hunner/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sops hosts layout

Browse source
This commit is contained in:
Hunter Haugen 2025-12-29 12:26:16 -08:00
parent 6b30d11d42
commit f9250db3d8
Signed by: hunner
GPG key ID: EF99694AA599DDAD
20 changed files with 585 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

258
hosts/cryochamber/configuration.nix Normal file
View file

@ -0,0 +1,258 @@
{ config, pkgs, lib, impermanence, ... }:
#zpool import -f rpool
#mount -t zfs rpool/local/root /mnt
#mkdir -p /mnt/{boot,nix,home,persist,var/lib,var/log}
#mount /dev/vda2 /mnt/boot
#mount -t zfs rpool/local/nix /mnt/nix
#mount -t zfs rpool/safe/home /mnt/home
#mount -t zfs rpool/safe/persist /mnt/persist
#mount -t zfs rpool/local/var/lib /mnt/var/lib
#mount -t zfs rpool/local/var/log /mnt/var/log
{
imports =
[
./hardware-configuration.nix
"${impermanence}/nixos.nix"
];
# Enable ZFS support
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.requestEncryptionCredentials = false;
fileSystems = {
"/persist" = {
device = "rpool/safe/persist";
fsType = "zfs";
neededForBoot = true; # Only /persist needs to be marked as needed for boot
};
};
# Import the existing ZFS pool from the second disk without formatting it
boot.zfs.extraPools = [ "tank" ];
boot.zfs.devNodes = "/dev/disk/by-path"; # This is neede for ZFS to find the pool at boot
# Use GRUB with BIOS booting, whether MBR or GPT
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/vda";
boot.loader.grub.zfsSupport = true;
boot.loader.grub.efiSupport = false;
# Impermanence configuration
# Set up impermanence - root filesystem will be reset on each boot
boot.initrd.postResumeCommands = lib.mkAfter ''
zfs rollback -r rpool/local/root@blank
'';
# /var/log and /var/lib ar persisted through zfs datasets, but not backed up.
# Anything stored in /persist should get backed up.
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/root"
"/etc/nixos"
"/etc/ssh"
];
files = [
"/etc/machine-id"
];
};
# Files are not copied to /persist during install, so need to do so manually
#rsync -azPH /mnt/root/ /mnt/persist/root
#rsync -azPH /mnt/etc/nixos/ /mnt/persist/etc/nixos
#rsync -azPH /mnt/etc/ssh/ /mnt/persist/etc/ssh
#cp /mnt/etc/machine-id /mnt/persist/etc/machine-id
# Swap configuration
swapDevices = [ {
device = "/dev/vda3";
randomEncryption.enable = true;
} ];
# Basic system configuration
networking.hostId = "5472a981"; # Required for ZFS
networking.hostName = "cryochamber";
# Enable networking
networking.networkmanager.enable = true;
# Don't lecture after reboot
security.sudo.extraConfig = ''
Defaults lecture = never
'';
# Set your time zone
time.timeZone = "UTC";
# Docker configuration
virtualisation.docker = {
enable = true;
extraOptions = "--storage-driver=overlay2";
};
# System packages
environment.systemPackages = with pkgs; [
git
vim
wget
curl
htop
zfs
zsh
tmux
docker-compose
lzop # for syncoid
pv # for syncoid
mbuffer # for syncoid
];
services.zfs.autoScrub = {
enable = true;
interval = "weekly";
pools = [ "tank" ];
};
services.sanoid = {
enable = true;
templates.backup = {
frequently = 0;
hourly = 0;
daily = 30;
monthly = 6;
yearly = 3;
autosnap = false;
autoprune = true;
recursive = true;
};
datasets."tank" = {
useTemplate = [ "backup" ];
};
datasets."rpool/safe" = {
useTemplate = [ "backup" ];
};
};
# sops-nix secrets
sops.defaultSopsFile = ./secrets/config.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets.hashedPassword.neededForUsers = true;
# Define a user account
users.users.hunner = {
isNormalUser = true;
extraGroups = [ "wheel" "docker" "networkmanager" ];
hashedPasswordFile = config.sops.secrets.hashedPassword.path;
shell = pkgs.zsh;
packages = with pkgs; [
fzf
neovim
devenv
pass
jq
yq
yt-dlp
bat
ripgrep
fd
shellcheck
tldr
unzip
lsof
gnupg
];
};
users.users.backup = {
isNormalUser = true;
description = "Backup replication user";
shell = pkgs.bash;
packages = with pkgs; [
sanoid
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDtgW+cxPjo70k6dkYPqzP0FR5G9zvbArp/85ZHRrMRL backup@cryochamber"
];
};
#services.syncoid = {
# enable = true;
# user = "backup";
# sshKey = "/var/lib/syncoid/.ssh/id_ed25519";
# commonArgs = [
# #"--sshoption=StrictHostKeyChecking=off"
# "--sshoption=UserKnownHostsFile=/var/lib/syncoid/.ssh/known_hosts"
# "--sshoption=IdentitiesOnly=yes"
# ];
# #commands."zima-bitrot" = {
# # source = "backup@zima:bitrot";
# # target = "tank/backups/zima/bitrot";
# # recursive = true;
# #};
# commands."zima-rpool-safe" = {
# source = "backup@zima:rpool/safe";
# target = "tank/backups/zima/rpool-safe";
# recursive = true;
# };
#};
#systemd.services.syncoid-zima-rpool-safe.serviceConfig = {
# Environment = [
# "HOME=/var/lib/syncoid"
# "SSH_AUTH_SOCK="
# ];
# ExecStartPre = [
# "+${pkgs.coreutils}/bin/mkdir -p /var/lib/syncoid/.ssh"
# "+${pkgs.coreutils}/bin/cp /home/backup/.ssh/id_ed25519 /var/lib/syncoid/.ssh/"
# "+${pkgs.coreutils}/bin/cp /home/backup/.ssh/known_hosts /var/lib/syncoid/.ssh/"
# "+${pkgs.coreutils}/bin/chown -R backup:syncoid /var/lib/syncoid/.ssh"
# "+${pkgs.coreutils}/bin/chmod 700 /var/lib/syncoid/.ssh"
# "+${pkgs.coreutils}/bin/chmod 600 /var/lib/syncoid/.ssh/id_ed25519"
# ];
#};
#systemd.services.syncoid-replication = {
# description = "ZFS syncoid replication";
# path = with pkgs; [ sanoid openssh zfs ];
# wants = [ "network-online.target" ];
# after = [ "network-online.target" "zfs.target" ];
# startAt = "03:00";
# serviceConfig = {
# Type = "oneshot";
# User = "backup";
# ExecStart = ''
# ${pkgs.sanoid}/bin/syncoid \
# --recursive \
# --create-bookmark \
# --sendoptions=w \
# --source-bwlimit=50000 \
# backup@zima:rpool/safe \
# tank/backups/zima/rpool-safe
# '';
# TimeoutStartSec = "6h";
# };
#};
programs.direnv = {
enable = true;
nix-direnv.enable = true;
};
programs.zsh.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
services.openssh.settings.Macs = [
"hmac-sha2-512"
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com"
];
services.tailscale.enable = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nixpkgs.config.allowUnfree = true;
system.stateVersion = "24.11";
}

127
hosts/cryochamber/disko-gpt.nix Normal file
View file

@ -0,0 +1,127 @@
{
disko.devices = {
disk = {
vda = {
type = "disk";
device = "/dev/vda";
content = {
type = "gpt";
partitions = {
boot = {
size = "1M";
type = "EF02";
};
ESP = {
name = "ESP";
size = "512M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "umask=0077" ];
};
};
swap = {
size = "8G";
type = "82";
content = {
type = "swap";
randomEncryption = true;
};
};
zfs = {
size = "100%";
type = "83";
content = {
type = "zfs";
pool = "rpool";
};
};
};
};
};
};
zpool = {
rpool = {
type = "zpool";
rootFsOptions = {
acltype = "posixacl";
compression = "lz4";
dnodesize = "auto";
normalization = "formD";
relatime = "on";
xattr = "sa";
};
options = {
ashift = "12";
autotrim = "on";
};
datasets = {
# Non-filesystem datasets
"local" = {
type = "zfs_fs";
options = {
mountpoint = "none";
canmount = "off";
};
};
"safe" = {
type = "zfs_fs";
options = {
mountpoint = "none";
canmount = "off";
};
};
"local/var" = {
type = "zfs_fs";
options = {
mountpoint = "none";
canmount = "off";
};
};
# Local datasets
"local/root" = {
type = "zfs_fs";
options = {
mountpoint = "legacy";
canmount = "noauto";
};
mountpoint = "/";
postCreateHook = ''
zfs snapshot rpool/local/root@blank
'';
};
"local/nix" = {
type = "zfs_fs";
options.mountpoint = "legacy";
mountpoint = "/nix";
};
"local/var/lib" = {
type = "zfs_fs";
options.mountpoint = "legacy";
mountpoint = "/var/lib";
};
"local/var/log" = {
type = "zfs_fs";
options.mountpoint = "legacy";
mountpoint = "/var/log";
};
# Safe datasets
"safe/persist" = {
type = "zfs_fs";
options.mountpoint = "legacy";
mountpoint = "/persist";
};
"safe/home" = {
type = "zfs_fs";
options.mountpoint = "legacy";
mountpoint = "/home";
};
};
};
};
};
}

23
hosts/cryochamber/flake.nix Normal file
View file

@ -0,0 +1,23 @@
{
inputs = {
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = {
self,
nixpkgs,
sops-nix,
}:
let
system = "x86_64-linux";
in
{
nixosConfigurations.cryochamber = nixpkgs.lib.nixosSystem {
modules = [
./configuration.nix
sops-nix.nixosModules.sops
];
};
};
}

64
hosts/cryochamber/hardware-configuration.nix Normal file
View file

@ -0,0 +1,64 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "rpool/local/root";
fsType = "zfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/8553-FF36";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
fileSystems."/home" =
{ device = "rpool/safe/home";
fsType = "zfs";
};
fileSystems."/nix" =
{ device = "rpool/local/nix";
fsType = "zfs";
};
fileSystems."/persist" =
{ device = "rpool/safe/persist";
fsType = "zfs";
};
fileSystems."/var/lib" =
{ device = "rpool/local/var/lib";
fsType = "zfs";
};
fileSystems."/var/log" =
{ device = "rpool/local/var/log";
fsType = "zfs";
};
#swapDevices =
# [ { device = "/dev/disk/by-uuid/c9c11edf-7989-4141-b647-4dbac7de5293"; }
# ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}

25
hosts/cryochamber/secrets/config.yaml Normal file
View file

@ -0,0 +1,25 @@
hashedPassword: ENC[AES256_GCM,data:iUN2iaC2RPDa/vq6H7Xp2KqHYcHfQHU6IhZ2FWXEuaNhByFzpyMbJC7N2bmbDUD3ERLudHg686Uqt6XJV2PevQoXa1iYhv9cLw==,iv:ekGMzP2TXSrxLkqZVclHgN1NQIv6OqtsVLHdvsTgXQc=,tag:RRSZCHjmhn8ClrUTYteWWA==,type:str]
sops:
age:
- recipient: age17sdp0gguexd88qel74fa4zeckxh93gqpkayz366fz6yvjauw7vcq7w6y45
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TWlKSGppbzRaZ0dUOUNz
cXpReDF5UUZIbVg1MGkyZGNneGNiK0t3eEdRCk9jRjIvL25hREI3c1pVOU5JS1l2
Q0tkNWU0RndiZEI4Z1dDSlFUQzAyZVUKLS0tIEVyc0JPVnBxNDlJSEVXc3V1WDY0
bzlsWjVJZGx6eHk1MFh6ZFVpN0FOelUKaNsnY+6+t4lGv1e35BQjwPmI7AcQqpiu
uiDxPhaXmGrlBDdpHaEjNYBvZjp0YA/0LwEX7uUipQD+Xrop5Snm4w==
-----END AGE ENCRYPTED FILE-----
- recipient: age122r8wrurhfjwple2ykd4wxafxezjd78mpkrzzyplcdju8q5ykecs3wycee
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYjdUWjQxL0UrWnNWSUpi
ZWlsUVNTK0xXZVVFd2pNSitldnFaVzdoQnhnCkNma2llSDVmTzZGL1Y0VUhFSk9h
NEVUM3MwU2RQMTJpdFdEVWtPa2tCdzQKLS0tIGxrU3hzUzh4MGZQcElyRG1CZ3RS
NDJWOEMyU1hwcHRXMUh6RkEzOFhndG8KY/fCz/+MfGQlnLC3Kzo5hYOmd0fRakDQ
JjVD+zxHFqN5b3U03iS9WIsdjF3hRFqqnZMOeXTUDezDfTNPdmUuMg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-29T20:30:43Z"
mac: ENC[AES256_GCM,data:4tBtaoDxLrLIyIXi51TKB2U5eP9kkEpz1UaW2eBTGXkdmn+k/oiouQ4spigQ8O0dKvdy4SmvOSksCC7TSDeZ0ToKbyorqFrTbnhvUdACjw6O6I8WJ8daaOGuvKHjiYk1CWhn8zdC+QTa/gpjVoQhTfiEFuPXgFMMoI24h7000XE=,iv:6taR8qzv/liCLAeqkYnUV+9D0b9z0zCOPHsOo+JMXnw=,tag:TUg6Z9GQLPLnyvW6lCHFpw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0

477
hosts/liminal/configuration.nix Normal file
View file

@ -0,0 +1,477 @@
# Config for framework16
{ config, pkgs, lib, nixos-hardware, impermanence, talon-nix, plover-flake, beads-flake, ... }:
{
nix.settings = {
download-buffer-size = 524288000; # 500 MiB
};
imports =
[
nixos-hardware.nixosModules.framework-16-7040-amd
./hardware-configuration.nix
impermanence.nixosModules.impermanence
talon-nix.nixosModules.talon
];
boot = {
loader.systemd-boot.enable = true;
loader.systemd-boot.configurationLimit = 20;
loader.efi.canTouchEfiVariables = true;
#initrd.luks.devices."cryptroot".device = "/dev/disk/by-partlabel/disk-nvme0n1-cryptroot";
initrd.luks.devices."cryptswap".device = "/dev/disk/by-partlabel/disk-nvme0n1-swap";
resumeDevice = "/dev/mapper/cryptswap";
kernelParams = [
"mem_sleep_default=deep"
];
extraModprobeConfig = ''
options amdgpu cwsr_enable=0 # For ROCm to not crash
'';
};
swapDevices = [ {
device = "/dev/mapper/cryptswap";
} ];
services.fwupd.enable = true;
hardware.framework.enableKmod = true;
fileSystems = {
"/" = {
device = "none";
fsType = "tmpfs";
options = [ "defaults" "size=17G" "mode=755" ];
};
"/persist" = {
neededForBoot = true;
};
};
hardware.amdgpu = {
opencl.enable = true;
};
hardware.graphics.enable = true;
services.xserver.videoDrivers = [ "amdgpu" ];
services.ollama = {
enable = true;
loadModels = [ "gemma3" ];
acceleration = "rocm";
rocmOverrideGfx = "11.0.2";
};
networking.hostId = "3294c9a2"; # Required for ZFS
networking.hostName = "liminal";
networking.networkmanager.enable = true;
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.extraHosts =
''
127.0.0.1 keycloak
127.0.0.1 k3d-cmvm
'';
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/root"
"/etc/nixos"
"/etc/ssh"
"/etc/NetworkManager/system-connections"
];
files = [
"/etc/machine-id"
#"/etc/nix/id_rsa" # Needed?
];
};
# Files are not copied to /persist during install, so need to do so manually
#rsync -azPH /mnt/root/ /mnt/persist/root
#rsync -azPH /mnt/etc/nixos/ /mnt/persist/etc/nixos
#rsync -azPH /mnt/etc/ssh/ /mnt/persist/etc/ssh
#cp /mnt/etc/machine-id /mnt/persist/etc/machine-id
security.sudo.extraConfig = ''
# Don't lecture after reboot
Defaults lecture = never
'';
# Set your time zone.
time.timeZone = "America/Los_Angeles";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
virtualisation.docker = {
enable = true;
extraOptions = "--storage-driver=overlay2";
};
programs.hyprland.enable = true;
programs.hyprland.xwayland.enable = false;
programs.hyprland.withUWSM = true;
programs.hyprlock.enable = true;
services.hypridle.enable = true;
programs.waybar.enable = true;
environment.sessionVariables.NIXOS_OZONE_WL = "1"; # hint electron apps to use wayland
programs.zsh.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "yes";
services.tailscale = {
enable = true;
useRoutingFeatures = "client";
extraUpFlags = [
"--accept-dns"
"--accept-routes"
];
};
hardware.brillo.enable = true;
# Enable the X11 windowing system.
services.xserver.enable = true;
# Enable the GNOME Desktop Environment.
services.displayManager.gdm.enable = true;
services.displayManager.gdm.wayland = true;
services.displayManager.gdm.autoSuspend = true;
services.desktopManager.gnome.enable = true;
services.xserver.windowManager.xmonad = {
enable = true;
enableContribAndExtras = true;
};
# Configure keymap in X11
services.xserver.xkb = {
layout = "us";
variant = "";
};
xdg.portal = {
enable = true;
xdgOpenUsePortal = true;
extraPortals = [
pkgs.xdg-desktop-portal-wlr
pkgs.xdg-desktop-portal-gtk
#pkgs.xdg-desktop-portal-hyprland
];
};
# Enable CUPS to print documents.
services.printing.enable = true;
# Enable bluetooth
hardware.bluetooth.enable = true;
services.blueman.enable = true;
services.logind.settings.Login = {
HandlePowerKey = "suspend";
HandleLidSwitch = "suspend";
};
services.upower = {
enable = true;
percentageLow = 15;
percentageCritical = 5;
percentageAction = 3;
criticalPowerAction = "Hibernate";
};
# Enable sound with pipewire.
services.pulseaudio.enable = false;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
# If you want to use JACK applications, uncomment this
#jack.enable = true;
# use the example session manager (no others are packaged yet so this is enabled by default,
# no need to redefine it in your config for now)
#media-session.enable = true;
};
# Enable touchpad support (enabled default in most desktopManager).
services.libinput.enable = true;
services.touchegg.enable = true;
# sops-nix secrets
sops.defaultSopsFile = ./secrets/config.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets.hashedPassword.neededForUsers = true;
# Define a user account. Don't forget to set a password with 'passwd'.
users.users.hunner = {
isNormalUser = true;
description = "Hunter Haugen";
extraGroups = [ "docker" "networkmanager" "wheel" "audio" "video" "dialout" ];
hashedPasswordFile = config.sops.secrets.hashedPassword.path;
shell = pkgs.zsh;
packages = with pkgs; [
fzf
neovim
asdf-vm
pinentry-gtk2
pinentry-gnome3
gnupg
pkgs.unstable.firefox-devedition
nodejs
slack
mplayer
ffmpeg
jetbrains-toolbox
pass
diff-so-fancy
pkgs.unstable.zed-editor
pkgs.unstable.package-version-server
amdgpu_top
nixd # for zed
rust-analyzer # for zed
nil # for zed
rustc # for zed
rustup # for zed
gcc # for zed
#ruff # for zed
goose-cli
claude-code
pkgs.unstable.codex
neofetch
eww
hyprpaper # for hyprland
hyprcursor # for hyprland
nordzy-icon-theme
nordzy-cursor-theme
wl-clipboard
onlyoffice-desktopeditors
calibre
clipse
plex-desktop
signal-desktop
flyctl
dtach
gromit-mpx
urbanterror
ghostty
talon-nix.packages.${pkgs.stdenv.hostPlatform.system}.default
pyright
just
yt-dlp
socat
plover-flake.packages.${pkgs.stdenv.hostPlatform.system}.plover-full
pkgs.unstable.zoom-us
beads-flake.packages.${pkgs.stdenv.hostPlatform.system}.default
];
};
systemd.user.services = {
polkit-agent = {
description = "PolKit Authentication Agent";
wantedBy = [ "graphical-session.target" ];
wants = [ "graphical-session.target" ];
after = [ "graphical-session.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
Restart = "on-failure";
RestartSec = 1;
TimeoutStopSec = 10;
};
};
};
# Enable automatic login for the user.
services.displayManager.autoLogin.enable = false;
services.displayManager.autoLogin.user = "hunner";
# Workaround for GNOME autologin: https://github.com/NixOS/nixpkgs/issues/103746#issuecomment-945091229
systemd.services."getty@tty1".enable = false;
systemd.services."autovt@tty1".enable = false;
# Install firefox.
programs.firefox.enable = true;
# Allow unfree packages
nixpkgs.config.allowUnfree = true;
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
jq
yq
bat
git
vim
emacs
wget
curl
htop
tmux
file
ripgrep
docker-compose
powertop
alacritty
rofi
wofi
xss-lock
xlockmore
fortune
dzen2
arandr
xclip
shellcheck
scrot
fd
xorg.xrandr
xorg.xsetroot
xorg.xset
xorg.xev
hsetroot
redshift
pkgs.unstable.code-cursor
pwvucontrol
pamixer
helvum
#hp15c
#nonpareil
framework-tool
kitty # for Hyprland
kdePackages.dolphin # file browser in hyprland
cliphist
restic
xscreensaver
unzip
scarlett2
alsa-scarlett-gui
pkgs.unstable.ndi-6
xdg-utils
btrbk
devenv
lsof
#(pkgs.unstable.flameshot.override { enableWlrSupport = true; })
hyprshot
hyprpicker
flameshot
chromium
];
services.clipmenu.enable = true;
services.picom = {
enable = true;
settings = {
inactive-opacity = 1.0;
inactive-dim = 0.0;
inactive-opacity-override = false;
frame-opacity = 1.0;
inactive-dim-fixed = false;
fading = false; # Optional, if you want to disable fading as well
};
};
programs.direnv = {
enable = true;
nix-direnv.enable = true;
#nix-direnv.package = unstable.nix-direnv;
};
programs._1password = {
enable = true;
};
programs._1password-gui = {
enable = true;
polkitPolicyOwners = [ "hunner" ];
};
programs.obs-studio = {
enable = true;
package = pkgs.unstable.obs-studio;
enableVirtualCamera = true;
plugins = with pkgs.unstable.obs-studio-plugins; [
wlrobs
obs-backgroundremoval
obs-pipewire-audio-capture
#obs-ndi
distroav
];
};
fonts.packages = with pkgs; [
nerd-fonts.droid-sans-mono
nerd-fonts.liberation
nerd-fonts.jetbrains-mono
nerd-fonts.sauce-code-pro
nerd-fonts.symbols-only
liberation_ttf
font-awesome
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
services.pcscd.enable = true;
# List services that you want to enable:
# Enable the OpenSSH daemon.
# services.openssh.enable = true;
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 8080 8081 8082 ];
networking.firewall.allowedUDPPorts = [ 8080 8081 8082 ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
systemd.services.upower.enable = true;
services.avahi = {
enable = true;
nssmdns4 = true; # Enable NSS lookup for .local domains
openFirewall = true;
publish = {
enable = true;
addresses = true;
domain = true;
workstation = true;
};
};
services.dbus = {
enable = true;
packages = [ pkgs.polkit ];
};
environment.etc = {
"1password/custom_allowed_browsers" = {
text = ''
firefox-devedition
'';
mode = "0755";
};
};
programs.dconf.enable = true;
security.polkit.enable = true;
systemd.services."user@".serviceConfig.Delegate = "cpu io memory pids cpuset";
services.fprintd.enable = true;
#security.pam.services = {
# login.fprintAuth = true;
# xscreensaver.fprintAuth = true;
# sudo.fprintAuth = true;
# #gdm.fprintAuth = true;
# gdm-password.fprintAuth = true;
#};
nix.settings.experimental-features = [ "nix-command" "flakes" ];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It's perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.11"; # Did you read the comment?
}
# vim: ft=nix ai

88
hosts/liminal/disko.nix Normal file
View file

@ -0,0 +1,88 @@
# Config for framework 16
# sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --mode destroy,format,mount disko.nix
{
disko.devices = {
disk = {
nvme0n1 = {
type = "disk";
device = "/dev/nvme0n1";
content = {
type = "gpt";
partitions = {
ESP = {
label = "boot";
name = "ESP";
size = "512M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "umask=0077" "defaults" ];
};
};
swap = {
size = "70G";
type = "8200";
content = {
type = "swap";
resumeDevice = true;
};
};
cryptroot = {
size = "100%";
content = {
type = "luks";
name = "cryptroot";
passwordFile = "/tmp/secret.key";
settings = {
allowDiscards = true;
crypttabExtraOpts = [ "no-read-workqueue" "no-write-workqueue" ];
};
content = {
type = "btrfs";
extraArgs = [ "-L" "nixos" "-f" ];
subvolumes = {
"/persist" = {
mountpoint = "/persist";
mountOptions = [ "compress=zstd" "noatime" "ssd" "space_cache=v2" ];
};
"/home" = {
mountpoint = "/home";
mountOptions = [ "compress=zstd" "noatime" "ssd" "space_cache=v2" ];
};
"/var/log" = {
mountpoint = "/var/log";
mountOptions = [ "compress=zstd" "noatime" "ssd" "space_cache=v2" ];
};
"/var/lib" = {
mountpoint = "/var/lib";
mountOptions = [ "compress=zstd" "noatime" "ssd" "space_cache=v2" ];
};
"/nix" = {
mountpoint = "/nix";
mountOptions = [ "compress=zstd" "noatime" "ssd" "space_cache=v2" ];
};
};
};
};
};
};
};
};
};
nodev = {
"/" = {
fsType = "tmpfs";
mountOptions = [
"defaults"
"size=4G"
"mode=755"
];
};
};
};
filesystems."/persist".neededForBoot = true;
filesystems."/var/log".neededForBoot = true;
}

357
hosts/liminal/flake.lock generated Normal file
View file

@ -0,0 +1,357 @@
{
"nodes": {
"beads-flake": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1764830699,
"narHash": "sha256-GmK2+kcaorEsQ/O9lweJIVBv21Np6VfW6sE/3F/GBjY=",
"owner": "steveyegge",
"repo": "beads",
"rev": "f4b8a7ad4f7eb3bd47b24357f69f22bc1a75d4b7",
"type": "github"
},
"original": {
"owner": "steveyegge",
"repo": "beads",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"impermanence": {
"locked": {
"lastModified": 1737831083,
"narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
"owner": "nix-community",
"repo": "impermanence",
"rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "impermanence",
"type": "github"
}
},
"nix-github-actions": {
"inputs": {
"nixpkgs": [
"talon-nix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1693660503,
"narHash": "sha256-B/g2V4v6gjirFmy+I5mwB2bCYc0l3j5scVfwgl6WOl8=",
"owner": "nix-community",
"repo": "nix-github-actions",
"rev": "bd5bdbb52350e145c526108f4ef192eb8e554fa0",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "nix-github-actions",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1764440730,
"narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
"type": "github"
},
"original": {
"owner": "NixOS",
"repo": "nixos-hardware",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1760284886,
"narHash": "sha256-TK9Kr0BYBQ/1P5kAsnNQhmWWKgmZXwUQr4ZMjCzWf2c=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "cf3f5c4def3c7b5f1fc012b3d839575dbe552d43",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1764667669,
"narHash": "sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "418468ac9527e799809c900eda37cbff999199b6",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1764677808,
"narHash": "sha256-H3lC7knbXOBrHI9hITQ7modLuX20mYJVhZORL5ioms0=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "1aab89277eb2d87823d5b69bae631a2496cff57a",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.11",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_3": {
"locked": {
"lastModified": 1764667669,
"narHash": "sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "418468ac9527e799809c900eda37cbff999199b6",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_4": {
"locked": {
"lastModified": 1698318101,
"narHash": "sha256-gUihHt3yPD7bVqg+k/UVHgngyaJ3DMEBchbymBMvK1E=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "63678e9f3d3afecfeafa0acead6239cdb447574c",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"plover": {
"flake": false,
"locked": {
"lastModified": 1764131295,
"narHash": "sha256-Q6vrDmn3a0m7oz8EeyuIhkq1V4nXNGHIdJhyQl9CAuE=",
"owner": "openstenoproject",
"repo": "plover",
"rev": "bf2eaa51491d719e65f2afc4b9f999d42230dbdb",
"type": "github"
},
"original": {
"owner": "openstenoproject",
"repo": "plover",
"type": "github"
}
},
"plover-flake": {
"inputs": {
"nixpkgs": "nixpkgs_3",
"plover": "plover",
"plover-machine-hid": "plover-machine-hid",
"plover-stroke": "plover-stroke",
"plover2cat": "plover2cat",
"plover_plugins_registry": "plover_plugins_registry",
"pyobjc": "pyobjc",
"rtf-tokenize": "rtf-tokenize"
},
"locked": {
"lastModified": 1764820984,
"narHash": "sha256-DyBpG7Mh2mPk6HUpC+g2a4vwvBhTHArX3RNJSmIbf6g=",
"owner": "openstenoproject",
"repo": "plover-flake",
"rev": "15dd9b231fd74e7c80416adf94daeb47ba74b8a6",
"type": "github"
},
"original": {
"owner": "openstenoproject",
"repo": "plover-flake",
"type": "github"
}
},
"plover-machine-hid": {
"flake": false,
"locked": {
"lastModified": 1757266704,
"narHash": "sha256-S+NBVnLjWdINTRpNIZvGotNGiMVSnvq1NZRPnKCmZyM=",
"owner": "dnaq",
"repo": "plover-machine-hid",
"rev": "db917f8b2545964fdaa2f664d1d1e2afafae96a1",
"type": "github"
},
"original": {
"owner": "dnaq",
"repo": "plover-machine-hid",
"type": "github"
}
},
"plover-stroke": {
"flake": false,
"locked": {
"lastModified": 1652559629,
"narHash": "sha256-A75OMzmEn0VmDAvmQCp6/7uptxzwWJTwsih3kWlYioA=",
"owner": "openstenoproject",
"repo": "plover_stroke",
"rev": "e717a1983b58dcba644153a542dbf8514425a39b",
"type": "github"
},
"original": {
"owner": "openstenoproject",
"repo": "plover_stroke",
"type": "github"
}
},
"plover2cat": {
"flake": false,
"locked": {
"lastModified": 1757574932,
"narHash": "sha256-kIDuIezGN+n3RDWMOlR6eFlQlQDp6okKgQCk71AgUDs=",
"owner": "greenwyrt",
"repo": "plover2CAT",
"rev": "477163958b1a9e6fc48337be137173570fa7350a",
"type": "github"
},
"original": {
"owner": "greenwyrt",
"repo": "plover2CAT",
"type": "github"
}
},
"plover_plugins_registry": {
"flake": false,
"locked": {
"lastModified": 1761769055,
"narHash": "sha256-OLXZEkKGifMpngZfQ9JO/phKXZPNQMigEvT4DWKtjJo=",
"owner": "openstenoproject",
"repo": "plover_plugins_registry",
"rev": "1420aaf4e792c328acd5233a78f343b9167a72e8",
"type": "github"
},
"original": {
"owner": "openstenoproject",
"repo": "plover_plugins_registry",
"type": "github"
}
},
"pyobjc": {
"flake": false,
"locked": {
"lastModified": 1736669867,
"narHash": "sha256-Kj1CH1+RYTFszao9G7P3fnsgBjTcvsq4ZpxdjHzQ520=",
"owner": "ronaldoussoren",
"repo": "pyobjc",
"rev": "e29d3a0c80b5bb852e4311ce10827efab9844c6c",
"type": "github"
},
"original": {
"owner": "ronaldoussoren",
"ref": "v11.0",
"repo": "pyobjc",
"type": "github"
}
},
"root": {
"inputs": {
"beads-flake": "beads-flake",
"impermanence": "impermanence",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_2",
"nixpkgs-unstable": "nixpkgs-unstable",
"plover-flake": "plover-flake",
"talon-nix": "talon-nix"
}
},
"rtf-tokenize": {
"flake": false,
"locked": {
"lastModified": 1751102035,
"narHash": "sha256-bM/DFl1mpHgeBItdyA5Tt+Eo9u82Gz+6qwft2h0bM94=",
"owner": "openstenoproject",
"repo": "rtf_tokenize",
"rev": "5c4ad772f4b45ceb35b60584e22a171e90526916",
"type": "github"
},
"original": {
"owner": "openstenoproject",
"repo": "rtf_tokenize",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"talon-nix": {
"inputs": {
"nix-github-actions": "nix-github-actions",
"nixpkgs": "nixpkgs_4"
},
"locked": {
"lastModified": 1746431176,
"narHash": "sha256-bwXLFy2pDpNE60EkVltrmiRgwNWLo4eYBesP997p8mg=",
"owner": "nix-community",
"repo": "talon-nix",
"rev": "cc110629c5f0be12e839b2aea6a16880f1822706",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "talon-nix",
"type": "github"
}
}
},
"root": "root",
"version": 7
}

44
hosts/liminal/flake.nix Normal file
View file

@ -0,0 +1,44 @@
{
description = "NixOS configuration for liminal (Framework 16)";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
nixos-hardware.url = "github:NixOS/nixos-hardware";
impermanence.url = "github:nix-community/impermanence";
talon-nix.url = "github:nix-community/talon-nix";
plover-flake.url = "github:openstenoproject/plover-flake";
beads-flake.url = "github:steveyegge/beads";
};
outputs = { self, nixpkgs, nixpkgs-unstable, nixos-hardware, impermanence, talon-nix, plover-flake, beads-flake, ... }:
let
system = "x86_64-linux";
# Create unstable overlay
overlay-unstable = final: prev: {
unstable = import nixpkgs-unstable {
inherit system;
config.allowUnfree = true;
};
};
in
{
nixosConfigurations.liminal = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = {
inherit nixos-hardware impermanence talon-nix plover-flake beads-flake;
};
modules = [
# Add unstable overlay
({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; })
# Import configuration
./configuration.nix
];
};
};
}

72
hosts/liminal/hardware-configuration.nix Normal file
View file

@ -0,0 +1,72 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "none";
fsType = "tmpfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/E270-3DFB";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/8be833f2-6247-49e4-a6cb-f8ebe69619f6";
fsType = "btrfs";
options = [ "subvol=home" ];
};
boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/2fade11e-8347-415d-8629-0578a7c8d534";
fileSystems."/nix" =
{ device = "/dev/disk/by-uuid/8be833f2-6247-49e4-a6cb-f8ebe69619f6";
fsType = "btrfs";
options = [ "subvol=nix" ];
};
fileSystems."/persist" =
{ device = "/dev/disk/by-uuid/8be833f2-6247-49e4-a6cb-f8ebe69619f6";
fsType = "btrfs";
options = [ "subvol=persist" ];
};
fileSystems."/var/lib" =
{ device = "/dev/disk/by-uuid/8be833f2-6247-49e4-a6cb-f8ebe69619f6";
fsType = "btrfs";
options = [ "subvol=var/lib" ];
};
fileSystems."/var/log" =
{ device = "/dev/disk/by-uuid/8be833f2-6247-49e4-a6cb-f8ebe69619f6";
fsType = "btrfs";
options = [ "subvol=var/log" ];
};
#swapDevices =
# [ { device = "/dev/disk/by-uuid/4ad150c5-5d21-422c-8038-18952e1d999d"; }
# ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

57
hosts/liminal/pkgs/hp15c/default.nix Normal file
View file

@ -0,0 +1,57 @@
{ stdenv, fetchzip, autoPatchelfHook, makeWrapper, lib, unstable }:
stdenv.mkDerivation rec {
pname = "hp15c";
version = "4.5.00";
src = fetchzip {
url = "https://www.hpcalc.org/other/pc/HP-15C_4.5.00_Linux_x86_64.zip";
sha256 = "15hxpckif4sab3lwkksqfnsf8agn545g2f5ijm6xrs2b23hdflmv";
stripRoot = false;
};
nativeBuildInputs = [
autoPatchelfHook
makeWrapper
];
buildInputs = [
unstable.tcl
unstable.tk
];
installPhase = ''
mkdir -p $out/bin
mkdir -p $out/share/hp15c
mkdir -p $out/share/fonts/truetype
# Install the binary
install -Dm755 HP-15C $out/bin/hp15c
# Install the font
install -Dm644 HP-15C_Simulator_Font.ttf $out/share/fonts/truetype/
# Install documentation
cp -r doc $out/share/hp15c/
cp "Read Me & Release Notes.html" $out/share/hp15c/
# Create a wrapper script that sets up the environment
makeWrapper $out/bin/hp15c $out/bin/hp15c-calculator \
--set FONTCONFIG_PATH /etc/fonts \
--set FONTCONFIG_FILE /etc/fonts/fonts.conf \
--prefix TCLLIBPATH : "${unstable.tcl}/lib" \
--prefix TCLLIBPATH : "${unstable.tk}/lib" \
--set TK_LIBRARY "${unstable.tk}/lib/tk8.6" \
--set TCL_LIBRARY "${unstable.tcl}/lib/tcl8.6" \
--prefix LD_LIBRARY_PATH : "${unstable.tcl}/lib" \
--prefix LD_LIBRARY_PATH : "${unstable.tk}/lib"
'';
meta = with lib; {
description = "HP-15C Calculator Simulator";
homepage = "https://www.hpcalc.org/other/pc/";
license = licenses.unfree; # You should check the actual license
platforms = [ "x86_64-linux" ];
maintainers = [ ];
};
}

37
hosts/liminal/pkgs/nonpareil/default.nix Normal file
View file

@ -0,0 +1,37 @@
{ stdenv, lib, fetchFromGitHub, pkg-config, autoreconfHook, pkgs }:
stdenv.mkDerivation rec {
pname = "nonpareil";
version = "unstable-2024-04-25";
src = fetchFromGitHub {
owner = "brouhaha";
repo = "nonpareil";
rev = "c347bc1ab20170c253512042f7aac0d952f304ea";
sha256 = "1d130hmsgvlmj8iy8sdd0frx9gzsc68wp84zdax6i8f7dhqdfxzx"; # You'll need to replace this
};
nativeBuildInputs = [
pkg-config
autoreconfHook
];
buildInputs = [
pkgs.gtk2
pkgs.glib
pkgs.libxml2
pkgs.SDL
];
configureFlags = [
"--with-gtk2"
];
meta = with lib; {
description = "Microcode-level simulation of HP calculators";
homepage = "https://github.com/brouhaha/nonpareil";
license = licenses.gpl2;
platforms = platforms.linux;
maintainers = [ ];
};
}

25
hosts/liminal/secrets/config.yaml Normal file
View file

@ -0,0 +1,25 @@
hashedPassword: ENC[AES256_GCM,data:FvSo0j1H/FpP8ljQTYNSRvAPDvvXi1TcIJnIY+WgTRiHZ0vb426+Pp8FNCqA06Rr/a+5T23ni2s1gOgX143LA4rI9xo9CgLxyw==,iv:QlenOW5mUdbS9+mnpoHfmVG/qnKLETuyVn8zOatTY98=,tag:6jslZ2Lth512XioIgHL92Q==,type:str]
sops:
age:
- recipient: age17sdp0gguexd88qel74fa4zeckxh93gqpkayz366fz6yvjauw7vcq7w6y45
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLdzBYdlZiQXZpNVVkMSs0
QzdtTU82bzFsSHlPY2tSYVB4THFZbmxyVUdzCkZqODVEZlRSSm9SMnFmZnhKTk5U
WEh3V1Zua1QyNTlvVGRHNktyQi9ualUKLS0tIGZFaEIxT0NVZTkvOXZQNFI5VTlP
TDM5czFEc1lCU281R0NKQkQ1bjNLL0kKHtVBtagNiz2fyyudwBJpxhfQBUMt++Be
tE1SGo+TirLPCgFK/ynw2zXUj7IZ8+qANOpGmStroUBgJGfoEHHlwg==
-----END AGE ENCRYPTED FILE-----
- recipient: age1jv3t4pltlsympq86vjhjjr66hvm25hv9utlk2nwa99qxfapc2amq2vmkel
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWL2dOcWpFWnZXYWdOZzhx
Z1hLUnRzTXo4N21ESXd6N1VhTVZUVVNHSFNNCnE2QkJ5clQvaExyY2dWMUZic3RI
NVJyVUNFZXdOTktjQ2ZYT0xER2x6Z1EKLS0tIHQxTFFTYlVnYjdiRUZnQXRDWHVB
WHVZYkQvN1MxaEV4NElLcHFPZmNjZVkKbUHXfK4Wt7MRS2XYBy9v/SQ3a6T4V5FK
bjd0nVVTJeMnE6V9avjNuOCVUkug4PylIzSMSohfpR6AmSy68jYElw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-29T21:00:07Z"
mac: ENC[AES256_GCM,data:IEWEy84qU3Lzq4tuNITS1JjxfNSNMksQMVTJbDHNyaN+gpVhjgS/SIX3ESU36S+CcgR/iczRvUvURA+s0csiMXCKfx2IwVuTIKqtTArDubjlqivr7fhY94VTkFz2e3ohfcHiJt6uzhzxHNDAAE5Ju9TzIAVyf+FRFZFUMRQwddc=,iv:oqnvxQg7mN7yWYoIahdJnKUestSeIMKvawt7+fDC38o=,tag:fcpPcvy+HTFSPTUM2GZ+0w==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0

304
hosts/zima/configuration.nix Normal file
View file

@ -0,0 +1,304 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
{ config, lib, pkgs, impermanence, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
"${impermanence}/nixos.nix"
];
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_7;
boot.supportedFilesystems = [ "zfs" ];
boot.zfs.extraPools = [ "bitrot" ];
hardware.enableAllFirmware = true;
nixpkgs.config.allowUnfree = true;
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
fileSystems = {
"/persist" = {
device = "rpool/safe/persist";
fsType = "zfs";
neededForBoot = true;
};
};
# TODO postResumeCommands after update
boot.initrd.postDeviceCommands = lib.mkAfter ''
zfs rollback -r rpool/local/root@blank
'';
networking.hostName = "zima"; # Define your hostname.
networking.hostId = "78599900";
# Pick only one of the below networking options.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
# Set your time zone.
time.timeZone = "America/Los_Angeles";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
# i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# useXkbConfig = true; # use xkb.options in tty.
# };
# Enable the X11 windowing system.
# services.xserver.enable = true;
virtualisation.docker.enable = true;
services.cron = {
enable = true;
systemCronJobs = [
"*/5 * * * * hunner widget drive zima $(zfs list -o available -H /bitrot) free"
];
};
# Configure keymap in X11
# services.xserver.xkb.layout = "us";
# services.xserver.xkb.options = "eurosign:e,caps:escape";
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable sound.
# sound.enable = true;
# hardware.pulseaudio.enable = true;
# Enable touchpad support (enabled default in most desktopManager).
# services.xserver.libinput.enable = true;
# sops-nix secrets
sops.defaultSopsFile = ./secrets/config.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets.hashedPassword.neededForUsers = true;
# Define a user account. Don't forget to set a password with ‘passwd’.
users.users.hunner = {
uid = 1000;
isNormalUser = true;
extraGroups = [ "wheel" "docker" ]; # Enable ‘sudo’ for the user.
hashedPasswordFile = config.sops.secrets.hashedPassword.path;
packages = with pkgs; [
tree
];
};
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
git
wget
tmux
awscli2
nix-search-cli
smartmontools
python3
ffmpeg
jq
sanoid
unrar
unzip
docker-compose
lzop # for syncoid
pv # for syncoid
mbuffer # for syncoid
restic
openssl
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# List services that you want to enable:
services.avahi = {
enable = true;
nssmdns = true;
publish = {
enable = true;
addresses = true;
workstation = true;
};
};
services.zfs.autoScrub = {
enable = true;
interval = "weekly";
pools = [ "bitrot" ];
};
services.sanoid = {
enable = true;
templates.production = {
frequently = 0;
hourly = 12;
daily = 10;
monthly = 2;
yearly = 1;
autosnap = true;
autoprune = true;
recursive = true;
};
datasets."bitrot" = {
useTemplate = [ "production" ];
};
datasets."rpool/safe" = {
useTemplate = [ "production" ];
};
};
users.users.backup = {
uid = 1001;
isNormalUser = true;
description = "Backup replication user";
shell = pkgs.bash;
packages = with pkgs; [
sanoid
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDtgW+cxPjo70k6dkYPqzP0FR5G9zvbArp/85ZHRrMRL backup@cryochamber"
];
};
services.syncoid = {
enable = true;
user = "backup";
sshKey = "/var/lib/syncoid/.ssh/id_ed25519";
commonArgs = [
#"--sshoption=StrictHostKeyChecking=off"
"--sshoption=UserKnownHostsFile=/var/lib/syncoid/.ssh/known_hosts"
"--sshoption=IdentitiesOnly=yes"
"--no-sync-snap"
];
commands."backup-zima-bitrot" = {
source = "bitrot";
target = "root@cryochamber:tank/backups/zima/bitrot";
recursive = true;
};
commands."backup-zima-rpool-safe" = {
source = "rpool/safe";
target = "root@cryochamber:tank/backups/zima/rpool-safe";
recursive = true;
};
};
# This was needed when trying to get the backup user to work instead of using
# root; probably not needed now
systemd.services.syncoid-backup-zima-bitrot.serviceConfig = {
Environment = [
"HOME=/var/lib/syncoid"
"SSH_AUTH_SOCK="
];
ExecStartPre = [
"+${pkgs.coreutils}/bin/mkdir -p /var/lib/syncoid/.ssh"
"+${pkgs.coreutils}/bin/cp /home/backup/.ssh/id_ed25519 /var/lib/syncoid/.ssh/"
"+${pkgs.coreutils}/bin/cp /home/backup/.ssh/known_hosts /var/lib/syncoid/.ssh/"
"+${pkgs.coreutils}/bin/chown -R backup:syncoid /var/lib/syncoid/.ssh"
"+${pkgs.coreutils}/bin/chmod 700 /var/lib/syncoid/.ssh"
"+${pkgs.coreutils}/bin/chmod 600 /var/lib/syncoid/.ssh/id_ed25519"
];
};
services.tailscale.enable = true;
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.settings.Macs = [
"hmac-sha2-256"
"hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com"
];
services.openssh.settings.AcceptEnv = "LANG LC_*";
# Old style
#environment.etc = {
# nixos.source = "/persist/etc/nixos";
# adjtime.source = "/persist/etc/adjtime";
# NIXOS.source = "/persist/etc/NIXOS";
# machine-id.source = "/persist/etc/machine-id";
# "ssh/ssh_host_rsa_key".source = "/persist/etc/ssh/ssh_host_rsa_key";
# "ssh/ssh_host_rsa_key.pub".source = "/persist/etc/ssh/ssh_host_rsa_key.pub";
# "ssh/ssh_host_ed25519_key".source = "/persist/etc/ssh/ssh_host_ed25519_key";
# "ssh/ssh_host_ed25519_key.pub".source = "/persist/etc/ssh/ssh_host_ed25519_key.pub";
#};
# https://www.reddit.com/r/NixOS/comments/13j64qh/how_to_add_impermanence_afterwards/?rdt=38929 also suggests
# - /var/log
# - /var/tmp
# - /var/lib/nixos
# but to do that I'd need something other than environment.etc
environment.persistence."/persist" = {
hideMounts = true;
directories = [
"/root"
"/etc/nixos"
"/etc/ssh"
#"/var/log"
#"/var/lib/nixos"
#"/var/lib/systemd/coredump"
#"/etc/NetworkManager/system-connections"
];
files = [
"/etc/machine-id"
];
};
security.sudo.extraConfig = ''
# rollback results in sudo lectures after each reboot
Defaults lecture = never
'';
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 32400 ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
# This option defines the first version of NixOS you have installed on this particular machine,
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
#
# Most users should NEVER change this value after the initial install, for any reason,
# even if you've upgraded your system to a new NixOS release.
#
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
# so changing it will NOT upgrade your system.
#
# This value being lower than the current NixOS release does NOT mean your system is
# out of date, out of support, or vulnerable.
#
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
# and migrated your data accordingly.
#
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
system.stateVersion = "23.11"; # Did you read the comment?
}

23
hosts/zima/flake.nix Normal file
View file

@ -0,0 +1,23 @@
{
inputs = {
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = {
self,
nixpkgs,
sops-nix,
}:
let
system = "x86_64-linux";
in
{
nixosConfigurations.zima = nixpkgs.lib.nixosSystem {
modules = [
./configuration.nix
sops-nix.nixosModules.sops
];
};
};
}

62
hosts/zima/hardware-configuration.nix Normal file
View file

@ -0,0 +1,62 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "rpool/local/root";
fsType = "zfs";
};
fileSystems."/nix" =
{ device = "rpool/local/nix";
fsType = "zfs";
};
fileSystems."/home" =
{ device = "rpool/safe/home";
fsType = "zfs";
};
fileSystems."/persist" =
{ device = "rpool/safe/persist";
fsType = "zfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/08E2-681A";
fsType = "vfat";
};
fileSystems."/var/lib" =
{ device = "rpool/local/var/lib";
fsType = "zfs";
};
fileSystems."/var/log" =
{ device = "rpool/local/var/log";
fsType = "zfs";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

25
hosts/zima/secrets/config.yaml Normal file
View file

@ -0,0 +1,25 @@
hashedPassword: ENC[AES256_GCM,data:8kCOlv0GfypM0kTNLALKDdWtb4bK6wK1o1DgnzHbuUqJUfIWt6wx1ILVXfuti0rHO38lkuL05LXt9sLh1niPEmFlS4OLNCMHWg==,iv:bNbQex3+6LkDvnypQP7obFSJZ3kuLgFegu+xDQsJZh8=,tag:sN/4YVcEXXPG5C0kvh56Bg==,type:str]
sops:
age:
- recipient: age17sdp0gguexd88qel74fa4zeckxh93gqpkayz366fz6yvjauw7vcq7w6y45
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPV3kwUFpNblhubTh0b293
eUF0WDVIbGxWVlA1NnpjNFo1RXhJalY5OWpzCmZxYkMxa2tCQi9iRG96YkVhMVVK
RDQ3T3Y0SnVYdnZYemp6Q2lnblpXZEEKLS0tIFNHWUVremJWN2tjYUN1UmpUdnhQ
RWIzVjBiMjRoa0VLNDNuWDFqa1lDcVEKFitdIkUqqMuWOTn+liboLyXPBkxd2u3O
K62aQV5UxXjDmwXeH6woDCiSMFfgdWlJT6PfvS+y1FO6VKRQ39ob4w==
-----END AGE ENCRYPTED FILE-----
- recipient: age16ptwug2yygtfh2dyy5dahaz85pfv3nvqyks03wltyymhyal25uyskz3q9v
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Q3MzS3Y1WWhkUmlFMUcw
amx1RU1hZ2lJWXRVajE4Q1UvbVFlOVZ5b0E4CjU3bENCYmM2Tmg3NkwwWWRRdldP
Zm4yOHlCMU5QQTRXV2xFRTV1UGtGZGcKLS0tIDh2WitGbDQ0aEx6c2t5eTF0djFT
L0hXK1ZSY292dTRDU0Z2NGlJNHhpb2cK76bGG3yJD8ORZFPvW/WAlHLi9mt2A8+Q
/uOs6FBcubW6MGiC50OlSAI19yvg7BYqqWRFI+XEkXjxbLlwhWy1RA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-21T01:32:03Z"
mac: ENC[AES256_GCM,data:PezvH3WCehALUH3QEvIu21hJX5xyjnuGIvZAtVbEhDeD1JdO+lXSFVyH2gWjNWSgrDiDEKXMKtdl0Q+5eXJPpqHjNHIh0lDLePG0JSMZWdOz/F7uuiXqqeA7b4Plrf28PniqA4+c2PURhp5UggW6Tb2mBmVgwtsSuVH7kPnted8=,iv:59HIfn640uI6YvRwJ5WCY9QiJLvMnrdVnjpsCTG000k=,tag:3rZ4sm9cwc/n9cK/SOnMLw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0