refactor: config/hosts => hosts
This commit is contained in:
108
hosts/imxyy-nix-x16/hardware.nix
Normal file
108
hosts/imxyy-nix-x16/hardware.nix
Normal file
@@ -0,0 +1,108 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
btrfs = "/dev/disk/by-uuid/69ab72d4-6ced-4f70-8b5e-aa2daa8c0b6b";
|
||||
in
|
||||
{
|
||||
boot = {
|
||||
initrd = {
|
||||
kernelModules = [ "amdgpu" ];
|
||||
availableKernelModules = [
|
||||
"nvme"
|
||||
"xhci_pci"
|
||||
"thunderbolt"
|
||||
"uas"
|
||||
"sd_mod"
|
||||
];
|
||||
verbose = false;
|
||||
};
|
||||
|
||||
kernelPackages = lib.mkForce pkgs.linuxPackages_xanmod_latest;
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
|
||||
tmp.useTmpfs = true;
|
||||
kernel.sysctl = {
|
||||
"fs.file-max" = 9223372036854775807;
|
||||
};
|
||||
};
|
||||
services.scx = {
|
||||
enable = true;
|
||||
scheduler = "scx_rusty";
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = btrfs;
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"compress=zstd"
|
||||
"subvol=root"
|
||||
];
|
||||
};
|
||||
|
||||
fileSystems."/nix" = {
|
||||
device = btrfs;
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"compress=zstd"
|
||||
"subvol=nix"
|
||||
];
|
||||
};
|
||||
|
||||
my.persist.location = "/nix/persist";
|
||||
fileSystems."/nix/persist" = {
|
||||
device = btrfs;
|
||||
fsType = "btrfs";
|
||||
options = [
|
||||
"compress=zstd"
|
||||
"subvol=persist"
|
||||
];
|
||||
neededForBoot = true;
|
||||
};
|
||||
|
||||
boot.initrd.postDeviceCommands = lib.mkAfter ''
|
||||
mkdir /btrfs_tmp
|
||||
mount ${btrfs} /btrfs_tmp
|
||||
mkdir -p /btrfs_tmp/old_roots
|
||||
if [[ -e /btrfs_tmp/root ]]; then
|
||||
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
|
||||
mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
|
||||
fi
|
||||
|
||||
delete_subvolume_recursively() {
|
||||
IFS=$'\n'
|
||||
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
|
||||
delete_subvolume_recursively "/btrfs_tmp/$i"
|
||||
done
|
||||
btrfs subvolume delete "$1"
|
||||
}
|
||||
|
||||
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +14); do
|
||||
delete_subvolume_recursively "$i"
|
||||
done
|
||||
|
||||
btrfs subvolume create /btrfs_tmp/root
|
||||
umount /btrfs_tmp
|
||||
'';
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/96D3-93B0";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"uid=0"
|
||||
"gid=0"
|
||||
"fmask=0077"
|
||||
"dmask=0077"
|
||||
];
|
||||
};
|
||||
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
|
||||
hardware.enableRedistributableFirmware = lib.mkDefault true;
|
||||
hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkForce "x86_64-linux";
|
||||
}
|
||||
141
hosts/imxyy-nix-x16/home.nix
Normal file
141
hosts/imxyy-nix-x16/home.nix
Normal file
@@ -0,0 +1,141 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
username,
|
||||
...
|
||||
}:
|
||||
{
|
||||
my.hm = {
|
||||
home.packages = with pkgs; [
|
||||
localsend
|
||||
|
||||
wpsoffice-cn
|
||||
wps-office-fonts
|
||||
ttf-wps-fonts
|
||||
papers
|
||||
|
||||
anki
|
||||
|
||||
ayugram-desktop
|
||||
signal-desktop
|
||||
element-desktop
|
||||
fractal
|
||||
qq
|
||||
wechat
|
||||
|
||||
gnome-clocks
|
||||
];
|
||||
programs.zsh = {
|
||||
sessionVariables = {
|
||||
PATH = "/home/${username}/bin:$PATH";
|
||||
};
|
||||
};
|
||||
|
||||
programs.niri.settings = {
|
||||
environment.STEAM_FORCE_DESKTOPUI_SCALING = "1.25";
|
||||
outputs = {
|
||||
eDP-1 = {
|
||||
enable = true;
|
||||
mode = {
|
||||
width = 1920;
|
||||
height = 1200;
|
||||
refresh = 60.002;
|
||||
};
|
||||
scale = 1.25;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
my = {
|
||||
gpg.enable = true;
|
||||
cli.all.enable = true;
|
||||
coding.all.enable = true;
|
||||
desktop.all.enable = true;
|
||||
virt.moonlight.enable = true;
|
||||
|
||||
i18n.fcitx5.enable = true;
|
||||
|
||||
xdg = {
|
||||
enable = true;
|
||||
defaultApplications =
|
||||
let
|
||||
browser = [ config.my.desktop.browser.default.desktop ];
|
||||
editor = [ "codium.desktop" ];
|
||||
imageviewer = [ "org.gnome.Shotwell-Viewer.desktop" ];
|
||||
in
|
||||
{
|
||||
"inode/directory" = [ "org.gnome.Nautilus.desktop" ];
|
||||
|
||||
"application/pdf" = [ "org.gnome.Papers.desktop" ];
|
||||
|
||||
"text/*" = editor;
|
||||
"application/json" = editor;
|
||||
"text/html" = editor;
|
||||
"text/xml" = editor;
|
||||
"application/xml" = editor;
|
||||
"application/xhtml+xml" = editor;
|
||||
"application/xhtml_xml" = editor;
|
||||
"application/rdf+xml" = editor;
|
||||
"application/rss+xml" = editor;
|
||||
"application/x-extension-htm" = editor;
|
||||
"application/x-extension-html" = editor;
|
||||
"application/x-extension-shtml" = editor;
|
||||
"application/x-extension-xht" = editor;
|
||||
"application/x-extension-xhtml" = editor;
|
||||
|
||||
"x-scheme-handler/about" = browser;
|
||||
"x-scheme-handler/ftp" = browser;
|
||||
"x-scheme-handler/http" = browser;
|
||||
"x-scheme-handler/https" = browser;
|
||||
"x-scheme-handler/unknown" = browser;
|
||||
|
||||
"audio/*" = imageviewer;
|
||||
"video/*" = imageviewer;
|
||||
"image/*" = imageviewer;
|
||||
"image/gif" = imageviewer;
|
||||
"image/jpeg" = imageviewer;
|
||||
"image/png" = imageviewer;
|
||||
"image/webp" = imageviewer;
|
||||
};
|
||||
};
|
||||
persist = {
|
||||
enable = true;
|
||||
homeDirs = [
|
||||
"Documents"
|
||||
"Downloads"
|
||||
"Videos"
|
||||
"Music"
|
||||
"Pictures"
|
||||
|
||||
"bin"
|
||||
"workspace"
|
||||
|
||||
".cache"
|
||||
".local/state"
|
||||
".local/share/Anki2"
|
||||
".local/share/shotwell"
|
||||
".local/share/Kingsoft"
|
||||
|
||||
".local/share/AyuGramDesktop"
|
||||
".local/share/fractal"
|
||||
".config/Signal"
|
||||
".config/Element"
|
||||
".config/QQ"
|
||||
".xwechat"
|
||||
|
||||
".config/Kingsoft"
|
||||
".config/dconf"
|
||||
".config/pip"
|
||||
".config/sunshine"
|
||||
|
||||
".gemini"
|
||||
".claude"
|
||||
".claude-code-router"
|
||||
];
|
||||
homeFiles = [
|
||||
".claude.json"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
101
hosts/imxyy-nix-x16/net.nix
Normal file
101
hosts/imxyy-nix-x16/net.nix
Normal file
@@ -0,0 +1,101 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
secrets,
|
||||
...
|
||||
}:
|
||||
{
|
||||
boot.kernelParams = [
|
||||
"biosdevname=0"
|
||||
"net.ifnames=0"
|
||||
];
|
||||
my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
|
||||
networking = {
|
||||
networkmanager.enable = true;
|
||||
firewall.enable = false;
|
||||
nftables = {
|
||||
enable = true;
|
||||
flushRuleset = true;
|
||||
ruleset = ''
|
||||
table inet firewall {
|
||||
set LANv4 {
|
||||
type ipv4_addr
|
||||
flags interval
|
||||
|
||||
elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
|
||||
}
|
||||
set LANv6 {
|
||||
type ipv6_addr
|
||||
flags interval
|
||||
|
||||
elements = { fd00::/8, fe80::/10 }
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority 100; policy accept;
|
||||
}
|
||||
|
||||
chain input {
|
||||
type filter hook input priority 0; policy drop;
|
||||
iif lo accept
|
||||
ct state invalid drop
|
||||
ct state established,related accept
|
||||
|
||||
ip saddr @LANv4 accept
|
||||
ip6 saddr @LANv6 accept
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.dae-imxyy-nix-x16 = {
|
||||
sopsFile = secrets.dae-imxyy-nix-x16;
|
||||
restartUnits = [ "dae.service" ];
|
||||
format = "binary";
|
||||
};
|
||||
services.dae = {
|
||||
enable = true;
|
||||
configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
|
||||
};
|
||||
systemd.services.dae.after = [ "sops-nix.service" ];
|
||||
sops.secrets.mihomo = {
|
||||
sopsFile = secrets.mihomo;
|
||||
restartUnits = [ "mihomo.service" ];
|
||||
format = "yaml";
|
||||
key = "";
|
||||
};
|
||||
systemd.services.mihomo.after = [ "sops-nix.service" ];
|
||||
services.mihomo = {
|
||||
enable = true;
|
||||
configFile = config.sops.secrets.mihomo.path;
|
||||
webui = pkgs.metacubexd;
|
||||
};
|
||||
|
||||
sops.secrets.et-imxyy-nix-x16 = {
|
||||
sopsFile = secrets.et-imxyy-nix-x16;
|
||||
restartUnits = [ "easytier.service" ];
|
||||
format = "binary";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [
|
||||
easytier
|
||||
];
|
||||
systemd.services."easytier" = {
|
||||
enable = true;
|
||||
script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-x16.path}";
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = 30;
|
||||
User = "root";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"sops-nix.service"
|
||||
];
|
||||
};
|
||||
}
|
||||
67
hosts/imxyy-nix-x16/nixos.nix
Normal file
67
hosts/imxyy-nix-x16/nixos.nix
Normal file
@@ -0,0 +1,67 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
username,
|
||||
secrets,
|
||||
...
|
||||
}:
|
||||
{
|
||||
boot.kernelParams = [
|
||||
"usbcore.autosuspend=-1" # Avoid usb autosuspend (for usb bluetooth adapter)
|
||||
];
|
||||
|
||||
services.upower.enable = true;
|
||||
services.power-profiles-daemon.enable = true;
|
||||
|
||||
services.keyd = {
|
||||
enable = true;
|
||||
keyboards.default.settings = {
|
||||
main = {
|
||||
capslock = "overload(control, esc)";
|
||||
home = "end";
|
||||
};
|
||||
shift = {
|
||||
home = "home";
|
||||
};
|
||||
control = {
|
||||
delete = "print";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
# Forbid root login through SSH.
|
||||
PermitRootLogin = null;
|
||||
PasswordAuthentication = true;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.rclone
|
||||
];
|
||||
|
||||
sops.secrets.imxyy-nix-rclone = {
|
||||
sopsFile = secrets.imxyy-nix-rclone;
|
||||
format = "binary";
|
||||
};
|
||||
fileSystems = {
|
||||
"/home/${username}/Nextcloud" = {
|
||||
device = "Nextcloud:";
|
||||
fsType = "rclone";
|
||||
options = [
|
||||
"nodev"
|
||||
"nofail"
|
||||
"allow_other"
|
||||
"args2env"
|
||||
"config=${config.sops.secrets.imxyy-nix-rclone.path}"
|
||||
"uid=1000"
|
||||
"gid=100"
|
||||
"rw"
|
||||
"no-check-certificate"
|
||||
"vfs-cache-mode=full"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user