a

flake.nix

@@ -69,6 +69,7 @@
         };
     in
     {
+      nixosConfigurations."anemone" = mkSystem nixpkgs "anemone" "x86_64-linux" true [];
       nixosConfigurations."blossom" = mkSystem nixpkgs "blossom" "x86_64-linux" true [];
       nixosConfigurations."hyacinth" = mkSystem nixpkgs "hyacinth" "x86_64-linux" true [];
 

hosts/anemone/default.nix

@@ -0,0 +1,43 @@
+{ config, inputs, modules, overlays, pkgs, ... }: {
+  networking.hostName = "anemone";
+  system.stateVersion = "23.11";
+  time.timeZone = "Asia/Phnom_Penh";
+
+  nixpkgs.overlays = [ inputs.neovim-nightly.overlay ];
+  age.secrets = {
+    passwd.file = ../../secrets/passwd.age;
+    #wg_hyacinth.file = ../../secrets/wg_blossom.age;
+    #wpa_conf.file = ../../secrets/wpa_conf.age;
+  };
+  imports = with modules.system; [
+    inputs.home-manager.nixosModule
+    home-manager
+
+    audio
+    base
+    ccache
+    corectrl
+    flatpak
+    greetd
+    gui
+    input
+    kernel
+    nix
+    packages
+    printing
+    security
+    snapper
+    #wireguard
+
+    ./filesystem.nix
+    ./kernel.nix
+    ./networking.nix
+
+    ../../users/rin
+  ];
+
+  # For steam fhs-env
+  nixpkgs.config.permittedInsecurePackages = [
+    "openssl-1.1.1w"
+  ];
+}

hosts/anemone/filesystem.nix

@@ -0,0 +1,36 @@
+{ config, lib, ... }:
+let
+  mkLabelMount = label: type: {
+    device = "/dev/disk/by-label/${label}";
+    fsType = type;
+    options = [ "defaults" "relatime" ];
+  };
+  mkBtrfsMount = name: subvol: atime: mkLabelMount name "btrfs" // {
+    options = [ "autodefrag" "compress=zstd:3" "defaults" "discard=async" "space_cache=v2" "ssd" "subvol=${subvol}" (if atime then "relatime" else "noatime") ];
+  };
+  submount = mkBtrfsMount "Anemone";
+in
+{
+  fileSystems = {
+    "/" = {
+      device = "rootfs";
+      fsType = "tmpfs";
+      options = [ "defaults" "size=8G" "mode=755" ];
+    };
+    "/boot" = mkLabelMount "SYSTEM" "vfat";
+
+    "/mnt/butter" = submount "/" true;
+    "/nix" = submount "/current/snow" false;
+    "/home" = submount "/current/home" true;
+    "/home/.snapshots" = submount "/snapshot/home" false;
+    "/root" = submount "/current/root" false;
+    "/var" = submount "/current/var" false;
+    "/persist" = {
+      depends = [ "/var" ];
+      device = "/var/persist";
+      fsType = "none";
+      options = [ "bind" ];
+      neededForBoot = true;
+    };
+  };
+}

hosts/anemone/kernel.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }: {
+  boot = {
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot.enable = true;
+    };
+    initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+    initrd.kernelModules = [ "amdgpu" ];
+    kernelModules = [ "kvm-amd" ];
+    kernelPackages = lib.mkForce (pkgs.linuxPackagesFor pkgs.me.linux-lava);
+  };
+
+  hardware.cpu.amd.updateMicrocode = true;
+}

hosts/anemone/networking.nix

@@ -0,0 +1,12 @@
+{ config, ... }: {
+  networking = {
+    useDHCP = true;
+    nameservers = [ "1.1.1.1" "8.8.8.8" ];
+    wireless.userControlled.enable = true;
+
+    extraHosts = ''
+      192.168.100.12 strawberry
+      192.168.100.15 caramel
+    '';
+  };
+}

modules/system/kernel.nix

@@ -9,7 +9,6 @@
       "kernel.core_pattern" = "|/bin/false";
       "kernel.sysrq" = 1;
     };
-    loader.grub.useOSProber = true;
   };
   hardware.enableRedistributableFirmware = true;
   zramSwap.enable = true;

packages/linux-lava/sources.nix

@@ -1,7 +1,7 @@
 { fetchFromGitHub, inputs, lib }:
 let
   version = "6.7.0";
-  kernelHash = "1l2nisx9lf2vdgkq910n5ldbi8z25ky1zvl67zgwg2nxcdna09nr";
+  kernelHash = "0s8hbcsg7fdvspqam8kzcxygjsznr4zfi60nqgc81l3n4m518cgg";
   kernelPatchHash = "1qnial7m91l3amcsgms3cs599pi529kvda1c982qk45s39y029xj";
 
   mm = lib.versions.majorMinor version;

secrets.nix

@@ -1,11 +1,12 @@
 let
+  anemone = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPFifSAybe97xDP/cq6AAjy7Fm0go0dtQ9ICK6JRUgc";
   blossom = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5wfPCcpkNR3ubr7cBV0UwVCDo/sMmV0aI/JOJTIxQj";
   caramel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPFJT1XYyjDZFHYT/8RdxAReKkeU8QfpLrmMjEeW/80";
   sugarcane = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIImymDDLSOdLcsox8wxS9Z84fsbsz6Mi58OU0od2p/ZQ";
 
   rin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15";
 in {
-  "secrets/passwd.age".publicKeys = [ blossom caramel sugarcane rin ];
+  "secrets/passwd.age".publicKeys = [ anemone blossom caramel sugarcane rin ];
   "secrets/wpa_conf.age".publicKeys = [ blossom caramel rin ];
 
   "secrets/acme_dns.age".publicKeys = [ caramel rin ];

secrets/acme_dns.age

@@ -1,10 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 U9FXlg dDnXFO4iUwixemx1WPFZSM15/z7xtAGjZxriBbsURRg
-uv6gdP/LDmZMZu/B3IWWYEzfR+H7TJsR3Zo8hYzthQE
--> ssh-ed25519 krYeuQ Yo3FXb2pDijXv2JxYvNP3IF0DADygWjIHEoUlfCw3zc
-vly4m2xyGfuJxBPue0mk9dodc4YAEKYTWLwx9ljVhWs
--> ,-grease
-v4PvG0kmxXhjh7Jf
---- 6yg8u5a9px36osMqiVI4ZPfea+ySjKB8GR/TcCG/ZXU
-q<EFBFBD>T!ř|Eí#மĐrÍňQíĚTQMąÉ‘IX#˛:f|kSiŔs^~Ą^ÖĎ_ŇôK•}§"đI)G–ŽIÝ
-~úŃ‹«*ç4ÎA^w(¸ÇŰ
+-> ssh-ed25519 krYeuQ SBY9moNFVc8mdntk13DRWSIyoJfSuzsBrhzmaH8u51c
+5QU1vtRllrmYsArw6LSktuRLQ7QbrtNBKVrOG8d2pyk
+-> ssh-ed25519 U9FXlg HR/A429gFyLaUq6QSyTYv8yK5syfJbLDFzmhGGTZt1M
+jCXRzzzp8vfB4n8pM6BAZr/IC9E+vBeeOm0AYGYBOe0
+--- /vlh5vuiRyVyiQpn4PZ5zBeUNaQclSW5Y5z1mR43fFg
+á,Sïï<C3AF>=ó;˜9Ð}Ö<0F>J|ý¢µ×5ÌUäjB„†Ã{Öj-ª<>v²ý¿(‘T7lÜÃÇ^–kÉ€Qx…^?å`½­/
‡N£ìÐ|<7C><>ŽaqŒÕxÄâƒI

secrets/warden_admin.age

@@ -1,10 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 U9FXlg YL/xEUVIIOIeP2FRVxZhkCg/yaiX50S74HSMslKzoSw
-SqzuQt4hd6ICDRlq+6Vqy0j/ZuNm3waCg7pUt9EqVD0
--> ssh-ed25519 krYeuQ IsFu0w7BFrTm5rAE6Ysxuievf3NiC60h/KkoUO51FUA
-/BCYR/4qP+1449Kf2MY79sq0ahpjqI5fq7Sme2swU6U
--> V;-grease ^F.M
-lxjBnTXUAhPceJGeXm985SzVP4D2PsxkUEv/kKSx+6LGCHUzYAggYXi8C2ahorkY
-XrYNvorBDG0aezi2GSicmAf4pQkkrLcvZhsmU+/QOKzyAxMw7V0
---- jUlhN0y3o/J/jQlcN0um+lTQ3hZv2Ur0crxSsGeZ28c
-ºDJ?…w䟆9%s5ÕzüÈ­k<C2AD>¢ÒõŒˆA›3U"»V3Î[ŒinÊå<C38A>0÷¹Ù’¿k’”Óø°X„Íøôi°:­LÇÆo¹aDºé'$Oý<4F>54õ&Õ<>Þ²‘ ˆÎ^–UL±
EQP¶Ïû/
+-> ssh-ed25519 krYeuQ V3hCVmXcLm9tDavUNciUCqqCc7+hg6lJir0t4iUoOA4
+CH3+qpJsmjTJ9+lB7hr1nE5W9RteMtpkuJHlCOSrc0c
+-> ssh-ed25519 U9FXlg VT5DxyuigkAL6btdC5Mt4vvCuzOB7xjuf/n/fYOALF0
+Ln3p2c9swsONWzPSkuY/ovv3HG8Sl/3dHpHqRHIckrU
+--- sBS5K5WGRvcgrs9CRXZjvteE5qQrPhM/Trmhc7bU+dg
+†<EFBFBD>tñ ƒ
fÿÕö9âKÚäh3"ÜÌÔ§’Šî¨cLð\E@¿-ÐÈnjb<>+BI;
+ñ(QÄþµ|À0jrÃm®ˆ¼H¡Q.hÌZ#l䘻÷1

ÓÃOI<49>pÊt’ÿ‘Px€ãqóC¸öÉY

secrets/wg_blossom.age

@@ -1,11 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 U9FXlg Y/Q29duiKdP+fV11ellTIMtHFyi9saczXfbcnq7iB0s
-D9P8MAHlFOLR7P8Ux90CjljnhExARGnuSuw24AXOr5c
--> ssh-ed25519 CUCjXQ eGpAJd5fydYBlC7o34CP7091jg4O4NsuLji1/rYtQVg
-9/rgYCpe9wcCrLM7fTYI92oa+3+SAEK6ZgJNmBeOtnM
--> A-grease xTj~+6%4 aF]RZn tj](JCp
-5iDN8bexrr7eNqyFwBNCUefrOqAIS10KppbrdDJH1+fD0TkUifEOjcM2uV/+3tH2
-dYX5eM94zkmwxw
---- QKnJmu6ICTTfadXCKLKii03FXVTBqAFvbAZVHGzGLzE
-äï<GÚÓ4q§<71>#gàâ
ªJ_<17>ÿ^o–ò4G•Vð£æþ5ä§
-ÑÈŠ$½<7F>wŸTú‹œ‹Íl¡•t—‹!…a†wŘí<CB9C>[Å„›
+-> ssh-ed25519 CUCjXQ iM2w01v4y0Q3DVbpGtt6f3HiHMRw7Xr08JgTB6fe8x4
+WiBMVRZr1edBVfLAPAFT4GSEGoyn9jWzO92yysNM9Mo
+-> ssh-ed25519 U9FXlg Bvlaqu4nEbjfBGgBFKDmD1cBbxH2+dyz1BHzegz1AS4
++sf3rC0J2Ik1SNtpr52GxV6G6tzGLiwlvjXFWE3qrSw
+--- yaZjH1jeXqPGiw1lIkH9uz6QJo/nM1lBezbpVlJDNUM
+Õñ´cg¾¹j‡<6A>û"ü
+UÅÑ"¨^¯€ÕàÌ*Þ<07>A«¢Dvl2‰cÿRq).NýLt˜ZjCBŸº5ûâl^É0)Á䥆.¥§Û