From 2423f9a473ea1d26755726ce9fcef1d59b487c6b Mon Sep 17 00:00:00 2001 From: Antoine Martin Date: Sat, 23 Sep 2023 13:34:41 +0200 Subject: [PATCH 1/3] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'home-manager': 'github:nix-community/home-manager/5bac4a1c06cd77cf8fc35a658ccb035a6c50cd2c' (2023-08-28) → 'github:nix-community/home-manager/07682fff75d41f18327a871088d20af2710d4744' (2023-09-19) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/ea5234e7073d5f44728c499192544a84244bf35a' (2023-08-28) → 'github:NixOS/nixpkgs/55ac2a9d2024f15c56adf20da505b29659911da8' (2023-09-21) --- flake.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 95eb3e2..8a1b6d2 100644 --- a/flake.lock +++ b/flake.lock @@ -64,11 +64,11 @@ ] }, "locked": { - "lastModified": 1693208669, - "narHash": "sha256-hHFaaUsZ860wvppPeiu7nJn/nXZjJfnqAQEu9SPFE9I=", + "lastModified": 1695108154, + "narHash": "sha256-gSg7UTVtls2yO9lKtP0yb66XBHT1Fx5qZSZbGMpSn2c=", "owner": "nix-community", "repo": "home-manager", - "rev": "5bac4a1c06cd77cf8fc35a658ccb035a6c50cd2c", + "rev": "07682fff75d41f18327a871088d20af2710d4744", "type": "github" }, "original": { @@ -128,11 +128,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1693183237, - "narHash": "sha256-c7OtyBkZ/vZE/WosBpRGRtkbWZjDHGJP7fg1FyB9Dsc=", + "lastModified": 1695272228, + "narHash": "sha256-4uw2OdJPVyjdB+xcDst9SecrNIpxKXJ2usN3M5HVa7o=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "ea5234e7073d5f44728c499192544a84244bf35a", + "rev": "55ac2a9d2024f15c56adf20da505b29659911da8", "type": "github" }, "original": { From e31a34719d6a90442a811407b56378d158bc1e25 Mon Sep 17 00:00:00 2001 From: Antoine Martin Date: Sat, 23 Sep 2023 13:35:35 +0200 Subject: [PATCH 2/3] hosts: add hephaestus --- flake.nix | 14 +++ hephaestus.nix | 23 ++++ hosts/hephaestus/default.nix | 98 ++++++++++++++++++ hosts/hephaestus/hardware-configuration.nix | 41 ++++++++ hosts/hephaestus/home.nix | 39 +++++++ hosts/hephaestus/secrets.nix | 20 ++++ modules/secrets/secrets.nix | 3 +- .../secrets/users/alarsyo-hashed-password.age | Bin 793 -> 926 bytes .../secrets/users/root-hashed-password.age | Bin 821 -> 909 bytes 9 files changed, 237 insertions(+), 1 deletion(-) create mode 100644 hephaestus.nix create mode 100644 hosts/hephaestus/default.nix create mode 100644 hosts/hephaestus/hardware-configuration.nix create mode 100644 hosts/hephaestus/home.nix create mode 100644 hosts/hephaestus/secrets.nix diff --git a/flake.nix b/flake.nix index 3a918c3..c9aada9 100644 --- a/flake.nix +++ b/flake.nix @@ -143,6 +143,20 @@ ] ++ sharedModules; }; + + hephaestus = nixpkgs.lib.nixosSystem rec { + inherit system; + modules = + [ + ./hephaestus.nix + + inputs.nixos-hardware.nixosModules.common-cpu-amd + inputs.nixos-hardware.nixosModules.common-gpu-amd + inputs.nixos-hardware.nixosModules.common-pc-laptop + inputs.nixos-hardware.nixosModules.common-pc-ssd + ] + ++ sharedModules; + }; }; } // inputs.flake-utils.lib.eachDefaultSystem (system: { diff --git a/hephaestus.nix b/hephaestus.nix new file mode 100644 index 0000000..1bb452a --- /dev/null +++ b/hephaestus.nix @@ -0,0 +1,23 @@ +{...}: { + imports = [ + # Default configuration + ./base + + # Module definitions + ./modules + + # Service definitions + ./services + + # Host-specific config + ./hosts/hephaestus + ]; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "23.05"; # Did you read the comment? +} diff --git a/hosts/hephaestus/default.nix b/hosts/hephaestus/default.nix new file mode 100644 index 0000000..8611e1e --- /dev/null +++ b/hosts/hephaestus/default.nix @@ -0,0 +1,98 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). +{ + config, + lib, + pkgs, + ... +}: { + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ./home.nix + ./secrets.nix + ]; + + boot.kernelPackages = pkgs.linuxPackages; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.initrd.secrets = { + "/crypto_keyfile.bin" = null; + }; + + boot.tmp.useTmpfs = true; + + services.btrfs = { + autoScrub = { + enable = true; + fileSystems = ["/"]; + }; + }; + + networking.hostName = "hephaestus"; # Define your hostname. + networking.domain = "alarsyo.net"; + + networking.networkmanager.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Paris"; + + # List services that you want to enable: + my.services = { + tailscale.enable = true; + pipewire.enable = true; + }; + + virtualisation.docker.enable = true; + virtualisation.libvirtd.enable = true; + programs.dconf.enable = true; + + services = { + tlp = { + settings = { + START_CHARGE_THRESH_BAT0 = 70; + STOP_CHARGE_THRESH_BAT0 = 80; + }; + }; + fwupd.enable = true; + openssh.enable = true; + }; + + my.gui.enable = true; + my.displayManager.sddm.enable = lib.mkForce false; + + hardware.bluetooth = { + enable = true; + powerOnBoot = false; + settings.General.Experimental = true; + }; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + + i18n.extraLocaleSettings = { + LC_ADDRESS = "fr_FR.UTF-8"; + LC_IDENTIFICATION = "fr_FR.UTF-8"; + LC_MEASUREMENT = "fr_FR.UTF-8"; + LC_MONETARY = "fr_FR.UTF-8"; + LC_NAME = "fr_FR.UTF-8"; + LC_NUMERIC = "fr_FR.UTF-8"; + LC_PAPER = "fr_FR.UTF-8"; + LC_TELEPHONE = "fr_FR.UTF-8"; + LC_TIME = "fr_FR.UTF-8"; + }; + + # Enable the X11 windowing system. + services.xserver.enable = true; + + # Enable the KDE Plasma Desktop Environment. + services.xserver.displayManager.sddm.enable = true; + services.xserver.desktopManager.plasma5.enable = true; + + # Configure console keymap + console.keyMap = "us"; +} diff --git a/hosts/hephaestus/hardware-configuration.nix b/hosts/hephaestus/hardware-configuration.nix new file mode 100644 index 0000000..4a44055 --- /dev/null +++ b/hosts/hephaestus/hardware-configuration.nix @@ -0,0 +1,41 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/54ded736-367c-4081-9978-9e2d8f61cb1b"; + fsType = "btrfs"; + options = [ "subvol=@" ]; + }; + + boot.initrd.luks.devices."luks-df96458d-45a1-4a30-8633-58feeff603f8".device = "/dev/disk/by-uuid/df96458d-45a1-4a30-8633-58feeff603f8"; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/826A-23F7"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true; + # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/hephaestus/home.nix b/hosts/hephaestus/home.nix new file mode 100644 index 0000000..2b20617 --- /dev/null +++ b/hosts/hephaestus/home.nix @@ -0,0 +1,39 @@ +{ + config, + pkgs, + ... +}: { + home-manager.users.alarsyo = { + my.home.laptop.enable = true; + + # Keyboard settings & i3 settings + my.home.x.enable = true; + my.home.x.i3bar.temperature.chip = "k10temp-pci-*"; + my.home.x.i3bar.temperature.inputs = ["Tccd1"]; + my.home.x.i3bar.networking.throughput_interfaces = ["wlp3s0"]; + my.home.emacs.enable = true; + + my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight; + + home.packages = builtins.attrValues { + inherit + (pkgs) + # some websites only work there :( + + chromium + darktable + # dev + + rustup + gdb + valgrind + arandr + zotero + ; + + inherit (pkgs.packages) spot; + + inherit (pkgs.wineWowPackages) stable; + }; + }; +} diff --git a/hosts/hephaestus/secrets.nix b/hosts/hephaestus/secrets.nix new file mode 100644 index 0000000..3fbc379 --- /dev/null +++ b/hosts/hephaestus/secrets.nix @@ -0,0 +1,20 @@ +{ + config, + lib, + options, + ... +}: { + config.age = { + secrets = let + toSecret = name: {...} @ attrs: + { + file = ./../../modules/secrets + "/${name}.age"; + } + // attrs; + in + lib.mapAttrs toSecret { + "users/alarsyo-hashed-password" = {}; + "users/root-hashed-password" = {}; + }; + }; +} diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix index 112685e..0accd18 100644 --- a/modules/secrets/secrets.nix +++ b/modules/secrets/secrets.nix @@ -4,10 +4,11 @@ let boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal"; hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades"; + hephaestus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7Cp+n5+huof68QlAoJV8bVf5h5p9kEZFAVpltWopdL root@hephaestus"; poseidon = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYhZYMbWQG9TSQ2qze8GgFo2XrZzgu/GuSOGwenByJo root@poseidon"; zephyrus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU4JfIADH9MXUnVe+3ezYK9WXsqy/jJcm1zFkmL4aSU root@zephyrus"; - machines = [boreal hades poseidon zephyrus]; + machines = [boreal hades hephaestus poseidon zephyrus]; all = users ++ machines; in { diff --git a/modules/secrets/users/alarsyo-hashed-password.age b/modules/secrets/users/alarsyo-hashed-password.age index f9a9f83c1edaf2939968fd91df928d4e88cebc77..1e7abbe3906d474d9d11daa02ec9c31a37944d9f 100644 GIT binary patch delta 838 zcmbQqHjjORPJL=hl3AI*SGr@md0}Wtakg=Jeu-g@ONc>wX<<=Dc9_3Op_z%fV~Ku5 zK37Cegn@a1zEM(TsZ&*WYLIbuhNr%hk*TS^iD!9MX1HsnziYa`nOAOAK9{bYLUD11 zZfc5=si~o*LP3N@rBS*bHSZ1)dZ+%v!XJB|*l1ENqc|@*bo{^Dh zMo?&pQE^x(mw#AtrmL%~sYOVzd3v^2m{E4HxoL)vL6vrHRi3`5WwKjjRG?+9Nt$yy zx^=;kx!M_y3dR{e>EZf5;elqEIVFY}ktrUuEFM}=DyhmsX5v1 zCR`?lIhLhWk!AX3MTstc!A|Z)Ngn1Ip+02>$&qf6W~RY883m=mNu@;|#S=e@hr7EP z8<|)b8|NmOrlnarYlrw52Nxz*m6eAZL`7v5IwhH!B^O&Hd1qzhb6Gg%r>9t!_!$-Z zS-1q}dV7VYl{#mpWd`|r7r2-^=b1VC_#{>Z8Wm<`PmX644>u~v@vU$QbxJBT4o-GW ziEzrxE-NX~FU$$hPI1?_(Dt`T_i%E~@Uh78XdDFe@=5yC~T=Oh3ue+ub9} zA|N;_G|J1+02Bl9i4KvK_8y_S=|!oD#io4|Lc3zZ0p?RpjlUr79mRq2CfOC3DdZu%jM{c1{ zPKB$Xd6IK7murrTX}*!8iIJs$qKQ+uTV8p3WLRFVS%8^=xmj39exQDqW09djVs?1` zx;GB!u^t6 zTs=~=3f+o*0`iJ8N`pOvD^tr-OCpVvytDN!ih^?sbF-a%xv~qqyz+xR{EaQWa*QiV z+&wZ)T&gNeOtQ+8ygjs?^j*!JjRM>w^BnU$(Ss@5DBUBgTp>I}KfT;1B|I!NFI+p& zD8IbEyvWDhC(AF5=IJqL#Jj|>r*EBNA&6mqRx!5wyAkr;NJKrcO$E485IVmH} zHK@ovJT%KyJFC3h-%VTJASl?cEFWZDYK*&`fpx5zZhBE_VsWZMjjB<4Uaq16mt~5v zv4L{NrdgnqMZI&0e@0OH(c7!M0-!2g}w>vgMm}&oXU&h{4Wd vd3V%8TkaH2;d&JAosfHr%k+35@1GapPCWWor&oKFU*ns7;)>6&!=}3c%uD|? diff --git a/modules/secrets/users/root-hashed-password.age b/modules/secrets/users/root-hashed-password.age index 0eff2bd9fdc3617698476bd5896a0828f2e51559..b373fa4646a546a93df31bcc1316b51dd34535cc 100644 GIT binary patch delta 839 zcmdnW*2_LYr#{~#veY2hF`^>PsVv9BF~_;GFyBJo-9IhG$Su+$EVU}ssmR&W#iSy_ zfGfi}G1%D5*(tNYH@PggINLcW-`LqBRXfZ-wcIFQ+b1{2HNV8TLf^;4l}p!7p}06h zH#Nn`)YQ;Yp&-Jd(kNXaDxlKM(!@B>BcRkdKiJzMv_8MmKPn_SC8gLs$0yx5s3Ii9 zD9WS4%stD5D>%`@*(}t-6!$S3) zgH7_ie9Ll8eG5_o4FV#aEA#R!Qyio6463w~T}{pNBk~GOe2juZxm>)olglDK6GM!h zbNn2`Eqzl1k|V+$JuTd;N)ol*D=S?+Jwm)vEyElq$1zIOn;BVn__&6n;WKcx#p!98>W~Tdut~KWm!Z7mFfou=BHJK zJ30G$B$xSxx%im`7bNK?6=s72sa7|=C^fM-RUyVVDJDQ6TGiaQFeqO^Lm}NbAeSr1 zH#aG)s=mt6LE46A-NPvNg@P3B&=eB~xRNojVa?u8PMPk6pM_H17Hi|M(hBI|0Zj&3-{E~RsB z$yt`e;%Yj^8P);USc{kIM5=D;UfU!8wa|WoBB=%()~ttGLL*xhNzmyg1Rlz|F%nF(W59)T=BpC?em@Aj!|g zm#f0q*VHg0FTlW~q#)QW+_%yw(LX5EGAFGfD8)Ou#4M}0)Gaco$UVT>fJ@g-p}06h zH#Nn`)YQ;Yp&-Jd(kNY_BHX>Gs-o1f!ac*+N!ukk)GaS9JjKk?IXg2is8XBB z-X`uQRjKKQ#g4|2u4QKB1tv+_sc!CGAtiz6p_FZu?vYilps!sLR%)D?WuBN+>X=#N zpI@I9TAZ6@mJ*m~;%lJqX|C-R5>}F=U67jL%jM)7X6{jG65(rP8Wdg{Tpm%GQJUhR zAM70I8fk2%pOWRDU1aH|yy|ALhN4wD1ytpva%*EZ+-_4h+xZ8i#a*1k!axn2v)xgYU1wQhL$|D0mdjXKlkpFd734V%d8JN4I2o4<#fGh9l~sJCwP Xc_bZmBwJVc%Z4|*4~TD^cziklvy=`y From 30ab470de64ab3a40addc02e6b780a83a75d72b6 Mon Sep 17 00:00:00 2001 From: Antoine Martin Date: Sat, 23 Sep 2023 13:35:44 +0200 Subject: [PATCH 3/3] base: gui: remove unused messaging clients --- base/gui-programs.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/base/gui-programs.nix b/base/gui-programs.nix index 5d7b8f7..da189b8 100644 --- a/base/gui-programs.nix +++ b/base/gui-programs.nix @@ -52,7 +52,6 @@ in { inherit (pkgs) chrysalis - element-desktop evince feh firefox @@ -62,8 +61,6 @@ in { mpv obs-studio pavucontrol - signal-desktop - slack spotify tdesktop teams