mirror of
https://github.com/girlbossceo/nixos-config.git
synced 2025-04-29 05:59:26 -04:00
initial configs
Signed-off-by: June Clementine Strawberry <strawberry@puppygock.gay>
This commit is contained in:
June Clementine Strawberry
parent
a05812d606
commit
d8453cf238
6 changed files with 624 additions and 0 deletions
5
.gitignore
vendored
Normal file
5
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
*~
|
||||||
|
|
||||||
|
secrets.nix
|
||||||
|
|
||||||
|
.DS_Store
|
||||||
5
README.md
Normal file
5
README.md
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
# nixos config for my twinkpad t495
|
||||||
|
|
||||||
|
dont bully me i know my config sucks
|
||||||
|
|
||||||
|
also i use flakes
|
||||||
412
configuration.nix
Normal file
412
configuration.nix
Normal file
|
|
@ -0,0 +1,412 @@
|
||||||
|
# Edit this configuration file to define what should be installed on
|
||||||
|
# your system. Help is available in the configuration.nix(5) man page
|
||||||
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||||
|
|
||||||
|
# To rebuild/apply changes, run `sudo nixos-rebuild switch --flake .`
|
||||||
|
# To update, run `nix flake update`
|
||||||
|
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# Bootloader.
|
||||||
|
boot.loader.systemd-boot.enable = true;
|
||||||
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
|
networking.hostName = "strawberry"; # Define your hostname.
|
||||||
|
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||||
|
|
||||||
|
# Configure network proxy if necessary
|
||||||
|
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||||
|
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||||
|
|
||||||
|
# Enable networking
|
||||||
|
networking.networkmanager.enable = true;
|
||||||
|
|
||||||
|
# Set your time zone.
|
||||||
|
time.timeZone = "America/New_York";
|
||||||
|
|
||||||
|
# Select internationalisation properties.
|
||||||
|
i18n.defaultLocale = "en_US.UTF-8";
|
||||||
|
|
||||||
|
i18n.extraLocaleSettings = {
|
||||||
|
LC_ADDRESS = "en_US.UTF-8";
|
||||||
|
LC_IDENTIFICATION = "en_US.UTF-8";
|
||||||
|
LC_MEASUREMENT = "en_US.UTF-8";
|
||||||
|
LC_MONETARY = "en_US.UTF-8";
|
||||||
|
LC_NAME = "en_US.UTF-8";
|
||||||
|
LC_NUMERIC = "en_US.UTF-8";
|
||||||
|
LC_PAPER = "en_US.UTF-8";
|
||||||
|
LC_TELEPHONE = "en_US.UTF-8";
|
||||||
|
LC_TIME = "en_US.UTF-8";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable the X11 windowing system.
|
||||||
|
# You can disable this if you're only using the Wayland session.
|
||||||
|
# services.xserver.enable = true;
|
||||||
|
|
||||||
|
# Enable the KDE Plasma Desktop Environment.
|
||||||
|
services.displayManager.sddm.enable = true;
|
||||||
|
services.displayManager.sddm.wayland.enable = true;
|
||||||
|
services.desktopManager.plasma6.enable = true;
|
||||||
|
|
||||||
|
services.tailscale.enable = true;
|
||||||
|
# disable MagicDNS
|
||||||
|
services.tailscale.extraUpFlags = [ "--accept-dns=false" ];
|
||||||
|
|
||||||
|
services.nextdns.enable = true;
|
||||||
|
services.nextdns.arguments = [
|
||||||
|
"-cache-size=20MB"
|
||||||
|
"-profile=6ae877"
|
||||||
|
];
|
||||||
|
services.fwupd.enable = true;
|
||||||
|
services.fstrim.enable = true;
|
||||||
|
|
||||||
|
# Configure keymap in X11
|
||||||
|
services.xserver.xkb = {
|
||||||
|
layout = "us";
|
||||||
|
variant = "";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable CUPS to print documents.
|
||||||
|
services.printing.enable = true;
|
||||||
|
|
||||||
|
# Enable sound with pipewire.
|
||||||
|
hardware.pulseaudio.enable = false;
|
||||||
|
security.rtkit.enable = true;
|
||||||
|
services.pipewire = {
|
||||||
|
enable = true;
|
||||||
|
alsa.enable = true;
|
||||||
|
alsa.support32Bit = true;
|
||||||
|
pulse.enable = true;
|
||||||
|
# If you want to use JACK applications, uncomment this
|
||||||
|
#jack.enable = true;
|
||||||
|
|
||||||
|
# use the example session manager (no others are packaged yet so this is enabled by default,
|
||||||
|
# no need to redefine it in your config for now)
|
||||||
|
#media-session.enable = true;
|
||||||
|
};
|
||||||
|
# bluetooth audio improvements; i have sony xm4s
|
||||||
|
services.pipewire.wireplumber.extraConfig.bluetoothEnhancements = {
|
||||||
|
"monitor.bluez.properties" = {
|
||||||
|
"bluez5.enable-sbc-xq" = true;
|
||||||
|
"bluez5.enable-msbc" = true;
|
||||||
|
"bluez5.enable-hw-volume" = true;
|
||||||
|
"bluez5.roles" = [ "hsp_hs" "hsp_ag" "hfp_hf" "hfp_ag" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
# Enable touchpad support (enabled default in most desktopManager).
|
||||||
|
# services.xserver.libinput.enable = true;
|
||||||
|
|
||||||
|
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||||
|
users.users.adm-clementine = {
|
||||||
|
isNormalUser = true;
|
||||||
|
description = "June Clementine Strawberry";
|
||||||
|
extraGroups = [ "networkmanager" "wheel" "audio" "adbusers" ];
|
||||||
|
packages = with pkgs; [
|
||||||
|
kdePackages.kate
|
||||||
|
# thunderbird
|
||||||
|
];
|
||||||
|
shell = pkgs.zsh;
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.sessionVariables = rec {
|
||||||
|
RUSTC_WRAPPER = "sccache";
|
||||||
|
SCCACHE_BUCKET = "sccache";
|
||||||
|
SCCACHE_REGION = "garage";
|
||||||
|
SCCACHE_ENDPOINT = "https://sccache.s3.garage.kennel.girlcock.ceo";
|
||||||
|
SCCACHE_ALLOW_CORE_DUMPS = "true";
|
||||||
|
SCCACHE_S3_USE_SSL = "true";
|
||||||
|
SCCACHE_CACHE_MULTIARCH = "true";
|
||||||
|
SCCACHE_LOG = "warn";
|
||||||
|
AWS_DEFAULT_REGION = "garage";
|
||||||
|
AWS_ENDPOINT_URL = "https://s3.garage.kennel.girlcock.ceo";
|
||||||
|
ATTIC_ENDPOINT = "https://attic.kennel.juneis.dog/conduwuit";
|
||||||
|
|
||||||
|
# TODO: how to add these in here safely for committing to git
|
||||||
|
#AWS_ACCESS_KEY_ID = "";
|
||||||
|
#AWS_SECRET_ACCESS_KEY= "";
|
||||||
|
#ATTIC_TOKEN = "";
|
||||||
|
|
||||||
|
GOPATH = "$HOME/go";
|
||||||
|
LIBCLANG_PATH = "${pkgs.llvmPackages_19.libclang.lib}/lib";
|
||||||
|
|
||||||
|
XDG_CACHE_HOME = "$HOME/.cache";
|
||||||
|
XDG_CONFIG_HOME = "$HOME/.config";
|
||||||
|
XDG_DATA_HOME = "$HOME/.local/share";
|
||||||
|
XDG_STATE_HOME = "$HOME/.local/state";
|
||||||
|
# not official
|
||||||
|
XDG_BIN_HOME = "$HOME/.local/bin";
|
||||||
|
PATH = [
|
||||||
|
"${GOPATH}/bin"
|
||||||
|
"${XDG_BIN_HOME}"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Install firefox.
|
||||||
|
programs.firefox.enable = true;
|
||||||
|
|
||||||
|
# fuck
|
||||||
|
programs.thefuck.enable = true;
|
||||||
|
|
||||||
|
programs.kdeconnect.enable = true;
|
||||||
|
|
||||||
|
programs.git.enable = true;
|
||||||
|
programs.git.lfs.enable = true;
|
||||||
|
programs.git.prompt.enable = true;
|
||||||
|
programs.git.config = [
|
||||||
|
{
|
||||||
|
init = { defaultBranch = "main"; };
|
||||||
|
url = {
|
||||||
|
"https://github.com/" = {
|
||||||
|
insteadOf = [ "gh:" "github:" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
global = { gpgsign = true; };
|
||||||
|
user = {
|
||||||
|
name = "June Clementine Strawberry";
|
||||||
|
email = "strawberry@puppygock.gay";
|
||||||
|
signingkey = "~/.ssh/id_ed25519";
|
||||||
|
};
|
||||||
|
core = { compression = 9; };
|
||||||
|
alias = {
|
||||||
|
# i use this for conduwuit so i can push to all my mirrors easily
|
||||||
|
pushall = "!git remote | grep -E 'origin' | xargs -L1 -P 0 git push";
|
||||||
|
fetchall = "!git remote | grep -E 'origin' | xargs -L1 -P 0 git fetch";
|
||||||
|
};
|
||||||
|
|
||||||
|
# no meme gpg pls
|
||||||
|
gpg.format = "ssh";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
programs.adb.enable = true;
|
||||||
|
|
||||||
|
# appimage support
|
||||||
|
programs.appimage = {
|
||||||
|
enable = true;
|
||||||
|
binfmt = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# Allow unfree packages
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
|
||||||
|
fonts = {
|
||||||
|
enableDefaultPackages = true;
|
||||||
|
packages = with pkgs; [
|
||||||
|
twitter-color-emoji
|
||||||
|
noto-fonts
|
||||||
|
noto-fonts-cjk-sans
|
||||||
|
noto-fonts-cjk-serif
|
||||||
|
corefonts
|
||||||
|
|
||||||
|
# woozy
|
||||||
|
monocraft
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
nix = {
|
||||||
|
# awa
|
||||||
|
package = pkgs.lix;
|
||||||
|
settings = {
|
||||||
|
experimental-features = ["nix-command" "flakes"];
|
||||||
|
substituters = [
|
||||||
|
"https://attic.kennel.juneis.dog/conduwuit"
|
||||||
|
"https://nix-community.cachix.org"
|
||||||
|
"https://aseipp-nix-cache.freetls.fastly.net"
|
||||||
|
"https://conduwuit.cachix.org"
|
||||||
|
"https://cache.lix.systems/"
|
||||||
|
"https://cache.nixos.org/"
|
||||||
|
];
|
||||||
|
trusted-public-keys = [
|
||||||
|
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
|
||||||
|
"conduwuit:BbycGUgTISsltcmH0qNjFR9dbrQNYgdIAcmViSGoVTE="
|
||||||
|
"conduwuit.cachix.org-1:MFRm6jcnfTf0jSAbmvLfhO3KBMt4px+1xaereWXp8Xg="
|
||||||
|
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# List packages installed in system profile. To search, run:
|
||||||
|
# $ nix search wget
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
p7zip
|
||||||
|
moreutils
|
||||||
|
git
|
||||||
|
pv
|
||||||
|
htop
|
||||||
|
nvme-cli
|
||||||
|
smartmontools
|
||||||
|
vscode
|
||||||
|
go
|
||||||
|
neovim
|
||||||
|
wget
|
||||||
|
curl
|
||||||
|
zip
|
||||||
|
unzip
|
||||||
|
signal-desktop
|
||||||
|
spotify
|
||||||
|
kitty
|
||||||
|
kitty-img
|
||||||
|
bitwarden-desktop
|
||||||
|
bitwarden-cli
|
||||||
|
ktailctl
|
||||||
|
nodejs_22
|
||||||
|
corepack_22
|
||||||
|
thunderbird
|
||||||
|
vesktop
|
||||||
|
hyfetch
|
||||||
|
fastfetch
|
||||||
|
nextdns
|
||||||
|
microcode-amd
|
||||||
|
nix-output-monitor
|
||||||
|
nix-fast-build
|
||||||
|
real_time_config_quick_scan
|
||||||
|
sccache
|
||||||
|
qbittorrent-enhanced
|
||||||
|
cargo-mommy # awoozy
|
||||||
|
bison
|
||||||
|
flex
|
||||||
|
fontforge
|
||||||
|
makeWrapper
|
||||||
|
pkg-config
|
||||||
|
pkgconf
|
||||||
|
libpkgconf
|
||||||
|
liburing
|
||||||
|
gcc14
|
||||||
|
gcc14Stdenv
|
||||||
|
libgcc
|
||||||
|
libiconv
|
||||||
|
clang_19
|
||||||
|
binutils
|
||||||
|
llvmPackages_19.libcxxClang
|
||||||
|
llvmPackages_19.libllvm
|
||||||
|
llvmPackages_19.stdenv
|
||||||
|
llvmPackages_19.libcxx
|
||||||
|
llvmPackages_19.libcxxStdenv
|
||||||
|
llvmPackages_19.compiler-rt
|
||||||
|
llvmPackages_19.clangUseLLVM
|
||||||
|
autoconf
|
||||||
|
automake
|
||||||
|
libtool
|
||||||
|
gnumake
|
||||||
|
awscli2
|
||||||
|
];
|
||||||
|
|
||||||
|
programs.zsh = {
|
||||||
|
enable = true;
|
||||||
|
enableCompletion = true;
|
||||||
|
autosuggestions.enable = true;
|
||||||
|
syntaxHighlighting.enable = true;
|
||||||
|
vteIntegration = true;
|
||||||
|
histSize = 10000;
|
||||||
|
|
||||||
|
shellAliases = {
|
||||||
|
lix = "nix";
|
||||||
|
grep = "grep --color=auto";
|
||||||
|
ssh = "kitten ssh";
|
||||||
|
neofetch = "hyfetch";
|
||||||
|
cargo = "cargo-mommy"; # awoozy
|
||||||
|
};
|
||||||
|
|
||||||
|
ohMyZsh = {
|
||||||
|
enable = true;
|
||||||
|
plugins = [ "git" "thefuck" "command-not-found" ];
|
||||||
|
theme = "alanpeabody";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
programs.direnv = {
|
||||||
|
enable = true;
|
||||||
|
nix-direnv.enable = true;
|
||||||
|
enableZshIntegration = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# enable nix-ld so random binaries are more likely to work
|
||||||
|
programs.nix-ld.enable = true;
|
||||||
|
programs.nix-ld.libraries = with pkgs; [
|
||||||
|
# put libraries needed by random binaries you download here
|
||||||
|
];
|
||||||
|
|
||||||
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
|
# started in user sessions.
|
||||||
|
# programs.mtr.enable = true;
|
||||||
|
# programs.gnupg.agent = {
|
||||||
|
# enable = true;
|
||||||
|
# enableSSHSupport = true;
|
||||||
|
# };
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
|
||||||
|
# we only accept ed25519 connections, so only make ed25519 hostkey
|
||||||
|
hostKeys = [
|
||||||
|
{
|
||||||
|
path = "/etc/ssh/ssh_host_ed25519_key";
|
||||||
|
type = "ed25519";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
# <https://wiki.osuosl.org/howtos/ssh_ip_qos_fix.html>
|
||||||
|
# <https://wikipedia.org/wiki/Differentiated_services>
|
||||||
|
#
|
||||||
|
# Service class: af21 Low-latency data , af11 High-throughput data
|
||||||
|
IPQoS = "af21 af11";
|
||||||
|
|
||||||
|
# we only accept modern, ed25519 key, and ChaCha20/AES-256-GCM connections
|
||||||
|
# also AES-GCM and ChaCha20 are already inherently authenticated
|
||||||
|
Macs = [ "-*" ];
|
||||||
|
KexAlgorithms = [ "sntrup761x25519-sha512@openssh.com" "curve25519-sha256" ];
|
||||||
|
PubkeyAcceptedKeyTypes = "ssh-ed25519,sk-ssh-ed25519@openssh.com";
|
||||||
|
Ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" ];
|
||||||
|
|
||||||
|
PasswordAuthentication = false;
|
||||||
|
PermitEmptyPasswords = false;
|
||||||
|
AllowUsers = [ "adm-clementine" ];
|
||||||
|
UseDns = true;
|
||||||
|
X11Forwarding = false;
|
||||||
|
PermitRootLogin = "prohibit-password";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Open ports in the firewall.
|
||||||
|
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||||
|
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||||
|
# Or disable the firewall altogether.
|
||||||
|
# networking.firewall.enable = false;
|
||||||
|
|
||||||
|
nix.settings.allowed-users = [ "@wheel" ];
|
||||||
|
security.sudo.execWheelOnly = true;
|
||||||
|
|
||||||
|
services.udev.packages = [ pkgs.android-udev-rules ];
|
||||||
|
|
||||||
|
# when can we get a realtime-privileges package in nixos so i aint gotta do allat
|
||||||
|
security.pam.loginLimits = [
|
||||||
|
{ domain = "@users"; item = "rtprio" ; type = "-" ; value = "1" ; }
|
||||||
|
{ domain = "@audio"; item = "memlock"; type = "-" ; value = "unlimited"; }
|
||||||
|
{ domain = "@audio"; item = "rtprio" ; type = "-" ; value = "99" ; }
|
||||||
|
{ domain = "@audio"; item = "nofile" ; type = "soft"; value = "99999999" ; }
|
||||||
|
{ domain = "@audio"; item = "nofile" ; type = "hard"; value = "99999999" ; }
|
||||||
|
];
|
||||||
|
services.udev.extraRules = ''
|
||||||
|
KERNEL=="rtc0", GROUP="audio"
|
||||||
|
KERNEL=="hpet", GROUP="audio"
|
||||||
|
'';
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "24.11"; # Did you read the comment?
|
||||||
|
}
|
||||||
27
flake.lock
generated
Normal file
27
flake.lock
generated
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
{
|
||||||
|
"nodes": {
|
||||||
|
"nixpkgs": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1734424634,
|
||||||
|
"narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"root": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": "nixpkgs"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"root": "root",
|
||||||
|
"version": 7
|
||||||
|
}
|
||||||
11
flake.nix
Normal file
11
flake.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
{
|
||||||
|
inputs = {
|
||||||
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||||
|
};
|
||||||
|
outputs = inputs@{ self, nixpkgs, ... }: {
|
||||||
|
nixosConfigurations.strawberry = nixpkgs.lib.nixosSystem {
|
||||||
|
system = "x86_64-linux";
|
||||||
|
modules = [ ./configuration.nix ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
164
hardware-configuration.nix
Normal file
164
hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,164 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [
|
||||||
|
"nvme"
|
||||||
|
"ehci_pci"
|
||||||
|
"xhci_pci"
|
||||||
|
"usb_storage"
|
||||||
|
"sd_mod"
|
||||||
|
"rtsx_pci_sdmmc"
|
||||||
|
# just in case, but my lsmod said these were loaded anyways
|
||||||
|
"aesni_intel"
|
||||||
|
"cryptd"
|
||||||
|
];
|
||||||
|
boot.initrd.kernelModules = [ ];
|
||||||
|
boot.kernelModules = [ "kvm-amd" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/a24c5ca6-aa90-4985-b598-28dd07b5f12e";
|
||||||
|
fsType = "ext4";
|
||||||
|
options = [
|
||||||
|
# asynchronously flushes commit blocks to disk without waiting for descriptor block to be written.
|
||||||
|
# improves i/o perf
|
||||||
|
#
|
||||||
|
# must use data=writeback or data=journal
|
||||||
|
#
|
||||||
|
# this will prevent this drive being mounted on ancient kernels.
|
||||||
|
"journal_async_commit"
|
||||||
|
# highest safety guarantees, and theoretically higher throughput
|
||||||
|
"data=writeback"
|
||||||
|
# im on a laptop so 5 -> 15 second commit is fine
|
||||||
|
"commit=15"
|
||||||
|
# forcefully fsync()'s file replacements if not done by the bad application
|
||||||
|
"auto_da_alloc"
|
||||||
|
# 64-bit inode version support
|
||||||
|
"i_version"
|
||||||
|
# journal checksumming for e2fsck recovery support
|
||||||
|
# internally enabled if using journal_async_commit
|
||||||
|
"journal_checksum"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/nix/store" =
|
||||||
|
{ device = "/dev/disk/by-uuid/a24c5ca6-aa90-4985-b598-28dd07b5f12e";
|
||||||
|
fsType = "ext4";
|
||||||
|
options = [
|
||||||
|
# bind mount because this is under / already
|
||||||
|
"bind"
|
||||||
|
# /nix/store is I/O heavy and doesn't need access times
|
||||||
|
"noatime"
|
||||||
|
# nix default
|
||||||
|
"ro"
|
||||||
|
# asynchronously flushes commit blocks to disk without waiting for descriptor block to be written.
|
||||||
|
# improves i/o perf
|
||||||
|
#
|
||||||
|
# must use data=writeback or data=journal
|
||||||
|
#
|
||||||
|
# this will prevent this drive being mounted on ancient kernels.
|
||||||
|
"journal_async_commit"
|
||||||
|
# highest safety guarantees, and theoretically higher throughput
|
||||||
|
"data=writeback"
|
||||||
|
# im on a laptop so 5 -> 15 second commit is fine
|
||||||
|
"commit=15"
|
||||||
|
# forcefully fsync()'s file replacements if not done by the bad application
|
||||||
|
"auto_da_alloc"
|
||||||
|
# 64-bit inode version support
|
||||||
|
"i_version"
|
||||||
|
# journal checksumming for e2fsck recovery support
|
||||||
|
# internally enabled if using journal_async_commit
|
||||||
|
"journal_checksum"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
boot.initrd.luks.devices."luks-9cff8e4d-0e9e-48a4-8dd4-1b48f68c2e19" = {
|
||||||
|
device = "/dev/disk/by-uuid/9cff8e4d-0e9e-48a4-8dd4-1b48f68c2e19";
|
||||||
|
|
||||||
|
# work queues dont make sense for fast hardware like SSDs, plus these
|
||||||
|
# are sync/blocking ops in linux which introduces kernel-thread deadlocks
|
||||||
|
# under extreme I/O load.
|
||||||
|
#
|
||||||
|
# check if this applies using luksDump after reboot. idk why this config option didnt work for me.
|
||||||
|
# sudo cryptsetup --perf-no_read_workqueue --perf-no_write_workqueue --allow-discards --persistent refresh luks-9cff8e4d-0e9e-48a4-8dd4-1b48f68c2e19
|
||||||
|
bypassWorkqueues = true;
|
||||||
|
|
||||||
|
# allow SSD TRIM ops; warning that this leaks metadata. this *may* expose FS-level ops
|
||||||
|
# on the physical SSD controller such as formatted FS type, amount of space used, etc.
|
||||||
|
# which *can* be of concern regarding forensics
|
||||||
|
allowDiscards = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/24C8-CDA5";
|
||||||
|
fsType = "vfat";
|
||||||
|
options = [
|
||||||
|
# /boot doesn't need any of this
|
||||||
|
"noexec"
|
||||||
|
"nosuid"
|
||||||
|
"nodev"
|
||||||
|
|
||||||
|
# /boot doesnt need access times
|
||||||
|
"noatime"
|
||||||
|
|
||||||
|
# /boot is just used by root
|
||||||
|
"umask=0077"
|
||||||
|
"fmask=0077"
|
||||||
|
"dmask=0077"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices = [{
|
||||||
|
device = "/dev/disk/by-partuuid/fc7bf131-5531-4673-a033-43bc892234e5";
|
||||||
|
# on modern linux >=5.6; urandom and random both use CSPRNGs, but random will wait/block
|
||||||
|
# for CSPRNG init. urandom will try to init at the time of use.
|
||||||
|
# beyond that, they both behave the same and just better atp to use random. ancient
|
||||||
|
# advice to use urandom for everything.
|
||||||
|
#
|
||||||
|
# <https://lore.kernel.org/lkml/20200131204924.GA455123@mit.edu/>
|
||||||
|
randomEncryption.source = "/dev/random";
|
||||||
|
|
||||||
|
randomEncryption.enable = true;
|
||||||
|
|
||||||
|
# nvme id-ns -H /dev/nvme0n1 | grep 'LBA Format'
|
||||||
|
#
|
||||||
|
# if you support more than 512 sector size and are currently not using it,
|
||||||
|
# then reinstall nixos and go through: <https://wiki.archlinux.org/title/Advanced_Format#NVMe_solid_state_drives>
|
||||||
|
# then change this to your new sector size
|
||||||
|
randomEncryption.sectorSize = 512;
|
||||||
|
|
||||||
|
# 512 instead of 256 default key size (for aes-xts-plain64) can't hurt
|
||||||
|
randomEncryption.keySize = 512;
|
||||||
|
|
||||||
|
# allow SSD TRIM ops; warning that this leaks metadata. this *may* expose FS-level ops
|
||||||
|
# on the physical SSD controller such as formatted FS type, amount of space used, etc.
|
||||||
|
# which *can* be of concern regarding forensics
|
||||||
|
randomEncryption.allowDiscards = true;
|
||||||
|
}];
|
||||||
|
|
||||||
|
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||||
|
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||||
|
# still possible to use this option, but it's recommended to use it in conjunction
|
||||||
|
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||||
|
networking.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp3s0f0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
|
||||||
|
# networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
|
||||||
|
|
||||||
|
# i want all my firmware and microcode pls
|
||||||
|
hardware.enableAllFirmware = true;
|
||||||
|
|
||||||
|
# i kinda question if this works because i don't see amd-ucode in /boot, but
|
||||||
|
# even nixos-hardware uses this so........
|
||||||
|
hardware.enableRedistributableFirmware = true;
|
||||||
|
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||||
|
|
||||||
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||||
|
}
|
||||||
Loading…
Add table
Reference in a new issue