diff options
| -rw-r--r-- | flake.lock | 259 | ||||
| -rw-r--r-- | flake.nix | 124 | ||||
| -rw-r--r-- | hosts/toaster/default.nix | 6 | ||||
| -rw-r--r-- | hosts/toaster/secure-boot.nix | 2 | ||||
| -rw-r--r-- | hosts/toaster/stateful-network.nix | 18 | ||||
| -rw-r--r-- | modules/binary-caches.nix | 5 | ||||
| -rw-r--r-- | modules/chromium.nix | 4 | ||||
| -rw-r--r-- | modules/devtools.nix | 15 | ||||
| -rw-r--r-- | modules/virtualization.nix | 5 |
9 files changed, 290 insertions, 148 deletions
@@ -1,5 +1,63 @@ { "nodes": { + "crane": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717535930, + "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=", + "owner": "ipetkov", + "repo": "crane", + "rev": "55e7754ec31dac78980c8be45f8a28e80e370946", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, + "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-parts": { + "inputs": { + "nixpkgs-lib": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717285511, + "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, "flake-utils": { "inputs": { "systems": "systems" @@ -18,6 +76,98 @@ "type": "github" } }, + "flake-utils_2": { + "inputs": { + "systems": "systems_2" + }, + "locked": { + "lastModified": 1710146030, + "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit-hooks-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "flake-compat": "flake-compat", + "flake-parts": "flake-parts", + "flake-utils": "flake-utils_2", + "nixpkgs": [ + "nixpkgs-stable" + ], + "pre-commit-hooks-nix": "pre-commit-hooks-nix", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1718178907, + "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v0.4.1", + "repo": "lanzaboote", + "type": "github" + } + }, + "microvm": { + "inputs": { + "flake-utils": [ + "flake-utils" + ], + "nixpkgs": [ + "nixpkgs-stable" + ], + "spectrum": "spectrum" + }, + "locked": { + "lastModified": 1712366957, + "narHash": "sha256-7W3D1Gk6mGlwtV07n6YB/7s3tThcBYknlvDPcoJJSe4=", + "owner": "astro", + "repo": "microvm.nix", + "rev": "1e746a8987eb893adc8dd317b84e73d72803b650", + "type": "github" + }, + "original": { + "owner": "astro", + "ref": "v0.5.0", + "repo": "microvm.nix", + "type": "github" + } + }, "nixos-hardware": { "locked": { "lastModified": 1735388221, @@ -36,11 +186,27 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1735531152, - "narHash": "sha256-As8I+ebItDKtboWgDXYZSIjGlKeqiLBvjxsQHUmAf1Q=", + "lastModified": 1710695816, + "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "614b4613980a522ba49f0d194531beddbb7220d3", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.11", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-stable_2": { + "locked": { + "lastModified": 1735669367, + "narHash": "sha256-tfYRbFhMOnYaM4ippqqid3BaLOXoFNdImrfBfCp4zn0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "3ffbbdbac0566a0977da3d2657b89cbcfe9a173b", + "rev": "edf04b75c13c2ac0e54df5ec5c543e300f76f1c9", "type": "github" }, "original": { @@ -66,16 +232,70 @@ "type": "github" } }, + "pre-commit-hooks-nix": { + "inputs": { + "flake-compat": [ + "lanzaboote", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ], + "nixpkgs-stable": "nixpkgs-stable" + }, + "locked": { + "lastModified": 1717664902, + "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, "root": { "inputs": { "flake-utils": "flake-utils", + "lanzaboote": "lanzaboote", + "microvm": "microvm", "nixos-hardware": "nixos-hardware", - "nixpkgs-stable": "nixpkgs-stable", + "nixpkgs-stable": "nixpkgs-stable_2", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix", "tmux-yank": "tmux-yank" } }, + "rust-overlay": { + "inputs": { + "flake-utils": [ + "lanzaboote", + "flake-utils" + ], + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1717813066, + "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "sops-nix": { "inputs": { "nixpkgs": [ @@ -96,6 +316,22 @@ "type": "github" } }, + "spectrum": { + "flake": false, + "locked": { + "lastModified": 1708358594, + "narHash": "sha256-e71YOotu2FYA67HoC/voJDTFsiPpZNRwmiQb4f94OxQ=", + "ref": "refs/heads/main", + "rev": "6d0e73864d28794cdbd26ab7b37259ab0e1e044c", + "revCount": 614, + "type": "git", + "url": "https://spectrum-os.org/git/spectrum" + }, + "original": { + "type": "git", + "url": "https://spectrum-os.org/git/spectrum" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -111,6 +347,21 @@ "type": "github" } }, + "systems_2": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tmux-yank": { "flake": false, "locked": { @@ -12,13 +12,18 @@ nixos-hardware.url = "github:NixOS/nixos-hardware/master"; - # microvm = { - # url = "github:astro/microvm.nix/v0.4.0"; - # inputs = { - # nixpkgs.follows = "nixpkgs"; - # flake-utils.follows = "flake-utils"; - # }; - # }; + microvm = { + url = "github:astro/microvm.nix/v0.5.0"; + inputs = { + nixpkgs.follows = "nixpkgs-stable"; + flake-utils.follows = "flake-utils"; + }; + }; + + lanzaboote = { + url = "github:nix-community/lanzaboote/v0.4.1"; + inputs.nixpkgs.follows = "nixpkgs-stable"; + }; tmux-yank = { url = "github:tmux-plugins/tmux-yank"; @@ -29,37 +34,23 @@ outputs = inputs@{ self , flake-utils - # , microvm + , microvm , nixpkgs-stable , nixpkgs-unstable , sops-nix , nixos-hardware + , lanzaboote , ... }: - flake-utils.lib.eachDefaultSystem - (system: - let - pkgs = nixpkgs-stable.legacyPackages.${system}; - in - { - # packages.slick = pkgs.callPackage "${self}/pkgs/slick.nix" { }; - # packages.imhex = pkgs.libsForQt5.callPackage "${self}/pkgs/imhex.nix" { }; - }) - // { - overlays.default = _final: prev: { - inherit (self.packages.${prev.system}) - slick; - }; - nixosConfigurations = { toaster = nixpkgs-unstable.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; }; modules = [ - # sops-nix.nixosModules.sops - # lanzaboote.nixosModules.lanzaboote + sops-nix.nixosModules.sops + lanzaboote.nixosModules.lanzaboote nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 ./hosts/toaster @@ -69,91 +60,14 @@ ./modules/devtools.nix ./modules/gnome.nix ./modules/gnupg.nix - # ./modules/mail ./modules/radio.nix ./modules/science.nix ./modules/tlp.nix # ./modules/virtualization.nix + ./hosts/toaster/secure-boot.nix + ./modules/chromium.nix ]; }; - - # cirrus = nixpkgs-stable.lib.nixosSystem { - # system = "x86_64-linux"; - # specialArgs = { inherit inputs; }; - # modules = [ - # sops-nix.nixosModules.sops - # ./hosts/cirrus - # ./modules/basic-tools - # ./modules/server - # ]; - # }; - - # dishwasher = nixpkgs-stable.lib.nixosSystem { - # system = "x86_64-linux"; - # specialArgs = { inherit inputs; }; - # modules = [ - # sops-nix.nixosModules.sops - # microvm.nixosModules.host - # ./hosts/dishwasher - # ./modules/basic-tools - # ./modules/binary-caches.nix - # ./modules/virtualization.nix - # ./modules/server - # ]; - # }; - - # nextcloud = nixpkgs.lib.nixosSystem { - # system = "x86_64-linux"; - # specialArgs = { inherit inputs; }; - # modules = [ - # sops-nix.nixosModules.sops - # microvm.nixosModules.microvm - # ./microvms/nextcloud - # ./modules/server - # ]; - # }; - - # music = nixpkgs.lib.nixosSystem { - # system = "x86_64-linux"; - # specialArgs = { inherit inputs; }; - # modules = [ - # sops-nix.nixosModules.sops - # microvm.nixosModules.microvm - # ./microvms/music - # ./modules/server - # ]; - # }; - - # news = nixpkgs.lib.nixosSystem { - # system = "x86_64-linux"; - # specialArgs = { inherit inputs; }; - # modules = [ - # sops-nix.nixosModules.sops - # microvm.nixosModules.microvm - # ./microvms/news - # ./modules/server - # ]; - # }; - - # noctilucent = nixpkgs.lib.nixosSystem { - # system = "x86_64-linux"; - # specialArgs = { inherit inputs; }; - # modules = [ - # sops-nix.nixosModules.sops - - # ./hosts/noctilucent - # ./modules/server - - # ./modules/basic-tools - # ./modules/binary-caches.nix - # ]; - # }; }; - - # hydraJobs = - # let - # get-toplevel = (host: nixSystem: nixSystem.config.microvm.declaredRunner or nixSystem.config.system.build.toplevel); - # in - # nixpkgs-stable.lib.mapAttrs get-toplevel self.nixosConfigurations; }; -} + } diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix index aa6531c..3cd352d 100644 --- a/hosts/toaster/default.nix +++ b/hosts/toaster/default.nix @@ -5,10 +5,8 @@ ./hardware-configuration.nix # ./irc.nix ./stateful-network.nix - # ./network.nix - # ./network-vpns.nix # ./secrets.nix - # ./secure-boot.nix + ./secure-boot.nix ./zfs.nix ]; @@ -50,6 +48,8 @@ environment.systemPackages = with pkgs; [ # factorio + element-desktop + discord ]; services.emacs.defaultEditor = false; diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix index d18e1cb..23424af 100644 --- a/hosts/toaster/secure-boot.nix +++ b/hosts/toaster/secure-boot.nix @@ -4,7 +4,7 @@ loader.systemd-boot.enable = lib.mkForce false; lanzaboote = { enable = true; - pkiBundle = "/etc/secureboot"; + pkiBundle = "/var/lib/sbctl"; }; }; diff --git a/hosts/toaster/stateful-network.nix b/hosts/toaster/stateful-network.nix index fcf5b7a..d65022d 100644 --- a/hosts/toaster/stateful-network.nix +++ b/hosts/toaster/stateful-network.nix @@ -18,22 +18,4 @@ ]; }; - # fixup the rpfilter fucking up the networkmanager wireguard - networking.firewall = { - # if packets are still dropped, they will show up in dmesg - logReversePathDrops = true; - # wireguard trips rpfilter up - extraCommands = '' - ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN - ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN - ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN - ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN - ''; - extraStopCommands = '' - ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true - ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true - ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN || true - ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN || true - ''; - }; } diff --git a/modules/binary-caches.nix b/modules/binary-caches.nix index 0508d89..01ee320 100644 --- a/modules/binary-caches.nix +++ b/modules/binary-caches.nix @@ -6,26 +6,23 @@ settings = { trusted-users = [ - "grue" + "0xa" "@wheel" ]; substituters = [ "https://microvm.cachix.org" - "https://nix-cache.hq.c3d2.de" "https://dump-dvb.cachix.org" "https://tlm-solutions.cachix.org" "https://nix-community.cachix.org" ]; trusted-substituters = [ "https://microvm.cachix.org" - "https://nix-cache.hq.c3d2.de" "https://dump-dvb.cachix.org" "https://tlm-solutions.cachix.org" "https://nix-community.cachix.org" ]; trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" - "nix-cache.hq.c3d2.de:KZRGGnwOYzys6pxgM8jlur36RmkJQ/y8y62e52fj1ps=" "dump-dvb.cachix.org-1:+Dq7gqpQG4YlLA2X3xJsG1v3BrlUGGpVtUKWk0dTyUU=" "tlm-solutions.cachix.org-1:J7qT6AvoNWPSj+59ed5bNESj35DLJNaROqga1EjVIoA=" "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" diff --git a/modules/chromium.nix b/modules/chromium.nix index f7803ab..0c9bc40 100644 --- a/modules/chromium.nix +++ b/modules/chromium.nix @@ -13,7 +13,9 @@ "pkehgijcmpdhfbdbbnkijodmdjhbjlgp" # privacy badger "ekhagklcjbdpajgpjgmbionohlpdbjgc" # zotero connector "nngceckbapebfimnlniiiahkandclblb" # bitwarden - "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin + # "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin + "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite + "mnjggcdmjocbbbhaepdhchncahnbgone" # sponsorblock ]; extraOpts = { "BrowserSignin" = 0; diff --git a/modules/devtools.nix b/modules/devtools.nix index 4a97bc7..8963c7d 100644 --- a/modules/devtools.nix +++ b/modules/devtools.nix @@ -1,6 +1,12 @@ { pkgs, inputs, ... }: { - environment.systemPackages = with pkgs; [ + environment.systemPackages = with pkgs; + let + kicad = pkgs.kicad.override { + addons = with pkgs.kicadAddons; [ kikit kikit-library ]; + }; + in + [ # general cmake gcc @@ -12,18 +18,13 @@ direnv # (nix-direnv.override { enableFlakes = true; }) sops - # rust - # (inputs.fenix.packages."x86_64-linux".stable.toolchain) - # nix - # rnix-lsp nil nixpkgs-fmt nix-index - # julia julia - # hardware kicad freecad-wayland + imhex ]; # Wireshark diff --git a/modules/virtualization.nix b/modules/virtualization.nix index 33b5588..97740e1 100644 --- a/modules/virtualization.nix +++ b/modules/virtualization.nix @@ -4,13 +4,8 @@ environment.systemPackages = with pkgs; [ virt-manager bridge-utils - vagrant ]; - environment.variables = { - VAGRANT_DEFAULT_PROVIDER="libvirt"; - }; - boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; # virtualization |