nevaforget
205e3eb60f
Adds hosts/desktop: 512G system disk, 1T disk for /home, each in its own LUKS container. modules/disk.nix gains moonarch.disk.home, which moves the /home subvolume to the second disk and drops it from the first. New modules/user.nix declares moonarch.user without a default, so the login name exists once per host instead of once per reference. Both hosts set an initialPassword: swaylock authenticates through pam_unix and cannot unlock a screen for an account without one.
99 lines
3.4 KiB
Nix
99 lines
3.4 KiB
Nix
# ABOUTME: Host configuration for the ThinkPad T14 Gen 3 (AMD).
|
|
# ABOUTME: Disk layout comes from modules/disk.nix, nothing is generated on the machine.
|
|
|
|
{ config, pkgs, ... }:
|
|
|
|
{
|
|
# Partitioning, LUKS and the btrfs subvolumes. The device path is the only
|
|
# machine specific value; the layout is shared with every other host.
|
|
moonarch.disk = {
|
|
enable = true;
|
|
device = "/dev/disk/by-id/nvme-SKHynix_HFS001TEJ9X102N_SDB7N7740101A8708";
|
|
};
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.kernelPackages = pkgs.linuxPackages_zen;
|
|
boot.kernelParams = [ "quiet" ];
|
|
|
|
networking.hostName = "thinkpad";
|
|
networking.networkmanager.enable = true;
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
i18n.defaultLocale = "de_DE.UTF-8";
|
|
i18n.extraLocaleSettings = {
|
|
LC_ADDRESS = "de_DE.UTF-8";
|
|
LC_IDENTIFICATION = "de_DE.UTF-8";
|
|
LC_MEASUREMENT = "de_DE.UTF-8";
|
|
LC_MONETARY = "de_DE.UTF-8";
|
|
LC_NAME = "de_DE.UTF-8";
|
|
LC_NUMERIC = "de_DE.UTF-8";
|
|
LC_PAPER = "de_DE.UTF-8";
|
|
LC_TELEPHONE = "de_DE.UTF-8";
|
|
LC_TIME = "de_DE.UTF-8";
|
|
};
|
|
console.keyMap = "de";
|
|
services.xserver.xkb.layout = "de";
|
|
|
|
moonarch.user = "dkressler";
|
|
|
|
users.users.${config.moonarch.user} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "networkmanager" "wheel" "video" "input" "plugdev" "docker" ];
|
|
shell = pkgs.zsh;
|
|
# Autologin gets past the greeter without a password, but swaylock
|
|
# authenticates through pam_unix and cannot unlock a screen for an account
|
|
# that has none. `mutableUsers` is at its default, so this applies when the
|
|
# account is created and `passwd` overrides it afterwards. Change it after
|
|
# the first boot — this value is in the repository.
|
|
initialPassword = "moonarch";
|
|
};
|
|
|
|
# LUKS already asked for a passphrase at boot, so the greeter would only ask
|
|
# for a second one. initial_session runs once per boot — the greeter comes
|
|
# back on logout, which is also where a session gets switched. greetd's
|
|
# restart option flips itself off when this is set.
|
|
services.greetd.settings.initial_session = {
|
|
command = "${pkgs.niri}/bin/niri-session";
|
|
user = config.moonarch.user;
|
|
};
|
|
|
|
# Snapshots of root and home. snap-pac has no counterpart here: NixOS keeps
|
|
# its own generations, so pre/post package snapshots are redundant.
|
|
services.snapper = {
|
|
configs = {
|
|
root = {
|
|
SUBVOLUME = "/";
|
|
ALLOW_USERS = [ config.moonarch.user ];
|
|
TIMELINE_CREATE = true;
|
|
TIMELINE_CLEANUP = true;
|
|
};
|
|
home = {
|
|
SUBVOLUME = "/home";
|
|
ALLOW_USERS = [ config.moonarch.user ];
|
|
TIMELINE_CREATE = true;
|
|
TIMELINE_CLEANUP = true;
|
|
};
|
|
};
|
|
snapshotInterval = "hourly";
|
|
cleanupInterval = "1d";
|
|
};
|
|
|
|
# The nixos-hardware profile only sets hardware.cpu.amd.updateMicrocode as a
|
|
# default derived from this option, so without it there is neither a microcode
|
|
# update nor the redistributable firmware the WLAN card and amdgpu load.
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# Fingerprint reader. The NixOS module wires pam_fprintd into the PAM stacks
|
|
# it owns; enrol a finger with `fprintd-enroll` after installing.
|
|
services.fprintd.enable = true;
|
|
|
|
services.fstrim.enable = true;
|
|
services.fwupd.enable = true;
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|