Bun/nixos-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Begin the move to the import all, activate by config model

Browse source
This commit is contained in:
Jimbo 2024-11-04 22:41:38 -05:00
parent 7397b614de
commit 07cb2d67a2
97 changed files with 776 additions and 633 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/system/devices/audio/default.nix
View file

@ -1,7 +1,7 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
{
services.pipewire = {
enable = true;
enable = config.system.desktop.enable;
wireplumber = {
enable = true;
configPackages = [

24
modules/system/devices/bluetooth/default.nix
View file

@ -1,17 +1,15 @@
{ ... }:
{ lib, config, ... }:
{
hardware.bluetooth = {
enable = true;
settings = {
General.Experimental = "true";
Policy.AutoEnable = "true";
config = lib.mkIf config.system.desktop.enable {
hardware.bluetooth = {
enable = true;
settings = {
General.Experimental = "true";
Policy.AutoEnable = "true";
};
};
systemd.tmpfiles.rules = [ "f /var/lib/systemd/linger/jimbo" ];
environment.persistence."/persist".directories = [ "/var/lib/bluetooth" ];
};
# Lingering helps keep headphones connected
systemd.tmpfiles.rules = [
"f /var/lib/systemd/linger/jimbo"
];
environment.persistence."/persist".directories = [ "/var/lib/bluetooth" ];
}

8
modules/system/devices/boot/default.nix Normal file
View file

@ -0,0 +1,8 @@
{ ... }:
{
imports = [
./extlinux
./lanzaboote
./systemd
];
}

19
modules/system/devices/boot/extlinux/default.nix
View file

@ -1,7 +1,18 @@
{ ... }:
{ lib, config, ... }:
{
boot.loader = {
generic-extlinux-compatible.enable = true;
grub.enable = false;
options.system.extlinux = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable Lanzaboote and force disable Systemd-boot";
};
};
config = lib.mkIf config.system.extlinux.enable {
boot.loader = {
generic-extlinux-compatible.enable = true;
systemd-boot.enable = lib.mkForce false;
grub.enable = lib.mkForce false;
};
};
}

30
modules/system/devices/boot/lanzaboote/default.nix
View file

@ -1,15 +1,25 @@
{ lanzaboote, pkgs, ... }:
{ lanzaboote, lib, config, pkgs, ... }:
{
imports = [
lanzaboote.nixosModules.lanzaboote
];
imports = [ lanzaboote.nixosModules.lanzaboote ];
boot.lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
options.system.lanzaboote = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable Lanzaboote and force disable Systemd-boot";
};
};
environment.systemPackages = with pkgs; [
sbctl
];
config = lib.mkIf config.system.lanzaboote.enable {
boot = {
loader.systemd-boot.enable = lib.mkForce false;
lanzaboote = {
enable = true;
pkiBundle = "/etc/secureboot";
};
};
environment.systemPackages = with pkgs; [ sbctl ];
};
}

4
modules/system/devices/default.nix
View file

@ -3,8 +3,8 @@
imports = [
./audio
./bluetooth
./filesystems
./impermanence
./boot
./disks
./networking
./printing
./udev

8
modules/system/devices/disks/default.nix Normal file
View file

@ -0,0 +1,8 @@
{ ... }:
{
imports = [
./filesystems
./impermanence
./snapper
];
}

3
modules/system/devices/filesystems/default.nix → modules/system/devices/disks/filesystems/default.nix
View file

@ -1,7 +1,6 @@
{ lib, ... }:
{ ... }:
{
boot.supportedFilesystems = {
ntfs = true;
zfs = lib.mkForce false;
};
}

0
modules/system/devices/impermanence/default.nix → modules/system/devices/disks/impermanence/default.nix
View file

3
modules/system/devices/impermanence/jimbo/default.nix → modules/system/devices/disks/impermanence/jimbo/default.nix
View file

@ -6,9 +6,10 @@
directories = [
"Downloads"
"Documents"
"Games"
"Pictures"
"Videos"
"Games"
".snapshots"
".mozilla"
".thunderbird"

0
modules/system/devices/impermanence/root/default.nix → modules/system/devices/disks/impermanence/root/default.nix
View file

13
modules/system/devices/disks/snapper/default.nix Normal file
View file

@ -0,0 +1,13 @@
{ ... }:
{
imports = [
./root
./jimbo
];
services.snapper = {
snapshotInterval = "0/6:00:00";
cleanupInterval = "12:00:00";
persistentTimer = true;
};
}

12
modules/system/devices/disks/snapper/jimbo/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ ... }:
{
services.snapper.configs.jimbo = {
SUBVOLUME = "/persist/home/jimbo";
TIMELINE_CREATE = true;
TIMELINE_CLEANUP = true;
TIMELINE_LIMIT_DAILY = 1;
TIMELINE_LIMIT_WEEKLY = 1;
TIMELINE_LIMIT_MONTHLY = 0;
TIMELINE_LIMIT_YEARLY = 0;
};
}

12
modules/system/devices/disks/snapper/root/default.nix Normal file
View file

@ -0,0 +1,12 @@
{ ... }:
{
services.snapper.configs.root = {
SUBVOLUME = "/persist";
TIMELINE_CREATE = true;
TIMELINE_CLEANUP = true;
TIMELINE_LIMIT_DAILY = 1;
TIMELINE_LIMIT_WEEKLY = 0;
TIMELINE_LIMIT_MONTHLY = 0;
TIMELINE_LIMIT_YEARLY = 0;
};
}

6
modules/system/devices/networking/default.nix
View file

@ -1,5 +1,11 @@
{ ... }:
{
imports = [
./firewall
./wireguard
./wireless
];
networking = {
wireless.enable = false;
dhcpcd.enable = true;

63
modules/system/devices/networking/firewall/default.nix Normal file
View file

@ -0,0 +1,63 @@
{ lib, config, ... }:
{
options.system.firewall = {
server = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable server firewall settings";
};
};
};
config = {
networking = {
firewall = {
allowPing = false;
extraInputRules = lib.mkIf (!config.system.firewall.server.enable) ''
ip saddr { ${config.ips.server}, ${config.ips.wgSpan}.1 } accept comment "Accept Server"
'' // lib.mkIf config.system.firewall.server.enable ''
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
'';
};
# Nftables configuration only if server is enabled
nftables = lib.mkIf config.system.firewall.server.enable {
tables = {
forwarding = {
family = "ip";
content = ''
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
tcp dport 2222 dnat to ${config.ips.wgSpan}.19:22 comment "SSH to Oracle VM"
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
tcp dport { 58010, 57989, 57984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
udp dport { 57998, 57999, 58000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP"
ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP"
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "${config.ips.netInt}" masquerade
}
'';
};
};
};
};
# Enable IP forwarding for the server configuration
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkIf config.system.firewall.server.enable 1;
};
}

9
modules/system/devices/networking/firewall/pc/default.nix
View file

@ -1,9 +0,0 @@
{ config, ... }:
{
networking.firewall = {
allowPing = false;
extraInputRules = ''
ip saddr { ${config.ips.server}, ${config.ips.wgSpan}.1 } accept comment "Accept Server"
'';
};
}

50
modules/system/devices/networking/firewall/server/default.nix
View file

@ -1,50 +0,0 @@
{ config, ... }:
{
# Allow forwarding
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
# Configure firewall
networking = {
firewall = {
allowPing = false;
extraInputRules = ''
ip saddr { ${config.ips.localSpan}.0/24, ${config.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
ip saddr { ${config.ips.pc}, ${config.secrets.lunaIP}, ${config.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
'';
};
# Enable nftables and forwarding
nftables = {
tables = {
forwarding = {
family = "ip";
content = ''
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
tcp dport 2222 dnat to ${config.ips.wgSpan}.19:22 comment "SSH to Oracle VM"
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
tcp dport { 58010, 57989, 57984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
udp dport { 57998, 57999, 58000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
ip saddr ${config.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR TCP"
ip saddr ${config.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${config.ips.vm} comment "VM ALVR UDP"
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "${config.ips.netInt}" masquerade
}
'';
};
};
};
};
}

63
modules/system/devices/networking/wireguard/default.nix Normal file
View file

@ -0,0 +1,63 @@
{ lib, config, ... }:
{
options.system.wireguard = {
client = {
enable = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Enable WireGuard client";
};
};
server = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable WireGuard server";
};
};
};
config = {
networking = {
firewall.allowedUDPPorts = [ 51820 ];
nat = {
enable = config.system.wireguard.server.enable;
externalInterface = "${config.ips.netInt}";
internalInterfaces = [ "${config.ips.wgInt}" ];
};
wireguard.interfaces = {
"wgc" = lib.mkIf config.system.wireguard.client.enable {
# Define IP of client in per device config
listenPort = 51820;
privateKey = config.secrets.wgClientPriv;
peers = [
{ # NixOS Server
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
allowedIPs = [ "${config.ips.wgSpan}.0/24" ];
endpoint = "sv.${config.domains.jim1}:51820";
persistentKeepalive = 25;
}
];
};
"wgs" = lib.mkIf config.system.wireguard.server.enable {
ips = [ "${config.ips.wgSpan}.1/24" ];
listenPort = 51820;
privateKey = config.secrets.wgServerPriv;
peers = [
{ # NixOS
publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
allowedIPs = [ "${config.ips.wgSpan}.16/28" ];
}
{ # Pixel 9
publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
allowedIPs = [ "${config.ips.wgSpan}.2/32" ];
}
];
};
};
};
};
}

22
modules/system/devices/networking/wireguard/pc/default.nix
View file

@ -1,22 +0,0 @@
{ config, ... }:
{
networking = {
firewall.allowedUDPPorts = [ 51820 ];
wireguard.interfaces = {
"${config.ips.wgInt}" = {
# Define IP of client in per device config
listenPort = 51820;
privateKey = config.secrets.wgClientPriv;
peers = [
{ # NixOS Server
publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
allowedIPs = [ "${config.ips.wgSpan}.0/24" ];
endpoint = "sv.${config.domains.jim1}:51820";
persistentKeepalive = 25;
}
];
};
};
};
}

30
modules/system/devices/networking/wireguard/server/default.nix
View file

@ -1,30 +0,0 @@
{ config, ... }:
{
networking = {
nat = {
enable = true;
externalInterface = "${config.ips.netInt}";
internalInterfaces = [ "${config.ips.wgInt}" ];
};
firewall.allowedUDPPorts = [ 51820 ];
wireguard.interfaces = {
"${config.ips.wgInt}" = {
ips = [ "${config.ips.wgSpan}.1/24" ];
listenPort = 51820;
privateKey = config.secrets.wgServerPriv;
peers = [
{ # NixOS
publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
allowedIPs = [ "${config.ips.wgSpan}.16/28" ];
}
{ # Pixel 9
publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
allowedIPs = [ "${config.ips.wgSpan}.2/32" ];
}
];
};
};
};
}

24
modules/system/devices/networking/wireless/default.nix
View file

@ -1,12 +1,22 @@
{ pkgs, ... }:
{ config, lib, pkgs, ... }:
{
networking = {
wireless.iwd.enable = true;
enableB43Firmware = true;
options.system.wireless = {
enable = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Enable Wifi with iwd";
};
};
environment = {
persistence."/persist".directories = [ "/var/lib/iwd/" ];
systemPackages = with pkgs; [ unstable.impala ];
config = lib.mkIf config.system.wireless.enable {
networking = {
wireless.iwd.enable = true;
enableB43Firmware = true;
};
environment = {
systemPackages = with pkgs; [ unstable.impala ];
persistence."/persist".directories = [ "/var/lib/iwd/" ];
};
};
}

30
modules/system/devices/printing/default.nix
View file

@ -1,19 +1,19 @@
{ pkgs, ... }:
{ config, lib, pkgs, ... }:
{
services = {
printing = {
enable = true;
drivers = with pkgs; [ hplip ];
webInterface = false;
config = lib.mkIf config.system.desktop.enable {
services = {
printing = {
enable = true;
drivers = with pkgs; [ hplip ];
webInterface = false;
};
avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
};
avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
};
environment.systemPackages = with pkgs; [
system-config-printer
];
environment.systemPackages = with pkgs; [ system-config-printer ];
};
}

16
modules/system/devices/udev/oculus/default.nix
View file

@ -1,12 +1,12 @@
{ pkgs, ... }:
{
services.udev = let
oculusRules = pkgs.writeTextFile {
name = "10-oculus.rules";
text = ''KERNEL=="hidraw*", ATTRS{idVendor}=="0e6f", ATTRS{idProduct}=="0184", MODE="0660", TAG+="uaccess"'';
destination = "/etc/udev/rules.d/10-oculus.rules";
};
in {
packages = [ oculusRules ];
services.udev = {
packages = [
(pkgs.writeTextFile {
name = "10-oculus.rules";
text = ''KERNEL=="hidraw*", ATTRS{idVendor}=="0e6f", ATTRS{idProduct}=="0184", MODE="0660", TAG+="uaccess"'';
destination = "/etc/udev/rules.d/10-oculus.rules";
})
];
};
}

16
modules/system/devices/udev/pdp/default.nix
View file

@ -1,12 +1,12 @@
{ pkgs, ... }:
{
services.udev = let
pdpRules = pkgs.writeTextFile {
name = "10-pdp.rules";
text = ''SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0666"'';
destination = "/etc/udev/rules.d/10-pdp.rules";
};
in {
packages = [ pdpRules ];
services.udev = {
packages = [
(pkgs.writeTextFile {
name = "10-pdp.rules";
text = ''SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0666"'';
destination = "/etc/udev/rules.d/10-pdp.rules";
})
];
};
}

6
modules/system/devices/video/default.nix
View file

@ -1,7 +1,9 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
{
imports = [ ./nvidia ];
hardware.opengl = {
enable = true;
enable = config.system.desktop.enable;
driSupport32Bit = true;
extraPackages = with pkgs; [
vulkan-loader

4
modules/system/devices/video/nouveau/default.nix
View file

@ -1,4 +0,0 @@
{ config, lib, ... }:
{
services.xserver.videoDrivers = [ "nouveau" ];
}

39
modules/system/devices/video/nvidia/default.nix
View file

@ -1,10 +1,35 @@
{ pkgs, config, lib, ... }:
{ lib, pkgs, config, ... }:
{
services.xserver.videoDrivers = [ "nvidia" ];
hardware.nvidia = {
modesetting.enable = true;
nvidiaSettings = false;
package = config.boot.kernelPackages.nvidiaPackages.beta;
open = false;
options.system.video = {
nvidia = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable the proprietary Nvidia stack";
};
};
nouveau = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable the open-source Nouveau driver";
};
};
};
config = {
# Conditionally set video drivers based on the options
services.xserver.videoDrivers =
if config.system.video.nvidia.enable then [ "nvidia" ]
else if config.system.video.nouveau.enable then [ "nouveau" ]
else [];
# Configure Nvidia settings if Nvidia is enabled
hardware.nvidia = lib.mkIf config.system.video.nvidia.enable {
modesetting.enable = true;
nvidiaSettings = false;
package = config.boot.kernelPackages.nvidiaPackages.beta;
open = false;
};
};
}