summaryrefslogtreecommitdiff
path: root/hosts/toaster
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/toaster')
-rw-r--r--hosts/toaster/0xa-home.nix21
-rw-r--r--hosts/toaster/amd.nix22
-rw-r--r--hosts/toaster/default.nix80
-rw-r--r--hosts/toaster/hardware-configuration.nix85
-rw-r--r--hosts/toaster/irc.nix10
-rw-r--r--hosts/toaster/network/default.nix45
-rw-r--r--hosts/toaster/network/dumpdvb.nix38
-rw-r--r--hosts/toaster/network/full-networkd.nix71
-rw-r--r--hosts/toaster/network/mullvad.nix98
-rw-r--r--hosts/toaster/network/zw.nix61
-rw-r--r--hosts/toaster/secrets.yaml51
-rw-r--r--hosts/toaster/secure-boot.nix13
-rw-r--r--hosts/toaster/zfs.nix25
13 files changed, 620 insertions, 0 deletions
diff --git a/hosts/toaster/0xa-home.nix b/hosts/toaster/0xa-home.nix
new file mode 100644
index 0000000..b3ff5eb
--- /dev/null
+++ b/hosts/toaster/0xa-home.nix
@@ -0,0 +1,21 @@
+{ pkgs, ... }:
+{
+ home.stateVersion = "24.11";
+
+ home.pointerCursor = {
+ name = "Banana";
+ size = 32;
+ package = pkgs.banana-cursor;
+ x11.enable = true;
+ gtk.enable = true;
+ };
+
+ gtk = {
+ enable = true;
+ cursorTheme = {
+ name = "Banana";
+ size = 32;
+ package = pkgs.banana-cursor;
+ };
+ };
+}
diff --git a/hosts/toaster/amd.nix b/hosts/toaster/amd.nix
new file mode 100644
index 0000000..b58784f
--- /dev/null
+++ b/hosts/toaster/amd.nix
@@ -0,0 +1,22 @@
+{ ... }:
+{
+ boot.initrd.kernelModules = [ "amdgpu" ];
+
+ boot.kernelParams = [
+ # use new amd pstate driver
+ "amd_pstate=active"
+ # fix flicker
+ "amdgpu.dcdebugmask=0x10"
+ ];
+
+ # hardware.graphics = {
+ # extraPackages = with pkgs; [
+ # rocm-opencl-icd
+ # rocm-opencl-runtime
+ # amdvlk
+ # ];
+ # extraPackages32 = with pkgs; [
+ # driversi686Linux.amdvlk
+ # ];
+ # };
+}
diff --git a/hosts/toaster/default.nix b/hosts/toaster/default.nix
new file mode 100644
index 0000000..2b8577b
--- /dev/null
+++ b/hosts/toaster/default.nix
@@ -0,0 +1,80 @@
+{ pkgs, config, ... }:
+{
+ imports = [
+ ./amd.nix
+ ./hardware-configuration.nix
+ ./irc.nix
+ ./network
+ ./secure-boot.nix
+ ./zfs.nix
+ ];
+
+ sops.defaultSopsFile = ./secrets.yaml;
+ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+ sops.secrets = {
+ "wg/zw" = {
+ owner = config.users.users.systemd-network.name;
+ };
+ "wg/dvb" = {
+ owner = config.users.users.systemd-network.name;
+ };
+ "wg/mullvad" = {
+ owner = config.users.users.systemd-network.name;
+ };
+ "wg/0xa-mgmt" = {
+ owner = config.users.users.systemd-network.name;
+ };
+ };
+
+ nixpkgs.config.allowUnfree = true;
+
+ # Use the systemd-boot EFI boot loader.
+ boot.loader.systemd-boot.enable = true;
+ boot.loader.efi.canTouchEfiVariables = true;
+ hardware.enableAllFirmware = true;
+
+ # update the firmware
+ services.fwupd.enable = true;
+
+ # Set your time zone.
+ time.timeZone = "Europe/Amsterdam";
+
+ # Select internationalisation properties.
+ i18n = {
+ defaultLocale = "en_US.UTF-8";
+ supportedLocales = [ "all" ];
+ };
+
+ # support ddc brigtness control
+ hardware.i2c.enable = true;
+ boot.kernelModules = [ "i2c-dev" ];
+ environment.systemPackages = [ pkgs.ddcutil ];
+
+ users.users."0xa" = {
+ extraGroups = [
+ "wheel"
+ "video"
+ "plugdev"
+ "dialout"
+ "bluetooth"
+ "libvirtd"
+ "qemu-libvirtd"
+ "i2c"
+ ];
+ group = "users";
+ home = "/home/0xa";
+ isNormalUser = true;
+ uid = 1000;
+ shell = pkgs.zsh;
+ };
+
+ # This value determines the NixOS release from which the default
+ # settings for stateful data, like file locations and database versions
+ # on your system were taken. It‘s perfectly fine and recommended to leave
+ # this value at the release version of the first install of this system.
+ # Before changing this value read the documentation for this option
+ # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+ system.stateVersion = "24.11"; # Did you read the comment?
+
+}
diff --git a/hosts/toaster/hardware-configuration.nix b/hosts/toaster/hardware-configuration.nix
new file mode 100644
index 0000000..318ff03
--- /dev/null
+++ b/hosts/toaster/hardware-configuration.nix
@@ -0,0 +1,85 @@
+# Do not modify this file! It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations. Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+ config,
+ lib,
+ modulesPath,
+ ...
+}:
+
+{
+ imports = [
+ (modulesPath + "/installer/scan/not-detected.nix")
+ ];
+
+ boot.initrd.availableKernelModules = [
+ "nvme"
+ "xhci_pci"
+ "usb_storage"
+ "usbhid"
+ "sd_mod"
+ ];
+ boot.initrd.kernelModules = [ ];
+ boot.kernelModules = [ "kvm-amd" ];
+ boot.extraModulePackages = [ ];
+ boot.zfs.extraPools = [ "zpool" ];
+
+ fileSystems."/" = {
+ device = "zpool/root";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
+
+ fileSystems."/nix" = {
+ device = "zpool/nix";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
+
+ fileSystems."/home" = {
+ device = "zpool/data/home";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
+
+ fileSystems."/var" = {
+ device = "zpool/data/var";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
+
+ fileSystems."/tmp" = {
+ device = "zpool/nocomp/tmp";
+ fsType = "zfs";
+ options = [ "zfsutil" ];
+ };
+
+ fileSystems."/boot" = {
+ device = "/dev/disk/by-uuid/A170-F83D";
+ fsType = "vfat";
+ options = [
+ "fmask=0022"
+ "dmask=0022"
+ ];
+ };
+
+ swapDevices = [
+ {
+ device = "/dev/disk/by-partuuid/037518f2-9fa0-44f0-9550-745e27bf1c1f";
+ randomEncryption = true;
+ }
+ ];
+
+ # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+ # (the default) this is the recommended approach. When using systemd-networkd it's
+ # still possible to use this option, but it's recommended to use it in conjunction
+ # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+ networking.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
+ # networking.interfaces.enp5s0f4u1u1.useDHCP = lib.mkDefault true;
+ # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+ hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/hosts/toaster/irc.nix b/hosts/toaster/irc.nix
new file mode 100644
index 0000000..ecdac88
--- /dev/null
+++ b/hosts/toaster/irc.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+ environment.systemPackages = [ pkgs.senpai ];
+
+ sops.secrets = {
+ "senpai" = {
+ owner = config.users.users."0xa".name;
+ };
+ };
+}
diff --git a/hosts/toaster/network/default.nix b/hosts/toaster/network/default.nix
new file mode 100644
index 0000000..6504dbb
--- /dev/null
+++ b/hosts/toaster/network/default.nix
@@ -0,0 +1,45 @@
+{ lib, config, ... }:
+{
+ imports = [
+ ./mullvad.nix
+ ./dumpdvb.nix
+ ./zw.nix
+ ];
+
+ # Networkmanager shouldn't interfere with systemd managed interfaces
+ networking.networkmanager = {
+ enable = true;
+ unmanaged =
+ let
+ systemd_netdevs = lib.attrsets.attrValues (
+ lib.attrsets.mapAttrs (_name: value: value.netdevConfig.Name) config.systemd.network.netdevs
+ );
+ in
+ systemd_netdevs;
+ };
+
+ systemd.network = {
+ enable = true;
+ wait-online.enable = false; # uplink is managed by networkmanager
+ };
+
+ users.users."0xa".extraGroups = [ "networkmanager" ];
+
+ networking = {
+ hostName = "toaster";
+ firewall.enable = true;
+ wireguard.enable = true;
+ };
+
+ services.resolved = {
+ enable = true;
+ dnssec = "false";
+ fallbackDns = [
+ "9.9.9.9"
+ "2620:fe::fe"
+ "149.112.112.112"
+ "2620:fe::9"
+ ];
+ };
+
+}
diff --git a/hosts/toaster/network/dumpdvb.nix b/hosts/toaster/network/dumpdvb.nix
new file mode 100644
index 0000000..d3fba93
--- /dev/null
+++ b/hosts/toaster/network/dumpdvb.nix
@@ -0,0 +1,38 @@
+{ config, ... }:
+{
+ systemd.network = {
+ # Wireguard
+ # Dump-dvb
+ netdevs."30-wg-dumpdvb" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg-dumpdvb";
+ Description = "dvb.solutions enterprise network";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.sops.secrets."wg/dvb".path;
+ };
+ wireguardPeers = [
+ {
+ PublicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY=";
+ Endpoint = "academicstrokes.com:51820";
+ AllowedIPs = [ "10.13.37.0/24" ];
+ PersistentKeepalive = 25;
+ }
+ ];
+ };
+ networks."30-wg-dumpdvb" = {
+ matchConfig.Name = "wg-dumpdvb";
+ networkConfig = {
+ Address = "10.13.37.3/24";
+ IPv6AcceptRA = true;
+ };
+ routes = [
+ {
+ Gateway = "10.13.37.1";
+ Destination = "10.13.37.0/24";
+ }
+ ];
+ };
+ };
+}
diff --git a/hosts/toaster/network/full-networkd.nix b/hosts/toaster/network/full-networkd.nix
new file mode 100644
index 0000000..ee0bdbe
--- /dev/null
+++ b/hosts/toaster/network/full-networkd.nix
@@ -0,0 +1,71 @@
+{ lib, pkgs, ... }:
+{
+ imports = [
+ ./mullvad.nix
+ ./dumpdvb.nix
+ ./zw.nix
+ ];
+
+ environment.systemPackages = with pkgs; [
+ iwgtk
+ impala
+ ];
+
+ # kick out networkmanager
+ networking.networkmanager.enable = lib.mkForce false;
+ networking.useNetworkd = true;
+ systemd.network.enable = true;
+
+ networking = {
+ hostName = "toaster";
+ firewall.enable = true;
+ wireguard.enable = true;
+ wireless.iwd.enable = true;
+ };
+
+ services.resolved = {
+ enable = true;
+ dnssec = "false";
+ fallbackDns = [
+ "9.9.9.9"
+ "2620:fe::fe"
+ "149.112.112.112"
+ "2620:fe::9"
+ ];
+ };
+
+ # we might have no interwebs at all
+ systemd.network.wait-online.enable = false;
+
+ # uplinks
+ systemd.network.networks = {
+ "10-ether-uplink" = {
+ matchConfig.Name = "enp1s0f0";
+ networkConfig = {
+ DHCP = "yes";
+ IPv6AcceptRA = true;
+ };
+ };
+ "10-dock-uplink" = {
+ matchConfig.Name = "enp5s0f4u1u1";
+ networkConfig = {
+ DHCP = "yes";
+ IPv6AcceptRA = true;
+ };
+ dhcpV4Config = {
+ RouteMetric = 666;
+ };
+ dhcpV6Config = {
+ RouteMetric = 666;
+ };
+ };
+ "wlan-uplink" = {
+ matchConfig.Name = "wlan0";
+ networkConfig = {
+ DHCP = "yes";
+ IPv6AcceptRA = true;
+ };
+ };
+ };
+
+}
diff --git a/hosts/toaster/network/mullvad.nix b/hosts/toaster/network/mullvad.nix
new file mode 100644
index 0000000..54fec8d
--- /dev/null
+++ b/hosts/toaster/network/mullvad.nix
@@ -0,0 +1,98 @@
+{
+ config,
+ ...
+}:
+{
+ systemd.network =
+ let
+ pubkey = "xpZ3ZDEukbqKQvdHwaqKMUhsYhcYD3uLPUh1ACsVr1s=";
+ endpoint = "185.65.134.86";
+ port = "51820";
+ addr = [
+ "10.74.16.48/32"
+ "fc00:bbbb:bbbb:bb01::b:102f/128"
+ ];
+ in
+ {
+ netdevs."10-wg-mullvad" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg-mullvad";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.sops.secrets."wg/mullvad".path;
+ FirewallMark = 34952; # 0x8888
+ RouteTable = "off";
+ };
+ wireguardPeers = [
+ {
+ PublicKey = pubkey;
+ Endpoint = "${endpoint}:${port}";
+ AllowedIPs = [
+ "0.0.0.0/0"
+ "::0/0"
+ ];
+ }
+ ];
+ };
+ networks."10-wg-mullvad" = {
+ matchConfig.Name = "wg-mullvad";
+ address = addr;
+ networkConfig = {
+ DNS = "10.64.0.1";
+ DNSDefaultRoute = true;
+ Domains = [ "~." ];
+ };
+ routes =
+ map
+ (gate: {
+ Gateway = gate;
+ Table = 1000;
+ })
+ [
+ "0.0.0.0"
+ "::"
+ ];
+
+ routingPolicyRules =
+ [
+ {
+ Family = "both";
+ FirewallMark = 34952; # 0x8888
+ InvertRule = true;
+ Table = "1000";
+ Priority = 100;
+ }
+ {
+ Family = "both";
+ SuppressPrefixLength = 0;
+ Table = "main";
+ Priority = 90;
+ }
+ ]
+ ++ map
+ (net: {
+ # only route global addresses over VPN
+ Priority = 80;
+ To = net;
+ })
+ [
+ # Mullvad endpoint
+ "${endpoint}/32"
+ # zw endpoint
+ "81.201.149.152/32"
+ # oxalab/oxa endpoint
+ "188.245.196.27/32"
+ # "10.0.0.0/8"
+ "10.13.37.0/24"
+ # 0xa-mgmt
+ "10.89.87.0/24"
+ # "172.16.0.0/12"
+ "172.16.0.0/12"
+ # "182.168.0.0/16"
+ "182.168.0.0/16"
+ # "fc00::/7"
+ ];
+ };
+ };
+}
diff --git a/hosts/toaster/network/zw.nix b/hosts/toaster/network/zw.nix
new file mode 100644
index 0000000..71e75be
--- /dev/null
+++ b/hosts/toaster/network/zw.nix
@@ -0,0 +1,61 @@
+{ config, ... }:
+{
+ # zentralwerk
+ systemd.network = {
+ netdevs."10-wg-zentralwerk" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg-zentralwerk";
+ Description = "Tunnel to the best basement in Dresden";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.sops.secrets."wg/zw".path;
+ RouteTable = "off";
+ };
+ wireguardPeers = [
+ {
+ PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
+ Endpoint = "81.201.149.152:1337";
+ AllowedIPs = [
+ "172.20.72.0/21"
+ "172.22.90.0/24"
+ "172.22.99.0/24"
+ ];
+ PersistentKeepalive = 25;
+ }
+ ];
+ };
+ networks."10-wg-zentralwerk" = {
+ matchConfig.Name = "wg-zentralwerk";
+ networkConfig = {
+ Address = "172.20.76.226/21";
+ IPv6AcceptRA = true;
+ DNS = "172.20.73.8";
+ Domains = [
+ "~hq.c3d2.de"
+ "~serv.zentralwerk.org"
+ "~hq.zentralwerk.org"
+ "~cluster.zentralwerk.org"
+ ];
+ };
+ routes = [
+ {
+ Gateway = "172.20.76.225";
+ Destination = "172.20.72.0/21";
+ Metric = 1023;
+ }
+ {
+ Gateway = "172.20.76.225";
+ Destination = "172.20.90.0/24";
+ Metric = 1023;
+ }
+ {
+ Gateway = "172.20.76.225";
+ Destination = "172.22.99.0/24";
+ Metric = 1023;
+ }
+
+ ];
+ };
+ };
+}
diff --git a/hosts/toaster/secrets.yaml b/hosts/toaster/secrets.yaml
new file mode 100644
index 0000000..701733d
--- /dev/null
+++ b/hosts/toaster/secrets.yaml
@@ -0,0 +1,51 @@
+wg:
+ mullvad: ENC[AES256_GCM,data:P9acMXooRll8i81RIBVb0OxFdzx2WsGgVKqX+BoV7cvPGWJK5FRIF8KAcqg=,iv:kq+3guPx2+reDqmfHuhWEvUsKNynG+t7LYRNp5kFLoQ=,tag:Aj0P7IrrTdRK59aBMjPx5Q==,type:str]
+ zw: ENC[AES256_GCM,data:CXrLvV+b9DUfmr+CwH8dBTHvDHtgVmiF9g+QpzFqMcc91yQDzQqT1d4AQSk=,iv:Wdj11qlGWGm2XSieFZ4csqdIyR0epzPCkeWyUUmjJbk=,tag:UO07WUwr138B5TtMGujvew==,type:str]
+ 0xa-mgmt: ENC[AES256_GCM,data:THKgWJs4bxNYwnl1FQzXSC0xIuv1r0jSByQgwoKau34sddgTzztRHbSztGs=,iv:wn08l8hlSORlyD8XpF6pk6F3HTsT345xp8XxkJVUKcY=,tag:oP+5+cunkQ5KVf6PB5Rirw==,type:str]
+ dvb: ENC[AES256_GCM,data:1+IM6ORPtlIroeekaJSkOwYArh0fN6ycJNaXo680pE2Xv4DUBrIlh8q3V2A=,iv:btf3IpM4Wntkf3RYPwUdhH+4WUUqZp0zYp0aj2sdGM0=,tag:MDvS4CWYQLdp2YGs3/5Htw==,type:str]
+mail:
+ oxapentane.com: ENC[AES256_GCM,data:HW1xcclr5CiUFVF8As79ZZH1c14sl4T0l18=,iv:leAVYaQkMuJewkCZc3fTUUNzZ9BDjV5CuT84bzvhrrs=,tag:Mm8OB8gLbmUwKSLugTR6GA==,type:str]
+ shipunov.xyz: ENC[AES256_GCM,data:cg+P+FrZ2icjfhwDGKGyUH9DejSZHpNs2bcSBPyz8g==,iv:XZFaSXnGmTL9j2sEyt5Q7+pe6rr+WA/0UGq/2Gl5DTI=,tag:oq+5EuJWJKwK3h0/e6Uozw==,type:str]
+ dvb.solutions: ENC[AES256_GCM,data:GSjPIPA5TGMWfhdRzTsiHPfXFVGLVSpJvJG+I++i,iv:EBlk00wqADCuYTzuVcuX9kSn6TVBfN12UlcXyps6TtE=,tag:G7rKTngN4v2FtuhQEMdUQQ==,type:str]
+ tlm.solutions: ENC[AES256_GCM,data:ncTMh/jw+YmcmcVU/c1I36vV1CwtmtYwfyDUx9w9,iv:vPnmdvDnEJ9FF4rDkSfPnLWebleSgI/yG7qOgJfq5ic=,tag:z4w4LOGf2v0TBSxrHULBsw==,type:str]
+senpai: ENC[AES256_GCM,data:nLMlw+Gw5p9pcyElvHy/d+GV0/dbTj3+Et+lzBs1YEUcsYT2lM7sN+5+4PEF6weJgHUreTl007fh8+FO8S+mUg==,iv:+5szUWaARn93RTQvY13JGn2zJ3y8iyjv09i3KtbhaTQ=,tag:OsD4IoRv8wGuUbEnsld7Dg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1avaphjah4k8n80jrnraeqh9r94fu6awd6k37z4zfjssl5ft07qkqmuehcm
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibGw3UTUzNHg2dDJGYmYx
+ Vis5WlhqeXUybmtxTU9XWEFLcjc1VEErOTN3CmZYa2kzcUdNQURVTG5NeUpSb0I0
+ STdQb1NqSWJoK1pmYXA5UXM5NDRFWVUKLS0tIDNWTmVTcDdneUEwemtWZVNZVFdz
+ bDRBWjJJSDl3bDkxenR1S2NMZW91dW8Kzhc/6HeEJfLGDaKdRSbpaMdR7XaBxdQI
+ jnAySJCGsXxCPebRtCIdDnoLjdqdzEggEhRh27JOpeOiEukLmakPMA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-02-05T19:41:58Z"
+ mac: ENC[AES256_GCM,data:5u2hJYMHwpFd5fcHXKzOblHfgnRTjNIEL+glBsHct3xZ+G1APQg9WdgZbRWc+ypdYPFfhqXKV9RBl/UHtFEyljL7JQV0U8EfumP1WNjPaMgnWftm5qLOe0PxmrPbwsYYBdotO9GVoplghrNd1euvMsxd3F+YtU+MnY+u4dcr4C8=,iv:A61rDNajtU/NOqcemmCN348STdMI9qqPRvdd6n/EuKg=,tag:Y1zi86LNX1xlXpjbslmRAA==,type:str]
+ pgp:
+ - created_at: "2025-01-02T22:57:16Z"
+ enc: |-
+ -----BEGIN PGP MESSAGE-----
+
+ hQIMA7zUOKwzpAE7AQ//fH+XzwM0ARlUGFK0/WDVXb4fR8364JdtrWp1njqYQBme
+ rRtIuyYWg7b4c1K9frX+3Ftei6EhZTejgyoSulQkOD5X7L726iik8kaJxtkH0Ubl
+ Hmak4viT9r4cCBYBBCsDQgojAImgNvaW+DyX4UFOyr0asnUEVj4N1/eejxPteXfj
+ c4+PzKKkliRpwUj4OZufmxcZvFi3XBy1AIgji9EpZkG6mGeeRpchJdA7kFWlO0fl
+ wUuDjudqSMr2hOySfOI/AW+4QgWo1t6uZwIi4VWMmI2h3hlAbsWfYiLMXqIB8RpF
+ lx30HdcFmZwfmVyT5n+oFlV4kPWPNvc0lLDvoZdKpsXIeuhMWKdrRZ2XmDE6F+rQ
+ PE4tT46vR4uCHNSAiLYhAY+yr2ic5w+Damv80mxsnGBrFhh93/5grJRSQ+iZcr1D
+ hu4nMAiw7xdkjgVHJrZZ0YEh9cXD74oUfvE7T201h2ppFEAzYaDrwuIuFqJmFew/
+ /meRImzoCpp2H2cAsol90kxVdNc+yQerNqknkNBU6TCWB5HkcEa1xM5PER2s8cHd
+ KK5ej1DzNgQHN41N3zv1xyd2HXOOgVXYwITkHU0BNFBowpf2JScUcVMWYtuZ2Mlh
+ izVM0pJwx7bJgZqVnpZsxyzSOD3I6ufS61VMp5RVOS/58qih2BNsTys3DtmaFcvS
+ XgFD1Mr9Ul4xIyF2akUeGU5n+fRZnIwtM7JmcJGjlg1nQPvRFZSLrYBs83TPrftS
+ zQv+xyb6mPo91iHqe/ey3JbB/+/uSkVSZsBL05thYNLucQJ0L3r0qhc6gnQxNNo=
+ =DYwa
+ -----END PGP MESSAGE-----
+ fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C
+ unencrypted_suffix: _unencrypted
+ version: 3.9.4
diff --git a/hosts/toaster/secure-boot.nix b/hosts/toaster/secure-boot.nix
new file mode 100644
index 0000000..9d934e1
--- /dev/null
+++ b/hosts/toaster/secure-boot.nix
@@ -0,0 +1,13 @@
+{ pkgs, lib, ... }:
+{
+ boot = {
+ bootspec.enable = true;
+ loader.systemd-boot.enable = lib.mkForce false;
+ lanzaboote = {
+ enable = true;
+ pkiBundle = "/var/lib/sbctl";
+ };
+ };
+
+ environment.systemPackages = [ pkgs.sbctl ];
+}
diff --git a/hosts/toaster/zfs.nix b/hosts/toaster/zfs.nix
new file mode 100644
index 0000000..1970bbf
--- /dev/null
+++ b/hosts/toaster/zfs.nix
@@ -0,0 +1,25 @@
+{
+ pkgs,
+ ...
+}:
+{
+ services.fstrim.enable = true;
+ services.zfs = {
+ autoSnapshot.enable = true;
+ trim.enable = true;
+ autoScrub = {
+ enable = true;
+ pools = [ "zpool" ];
+ };
+ };
+ networking.hostId = "dca22577";
+ boot = {
+ kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+ zfs.package = pkgs.zfs_2_3;
+ supportedFilesystems = [ "zfs" ];
+ kernelParams = [ "nohibernate" ];
+ plymouth.enable = false;
+ tmp.useTmpfs = false;
+ tmp.cleanOnBoot = true;
+ };
+}
generated by cgit v1.3.1 (git 2.54.0) at 2026-07-28 03:39:38 +0000