From 2f65730e2e06757d67098d5911fb983c50f88c5b Mon Sep 17 00:00:00 2001 From: Maaz Khokhar Date: Sun, 21 Jun 2026 20:13:58 -0500 Subject: [PATCH] might work might now idk --- .vscode/settings.json | 3 ++ flake.lock | 68 ++++++++++++++++++++++++ flake.nix | 52 ++++++++++++++++++ home/default.nix | 0 hosts/laptop/configuration.nix | 96 ++++++++++++++++++++++++++++++++++ hosts/laptop/disko.nix | 72 +++++++++++++++++++++++++ 6 files changed, 291 insertions(+) create mode 100644 .vscode/settings.json create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 home/default.nix create mode 100644 hosts/laptop/configuration.nix create mode 100644 hosts/laptop/disko.nix diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..a8b67ce --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,3 @@ +{ + "cSpell.enabled": false +} diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..54e8e64 --- /dev/null +++ b/flake.lock @@ -0,0 +1,68 @@ +{ + "nodes": { + "disko": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1781152676, + "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=", + "owner": "nix-community", + "repo": "disko", + "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "disko", + "type": "github" + } + }, + "home-manager": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782051614, + "narHash": "sha256-xBRAhYLEXcjp8hM2tkkTTLb6PWU7VDxDoogl25g7Ezs=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "d1ccd0721ec599866622665f3651e19e6e2d4c6a", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1781577229, + "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-unstable", + "type": "indirect" + } + }, + "root": { + "inputs": { + "disko": "disko", + "home-manager": "home-manager", + "nixpkgs": "nixpkgs" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..e3b918f --- /dev/null +++ b/flake.nix @@ -0,0 +1,52 @@ +{ + inputs = { + nixpkgs.url = "nixpkgs/nixos-unstable"; + + disko = { + url = "github:nix-community/disko"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + + home-manager = { + url = "github:nix-community/home-manager"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; + + outputs = + { + self, + nixpkgs, + disko, + home-manager, + ... + }: + let + system = "x86_64-linux"; + in + { + nixosConfigurations.laptop = nixpkgs.lib.nixosSystem { + inherit system; + + specialArgs = { + disk = "/dev/disk/by-id/REPLACE_ME"; # 👈 change at install time + }; + + modules = [ + disko.nixosModules.disko + + ./hosts/laptop/disko.nix + ./hosts/laptop/configuration.nix + + home-manager.nixosModules.home-manager + + { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + + home-manager.users.river = import ./home; + } + ]; + }; + }; +} diff --git a/home/default.nix b/home/default.nix new file mode 100644 index 0000000..e69de29 diff --git a/hosts/laptop/configuration.nix b/hosts/laptop/configuration.nix new file mode 100644 index 0000000..e7303d4 --- /dev/null +++ b/hosts/laptop/configuration.nix @@ -0,0 +1,96 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./hardware-configuration.nix + ./disko.nix + ]; + + boot = { + supportedFilesystems = [ "zfs" ]; + loader = { + initrd = { + systemd.enable = true; + + luks.devices."cryptroot" = { + device = "/dev/disk/by-partlabel/luks"; + allowDiscards = true; + }; + + initrd.availableKernelModules = [ + "tpm_tis" + "tpm_crb" + ]; + }; + efi.canTouchEfiVariables = true; + }; + kernelModules = [ + "tpm_tis" + "tpm_crb" + ]; + }; + + security = { + tpm2.enable = true; + sudo.wheelNeedsPassword = false; + }; + + networking = { + hostName = "laptop"; + networkmanager.enable = true; + + firewall = { + enable = true; + + allowPing = true; + + allowedTCPPorts = [ 22 80 ]; + allowedUDPPorts = [ 51820 ]; + } + }; + + time.timeZone = "America/Chicago"; + + services.zfs.autoScrub.enable = true; + services.zfs.autoSnapshot.enable = true; + + networking.hostId = "8425e349"; + + users.users.river = { + isNormalUser = true; + extraGroups = [ + "wheel" + "networkmanager" + "podman" + ]; + }; + + environment.systemPackages = with pkgs; [ + git + neovim + btop + unzip + tpm2-tools + ]; + + nix.gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 7d"; + }; + + nix.settings.auto-optimise-store = true; + + services.openssh = { + enable = true; + settings.PermitRootLogin = "no"; + }; + + services.pipewire = { + enable = true; + pulse.enable = true; + alsa.enable = true; + }; + + system.stateVersion = "26.05"; +} diff --git a/hosts/laptop/disko.nix b/hosts/laptop/disko.nix new file mode 100644 index 0000000..29d5a3d --- /dev/null +++ b/hosts/laptop/disko.nix @@ -0,0 +1,72 @@ +{ disk, ... }: + +{ + disko.devices.disk.main = { + type = "disk"; + device = disk; + content = { + type = "gpt"; + + partitions = { + ESP = { + size = "1G"; + type = "EF00"; + + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + + luks = { + size = "100%"; + + content = { + type = "luks"; + name = "cryptroot"; + + # important: allow TPM-based unlocking + settings = { + allowDiscards = true; + }; + + # this is key for TPM workflows + initrdUnlock = true; + + content = { + type = "zfs"; + pool = "rpool"; + }; + }; + }; + }; + }; + }; + + zpool.rpool = { + type = "zpool"; + + rootFsOptions = { + compression = "zstd"; + "com.sun:auto-snapshot" = "true"; + }; + + datasets = { + root = { + type = "zfs_fs"; + mountpoint = "/"; + }; + + nix = { + type = "zfs_fs"; + mountpoint = "/nix"; + }; + + home = { + type = "zfs_fs"; + mountpoint = "/home"; + }; + }; + }; +}