summary refs log tree commit diff
path: root/nixos.org
blob: bcdb5c4ead6a3a5823a8e7cfa2ceda0191c44f3c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
#+TITLE:Nixos Config
#+AUTHOR: Crazazy
#+INCLUDE: ./style.org
For now this is the way I'm configuring nixos. There is no flakes here, just a configuration.nix and a bunch of other
stuff
* Prefix
  The nixos config is going to consist of a bunch of "imports" which are just a bunch of configs
  in the imports part of the main configuration. Then we can put each part of said config on its own source block
  This does require a bit of a prefix, that lets us access packages, existing configuration and library functions
  #+begin_src nix :tangle configuration.nix :noweb no-export :padline no
    { config, lib, pkgs, ... }:
    let
      sources = import ./nix/sources.nix;
      nur = import sources.NUR { inherit pkgs; };
      nurModules = import sources.NUR { };
    in
    {
      imports = [
        <<nixos-config>>
      ];
    }
  #+end_src
* Configuration
:PROPERTIES:
:header-args: :tangle no :noweb-ref nixos-config
:END:

** Hardware
   Normal nixos installation comes with a hardware-configuration file. we are not going to add the contents of that
   file here ourself, but instead add it as an external module. This is the only place where we'll do this
   #+begin_src nix
     ./hardware-configuration.nix
   #+end_src
   Also i want to have a full bluetooth experience
   #+begin_src nix
     {
       hardware.bluetooth = {
         enable = true;
         package = pkgs.bluez;
       };
     }
   #+end_src
** personal stuff
   First, some personal stuff, so that I can tel people my computer is mine
   #+begin_src nix
     {
       options.mainUser = with lib; mkOption {
         type = types.str;
         default = builtins.getEnv "USER";
       };
     }
   #+end_src

   and then the actual info:
   #+begin_src nix
     {
       mainUser = "erik";
       networking.hostName = "RACEMONSTER";
       time.timeZone = "Europe/Amsterdam";
     }
   #+end_src
** Main user config
   This sets up a (secret) default password for the main user and also sets some default groups
   #+begin_src nix
     {
       users.mutableUsers = false;
       # Define a user account. Don't forget to set a password with ‘passwd’.
       users.users.${config.mainUser} = {
         initialHashedPassword = "$6$XTH/sALyqg$G.bMWemErh4KGCAjUfT16DL96QMn/4NTmxlw6Z26wUVJn.tagQG.Fzmrz7uPkdiWZbBBFWP36.YA4hw9AcL8Q1";
         isNormalUser = true;
         extraGroups = [ "video" "wheel" "NetworkManager" ]; # Enable ‘sudo’ for the user.
         # shell = pkgs.nushell;
       };
     }
   #+end_src
   Furthermore, I want to have some prefabs available in my $PATH if I make them
   #+begin_src nix
     {
       environment.shellInit =
         ''
          if [ -h /etc/nixos/nix-prefabs/result ]; then
           export PATH=$PATH:/etc/nixos/nix-prefabs/result/bin
          fi
         '';
     }
   #+end_src
** Init system
   nixos is started with systemd-boot, since we don't run any other distros
   #+begin_src nix
     {
       boot.loader.systemd-boot.enable = true;
       boot.loader.efi.canTouchEfiVariables = true;
     }
   #+end_src
** nixpkgs setup
   not much info here right now. emacs itself now refers to emacsng
   #+begin_src nix
     {
       nix.package = pkgs.nixVersions.stable;
       programs.nix-ld = {
         enable = true;
         # use all the libraries that AppImage uses to load an image
         libraries = with pkgs; [fuse] ++ (with appimageTools.defaultFhsEnvArgs; multiPkgs pkgs ++ targetPkgs pkgs);
       };
       nixpkgs.config.allowUnfree = true;
       nixpkgs.overlays = [
         (final: prev: {
           emacs = (import sources.emacs-ng).outputs.packages."x86_64-linux".default;
           emacsWithPackages = final.emacs.pkgs.withPackages;
         })
       ];
     }
   #+end_src
*** cachix
    Cachix and other substitute servers allow you to not have to compile things as much as you are supposed to
    We will create a small module for cachix before we put in the rest declaratively
    #+begin_src nix
      {
        options.nix.cacheAttrs = with lib; mkOption {
          type = with types; attrsOf str;
          default = {};

        };
        config = with lib; {
          nix.settings.substituters = builtins.attrNames config.nix.cacheAttrs;
          nix.settings.trusted-public-keys = builtins.attrValues config.nix.cacheAttrs;
        };
      }
    #+end_src
    With the config in hand, we can now quickly and easily declare our substitute servers
    #+begin_src nix
      {
        nix.cacheAttrs = {
          "https://crazazy.cachix.org" = "crazazy.cachix.org-1:3KaIHK26pkvd5palJH5A4Re1Hn2+GDV+aXYnftMYAm4=";
          "https://emacsng.cachix.org" = "emacsng.cachix.org-1:i7wOr4YpdRpWWtShI8bT6V7lOTnPeI7Ho6HaZegFWMI=";
          # "https://ethancedwards8.cachix.org" = "ethancedwards8.cachix.org-1:YMasjqyFnDreRQ9GXmnPIshT3tYyFHE2lUiNhbyIxOc=";
          "https://nix-community.cachix.org" = "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
          # "https://nrdxp.cachix.org" = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4=";
          # "https://rycee.cachix.org" = "rycee.cachix.org-1:TiiXyeSk0iRlzlys4c7HiXLkP3idRf20oQ/roEUAh/A=";
          # "https://cache.iog.io" = "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=";
        };
      }
    #+end_src
** udev binds
   I have a bindmount system so that I can easily make binds to persistent directories from my home directory
   This should prevent clutter
*** The config
    This part is quite advanced. It makes entries for filesystems and then makes a systemd service to re-assign
    generated temporary directories to the owner of the home folder
    #+begin_src nix
      {
        options = with lib; {
          homeBinds = mkOption {
            type = with types; listOf str;
            default = [ ];
            description = "Bind mounts in your home folder";
          };
          persistRoot = mkOption {
            type = types.str;
            default = "/nix/persist";
          };
        };
        config = with lib; mkIf (config.homeBinds != [ ]) {
          fileSystems = genAttrs (map (loc: "/home/${config.mainUser}/${loc}") config.homeBinds)
            (loc: {
                    device = "${config.persistRoot}${loc}";
                    fsType = "none";
                    options = [ "bind" ];
            });
          systemd.services.fix-home-perms = {
            wantedBy = [ "multi-user.target" ];
            after = map (loc: "${builtins.replaceStrings ["/"] ["-"] loc}.mount") config.homeBinds;
            serviceConfig.Type = "oneshot";
            script = "chown -R ${config.mainUser} /home/${config.mainUser}";
          };
        };
      }
    #+end_src
*** The binds
    These are the binds themselves, they change frequently
    #+begin_src nix
      {
        homeBinds = [
          ".config/keybase"
          ".local/share/keybase"
          ".ssh"
          "Desktop"
          "Documents/uni-docs"
          "Documents/IdeaProjects"
          "Documents/java-jars"
          "Documents/notes"
          "Music"
          "Videos"
        ];
      }
    #+end_src
** Visual stuff
   I don't acutally literally live in the terminal. So we have to implement some xorg and other stuff
*** Basics
    Enable printing, sound and a good keyboard, along with x11 itself
    #+begin_src nix
      {
        # Enable CUPS to print documents.
        services.printing.enable = true;

        # Enable sound.
        sound.enable = true;
        hardware.pulseaudio.enable = true;

        # Enable the X11 windowing system.
        services.xserver.enable = true;
        services.xserver.layout = "us";
        services.xserver.xkbVariant = "altgr-intl";
        services.xserver.xkbOptions = "eurosign:e";
        # touchpad controls
        services.xserver.libinput.enable = true;
      }
    #+end_src
*** KDE
    I have decided to be lazy and not install a fancy window manager or whatever into the system. Thats headache
    #+begin_src nix
      {
        services.xserver.displayManager.sddm.enable = true;
        services.xserver.desktopManager.plasma5.enable = true;
      }
    #+end_src
** Networking
   Some default network settings for my laptop
   #+begin_src nix
     {
       networking.networkmanager.enable = true; # Enables wireless support via NetworkManager
     }
   #+end_src
** packages
*** Core packages
    These are the normal packages that I use for core maintenance. I use a special hardened version of firefox that takes in some addons as well
    [[https://github.com/nix-community/nur-combined/blob/master/repos/ijohanne/pkgs/firefox-hardened/default.nix][Hardened firefox source]]
    #+begin_src nix
      {
        environment.systemPackages = let
          myFirefox = with pkgs; wrapFirefox firefox-esr-unwrapped {
            nixExtensions = builtins.filter lib.isDerivation (builtins.attrValues nur.repos.crazazy.firefox-addons);

            extraPolicies = {
              CaptivePortal = false;
              DisableFirefoxStudies = true;
              DisablePocket = true;
              DisableTelemetry = true;
              DisableFirefoxAccounts = true;
              DontCheckDefaultBrowser = true;
              FirefoxHome = {
                Pocket = false;
                Snippets = false;
              };
              UserMessaging = {
                ExtensionRecommendations = false;
                SkipOnboarding = true;
              };
            };
            extraPrefs = ''
            // Show more ssl cert infos
            lockPref("security.identityblock.show_extended_validation", true);
            // Enable userchrome css
            lockPref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
            // Enable light dev tools
            lockPref("devtools.theme","light");
            // Misc other settings
            lockPref("extensions.autoDisableScopes", 0);
            lockPref("browser.uidensity", 1);
            lockPref("browser.search.openintab", true);
            lockPref("extensions.update.enabled", false);
            lockPref("identity.fxaccounts.enabled", false);
            lockPref("signon.rememberSignons", false);
            lockPref("signon.rememberSignons.visibilityToggle", false);
            lockPref("media.eme.enabled", true);
            lockPref("browser.eme.ui.enabled", true);
            lockPref("xpinstall.signatures.required",false);
            lockPref("browser.shell.checkDefaultBrowser", false );
          '';
          };
        in
          with pkgs; [
            bun
            # compcert
            curl
            # deno
            discord
            gitFull
            graalvm17-ce
            libreoffice
            mpv
            # nur.repos.crazazy.seamonkey
            myFirefox
            unzip zip
            vim
            (wine.override { wineBuild = "wineWow"; })
          ];
        # persistent directory for my browser details
        homeBinds = [
          ".mozilla/firefox"
          ".config/discord"
          ".wine"
        ];
      }
    #+end_src
*** Steam
    I like to play videogames sometimes, however steam also requires a little more special attention
    #+begin_src nix
      {
        imports = [
          nurModules.repos.crazazy.modules.private.steam-config
        ];
        homeBinds = [
          ".local/share/Steam"
        ];
        environment.systemPackages = with pkgs; [
          steam
        ];
      }
    #+end_src
*** Emacs
    Emacs needs to be integrated into the rest of the system. We are going to do that via a emacs daemon
    #+begin_src nix
      {
        services.emacs = {
          package = import ./emacs.nix;
          defaultEditor = true;
          enable = true;
        };
        homeBinds = [
          # ".config/emacs"
        ];
      }
    #+end_src
*** QEMU & frens
    I also sometimes run qemu vms. The qemu's manager will be libvirtd, but not sure if I will even use that
    #+begin_src nix
      {
        virtualisation.libvirtd.enable = true;
      }
    #+end_src