diff options
| -rw-r--r-- | flake.nix | 26 | ||||
| -rw-r--r-- | hosts/thinklappi-bootstrap/basesystem.nix | 111 | ||||
| -rw-r--r-- | hosts/thinklappi-bootstrap/default.nix | 46 |
3 files changed, 175 insertions, 8 deletions
diff --git a/flake.nix b/flake.nix index 0c27b6a..ad175f6 100644 --- a/flake.nix +++ b/flake.nix @@ -157,14 +157,24 @@ } ]; in { - nixosConfigurations.thinklappi = nixpkgs.lib.nixosSystem { - inherit system; - specialArgs = attrs; - modules = - [ - ./hosts/thinklappi - ] - ++ defaultModules; + nixosConfigurations = { + thinklappi = nixpkgs.lib.nixosSystem { + inherit system; + specialArgs = attrs; + modules = + [ + ./hosts/thinklappi + ] + ++ defaultModules; + }; + thinklappi-bootstrap = nixpkgs.lib.nixosSystem { + inherit system; + specialArgs = attrs; + modules = [ + ./hosts/thinklappi-bootstrap + lanzaboote.nixosModules.lanzaboote + ]; + }; }; devShells."${system}" = { default = pkgs.mkShell { diff --git a/hosts/thinklappi-bootstrap/basesystem.nix b/hosts/thinklappi-bootstrap/basesystem.nix new file mode 100644 index 0000000..214f318 --- /dev/null +++ b/hosts/thinklappi-bootstrap/basesystem.nix @@ -0,0 +1,111 @@ +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot = { + initrd = { + #systemd.enable = true; + availableKernelModules = ["xhci_pci" "nvme" "rtsx_pci_sdmmc"]; + kernelModules = []; + luks.devices."cryptroot".device = "/dev/disk/by-uuid/6700d662-29a9-4ea5-8ca6-85d42550b3ab"; + }; + loader.efi.canTouchEfiVariables = true; + loader.systemd-boot = { + enable = true; + configurationLimit = 3; + }; + kernelModules = ["kvm-intel"]; + extraModulePackages = []; + kernelPackages = pkgs.linuxPackages_latest; + #lanzaboote = { + # enable = true; + # configurationLimit = 3; + # pkiBundle = "/etc/secureboot"; + #}; + #resumeDevice = "/dev/disk/by-uuid/68da1329-f5ea-4f2c-a38e-faffaaaa6b5a"; + kernelParams = ["resume_offset=369403136"]; + }; + + fileSystems = { + "/" = { + device = "tmpfs"; + fsType = "tmpfs"; + options = ["defaults" "size=2G" "mode=755"]; + }; + "/tmp" = { + device = "tmpfs"; + fsType = "tmpfs"; + options = ["defaults" "size=5G" "mode=755"]; + }; + "/nix" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=nix" "compress-force=zstd"]; + }; + "/etc/NetworkManager" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=networkmanagerconfig" "compress-force=zstd"]; + }; + "/etc/secureboot" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=secureboot" "compress-force=zstd"]; + }; + "/etc/nixos" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=nixconfig" "compress-force=zstd"]; + }; + "/srv" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=srv" "compress-force=zstd"]; + neededForBoot = true; + }; + "/swap" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=swap" "noatime"]; + }; + "/home" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=home" "compress-force=zstd"]; + }; + "/srv/snapshots" = { + device = "/dev/disk/by-label/nixos-root"; + fsType = "btrfs"; + options = ["subvol=snapshots" "compress-force=zstd"]; + }; + "/boot" = { + device = "/dev/disk/by-uuid/4064-2D6C"; + fsType = "vfat"; + }; + }; + + swapDevices = [ + { + device = "/swap/swapfile"; + } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true; + # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/thinklappi-bootstrap/default.nix b/hosts/thinklappi-bootstrap/default.nix new file mode 100644 index 0000000..10ed8ef --- /dev/null +++ b/hosts/thinklappi-bootstrap/default.nix @@ -0,0 +1,46 @@ +{ + config, + pkgs, + ... +}: { + imports = [ + ./basesystem.nix + ../../sys/users + ]; + + hardware = { + opengl.enable = true; + bluetooth.enable = true; + pulseaudio.enable = false; + }; + + virtualisation.waydroid.enable = true; # Android emulation + + security = { + rtkit.enable = true; + pam.services.swaylock = {}; + }; + + environment.systemPackages = [ + pkgs.xorg.xkbcomp + pkgs.neovim + pkgs.git + ]; + + i18n.defaultLocale = "en_US.UTF-8"; + + networking = { + hostName = "thinklappi"; + #nameservers = ["2620:fe::fe" "2620:fe::9" "9.9.9.9" "149.112.112.112"]; + networkmanager = { + enable = true; + #dns = "none"; + }; + }; + + time.timeZone = "Europe/Berlin"; + + programs.ssh.startAgent = true; + + system.stateVersion = "23.05"; +} |