From c31da4140c6d9f0cd8a54b17ece38b5ea7197139 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Thu, 29 Apr 2021 12:16:49 +0000 Subject: [PATCH] ops/nixos/howl: init --- ops/nixos/default.nix | 1 + ops/nixos/howl/default.nix | 211 ++++++++++++++++++++++++++++++++ ops/nixos/installcd/default.nix | 4 +- 3 files changed, 213 insertions(+), 3 deletions(-) create mode 100644 ops/nixos/howl/default.nix diff --git a/ops/nixos/default.nix b/ops/nixos/default.nix index de8268f7e4..617d2e6afd 100644 --- a/ops/nixos/default.nix +++ b/ops/nixos/default.nix @@ -17,6 +17,7 @@ let }); systems = [ "porcorosso" + "howl" "marukuru" "clouvider-fra01" "totoro" diff --git a/ops/nixos/howl/default.nix b/ops/nixos/howl/default.nix new file mode 100644 index 0000000000..9d286a5b3b --- /dev/null +++ b/ops/nixos/howl/default.nix @@ -0,0 +1,211 @@ +# SPDX-FileCopyrightText: 2020 Luke Granger-Brown +# +# SPDX-License-Identifier: Apache-2.0 + +{ depot, lib, pkgs, rebuilder, config, ... }: +let + inherit (depot.ops) secrets; +in { + imports = [ + ../lib/zfs.nix + ../lib/graphical-client.nix + ../lib/whitby-distributed.nix + ]; + + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ahci" + "nvme" + "usbhid" + "usb_storage" + "sd_mod" + "rtsx_pci_sdmmc" + ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.supportedFilesystems = [ "ntfs" ]; + boot.kernel.sysctl = { + "abi.vsyscall32" = "0"; + }; + + my.rundeck.expectedOnline = false; + + fileSystems = let + zfs = device: { + device = device; + fsType = "zfs"; + }; + in { + "/" = zfs "zpool/local/root"; + "/nix" = zfs "zpool/local/nix"; + "/tmp" = zfs "zpool/local/tmp"; + + "/var" = zfs "zpool/safe/var"; + "/home" = zfs "zpool/safe/home"; + "/persist" = zfs "zpool/safe/persist"; + + "/boot" = { + device = "/dev/disk/by-label/NIXBOOT"; + fsType = "vfat"; + }; + }; + + nix.maxJobs = lib.mkDefault 12; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; + hardware.enableRedistributableFirmware = true; + + # Laptop, don't autodeploy. + my.deploy.enable = false; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + # ZFS! + services.zfs.rollbackOnBoot.enable = true; + + # Enable libvirtd. + virtualisation.libvirtd = { + enable = true; + }; + + networking.hostName = "howl"; + networking.hostId = "cdd51451"; + + # Boot faster. + systemd.services.systemd-udev-settle.enable = false; + systemd.services.NetworkManager-wait-online.enable = false; + + # The global useDHCP flag is deprecated, therefore explicitly set to false here. + # Per-interface useDHCP will be mandatory in the future, so this generated config + # replicates the default behaviour. + # Use NetworkManager instead. + networking.useDHCP = false; + networking.interfaces.eno1.useDHCP = false; + networking.networkmanager.enable = true; + #my.ip.tailscale = "100.125.26.108"; + + # Set your time zone. + time.timeZone = "Europe/London"; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + pciutils + deluge + ]; + + # Enable the X11 windowing system. + services.xserver.enable = true; + services.xserver.layout = "us"; + services.xserver.libinput.enable = true; + services.xserver.windowManager.i3.enable = true; + services.xserver.videoDrivers = [ "intel" ]; + services.xserver.displayManager.gdm = { + enable = true; + }; + + hardware.opengl.driSupport32Bit = true; + hardware.opengl.extraPackages = with pkgs; [ + intel-media-driver vaapiVdpau libvdpau-va-gl libva + ]; + hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ]; + hardware.acpilight.enable = true; + + # TODO(lukegb): finish evaluating pipewire + hardware.pulseaudio.enable = lib.mkForce false; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + jack.enable = true; + pulse.enable = true; + + media-session.enable = true; + }; + + # Define a user account. + users.users.lukegb = { + extraGroups = [ "wheel" "networkmanager" "libvirtd" "video" ]; + }; + my.home-manager.system = {...}: { + home.packages = lib.mkAfter (with pkgs; [ + steam + (writeScriptBin "javaws" '' + #!/bin/sh + exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@" + '') + factorio-experimental + (depot.nix.pkgs.secretsync.configure { + workingDir = "/home/lukegb/depot"; + gitlabAccessToken = secrets.deployer.gitlabAccessToken; + manifestVariable = "SECRETS_MANIFEST"; + variablesToFile = { + "OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix"; + }; + }) + efibootmgr + iw + obs-studio + vulkan-tools + ]); + }; + + # Things to persist. + services.openssh.hostKeys = [ + { + path = "/persist/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + } + { + path = "/persist/etc/ssh/ssh_host_rsa_key"; + type = "rsa"; + bits = 4096; + } + ]; + environment.etc = { + "NetworkManager/system-connections" = { + source = "/persist/etc/NetworkManager/system-connections/"; + }; + }; + systemd.tmpfiles.rules = [ + "d /var/lib/libvirt 0755 root - - -" + ]; + systemd.mounts = let + bindMount' = dir: { + unitConfig.RequiresMountsFor = dir; + options = "bind"; + what = "/persist${dir}"; + where = dir; + }; + bindMountSvc = dir: svc: (bindMount' dir) // { + bindsTo = [svc]; + partOf = [svc]; + }; + bindMount = dir: (bindMount' dir) // { + wantedBy = ["multi-user.target"]; + }; + in [ + (bindMountSvc "/var/lib/libvirt" "libvirtd.service") + (bindMount "/root") + ]; + + # Enable Thunderbolt device management. + services.hardware.bolt.enable = true; + + services.avahi.enable = true; + + nix.buildMachines = [ { + hostName = "totoro"; + system = "x86_64-linux"; + maxJobs = 4; + speedFactor = 2; + supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; + mandatoryFeatures = [ ]; + }]; + + # This value determines the NixOS release with which your system is to be + # compatible, in order to avoid breaking some software such as database + # servers. You should change this only after NixOS release notes say you + # should. + system.stateVersion = "21.05"; # Did you read the comment? +} diff --git a/ops/nixos/installcd/default.nix b/ops/nixos/installcd/default.nix index 77d12d596d..76eefbccba 100644 --- a/ops/nixos/installcd/default.nix +++ b/ops/nixos/installcd/default.nix @@ -13,9 +13,7 @@ in { isoImage.isoName = lib.mkForce "nixos-${depot.version}-${pkgs.stdenv.hostPlatform.system}.iso"; isoImage.storeContents = [ - depot.ops.nixos.systems.bvm-twitterchiver - depot.ops.nixos.systems.bvm-prosody - depot.ops.nixos.systems.bvm-ipfs + depot.ops.nixos.systems.howl ]; system.stateVersion = "21.05";