summary refs log tree commit diff
path: root/nixos.org
blob: 0c25153a9ba1529c38ea010d9b1823fb8276ad06 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
#+TITLE:Nixos Config
#+AUTHOR: Crazazy
#+INCLUDE: ./style.org
For now this is the way I'm configuring nixos. There is no flakes here, just a configuration.nix and a bunch of other
stuff
* Prefix
  The nixos config is going to consist of a bunch of "imports" which are just a bunch of configs
  in the imports part of the main configuration. Then we can put each part of said config on its own source block
  This does require a bit of a prefix, that lets us access packages, existing configuration and library functions
  #+begin_src nix :tangle configuration.nix :noweb no-export :padline no
    { config, lib, pkgs, ... }:
    let
      sources = import ./nix/sources.nix;
      nur = import sources.NUR { inherit pkgs; };
      nurModules = import sources.NUR { };
    in
    {
      imports = [
        <<nixos-config>>
      ];
    }
  #+end_src
* Configuration
** Hardware
   Normal nixos installation comes with a hardware-configuration file. we are not going to add the contents of that
   file here ourself, but instead add it as an external module. This is the only place where we'll do this
   #+begin_src nix :noweb-ref nixos-config :tangle no
     ./hardware-configuration.nix
   #+end_src
** personal stuff
   First, some personal stuff, so that I can tel people my computer is mine
   #+begin_src nix :noweb-ref nixos-config :tangle no
     {
       options.mainUser = with lib; mkOption {
         type = types.str;
         default = builtins.getEnv "USER";
       };
     }
   #+end_src

   and then the actual info:
   #+begin_src nix :noweb-ref nixos-config :tangle no
     {
       mainUser = "erik";
       networking.hostName = "RACEMONSTER";
       time.timeZone = "Europe/Amsterdam";
     }
   #+end_src
** Main user config
   This sets up a (secret) default password for the main user and also sets some default groups
   #+begin_src nix :noweb-ref nixos-config :tangle no
     {
       users.mutableUsers = false;
       # Define a user account. Don't forget to set a password with ‘passwd’.
       users.users.${config.mainUser} = {
         initialHashedPassword = "$6$XTH/sALyqg$G.bMWemErh4KGCAjUfT16DL96QMn/4NTmxlw6Z26wUVJn.tagQG.Fzmrz7uPkdiWZbBBFWP36.YA4hw9AcL8Q1";
         isNormalUser = true;
         extraGroups = [ "video" "wheel" "NetworkManager" ]; # Enable ‘sudo’ for the user.
         # shell = pkgs.nushell;
       };
     }
   #+end_src
** Init system
   nixos is started with systemd-boot, since we don't run any other distros
   #+begin_src nix :noweb-ref nixos-config :tangle no
     {
       boot.loader.systemd-boot.enable = true;
       boot.loader.efi.canTouchEfiVariables = true;
     }
   #+end_src
** nixpkgs setup
   not much info here right now. emacs itself now refers to emacsng
   #+begin_src nix :noweb-ref nixos-config :tangle no
     {
       nix.package = pkgs.nixFlakes;
       nixpkgs.config.allowUnfree = true;
       nixpkgs.overlays = [
         (final: prev: {
           emacs = (import sources.emacs-ng).outputs.defaultPackage."x86_64-linux";
           emacsWithPackages = final.emacs.pkgs.withPackages;
         })
       ];
     }
   #+end_src
*** cachix
    Cachix and other substitute servers allow you to not have to compile things as much as you are supposed to
    We will create a small module for cachix before we put in the rest declaratively
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        options.nix.cacheAttrs = with lib; mkOption {
          type = with types; attrsOf str;
          default = {};

        };
        config = with lib; {
          nix.settings.substituters = builtins.attrNames config.nix.cacheAttrs;
          nix.settings.trusted-public-keys = builtins.attrValues config.nix.cacheAttrs;
        };
      }
    #+end_src
    With the config in hand, we can now quickly and easily declare our substitute servers
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        nix.cacheAttrs = {
          "https://crazazy.cachix.org" = "crazazy.cachix.org-1:3KaIHK26pkvd5palJH5A4Re1Hn2+GDV+aXYnftMYAm4=";
          "https://emacsng.cachix.org" = "emacsng.cachix.org-1:i7wOr4YpdRpWWtShI8bT6V7lOTnPeI7Ho6HaZegFWMI=";
          "https://ethancedwards8.cachix.org" = "ethancedwards8.cachix.org-1:YMasjqyFnDreRQ9GXmnPIshT3tYyFHE2lUiNhbyIxOc=";
          "https://nix-community.cachix.org" = "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=";
          "https://nrdxp.cachix.org" = "nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4=";
          "https://rycee.cachix.org" = "rycee.cachix.org-1:TiiXyeSk0iRlzlys4c7HiXLkP3idRf20oQ/roEUAh/A=";
        };
      }
    #+end_src
** udev binds
   I have a bindmount system so that I can easily make binds to persistent directories from my home directory
   This should prevent clutter
*** The config
    This part is quite advanced. It makes entries for filesystems and then makes a systemd service to re-assign
    generated temporary directories to the owner of the home folder
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        options = with lib; {
          homeBinds = mkOption {
            type = with types; listOf str;
            default = [ ];
            description = "Bind mounts in your home folder";
          };
          persistRoot = mkOption {
            type = types.str;
            default = "/nix/persist";
          };
        };
        config = with lib; mkIf (config.homeBinds != [ ]) {
          fileSystems = genAttrs (map (loc: "/home/${config.mainUser}/${loc}") config.homeBinds)
            (loc: {
                    device = "${config.persistRoot}${loc}";
                    fsType = "none";
                    options = [ "bind" ];
            });
          systemd.services.fix-home-perms = {
            wantedBy = [ "multi-user.target" ];
            after = map (loc: "${builtins.replaceStrings ["/"] ["-"] loc}.mount") config.homeBinds;
            serviceConfig.Type = "oneshot";
            script = "chown -R ${config.mainUser} /home/${config.mainUser}";
          };
        };
      }
    #+end_src
*** The binds
    These are the binds themselves, they change frequently
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        homeBinds = [
          ".config/keybase"
          ".local/share/keybase"
          ".ssh"
          "Desktop"
          "Documents"
          "Music"
          "Videos"
        ];
      }
    #+end_src
** Visual stuff
   I don't acutally literally live in the terminal. So we have to implement some xorg and other stuff
*** Basics
    Enable printing, sound and a good keyboard, along with x11 itself
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        # Enable CUPS to print documents.
        services.printing.enable = true;

        # Enable sound.
        sound.enable = true;
        hardware.pulseaudio.enable = true;

        # Enable the X11 windowing system.
        services.xserver.enable = true;
        services.xserver.layout = "us";
        services.xserver.xkbVariant = "altgr-intl";
        services.xserver.xkbOptions = "eurosign:e";
        # touchpad controls
        services.xserver.libinput.enable = true;
      }
    #+end_src
*** XFCE
    I have decided to be lazy and not install a fancy window manager or whatever into the system. Thats headache
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        services.xserver.displayManager.lightdm.enable = true;
        services.xserver.desktopManager.xfce.enable = true;
      }
    #+end_src
** Networking
   Some default network settings for my laptop
   #+begin_src nix :noweb-ref nixos-config :tangle no
     {
       networking.networkmanager.enable = true; # Enables wireless support via NetworkManager
     }
   #+end_src
** packages
*** Core packages
    These are the normal packages that I use for core maintenance. I use a special hardened version of firefox that takes in some addons as well
    [[https://github.com/nix-community/nur-combined/blob/master/repos/ijohanne/pkgs/firefox-hardened/default.nix][Hardened firefox source]]
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        environment.systemPackages = let
          myFirefox = with pkgs; wrapFirefox firefox-esr-unwrapped {
            nixExtensions = builtins.filter lib.isDerivation (builtins.attrValues nur.repos.crazazy.firefox-addons);

            extraPolicies = {
              CaptivePortal = false;
              DisableFirefoxStudies = true;
              DisablePocket = true;
              DisableTelemetry = true;
              DisableFirefoxAccounts = true;
              DontCheckDefaultBrowser = true;
              FirefoxHome = {
                Pocket = false;
                Snippets = false;
              };
              UserMessaging = {
                ExtensionRecommendations = false;
                SkipOnboarding = true;
              };
            };
            extraPrefs = ''
            // Show more ssl cert infos
            lockPref("security.identityblock.show_extended_validation", true);
            // Enable userchrome css
            lockPref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
            // Enable dark dev tools
            lockPref("devtools.theme","dark");
            // Misc other settings
            lockPref("extensions.autoDisableScopes", 0);
            lockPref("browser.uidensity", 1);
            lockPref("browser.search.openintab", true);
            lockPref("extensions.update.enabled", false);
            lockPref("identity.fxaccounts.enabled", false);
            lockPref("signon.rememberSignons", false);
            lockPref("signon.rememberSignons.visibilityToggle", false);
            lockPref("media.eme.enabled", true);
            lockPref("browser.eme.ui.enabled", true);
            lockPref("xpinstall.signatures.required",false);
            lockPref("browser.shell.checkDefaultBrowser", false );
          '';
          };
        in
          with pkgs; [
            gitFull
            curl
            vim
            myFirefox
            # nur.repos.crazazy.seamonkey
            (wine.override { wineBuild = "wineWow"; })
          ];
        # persistent directory for my browser details
        homeBinds = [
          ".mozilla/firefox"
        ];
      }
    #+end_src
*** Steam
    I like to play videogames sometimes, however steam also requires a little more special attention
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        imports = [
          nurModules.repos.crazazy.modules.private.steam-config
        ];
        homeBinds = [
          ".local/share/Steam"
        ];
        environment.systemPackages = with pkgs; [
          steam
        ];
      }
    #+end_src
*** Emacs
    Emacs needs to be integrated into the rest of the system. We are going to do that via a emacs daemon
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        services.emacs = {
          package = import ./emacs.nix;
          enable = true;
        };
        homeBinds = [
          ".config/emacs"
        ];
      }
    #+end_src
*** QEMU & frens
    I also sometimes run qemu vms. The qemu's manager will be libvirtd, but not sure if I will even use that
    #+begin_src nix :noweb-ref nixos-config :tangle no
      {
        virtualisation.libvirtd.enable = true;
      }
    #+end_src