ops/nixos/howl: init
This commit is contained in:
parent
8837939f5e
commit
c31da4140c
3 changed files with 213 additions and 3 deletions
|
|
@ -17,6 +17,7 @@ let
|
|||
});
|
||||
systems = [
|
||||
"porcorosso"
|
||||
"howl"
|
||||
"marukuru"
|
||||
"clouvider-fra01"
|
||||
"totoro"
|
||||
|
|
|
|||
211
ops/nixos/howl/default.nix
Normal file
211
ops/nixos/howl/default.nix
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
|
||||
#
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
{ depot, lib, pkgs, rebuilder, config, ... }:
|
||||
let
|
||||
inherit (depot.ops) secrets;
|
||||
in {
|
||||
imports = [
|
||||
../lib/zfs.nix
|
||||
../lib/graphical-client.nix
|
||||
../lib/whitby-distributed.nix
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
"rtsx_pci_sdmmc"
|
||||
];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.supportedFilesystems = [ "ntfs" ];
|
||||
boot.kernel.sysctl = {
|
||||
"abi.vsyscall32" = "0";
|
||||
};
|
||||
|
||||
my.rundeck.expectedOnline = false;
|
||||
|
||||
fileSystems = let
|
||||
zfs = device: {
|
||||
device = device;
|
||||
fsType = "zfs";
|
||||
};
|
||||
in {
|
||||
"/" = zfs "zpool/local/root";
|
||||
"/nix" = zfs "zpool/local/nix";
|
||||
"/tmp" = zfs "zpool/local/tmp";
|
||||
|
||||
"/var" = zfs "zpool/safe/var";
|
||||
"/home" = zfs "zpool/safe/home";
|
||||
"/persist" = zfs "zpool/safe/persist";
|
||||
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
};
|
||||
};
|
||||
|
||||
nix.maxJobs = lib.mkDefault 12;
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
# Laptop, don't autodeploy.
|
||||
my.deploy.enable = false;
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# ZFS!
|
||||
services.zfs.rollbackOnBoot.enable = true;
|
||||
|
||||
# Enable libvirtd.
|
||||
virtualisation.libvirtd = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
networking.hostName = "howl";
|
||||
networking.hostId = "cdd51451";
|
||||
|
||||
# Boot faster.
|
||||
systemd.services.systemd-udev-settle.enable = false;
|
||||
systemd.services.NetworkManager-wait-online.enable = false;
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
# Use NetworkManager instead.
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eno1.useDHCP = false;
|
||||
networking.networkmanager.enable = true;
|
||||
#my.ip.tailscale = "100.125.26.108";
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/London";
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
pciutils
|
||||
deluge
|
||||
];
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver.enable = true;
|
||||
services.xserver.layout = "us";
|
||||
services.xserver.libinput.enable = true;
|
||||
services.xserver.windowManager.i3.enable = true;
|
||||
services.xserver.videoDrivers = [ "intel" ];
|
||||
services.xserver.displayManager.gdm = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
hardware.opengl.driSupport32Bit = true;
|
||||
hardware.opengl.extraPackages = with pkgs; [
|
||||
intel-media-driver vaapiVdpau libvdpau-va-gl libva
|
||||
];
|
||||
hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
|
||||
hardware.acpilight.enable = true;
|
||||
|
||||
# TODO(lukegb): finish evaluating pipewire
|
||||
hardware.pulseaudio.enable = lib.mkForce false;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
jack.enable = true;
|
||||
pulse.enable = true;
|
||||
|
||||
media-session.enable = true;
|
||||
};
|
||||
|
||||
# Define a user account.
|
||||
users.users.lukegb = {
|
||||
extraGroups = [ "wheel" "networkmanager" "libvirtd" "video" ];
|
||||
};
|
||||
my.home-manager.system = {...}: {
|
||||
home.packages = lib.mkAfter (with pkgs; [
|
||||
steam
|
||||
(writeScriptBin "javaws" ''
|
||||
#!/bin/sh
|
||||
exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
|
||||
'')
|
||||
factorio-experimental
|
||||
(depot.nix.pkgs.secretsync.configure {
|
||||
workingDir = "/home/lukegb/depot";
|
||||
gitlabAccessToken = secrets.deployer.gitlabAccessToken;
|
||||
manifestVariable = "SECRETS_MANIFEST";
|
||||
variablesToFile = {
|
||||
"OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix";
|
||||
};
|
||||
})
|
||||
efibootmgr
|
||||
iw
|
||||
obs-studio
|
||||
vulkan-tools
|
||||
]);
|
||||
};
|
||||
|
||||
# Things to persist.
|
||||
services.openssh.hostKeys = [
|
||||
{
|
||||
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}
|
||||
{
|
||||
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
||||
type = "rsa";
|
||||
bits = 4096;
|
||||
}
|
||||
];
|
||||
environment.etc = {
|
||||
"NetworkManager/system-connections" = {
|
||||
source = "/persist/etc/NetworkManager/system-connections/";
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/libvirt 0755 root - - -"
|
||||
];
|
||||
systemd.mounts = let
|
||||
bindMount' = dir: {
|
||||
unitConfig.RequiresMountsFor = dir;
|
||||
options = "bind";
|
||||
what = "/persist${dir}";
|
||||
where = dir;
|
||||
};
|
||||
bindMountSvc = dir: svc: (bindMount' dir) // {
|
||||
bindsTo = [svc];
|
||||
partOf = [svc];
|
||||
};
|
||||
bindMount = dir: (bindMount' dir) // {
|
||||
wantedBy = ["multi-user.target"];
|
||||
};
|
||||
in [
|
||||
(bindMountSvc "/var/lib/libvirt" "libvirtd.service")
|
||||
(bindMount "/root")
|
||||
];
|
||||
|
||||
# Enable Thunderbolt device management.
|
||||
services.hardware.bolt.enable = true;
|
||||
|
||||
services.avahi.enable = true;
|
||||
|
||||
nix.buildMachines = [ {
|
||||
hostName = "totoro";
|
||||
system = "x86_64-linux";
|
||||
maxJobs = 4;
|
||||
speedFactor = 2;
|
||||
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
||||
mandatoryFeatures = [ ];
|
||||
}];
|
||||
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
# should.
|
||||
system.stateVersion = "21.05"; # Did you read the comment?
|
||||
}
|
||||
|
|
@ -13,9 +13,7 @@ in {
|
|||
isoImage.isoName = lib.mkForce "nixos-${depot.version}-${pkgs.stdenv.hostPlatform.system}.iso";
|
||||
|
||||
isoImage.storeContents = [
|
||||
depot.ops.nixos.systems.bvm-twitterchiver
|
||||
depot.ops.nixos.systems.bvm-prosody
|
||||
depot.ops.nixos.systems.bvm-ipfs
|
||||
depot.ops.nixos.systems.howl
|
||||
];
|
||||
|
||||
system.stateVersion = "21.05";
|
||||
|
|
|
|||
Loading…
Reference in a new issue