338 lines
9.8 KiB
Nix
338 lines
9.8 KiB
Nix
# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
{ depot, lib, pkgs, rebuilder, config, ... }:
|
|
let
|
|
inherit (depot.ops) secrets;
|
|
nvidia-offload-profile = ''
|
|
export __NV_PRIME_RENDER_OFFLOAD=1
|
|
export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
|
|
export __GLX_VENDOR_LIBRARY_NAME=nvidia
|
|
export __VK_LAYER_NV_optimus=NVIDIA_only
|
|
'';
|
|
nvidia-offload = pkgs.writeShellScriptBin "nvidia-offload"
|
|
(nvidia-offload-profile + ''
|
|
exec -a "$0" "$@"
|
|
'');
|
|
in {
|
|
imports = [
|
|
../lib/zfs.nix
|
|
../lib/graphical-client-x11.nix
|
|
../lib/whitby-distributed.nix
|
|
|
|
../lib/quotes.bfob.gg.nix
|
|
|
|
./blast.nix
|
|
];
|
|
|
|
boot.initrd.availableKernelModules = [
|
|
"xhci_pci"
|
|
"ahci"
|
|
"nvme"
|
|
"usbhid"
|
|
"usb_storage"
|
|
"sd_mod"
|
|
"rtsx_pci_sdmmc"
|
|
];
|
|
boot.kernelModules = [ "kvm-intel" ];
|
|
boot.supportedFilesystems = [ "ntfs" ];
|
|
boot.kernel.sysctl = {
|
|
"abi.vsyscall32" = "0";
|
|
};
|
|
|
|
my.rundeck.expectedOnline = false;
|
|
|
|
fileSystems = let
|
|
zfs = device: {
|
|
device = device;
|
|
fsType = "zfs";
|
|
};
|
|
in {
|
|
"/" = zfs "zpool/local/root";
|
|
"/nix" = zfs "zpool/local/nix";
|
|
"/tmp" = zfs "zpool/local/tmp";
|
|
|
|
"/var" = zfs "zpool/safe/var";
|
|
"/home" = zfs "zpool/safe/home";
|
|
"/persist" = zfs "zpool/safe/persist";
|
|
|
|
"/boot" = {
|
|
device = "/dev/disk/by-label/NIXBOOT";
|
|
fsType = "vfat";
|
|
};
|
|
"/data" = {
|
|
device = "/dev/disk/by-label/BULKDATA";
|
|
fsType = "ntfs";
|
|
options = [ "rw" "uid=1000" "gid=100" "dmask=022" "fmask=024" "windows_names" ];
|
|
};
|
|
};
|
|
|
|
nix.maxJobs = lib.mkDefault 12;
|
|
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# Laptop, don't autodeploy.
|
|
my.deploy.enable = false;
|
|
|
|
# Use the systemd-boot EFI boot loader.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# ZFS!
|
|
services.zfs.rollbackOnBoot.enable = true;
|
|
|
|
# Enable HyperV guesting
|
|
virtualisation.hypervGuest.enable = true;
|
|
|
|
# Enable Podman
|
|
virtualisation.podman = {
|
|
enable = true;
|
|
dockerCompat = true;
|
|
};
|
|
|
|
# Enable LXD
|
|
virtualisation.lxd = {
|
|
enable = false;
|
|
zfsSupport = true;
|
|
recommendedSysctlSettings = true;
|
|
};
|
|
systemd.services.lxd.serviceConfig.path = lib.mkAfter (with pkgs; [
|
|
iptables
|
|
ebtables
|
|
]);
|
|
|
|
# Enable libvirtd.
|
|
virtualisation.libvirtd = {
|
|
enable = true;
|
|
};
|
|
|
|
networking.hostName = "porcorosso";
|
|
networking.hostId = "1ee729a4";
|
|
|
|
# Boot faster.
|
|
systemd.services.systemd-udev-settle.enable = false;
|
|
systemd.services.NetworkManager-wait-online.enable = false;
|
|
|
|
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
|
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
|
# replicates the default behaviour.
|
|
# Use NetworkManager instead.
|
|
networking.useDHCP = false;
|
|
networking.interfaces.eno1.useDHCP = false;
|
|
networking.networkmanager.enable = true;
|
|
my.ip.tailscale = "100.125.26.108";
|
|
|
|
# Set your time zone.
|
|
time.timeZone = "Europe/London";
|
|
|
|
# List packages installed in system profile. To search, run:
|
|
# $ nix search wget
|
|
environment.systemPackages = with pkgs; [
|
|
pciutils
|
|
nvidia-offload
|
|
rebuilder
|
|
deluge
|
|
(writeShellScriptBin "windows" ''
|
|
set -ue
|
|
if [[ $EUID -ne 0 ]]; then
|
|
exec sudo "$0" "$@"
|
|
fi
|
|
|
|
efibootmgr -n 0001
|
|
systemctl reboot
|
|
'')
|
|
];
|
|
|
|
# Some programs need SUID wrappers, can be configured further or are
|
|
# started in user sessions.
|
|
# programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
|
|
|
|
# List services that you want to enable:
|
|
|
|
# Enable CUPS to print documents.
|
|
services.printing.enable = true;
|
|
services.printing.drivers = with depot.pkgs; [ intermec-cups-driver ];
|
|
|
|
# Enable the X11 windowing system.
|
|
services.xserver.enable = true;
|
|
services.xserver.layout = "us";
|
|
services.xserver.libinput.enable = true;
|
|
services.xserver.windowManager.i3.enable = true;
|
|
services.xserver.videoDrivers = [ "nvidia" ];
|
|
specialisation.intelGraphics.configuration = {
|
|
my.specialisationName = "intelGraphics";
|
|
services.xserver.videoDrivers = lib.mkForce [ "intel" ];
|
|
};
|
|
services.xserver.displayManager.gdm = {
|
|
enable = true;
|
|
wayland = false;
|
|
nvidiaWayland = false;
|
|
};
|
|
|
|
hardware.opengl.driSupport32Bit = true;
|
|
hardware.opengl.extraPackages = with pkgs; [
|
|
intel-media-driver vaapiVdpau libvdpau-va-gl libva
|
|
];
|
|
hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
|
|
hardware.acpilight.enable = true;
|
|
hardware.bluetooth.enable = true;
|
|
|
|
# TODO(lukegb): finish evaluating pipewire
|
|
hardware.pulseaudio.enable = lib.mkForce false;
|
|
services.pipewire = {
|
|
enable = true;
|
|
alsa.enable = true;
|
|
alsa.support32Bit = true;
|
|
jack.enable = true;
|
|
pulse.enable = true;
|
|
|
|
media-session.enable = true;
|
|
};
|
|
|
|
# Define a user account.
|
|
users.users.lukegb = {
|
|
extraGroups = [ "wheel" "networkmanager" "libvirtd" "lxd" "video" ];
|
|
};
|
|
my.home-manager.system = {...}: {
|
|
xsession.windowManager.i3.config.startup = lib.mkAfter [
|
|
{ command = "${pkgs.autorandr}/bin/autorandr -c"; notification = false; }
|
|
];
|
|
programs.autorandr = {
|
|
enable = true;
|
|
profiles.standard = {
|
|
config = {
|
|
"DP-0.2" = {
|
|
enable = true;
|
|
mode = "3840x2160";
|
|
primary = true;
|
|
position = "0x0";
|
|
rate = "60.00";
|
|
crtc = 0;
|
|
};
|
|
"DP-0.1" = {
|
|
enable = true;
|
|
mode = "3840x2160";
|
|
position = "3840x0";
|
|
rate = "60.00";
|
|
crtc = 1;
|
|
};
|
|
};
|
|
fingerprint = {
|
|
"DP-0.2" = "00ffffffffffff0005e36828e70100001b180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c001010101e5ca0038f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a20202020202020014d020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013";
|
|
"DP-0.1" = "00ffffffffffff0005e368283302000016180104a53e22783aeed1a555489b26125054bfef00d1c0b30095008180814081c001010101e5ca0038f0703e8018108a006d552100001a04740030f2705a80b0588a006d552100001a000000fd0017501ea03c010a202020202020000000fc0055323836380a202020202020200105020326f14b0103051404131f1202119023090707830100006d030c00100000782000600102038c0ad08a20e02d10103e96006d5521000018011d007251d01e206e2855006d552100001e8c0ad08a20e02d10103e96006d55210000188c0ad090204031200c4055006d5521000018000000000000000000000000000000000013";
|
|
};
|
|
};
|
|
};
|
|
|
|
home.packages = lib.mkAfter (with pkgs; [
|
|
(steam.override { extraProfile = nvidia-offload-profile; })
|
|
(writeScriptBin "javaws" ''
|
|
#!/bin/sh
|
|
exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
|
|
'')
|
|
factorio-experimental
|
|
(depot.nix.pkgs.secretsync.configure {
|
|
workingDir = "/home/lukegb/depot";
|
|
gitlabAccessToken = secrets.deployer.gitlabAccessToken;
|
|
manifestVariable = "SECRETS_MANIFEST";
|
|
variablesToFile = {
|
|
"OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix";
|
|
};
|
|
})
|
|
efibootmgr
|
|
iw
|
|
obs-studio
|
|
vulkan-tools
|
|
]);
|
|
|
|
xdg.configFile."pulse/default.pa".source = ./default.pa;
|
|
};
|
|
|
|
# github.com/target/lorri
|
|
services.lorri.enable = true;
|
|
|
|
# Things to persist.
|
|
services.openssh.hostKeys = [
|
|
{
|
|
path = "/persist/etc/ssh/ssh_host_ed25519_key";
|
|
type = "ed25519";
|
|
}
|
|
{
|
|
path = "/persist/etc/ssh/ssh_host_rsa_key";
|
|
type = "rsa";
|
|
bits = 4096;
|
|
}
|
|
];
|
|
environment.etc = {
|
|
"NetworkManager/system-connections" = {
|
|
source = "/persist/etc/NetworkManager/system-connections/";
|
|
};
|
|
"nixos" = { source = "/persist/etc/nixos/"; };
|
|
};
|
|
systemd.tmpfiles.rules = [
|
|
#"L /etc/nixos - - - - /persist/etc/nixos"
|
|
"d /var/lib/libvirt 0755 root - - -"
|
|
];
|
|
systemd.mounts = let
|
|
bindMount' = dir: {
|
|
unitConfig.RequiresMountsFor = dir;
|
|
options = "bind";
|
|
what = "/persist${dir}";
|
|
where = dir;
|
|
};
|
|
bindMountSvc = dir: svc: (bindMount' dir) // {
|
|
bindsTo = [svc];
|
|
partOf = [svc];
|
|
};
|
|
bindMount = dir: (bindMount' dir) // {
|
|
wantedBy = ["multi-user.target"];
|
|
};
|
|
in [
|
|
(bindMountSvc "/var/lib/libvirt" "libvirtd.service")
|
|
(bindMount "/root")
|
|
];
|
|
|
|
# Enable Thunderbolt device management.
|
|
services.hardware.bolt.enable = true;
|
|
|
|
services.redis.servers."".enable = true;
|
|
services.postgresql.enable = true;
|
|
services.postgresql.ensureUsers = [{
|
|
name = "lukegb";
|
|
ensurePermissions = {
|
|
"ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
|
|
"DATABASE lukegb" = "ALL PRIVILEGES";
|
|
};
|
|
}];
|
|
services.postgresql.authentication = ''
|
|
local all all trust
|
|
host all all 127.0.0.1/32 trust
|
|
host all all ::1/128 trust
|
|
'';
|
|
|
|
nix.buildMachines = [ {
|
|
hostName = "totoro";
|
|
system = "x86_64-linux";
|
|
maxJobs = 4;
|
|
speedFactor = 2;
|
|
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
|
mandatoryFeatures = [ ];
|
|
}];
|
|
|
|
services.tlp = {
|
|
enable = true;
|
|
settings = {
|
|
DISK_DEVICES = "nvme0n1 nvme1n1 nvme2n1";
|
|
DISK_IOSCHED = "mq-deadline mq-deadline mq-deadline";
|
|
};
|
|
};
|
|
|
|
my.scrapeJournal.enable = false; # Laptop, don't pull too much.
|
|
|
|
# This value determines the NixOS release with which your system is to be
|
|
# compatible, in order to avoid breaking some software such as database
|
|
# servers. You should change this only after NixOS release notes say you
|
|
# should.
|
|
system.stateVersion = "20.03"; # Did you read the comment?
|
|
}
|