ops/nixos/laputa: init

ops/nixos/default.nix

@@ -48,6 +48,7 @@ let
     "oracle-lon01"
     "kerrigan"
     "cofractal-ams01"
+    "laputa"
   ];
   rebuilder = system: (import ./lib/rebuilder.nix (args // { system = system; }));
   systemCfgs = lib.genAttrs systems

ops/nixos/installcd/default.nix

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
+# SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
 #
 # SPDX-License-Identifier: Apache-2.0
 
@@ -13,7 +13,7 @@ in {
   isoImage.isoName = lib.mkForce "nixos-${depot.version}-${pkgs.stdenv.hostPlatform.system}.iso";
 
   isoImage.storeContents = [
-    depot.ops.nixos.systems.cofractal-ams01
+    depot.ops.nixos.systems.laputa
   ];
 
   system.disableInstallerTools = false;

ops/nixos/laputa/README.md

@@ -0,0 +1,9 @@
+<!--
+SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# laputa.roam.lukegb.net
+
+Hackboard 2

ops/nixos/laputa/default.nix

@@ -0,0 +1,222 @@
+# SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+{ depot, lib, pkgs, config, ... }:
+{
+  imports = [
+    ../lib/zfs.nix
+    ../lib/graphical-client-wayland.nix
+    ../lib/plasma.nix
+    ../lib/whitby-distributed.nix
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.supportedFilesystems = [ "ntfs" ];
+  boot.kernel.sysctl = {
+    "abi.vsyscall32" = "0";
+  };
+
+  fileSystems = let
+    zfs = device: {
+      device = device;
+      fsType = "zfs";
+    };
+  in {
+    "/" = zfs "zpool/local/root";
+    "/nix" = zfs "zpool/local/nix";
+    "/tmp" = zfs "zpool/local/tmp";
+
+    "/var" = zfs "zpool/safe/var";
+    "/home" = zfs "zpool/safe/home";
+    "/persist" = zfs "zpool/safe/persist";
+
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+    };
+  };
+
+  nix.settings.max-jobs = lib.mkDefault 4;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.enableRedistributableFirmware = true;
+
+  # Laptop, don't autodeploy.
+  my.deploy.enable = false;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # ZFS!
+  services.zfs.rollbackOnBoot.enable = true;
+
+  # Enable Podman
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+  };
+
+  # Enable libvirtd.
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu = {
+      swtpm.enable = true;
+      ovmf.packages = [
+        pkgs.OVMFFull.fd
+      ];
+    };
+  };
+  security.polkit.enable = true;
+
+  networking.hostName = "laputa";
+  networking.hostId = "88b46fc6";
+
+  # Boot faster.
+  systemd.services.systemd-udev-settle.enable = false;
+  systemd.services.NetworkManager-wait-online.enable = false;
+
+  networking.networkmanager = {
+    enable = true;
+    wifi.backend = "iwd";
+  };
+  #my.ip.tailscale = "100.125.26.108";
+  #my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:1a6c";
+
+  # Set your time zone.
+  time.timeZone = "Europe/London";
+
+  environment.systemPackages = with pkgs; [
+    pciutils
+    deluge
+  ];
+
+  # Enable CUPS to print documents.
+  services.printing.enable = true;
+  services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ];
+
+  # Enable the X11 windowing system.
+  services.xserver = {
+    enable = true;
+    layout = "us";
+    libinput.enable = true;
+    windowManager.i3.enable = true;
+    videoDrivers = [ "modesetting" "fbdev" "intel" ];
+  };
+  services.xserver.displayManager = {
+    sddm = {
+      enable = true;
+      settings = {
+        General.DisplayServer = "wayland";
+        Users.HideUsers = "deployer";
+      };
+    };
+    defaultSession = "plasmawayland";
+  };
+
+  boot.initrd.systemd.enable = true;
+
+  hardware.opengl.driSupport32Bit = true;
+  hardware.opengl.extraPackages = with pkgs; [
+    intel-media-driver libva
+    # intel-compute-runtime  # intel gpu
+    depot.nix.pkgs.intel-oclcpuexp
+  ];
+  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
+  hardware.acpilight.enable = true;
+  hardware.bluetooth.enable = true;
+
+  # Define a user account.
+  programs.adb.enable = true;
+  users.users.lukegb = {
+    extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" "dialout" "adbusers" ];
+  };
+  my.home-manager.system = {...}: {
+    home.packages = lib.mkAfter (with pkgs; [
+      iw
+      vulkan-tools
+    ]);
+  };
+
+  # Things to persist.
+  services.openssh.hostKeys = [
+    {
+      path = "/persist/etc/ssh/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+    {
+      path = "/persist/etc/ssh/ssh_host_rsa_key";
+      type = "rsa";
+      bits = 4096;
+    }
+  ];
+  environment.etc = {
+    "nixos" = { source = "/persist/etc/nixos/"; };
+  };
+  systemd.tmpfiles.rules = [
+    "d /var/lib/libvirt 0755 root - - -"
+  ];
+  systemd.mounts = let
+    bindMount' = dir: {
+      unitConfig.RequiresMountsFor = dir;
+      options = "bind";
+      what = "/persist${dir}";
+      where = dir;
+    };
+    bindMountSvc = dir: svc: target: (bindMount' dir) // {
+      bindsTo = [svc];
+      partOf = [svc];
+      before = [svc];
+      wantedBy = [target];
+    };
+    bindMount = dir: (bindMount' dir) // {
+      wantedBy = ["multi-user.target"];
+    };
+  in [
+    (bindMountSvc "/var/lib/libvirt" "libvirtd.service" "multi-user.target")
+    (bindMountSvc "/etc/NetworkManager/system-connections" "NetworkManager.service" "network.target")
+    (bindMount "/root")
+  ];
+
+  # Enable Thunderbolt device management.
+  services.hardware.bolt.enable = true;
+
+  services.redis.servers."".enable = true;
+  services.postgresql.enable = true;
+  services.postgresql.ensureDatabases = [ "lukegb" ];
+  services.postgresql.ensureUsers = [{
+    name = "lukegb";
+    ensureDBOwnership = true;
+  }];
+  services.postgresql.authentication = ''
+    local all all              trust
+    host  all all 127.0.0.1/32 trust
+    host  all all ::1/128      trust
+  '';
+
+  my.scrapeJournal.enable = false;  # Laptop, don't pull too much.
+
+  services.avahi = {
+    enable = true;
+    openFirewall = true;
+  };
+  services.lldpd = {
+    enable = true;
+  };
+
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "23.04"; # Did you read the comment?
+}