mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
refactor: finish initial move to modules-only [WIP]
This commit is contained in:
Leon Schwarzäugl
parent
e7e59715d8
commit
27679d38fd
GPG key ID:
26A54C31F2A4FD84
34 changed files with 1934 additions and 1617 deletions
|
|
@ -1,10 +1,13 @@
|
|||
{ config, ... }:
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) mainUser;
|
||||
in
|
||||
{
|
||||
services = {
|
||||
getty.autologinUser = mainUser;
|
||||
greetd.settings.initial_session.user = mainUser;
|
||||
options.swarselsystems.modules.optional.autologin = lib.mkEnableOption "optional autologin settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.autologin {
|
||||
services = {
|
||||
getty.autologinUser = mainUser;
|
||||
greetd.settings.initial_session.user = mainUser;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,36 +1,39 @@
|
|||
{ pkgs, lib, ... }:
|
||||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
specialisation = {
|
||||
gaming.configuration = {
|
||||
networking = {
|
||||
firewall.enable = lib.mkForce false;
|
||||
firewall = {
|
||||
allowedUDPPorts = [ 4380 27036 14242 34197 ]; # 34197: factorio; 4380 27036 14242: barotrauma;
|
||||
allowedTCPPorts = [ ]; # 34197: factorio; 4380 27036 14242: barotrauma; 51820: wireguard
|
||||
allowedTCPPortRanges = [
|
||||
{ from = 27015; to = 27030; } # barotrauma
|
||||
{ from = 27036; to = 27037; } # barotrauma
|
||||
];
|
||||
allowedUDPPortRanges = [
|
||||
{ from = 27000; to = 27031; } # barotrauma
|
||||
{ from = 58962; to = 58964; } # barotrauma
|
||||
options.swarselsystems.modules.optional.gaming = lib.mkEnableOption "optional gaming settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.gaming {
|
||||
specialisation = {
|
||||
gaming.configuration = {
|
||||
networking = {
|
||||
firewall.enable = lib.mkForce false;
|
||||
firewall = {
|
||||
allowedUDPPorts = [ 4380 27036 14242 34197 ]; # 34197: factorio; 4380 27036 14242: barotrauma;
|
||||
allowedTCPPorts = [ ]; # 34197: factorio; 4380 27036 14242: barotrauma; 51820: wireguard
|
||||
allowedTCPPortRanges = [
|
||||
{ from = 27015; to = 27030; } # barotrauma
|
||||
{ from = 27036; to = 27037; } # barotrauma
|
||||
];
|
||||
allowedUDPPortRanges = [
|
||||
{ from = 27000; to = 27031; } # barotrauma
|
||||
{ from = 58962; to = 58964; } # barotrauma
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
package = pkgs.steam;
|
||||
extraCompatPackages = [
|
||||
pkgs.proton-ge-bin
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
package = pkgs.steam;
|
||||
extraCompatPackages = [
|
||||
pkgs.proton-ge-bin
|
||||
hardware.xone.enable = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.linuxKernel.packages.linux_6_12.xone
|
||||
];
|
||||
};
|
||||
|
||||
hardware.xone.enable = true;
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.linuxKernel.packages.linux_6_12.xone
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,13 @@
|
|||
{ pkgs, ... }:
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
services.nswitch-rcm = {
|
||||
enable = true;
|
||||
package = pkgs.fetchurl {
|
||||
url = "https://github.com/Atmosphere-NX/Atmosphere/releases/download/1.3.2/fusee.bin";
|
||||
hash = "sha256-5AXzNsny45SPLIrvWJA9/JlOCal5l6Y++Cm+RtlJppI=";
|
||||
options.swarselsystems.modules.optional.nswitch-rcm = lib.mkEnableOption "optional nswitch-rcm settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.nswitch-rcm {
|
||||
services.nswitch-rcm = {
|
||||
enable = true;
|
||||
package = pkgs.fetchurl {
|
||||
url = "https://github.com/Atmosphere-NX/Atmosphere/releases/download/1.3.2/fusee.bin";
|
||||
hash = "sha256-5AXzNsny45SPLIrvWJA9/JlOCal5l6Y++Cm+RtlJppI=";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,20 +1,22 @@
|
|||
{ lib, pkgs, ... }:
|
||||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
|
||||
specialisation = {
|
||||
VBox.configuration = {
|
||||
virtualisation.virtualbox = {
|
||||
host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
# leaving this here for future notice. setting guest.enable = true will make 'restarting sysinit-reactivation.target' take till timeout on nixos-rebuild switch
|
||||
guest = {
|
||||
enable = false;
|
||||
options.swarselsystems.modules.optional.virtualbox = lib.mkEnableOption "optional VBox settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.virtualbox {
|
||||
specialisation = {
|
||||
VBox.configuration = {
|
||||
virtualisation.virtualbox = {
|
||||
host = {
|
||||
enable = true;
|
||||
enableExtensionPack = true;
|
||||
};
|
||||
# leaving this here for future notice. setting guest.enable = true will make 'restarting sysinit-reactivation.target' take till timeout on nixos-rebuild switch
|
||||
guest = {
|
||||
enable = false;
|
||||
};
|
||||
};
|
||||
# run an older kernel to provide compatibility with windows vm
|
||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages;
|
||||
};
|
||||
# run an older kernel to provide compatibility with windows vm
|
||||
boot.kernelPackages = lib.mkForce pkgs.linuxPackages;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
_:
|
||||
{ lib, config, ... }:
|
||||
{
|
||||
|
||||
virtualisation.vmware.host.enable = true;
|
||||
virtualisation.vmware.guest.enable = true;
|
||||
options.swarselsystems.modules.optional.vmware = lib.mkEnableOption "optional vmware settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.vmware {
|
||||
virtualisation.vmware.host.enable = true;
|
||||
virtualisation.vmware.guest.enable = true;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,167 +24,170 @@ let
|
|||
};
|
||||
in
|
||||
{
|
||||
sops =
|
||||
let
|
||||
secretNames = [
|
||||
"vcuser"
|
||||
"vcpw"
|
||||
"govcuser"
|
||||
"govcpw"
|
||||
"govcurl"
|
||||
"govcdc"
|
||||
"govcds"
|
||||
"govchost"
|
||||
"govcnetwork"
|
||||
"govcpool"
|
||||
];
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(name: {
|
||||
inherit name;
|
||||
value = { inherit owner sopsFile; };
|
||||
})
|
||||
secretNames
|
||||
);
|
||||
};
|
||||
options.swarselsystems.modules.optional.work = lib.mkEnableOption "optional work settings";
|
||||
config = lib.mkIf config.swarselsystems.modules.optional.work {
|
||||
sops =
|
||||
let
|
||||
secretNames = [
|
||||
"vcuser"
|
||||
"vcpw"
|
||||
"govcuser"
|
||||
"govcpw"
|
||||
"govcurl"
|
||||
"govcdc"
|
||||
"govcds"
|
||||
"govchost"
|
||||
"govcnetwork"
|
||||
"govcpool"
|
||||
];
|
||||
in
|
||||
{
|
||||
secrets = builtins.listToAttrs (
|
||||
map
|
||||
(name: {
|
||||
inherit name;
|
||||
value = { inherit owner sopsFile; };
|
||||
})
|
||||
secretNames
|
||||
);
|
||||
};
|
||||
|
||||
boot.initrd = {
|
||||
systemd.enable = lib.mkForce true; # make sure we are using initrd systemd even when not using Impermanence
|
||||
luks = {
|
||||
# disable "support" since we use systemd-cryptenroll
|
||||
# make sure yubikeys are enrolled using
|
||||
# sudo systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=no --fido2-with-user-presence=true --fido2-with-client-pin=no /dev/nvme0n1p2
|
||||
yubikeySupport = false;
|
||||
fido2Support = false;
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
zsh.shellInit = ''
|
||||
export VSPHERE_USER="$(cat ${config.sops.secrets.vcuser.path})"
|
||||
export VSPHERE_PW="$(cat ${config.sops.secrets.vcpw.path})"
|
||||
export GOVC_USERNAME="$(cat ${config.sops.secrets.govcuser.path})"
|
||||
export GOVC_PASSWORD="$(cat ${config.sops.secrets.govcpw.path})"
|
||||
export GOVC_URL="$(cat ${config.sops.secrets.govcurl.path})"
|
||||
export GOVC_DATACENTER="$(cat ${config.sops.secrets.govcdc.path})"
|
||||
export GOVC_DATASTORE="$(cat ${config.sops.secrets.govcds.path})"
|
||||
export GOVC_HOST="$(cat ${config.sops.secrets.govchost.path})"
|
||||
export GOVC_RESOURCE_POOL="$(cat ${config.sops.secrets.govcpool.path})"
|
||||
export GOVC_NETWORK="$(cat ${config.sops.secrets.govcnetwork.path})"
|
||||
'';
|
||||
|
||||
browserpass.enable = true;
|
||||
_1password.enable = true;
|
||||
_1password-gui = {
|
||||
enable = true;
|
||||
polkitPolicyOwners = [ "${mainUser}" ];
|
||||
};
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall.trustedInterfaces = [ "virbr0" ];
|
||||
search = [
|
||||
"vbc.ac.at"
|
||||
"clip.vbc.ac.at"
|
||||
"imp.univie.ac.at"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = lib.mkIf (!config.virtualisation.podman.dockerCompat) true;
|
||||
spiceUSBRedirection.enable = true;
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
qemu = {
|
||||
package = pkgs.qemu_kvm;
|
||||
runAsRoot = true;
|
||||
swtpm.enable = true;
|
||||
vhostUserPackages = with pkgs; [ virtiofsd ];
|
||||
ovmf = {
|
||||
enable = true;
|
||||
packages = [
|
||||
(pkgs.OVMFFull.override {
|
||||
secureBoot = true;
|
||||
tpmSupport = true;
|
||||
}).fd
|
||||
];
|
||||
};
|
||||
boot.initrd = {
|
||||
systemd.enable = lib.mkForce true; # make sure we are using initrd systemd even when not using Impermanence
|
||||
luks = {
|
||||
# disable "support" since we use systemd-cryptenroll
|
||||
# make sure yubikeys are enrolled using
|
||||
# sudo systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=no --fido2-with-user-presence=true --fido2-with-client-pin=no /dev/nvme0n1p2
|
||||
yubikeySupport = false;
|
||||
fido2Support = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
# (python39.withPackages (ps: with ps; [
|
||||
# cryptography
|
||||
# ]))
|
||||
# docker
|
||||
python39
|
||||
qemu
|
||||
packer
|
||||
gnumake
|
||||
libisoburn
|
||||
govc
|
||||
terraform
|
||||
graphviz
|
||||
programs = {
|
||||
zsh.shellInit = ''
|
||||
export VSPHERE_USER="$(cat ${config.sops.secrets.vcuser.path})"
|
||||
export VSPHERE_PW="$(cat ${config.sops.secrets.vcpw.path})"
|
||||
export GOVC_USERNAME="$(cat ${config.sops.secrets.govcuser.path})"
|
||||
export GOVC_PASSWORD="$(cat ${config.sops.secrets.govcpw.path})"
|
||||
export GOVC_URL="$(cat ${config.sops.secrets.govcurl.path})"
|
||||
export GOVC_DATACENTER="$(cat ${config.sops.secrets.govcdc.path})"
|
||||
export GOVC_DATASTORE="$(cat ${config.sops.secrets.govcds.path})"
|
||||
export GOVC_HOST="$(cat ${config.sops.secrets.govchost.path})"
|
||||
export GOVC_RESOURCE_POOL="$(cat ${config.sops.secrets.govcpool.path})"
|
||||
export GOVC_NETWORK="$(cat ${config.sops.secrets.govcnetwork.path})"
|
||||
'';
|
||||
|
||||
# vm
|
||||
virt-manager
|
||||
virt-viewer
|
||||
virtiofsd
|
||||
spice
|
||||
spice-gtk
|
||||
spice-protocol
|
||||
win-virtio
|
||||
win-spice
|
||||
];
|
||||
|
||||
|
||||
services = {
|
||||
spice-vdagentd.enable = true;
|
||||
openssh = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
'';
|
||||
browserpass.enable = true;
|
||||
_1password.enable = true;
|
||||
_1password-gui = {
|
||||
enable = true;
|
||||
polkitPolicyOwners = [ "${mainUser}" ];
|
||||
};
|
||||
};
|
||||
|
||||
syncthing = {
|
||||
settings = {
|
||||
"winters" = {
|
||||
id = "O7RWDMD-AEAHPP7-7TAVLKZ-BSWNBTU-2VA44MS-EYGUNBB-SLHKB3C-ZSLMOAA";
|
||||
};
|
||||
folders = {
|
||||
"Documents" = {
|
||||
path = "${homeDir}/Documents";
|
||||
devices = [ "magicant" "winters" ];
|
||||
id = "hgr3d-pfu3w";
|
||||
networking = {
|
||||
firewall.trustedInterfaces = [ "virbr0" ];
|
||||
search = [
|
||||
"vbc.ac.at"
|
||||
"clip.vbc.ac.at"
|
||||
"imp.univie.ac.at"
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
docker.enable = lib.mkIf (!config.virtualisation.podman.dockerCompat) true;
|
||||
spiceUSBRedirection.enable = true;
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
qemu = {
|
||||
package = pkgs.qemu_kvm;
|
||||
runAsRoot = true;
|
||||
swtpm.enable = true;
|
||||
vhostUserPackages = with pkgs; [ virtiofsd ];
|
||||
ovmf = {
|
||||
enable = true;
|
||||
packages = [
|
||||
(pkgs.OVMFFull.override {
|
||||
secureBoot = true;
|
||||
tpmSupport = true;
|
||||
}).fd
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
udev.extraRules = ''
|
||||
# share screen when dongle detected
|
||||
SUBSYSTEM=="usb", ACTION=="add", ATTRS{idVendor}=="343c", ATTRS{idProduct}=="0000", TAG+="systemd", ENV{SYSTEMD_WANTS}="swarsel-screenshare.service"
|
||||
environment.systemPackages = with pkgs; [
|
||||
# (python39.withPackages (ps: with ps; [
|
||||
# cryptography
|
||||
# ]))
|
||||
# docker
|
||||
python39
|
||||
qemu
|
||||
packer
|
||||
gnumake
|
||||
libisoburn
|
||||
govc
|
||||
terraform
|
||||
graphviz
|
||||
|
||||
# lock screen when yubikey removed
|
||||
ACTION=="remove", ENV{PRODUCT}=="3/1050/407/110", RUN+="${pkgs.systemd}/bin/systemctl suspend"
|
||||
'';
|
||||
# vm
|
||||
virt-manager
|
||||
virt-viewer
|
||||
virtiofsd
|
||||
spice
|
||||
spice-gtk
|
||||
spice-protocol
|
||||
win-virtio
|
||||
win-spice
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
systemd.services = lib.mkMerge [
|
||||
(swarselService "swarsel-screenshare" "Start screensharing after HDMI dongle is detected" "${pkgs.screenshare}/bin/screenshare -h")
|
||||
];
|
||||
services = {
|
||||
spice-vdagentd.enable = true;
|
||||
openssh = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
'';
|
||||
};
|
||||
|
||||
# cgroups v1 is required for centos7 dockers
|
||||
specialisation = {
|
||||
cgroup_v1.configuration = {
|
||||
boot.kernelParams = [
|
||||
"SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1"
|
||||
"systemd.unified_cgroup_hierarchy=0"
|
||||
];
|
||||
syncthing = {
|
||||
settings = {
|
||||
"winters" = {
|
||||
id = "O7RWDMD-AEAHPP7-7TAVLKZ-BSWNBTU-2VA44MS-EYGUNBB-SLHKB3C-ZSLMOAA";
|
||||
};
|
||||
folders = {
|
||||
"Documents" = {
|
||||
path = "${homeDir}/Documents";
|
||||
devices = [ "magicant" "winters" ];
|
||||
id = "hgr3d-pfu3w";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
udev.extraRules = ''
|
||||
# share screen when dongle detected
|
||||
SUBSYSTEM=="usb", ACTION=="add", ATTRS{idVendor}=="343c", ATTRS{idProduct}=="0000", TAG+="systemd", ENV{SYSTEMD_WANTS}="swarsel-screenshare.service"
|
||||
|
||||
# lock screen when yubikey removed
|
||||
ACTION=="remove", ENV{PRODUCT}=="3/1050/407/110", RUN+="${pkgs.systemd}/bin/systemctl suspend"
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
systemd.services = lib.mkMerge [
|
||||
(swarselService "swarsel-screenshare" "Start screensharing after HDMI dongle is detected" "${pkgs.screenshare}/bin/screenshare -h")
|
||||
];
|
||||
|
||||
# cgroups v1 is required for centos7 dockers
|
||||
specialisation = {
|
||||
cgroup_v1.configuration = {
|
||||
boot.kernelParams = [
|
||||
"SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1"
|
||||
"systemd.unified_cgroup_hierarchy=0"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue