depot/ops/nixos/nausicaa/default.nix

328 lines
8.2 KiB
Nix
Raw Normal View History

2024-03-01 14:23:22 +00:00
# SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ depot, lib, pkgs, config, ... }:
let
inherit (depot.ops) secrets;
in {
imports = [
../lib/zfs.nix
../lib/graphical-client-wayland.nix
../lib/plasma.nix
#../lib/whitby-distributed.nix
2024-06-10 12:35:28 +00:00
#../lib/nixbuild-distributed.nix
../lib/rexxar-distributed.nix
2024-03-01 14:23:22 +00:00
../lib/quadv-ca/default.nix
((import ../../../third_party/lanzaboote.nix { }).nixosModules.lanzaboote)
2024-08-11 01:25:04 +00:00
../lib/open5gs.nix
2024-03-01 14:23:22 +00:00
];
boot = lib.mkMerge [{
initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usbhid"
"usb_storage"
"sd_mod"
"rtsx_pci_sdmmc"
];
initrd.kernelModules = [ "amdgpu" ];
kernelModules = [ "kvm-amd" ];
supportedFilesystems = [ "ntfs" ];
kernel.sysctl = {
"abi.vsyscall32" = "0";
};
# We're using Lanzaboote, so no systemd-boot.
lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
settings = {
reboot-for-bitlocker = true;
editor = false;
};
};
loader.efi.canTouchEfiVariables = true;
initrd.systemd.enable = true;
binfmt.emulatedSystems = [ "aarch64-linux" ];
kernelParams = [ "amd_pstate=active" ];
} (lib.mkIf (lib.versionOlder config.boot.kernelPackages.kernel.version "6.8") {
kernelParams = [
# Scatter/Gather causes display flickering
"amdgpu.sg_display=0"
# SuspendThenHibernate workaround
"rtc_cmos.use_acpi_alarm=1"
];
})];
my.rundeck.expectedOnline = false;
fileSystems = let
zfs = device: {
device = device;
fsType = "zfs";
};
in {
"/" = zfs "zpool/local/root";
"/nix" = zfs "zpool/local/nix";
"/tmp" = zfs "zpool/local/tmp";
"/var" = zfs "zpool/safe/var";
"/home" = zfs "zpool/safe/home";
"/persist" = zfs "zpool/safe/persist";
"/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
};
};
nix.settings.max-jobs = lib.mkDefault 12;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.enableRedistributableFirmware = true;
# Laptop, don't autodeploy.
my.deploy.enable = false;
# ZFS!
services.zfs.rollbackOnBoot.enable = true;
# Enable Podman
virtualisation.podman = {
enable = true;
dockerCompat = true;
};
# Enable LXD
virtualisation.lxd = {
enable = false;
zfsSupport = true;
recommendedSysctlSettings = true;
};
systemd.services.lxd.serviceConfig.path = lib.mkAfter (with pkgs; [
iptables
ebtables
]);
# Enable libvirtd.
virtualisation.libvirtd = {
enable = true;
qemu = {
swtpm.enable = true;
ovmf.packages = [
pkgs.OVMFFull.fd
];
};
};
security.polkit.enable = true;
networking.hostName = "nausicaa";
networking.domain = "int.as205479.net";
networking.hostId = "db370a50";
# Boot faster.
systemd.services.systemd-udev-settle.enable = false;
systemd.services.NetworkManager-wait-online.enable = false;
networking.networkmanager = {
enable = true;
wifi.backend = "iwd";
};
#my.ip.tailscale = "100.125.26.108";
#my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:1a6c";
# Set your time zone.
time.timeZone = "Europe/London";
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
sbctl
pciutils
deluge
(writeShellScriptBin "windows" ''
set -ue
if [[ $EUID -ne 0 ]]; then
exec sudo "$0" "$@"
fi
2024-06-22 22:55:22 +00:00
efibootmgr -n 0003
2024-03-01 14:23:22 +00:00
systemctl reboot
'')
2024-08-11 01:25:04 +00:00
limesuiteWithGui
srsran
];
services.udev.packages = with pkgs; [
limesuiteWithGui
2024-03-01 14:23:22 +00:00
];
# Enable CUPS to print documents.
services.printing.enable = true;
2024-07-19 22:39:17 +00:00
services.printing.drivers = with depot.pkgs; [ intermec-cups-driver magicard-cups-driver ];
2024-03-01 14:23:22 +00:00
# Enable the X11 windowing system.
services.xserver = {
enable = true;
2024-03-01 17:34:53 +00:00
xkb.layout = "us";
2024-03-01 14:23:22 +00:00
windowManager.i3.enable = true;
videoDrivers = [ "modesetting" ];
};
2024-05-18 14:43:53 +00:00
services.libinput.enable = true;
services.displayManager = {
2024-03-01 14:23:22 +00:00
sddm = {
enable = true;
wayland.enable = true;
2024-03-01 14:23:22 +00:00
settings = {
Users.HideUsers = "deployer";
};
};
2024-06-08 23:52:32 +00:00
defaultSession = "plasma";
2024-03-01 14:23:22 +00:00
};
2024-07-03 19:32:37 +00:00
hardware.graphics.enable32Bit = true;
2024-03-01 14:23:22 +00:00
hardware.acpilight.enable = true;
hardware.bluetooth.enable = true;
hardware.sensor.iio.enable = true;
services.fprintd.enable = true;
2024-06-22 21:54:39 +00:00
services.hardware.openrgb = {
enable = true;
package = pkgs.openrgb-with-all-plugins;
};
2024-03-01 14:23:22 +00:00
services.udev.extraRules = ''
# Ethernet expansion card support
ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="0bda", ATTR{idProduct}=="8156", ATTR{power/autosuspend}="20"
2024-06-22 21:54:39 +00:00
# RGB ANSI Keyboard
SUBSYSTEMS=="usb", ATTRS{idVendor}=="32ac", ATTRS{idProduct}=="0012", TAG+="uaccess"
# RGB Macropad
SUBSYSTEMS=="usb", ATTRS{idVendor}=="32ac", ATTRS{idProduct}=="0013", TAG+="uaccess"
2024-03-01 14:23:22 +00:00
'';
# Define a user account.
programs.adb.enable = true;
users.users.lukegb = {
extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" "dialout" "adbusers" ];
};
my.home-manager.system = {...}: {
home.packages = lib.mkAfter (with pkgs; [
steam
(writeScriptBin "javaws" ''
#!/bin/sh
exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
'')
factorio-experimental
(depot.nix.pkgs.secretsync.configure {
workingDir = "/home/lukegb/depot";
gitlabAccessToken = secrets.deployer.gitlabAccessToken;
manifestVariable = "SECRETS_MANIFEST";
variablesToFile = {
"OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix";
};
})
efibootmgr
iw
obs-studio
vulkan-tools
2024-08-11 01:25:04 +00:00
depot.nix.pkgs.world-of-goo2
yt-dlp
2024-03-01 14:23:22 +00:00
]);
};
# Things to persist.
services.openssh.hostKeys = [
{
path = "/persist/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/persist/etc/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
environment.etc = {
"nixos" = { source = "/persist/etc/nixos/"; };
"secureboot" = { source = "/persist/etc/secureboot/"; };
};
systemd.tmpfiles.rules = [
#"L /etc/nixos - - - - /persist/etc/nixos"
"d /var/lib/libvirt 0755 root - - -"
"d /persist/etc/nixos 0700 root - - -"
"d /persist/etc/secureboot 0700 root - - -"
];
systemd.mounts = let
bindMount' = dir: {
unitConfig.RequiresMountsFor = dir;
options = "bind";
what = "/persist${dir}";
where = dir;
};
bindMountSvc = dir: svc: target: (bindMount' dir) // {
bindsTo = [svc];
partOf = [svc];
before = [svc];
wantedBy = [target];
};
bindMount = dir: (bindMount' dir) // {
wantedBy = ["multi-user.target"];
};
in [
(bindMountSvc "/var/lib/libvirt" "libvirtd.service" "multi-user.target")
(bindMountSvc "/etc/NetworkManager/system-connections" "NetworkManager.service" "network.target")
(bindMount "/root")
];
# Enable Thunderbolt device management.
services.hardware.bolt.enable = true;
services.redis.servers."".enable = true;
services.postgresql.enable = true;
services.postgresql.ensureDatabases = [ "lukegb" ];
services.postgresql.ensureUsers = [{
name = "lukegb";
}];
services.postgresql.authentication = ''
local all all trust
host all all 127.0.0.1/32 trust
host all all ::1/128 trust
'';
nix.buildMachines = [ {
hostName = "totoro";
system = "x86_64-linux";
maxJobs = 4;
speedFactor = 2;
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
mandatoryFeatures = [ ];
}];
hardware.cpu.amd.updateMicrocode = true;
services.power-profiles-daemon.enable = true;
my.scrapeJournal.enable = false; # Laptop, don't pull too much.
services.avahi = {
enable = true;
openFirewall = true;
};
services.lldpd = {
enable = true;
};
2024-08-11 01:25:04 +00:00
my.services.open5gs.enable = true;
2024-03-01 14:23:22 +00:00
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you
# should.
system.stateVersion = "24.05"; # Did you read the comment?
}