diff options
Diffstat (limited to 'machines')
| -rw-r--r-- | machines/enzo/default.nix | 91 | ||||
| -rw-r--r-- | machines/enzo/desktop.nix | 68 | ||||
| -rw-r--r-- | machines/enzo/disko.nix | 93 | ||||
| -rw-r--r-- | machines/enzo/hardware-configuration.nix | 27 | ||||
| -rw-r--r-- | machines/kusanagi/default.nix | 317 | ||||
| -rw-r--r-- | machines/kusanagi/hardware-configuration.nix | 39 |
6 files changed, 635 insertions, 0 deletions
diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix new file mode 100644 index 0000000..65adef6 --- /dev/null +++ b/machines/enzo/default.nix @@ -0,0 +1,91 @@ +# enzo — laptop. Gets the shared common/ base plus laptop-only settings. +{ inputs, pkgs, ... }: + +{ + imports = [ + # enzo's own minimal desktop (not the shared profiles/desktop.nix). Add + # ../../profiles/dev.nix or apps.nix here, or one-off packages below, as needed. + ./desktop.nix + + inputs.disko.nixosModules.disko + ./disko.nix + ./hardware-configuration.nix + ]; + + networking.hostName = "enzo"; + + # Set this to the NixOS release the laptop is first installed from, then + # leave it. (See the comment in machines/kusanagi/default.nix.) + system.stateVersion = "26.05"; + + # --- User account (hwebs) --- + # (Desktop groups audio/input come from ./desktop.nix.) + users.users.hwebs = { + isNormalUser = true; + description = "Henry Webster"; + extraGroups = [ + "networkmanager" + "wheel" + ]; + packages = with pkgs; [ + git + neovim + tmux + btop + ripgrep + unzip + xclip + bc + psmisc + usbutils + stow + nushell + ]; + }; + + nix.settings.trusted-users = [ + "root" + "hwebs" + ]; + + # --- Disk encryption / hibernation / swap --- + # systemd in initrd is required for TPM2 unlock and clean hibernate resume. + boot.initrd.systemd.enable = true; + + # TPM2 auto-unlock. Enroll the key WITH A PIN post-install: + # sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 \ + # --tpm2-with-pin=yes /dev/nvme0n1p2 + # The original LUKS passphrase stays as a fallback keyslot. disko already + # declares boot.initrd.luks.devices."crypted".device. + boot.initrd.luks.devices."crypted".crypttabExtraOpts = [ "tpm2-device=auto" ]; + + # zram for everyday paging; the encrypted LVM swap from disko.nix is the + # hibernation target (boot.resumeDevice comes from disko's resumeDevice=true). + zramSwap.enable = true; + + # Suspend-to-RAM on lid close, auto-hibernate after a delay so a dying battery + # doesn't lose the session. Everyday resume needs only the login password; the + # LUKS PIN appears only on cold boot / hibernate resume. + services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate"; + systemd.sleep.settings.Sleep.HibernateDelaySec = "60min"; + + # btrfs + SSD upkeep. + services.btrfs.autoScrub.enable = true; + services.fstrim.enable = true; + + # --- Laptop power management --- + # power-profiles-daemon integrates with GNOME's power settings. If you prefer + # finer-grained control, disable this and enable services.tlp instead. + services.power-profiles-daemon.enable = true; + powerManagement.enable = true; + + # Backlight control from the CLI / keybinds (programs.light was removed from + # nixpkgs; acpilight provides the udev rules and brightnessctl the CLI). + hardware.acpilight.enable = true; + environment.systemPackages = [ pkgs.brightnessctl ]; + + # --- GPU --- + # TODO: adjust for the laptop's actual GPU once known. For an Intel iGPU add + # intel-media-driver to hardware.graphics.extraPackages; for a discrete AMD + # GPU you may want ROCm as in machines/kusanagi/default.nix. +} diff --git a/machines/enzo/desktop.nix b/machines/enzo/desktop.nix new file mode 100644 index 0000000..8fb68ef --- /dev/null +++ b/machines/enzo/desktop.nix @@ -0,0 +1,68 @@ +# Minimal niri desktop for enzo — deliberately separate from ../../profiles/desktop.nix +# so the laptop can grow on its own terms. Add to it (or switch to the shared +# profile) whenever you want more. +{ pkgs, ... }: + +{ + # --- Session / login --- + programs.niri.enable = true; + programs.dconf.enable = true; + + services.greetd = { + enable = true; + settings.default_session = { + command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd niri-session"; + user = "greeter"; + }; + }; + # Let tuigreet write its cache (for --remember). + systemd.services.greetd.serviceConfig = { + Type = "idle"; + StandardInput = "tty"; + StandardOutput = "tty"; + StandardError = "journal"; + TTYReset = true; + TTYVHangup = true; + TTYVTDisallocate = true; + }; + + # --- Graphics --- + hardware.graphics.enable = true; + + # --- Audio (playback only; no rtkit/jack — enzo isn't for recording). + # If you ever hear dropouts under load, add: security.rtkit.enable = true; + services.pulseaudio.enable = false; + services.pipewire = { + enable = true; + alsa.enable = true; + pulse.enable = true; + }; + + # --- Fonts (minimal) --- + fonts.enableDefaultPackages = true; + fonts.packages = with pkgs; [ + noto-fonts + nerd-fonts.symbols-only + ]; + + environment.sessionVariables = { + XCURSOR_THEME = "Adwaita"; + XCURSOR_SIZE = "24"; + }; + + # --- User: groups + niri essentials --- + users.users.hwebs.extraGroups = [ + "audio" + "input" + ]; + + users.users.hwebs.packages = with pkgs; [ + ghostty # terminal + fuzzel # launcher + swaybg # wallpaper + xwayland-satellite # run X11 apps under niri + networkmanagerapplet # wifi tray + mako # notifications + libnotify # notify-send + ]; +} diff --git a/machines/enzo/disko.nix b/machines/enzo/disko.nix new file mode 100644 index 0000000..ddfa4d3 --- /dev/null +++ b/machines/enzo/disko.nix @@ -0,0 +1,93 @@ +# Declarative disk layout for enzo: LVM-on-LUKS with a btrfs root and an +# encrypted swap logical volume (>= RAM) for hibernation. +# +# nvme0n1 +# ├─ p1 ESP 1 GiB vfat /boot (unencrypted) +# └─ p2 LUKS2 "crypted" ── LVM vg "vg" ── +# ├─ lv "swap" swap (hibernation target) +# └─ lv "root" btrfs subvolumes: @ @home @nix @log @snapshots +# +# Apply on the laptop with (prompts for the LUKS passphrase = fallback keyslot): +# sudo nix run github:nix-community/disko/latest -- \ +# --mode destroy,format,mount ./machines/enzo/disko.nix +{ ... }: + +{ + disko.devices = { + disk.main = { + type = "disk"; + device = "/dev/nvme0n1"; # TODO: confirm on the laptop with `lsblk` + content = { + type = "gpt"; + partitions = { + ESP = { + size = "1G"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + luks = { + size = "100%"; + content = { + type = "luks"; + name = "crypted"; + settings = { + # Allow TRIM through LUKS (minor metadata leak, fine for a laptop SSD). + allowDiscards = true; + }; + content = { + type = "lvm_pv"; + vg = "vg"; + }; + }; + }; + }; + }; + }; + + lvm_vg.vg = { + type = "lvm_vg"; + lvs = { + swap = { + size = "20G"; # TODO: set >= RAM (RAM + a little) for hibernation + content = { + type = "swap"; + resumeDevice = true; # emits swapDevices + boot.resumeDevice + }; + }; + root = { + size = "100%FREE"; + content = { + type = "btrfs"; + extraArgs = [ "-f" ]; + subvolumes = { + "@" = { + mountpoint = "/"; + mountOptions = [ "compress=zstd" "noatime" ]; + }; + "@home" = { + mountpoint = "/home"; + mountOptions = [ "compress=zstd" "noatime" ]; + }; + "@nix" = { + mountpoint = "/nix"; + mountOptions = [ "compress=zstd" "noatime" ]; + }; + "@log" = { + mountpoint = "/var/log"; + mountOptions = [ "compress=zstd" "noatime" ]; + }; + "@snapshots" = { + mountpoint = "/.snapshots"; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/machines/enzo/hardware-configuration.nix b/machines/enzo/hardware-configuration.nix new file mode 100644 index 0000000..30c00ee --- /dev/null +++ b/machines/enzo/hardware-configuration.nix @@ -0,0 +1,27 @@ +# PLACEHOLDER — regenerate on the laptop. +# +# During install run: nixos-generate-config --no-filesystems --root /mnt +# then copy the generated hardware-configuration.nix over this file. Because the +# disk layout is declared in ./disko.nix, this file must NOT define fileSystems +# or swapDevices (--no-filesystems omits them). It only needs to evaluate until +# the real one is generated; it will NOT boot as-is. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + # nixos-generate-config fills these in on the laptop. TPM unlock in initrd + # needs the TPM module (tpm_tis / tpm_crb) here — usually auto-detected. + boot.initrd.availableKernelModules = [ ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + # fileSystems / swapDevices intentionally omitted — provided by ./disko.nix. + + networking.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix new file mode 100644 index 0000000..10531c2 --- /dev/null +++ b/machines/kusanagi/default.nix @@ -0,0 +1,317 @@ +# kusanagi — AMD workstation. Everything here is specific to this machine: +# ROCm/GPU, the Focusrite Scarlett audio interface, optical-disc archiving, the +# NAS mounts, and the Kavita/Immich/Ollama servers. +{ pkgs, ... }: + +{ + imports = [ + ../../profiles/desktop.nix + ../../profiles/dev.nix + ../../profiles/apps.nix + ./hardware-configuration.nix + ]; + + networking.hostName = "kusanagi"; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + system.stateVersion = "24.11"; # Did you read the comment? + + powerManagement.cpuFreqGovernor = "performance"; + + boot.binfmt.emulatedSystems = [ "aarch64-linux" ]; + + # --- GPU (ROCm) --- + nixpkgs.config.rocmSupport = true; + hardware.graphics.extraPackages = with pkgs; [ + rocmPackages.clr.icd + ]; + + # --- Optical disc drives / archiving --- + boot.kernelModules = [ "sg" ]; # for disc drive + + # For disc drives + services.udev.extraRules = '' + KERNEL=="sr[0-9]*", GROUP="cdrom", MODE="0660" + KERNEL=="sg[0-9]*", GROUP="sg", MODE="0660" + ''; + + services.pcscd.enable = true; + + # abcde: patch its musicbrainz tool to accept discs with 4 args. + nixpkgs.overlays = [ + (self: super: { + abcde = super.abcde.overrideAttrs (oldAttrs: { + # We use postInstall to modify the script after it has been copied to the output directory + postInstall = (oldAttrs.postInstall or "") + '' + # Patch 1: Allow GetOptions to accept 4 arguments (instead of requiring 5+) + sed -i 's/discinfo=i{5,}/discinfo=i{4,}/g' $out/bin/abcde-musicbrainz-tool + + # Patch 2: Lower the logic check from 5 to 4 + sed -i 's/$#discinfo < 5/$#discinfo < 4/g' $out/bin/abcde-musicbrainz-tool + ''; + }); + }) + ]; + + # --- Scanner --- + hardware.sane.enable = true; + + # --- Audio interface (Focusrite Scarlett 18i20) --- + # Add this for better pro audio support + services.pipewire.extraConfig.pipewire."10-low-latency" = { + "context.properties" = { + "default.clock.rate" = 48000; + "default.clock.quantum" = 256; + "default.clock.min-quantum" = 256; + "default.clock.max-quantum" = 2048; + }; + }; + + # Pin the Scarlett 18i20 to the raw "Pro Audio" profile. + # The 26.05 pipewire/wireplumber update began preferring the UCM "HiFi" + # profile, which splits the interface into Direct1/Line5/SPDIF1/... sinks and + # broke monitoring. This priority rule forces the multichannel Pro Audio + # profile statelessly on every boot (and survives future UCM renames). + services.pipewire.wireplumber.extraConfig."51-scarlett-pro-audio" = { + "device.profile.priority.rules" = [ + { + matches = [ + { + "device.name" = "alsa_card.usb-Focusrite_Scarlett_18i20_USB_P9DCR6Y378D1E6-00"; + } + ]; + actions = { + update-props = { + priorities = [ "pro-audio" ]; + }; + }; + } + ]; + }; + + # Real-time audio optimizations + security.pam.loginLimits = [ + { + domain = "@audio"; + item = "memlock"; + type = "-"; + value = "unlimited"; + } + { + domain = "@audio"; + item = "rtprio"; + type = "-"; + value = "99"; + } + { + domain = "@audio"; + item = "nofile"; + type = "soft"; + value = "99999"; + } + { + domain = "@audio"; + item = "nofile"; + type = "hard"; + value = "99999"; + } + ]; + + # Kernel optimizations for audio + boot.kernelParams = [ + "threadirqs" + "preempt=full" # if using a PREEMPT kernel + # Add USB audio optimizations + "usbcore.usbfs_memory_mb=1024" + ]; + + # --- MPD (music) --- + services.mpd.enable = false; + + systemd.user.services.mpd = { + description = "Music Player Daemon"; + after = [ + "network.target" + "sound.target" + ]; + wantedBy = [ "default.target" ]; + serviceConfig = { + ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon"; + Type = "notify"; + LimitRTPRIO = 50; + LimitRTTIME = "infinity"; + }; + }; + + # --- NAS (NFS) --- + boot.supportedFilesystems = [ "nfs" ]; + + services.nfs.server.enable = false; + services.rpcbind.enable = true; + + services.nfs.idmapd.settings = { + General = { + Domain = "kusanagi"; # or your actual domain name + }; + }; + + # NAS shares. Use the mDNS-resolvable name (bare "milgrim" doesn't resolve) + # and automount on first access so a boot-time DNS/network race can't leave + # them unmounted (which silently breaks MPD, whose DB points at these paths). + fileSystems."/mnt/milgrim-share" = { + device = "milgrim.local:/volume1/share"; + fsType = "nfs"; + options = [ + "nfsvers=4" + "rsize=8192" + "wsize=8192" + "_netdev" + "noauto" + "x-systemd.automount" + "x-systemd.idle-timeout=600" + "x-systemd.mount-timeout=10s" + ]; + }; + + fileSystems."/mnt/milgrim-public" = { + device = "milgrim.local:/volume1/public"; + fsType = "nfs"; + options = [ + "nfsvers=4" + "rsize=8192" + "wsize=8192" + "_netdev" + "noauto" + "x-systemd.automount" + "x-systemd.idle-timeout=600" + "x-systemd.mount-timeout=10s" + ]; + }; + + # --- Servers --- + services.kavita = { + enable = true; + tokenKeyFile = "/var/lib/kavita/token-key"; + settings.Port = 5000; + }; + + systemd.tmpfiles.rules = [ + "d /srv/library 2750 henz kavita - -" + ]; + + services.ollama = { + enable = true; + package = pkgs.ollama-rocm; + environmentVariables = { + HIP_VISIBLE_DEVICES = "0"; + OLLAMA_CONTEXT_LENGTH = "32768"; + OLLAMA_KV_CACHE_TYPE = "q8_0"; + }; + }; + + services.immich = { + enable = true; + machine-learning.enable = false; + }; + + # --- discidurl / haunt tooling (needs the per-machine overlays in flake.nix) --- + environment.systemPackages = + let + # open the MusicBrainz submission URL for the disc in the drive + discid = pkgs.writeShellApplication { + name = "discid"; + runtimeInputs = [ + pkgs.discidurl + pkgs.xdg-utils + ]; + text = "discidurl | xargs -r xdg-open"; + }; + in + with pkgs; + [ + discidurl + discid + haunt + ]; + + # --- User account (henz) --- + # (Desktop groups audio/lp/input come from profiles/desktop.nix.) + users.users.henz.isNormalUser = true; + users.users.henz.description = "Henry Webster"; + users.users.henz.extraGroups = [ + # base + "networkmanager" + "wheel" + # kusanagi hardware + "cdrom" + "optical" + "sg" + "scanner" + ]; + + nix.settings.trusted-users = [ + "root" + "henz" + ]; + + users.users.henz.packages = with pkgs; [ + # base CLI + git + neovim + tmux + btop + ripgrep + unzip + xclip + bc + psmisc + usbutils + stow + nushell + + # kusanagi + blender + rocmPackages.rpp + rocmPackages.hipcc + rocmPackages.rocminfo + ardour + davinci-resolve-studio + calf + alsa-utils + alsa-tools + pipewire.jack + nfs-utils + + # music + mpd + mpc + ncmpcpp + + # for archiving + #makemkv + abcde + libaacs + libbdplus + libdvdcss + mkvtoolnix + dvdbackup + chromaprint + picard + flac + + # scanners + simple-scan + + (pkgs.makeDesktopItem { + name = "PICO-8"; + desktopName = "PICO-8"; + exec = "pico8"; + icon = "pico8"; + comment = "Fantasy console for making, sharing and playing tiny games"; + categories = [ "Game" ]; + }) + ]; +} diff --git a/machines/kusanagi/hardware-configuration.nix b/machines/kusanagi/hardware-configuration.nix new file mode 100644 index 0000000..9c601e9 --- /dev/null +++ b/machines/kusanagi/hardware-configuration.nix @@ -0,0 +1,39 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/ad74db0c-c909-4503-84f6-cc08ca0b1e4b"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/9499-40FE"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp9s0.useDHCP = lib.mkDefault true; + # networking.interfaces.wlp8s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} |