Switch to GRUB and add more system configuration
The system boots and functions now. Let's reinstall again \(^v^)/
This commit is contained in:
parent
6a156fe0de
commit
856519d807
GPG Key ID:
B0567C20730E9B11
|
|
@ -20,30 +20,6 @@
|
|||
# age.keyFile = "/var/lib/sops-nix/age-key.txt";
|
||||
};
|
||||
|
||||
# Being fancy. Other people have already taken care of all the tough setting-up parts :)
|
||||
boot.plymouth = {
|
||||
enable = true;
|
||||
logo = "${pkgs.nixos-icons}/share/icons/hicolor/72x72/apps/nix-snowflake.png";
|
||||
};
|
||||
|
||||
# Most valuable directories (.e.g /home, /gnu, /nix) are persisted using ZFS datasets.
|
||||
# Impermanence is used to deal with state files.
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
];
|
||||
directories = [
|
||||
"/etc/NetworkManager/system-connections"
|
||||
"/var/lib/NetworkManager"
|
||||
"/var/lib/libvirt"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd"
|
||||
"/var/log"
|
||||
"/var/tmp"
|
||||
];
|
||||
};
|
||||
|
||||
# This setting is solely used to ensure ZFS can import pools correctly.
|
||||
# Randomly generated with `head -c4 /dev/urandom | od -A none -t x4` (ensure it's unique per network).
|
||||
networking.hostId = "b5ce5013";
|
||||
|
|
@ -55,6 +31,53 @@
|
|||
wifi.backend = "iwd";
|
||||
};
|
||||
|
||||
# Use an NTP client with NTS support (systemd-timesyncd is the default)
|
||||
# Currently, there are only 2 options: chrony and ntpd-rs
|
||||
services.ntpd-rs =
|
||||
let
|
||||
timeServers = [
|
||||
"time.cloudflare.com"
|
||||
"ntpmon.dcs1.biz"
|
||||
"nts.netnod.se"
|
||||
"ntp.zeitgitter.net"
|
||||
"virginia.time.system76.com"
|
||||
"ntp3.fau.de"
|
||||
"gps.ntp.br"
|
||||
];
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
useNetworkingTimeServers = false;
|
||||
settings = {
|
||||
source = builtins.map
|
||||
(server: {
|
||||
mode = "nts";
|
||||
address = server;
|
||||
})
|
||||
timeServers;
|
||||
};
|
||||
};
|
||||
|
||||
# Basic protection is good
|
||||
networking.nftables.enable = true;
|
||||
networking.nftables.flushRuleset = true;
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
filterForward = true;
|
||||
pingLimit = "10/second burst 5 packets";
|
||||
|
||||
# TODO: allow DNS queries for libvirt and incus bridge interfaces
|
||||
# Ref: https://github.com/NixOS/nixpkgs/issues/263359
|
||||
};
|
||||
|
||||
# TODO: look into sudo-rs
|
||||
security.sudo.execWheelOnly = true;
|
||||
|
||||
# Not as horrifying as SELinux, and way less effective
|
||||
# (doesn't seem to work yet: https://github.com/NixOS/nixpkgs/issues/273164)
|
||||
# security.apparmor.enable = true;
|
||||
# services.dbus.apparmor = "enabled";
|
||||
|
||||
# DNS-over-TLS out of the box. Yay.
|
||||
services.resolved =
|
||||
let
|
||||
|
|
@ -99,10 +122,10 @@
|
|||
|
||||
# Keep the disk in good health
|
||||
# TODO: autoSnapshot or sanoid configuration
|
||||
services.zfs = {
|
||||
trim.enable = true;
|
||||
autoScrub.enable = true;
|
||||
};
|
||||
services.zfs.autoScrub.enable = true;
|
||||
|
||||
# Keep the firmware up-to-date
|
||||
services.fwupd.enable = true;
|
||||
|
||||
# Such a crime, using Guix on a NixOS system
|
||||
services.guix = {
|
||||
|
|
@ -116,6 +139,69 @@
|
|||
};
|
||||
};
|
||||
|
||||
# TODO: enable libvirt and incus services (use modular libvirt daemons)
|
||||
# Some notes:
|
||||
# - https://nixos.wiki/wiki/Libvirt
|
||||
# - https://github.com/NixOS/nixpkgs/pull/258379
|
||||
# virtualisation.libvirtd = {
|
||||
# enable = true;
|
||||
# qemu = {
|
||||
# runAsRoot = false;
|
||||
# swtpm.enable = true;
|
||||
# };
|
||||
# };
|
||||
|
||||
# TODO: enable auditd
|
||||
|
||||
# Let everyone use flatpak
|
||||
# xdg.portal.* options are managed inside home-manager
|
||||
services.flatpak.enable = true;
|
||||
|
||||
# KDE is easy to use. I'll have Sway later.
|
||||
# QT platformtheme and cursor theme are managed per-user inside home-manager.
|
||||
# Ref: https://nixos.wiki/wiki/KDE
|
||||
services.xserver.enable = true;
|
||||
services.xserver.displayManager.defaultSession = "plasmawayland";
|
||||
services.xserver.displayManager.sddm = {
|
||||
enable = true;
|
||||
enableHidpi = true;
|
||||
wayland.enable = true;
|
||||
theme = "breeze";
|
||||
};
|
||||
services.xserver.desktopManager.plasma5 = {
|
||||
enable = true;
|
||||
useQtScaling = true;
|
||||
};
|
||||
environment.plasma5.excludePackages = with pkgs.libsForQt5; [ plasma-browser-integration konsole oxygen ];
|
||||
programs.dconf.enable = true;
|
||||
programs.xwayland.enable = true;
|
||||
|
||||
# Sound
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
};
|
||||
|
||||
# Most valuable directories (.e.g /home, /gnu, /nix) are persisted using ZFS datasets.
|
||||
# Impermanence is used only to deal with state files.
|
||||
environment.persistence."/persist" = {
|
||||
hideMounts = true;
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
];
|
||||
directories = [
|
||||
"/etc/NetworkManager/system-connections"
|
||||
"/var/lib/NetworkManager"
|
||||
"/var/lib/libvirt"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/systemd"
|
||||
"/var/log"
|
||||
"/var/tmp"
|
||||
];
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Asia/Ho_Chi_Minh";
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, ... }: {
|
||||
{ config, pkgs, ... }: {
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ "amdgpu" ];
|
||||
boot.initrd.supportedFilesystems = [ "zfs" ];
|
||||
|
|
@ -8,16 +8,57 @@
|
|||
boot.kernelParams = [ "amd_pstate=active" ];
|
||||
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.systemd-boot.configurationLimit = 10; # prevent /boot to go out of disk space
|
||||
boot.loader.timeout = 10;
|
||||
# Use systemd-boot
|
||||
# boot.loader.systemd-boot = {
|
||||
# enable = true;
|
||||
# configurationLimit = 10;
|
||||
# };
|
||||
# Being more fancy with grub2
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
enableCryptodisk = true;
|
||||
zfsSupport = true;
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true; # guarantee that the firmware will find GRUB
|
||||
configurationLimit = 10;
|
||||
# gfxmodeEfi = ""; # TODO: find out the best mode manually later
|
||||
theme = pkgs.nixos-grub2-theme;
|
||||
font = config.boot.plymouth.font;
|
||||
fontSize = 32;
|
||||
};
|
||||
|
||||
# Being fancy. Other people have already taken care of all the tough setting-up parts :)
|
||||
boot.plymouth = {
|
||||
enable = true;
|
||||
themePackages = [ pkgs.adi1090x-plymouth-themes ];
|
||||
theme = "rings_2";
|
||||
};
|
||||
|
||||
# Terminus is a nice console font set
|
||||
console.earlySetup = true;
|
||||
console.font = "${pkgs.terminus_font}/share/consolefonts/ter-h32b.psf.gz";
|
||||
|
||||
# Necessary ~~evils~~ binary blobs
|
||||
# Ref: https://github.com/NixOS/nixos-hardware/tree/master/common/{cpu,gpu}/amd
|
||||
hardware.cpu.amd.updateMicrocode = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
# OpenGL, for wayland support in general
|
||||
hardware.opengl = {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
extraPackages = with pkgs.rocmPackages; [ clr clr.icd ];
|
||||
};
|
||||
|
||||
# Bluetooth is meh, but I might need it sometimes
|
||||
hardware.bluetooth = {
|
||||
enable = true;
|
||||
hsphfpd.enable = true;
|
||||
powerOnBoot = false;
|
||||
};
|
||||
|
||||
disko.devices = {
|
||||
nodev."/" = {
|
||||
fsType = "tmpfs";
|
||||
|
|
@ -31,7 +72,7 @@
|
|||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "512M";
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
|
|
|
|||
|
|
@ -15,27 +15,27 @@ lib.mkMerge [
|
|||
|
||||
{
|
||||
# Enable corresponding shells for each user
|
||||
programs = {
|
||||
fish.enable = true;
|
||||
zsh.enable = true;
|
||||
};
|
||||
programs.fish.enable = true;
|
||||
programs.zsh.enable = true;
|
||||
|
||||
users.mutableUsers = false;
|
||||
users.users = {
|
||||
follie = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "networkmanager" ];
|
||||
extraGroups = [ "wheel" "networkmanager" "libvirtd" ];
|
||||
shell = pkgs.fish;
|
||||
|
||||
# TODO: Ref: https://rootlesscontaine.rs/getting-started/common/subuid/
|
||||
# subUidRanges
|
||||
# subGidRanges
|
||||
# Ref: https://rootlesscontaine.rs/getting-started/common/subuid/
|
||||
autoSubUidGidRange = true;
|
||||
};
|
||||
|
||||
gema = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "networkmanager" ];
|
||||
shell = pkgs.zsh;
|
||||
|
||||
# This user doesn't run rootless containers
|
||||
autoSubUidGidRange = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue