disko flash script, new hosts, and other things
This commit is contained in:
Sebastian Moser
@@ -45,7 +45,7 @@
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/FES-BOOT";
|
||||
fsType = "fat32";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
@@ -147,7 +147,7 @@
|
||||
address = "192.168.1.1";
|
||||
interface = "br0";
|
||||
};
|
||||
hostName = "fes";
|
||||
hostName = "fe";
|
||||
nameservers = [ "1.1.1.1" "8.8.8.8" ];
|
||||
};
|
||||
|
||||
324
hosts/ki.nix
Normal file
324
hosts/ki.nix
Normal file
@@ -0,0 +1,324 @@
|
||||
{ lib, secretsDir, pkgs, inputs, unstable, ... }: let
|
||||
|
||||
myobs = pkgs.wrapOBS {
|
||||
plugins = with pkgs.obs-studio-plugins; [
|
||||
obs-ndi
|
||||
obs-teleport
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
in {
|
||||
|
||||
imports = [
|
||||
../common/all.nix
|
||||
../common/nixos.nix
|
||||
../common/building.nix
|
||||
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
inputs.networkmanager.nixosModules.networkmanager
|
||||
inputs.disko.nixosModules.disko
|
||||
../users/me/gui.nix
|
||||
../users/root/default.nix
|
||||
../common/nixos-wayland.nix
|
||||
];
|
||||
services.tailscale.enable = true;
|
||||
programs.nix-ld.enable = true;
|
||||
|
||||
networking.hostName = "mac";
|
||||
networking.firewall.enable = false;
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns = true;
|
||||
publish = {
|
||||
enable = true;
|
||||
addresses = true;
|
||||
domain = true;
|
||||
hinfo = true;
|
||||
userServices = true;
|
||||
workstation = true;
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
8888 # for general usage
|
||||
9999 # for general usage
|
||||
6000 # Xserver
|
||||
6666 # vnc sway
|
||||
5900 # vnc for win VM
|
||||
5901 # vnc
|
||||
5902 # vnc
|
||||
4400 # rdp win VM
|
||||
4401 # ssh for mandroid
|
||||
4402 # random
|
||||
4403 # random
|
||||
4404 # random
|
||||
4405 # clipboard sync
|
||||
];
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
48899 # GoodWe inverter discovery
|
||||
4410 # lan-mouse
|
||||
];
|
||||
|
||||
swapDevices = [ { device = "/swapfile"; } ];
|
||||
|
||||
boot.kernelModules = [ "usbip_core" ];
|
||||
boot.extraModprobeConfig = "options kvm_intel nested=1";
|
||||
|
||||
# to build rpi images
|
||||
boot.binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
];
|
||||
|
||||
virtualisation.libvirtd = {
|
||||
enable = true;
|
||||
qemuOvmf = true;
|
||||
qemuSwtpm = true;
|
||||
#qemuOvmfPackage = pkgs.OVMFFull;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
linuxPackages.usbip
|
||||
helvum
|
||||
passt
|
||||
mount
|
||||
pkgs.hicolor-icon-theme
|
||||
efibootmgr
|
||||
tcpdump
|
||||
];
|
||||
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
# require public key authentication for better security
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "no";
|
||||
|
||||
settings.X11Forwarding = true;
|
||||
|
||||
extraConfig = ''
|
||||
X11UseLocalhost no
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
services.greetd = lib.mkForce {
|
||||
enable = true;
|
||||
settings = rec {
|
||||
terminal.vt = 1;
|
||||
initial_session = let
|
||||
|
||||
newerUnstableSrc = builtins.getFlake "nixpkgs/d0fc30899600b9b3466ddb260fd83deb486c32f1";
|
||||
newerUnstable = import newerUnstableSrc.outPath {};
|
||||
|
||||
mySway = newerUnstable.sway.override {
|
||||
sway-unwrapped = (newerUnstable.sway-unwrapped.overrideAttrs (prev: {
|
||||
/*
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "WillPower3309";
|
||||
repo = "swayfx";
|
||||
rev = "";
|
||||
hash = "";
|
||||
};
|
||||
*/
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "swaywm";
|
||||
repo = "sway";
|
||||
rev = "73c244fb4807a29c6599d42c15e8a8759225b2d6";
|
||||
hash = "sha256-P2w1oRVUNBWajt8jZOxPXvBE29urbrhtORy+lfYqnF8=";
|
||||
};
|
||||
})).override {
|
||||
wlroots = newerUnstable.wlroots.overrideAttrs (prev: {
|
||||
version = "master";
|
||||
src = pkgs.fetchFromGitLab {
|
||||
domain = "gitlab.freedesktop.org";
|
||||
owner = "wlroots";
|
||||
repo = "wlroots";
|
||||
rev = "master";
|
||||
sha256 = "sha256-2FK6FGRpgf/YYqwJST0LVA/pnNRSUDrfrrp6mSwA0Fk=";
|
||||
};
|
||||
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
in {
|
||||
#command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time -d --env WLR_RENDERER_ALLOW_SOFTWARE=1 --cmd sway";
|
||||
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --cmd ${pkgs.writeScriptBin "run-sway" ''
|
||||
export WLR_RENDERER_ALLOW_SOFTWARE=1
|
||||
export SDL_VIDEODRIVER=wayland
|
||||
export _JAVA_AWT_WM_NONREPARENTING=1
|
||||
export QT_QPA_PLATFORM=wayland
|
||||
export XDG_CURRENT_DESKTOP=sway
|
||||
export XDG_SESSION_DESKTOP=sway
|
||||
exec ${pkgs.lib.getExe mySway}
|
||||
''}/bin/run-sway";
|
||||
user = "me";
|
||||
};
|
||||
default_session = initial_session;
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
systemd.extraConfig = "DefaultLimitNOFILE=2048";
|
||||
|
||||
###################################################### the kiosk stuff
|
||||
|
||||
services.dbus.enable = true;
|
||||
|
||||
fonts.enableDefaultPackages = true;
|
||||
xdg.icons.enable = true;
|
||||
gtk.iconCache.enable = true;
|
||||
|
||||
services.udisks2.enable = false;
|
||||
hardware.opengl.enable = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
systemd.defaultUnit = "graphical.target";
|
||||
|
||||
|
||||
############################# networkmanager
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
networking.networkmanager.profiles = {
|
||||
pw = {
|
||||
connection = {
|
||||
id = "pw";
|
||||
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
|
||||
type = "wifi";
|
||||
interface-name = "wlp2s0";
|
||||
};
|
||||
|
||||
wifi = {
|
||||
hidden = "true";
|
||||
mode = "infrastructure";
|
||||
ssid = builtins.readFile "${secretsDir}/wifi-ssid";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
#address1 = "192.168.20.11/24";
|
||||
dns = "1.1.1.1;8.8.8.8;";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
hot = {
|
||||
connection = {
|
||||
id = "hot";
|
||||
uuid = "ab51de8a-9742-465a-928b-be54a83ab6a3";
|
||||
type = "wifi";
|
||||
autoconnect = false;
|
||||
interface-name = "wlp3s0";
|
||||
};
|
||||
wifi = {
|
||||
mode = "ap";
|
||||
ssid = "c2vi-mac";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
method = "shared";
|
||||
};
|
||||
};
|
||||
|
||||
share = {
|
||||
connection = {
|
||||
id = "share";
|
||||
uuid = "f55f34e3-4595-4642-b1f6-df3185bc0a04";
|
||||
type = "ethernet";
|
||||
autoconnect = false;
|
||||
interface-name = "enp2s0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "C8:2A:14:0B:7F:3D";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.4.1/24";
|
||||
method = "shared";
|
||||
};
|
||||
|
||||
ipv6 = {
|
||||
addr-gen-mode = "stable-privacy";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
dhcp = {
|
||||
connection = {
|
||||
id = "dhcp";
|
||||
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
|
||||
type = "ethernet";
|
||||
autoconnect = true;
|
||||
interface-name = "enp2s0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "C8:2A:14:0B:7F:3D";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
method = "auto";
|
||||
address1 = "192.168.1.33/24,192.168.1.1";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
############### disk config
|
||||
boot.plymouth.enable = false;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.efiInstallAsRemovable = true;
|
||||
boot.loader.grub.devices = [ "nodev" ];
|
||||
boot.loader.grub.extraConfig = ''
|
||||
set timeout=2
|
||||
'';
|
||||
|
||||
# the flash drive in use for te
|
||||
#disko.devices.disk.root.device = "/dev/disk/by-id/usb-Generic_Flash_Disk_FF830E8F-0:0";
|
||||
disko.devices.disk.root.device = "/dev/disk/by-id/ata-SSD_HB202408140276168";
|
||||
disko.devices = {
|
||||
disk = {
|
||||
root = {
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
|
||||
ESP = {
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
324
hosts/le.nix
Normal file
324
hosts/le.nix
Normal file
@@ -0,0 +1,324 @@
|
||||
{ lib, pkgs, inputs, secretsDir, config, ... }:
|
||||
{
|
||||
|
||||
#system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
imports = [
|
||||
"${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
|
||||
#inputs.nixos-hardware.nixosModules.raspberry-pi-4
|
||||
inputs.networkmanager.nixosModules.networkmanager
|
||||
|
||||
../common/all.nix
|
||||
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
../users/me/headless.nix
|
||||
|
||||
##### project modules #####
|
||||
|
||||
# the module for the zwave setup
|
||||
#"${workDir}/htl/labor/hackl/zwave.nix"
|
||||
|
||||
# labor nas project
|
||||
# with this moduel it does not boot, it waits for /dev/disk/by-label/nas-storage
|
||||
# "${workDir}/htl/labor/nas/nixos/lush-module.nix"
|
||||
];
|
||||
|
||||
# fix bluetooth
|
||||
hardware = {
|
||||
bluetooth = {
|
||||
package = pkgs.bluez;
|
||||
enable = true;
|
||||
powerOnBoot = true;
|
||||
};
|
||||
};
|
||||
|
||||
# get usbip working
|
||||
boot.extraModulePackages = [
|
||||
config.boot.kernelPackages.usbip
|
||||
];
|
||||
|
||||
|
||||
boot.kernelParams = lib.mkForce ["console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0" "nohibernate" "loglevel=7" ];
|
||||
# hardware.bluetooth.enable = true;
|
||||
|
||||
|
||||
|
||||
# home-manager.users.me = import ../users/me/home-headless.nix;
|
||||
|
||||
|
||||
/* for cross compiling
|
||||
#nixpkgs.hostPlatform.system = "aarch64-linux";
|
||||
#nixpkgs.buildPlatform.system = "x86_64-linux";
|
||||
nixpkgs.overlays = [
|
||||
|
||||
(outerFinal: outerPrev: {
|
||||
#https://github.com/adrienverge/openfortivpn/issues/446
|
||||
#https://github.com/NixOS/nixpkgs/blob/nixos-23.05/pkgs/tools/networking/openfortivpn/default.nix#L47
|
||||
openfortivpn = outerPrev.openfortivpn.overrideAttrs (final: prev: {
|
||||
configureFlags = prev.configureFlags or [] ++ [
|
||||
"--disable-proc"
|
||||
"--with-rt_dst=yes"
|
||||
"--with-pppd=/usr/sbin/pppd"
|
||||
];
|
||||
});
|
||||
})
|
||||
];
|
||||
*/
|
||||
|
||||
services.blueman.enable = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
linuxPackages.usbip
|
||||
vim
|
||||
bluez
|
||||
git
|
||||
];
|
||||
|
||||
# "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix" creates a
|
||||
# disk with this label on first boot. Therefore, we need to keep it. It is the
|
||||
# only information from the installer image that we need to keep persistent
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/NIXOS_SD";
|
||||
noCheck = true;
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
boot = {
|
||||
#kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
|
||||
loader = {
|
||||
generic-extlinux-compatible.enable = lib.mkDefault true;
|
||||
grub.enable = lib.mkDefault false;
|
||||
};
|
||||
};
|
||||
|
||||
########################### ssh ############################
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [ 22 ];
|
||||
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "no";
|
||||
settings.X11Forwarding = true;
|
||||
extraConfig = ''
|
||||
X11UseLocalhost no
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
####################################### networking ##########################
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
3702 # wsdd
|
||||
51820 # wireguard
|
||||
67 # allow DHCP traffic
|
||||
53 # allow dns
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
8888 # general use
|
||||
9999 # general use
|
||||
3240 # usbip
|
||||
];
|
||||
|
||||
networking.hostName = "lush";
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
networking.networkmanager.profiles = {
|
||||
pw = {
|
||||
connection = {
|
||||
id = "pw";
|
||||
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
|
||||
type = "wifi";
|
||||
interface-name = "wlan0";
|
||||
autoconnect = true;
|
||||
autoconnect-priority = "-200";
|
||||
};
|
||||
|
||||
wifi = {
|
||||
hidden = "true";
|
||||
mode = "infrastructure";
|
||||
ssid = builtins.readFile "${secretsDir}/wifi-ssid";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.20.21/24";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
hh40 = {
|
||||
connection = {
|
||||
id = "hh40";
|
||||
uuid = "73a61cef-8f7b-4f42-ab3f-0066e0295bbc";
|
||||
type = "wifi";
|
||||
interface-name = "wlan0";
|
||||
autoconnect = true;
|
||||
autoconnect-priority = "-999";
|
||||
};
|
||||
|
||||
wifi = {
|
||||
hidden = "false";
|
||||
mode = "infrastructure";
|
||||
ssid = builtins.readFile "${secretsDir}/home-wifi-ssid";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/home-wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
method = "auto";
|
||||
address1 = "192.168.1.37/24";
|
||||
};
|
||||
};
|
||||
|
||||
dhcp = {
|
||||
connection = {
|
||||
id = "dhcp";
|
||||
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
|
||||
type = "ethernet";
|
||||
autoconnect = "true";
|
||||
interface-name = "end0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "DC:A6:32:CB:4D:5E";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.1.44/24,192.168.1.1";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
share = {
|
||||
connection = {
|
||||
id = "share";
|
||||
uuid = "f55f34e3-4595-4642-b1f6-df3185bc0a04";
|
||||
type = "ethernet";
|
||||
autoconnect = false;
|
||||
interface-name = "end0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "DC:A6:32:CB:4D:5E";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.4.1/24";
|
||||
method = "shared";
|
||||
};
|
||||
|
||||
ipv6 = {
|
||||
addr-gen-mode = "stable-privacy";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
pt = {
|
||||
connection = {
|
||||
id = "pt";
|
||||
uuid = "f028117e-9eef-47c1-8483-574f7ee798a4";
|
||||
type = "bluetooth";
|
||||
autoconnect = true;
|
||||
};
|
||||
|
||||
bluetooth = {
|
||||
bdaddr = "E8:78:29:C4:BA:7C";
|
||||
type = "panu";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.44.22/24";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
/*
|
||||
me = {
|
||||
connection = {
|
||||
id = "me";
|
||||
uuid = "fe45d3bc-21c6-41ff-bc06-c936017c6e02";
|
||||
type = "wireguard";
|
||||
autoconnect = "true";
|
||||
interface-name = "me0";
|
||||
};
|
||||
wireguard = {
|
||||
listen-port = "51820";
|
||||
private-key = builtins.readFile "${secretsDir}/wg-private-lush";
|
||||
};
|
||||
ipv4 = {
|
||||
address1 = "10.1.1.4/24";
|
||||
method = "manual";
|
||||
};
|
||||
} // (import ../common/wg-peers.nix { inherit secretsDir; });
|
||||
*/
|
||||
};
|
||||
|
||||
|
||||
systemd.services.iwd.serviceConfig.Restart = "always";
|
||||
/*
|
||||
networking = {
|
||||
interfaces."wlan0".useDHCP = true;
|
||||
|
||||
interfaces."eth0" = {
|
||||
#name = "eth0";
|
||||
ipv4.addresses = [
|
||||
{ address = "192.168.5.5"; prefixLength = 24;}
|
||||
];
|
||||
};
|
||||
*/
|
||||
|
||||
/*
|
||||
wireless = {
|
||||
interfaces = [ "wlan0" ];
|
||||
enable = true;
|
||||
networks = {
|
||||
seb-phone.psk = "hellogello";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
*/
|
||||
|
||||
|
||||
####################################### wireguard ##########################
|
||||
/*
|
||||
systemd.network.netdevs.me0 = {
|
||||
enable = true;
|
||||
wireguardPeers = import ../common/wg-peers.nix { inherit secretsDir; };
|
||||
wireguardConfig = {
|
||||
ListenPort = 51820;
|
||||
PrivateKeyFile = "/etc/wireguard/secret.key";
|
||||
};
|
||||
};
|
||||
networking.wireguard.interfaces = {
|
||||
me = {
|
||||
ips = [ "10.1.1.11/24" ];
|
||||
};
|
||||
*/
|
||||
|
||||
/*
|
||||
boot = {
|
||||
kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
|
||||
initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" ];
|
||||
loader = {
|
||||
grub.enable = false;
|
||||
generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
*/
|
||||
|
||||
}
|
||||
@@ -213,6 +213,7 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
in {
|
||||
#command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time -d --env WLR_RENDERER_ALLOW_SOFTWARE=1 --cmd sway";
|
||||
command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --cmd ${pkgs.writeScriptBin "run-sway" ''
|
||||
|
||||
366
hosts/te.nix
Normal file
366
hosts/te.nix
Normal file
@@ -0,0 +1,366 @@
|
||||
{ lib, secretsDir, pkgs, inputs, unstable, ... }: let
|
||||
|
||||
in {
|
||||
|
||||
#users.users.me.password = builtins.readFile "${secretsDir}/te-password";
|
||||
#users.users.root.password = builtins.readFile "${secretsDir}/te-password";
|
||||
|
||||
imports = [
|
||||
../common/all.nix
|
||||
../common/nixos.nix
|
||||
../common/building.nix
|
||||
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
inputs.networkmanager.nixosModules.networkmanager
|
||||
inputs.disko.nixosModules.disko
|
||||
../users/me/gui.nix
|
||||
../users/root/default.nix
|
||||
../common/nixos-wayland.nix
|
||||
];
|
||||
|
||||
services.tailscale.enable = true;
|
||||
programs.nix-ld.enable = true;
|
||||
|
||||
networking.hostName = "te";
|
||||
networking.firewall.enable = false;
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns = true;
|
||||
publish = {
|
||||
enable = true;
|
||||
addresses = true;
|
||||
domain = true;
|
||||
hinfo = true;
|
||||
userServices = true;
|
||||
workstation = true;
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
8888 # for general usage
|
||||
9999 # for general usage
|
||||
6000 # Xserver
|
||||
6666 # vnc sway
|
||||
5900 # vnc for win VM
|
||||
5901 # vnc
|
||||
5902 # vnc
|
||||
4400 # rdp win VM
|
||||
4401 # ssh for mandroid
|
||||
4402 # random
|
||||
4403 # random
|
||||
4404 # random
|
||||
];
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
48899 # GoodWe inverter discovery
|
||||
4410 # lan-mouse
|
||||
];
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/swapfile";
|
||||
size = 4 * 1024;
|
||||
}
|
||||
];
|
||||
|
||||
boot.kernelModules = [ "usbip_core" ];
|
||||
boot.extraModprobeConfig = "options kvm_intel nested=1";
|
||||
|
||||
# to build rpi images
|
||||
boot.binfmt.emulatedSystems = [
|
||||
"aarch64-linux"
|
||||
];
|
||||
|
||||
virtualisation.libvirtd = {
|
||||
enable = true;
|
||||
qemuOvmf = true;
|
||||
qemuSwtpm = true;
|
||||
#qemuOvmfPackage = pkgs.OVMFFull;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
linuxPackages.usbip
|
||||
mount
|
||||
efibootmgr
|
||||
tcpdump
|
||||
];
|
||||
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
# require public key authentication for better security
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "no";
|
||||
|
||||
settings.X11Forwarding = true;
|
||||
|
||||
extraConfig = ''
|
||||
X11UseLocalhost no
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services."sway@" = let
|
||||
mySway = unstable.sway.overrideAttrs (prev: {
|
||||
/*
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "WillPower3309";
|
||||
repo = "swayfx";
|
||||
rev = "";
|
||||
hash = "";
|
||||
};
|
||||
*/
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "swaywm";
|
||||
repo = "sway";
|
||||
rev = "73c244fb4807a29c6599d42c15e8a8759225b2d6";
|
||||
hash = "sha256-P2w1oRVUNBWajt8jZOxPXvBE29urbrhtORy+lfYqnF8=";
|
||||
};
|
||||
});
|
||||
in {
|
||||
enable = false;
|
||||
after = [ "systemd-user-sessions.service" "dbus.socket" "systemd-logind.service" "getty@%i.service" "plymouth-deactivate.service" "plymouth-quit.service" ];
|
||||
before = [ "graphical.target" ];
|
||||
wants = [ "dbus.socket" "systemd-logind.service" "plymouth-deactivate.service" ];
|
||||
wantedBy = [ "graphical.target" ];
|
||||
conflicts = [ "getty@%i.service" ]; # "plymouth-quit.service" "plymouth-quit-wait.service"
|
||||
|
||||
restartIfChanged = false;
|
||||
serviceConfig = {
|
||||
ExecStart = "${lib.getExe mySway}";
|
||||
User = "me";
|
||||
|
||||
# ConditionPathExists = "/dev/tty0";
|
||||
IgnoreSIGPIPE = "no";
|
||||
|
||||
# Log this user with utmp, letting it show up with commands 'w' and
|
||||
# 'who'. This is needed since we replace (a)getty.
|
||||
UtmpIdentifier = "%I";
|
||||
UtmpMode = "user";
|
||||
# A virtual terminal is needed.
|
||||
TTYPath = "/dev/%I";
|
||||
TTYReset = "yes";
|
||||
TTYVHangup = "yes";
|
||||
TTYVTDisallocate = "yes";
|
||||
# Fail to start if not controlling the virtual terminal.
|
||||
#StandardInput = "tty-fail";
|
||||
#StandardOutput = "syslog";
|
||||
#StandardError = "syslog";
|
||||
# Set up a full (custom) user session for the user, required by Cage.
|
||||
PAMName = "cage";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.extraConfig = "DefaultLimitNOFILE=2048";
|
||||
|
||||
###################################################### the kiosk stuff
|
||||
|
||||
services.dbus.enable = true;
|
||||
|
||||
fonts.enableDefaultPackages = true;
|
||||
xdg.icons.enable = true;
|
||||
gtk.iconCache.enable = true;
|
||||
|
||||
services.udisks2.enable = false;
|
||||
hardware.opengl.enable = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
systemd.defaultUnit = "graphical.target";
|
||||
|
||||
|
||||
############################# networkmanager
|
||||
|
||||
# update name of wifi-interface
|
||||
systemd.services.update-wifi-iface = {
|
||||
description = "Update Wi-Fi interface name in network manager";
|
||||
path = with pkgs; [
|
||||
networkmanager # for nmcli
|
||||
iproute2 # for ip
|
||||
gawk # for awk
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.writeShellScriptBin "run" ''
|
||||
name=$(ip link | awk -F: '/^[0-9]+: wl/ {print $2}' | sed 's/^ //')
|
||||
nmcli connection modify pw connection.interface-name $name
|
||||
''}/bin/run";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "Networkmanager.service" "network.target" ];
|
||||
};
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
networking.networkmanager.profiles = {
|
||||
pw = {
|
||||
connection = {
|
||||
id = "pw";
|
||||
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
|
||||
type = "wifi";
|
||||
interface-name = "wlp3s0";
|
||||
};
|
||||
|
||||
wifi = {
|
||||
hidden = "true";
|
||||
mode = "infrastructure";
|
||||
ssid = builtins.readFile "${secretsDir}/wifi-ssid";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
#address1 = "192.168.20.11/24";
|
||||
dns = "1.1.1.1;8.8.8.8;";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
pt = {
|
||||
connection = {
|
||||
id = "pt";
|
||||
uuid = "f028117e-9eef-47c1-8483-574f7ee798a4";
|
||||
type = "bluetooth";
|
||||
autoconnect = "false";
|
||||
};
|
||||
|
||||
bluetooth = {
|
||||
bdaddr = "E8:78:29:C4:BA:7C";
|
||||
type = "panu";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.44.11/24";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
hot = {
|
||||
connection = {
|
||||
id = "hot";
|
||||
uuid = "ab51de8a-9742-465a-928b-be54a83ab6a3";
|
||||
type = "wifi";
|
||||
autoconnect = false;
|
||||
interface-name = "wlp3s0";
|
||||
};
|
||||
wifi = {
|
||||
mode = "ap";
|
||||
ssid = "c2vi-te";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
method = "shared";
|
||||
};
|
||||
};
|
||||
|
||||
share = {
|
||||
connection = {
|
||||
id = "share";
|
||||
uuid = "f55f34e3-4595-4642-b1f6-df3185bc0a04";
|
||||
type = "ethernet";
|
||||
interface-name = "enp2s0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "C8:2A:14:0B:7F:3D";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.4.1/24";
|
||||
method = "shared";
|
||||
};
|
||||
|
||||
ipv6 = {
|
||||
addr-gen-mode = "stable-privacy";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
############ boot stuff
|
||||
boot.plymouth.enable = false;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.efiInstallAsRemovable = true;
|
||||
boot.loader.grub.devices = [ "nodev" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ehci_pci"
|
||||
"uhci_hcd"
|
||||
"ohci_hcd"
|
||||
"usb_storage"
|
||||
"uas"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
"scsi_mod"
|
||||
];
|
||||
boot.loader.grub.extraConfig = ''
|
||||
set timeout=2
|
||||
'';
|
||||
|
||||
############### disk config
|
||||
# the flash drive in use for te
|
||||
#disko.devices.disk.root.device = "/dev/disk/by-id/usb-Generic_Flash_Disk_FF830E8F-0:0";
|
||||
disko.devices.disk.root.device = "/dev/disk/by-id/ata-KBG40ZNV512G_KIOXIA_70GPGA85QBV1";
|
||||
disko.devices = {
|
||||
disk = {
|
||||
root = {
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
|
||||
ESP = {
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
|
||||
biosboot = {
|
||||
size = "2M";
|
||||
type = "21686148-6449-6E6F-744E-656564454649"; # BIOS boot
|
||||
};
|
||||
|
||||
root = {
|
||||
size = "240G";
|
||||
content = {
|
||||
# LUKS passphrase will be prompted interactively only
|
||||
type = "luks";
|
||||
name = "crypted";
|
||||
settings = {
|
||||
allowDiscards = true;
|
||||
};
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
pub = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/pub";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
324
hosts/ti.nix
Normal file
324
hosts/ti.nix
Normal file
@@ -0,0 +1,324 @@
|
||||
{ lib, pkgs, inputs, secretsDir, config, ... }:
|
||||
{
|
||||
|
||||
#system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
imports = [
|
||||
"${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
|
||||
#inputs.nixos-hardware.nixosModules.raspberry-pi-4
|
||||
inputs.networkmanager.nixosModules.networkmanager
|
||||
|
||||
../common/all.nix
|
||||
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
../users/me/headless.nix
|
||||
|
||||
##### project modules #####
|
||||
|
||||
# the module for the zwave setup
|
||||
#"${workDir}/htl/labor/hackl/zwave.nix"
|
||||
|
||||
# labor nas project
|
||||
# with this moduel it does not boot, it waits for /dev/disk/by-label/nas-storage
|
||||
# "${workDir}/htl/labor/nas/nixos/lush-module.nix"
|
||||
];
|
||||
|
||||
# fix bluetooth
|
||||
hardware = {
|
||||
bluetooth = {
|
||||
package = pkgs.bluez;
|
||||
enable = true;
|
||||
powerOnBoot = true;
|
||||
};
|
||||
};
|
||||
|
||||
# get usbip working
|
||||
boot.extraModulePackages = [
|
||||
config.boot.kernelPackages.usbip
|
||||
];
|
||||
|
||||
|
||||
boot.kernelParams = lib.mkForce ["console=ttyS0,115200n8" "console=ttyAMA0,115200n8" "console=tty0" "nohibernate" "loglevel=7" ];
|
||||
# hardware.bluetooth.enable = true;
|
||||
|
||||
|
||||
|
||||
# home-manager.users.me = import ../users/me/home-headless.nix;
|
||||
|
||||
|
||||
/* for cross compiling
|
||||
#nixpkgs.hostPlatform.system = "aarch64-linux";
|
||||
#nixpkgs.buildPlatform.system = "x86_64-linux";
|
||||
nixpkgs.overlays = [
|
||||
|
||||
(outerFinal: outerPrev: {
|
||||
#https://github.com/adrienverge/openfortivpn/issues/446
|
||||
#https://github.com/NixOS/nixpkgs/blob/nixos-23.05/pkgs/tools/networking/openfortivpn/default.nix#L47
|
||||
openfortivpn = outerPrev.openfortivpn.overrideAttrs (final: prev: {
|
||||
configureFlags = prev.configureFlags or [] ++ [
|
||||
"--disable-proc"
|
||||
"--with-rt_dst=yes"
|
||||
"--with-pppd=/usr/sbin/pppd"
|
||||
];
|
||||
});
|
||||
})
|
||||
];
|
||||
*/
|
||||
|
||||
services.blueman.enable = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
linuxPackages.usbip
|
||||
vim
|
||||
bluez
|
||||
git
|
||||
];
|
||||
|
||||
# "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix" creates a
|
||||
# disk with this label on first boot. Therefore, we need to keep it. It is the
|
||||
# only information from the installer image that we need to keep persistent
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/NIXOS_SD";
|
||||
noCheck = true;
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
boot = {
|
||||
#kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
|
||||
loader = {
|
||||
generic-extlinux-compatible.enable = lib.mkDefault true;
|
||||
grub.enable = lib.mkDefault false;
|
||||
};
|
||||
};
|
||||
|
||||
########################### ssh ############################
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
ports = [ 22 ];
|
||||
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "no";
|
||||
settings.X11Forwarding = true;
|
||||
extraConfig = ''
|
||||
X11UseLocalhost no
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
####################################### networking ##########################
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
3702 # wsdd
|
||||
51820 # wireguard
|
||||
67 # allow DHCP traffic
|
||||
53 # allow dns
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
8888 # general use
|
||||
9999 # general use
|
||||
3240 # usbip
|
||||
];
|
||||
|
||||
networking.hostName = "lush";
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
networking.networkmanager.profiles = {
|
||||
pw = {
|
||||
connection = {
|
||||
id = "pw";
|
||||
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
|
||||
type = "wifi";
|
||||
interface-name = "wlan0";
|
||||
autoconnect = true;
|
||||
autoconnect-priority = "-200";
|
||||
};
|
||||
|
||||
wifi = {
|
||||
hidden = "true";
|
||||
mode = "infrastructure";
|
||||
ssid = builtins.readFile "${secretsDir}/wifi-ssid";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.20.21/24";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
hh40 = {
|
||||
connection = {
|
||||
id = "hh40";
|
||||
uuid = "73a61cef-8f7b-4f42-ab3f-0066e0295bbc";
|
||||
type = "wifi";
|
||||
interface-name = "wlan0";
|
||||
autoconnect = true;
|
||||
autoconnect-priority = "-999";
|
||||
};
|
||||
|
||||
wifi = {
|
||||
hidden = "false";
|
||||
mode = "infrastructure";
|
||||
ssid = builtins.readFile "${secretsDir}/home-wifi-ssid";
|
||||
};
|
||||
|
||||
wifi-security = {
|
||||
key-mgmt = "wpa-psk";
|
||||
psk = builtins.readFile "${secretsDir}/home-wifi-password";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
method = "auto";
|
||||
address1 = "192.168.1.37/24";
|
||||
};
|
||||
};
|
||||
|
||||
dhcp = {
|
||||
connection = {
|
||||
id = "dhcp";
|
||||
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
|
||||
type = "ethernet";
|
||||
autoconnect = "true";
|
||||
interface-name = "end0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "DC:A6:32:CB:4D:5E";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.1.44/24,192.168.1.1";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
share = {
|
||||
connection = {
|
||||
id = "share";
|
||||
uuid = "f55f34e3-4595-4642-b1f6-df3185bc0a04";
|
||||
type = "ethernet";
|
||||
autoconnect = false;
|
||||
interface-name = "end0";
|
||||
};
|
||||
|
||||
ethernet = {
|
||||
mac-address = "DC:A6:32:CB:4D:5E";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.4.1/24";
|
||||
method = "shared";
|
||||
};
|
||||
|
||||
ipv6 = {
|
||||
addr-gen-mode = "stable-privacy";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
pt = {
|
||||
connection = {
|
||||
id = "pt";
|
||||
uuid = "f028117e-9eef-47c1-8483-574f7ee798a4";
|
||||
type = "bluetooth";
|
||||
autoconnect = true;
|
||||
};
|
||||
|
||||
bluetooth = {
|
||||
bdaddr = "E8:78:29:C4:BA:7C";
|
||||
type = "panu";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
address1 = "192.168.44.22/24";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
/*
|
||||
me = {
|
||||
connection = {
|
||||
id = "me";
|
||||
uuid = "fe45d3bc-21c6-41ff-bc06-c936017c6e02";
|
||||
type = "wireguard";
|
||||
autoconnect = "true";
|
||||
interface-name = "me0";
|
||||
};
|
||||
wireguard = {
|
||||
listen-port = "51820";
|
||||
private-key = builtins.readFile "${secretsDir}/wg-private-lush";
|
||||
};
|
||||
ipv4 = {
|
||||
address1 = "10.1.1.4/24";
|
||||
method = "manual";
|
||||
};
|
||||
} // (import ../common/wg-peers.nix { inherit secretsDir; });
|
||||
*/
|
||||
};
|
||||
|
||||
|
||||
systemd.services.iwd.serviceConfig.Restart = "always";
|
||||
/*
|
||||
networking = {
|
||||
interfaces."wlan0".useDHCP = true;
|
||||
|
||||
interfaces."eth0" = {
|
||||
#name = "eth0";
|
||||
ipv4.addresses = [
|
||||
{ address = "192.168.5.5"; prefixLength = 24;}
|
||||
];
|
||||
};
|
||||
*/
|
||||
|
||||
/*
|
||||
wireless = {
|
||||
interfaces = [ "wlan0" ];
|
||||
enable = true;
|
||||
networks = {
|
||||
seb-phone.psk = "hellogello";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
*/
|
||||
|
||||
|
||||
####################################### wireguard ##########################
|
||||
/*
|
||||
systemd.network.netdevs.me0 = {
|
||||
enable = true;
|
||||
wireguardPeers = import ../common/wg-peers.nix { inherit secretsDir; };
|
||||
wireguardConfig = {
|
||||
ListenPort = 51820;
|
||||
PrivateKeyFile = "/etc/wireguard/secret.key";
|
||||
};
|
||||
};
|
||||
networking.wireguard.interfaces = {
|
||||
me = {
|
||||
ips = [ "10.1.1.11/24" ];
|
||||
};
|
||||
*/
|
||||
|
||||
/*
|
||||
boot = {
|
||||
kernelPackages = pkgs.linuxKernel.packages.linux_rpi4;
|
||||
initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" ];
|
||||
loader = {
|
||||
grub.enable = false;
|
||||
generic-extlinux-compatible.enable = true;
|
||||
};
|
||||
};
|
||||
*/
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user