rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-01-19 01:21:39 +01:00
Code Issues Projects Releases Packages Wiki Activity

re-enabled impermanence and secure boot

Browse source
This commit is contained in:
Rouven Seifert 2023-08-02 20:28:22 +02:00
parent 085e064e46
commit a7a6c8e320
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
3 changed files with 45 additions and 35 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
flake.lock
View file

@ -171,11 +171,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1690970947, "lastModified": 1690982105,
"narHash": "sha256-7vOE9NFsNhe3+cpgGZ9ZLuSIzE+b8oNutezmr8tI60w=", "narHash": "sha256-32AzoLuwhtxBItcULRiCnxRfJcbVXbPZSH9TDVg21mU=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "484a1c94424d296b15af3e6858f08b576b842ec2", "rev": "b2ac1d2c32ac11b8d231d23622cdc4b2f28d07d2",
"type": "github" "type": "github"
}, },
"original": { "original": {

38
hosts/thinkpad/default.nix
View file

@ -16,13 +16,12 @@
# This setting is usually set to true in configuration.nix # This setting is usually set to true in configuration.nix
# generated at installation time. So we force it to false # generated at installation time. So we force it to false
# for now. # for now.
# loader.systemd-boot.enable = lib.mkForce false; loader.systemd-boot.enable = lib.mkForce false;
loader.systemd-boot.enable = true; lanzaboote = {
# lanzaboote = { enable = true;
# enable = true; pkiBundle = "/etc/secureboot";
# pkiBundle = "/etc/secureboot"; configurationLimit = 10;
# configurationLimit = 10; };
# };
extraModulePackages = [ extraModulePackages = [
config.boot.kernelPackages.v4l2loopback.out config.boot.kernelPackages.v4l2loopback.out
]; ];
@ -62,19 +61,19 @@
# ]; # ];
}; };
#environment.persistence."/nix/persist/system" = { environment.persistence."/nix/persist/system" = {
# directories = [ directories = [
# "/etc/nixos" # bind mounted from /nix/persist/system/etc/nixos to /etc/nixos "/etc/nixos" # bind mounted from /nix/persist/system/etc/nixos to /etc/nixos
# "/etc/ssh" "/etc/ssh"
# "/etc/secureboot" "/etc/secureboot"
# "/root/.ssh" "/root/.ssh"
# ]; ];
# files = [ files = [
# "/etc/machine-id" "/etc/machine-id"
# ]; ];
#}; };
# impermanence fixes # impermanence fixes
#sops.age.sshKeyPaths = lib.mkForce [ "/nix/persist/system/etc/ssh/ssh_host_ed25519_key" ]; sops.age.sshKeyPaths = lib.mkForce [ "/nix/persist/system/etc/ssh/ssh_host_ed25519_key" ];
sops.gnupg.sshKeyPaths = lib.mkForce [ ]; sops.gnupg.sshKeyPaths = lib.mkForce [ ];
time.timeZone = "Europe/Berlin"; time.timeZone = "Europe/Berlin";
@ -158,6 +157,7 @@
openFirewall = false; openFirewall = false;
}; };
fwupd.enable = true; # firmware updates fwupd.enable = true; # firmware updates
zfs.autoScrub.enable = true;
}; };
programs.steam.enable = true; # putting steam in here cause in home manager it doesn't work programs.steam.enable = true; # putting steam in here cause in home manager it doesn't work

36
hosts/thinkpad/hardware-configuration.nix
View file

@ -9,17 +9,26 @@
(modulesPath + "/installer/scan/not-detected.nix") (modulesPath + "/installer/scan/not-detected.nix")
]; ];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ]; boot = {
boot.initrd.kernelModules = [ ]; initrd = {
boot.kernelModules = [ "kvm-intel" ]; availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.extraModulePackages = [ ]; kernelModules = [ ];
boot.initrd.systemd.enable = true; systemd.enable = true;
boot.initrd.luks.devices."luksroot" = { luks.devices."luksroot" = {
device = "/dev/disk/by-uuid/6b89181c-71e0-4e84-8523-2456d3e28400"; device = "/dev/disk/by-uuid/6b89181c-71e0-4e84-8523-2456d3e28400";
allowDiscards = true; allowDiscards = true;
}; };
boot.initrd.luks.devices."luksswap" = { luks.devices."luksswap" = {
device = "/dev/disk/by-uuid/4a5fd2d9-1b37-4895-a24b-835a9cd4063e"; device = "/dev/disk/by-uuid/4a5fd2d9-1b37-4895-a24b-835a9cd4063e";
};
};
kernelModules = [ "kvm-intel" ];
zfs = {
allowHibernation = true;
forceImportRoot = false;
};
}; };
@ -48,8 +57,9 @@
}; };
fileSystems."/" = fileSystems."/" =
{ {
device = "rpool/nixos/fixroot"; device = "tmpfs";
fsType = "zfs"; fsType = "tmpfs";
options = [ "mode=755" ];
}; };
fileSystems."/boot" = fileSystems."/boot" =