summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.nix15
-rw-r--r--machines/iridium/default.nix15
-rw-r--r--machines/t480/default.nix8
-rw-r--r--machines/xnet/default.nix2
-rw-r--r--machines/xnet/desktop/default.nix108
-rw-r--r--machines/xnet/disk.nix17
-rw-r--r--machines/xnet/nginx.nix1
-rw-r--r--machines/xnet/users.nix26
8 files changed, 142 insertions, 50 deletions
diff --git a/flake.nix b/flake.nix
index ca20bf3..598ba0e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -77,7 +77,20 @@
value = nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs depot; };
- modules = [ ./machines/${name} self.nixosModules.xnet ];
+ modules = [
+ # Machine's specific configuration
+ ./machines/${name}
+
+ # Implicitly import xnet
+ self.nixosModules.xnet
+
+ # Global module
+ ({ inputs, ... }: {
+
+ # Set system nixpkgs to flake input
+ nix.registry.nixpkgs.flake = inputs.nixpkgs;
+ })
+ ];
};
})
machines);
diff --git a/machines/iridium/default.nix b/machines/iridium/default.nix
index 640554b..caf55fa 100644
--- a/machines/iridium/default.nix
+++ b/machines/iridium/default.nix
@@ -1,4 +1,4 @@
-{ inputs, lib, ... }:
+{ lib, ... }:
let
gitKeys = builtins.fetchurl {
url = "https://github.com/kbujari.keys";
@@ -8,26 +8,17 @@ in
{
system.stateVersion = "24.11";
- users.mutableUsers = false;
- users.users.root = {
- initialPassword = "test";
- };
-
xnet = {
disk = {
enable = true;
device = "/dev/nvme0n1";
};
- net = {
- sshd.enable = true;
- };
- users.enable = [ "kle" ];
+ net.sshd.enable = true;
+ nginx.enable = true;
gitServer = {
enable = true;
gitweb.enable = true;
keys = lib.splitString "\n" (builtins.readFile gitKeys);
};
};
-
- nix.registry.nixpkgs.flake = inputs.nixpkgs;
}
diff --git a/machines/t480/default.nix b/machines/t480/default.nix
index cdc0756..ec38d92 100644
--- a/machines/t480/default.nix
+++ b/machines/t480/default.nix
@@ -18,13 +18,13 @@
networkmanager = {
enable = true;
dns = "none";
- wifi = {
- powersave = true;
- backend = "iwd";
- };
+ wifi.powersave = true;
};
};
+ programs.nm-applet.enable = true;
+ services.fwupd.enable = true;
+
systemd.tmpfiles.rules = [
"d /persist/data/NetworkManager 0750 - - -"
"L+ /var/lib/NetworkManager - - - - /persist/data/NetworkManager"
diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 5a6c587..006dd1c 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
let
inherit (lib) mkDefault;
in
diff --git a/machines/xnet/desktop/default.nix b/machines/xnet/desktop/default.nix
index 1e37497..16c6873 100644
--- a/machines/xnet/desktop/default.nix
+++ b/machines/xnet/desktop/default.nix
@@ -2,6 +2,7 @@
let
cfg = config.xnet.desktop;
inherit (lib) mkDefault mkOption mkIf types;
+ inherit (builtins) listToAttrs;
in
{
options.xnet.desktop = {
@@ -28,6 +29,7 @@ in
gtk = true;
base = true;
};
+ xwayland.enable = true;
extraPackages = with pkgs; [
foot
fuzzel
@@ -43,7 +45,6 @@ in
tigervnc
waybar
wl-clipboard
- xwayland
zathura
];
extraSessionCommands = ''
@@ -55,8 +56,6 @@ in
'';
};
- programs.light.enable = mkDefault true;
-
qt = {
enable = true;
style = "adwaita-dark";
@@ -79,9 +78,60 @@ in
];
};
+ programs = {
+ fish.enable = true;
+ light.enable = mkDefault true;
+ direnv = {
+ enable = true;
+ nix-direnv.enable = true;
+ };
+
+ # GTK settings
+ dconf = {
+ enable = true;
+ profiles.user.databases = [{
+ lockAll = true;
+ settings = {
+ "org/gnome/desktop/interface" = {
+ color-scheme = "prefer-dark";
+ gtk-font-name = "System-ui 10";
+ icon-theme = "Pop";
+ theme-name = "Adwaita-dark";
+ };
+ };
+ }];
+ };
+ };
+
+ # Helper for managing dotfiles
+ environment.shellAliases.dots =
+ "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME";
+
+ # Enable yubikey for SSH and more
+ services = {
+ yubikey-agent.enable = true;
+ pcscd.enable = true;
+ udev.packages = with pkgs; [ yubikey-personalization ];
+ };
+
programs.firefox = {
enable = true;
+ preferences = {
+ # Enable hardware transcoding
+ "media.ffmpeg.vaapi.enabled" = true;
+
+ # Enable legacy compact mode
+ "browser.compactmode.show" = true;
+ "browser.uidensity" = 1;
+
+ # Disable ctrl+q closing browser
+ "browser.quitShortcut.disabled" = true;
+
+ # Hardcode theme to dark mode
+ "ui.systemUsesDarkTheme" = 1;
+ };
policies = {
+ DefaultDownloadDirectory = "/tmp/firefox";
DisableTelemetry = true;
DisableFirefoxStudies = true;
EnableTrackingProtection = {
@@ -90,34 +140,40 @@ in
Cryptomining = true;
Fingerprinting = true;
};
- DisablePocket = true;
- DisableFirefoxAccounts = true;
DisableAccounts = true;
+ DisableFirefoxAccounts = true;
DisableFirefoxScreenshots = true;
- OverrideFirstRunPage = "";
- OverridePostUpdatePage = "";
- DontCheckDefaultBrowser = true;
+ DisablePocket = true;
DisplayBookmarksToolbar = "never";
DisplayMenuBar = "default-off";
- SearchBar = "unified";
- ExtensionSettings = {
- "*".installation_mode = "blocked"; # blocks all addons except the ones specified below
- # uBlock Origin:
- "uBlock0@raymondhill.net" = {
- install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
- installation_mode = "force_installed";
- };
- # Bitwarden:
- "{446900e4-71c2-419f-a6a7-df9c091e268b}" = {
- install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi";
- installation_mode = "force_installed";
- };
- # Dark Reader:
- "addon@darkreader.org" = {
- install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi";
- installation_mode = "force_installed";
- };
+ DontCheckDefaultBrowser = true;
+ Homepage = {
+ URL = "about:blank";
+ StartPage = "homepage";
};
+ HttpsOnlyMode = "enabled";
+ DNSOverHTTPS = false;
+ NewTabPage = false;
+ OfferToSaveLogins = false;
+ PasswordManagerEnabled = false;
+ SearchBar = "unified";
+ SearchEngines.Default = "DuckDuckGo";
+ SearchSuggestEnabled = false;
+ ExtensionSettings =
+ let
+ extension = shortId: uuid: {
+ name = uuid;
+ value = {
+ install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
+ installation_mode = "force_installed";
+ };
+ };
+ in
+ listToAttrs [
+ (extension "ublock-origin" "uBlock0@raymondhill.net")
+ (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")
+ (extension "darkreader" "addon@darkreader.org")
+ ];
};
};
};
diff --git a/machines/xnet/disk.nix b/machines/xnet/disk.nix
index caef61d..26b6909 100644
--- a/machines/xnet/disk.nix
+++ b/machines/xnet/disk.nix
@@ -47,7 +47,7 @@ in
boot = {
kernelParams = [ "nohibernate" "elevator=none" ];
supportedFilesystems = [ "vfat" "zfs" ];
- zfs.devNodes = "/dev/disk/by-partuuid";
+ zfs.devNodes = mkDefault "/dev/disk/by-partuuid";
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
@@ -135,5 +135,20 @@ in
};
};
};
+
+ services.sanoid = {
+ enable = true;
+ templates.default = {
+ autosnap = true;
+ autoprune = true;
+ hourly = 24;
+ daily = 14;
+ monthly = 1;
+ };
+ datasets."zroot/persist" = {
+ useTemplate = [ "default" ];
+ recursive = true;
+ };
+ };
};
}
diff --git a/machines/xnet/nginx.nix b/machines/xnet/nginx.nix
index 64c1d65..eadd794 100644
--- a/machines/xnet/nginx.nix
+++ b/machines/xnet/nginx.nix
@@ -5,7 +5,6 @@ let
inherit (lib) mkOption mkIf types;
in
{
-
options.xnet.nginx = {
enable = mkOption {
type = types.bool;
diff --git a/machines/xnet/users.nix b/machines/xnet/users.nix
index 53aa15b..384cb8c 100644
--- a/machines/xnet/users.nix
+++ b/machines/xnet/users.nix
@@ -2,6 +2,11 @@
let
cfg = config.xnet.users;
inherit (lib) mkOption mkIf types;
+
+ gitKeys = builtins.fetchurl {
+ url = "https://github.com/kbujari.keys";
+ sha256 = "0fpa679zkrpx77vangzf3gnidwvmky8ifivn8411xx6albrikaqx";
+ };
in
{
@@ -16,9 +21,15 @@ in
config = {
users = {
mutableUsers = false;
+ users.root = {
+ initialHashedPassword = "$y$j9T$eGwGb5tZwhk/.K0Lezsx4/$dJ4AODPBo0RBkVoCh1MVZTtkkDRn/C6A/XQIKt2YBNA";
+ openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile gitKeys);
+ };
users.kle = mkIf (builtins.elem "kle" cfg.enable) {
- hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
+ initialHashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
isNormalUser = true;
+ shell = pkgs.fish;
+ home = "/persist/usr/kle";
createHome = true;
extraGroups = [ "wheel" "users" "networkmanager" "video" ];
packages = with pkgs; [
@@ -29,14 +40,13 @@ in
lynx
neovim
ranger
+ ripgrep
rsync
sshfs
tree
zip
];
- openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
- ];
+ openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile gitKeys);
};
};
@@ -48,16 +58,24 @@ in
programs.ssh = {
knownHosts = {
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+ "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
+ "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
+ "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
};
extraConfig = ''
Host github
HostName github.com
User git
PreferredAuthentications publickey
+
+ Host ee
+ HostName pascal.ee.ryerson.ca
+ User kbujari
'';
};
programs.git = {
+ enable = true;
config = {
init.defaultBranch = "master";
fetch.prune = true;
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-04 06:55:29 +0000