depot/ops/nixos/porcorosso/default.nix

363 lines
11 KiB
Nix
Raw Normal View History

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ depot, lib, pkgs, config, ... }:
let
inherit (depot.ops) secrets;
nvidia-offload-profile = ''
export __NV_PRIME_RENDER_OFFLOAD=1
export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
export __GLX_VENDOR_LIBRARY_NAME=nvidia
export __VK_LAYER_NV_optimus=NVIDIA_only
'';
nvidia-offload = pkgs.writeShellScriptBin "nvidia-offload"
(nvidia-offload-profile + ''
exec -a "$0" "$@"
'');
setup-display = pkgs.writeShellScriptBin "setup-display-porcorosso" ''
${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource modesetting NVIDIA-0
${pkgs.xorg.xrandr}/bin/xrandr --auto
${pkgs.autorandr}/bin/autorandr -c
'';
in {
imports = [
../lib/zfs.nix
2021-05-05 21:13:27 +00:00
../lib/graphical-client-x11.nix
2020-07-19 17:20:21 +00:00
../lib/whitby-distributed.nix
];
boot.initrd.availableKernelModules = [
"xhci_pci"
"ahci"
"nvme"
"usbhid"
"usb_storage"
"sd_mod"
"rtsx_pci_sdmmc"
];
boot.initrd.kernelModules = [ "nvidia" "nvidia_uvm" "nvidia_drm" "nvidia_modeset" "i2c_nvidia_gpu" ];
boot.kernelModules = [ "kvm-intel" ];
2020-05-11 20:15:49 +00:00
boot.supportedFilesystems = [ "ntfs" ];
2020-11-04 17:09:53 +00:00
boot.kernel.sysctl = {
"abi.vsyscall32" = "0";
};
2022-04-03 18:47:19 +00:00
boot.blacklistedKernelModules = [
# TODO(lukegb): remove this again
# For reasons unknown, at the moment, the firmware keeps getting reloaded every 10 seconds or so, resulting in a brief stutter and
# "r8152 6-2.4:1.0: load rtl8153b-2 v1 10/23/19 successfully"
# This driver is used for the Ethernet port on my USB4 dock, so let's drop this for now.
"r8153_ecm" "r8152"
];
my.rundeck.expectedOnline = false;
fileSystems = let
zfs = device: {
device = device;
fsType = "zfs";
};
in {
"/" = zfs "zpool/local/root";
"/nix" = zfs "zpool/local/nix";
"/tmp" = zfs "zpool/local/tmp";
"/var" = zfs "zpool/safe/var";
"/home" = zfs "zpool/safe/home";
"/persist" = zfs "zpool/safe/persist";
"/boot" = {
device = "/dev/disk/by-label/NIXBOOT";
fsType = "vfat";
};
2020-05-11 20:15:49 +00:00
"/data" = {
device = "/dev/disk/by-label/BULKDATA";
fsType = "ntfs";
2020-06-13 17:29:10 +00:00
options = [ "rw" "uid=1000" "gid=100" "dmask=022" "fmask=024" "windows_names" ];
2020-05-11 20:15:49 +00:00
};
};
nix.settings.max-jobs = lib.mkDefault 12;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.enableRedistributableFirmware = true;
# Laptop, don't autodeploy.
my.deploy.enable = false;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# ZFS!
services.zfs.rollbackOnBoot.enable = true;
2020-10-04 00:03:28 +00:00
# Enable Podman
virtualisation.podman = {
enable = true;
dockerCompat = true;
};
2020-12-26 15:39:41 +00:00
# Enable LXD
virtualisation.lxd = {
2021-11-25 17:14:03 +00:00
enable = false;
2020-12-26 15:39:41 +00:00
zfsSupport = true;
recommendedSysctlSettings = true;
};
systemd.services.lxd.serviceConfig.path = lib.mkAfter (with pkgs; [
iptables
ebtables
]);
2020-11-03 16:03:22 +00:00
# Enable libvirtd.
virtualisation.libvirtd = {
enable = true;
qemu = {
swtpm.enable = true;
ovmf.packages = [
pkgs.OVMFFull.fd
];
};
2020-11-03 16:03:22 +00:00
};
2022-08-14 20:01:26 +00:00
security.polkit.enable = true;
2020-11-03 16:03:22 +00:00
networking.hostName = "porcorosso";
networking.hostId = "1ee729a4";
# Boot faster.
systemd.services.systemd-udev-settle.enable = false;
systemd.services.NetworkManager-wait-online.enable = false;
2022-08-14 17:11:14 +00:00
networking.networkmanager = {
enable = true;
wifi.backend = "iwd";
};
my.ip.tailscale = "100.125.26.108";
2022-09-01 23:22:16 +00:00
my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:1a6c";
# Set your time zone.
time.timeZone = "Europe/London";
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
pciutils
nvidia-offload
2020-05-10 01:12:29 +00:00
deluge
(writeShellScriptBin "windows" ''
set -ue
if [[ $EUID -ne 0 ]]; then
exec sudo "$0" "$@"
fi
2020-10-25 11:36:16 +00:00
efibootmgr -n 0001
systemctl reboot
'')
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
# List services that you want to enable:
# Enable CUPS to print documents.
services.printing.enable = true;
services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ];
# Enable the X11 windowing system.
2022-01-08 21:45:18 +00:00
services.xserver = {
enable = true;
layout = "us";
libinput.enable = true;
windowManager.i3.enable = true;
videoDrivers = [ "nvidia" ];
};
specialisation.intelGraphics.configuration = {
my.specialisationName = "intelGraphics";
services.xserver.videoDrivers = lib.mkForce [ "intel" ];
hardware.nvidia.modesetting.enable = lib.mkForce false;
hardware.nvidia.prime.offload.enable = lib.mkForce false;
boot.initrd.kernelModules = lib.mkForce [];
};
services.xserver.displayManager.gdm = {
enable = true;
2021-08-30 13:23:20 +00:00
wayland = false;
};
hardware.nvidia = {
modesetting.enable = true;
prime = {
# PRIME sync enables using Intel non-muxed outputs (i.e. the internal display)
sync.enable = true;
nvidiaBusId = "PCI:1:0:0";
intelBusId = "PCI:0:2:0";
};
};
hardware.opengl.driSupport32Bit = true;
hardware.opengl.extraPackages = with pkgs; [
2022-04-05 03:14:07 +00:00
intel-media-driver libva
];
hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
2021-02-13 13:50:13 +00:00
hardware.acpilight.enable = true;
2021-10-22 01:49:50 +00:00
hardware.bluetooth.enable = true;
# Define a user account.
users.users.lukegb = {
extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" "dialout" ];
2020-10-25 11:36:16 +00:00
};
my.home-manager.system = {...}: {
xsession.windowManager.i3.config.startup = lib.mkAfter [
{ command = "${setup-display}/bin/setup-display-porcorosso"; notification = false; }
2021-07-26 13:02:57 +00:00
];
programs.autorandr = {
enable = true;
profiles.standard = {
config = {
"eDP-1-1" = {
enable = true;
mode = "1920x1080";
position = "0x0";
rate = "59.98";
};
2021-07-26 13:02:57 +00:00
"DP-0.2" = {
enable = true;
mode = "3840x2160";
primary = true;
2022-01-23 23:38:52 +00:00
position = "1920x0";
2021-07-26 13:02:57 +00:00
rate = "60.00";
};
"DP-0.1" = {
enable = true;
mode = "3840x2160";
2022-01-23 23:38:52 +00:00
position = "5760x0";
2021-07-26 13:02:57 +00:00
rate = "60.00";
};
};
fingerprint = {
"DP-0.2" = "00ffffffffffff0005e36828e70100001b180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c001010101e5ca0038f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a20202020202020014d020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013";
"DP-0.1" = "00ffffffffffff0005e368283302000016180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c00101010125cc0050f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a2020202020202001ab020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013";
"eDP-1-1" = "00ffffffffffff0030e41a0600000000001c0104a522137802e0b5a3544e9b260c505400000001010101010101010101010101010101243680a070381f403020350058c21000001a502b80a070381f403020350058c21000001a000000fe003150564d35803135365746430a00000000000141319e001000000a010a2020007a";
2021-07-26 13:02:57 +00:00
};
};
};
2020-10-25 11:36:16 +00:00
home.packages = lib.mkAfter (with pkgs; [
(steam.override { extraProfile = nvidia-offload-profile; })
(writeScriptBin "javaws" ''
#!/bin/sh
exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
'')
2020-11-24 02:56:18 +00:00
factorio-experimental
(depot.nix.pkgs.secretsync.configure {
workingDir = "/home/lukegb/depot";
gitlabAccessToken = secrets.deployer.gitlabAccessToken;
manifestVariable = "SECRETS_MANIFEST";
variablesToFile = {
"OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix";
};
})
efibootmgr
iw
2020-11-25 02:13:14 +00:00
obs-studio
2020-05-31 17:58:29 +00:00
vulkan-tools
setup-display
2020-10-25 11:36:16 +00:00
]);
};
2020-05-22 12:04:47 +00:00
# github.com/target/lorri
services.lorri.enable = true;
# Things to persist.
services.openssh.hostKeys = [
{
path = "/persist/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/persist/etc/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
environment.etc = {
"nixos" = { source = "/persist/etc/nixos/"; };
};
systemd.tmpfiles.rules = [
#"L /etc/nixos - - - - /persist/etc/nixos"
2020-11-04 17:09:53 +00:00
"d /var/lib/libvirt 0755 root - - -"
];
systemd.mounts = let
bindMount' = dir: {
unitConfig.RequiresMountsFor = dir;
options = "bind";
what = "/persist${dir}";
where = dir;
};
bindMountSvc = dir: svc: (bindMount' dir) // {
bindsTo = [svc];
partOf = [svc];
};
bindMount = dir: (bindMount' dir) // {
wantedBy = ["multi-user.target"];
};
in [
(bindMountSvc "/var/lib/libvirt" "libvirtd.service")
(bindMountSvc "/etc/NetworkManager/system-connections" "NetworkManager.service")
(bindMount "/root")
];
# Enable Thunderbolt device management.
services.hardware.bolt.enable = true;
services.redis.servers."".enable = true;
2020-06-20 22:11:24 +00:00
services.postgresql.enable = true;
services.postgresql.ensureUsers = [{
name = "lukegb";
ensurePermissions = {
"ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
"DATABASE lukegb" = "ALL PRIVILEGES";
};
}];
services.postgresql.authentication = ''
local all all trust
host all all 127.0.0.1/32 trust
host all all ::1/128 trust
'';
nix.buildMachines = [ {
hostName = "totoro";
system = "x86_64-linux";
maxJobs = 4;
speedFactor = 2;
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
mandatoryFeatures = [ ];
}];
services.tlp = {
enable = true;
settings = {
DISK_DEVICES = "nvme0n1 nvme1n1 nvme2n1";
DISK_IOSCHED = "mq-deadline mq-deadline mq-deadline";
};
};
2022-01-01 15:08:52 +00:00
my.scrapeJournal.enable = false; # Laptop, don't pull too much.
2022-08-14 17:11:14 +00:00
services.avahi = {
enable = true;
openFirewall = true;
};
services.lldpd = {
enable = true;
};
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
# servers. You should change this only after NixOS release notes say you
# should.
2020-05-11 20:15:49 +00:00
system.stateVersion = "20.03"; # Did you read the comment?
2020-06-13 17:31:37 +00:00
}