From 8b5e5079e5fd00eadf2e3926c104e4ecf99a5779 Mon Sep 17 00:00:00 2001 From: Fuwn Date: Wed, 4 Sep 2024 19:57:20 -0700 Subject: refac --- home/ebisu/fortune/desktop/default.nix | 2 - .../desktop/hyprland/hyprland/executions.nix | 2 +- home/ebisu/fortune/development/nix/default.nix | 1 + .../fortune/system/virtualisation/default.nix | 6 +- modules/boot/default.nix | 113 -------------- modules/boot/grub.nix | 32 ---- modules/boot/systemd-boot.nix | 10 -- modules/datetime.nix | 27 ---- modules/default.nix | 20 +-- modules/environment/default.nix | 8 - modules/environment/system-packages/default.nix | 29 ---- modules/environment/system-packages/gtk.nix | 8 - modules/environment/system-packages/libva.nix | 7 - modules/environment/system-packages/nvidia.nix | 7 - modules/environment/system-packages/usb.nix | 8 - modules/environment/system-packages/vulkan.nix | 9 -- modules/environment/variables.nix | 74 --------- modules/hardware/bluetooth.nix | 2 + modules/hardware/cpu.nix | 26 ++++ modules/hardware/default.nix | 7 +- modules/hardware/graphics.nix | 19 --- modules/hardware/nvidia.nix | 19 --- modules/hardware/tpm.nix | 18 +++ modules/hardware/usb.nix | 10 ++ modules/hardware/yubikey.nix | 23 +++ modules/multimedia/audio/default.nix | 6 + modules/multimedia/audio/pipewire.nix | 165 +++++++++++++++++++++ modules/multimedia/audio/wireplumber.nix | 42 ++++++ modules/multimedia/default.nix | 6 + modules/multimedia/video/default.nix | 13 ++ modules/multimedia/video/graphics.nix | 21 +++ modules/multimedia/video/libva.nix | 7 + modules/multimedia/video/nvidia.nix | 37 +++++ modules/multimedia/video/vulkan.nix | 9 ++ modules/networking/default.nix | 27 ---- modules/networking/dhcpcd.nix | 6 - modules/networking/firewall.nix | 13 -- modules/networking/networkmanager.nix | 9 -- modules/nix.nix | 78 ---------- modules/nix/default.nix | 89 +++++++++++ modules/nix/nh.nix | 10 ++ modules/nixpkgs.nix | 6 - modules/programs/default.nix | 20 --- modules/programs/gnupg.nix | 16 -- modules/programs/mosh.nix | 6 - modules/programs/nh.nix | 10 -- modules/security/apparmor.nix | 22 +++ modules/security/audit.nix | 10 +- modules/security/default.nix | 12 +- modules/security/kernel.nix | 160 ++++++++++++++++++++ modules/security/pam.nix | 50 +++++++ modules/security/polkit.nix | 3 +- modules/security/sudo.nix | 76 +++++++++- modules/security/tpm.nix | 16 -- modules/services/ananicy.nix | 8 - modules/services/dbus.nix | 11 -- modules/services/default.nix | 31 ---- modules/services/fail2ban.nix | 18 --- modules/services/libinput.nix | 13 -- modules/services/ollama.nix | 6 - modules/services/openntpd.nix | 10 -- modules/services/openssh.nix | 24 --- modules/services/pia.nix | 10 -- modules/services/pipewire.nix | 165 --------------------- modules/services/resolved.nix | 15 -- modules/services/tor.nix | 6 - modules/services/wireplumber.nix | 42 ------ modules/services/xserver.nix | 6 - modules/system.nix | 10 -- modules/system/access/default.nix | 7 + modules/system/access/gnupg.nix | 16 ++ modules/system/access/mosh.nix | 6 + modules/system/access/ssh.nix | 26 ++++ modules/system/boot/default.nix | 32 ++++ modules/system/boot/grub.nix | 32 ++++ modules/system/boot/systemd-boot.nix | 10 ++ modules/system/datetime/datetime.nix | 33 +++++ modules/system/datetime/default.nix | 6 + modules/system/datetime/openntpd.nix | 13 ++ modules/system/default.nix | 24 +++ modules/system/desktop/default.nix | 6 + modules/system/desktop/gtk.nix | 8 + modules/system/desktop/xdg-portal.nix | 15 ++ modules/system/encryption.nix | 16 ++ modules/system/networking/default.nix | 33 +++++ modules/system/networking/dhcpcd.nix | 6 + modules/system/networking/fail2ban.nix | 18 +++ modules/system/networking/firewall.nix | 12 ++ modules/system/networking/ipv6.nix | 9 ++ modules/system/networking/loopback.nix | 7 + modules/system/networking/networkmanager.nix | 22 +++ modules/system/networking/optimise.nix | 73 +++++++++ modules/system/networking/resolved.nix | 15 ++ modules/system/networking/tor.nix | 6 + modules/system/networking/vpn/default.nix | 6 + modules/system/networking/vpn/pia.nix | 10 ++ modules/system/networking/vpn/tailscale.nix | 4 + modules/system/programs.nix | 21 +++ modules/system/services/ananicy.nix | 8 + modules/system/services/dbus.nix | 11 ++ modules/system/services/default.nix | 20 +++ modules/system/services/libinput.nix | 13 ++ modules/system/services/ollama.nix | 6 + modules/system/services/xserver.nix | 6 + modules/system/systemd.nix | 11 ++ modules/system/users.nix | 42 ++++++ modules/system/variables.nix | 74 +++++++++ modules/users.nix | 42 ------ modules/virtualisation.nix | 37 ----- modules/virtualisation/default.nix | 6 + modules/virtualisation/docker.nix | 33 +++++ modules/virtualisation/libvirtd.nix | 26 ++++ modules/xdg-portal.nix | 15 -- 113 files changed, 1563 insertions(+), 1086 deletions(-) delete mode 100644 modules/boot/default.nix delete mode 100644 modules/boot/grub.nix delete mode 100644 modules/boot/systemd-boot.nix delete mode 100644 modules/datetime.nix delete mode 100644 modules/environment/default.nix delete mode 100644 modules/environment/system-packages/default.nix delete mode 100644 modules/environment/system-packages/gtk.nix delete mode 100644 modules/environment/system-packages/libva.nix delete mode 100644 modules/environment/system-packages/nvidia.nix delete mode 100644 modules/environment/system-packages/usb.nix delete mode 100644 modules/environment/system-packages/vulkan.nix delete mode 100644 modules/environment/variables.nix create mode 100644 modules/hardware/cpu.nix delete mode 100644 modules/hardware/graphics.nix delete mode 100644 modules/hardware/nvidia.nix create mode 100644 modules/hardware/tpm.nix create mode 100644 modules/hardware/usb.nix create mode 100644 modules/hardware/yubikey.nix create mode 100644 modules/multimedia/audio/default.nix create mode 100644 modules/multimedia/audio/pipewire.nix create mode 100644 modules/multimedia/audio/wireplumber.nix create mode 100644 modules/multimedia/default.nix create mode 100644 modules/multimedia/video/default.nix create mode 100644 modules/multimedia/video/graphics.nix create mode 100644 modules/multimedia/video/libva.nix create mode 100644 modules/multimedia/video/nvidia.nix create mode 100644 modules/multimedia/video/vulkan.nix delete mode 100644 modules/networking/default.nix delete mode 100644 modules/networking/dhcpcd.nix delete mode 100644 modules/networking/firewall.nix delete mode 100644 modules/networking/networkmanager.nix delete mode 100644 modules/nix.nix create mode 100644 modules/nix/default.nix create mode 100644 modules/nix/nh.nix delete mode 100644 modules/nixpkgs.nix delete mode 100644 modules/programs/default.nix delete mode 100644 modules/programs/gnupg.nix delete mode 100644 modules/programs/mosh.nix delete mode 100644 modules/programs/nh.nix create mode 100644 modules/security/apparmor.nix create mode 100644 modules/security/kernel.nix create mode 100644 modules/security/pam.nix delete mode 100644 modules/security/tpm.nix delete mode 100644 modules/services/ananicy.nix delete mode 100644 modules/services/dbus.nix delete mode 100644 modules/services/default.nix delete mode 100644 modules/services/fail2ban.nix delete mode 100644 modules/services/libinput.nix delete mode 100644 modules/services/ollama.nix delete mode 100644 modules/services/openntpd.nix delete mode 100644 modules/services/openssh.nix delete mode 100644 modules/services/pia.nix delete mode 100644 modules/services/pipewire.nix delete mode 100644 modules/services/resolved.nix delete mode 100644 modules/services/tor.nix delete mode 100644 modules/services/wireplumber.nix delete mode 100644 modules/services/xserver.nix delete mode 100644 modules/system.nix create mode 100644 modules/system/access/default.nix create mode 100644 modules/system/access/gnupg.nix create mode 100644 modules/system/access/mosh.nix create mode 100644 modules/system/access/ssh.nix create mode 100644 modules/system/boot/default.nix create mode 100644 modules/system/boot/grub.nix create mode 100644 modules/system/boot/systemd-boot.nix create mode 100644 modules/system/datetime/datetime.nix create mode 100644 modules/system/datetime/default.nix create mode 100644 modules/system/datetime/openntpd.nix create mode 100644 modules/system/default.nix create mode 100644 modules/system/desktop/default.nix create mode 100644 modules/system/desktop/gtk.nix create mode 100644 modules/system/desktop/xdg-portal.nix create mode 100644 modules/system/encryption.nix create mode 100644 modules/system/networking/default.nix create mode 100644 modules/system/networking/dhcpcd.nix create mode 100644 modules/system/networking/fail2ban.nix create mode 100644 modules/system/networking/firewall.nix create mode 100644 modules/system/networking/ipv6.nix create mode 100644 modules/system/networking/loopback.nix create mode 100644 modules/system/networking/networkmanager.nix create mode 100644 modules/system/networking/optimise.nix create mode 100644 modules/system/networking/resolved.nix create mode 100644 modules/system/networking/tor.nix create mode 100644 modules/system/networking/vpn/default.nix create mode 100644 modules/system/networking/vpn/pia.nix create mode 100644 modules/system/networking/vpn/tailscale.nix create mode 100644 modules/system/programs.nix create mode 100644 modules/system/services/ananicy.nix create mode 100644 modules/system/services/dbus.nix create mode 100644 modules/system/services/default.nix create mode 100644 modules/system/services/libinput.nix create mode 100644 modules/system/services/ollama.nix create mode 100644 modules/system/services/xserver.nix create mode 100644 modules/system/systemd.nix create mode 100644 modules/system/users.nix create mode 100644 modules/system/variables.nix delete mode 100644 modules/users.nix delete mode 100644 modules/virtualisation.nix create mode 100644 modules/virtualisation/default.nix create mode 100644 modules/virtualisation/docker.nix create mode 100644 modules/virtualisation/libvirtd.nix delete mode 100644 modules/xdg-portal.nix diff --git a/home/ebisu/fortune/desktop/default.nix b/home/ebisu/fortune/desktop/default.nix index 56cc9c9..a69315f 100644 --- a/home/ebisu/fortune/desktop/default.nix +++ b/home/ebisu/fortune/desktop/default.nix @@ -24,7 +24,5 @@ bibata-cursors xorg.xlsclients libnotify - # lemurs - # emptty ]; } diff --git a/home/ebisu/fortune/desktop/hyprland/hyprland/executions.nix b/home/ebisu/fortune/desktop/hyprland/hyprland/executions.nix index f9cd3c4..bcd333b 100644 --- a/home/ebisu/fortune/desktop/hyprland/hyprland/executions.nix +++ b/home/ebisu/fortune/desktop/hyprland/hyprland/executions.nix @@ -11,7 +11,7 @@ # "${pkgs.waybar}/bin/waybar" "waybar" "hyprctl setcursor Bibata-Modern-Ice 18" - "trayscale" + "trayscale --hide-window" # Fcitx5 "fcitx5-remote -r" diff --git a/home/ebisu/fortune/development/nix/default.nix b/home/ebisu/fortune/development/nix/default.nix index c713393..954dd97 100644 --- a/home/ebisu/fortune/development/nix/default.nix +++ b/home/ebisu/fortune/development/nix/default.nix @@ -29,5 +29,6 @@ devenv manix niv + nix-diff ]; } diff --git a/home/ebisu/fortune/system/virtualisation/default.nix b/home/ebisu/fortune/system/virtualisation/default.nix index 3352886..8465b37 100644 --- a/home/ebisu/fortune/system/virtualisation/default.nix +++ b/home/ebisu/fortune/system/virtualisation/default.nix @@ -1,9 +1,5 @@ { pkgs, ... }: { imports = [ ./docker.nix ]; - - home.packages = with pkgs; [ - bottles - virt-manager - ]; + home.packages = [ pkgs.bottles ]; } diff --git a/modules/boot/default.nix b/modules/boot/default.nix deleted file mode 100644 index 964a4e1..0000000 --- a/modules/boot/default.nix +++ /dev/null @@ -1,113 +0,0 @@ -{ - pkgs, - config, - ... -}: -{ - imports = [ - ./grub.nix - ./systemd-boot.nix - ]; - - boot = { - crashDump.enable = false; - consoleLogLevel = 3; - - loader = { - timeout = 5; - generationsDir.copyKernels = true; - - efi = { - canTouchEfiVariables = true; - efiSysMountPoint = "/boot"; - }; - }; - - kernelPackages = pkgs.linuxPackages_zen; - blacklistedKernelModules = [ "nouveau" ]; - - extraModulePackages = with config.boot.kernelPackages; [ - v4l2loopback - zenpower - ]; - - initrd = { - # systemd.enable = true; - - availableKernelModules = [ - # "aesni_intel" - # "cryptd" - "usb_storage" - ]; - }; - - kernelModules = [ - "v4l2loopback" - "tls" - "tcp_bbr" - "uhid" - "amd-pstate" - "zenpower" - "msr" - ]; - - kernel.sysctl = { - # TCP hardening - # Prevent bogus ICMP errors from filling up logs. - "net.ipv4.icmp_ignore_bogus_error_responses" = 1; - # Reverse path filtering causes the kernel to do source validation of - # packets received from all interfaces. This can mitigate IP spoofing. - "net.ipv4.conf.default.rp_filter" = 1; - "net.ipv4.conf.all.rp_filter" = 1; - # Do not accept IP source route packets (we're not a router) - "net.ipv4.conf.all.accept_source_route" = 0; - "net.ipv6.conf.all.accept_source_route" = 0; - # Don't send ICMP redirects (again, we're on a router) - "net.ipv4.conf.all.send_redirects" = 0; - "net.ipv4.conf.default.send_redirects" = 0; - # Refuse ICMP redirects (MITM mitigations) - "net.ipv4.conf.all.accept_redirects" = 0; - "net.ipv4.conf.default.accept_redirects" = 0; - "net.ipv4.conf.all.secure_redirects" = 0; - "net.ipv4.conf.default.secure_redirects" = 0; - "net.ipv6.conf.all.accept_redirects" = 0; - "net.ipv6.conf.default.accept_redirects" = 0; - # Protects against SYN flood attacks - "net.ipv4.tcp_syncookies" = 1; - # Incomplete protection again TIME-WAIT assassination - "net.ipv4.tcp_rfc1337" = 1; - # And other stuff - "net.ipv4.conf.all.log_martians" = true; - "net.ipv4.conf.default.log_martians" = true; - "net.ipv4.icmp_echo_ignore_broadcasts" = true; - "net.ipv6.conf.default.accept_ra" = 0; - "net.ipv6.conf.all.accept_ra" = 0; - "net.ipv4.tcp_timestamps" = 0; - - # TCP optimization - # TCP Fast Open is a TCP extension that reduces network latency by packing - # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for - # both incoming and outgoing connections: - "net.ipv4.tcp_fastopen" = 3; - # Bufferbloat mitigations + slight improvement in throughput & latency - "net.ipv4.tcp_congestion_control" = "bbr"; - "net.core.default_qdisc" = "cake"; - - "net.ipv6.conf.enp42s0.disable_ipv6" = true; - "net.ipv6.conf.wlp4s0.disable_ipv6" = true; - "net.ipv6.conf.tun0.disable_ipv6" = true; - }; - - kernelParams = [ - "nvidia-drm.fbdev=1" - "nvidia.NVreg_PreserveVideoMemoryAllocations=1" - "usbcore.autosuspend=-1" - "iommu=pt" - "threadirqs" - "btusb" - "amd_iommu=on" - "luks.options=timeout=0" - "rd.luks.options=timeout=0" - ]; - }; -} diff --git a/modules/boot/grub.nix b/modules/boot/grub.nix deleted file mode 100644 index 49e0eef..0000000 --- a/modules/boot/grub.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ pkgs, ... }: -{ - boot.loader.grub = { - enable = true; - device = "nodev"; - efiSupport = true; - useOSProber = true; - configurationLimit = 10; - memtest86.enable = true; - gfxmodeEfi = "1920x1080x32"; - gfxmodeBios = "1920x1080x32"; - gfxpayloadBios = "keep"; - gfxpayloadEfi = "keep"; - splashMode = "normal"; - - # extraEntries = '' - # menuentry "Arch Linux (linux-clear)" { - # linux /vmlinuz-linux-clear - # initrd /amd-ucode.img - # initrd /booster-linux-clear.img - # options root=PARTUUID=f510f35d-76a0-4469-aad5-da449541ecd2 rootflags=subvol=@ rw rootfstype=btrfs psi=1 nvidia_drm.modeset=1 - # } - # ''; - - theme = pkgs.fetchFromGitHub { - owner = "Lxtharia"; - repo = "minegrub-theme"; - rev = "193b3a7c3d432f8c6af10adfb465b781091f56b3"; - sha256 = "1bvkfmjzbk7pfisvmyw5gjmcqj9dab7gwd5nmvi8gs4vk72bl2ap"; - }; - }; -} diff --git a/modules/boot/systemd-boot.nix b/modules/boot/systemd-boot.nix deleted file mode 100644 index 5b50bad..0000000 --- a/modules/boot/systemd-boot.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ - boot.loader.systemd-boot = { - enable = false; - editor = true; - consoleMode = "max"; - memtest86.enable = true; - netbootxyz.enable = true; - configurationLimit = 10; - }; -} diff --git a/modules/datetime.nix b/modules/datetime.nix deleted file mode 100644 index 9d9bbbb..0000000 --- a/modules/datetime.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ pkgs, ... }: -{ - time.timeZone = "America/Los_Angeles"; - - i18n = { - defaultLocale = "en_US.UTF-8"; - - inputMethod = { - enable = true; - type = "fcitx5"; - - fcitx5 = { - waylandFrontend = true; - - addons = with pkgs; [ - fcitx5-configtool - fcitx5-gtk - fcitx5-hangul - fcitx5-mozc - fcitx5-rime - rime-data - catppuccin-fcitx5 - ]; - }; - }; - }; -} diff --git a/modules/default.nix b/modules/default.nix index e491f13..c18ed49 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,20 +1,10 @@ { imports = [ - ./boot - ./environment - ./programs - ./security ./hardware - ./networking - ./services - ./datetime.nix - ./nix.nix - ./nixpkgs.nix - ./system.nix - ./users.nix - ./virtualisation.nix - ./xdg-portal.nix + ./multimedia + ./nix + ./security + ./system + ./virtualisation ]; - - location.provider = "geoclue2"; } diff --git a/modules/environment/default.nix b/modules/environment/default.nix deleted file mode 100644 index fafb09d..0000000 --- a/modules/environment/default.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ - imports = [ - ./system-packages - ./variables.nix - ]; - - environment.shellAliases.nvidia-settings = "nvidia-settings --config='$XDG_CONFIG_HOME'/nvidia/settings"; -} diff --git a/modules/environment/system-packages/default.nix b/modules/environment/system-packages/default.nix deleted file mode 100644 index 1174e5e..0000000 --- a/modules/environment/system-packages/default.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ pkgs, ... }: -{ - imports = [ - ./gtk.nix - ./libva.nix - ./nvidia.nix - ./usb.nix - ./vulkan.nix - ]; - - environment.systemPackages = with pkgs; [ - vim - wget - git - mediastreamer-openh264 - pinentry - runc - openntpd - mesa - amdctl - ]; - - systemd.services.containerd.path = with pkgs; [ - containerd - runc - iptables - nvidia-docker - ]; -} diff --git a/modules/environment/system-packages/gtk.nix b/modules/environment/system-packages/gtk.nix deleted file mode 100644 index 4357e75..0000000 --- a/modules/environment/system-packages/gtk.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ pkgs, ... }: -{ - environment.systemPackages = with pkgs; [ - gtk2 - gtk3 - gtk4 - ]; -} diff --git a/modules/environment/system-packages/libva.nix b/modules/environment/system-packages/libva.nix deleted file mode 100644 index d420495..0000000 --- a/modules/environment/system-packages/libva.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ pkgs, ... }: -{ - environment.systemPackages = with pkgs; [ - libva - libva-utils - ]; -} diff --git a/modules/environment/system-packages/nvidia.nix b/modules/environment/system-packages/nvidia.nix deleted file mode 100644 index dad4394..0000000 --- a/modules/environment/system-packages/nvidia.nix +++ /dev/null @@ -1,7 +0,0 @@ -{ pkgs, ... }: -{ - environment.systemPackages = with pkgs; [ - nvidia-container-toolkit - nvidia-docker - ]; -} diff --git a/modules/environment/system-packages/usb.nix b/modules/environment/system-packages/usb.nix deleted file mode 100644 index 28bb194..0000000 --- a/modules/environment/system-packages/usb.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ pkgs, ... }: -{ - environment.systemPackages = with pkgs; [ - usbutils - lm_sensors - pciutils - ]; -} diff --git a/modules/environment/system-packages/vulkan.nix b/modules/environment/system-packages/vulkan.nix deleted file mode 100644 index be37e0e..0000000 --- a/modules/environment/system-packages/vulkan.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ pkgs, ... }: -{ - environment.systemPackages = with pkgs; [ - vulkan-loader - vulkan-validation-layers - vulkan-tools - vulkan-extension-layer - ]; -} diff --git a/modules/environment/variables.nix b/modules/environment/variables.nix deleted file mode 100644 index 7e9b794..0000000 --- a/modules/environment/variables.nix +++ /dev/null @@ -1,74 +0,0 @@ -{ - environment.variables = { - # OpenGL - __GL_GSYNC_ALLOWED = "1"; - __GL_VRR_ALLOWED = "0"; - __GL_MaxFramesAllowed = "1"; - - # Java - _JAVA_AWT_WM_NONREPARENTING = "1"; - - # Qt - QT_AUTO_SCREEN_SCALE_FACTOR = "1"; - QT_WAYLAND_DISABLE_WINDOWDECORATION = "1"; - QT_QPA_PLATFORM = "wayland;xcb"; - DISABLE_QT5_COMPAT = "0"; - DISABLE_QT_COMPAT = "0"; - QT_QPA_PLATFORMTHEME = "qt5ct"; - # QT_STYLE_OVERRIDE = "kvantum"; - - # Electron - # ELECTRON_OZONE_PLATFORM_HINT = "auto"; - # OZONE_PLATFORM = "wayland"; - NIXOS_OZONE_WL = "1"; - - # Proton - PROTON_ENABLE_NGX_UPDATER = "1"; - - # wlroots - WLR_NO_HARDWARE_CURSORS = "1"; - WLR_DRM_NO_ATOMIC = "1"; - WLR_USE_LIBINPUT = "1"; - WLR_RENDERER_ALLOW_SOFTWARE = "1"; - WLR_DRM_DEVICES = "/dev/dri/card0"; - WLR_EGL_NO_MODIFIERS = "1"; - WLR_BACKEND = "vulkan"; - WLR_RENDERER = "vulkan"; - - # Mozilla - MOZ_ENABLE_WAYLAND = "1"; - MOZ_DISABLE_RDD_SANDBOX = "1"; - - # Nvidia - LIBVA_DRIVER_NAME = "nvidia"; - __GLX_VENDOR_LIBRARY_NAME = "nvidia"; - GBM_BACKEND = "nvidia-drm"; - __VK_LAYER_NV_optimus = "NVIDIA_only"; - __NV_PRIME_RENDER_OFFLOAD = "1"; - NVD_BACKEND = "direct"; - - # Fcitx - # https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland - QT_IM_MODULE = "fcitx"; - XMODIFIERS = "@im=fcitx"; - # GTK_IM_MODULE = "wayland"; - # GTK_IM_MODULE = "fcitx"; - SDL_IM_MODULE = "fcitx"; - GLFW_IM_MODULE = "ibus"; - INPUT_METHOD = "fcitx"; - CUDA_CACHE_PATH = "$XDG_CACHE_HOME/nv"; - - # Other Wayland - GDK_BACKEND = "wayland,x11,*"; - SDL_VIDEODRIVER = "wayland"; - CLUTTER_BACKEND = "wayland"; - XWAYLAND_NO_GLAMOR = "1"; # Gamescope - ANKI_WAYLAND = "1"; - XDG_SESSION_TYPE = "wayland"; - - # Other - GTK_USE_PORTAL = "1"; - DIRENV_LOG_FORMAT = ""; - SSH_AUTH_SOCK = "/run/user/1000/keyring/ssh"; - }; -} diff --git a/modules/hardware/bluetooth.nix b/modules/hardware/bluetooth.nix index ede4f77..8400a72 100644 --- a/modules/hardware/bluetooth.nix +++ b/modules/hardware/bluetooth.nix @@ -1,5 +1,7 @@ { pkgs, ... }: { + boot.kernelParams = [ "btusb" ]; + hardware.bluetooth = { enable = true; powerOnBoot = true; diff --git a/modules/hardware/cpu.nix b/modules/hardware/cpu.nix new file mode 100644 index 0000000..b57190a --- /dev/null +++ b/modules/hardware/cpu.nix @@ -0,0 +1,26 @@ +{ + pkgs, + config, + ... +}: +{ + hardware.cpu.amd.updateMicrocode = true; + environment.systemPackages = [ pkgs.amdctl ]; + + powerManagement = { + enable = true; + cpuFreqGovernor = "performance"; + }; + + boot = { + kernelModules = [ + # "kvm-amd" + "amd-pstate" + "zenpower" + "msr" + ]; + + kernelParams = [ "amd_iommu=on" ]; + extraModulePackages = [ config.boot.kernelPackages.zenpower ]; + }; +} diff --git a/modules/hardware/default.nix b/modules/hardware/default.nix index 4c413a0..167e7c7 100644 --- a/modules/hardware/default.nix +++ b/modules/hardware/default.nix @@ -1,13 +1,14 @@ { imports = [ + ./cpu.nix ./bluetooth.nix - ./graphics.nix - ./nvidia.nix + ./usb.nix + ./tpm.nix + ./yubikey.nix ]; hardware = { enableRedistributableFirmware = true; enableAllFirmware = true; - cpu.amd.updateMicrocode = true; }; } diff --git a/modules/hardware/graphics.nix b/modules/hardware/graphics.nix deleted file mode 100644 index 0e01517..0000000 --- a/modules/hardware/graphics.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ pkgs, ... }: -{ - hardware.graphics = { - enable = true; - enable32Bit = true; - - extraPackages = with pkgs; [ - nvidia-vaapi-driver - vaapiVdpau - libvdpau-va-gl - ]; - - extraPackages32 = with pkgs; [ - nvidia-vaapi-driver - vaapiVdpau - libvdpau-va-gl - ]; - }; -} diff --git a/modules/hardware/nvidia.nix b/modules/hardware/nvidia.nix deleted file mode 100644 index 31e2100..0000000 --- a/modules/hardware/nvidia.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, ... }: -{ - hardware = { - nvidia-container-toolkit.enable = true; - - nvidia = { - modesetting.enable = true; - open = false; - nvidiaSettings = true; - package = config.boot.kernelPackages.nvidiaPackages.production; - forceFullCompositionPipeline = true; - - powerManagement = { - enable = true; - finegrained = false; - }; - }; - }; -} diff --git a/modules/hardware/tpm.nix b/modules/hardware/tpm.nix new file mode 100644 index 0000000..b84551e --- /dev/null +++ b/modules/hardware/tpm.nix @@ -0,0 +1,18 @@ +{ pkgs, ... }: +{ + security.tpm2 = { + enable = true; + applyUdevRules = true; + abrmd.enable = true; + tctiEnvironment.enable = true; + pkcs11.enable = true; + }; + + environment.systemPackages = with pkgs; [ + tpm2-tools + tpm2-tss + tpm2-abrmd + ]; + + boot.kernelModules = [ "uhid" ]; +} diff --git a/modules/hardware/usb.nix b/modules/hardware/usb.nix new file mode 100644 index 0000000..f697761 --- /dev/null +++ b/modules/hardware/usb.nix @@ -0,0 +1,10 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + usbutils + lm_sensors + pciutils + ]; + + boot.kernelParams = [ "usbcore.autosuspend=-1" ]; +} diff --git a/modules/hardware/yubikey.nix b/modules/hardware/yubikey.nix new file mode 100644 index 0000000..87633ac --- /dev/null +++ b/modules/hardware/yubikey.nix @@ -0,0 +1,23 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + hardware.gpgSmartcards.enable = true; + + services = { + pcscd.enable = true; + udev.packages = [ pkgs.yubikey-personalization ]; + }; + + environment.systemPackages = with pkgs; [ + yubikey-manager + yubikey-manager-qt + yubikey-personalization + yubikey-personalization-gui + yubico-piv-tool + yubioath-flutter + ]; +} diff --git a/modules/multimedia/audio/default.nix b/modules/multimedia/audio/default.nix new file mode 100644 index 0000000..f4e7f0a --- /dev/null +++ b/modules/multimedia/audio/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./pipewire.nix + # ./wireplumber.nix + ]; +} diff --git a/modules/multimedia/audio/pipewire.nix b/modules/multimedia/audio/pipewire.nix new file mode 100644 index 0000000..4e914a1 --- /dev/null +++ b/modules/multimedia/audio/pipewire.nix @@ -0,0 +1,165 @@ +# { lib, ... }: +# let +# inherit (lib.modules) mkBefore; +# inherit (lib.lists) singleton; +# inherit (builtins) toString; + +# mapOptionDefault = lib.attrsets.mapAttrs (_: lib.modules.mkOptionDefault); +# quantum = toString 64; +# rate = toString 48000; +# qr = "${quantum}/${rate}"; +# in +{ + services.pipewire = { + enable = true; + wireplumber.enable = true; + jack.enable = true; + pulse.enable = true; + audio.enable = true; + + alsa = { + enable = true; + support32Bit = true; + }; + + extraConfig = { + pipewire = { + "10-logging" = { + "context.properties"."log.level" = 3; + }; + + # "10-defaults" = { + # "context.properties" = mapOptionDefault { + # "clock.power-of-two-quantum" = true; + # "core.daemon" = true; + # "core.name" = "pipewire-0"; + # "link.max-buffers" = 16; + # "settings.check-quantum" = true; + # }; + + # "context.spa-libs" = mapOptionDefault { + # "audio.convert.*" = "audioconvert/libspa-audioconvert"; + # "avb.*" = "avb/libspa-avb"; + # "api.alsa.*" = "alsa/libspa-alsa"; + # "api.v4l2.*" = "v4l2/libspa-v4l2"; + # "api.libcamera.*" = "libcamera/libspa-libcamera"; + # "api.bluez5.*" = "bluez5/libspa-bluez5"; + # "api.vulkan.*" = "vulkan/libspa-vulkan"; + # "api.jack.*" = "jack/libspa-jack"; + # "support.*" = "support/libspa-support"; + # "video.convert.*" = "videoconvert/libspa-videoconvert"; + # }; + # }; + }; + + # pipewire-pulse = { + # "10-defaults" = { + # "context.spa-libs" = mapOptionDefault { + # "audio.convert.*" = "audioconvert/libspa-audioconvert"; + # "support.*" = "support/libspa-support"; + # }; + + # "pulse.cmd" = mkBefore [ + # { + # cmd = "load-module"; + # args = "module-always-sink"; + # flags = [ ]; + # } + # ]; + + # "pulse.properties" = { + # "server.address" = mkBefore [ "unix:native" ]; + # }; + + # "pulse.rules" = mkBefore [ + # { + # matches = [ + # { "application.process.binary" = "teams"; } + # { "application.process.binary" = "teams-insiders"; } + # { "application.process.binary" = "skypeforlinux"; } + # ]; + + # actions.quirks = [ "force-s16-info" ]; + # } + # { + # matches = singleton { "application.process.binary" = "firefox"; }; + # actions.quirks = [ "remove-capture-dont-move" ]; + # } + # { + # matches = singleton { "application.name" = "~speech-dispatcher*"; }; + + # actions = { + # update-props = { + # "pulse.min.req" = "1024/48000"; # 21 milliseconds + # "pulse.min.quantum " = "1024/48000"; # 21 milliseconds + # }; + # }; + # } + # ]; + # }; + # }; + + # pipewire."92-low-latency" = { + # "context.properties" = { + # "default.clock.rate" = rate; + # "default.clock.quantum" = quantum; + # "default.clock.min-quantum" = quantum; + # "default.clock.max-quantum" = quantum; + # "default.clock.allowed-rates" = [ rate ]; + # }; + + # # "context.modules" = [ + # # { + # # name = "libpipewire-module-rtkit"; + + # # flags = [ + # # "ifexists" + # # "nofail" + # # ]; + + # # args = { + # # "nice.level" = -15; + # # "rt.prio" = 90; + # # "rt.time.soft" = 200000; + # # "rt.time.hard" = 200000; + # # }; + # # } + # # { + # # name = "libpipewire-module-protocol-pulse"; + + # # args = { + # # "server.address" = [ "unix:native" ]; + # # "pulse.min.quantum" = qr; + # # "pulse.min.req" = qr; + # # "pulse.min.frag" = qr; + # # }; + # # } + # # ]; + + # "stream.properties" = { + # "node.latency" = qr; + # "resample.quality" = 1; + # }; + # }; + + # pipewire-pulse."92-low-latency" = { + # "context.modules" = singleton { + # name = "libpipewire-module-protocol-pulse"; + + # args = { + # "pulse.min.req" = qr; + # "pulse.default.req" = qr; + # "pulse.max.req" = qr; + # "pulse.min.quantum" = qr; + # "pulse.max.quantum" = qr; + # }; + # }; + + # "stream.properties" = { + # "node.latency" = qr; + # "resample.quality" = 4; + # }; + # }; + }; + }; +} diff --git a/modules/multimedia/audio/wireplumber.nix b/modules/multimedia/audio/wireplumber.nix new file mode 100644 index 0000000..970396f --- /dev/null +++ b/modules/multimedia/audio/wireplumber.nix @@ -0,0 +1,42 @@ +let + rate = builtins.toString 48000; +in +{ + services.pipewire.wireplumber = { + enable = true; + + extraConfig = { + "10-log-level-debug" = { + "context.properties"."log.level" = "D"; + }; + + "10-default-volume" = { + "wireplumber.settings"."device.routes.default-sink-volume" = 1.0; + }; + + "92-low-latency" = { + "monitor.alsa.rules" = [ + { + matches = [ + { "device.name" = "~alsa_card.*"; } + { "node.name" = "~alsa_output.*"; } + ]; + + actions.update-props = { + "node.description" = "ALSA Low Latency Output"; + "audio.rate" = rate; + "audio.format" = "S32LE"; + "resample.quality" = 4; + "resample.disable" = false; + "session.suspend-timeout-seconds" = 0; + "api.alsa.period-size" = 2; + "api.alsa.headroom" = 128; + "api.alsa.period-num" = 2; + "api.alsa.disable-batch" = false; + }; + } + ]; + }; + }; + }; +} diff --git a/modules/multimedia/default.nix b/modules/multimedia/default.nix new file mode 100644 index 0000000..7bf261a --- /dev/null +++ b/modules/multimedia/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./audio + ./video + ]; +} diff --git a/modules/multimedia/video/default.nix b/modules/multimedia/video/default.nix new file mode 100644 index 0000000..1157479 --- /dev/null +++ b/modules/multimedia/video/default.nix @@ -0,0 +1,13 @@ +{ pkgs, ... }: +{ + imports = [ + ./graphics.nix + ./libva.nix + ./nvidia.nix + ./vulkan.nix + ]; + + environment.systemPackages = [ + pkgs.mediastreamer-openh264 + ]; +} diff --git a/modules/multimedia/video/graphics.nix b/modules/multimedia/video/graphics.nix new file mode 100644 index 0000000..13da295 --- /dev/null +++ b/modules/multimedia/video/graphics.nix @@ -0,0 +1,21 @@ +{ pkgs, ... }: +{ + hardware.graphics = { + enable = true; + enable32Bit = true; + + extraPackages = with pkgs; [ + nvidia-vaapi-driver + vaapiVdpau + libvdpau-va-gl + ]; + + extraPackages32 = with pkgs; [ + nvidia-vaapi-driver + vaapiVdpau + libvdpau-va-gl + ]; + }; + + environment.systemPackages = [ pkgs.mesa ]; +} diff --git a/modules/multimedia/video/libva.nix b/modules/multimedia/video/libva.nix new file mode 100644 index 0000000..d420495 --- /dev/null +++ b/modules/multimedia/video/libva.nix @@ -0,0 +1,7 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + libva + libva-utils + ]; +} diff --git a/modules/multimedia/video/nvidia.nix b/modules/multimedia/video/nvidia.nix new file mode 100644 index 0000000..bc8cb22 --- /dev/null +++ b/modules/multimedia/video/nvidia.nix @@ -0,0 +1,37 @@ +{ pkgs, config, ... }: +{ + environment = { + systemPackages = with pkgs; [ + nvidia-container-toolkit + nvidia-docker + ]; + + shellAliases.nvidia-settings = "nvidia-settings --config='$XDG_CONFIG_HOME'/nvidia/settings"; + }; + + boot = { + blacklistedKernelModules = [ "nouveau" ]; + + kernelParams = [ + "nvidia-drm.fbdev=1" + "nvidia.NVreg_PreserveVideoMemoryAllocations=1" + ]; + }; + + hardware = { + nvidia-container-toolkit.enable = true; + + nvidia = { + modesetting.enable = true; + open = false; + nvidiaSettings = true; + package = config.boot.kernelPackages.nvidiaPackages.production; + forceFullCompositionPipeline = true; + + powerManagement = { + enable = true; + finegrained = false; + }; + }; + }; +} diff --git a/modules/multimedia/video/vulkan.nix b/modules/multimedia/video/vulkan.nix new file mode 100644 index 0000000..be37e0e --- /dev/null +++ b/modules/multimedia/video/vulkan.nix @@ -0,0 +1,9 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + vulkan-loader + vulkan-validation-layers + vulkan-tools + vulkan-extension-layer + ]; +} diff --git a/modules/networking/default.nix b/modules/networking/default.nix deleted file mode 100644 index 753e877..0000000 --- a/modules/networking/default.nix +++ /dev/null @@ -1,27 +0,0 @@ -{ - imports = [ - ./dhcpcd.nix - ./firewall.nix - ./networkmanager.nix - ]; - - networking = { - hostName = "kansai"; - nftables.enable = true; - enableIPv6 = false; - - nameservers = [ - "1.1.1.1#one.one.one.one" - "1.0.0.1#one.one.one.one" - "9.9.9.9#dns.quad9.net" - "149.112.112.112#dns.quad9.net" - ]; - - timeServers = [ - "0.nixos.pool.ntp.org" - "1.nixos.pool.ntp.org" - "2.nixos.pool.ntp.org" - "3.nixos.pool.ntp.org" - ]; - }; -} diff --git a/modules/networking/dhcpcd.nix b/modules/networking/dhcpcd.nix deleted file mode 100644 index 99ac0f3..0000000 --- a/modules/networking/dhcpcd.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - networking.dhcpcd = { - wait = "background"; - extraConfig = "noarp"; - }; -} diff --git a/modules/networking/firewall.nix b/modules/networking/firewall.nix deleted file mode 100644 index d389bff..0000000 --- a/modules/networking/firewall.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ - networking.firewall = { - enable = true; - allowedUDPPorts = [ 53 ]; - allowPing = false; - trustedInterfaces = [ "tailscale0" ]; - - allowedTCPPorts = [ - 80 - 443 - ]; - }; -} diff --git a/modules/networking/networkmanager.nix b/modules/networking/networkmanager.nix deleted file mode 100644 index 8435824..0000000 --- a/modules/networking/networkmanager.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ pkgs, ... }: -{ - networking.networkmanager = { - enable = true; - plugins = [ pkgs.networkmanager-openvpn ]; - dns = "systemd-resolved"; - wifi.backend = "iwd"; - }; -} diff --git a/modules/nix.nix b/modules/nix.nix deleted file mode 100644 index ee392d7..0000000 --- a/modules/nix.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ config, ... }: -{ - nix = { - settings = { - auto-optimise-store = true; - http-connections = 0; - warn-dirty = false; - log-lines = 50; - sandbox = true; - sandbox-fallback = false; - extra-sandbox-paths = [ config.programs.ccache.cacheDir ]; - keep-going = true; - accept-flake-config = false; - stalled-download-timeout = 20; - - system-features = [ - "nixos-test" - "kvm" - "recursive-nix" - "big-parallel" - ]; - - trusted-users = [ - "root" - "@wheel" - "nix-builder" - ]; - - allowed-users = [ - "root" - "@wheel" - "nix-builder" - ]; - - substituters = [ - "https://cache.nixos.org/" - "https://nix-community.cachix.org" - "https://hyprland.cachix.org" - "https://nyx.chaotic.cx/" - "https://nixpkgs-wayland.cachix.org" - "https://cuda-maintainers.cachix.org" - "https://nixpkgs-unfree.cachix.org" - ]; - - trusted-public-keys = [ - "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc=" - "nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8=" - "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA=" - "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E=" - "nixpkgs-unfree.cachix.org-1:hqvoInulhbV4nJ9yJOEr+4wxhDV4xq2d1DK7S6Nj6rs=" - ]; - - experimental-features = [ - "nix-command" - "flakes" - "recursive-nix" - "ca-derivations" - "auto-allocate-uids" - "cgroups" - "repl-flake" - "no-url-literals" - "dynamic-derivations" - ]; - }; - - gc = { - automatic = true; - dates = "03:00"; - options = "--delete-older-than 3d"; - }; - - optimise = { - automatic = true; - dates = [ "04:00" ]; - }; - }; -} diff --git a/modules/nix/default.nix b/modules/nix/default.nix new file mode 100644 index 0000000..7461ea2 --- /dev/null +++ b/modules/nix/default.nix @@ -0,0 +1,89 @@ +{ config, ... }: +{ + imports = [ + ./nh.nix + ]; + + nixpkgs.config = { + cudaSupport = true; + allowUnfree = true; + }; + + programs.nix-index-database.comma.enable = true; + + nix = { + settings = { + auto-optimise-store = true; + http-connections = 0; + warn-dirty = false; + log-lines = 50; + sandbox = true; + sandbox-fallback = false; + extra-sandbox-paths = [ config.programs.ccache.cacheDir ]; + keep-going = true; + accept-flake-config = false; + stalled-download-timeout = 20; + + system-features = [ + "nixos-test" + "kvm" + "recursive-nix" + "big-parallel" + ]; + + trusted-users = [ + "root" + "@wheel" + "nix-builder" + ]; + + allowed-users = [ + "root" + "@wheel" + "nix-builder" + ]; + + substituters = [ + "https://cache.nixos.org/" + "https://nix-community.cachix.org" + "https://hyprland.cachix.org" + "https://nyx.chaotic.cx/" + "https://nixpkgs-wayland.cachix.org" + "https://cuda-maintainers.cachix.org" + "https://nixpkgs-unfree.cachix.org" + ]; + + trusted-public-keys = [ + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" + "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc=" + "nyx.cachix.org-1:HfnXSw4pj95iI/n17rIDy40agHj12WfF+Gqk6SonIT8=" + "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA=" + "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E=" + "nixpkgs-unfree.cachix.org-1:hqvoInulhbV4nJ9yJOEr+4wxhDV4xq2d1DK7S6Nj6rs=" + ]; + + experimental-features = [ + "nix-command" + "flakes" + "recursive-nix" + "ca-derivations" + "auto-allocate-uids" + "cgroups" + "repl-flake" + "no-url-literals" + "dynamic-derivations" + ]; + }; + + gc = { + automatic = true; + dates = "03:00"; + options = "--delete-older-than 3d"; + }; + + optimise = { + automatic = true; + dates = [ "04:00" ]; + }; + }; +} diff --git a/modules/nix/nh.nix b/modules/nix/nh.nix new file mode 100644 index 0000000..29481a6 --- /dev/null +++ b/modules/nix/nh.nix @@ -0,0 +1,10 @@ +{ + programs.nh = { + enable = true; + + clean = { + enable = false; + extraArgs = "--keep-since 3d --keep 3"; + }; + }; +} diff --git a/modules/nixpkgs.nix b/modules/nixpkgs.nix deleted file mode 100644 index 206983c..0000000 --- a/modules/nixpkgs.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - nixpkgs.config = { - cudaSupport = true; - allowUnfree = true; - }; -} diff --git a/modules/programs/default.nix b/modules/programs/default.nix deleted file mode 100644 index 7139072..0000000 --- a/modules/programs/default.nix +++ /dev/null @@ -1,20 +0,0 @@ -{ - imports = [ - ./gnupg.nix - ./mosh.nix - ./nh.nix - ]; - - programs = { - fish.enable = true; - mtr.enable = true; - dconf.enable = true; - ssh.startAgent = false; - ccache.enable = true; - nix-index-database.comma.enable = true; - - bash.interactiveShellInit = '' - export HISTFILE="$XDG_STATE_HOME/bash/history" - ''; - }; -} diff --git a/modules/programs/gnupg.nix b/modules/programs/gnupg.nix deleted file mode 100644 index aeffb23..0000000 --- a/modules/programs/gnupg.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ pkgs, ... }: -{ - programs.gnupg.agent = { - enable = true; - enableSSHSupport = true; - pinentryPackage = pkgs.pinentry-curses; - - settings = { - enable-ssh-support = ""; - ttyname = "$GPG_TTY"; - default-cache-ttl = 34560000; # 60 - max-cache-ttl = 34560000; # 120 - allow-loopback-pinentry = ""; - }; - }; -} diff --git a/modules/programs/mosh.nix b/modules/programs/mosh.nix deleted file mode 100644 index c9af5bf..0000000 --- a/modules/programs/mosh.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - programs.mosh = { - enable = true; - openFirewall = false; - }; -} diff --git a/modules/programs/nh.nix b/modules/programs/nh.nix deleted file mode 100644 index 29481a6..0000000 --- a/modules/programs/nh.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ - programs.nh = { - enable = true; - - clean = { - enable = false; - extraArgs = "--keep-since 3d --keep 3"; - }; - }; -} diff --git a/modules/security/apparmor.nix b/modules/security/apparmor.nix new file mode 100644 index 0000000..a469add --- /dev/null +++ b/modules/security/apparmor.nix @@ -0,0 +1,22 @@ +{ pkgs, config, ... }: +{ + environment.systemPackages = with pkgs; [ + apparmor-pam + apparmor-utils + apparmor-parser + apparmor-profiles + apparmor-bin-utils + apparmor-kernel-patches + libapparmor + ]; + + services.dbus.apparmor = "enabled"; + + security.apparmor = { + enable = true; + enableCache = true; + killUnconfinedConfinables = true; + packages = [ pkgs.apparmor-profiles ]; + policies.dummy.profile = "/dummy { }"; + }; +} diff --git a/modules/security/audit.nix b/modules/security/audit.nix index 67dce9d..e5d820a 100644 --- a/modules/security/audit.nix +++ b/modules/security/audit.nix @@ -1,6 +1,10 @@ { - security.audit = { - enable = true; - rules = [ "-a exit,always -F arch=b64 -S execve" ]; + security = { + auditd.enable = true; + + audit = { + enable = true; + rules = [ "-a exit,always -F arch=b64 -S execve" ]; + }; }; } diff --git a/modules/security/default.nix b/modules/security/default.nix index 06302ea..48cc702 100644 --- a/modules/security/default.nix +++ b/modules/security/default.nix @@ -3,22 +3,22 @@ lib, ... }: -let - inherit (lib.modules) mkForce; -in { imports = [ + ./apparmor.nix ./audit.nix ./doas.nix + ./kernel.nix + ./pam.nix ./pki.nix ./polkit.nix ./sudo.nix - ./tpm.nix ]; security = { - auditd.enable = true; - rtkit.enable = mkForce config.services.pipewire.enable; + rtkit.enable = lib.modules.mkForce config.services.pipewire.enable; virtualisation.flushL1DataCache = "always"; }; + + programs.firejail.enable = true; } diff --git a/modules/security/kernel.nix b/modules/security/kernel.nix new file mode 100644 index 0000000..62b2f28 --- /dev/null +++ b/modules/security/kernel.nix @@ -0,0 +1,160 @@ +{ lib, ... }: +{ + boot = { + # https://docs.kernel.org/admin-guide/sysctl/vm.html + kernel.sysctl = { + # The Magic SysRq key is a key combo that allows users connected to the + # system console of a Linux kernel to perform some low-level commands. + # Disable it, since we don't need it, and is a potential security concern. + "kernel.sysrq" = lib.mkForce 0; + + # Restrict ptrace() usage to processes with a pre-defined relationship + # (e.g., parent/child) + # FIXME: this breaks game launchers, find a way to launch them with privileges (steam) + # gamescope wrapped with the capabilities *might* solve the issue + # spoiler: it didn't + # "kernel.yama.ptrace_scope" = 2; + + # Hide kptrs even for processes with CAP_SYSLOG + # also prevents printing kernel pointers + "kernel.kptr_restrict" = 2; + + # Disable bpf() JIT (to eliminate spray attacks) + "net.core.bpf_jit_enable" = false; + + # Disable ftrace debugging + "kernel.ftrace_enabled" = false; + + # Avoid kernel memory address exposures via dmesg (this value can also be set by CONFIG_SECURITY_DMESG_RESTRICT). + "kernel.dmesg_restrict" = 1; + + # Prevent creating files in potentially attacker-controlled environments such + # as world-writable directories to make data spoofing attacks more difficult + "fs.protected_fifos" = 2; + + # Prevent unintended writes to already-created files + "fs.protected_regular" = 2; + + # Disable SUID binary dump + "fs.suid_dumpable" = 0; + + # Prevent unprivileged users from creating hard or symbolic links to files + "fs.protected_symlinks" = 1; + "fs.protected_hardlinks" = 1; + + # Disable late module loading + # "kernel.modules_disabled" = 1; + + # Disallow profiling at all levels without CAP_SYS_ADMIN + "kernel.perf_event_paranoid" = 3; + + # Require CAP_BPF to use bpf + "kernel.unprivileged_bpf_disabled" = true; + + # Prevent boot console kernel log information leaks + "kernel.printk" = "3 3 3 3"; + + # Restrict loading TTY line disciplines to the CAP_SYS_MODULE capability to + # prevent unprivileged attackers from loading vulnerable line disciplines with + # the TIOCSETD ioctl + "dev.tty.ldisc_autoload" = 0; + + # Kexec allows replacing the current running kernel. There may be an edge case where + # you wish to boot into a different kernel, but I do not require kexec. Disabling it + # patches a potential security hole in our system. + "kernel.kexec_load_disabled" = true; + + # Borrowed by NixOS/nixpkgs. Since the security module does not explain what those + # options do, it is up you to educate yourself dear reader. + # See: + # - + # - + "vm.mmap_rnd_bits" = 32; + "vm.mmap_min_addr" = 65536; + }; + + # https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html + kernelParams = [ + # I'm sure we break hibernation in at least 5 other sections of this config, so + # let's disable hibernation explicitly. Allowing hibernation makes it possible + # to replace the booted kernel with a malicious one, akin to kexec. This helps + # us prevent an attack called "Evil Maid" where an attacker with physical access + # to the device. P.S. I chose to mention "Evil Maid" specifically because it sounds + # funny. Do not think that is the only attack you are vulnerable to. + # See: + "nohibernate" + + # make stack-based attacks on the kernel harder + "randomize_kstack_offset=on" + + # Disable vsyscalls as they are obsolete and have been replaced with vDSO. + # vsyscalls are also at fixed addresses in memory, making them a potential + # target for ROP attacks + # this breaks really old binaries for security + "vsyscall=none" + + # reduce most of the exposure of a heap attack to a single cache + # Disable slab merging which significantly increases the difficulty of heap + # exploitation by preventing overwriting objects from merged caches and by + # making it harder to influence slab cache layout + "slab_nomerge" + + # Disable debugfs which exposes a lot of sensitive information about the + # kernel. Some programs, such as powertop, use this interface to gather + # information about the system, but it is not necessary for the system to + # actually publish those. I can live without it. + "debugfs=off" + + # Sometimes certain kernel exploits will cause what is known as an "oops". + # This parameter will cause the kernel to panic on such oopses, thereby + # preventing those exploits + "oops=panic" + + # Only allow kernel modules that have been signed with a valid key to be + # loaded, which increases security by making it much harder to load a + # malicious kernel module + "module.sig_enforce=1" + + # The kernel lockdown LSM can eliminate many methods that user space code + # could abuse to escalate to kernel privileges and extract sensitive + # information. This LSM is necessary to implement a clear security boundary + # between user space and the kernel + # integrity: kernel features that allow userland to modify the running kernel + # are disabled + # confidentiality: kernel features that allow userland to extract confidential + # information from the kernel are also disabled + # ArchWiki recommends opting in for "integrity", however since we avoid modifying + # running kernel (by the virtue of using NixOS and locking module hot-loading) the + # confidentiality mode is a better solution. + "lockdown=confidentiality" + + # enable buddy allocator free poisoning + # on: memory will befilled with a specific byte pattern + # that is unlikely to occur in normal operation. + # off (default): page poisoning will be disabled + "page_poison=on" + + # performance improvement for direct-mapped memory-side-cache utilization + # reduces the predictability of page allocations + "page_alloc.shuffle=1" + + # for debugging kernel-level slab issues + "slub_debug=FZP" + + # ignore access time (atime) updates on files + # except when they coincide with updates to the ctime or mtime + "rootflags=noatime" + + # linux security modules + "lsm=landlock,lockdown,yama,integrity,apparmor,bpf,tomoyo,selinux" + + # prevent the kernel from blanking plymouth out of the fb + "fbcon=nodefer" + + # the format that will be used for integrity audit logs + # 0 (default): basic integrity auditing messages + # 1: additional integrity auditing messages + "integrity_audit=1" + ]; + }; +} diff --git a/modules/security/pam.nix b/modules/security/pam.nix new file mode 100644 index 0000000..b7eb426 --- /dev/null +++ b/modules/security/pam.nix @@ -0,0 +1,50 @@ +{ + security = { + pam = { + loginLimits = [ + { + domain = "@wheel"; + item = "nofile"; + type = "soft"; + value = "524288"; + } + { + domain = "@wheel"; + item = "nofile"; + type = "hard"; + value = "1048576"; + } + ]; + + services = + let + ttyAudit = { + enable = true; + enablePattern = "*"; + }; + in + { + swaylock.text = "auth include login"; + gtklock.text = "auth include login"; + + login = { + inherit ttyAudit; + + setLoginUid = true; + }; + + sshd = { + inherit ttyAudit; + + setLoginUid = true; + }; + + sudo = { + inherit ttyAudit; + + setLoginUid = true; + }; + }; + }; + }; +} diff --git a/modules/security/polkit.nix b/modules/security/polkit.nix index 400ea87..786d1a0 100644 --- a/modules/security/polkit.nix +++ b/modules/security/polkit.nix @@ -1,6 +1,7 @@ +{ lib, ... }: { security.polkit = { enable = true; - debug = true; + debug = lib.modules.mkDefault true; }; } diff --git a/modules/security/sudo.nix b/modules/security/sudo.nix index 5c79eaf..6623b71 100644 --- a/modules/security/sudo.nix +++ b/modules/security/sudo.nix @@ -1,7 +1,75 @@ +{ pkgs, lib, ... }: +let + inherit (lib.modules) mkForce; +in { - security.sudo = { - enable = true; - execWheelOnly = true; - wheelNeedsPassword = false; + security = { + sudo-rs.enable = mkForce false; + + sudo = { + enable = true; + execWheelOnly = mkForce true; + wheelNeedsPassword = lib.modules.mkDefault false; + + extraConfig = '' + Defaults lecture = never + Defaults pwfeedback + Defaults env_keep += "EDITOR PATH DISPLAY" + Defaults timestamp_timeout = 300 + ''; + + extraRules = [ + { + groups = [ "wheel" ]; + commands = + map + (rule: { + command = lib.meta.getExe' rule.package rule.command; + options = [ "NOPASSWD" ]; + }) + ( + with pkgs; + [ + { + package = coreutils; + command = "sync"; + } + { + package = hdparm; + command = "hdparm"; + } + { + package = nixos-rebuild; + command = "nixos-rebuild"; + } + { + package = nvme-cli; + command = "nvme"; + } + { + package = systemd; + command = "poweroff"; + } + { + package = systemd; + command = "reboot"; + } + { + package = systemd; + command = "shutdown"; + } + { + package = systemd; + command = "systemctl"; + } + { + package = util-linux; + command = "dmesg"; + } + ] + ); + } + ]; + }; }; } diff --git a/modules/security/tpm.nix b/modules/security/tpm.nix deleted file mode 100644 index 3277d9f..0000000 --- a/modules/security/tpm.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ pkgs, ... }: -{ - security.tpm2 = { - enable = true; - applyUdevRules = true; - abrmd.enable = true; - tctiEnvironment.enable = true; - pkcs11.enable = true; - }; - - environment.systemPackages = with pkgs; [ - tpm2-tools - tpm2-tss - tpm2-abrmd - ]; -} diff --git a/modules/services/ananicy.nix b/modules/services/ananicy.nix deleted file mode 100644 index bdc9bbd..0000000 --- a/modules/services/ananicy.nix +++ /dev/null @@ -1,8 +0,0 @@ -{ pkgs, ... }: -{ - services.ananicy = { - enable = false; - package = pkgs.ananicy-cpp; - rulesProvider = pkgs.ananicy-rules-cachyos; - }; -} diff --git a/modules/services/dbus.nix b/modules/services/dbus.nix deleted file mode 100644 index d67ed2b..0000000 --- a/modules/services/dbus.nix +++ /dev/null @@ -1,11 +0,0 @@ -{ - services.dbus = { - enable = true; - implementation = "broker"; - - # packages = [ - # # pkgs.flatpak - # pkgs.xdg-desktop-portal - # ]; - }; -} diff --git a/modules/services/default.nix b/modules/services/default.nix deleted file mode 100644 index adc5d0b..0000000 --- a/modules/services/default.nix +++ /dev/null @@ -1,31 +0,0 @@ -{ pkgs, ... }: -{ - imports = [ - ./ananicy.nix - ./dbus.nix - ./fail2ban.nix - ./libinput.nix - ./ollama.nix - ./openntpd.nix - ./openssh.nix - ./pia.nix - ./pipewire.nix - ./resolved.nix - ./tor.nix - # ./wireplumber.nix - ./xserver.nix - ]; - - services = { - printing.enable = false; - gnome.gnome-keyring.enable = true; - fstrim.enable = true; - gvfs.enable = true; - udev.packages = with pkgs; [ pkgs.logitech-udev-rules ]; - thermald.enable = true; - chrony.enable = false; - timesyncd.enable = true; - irqbalance.enable = true; - tailscale.enable = true; - }; -} diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix deleted file mode 100644 index fa45565..0000000 --- a/modules/services/fail2ban.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ lib, config, ... }: -{ - services.fail2ban = { - enable = false; - - ignoreIP = [ - "10.0.0.0/8" - "172.16.0.0/12" - "192.168.0.0/16" - ]; - - jails.sshd.settings = { - enabled = true; - filter = "sshd[mode=aggressive]"; - port = lib.strings.concatStringsSep "," (map toString config.services.openssh.ports); - }; - }; -} diff --git a/modules/services/libinput.nix b/modules/services/libinput.nix deleted file mode 100644 index 643f814..0000000 --- a/modules/services/libinput.nix +++ /dev/null @@ -1,13 +0,0 @@ -{ - services.libinput = { - enable = true; - - mouse = { - accelProfile = "flat"; - }; - - touchpad = { - accelProfile = "flat"; - }; - }; -} diff --git a/modules/services/ollama.nix b/modules/services/ollama.nix deleted file mode 100644 index 2638d12..0000000 --- a/modules/services/ollama.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - services.ollama = { - enable = false; - acceleration = "cuda"; - }; -} diff --git a/modules/services/openntpd.nix b/modules/services/openntpd.nix deleted file mode 100644 index ebd148d..0000000 --- a/modules/services/openntpd.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ - services.openntpd = { - enable = true; - - extraConfig = '' - listen on 127.0.0.1 - listen on ::1 - ''; - }; -} diff --git a/modules/services/openssh.nix b/modules/services/openssh.nix deleted file mode 100644 index 8bab2a4..0000000 --- a/modules/services/openssh.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ - services.openssh = { - enable = true; - ports = [ 22 ]; - openFirewall = false; - - settings = { - KexAlgorithms = [ - "curve25519-sha256" - "curve25519-sha256@libssh.org" - "diffie-hellman-group16-sha512" - "diffie-hellman-group18-sha512" - "diffie-hellman-group-exchange-sha256" - "sntrup761x25519-sha512@openssh.com" - ]; - - Macs = [ - "hmac-sha2-512-etm@openssh.com" - "hmac-sha2-256-etm@openssh.com" - "umac-128-etm@openssh.com" - ]; - }; - }; -} diff --git a/modules/services/pia.nix b/modules/services/pia.nix deleted file mode 100644 index d52dbf8..0000000 --- a/modules/services/pia.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ secrets, ... }: -{ - services.pia = { - enable = true; - - authUserPass = { - inherit (secrets.pia) username password; - }; - }; -} diff --git a/modules/services/pipewire.nix b/modules/services/pipewire.nix deleted file mode 100644 index 4e914a1..0000000 --- a/modules/services/pipewire.nix +++ /dev/null @@ -1,165 +0,0 @@ -# { lib, ... }: -# let -# inherit (lib.modules) mkBefore; -# inherit (lib.lists) singleton; -# inherit (builtins) toString; - -# mapOptionDefault = lib.attrsets.mapAttrs (_: lib.modules.mkOptionDefault); -# quantum = toString 64; -# rate = toString 48000; -# qr = "${quantum}/${rate}"; -# in -{ - services.pipewire = { - enable = true; - wireplumber.enable = true; - jack.enable = true; - pulse.enable = true; - audio.enable = true; - - alsa = { - enable = true; - support32Bit = true; - }; - - extraConfig = { - pipewire = { - "10-logging" = { - "context.properties"."log.level" = 3; - }; - - # "10-defaults" = { - # "context.properties" = mapOptionDefault { - # "clock.power-of-two-quantum" = true; - # "core.daemon" = true; - # "core.name" = "pipewire-0"; - # "link.max-buffers" = 16; - # "settings.check-quantum" = true; - # }; - - # "context.spa-libs" = mapOptionDefault { - # "audio.convert.*" = "audioconvert/libspa-audioconvert"; - # "avb.*" = "avb/libspa-avb"; - # "api.alsa.*" = "alsa/libspa-alsa"; - # "api.v4l2.*" = "v4l2/libspa-v4l2"; - # "api.libcamera.*" = "libcamera/libspa-libcamera"; - # "api.bluez5.*" = "bluez5/libspa-bluez5"; - # "api.vulkan.*" = "vulkan/libspa-vulkan"; - # "api.jack.*" = "jack/libspa-jack"; - # "support.*" = "support/libspa-support"; - # "video.convert.*" = "videoconvert/libspa-videoconvert"; - # }; - # }; - }; - - # pipewire-pulse = { - # "10-defaults" = { - # "context.spa-libs" = mapOptionDefault { - # "audio.convert.*" = "audioconvert/libspa-audioconvert"; - # "support.*" = "support/libspa-support"; - # }; - - # "pulse.cmd" = mkBefore [ - # { - # cmd = "load-module"; - # args = "module-always-sink"; - # flags = [ ]; - # } - # ]; - - # "pulse.properties" = { - # "server.address" = mkBefore [ "unix:native" ]; - # }; - - # "pulse.rules" = mkBefore [ - # { - # matches = [ - # { "application.process.binary" = "teams"; } - # { "application.process.binary" = "teams-insiders"; } - # { "application.process.binary" = "skypeforlinux"; } - # ]; - - # actions.quirks = [ "force-s16-info" ]; - # } - # { - # matches = singleton { "application.process.binary" = "firefox"; }; - # actions.quirks = [ "remove-capture-dont-move" ]; - # } - # { - # matches = singleton { "application.name" = "~speech-dispatcher*"; }; - - # actions = { - # update-props = { - # "pulse.min.req" = "1024/48000"; # 21 milliseconds - # "pulse.min.quantum " = "1024/48000"; # 21 milliseconds - # }; - # }; - # } - # ]; - # }; - # }; - - # pipewire."92-low-latency" = { - # "context.properties" = { - # "default.clock.rate" = rate; - # "default.clock.quantum" = quantum; - # "default.clock.min-quantum" = quantum; - # "default.clock.max-quantum" = quantum; - # "default.clock.allowed-rates" = [ rate ]; - # }; - - # # "context.modules" = [ - # # { - # # name = "libpipewire-module-rtkit"; - - # # flags = [ - # # "ifexists" - # # "nofail" - # # ]; - - # # args = { - # # "nice.level" = -15; - # # "rt.prio" = 90; - # # "rt.time.soft" = 200000; - # # "rt.time.hard" = 200000; - # # }; - # # } - # # { - # # name = "libpipewire-module-protocol-pulse"; - - # # args = { - # # "server.address" = [ "unix:native" ]; - # # "pulse.min.quantum" = qr; - # # "pulse.min.req" = qr; - # # "pulse.min.frag" = qr; - # # }; - # # } - # # ]; - - # "stream.properties" = { - # "node.latency" = qr; - # "resample.quality" = 1; - # }; - # }; - - # pipewire-pulse."92-low-latency" = { - # "context.modules" = singleton { - # name = "libpipewire-module-protocol-pulse"; - - # args = { - # "pulse.min.req" = qr; - # "pulse.default.req" = qr; - # "pulse.max.req" = qr; - # "pulse.min.quantum" = qr; - # "pulse.max.quantum" = qr; - # }; - # }; - - # "stream.properties" = { - # "node.latency" = qr; - # "resample.quality" = 4; - # }; - # }; - }; - }; -} diff --git a/modules/services/resolved.nix b/modules/services/resolved.nix deleted file mode 100644 index 632ca7a..0000000 --- a/modules/services/resolved.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ - services.resolved = { - enable = true; - dnssec = "true"; - domains = [ "~." ]; - dnsovertls = "true"; - - fallbackDns = [ - "1.1.1.1#one.one.one.one" - "1.0.0.1#one.one.one.one" - "9.9.9.9#dns.quad9.net" - "149.112.112.112#dns.quad9.net" - ]; - }; -} diff --git a/modules/services/tor.nix b/modules/services/tor.nix deleted file mode 100644 index 3e3831f..0000000 --- a/modules/services/tor.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - services.tor = { - enable = true; - client.enable = true; - }; -} diff --git a/modules/services/wireplumber.nix b/modules/services/wireplumber.nix deleted file mode 100644 index 970396f..0000000 --- a/modules/services/wireplumber.nix +++ /dev/null @@ -1,42 +0,0 @@ -let - rate = builtins.toString 48000; -in -{ - services.pipewire.wireplumber = { - enable = true; - - extraConfig = { - "10-log-level-debug" = { - "context.properties"."log.level" = "D"; - }; - - "10-default-volume" = { - "wireplumber.settings"."device.routes.default-sink-volume" = 1.0; - }; - - "92-low-latency" = { - "monitor.alsa.rules" = [ - { - matches = [ - { "device.name" = "~alsa_card.*"; } - { "node.name" = "~alsa_output.*"; } - ]; - - actions.update-props = { - "node.description" = "ALSA Low Latency Output"; - "audio.rate" = rate; - "audio.format" = "S32LE"; - "resample.quality" = 4; - "resample.disable" = false; - "session.suspend-timeout-seconds" = 0; - "api.alsa.period-size" = 2; - "api.alsa.headroom" = 128; - "api.alsa.period-num" = 2; - "api.alsa.disable-batch" = false; - }; - } - ]; - }; - }; - }; -} diff --git a/modules/services/xserver.nix b/modules/services/xserver.nix deleted file mode 100644 index e08ac04..0000000 --- a/modules/services/xserver.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ - services.xserver = { - xkb.layout = "us"; - videoDrivers = [ "nvidia" ]; - }; -} diff --git a/modules/system.nix b/modules/system.nix deleted file mode 100644 index 9ba445e..0000000 --- a/modules/system.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ - system = { - autoUpgrade.enable = false; - - switch = { - enable = false; - enableNg = true; - }; - }; -} diff --git a/modules/system/access/default.nix b/modules/system/access/default.nix new file mode 100644 index 0000000..7db7629 --- /dev/null +++ b/modules/system/access/default.nix @@ -0,0 +1,7 @@ +{ + imports = [ + ./gnupg.nix + ./mosh.nix + ./ssh.nix + ]; +} diff --git a/modules/system/access/gnupg.nix b/modules/system/access/gnupg.nix new file mode 100644 index 0000000..aeffb23 --- /dev/null +++ b/modules/system/access/gnupg.nix @@ -0,0 +1,16 @@ +{ pkgs, ... }: +{ + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + pinentryPackage = pkgs.pinentry-curses; + + settings = { + enable-ssh-support = ""; + ttyname = "$GPG_TTY"; + default-cache-ttl = 34560000; # 60 + max-cache-ttl = 34560000; # 120 + allow-loopback-pinentry = ""; + }; + }; +} diff --git a/modules/system/access/mosh.nix b/modules/system/access/mosh.nix new file mode 100644 index 0000000..c9af5bf --- /dev/null +++ b/modules/system/access/mosh.nix @@ -0,0 +1,6 @@ +{ + programs.mosh = { + enable = true; + openFirewall = false; + }; +} diff --git a/modules/system/access/ssh.nix b/modules/system/access/ssh.nix new file mode 100644 index 0000000..b1fc187 --- /dev/null +++ b/modules/system/access/ssh.nix @@ -0,0 +1,26 @@ +{ + programs.ssh.startAgent = false; + + services.openssh = { + enable = true; + ports = [ 22 ]; + openFirewall = false; + + settings = { + KexAlgorithms = [ + "curve25519-sha256" + "curve25519-sha256@libssh.org" + "diffie-hellman-group16-sha512" + "diffie-hellman-group18-sha512" + "diffie-hellman-group-exchange-sha256" + "sntrup761x25519-sha512@openssh.com" + ]; + + Macs = [ + "hmac-sha2-512-etm@openssh.com" + "hmac-sha2-256-etm@openssh.com" + "umac-128-etm@openssh.com" + ]; + }; + }; +} diff --git a/modules/system/boot/default.nix b/modules/system/boot/default.nix new file mode 100644 index 0000000..9a517ef --- /dev/null +++ b/modules/system/boot/default.nix @@ -0,0 +1,32 @@ +{ + pkgs, + config, + ... +}: +{ + imports = [ + ./grub.nix + ./systemd-boot.nix + ]; + + boot = { + crashDump.enable = false; + consoleLogLevel = 3; + kernelPackages = pkgs.linuxPackages_zen; + + kernelParams = [ + "iommu=pt" + "threadirqs" + ]; + + loader = { + timeout = 5; + generationsDir.copyKernels = true; + + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + }; + }; +} diff --git a/modules/system/boot/grub.nix b/modules/system/boot/grub.nix new file mode 100644 index 0000000..49e0eef --- /dev/null +++ b/modules/system/boot/grub.nix @@ -0,0 +1,32 @@ +{ pkgs, ... }: +{ + boot.loader.grub = { + enable = true; + device = "nodev"; + efiSupport = true; + useOSProber = true; + configurationLimit = 10; + memtest86.enable = true; + gfxmodeEfi = "1920x1080x32"; + gfxmodeBios = "1920x1080x32"; + gfxpayloadBios = "keep"; + gfxpayloadEfi = "keep"; + splashMode = "normal"; + + # extraEntries = '' + # menuentry "Arch Linux (linux-clear)" { + # linux /vmlinuz-linux-clear + # initrd /amd-ucode.img + # initrd /booster-linux-clear.img + # options root=PARTUUID=f510f35d-76a0-4469-aad5-da449541ecd2 rootflags=subvol=@ rw rootfstype=btrfs psi=1 nvidia_drm.modeset=1 + # } + # ''; + + theme = pkgs.fetchFromGitHub { + owner = "Lxtharia"; + repo = "minegrub-theme"; + rev = "193b3a7c3d432f8c6af10adfb465b781091f56b3"; + sha256 = "1bvkfmjzbk7pfisvmyw5gjmcqj9dab7gwd5nmvi8gs4vk72bl2ap"; + }; + }; +} diff --git a/modules/system/boot/systemd-boot.nix b/modules/system/boot/systemd-boot.nix new file mode 100644 index 0000000..5b50bad --- /dev/null +++ b/modules/system/boot/systemd-boot.nix @@ -0,0 +1,10 @@ +{ + boot.loader.systemd-boot = { + enable = false; + editor = true; + consoleMode = "max"; + memtest86.enable = true; + netbootxyz.enable = true; + configurationLimit = 10; + }; +} diff --git a/modules/system/datetime/datetime.nix b/modules/system/datetime/datetime.nix new file mode 100644 index 0000000..7451fa2 --- /dev/null +++ b/modules/system/datetime/datetime.nix @@ -0,0 +1,33 @@ +{ pkgs, ... }: +{ + time.timeZone = "America/Los_Angeles"; + location.provider = "geoclue2"; + + services = { + chrony.enable = false; + timesyncd.enable = true; + }; + + i18n = { + defaultLocale = "en_US.UTF-8"; + + inputMethod = { + enable = true; + type = "fcitx5"; + + fcitx5 = { + waylandFrontend = true; + + addons = with pkgs; [ + fcitx5-configtool + fcitx5-gtk + fcitx5-hangul + fcitx5-mozc + fcitx5-rime + rime-data + catppuccin-fcitx5 + ]; + }; + }; + }; +} diff --git a/modules/system/datetime/default.nix b/modules/system/datetime/default.nix new file mode 100644 index 0000000..97ba4c8 --- /dev/null +++ b/modules/system/datetime/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./datetime.nix + ./openntpd.nix + ]; +} diff --git a/modules/system/datetime/openntpd.nix b/modules/system/datetime/openntpd.nix new file mode 100644 index 0000000..ec59d5b --- /dev/null +++ b/modules/system/datetime/openntpd.nix @@ -0,0 +1,13 @@ +{ pkgs, ... }: +{ + services.openntpd = { + enable = true; + + extraConfig = '' + listen on 127.0.0.1 + listen on ::1 + ''; + }; + + environment.systemPackages = [ pkgs.openntpd ]; +} diff --git a/modules/system/default.nix b/modules/system/default.nix new file mode 100644 index 0000000..cdef99d --- /dev/null +++ b/modules/system/default.nix @@ -0,0 +1,24 @@ +{ + imports = [ + ./access + ./boot + ./datetime + ./desktop + ./networking + ./services + ./encryption.nix + ./programs.nix + ./systemd.nix + ./users.nix + ./variables.nix + ]; + + system = { + autoUpgrade.enable = false; + + switch = { + enable = false; + enableNg = true; + }; + }; +} diff --git a/modules/system/desktop/default.nix b/modules/system/desktop/default.nix new file mode 100644 index 0000000..bd2c811 --- /dev/null +++ b/modules/system/desktop/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./gtk.nix + ./xdg-portal.nix + ]; +} diff --git a/modules/system/desktop/gtk.nix b/modules/system/desktop/gtk.nix new file mode 100644 index 0000000..4357e75 --- /dev/null +++ b/modules/system/desktop/gtk.nix @@ -0,0 +1,8 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + gtk2 + gtk3 + gtk4 + ]; +} diff --git a/modules/system/desktop/xdg-portal.nix b/modules/system/desktop/xdg-portal.nix new file mode 100644 index 0000000..72bcb97 --- /dev/null +++ b/modules/system/desktop/xdg-portal.nix @@ -0,0 +1,15 @@ +{ pkgs, ... }: +{ + xdg.portal = { + enable = true; + config.common.default = "*"; + # wlr.enable = true; + # xdgOpenUsePortal = true; + + extraPortals = with pkgs; [ + xdg-desktop-portal-wlr + xdg-desktop-portal-gtk + xdg-desktop-portal-gnome + ]; + }; +} diff --git a/modules/system/encryption.nix b/modules/system/encryption.nix new file mode 100644 index 0000000..53a24bb --- /dev/null +++ b/modules/system/encryption.nix @@ -0,0 +1,16 @@ +{ + boot = { + initrd.availableKernelModules = [ + # "aesni_intel" + # "cryptd" + "usb_storage" + ]; + + # + kernelParams = [ + "luks.options=timeout=0" + "rd.luks.options=timeout=0" + "rootflags=x-systemd.device-timeout=0" + ]; + }; +} diff --git a/modules/system/networking/default.nix b/modules/system/networking/default.nix new file mode 100644 index 0000000..96f89d0 --- /dev/null +++ b/modules/system/networking/default.nix @@ -0,0 +1,33 @@ +{ + imports = [ + ./vpn + ./dhcpcd.nix + ./fail2ban.nix + ./firewall.nix + ./ipv6.nix + ./loopback.nix + ./networkmanager.nix + ./optimise.nix + ./resolved.nix + ./tor.nix + ]; + + networking = { + hostName = "kansai"; + nftables.enable = true; + + nameservers = [ + "1.1.1.1#one.one.one.one" + "1.0.0.1#one.one.one.one" + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + ]; + + timeServers = [ + "0.nixos.pool.ntp.org" + "1.nixos.pool.ntp.org" + "2.nixos.pool.ntp.org" + "3.nixos.pool.ntp.org" + ]; + }; +} diff --git a/modules/system/networking/dhcpcd.nix b/modules/system/networking/dhcpcd.nix new file mode 100644 index 0000000..99ac0f3 --- /dev/null +++ b/modules/system/networking/dhcpcd.nix @@ -0,0 +1,6 @@ +{ + networking.dhcpcd = { + wait = "background"; + extraConfig = "noarp"; + }; +} diff --git a/modules/system/networking/fail2ban.nix b/modules/system/networking/fail2ban.nix new file mode 100644 index 0000000..fa45565 --- /dev/null +++ b/modules/system/networking/fail2ban.nix @@ -0,0 +1,18 @@ +{ lib, config, ... }: +{ + services.fail2ban = { + enable = false; + + ignoreIP = [ + "10.0.0.0/8" + "172.16.0.0/12" + "192.168.0.0/16" + ]; + + jails.sshd.settings = { + enabled = true; + filter = "sshd[mode=aggressive]"; + port = lib.strings.concatStringsSep "," (map toString config.services.openssh.ports); + }; + }; +} diff --git a/modules/system/networking/firewall.nix b/modules/system/networking/firewall.nix new file mode 100644 index 0000000..569089c --- /dev/null +++ b/modules/system/networking/firewall.nix @@ -0,0 +1,12 @@ +{ + networking.firewall = { + enable = true; + allowedUDPPorts = [ 53 ]; + allowPing = false; + + allowedTCPPorts = [ + 80 + 443 + ]; + }; +} diff --git a/modules/system/networking/ipv6.nix b/modules/system/networking/ipv6.nix new file mode 100644 index 0000000..274c1ae --- /dev/null +++ b/modules/system/networking/ipv6.nix @@ -0,0 +1,9 @@ +{ + boot.kernel.sysctl = { + "net.ipv6.conf.enp42s0.disable_ipv6" = true; + "net.ipv6.conf.wlp4s0.disable_ipv6" = true; + "net.ipv6.conf.tun0.disable_ipv6" = true; + }; + + networking.enableIPv6 = false; +} diff --git a/modules/system/networking/loopback.nix b/modules/system/networking/loopback.nix new file mode 100644 index 0000000..62e745e --- /dev/null +++ b/modules/system/networking/loopback.nix @@ -0,0 +1,7 @@ +{ config, ... }: +{ + boot = { + kernelModules = [ "v4l2loopback" ]; + extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ]; + }; +} diff --git a/modules/system/networking/networkmanager.nix b/modules/system/networking/networkmanager.nix new file mode 100644 index 0000000..e5fdfc1 --- /dev/null +++ b/modules/system/networking/networkmanager.nix @@ -0,0 +1,22 @@ +{ pkgs, ... }: +{ + environment.systemPackages = [ pkgs.networkmanagerapplet ]; + + networking.networkmanager = { + enable = true; + plugins = [ pkgs.networkmanager-openvpn ]; + dns = "systemd-resolved"; + wifi.backend = "iwd"; + + unmanaged = [ + "interface-name:tailscale*" + "interface-name:br-*" + "interface-name:rndis*" + "interface-name:docker*" + "interface-name:virbr*" + "interface-name:vboxnet*" + "interface-name:waydroid*" + "type:bridge" + ]; + }; +} diff --git a/modules/system/networking/optimise.nix b/modules/system/networking/optimise.nix new file mode 100644 index 0000000..c6f2bec --- /dev/null +++ b/modules/system/networking/optimise.nix @@ -0,0 +1,73 @@ +{ + boot = { + kernelModules = [ + "tls" + "tcp_bbr" + ]; + + kernel.sysctl = { + # TCP hardening + # Prevent bogus ICMP errors from filling up logs. + "net.ipv4.icmp_ignore_bogus_error_responses" = 1; + # Reverse path filtering causes the kernel to do source validation of + # packets received from all interfaces. This can mitigate IP spoofing. + "net.ipv4.conf.default.rp_filter" = 1; + "net.ipv4.conf.all.rp_filter" = 1; + # Do not accept IP source route packets (we're not a router) + "net.ipv4.conf.all.accept_source_route" = 0; + "net.ipv6.conf.all.accept_source_route" = 0; + # Don't send ICMP redirects (again, we're on a router) + "net.ipv4.conf.all.send_redirects" = 0; + "net.ipv4.conf.default.send_redirects" = 0; + # Refuse ICMP redirects (MITM mitigations) + "net.ipv4.conf.all.accept_redirects" = 0; + "net.ipv4.conf.default.accept_redirects" = 0; + "net.ipv4.conf.all.secure_redirects" = 0; + "net.ipv4.conf.default.secure_redirects" = 0; + "net.ipv6.conf.all.accept_redirects" = 0; + "net.ipv6.conf.default.accept_redirects" = 0; + # Protects against SYN flood attacks + "net.ipv4.tcp_syncookies" = 1; + # Incomplete protection again TIME-WAIT assassination + "net.ipv4.tcp_rfc1337" = 1; + # And other stuff + "net.ipv4.conf.all.log_martians" = true; + "net.ipv4.conf.default.log_martians" = true; + "net.ipv4.icmp_echo_ignore_broadcasts" = true; + "net.ipv6.conf.default.accept_ra" = 0; + "net.ipv6.conf.all.accept_ra" = 0; + "net.ipv4.tcp_timestamps" = 0; + + # TCP optimization + # TCP Fast Open is a TCP extension that reduces network latency by packing + # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for + # both incoming and outgoing connections: + "net.ipv4.tcp_fastopen" = 3; + # Bufferbloat mitigations + slight improvement in throughput & latency + "net.ipv4.tcp_congestion_control" = "bbr"; + "net.core.default_qdisc" = "cake"; + + # Other stuff that I am too lazy to document + "net.core.optmem_max" = 65536; + "net.core.rmem_default" = 1048576; + "net.core.rmem_max" = 16777216; + "net.core.somaxconn" = 8192; + "net.core.wmem_default" = 1048576; + "net.core.wmem_max" = 16777216; + "net.ipv4.ip_local_port_range" = "16384 65535"; + "net.ipv4.tcp_max_syn_backlog" = 8192; + "net.ipv4.tcp_max_tw_buckets" = 2000000; + "net.ipv4.tcp_mtu_probing" = 1; + "net.ipv4.tcp_rmem" = "4096 1048576 2097152"; + "net.ipv4.tcp_slow_start_after_idle" = 0; + "net.ipv4.tcp_tw_reuse" = 1; + "net.ipv4.tcp_wmem" = "4096 65536 16777216"; + "net.ipv4.udp_rmem_min" = 8192; + "net.ipv4.udp_wmem_min" = 8192; + "net.netfilter.nf_conntrack_generic_timeout" = 60; + "net.netfilter.nf_conntrack_max" = 1048576; + "net.netfilter.nf_conntrack_tcp_timeout_established" = 600; + "net.netfilter.nf_conntrack_tcp_timeout_time_wait" = 1; + }; + }; +} diff --git a/modules/system/networking/resolved.nix b/modules/system/networking/resolved.nix new file mode 100644 index 0000000..632ca7a --- /dev/null +++ b/modules/system/networking/resolved.nix @@ -0,0 +1,15 @@ +{ + services.resolved = { + enable = true; + dnssec = "true"; + domains = [ "~." ]; + dnsovertls = "true"; + + fallbackDns = [ + "1.1.1.1#one.one.one.one" + "1.0.0.1#one.one.one.one" + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + ]; + }; +} diff --git a/modules/system/networking/tor.nix b/modules/system/networking/tor.nix new file mode 100644 index 0000000..3e3831f --- /dev/null +++ b/modules/system/networking/tor.nix @@ -0,0 +1,6 @@ +{ + services.tor = { + enable = true; + client.enable = true; + }; +} diff --git a/modules/system/networking/vpn/default.nix b/modules/system/networking/vpn/default.nix new file mode 100644 index 0000000..92a11b0 --- /dev/null +++ b/modules/system/networking/vpn/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./pia.nix + ./tailscale.nix + ]; +} diff --git a/modules/system/networking/vpn/pia.nix b/modules/system/networking/vpn/pia.nix new file mode 100644 index 0000000..d52dbf8 --- /dev/null +++ b/modules/system/networking/vpn/pia.nix @@ -0,0 +1,10 @@ +{ secrets, ... }: +{ + services.pia = { + enable = true; + + authUserPass = { + inherit (secrets.pia) username password; + }; + }; +} diff --git a/modules/system/networking/vpn/tailscale.nix b/modules/system/networking/vpn/tailscale.nix new file mode 100644 index 0000000..5d51594 --- /dev/null +++ b/modules/system/networking/vpn/tailscale.nix @@ -0,0 +1,4 @@ +{ + services.tailscale.enable = true; + networking.firewall.trustedInterfaces = [ "tailscale0" ]; +} diff --git a/modules/system/programs.nix b/modules/system/programs.nix new file mode 100644 index 0000000..8a856d5 --- /dev/null +++ b/modules/system/programs.nix @@ -0,0 +1,21 @@ +{ pkgs, ... }: +{ + programs = { + fish.enable = true; + mtr.enable = true; + dconf.enable = true; + ccache.enable = true; + + bash.interactiveShellInit = '' + export HISTFILE="$XDG_STATE_HOME/bash/history" + ''; + }; + + environment.systemPackages = with pkgs; [ + vim + wget + git + pinentry + runc + ]; +} diff --git a/modules/system/services/ananicy.nix b/modules/system/services/ananicy.nix new file mode 100644 index 0000000..bdc9bbd --- /dev/null +++ b/modules/system/services/ananicy.nix @@ -0,0 +1,8 @@ +{ pkgs, ... }: +{ + services.ananicy = { + enable = false; + package = pkgs.ananicy-cpp; + rulesProvider = pkgs.ananicy-rules-cachyos; + }; +} diff --git a/modules/system/services/dbus.nix b/modules/system/services/dbus.nix new file mode 100644 index 0000000..d67ed2b --- /dev/null +++ b/modules/system/services/dbus.nix @@ -0,0 +1,11 @@ +{ + services.dbus = { + enable = true; + implementation = "broker"; + + # packages = [ + # # pkgs.flatpak + # pkgs.xdg-desktop-portal + # ]; + }; +} diff --git a/modules/system/services/default.nix b/modules/system/services/default.nix new file mode 100644 index 0000000..44436bd --- /dev/null +++ b/modules/system/services/default.nix @@ -0,0 +1,20 @@ +{ pkgs, ... }: +{ + imports = [ + ./ananicy.nix + ./dbus.nix + ./libinput.nix + ./ollama.nix + ./xserver.nix + ]; + + services = { + printing.enable = false; + gnome.gnome-keyring.enable = true; + fstrim.enable = true; + gvfs.enable = true; + udev.packages = with pkgs; [ pkgs.logitech-udev-rules ]; + thermald.enable = true; + irqbalance.enable = true; + }; +} diff --git a/modules/system/services/libinput.nix b/modules/system/services/libinput.nix new file mode 100644 index 0000000..643f814 --- /dev/null +++ b/modules/system/services/libinput.nix @@ -0,0 +1,13 @@ +{ + services.libinput = { + enable = true; + + mouse = { + accelProfile = "flat"; + }; + + touchpad = { + accelProfile = "flat"; + }; + }; +} diff --git a/modules/system/services/ollama.nix b/modules/system/services/ollama.nix new file mode 100644 index 0000000..2638d12 --- /dev/null +++ b/modules/system/services/ollama.nix @@ -0,0 +1,6 @@ +{ + services.ollama = { + enable = false; + acceleration = "cuda"; + }; +} diff --git a/modules/system/services/xserver.nix b/modules/system/services/xserver.nix new file mode 100644 index 0000000..e08ac04 --- /dev/null +++ b/modules/system/services/xserver.nix @@ -0,0 +1,6 @@ +{ + services.xserver = { + xkb.layout = "us"; + videoDrivers = [ "nvidia" ]; + }; +} diff --git a/modules/system/systemd.nix b/modules/system/systemd.nix new file mode 100644 index 0000000..9ecb5b2 --- /dev/null +++ b/modules/system/systemd.nix @@ -0,0 +1,11 @@ +{ pkgs, ... }: +{ + # boot.initrd.systemd.enable = true; + + systemd.services.containerd.path = with pkgs; [ + containerd + runc + iptables + nvidia-docker + ]; +} diff --git a/modules/system/users.nix b/modules/system/users.nix new file mode 100644 index 0000000..4055353 --- /dev/null +++ b/modules/system/users.nix @@ -0,0 +1,42 @@ +{ pkgs, ... }: +let + initialPassword = "123456"; +in +{ + users.users = { + root = { + inherit initialPassword; + + shell = pkgs.bash; + }; + + ebisu = { + inherit initialPassword; + + isNormalUser = true; + shell = pkgs.fish; + + extraGroups = [ + "wheel" + "systemd-journal" + "audio" + "video" + "input" + "plugdev" + "lp" + "tss" + "power" + "nix" + "network" + "networkmanager" + "wireshark" + "mysql" + "docker" + "podman" + "git" + "libvirtd" + "kvm" + ]; + }; + }; +} diff --git a/modules/system/variables.nix b/modules/system/variables.nix new file mode 100644 index 0000000..7e9b794 --- /dev/null +++ b/modules/system/variables.nix @@ -0,0 +1,74 @@ +{ + environment.variables = { + # OpenGL + __GL_GSYNC_ALLOWED = "1"; + __GL_VRR_ALLOWED = "0"; + __GL_MaxFramesAllowed = "1"; + + # Java + _JAVA_AWT_WM_NONREPARENTING = "1"; + + # Qt + QT_AUTO_SCREEN_SCALE_FACTOR = "1"; + QT_WAYLAND_DISABLE_WINDOWDECORATION = "1"; + QT_QPA_PLATFORM = "wayland;xcb"; + DISABLE_QT5_COMPAT = "0"; + DISABLE_QT_COMPAT = "0"; + QT_QPA_PLATFORMTHEME = "qt5ct"; + # QT_STYLE_OVERRIDE = "kvantum"; + + # Electron + # ELECTRON_OZONE_PLATFORM_HINT = "auto"; + # OZONE_PLATFORM = "wayland"; + NIXOS_OZONE_WL = "1"; + + # Proton + PROTON_ENABLE_NGX_UPDATER = "1"; + + # wlroots + WLR_NO_HARDWARE_CURSORS = "1"; + WLR_DRM_NO_ATOMIC = "1"; + WLR_USE_LIBINPUT = "1"; + WLR_RENDERER_ALLOW_SOFTWARE = "1"; + WLR_DRM_DEVICES = "/dev/dri/card0"; + WLR_EGL_NO_MODIFIERS = "1"; + WLR_BACKEND = "vulkan"; + WLR_RENDERER = "vulkan"; + + # Mozilla + MOZ_ENABLE_WAYLAND = "1"; + MOZ_DISABLE_RDD_SANDBOX = "1"; + + # Nvidia + LIBVA_DRIVER_NAME = "nvidia"; + __GLX_VENDOR_LIBRARY_NAME = "nvidia"; + GBM_BACKEND = "nvidia-drm"; + __VK_LAYER_NV_optimus = "NVIDIA_only"; + __NV_PRIME_RENDER_OFFLOAD = "1"; + NVD_BACKEND = "direct"; + + # Fcitx + # https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland + QT_IM_MODULE = "fcitx"; + XMODIFIERS = "@im=fcitx"; + # GTK_IM_MODULE = "wayland"; + # GTK_IM_MODULE = "fcitx"; + SDL_IM_MODULE = "fcitx"; + GLFW_IM_MODULE = "ibus"; + INPUT_METHOD = "fcitx"; + CUDA_CACHE_PATH = "$XDG_CACHE_HOME/nv"; + + # Other Wayland + GDK_BACKEND = "wayland,x11,*"; + SDL_VIDEODRIVER = "wayland"; + CLUTTER_BACKEND = "wayland"; + XWAYLAND_NO_GLAMOR = "1"; # Gamescope + ANKI_WAYLAND = "1"; + XDG_SESSION_TYPE = "wayland"; + + # Other + GTK_USE_PORTAL = "1"; + DIRENV_LOG_FORMAT = ""; + SSH_AUTH_SOCK = "/run/user/1000/keyring/ssh"; + }; +} diff --git a/modules/users.nix b/modules/users.nix deleted file mode 100644 index 4055353..0000000 --- a/modules/users.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ pkgs, ... }: -let - initialPassword = "123456"; -in -{ - users.users = { - root = { - inherit initialPassword; - - shell = pkgs.bash; - }; - - ebisu = { - inherit initialPassword; - - isNormalUser = true; - shell = pkgs.fish; - - extraGroups = [ - "wheel" - "systemd-journal" - "audio" - "video" - "input" - "plugdev" - "lp" - "tss" - "power" - "nix" - "network" - "networkmanager" - "wireshark" - "mysql" - "docker" - "podman" - "git" - "libvirtd" - "kvm" - ]; - }; - }; -} diff --git a/modules/virtualisation.nix b/modules/virtualisation.nix deleted file mode 100644 index 579a0e2..0000000 --- a/modules/virtualisation.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ pkgs, lib, ... }: -{ - virtualisation = { - docker = { - enable = true; - storageDriver = "btrfs"; - enableOnBoot = false; - liveRestore = true; - enableNvidia = lib.mkForce true; - extraOptions = "--iptables=False"; - - daemon.settings = { - default-runtime = "nvidia"; - # runtimes.nvidia.path = "${pkgs.nvidia-docker}/bin/nvidia-container-runtime"; - experimental = true; - }; - - autoPrune = { - enable = false; - dates = "daily"; - }; - - rootless = { - enable = false; - setSocketVariable = true; - - daemon.settings = { - default-runtime = "nvidia"; - runtimes.nvidia.path = "${pkgs.nvidia-docker}/bin/nvidia-container-runtime"; - experimental = true; - }; - }; - }; - - libvirtd.enable = true; - }; -} diff --git a/modules/virtualisation/default.nix b/modules/virtualisation/default.nix new file mode 100644 index 0000000..765923f --- /dev/null +++ b/modules/virtualisation/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./docker.nix + ./libvirtd.nix + ]; +} diff --git a/modules/virtualisation/docker.nix b/modules/virtualisation/docker.nix new file mode 100644 index 0000000..20ce40a --- /dev/null +++ b/modules/virtualisation/docker.nix @@ -0,0 +1,33 @@ +{ pkgs, lib, ... }: +{ + virtualisation.docker = { + enable = true; + storageDriver = "btrfs"; + enableOnBoot = false; + liveRestore = true; + enableNvidia = lib.mkForce true; + extraOptions = "--iptables=False"; + + daemon.settings = { + default-runtime = "nvidia"; + # runtimes.nvidia.path = "${pkgs.nvidia-docker}/bin/nvidia-container-runtime"; + experimental = true; + }; + + autoPrune = { + enable = false; + dates = "daily"; + }; + + rootless = { + enable = false; + setSocketVariable = true; + + daemon.settings = { + default-runtime = "nvidia"; + runtimes.nvidia.path = "${pkgs.nvidia-docker}/bin/nvidia-container-runtime"; + experimental = true; + }; + }; + }; +} diff --git a/modules/virtualisation/libvirtd.nix b/modules/virtualisation/libvirtd.nix new file mode 100644 index 0000000..4618c46 --- /dev/null +++ b/modules/virtualisation/libvirtd.nix @@ -0,0 +1,26 @@ +{ pkgs, ... }: +{ + boot.extraModprobeConfig = "options kvm_intel nested=1"; + environment.systemPackages = [ pkgs.virt-manager ]; + + virtualisation.libvirtd = { + enable = true; + + qemu = { + package = pkgs.qemu_kvm; + runAsRoot = true; + swtpm.enable = true; + + ovmf = { + enable = true; + + packages = [ + (pkgs.OVMF.override { + secureBoot = true; + tpmSupport = true; + }).fd + ]; + }; + }; + }; +} diff --git a/modules/xdg-portal.nix b/modules/xdg-portal.nix deleted file mode 100644 index 72bcb97..0000000 --- a/modules/xdg-portal.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ pkgs, ... }: -{ - xdg.portal = { - enable = true; - config.common.default = "*"; - # wlr.enable = true; - # xdgOpenUsePortal = true; - - extraPortals = with pkgs; [ - xdg-desktop-portal-wlr - xdg-desktop-portal-gtk - xdg-desktop-portal-gnome - ]; - }; -} -- cgit v1.2.3