265 lines
6.5 KiB
Nix
265 lines
6.5 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports =
|
|
[
|
|
<nixos-hardware/lenovo/thinkpad/t14s/amd>
|
|
/etc/nixos/hardware-configuration.nix
|
|
/etc/nixos/machine.nix
|
|
/etc/nixos/wifi.nix
|
|
];
|
|
|
|
system.stateVersion = "22.05";
|
|
nix.autoOptimiseStore = true;
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.initrd.luks.reusePassphrases = true;
|
|
boot.kernelModules = [ "kvm-amd" "v4l2loopback" ];
|
|
boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
|
|
boot.extraModprobeConfig = ''
|
|
options v4l2loopback devices=2 video_nr=8,9 card_label="Wayland 8,Wayland 9" exclusive_caps=1
|
|
'';
|
|
|
|
boot.kernel.sysctl = {
|
|
"fs.inotify.max_user_watches" = "1310720";
|
|
"fs.inotify.max_user_instances" = "8192";
|
|
};
|
|
boot.loader.systemd-boot.enable = false;
|
|
boot.loader.grub = {
|
|
enable = true;
|
|
version = 2;
|
|
device = "nodev";
|
|
efiSupport = true;
|
|
enableCryptodisk = true;
|
|
};
|
|
|
|
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
|
|
|
networking = {
|
|
useDHCP = false;
|
|
networkmanager.enable = false;
|
|
useNetworkd = true;
|
|
firewall.allowedTCPPorts = [ 22 ];
|
|
wireless = {
|
|
enable = true;
|
|
userControlled.enable = true;
|
|
};
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
wait-online.anyInterface = true;
|
|
|
|
networks = {
|
|
"100-ethernet" = {
|
|
matchConfig.Name = "ethernet";
|
|
DHCP = "yes";
|
|
networkConfig = {
|
|
IPv6AcceptRA = true;
|
|
LinkLocalAddressing = "yes";
|
|
};
|
|
dhcpConfig = {
|
|
UseDomains = true;
|
|
UseDNS = true;
|
|
};
|
|
};
|
|
|
|
"100-dorhamm-docking" = {
|
|
matchConfig.Name = "dorhamm-docking";
|
|
DHCP = "yes";
|
|
networkConfig = {
|
|
IPv6AcceptRA = true;
|
|
LinkLocalAddressing = "yes";
|
|
};
|
|
dhcpConfig = {
|
|
UseDomains = true;
|
|
UseDNS = true;
|
|
};
|
|
};
|
|
|
|
"100-wifi" = {
|
|
matchConfig.Name = "wifi";
|
|
DHCP = "yes";
|
|
networkConfig = {
|
|
IPv6AcceptRA = true;
|
|
LinkLocalAddressing = "yes";
|
|
};
|
|
dhcpConfig = {
|
|
UseDomains = true;
|
|
UseDNS = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
programs.zsh.enable = true;
|
|
programs.sway.enable = true;
|
|
programs.light.enable = true;
|
|
programs.fish.enable = true;
|
|
|
|
users.defaultUserShell = pkgs.fish;
|
|
users.extraUsers.bascht = {
|
|
isNormalUser = true;
|
|
shell = pkgs.fish;
|
|
extraGroups = [ "audio" "video" "networkmanager" "systemd-network" "storage" "wheel" "disk" "plugdev" "docker" ];
|
|
};
|
|
|
|
security.doas.enable = true;
|
|
|
|
security.doas.extraRules = [{
|
|
users = [ "bascht" ];
|
|
keepEnv = true;
|
|
persist = true;
|
|
}{
|
|
users = [ "bascht" ];
|
|
keepEnv = true;
|
|
noPass = true;
|
|
cmd = "/run/current-system/sw/bin/openvpn";
|
|
}{
|
|
}{
|
|
users = [ "bascht" ];
|
|
keepEnv = true;
|
|
noPass = true;
|
|
cmd = "/run/current-system/sw/bin/cryptsetup";
|
|
}{
|
|
users = [ "bascht" ];
|
|
noPass = true;
|
|
cmd = "/run/current-system/sw/bin/systemctl";
|
|
args = ["suspend"];
|
|
}{
|
|
users = [ "bascht" ];
|
|
noPass = true;
|
|
cmd = "/run/current-system/sw/bin/cryptsetup";
|
|
args = ["luksOpen" "/dev/disk/by-partlabel/Gulasch" "Gulasch"];
|
|
}{
|
|
users = [ "bascht" ];
|
|
noPass = true;
|
|
cmd = "/run/wrappers/bin/mount";
|
|
args = ["/dev/mapper/Gulasch" "/mnt/Gulasch"];
|
|
}];
|
|
security.pam.loginLimits = [
|
|
{ domain = "@users"; item = "nofile"; type = "soft"; value = "8192"; }
|
|
];
|
|
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
console = {
|
|
packages = [ pkgs.terminus_font ];
|
|
font = "${pkgs.terminus_font}/share/consolefonts/ter-v12n.psf.gz";
|
|
colors = [
|
|
"3B4252"
|
|
"BF616A"
|
|
"A3BE8C"
|
|
"EBCB8B"
|
|
"81A1C1"
|
|
"B48EAD"
|
|
"88C0D0"
|
|
"E5E9F0"
|
|
"4C566A"
|
|
"BF616A"
|
|
"A3BE8C"
|
|
"EBCB8B"
|
|
"81A1C1"
|
|
"B48EAD"
|
|
"8FBCBB"
|
|
"ECEFF4"
|
|
];
|
|
earlySetup = true;
|
|
keyMap = "de-latin1-nodeadkeys";
|
|
};
|
|
|
|
services.devmon.enable = true;
|
|
services.pipewire.enable = true;
|
|
services.printing.drivers = [ pkgs.brgenml1cupswrapper ];
|
|
services.printing.enable = true;
|
|
services.udev.packages = [ pkgs.yubikey-personalization ];
|
|
services.udisks2.enable = true;
|
|
services.xserver.enable = false;
|
|
services.xserver.libinput.enable = true;
|
|
services.pcscd.enable = true;
|
|
services.openssh.enable = true;
|
|
services.upower.enable = true;
|
|
services.fwupd.enable = true;
|
|
|
|
sound.enable = true;
|
|
hardware.keyboard.zsa.enable = true;
|
|
hardware.logitech.wireless.enable = true;
|
|
hardware.logitech.wireless.enableGraphical = true;
|
|
hardware.ledger.enable = true;
|
|
|
|
hardware.pulseaudio.enable = true;
|
|
hardware.enableAllFirmware = true;
|
|
hardware.opengl = {
|
|
enable = true;
|
|
driSupport = true;
|
|
};
|
|
|
|
services.udev.extraRules = ''
|
|
ACTION=="remove", ATTRS{idVendor}=="3297", RUN+="${pkgs.su}/bin/su bascht --shell ${pkgs.bash}/bin/bash /home/bascht/bin/thinkpad-dock", OWNER="bascht"
|
|
ACTION=="add", ATTRS{idVendor}=="3297", RUN+="${pkgs.su}/bin/su bascht --shell ${pkgs.bash}/bin/bash /home/bascht/bin/thinkpad-dock", OWNER="bascht"
|
|
'' + builtins.readFile /etc/nixos/machine-udev-network.rules;
|
|
|
|
nixpkgs.config.joypixels.acceptLicense = true;
|
|
|
|
fonts = {
|
|
enableDefaultFonts = false;
|
|
fonts = with pkgs; [
|
|
font-awesome
|
|
twitter-color-emoji
|
|
jetbrains-mono
|
|
fira
|
|
mononoki
|
|
fira-mono
|
|
fira-code
|
|
fantasque-sans-mono
|
|
medio
|
|
terminus_font
|
|
ibm-plex
|
|
iosevka
|
|
roboto
|
|
roboto-mono
|
|
joypixels
|
|
(iosevka-bin.override { variant = "aile"; })
|
|
(iosevka-bin.override { variant = "etoile"; })
|
|
(nerdfonts.override { fonts = [ "JetBrainsMono" "IBMPlexMono" "Iosevka" ]; }) ];
|
|
fontconfig.enable = true;
|
|
fontconfig.defaultFonts = {
|
|
emoji = lib.mkBefore [ "Joypixels" "Noto Color Emoji" ];
|
|
monospace = lib.mkBefore [ "IBM Plex Mono" "JetBrains Mono" ];
|
|
serif = lib.mkBefore [ "Iosevka Etoile" ];
|
|
sansSerif = lib.mkBefore [ "Iosevka Aile" ];
|
|
};
|
|
};
|
|
|
|
nix.trustedUsers = [ "root" "bascht" ];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
home-manager
|
|
wget
|
|
curl
|
|
vim
|
|
git
|
|
cachix
|
|
linuxPackages.v4l2loopback
|
|
wireguard-tools
|
|
openvpn
|
|
openssl
|
|
ledger-udev-rules
|
|
];
|
|
|
|
virtualisation = {
|
|
docker.enable = true;
|
|
podman = {
|
|
enable = true;
|
|
dockerCompat = false;
|
|
};
|
|
};
|
|
}
|