From dd461e48043dabee4694e2b200f4c1d9cfdbc3d9 Mon Sep 17 00:00:00 2001 From: Preston Pan Date: Mon, 13 Jan 2025 22:11:02 -0800 Subject: merge these two repos into one --- nix/systems/desktop/configuration.nix | 399 ++++++++++ nix/systems/desktop/home.nix | 14 + nix/systems/desktop/sda-simple.nix | 39 + nix/systems/desktop/user.nix | 1395 +++++++++++++++++++++++++++++++++ nix/systems/desktop/vars.nix | 54 ++ nix/systems/installer/commits.nix | 4 + nix/systems/installer/iso.nix | 181 +++++ 7 files changed, 2086 insertions(+) create mode 100644 nix/systems/desktop/configuration.nix create mode 100644 nix/systems/desktop/home.nix create mode 100644 nix/systems/desktop/sda-simple.nix create mode 100644 nix/systems/desktop/user.nix create mode 100644 nix/systems/desktop/vars.nix create mode 100644 nix/systems/installer/commits.nix create mode 100644 nix/systems/installer/iso.nix (limited to 'nix/systems') diff --git a/nix/systems/desktop/configuration.nix b/nix/systems/desktop/configuration.nix new file mode 100644 index 0000000..8359d25 --- /dev/null +++ b/nix/systems/desktop/configuration.nix @@ -0,0 +1,399 @@ +{ pkgs, lib, ... }: +let + vars = import ./vars.nix; +in +{ + imports = []; + + hardware.enableAllFirmware = true; + + documentation = { + enable = true; + man.enable = true; + dev.enable = true; + }; + + environment = { + etc = { + securetty.text = '' + # /etc/securetty: list of terminals on which root is allowed to login. + # See securetty(5) and login(1). + ''; + }; + }; + + systemd = { + coredump.enable = false; + network.config.networkConfig.IPv6PrivacyExtensions = "kernel"; + tmpfiles.settings = { + "restricthome"."/home/*".Z.mode = "~0700"; + + "restrictetcnixos"."/etc/nixos/*".Z = { + mode = "0000"; + user = "root"; + group = "root"; + }; + }; + }; + + + boot = { + extraModulePackages = [ ]; + + initrd = { + availableKernelModules = [ + "xhci_pci" + "ahci" + "usb_storage" + "sd_mod" + "nvme" + "sd_mod" + "ehci_pci" + "rtsx_pci_sdmmc" + "usbhid" + ]; + + kernelModules = [ ]; + }; + + lanzaboote = { + enable = vars.secureBoot; + pkiBundle = "/etc/secureboot"; + }; + + loader = { + systemd-boot.enable = lib.mkForce (! vars.secureBoot); + efi.canTouchEfiVariables = true; + }; + + kernelModules = [ + "snd-seq" + "snd-rawmidi" + "xhci_hcd" + "kvm_intel" + ]; + + kernelParams = [ + "debugfs=off" + "page_alloc.shuffle=1" + "slab_nomerge" + "page_poison=1" + + # madaidan + "pti=on" + "randomize_kstack_offset=on" + "vsyscall=none" + "module.sig_enforce=1" + "lockdown=confidentiality" + + # cpu + "spectre_v2=on" + "spec_store_bypass_disable=on" + "tsx=off" + "tsx_async_abort=full,nosmt" + "mds=full,nosmt" + "l1tf=full,force" + "nosmt=force" + "kvm.nx_huge_pages=force" + + # hardened + "extra_latent_entropy" + + # mineral + "init_on_alloc=1" + "random.trust_cpu=off" + "random.trust_bootloader=off" + "intel_iommu=on" + "amd_iommu=force_isolation" + "iommu=force" + "iommu.strict=1" + "init_on_free=1" + "quiet" + "loglevel=0" + ]; + + blacklistedKernelModules = [ + "netrom" + "rose" + + "adfs" + "affs" + "bfs" + "befs" + "cramfs" + "efs" + "erofs" + "exofs" + "freevxfs" + "f2fs" + "hfs" + "hpfs" + "jfs" + "minix" + "nilfs2" + "ntfs" + "omfs" + "qnx4" + "qnx6" + "sysv" + "ufs" + ]; + + kernel.sysctl = { + "kernel.ftrace_enabled" = false; + "net.core.bpf_jit_enable" = false; + "kernel.kptr_restrict" = 2; + + # madaidan + "vm.swappiness" = 1; + "vm.unprivileged_userfaultfd" = 0; + "dev.tty.ldisc_autoload" = 0; + "kernel.kexec_load_disabled" = 1; + "kernel.sysrq" = 4; + "kernel.perf_event_paranoid" = 3; + + # net + "net.ipv4.icmp_echo_ignore_broadcasts" = true; + + "net.ipv4.conf.all.accept_redirects" = false; + "net.ipv4.conf.all.secure_redirects" = false; + "net.ipv4.conf.default.accept_redirects" = false; + "net.ipv4.conf.default.secure_redirects" = false; + "net.ipv6.conf.all.accept_redirects" = false; + "net.ipv6.conf.default.accept_redirects" = false; + }; + }; + + networking = { + useDHCP = lib.mkDefault true; + hostName = vars.hostName; + networkmanager = { + enable = true; + # wifi.macAddress = ""; + }; + firewall = { + allowedTCPPorts = [ ]; + allowedUDPPorts = [ ]; + }; + }; + + hardware = { + cpu.intel.updateMicrocode = true; + bluetooth = { + enable = true; + powerOnBoot = true; + }; + + graphics = { + enable = true; + }; + + pulseaudio.enable = false; + }; + + services = { + chrony = { + enable = true; + enableNTS = true; + servers = [ "time.cloudflare.com" "ptbtime1.ptb.de" "ptbtime2.ptb.de" ]; + }; + + jitterentropy-rngd.enable = true; + resolved.dnssec = true; + # usbguard.enable = true; + usbguard.enable = false; + dbus = { + apparmor = "enabled"; + }; + + tor = { + enable = true; + openFirewall = true; + client = { + enable = true; + socksListenAddress = { + IsolateDestAddr = true; + addr = "127.0.0.1"; + port = 9050; + }; + dns.enable = true; + }; + torsocks = { + enable = true; + server = "127.0.0.1:9050"; + }; + }; + + xserver = { + displayManager = { + startx.enable = true; + }; + + windowManager = { + i3 = { + enable = true; + package = pkgs.i3-gaps; + }; + }; + + desktopManager = { + runXdgAutostartIfNone = true; + }; + + xkb = { + layout = "us"; + variant = ""; + options = "caps:escape"; + }; + + videoDrivers = vars.videoDrivers; + enable = true; + }; + + pipewire = { + enable = true; + alsa = { + enable = true; + support32Bit = true; + }; + pulse.enable = true; + jack.enable = true; + wireplumber.enable = true; + extraConfig.pipewire-pulse."92-low-latency" = { + "context.properties" = [ + { + name = "libpipewire-module-protocol-pulse"; + args = { }; + } + ]; + "pulse.properties" = { + "pulse.min.req" = "32/48000"; + "pulse.default.req" = "32/48000"; + "pulse.max.req" = "32/48000"; + "pulse.min.quantum" = "32/48000"; + "pulse.max.quantum" = "32/48000"; + }; + "stream.properties" = { + "node.latency" = "32/48000"; + "resample.quality" = 1; + }; + }; + }; + + kanata = { + enable = true; + }; + + openssh = { + enable = true; + settings = { + PasswordAuthentication = true; + AllowUsers = [ vars.userName ]; + PermitRootLogin = "no"; + KbdInteractiveAuthentication = false; + }; + }; + + # Misc. + udev = { + extraRules = ''''; + packages = with pkgs; [ + platformio-core + platformio-core.udev + openocd + ]; + }; + + printing.enable = true; + udisks2.enable = true; + }; + + programs = { + nix-ld.enable = true; + zsh.enable = true; + light.enable = true; + ssh.enableAskPassword = false; + }; + + nixpkgs = { + hostPlatform = lib.mkDefault "x86_64-linux"; + config = { + allowUnfree = true; + cudaSupport = false; + }; + }; + + security = { + apparmor = { + enable = true; + killUnconfinedConfinables = true; + }; + + pam.loginLimits = [ + { domain = "*"; item = "nofile"; type = "-"; value = "32768"; } + { domain = "*"; item = "memlock"; type = "-"; value = "32768"; } + ]; + rtkit.enable = true; + + lockKernelModules = true; + protectKernelImage = true; + allowSimultaneousMultithreading = false; + forcePageTableIsolation = true; + + tpm2 = { + enable = true; + pkcs11.enable = true; + tctiEnvironment.enable = true; + }; + + auditd.enable = true; + audit.enable = true; + chromiumSuidSandbox.enable = true; + sudo.enable = true; + }; + + xdg.portal = { + enable = true; + wlr.enable = true; + extraPortals = with pkgs; [ xdg-desktop-portal-gtk xdg-desktop-portal xdg-desktop-portal-hyprland ]; + config.common.default = "*"; + }; + + environment.systemPackages = with pkgs; [ + cryptsetup + restic + sbctl + linux-manual + man-pages + man-pages-posix + tree + ]; + + + users.users = { + root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINSshvS1N/42pH9Unp3Zj4gjqs9BXoin99oaFWYHXZDJ preston@preston-arch" + ]; + + "${vars.userName}" = { + initialPassword = "${vars.userName}"; + isNormalUser = true; + description = vars.fullName; + extraGroups = [ "networkmanager" "wheel" "video" "docker" "jackaudio" "tss" "dialout" ]; + shell = pkgs.zsh; + packages = []; + }; + }; + + + nix.settings.experimental-features = "nix-command flakes"; + time.timeZone = vars.timeZone; + i18n.defaultLocale = "en_CA.UTF-8"; + + system = { + stateVersion = "24.11"; + nixos = { + tags = [ "continuity-2.0" ]; + }; + }; +} diff --git a/nix/systems/desktop/home.nix b/nix/systems/desktop/home.nix new file mode 100644 index 0000000..166bd16 --- /dev/null +++ b/nix/systems/desktop/home.nix @@ -0,0 +1,14 @@ +{ sops-nix, ... }: +let + vars = import ./vars.nix; +in +{ + home-manager = { + sharedModules = [ + sops-nix.homeManagerModules.sops + ]; + useGlobalPkgs = true; + useUserPackages = true; + users."${vars.userName}" = ./user.nix; + }; +} diff --git a/nix/systems/desktop/sda-simple.nix b/nix/systems/desktop/sda-simple.nix new file mode 100644 index 0000000..86263dd --- /dev/null +++ b/nix/systems/desktop/sda-simple.nix @@ -0,0 +1,39 @@ +# This will install a simple system with a root and boot partition. +# Make sure to change the entry device entry to the one that you +# are installing the configuration to. +{ + disko.devices = { + disk = { + my-disk = { + # change this entry + device = "/dev/sda"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + ESP = { + type = "EF00"; + size = "500M"; + priority = 1; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + root = { + size = "100%"; + priority = 2; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/nix/systems/desktop/user.nix b/nix/systems/desktop/user.nix new file mode 100644 index 0000000..85dcd20 --- /dev/null +++ b/nix/systems/desktop/user.nix @@ -0,0 +1,1395 @@ +{ lib, config, pkgs, wallpapers, scripts, ... }: +let + vars = import ./vars.nix; +in +{ + sops = { + defaultSopsFile = ../../secrets/secrets.yaml; + age = { + keyFile = "/home/${vars.userName}/.ssh/keys.txt"; + }; + secrets.mail = { + format = "yaml"; + path = "${config.sops.defaultSymlinkPath}/mail"; + }; + secrets.digikey = { + format = "yaml"; + path = "${config.sops.defaultSymlinkPath}/digikey"; + }; + + defaultSymlinkPath = "/run/user/1000/secrets"; + defaultSecretsMountPoint = "/run/user/1000/secrets.d"; + }; + + home = { + activation.startup-files = lib.hm.dag.entryAfter [ "installPackages" ] '' + if [ ! -d "/home/${vars.userName}/org/website/" ]; then + mkdir -p /home/${vars.userName}/org/website/ + ${pkgs.git}/bin/git clone https://git.${vars.remoteHost}/ret2pop-website.git /home/${vars.userName}/org/website/ + fi + + if [ ! -d "/home/${vars.userName}/src/publish-org-roam-ui" ]; then + mkdir -p /home/${vars.userName}/src + ${pkgs.git}/bin/git clone https://git.${vars.remoteHost}/publish-org-roam-ui.git /home/${vars.userName}/src/publish-org-roam-ui + fi + + if [ ! -d "/home/${vars.userName}/.password-store" ]; then + ${pkgs.git}/bin/git clone https://git.${vars.remoteHost}/passwords.git /home/${vars.userName}/.password-store + fi + + if [ ! -d "/home/${vars.userName}/email/ret2pop/" ]; then + mkdir -p /home/${vars.userName}/email/ret2pop/ + fi + + if [ ! -d "/home/${vars.userName}/music" ]; then + mkdir -p /home/${vars.userName}/music + fi + + if [ ! -d "/home/${vars.userName}/sounds" ]; then + mkdir -p /home/${vars.userName}/sounds + fi + touch /home/${vars.userName}/org/agenda.org + touch /home/${vars.userName}/org/notes.org + + if [ ! -f "/home/${vars.userName}/.toughnix" ]; then + echo "Don't delete this file. Autogen by home manager" > "/home/${vars.userName}/.toughnix" + fi + ''; + + enableNixpkgsReleaseCheck = false; + username = vars.userName; + homeDirectory = "/home/${vars.userName}"; + stateVersion = "24.11"; + + packages = with pkgs; [ + # kicad + age + acpilight + alsa-utils + autobuild + bash-language-server + bear + bitcoin + bun + cargo + clang + clang-tools + curl + electrum + ffmpeg + fira-code + font-awesome_6 + fswebcam + gdb + ghostscript + git + gnumake + gnupg + graphviz + grim + gum + (writeShellScriptBin "post-install" '' +cd $HOME +ping -q -c1 google.com &>/dev/null && echo "online! Proceeding with the post-install..." || nmtui +sudo chown -R "$(whoami)":users toughnix + +sudo nixos-rebuild switch --flake ./toughnix#continuity +echo "Post install done! Now install your ssh and gpg keys. Log in again." +sleep 3 +exit +'') + helvum + imagemagick + inkscape + jq + krita + libnotify + miniserve + monero-cli + monero-gui + mpc-cli + mu + nil + nixd + nixfmt-rfc-style + nodejs + noto-fonts + noto-fonts-cjk-sans + noto-fonts-emoji + octaveFull + openscad + openscad-lsp + pandoc + passExtensions.pass-otp + pavucontrol + pfetch + pinentry + poetry + python3 + python312Packages.jedi + rsync + rust-analyzer + rustfmt + solc + sops + sox + swww + texliveFull + tor-browser + torsocks + typescript + vesktop + vim + vscode-langservers-extracted + x11_ssh_askpass + xdg-utils + yarn + (aspellWithDicts + (dicts: with dicts; [ en en-computers en-science ])) + (nerdfonts.override { fonts = [ "Iosevka" ]; }) + (pass.withExtensions (ext: with ext; [ + pass-otp + pass-import + pass-genphrase + pass-update + pass-tomb + ])) + ]; + }; + + services = { + mako = { + enable = true; + backgroundColor = "#11111bf8"; + textColor = "#cdd6f4"; + borderColor = "#89b4faff"; + borderRadius = 1; + font = "Fira Code 10"; + defaultTimeout = 3000; + extraConfig = '' +on-notify=exec mpv /home/${vars.userName}/sounds/notification.wav --no-config --no-video +''; + }; + + gpg-agent = { + pinentryPackage = pkgs.pinentry-emacs; + enable = true; + extraConfig = '' + allow-emacs-pinentry + allow-loopback-pinentry + ''; + }; + + gammastep = { + enable = true; + provider = "manual"; + latitude = 49.282730; + longitude = -123.120735; + + temperature = { + day = 5000; + night = 3000; + }; + + settings = { + general = { + adjustment-method = "wayland"; + }; + }; + }; + + mpd = { + enable = true; + dbFile = "/home/${vars.userName}/.config/mpd/db"; + dataDir = "/home/${vars.userName}/.config/mpd/"; + network.port = 6600; + musicDirectory = "/home/${vars.userName}/music"; + playlistDirectory = "/home/${vars.userName}/.config/mpd/playlists"; + network.listenAddress = "0.0.0.0"; + extraConfig = '' + audio_output { + type "pipewire" + name "pipewire output" + } + audio_output { + type "httpd" + name "My HTTP Stream" + encoder "opus" # optional + port "8000" + # quality "5.0" # do not define if bitrate is defined + bitrate "128000" # do not define if quality is defined + format "48000:16:1" + always_on "yes" # prevent MPD from disconnecting all listeners when playback is stopped. + tags "yes" # httpd supports sending tags to listening streams. + } + ''; + }; + }; + + programs = { + chromium = { + package = pkgs.chromium; + enable = true; + extensions = [ + "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock-origin lite + "dbepggeogbaibhgnhhndojpepiihcmeb" # vimium + "eimadpbcbfnmbkopoojfekhnkhdbieeh" # dark reader + "oicakdoenlelpjnkoljnaakdofplkgnd" # tree style tabs + "nkbihfbeogaeaoehlefnkodbefgpgknn" # metamask + ]; + }; + + mpv = { + enable = true; + config = { + profile = "gpu-hq"; + force-window = true; + ytdl-format = "bestvideo+bestaudio"; + cache-default = 4000000; + }; + }; + + yt-dlp = { + enable = true; + settings = { + embed-thumbnail = true; + embed-subs = true; + sub-langs = "all"; + downloader = "aria2c"; + downloader-args = "aria2c:'-c -x8 -s8 -k1M'"; + }; + }; + + wofi = { + enable = true; + settings = { + location = "bottom-right"; + allow_markup = true; + show = "drun"; + width = 750; + height = 400; + always_parse_args = true; + show_all = false; + term = "kitty"; + hide_scroll = true; + print_command = true; + insensitive = true; + prompt = "Run what, Commander?"; + columns = 2; + }; + + style = '' + @define-color rosewater #f5e0dc; + @define-color rosewater-rgb rgb(245, 224, 220); + @define-color flamingo #f2cdcd; + @define-color flamingo-rgb rgb(242, 205, 205); + @define-color pink #f5c2e7; + @define-color pink-rgb rgb(245, 194, 231); + @define-color mauve #cba6f7; + @define-color mauve-rgb rgb(203, 166, 247); + @define-color red #f38ba8; + @define-color red-rgb rgb(243, 139, 168); + @define-color maroon #eba0ac; + @define-color maroon-rgb rgb(235, 160, 172); + @define-color peach #fab387; + @define-color peach-rgb rgb(250, 179, 135); + @define-color yellow #f9e2af; + @define-color yellow-rgb rgb(249, 226, 175); + @define-color green #a6e3a1; + @define-color green-rgb rgb(166, 227, 161); + @define-color teal #94e2d5; + @define-color teal-rgb rgb(148, 226, 213); + @define-color sky #89dceb; + @define-color sky-rgb rgb(137, 220, 235); + @define-color sapphire #74c7ec; + @define-color sapphire-rgb rgb(116, 199, 236); + @define-color blue #89b4fa; + @define-color blue-rgb rgb(137, 180, 250); + @define-color lavender #b4befe; + @define-color lavender-rgb rgb(180, 190, 254); + @define-color text #cdd6f4; + @define-color text-rgb rgb(205, 214, 244); + @define-color subtext1 #bac2de; + @define-color subtext1-rgb rgb(186, 194, 222); + @define-color subtext0 #a6adc8; + @define-color subtext0-rgb rgb(166, 173, 200); + @define-color overlay2 #9399b2; + @define-color overlay2-rgb rgb(147, 153, 178); + @define-color overlay1 #7f849c; + @define-color overlay1-rgb rgb(127, 132, 156); + @define-color overlay0 #6c7086; + @define-color overlay0-rgb rgb(108, 112, 134); + @define-color surface2 #585b70; + @define-color surface2-rgb rgb(88, 91, 112); + @define-color surface1 #45475a; + @define-color surface1-rgb rgb(69, 71, 90); + @define-color surface0 #313244; + @define-color surface0-rgb rgb(49, 50, 68); + @define-color base #1e1e2e; + @define-color base-rgb rgb(30, 30, 46); + @define-color mantle #181825; + @define-color mantle-rgb rgb(24, 24, 37); + @define-color crust #11111b; + @define-color crust-rgb rgb(17, 17, 27); + + * { + font-family: 'Iosevka Nerd Font', monospace; + font-size: 14px; + } + + /* Window */ + window { + margin: 0px; + padding: 10px; + border: 0.16em solid @lavender; + border-radius: 0.1em; + background-color: @base; + animation: slideIn 0.5s ease-in-out both; + } + + /* Slide In */ + @keyframes slideIn { + 0% { + opacity: 0; + } + + 100% { + opacity: 1; + } + } + + /* Inner Box */ + #inner-box { + margin: 5px; + padding: 10px; + border: none; + background-color: @base; + animation: fadeIn 0.5s ease-in-out both; + } + + /* Fade In */ + @keyframes fadeIn { + 0% { + opacity: 0; + } + + 100% { + opacity: 1; + } + } + + /* Outer Box */ + #outer-box { + margin: 5px; + padding: 10px; + border: none; + background-color: @base; + } + + /* Scroll */ + #scroll { + margin: 0px; + padding: 10px; + border: none; + background-color: @base; + } + + /* Input */ + #input { + margin: 5px 20px; + padding: 10px; + border: none; + border-radius: 0.1em; + color: @text; + background-color: @base; + animation: fadeIn 0.5s ease-in-out both; + } + + #input image { + border: none; + color: @red; + } + + #input * { + outline: 4px solid @red!important; + } + + /* Text */ + #text { + margin: 5px; + border: none; + color: @text; + animation: fadeIn 0.5s ease-in-out both; + } + + #entry { + background-color: @base; + } + + #entry arrow { + border: none; + color: @lavender; + } + + /* Selected Entry */ + #entry:selected { + border: 0.11em solid @lavender; + } + + #entry:selected #text { + color: @mauve; + } + + #entry:drop(active) { + background-color: @lavender!important; + } + ''; + }; + + kitty = { + enable = true; + settings = { + enable_audio_bell = false; + font_family = "Iosevka Nerd Font"; + font_size = 14; + confirm_os_window_close = 0; + background_opacity = "0.9"; + # Catppuccin theme + foreground = "#cdd6f4"; + background = "#1e1e2e"; + selection_foreground = "#1e1e2e"; + selection_background = "#f5e0dc"; + cursor = "#f5e0dc"; + cursor_text_color = "#1e1e2e"; + url_color = "#f5e0dc"; + active_border_color = "#B4BEFE"; + inactive_border_color = "#6C7086"; + bell_border_color = "#F9E2AF"; + wayland_titlebar_color = "#1E1E2E"; + macos_titlebar_color = "#1E1E2E"; + active_tab_foreground = "#11111B"; + active_tab_background = "#CBA6F7"; + inactive_tab_foreground = "#CDD6F4"; + inactive_tab_background = "#181825"; + tab_bar_background = "#11111B"; + mark1_foreground = "#1E1E2E"; + mark1_background = "#B4BEFE"; + mark2_foreground = "#1E1E2E"; + mark2_background = "#CBA6F7"; + mark3_foreground = "#1E1E2E"; + mark3_background = "#74C7EC"; + color0 = "#45475A"; + color8 = "#585B70"; + color1 = "#F38BA8"; + color9 = "#F38BA8"; + color2 = "#A6E3A1"; + color10 = "#A6E3A1"; + color3 = "#F9E2AF"; + color11 = "#F9E2AF"; + color4 = "#89B4FA"; + color12 = "#89B4FA"; + color5 = "#F5C2E7"; + color13 = "#F5C2E7"; + color6 = "#94E2D5"; + color14 = "#94E2D5"; + color7 = "#BAC2DE"; + color15 = "#A6ADC8"; + }; + }; + + firefox = { + policies = { + EnableTrackingProtection = true; + OfferToSaveLogins = false; + }; + + package = pkgs.firefox-wayland; + enable = true; + + profiles = { + default = { + id = 0; + name = "default"; + isDefault = true; + + extensions = with pkgs.nur.repos.rycee.firefox-addons; [ + ublock-origin + tree-style-tab + firefox-color + vimium + metamask + ]; + + settings = { + media = { + memory_cache_max_size = 65536; + cache_readahead_limit = 7200; + cache_resume_threshold = 3600; + peerconnection.ice = { + proxy_only_if_behind_proxy = true; + default_address_only = true; + }; + }; + + gfx = { + content.skia-font-cache-size = 20; + canvas.accelerated = { + cache-items = 4096; + cache-size = 512; + }; + }; + + network = { + http = { + max-connections = 1800; + max-persistent-connections-per-server = 10; + max-urgent-start-excessive-connections-per-host = 5; + referer.XOriginTrimmingPolicy = 2; + }; + + buffer.cache = { + size = 262144; + count = 128; + }; + + dns = { + max_high_priority_threads = 8; + disablePrefetch = true; + }; + + pacing.requests.enabled = false; + dnsCacheExpiration = 3600; + ssl_tokens_cache_capacity = 10240; + prefetch-next = false; + predictor.enabled = false; + cookie.sameSite.noneRequiresSecure = true; + IDN_show_punycode = true; + auth.subresource-http-auth-allow = 1; + captive-portal-service.enabled = false; + connectivity-service.enabled = false; + }; + + browser = { + download = { + always_ask_before_handling_new_types = true; + manager.addToRecentDocs = false; + open_pdf_attachments_inline = true; + start_downloads_in_tmp_dir = true; + }; + + urlbar = { + suggest.quicksuggest.sponsored = false; + suggest.quicksuggest.nonsponsored = false; + suggest.calculator = true; + update2.engineAliasRefresh = true; + unitConversion.enabled = true; + trending.featureGate = false; + }; + + search = { + separatePrivateDefault.ui.enabled = true; + suggest.enabled = false; + }; + + newtabpage.activity-stream = { + feeds = { + topsites = false; + section.topstories = false; + telemetry = false; + }; + asrouter.userprefs.cfr = { + addons = false; + features = false; + }; + telemetry = false; + }; + + privatebrowsing = { + vpnpromourl = ""; + forceMediaMemoryCache = true; + }; + + display = { + focus_ring_on_anything = true; + focus_ring_style = 0; + focus_ring_width = 0; + }; + + cache.jsbc_compression_level = 3; + helperApps.deleteTempFileOnExit = true; + uitour.enabled = false; + sessionstore.interval = 60000; + formfill.enable = false; + xul.error_pages.expert_bad_cert = true; + contentblocking.category = "strict"; + ping-centre.telemetry = false; + discovery.enabled = false; + shell.checkDefaultBrowser = false; + preferences.moreFromMozilla = false; + tabs.tabmanager.enabled = false; + aboutConfig.showWarning = false; + aboutwelcome.enabled = false; + bookmarks.openInTabClosesMenu = false; + menu.showViewImageInfo = true; + compactmode.show = true; + safebrowsing.downloads.remote.enabled = false; + tabs.crashReporting.sendReport = false; + crashReports.unsubmittedCheck.autoSubmit2 = false; + privateWindowSeparation.enabled = false; + }; + + security = { + mixed_content = { + block_display_content = true; + upgrade_display_content = true; + }; + insecure_connection_text = { + enabled = true; + pbmode.enabled = true; + }; + OCSP.enabled = 0; + remote_settings.crlite_filters.enabled = true; + pki.crlite_mode = 2; + ssl.treat_unsafe_negotiation_as_broken = true; + tls.enable_0rtt_data = false; + }; + + toolkit = { + telemetry = { + unified = false; + enabled = false; + server = "data:,"; + archive.enabled = false; + newProfilePing.enabled = false; + shutdownPingSender.enabled = false; + updatePing.enabled = false; + bhrPing.enabled = false; + firstShutdownPing.enabled = false; + coverage.opt-out = true; + }; + coverage = { + opt-out = true; + endpoint.base = ""; + }; + legacyUserProfileCustomizations.stylesheets = true; + }; + + dom = { + security = { + https_first = true; + https_first_schemeless = true; + sanitizer.enabled = true; + }; + enable_web_task_scheduling = true; + }; + + layout = { + css = { + grid-template-masonry-value.enabled = true; + has-selector.enabled = true; + prefers-color-scheme.content-override = 2; + }; + word_select.eat_space_to_next_word = false; + }; + + urlclassifier = { + trackingSkipURLs = "*.reddit.com, *.twitter.com, *.twimg.com, *.tiktok.com"; + features.socialtracking.skipURLs = "*.instagram.com, *.twitter.com, *.twimg.com"; + }; + + privacy = { + globalprivacycontrol.enabled = true; + history.custom = true; + userContext.ui.enabled = true; + }; + + full-screen-api = { + transition-duration = { + enter = "0 0"; + leave = "0 0"; + }; + warning = { + delay = -1; + timeout = 0; + }; + }; + + permissions.default = { + desktop-notification = 2; + geo = 2; + }; + + signon = { + formlessCapture.enabled = false; + privateBrowsingCapture.enabled = false; + }; + + datareporting = { + policy.dataSubmissionEnabled = false; + healthreport.uploadEnabled = false; + }; + + extensions = { + pocket.enabled = false; + getAddons.showPane = false; + htmlaboutaddons.recommendations.enabled = false; + postDownloadThirdPartyPrompt = false; + }; + + app = { + shield.optoutstudies.enabled = false; + normandy.enabled = false; + normandy.api_url = ""; + }; + + image.mem.decode_bytes_at_a_time = 32768; + editor.truncate_user_pastes = false; + pdfjs.enableScripting = false; + geo.provider.network.url = "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"; + permissions.manager.defaultsUrl = ""; + webchannel.allowObject.urlWhitelist = ""; + breakpad.reportURL = ""; + captivedetect.canonicalURL = ""; + cookiebanners.service.mode = 1; + findbar.highlightAll = true; + content.notify.interval = 100000; + }; + }; + }; + }; + + waybar = { + enable = true; + style = '' + * { + border: none; + border-radius: 0px; + font-family: Iosevka Nerd Font, FontAwesome, Noto Sans CJK; + font-size: 14px; + font-style: normal; + min-height: 0; + } + + window#waybar { + background: rgba(30, 30, 46, 0.5); + border-bottom: 1px solid #45475a; + color: #cdd6f4; + } + + #workspaces { + background: #45475a; + margin: 5px 5px 5px 5px; + padding: 0px 5px 0px 5px; + border-radius: 16px; + border: solid 0px #f4d9e1; + font-weight: normal; + font-style: normal; + } + #workspaces button { + padding: 0px 5px; + border-radius: 16px; + color: #a6adc8; + } + + #workspaces button.active { + color: #f4d9e1; + background-color: transparent; + border-radius: 16px; + } + + #workspaces button:hover { + background-color: #cdd6f4; + color: black; + border-radius: 16px; + } + + #custom-date, #clock, #battery, #pulseaudio, #network, #custom-randwall, #custom-launcher { + background: transparent; + padding: 5px 5px 5px 5px; + margin: 5px 5px 5px 5px; + border-radius: 8px; + border: solid 0px #f4d9e1; + } + + #custom-date { + color: #D3869B; + } + + #custom-power { + color: #24283b; + background-color: #db4b4b; + border-radius: 5px; + margin-right: 10px; + margin-top: 5px; + margin-bottom: 5px; + margin-left: 0px; + padding: 5px 10px; + } + + #tray { + background: #45475a; + margin: 5px 5px 5px 5px; + border-radius: 16px; + padding: 0px 5px; + /*border-right: solid 1px #282738;*/ + } + + #clock { + color: #cdd6f4; + background-color: #45475a; + border-radius: 0px 0px 0px 24px; + padding-left: 13px; + padding-right: 15px; + margin-right: 0px; + margin-left: 10px; + margin-top: 0px; + margin-bottom: 0px; + font-weight: bold; + /*border-left: solid 1px #282738;*/ + } + + #battery { + color: #89b4fa; + } + + #battery.charging { + color: #a6e3a1; + } + + #battery.warning:not(.charging) { + background-color: #f7768e; + color: #f38ba8; + border-radius: 5px 5px 5px 5px; + } + + #backlight { + background-color: #24283b; + color: #db4b4b; + border-radius: 0px 0px 0px 0px; + margin: 5px; + margin-left: 0px; + margin-right: 0px; + padding: 0px 0px; + } + + #network { + color: #f4d9e1; + border-radius: 8px; + margin-right: 5px; + } + + #pulseaudio { + color: #f4d9e1; + border-radius: 8px; + margin-left: 0px; + } + + #pulseaudio.muted { + background: transparent; + color: #928374; + border-radius: 8px; + margin-left: 0px; + } + + #custom-randwall { + color: #f4d9e1; + border-radius: 8px; + margin-right: 0px; + } + + #custom-launcher { + color: #e5809e; + background-color: #45475a; + border-radius: 0px 24px 0px 0px; + margin: 0px 0px 0px 0px; + padding: 0 20px 0 13px; + /*border-right: solid 1px #282738;*/ + font-size: 20px; + } + + #custom-launcher button:hover { + background-color: #FB4934; + color: transparent; + border-radius: 8px; + margin-right: -5px; + margin-left: 10px; + } + + #custom-playerctl { + background: #45475a; + padding-left: 15px; + padding-right: 14px; + border-radius: 16px; + /*border-left: solid 1px #282738;*/ + /*border-right: solid 1px #282738;*/ + margin-top: 5px; + margin-bottom: 5px; + margin-left: 0px; + font-weight: normal; + font-style: normal; + font-size: 16px; + } + + #custom-playerlabel { + background: transparent; + padding-left: 10px; + padding-right: 15px; + border-radius: 16px; + /*border-left: solid 1px #282738;*/ + /*border-right: solid 1px #282738;*/ + margin-top: 5px; + margin-bottom: 5px; + font-weight: normal; + font-style: normal; + } + + #window { + background: #45475a; + padding-left: 15px; + padding-right: 15px; + border-radius: 16px; + /*border-left: solid 1px #282738;*/ + /*border-right: solid 1px #282738;*/ + margin-top: 5px; + margin-bottom: 5px; + font-weight: normal; + font-style: normal; + } + + #custom-wf-recorder { + padding: 0 20px; + color: #e5809e; + background-color: #1E1E2E; + } + + #cpu { + background-color: #45475a; + /*color: #FABD2D;*/ + border-radius: 16px; + margin: 5px; + margin-left: 5px; + margin-right: 5px; + padding: 0px 10px 0px 10px; + font-weight: bold; + } + + #memory { + background-color: #45475a; + /*color: #83A598;*/ + border-radius: 16px; + margin: 5px; + margin-left: 5px; + margin-right: 5px; + padding: 0px 10px 0px 10px; + font-weight: bold; + } + + #disk { + background-color: #45475a; + /*color: #8EC07C;*/ + border-radius: 16px; + margin: 5px; + margin-left: 5px; + margin-right: 5px; + padding: 0px 10px 0px 10px; + font-weight: bold; + } + + #custom-hyprpicker { + background-color: #45475a; + /*color: #8EC07C;*/ + border-radius: 16px; + margin: 5px; + margin-left: 5px; + margin-right: 5px; + padding: 0px 11px 0px 9px; + font-weight: bold; + } + ''; + settings = { + mainBar = { + layer = "top"; + position = "top"; + height = 50; + + output = vars.monitors; + + modules-left = [ "hyprland/workspaces" ]; + modules-center = [ "hyprland/window" ]; + modules-right = [ "battery" "clock" ]; + + battery = { + format = "{icon} {capacity}%"; + format-icons = ["" "" "" "" "" ]; + }; + + clock = { + format = "⏰ {:%a %d, %b %H:%M}"; + }; + }; + }; + }; + + zsh = { + enable = true; + initExtra = '' + umask 0077 + export EXTRA_CCFLAGS="-I/usr/include" + source ${pkgs.zsh-vi-mode}/share/zsh-vi-mode/zsh-vi-mode.plugin.zsh + export QT_QPA_PLATFORM="wayland" + ''; + + localVariables = { + EDITOR = "emacsclient --create-frame --alternate-editor=vim"; + INPUT_METHOD = "fcitx"; + QT_IM_MODULE = "fcitx"; + GTK_IM_MODULE = "fcitx"; + XMODIFIERS = "@im=fcitx"; + XIM_SERVERS = "fcitx"; + WXSUPPRESS_SIZER_FLAGS_CHECK = "1"; + }; + + shellAliases = { + c = "clear"; + g = "git"; + v = "vim"; + py = "python3"; + rb = "sudo nixos-rebuild switch --flake .#continuity"; + nfu = "cd ~/toughnix && git add . && git commit -m \"new flake lock\" && nix flake update"; + usite + = "cd ~/src/publish-org-roam-ui && bash local.sh && rm -rf ~/website_html/graph_view; cp -r ~/src/publish-org-roam-ui/out ~/website_html/graph_view && rsync -azvP --chmod=\"Du=rwx,Dg=rx,Do=rx,Fu=rw,Fg=r,Fo=r\" ~/website_html/ root@${vars.remoteHost}:/usr/share/nginx/ret2pop/"; + sai = "eval \"$(ssh-agent -s)\" && ssh-add ~/.ssh/id_ed25519 && ssh-add -l"; + i3 = "exec ${pkgs.i3-gaps}/bin/i3"; + }; + loginExtra = '' + if [[ "$(tty)" = "/dev/tty1" && -f "$HOME/.toughnix" ]]; then + exec Hyprland + fi + + if [[ ! -f "$HOME/.toughnix" ]]; then + post-install + fi + ''; + }; + + emacs = { + enable = true; + package = pkgs.emacs29-pgtk; + extraConfig = '' + (setq debug-on-error t) + (org-babel-load-file + (expand-file-name "~/org/website/config/emacs.org"))''; + extraPackages = epkgs: [ + epkgs.all-the-icons + epkgs.auctex + epkgs.catppuccin-theme + epkgs.chatgpt-shell + epkgs.company + epkgs.company-solidity + epkgs.counsel + epkgs.dashboard + epkgs.doom-modeline + epkgs.elfeed + epkgs.elfeed-org + epkgs.elfeed-tube + epkgs.elfeed-tube-mpv + epkgs.ellama + epkgs.elpher + epkgs.ement + epkgs.emmet-mode + epkgs.emms + epkgs.enwc + epkgs.evil + epkgs.evil-collection + epkgs.evil-commentary + epkgs.evil-org + epkgs.f + epkgs.flycheck + epkgs.general + epkgs.gptel + epkgs.gruvbox-theme + epkgs.htmlize + epkgs.irony-eldoc + epkgs.ivy + epkgs.ivy-pass + epkgs.latex-preview-pane + epkgs.lsp-ivy + epkgs.lsp-mode + epkgs.lyrics-fetcher + epkgs.magit + epkgs.magit-delta + epkgs.mu4e + epkgs.nix-mode + epkgs.org-fragtog + epkgs.org-journal + epkgs.org-roam + epkgs.org-roam-ui + epkgs.org-superstar + epkgs.page-break-lines + epkgs.password-store + epkgs.pdf-tools + epkgs.pinentry + epkgs.platformio-mode + epkgs.projectile + epkgs.rustic + epkgs.scad-mode + epkgs.simple-httpd + epkgs.solidity-flycheck + epkgs.solidity-mode + epkgs.sudo-edit + epkgs.treemacs + epkgs.treemacs-evil + epkgs.treemacs-magit + epkgs.treemacs-projectile + epkgs.treesit-auto + epkgs.typescript-mode + epkgs.unicode-fonts + epkgs.use-package + epkgs.vterm + epkgs.web-mode + epkgs.websocket + epkgs.which-key + epkgs.writegood-mode + epkgs.writeroom-mode + epkgs.yaml-mode + epkgs.yasnippet + epkgs.yasnippet-snippets + ]; + }; + + mbsync = { + enable = true; + extraConfig = '' + IMAPAccount ret2pop + Host ${vars.imapsServer} + User ${vars.email} + PassCmd "cat ${config.sops.secrets.mail.path}" + Port 993 + TLSType IMAPS + AuthMechs * + CertificateFile /etc/ssl/certs/ca-certificates.crt + + IMAPStore ret2pop-remote + Account ret2pop + + MaildirStore ret2pop-local + Path ~/email/ret2pop/ + Inbox ~/email/ret2pop/INBOX + SubFolders Verbatim + + Channel ret2pop + Far :ret2pop-remote: + Near :ret2pop-local: + Patterns * + Create Near + Sync All + Expunge None + SyncState * + ''; + }; + + msmtp = { + enable = true; + extraConfig = '' + # Set default values for all following accounts. + defaults + auth on + tls on + tls_trust_file /etc/ssl/certs/ca-certificates.crt + tls_certcheck off + logfile ~/.msmtp.log + + # Gmail + account ${vars.userName} + host ${vars.smtpsServer} + port 587 + from ${vars.email} + user ${vars.email} + passwordeval "cat ${config.sops.secrets.mail.path}" + + + # Set a default account + account default : ${vars.userName} + ''; + }; + + bash = { + enable = true; + }; + + git = { + enable = true; + userName = vars.fullName; + userEmail = vars.email; + signing = { + key = vars.gpgKey; + signByDefault = true; + }; + + extraConfig = { + init.defaultBranch = "main"; + }; + + aliases = { + co = "checkout"; + c = "commit"; + a = "add"; + s = "switch"; + b = "branch"; + }; + }; + home-manager.enable = true; + }; + + wayland.windowManager.hyprland = { + enable = true; + package = pkgs.hyprland; + xwayland.enable = true; + systemd.enable = true; + settings = { + "$mod" = "SUPER"; + exec-once = [ + "waybar" + "swww-daemon --format xrgb" + "swww img ${wallpapers}/imagination.png" + "fcitx5-remote -r" + "fcitx5 -d --replace" + "fcitx5-remote -r" + "emacs" + "firefox" + ]; + env = [ + "LIBVA_DRIVER_NAME,nvidia" + "XDG_SESSION_TYPE,wayland" + "GBM_BACKEND,nvidia-drm" + "__GLX_VENDOR_LIBRARY_NAME,nvidia" + "ELECTRON_OZONE_PLATFORM_HINT,auto" + ]; + blurls = [ + "waybar" + ]; + monitor = [ + "Unknown-1,disable" + ]; + windowrule = [ + "workspace 1, ^(.*emacs.*)$" + "workspace 2, ^(.*firefox.*)$" + "workspace 2, ^(.*Tor Browser.*)$" + "workspace 2, ^(.*Chromium-browser.*)$" + "workspace 2, ^(.*chromium.*)$" + "workspace 3, ^(.*discord.*)$" + "workspace 3, ^(.*vesktop.*)$" + "workspace 3, ^(.*fluffychat.*)$" + "workspace 3, ^(.*element-desktop.*)$" + "workspace 4, ^(.*qpwgraph.*)$" + "workspace 4, ^(.*mpv.*)$" + "workspace 5, ^(.*Monero.*)$" + "workspace 5, ^(.*org\.bitcoin\..*)$" + "workspace 5, ^(.*Bitcoin Core - preston.*)$" + "workspace 5, ^(.*org\.getmonero\..*)$" + "workspace 5, ^(.*Monero - preston.*)$" + "workspace 5, ^(.*electrum.*)$" + "pseudo,fcitx" + ]; + bind = [ + "$mod, F, exec, firefox" + "$mod, T, exec, tor-browser" + "$mod, Return, exec, kitty" + "$mod, E, exec, emacs" + "$mod, B, exec, bitcoin-qt" + "$mod, M, exec, monero-wallet-gui" + "$mod, V, exec, vesktop" + "$mod, D, exec, wofi --show run" + "$mod, P, exec, bash ${scripts}/powermenu.sh" + "$mod, Q, killactive" + "$mod SHIFT, H, movewindow, l" + "$mod SHIFT, L, movewindow, r" + "$mod SHIFT, K, movewindow, u" + "$mod SHIFT, J, movewindow, d" + "$mod, H, movefocus, l" + "$mod, L, movefocus, r" + "$mod, K, movefocus, u" + "$mod, J, movefocus, d" + ", XF86AudioPlay, exec, mpc toggle" + ", Print, exec, grim" + ] + ++ ( + builtins.concatLists (builtins.genList + ( + x: + let + ws = + let + c = (x + 1) / 10; + in + builtins.toString (x + 1 - (c * 10)); + in + [ + "$mod, ${ws}, workspace, ${toString (x + 1)}" + "$mod SHIFT, ${ws}, movetoworkspace, ${toString (x + 1)}" + ] + ) + 10) + ); + bindm = [ + "$mod, mouse:272, movewindow" + "$mod, mouse:273, resizewindow" + "$mod ALT, mouse:272, resizewindow" + ]; + binde = [ + ", XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.5 @DEFAULT_AUDIO_SINK@ 5%+" + ", XF86AudioLowerVolume, exec, wpctl set-volume -l 1.5 @DEFAULT_AUDIO_SINK@ 5%-" + ", XF86AudioNext, exec, mpc next" + ", XF86AudioPrev, exec, mpc prev" + ", XF86MonBrightnessUp , exec, xbacklight -inc 10" + ", XF86MonBrightnessDown, exec, xbacklight -dec 10" + ]; + decoration = { + blur = { + enabled = true; + size = 5; + passes = 2; + }; + rounding = 5; + }; + input = { + kb_options = "caps:swapescape"; + repeat_delay = 300; + repeat_rate = 50; + natural_scroll = true; + touchpad = { + natural_scroll = true; + disable_while_typing = true; + tap-to-click = true; + }; + }; + cursor = { + no_hardware_cursors = true; + }; + misc = { + force_default_wallpaper = 0; + disable_hyprland_logo = true; + }; + }; + }; + + gtk = { + enable = true; + theme = null; + iconTheme = null; + }; + + i18n.inputMethod = { + enabled = "fcitx5"; + fcitx5.addons = with pkgs; [ + fcitx5-gtk + fcitx5-chinese-addons + fcitx5-configtool + fcitx5-mozc + fcitx5-rime + ]; + }; + + fonts.fontconfig.enable = true; + nixpkgs.config.cudaSupport = false; +} diff --git a/nix/systems/desktop/vars.nix b/nix/systems/desktop/vars.nix new file mode 100644 index 0000000..eb0b305 --- /dev/null +++ b/nix/systems/desktop/vars.nix @@ -0,0 +1,54 @@ +# Change the following variables +{ + # set your host name. + hostName = "continuity"; + + # username used for unix username as well as msmtp configuration name. + userName = "preston"; + + # your full name + fullName = "Preston Pan"; + + # Create a new gpg key for this system or import your keys from another system + gpgKey = "AEC273BF75B6F54D81343A1AC1FE6CED393AE6C1"; + + # Used for referencing the remote host in config. This mostly shouldn't matter if you are not + # using my website. + remoteHost = "nullring.xyz"; + + # email used for `From` and also as your login email. + email = "ret2pop@gmail.com"; + + # IMAPS server. Must be encrypted. + imapsServer = "imap.gmail.com"; + + # SMTPS server. Must be encrypted. + smtpsServer = "smtp.gmail.com"; + + # Change to your timezone + timeZone = "America/Vancouver"; + + # After rebooting, use the command `hyprctl monitors` in order to check which monitor + # you are using. This is so that waybar knows which monitors to appear in. + monitors = [ + "HDMI-A-1" + "eDP-1" + "DP-2" + "DP-3" + "LVDS-1" + ]; + + # enable video drivers based on your system. + # Example: + # videoDrivers = [ + # "nvidia" + # "amdgpu" + # ] + videoDrivers = [ + ]; + + # use false if this is your first install of continuity. + # See https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md + # for more information. + secureBoot = false; +} diff --git a/nix/systems/installer/commits.nix b/nix/systems/installer/commits.nix new file mode 100644 index 0000000..f652035 --- /dev/null +++ b/nix/systems/installer/commits.nix @@ -0,0 +1,4 @@ +{ + diskoCommitHash = "latest"; + toughnixCommitHash = "HEAD"; +} diff --git a/nix/systems/installer/iso.nix b/nix/systems/installer/iso.nix new file mode 100644 index 0000000..2fcc08f --- /dev/null +++ b/nix/systems/installer/iso.nix @@ -0,0 +1,181 @@ +{ pkgs, lib, ... }: +let + commits = ./commits.nix; +in +{ + documentation = { + enable = true; + man.enable = true; + dev.enable = true; + }; + + environment = { + etc = { + securetty.text = '' + # /etc/securetty: list of terminals on which root is allowed to login. + # See securetty(5) and login(1). + ''; + }; + }; + + networking = { + hostName = "iso"; + wireless.enable = lib.mkForce false; + networkmanager = { + enable = true; + # wifi.macAddress = ""; + }; + firewall = { + allowedTCPPorts = [ ]; + allowedUDPPorts = [ ]; + }; + }; + + hardware = { + cpu.intel.updateMicrocode = true; + graphics = { + enable = true; + }; + pulseaudio.enable = false; + }; + + services = { + qemuGuest.enable = true; + chrony = { + enable = true; + enableNTS = true; + servers = [ "time.cloudflare.com" "ptbtime1.ptb.de" "ptbtime2.ptb.de" ]; + }; + + jitterentropy-rngd.enable = true; + resolved.dnssec = true; + dbus = { + apparmor = "enabled"; + }; + + pipewire = { + enable = true; + alsa = { + enable = true; + support32Bit = true; + }; + pulse.enable = true; + jack.enable = true; + wireplumber.enable = true; + extraConfig.pipewire-pulse."92-low-latency" = { + "context.properties" = [ + { + name = "libpipewire-module-protocol-pulse"; + args = { }; + } + ]; + "pulse.properties" = { + "pulse.min.req" = "32/48000"; + "pulse.default.req" = "32/48000"; + "pulse.max.req" = "32/48000"; + "pulse.min.quantum" = "32/48000"; + "pulse.max.quantum" = "32/48000"; + }; + "stream.properties" = { + "node.latency" = "32/48000"; + "resample.quality" = 1; + }; + }; + }; + + openssh = { + enable = true; + settings = { + PasswordAuthentication = true; + AllowUsers = [ "nixos" ]; + PermitRootLogin = "yes"; + KbdInteractiveAuthentication = false; + }; + }; + }; + + programs = { + zsh.enable = true; + ssh.enableAskPassword = false; + }; + + nixpkgs.config = { + allowUnfree = true; + cudaSupport = false; + }; + + environment.systemPackages = with pkgs; [ + cryptsetup + restic + sbctl + linux-manual + man-pages + man-pages-posix + ]; + + users.extraUsers.root.password = "nixos"; + users.extraUsers.nixos.password = "nixos"; + users.users = { + nixos = { + isNormalUser = true; + description = "NixOS"; + extraGroups = [ "networkmanager" "wheel" "video" "docker" "jackaudio" "tss" "dialout" ]; + shell = pkgs.zsh; + packages = with pkgs; [ + git + curl + gum + (writeShellScriptBin "nix_installer" + '' +#!/usr/bin/env bash +set -euo pipefail + +if [ "$(id -u)" -eq 0 ]; then + echo "ERROR! $(basename "$0") should be run as a regular user" + exit 1 +fi + +ping -q -c1 google.com &>/dev/null && echo "online! Proceeding with the installation..." || nmtui + +if [ ! -d "$HOME/toughnix/" ]; then + cd $HOME + git clone https://git.nullring.xyz/toughnix.git + cd toughnix + git checkout "${commits.toughnixCommitHash}" + cd $HOME +fi + +vim "$HOME/toughnix/systems/desktop/vars.nix" +vim "$HOME/toughnix/systems/desktop/sda-simple.nix" +sudo nix --experimental-features "nix-command flakes" run "github:nix-community/disko/${commits.diskoCommitHash}" -- --mode destroy,format,mount "$HOME/toughnix/systems/desktop/sda-simple.nix" +cd /mnt + +sudo nixos-install --flake $HOME/toughnix#continuity +sudo cp $HOME/toughnix "/mnt/home/$(ls /mnt/home/)/" +echo "Installation complete! Rebooting..." +sleep 3 +reboot +'') + ]; + }; + }; + + + nix.settings.experimental-features = "nix-command flakes"; + time.timeZone = "America/Vancouver"; + i18n.defaultLocale = "en_CA.UTF-8"; + + systemd = { + services.sshd.wantedBy = pkgs.lib.mkForce ["multi-user.target"]; + targets = { + sleep.enable = false; + suspend.enable = false; + hibernate.enable = false; + hybrid-sleep.enable = false; + }; + }; + + system = { + stateVersion = "24.11"; + }; +} -- cgit