";
|
|
paths = "/home/alex";
|
|
repo = "ssh://u278697-sub2@u278697.your-storagebox.de:23/./borg";
|
|
startAt = "daily";
|
|
user = "alex";
|
|
prune.keep = {
|
|
daily = 7;
|
|
weekly = 4;
|
|
monthly = 6;
|
|
};
|
|
extraPruneArgs = "--save-space --list --stats";
|
|
exclude = map (x: paths + "/" + x) be.borg-exclude;
|
|
};
|
|
|
|
# home-external = rec {
|
|
# compression = "auto,zstd";
|
|
# encryption = {
|
|
# mode = "repokey-blake2";
|
|
# passCommand = "cat ${config.sops.secrets.borg-key.path}";
|
|
# };
|
|
# extraCreateArgs = "--checkpoint-interval 600 --exclude-caches";
|
|
# paths = "/home/alex";
|
|
# repo = "/run/media/alex/b6c33623-fc23-47ed-b6f5-e99455d5534a/borg";
|
|
# startAt = [ ];
|
|
# user = "alex";
|
|
# prune.keep = {
|
|
# daily = 7;
|
|
# weekly = 4;
|
|
# monthly = 6;
|
|
# };
|
|
# extraPruneArgs = "--save-space --list --stats";
|
|
# exclude = map (x: paths + "/" + x) [
|
|
# ".cache"
|
|
# ".config/Nextcloud/logs"
|
|
# ".local/share/baloo"
|
|
# ];
|
|
# };
|
|
};
|
|
};
|
|
|
|
security = {
|
|
# rtkit.enable = true;
|
|
# apparmor.enable = true;
|
|
|
|
# auditd.enable = true;
|
|
# audit.enable = true;
|
|
# audit.rules = [
|
|
# "-a exit,always -F arch=b64 -S execve"
|
|
# ];
|
|
|
|
sudo.extraConfig = ''
|
|
# rollback results in sudo lectures after each reboot
|
|
Defaults lecture = never
|
|
'';
|
|
};
|
|
|
|
system.stateVersion = "24.11";
|
|
}
|