feat: make nixos-laptop empheral
This commit is contained in:
parent
0603a18d9e
commit
f43b993869
12 changed files with 355 additions and 182 deletions
|
|
@ -3,37 +3,35 @@
|
|||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
{ pkgs
|
||||
, inputs
|
||||
, lib
|
||||
, ...
|
||||
}: {
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./disko.nix
|
||||
./impermanence.nix
|
||||
];
|
||||
|
||||
my = {
|
||||
virtualisation.libvirtd.enable = true;
|
||||
yubikey.luksSupport.enable = false;
|
||||
profiles = {
|
||||
desktop.enable = true;
|
||||
personal.enable = true;
|
||||
webis.enable = true;
|
||||
# webis.enable = true;
|
||||
};
|
||||
shell.aliases.zfs-diff = "sudo zfs diff zroot/encrypted/root@blank | parallel --pipe cut -f2 | parallel 'test -e /persist/{} || echo {}' | ${lib.getExe pkgs.tree} --fromfile .";
|
||||
};
|
||||
|
||||
home-manager.users.moritz.home.packages = with pkgs; [
|
||||
jetbrains.idea-ultimate
|
||||
# jetbrains.idea-ultimate
|
||||
];
|
||||
|
||||
# BOOT
|
||||
boot = {
|
||||
supportedFilesystems = [ "btrfs" ];
|
||||
loader = {
|
||||
grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
efiSupport = true;
|
||||
};
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
supportedFilesystems = [ "zfs" ];
|
||||
loader.systemd-boot.enable = true;
|
||||
};
|
||||
|
||||
# SERVICES
|
||||
|
|
|
|||
94
hosts/nixos-laptop/disko.nix
Normal file
94
hosts/nixos-laptop/disko.nix
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
{ lib, ... }:
|
||||
|
||||
{
|
||||
# needed for zfs pool
|
||||
networking.hostId = "9c85d185";
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
type = "disk";
|
||||
device = "/dev/nvme0n1";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "64M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "zroot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
zpool = {
|
||||
zroot = {
|
||||
type = "zpool";
|
||||
rootFsOptions = {
|
||||
compression = "zstd";
|
||||
"com.sun:auto-snapshot" = "false";
|
||||
};
|
||||
mountpoint = null;
|
||||
|
||||
datasets = {
|
||||
encrypted = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
encryption = "aes-256-gcm";
|
||||
keyformat = "passphrase";
|
||||
};
|
||||
# use this to read the key during boot
|
||||
postCreateHook = ''
|
||||
zfs set keylocation="prompt" "zroot/$name";
|
||||
'';
|
||||
};
|
||||
"encrypted/root" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/";
|
||||
postCreateHook = "zfs snapshot zroot/encrypted/root@blank";
|
||||
};
|
||||
"encrypted/nix" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
"encrypted/persist" = {
|
||||
type = "zfs_fs";
|
||||
options.mountpoint = "legacy";
|
||||
mountpoint = "/persist";
|
||||
options."com.sun:auto-snapshot" = "true";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
# rollback to blank
|
||||
boot.initrd.postDeviceCommands = lib.mkAfter ''
|
||||
zfs rollback -r zroot/encrypted/root@blank
|
||||
'';
|
||||
fileSystems."/persist".neededForBoot = true;
|
||||
# HACK: to fix issue of agenix running before impermanence
|
||||
age.identityPaths = [
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/persist/etc/ssh/ssh_host_ed25519_key"
|
||||
"/persist/etc/ssh/ssh_host_rsa_key"
|
||||
];
|
||||
services.zfs = {
|
||||
autoScrub.enable = true;
|
||||
trim.enable = true;
|
||||
autoSnapshot.enable = true;
|
||||
};
|
||||
}
|
||||
|
|
@ -10,45 +10,4 @@
|
|||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/4a91d3eb-1633-42d9-8304-c10e49a61154";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=root" "compress=zstd" ];
|
||||
};
|
||||
|
||||
boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/078b81ba-238e-471d-9951-b743588532b8";
|
||||
|
||||
fileSystems."/log" = {
|
||||
device = "/dev/disk/by-uuid/4a91d3eb-1633-42d9-8304-c10e49a61154";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=log" "compress=zstd" ];
|
||||
neededForBoot = true;
|
||||
};
|
||||
|
||||
fileSystems."/nix" = {
|
||||
device = "/dev/disk/by-uuid/4a91d3eb-1633-42d9-8304-c10e49a61154";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/938D-F813";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/persist" = {
|
||||
device = "/dev/disk/by-uuid/4a91d3eb-1633-42d9-8304-c10e49a61154";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=persist" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" = {
|
||||
device = "/dev/disk/by-uuid/4a91d3eb-1633-42d9-8304-c10e49a61154";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" "compress=zstd" ];
|
||||
};
|
||||
|
||||
swapDevices = [{ device = "/dev/disk/by-uuid/29ebf65f-e6ca-4625-9f72-a9321152be1b"; }];
|
||||
}
|
||||
|
|
|
|||
70
hosts/nixos-laptop/impermanence.nix
Normal file
70
hosts/nixos-laptop/impermanence.nix
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
age.secrets = {
|
||||
root-password.file = ../../secrets/root-password.age;
|
||||
moritz-password.file = ../../secrets/moritz-password.age;
|
||||
};
|
||||
users.users = {
|
||||
root.hashedPasswordFile = config.age.secrets.root-password.path;
|
||||
moritz.hashedPasswordFile = config.age.secrets.moritz-password.path;
|
||||
};
|
||||
users.mutableUsers = false;
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/etc/NetworkManager/system-connections"
|
||||
"/var/db/dhcpcd/"
|
||||
"/var/lib/NetworkManager/"
|
||||
"/var/lib/bluetooth"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd/coredump"
|
||||
"/var/log"
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
"/etc/nix/id_rsa"
|
||||
"/etc/ssh/ssh_host_ed25519_key"
|
||||
"/etc/ssh/ssh_host_ed25519_key.pub"
|
||||
"/etc/ssh/ssh_host_rsa_key"
|
||||
"/etc/ssh/ssh_host_rsa_key.pub"
|
||||
];
|
||||
users.moritz = {
|
||||
directories = [
|
||||
".SynologyDrive/data"
|
||||
".SynologyDrive/log"
|
||||
".cache/keepassxc"
|
||||
".cache/nvim/luac"
|
||||
".config/Nextcloud"
|
||||
".config/keepassxc"
|
||||
".local/share/direnv"
|
||||
".local/share/zoxide"
|
||||
".local/state/nvim"
|
||||
".mozilla"
|
||||
"Documents"
|
||||
"Downloads"
|
||||
"Music"
|
||||
"Pictures"
|
||||
"Videos"
|
||||
{ directory = ".gnupg"; mode = "0700"; }
|
||||
{ directory = ".local/share/keyrings"; mode = "0700"; }
|
||||
{ directory = ".ssh"; mode = "0700"; }
|
||||
];
|
||||
files = [
|
||||
".local/share/fish/fish_history"
|
||||
".local/share/nix/trusted-settings.json"
|
||||
".parallel/will-cite"
|
||||
];
|
||||
};
|
||||
users.root = {
|
||||
home = "/root";
|
||||
directories = [
|
||||
{ directory = ".gnupg"; mode = "0700"; }
|
||||
{ directory = ".ssh"; mode = "0700"; }
|
||||
];
|
||||
files = [
|
||||
".local/share/nix/trusted-settings.json"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue