From e86fdf181986a30ec775a74ec75aecf64e9f05df Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 28 Nov 2023 11:37:35 +0100 Subject: [PATCH 1/4] tomate: init --- .sops.yaml | 13 ++ flake.nix | 12 ++ hosts/quitte/configuration.nix | 1 + hosts/tomate/configuration.nix | 153 ++++++++++++++++++++++++ hosts/tomate/hardware-configuration.nix | 40 +++++++ modules/base.nix | 1 - 6 files changed, 219 insertions(+), 1 deletion(-) create mode 100644 hosts/tomate/configuration.nix create mode 100644 hosts/tomate/hardware-configuration.nix diff --git a/.sops.yaml b/.sops.yaml index 0b6cb06..a85f163 100755 --- a/.sops.yaml +++ b/.sops.yaml @@ -10,6 +10,7 @@ keys: - &jonas A4F92BC7B792108A463995827C1F2DA2BC929412 - &joachim B1A16011B86BACB56ADB713DB712039D23133661 - &quitte age1wvdnprpnq2rcc4se3zpx2p267n0apxg2jucvlm93e3pfj439ephqh2506t + - &tomate age18lwgjazaxujqgcc5j0gjllnykhtjn6p0q44jzrsk4au2a5k6nd9s77kd6d creation_rules: - path_regex: secrets/quitte\.yaml$ @@ -24,6 +25,18 @@ creation_rules: - *jonas age: - *quitte + - path_regex: secrets/tomate\.yaml$ + key_groups: + - pgp: + - *bennofs + - *revol-xut + - *felix + - *rouven + - *fugi + - *joachim + - *jonas + age: + - *tomate - path_regex: secrets/admin\.yaml$ key_groups: - pgp: diff --git a/flake.nix b/flake.nix index 1d5efbc..66dba59 100755 --- a/flake.nix +++ b/flake.nix @@ -71,6 +71,18 @@ } ]; }; + tomate = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = inputs; + modules = [ + inputs.sops-nix.nixosModules.sops + ./modules/base.nix + ./modules/zsh.nix + # { + # sops.defaultSopsFile = ./secrets/tomate.yaml; + # } + ]; + }; }; }; } diff --git a/hosts/quitte/configuration.nix b/hosts/quitte/configuration.nix index 428e7fe..066938d 100644 --- a/hosts/quitte/configuration.nix +++ b/hosts/quitte/configuration.nix @@ -19,6 +19,7 @@ # Set your time zone. time.timeZone = "Europe/Berlin"; + i18n.defaultLocale = "en_US.UTF-8"; # List packages installed in system profile. To search, run: # $ nix search wget diff --git a/hosts/tomate/configuration.nix b/hosts/tomate/configuration.nix new file mode 100644 index 0000000..bc2efb9 --- /dev/null +++ b/hosts/tomate/configuration.nix @@ -0,0 +1,153 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "tomate"; # Define your hostname. + networking.nftables.enable = true; + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Enable networking + networking.networkmanager.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Berlin"; + + # Select internationalisation properties. + i18n.defaultLocale = "de_DE.UTF-8"; + + i18n.extraLocaleSettings = { + LC_ADDRESS = "de_DE.UTF-8"; + LC_IDENTIFICATION = "de_DE.UTF-8"; + LC_MEASUREMENT = "de_DE.UTF-8"; + LC_MONETARY = "de_DE.UTF-8"; + LC_NAME = "de_DE.UTF-8"; + LC_NUMERIC = "de_DE.UTF-8"; + LC_PAPER = "de_DE.UTF-8"; + LC_TELEPHONE = "de_DE.UTF-8"; + LC_TIME = "de_DE.UTF-8"; + }; + + # Enable the X11 windowing system. + services.xserver.enable = true; + + # Enable the KDE Plasma Desktop Environment. + services.xserver.displayManager.sddm.enable = true; + services.xserver.desktopManager.plasma5.enable = true; + + # Configure keymap in X11 + services.xserver = { + layout = "de"; + xkbVariant = ""; + }; + + # Configure console keymap + console.keyMap = "de"; + + # Enable CUPS to print documents. + services.printing.enable = true; + services.printing.defaultShared = true; + services.printing.browsing = true; + # sollte auf nur fsr netz beschränkt werden sobald die tomate mal nach außen zeigt + services.printing.allowFrom = [ "all" ]; + + # services.avahi = { + # enable = true; + # nssmdns = true; + # openFirewall = true; + # publish = { + # enable = true; + # userServices = true; + # }; + # }; + networking.firewall = { + allowedTCPPorts = [ 631 ]; + allowedUDPPorts = [ 631 ]; + }; + + # Enable sound with pipewire. + sound.enable = true; + hardware.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; + + # Enable touchpad support (enabled default in most desktopManager). + # services.xserver.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.fsr = { + isNormalUser = true; + description = "FSR Informatik"; + extraGroups = [ "networkmanager" "wheel" ]; + packages = with pkgs; [ + firefox + kate + # thunderbird + ]; + }; + + # Allow unfree packages + nixpkgs.config.allowUnfree = true; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + # wget + ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "23.05"; # Did you read the comment? + +} diff --git a/hosts/tomate/hardware-configuration.nix b/hosts/tomate/hardware-configuration.nix new file mode 100644 index 0000000..cef0fd9 --- /dev/null +++ b/hosts/tomate/hardware-configuration.nix @@ -0,0 +1,40 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/618e281f-a8bf-4129-bfc1-aa47f86a8c54"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/0844-2A73"; + fsType = "vfat"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/8bdeb0c1-8f1e-43a7-b4b9-c06e27a94460"; } + ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/modules/base.nix b/modules/base.nix index 0c8eff0..348aa2c 100755 --- a/modules/base.nix +++ b/modules/base.nix @@ -14,7 +14,6 @@ ''; # Select internationalisation properties. - i18n.defaultLocale = "en_US.UTF-8"; console = { #font = "Lat2-Terminus16"; font = "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz"; From 71f197c2f58d21abf3aa51dbf730052502949b95 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 28 Nov 2023 11:40:04 +0100 Subject: [PATCH 2/4] tomate: reformat --- hosts/tomate/hardware-configuration.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/hosts/tomate/hardware-configuration.nix b/hosts/tomate/hardware-configuration.nix index cef0fd9..9866793 100644 --- a/hosts/tomate/hardware-configuration.nix +++ b/hosts/tomate/hardware-configuration.nix @@ -5,7 +5,8 @@ { imports = - [ (modulesPath + "/installer/scan/not-detected.nix") + [ + (modulesPath + "/installer/scan/not-detected.nix") ]; boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "usbhid" "usb_storage" "sd_mod" ]; @@ -14,18 +15,19 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/618e281f-a8bf-4129-bfc1-aa47f86a8c54"; + { + device = "/dev/disk/by-uuid/618e281f-a8bf-4129-bfc1-aa47f86a8c54"; fsType = "ext4"; }; fileSystems."/boot" = - { device = "/dev/disk/by-uuid/0844-2A73"; + { + device = "/dev/disk/by-uuid/0844-2A73"; fsType = "vfat"; }; swapDevices = - [ { device = "/dev/disk/by-uuid/8bdeb0c1-8f1e-43a7-b4b9-c06e27a94460"; } - ]; + [{ device = "/dev/disk/by-uuid/8bdeb0c1-8f1e-43a7-b4b9-c06e27a94460"; }]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's From 7197d6b2e2f008fe4fcb432210b10a53cec9f428 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 28 Nov 2023 11:42:50 +0100 Subject: [PATCH 3/4] tomate: add missing modules --- flake.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/flake.nix b/flake.nix index 66dba59..7bb1f1f 100755 --- a/flake.nix +++ b/flake.nix @@ -76,6 +76,8 @@ specialArgs = inputs; modules = [ inputs.sops-nix.nixosModules.sops + inputs.nix-index-database.nixosModules.nix-index + ./hosts/tomate/configuration.nix ./modules/base.nix ./modules/zsh.nix # { From 8b9099fe043d82e0f8e160a3236b462692e2508d Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 28 Nov 2023 11:48:11 +0100 Subject: [PATCH 4/4] tomate: remove fsr from wheel --- hosts/tomate/configuration.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/tomate/configuration.nix b/hosts/tomate/configuration.nix index bc2efb9..d66d266 100644 --- a/hosts/tomate/configuration.nix +++ b/hosts/tomate/configuration.nix @@ -105,7 +105,7 @@ users.users.fsr = { isNormalUser = true; description = "FSR Informatik"; - extraGroups = [ "networkmanager" "wheel" ]; + extraGroups = [ "networkmanager" ]; packages = with pkgs; [ firefox kate