desktop is building I guess, idk, need to start commiting stuff eventually lmao
This commit is contained in:
mjallen18
@@ -0,0 +1,7 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./modules/default.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
pkgs' = config.hardware.asahi.pkgs;
|
||||
|
||||
bootM1n1 = pkgs'.m1n1.override {
|
||||
isRelease = true;
|
||||
withTools = false;
|
||||
customLogo = config.boot.m1n1CustomLogo;
|
||||
};
|
||||
|
||||
bootUBoot = pkgs'.uboot-asahi.override {
|
||||
m1n1 = bootM1n1;
|
||||
};
|
||||
|
||||
bootFiles = {
|
||||
"m1n1/boot.bin" = pkgs.runCommand "boot.bin" {} ''
|
||||
cat ${bootM1n1}/build/m1n1.bin > $out
|
||||
cat ${config.boot.kernelPackages.kernel}/dtbs/apple/*.dtb >> $out
|
||||
cat ${bootUBoot}/u-boot-nodtb.bin.gz >> $out
|
||||
if [ -n "${config.boot.m1n1ExtraOptions}" ]; then
|
||||
echo '${config.boot.m1n1ExtraOptions}' >> $out
|
||||
fi
|
||||
'';
|
||||
};
|
||||
in {
|
||||
config = lib.mkIf config.hardware.asahi.enable {
|
||||
# install m1n1 with the boot loader
|
||||
boot.loader.grub.extraFiles = bootFiles;
|
||||
boot.loader.systemd-boot.extraFiles = bootFiles;
|
||||
|
||||
# ensure the installer has m1n1 in the image
|
||||
system.extraDependencies = lib.mkForce [ bootM1n1 bootUBoot ];
|
||||
system.build.m1n1 = bootFiles."m1n1/boot.bin";
|
||||
};
|
||||
|
||||
options.boot = {
|
||||
m1n1ExtraOptions = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = ''
|
||||
Append extra options to the m1n1 boot binary. Might be useful for fixing
|
||||
display problems on Mac minis.
|
||||
https://github.com/AsahiLinux/m1n1/issues/159
|
||||
'';
|
||||
};
|
||||
|
||||
m1n1CustomLogo = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
Custom logo to build into m1n1. The path must point to a 256x256 PNG.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./kernel
|
||||
./mesa
|
||||
./peripheral-firmware
|
||||
./boot-m1n1
|
||||
./sound
|
||||
];
|
||||
|
||||
config = let
|
||||
cfg = config.hardware.asahi;
|
||||
in lib.mkIf cfg.enable {
|
||||
nixpkgs.overlays = lib.mkBefore [ cfg.overlay ];
|
||||
|
||||
# patch systemd-boot to boot in Apple Silicon UEFI environment.
|
||||
# This regression only appeared in systemd 256.7.
|
||||
# see https://github.com/NixOS/nixpkgs/pull/355290
|
||||
# and https://github.com/systemd/systemd/issues/35026
|
||||
systemd.package = let
|
||||
systemdBroken = (pkgs.systemd.version == "256.7");
|
||||
|
||||
systemdPatched = pkgs.systemd.overrideAttrs (old: {
|
||||
patches = let
|
||||
oldPatches = (old.patches or []);
|
||||
# not sure why there are non-paths in there but oh well
|
||||
patchNames = (builtins.map (p: if ((builtins.typeOf p) == "path") then builtins.baseNameOf p else "") oldPatches);
|
||||
fixName = "0019-Revert-boot-Make-initrd_prepare-semantically-equival.patch";
|
||||
alreadyPatched = builtins.elem fixName patchNames;
|
||||
in oldPatches ++ lib.optionals (!alreadyPatched) [
|
||||
(pkgs.fetchpatch {
|
||||
url = "https://raw.githubusercontent.com/NixOS/nixpkgs/125e99477b0ac0a54b7cddc6c5a704821a3074c7/pkgs/os-specific/linux/systemd/${fixName}";
|
||||
hash = "sha256-UW3DZiaykQUUNcGA5UFxN+/wgNSW3ufxDDCZ7emD16o=";
|
||||
})
|
||||
];
|
||||
});
|
||||
in if systemdBroken then systemdPatched else pkgs.systemd;
|
||||
|
||||
hardware.asahi.pkgs =
|
||||
if cfg.pkgsSystem != "aarch64-linux"
|
||||
then
|
||||
import (pkgs.path) {
|
||||
crossSystem.system = "aarch64-linux";
|
||||
localSystem.system = cfg.pkgsSystem;
|
||||
overlays = [ cfg.overlay ];
|
||||
}
|
||||
else pkgs;
|
||||
};
|
||||
|
||||
options.hardware.asahi = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Enable the basic Asahi Linux components, such as kernel and boot setup.
|
||||
'';
|
||||
};
|
||||
|
||||
pkgsSystem = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "aarch64-linux";
|
||||
description = ''
|
||||
System architecture that should be used to build the major Asahi
|
||||
packages, if not the default aarch64-linux. This allows installing from
|
||||
a cross-built ISO without rebuilding them during installation.
|
||||
'';
|
||||
};
|
||||
|
||||
pkgs = lib.mkOption {
|
||||
type = lib.types.raw;
|
||||
description = ''
|
||||
Package set used to build the major Asahi packages. Defaults to the
|
||||
ambient set if not cross-built, otherwise re-imports the ambient set
|
||||
with the system defined by `hardware.asahi.pkgsSystem`.
|
||||
'';
|
||||
};
|
||||
|
||||
overlay = lib.mkOption {
|
||||
type = lib.mkOptionType {
|
||||
name = "nixpkgs-overlay";
|
||||
description = "nixpkgs overlay";
|
||||
check = lib.isFunction;
|
||||
merge = lib.mergeOneOption;
|
||||
};
|
||||
default = import ../packages/overlay.nix;
|
||||
defaultText = "overlay provided with the module";
|
||||
description = ''
|
||||
The nixpkgs overlay for asahi packages.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
# the Asahi Linux kernel and options that must go along with it
|
||||
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config = lib.mkIf config.hardware.asahi.enable {
|
||||
boot.kernelPackages = let
|
||||
pkgs' = config.hardware.asahi.pkgs;
|
||||
in
|
||||
pkgs'.linux-asahi.override {
|
||||
_kernelPatches = config.boot.kernelPatches;
|
||||
withRust = config.hardware.asahi.withRust;
|
||||
};
|
||||
|
||||
# we definitely want to use CONFIG_ENERGY_MODEL, and
|
||||
# schedutil is a prerequisite for using it
|
||||
# source: https://www.kernel.org/doc/html/latest/scheduler/sched-energy.html
|
||||
powerManagement.cpuFreqGovernor = lib.mkOverride 800 "schedutil";
|
||||
|
||||
boot.initrd.includeDefaultModules = false;
|
||||
boot.initrd.availableKernelModules = [
|
||||
# list of initrd modules stolen from
|
||||
# https://github.com/AsahiLinux/asahi-scripts/blob/f461f080a1d2575ae4b82879b5624360db3cff8c/initcpio/install/asahi
|
||||
"apple-mailbox"
|
||||
"nvme_apple"
|
||||
"pinctrl-apple-gpio"
|
||||
"macsmc"
|
||||
"macsmc-rtkit"
|
||||
"i2c-pasemi-platform"
|
||||
"tps6598x"
|
||||
"apple-dart"
|
||||
"dwc3"
|
||||
"dwc3-of-simple"
|
||||
"xhci-pci"
|
||||
"pcie-apple"
|
||||
"gpio_macsmc"
|
||||
"phy-apple-atc"
|
||||
"nvmem_apple_efuses"
|
||||
"spi-apple"
|
||||
"spi-hid-apple"
|
||||
"spi-hid-apple-of"
|
||||
"rtc-macsmc"
|
||||
"simple-mfd-spmi"
|
||||
"spmi-apple-controller"
|
||||
"nvmem_spmi_mfd"
|
||||
"apple-dockchannel"
|
||||
"dockchannel-hid"
|
||||
"apple-rtkit-helper"
|
||||
|
||||
# additional stuff necessary to boot off USB for the installer
|
||||
# and if the initrd (i.e. stage 1) goes wrong
|
||||
"usb-storage"
|
||||
"xhci-plat-hcd"
|
||||
"usbhid"
|
||||
"hid_generic"
|
||||
];
|
||||
|
||||
boot.kernelParams = [
|
||||
"earlycon"
|
||||
"console=tty0"
|
||||
"boot.shell_on_fail"
|
||||
# Apple's SSDs are slow (~dozens of ms) at processing flush requests which
|
||||
# slows down programs that make a lot of fsync calls. This parameter sets
|
||||
# a delay in ms before actually flushing so that such requests can be
|
||||
# coalesced. Be warned that increasing this parameter above zero (default
|
||||
# is 1000) has the potential, though admittedly unlikely, risk of
|
||||
# UNBOUNDED data corruption in case of power loss!!!! Don't even think
|
||||
# about it on desktops!!
|
||||
"nvme_apple.flush_interval=0"
|
||||
];
|
||||
|
||||
# U-Boot does not support EFI variables
|
||||
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
||||
|
||||
# U-Boot does not support switching console mode
|
||||
boot.loader.systemd-boot.consoleMode = "0";
|
||||
|
||||
# GRUB has to be installed as removable if the user chooses to use it
|
||||
boot.loader.grub = lib.mkDefault {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
device = "nodev";
|
||||
};
|
||||
|
||||
# autosuspend was enabled as safe for the PCI SD card reader
|
||||
# "Genesys Logic, Inc GL9755 SD Host Controller [17a0:9755] (rev 01)"
|
||||
# by recent systemd versions, but this has a "negative interaction"
|
||||
# with our kernel/SoC and causes random boot hangs. disable it!
|
||||
services.udev.extraHwdb = ''
|
||||
pci:v000017A0d00009755*
|
||||
ID_AUTOSUSPEND=0
|
||||
'';
|
||||
};
|
||||
|
||||
imports = [
|
||||
(lib.mkRemovedOptionModule [ "hardware" "asahi" "addEdgeKernelConfig" ]
|
||||
"All edge kernel config options are now the default.")
|
||||
];
|
||||
|
||||
options.hardware.asahi.withRust = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Build the Asahi Linux kernel with Rust support.
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
{ options, config, pkgs, lib, ... }:
|
||||
{
|
||||
config = let
|
||||
isMode = mode: (config.hardware.asahi.useExperimentalGPUDriver
|
||||
&& config.hardware.asahi.experimentalGPUInstallMode == mode);
|
||||
in lib.mkIf config.hardware.asahi.enable (lib.mkMerge [
|
||||
{
|
||||
# required for proper DRM setup even without GPU driver
|
||||
services.xserver.config = ''
|
||||
Section "OutputClass"
|
||||
Identifier "appledrm"
|
||||
MatchDriver "apple"
|
||||
Driver "modesetting"
|
||||
Option "PrimaryGPU" "true"
|
||||
EndSection
|
||||
'';
|
||||
}
|
||||
(lib.mkIf config.hardware.asahi.useExperimentalGPUDriver {
|
||||
# install the Asahi Mesa version
|
||||
hardware.graphics.package = config.hardware.asahi.pkgs.mesa-asahi-edge;
|
||||
# required for in-kernel GPU driver
|
||||
hardware.asahi.withRust = true;
|
||||
})
|
||||
]);
|
||||
|
||||
options.hardware.asahi.useExperimentalGPUDriver = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Use the experimental Asahi Mesa GPU driver.
|
||||
|
||||
Do not report issues using this driver under NixOS to the Asahi project.
|
||||
'';
|
||||
};
|
||||
|
||||
# hopefully no longer used, should be deprecated eventually
|
||||
options.hardware.asahi.experimentalGPUInstallMode = lib.mkOption {
|
||||
type = lib.types.enum [ "driver" "replace" "overlay" ];
|
||||
default = "replace";
|
||||
description = ''
|
||||
Mode to use to install the experimental GPU driver into the system.
|
||||
|
||||
driver: install only as a driver, do not replace system Mesa.
|
||||
Causes issues with certain programs like Plasma Wayland.
|
||||
|
||||
replace (default): use replaceRuntimeDependencies to replace system Mesa with Asahi Mesa.
|
||||
Does not work in pure evaluation context (i.e. in flakes by default).
|
||||
|
||||
overlay: overlay system Mesa with Asahi Mesa
|
||||
Requires rebuilding the world.
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
config = lib.mkIf config.hardware.asahi.enable {
|
||||
assertions = lib.mkIf config.hardware.asahi.extractPeripheralFirmware [
|
||||
{ assertion = config.hardware.asahi.peripheralFirmwareDirectory != null;
|
||||
message = ''
|
||||
Asahi peripheral firmware extraction is enabled but the firmware
|
||||
location appears incorrect.
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
hardware.firmware = let
|
||||
pkgs' = config.hardware.asahi.pkgs;
|
||||
in
|
||||
lib.mkIf ((config.hardware.asahi.peripheralFirmwareDirectory != null)
|
||||
&& config.hardware.asahi.extractPeripheralFirmware) [
|
||||
(pkgs.stdenv.mkDerivation {
|
||||
name = "asahi-peripheral-firmware";
|
||||
|
||||
nativeBuildInputs = [ pkgs'.asahi-fwextract pkgs.cpio ];
|
||||
|
||||
buildCommand = ''
|
||||
mkdir extracted
|
||||
asahi-fwextract ${config.hardware.asahi.peripheralFirmwareDirectory} extracted
|
||||
|
||||
mkdir -p $out/lib/firmware
|
||||
cat extracted/firmware.cpio | cpio -id --quiet --no-absolute-filenames
|
||||
mv vendorfw/* $out/lib/firmware
|
||||
'';
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
options.hardware.asahi = {
|
||||
extractPeripheralFirmware = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Automatically extract the non-free non-redistributable peripheral
|
||||
firmware necessary for features like Wi-Fi.
|
||||
'';
|
||||
};
|
||||
|
||||
peripheralFirmwareDirectory = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
|
||||
default = lib.findFirst (path: builtins.pathExists (path + "/all_firmware.tar.gz")) null
|
||||
[
|
||||
# path when the system is operating normally
|
||||
/boot/asahi
|
||||
# path when the system is mounted in the installer
|
||||
/mnt/boot/asahi
|
||||
];
|
||||
|
||||
description = ''
|
||||
Path to the directory containing the non-free non-redistributable
|
||||
peripheral firmware necessary for features like Wi-Fi. Ordinarily, this
|
||||
will automatically point to the appropriate location on the ESP. Flake
|
||||
users and those interested in maximum purity will want to copy those
|
||||
files elsewhere and specify this manually.
|
||||
|
||||
Currently, this consists of the files `all-firmware.tar.gz` and
|
||||
`kernelcache*`. The official Asahi Linux installer places these files
|
||||
in the `asahi` directory of the EFI system partition when creating it.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
{ config, options, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
options.hardware.asahi = {
|
||||
setupAsahiSound = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = config.hardware.asahi.enable;
|
||||
description = ''
|
||||
Set up the Asahi DSP components so that the speakers and headphone jack
|
||||
work properly and safely.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
cfg = config.hardware.asahi;
|
||||
in lib.mkIf (cfg.setupAsahiSound && cfg.enable) (lib.mkMerge [
|
||||
{
|
||||
# can't be used by Asahi sound infrastructure
|
||||
services.pulseaudio.enable = false;
|
||||
# enable pipewire to run real-time and avoid audible glitches
|
||||
security.rtkit.enable = true;
|
||||
# set up pipewire with the supported capabilities (instead of pulseaudio)
|
||||
# and asahi-audio configs and plugins
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
pulse.enable = true;
|
||||
|
||||
configPackages = [ pkgs.asahi-audio ];
|
||||
|
||||
wireplumber = {
|
||||
enable = true;
|
||||
|
||||
configPackages = [ pkgs.asahi-audio ];
|
||||
};
|
||||
};
|
||||
|
||||
# set up enivronment so that UCM configs are used as well
|
||||
environment.variables.ALSA_CONFIG_UCM2 = "${pkgs.alsa-ucm-conf-asahi}/share/alsa/ucm2";
|
||||
systemd.user.services.pipewire.environment.ALSA_CONFIG_UCM2 = config.environment.variables.ALSA_CONFIG_UCM2;
|
||||
systemd.user.services.wireplumber.environment.ALSA_CONFIG_UCM2 = config.environment.variables.ALSA_CONFIG_UCM2;
|
||||
|
||||
# enable speakersafetyd to protect speakers
|
||||
systemd.packages = [ pkgs.speakersafetyd ];
|
||||
services.udev.packages = [ pkgs.speakersafetyd ];
|
||||
}
|
||||
]);
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{ lib
|
||||
, fetchFromGitHub
|
||||
, alsa-ucm-conf
|
||||
}:
|
||||
|
||||
(alsa-ucm-conf.overrideAttrs (oldAttrs: let
|
||||
versionAsahi = "8";
|
||||
|
||||
srcAsahi = fetchFromGitHub {
|
||||
# tracking: https://src.fedoraproject.org/rpms/alsa-ucm-asahi
|
||||
owner = "AsahiLinux";
|
||||
repo = "alsa-ucm-conf-asahi";
|
||||
rev = "v${versionAsahi}";
|
||||
hash = "sha256-FPrAzscc1ICSCQSqULaGLqG4UCq8GZU9XLV7TUSBBRM=";
|
||||
};
|
||||
in {
|
||||
name = "${oldAttrs.pname}-${oldAttrs.version}-asahi-${versionAsahi}";
|
||||
|
||||
postInstall = oldAttrs.postInstall or "" + ''
|
||||
cp -r ${srcAsahi}/ucm2 $out/share/alsa
|
||||
'';
|
||||
}))
|
||||
@@ -0,0 +1,46 @@
|
||||
{ stdenv
|
||||
, lib
|
||||
, fetchFromGitHub
|
||||
, lsp-plugins
|
||||
, bankstown-lv2
|
||||
, triforce-lv2
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "asahi-audio";
|
||||
# tracking: https://src.fedoraproject.org/rpms/asahi-audio
|
||||
version = "3.3";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "AsahiLinux";
|
||||
repo = "asahi-audio";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-p0M1pPxov+wSLT2F4G6y5NZpCXzbjZkzle+75zQ4xxU=";
|
||||
};
|
||||
|
||||
preBuild = ''
|
||||
export PREFIX=$out
|
||||
|
||||
readarray -t configs < <(\
|
||||
find . \
|
||||
-name '*.conf' -or \
|
||||
-name '*.json' -or \
|
||||
-name '*.lua'
|
||||
)
|
||||
|
||||
substituteInPlace "''${configs[@]}" --replace \
|
||||
"/usr/share/asahi-audio" \
|
||||
"$out/asahi-audio"
|
||||
'';
|
||||
|
||||
postInstall = ''
|
||||
# no need to link the asahi-audio dir globally
|
||||
mv $out/share/asahi-audio $out
|
||||
'';
|
||||
|
||||
passthru.requiredLv2Packages = [
|
||||
lsp-plugins
|
||||
bankstown-lv2
|
||||
triforce-lv2
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
{ lib
|
||||
, python3
|
||||
, fetchFromGitHub
|
||||
, gzip
|
||||
, gnutar
|
||||
, lzfse
|
||||
}:
|
||||
|
||||
python3.pkgs.buildPythonApplication rec {
|
||||
pname = "asahi-fwextract";
|
||||
version = "0.7.8";
|
||||
|
||||
# tracking version: https://packages.fedoraproject.org/pkgs/asahi-installer/python3-asahi_firmware/
|
||||
src = fetchFromGitHub {
|
||||
owner = "AsahiLinux";
|
||||
repo = "asahi-installer";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-UmgHWKIRbcg9PK44YPPM4tyuEDC0+ANKO3Mzc4N9RHo=";
|
||||
};
|
||||
|
||||
postPatch = ''
|
||||
substituteInPlace asahi_firmware/img4.py \
|
||||
--replace 'liblzfse.so' '${lzfse}/lib/liblzfse.so'
|
||||
substituteInPlace asahi_firmware/update.py \
|
||||
--replace '"tar"' '"${gnutar}/bin/tar"' \
|
||||
--replace '"xf"' '"-x", "-I", "${gzip}/bin/gzip", "-f"'
|
||||
'';
|
||||
|
||||
nativeBuildInputs = [ python3.pkgs.setuptools ];
|
||||
|
||||
doCheck = false;
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,104 @@
|
||||
{ lib
|
||||
, callPackage
|
||||
, writeText
|
||||
, linuxPackagesFor
|
||||
, withRust ? true
|
||||
, _kernelPatches ? [ ]
|
||||
}:
|
||||
|
||||
let
|
||||
i = builtins.elemAt;
|
||||
|
||||
# parse <OPT> [ymn]|foo style configuration as found in a patch's extraConfig
|
||||
# into a list of k, v tuples
|
||||
parseExtraConfig = config:
|
||||
let
|
||||
lines =
|
||||
builtins.filter (s: s != "") (lib.strings.splitString "\n" config);
|
||||
parseLine = line: let
|
||||
t = lib.strings.splitString " " line;
|
||||
join = l: builtins.foldl' (a: b: "${a} ${b}")
|
||||
(builtins.head l) (builtins.tail l);
|
||||
v = if (builtins.length t) > 2 then join (builtins.tail t) else (i t 1);
|
||||
in [ "CONFIG_${i t 0}" v ];
|
||||
in map parseLine lines;
|
||||
|
||||
# parse <OPT>=lib.kernel.(yes|module|no)|lib.kernel.freeform "foo"
|
||||
# style configuration as found in a patch's extraStructuredConfig into
|
||||
# a list of k, v tuples
|
||||
parseExtraStructuredConfig = config: lib.attrsets.mapAttrsToList
|
||||
(k: v: [ "CONFIG_${k}" (v.tristate or v.freeform) ] ) config;
|
||||
|
||||
parsePatchConfig = { extraConfig ? "", extraStructuredConfig ? {}, ... }:
|
||||
(parseExtraConfig extraConfig) ++
|
||||
(parseExtraStructuredConfig extraStructuredConfig);
|
||||
|
||||
# parse CONFIG_<OPT>=[ymn]|"foo" style configuration as found in a config file
|
||||
# into a list of k, v tuples
|
||||
parseConfig = config:
|
||||
let
|
||||
parseLine = builtins.match ''(CONFIG_[[:upper:][:digit:]_]+)=(([ymn])|"([^"]*)")'';
|
||||
# get either the [ymn] option or the "foo" option; whichever matched
|
||||
t = l: let v = (i l 2); in [ (i l 0) (if v != null then v else (i l 3)) ];
|
||||
lines = lib.strings.splitString "\n" config;
|
||||
in map t (builtins.filter (l: l != null) (map parseLine lines));
|
||||
|
||||
origConfigfile = ./config;
|
||||
|
||||
linux-asahi-pkg = { stdenv, lib, fetchFromGitHub, fetchpatch, linuxKernel,
|
||||
rustc, rust-bindgen, ... } @ args:
|
||||
let
|
||||
origConfigText = builtins.readFile origConfigfile;
|
||||
|
||||
# extraConfig from all patches in order
|
||||
extraConfig =
|
||||
lib.fold (patch: ex: ex ++ (parsePatchConfig patch)) [] _kernelPatches
|
||||
++ (lib.optional withRust [ "CONFIG_RUST" "y" ]);
|
||||
# config file text for above
|
||||
extraConfigText = let
|
||||
text = k: v: if (v == "y") || (v == "m") || (v == "n")
|
||||
then "${k}=${v}" else ''${k}="${v}"'';
|
||||
in (map (t: text (i t 0) (i t 1)) extraConfig);
|
||||
|
||||
# final config as a text file path
|
||||
configfile = if extraConfig == [] then origConfigfile else
|
||||
writeText "config" ''
|
||||
${origConfigText}
|
||||
|
||||
# Patches
|
||||
${lib.strings.concatStringsSep "\n" extraConfigText}
|
||||
'';
|
||||
# final config as an attrset
|
||||
configAttrs = let
|
||||
makePair = t: lib.nameValuePair (i t 0) (i t 1);
|
||||
configList = (parseConfig origConfigText) ++ extraConfig;
|
||||
in builtins.listToAttrs (map makePair (lib.lists.reverseList configList));
|
||||
|
||||
# used to fix issues when nixpkgs gets ahead of the kernel
|
||||
rustAtLeast = version: withRust && (lib.versionAtLeast rustc.version version);
|
||||
bindgenAtLeast = version: withRust && (lib.versionAtLeast rust-bindgen.unwrapped.version version);
|
||||
in
|
||||
linuxKernel.manualConfig rec {
|
||||
inherit stdenv lib;
|
||||
|
||||
version = "6.14.8-asahi";
|
||||
modDirVersion = version;
|
||||
extraMeta.branch = "6.14";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
# tracking: https://github.com/AsahiLinux/linux/tree/asahi-wip (w/ fedora verification)
|
||||
owner = "AsahiLinux";
|
||||
repo = "linux";
|
||||
rev = "asahi-6.14.8-1";
|
||||
hash = "sha256-JrWVw1FiF9LYMiOPm0QI0bg/CrZAMSSVcs4AWNDIH3Q=";
|
||||
};
|
||||
|
||||
kernelPatches = [
|
||||
] ++ _kernelPatches;
|
||||
|
||||
inherit configfile;
|
||||
config = configAttrs;
|
||||
};
|
||||
|
||||
linux-asahi = (callPackage linux-asahi-pkg { });
|
||||
in lib.recurseIntoAttrs (linuxPackagesFor linux-asahi)
|
||||
@@ -0,0 +1,110 @@
|
||||
{ stdenv
|
||||
, buildPackages
|
||||
, lib
|
||||
, fetchFromGitHub
|
||||
, python3
|
||||
, dtc
|
||||
, imagemagick
|
||||
, isRelease ? false
|
||||
, withTools ? true
|
||||
, withChainloading ? false
|
||||
, customLogo ? null
|
||||
}:
|
||||
|
||||
let
|
||||
pyenv = python3.withPackages (p: with p; [
|
||||
construct
|
||||
pyserial
|
||||
]);
|
||||
|
||||
stdenvOpts = {
|
||||
targetPlatform.system = "aarch64-none-elf";
|
||||
targetPlatform.rust.rustcTarget = "${stdenv.hostPlatform.parsed.cpu.name}-unknown-none-softfloat";
|
||||
targetPlatform.rust.rustcTargetSpec = "${stdenv.hostPlatform.parsed.cpu.name}-unknown-none-softfloat";
|
||||
};
|
||||
rust = buildPackages.rust.override {
|
||||
stdenv = lib.recursiveUpdate buildPackages.stdenv stdenvOpts;
|
||||
};
|
||||
rustPackages = rust.packages.stable.overrideScope (f: p: {
|
||||
rustc-unwrapped = p.rustc-unwrapped.override {
|
||||
stdenv = lib.recursiveUpdate p.rustc-unwrapped.stdenv stdenvOpts;
|
||||
};
|
||||
});
|
||||
rustPlatform = buildPackages.makeRustPlatform rustPackages;
|
||||
|
||||
in stdenv.mkDerivation rec {
|
||||
pname = "m1n1";
|
||||
version = "1.4.21";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
# tracking: https://src.fedoraproject.org/rpms/m1n1
|
||||
owner = "AsahiLinux";
|
||||
repo = "m1n1";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-PEjTaSwcsV8PzM9a3rDWMYXGX9FlrM0oeElrP5HYRPg=";
|
||||
fetchSubmodules = true;
|
||||
};
|
||||
cargoVendorDir = ".";
|
||||
|
||||
makeFlags = [ "ARCH=${stdenv.cc.targetPrefix}" ]
|
||||
++ lib.optional isRelease "RELEASE=1"
|
||||
++ lib.optional withChainloading "CHAINLOADING=1";
|
||||
|
||||
nativeBuildInputs = [
|
||||
dtc
|
||||
] ++ lib.optionals withChainloading [rustPackages.rustc rustPackages.cargo rustPlatform.cargoSetupHook]
|
||||
++ lib.optional (customLogo != null) imagemagick;
|
||||
|
||||
postPatch = ''
|
||||
substituteInPlace proxyclient/m1n1/asm.py \
|
||||
--replace 'aarch64-linux-gnu-' 'aarch64-unknown-linux-gnu-' \
|
||||
--replace 'TOOLCHAIN = ""' 'TOOLCHAIN = "'$out'/toolchain-bin/"'
|
||||
'';
|
||||
|
||||
preConfigure = lib.optionalString (customLogo != null) ''
|
||||
pushd data &>/dev/null
|
||||
ln -fs ${customLogo} bootlogo_256.png
|
||||
if [[ "$(magick identify bootlogo_256.png)" != 'bootlogo_256.png PNG 256x256'* ]]; then
|
||||
echo "Custom logo is not a 256x256 PNG"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
rm bootlogo_128.png
|
||||
convert bootlogo_256.png -resize 128x128 bootlogo_128.png
|
||||
patchShebangs --build ./makelogo.sh
|
||||
./makelogo.sh
|
||||
popd &>/dev/null
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/build
|
||||
cp build/m1n1.bin $out/build
|
||||
'' + (lib.optionalString withTools ''
|
||||
mkdir -p $out/{bin,script,toolchain-bin}
|
||||
cp -r proxyclient $out/script
|
||||
cp -r tools $out/script
|
||||
|
||||
for toolpath in $out/script/proxyclient/tools/*.py; do
|
||||
tool=$(basename $toolpath .py)
|
||||
script=$out/bin/m1n1-$tool
|
||||
cat > $script <<EOF
|
||||
#!/bin/sh
|
||||
${pyenv}/bin/python $toolpath "\$@"
|
||||
EOF
|
||||
chmod +x $script
|
||||
done
|
||||
|
||||
GCC=${buildPackages.gcc}
|
||||
BINUTILS=${buildPackages.binutils-unwrapped}
|
||||
|
||||
ln -s $GCC/bin/${stdenv.cc.targetPrefix}gcc $out/toolchain-bin/
|
||||
ln -s $GCC/bin/${stdenv.cc.targetPrefix}ld $out/toolchain-bin/
|
||||
ln -s $BINUTILS/bin/${stdenv.cc.targetPrefix}objcopy $out/toolchain-bin/
|
||||
ln -s $BINUTILS/bin/${stdenv.cc.targetPrefix}objdump $out/toolchain-bin/
|
||||
ln -s $GCC/bin/${stdenv.cc.targetPrefix}nm $out/toolchain-bin/
|
||||
'') + ''
|
||||
runHook postInstall
|
||||
'';
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
{ lib
|
||||
, fetchFromGitLab
|
||||
, mesa
|
||||
}:
|
||||
|
||||
(mesa.override {
|
||||
galliumDrivers = [ "softpipe" "llvmpipe" "asahi" ];
|
||||
vulkanDrivers = [ "swrast" "asahi" ];
|
||||
}).overrideAttrs (oldAttrs: {
|
||||
version = "25.1.0-asahi";
|
||||
src = fetchFromGitLab {
|
||||
# tracking: https://pagure.io/fedora-asahi/mesa/commits/asahi
|
||||
domain = "gitlab.freedesktop.org";
|
||||
owner = "asahi";
|
||||
repo = "mesa";
|
||||
tag = "asahi-20250425";
|
||||
hash = "sha256-3c3uewzKv5wL9BRwaVL4E3FnyA04veQwAPxfHiL7wII=";
|
||||
};
|
||||
|
||||
mesonFlags =
|
||||
let
|
||||
badFlags = [
|
||||
"-Dinstall-mesa-clc"
|
||||
"-Dgallium-nine"
|
||||
"-Dtools"
|
||||
];
|
||||
isBadFlagList = f: builtins.map (b: lib.hasPrefix b f) badFlags;
|
||||
isGoodFlag = f: !(builtins.foldl' (x: y: x || y) false (isBadFlagList f));
|
||||
in
|
||||
(builtins.filter isGoodFlag oldAttrs.mesonFlags) ++ [
|
||||
# we do not build any graphics drivers these features can be enabled for
|
||||
"-Dgallium-va=disabled"
|
||||
"-Dgallium-vdpau=disabled"
|
||||
"-Dgallium-xa=disabled"
|
||||
"-Dtools=asahi"
|
||||
];
|
||||
|
||||
# replace patches with ones tweaked slightly to apply to this version
|
||||
patches = [
|
||||
./opencl.patch
|
||||
];
|
||||
|
||||
postInstall = (oldAttrs.postInstall or "") + ''
|
||||
# we don't build anything to go in this output but it needs to exist
|
||||
touch $spirv2dxil
|
||||
touch $cross_tools
|
||||
'';
|
||||
})
|
||||
@@ -0,0 +1,54 @@
|
||||
diff --git a/meson.build b/meson.build
|
||||
index 07991a6..4c875b9 100644
|
||||
--- a/meson.build
|
||||
+++ b/meson.build
|
||||
@@ -1900,7 +1900,7 @@ endif
|
||||
|
||||
dep_clang = null_dep
|
||||
if with_clc or with_gallium_clover
|
||||
- llvm_libdir = dep_llvm.get_variable(cmake : 'LLVM_LIBRARY_DIR', configtool: 'libdir')
|
||||
+ llvm_libdir = get_option('clang-libdir')
|
||||
|
||||
dep_clang = cpp.find_library('clang-cpp', dirs : llvm_libdir, required : false)
|
||||
|
||||
diff --git a/meson.options b/meson.options
|
||||
index 84e0f20..38ea92c 100644
|
||||
--- a/meson.options
|
||||
+++ b/meson.options
|
||||
@@ -795,3 +795,10 @@ option(
|
||||
value : false,
|
||||
description : 'Install the drivers internal shader compilers (if needed for cross builds).'
|
||||
)
|
||||
+
|
||||
+option(
|
||||
+ 'clang-libdir',
|
||||
+ type : 'string',
|
||||
+ value : '',
|
||||
+ description : 'Locations to search for clang libraries.'
|
||||
+)
|
||||
diff --git a/src/gallium/targets/opencl/meson.build b/src/gallium/targets/opencl/meson.build
|
||||
index ab2c835..a59e88e 100644
|
||||
--- a/src/gallium/targets/opencl/meson.build
|
||||
+++ b/src/gallium/targets/opencl/meson.build
|
||||
@@ -56,7 +56,7 @@ if with_opencl_icd
|
||||
configuration : _config,
|
||||
input : 'mesa.icd.in',
|
||||
output : 'mesa.icd',
|
||||
- install : true,
|
||||
+ install : false,
|
||||
install_tag : 'runtime',
|
||||
install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
|
||||
)
|
||||
diff --git a/src/gallium/targets/rusticl/meson.build b/src/gallium/targets/rusticl/meson.build
|
||||
index 2b214ad..7f91939 100644
|
||||
--- a/src/gallium/targets/rusticl/meson.build
|
||||
+++ b/src/gallium/targets/rusticl/meson.build
|
||||
@@ -64,7 +64,7 @@ configure_file(
|
||||
configuration : _config,
|
||||
input : 'rusticl.icd.in',
|
||||
output : 'rusticl.icd',
|
||||
- install : true,
|
||||
+ install : false,
|
||||
install_tag : 'runtime',
|
||||
install_dir : join_paths(get_option('sysconfdir'), 'OpenCL', 'vendors'),
|
||||
)
|
||||
@@ -0,0 +1,9 @@
|
||||
final: prev: {
|
||||
linux-asahi = final.callPackage ./linux-asahi { };
|
||||
m1n1 = final.callPackage ./m1n1 { };
|
||||
uboot-asahi = final.callPackage ./uboot-asahi { };
|
||||
asahi-fwextract = final.callPackage ./asahi-fwextract { };
|
||||
mesa-asahi-edge = final.callPackage ./mesa-asahi-edge { };
|
||||
alsa-ucm-conf-asahi = final.callPackage ./alsa-ucm-conf-asahi { inherit (prev) alsa-ucm-conf; };
|
||||
asahi-audio = final.callPackage ./asahi-audio { };
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{ lib
|
||||
, fetchFromGitHub
|
||||
, buildUBoot
|
||||
, m1n1
|
||||
}:
|
||||
|
||||
(buildUBoot rec {
|
||||
src = fetchFromGitHub {
|
||||
# tracking: https://pagure.io/fedora-asahi/uboot-tools/commits/main
|
||||
owner = "AsahiLinux";
|
||||
repo = "u-boot";
|
||||
rev = "asahi-v2025.04-1";
|
||||
hash = "sha256-/z37qj26AqsyEBsFT6UEN3GjG6KVsoJOoUB4s9BRDbE=";
|
||||
};
|
||||
version = "2025.04-1-asahi";
|
||||
|
||||
defconfig = "apple_m1_defconfig";
|
||||
extraMeta.platforms = [ "aarch64-linux" ];
|
||||
filesToInstall = [
|
||||
"u-boot-nodtb.bin.gz"
|
||||
"m1n1-u-boot.bin"
|
||||
];
|
||||
extraConfig = ''
|
||||
CONFIG_IDENT_STRING=" ${version}"
|
||||
CONFIG_VIDEO_FONT_4X6=n
|
||||
CONFIG_VIDEO_FONT_8X16=n
|
||||
CONFIG_VIDEO_FONT_SUN12X22=n
|
||||
CONFIG_VIDEO_FONT_16X32=y
|
||||
CONFIG_CMD_BOOTMENU=y
|
||||
'';
|
||||
}).overrideAttrs (o: {
|
||||
# nixos's downstream patches are not applicable
|
||||
patches = [
|
||||
];
|
||||
|
||||
# DTC= flag somehow breaks DTC compilation so we remove it
|
||||
makeFlags = builtins.filter (s: (!(lib.strings.hasPrefix "DTC=" s))) o.makeFlags;
|
||||
|
||||
preInstall = ''
|
||||
# compress so that m1n1 knows U-Boot's size and can find things after it
|
||||
gzip -n u-boot-nodtb.bin
|
||||
cat ${m1n1}/build/m1n1.bin arch/arm/dts/t[68]*.dtb u-boot-nodtb.bin.gz > m1n1-u-boot.bin
|
||||
'';
|
||||
})
|
||||
34
systems/aarch64-linux/mac-nixos/boot.nix
Normal file
34
systems/aarch64-linux/mac-nixos/boot.nix
Normal file
@@ -0,0 +1,34 @@
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot = {
|
||||
loader = {
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = 15;
|
||||
consoleMode = lib.mkDefault "max";
|
||||
};
|
||||
efi.canTouchEfiVariables = lib.mkForce false;
|
||||
};
|
||||
|
||||
kernelParams = [
|
||||
"apple_dcp.show_notch=1"
|
||||
];
|
||||
|
||||
extraModprobeConfig = ''
|
||||
options hid_apple iso_layout=0
|
||||
'';
|
||||
|
||||
binfmt.registrations. "x86_64-linux" = {
|
||||
magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00'';
|
||||
mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
|
||||
openBinary = true;
|
||||
interpreter = "${pkgs.box64}/bin/box64";
|
||||
preserveArgvZero = true;
|
||||
matchCredentials = true;
|
||||
fixBinary = false;
|
||||
};
|
||||
};
|
||||
|
||||
zramSwap.enable = true;
|
||||
}
|
||||
70
systems/aarch64-linux/mac-nixos/configuration.nix
Executable file
70
systems/aarch64-linux/mac-nixos/configuration.nix
Executable file
@@ -0,0 +1,70 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{ pkgs, lib, ... }:
|
||||
let
|
||||
plasma = false;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./hardware-configuration.nix
|
||||
./networking.nix
|
||||
./services.nix
|
||||
];
|
||||
|
||||
hardware.asahi = {
|
||||
enable = true;
|
||||
useExperimentalGPUDriver = true;
|
||||
peripheralFirmwareDirectory = ./firmware;
|
||||
setupAsahiSound = true;
|
||||
};
|
||||
|
||||
hardware.graphics.enable32Bit = lib.mkForce false;
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.allowUnsupportedSystem = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.matt = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"keys"
|
||||
"networkmanager"
|
||||
"ratbagd"
|
||||
"input"
|
||||
"scanner"
|
||||
"lp"
|
||||
"video"
|
||||
"i2c"
|
||||
]; # Enable ‘sudo’ for the user.
|
||||
shell = pkgs.zsh;
|
||||
packages = with pkgs; [
|
||||
firefox
|
||||
tree
|
||||
git
|
||||
box64
|
||||
prismlauncher
|
||||
distrobox
|
||||
];
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
containers.enable = true;
|
||||
podman.enable = true;
|
||||
};
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
micro
|
||||
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
];
|
||||
|
||||
environment.sessionVariables = {
|
||||
DBX_CONTAINER_MANAGER = "podman";
|
||||
};
|
||||
}
|
||||
BIN
systems/aarch64-linux/mac-nixos/firmware/all_firmware.tar.gz
Executable file
BIN
systems/aarch64-linux/mac-nixos/firmware/all_firmware.tar.gz
Executable file
Binary file not shown.
BIN
systems/aarch64-linux/mac-nixos/firmware/kernelcache.release.mac14j
Executable file
BIN
systems/aarch64-linux/mac-nixos/firmware/kernelcache.release.mac14j
Executable file
Binary file not shown.
78
systems/aarch64-linux/mac-nixos/hardware-configuration.nix
Normal file
78
systems/aarch64-linux/mac-nixos/hardware-configuration.nix
Normal file
@@ -0,0 +1,78 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "uas" "sdhci_pci" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "none";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/root" =
|
||||
{ device = "/dev/disk/by-uuid/adcc14fa-8bf7-4b4b-a9e4-b038993b96cc";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "noatime" "subvol=root" ];
|
||||
};
|
||||
|
||||
fileSystems."/etc" =
|
||||
{ device = "/dev/disk/by-uuid/adcc14fa-8bf7-4b4b-a9e4-b038993b96cc";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "noatime" "subvol=etc" ];
|
||||
};
|
||||
|
||||
fileSystems."/tmp" =
|
||||
{ device = "/dev/disk/by-uuid/adcc14fa-8bf7-4b4b-a9e4-b038993b96cc";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "noatime" "subvol=tmp" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/adcc14fa-8bf7-4b4b-a9e4-b038993b96cc";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "noatime" "subvol=nix" ];
|
||||
};
|
||||
|
||||
fileSystems."/var/log" =
|
||||
{ device = "/dev/disk/by-uuid/adcc14fa-8bf7-4b4b-a9e4-b038993b96cc";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "noatime" "subvol=log" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/adcc14fa-8bf7-4b4b-a9e4-b038993b96cc";
|
||||
fsType = "btrfs";
|
||||
options = [ "compress=zstd" "subvol=home" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/23FA-AD3E";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/tmp/swapfile";
|
||||
randomEncryption.enable = true;
|
||||
}
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
28
systems/aarch64-linux/mac-nixos/home.nix
Executable file
28
systems/aarch64-linux/mac-nixos/home.nix
Executable file
@@ -0,0 +1,28 @@
|
||||
{ pkgs, ... }:
|
||||
let
|
||||
shellAliases = {
|
||||
update-boot = "sudo nixos-rebuild boot --max-jobs 10 --build-host admin@10.0.1.3";
|
||||
update-switch = "sudo nixos-rebuild switch --max-jobs 10 --build-host admin@10.0.1.3";
|
||||
update-flake = "nix flake update mac-nixpkgs mac-nixos-apple-silicon mac-home-manager mac-impermanence mac-sops-nix --flake /etc/nixos";
|
||||
update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@10.0.1.3 --build-host admin@10.0.1.3 --flake ~/nix-config#jallen-nas";
|
||||
};
|
||||
in
|
||||
{
|
||||
|
||||
home.username = "matt";
|
||||
home.homeDirectory = "/home/matt";
|
||||
home.stateVersion = "23.11";
|
||||
|
||||
home.packages = with pkgs; [
|
||||
iw
|
||||
iwd
|
||||
orca-slicer
|
||||
vscodium
|
||||
];
|
||||
|
||||
programs = {
|
||||
password-store.enable = true;
|
||||
|
||||
zsh.shellAliases = shellAliases;
|
||||
};
|
||||
}
|
||||
82
systems/aarch64-linux/mac-nixos/hyprland-settings.nix
Normal file
82
systems/aarch64-linux/mac-nixos/hyprland-settings.nix
Normal file
@@ -0,0 +1,82 @@
|
||||
let
|
||||
theme = import ../../modules/desktop-environments/hyprland/theme.nix;
|
||||
|
||||
# Displays
|
||||
display = {
|
||||
input = "eDP-1";
|
||||
resolution = "3456x2234";
|
||||
refreshRate = "60.00000";
|
||||
};
|
||||
in
|
||||
{
|
||||
primaryDisplay = display;
|
||||
networkInterface = "wlan0";
|
||||
|
||||
wallpaper = [
|
||||
"${display.input}, /run/wallpaper.jpg"
|
||||
];
|
||||
|
||||
monitor = [
|
||||
"${display.input},${display.resolution}@${display.refreshRate},0x0,1.25,bitdepth,10,cm,hdr,sdrbrightness,1.2,sdrsaturation,0.98"
|
||||
];
|
||||
|
||||
# monitorv2 = {
|
||||
# output = "eDP-1";
|
||||
# mode = "3456x2234@60.00000";
|
||||
# position = "0x0";
|
||||
# scale = "1.25";
|
||||
# #bitdepth,10,cm,hdr,sdrbrightness,1.2,sdrsaturation,0.98"
|
||||
# };
|
||||
|
||||
workspace = [
|
||||
"name:firefox, monitor:${display.input}, default:false, special, class:(.*firefox.*)"
|
||||
"name:discord, monitor:${display.input}, default:true, special, title:(.*vesktop.*), title:(.*Apple Music.*)"
|
||||
"name:steam, monitor:${display.input}, default:false, special, class:(.*[Ss]team.*)"
|
||||
];
|
||||
|
||||
windowRule = [
|
||||
# "tag +fakefull, fullscreen: 0"
|
||||
# "float, tag:fakefull"
|
||||
# "size 3356 2160, tag:fakefull"
|
||||
# "move 100 74, tag:fakefull"
|
||||
# "noanim, tag:fakefull"
|
||||
# "noblur, tag:fakefull"
|
||||
# "norounding, tag:fakefull"
|
||||
# "noshadow, tag:fakefull"
|
||||
# "immediate, tag:fakefull"
|
||||
# "noborder, tag:fakefull"
|
||||
# "nodim, tag:fakefull"
|
||||
# "idleinhibit, tag:fakefull"
|
||||
"size 2160 3356, tag:horizonrdp"
|
||||
];
|
||||
|
||||
waybar = {
|
||||
layer = "top";
|
||||
|
||||
modules-right = [
|
||||
"tray"
|
||||
"temperature"
|
||||
"temperature#gpu"
|
||||
"keyboard-state#capslock"
|
||||
"keyboard-state#numlock"
|
||||
"wireplumber#sink"
|
||||
# "wireplumber#source"
|
||||
"bluetooth"
|
||||
"network"
|
||||
"idle_inhibitor"
|
||||
"clock"
|
||||
"battery"
|
||||
"custom/weather"
|
||||
];
|
||||
|
||||
moduleStyle = {
|
||||
window = {
|
||||
margin-right = "75rem";
|
||||
};
|
||||
temperature = {
|
||||
location = "${theme.waybar.borderLeft}";
|
||||
border-radius = "1";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
44
systems/aarch64-linux/mac-nixos/networking.nix
Normal file
44
systems/aarch64-linux/mac-nixos/networking.nix
Normal file
@@ -0,0 +1,44 @@
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
# Networking configs
|
||||
networking = {
|
||||
hostName = "macbook-pro-nixos";
|
||||
|
||||
wireless.iwd = {
|
||||
enable = true;
|
||||
settings = {
|
||||
General = {
|
||||
EnableNetworkConfiguration = true;
|
||||
};
|
||||
Rank = {
|
||||
BandModifier2_4GHz = 1.0;
|
||||
BandModifier5GHz = 5.0;
|
||||
BandModifier6GHz = 10.0;
|
||||
};
|
||||
# DriverQuirks = {
|
||||
# PowerSaveDisable = "hci_bcm4377,brcmfmac";
|
||||
# };
|
||||
Network = {
|
||||
AutoConnect = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Enable Network Manager
|
||||
networkmanager = {
|
||||
enable = lib.mkForce false;
|
||||
wifi = {
|
||||
backend = lib.mkForce "iwd";
|
||||
powersave = lib.mkDefault false;
|
||||
};
|
||||
settings.connectivity.uri = lib.mkDefault "http://nmcheck.gnome.org/check_network_status.txt";
|
||||
};
|
||||
|
||||
# orca
|
||||
firewall.extraCommands = ''
|
||||
iptables -I INPUT -m pkttype --pkt-type multicast -j ACCEPT
|
||||
iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
|
||||
iptables -I INPUT -p udp -m udp --match multiport --dports 1990,2021 -j ACCEPT
|
||||
'';
|
||||
};
|
||||
}
|
||||
123
systems/aarch64-linux/mac-nixos/omnissa.nix
Normal file
123
systems/aarch64-linux/mac-nixos/omnissa.nix
Normal file
@@ -0,0 +1,123 @@
|
||||
{ stdenv
|
||||
, lib
|
||||
, buildFHSEnv
|
||||
, fetchurl
|
||||
, makeWrapper
|
||||
, gsettings-desktop-schemas
|
||||
, opensc
|
||||
, writeTextDir
|
||||
, configText ? ""
|
||||
}:
|
||||
|
||||
let
|
||||
version = "2503-8.15.0";
|
||||
sysArch = "armhf";
|
||||
mainProgram = "horizon-client";
|
||||
|
||||
wrapBinCommands = path: name: ''
|
||||
makeWrapper "$out/${path}/${name}" "$out/bin/${name}_wrapper" \
|
||||
--set GTK_THEME Adwaita \
|
||||
--suffix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}" \
|
||||
--suffix LD_LIBRARY_PATH : "$out/lib/omnissa/horizon:$out/lib/omnissa/horizon/vdpService:$out/lib/omnissa"
|
||||
'';
|
||||
|
||||
omnissaHorizonClientFiles = stdenv.mkDerivation {
|
||||
pname = "omnissa-horizon-armhf-files";
|
||||
inherit version;
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://download3.omnissa.com/software/CART26FQ1_LIN_2503_TARBALL/Omnissa-Horizon-Client-Linux-2503-8.15.0-14256322247.tar.gz";
|
||||
sha256 = "sha256-x98ITXF9xwzlPq375anQ2qBpMbZAcCqDVXBfvZPha7Q=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ makeWrapper ];
|
||||
|
||||
installPhase = ''
|
||||
mkdir ext
|
||||
tar -xzf $src
|
||||
cd Omnissa-Horizon-Client-Linux-*/${sysArch}
|
||||
|
||||
mkdir -p ext
|
||||
for archive in *.tar.gz; do
|
||||
tar -C ext --strip-components=1 -xf "$archive"
|
||||
done
|
||||
|
||||
chmod -R u+w ext/usr/lib
|
||||
|
||||
mkdir -p $out
|
||||
mv ext/usr $out
|
||||
mv ext/${sysArch}/lib $out/
|
||||
mv ext/${sysArch}/include $out/
|
||||
|
||||
mkdir -p $out/lib/omnissa/horizon/pkcs11
|
||||
ln -s ${opensc}/lib/pkcs11/opensc-pkcs11.so $out/lib/omnissa/horizon/pkcs11/libopenscpkcs11.so
|
||||
|
||||
chmod +x "$out/usr/bin/horizon-client"
|
||||
${wrapBinCommands "usr/bin" "horizon-client"}
|
||||
'';
|
||||
};
|
||||
|
||||
omnissaFHSUserEnv =
|
||||
pname:
|
||||
buildFHSEnv {
|
||||
inherit pname version;
|
||||
|
||||
runScript = "${omnissaHorizonClientFiles}/bin/${pname}_wrapper";
|
||||
|
||||
targetPkgs = pkgs: with pkgs; [
|
||||
atk
|
||||
cairo
|
||||
dbus
|
||||
file
|
||||
fontconfig
|
||||
freetype
|
||||
gdk-pixbuf
|
||||
glib
|
||||
gtk3
|
||||
libjpeg
|
||||
libpng
|
||||
libpulseaudio
|
||||
libtiff
|
||||
libuuid
|
||||
libv4l
|
||||
libxml2
|
||||
pango
|
||||
pcsclite
|
||||
pixman
|
||||
udev
|
||||
omnissaHorizonClientFiles
|
||||
xorg.libX11
|
||||
xorg.libXau
|
||||
xorg.libXcursor
|
||||
xorg.libXext
|
||||
xorg.libXi
|
||||
xorg.libXrandr
|
||||
xorg.libXrender
|
||||
xorg.libXtst
|
||||
zlib
|
||||
|
||||
(writeTextDir "etc/omnissa/config" configText)
|
||||
];
|
||||
};
|
||||
in
|
||||
stdenv.mkDerivation {
|
||||
pname = "omnissa-horizon-client";
|
||||
inherit version;
|
||||
|
||||
dontUnpack = true;
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/bin
|
||||
ln -s ${omnissaFHSUserEnv "horizon-client"}/bin/horizon-client $out/bin/
|
||||
ln -s ${omnissaFHSUserEnv "horizon-eucusbarbitrator"}/bin/horizon-eucusbarbitrator $out/bin/
|
||||
'';
|
||||
|
||||
passthru.unwrapped = omnissaHorizonClientFiles;
|
||||
|
||||
meta = {
|
||||
description = "Omnissa Horizon Client for ARM";
|
||||
homepage = "https://www.omnissa.com/products/horizon-8/";
|
||||
license = lib.licenses.unfree;
|
||||
platforms = [ "aarch64-linux" "armv7l-linux" ];
|
||||
};
|
||||
}
|
||||
130
systems/aarch64-linux/mac-nixos/services.nix
Normal file
130
systems/aarch64-linux/mac-nixos/services.nix
Normal file
@@ -0,0 +1,130 @@
|
||||
{ lib, ... }:
|
||||
{
|
||||
services = {
|
||||
auto-cpufreq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# settings for when connected to a power source
|
||||
charger = {
|
||||
# see available governors by running: cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors
|
||||
# preferred governor
|
||||
governor = "performance";
|
||||
|
||||
# minimum cpu frequency (in kHz)
|
||||
# example: for 800 MHz = 800000 kHz --> scaling_min_freq = 800000
|
||||
# see conversion info: https://www.rapidtables.com/convert/frequency/mhz-to-hz.html
|
||||
# to use this feature, uncomment the following line and set the value accordingly
|
||||
# scaling_min_freq = 800000
|
||||
|
||||
# maximum cpu frequency (in kHz)
|
||||
# example: for 1GHz = 1000 MHz = 1000000 kHz -> scaling_max_freq = 1000000
|
||||
# see conversion info: https://www.rapidtables.com/convert/frequency/mhz-to-hz.html
|
||||
# to use this feature, uncomment the following line and set the value accordingly
|
||||
# scaling_max_freq = 1000000
|
||||
|
||||
# turbo boost setting. possible values: always, auto, never
|
||||
turbo = "auto";
|
||||
};
|
||||
# settings for when using battery power
|
||||
battery = {
|
||||
# see available governors by running: cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_governors
|
||||
# preferred governor
|
||||
governor = "schedutil";
|
||||
|
||||
# minimum cpu frequency (in kHz)
|
||||
# example: for 800 MHz = 800000 kHz --> scaling_min_freq = 800000
|
||||
# see conversion info: https://www.rapidtables.com/convert/frequency/mhz-to-hz.html
|
||||
# to use this feature, uncomment the following line and set the value accordingly
|
||||
# scaling_min_freq = 800000
|
||||
|
||||
# maximum cpu frequency (in kHz)
|
||||
# see conversion info: https://www.rapidtables.com/convert/frequency/mhz-to-hz.html
|
||||
# example: for 1GHz = 1000 MHz = 1000000 kHz -> scaling_max_freq = 1000000
|
||||
# to use this feature, uncomment the following line and set the value accordingly
|
||||
# scaling_max_freq = 1000000
|
||||
|
||||
# turbo boost setting (always, auto, or never)
|
||||
turbo = "auto";
|
||||
|
||||
# battery charging threshold
|
||||
# reference: https://github.com/AdnanHodzic/auto-cpufreq/#battery-charging-thresholds
|
||||
#enable_thresholds = true
|
||||
#start_threshold = 20
|
||||
#stop_threshold = 80
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
displayManager = {
|
||||
sddm = {
|
||||
enable = lib.mkForce true;
|
||||
wayland.enable = lib.mkForce true;
|
||||
};
|
||||
gdm.enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
desktopManager = {
|
||||
plasma6.enable = lib.mkForce false;
|
||||
gnome.enable = lib.mkForce false;
|
||||
};
|
||||
|
||||
logind = {
|
||||
lidSwitch = "suspend";
|
||||
lidSwitchExternalPower = "ignore";
|
||||
powerKey = "suspend";
|
||||
powerKeyLongPress = "poweroff";
|
||||
};
|
||||
|
||||
# Enable Flatpak
|
||||
flatpak.enable = lib.mkDefault false;
|
||||
|
||||
gvfs.enable = true;
|
||||
|
||||
keyd = {
|
||||
enable = true;
|
||||
keyboards = {
|
||||
default = {
|
||||
ids = [ "*" ];
|
||||
settings = {
|
||||
main = {
|
||||
# Use ⌘ key (leftmeta) to activate macOS-like layer
|
||||
leftmeta = "layer(meta_mac)";
|
||||
};
|
||||
|
||||
meta_mac = {
|
||||
# Tab switching
|
||||
tab = "swapm(app_switch_state, M-tab)";
|
||||
"`" = "A-f6";
|
||||
|
||||
# App shortcuts
|
||||
c = "C-insert"; # Copy
|
||||
v = "S-insert"; # Paste
|
||||
x = "S-delete"; # Cut
|
||||
|
||||
"1" = "A-1";
|
||||
"2" = "A-2";
|
||||
"3" = "A-3";
|
||||
"4" = "A-4";
|
||||
"5" = "A-5";
|
||||
"6" = "A-6";
|
||||
"7" = "A-7";
|
||||
"8" = "A-8";
|
||||
"9" = "A-9";
|
||||
|
||||
# Move to line start/end
|
||||
left = "home";
|
||||
right = "end";
|
||||
};
|
||||
|
||||
app_switch_state = {
|
||||
tab = "M-tab";
|
||||
right = "M-tab";
|
||||
"`" = "M-S-tab";
|
||||
left = "M-S-tab";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
70
systems/aarch64-linux/mac-nixos/sops.nix
Normal file
70
systems/aarch64-linux/mac-nixos/sops.nix
Normal file
@@ -0,0 +1,70 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
user = "matt";
|
||||
in
|
||||
{
|
||||
# Permission modes are in octal representation (same as chmod),
|
||||
# the digits represent: user|group|others
|
||||
# 7 - full (rwx)
|
||||
# 6 - read and write (rw-)
|
||||
# 5 - read and execute (r-x)
|
||||
# 4 - read only (r--)
|
||||
# 3 - write and execute (-wx)
|
||||
# 2 - write only (-w-)
|
||||
# 1 - execute only (--x)
|
||||
# 0 - none (---)
|
||||
# Either a user id or group name representation of the secret owner
|
||||
# It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
|
||||
# Either the group id or group name representation of the secret group
|
||||
# It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
|
||||
sops = {
|
||||
defaultSopsFile = ../../secrets/secrets.yaml;
|
||||
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
# ------------------------------
|
||||
# Secrets
|
||||
# ------------------------------
|
||||
secrets = {
|
||||
"wifi" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
};
|
||||
|
||||
# ------------------------------
|
||||
# SSH keys
|
||||
# ------------------------------
|
||||
# "ssh-keys-public/desktop-nixos" = {
|
||||
# sopsFile = ../../secrets/secrets.yaml;
|
||||
# mode = "0644";
|
||||
# owner = config.users.users."${user}".name;
|
||||
# group = config.users.users."${user}".group;
|
||||
# restartUnits = [ "sshd.service" ];
|
||||
# };
|
||||
# "ssh-keys-private/desktop-nixos" = {
|
||||
# sopsFile = ../../secrets/secrets.yaml;
|
||||
# mode = "0600";
|
||||
# owner = config.users.users."${user}".name;
|
||||
# group = config.users.users."${user}".group;
|
||||
# restartUnits = [ "sshd.service" ];
|
||||
# };
|
||||
# "ssh-keys-public/desktop-nixos-root" = {
|
||||
# sopsFile = ../../secrets/secrets.yaml;
|
||||
# path = "/root/.ssh/id_ed25519.pub";
|
||||
# mode = "0600";
|
||||
# restartUnits = [ "sshd.service" ];
|
||||
# };
|
||||
# "ssh-keys-private/desktop-nixos-root" = {
|
||||
# sopsFile = ../../secrets/secrets.yaml;
|
||||
# path = "/root/.ssh/id_ed25519";
|
||||
# mode = "0600";
|
||||
# restartUnits = [ "sshd.service" ];
|
||||
# };
|
||||
};
|
||||
|
||||
# ------------------------------
|
||||
# Templates
|
||||
# ------------------------------
|
||||
templates = {
|
||||
# ...
|
||||
};
|
||||
};
|
||||
}
|
||||
57
systems/aarch64-linux/pi4/adguard.nix
Normal file
57
systems/aarch64-linux/pi4/adguard.nix
Normal file
@@ -0,0 +1,57 @@
|
||||
{ ... }:
|
||||
{
|
||||
services.adguardhome = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
allowDHCP = true;
|
||||
mutableSettings = true;
|
||||
settings = {
|
||||
http.address = "0.0.0.0:0";
|
||||
users = [
|
||||
{
|
||||
name = "mjallen";
|
||||
password = "$2a$10$G07P7V1EnBQxWtMNGyfgTOTpAgr4d.uqYoG.cGSFCv9jQdiYWCsfq";
|
||||
}
|
||||
];
|
||||
dns = {
|
||||
upstream_dns = [
|
||||
"https://dns10.quad9.net/dns-query"
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
bootstrap_dns = [
|
||||
"9.9.9.10"
|
||||
"149.112.112.10"
|
||||
"2620:fe::10"
|
||||
"2620:fe::fe:10"
|
||||
];
|
||||
upstream_mode = "load_balance";
|
||||
trusted_proxies = [
|
||||
"127.0.0.0/8"
|
||||
"::1/128"
|
||||
"10.0.1.3"
|
||||
];
|
||||
cache_optimistic = true;
|
||||
};
|
||||
dhcp = {
|
||||
enabled = false;
|
||||
interface_name = "end0";
|
||||
local_domain_name = "lan";
|
||||
dhcpv4 = {
|
||||
gateway_ip = "10.0.1.1";
|
||||
subnet_mask = "255.255.255.0";
|
||||
range_start = "10.0.1.100";
|
||||
range_end = "10.0.1.254";
|
||||
lease_duration = 86400;
|
||||
icmp_timeout_msec = 1000;
|
||||
};
|
||||
dhcpv6 = {
|
||||
range_start = "2001::1";
|
||||
lease_duration = 86400;
|
||||
ra_slaac_only = false;
|
||||
ra_allow_slaac = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
69
systems/aarch64-linux/pi4/argononed.nix
Normal file
69
systems/aarch64-linux/pi4/argononed.nix
Normal file
@@ -0,0 +1,69 @@
|
||||
# { ... }:
|
||||
# {
|
||||
# programs.argon.one = {
|
||||
# enable = true;
|
||||
|
||||
# settings = {
|
||||
# # Is 'celsius' by default, can also be set to 'fahrenheit'
|
||||
# displayUnits = "celsius";
|
||||
|
||||
# # This is the same config as the original Argon40 config.
|
||||
# # This is also the default config for this flake.
|
||||
# fanspeed = [
|
||||
# {
|
||||
# # This the temperature threshold at which this fan speed will activate.
|
||||
# # The temperature is in the above specified unit.
|
||||
# temperature = 55;
|
||||
# # This is speed percentage at which the fan will spin.
|
||||
# speed = 30;
|
||||
# }
|
||||
# {
|
||||
# temperature = 60;
|
||||
# speed = 55;
|
||||
# }
|
||||
# {
|
||||
# temperature = 65;
|
||||
# speed = 100;
|
||||
# }
|
||||
# ];
|
||||
# ir = {
|
||||
# enable = true;
|
||||
# gpio.enable = true;
|
||||
# keymap = {
|
||||
# "POWER" = "00ff39c6";
|
||||
# "UP" = "00ff53ac";
|
||||
# "DOWN" = "00ff4bb4";
|
||||
# "LEFT" = "00ff9966";
|
||||
# "RIGHT" = "00ff837c";
|
||||
# "VOLUMEUP" = "00ff01fe";
|
||||
# "VOLUMEDOWN" = "00ff817e";
|
||||
# "OK" = "00ff738c";
|
||||
# "HOME" = "00ffd32c";
|
||||
# "MENU" = "00ffb946";
|
||||
# "BACK" = "00ff09f6";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# }
|
||||
# { lib, stdenv, pkgs, config, ...}:
|
||||
# {
|
||||
# imports = let
|
||||
# argononed = fetchGit {
|
||||
# url = "https://github.com/mjallen18/argononed.git";
|
||||
# ref = "dev"; # Or any other branches deemed suitable
|
||||
# };
|
||||
# in
|
||||
# [ "${argononed}/OS/nixos" ];
|
||||
|
||||
# services.argonone = {
|
||||
# enable = true;
|
||||
# logLevel = 4;
|
||||
# settings = {
|
||||
# fanTemp0 = 36; fanSpeed0 = 10;
|
||||
# fanTemp1 = 41; fanSpeed1 = 50;
|
||||
# fanTemp2 = 46; fanSpeed2 = 80;
|
||||
# hysteresis = 4;
|
||||
# };
|
||||
# };
|
||||
# }
|
||||
78
systems/aarch64-linux/pi4/boot.nix
Executable file
78
systems/aarch64-linux/pi4/boot.nix
Executable file
@@ -0,0 +1,78 @@
|
||||
# { pkgs, lib, ... }:
|
||||
# let
|
||||
# uefi_pi4 = pkgs.callPackage ./pi4-uefi.nix { };
|
||||
# in
|
||||
# {
|
||||
# boot = {
|
||||
# loader = {
|
||||
# systemd-boot.enable = lib.mkForce false;
|
||||
# efi.canTouchEfiVariables = false;
|
||||
# generic-extlinux-compatible.enable = lib.mkForce true;
|
||||
# };
|
||||
# plymouth.enable = false;
|
||||
# kernelPackages = pkgs.linuxPackages_rpi4;
|
||||
# kernelModules = [ "i2c-dev" "i2c-bcm2835" ];
|
||||
# initrd.kernelModules = [ "i2c-dev" "i2c-bcm2835" ];
|
||||
# };
|
||||
# # environment.systemPackages = [ uefi_pi4 ];
|
||||
|
||||
# # Copy UEFI firmware files to the boot partition
|
||||
# # system.activationScripts.installUEFIFirmware.text = ''
|
||||
# # cp -r ${uefi_pi4}/share/uefi_rpi4/* /boot/firmware/
|
||||
# # '';
|
||||
# }
|
||||
{ pkgs, lib, ... }:
|
||||
let
|
||||
kernelBundle = pkgs.linuxAndFirmware.latest;
|
||||
in
|
||||
{
|
||||
boot = {
|
||||
loader.raspberryPi.firmwarePackage = kernelBundle.raspberrypifw;
|
||||
kernelPackages = kernelBundle.linuxPackages_rpi4;
|
||||
};
|
||||
|
||||
hardware.raspberry-pi.config = {
|
||||
all = { # [all] conditional filter, https://www.raspberrypi.com/documentation/computers/config_txt.html#conditional-filters
|
||||
|
||||
base-dt-params = {
|
||||
i2c_arm = {
|
||||
enable = true;
|
||||
value = "on";
|
||||
};
|
||||
i2c = {
|
||||
enable = true;
|
||||
value = "on";
|
||||
};
|
||||
spi = {
|
||||
enable = true;
|
||||
value = "on";
|
||||
};
|
||||
};
|
||||
|
||||
options = {
|
||||
# https://www.raspberrypi.com/documentation/computers/config_txt.html#enable_uart
|
||||
# in conjunction with `console=serial0,115200` in kernel command line (`cmdline.txt`)
|
||||
# creates a serial console, accessible using GPIOs 14 and 15 (pins
|
||||
# 8 and 10 on the 40-pin header)
|
||||
enable_uart = {
|
||||
enable = true;
|
||||
value = true;
|
||||
};
|
||||
# https://www.raspberrypi.com/documentation/computers/config_txt.html#uart_2ndstage
|
||||
# enable debug logging to the UART, also automatically enables
|
||||
# UART logging in `start.elf`
|
||||
uart_2ndstage = {
|
||||
enable = true;
|
||||
value = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Base DTB parameters
|
||||
# https://github.com/raspberrypi/linux/blob/a1d3defcca200077e1e382fe049ca613d16efd2b/arch/arm/boot/dts/overlays/README#L132
|
||||
base-dt-params = {
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
113
systems/aarch64-linux/pi4/configuration.nix
Executable file
113
systems/aarch64-linux/pi4/configuration.nix
Executable file
@@ -0,0 +1,113 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
user = "matt";
|
||||
# password = config.sops.secrets."pi4/matt-password".path;
|
||||
kernelBundle = pkgs.linuxAndFirmware.latest;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./adguard.nix
|
||||
./boot.nix
|
||||
./impermanence.nix
|
||||
./networking.nix
|
||||
./sops.nix
|
||||
];
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
substituters = [
|
||||
"https://nixos-raspberrypi.cachix.org"
|
||||
"https://cache.mjallen.dev"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
|
||||
"cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Configure nixpkgs
|
||||
nixpkgs = {
|
||||
overlays = lib.mkAfter [
|
||||
(self: super: {
|
||||
# This is used in (modulesPath + "/hardware/all-firmware.nix") when at least
|
||||
# enableRedistributableFirmware is enabled
|
||||
# I know no easier way to override this package
|
||||
inherit (kernelBundle) raspberrypiWirelessFirmware;
|
||||
# Some derivations want to use it as an input,
|
||||
# e.g. raspberrypi-dtbs, omxplayer, sd-image-* modules
|
||||
inherit (kernelBundle) raspberrypifw;
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
system.nixos.tags = let
|
||||
cfg = config.boot.loader.raspberryPi;
|
||||
in [
|
||||
"raspberry-pi-${cfg.variant}"
|
||||
cfg.bootloader
|
||||
config.boot.kernelPackages.kernel.version
|
||||
];
|
||||
|
||||
programs.zsh.enable = true;
|
||||
hardware.i2c.enable = true;
|
||||
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
authorizedKeysFiles = [
|
||||
config.sops.secrets."ssh-keys-public/pi5".path
|
||||
];
|
||||
hostKeys = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.btattach = {
|
||||
before = [ "bluetooth.service" ];
|
||||
after = [ "dev-ttyAMA0.device" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.bluez}/bin/btattach -B /dev/ttyAMA0 -P bcm -S 3000000";
|
||||
};
|
||||
};
|
||||
|
||||
environment = {
|
||||
systemPackages = with pkgs; [
|
||||
i2c-tools
|
||||
libraspberrypi
|
||||
raspberrypi-eeprom
|
||||
raspberrypifw
|
||||
raspberrypiWirelessFirmware
|
||||
raspberrypi-armstubs
|
||||
];
|
||||
};
|
||||
|
||||
users = {
|
||||
mutableUsers = false;
|
||||
users."${user}" = {
|
||||
isNormalUser = true;
|
||||
# hashedPasswordFile = password;
|
||||
password = "BogieDudie1";
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"docker"
|
||||
"video"
|
||||
];
|
||||
shell = pkgs.zsh;
|
||||
openssh.authorizedKeys.keys = [
|
||||
# macBook
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCw9zq8DLGByI5v2gAn95hKNyOsm3g61a2buxu2BBMFysQJgmZPCCLUqRJKhSM5Vm/JOgsAmdpRBRZQoHD+6S844CJHb4v4VIbjkyQgYCuM7Rst2IOZ5QybvsA2/D0nwytZ+HXQqDj2AagUYDbz0gyyIHkDQ5YGBMkvkWz/h1Vci6aoBM7VihEDM4KlWoTVuPeASGM8r5IZ2FS83Djbqo4ov6AYvLMrKB9Z7hmFgH6R3LE0gxOkzbGVXtSuvJyrjvgytoT22UhATjjxSQ9D+YJXXkQoB3lUdg8OoIquUPjMZpl4mR8ffvseWPfcvD1XlD5t+TOHFqKpESO547tlOBYhdpew+NSgAXpamCU6oyV8tDCywLQu2ucxHRn78u6WXzWHkDtffdhzmk6TZaPhWqVHuTGjR4higBgGqUfSaKOMszt+FDRZAr3HtuQ2+zJ8bowK9fW5OqilTtK2HtQqroD9ApegDNbqOz6kGy5IycSXvqPURy/M4lxZxbtBPuemcJs= mattjallen@MacBook-Pro.local"
|
||||
# desktop windows
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ2PYPjZddOzR8OJj16G88KcUhCDLkvrEmpUQP0wKHDUuA27HQQ2ORo66asadwGHY3k1VDZ1ei9l9H++SIIeKOaaUr5yZdktvj4POUNtbd9ZhcS7sZU7BSF+NMDM+h3tImh6z0S7mWvRQOUv3ZM+ZER+5xTWJVG1OOJEpb1drxJk6Qz0wbZKSR7TPNFBLLXlVy7hkNYf07RtDyhCCxNB3hJfa8c+oztnWumwDhDQWLqiUXWIU2QH6iRLGl/WYnujtNvVVaV/Hn3JJkS6MM9dnV3cpoIO0+J7+WfsN9rZ0wXt5yY3GhiGXwmcO5eYVli8lHlLWtK7aYSETyry6CBsLbojzOQO5rSqhpwfF2njAAFAQU0UjLc8PahisIuFKCwHH4iyXXOagiv5K1Mc/0Ak+WhhMPee6vV2p7NTyNpXRvouDbWy5cSRH31WgQ9fK5mIGe5v8nGGqtEhUubUkiOgP+H3UbT2V/nTv/TFKdJcKw+WmizvTrxBmaMjWALlkYl+s= mattl@Jallen-PC"
|
||||
# desktop nixos
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTBMydhOc6SnOdB5WrEd7X07DrboAtagCUgXiOJjLov matt@matt-nixos"
|
||||
];
|
||||
};
|
||||
|
||||
users.root.shell = pkgs.zsh;
|
||||
};
|
||||
}
|
||||
66
systems/aarch64-linux/pi4/home.nix
Executable file
66
systems/aarch64-linux/pi4/home.nix
Executable file
@@ -0,0 +1,66 @@
|
||||
{ lib, ... }:
|
||||
let
|
||||
shellAliases = {
|
||||
ll = "ls -alh";
|
||||
update-boot = "sudo nixos-rebuild boot --max-jobs 10 --build-host admin@10.0.1.3";
|
||||
update-switch = "sudo nixos-rebuild switch --max-jobs 10 --build-host admin@10.0.1.3";
|
||||
update-flake = "nix flake update pi4-nixpkgs pi4-home-manager pi4-impermanence pi4-sops-nix pi4-nixos-hardware pi4-nixos-raspberrypi pi4-disko --flake /etc/nixos";
|
||||
update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@10.0.1.3 --build-host admin@10.0.1.3 --flake ~/nix-config#jallen-nas";
|
||||
nas-ssh = "kitten ssh admin@10.0.1.3";
|
||||
ducks = "du -cksh * | sort -hr | head -n 15";
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../../share/home/defaults.nix
|
||||
../../share/home/git.nix
|
||||
../../share/home/shell.nix
|
||||
];
|
||||
|
||||
home.username = "matt";
|
||||
|
||||
sops = {
|
||||
age.keyFile = "/home/matt/.config/sops/age/keys.txt";
|
||||
defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets = {
|
||||
"ssh-keys-public/pi4" = {
|
||||
path = "/home/matt/.ssh/id_ed25519.pub";
|
||||
mode = "0644";
|
||||
};
|
||||
"ssh-keys-private/pi4" = {
|
||||
path = "/home/matt/.ssh/id_ed25519";
|
||||
mode = "0600";
|
||||
};
|
||||
# "ssh-keys-public/desktop-nixos" = {
|
||||
# path = "/home/matt/.ssh/authorized_keys";
|
||||
# mode = "0600";
|
||||
# };
|
||||
|
||||
# "ssh-keys-public/desktop-nixos-root" = {
|
||||
# path = "/home/matt/.ssh/authorized_keys2";
|
||||
# mode = "0600";
|
||||
# };
|
||||
|
||||
# "ssh-keys-public/desktop-windows" = {
|
||||
# path = "/home/matt/.ssh/authorized_keys3";
|
||||
# mode = "0600";
|
||||
# };
|
||||
|
||||
# "ssh-keys-public/macbook-macos" = {
|
||||
# path = "/home/matt/.ssh/authorized_keys4";
|
||||
# mode = "0600";
|
||||
# };
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
java.enable = lib.mkForce true;
|
||||
mangohud.enable = lib.mkForce true;
|
||||
zsh.shellAliases = shellAliases;
|
||||
};
|
||||
|
||||
services = {
|
||||
nextcloud-client.enable = lib.mkForce true;
|
||||
};
|
||||
}
|
||||
35
systems/aarch64-linux/pi4/impermanence.nix
Executable file
35
systems/aarch64-linux/pi4/impermanence.nix
Executable file
@@ -0,0 +1,35 @@
|
||||
{ ... }:
|
||||
{
|
||||
# Set up impernance configuration for things like bluetooth
|
||||
# In this configuration with /etc and /var/log being persistent, only directories outside of that need to be done here. See hardware configuration for all mountpoints.
|
||||
|
||||
environment.persistence."/nix/persist/system" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/bluetooth"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/libvirt"
|
||||
"/var/lib/systemd/coredump"
|
||||
{
|
||||
directory = "/var/lib/private";
|
||||
mode = "u=rwx,g=,o=";
|
||||
}
|
||||
"/etc/NetworkManager/system-connections"
|
||||
{
|
||||
directory = "/etc/nix";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "u=rwx,g=rx,o=rx";
|
||||
}
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
];
|
||||
};
|
||||
|
||||
security.sudo.extraConfig = ''
|
||||
# rollback results in sudo lectures after each reboot
|
||||
Defaults lecture = never
|
||||
'';
|
||||
|
||||
}
|
||||
75
systems/aarch64-linux/pi4/networking.nix
Executable file
75
systems/aarch64-linux/pi4/networking.nix
Executable file
@@ -0,0 +1,75 @@
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
hostname = "pi4";
|
||||
in
|
||||
{
|
||||
# Networking configs
|
||||
networking = {
|
||||
hostName = hostname;
|
||||
|
||||
defaultGateway.address = "10.0.1.1";
|
||||
nameservers = [ "10.0.1.1" ];
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 ];
|
||||
};
|
||||
|
||||
# Enable Network Manager
|
||||
networkmanager = {
|
||||
enable = lib.mkDefault true;
|
||||
wifi.powersave = lib.mkDefault false;
|
||||
settings.connectivity.uri = lib.mkDefault "http://nmcheck.gnome.org/check_network_status.txt";
|
||||
ensureProfiles = {
|
||||
environmentFiles = [
|
||||
config.sops.secrets.wifi.path
|
||||
];
|
||||
|
||||
profiles = {
|
||||
# "Joey's Jungle 5G" = {
|
||||
# connection = {
|
||||
# id = "Joey's Jungle 5G";
|
||||
# type = "wifi";
|
||||
# };
|
||||
# ipv4 = {
|
||||
# method = "auto";
|
||||
# };
|
||||
# ipv6 = {
|
||||
# addr-gen-mode = "stable-privacy";
|
||||
# method = "auto";
|
||||
# };
|
||||
# wifi = {
|
||||
# mode = "infrastructure";
|
||||
# ssid = "Joey's Jungle 5G";
|
||||
# };
|
||||
# wifi-security = {
|
||||
# key-mgmt = "sae";
|
||||
# psk = "$PSK";
|
||||
# };
|
||||
# };
|
||||
|
||||
"static-enabcm6e4ei0" = {
|
||||
connection = {
|
||||
id = "static-enabcm6e4ei0";
|
||||
type = "ethernet";
|
||||
interface-name = "enabcm6e4ei0";
|
||||
};
|
||||
|
||||
ipv4 = {
|
||||
method = "manual";
|
||||
address = "10.0.1.2/24";
|
||||
gateway = "10.0.1.1";
|
||||
dns = "1.1.1.1";
|
||||
};
|
||||
ipv6 = {
|
||||
addr-gen-mode = "stable-privacy";
|
||||
method = "auto";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
22
systems/aarch64-linux/pi4/pi4-hw.nix
Normal file
22
systems/aarch64-linux/pi4/pi4-hw.nix
Normal file
@@ -0,0 +1,22 @@
|
||||
{ ... }:
|
||||
{
|
||||
hardware = {
|
||||
raspberry-pi."4" = {
|
||||
apply-overlays-dtmerge.enable = true;
|
||||
audio.enable = true;
|
||||
backlight.enable = false;
|
||||
bluetooth.enable = true;
|
||||
dwc2.enable = true;
|
||||
i2c0.enable = true;
|
||||
i2c1.enable = true;
|
||||
leds = {
|
||||
eth.disable = false;
|
||||
act.disable = false;
|
||||
pwr.disable = false;
|
||||
};
|
||||
fkms-3d.enable = true;
|
||||
xhci.enable = true;
|
||||
};
|
||||
deviceTree.filter = "bcm2711-rpi-4*.dtb";
|
||||
};
|
||||
}
|
||||
23
systems/aarch64-linux/pi4/pi4-uefi.nix
Normal file
23
systems/aarch64-linux/pi4/pi4-uefi.nix
Normal file
@@ -0,0 +1,23 @@
|
||||
{ stdenv, fetchzip }:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "uefi_rpi4";
|
||||
version = "1.38";
|
||||
|
||||
src = fetchzip {
|
||||
url = "https://github.com/pftf/RPi4/releases/download/v1.38/RPi4_UEFI_Firmware_v1.38.zip";
|
||||
hash = "sha256-9tOr80jcmguFy2bSz+H3TfmG8BkKyBTFoUZkMy8x+0g=";
|
||||
stripRoot = false;
|
||||
};
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out/share/uefi_rpi4
|
||||
cp -r * $out/share/uefi_rpi4
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "UEFI Firmware for Raspberry Pi 4";
|
||||
homepage = "https://github.com/pftf/RPi4";
|
||||
platforms = [ "aarch64-linux" ];
|
||||
};
|
||||
}
|
||||
58
systems/aarch64-linux/pi4/pkg.nix
Normal file
58
systems/aarch64-linux/pi4/pkg.nix
Normal file
@@ -0,0 +1,58 @@
|
||||
{ lib, stdenv, fetchFromGitHub, nix-gitignore, dtc, installShellFiles, logLevel ? 5, ... }:
|
||||
|
||||
let
|
||||
rawSrc = fetchFromGitHub {
|
||||
owner = "mjallen18";
|
||||
repo = "argononed";
|
||||
rev = "master"; # replace with actual commit or tag
|
||||
sha256 = "sha256-PpFR+6Aa4Pz9EmxOayMSsSTKFzUR6sYIAkGZ8+SUK18="; # fill this in with actual hash
|
||||
};
|
||||
|
||||
ignores = ''
|
||||
/*
|
||||
!/version
|
||||
!/makefile
|
||||
!/configure
|
||||
!/src
|
||||
!/OS
|
||||
/OS/*
|
||||
!/OS/_common/
|
||||
!/OS/nixos/
|
||||
'';
|
||||
|
||||
cleanSrc = nix-gitignore.gitignoreSourcePure ignores rawSrc;
|
||||
in
|
||||
|
||||
stdenv.mkDerivation {
|
||||
pname = "argononed";
|
||||
version = lib.strings.fileContents "${cleanSrc}/version";
|
||||
|
||||
src = cleanSrc;
|
||||
|
||||
nativeBuildInputs = [ dtc installShellFiles ];
|
||||
|
||||
preConfigure = ''
|
||||
patchShebangs --build ./configure
|
||||
export TARGET_DISTRO=nixos
|
||||
'';
|
||||
|
||||
patches = [
|
||||
"${cleanSrc}/OS/nixos/patches/nixos.patch"
|
||||
"${cleanSrc}/OS/nixos/patches/shutdown.patch"
|
||||
];
|
||||
|
||||
buildFlags = [ "LOGLEVEL=${toString logLevel}" ];
|
||||
|
||||
installFlags = [ "NIX_DRVOUT=$(out)" ];
|
||||
|
||||
postInstall = ''
|
||||
installShellCompletion --bash --name argonone-cli OS/_common/argonone-cli-complete.bash
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "A replacement daemon for the Argon One Raspberry Pi case";
|
||||
homepage = "https://gitlab.com/DarkElvenAngel/argononed";
|
||||
license = lib.licenses.mit;
|
||||
platforms = [ "aarch64-linux" ];
|
||||
};
|
||||
}
|
||||
70
systems/aarch64-linux/pi4/sops.nix
Executable file
70
systems/aarch64-linux/pi4/sops.nix
Executable file
@@ -0,0 +1,70 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
user = "matt";
|
||||
in
|
||||
{
|
||||
sops = {
|
||||
defaultSopsFile = ../../secrets/pi4-secrets.yaml;
|
||||
# age = {
|
||||
# generateKey = true;
|
||||
# sshKeyPaths = [ "/etc/ssd/ssh_host_ed25519_key" ];
|
||||
# };
|
||||
age.keyFile = "/home/matt/.config/sops/age/keys.txt";
|
||||
validateSopsFiles = false;
|
||||
# ------------------------------
|
||||
# Secrets
|
||||
# ------------------------------
|
||||
secrets = {
|
||||
"wifi" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
};
|
||||
"pi4/matt-password" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
};
|
||||
|
||||
# ------------------------------
|
||||
# SSH keys
|
||||
# ------------------------------
|
||||
|
||||
"ssh-keys-public/pi4" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
mode = "0644";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"ssh-keys-private/pi4" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"ssh-keys-public/pi5" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users.root.name;
|
||||
group = config.users.users.root.group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"pi4/sys-public-key" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users.root.name;
|
||||
group = config.users.users.root.group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"pi4/sys-priv-key" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users.root.name;
|
||||
group = config.users.users.root.group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
52
systems/aarch64-linux/pi5/boot.nix
Executable file
52
systems/aarch64-linux/pi5/boot.nix
Executable file
@@ -0,0 +1,52 @@
|
||||
{ pkgs, lib, ... }:
|
||||
let
|
||||
kernelBundle = pkgs.linuxAndFirmware.latest;
|
||||
in
|
||||
{
|
||||
boot = {
|
||||
loader.raspberryPi.firmwarePackage = kernelBundle.raspberrypifw;
|
||||
kernelPackages = kernelBundle.linuxPackages_rpi5;
|
||||
};
|
||||
|
||||
hardware.raspberry-pi.config = {
|
||||
all = { # [all] conditional filter, https://www.raspberrypi.com/documentation/computers/config_txt.html#conditional-filters
|
||||
|
||||
options = {
|
||||
# https://www.raspberrypi.com/documentation/computers/config_txt.html#enable_uart
|
||||
# in conjunction with `console=serial0,115200` in kernel command line (`cmdline.txt`)
|
||||
# creates a serial console, accessible using GPIOs 14 and 15 (pins
|
||||
# 8 and 10 on the 40-pin header)
|
||||
enable_uart = {
|
||||
enable = true;
|
||||
value = true;
|
||||
};
|
||||
# https://www.raspberrypi.com/documentation/computers/config_txt.html#uart_2ndstage
|
||||
# enable debug logging to the UART, also automatically enables
|
||||
# UART logging in `start.elf`
|
||||
uart_2ndstage = {
|
||||
enable = true;
|
||||
value = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Base DTB parameters
|
||||
# https://github.com/raspberrypi/linux/blob/a1d3defcca200077e1e382fe049ca613d16efd2b/arch/arm/boot/dts/overlays/README#L132
|
||||
base-dt-params = {
|
||||
|
||||
# https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#enable-pcie
|
||||
pciex1 = {
|
||||
enable = true;
|
||||
value = "on";
|
||||
};
|
||||
# PCIe Gen 3.0
|
||||
# https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#pcie-gen-3-0
|
||||
pciex1_gen = {
|
||||
enable = true;
|
||||
value = "3";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
110
systems/aarch64-linux/pi5/configuration.nix
Executable file
110
systems/aarch64-linux/pi5/configuration.nix
Executable file
@@ -0,0 +1,110 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
user = "matt";
|
||||
password = config.sops.secrets."pi5/matt-password".path;
|
||||
kernelBundle = pkgs.linuxAndFirmware.latest;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./boot.nix
|
||||
./impermanence.nix
|
||||
./networking.nix
|
||||
./services.nix
|
||||
./sops.nix
|
||||
../../modules/desktop-environments/hyprland
|
||||
./hass.nix
|
||||
];
|
||||
|
||||
# Enable nix flakes and nix-command tools
|
||||
nix = {
|
||||
settings = {
|
||||
substituters = [
|
||||
"https://nixos-raspberrypi.cachix.org"
|
||||
# "https://cache.mjallen.dev"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
|
||||
# "cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Configure nixpkgs
|
||||
nixpkgs = {
|
||||
overlays = lib.mkAfter [
|
||||
(self: super: {
|
||||
# This is used in (modulesPath + "/hardware/all-firmware.nix") when at least
|
||||
# enableRedistributableFirmware is enabled
|
||||
# I know no easier way to override this package
|
||||
inherit (kernelBundle) raspberrypiWirelessFirmware;
|
||||
# Some derivations want to use it as an input,
|
||||
# e.g. raspberrypi-dtbs, omxplayer, sd-image-* modules
|
||||
inherit (kernelBundle) raspberrypifw;
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
system.nixos.tags = let
|
||||
cfg = config.boot.loader.raspberryPi;
|
||||
in [
|
||||
"raspberry-pi-${cfg.variant}"
|
||||
cfg.bootloader
|
||||
config.boot.kernelPackages.kernel.version
|
||||
];
|
||||
|
||||
systemd.services.btattach = {
|
||||
before = [ "bluetooth.service" ];
|
||||
after = [ "dev-ttyAMA0.device" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.bluez}/bin/btattach -B /dev/ttyAMA0 -P bcm -S 3000000";
|
||||
};
|
||||
};
|
||||
|
||||
environment = {
|
||||
systemPackages = with pkgs; [
|
||||
erofs-utils
|
||||
fex
|
||||
libraspberrypi
|
||||
raspberrypi-eeprom
|
||||
raspberrypifw
|
||||
raspberrypiWirelessFirmware
|
||||
raspberrypi-armstubs
|
||||
squashfuse
|
||||
squashfsTools
|
||||
];
|
||||
};
|
||||
|
||||
hardware.graphics.enable32Bit = lib.mkForce false;
|
||||
|
||||
users = {
|
||||
mutableUsers = false;
|
||||
users."${user}" = {
|
||||
isNormalUser = true;
|
||||
# hashedPasswordFile = password;
|
||||
password = "BogieDudie1";
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"docker"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
# macBook
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCw9zq8DLGByI5v2gAn95hKNyOsm3g61a2buxu2BBMFysQJgmZPCCLUqRJKhSM5Vm/JOgsAmdpRBRZQoHD+6S844CJHb4v4VIbjkyQgYCuM7Rst2IOZ5QybvsA2/D0nwytZ+HXQqDj2AagUYDbz0gyyIHkDQ5YGBMkvkWz/h1Vci6aoBM7VihEDM4KlWoTVuPeASGM8r5IZ2FS83Djbqo4ov6AYvLMrKB9Z7hmFgH6R3LE0gxOkzbGVXtSuvJyrjvgytoT22UhATjjxSQ9D+YJXXkQoB3lUdg8OoIquUPjMZpl4mR8ffvseWPfcvD1XlD5t+TOHFqKpESO547tlOBYhdpew+NSgAXpamCU6oyV8tDCywLQu2ucxHRn78u6WXzWHkDtffdhzmk6TZaPhWqVHuTGjR4higBgGqUfSaKOMszt+FDRZAr3HtuQ2+zJ8bowK9fW5OqilTtK2HtQqroD9ApegDNbqOz6kGy5IycSXvqPURy/M4lxZxbtBPuemcJs= mattjallen@MacBook-Pro.local"
|
||||
# desktop windows
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ2PYPjZddOzR8OJj16G88KcUhCDLkvrEmpUQP0wKHDUuA27HQQ2ORo66asadwGHY3k1VDZ1ei9l9H++SIIeKOaaUr5yZdktvj4POUNtbd9ZhcS7sZU7BSF+NMDM+h3tImh6z0S7mWvRQOUv3ZM+ZER+5xTWJVG1OOJEpb1drxJk6Qz0wbZKSR7TPNFBLLXlVy7hkNYf07RtDyhCCxNB3hJfa8c+oztnWumwDhDQWLqiUXWIU2QH6iRLGl/WYnujtNvVVaV/Hn3JJkS6MM9dnV3cpoIO0+J7+WfsN9rZ0wXt5yY3GhiGXwmcO5eYVli8lHlLWtK7aYSETyry6CBsLbojzOQO5rSqhpwfF2njAAFAQU0UjLc8PahisIuFKCwHH4iyXXOagiv5K1Mc/0Ak+WhhMPee6vV2p7NTyNpXRvouDbWy5cSRH31WgQ9fK5mIGe5v8nGGqtEhUubUkiOgP+H3UbT2V/nTv/TFKdJcKw+WmizvTrxBmaMjWALlkYl+s= mattl@Jallen-PC"
|
||||
# desktop nixos
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTBMydhOc6SnOdB5WrEd7X07DrboAtagCUgXiOJjLov matt@matt-nixos"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTha0FbV1tkpnJr7xVH78S5MetJH+0o2YrEcuvhL692 root@jallen-nas"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIwoHWOLSTGVif9hAhaMLl0qDA4roIzCNuyR6kyIXDOj admin@jallen-nas"
|
||||
];
|
||||
shell = pkgs.zsh;
|
||||
};
|
||||
users.root.shell = pkgs.zsh;
|
||||
};
|
||||
|
||||
zramSwap.enable = true;
|
||||
}
|
||||
109
systems/aarch64-linux/pi5/disko.nix
Normal file
109
systems/aarch64-linux/pi5/disko.nix
Normal file
@@ -0,0 +1,109 @@
|
||||
{ ... }:
|
||||
let
|
||||
rootDisk = "/dev/nvme0n1";
|
||||
in
|
||||
{
|
||||
disko.devices.disk.main.imageSize = "15G";
|
||||
disko.devices = {
|
||||
nodev."/" = {
|
||||
fsType = "tmpfs";
|
||||
mountOptions = [
|
||||
"mode=755"
|
||||
"defaults"
|
||||
"size=2G"
|
||||
];
|
||||
};
|
||||
# root disk setup
|
||||
disk.main = {
|
||||
type = "disk";
|
||||
device = rootDisk;
|
||||
content = {
|
||||
type = "gpt";
|
||||
# specify partitions
|
||||
partitions = {
|
||||
# /boot/firmware
|
||||
FIRMWARE = {
|
||||
priority = 1;
|
||||
name = "FIRMWARE";
|
||||
start = "1M";
|
||||
end = "1G";
|
||||
type = "0700";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot/firmware";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
# /boot
|
||||
ESP = {
|
||||
priority = 2;
|
||||
name = "ESP";
|
||||
# start = "1G";
|
||||
# end = "2G";
|
||||
size = "1G";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
|
||||
root = {
|
||||
name = "btrfs-root";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-f" ]; # Override existing partition
|
||||
# Subvolumes must set a mountpoint in order to be mounted,
|
||||
# unless their parent is mounted
|
||||
subvolumes = {
|
||||
"home" = {
|
||||
mountOptions = [ "compress=zstd" ];
|
||||
mountpoint = "/home";
|
||||
};
|
||||
"root" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
mountpoint = "/root";
|
||||
};
|
||||
"nix" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
"etc" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
mountpoint = "/etc";
|
||||
};
|
||||
"tmp" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
mountpoint = "/tmp";
|
||||
};
|
||||
"log" = {
|
||||
mountOptions = [
|
||||
"compress=zstd"
|
||||
"noatime"
|
||||
];
|
||||
mountpoint = "/var/log";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
74
systems/aarch64-linux/pi5/hardware-configuration.nix
Normal file
74
systems/aarch64-linux/pi5/hardware-configuration.nix
Normal file
@@ -0,0 +1,74 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "none";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{ device = "/dev/disk/by-uuid/6f7adf66-5662-48cd-9c50-690469e2b615";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=nix" "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/etc" =
|
||||
{ device = "/dev/disk/by-uuid/6f7adf66-5662-48cd-9c50-690469e2b615";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=etc" "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/root" =
|
||||
{ device = "/dev/disk/by-uuid/6f7adf66-5662-48cd-9c50-690469e2b615";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=root" "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/var/log" =
|
||||
{ device = "/dev/disk/by-uuid/6f7adf66-5662-48cd-9c50-690469e2b615";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=log" "compress=zstd" "noatime" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "/dev/disk/by-uuid/6f7adf66-5662-48cd-9c50-690469e2b615";
|
||||
fsType = "btrfs";
|
||||
options = [ "subvol=home" "compress=zstd" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/7793-909B";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot/firmware" =
|
||||
{ device = "/dev/disk/by-uuid/15B0-5CAA";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.end0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
65
systems/aarch64-linux/pi5/home.nix
Executable file
65
systems/aarch64-linux/pi5/home.nix
Executable file
@@ -0,0 +1,65 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
shellAliases = {
|
||||
update-boot = "sudo nixos-rebuild boot --max-jobs 10 --build-host admin@10.0.1.3";
|
||||
update-switch = "sudo nixos-rebuild switch --max-jobs 10 --build-host admin@10.0.1.3";
|
||||
update-flake = "nix flake update pi5-nixpkgs pi5-home-manager pi5-impermanence pi5-nixos-hardware pi5-sops-nix nixos-raspberrypi --flake /etc/nixos";
|
||||
update-nas = "nixos-rebuild switch --use-remote-sudo --target-host admin@10.0.1.3 --build-host admin@10.0.1.3 --flake ~/nix-config#jallen-nas";
|
||||
nas-ssh = "kitten ssh admin@10.0.1.3";
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
../../share/home/defaults.nix
|
||||
../../share/home/git.nix
|
||||
../../share/home/gnome.nix
|
||||
../../share/home/librewolf.nix
|
||||
../../share/home/shell.nix
|
||||
../../share/home/vscode.nix
|
||||
];
|
||||
|
||||
home.username = "matt";
|
||||
|
||||
sops = {
|
||||
age.keyFile = "/home/matt/.config/sops/age/keys.txt";
|
||||
defaultSopsFile = "/etc/nixos/secrets/secrets.yaml";
|
||||
validateSopsFiles = false;
|
||||
secrets = {
|
||||
"ssh-keys-public/pi5" = {
|
||||
path = "/home/matt/.ssh/id_ed25519.pub";
|
||||
mode = "0644";
|
||||
};
|
||||
"ssh-keys-private/pi5" = {
|
||||
path = "/home/matt/.ssh/id_ed25519";
|
||||
mode = "0600";
|
||||
};
|
||||
"ssh-keys-public/jallen-nas" = { };
|
||||
|
||||
"ssh-keys-public/jallen-nas-root" = { };
|
||||
|
||||
"ssh-keys-public/desktop-nixos" = { };
|
||||
|
||||
"ssh-keys-public/desktop-nixos-root" = { };
|
||||
|
||||
"ssh-keys-public/desktop-windows" = { };
|
||||
|
||||
"ssh-keys-public/macbook-macos" = { };
|
||||
};
|
||||
|
||||
templates = {
|
||||
"authorized_keys" = {
|
||||
content = ''
|
||||
${config.sops.placeholder."ssh-keys-public/jallen-nas"}
|
||||
${config.sops.placeholder."ssh-keys-public/jallen-nas-root"}
|
||||
${config.sops.placeholder."ssh-keys-public/desktop-nixos"}
|
||||
${config.sops.placeholder."ssh-keys-public/desktop-nixos-root"}
|
||||
${config.sops.placeholder."ssh-keys-public/macbook-macos"}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
programs = {
|
||||
zsh.shellAliases = shellAliases;
|
||||
};
|
||||
}
|
||||
36
systems/aarch64-linux/pi5/impermanence.nix
Executable file
36
systems/aarch64-linux/pi5/impermanence.nix
Executable file
@@ -0,0 +1,36 @@
|
||||
{ ... }:
|
||||
{
|
||||
# Set up impernance configuration for things like bluetooth
|
||||
# In this configuration with /etc and /var/log being persistent, only directories outside of that need to be done here. See hardware configuration for all mountpoints.
|
||||
|
||||
environment.persistence."/nix/persist/system" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/var/lib/bluetooth"
|
||||
"/var/lib/nixos"
|
||||
"/var/lib/libvirt"
|
||||
"/var/lib/systemd/coredump"
|
||||
{
|
||||
directory = "/var/lib/private";
|
||||
mode = "u=rwx,g=,o=";
|
||||
}
|
||||
"/etc/NetworkManager/system-connections"
|
||||
{
|
||||
directory = "/etc/nix";
|
||||
user = "root";
|
||||
group = "root";
|
||||
mode = "u=rwx,g=rx,o=rx";
|
||||
}
|
||||
];
|
||||
# files = [
|
||||
# "/etc/machine-id"
|
||||
# { file = "/etc/nix/id_rsa"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
|
||||
# ];
|
||||
};
|
||||
|
||||
security.sudo.extraConfig = ''
|
||||
# rollback results in sudo lectures after each reboot
|
||||
Defaults lecture = never
|
||||
'';
|
||||
|
||||
}
|
||||
54
systems/aarch64-linux/pi5/networking.nix
Executable file
54
systems/aarch64-linux/pi5/networking.nix
Executable file
@@ -0,0 +1,54 @@
|
||||
{ lib, config, ... }:
|
||||
let
|
||||
hostname = "pi5";
|
||||
in
|
||||
{
|
||||
# Networking configs
|
||||
networking = {
|
||||
hostName = hostname;
|
||||
|
||||
defaultGateway.address = "10.0.1.1";
|
||||
nameservers = [ "10.0.1.1" ];
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
};
|
||||
|
||||
# Enable Network Manager
|
||||
networkmanager = {
|
||||
enable = lib.mkDefault true;
|
||||
wifi.powersave = lib.mkDefault false;
|
||||
settings.connectivity.uri = lib.mkDefault "http://nmcheck.gnome.org/check_network_status.txt";
|
||||
ensureProfiles = {
|
||||
environmentFiles = [
|
||||
config.sops.secrets.wifi.path
|
||||
];
|
||||
|
||||
profiles = {
|
||||
"Joey's Jungle 5G" = {
|
||||
connection = {
|
||||
id = "Joey's Jungle 5G";
|
||||
type = "wifi";
|
||||
};
|
||||
ipv4 = {
|
||||
method = "auto";
|
||||
};
|
||||
ipv6 = {
|
||||
addr-gen-mode = "stable-privacy";
|
||||
method = "auto";
|
||||
};
|
||||
wifi = {
|
||||
mode = "infrastructure";
|
||||
ssid = "Joey's Jungle 5G";
|
||||
};
|
||||
wifi-security = {
|
||||
key-mgmt = "sae";
|
||||
psk = "$PSK";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
16
systems/aarch64-linux/pi5/services.nix
Normal file
16
systems/aarch64-linux/pi5/services.nix
Normal file
@@ -0,0 +1,16 @@
|
||||
{ ... }:
|
||||
{
|
||||
services = {
|
||||
xserver.desktopManager.gnome.enable = true;
|
||||
|
||||
shairport-sync = {
|
||||
enable = false;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
general = {
|
||||
name = "Living Room Speakers";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
60
systems/aarch64-linux/pi5/sops.nix
Executable file
60
systems/aarch64-linux/pi5/sops.nix
Executable file
@@ -0,0 +1,60 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
user = "matt";
|
||||
in
|
||||
{
|
||||
sops = {
|
||||
defaultSopsFile = ../../secrets/pi5-secrets.yaml;
|
||||
# age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.keyFile = "/home/matt/.config/sops/age/keys.txt";
|
||||
|
||||
# ------------------------------
|
||||
# Secrets
|
||||
# ------------------------------
|
||||
secrets = {
|
||||
"wifi" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
};
|
||||
"pi5/matt-password" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
};
|
||||
|
||||
# ------------------------------
|
||||
# SSH keys
|
||||
# ------------------------------
|
||||
|
||||
"ssh-keys-public/pi5" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
mode = "0644";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"ssh-keys-private/pi5" = {
|
||||
sopsFile = ../../secrets/secrets.yaml;
|
||||
mode = "0600";
|
||||
owner = config.users.users."${user}".name;
|
||||
group = config.users.users."${user}".group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
|
||||
"pi5/sys-public-key" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users.root.name;
|
||||
group = config.users.users.root.group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
"pi5/sys-priv-key" = {
|
||||
neededForUsers = true;
|
||||
mode = "0600";
|
||||
owner = config.users.users.root.name;
|
||||
group = config.users.users.root.group;
|
||||
restartUnits = [ "sshd.service" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user