feat: add matej-tower host
This commit is contained in:
292
hosts/matej-tower/configuration.nix
Normal file
292
hosts/matej-tower/configuration.nix
Normal file
@@ -0,0 +1,292 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
options,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
|
||||
in
|
||||
|
||||
{
|
||||
imports = [
|
||||
inputs.stylix.nixosModules.stylix
|
||||
inputs.lanzaboote.nixosModules.lanzaboote
|
||||
inputs.self.nixosModules.yubikey
|
||||
inputs.self.nixosModules.sway
|
||||
];
|
||||
|
||||
sway.enable = true;
|
||||
yubikey.enable = true;
|
||||
|
||||
fonts.packages = with pkgs; [
|
||||
font-awesome
|
||||
nerd-fonts.jetbrains-mono
|
||||
maple-mono.NF
|
||||
];
|
||||
|
||||
stylix = {
|
||||
enable = true;
|
||||
polarity = "dark";
|
||||
image = "${inputs.self}/assets/wallpaper.png";
|
||||
base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
|
||||
};
|
||||
|
||||
virtualisation.docker = {
|
||||
enable = true;
|
||||
logDriver = "json-file";
|
||||
};
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
boot.lanzaboote = {
|
||||
enable = true;
|
||||
pkiBundle = "/var/lib/sbctl";
|
||||
};
|
||||
|
||||
services.udev.packages = with pkgs; [
|
||||
yubikey-personalization
|
||||
];
|
||||
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
useRoutingFeatures = "both";
|
||||
};
|
||||
|
||||
services.udisks2.enable = true;
|
||||
security.polkit.enable = true;
|
||||
|
||||
hardware.bluetooth.enable = true;
|
||||
services.blueman.enable = true;
|
||||
|
||||
users.defaultUserShell = pkgs.zsh;
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
};
|
||||
environment.etc."zshenv".text = ''
|
||||
export ZDOTDIR=$HOME/.config/zsh
|
||||
'';
|
||||
|
||||
programs._1password.enable = true;
|
||||
programs._1password-gui.enable = true;
|
||||
|
||||
users.users.matej = {
|
||||
uid = 1000;
|
||||
isNormalUser = true;
|
||||
home = "/home/matej";
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
|
||||
];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [ 22 ];
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = null;
|
||||
PermitRootLogin = "no";
|
||||
StreamLocalBindUnlink = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
services.greetd = {
|
||||
enable = true;
|
||||
useTextGreeter = true;
|
||||
settings = {
|
||||
default_session = {
|
||||
user = "greeter";
|
||||
command = ''
|
||||
${pkgs.tuigreet}/bin/tuigreet \
|
||||
--time \
|
||||
--remember \
|
||||
--cmd "sway"
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "matej-tower"; # Define your hostname.
|
||||
# Pick only one of the below networking options.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
# networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Set your time zone.
|
||||
# time.timeZone = "Europe/Amsterdam";
|
||||
time.timeZone = "Europe/Ljubljana";
|
||||
environment.variables.TZ = "Europe/Ljubljana";
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
# Select internationalisation properties.
|
||||
# i18n.defaultLocale = "en_US.UTF-8";
|
||||
# console = {
|
||||
# font = "Lat2-Terminus16";
|
||||
# keyMap = "us";
|
||||
# useXkbConfig = true; # use xkb.options in tty.
|
||||
# };
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
# services.xserver.enable = true;
|
||||
|
||||
# Configure keymap in X11
|
||||
# services.xserver.xkb.layout = "us";
|
||||
# services.xserver.xkb.options = "eurosign:e,caps:escape";
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
# services.printing.enable = true;
|
||||
|
||||
# Enable sound.
|
||||
# services.pulseaudio.enable = true;
|
||||
# OR
|
||||
# services.pipewire = {
|
||||
# enable = true;
|
||||
# pulse.enable = true;
|
||||
# };
|
||||
|
||||
# Enable touchpad support (enabled default in most desktopManager).
|
||||
# services.libinput.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
# users.users.alice = {
|
||||
# isNormalUser = true;
|
||||
# extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
# packages = with pkgs; [
|
||||
# tree
|
||||
# ];
|
||||
# };
|
||||
|
||||
# programs.firefox.enable = true;
|
||||
|
||||
services.printing.enable = true;
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns4 = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
# alsa.enable = true;
|
||||
# alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
# jack.enable = true;
|
||||
extraConfig.pipewire.adjust-sample-rate = {
|
||||
"context.properties" = {
|
||||
"default.clock.rate" = 192000;
|
||||
#"defautlt.allowed-rates" = [ 192000 48000 44100 ];
|
||||
"defautlt.allowed-rates" = [ 192000 ];
|
||||
# "default.clock.quantum" = 32;
|
||||
# "default.clock.min-quantum" = 32;
|
||||
# "default.clock.max-quantum" = 32;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.dbus.enable = true;
|
||||
|
||||
services.playerctld.enable = true;
|
||||
|
||||
xdg = {
|
||||
portal = {
|
||||
xdgOpenUsePortal = true;
|
||||
enable = true;
|
||||
extraPortals = [
|
||||
pkgs.xdg-desktop-portal-wlr
|
||||
pkgs.xdg-desktop-portal-gtk
|
||||
];
|
||||
};
|
||||
mime.defaultApplications = {
|
||||
"application/pdf" = "org.pwmt.zathura.desktop";
|
||||
};
|
||||
};
|
||||
|
||||
# List packages installed in system profile.
|
||||
# You can use https://search.nixos.org/ to find more packages (and options).
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
wget
|
||||
ghostty
|
||||
vesktop
|
||||
rocketchat-desktop
|
||||
telegram-desktop
|
||||
slack
|
||||
mdbook
|
||||
google-chrome
|
||||
pavucontrol
|
||||
protonmail-bridge
|
||||
python3
|
||||
zathura
|
||||
smartmontools
|
||||
marksman
|
||||
mdformat
|
||||
jellyfin-media-player
|
||||
cider-2
|
||||
bolt-launcher
|
||||
easyeffects
|
||||
];
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableExtraSocket = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||||
#
|
||||
# Most users should NEVER change this value after the initial install, for any reason,
|
||||
# even if you've upgraded your system to a new NixOS release.
|
||||
#
|
||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||||
# to actually do that.
|
||||
#
|
||||
# This value being lower than the current NixOS release does NOT mean your system is
|
||||
# out of date, out of support, or vulnerable.
|
||||
#
|
||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||||
# and migrated your data accordingly.
|
||||
#
|
||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||||
system.stateVersion = "25.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
84
hosts/matej-tower/hardware-configuration.nix
Normal file
84
hosts/matej-tower/hardware-configuration.nix
Normal file
@@ -0,0 +1,84 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
hardware.firmware = [ pkgs.linux-firmware ];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [
|
||||
"dm-snapshot"
|
||||
"r8169"
|
||||
];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
boot.initrd.luks.devices."cryptlvm".device =
|
||||
"/dev/disk/by-uuid/0b4778fc-647c-409a-ac53-dd12433a759c";
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/8103b1f4-2965-4ec2-95b2-6e71ffa82c29";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/8493-4127";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-uuid/e0952ef2-1a9a-4022-bbcf-b2f016384258"; }
|
||||
];
|
||||
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 22;
|
||||
hostKeys = [
|
||||
"/etc/secrets/initrd/ssh_host_rsa_key"
|
||||
"/etc/secrets/initrd/ssh_host_ed25519_key"
|
||||
];
|
||||
authorizedKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
|
||||
];
|
||||
};
|
||||
postCommands = ''
|
||||
echo 'cryptsetup-askpass' >> /root/.profile
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp11s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
Reference in New Issue
Block a user