{ config, lib, pkgs, ... }: { imports = [ ]; security = { rtkit.enable = true; doas.enable = true; doas.wheelNeedsPassword = false; sudo.wheelNeedsPassword = false; }; boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; boot.kernelParams = [ "console=tty1" "i915.fastboot=1" ]; # Load the intel iGPU driver boot.initrd.kernelModules = [ "i915" ]; # TODO: broken >=6.6 services.xserver.videoDrivers = [ "intel" /* "displaylink" */]; nixpkgs.allowedUnfree = [ "displaylink" ]; boot.initrd.supportedFilesystems = [ "zfs" ]; boot.supportedFilesystems = [ "zfs" ]; boot.zfs.enableUnstable = true; boot.zfs.forceImportRoot = false; boot.zfs.forceImportAll = false; boot.zfs.allowHibernation = true; # NOTE: disable if using swap on ZFS # GRUB bootloader boot.loader.efi.canTouchEfiVariables = true; boot.loader.grub = { enable = true; efiSupport = true; configurationLimit = 10; device = "nodev"; useOSProber = true; copyKernels = true; gfxmodeEfi = "1920x1200"; fontSize = 32; extraEntries = '' menuentry "Reboot" { reboot } menuentry "Shutdown" { halt } ''; }; # Erase your darlings. boot.initrd.postDeviceCommands = lib.mkAfter '' zfs rollback -r rpool/local/root@blank ''; # Enable microcode updates, etc hardware.enableRedistributableFirmware = true; networking.hostName = "haruka"; networking.hostId = "8425e349"; networking.networkmanager.enable = true; networking.firewall.enable = true; # TODO: https://github.com/NixOS/nixpkgs/issues/180175 systemd.services.NetworkManager-wait-online.serviceConfig.ExecStart = '' ${pkgs.networkmanager}/bin/nm-online -q ''; programs.nm-applet.enable = true; i18n.defaultLocale = "en_US.UTF-8"; # HiDPI console.earlySetup = lib.mkDefault true; console.font = lib.mkForce "${pkgs.terminus_font}/share/consolefonts/ter-v32n.psf.gz"; console.keyMap = "us"; console.colors = [ "151515" "cf6a4c" "99ad6a" "dfa358" "8197bf" "b3a3ff" "8fbfdc" "cbc0ab" "333333" "d98870" "adbd88" "e5b579" "9aaccc" "c2b5ff" "a5cce3" "d5cdbc" ]; time.timeZone = "Asia/Tokyo"; environment.systemPackages = with pkgs; [ gcc git gnumake ]; services.zfs.trim.enable = true; services.zfs.autoScrub.enable = true; services.zfs.autoScrub.pools = [ "rpool" ]; # NOTE: `com.sun:auto-snapshot` property must be set to true on datasets you # wish to snapshot services.zfs.autoSnapshot.enable = true; services.zfs.autoSnapshot.flags = "-k -p --utc"; services.openssh.enable = true; services.openssh.settings.PasswordAuthentication = false; services.openssh.hostKeys = [ { path = "/persist/ssh/ssh_host_ed25519_key"; type = "ed25519"; } { path = "/persist/ssh/ssh_host_rsa_key"; type = "rsa"; bits = 4096; } ]; sops.secrets.borg-haruka-rolling-pass = { }; services.borgbackup.jobs.haruka-rolling = { paths = [ "/persist" "/home" ]; exclude = [ # Ephemeral user files "**/.cache" "**/.nix-profile" # Rust build files "**/target" ]; prune.keep = { within = "1d"; daily = 7; weekly = 4; monthly = 3; }; repo = "20963@hk-s020.rsync.net:rolling/haruka"; encryption.mode = "repokey-blake2"; encryption.passCommand = "cat ${config.sops.secrets.borg-haruka-rolling-pass.path}"; environment.BORG_RSH = "ssh -i /persist/ssh/ssh_host_ed25519_key"; # use borg 1.0+ on rsync.net environment.BORG_REMOTE_PATH = "/usr/local/bin/borg1/borg1"; extraCreateArgs = "--verbose --stats --checkpoint-interval 600"; compression = "auto,zstd"; startAt = "hourly"; persistentTimer = true; }; systemd.services.borgbackup-job-haruka-rolling = { preStart = lib.mkBefore '' # Wait until internet is reachable after resuming echo "Waiting until the remote is reachable..." until /run/current-system/sw/bin/ping rsync.net -c1 -q >/dev/null 2>&1; do :; done echo "Remote is reachable, exiting preStart" ''; }; services.openssh.knownHosts."hk-s020.rsync.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcPl9x9JfRFwsn09NnDw/xBZbAN80ZQck+h6AqlVqPH"; sound.enable = true; services.pipewire = { enable = true; alsa.enable = true; alsa.support32Bit = true; pulse.enable = true; }; hardware.bluetooth.enable = true; hardware.opentabletdriver.enable = true; hardware.devkit.enable = true; hardware.trackpoint = { enable = true; device = "TPPS/2 Elan TrackPoint"; }; # TODO: https://github.com/NixOS/nixpkgs/issues/171136 services.fprintd.enable = false; services.fwupd.enable = true; services.tlp = { enable = true; settings = { START_CHARGE_THRESH_BAT0 = 75; STOP_CHARGE_THRESH_BAT0 = 80; }; }; services.keyd-qol.enable = true; services.printing.enable = true; services.avahi.enable = true; services.avahi.nssmdns4 = true; environment.persistence."/persist".directories = [ "/etc/NetworkManager/system-connections" "/etc/cups" "/var/lib/fprint" "/var/lib/bluetooth" "/var/lib/tailscale" ]; services.pcscd.enable = true; programs.dconf.enable = true; services.gnome.gnome-keyring.enable = true; # TODO: replace this with pass-secret-service? services.tailscale.enable = true; services.tailscale.useRoutingFeatures = "both"; programs.trayscale.enable = true; # User = networkId; # nameToId = netName: "nebula-${netName}"; # sops.secrets.nebula-sefidel-internal-ca = { owner = "nebula-sefidel-internal"; }; # sops.secrets.nebula-sefidel-internal-cert = { owner = "nebula-sefidel-internal"; }; # sops.secrets.nebula-sefidel-internal-key = { owner = "nebula-sefidel-internal"; }; services.nebula.networks = { sefidel-internal = { enable = false; ca = config.sops.secrets.nebula-sefidel-internal-ca.path; cert = config.sops.secrets.nebula-sefidel-internal-cert.path; key = config.sops.secrets.nebula-sefidel-internal-key.path; staticHostMap = { "100.64.0.1" = [ "v-coord1.sefidel.net:4242" ]; }; lighthouses = [ "100.64.0.1" ]; relays = [ "100.64.0.1" ]; firewall.inbound = [ { host = "any"; port = "any"; proto = "any"; } ]; }; }; services.greetd = { enable = true; vt = 2; settings.default_session.command = "${pkgs.greetd.tuigreet}/bin/tuigreet -t -c sway"; }; environment.sessionVariables = { # wlroots displaylink hack # see home/profiles/gui and `overlays/patches/wlroots-displaylink` for more info WLR_EVDI_RENDER_DEVICE="/dev/dri/card0"; }; systemd.extraConfig = "RebootWatchdogSec=5"; fonts = { fontDir.enable = true; packages = with pkgs; [ (nerdfonts.override { fonts = [ "Iosevka" "JetBrainsMono" ]; }) emacs-all-the-icons-fonts jetbrains-mono nanum profont sarasa-gothic siji tamzen twemoji-color-font ]; fontconfig = { enable = true; defaultFonts = { serif = [ "Sarasa Gothic C" "Sarasa Gothic J" "Sarasa Gothic K" ]; sansSerif = [ "Sarasa Gothic C" "Sarasa Gothic J" "Sarasa Gothic K" ]; monospace = [ # FIXME: bitmap fonts doesn't look crisp on fractionally scaled display # "Terminus" # "ProFont" "Iosevka Nerd Font" "JetBrainsMono Nerd Font" ]; emoji = [ "Siji" "Twitter Color Emoji" ]; }; }; }; programs = { sway.enable = true; sway.package = null; # Managed by home-manager sway.extraPackages = lib.mkForce [ ]; zsh.enable = true; zsh.enableCompletion = true; }; hardware.opengl.enable = true; hardware.opengl.driSupport = true; hardware.opengl.driSupport32Bit = true; hardware.opengl.extraPackages = with pkgs; [ vaapiVdpau libvdpau-va-gl ]; xdg.portal = { enable = true; extraPortals = with pkgs; [ xdg-desktop-portal-gtk xdg-desktop-portal-wlr ]; }; sops.defaultSopsFile = ./secrets/secrets.yaml; sops.secrets.root-password.neededForUsers = true; sops.secrets.sefidel-password.neededForUsers = true; users.mutableUsers = false; fileSystems."/persist".neededForBoot = true; users.users = { root.hashedPasswordFile = config.sops.secrets.root-password.path; sefidel = { isNormalUser = true; shell = pkgs.zsh; hashedPasswordFile = config.sops.secrets.sefidel-password.path; extraGroups = [ "wheel" "audio" "networkmanager" "plugdev" ]; }; }; # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It's perfectly fine and recommended to leave # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "23.11"; # Did you read the comment? }