gwg313/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

new formatter

Browse source
This commit is contained in:
Glen Goodwin 2023-11-06 02:01:49 -05:00
parent 85aa90c2ac
commit 9fa59c1ba2
39 changed files with 556 additions and 405 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/thinkpad/apparmor.nix
View file

@ -1,5 +1,4 @@
{ pkgs, ... }:
{
{pkgs, ...}: {
security.apparmor.enable = true;
security.apparmor.killUnconfinedConfinables = true;
}

3
hosts/thinkpad/auditd.nix
View file

@ -1,5 +1,4 @@
{ ... }:
{
{...}: {
security.auditd.enable = true;
security.audit.enable = true;
security.audit.rules = [

38
hosts/thinkpad/default.nix
View file

@ -1,23 +1,29 @@
{ config, pkgs, user, ... }:
{
imports = # For now, if applying to other system, swap files
[ (import ./hardware-configuration.nix) ] ++ # Current system hardware config @ /etc/nixos/hardware-configuration.nix
(import ../../modules/desktop/virtualisation/default.nix) ++
(import ../../modules/hardware/default.nix) ++
config,
pkgs,
user,
...
}: {
imports =
# For now, if applying to other system, swap files
[(import ./hardware-configuration.nix)]
++ # Current system hardware config @ /etc/nixos/hardware-configuration.nix
(import ../../modules/desktop/virtualisation/default.nix)
++ (import ../../modules/hardware/default.nix)
++
# (import ./auditd.nix) ++
[ (import ./sysctl.nix) ] ++
[ (import ./kernel.nix) ] ++
[ (import ./auditd.nix) ] ++
[ (import ./openssh.nix) ] ++
[ (import ./apparmor.nix) ] ++
[ (import ../../modules/programs/thunar.nix) ] ++
[ (import ../../modules/desktop/hyprland/default.nix) ]; # Window Manager
[(import ./sysctl.nix)]
++ [(import ./kernel.nix)]
++ [(import ./auditd.nix)]
++ [(import ./openssh.nix)]
++ [(import ./apparmor.nix)]
++ [(import ../../modules/programs/thunar.nix)]
++ [(import ../../modules/desktop/hyprland/default.nix)]; # Window Manager
hardware.sane = {
# Used for scanning with Xsane
enable = true;
extraBackends = [ pkgs.sane-airscan ];
extraBackends = [pkgs.sane-airscan];
};
environment = {
@ -42,11 +48,11 @@
tailscale.enable = true;
};
networking.firewall.trustedInterfaces = [ "tailscale0" ];
networking.firewall.trustedInterfaces = ["tailscale0"];
#temporary bluetooth fix
systemd.tmpfiles.rules = [
"d /var/lib/bluetooth 700 root root - -"
];
systemd.targets."bluetooth".after = [ "systemd-tmpfiles-setup.service" ];
systemd.targets."bluetooth".after = ["systemd-tmpfiles-setup.service"];
}

87
hosts/thinkpad/hardware-configuration.nix
View file

@ -1,62 +1,59 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[
(modulesPath + "/installer/scan/not-detected.nix")
];
config,
lib,
pkgs,
modulesPath,
...
}: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-amd"];
boot.extraModulePackages = [];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/88ae54e9-a47f-4ef0-acae-256803662304";
fsType = "ext4";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/88ae54e9-a47f-4ef0-acae-256803662304";
fsType = "ext4";
};
fileSystems."/media" =
{
device = "192.168.10.2:/mnt/tank/media";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/media" = {
device = "192.168.10.2:/mnt/tank/media";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
fileSystems."/books" =
{
device = "192.168.10.2:/mnt/tank/books";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/books" = {
device = "192.168.10.2:/mnt/tank/books";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
fileSystems."/music" =
{
device = "192.168.10.2:/mnt/tank/music";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/music" = {
device = "192.168.10.2:/mnt/tank/music";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
fileSystems."/projects" =
{
device = "192.168.10.2:/mnt/tank/projects";
fsType = "nfs";
options = [ "x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90" ];
};
fileSystems."/projects" = {
device = "192.168.10.2:/mnt/tank/projects";
fsType = "nfs";
options = ["x-systemd.automount" "noauto" "x-systemd.after=network-online.target" "x-systemd.mount-timeout=90"];
};
boot.initrd.luks.devices."luks-9d4b251f-b7d5-4a28-8e5d-6df09b434e47".device = "/dev/disk/by-uuid/9d4b251f-b7d5-4a28-8e5d-6df09b434e47";
fileSystems."/boot/efi" =
{
device = "/dev/disk/by-uuid/C3A8-F13F";
fsType = "vfat";
};
fileSystems."/boot/efi" = {
device = "/dev/disk/by-uuid/C3A8-F13F";
fsType = "vfat";
};
swapDevices = [ ];
swapDevices = [];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's

13
hosts/thinkpad/home.nix
View file

@ -1,11 +1,8 @@
{ pkgs, ... }:
{
imports =
[
../../modules/shell/git/home.nix
../../modules/desktop/hyprland/home.nix
];
{pkgs, ...}: {
imports = [
../../modules/shell/git/home.nix
../../modules/desktop/hyprland/home.nix
];
home = {
# Specific packages for laptop

8
hosts/thinkpad/kernel.nix
View file

@ -1,6 +1,9 @@
{ config, pkgs, stdenv, ... }:
{
config,
pkgs,
stdenv,
...
}: {
boot.kernelPackages = pkgs.linuxPackages_hardened;
boot.kernelParams = [
# Disable slab merging to prevent heap exploitation
@ -20,5 +23,4 @@
# Enable lockdown LSM
"lockdown=confidentiality"
];
}

3
hosts/thinkpad/openssh.nix
View file

@ -1,5 +1,4 @@
{ ... }:
{
{...}: {
services.openssh = {
enable = true;
settings = {

6
hosts/thinkpad/sysctl.nix
View file

@ -1,6 +1,8 @@
{ config, pkgs, ... }:
{
config,
pkgs,
...
}: {
boot.kernel.sysctl = {
# Restrict kernel pointers
"kernel.kptr_restrict" = 2;