From 0f759811201c8665035bf67bc4c1abd0c8307a3c Mon Sep 17 00:00:00 2001 From: stubdesu Date: Mon, 15 Jan 2024 16:09:39 +0700 Subject: [PATCH] a --- flake.nix | 1 + hosts/anemone/default.nix | 43 ++++++++++++++++++++++++++++++++ hosts/anemone/filesystem.nix | 36 ++++++++++++++++++++++++++ hosts/anemone/kernel.nix | 14 +++++++++++ hosts/anemone/networking.nix | 12 +++++++++ modules/system/kernel.nix | 1 - packages/linux-lava/sources.nix | 2 +- secrets.nix | 3 ++- secrets/acme_dns.age | 15 +++++------ secrets/passwd.age | Bin 675 -> 751 bytes secrets/warden_admin.age | 16 ++++++------ secrets/wg_blossom.age | 17 ++++++------- secrets/wg_caramel.age | Bin 479 -> 367 bytes secrets/wg_sugarcane.age | Bin 461 -> 367 bytes secrets/wpa_conf.age | Bin 567 -> 530 bytes 15 files changed, 129 insertions(+), 31 deletions(-) create mode 100644 hosts/anemone/default.nix create mode 100644 hosts/anemone/filesystem.nix create mode 100644 hosts/anemone/kernel.nix create mode 100644 hosts/anemone/networking.nix diff --git a/flake.nix b/flake.nix index d5ef5c7..e6aa1ef 100644 --- a/flake.nix +++ b/flake.nix @@ -69,6 +69,7 @@ }; in { + nixosConfigurations."anemone" = mkSystem nixpkgs "anemone" "x86_64-linux" true []; nixosConfigurations."blossom" = mkSystem nixpkgs "blossom" "x86_64-linux" true []; nixosConfigurations."hyacinth" = mkSystem nixpkgs "hyacinth" "x86_64-linux" true []; diff --git a/hosts/anemone/default.nix b/hosts/anemone/default.nix new file mode 100644 index 0000000..76118cf --- /dev/null +++ b/hosts/anemone/default.nix @@ -0,0 +1,43 @@ +{ config, inputs, modules, overlays, pkgs, ... }: { + networking.hostName = "anemone"; + system.stateVersion = "23.11"; + time.timeZone = "Asia/Phnom_Penh"; + + nixpkgs.overlays = [ inputs.neovim-nightly.overlay ]; + age.secrets = { + passwd.file = ../../secrets/passwd.age; + #wg_hyacinth.file = ../../secrets/wg_blossom.age; + #wpa_conf.file = ../../secrets/wpa_conf.age; + }; + imports = with modules.system; [ + inputs.home-manager.nixosModule + home-manager + + audio + base + ccache + corectrl + flatpak + greetd + gui + input + kernel + nix + packages + printing + security + snapper + #wireguard + + ./filesystem.nix + ./kernel.nix + ./networking.nix + + ../../users/rin + ]; + + # For steam fhs-env + nixpkgs.config.permittedInsecurePackages = [ + "openssl-1.1.1w" + ]; +} diff --git a/hosts/anemone/filesystem.nix b/hosts/anemone/filesystem.nix new file mode 100644 index 0000000..2ba2d02 --- /dev/null +++ b/hosts/anemone/filesystem.nix @@ -0,0 +1,36 @@ +{ config, lib, ... }: +let + mkLabelMount = label: type: { + device = "/dev/disk/by-label/${label}"; + fsType = type; + options = [ "defaults" "relatime" ]; + }; + mkBtrfsMount = name: subvol: atime: mkLabelMount name "btrfs" // { + options = [ "autodefrag" "compress=zstd:3" "defaults" "discard=async" "space_cache=v2" "ssd" "subvol=${subvol}" (if atime then "relatime" else "noatime") ]; + }; + submount = mkBtrfsMount "Anemone"; +in +{ + fileSystems = { + "/" = { + device = "rootfs"; + fsType = "tmpfs"; + options = [ "defaults" "size=8G" "mode=755" ]; + }; + "/boot" = mkLabelMount "SYSTEM" "vfat"; + + "/mnt/butter" = submount "/" true; + "/nix" = submount "/current/snow" false; + "/home" = submount "/current/home" true; + "/home/.snapshots" = submount "/snapshot/home" false; + "/root" = submount "/current/root" false; + "/var" = submount "/current/var" false; + "/persist" = { + depends = [ "/var" ]; + device = "/var/persist"; + fsType = "none"; + options = [ "bind" ]; + neededForBoot = true; + }; + }; +} diff --git a/hosts/anemone/kernel.nix b/hosts/anemone/kernel.nix new file mode 100644 index 0000000..d782fe3 --- /dev/null +++ b/hosts/anemone/kernel.nix @@ -0,0 +1,14 @@ +{ config, lib, pkgs, ... }: { + boot = { + loader = { + efi.canTouchEfiVariables = true; + systemd-boot.enable = true; + }; + initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ]; + initrd.kernelModules = [ "amdgpu" ]; + kernelModules = [ "kvm-amd" ]; + kernelPackages = lib.mkForce (pkgs.linuxPackagesFor pkgs.me.linux-lava); + }; + + hardware.cpu.amd.updateMicrocode = true; +} diff --git a/hosts/anemone/networking.nix b/hosts/anemone/networking.nix new file mode 100644 index 0000000..d8ca7a7 --- /dev/null +++ b/hosts/anemone/networking.nix @@ -0,0 +1,12 @@ +{ config, ... }: { + networking = { + useDHCP = true; + nameservers = [ "1.1.1.1" "8.8.8.8" ]; + wireless.userControlled.enable = true; + + extraHosts = '' + 192.168.100.12 strawberry + 192.168.100.15 caramel + ''; + }; +} diff --git a/modules/system/kernel.nix b/modules/system/kernel.nix index 181ef90..e4c5b6b 100644 --- a/modules/system/kernel.nix +++ b/modules/system/kernel.nix @@ -9,7 +9,6 @@ "kernel.core_pattern" = "|/bin/false"; "kernel.sysrq" = 1; }; - loader.grub.useOSProber = true; }; hardware.enableRedistributableFirmware = true; zramSwap.enable = true; diff --git a/packages/linux-lava/sources.nix b/packages/linux-lava/sources.nix index f6ea9d4..9f1773b 100644 --- a/packages/linux-lava/sources.nix +++ b/packages/linux-lava/sources.nix @@ -1,7 +1,7 @@ { fetchFromGitHub, inputs, lib }: let version = "6.7.0"; - kernelHash = "1l2nisx9lf2vdgkq910n5ldbi8z25ky1zvl67zgwg2nxcdna09nr"; + kernelHash = "0s8hbcsg7fdvspqam8kzcxygjsznr4zfi60nqgc81l3n4m518cgg"; kernelPatchHash = "1qnial7m91l3amcsgms3cs599pi529kvda1c982qk45s39y029xj"; mm = lib.versions.majorMinor version; diff --git a/secrets.nix b/secrets.nix index a713b13..f83332a 100644 --- a/secrets.nix +++ b/secrets.nix @@ -1,11 +1,12 @@ let + anemone = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEPFifSAybe97xDP/cq6AAjy7Fm0go0dtQ9ICK6JRUgc"; blossom = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5wfPCcpkNR3ubr7cBV0UwVCDo/sMmV0aI/JOJTIxQj"; caramel = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPFJT1XYyjDZFHYT/8RdxAReKkeU8QfpLrmMjEeW/80"; sugarcane = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIImymDDLSOdLcsox8wxS9Z84fsbsz6Mi58OU0od2p/ZQ"; rin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPru5eTBvHJ4ZmrrzPRHCGM09wQP/ZHSaKYalDuBVO15"; in { - "secrets/passwd.age".publicKeys = [ blossom caramel sugarcane rin ]; + "secrets/passwd.age".publicKeys = [ anemone blossom caramel sugarcane rin ]; "secrets/wpa_conf.age".publicKeys = [ blossom caramel rin ]; "secrets/acme_dns.age".publicKeys = [ caramel rin ]; diff --git a/secrets/acme_dns.age b/secrets/acme_dns.age index aae2a16..17f90a8 100644 --- a/secrets/acme_dns.age +++ b/secrets/acme_dns.age @@ -1,10 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 U9FXlg dDnXFO4iUwixemx1WPFZSM15/z7xtAGjZxriBbsURRg -uv6gdP/LDmZMZu/B3IWWYEzfR+H7TJsR3Zo8hYzthQE --> ssh-ed25519 krYeuQ Yo3FXb2pDijXv2JxYvNP3IF0DADygWjIHEoUlfCw3zc -vly4m2xyGfuJxBPue0mk9dodc4YAEKYTWLwx9ljVhWs --> ,-grease -v4PvG0kmxXhjh7Jf ---- 6yg8u5a9px36osMqiVI4ZPfea+ySjKB8GR/TcCG/ZXU -qT!|E#r QT QMɑIX#:f|kSis^~^ _K}"I)GI -~ы*4A^w( \ No newline at end of file +-> ssh-ed25519 krYeuQ SBY9moNFVc8mdntk13DRWSIyoJfSuzsBrhzmaH8u51c +5QU1vtRllrmYsArw6LSktuRLQ7QbrtNBKVrOG8d2pyk +-> ssh-ed25519 U9FXlg HR/A429gFyLaUq6QSyTYv8yK5syfJbLDFzmhGGTZt1M +jCXRzzzp8vfB4n8pM6BAZr/IC9E+vBeeOm0AYGYBOe0 +--- /vlh5vuiRyVyiQpn4PZ5zBeUNaQclSW5Y5z1mR43fFg +,S=;9}J|5UjB{j-v(T7l^kɀQx^?`/N|aqxI \ No newline at end of file diff --git a/secrets/passwd.age b/secrets/passwd.age index 0e7d693b257338eabfa2faf4388d64f7ea60f713..7d2a22449bce6d1b4351487b311a26e2c4412171 100644 GIT binary patch delta 687 zcmZ3?`kr-yYFvIsWpIh3La338c|@^^aiL?Hb5f>nM!1n#d2V2+N0nDzftz+xk-mPu zxnWggUZj%&m$sKrVr5loxSye;wt;I=QAAdSc1d`)mwvfLKuJ(>j=x_~zHgyrYLJWL z{g!h$2YTrAT9^z$9d41zt9oDIUu zgFTHhO`?*s%sjFK^fTRkybJxpwOtC6ja*#0bnO(1i!*dnQ;bYa4J{QsDvZsO%N5cL zlRSdcO#_Yn0!>mYt2`|0wJS|rBGQ7w(!v}~LaNg9DkHHj7SP}OUX|(Fi5iq%TM<3@W?WBOs)#$($&>f(9TJ9HqMRo^@(sZGPm&6_6P|# z^UMq>EXgqm_bD$6GfGa*DT%1aO4Rq|S|UB`hQH2oFQu})bGIYjoHCuAy8NBca<(T~ z7R$nKD4*d}>nzZmlDm3d)$b;j9q(q_T9x!1if7|0ju7qI|3l;PfwzgR3l1neC=0na zz5dJWpF delta 608 zcmaFQx|nr>>g2nO?BSuNPGx>6&Y?j*<;GEo`mSzym6_#U;jY?wK?bG;6OmT zC8=3K>0F`Z;Re}xuCC=NNyUDiE^ZbD&Ynr-iE5LvjkE!V4WEs*;UNQlkvhqk=P>JSTn>uXk}Sb`32IGqDU$ zH*rb{uS}`%&J7F9bBih}uPAU!F^kIZGAy?Ys&qCk=St7aw@md6Newp6&hih}&nn3^ zO3cdjE-Z6OP0rFT%E~EoEcEg8Da{Nw;nKBJC@#*>O-(T}H8r$Ua1M3OiU?FlbA4n;Y!NrK_u};2G>(oKslfZ04Np?`R&BTo6$2U*hO&;pJ#%QEcp(;hPef zlIoJ<;>rXW;2Ub1M`ukK=$L8p_tIq|wM1Q@meCT{kp=VidPh_y; z@mr<0J5Imj_`O=>_k;ZpLl6Bn`abQ}kB9FPTtY9Ff7IFdBCRg?!R$v{YMgGcY+*P0 y{?dBJsbuY|8xxx~ndLTix4Nmk-xk7lXGhV6)n&8dioZEd;VVfwyy<)de*gfv4&@dA diff --git a/secrets/warden_admin.age b/secrets/warden_admin.age index 972ef49..ef48c4d 100644 --- a/secrets/warden_admin.age +++ b/secrets/warden_admin.age @@ -1,10 +1,8 @@ age-encryption.org/v1 --> ssh-ed25519 U9FXlg YL/xEUVIIOIeP2FRVxZhkCg/yaiX50S74HSMslKzoSw -SqzuQt4hd6ICDRlq+6Vqy0j/ZuNm3waCg7pUt9EqVD0 --> ssh-ed25519 krYeuQ IsFu0w7BFrTm5rAE6Ysxuievf3NiC60h/KkoUO51FUA -/BCYR/4qP+1449Kf2MY79sq0ahpjqI5fq7Sme2swU6U --> V;-grease ^F.M -lxjBnTXUAhPceJGeXm985SzVP4D2PsxkUEv/kKSx+6LGCHUzYAggYXi8C2ahorkY -XrYNvorBDG0aezi2GSicmAf4pQkkrLcvZhsmU+/QOKzyAxMw7V0 ---- jUlhN0y3o/J/jQlcN0um+lTQ3hZv2Ur0crxSsGeZ28c -DJ?w9%s5zkA3U"V3[in0kXi:LoaD'$O54&Ս² ^ULEQP/ \ No newline at end of file +-> ssh-ed25519 krYeuQ V3hCVmXcLm9tDavUNciUCqqCc7+hg6lJir0t4iUoOA4 +CH3+qpJsmjTJ9+lB7hr1nE5W9RteMtpkuJHlCOSrc0c +-> ssh-ed25519 U9FXlg VT5DxyuigkAL6btdC5Mt4vvCuzOB7xjuf/n/fYOALF0 +Ln3p2c9swsONWzPSkuY/ovv3HG8Sl/3dHpHqRHIckrU +--- sBS5K5WGRvcgrs9CRXZjvteE5qQrPhM/Trmhc7bU+dg +t f9Kh3"ԧcL\E@-nj b+BI; +(Q|0jrmHQ.hZ#l䘻1 OIptPxqCY \ No newline at end of file diff --git a/secrets/wg_blossom.age b/secrets/wg_blossom.age index 6b5df62..f7f550e 100644 --- a/secrets/wg_blossom.age +++ b/secrets/wg_blossom.age @@ -1,11 +1,8 @@ age-encryption.org/v1 --> ssh-ed25519 U9FXlg Y/Q29duiKdP+fV11ellTIMtHFyi9saczXfbcnq7iB0s -D9P8MAHlFOLR7P8Ux90CjljnhExARGnuSuw24AXOr5c --> ssh-ed25519 CUCjXQ eGpAJd5fydYBlC7o34CP7091jg4O4NsuLji1/rYtQVg -9/rgYCpe9wcCrLM7fTYI92oa+3+SAEK6ZgJNmBeOtnM --> A-grease xTj~+6%4 aF]RZn tj](JCp -5iDN8bexrr7eNqyFwBNCUefrOqAIS10KppbrdDJH1+fD0TkUifEOjcM2uV/+3tH2 -dYX5eM94zkmwxw ---- QKnJmu6ICTTfadXCKLKii03FXVTBqAFvbAZVHGzGLzE - ssh-ed25519 CUCjXQ iM2w01v4y0Q3DVbpGtt6f3HiHMRw7Xr08JgTB6fe8x4 +WiBMVRZr1edBVfLAPAFT4GSEGoyn9jWzO92yysNM9Mo +-> ssh-ed25519 U9FXlg Bvlaqu4nEbjfBGgBFKDmD1cBbxH2+dyz1BHzegz1AS4 ++sf3rC0J2Ik1SNtpr52GxV6G6tzGLiwlvjXFWE3qrSw +--- yaZjH1jeXqPGiw1lIkH9uz6QJo/nM1lBezbpVlJDNUM +cgj" +U"^ *ADvl2cRq).NLtZjCB5l^0)䥆. \ No newline at end of file diff --git a/secrets/wg_caramel.age b/secrets/wg_caramel.age index 2a18202bcd6cea702c270ac871e992141510fdfb..37276ac0c5d7aa79178598407f787d3ba0778cf9 100644 GIT binary patch delta 339 zcmcc5{GMroYJGN5WNK-kLRpTtrDLMLTSj)4VOEG^a&mHocV2K+mO++ZnrnW9X=QFe zMowa(XIOACS6GsHPEfIPuD7p&TUlC?wqK=Ro}Y78p|fLPabAj#Uy7q)UW8kArhkzm zm#&>cadC!jYKoDmsiCDpsHIy(PP&4JWoB8SV^ErTa(zl#rBjMYU|vq4PiBB$L0Yy^ zgnp{GnSr;dzP`43j$t}ieq?&0M_9O*MMbi9TCQ)1Z&^`9aEYNyaadZCpPNCINtm{u zzO!Ljc|;_auCA^^R!OOGMMb!qOSn@>ZmMajuc?u1v2U(_xwlJkv4v}LNnWJ6TR~c2 zvZo2x1Rtrd30;edm$+X4r_B)&*6s1t{p9+Co>7xMsx4;kKep)Z%$cvB%(~s$oo_6X mY-`!IqNl^jD!pXdvbBAG7vykWocQ{ZfY5Q->1AF&?YID5uzhR* delta 452 zcmaFQbf0;GYJI4sTSQK}LSA99hq0%Aj%SfeN>!$7ildojrg@Tqf22{OWv0KWL1ku+ zrMIhTNp5g5msv@PS%!OZq(!BXqhGeKmy3UZfqA8|yQ^Q4p=*k-t9y`RdS$kMcD{!z zm#&>cadC!jYKoDmsiCDpc2Q(%X`n(_T10T6iLskUL48QLNtAxLzhAngPlaKYNm03L zRep$Jh((~YZ=zd9dU`omaEPl}e!g*9T1IZVSwWhAgtvcMXp);(PElD@TCty3h)<cgJ4JJG%xM&$_g%BU0nr>!VH7Ts-P@S*Ssi8mnai`=ipS!?0}MRW9RaS)RF+7 zl+1`qGyg(;uTZYqJdbH^Z*&Y|!!|98xxiCpTlwqt>=j{)8SdQr&3Vo6@b72o&1`&U t)e_1~!qz)ISs(i~EkV)pXyfUIc^OL>EvEbyNtyUw;cw=Xg=szB8v$<abdbImt&fVdqI{_c3`nzc#&_3NmQVrXGyMiacOX&xo@(orE_+&Wv*j(eo1aI zm#&>cadC!jYKoDmsiCDpsHIy(PP&42ab9LgnVC_JbA3grNwII0erB*mZk2_nwyAe$ zd5Mp|K~|+>q+x17kwGz6YCvIVaIUv;fN?;WPrkNiO1QVNd!e>@l2NvAc9K_aL2+e7 zVRE>eW10n*uCA^^zN1B?sb#)?W`4Ozu2D!(qVOl|^QE`x8Nkv{n zm2o835}&?Dmk(%&ySML2$u;})F7x8Y-|cp-cAGWou3voWRGoCS-q_>n6Zh?+=GW#& nPhvk?=wx+sje6VqS5ls*&RX7k@y6&v>rJm4EIU&^)ZPaGjt_uS delta 434 zcmaFQbe4I7YJI4sTSQK}f^R@}a*2MFM^u=TS-4YyQ+ZK_Nq~M@X@)_fXNr4@e~Q0> zZ@FoHj-Q7km$|n`RkD|}XHHUXkcnSFuv3YlUv{CdYp{1(hGAq@s=leQp<7m7M7pH` zm#&>cadC!jYKoDmsiCEUM}@I@a=AjOYhsycWLl)QM}2BWWroF4aJsp#NnVnNzGJXY<`k7UQl$ZU&%l5*qRFw-oj68$7+H^0nsuGVh9Nh@Zl zirSoH1pSCr7eD)iW^L`&TR;mU^<*RDFyHIAd bSB^KX;97rXtH5mDHJ;bJ8BTnelkW}yQze$l diff --git a/secrets/wpa_conf.age b/secrets/wpa_conf.age index 60be4dbaa21a3f34ff8a9cc41e0c90ccf1fa59b0..17e93a9e7aecee8096bb02f3eea576b17cdd583a 100644 GIT binary patch delta 503 zcmdnaGKpn^YQ1x)b5=y4LP}7Oi*J=_ZfUS-WVmxih*yA7erZK`L3p`eQkschZd6`* zQG{nfXs}BcadC!jYKoDmsiCDpc2Q(%X`n)SzE^&tuWPDHe!ZVZdSZHIRhqHBM`m(xYNmHo zd1kP)QHp_Ase77nk!v8Ab7YBjfI(4VR8g6iYf`RXK!968QBJa{L4K-5KyZekQ&p%- zVVHAhPM9aUb)lAS5jp7!W?`j%-fjk|VeXj`X~9YU#zu}g7NNP$c?HS!UI9hv8RlUw z$p)#W;W_2LT;55!$$llN&Z$+7Wk$|<9{H{T7GcSu#--)y29Zww1sTcN`XQBu!MRDH zT)Mit3LYL27EYS zlPYGYJP-_dUVKeEW9E`$1-ZfbF4gb<{o(#(?|%8sjB5&u*^>NZ8~#hrb?D#cX~BJO z-KuEYh(%XlN#0~VbmHm-_Csll_dc_Wi)8AnEuFw?I)9Ji44$9AgVVz7mv3G8bDM=& k(DAtoI*QA#EV}$|!mhIA=NQ_<8(Vz-O4wiK6TEN^04Qj?)c^nh delta 541 zcmbQlvYlmuYJI4sTSQK}LQ+VOvvFWSSzdubW@S!9WSM@rXQ6+he^_XUyOB|@XNgy7 zX0}_lyMJ~*SCM&^i?)e#YKpsYP-tO}S-7!Rs!O<8scadC!jYKoDmsiCDpc2Q(%X`n)hQAI#uUWjp_e|?U-mqlPfQn*2pzIIhoUZ#6d zj<$bdkb!%kVOnyorJ)6vQ;2y%l6#VmpKpFjM0iO+nz6n|a$as)j((X(l#!c9Vrr_P zexhfducraJb$!_6=c^Drdz z+1?o@!6t6STqS8?MFml2Y33y<24+F2f!V?R5F5PBYBQkYX$;XmCqIFD@cwSU*m?>Wq)fJe!`sn-Y`h#!Gtu)f#2ze^} zdXo1=VS!IQ-D=6(2iAa&x! TGS3|Q;I$dT@9p;Lcs>FE7xTeT