# SPDX-FileCopyrightText: 2020 Luke Granger-Brown # # SPDX-License-Identifier: Apache-2.0 { depot, lib, pkgs, rebuilder, config, ... }: let inherit (depot.ops) secrets; nvidia-offload-profile = '' export __NV_PRIME_RENDER_OFFLOAD=1 export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0 export __GLX_VENDOR_LIBRARY_NAME=nvidia export __VK_LAYER_NV_optimus=NVIDIA_only ''; nvidia-offload = pkgs.writeShellScriptBin "nvidia-offload" (nvidia-offload-profile + '' exec -a "$0" "$@" ''); in { imports = [ ../lib/zfs.nix ../lib/graphical-client-x11.nix ../lib/whitby-distributed.nix ../lib/quotes.bfob.gg.nix ./blast.nix ]; boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ]; boot.kernelModules = [ "kvm-intel" ]; boot.supportedFilesystems = [ "ntfs" ]; boot.kernel.sysctl = { "abi.vsyscall32" = "0"; }; my.rundeck.expectedOnline = false; fileSystems = let zfs = device: { device = device; fsType = "zfs"; }; in { "/" = zfs "zpool/local/root"; "/nix" = zfs "zpool/local/nix"; "/tmp" = zfs "zpool/local/tmp"; "/var" = zfs "zpool/safe/var"; "/home" = zfs "zpool/safe/home"; "/persist" = zfs "zpool/safe/persist"; "/boot" = { device = "/dev/disk/by-label/NIXBOOT"; fsType = "vfat"; }; "/data" = { device = "/dev/disk/by-label/BULKDATA"; fsType = "ntfs"; options = [ "rw" "uid=1000" "gid=100" "dmask=022" "fmask=024" "windows_names" ]; }; }; nix.maxJobs = lib.mkDefault 12; powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; hardware.enableRedistributableFirmware = true; # Laptop, don't autodeploy. my.deploy.enable = false; # Use the systemd-boot EFI boot loader. boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; # ZFS! services.zfs.rollbackOnBoot.enable = true; # Enable HyperV guesting virtualisation.hypervGuest.enable = true; # Enable Podman virtualisation.podman = { enable = true; dockerCompat = true; }; # Enable LXD virtualisation.lxd = { enable = false; zfsSupport = true; recommendedSysctlSettings = true; }; systemd.services.lxd.serviceConfig.path = lib.mkAfter (with pkgs; [ iptables ebtables ]); # Enable libvirtd. virtualisation.libvirtd = { enable = true; }; networking.hostName = "porcorosso"; networking.hostId = "1ee729a4"; # Boot faster. systemd.services.systemd-udev-settle.enable = false; systemd.services.NetworkManager-wait-online.enable = false; # The global useDHCP flag is deprecated, therefore explicitly set to false here. # Per-interface useDHCP will be mandatory in the future, so this generated config # replicates the default behaviour. # Use NetworkManager instead. networking.useDHCP = false; networking.interfaces.eno1.useDHCP = false; networking.networkmanager.enable = true; my.ip.tailscale = "100.125.26.108"; # Set your time zone. time.timeZone = "Europe/London"; # List packages installed in system profile. To search, run: # $ nix search wget environment.systemPackages = with pkgs; [ pciutils nvidia-offload rebuilder deluge (writeShellScriptBin "windows" '' set -ue if [[ $EUID -ne 0 ]]; then exec sudo "$0" "$@" fi efibootmgr -n 0001 systemctl reboot '') ]; # Some programs need SUID wrappers, can be configured further or are # started in user sessions. # programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; # List services that you want to enable: # Enable CUPS to print documents. services.printing.enable = true; services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ]; # Enable the X11 windowing system. services.xserver.enable = true; services.xserver.layout = "us"; services.xserver.libinput.enable = true; services.xserver.windowManager.i3.enable = true; services.xserver.videoDrivers = [ "nvidia" ]; specialisation.intelGraphics.configuration = { services.xserver.videoDrivers = lib.mkForce [ "intel" ]; }; services.xserver.displayManager.gdm = { enable = true; wayland = false; nvidiaWayland = false; }; hardware.opengl.driSupport32Bit = true; hardware.opengl.extraPackages = with pkgs; [ intel-media-driver vaapiVdpau libvdpau-va-gl libva ]; hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ]; hardware.acpilight.enable = true; hardware.bluetooth.enable = true; # TODO(lukegb): finish evaluating pipewire hardware.pulseaudio.enable = lib.mkForce false; services.pipewire = { enable = true; alsa.enable = true; alsa.support32Bit = true; jack.enable = true; pulse.enable = true; media-session.enable = true; }; # Define a user account. users.users.lukegb = { extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" ]; }; my.home-manager.system = {...}: { xsession.windowManager.i3.config.startup = lib.mkAfter [ { command = "${pkgs.autorandr}/bin/autorandr -c"; notification = false; } ]; programs.autorandr = { enable = true; profiles.standard = { config = { "DP-0.2" = { enable = true; mode = "3840x2160"; primary = true; position = "0x0"; rate = "60.00"; crtc = 0; }; "DP-0.1" = { enable = true; mode = "3840x2160"; position = "3840x0"; rate = "60.00"; crtc = 1; }; }; fingerprint = { "DP-0.2" = "00ffffffffffff0005e36828e70100001b180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c001010101e5ca0038f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a20202020202020014d020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013"; "DP-0.1" = "00ffffffffffff0005e368283302000016180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c001010101e5ca0038f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a202020202020200105020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013"; }; }; }; home.packages = lib.mkAfter (with pkgs; [ (steam.override { extraProfile = nvidia-offload-profile; }) (writeScriptBin "javaws" '' #!/bin/sh exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@" '') factorio-experimental (depot.nix.pkgs.secretsync.configure { workingDir = "/home/lukegb/depot"; gitlabAccessToken = secrets.deployer.gitlabAccessToken; manifestVariable = "SECRETS_MANIFEST"; variablesToFile = { "OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix"; }; }) efibootmgr iw obs-studio vulkan-tools ]); xdg.configFile."pulse/default.pa".source = ./default.pa; }; # github.com/target/lorri services.lorri.enable = true; # Things to persist. services.openssh.hostKeys = [ { path = "/persist/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; } { path = "/persist/etc/ssh/ssh_host_rsa_key"; type = "rsa"; bits = 4096; } ]; environment.etc = { "NetworkManager/system-connections" = { source = "/persist/etc/NetworkManager/system-connections/"; }; "nixos" = { source = "/persist/etc/nixos/"; }; }; systemd.tmpfiles.rules = [ #"L /etc/nixos - - - - /persist/etc/nixos" "d /var/lib/libvirt 0755 root - - -" ]; systemd.mounts = let bindMount' = dir: { unitConfig.RequiresMountsFor = dir; options = "bind"; what = "/persist${dir}"; where = dir; }; bindMountSvc = dir: svc: (bindMount' dir) // { bindsTo = [svc]; partOf = [svc]; }; bindMount = dir: (bindMount' dir) // { wantedBy = ["multi-user.target"]; }; in [ (bindMountSvc "/var/lib/libvirt" "libvirtd.service") (bindMount "/root") ]; # Enable Thunderbolt device management. services.hardware.bolt.enable = true; services.redis.servers."".enable = true; services.postgresql.enable = true; services.postgresql.ensureUsers = [{ name = "lukegb"; ensurePermissions = { "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES"; "DATABASE lukegb" = "ALL PRIVILEGES"; }; }]; services.postgresql.authentication = '' local all all trust host all all 127.0.0.1/32 trust host all all ::1/128 trust ''; services.avahi.enable = true; nix.buildMachines = [ { hostName = "totoro"; system = "x86_64-linux"; maxJobs = 4; speedFactor = 2; supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; mandatoryFeatures = [ ]; }]; # This value determines the NixOS release with which your system is to be # compatible, in order to avoid breaking some software such as database # servers. You should change this only after NixOS release notes say you # should. system.stateVersion = "20.03"; # Did you read the comment? }