From bb58d112c3aa5799b654ea83a74807dba3dc1ce4 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Mon, 15 Jan 2024 01:08:01 +0000 Subject: [PATCH] ops/nixos/laputa: init --- ops/nixos/default.nix | 1 + ops/nixos/installcd/default.nix | 4 +- ops/nixos/laputa/README.md | 9 ++ ops/nixos/laputa/default.nix | 222 ++++++++++++++++++++++++++++++++ 4 files changed, 234 insertions(+), 2 deletions(-) create mode 100644 ops/nixos/laputa/README.md create mode 100644 ops/nixos/laputa/default.nix diff --git a/ops/nixos/default.nix b/ops/nixos/default.nix index ab33a96611..6200810566 100644 --- a/ops/nixos/default.nix +++ b/ops/nixos/default.nix @@ -48,6 +48,7 @@ let "oracle-lon01" "kerrigan" "cofractal-ams01" + "laputa" ]; rebuilder = system: (import ./lib/rebuilder.nix (args // { system = system; })); systemCfgs = lib.genAttrs systems diff --git a/ops/nixos/installcd/default.nix b/ops/nixos/installcd/default.nix index 7d116b65e8..79821e2d88 100644 --- a/ops/nixos/installcd/default.nix +++ b/ops/nixos/installcd/default.nix @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: 2020 Luke Granger-Brown +# SPDX-FileCopyrightText: 2024 Luke Granger-Brown # # SPDX-License-Identifier: Apache-2.0 @@ -13,7 +13,7 @@ in { isoImage.isoName = lib.mkForce "nixos-${depot.version}-${pkgs.stdenv.hostPlatform.system}.iso"; isoImage.storeContents = [ - depot.ops.nixos.systems.cofractal-ams01 + depot.ops.nixos.systems.laputa ]; system.disableInstallerTools = false; diff --git a/ops/nixos/laputa/README.md b/ops/nixos/laputa/README.md new file mode 100644 index 0000000000..37aaa81569 --- /dev/null +++ b/ops/nixos/laputa/README.md @@ -0,0 +1,9 @@ + + +# laputa.roam.lukegb.net + +Hackboard 2 diff --git a/ops/nixos/laputa/default.nix b/ops/nixos/laputa/default.nix new file mode 100644 index 0000000000..a42a0a95cf --- /dev/null +++ b/ops/nixos/laputa/default.nix @@ -0,0 +1,222 @@ +# SPDX-FileCopyrightText: 2024 Luke Granger-Brown +# +# SPDX-License-Identifier: Apache-2.0 + +{ depot, lib, pkgs, config, ... }: +{ + imports = [ + ../lib/zfs.nix + ../lib/graphical-client-wayland.nix + ../lib/plasma.nix + ../lib/whitby-distributed.nix + ]; + + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ahci" + "nvme" + "usbhid" + "usb_storage" + "sd_mod" + "rtsx_pci_sdmmc" + ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.supportedFilesystems = [ "ntfs" ]; + boot.kernel.sysctl = { + "abi.vsyscall32" = "0"; + }; + + fileSystems = let + zfs = device: { + device = device; + fsType = "zfs"; + }; + in { + "/" = zfs "zpool/local/root"; + "/nix" = zfs "zpool/local/nix"; + "/tmp" = zfs "zpool/local/tmp"; + + "/var" = zfs "zpool/safe/var"; + "/home" = zfs "zpool/safe/home"; + "/persist" = zfs "zpool/safe/persist"; + + "/boot" = { + device = "/dev/disk/by-label/NIXBOOT"; + fsType = "vfat"; + }; + }; + + nix.settings.max-jobs = lib.mkDefault 4; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; + hardware.enableRedistributableFirmware = true; + + # Laptop, don't autodeploy. + my.deploy.enable = false; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + # ZFS! + services.zfs.rollbackOnBoot.enable = true; + + # Enable Podman + virtualisation.podman = { + enable = true; + dockerCompat = true; + }; + + # Enable libvirtd. + virtualisation.libvirtd = { + enable = true; + qemu = { + swtpm.enable = true; + ovmf.packages = [ + pkgs.OVMFFull.fd + ]; + }; + }; + security.polkit.enable = true; + + networking.hostName = "laputa"; + networking.hostId = "88b46fc6"; + + # Boot faster. + systemd.services.systemd-udev-settle.enable = false; + systemd.services.NetworkManager-wait-online.enable = false; + + networking.networkmanager = { + enable = true; + wifi.backend = "iwd"; + }; + #my.ip.tailscale = "100.125.26.108"; + #my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:1a6c"; + + # Set your time zone. + time.timeZone = "Europe/London"; + + environment.systemPackages = with pkgs; [ + pciutils + deluge + ]; + + # Enable CUPS to print documents. + services.printing.enable = true; + services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ]; + + # Enable the X11 windowing system. + services.xserver = { + enable = true; + layout = "us"; + libinput.enable = true; + windowManager.i3.enable = true; + videoDrivers = [ "modesetting" "fbdev" "intel" ]; + }; + services.xserver.displayManager = { + sddm = { + enable = true; + settings = { + General.DisplayServer = "wayland"; + Users.HideUsers = "deployer"; + }; + }; + defaultSession = "plasmawayland"; + }; + + boot.initrd.systemd.enable = true; + + hardware.opengl.driSupport32Bit = true; + hardware.opengl.extraPackages = with pkgs; [ + intel-media-driver libva + # intel-compute-runtime # intel gpu + depot.nix.pkgs.intel-oclcpuexp + ]; + hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ]; + hardware.acpilight.enable = true; + hardware.bluetooth.enable = true; + + # Define a user account. + programs.adb.enable = true; + users.users.lukegb = { + extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" "dialout" "adbusers" ]; + }; + my.home-manager.system = {...}: { + home.packages = lib.mkAfter (with pkgs; [ + iw + vulkan-tools + ]); + }; + + # Things to persist. + services.openssh.hostKeys = [ + { + path = "/persist/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + } + { + path = "/persist/etc/ssh/ssh_host_rsa_key"; + type = "rsa"; + bits = 4096; + } + ]; + environment.etc = { + "nixos" = { source = "/persist/etc/nixos/"; }; + }; + systemd.tmpfiles.rules = [ + "d /var/lib/libvirt 0755 root - - -" + ]; + systemd.mounts = let + bindMount' = dir: { + unitConfig.RequiresMountsFor = dir; + options = "bind"; + what = "/persist${dir}"; + where = dir; + }; + bindMountSvc = dir: svc: target: (bindMount' dir) // { + bindsTo = [svc]; + partOf = [svc]; + before = [svc]; + wantedBy = [target]; + }; + bindMount = dir: (bindMount' dir) // { + wantedBy = ["multi-user.target"]; + }; + in [ + (bindMountSvc "/var/lib/libvirt" "libvirtd.service" "multi-user.target") + (bindMountSvc "/etc/NetworkManager/system-connections" "NetworkManager.service" "network.target") + (bindMount "/root") + ]; + + # Enable Thunderbolt device management. + services.hardware.bolt.enable = true; + + services.redis.servers."".enable = true; + services.postgresql.enable = true; + services.postgresql.ensureDatabases = [ "lukegb" ]; + services.postgresql.ensureUsers = [{ + name = "lukegb"; + ensureDBOwnership = true; + }]; + services.postgresql.authentication = '' + local all all trust + host all all 127.0.0.1/32 trust + host all all ::1/128 trust + ''; + + my.scrapeJournal.enable = false; # Laptop, don't pull too much. + + services.avahi = { + enable = true; + openFirewall = true; + }; + services.lldpd = { + enable = true; + }; + + # This value determines the NixOS release with which your system is to be + # compatible, in order to avoid breaking some software such as database + # servers. You should change this only after NixOS release notes say you + # should. + system.stateVersion = "23.04"; # Did you read the comment? +}