nevaforget
205e3eb60f
Adds hosts/desktop: 512G system disk, 1T disk for /home, each in its own LUKS container. modules/disk.nix gains moonarch.disk.home, which moves the /home subvolume to the second disk and drops it from the first. New modules/user.nix declares moonarch.user without a default, so the login name exists once per host instead of once per reference. Both hosts set an initialPassword: swaylock authenticates through pam_unix and cannot unlock a screen for an account without one.
119 lines
4.4 KiB
Nix
119 lines
4.4 KiB
Nix
# ABOUTME: Host configuration for the desktop: 512G system disk, 1T disk for /home.
|
|
# ABOUTME: Disk layout comes from modules/disk.nix, nothing is generated on the machine.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
# Both device paths are placeholders. disko-install overrides them with
|
|
# `--disk main <path>` and `--disk home <path>`, so the real paths are read
|
|
# from lsblk on the machine and never travel into this repository. The values
|
|
# here are deliberately invalid: without the flags the install fails instead
|
|
# of erasing whatever happens to be first in the enumeration.
|
|
moonarch.disk = {
|
|
enable = true;
|
|
device = "/dev/disk/by-id/SET-VIA-disko-install--disk-main";
|
|
home = {
|
|
enable = true;
|
|
device = "/dev/disk/by-id/SET-VIA-disko-install--disk-home";
|
|
};
|
|
};
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.kernelPackages = pkgs.linuxPackages_zen;
|
|
boot.kernelParams = [ "quiet" ];
|
|
|
|
networking.hostName = "desktop";
|
|
networking.networkmanager.enable = true;
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
i18n.defaultLocale = "de_DE.UTF-8";
|
|
i18n.extraLocaleSettings = {
|
|
LC_ADDRESS = "de_DE.UTF-8";
|
|
LC_IDENTIFICATION = "de_DE.UTF-8";
|
|
LC_MEASUREMENT = "de_DE.UTF-8";
|
|
LC_MONETARY = "de_DE.UTF-8";
|
|
LC_NAME = "de_DE.UTF-8";
|
|
LC_NUMERIC = "de_DE.UTF-8";
|
|
LC_PAPER = "de_DE.UTF-8";
|
|
LC_TELEPHONE = "de_DE.UTF-8";
|
|
LC_TIME = "de_DE.UTF-8";
|
|
};
|
|
console.keyMap = "de";
|
|
services.xserver.xkb.layout = "de";
|
|
|
|
moonarch.user = "dkressler";
|
|
|
|
users.users.${config.moonarch.user} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "networkmanager" "wheel" "video" "input" "plugdev" "docker" ];
|
|
shell = pkgs.zsh;
|
|
# Autologin gets past the greeter without a password, but swaylock
|
|
# authenticates through pam_unix and cannot unlock a screen for an account
|
|
# that has none. `mutableUsers` is at its default, so this applies when the
|
|
# account is created and `passwd` overrides it afterwards. Change it after
|
|
# the first boot — this value is in the repository.
|
|
initialPassword = "moonarch";
|
|
};
|
|
|
|
# LUKS already asked for a passphrase at boot, so the greeter would only ask
|
|
# for a second one. initial_session runs once per boot — the greeter comes
|
|
# back on logout, which is also where a session gets switched. greetd's
|
|
# restart option flips itself off when this is set.
|
|
services.greetd.settings.initial_session = {
|
|
command = "${pkgs.niri}/bin/niri-session";
|
|
user = config.moonarch.user;
|
|
};
|
|
|
|
# Snapshots of root and home. snap-pac has no counterpart here: NixOS keeps
|
|
# its own generations, so pre/post package snapshots are redundant. /home is
|
|
# its own btrfs on the second disk, which snapper does not care about — a
|
|
# subvolume is a subvolume.
|
|
services.snapper = {
|
|
configs = {
|
|
root = {
|
|
SUBVOLUME = "/";
|
|
ALLOW_USERS = [ config.moonarch.user ];
|
|
TIMELINE_CREATE = true;
|
|
TIMELINE_CLEANUP = true;
|
|
};
|
|
home = {
|
|
SUBVOLUME = "/home";
|
|
ALLOW_USERS = [ config.moonarch.user ];
|
|
TIMELINE_CREATE = true;
|
|
TIMELINE_CLEANUP = true;
|
|
};
|
|
};
|
|
snapshotInterval = "hourly";
|
|
cleanupInterval = "1d";
|
|
};
|
|
|
|
# No nixos-hardware profile applies to a self-built desktop, so the firmware
|
|
# this machine needs is enabled here instead.
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# The nixos-hardware profile derives this from enableRedistributableFirmware
|
|
# on the ThinkPad; here nothing does, so without this line the CPU runs on the
|
|
# microcode in its BIOS.
|
|
hardware.cpu.amd.updateMicrocode = true;
|
|
|
|
# The GPU is AMD, so amdgpu and Mesa cover it and there is nothing to declare:
|
|
# the kernel module is in the default initrd and Mesa comes with the graphics
|
|
# stack. An NVIDIA card would have needed videoDrivers and hardware.nvidia.
|
|
|
|
services.fstrim.enable = true;
|
|
|
|
# modules/services.nix turns fwupd on for every host. Lenovo publishes to the
|
|
# LVFS, so it earns its place on the ThinkPad; desktop mainboard vendors
|
|
# mostly do not, which leaves a daemon with nothing to update. mkForce because
|
|
# the shared module sets it unconditionally.
|
|
services.fwupd.enable = lib.mkForce false;
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
# The release this machine is first installed with. It stays at this value
|
|
# for the life of the installation and is never raised by an update.
|
|
system.stateVersion = "26.11";
|
|
}
|