1c308ee8ee
Sample noise: Jun 23 14:45:47 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:45:47 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:45:53 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:45:53 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:45:53 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:45:53 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:46:17 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:46:17 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:46:47 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:46:47 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:47:10 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:47:10 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:47:17 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:47:17 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:48:17 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:48:17 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:48:48 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:48:48 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:49:18 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:49:18 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:49:48 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Jun 23 14:49:48 main rtkit-daemon[1859]: Supervising 9 threads of 6 processes of 1 users. Related: https://bugzilla.redhat.com/show_bug.cgi?id=2040278
262 lines
7.8 KiB
Nix
262 lines
7.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
# Module
|
|
host = config.host;
|
|
|
|
# Resources
|
|
palette = import ./resources/palette.nix;
|
|
in
|
|
{
|
|
imports = [
|
|
<nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
|
|
../packages/kmonad.nix
|
|
];
|
|
|
|
options.host = {
|
|
name = lib.mkOption { type = lib.types.str; };
|
|
local = lib.mkOption { type = lib.types.path; };
|
|
resources = lib.mkOption { type = lib.types.path; };
|
|
};
|
|
|
|
config = {
|
|
# Overrides
|
|
nixpkgs.overlays = [
|
|
# Pending https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/5370
|
|
(_: pkgs: {
|
|
gnome = pkgs.gnome.overrideScope' (_: gnome: {
|
|
gnome-shell = gnome.gnome-shell.overrideAttrs (gnome-shell: {
|
|
patches = gnome-shell.patches ++ [ ../patches/gnome-shell_screenshot-location.patch ];
|
|
});
|
|
});
|
|
})
|
|
];
|
|
|
|
# Nix
|
|
nix.autoOptimiseStore = true;
|
|
nix.gc = { automatic = true; options = "--delete-older-than 7d"; };
|
|
nix.extraOptions = ''
|
|
# Recommended by nix-direnv
|
|
keep-outputs = true
|
|
keep-derivations = true
|
|
'';
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
# Boot
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.systemd-boot.memtest86.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.plymouth.enable = true;
|
|
|
|
# Swap
|
|
zramSwap.enable = true;
|
|
|
|
# Filesystems
|
|
boot.initrd.luks = {
|
|
gpgSupport = true;
|
|
devices.pv = {
|
|
device = "/dev/disk/by-partlabel/pv-enc";
|
|
allowDiscards = true;
|
|
fallbackToPassword = true;
|
|
gpgCard.encryptedPass = ./local/resources/luks-passphrase.gpg;
|
|
gpgCard.publicKey = ./resources/andrew.asc;
|
|
};
|
|
};
|
|
fileSystems."/".options = [ "compress=zstd:2" "discard=async" "noatime" ];
|
|
services.btrfs.autoScrub.enable = true;
|
|
boot.cleanTmpDir = true;
|
|
|
|
# Time and locale
|
|
time.timeZone = "America/Los_Angeles";
|
|
i18n.extraLocaleSettings.LC_TIME = "en_DK.UTF-8";
|
|
|
|
# Networking
|
|
networking.hostName = host.name;
|
|
networking.domain = "home.arpa";
|
|
networking.search = [ "home.arpa" ];
|
|
# Workaround for `avahi-daemon[1234]: Failed to read /etc/avahi/services.`
|
|
# Upstream: https://github.com/lathiat/avahi/blob/v0.8/avahi-daemon/static-services.c#L917-L919
|
|
system.activationScripts.etcAvahiServices = "mkdir -p /etc/avahi/services";
|
|
|
|
# Console
|
|
console.packages = with pkgs; [ terminus_font ];
|
|
console.font = "ter-v32n";
|
|
console.colors = map (lib.removePrefix "#") (with palette; [
|
|
"#000000" red green yellow blue orange purple white
|
|
gray red green yellow blue orange purple white
|
|
]);
|
|
|
|
# Keyboard
|
|
services.xserver.extraLayouts.halmakish = {
|
|
description = "Halmakish";
|
|
languages = [ "eng" ];
|
|
symbolsFile = ./resources/halmakish.xkb;
|
|
};
|
|
services.xserver.layout = "halmakish";
|
|
console.useXkbConfig = true;
|
|
services.kmonad = {
|
|
enable = true;
|
|
keyboards.default = {
|
|
config = builtins.readFile (host.resources + "/halmakish.kbd");
|
|
fallthrough = true;
|
|
allowCommands = false;
|
|
};
|
|
};
|
|
|
|
# Power
|
|
systemd.ctrlAltDelUnit = "poweroff.target";
|
|
|
|
# Authentication
|
|
security.pam.u2f = {
|
|
enable = true;
|
|
appId = "pam://${host.name}";
|
|
control = "sufficient";
|
|
cue = true;
|
|
};
|
|
|
|
# Authorization
|
|
security.sudo.extraRules = [
|
|
{
|
|
groups = [ "wheel" ];
|
|
commands = [
|
|
{ command = "/run/current-system/sw/bin/btrfs balance start --enqueue -dusage=50 -musage=50 /"; options = [ "NOPASSWD" ]; }
|
|
{ command = "/run/current-system/sw/bin/nix-channel --update"; options = [ "NOPASSWD" ]; }
|
|
{ command = "/run/current-system/sw/bin/nixos-rebuild boot"; options = [ "NOPASSWD" ]; }
|
|
{ command = "/run/current-system/sw/bin/nixos-rebuild switch"; options = [ "NOPASSWD" ]; }
|
|
{ command = "/run/current-system/sw/bin/poweroff"; options = [ "NOPASSWD" ]; }
|
|
];
|
|
}
|
|
];
|
|
|
|
# SSH
|
|
services.openssh = { enable = true; passwordAuthentication = false; };
|
|
|
|
# Mail
|
|
services.postfix = {
|
|
enable = true;
|
|
config = {
|
|
relayhost = "[email-smtp.us-west-2.amazonaws.com]:587";
|
|
smtp_use_tls = "yes";
|
|
smtp_tls_security_level = "encrypt";
|
|
smtp_tls_note_starttls_offer = "yes";
|
|
smtp_sasl_auth_enable = "yes";
|
|
smtp_sasl_security_options = "noanonymous";
|
|
smtp_sasl_password_maps = "hash:/var/lib/postfix/conf/smtp_sasl_password_maps";
|
|
};
|
|
origin = "andrew.kvalhe.im";
|
|
destination = [ ]; # Disable local delivery
|
|
mapFiles.smtp_sasl_password_maps = (host.local + "/resources/smtp-sasl-password-maps");
|
|
};
|
|
systemd.services."alert@" = {
|
|
description = "Alert of failed %I";
|
|
serviceConfig.SyslogIdentifier = "%p";
|
|
serviceConfig.Type = "oneshot";
|
|
serviceConfig.ExecStart = ''
|
|
${pkgs.bash}/bin/bash -c "${pkgs.system-sendmail}/bin/sendmail -i root \
|
|
<<< $'Subject: %I failed\n\n'\"$(systemctl --full status %I)\""
|
|
'';
|
|
};
|
|
|
|
# SMART monitoring
|
|
services.smartd = {
|
|
enable = true;
|
|
notifications.mail.enable = true;
|
|
};
|
|
|
|
# Firmware updates
|
|
services.fwupd.enable = true;
|
|
|
|
# Audio
|
|
hardware.pulseaudio.enable = false;
|
|
security.rtkit.enable = true;
|
|
systemd.services.rtkit-daemon.serviceConfig.LogLevelMax = "notice";
|
|
services.pipewire = {
|
|
enable = true;
|
|
alsa = { enable = true; support32Bit = true; };
|
|
pulse.enable = true;
|
|
};
|
|
|
|
# Printer
|
|
services.printing.enable = true;
|
|
services.printing.drivers = with pkgs; [ brgenml1cupswrapper ];
|
|
hardware.printers = {
|
|
ensureDefaultPrinter = "DCP-7065DN";
|
|
ensurePrinters = [{
|
|
name = "DCP-7065DN";
|
|
description = "Brother DCP-7065DN";
|
|
model = "brother-BrGenML1-cups-en.ppd";
|
|
deviceUri = "lpd://lumberjack/binary_p1";
|
|
}];
|
|
};
|
|
|
|
# Scanner
|
|
hardware.sane.enable = true;
|
|
hardware.sane.brscan4 = {
|
|
enable = true;
|
|
netDevices.DCP-7065DN = { model = "DCP-7065DN"; nodename = "lumberjack"; };
|
|
};
|
|
|
|
# Graphical environment
|
|
services.xserver.enable = true;
|
|
services.xserver.displayManager.gdm.enable = true;
|
|
services.xserver.desktopManager.gnome.enable = true;
|
|
|
|
# Applications
|
|
environment.gnome.excludePackages = with pkgs; [
|
|
gnome.epiphany
|
|
gnome.geary
|
|
gnome.gnome-calculator
|
|
gnome.gnome-maps
|
|
gnome.gnome-music
|
|
gnome.gnome-weather
|
|
gnome-photos
|
|
];
|
|
services.pcscd.enable = true;
|
|
programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
|
|
virtualisation = {
|
|
containers.registries.search = [ "docker.io" ];
|
|
docker = { enable = true; enableOnBoot = false; autoPrune.enable = true; };
|
|
podman.enable = true;
|
|
libvirtd.enable = true;
|
|
};
|
|
programs.zsh.enable = true;
|
|
environment.localBinInPath = true;
|
|
|
|
# Users
|
|
users.mutableUsers = false;
|
|
users.groups.ak.gid = 1000;
|
|
users.users.ak = {
|
|
isNormalUser = true;
|
|
uid = 1000;
|
|
group = "ak";
|
|
extraGroups = [
|
|
"wheel"
|
|
"networkmanager"
|
|
"lp"
|
|
"scanner"
|
|
"podman"
|
|
"docker"
|
|
"libvirtd"
|
|
];
|
|
description = "Andrew";
|
|
hashedPassword = builtins.readFile ./local/resources/ak.passwd;
|
|
shell = pkgs.zsh;
|
|
openssh.authorizedKeys.keys = [ (builtins.readFile ./resources/andrew.pub) ];
|
|
};
|
|
|
|
# Backup
|
|
systemd.services.mirror = {
|
|
description = "Mirror to closet";
|
|
serviceConfig.Type = "oneshot";
|
|
serviceConfig.Nice = 10;
|
|
onFailure = [ "alert@%n.service" ];
|
|
path = with pkgs; [ netcat openssh rsync ];
|
|
script = builtins.readFile (host.local + "/resources/mirror.sh");
|
|
};
|
|
systemd.timers.mirror = {
|
|
timerConfig.OnCalendar = "00,12,17:00 America/Los_Angeles";
|
|
timerConfig.Persistent = true;
|
|
wantedBy = [ "timers.target" ];
|
|
};
|
|
};
|
|
}
|