292 lines
6.4 KiB
Nix
292 lines
6.4 KiB
Nix
{ lib, secretsDir, pkgs, inputs, unstable, ... }: let
|
|
|
|
in {
|
|
|
|
imports = [
|
|
../common/all.nix
|
|
../common/nixos.nix
|
|
../common/building.nix
|
|
|
|
inputs.home-manager.nixosModules.home-manager
|
|
inputs.networkmanager.nixosModules.networkmanager
|
|
inputs.disko.nixosModules.disko
|
|
../users/me/gui.nix
|
|
../users/root/default.nix
|
|
../common/nixos-wayland.nix
|
|
];
|
|
services.tailscale.enable = true;
|
|
programs.nix-ld.enable = true;
|
|
|
|
services.keyd.enable = lib.mkForce false;
|
|
|
|
networking.hostName = "ki";
|
|
networking.firewall.enable = false;
|
|
services.avahi = {
|
|
enable = true;
|
|
nssmdns = true;
|
|
publish = {
|
|
enable = true;
|
|
addresses = true;
|
|
domain = true;
|
|
hinfo = true;
|
|
userServices = true;
|
|
workstation = true;
|
|
};
|
|
};
|
|
networking.firewall.allowedTCPPorts = [
|
|
8888 # for general usage
|
|
9999 # for general usage
|
|
6000 # Xserver
|
|
6666 # vnc sway
|
|
5900 # vnc for win VM
|
|
5901 # vnc
|
|
5902 # vnc
|
|
4400 # rdp win VM
|
|
4401 # ssh for mandroid
|
|
4402 # random
|
|
4403 # random
|
|
4404 # random
|
|
4405 # clipboard sync
|
|
];
|
|
|
|
networking.firewall.allowedUDPPorts = [
|
|
48899 # GoodWe inverter discovery
|
|
4410 # lan-mouse
|
|
];
|
|
|
|
services.resilio = {
|
|
enable = true;
|
|
enableWebUI = true;
|
|
httpListenAddr = "100.96.201.42";
|
|
checkForUpdates = false;
|
|
listeningPort = 44444;
|
|
};
|
|
users.users.me.extraGroups = [ "rslsync" ];
|
|
users.users.rslsync.extraGroups = [ "users" ];
|
|
users.users.me.homeMode = "770"; # important for resilio
|
|
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
|
|
44444 # resilio sync
|
|
9000 # resilio webui
|
|
];
|
|
|
|
|
|
swapDevices = [ { device = "/swapfile"; } ];
|
|
|
|
boot.kernelModules = [ "usbip_core" ];
|
|
boot.extraModprobeConfig = "options kvm_intel nested=1";
|
|
|
|
# to build rpi images
|
|
boot.binfmt.emulatedSystems = [
|
|
"aarch64-linux"
|
|
];
|
|
|
|
home-manager.users.me.home.file.".config/sway/config".text = ''
|
|
exec ${pkgs.wayvnc}/bin/wayvnc 0.0.0.0 6666
|
|
'';
|
|
|
|
virtualisation.libvirtd = {
|
|
enable = true;
|
|
qemuOvmf = true;
|
|
qemuSwtpm = true;
|
|
#qemuOvmfPackage = pkgs.OVMFFull;
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
linuxPackages.usbip
|
|
helvum
|
|
passt
|
|
mount
|
|
pkgs.hicolor-icon-theme
|
|
efibootmgr
|
|
tcpdump
|
|
];
|
|
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
# require public key authentication for better security
|
|
settings.PasswordAuthentication = false;
|
|
settings.KbdInteractiveAuthentication = false;
|
|
settings.PermitRootLogin = "no";
|
|
|
|
settings.X11Forwarding = true;
|
|
|
|
extraConfig = ''
|
|
X11UseLocalhost no
|
|
'';
|
|
};
|
|
|
|
systemd.extraConfig = "DefaultLimitNOFILE=2048";
|
|
|
|
services.logind = {
|
|
extraConfig = ''
|
|
HandlePowerKey=suspend-then-hibernate
|
|
'';
|
|
lidSwitch = "ignore";
|
|
lidSwitchExternalPower = "ignore";
|
|
lidSwitchDocked = "ignore";
|
|
};
|
|
|
|
services.dbus.enable = true;
|
|
|
|
fonts.enableDefaultPackages = true;
|
|
xdg.icons.enable = true;
|
|
gtk.iconCache.enable = true;
|
|
|
|
services.udisks2.enable = false;
|
|
hardware.opengl.enable = true;
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
systemd.defaultUnit = "graphical.target";
|
|
|
|
|
|
############################# networkmanager
|
|
networking.networkmanager.enable = true;
|
|
|
|
networking.networkmanager.profiles = {
|
|
pw = {
|
|
connection = {
|
|
id = "pw";
|
|
uuid = "e0103dac-7da0-4e32-a01b-487b8c4c813c";
|
|
type = "wifi";
|
|
interface-name = "wlp2s0";
|
|
};
|
|
|
|
wifi = {
|
|
hidden = "true";
|
|
mode = "infrastructure";
|
|
ssid = builtins.readFile "${secretsDir}/wifi-ssid";
|
|
};
|
|
|
|
wifi-security = {
|
|
key-mgmt = "wpa-psk";
|
|
psk = builtins.readFile "${secretsDir}/wifi-password";
|
|
};
|
|
|
|
ipv4 = {
|
|
#address1 = "192.168.20.11/24";
|
|
dns = "1.1.1.1;8.8.8.8;";
|
|
method = "auto";
|
|
};
|
|
};
|
|
|
|
hot = {
|
|
connection = {
|
|
id = "hot";
|
|
uuid = "ab51de8a-9742-465a-928b-be54a83ab6a3";
|
|
type = "wifi";
|
|
autoconnect = false;
|
|
interface-name = "wlp3s0";
|
|
};
|
|
wifi = {
|
|
mode = "ap";
|
|
ssid = "c2vi-ki";
|
|
};
|
|
|
|
wifi-security = {
|
|
key-mgmt = "wpa-psk";
|
|
psk = builtins.readFile "${secretsDir}/wifi-password";
|
|
};
|
|
|
|
ipv4 = {
|
|
method = "shared";
|
|
};
|
|
};
|
|
|
|
share = {
|
|
connection = {
|
|
id = "share";
|
|
uuid = "f55f34e3-4595-4642-b1f6-df3185bc0a04";
|
|
type = "ethernet";
|
|
autoconnect = false;
|
|
interface-name = "enp2s0";
|
|
};
|
|
|
|
ethernet = {
|
|
mac-address = "C8:2A:14:0B:7F:3D";
|
|
};
|
|
|
|
ipv4 = {
|
|
address1 = "192.168.4.1/24";
|
|
method = "shared";
|
|
};
|
|
|
|
ipv6 = {
|
|
addr-gen-mode = "stable-privacy";
|
|
method = "auto";
|
|
};
|
|
};
|
|
|
|
dhcp = {
|
|
connection = {
|
|
id = "dhcp";
|
|
uuid = "c006389a-1697-4f77-91c3-95b466f85f13";
|
|
type = "ethernet";
|
|
autoconnect = true;
|
|
interface-name = "enp2s0";
|
|
};
|
|
|
|
ethernet = {
|
|
mac-address = "C8:2A:14:0B:7F:3D";
|
|
};
|
|
|
|
ipv4 = {
|
|
method = "auto";
|
|
address1 = "192.168.1.33/24,192.168.1.1";
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
############### disk config
|
|
boot.plymouth.enable = false;
|
|
boot.loader.grub.enable = true;
|
|
boot.loader.grub.efiSupport = true;
|
|
boot.loader.grub.efiInstallAsRemovable = true;
|
|
boot.loader.grub.devices = [ "nodev" ];
|
|
boot.loader.grub.extraConfig = ''
|
|
set timeout=2
|
|
'';
|
|
|
|
# the flash drive in use for te
|
|
#disko.devices.disk.root.device = "/dev/disk/by-id/usb-Generic_Flash_Disk_FF830E8F-0:0";
|
|
disko.devices.disk.root.device = "/dev/disk/by-id/ata-SSD_HB202408140276168";
|
|
disko.devices = {
|
|
disk = {
|
|
root = {
|
|
type = "disk";
|
|
content = {
|
|
type = "gpt";
|
|
partitions = {
|
|
|
|
biosboot = {
|
|
size = "2M";
|
|
type = "21686148-6449-6E6F-744E-656564454649"; # BIOS boot
|
|
};
|
|
|
|
ESP = {
|
|
size = "1G";
|
|
type = "EF00";
|
|
content = {
|
|
type = "filesystem";
|
|
format = "vfat";
|
|
mountpoint = "/boot";
|
|
mountOptions = [ "umask=0077" ];
|
|
};
|
|
};
|
|
|
|
root = {
|
|
size = "100%";
|
|
content = {
|
|
type = "filesystem";
|
|
format = "ext4";
|
|
mountpoint = "/";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|