diff --git a/.direnv/flake-profile b/.direnv/flake-profile new file mode 120000 index 0000000..0c05709 --- /dev/null +++ b/.direnv/flake-profile @@ -0,0 +1 @@ +flake-profile-1-link \ No newline at end of file diff --git a/.direnv/flake-profile-1-link b/.direnv/flake-profile-1-link new file mode 120000 index 0000000..bcf3465 --- /dev/null +++ b/.direnv/flake-profile-1-link @@ -0,0 +1 @@ +/nix/store/ljhdc2i39m71frrpfahkwrif7m4x04si-nix-shell-env \ No newline at end of file diff --git a/flake.lock b/flake.lock index 8aca68d..7d408ee 100644 --- a/flake.lock +++ b/flake.lock @@ -77,15 +77,16 @@ ] }, "locked": { - "lastModified": 1781751568, - "narHash": "sha256-hZAbXoNA4nCSaIJJLGl/EdErFtlnAS06jEp4oO7Qp6s=", + "lastModified": 1785119570, + "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=", "owner": "nix-community", "repo": "home-manager", - "rev": "5bcff43156c0eebe68759338b7879c8e1b2e2bd0", + "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d", "type": "github" }, "original": { "owner": "nix-community", + "ref": "release-26.05", "repo": "home-manager", "type": "github" } @@ -166,16 +167,16 @@ }, "nixpkgs": { "locked": { - "lastModified": 1781577229, - "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=", + "lastModified": 1785491804, + "narHash": "sha256-p00vplVOyfKGlhju0+eGGPAxyYYKaY0lpyuoHLFIx2Y=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f", + "rev": "5b4f72e1705a63aace42900610c4db82cb4af0ec", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-unstable", + "ref": "nixos-26.05", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index 3fb8f12..9a4da81 100644 --- a/flake.nix +++ b/flake.nix @@ -1,15 +1,28 @@ { - description = "Description for the project"; + description = "NixOS configuration for sora, a CM5 uConsole"; + + nixConfig = { + extra-substituters = [ + "https://nixos-raspberrypi.cachix.org" + "https://nixos-clockworkpi-uconsole.cachix.org" + ]; + extra-trusted-public-keys = [ + "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=" + "nixos-clockworkpi-uconsole.cachix.org-1:6NRN3n9/r3w5ZS8/gZudW6PkPDoC3liCt/dBseICua0=" + ]; + }; inputs = { # meta - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; flake-parts.url = "github:hercules-ci/flake-parts"; treefmt-nix.url = "github:numtide/treefmt-nix"; # hardware nixos-uconsole = { url = "github:nixos-uconsole/nixos-uconsole"; + # Keep one nixpkgs revision across the system. This intentionally trades + # compatibility with the upstream 25.11 binary cache for consistency. inputs.nixpkgs.follows = "nixpkgs"; }; @@ -20,7 +33,7 @@ # userspace home-manager = { - url = "github:nix-community/home-manager"; + url = "github:nix-community/home-manager/release-26.05"; inputs.nixpkgs.follows = "nixpkgs"; }; run0-sudo-shim = { @@ -33,87 +46,78 @@ outputs = { - self, - nixpkgs, flake-parts, home-manager, nixos-uconsole, ... }@inputs: - let - lib = nixpkgs.lib; - - mkHosts = ( - hosts: - lib.mapAttrs ( - hostname: modules: - lib.nixosSystem { - specialArgs = { inherit inputs; }; - modules = [ { networking.hostName = hostname; } ] ++ modules; - } - ) hosts - ); - - mkHomes = ( - system: homes: - lib.mapAttrs ( - username: modules: - home-manager.lib.homeManagerConfiguration { - pkgs = nixpkgs.legacyPackages.${system}; - extraSpecialArgs = { inherit inputs; }; - modules = [ - { - home.username = username; - home.homeDirectory = "/home/${username}"; - } - ] - ++ modules; - } - ) homes - ); - - in flake-parts.lib.mkFlake { inherit inputs; } { - imports = with inputs; [ - treefmt-nix.flakeModule - disko.flakeModules.default + imports = [ + inputs.treefmt-nix.flakeModule ]; systems = [ "x86_64-linux" "aarch64-linux" - "aarch64-darwin" - "x86_64-darwin" ]; perSystem = { config, - self', - inputs', pkgs, - system, ... }: { + devShells.default = pkgs.mkShell { + packages = [ config.treefmt.build.wrapper ]; + }; + treefmt = { projectRootFile = "flake.nix"; programs.nixfmt.enable = true; }; }; - flake = { - nixosConfigurations = { - sora = nixos-uconsole.lib.mkUConsoleSystem { - variant = "cm5"; - specialArgs = { inherit inputs; }; - modules = [ - { networking.hostName = "sora"; } - inputs.disko.nixosModules.disko - ./hosts/sora - ]; + flake = + let + mkSora = + extraModules: + nixos-uconsole.lib.mkUConsoleSystem { + variant = "cm5"; + specialArgs = { inherit inputs; }; + modules = [ + { networking.hostName = "sora"; } + inputs.disko.nixosModules.disko + ./hosts/sora + ./home/winter/nixos.nix + ] + ++ extraModules; + }; + sora = mkSora [ ]; + winter = home-manager.lib.homeManagerConfiguration { + pkgs = inputs.nixpkgs.legacyPackages.aarch64-linux; + extraSpecialArgs = { + inherit inputs; + stateVersion = sora.config.system.stateVersion; + }; + modules = [ ./home/winter ]; + }; + in + { + checks.aarch64-linux = { + sora-system = sora.config.system.build.toplevel; + winter-home = winter.activationPackage; + }; + + homeConfigurations.winter = winter; + + nixosConfigurations.sora = sora; + + nixosModules = { + lix = ./modules/lix.nix; + network = ./modules/network.nix; + run0-sudo-shim = ./modules/run0-sudo-shim.nix; }; }; - }; }; } diff --git a/home/winter/default.nix b/home/winter/default.nix index 1f0f2c2..c64c2e2 100644 --- a/home/winter/default.nix +++ b/home/winter/default.nix @@ -1,5 +1,10 @@ +{ stateVersion, ... }: { - imports = [ + home = { + username = "winter"; + homeDirectory = "/home/winter"; + inherit stateVersion; + }; - ]; + programs.home-manager.enable = true; } diff --git a/home/winter/nixos.nix b/home/winter/nixos.nix new file mode 100644 index 0000000..f42f142 --- /dev/null +++ b/home/winter/nixos.nix @@ -0,0 +1,14 @@ +{ config, inputs, ... }: +{ + imports = [ inputs.home-manager.nixosModules.home-manager ]; + + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + extraSpecialArgs = { + inherit inputs; + stateVersion = config.system.stateVersion; + }; + users.winter = import ./default.nix; + }; +} diff --git a/hosts/sora/default.nix b/hosts/sora/default.nix index d75ad88..11a2bbf 100644 --- a/hosts/sora/default.nix +++ b/hosts/sora/default.nix @@ -1,11 +1,39 @@ -{ pkgs, inputs, ... }: +{ lib, ... }: { imports = [ ./disko.nix ./overrides.nix - "${inputs.self}/modules/lix.nix" - "${inputs.self}/modules/run0-sudo-shim.nix" + ../../modules/lix.nix + ../../modules/network.nix + ../../modules/run0-sudo-shim.nix ]; + services.openssh.settings = { + PermitRootLogin = lib.mkForce "no"; + PasswordAuthentication = lib.mkForce false; + }; + + users = { + mutableUsers = false; + users = { + root = { + initialPassword = lib.mkForce null; + hashedPassword = lib.mkForce "!"; + }; + winter = { + isNormalUser = true; + extraGroups = [ + "networkmanager" + "wheel" + ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBE6oJav0oG+gEmm4oWam4MCFRYQFlBkBb+7dNtHsvcj winter@wavedash" + ]; + }; + }; + }; + + systemd.services.force-password-change.enable = false; + system.stateVersion = "26.05"; } diff --git a/modules/lix.nix b/modules/lix.nix index 5160a5d..07f7474 100644 --- a/modules/lix.nix +++ b/modules/lix.nix @@ -1,17 +1,7 @@ { pkgs, ... }: { - nixpkgs.overlays = [ - (final: prev: { - inherit (prev.lixPackageSets.stable) - nixpkgs-review - nix-eval-jobs - nix-fast-build - colmena - nil - nix-direnv - ; - }) - ]; + # use the scoped package directly; overlaying its members onto the packages + # they override causes an infinite recursion in nixpkgs. nix.package = pkgs.lixPackageSets.stable.lix; } diff --git a/modules/network.nix b/modules/network.nix index c47f6a2..db5931c 100644 --- a/modules/network.nix +++ b/modules/network.nix @@ -1,9 +1,7 @@ { services.resolved = { enable = true; - settings.Resolve = { - DNSOverTLS = true; - }; + settings.Resolve.DNSOverTLS = true; }; networking = { nameservers = [ diff --git a/modules/run0-sudo-shim.nix b/modules/run0-sudo-shim.nix index 1d2225f..790fa40 100644 --- a/modules/run0-sudo-shim.nix +++ b/modules/run0-sudo-shim.nix @@ -1,12 +1,12 @@ -{ inputs, pkgs, ... }: +{ inputs, ... }: { imports = [ inputs.run0-sudo-shim.nixosModules.default ]; + services.dbus.implementation = "broker"; security = { polkit.persistentAuthentication = true; - run0.enable = true; run0-sudo-shim.enable = true; wrappers = { su.enable = false;