feat: NixOS system entry point (configuration.nix)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
parent
c8c89a19cf
commit
8d2a0357c1
1 changed files with 245 additions and 0 deletions
245
configuration.nix
Normal file
245
configuration.nix
Normal file
|
|
@ -0,0 +1,245 @@
|
||||||
|
# Omnixient NixOS Configuration
|
||||||
|
# This is the main entry point — keep it thin.
|
||||||
|
# System-level config lives in modules/; this file is for per-host settings.
|
||||||
|
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
settings,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
|
||||||
|
let
|
||||||
|
currentTheme = settings.theme;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# NOTE: hardware-configuration.nix is imported per-host from
|
||||||
|
# hosts/<name>/default.nix (it's machine-specific), not here.
|
||||||
|
|
||||||
|
# Omnixient modules
|
||||||
|
./modules/lib.nix
|
||||||
|
./modules/core.nix
|
||||||
|
./modules/colors.nix
|
||||||
|
./modules/boot.nix
|
||||||
|
./modules/security.nix
|
||||||
|
./modules/secrets.nix
|
||||||
|
./modules/fastfetch.nix
|
||||||
|
./modules/walker.nix
|
||||||
|
./modules/scripts.nix
|
||||||
|
./modules/menus.nix
|
||||||
|
./modules/desktop/hyprland.nix
|
||||||
|
./modules/packages.nix
|
||||||
|
./modules/development.nix
|
||||||
|
./modules/mcp.nix
|
||||||
|
./modules/themes/${currentTheme}.nix
|
||||||
|
./modules/users.nix
|
||||||
|
./modules/services.nix
|
||||||
|
./modules/hardware
|
||||||
|
];
|
||||||
|
|
||||||
|
# --- Per-host settings (edit these) ---
|
||||||
|
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
# Electron 39 is EOL upstream but still bundled by signal-desktop /
|
||||||
|
# element-desktop / obsidian in current nixpkgs. Allow until those
|
||||||
|
# packages move to a supported electron.
|
||||||
|
nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];
|
||||||
|
|
||||||
|
nix = {
|
||||||
|
settings = {
|
||||||
|
experimental-features = [
|
||||||
|
"nix-command"
|
||||||
|
"flakes"
|
||||||
|
];
|
||||||
|
auto-optimise-store = true;
|
||||||
|
# Bound build concurrency so a big rebuild (lnbits/webapp/lamassu)
|
||||||
|
# can't allocate past available RAM and trigger the OOM-killer
|
||||||
|
# against the desktop session. 4×4 keeps headroom on a 16-core box.
|
||||||
|
max-jobs = 4;
|
||||||
|
cores = 4;
|
||||||
|
substituters = [
|
||||||
|
"https://cache.nixos.org"
|
||||||
|
"https://nix-community.cachix.org"
|
||||||
|
"https://hyprland.cachix.org"
|
||||||
|
];
|
||||||
|
trusted-public-keys = [
|
||||||
|
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||||
|
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||||
|
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
|
||||||
|
];
|
||||||
|
};
|
||||||
|
# Run the daemon (and therefore all build workers it spawns) at idle
|
||||||
|
# CPU + IO priority, so interactive apps always preempt nix.
|
||||||
|
daemonCPUSchedPolicy = "idle";
|
||||||
|
daemonIOSchedClass = "idle";
|
||||||
|
gc = {
|
||||||
|
automatic = true;
|
||||||
|
dates = "weekly";
|
||||||
|
options = "--delete-older-than 30d";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Hard memory ceiling on the nix-daemon cgroup: MemoryHigh applies
|
||||||
|
# backpressure (slows builds before OOM); MemoryMax kills the build
|
||||||
|
# cgroup before the kernel reaps Chromium/waybar/walker.
|
||||||
|
systemd.services.nix-daemon.serviceConfig = {
|
||||||
|
MemoryHigh = "16G";
|
||||||
|
MemoryMax = "20G";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Compressed swap-in-RAM. With no disk swap the kernel reaches for the
|
||||||
|
# OOM-killer the moment a build spikes; zram gives it a release valve
|
||||||
|
# for cold pages without thrashing a disk.
|
||||||
|
zramSwap = {
|
||||||
|
enable = true;
|
||||||
|
memoryPercent = 50;
|
||||||
|
algorithm = "zstd";
|
||||||
|
};
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
hostName = settings.hostName;
|
||||||
|
# iwd-only wifi (impala handles WPA2-Enterprise natively since v0.5.0)
|
||||||
|
networkmanager.enable = false;
|
||||||
|
wireless.iwd = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
General.EnableNetworkConfiguration = true;
|
||||||
|
Network.EnableIPv6 = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
firewall = {
|
||||||
|
enable = true;
|
||||||
|
allowedTCPPorts = [
|
||||||
|
22
|
||||||
|
80
|
||||||
|
443
|
||||||
|
3000
|
||||||
|
8080
|
||||||
|
5173 # webapp hub (Vite dev)
|
||||||
|
5180 # libra
|
||||||
|
5181 # activities (sortir)
|
||||||
|
5182 # wallet
|
||||||
|
5183 # chat
|
||||||
|
5184 # forum
|
||||||
|
5185 # market
|
||||||
|
5186 # tasks
|
||||||
|
5187 # restaurant
|
||||||
|
5001 # LNbits
|
||||||
|
3333 # Fava (docker maps :5000→:3333; also the deploy default)
|
||||||
|
6033 # pict-rs
|
||||||
|
6173 # chateau-du-faune dev
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
time.timeZone = settings.timeZone;
|
||||||
|
i18n = {
|
||||||
|
defaultLocale = "en_US.UTF-8";
|
||||||
|
extraLocaleSettings = {
|
||||||
|
LC_ADDRESS = "en_US.UTF-8";
|
||||||
|
LC_IDENTIFICATION = "en_US.UTF-8";
|
||||||
|
LC_MEASUREMENT = "en_US.UTF-8";
|
||||||
|
LC_MONETARY = "en_US.UTF-8";
|
||||||
|
LC_NAME = "en_US.UTF-8";
|
||||||
|
LC_NUMERIC = "en_US.UTF-8";
|
||||||
|
LC_PAPER = "en_US.UTF-8";
|
||||||
|
LC_TELEPHONE = "en_US.UTF-8";
|
||||||
|
LC_TIME = "en_US.UTF-8";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
system.stateVersion = settings.stateVersion;
|
||||||
|
|
||||||
|
# VM testing settings (ignored on real hardware)
|
||||||
|
virtualisation.vmVariant = {
|
||||||
|
virtualisation = {
|
||||||
|
memorySize = 4096;
|
||||||
|
cores = 2;
|
||||||
|
qemu.options = [
|
||||||
|
"-vga virtio"
|
||||||
|
];
|
||||||
|
# Forward host port 2222 -> guest port 22 so we can ssh in
|
||||||
|
# from the host (`ssh -p 2222 user@localhost`) instead of
|
||||||
|
# typing into the QEMU window. The host_port=2222 avoids
|
||||||
|
# needing root for a low port and dodges any local sshd.
|
||||||
|
forwardPorts = [
|
||||||
|
{
|
||||||
|
from = "host";
|
||||||
|
host.port = 2222;
|
||||||
|
guest.port = 22;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
# Disable services that don't work in VMs
|
||||||
|
services.smartd.enable = lib.mkForce false;
|
||||||
|
services.power-profiles-daemon.enable = lib.mkForce false;
|
||||||
|
services.thermald.enable = lib.mkForce false;
|
||||||
|
# Use software rendering as fallback for Hyprland
|
||||||
|
environment.variables.WLR_RENDERER = "pixman";
|
||||||
|
|
||||||
|
# VM-only: re-enable password ssh auth so we can ssh in from
|
||||||
|
# the host to test without injecting keys. Production has these
|
||||||
|
# disabled in modules/services.nix; this override only applies
|
||||||
|
# to the vmVariant so it never reaches a real machine.
|
||||||
|
services.openssh.settings.PasswordAuthentication = lib.mkForce true;
|
||||||
|
services.openssh.settings.KbdInteractiveAuthentication = lib.mkForce true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# --- Omnixient settings ---
|
||||||
|
|
||||||
|
hardware.bluetooth.enhanced.enable = true;
|
||||||
|
|
||||||
|
# udev rules for ZSA keyboards (Moonlander) — needed to flash firmware
|
||||||
|
# and use Oryx live-training. Flash with keymapp (see home.packages).
|
||||||
|
hardware.keyboard.zsa.enable = true;
|
||||||
|
|
||||||
|
omni = {
|
||||||
|
enable = true;
|
||||||
|
desktop.enable = true;
|
||||||
|
mcp.enable = true;
|
||||||
|
mcp.servers.lnbits = {
|
||||||
|
enable = true;
|
||||||
|
url = "http://localhost:5001";
|
||||||
|
};
|
||||||
|
mcp.servers.nextcloud = {
|
||||||
|
enable = true;
|
||||||
|
url = "https://cloud.ariege.io";
|
||||||
|
username = "pat";
|
||||||
|
};
|
||||||
|
user = settings.user;
|
||||||
|
theme = currentTheme;
|
||||||
|
displayManager = "tuigreet";
|
||||||
|
preset = "developer";
|
||||||
|
features = {
|
||||||
|
office = true;
|
||||||
|
communication = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
security = {
|
||||||
|
enable = true;
|
||||||
|
fingerprint = {
|
||||||
|
enable = false;
|
||||||
|
autoDetect = true;
|
||||||
|
};
|
||||||
|
fido2 = {
|
||||||
|
enable = false;
|
||||||
|
autoDetect = true;
|
||||||
|
};
|
||||||
|
systemHardening = {
|
||||||
|
enable = true;
|
||||||
|
faillock = {
|
||||||
|
enable = true;
|
||||||
|
denyAttempts = 10;
|
||||||
|
unlockTime = 120;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# colorScheme = inputs.nix-colors.colorSchemes.tokyo-night-dark;
|
||||||
|
# wallpaper = /path/to/your/wallpaper.jpg;
|
||||||
|
# features = { coding = true; containers = true; };
|
||||||
|
# packages.exclude = [ "discord" "spotify" ];
|
||||||
|
};
|
||||||
|
}
|
||||||
Loading…
Add table
Add a link
Reference in a new issue