lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

nixos: start using home-manager

Browse source
This commit is contained in:
Luke Granger-Brown 2020-10-25 11:36:16 +00:00
parent 9599a84a1c
commit 29fa1e35fd
8 changed files with 235 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
ops/nixos/lib/client.nix
View file

@ -2,20 +2,15 @@
#
# SPDX-License-Identifier: Apache-2.0
{ pkgs, depot, lib, ... }:
{ pkgs, config, depot, lib, ... }:
let
inherit (lib) mkBefore;
in
{
nix.gc.automatic = false;
imports = [ ../../../third_party/home-manager/nixos ];
users.users.lukegb.packages = mkBefore (with pkgs; [
depot.nix.pkgs.copybara
direnv
git
go
graphicsmagick-imagemagick-compat
ripgrep
whois
]);
config = {
my.home-manager.imports = lib.mkAfter [ ./home-manager/client.nix ];
nix.gc.automatic = false;
};
}

165
ops/nixos/lib/common.nix
View file

@ -2,90 +2,113 @@
#
# SPDX-License-Identifier: Apache-2.0
{ pkgs, depot, lib, rebuilder, ... }:
{ pkgs, config, depot, lib, rebuilder, ... }@args:
let
inherit (lib) mkDefault;
in
{
hardware.enableRedistributableFirmware = true;
nix = {
nixPath = [ "depot=/home/lukegb/depot/" "nixpkgs=/home/lukegb/depot/third_party/nixpkgs/" ];
trustedUsers = [ "root" "@wheel" ];
binaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
trustedBinaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
envVars = {
AWS_ACCESS_KEY_ID = "${depot.ops.secrets.nixCache.AWS_ACCESS_KEY_ID}";
AWS_SECRET_ACCESS_KEY = "${depot.ops.secrets.nixCache.AWS_SECRET_ACCESS_KEY}";
};
options.my.home-manager.imports = lib.mkOption {
type = lib.types.listOf lib.types.path;
default = [ ./home-manager/common.nix ];
};
nixpkgs.config = depot.third_party.nixpkgsConfig;
i18n.defaultLocale = "en_GB.UTF-8";
console.keyMap = "us";
time.timeZone = mkDefault "Etc/UTC";
environment.systemPackages = with pkgs; [
vim rxvt_unicode.terminfo tmux rebuilder tailscale rsync
(mercurial.overridePythonAttrs (origAttrs: {
propagatedBuildInputs = origAttrs.propagatedBuildInputs ++ [python3Packages.hg-evolve depot.nix.pkgs.hg-git];
}))
];
networking.firewall = {
allowPing = true;
options.my.home-manager.system = lib.mkOption {
type = lib.types.nullOr lib.types.anything;
default = null;
};
users.mutableUsers = false;
users.users = let secrets = depot.ops.secrets; in {
root.hashedPassword = secrets.passwordHashes.root;
lukegb = {
isNormalUser = true;
uid = 1000;
extraGroups = [ "wheel" ];
hashedPassword = secrets.passwordHashes.lukegb;
config = {
hardware.enableRedistributableFirmware = true;
nix = {
nixPath = [ "depot=/home/lukegb/depot/" "nixpkgs=/home/lukegb/depot/third_party/nixpkgs/" ];
trustedUsers = [ "root" "@wheel" ];
binaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
trustedBinaryCaches = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
envVars = {
AWS_ACCESS_KEY_ID = "${depot.ops.secrets.nixCache.AWS_ACCESS_KEY_ID}";
AWS_SECRET_ACCESS_KEY = "${depot.ops.secrets.nixCache.AWS_SECRET_ACCESS_KEY}";
};
};
deployer = {
isSystemUser = true;
uid = 1001;
hashedPassword = "!";
useDefaultShell = true;
home = "/var/lib/deployer";
createHome = true;
openssh.authorizedKeys.keyFiles = [
../../secrets/deployer_ed25519.pub
];
nixpkgs.config = depot.third_party.nixpkgsConfig;
i18n.defaultLocale = "en_GB.UTF-8";
console.keyMap = "us";
time.timeZone = mkDefault "Etc/UTC";
environment.systemPackages = with pkgs; [
vim rxvt_unicode.terminfo tmux rebuilder tailscale rsync
(mercurial.overridePythonAttrs (origAttrs: {
propagatedBuildInputs = origAttrs.propagatedBuildInputs ++ [python3Packages.hg-evolve depot.nix.pkgs.hg-git];
}))
];
networking.firewall = {
allowPing = true;
};
};
security.sudo.extraRules = [{
users = [ "deployer" ];
commands = [{
command = "${rebuilder}/bin/rebuilder";
options = [ "NOPASSWD" ];
users.mutableUsers = false;
users.users = let secrets = depot.ops.secrets; in {
root.hashedPassword = secrets.passwordHashes.root;
lukegb = {
isNormalUser = true;
uid = 1000;
extraGroups = [ "wheel" ];
hashedPassword = secrets.passwordHashes.lukegb;
};
deployer = {
isSystemUser = true;
uid = 1001;
hashedPassword = "!";
useDefaultShell = true;
home = "/var/lib/deployer";
createHome = true;
openssh.authorizedKeys.keyFiles = [
../../secrets/deployer_ed25519.pub
];
};
};
security.sudo.extraRules = [{
users = [ "deployer" ];
commands = [{
command = "${rebuilder}/bin/rebuilder";
options = [ "NOPASSWD" ];
}];
}];
}];
security.sudo.extraConfig = ''
Defaults:deployer !requiretty
'';
security.sudo.extraConfig = ''
Defaults:deployer !requiretty
'';
programs.mtr.enable = true;
services.openssh.enable = true;
services.tailscale.enable = true;
programs.mtr.enable = true;
services.openssh.enable = true;
services.tailscale.enable = true;
boot = {
kernelModules = [ "tcp_bbr" ];
kernel.sysctl."net.ipv4.tcp_congestion_control" = "bbr";
kernel.sysctl."net.core.default_qdisc" = "fq_codel";
};
boot = {
kernelModules = [ "tcp_bbr" ];
kernel.sysctl."net.ipv4.tcp_congestion_control" = "bbr";
kernel.sysctl."net.core.default_qdisc" = "fq_codel";
};
system.activationScripts.lukegb-hgrc = lib.stringAfter [ "users" "groups" ] ''
ln -sfn ${./hgrc} /home/lukegb/.hgrc
'';
# Clean up daily.
nix.gc = {
automatic = lib.mkDefault true;
dates = "*-*-* 05:00:00";
};
# Clean up daily.
nix.gc = {
automatic = lib.mkDefault true;
dates = "*-*-* 05:00:00";
home-manager.useUserPackages = true;
home-manager.useGlobalPkgs = true;
systemd.services."home-manager-lukegb" = {
before = [ "display-manager.service" ];
wantedBy = [ "multi-user.target" ];
};
home-manager.users.lukegb = { pkgs, ... }: ({
imports = [ ({
_module.args = args;
})] ++ config.my.home-manager.imports ++ (
lib.optional (config.my.home-manager.system != null) config.my.home-manager.system
);
});
};
}

40
ops/nixos/lib/graphical-client.nix
View file

@ -11,24 +11,28 @@ in
./client.nix
];
fonts.fonts = with pkgs; [
iosevka
];
services.udev.packages = [ pkgs.libu2f-host ];
services.pcscd.enable = true;
config = {
my.home-manager.imports = lib.mkAfter [ ./home-manager/graphical-client.nix ];
sound.enable = true;
hardware.pulseaudio.enable = true;
fonts.fonts = with pkgs; [
iosevka
];
services.udev.packages = [ pkgs.libu2f-host ];
services.pcscd.enable = true;
users.users.lukegb.packages = mkBefore (with pkgs; [
chromium
dino
lutris
pavucontrol
rxvt_unicode
teamspeak_client
virtmanager
xclip
yubioath-desktop
]);
sound.enable = true;
hardware.pulseaudio.enable = true;
users.users.lukegb.packages = mkBefore (with pkgs; [
chromium
dino
lutris
pavucontrol
rxvt_unicode
teamspeak_client
virtmanager
xclip
yubioath-desktop
]);
};
}

38
ops/nixos/lib/home-manager/client.nix Normal file
View file

@ -0,0 +1,38 @@
{ depot, lib, pkgs, ... }:
{
imports = [ ./common.nix ];
programs.git = {
enable = true;
package = pkgs.gitAndTools.gitFull;
extraConfig = {
user.name = "Luke Granger-Brown";
user.email = "git@lukegb.com";
pull.ff = "only";
};
};
programs.direnv.enable = true;
programs.bash.enableVteIntegration = true;
programs.vim = {
plugins = (with pkgs.vimPlugins; [
vim-go
]);
extraConfig = ''
source $VIMRUNTIME/defaults.vim
let g:go_def_mode='gopls'
let g:go_info_mode='gopls'
let g:go_fmt_command='goimports'
set mouse=
'';
};
home.packages = lib.mkAfter (with pkgs; [
depot.nix.pkgs.copybara
go
gopls
goimports
graphicsmagick-imagemagick-compat
]);
}

55
ops/nixos/lib/home-manager/common.nix Normal file
View file

@ -0,0 +1,55 @@
{ depot, pkgs, ... }:
{
programs.home-manager.enable = true;
home.username = "lukegb";
home.homeDirectory = "/home/lukegb";
home.file = {
".hgrc".source = ./hgrc;
};
programs.bash = {
enable = true;
enableVteIntegration = true;
initExtra = ''
function join_by { local IFS="$1"; shift; echo "$*"; }
if [[ -z "$LAUNCH_SHLVL" ]]; then
export LAUNCH_SHLVL="$SHLVL"
fi
export LAUNCH_DEPTH="$(expr $SHLVL - $LAUNCH_SHLVL)"
export LAUNCH_DEPTH_STR=""
if [[ "$LAUNCH_DEPTH" > 0 ]]; then
if [[ "$PATH" == /nix/store/* ]]; then
declare -a RECENT_PKGS
while read -rd: pathseg; do
if [[ "$pathseg" != /nix/store/* ]]; then
break
fi
RECENT_PKGS+=("$(echo "$pathseg" | sed -E -e 's,^/nix/store/[a-z0-9]+-,,' -e 's,/.*$,,' -e 's,-[0-9.]+$,,')")
done <<< $PATH
RECENT_PKG="$(join_by ":" "''${RECENT_PKGS[@]}")"
if [[ "''${#RECENT_PKG}" > 32 ]]; then
RECENT_PKGS="''${RECENT_PKGS[0]}"
fi
if [[ ! -z "$RECENT_PKG" ]]; then
LAUNCH_DEPTH_STR="[$RECENT_PKG] "
fi
fi
if [[ -z "$LAUNCH_DEPTH_STR" ]]; then
LAUNCH_DEPTH_STR="[$LAUNCH_DEPTH] "
fi
fi
export PS1="\n\[\033[1;32m\]$LAUNCH_DEPTH_STR[\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$ \[\033[0m\]"
'';
};
programs.vim.enable = true;
home.packages = (with pkgs; [
ripgrep
whois
]);
home.stateVersion = "20.09";
}

15
ops/nixos/lib/home-manager/graphical-client.nix Normal file
View file

@ -0,0 +1,15 @@
{ pkgs, ... }:
{
imports = [ ./client.nix ];
gtk = {
enable = true;
gtk3.extraConfig = {
gtk-application-prefer-dark-theme = 1;
};
};
qt = {
enable = true;
platformTheme = "gtk";
};
}

0
ops/nixos/lib/hgrc → ops/nixos/lib/home-manager/hgrc
View file

8
ops/nixos/porcorosso/default.nix
View file

@ -110,7 +110,7 @@ in {
if [[ $EUID -ne 0 ]]; then
exec sudo "$0" "$@"
fi
efibootmgr -n 0001
systemctl reboot
'')
@ -142,7 +142,9 @@ in {
# Define a user account.
users.users.lukegb = {
extraGroups = [ "wheel" "networkmanager" ];
packages = with pkgs; [
};
my.home-manager.system = {...}: {
home.packages = lib.mkAfter (with pkgs; [
(steam.override { extraProfile = nvidia-offload-profile; })
(writeScriptBin "javaws" ''
#!/bin/sh
@ -160,7 +162,7 @@ in {
iotop
iw
vulkan-tools
];
]);
};
# github.com/target/lorri