gwg313/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

new formatter

Browse source
This commit is contained in:
Glen Goodwin 2023-11-06 02:01:49 -05:00
parent 85aa90c2ac
commit 9fa59c1ba2
39 changed files with 556 additions and 405 deletions
Download patch file Download diff file Expand all files Collapse all files

26
hosts/configuration.nix
View file

@ -1,12 +1,15 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, inputs, ... }:
{
imports = (import ../modules/editors) ++
(import ../modules/shell);
config,
pkgs,
inputs,
...
}: {
imports =
(import ../modules/editors)
++ (import ../modules/shell);
# Bootloader.
boot.loader.systemd-boot.enable = true;
@ -41,9 +44,9 @@
users.users.glen = {
isNormalUser = true;
description = "Glen";
extraGroups = [ "networkmanager" "wheel" "video" "docker" "audio" ];
extraGroups = ["networkmanager" "wheel" "video" "docker" "audio"];
shell = pkgs.zsh; # Default shell
packages = with pkgs; [ ];
packages = with pkgs; [];
};
# Allow unfree packages
@ -110,15 +113,13 @@
# enable firewall and block all ports
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [ ];
networking.firewall.allowedUDPPorts = [ ];
networking.firewall.allowedTCPPorts = [];
networking.firewall.allowedUDPPorts = [];
# only members of wheel can interact with the nix daemon
nix.settings.allowed-users = [ "@wheel" ];
nix.settings.allowed-users = ["@wheel"];
security.sudo.execWheelOnly = true;
# enable antivirus clamav and
# keep the signatures' database updated
services.clamav.daemon.enable = true;
@ -136,5 +137,4 @@
package = pkgs.nixFlakes;
extraOptions = "experimental-features = nix-command flakes";
};
}

20
hosts/default.nix
View file

@ -1,7 +1,10 @@
{ lib, inputs, system, user, ... }:
{
lib,
inputs,
system,
user,
...
}: {
thinkpad = lib.nixosSystem {
inherit system;
specialArgs = {
@ -22,18 +25,11 @@
{
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
home-manager.extraSpecialArgs = { inherit user inputs; };
home-manager.extraSpecialArgs = {inherit user inputs;};
home-manager.users.${user} = {
imports = [ (import ./home.nix) ] ++ [ (import ./thinkpad/home.nix) ];
imports = [(import ./home.nix)] ++ [(import ./thinkpad/home.nix)];
};
}
];
};
}

43
hosts/home.nix
View file

@ -1,20 +1,27 @@
{ config, lib, pkgs, stable, user, devenv, inputs, ... }:
{
imports = # Home Manager Modules
[ (import ../modules/shell/git/home.nix) ] ++
[ (import ../modules/programs/wofi.nix) ] ++
[ (import ../modules/programs/devenv/home.nix) ] ++
[ (import ../modules/programs/kitty.nix) ] ++
[ (import ../modules/shell/tmux/home.nix) ] ++
[ (import ../modules/shell/ranger/home.nix) ] ++
[ (import ../modules/themes/home.nix) ] ++
[ (import ../modules/programs/mako.nix) ] ++
[ (import ../modules/programs/alacritty.nix) ] ++
[ (import ../modules/programs/zathura.nix) ] ++
[ (import ../modules/desktop/gtk.nix) ] ++
[ (import ../modules/shell/zsh/home.nix) ];
config,
lib,
pkgs,
stable,
user,
devenv,
inputs,
...
}: {
imports =
# Home Manager Modules
[(import ../modules/shell/git/home.nix)]
++ [(import ../modules/programs/wofi.nix)]
++ [(import ../modules/programs/devenv/home.nix)]
++ [(import ../modules/programs/kitty.nix)]
++ [(import ../modules/shell/tmux/home.nix)]
++ [(import ../modules/shell/ranger/home.nix)]
++ [(import ../modules/themes/home.nix)]
++ [(import ../modules/programs/mako.nix)]
++ [(import ../modules/programs/alacritty.nix)]
++ [(import ../modules/programs/zathura.nix)]
++ [(import ../modules/desktop/gtk.nix)]
++ [(import ../modules/shell/zsh/home.nix)];
#Add support for ./local/bin
#home.sessionPath = [
@ -81,8 +88,6 @@
navi
git-crypt
# Video/Audio
feh # Image Viewer
#mpv # Media Player
@ -179,7 +184,7 @@
#steam # Games
#simple-scan # Scanning
#sshpass # Ansible dependency
#
#
# Laptop
#cbatticon # Battery Notifications
#blueman # Bluetooth

3
hosts/thinkpad/apparmor.nix
View file

@ -1,5 +1,4 @@
{ pkgs, ... }:
{
{pkgs, ...}: {
security.apparmor.enable = true;
security.apparmor.killUnconfinedConfinables = true;
}

3
hosts/thinkpad/auditd.nix
View file

@ -1,5 +1,4 @@
{ ... }:
{
{...}: {
security.auditd.enable = true;
security.audit.enable = true;
security.audit.rules = [

38
hosts/thinkpad/default.nix
View file

@ -1,23 +1,29 @@
{ config, pkgs, user, ... }:
{
imports = # For now, if applying to other system, swap files
[ (import ./hardware-configuration.nix) ] ++ # Current system hardware config @ /etc/nixos/hardware-configuration.nix
(import ../../modules/desktop/virtualisation/default.nix) ++
(import ../../modules/hardware/default.nix) ++
config,
pkgs,
user,
...
}: {
imports =
# For now, if applying to other system, swap files
[(import ./hardware-configuration.nix)]
++ # Current system hardware config @ /etc/nixos/hardware-configuration.nix
(import ../../modules/desktop/virtualisation/default.nix)
++ (import ../../modules/hardware/default.nix)
++
# (import ./auditd.nix) ++
[ (import ./sysctl.nix) ] ++
[ (import ./kernel.nix) ] ++
[ (import ./auditd.nix) ] ++
[ (import ./openssh.nix) ] ++
[ (import ./apparmor.nix) ] ++
[ (import ../../modules/programs/thunar.nix) ] ++
[ (import ../../modules/desktop/hyprland/default.nix) ]; # Window Manager
[(import ./sysctl.nix)]
++ [(import ./kernel.nix)]
++ [(import ./auditd.nix)]
++ [(import ./openssh.nix)]
++ [(import ./apparmor.nix)]
++ [(import ../../modules/programs/thunar.nix)]
++ [(import ../../modules/desktop/hyprland/default.nix)]; # Window Manager
hardware.sane = {
# Used for scanning with Xsane
enable = true;
extraBackends = [ pkgs.sane-airscan ];
extraBackends = [pkgs.sane-airscan];
};
environment = {
@ -42,11 +48,11 @@
tailscale.enable = true;
};
networking.firewall.trustedInterfaces = [ "tailscale0" ];
networking.firewall.trustedInterfaces = ["tailscale0"];
#temporary bluetooth fix
systemd.tmpfiles.rules = [
"d /var/lib/bluetooth 700 root root - -"
];
systemd.targets."bluetooth".after = [ "systemd-tmpfiles-setup.service" ];
systemd.targets."bluetooth".after = ["systemd-tmpfiles-setup.service"];
}

87
hosts/thinkpad/hardware-configuration.nix
View file

@ -1,62 +1,59 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-amd"];
boot.extraModulePackages = [];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/88ae54e9-a47f-4ef0-acae-256803662304";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/88ae54e9-a47f-4ef0-acae-256803662304";
fsType = "ext4";
};
fileSystems."/media" =
{
device = "192.168.10.2:/mnt/tank/media";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/media" = {
device = "192.168.10.2:/mnt/tank/media";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
fileSystems."/books" =
{
device = "192.168.10.2:/mnt/tank/books";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/books" = {
device = "192.168.10.2:/mnt/tank/books";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
fileSystems."/music" =
{
device = "192.168.10.2:/mnt/tank/music";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/music" = {
device = "192.168.10.2:/mnt/tank/music";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
fileSystems."/projects" =
{
device = "192.168.10.2:/mnt/tank/projects";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/projects" = {
device = "192.168.10.2:/mnt/tank/projects";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
boot.initrd.luks.devices."luks-9d4b251f-b7d5-4a28-8e5d-6df09b434e47".device = "/dev/disk/by-uuid/9d4b251f-b7d5-4a28-8e5d-6df09b434e47";
fileSystems."/boot/efi" =
{
device = "/dev/disk/by-uuid/C3A8-F13F";
fsType = "vfat";
};
fileSystems."/boot/efi" = {
device = "/dev/disk/by-uuid/C3A8-F13F";
fsType = "vfat";
};
swapDevices = [ ];
swapDevices = [];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's

13
hosts/thinkpad/home.nix
View file

@ -1,11 +1,8 @@
{ pkgs, ... }:
{
imports =
[
../../modules/shell/git/home.nix
../../modules/desktop/hyprland/home.nix
];
{pkgs, ...}: {
imports = [
../../modules/shell/git/home.nix
../../modules/desktop/hyprland/home.nix
];
home = {
# Specific packages for laptop

8
hosts/thinkpad/kernel.nix
View file

@ -1,6 +1,9 @@
{ config, pkgs, stdenv, ... }:
{
config,
pkgs,
stdenv,
...
}: {
boot.kernelPackages = pkgs.linuxPackages_hardened;
boot.kernelParams = [
# Disable slab merging to prevent heap exploitation
@ -20,5 +23,4 @@
# Enable lockdown LSM
"lockdown=confidentiality"
];
}

3
hosts/thinkpad/openssh.nix
View file

@ -1,5 +1,4 @@
{ ... }:
{
{...}: {
services.openssh = {
enable = true;
settings = {

6
hosts/thinkpad/sysctl.nix
View file

@ -1,6 +1,8 @@
{ config, pkgs, ... }:
{
config,
pkgs,
...
}: {
boot.kernel.sysctl = {
# Restrict kernel pointers
"kernel.kptr_restrict" = 2;