nevaforget
205e3eb60f
Adds hosts/desktop: 512G system disk, 1T disk for /home, each in its own LUKS container. modules/disk.nix gains moonarch.disk.home, which moves the /home subvolume to the second disk and drops it from the first. New modules/user.nix declares moonarch.user without a default, so the login name exists once per host instead of once per reference. Both hosts set an initialPassword: swaylock authenticates through pam_unix and cannot unlock a screen for an account without one.
68 lines
2.4 KiB
Nix
68 lines
2.4 KiB
Nix
# ABOUTME: Host configuration for the QEMU/KVM test VM.
|
|
# ABOUTME: Launcher script lives outside this repo at ~/VMs/moonix-vm.sh.
|
|
|
|
{ config, pkgs, modulesPath, ... }:
|
|
|
|
{
|
|
# virtio_blk and virtio_pci are not in boot.initrd.availableKernelModules by
|
|
# default — that list covers nvme, ahci and USB, not virtio. Without them the
|
|
# initrd never sees the disk and stops at
|
|
# "timed out waiting for device /dev/disk/by-partlabel/disk-main-root".
|
|
# Real hardware needs no counterpart to this; nvme is covered.
|
|
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
|
|
|
# The launcher attaches the qcow2 as if=virtio, so the guest sees /dev/vda.
|
|
# There is no by-id path for it — the disk only exists inside the VM.
|
|
# Encryption stays on: this is where the LUKS layer gets exercised before it
|
|
# runs on real hardware.
|
|
moonarch.disk = {
|
|
enable = true;
|
|
device = "/dev/vda";
|
|
swapSize = "2G";
|
|
};
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.kernelParams = [ "quiet" ];
|
|
|
|
networking.hostName = "testvm";
|
|
networking.networkmanager.enable = true;
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
i18n.defaultLocale = "de_DE.UTF-8";
|
|
console.keyMap = "de";
|
|
|
|
moonarch.user = "moon";
|
|
|
|
users.users.${config.moonarch.user} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "networkmanager" "wheel" "video" "input" ];
|
|
shell = pkgs.zsh;
|
|
# Throwaway password for a throwaway guest. `mutableUsers` is at its
|
|
# default, so this applies when the account is created and `passwd`
|
|
# overrides it afterwards.
|
|
initialPassword = "moonarch";
|
|
};
|
|
|
|
# LUKS already asked for a passphrase at boot, so the greeter would only ask
|
|
# for a second one. initial_session runs once per boot — the greeter comes
|
|
# back on logout, which is also where a session gets switched. greetd's
|
|
# restart option flips itself off when this is set.
|
|
services.greetd.settings.initial_session = {
|
|
command = "${pkgs.niri}/bin/niri-session";
|
|
user = config.moonarch.user;
|
|
};
|
|
|
|
# Development access from the host via the QEMU port forward on 127.0.0.1:2222.
|
|
services.openssh.enable = true;
|
|
|
|
# QEMU guest agent and clipboard/resolution integration.
|
|
services.qemuGuest.enable = true;
|
|
services.spice-vdagentd.enable = true;
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|