Daniel Lundin
c59ea29957
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
We want verity protected partitions as well as encrypted state/data along with verified boot. This PR integrates Peter Marshall's awesome little Nixlet project as a starting point, especially the nice testing scaffolding will be super helpful! ✨ https://github.com/petm5/nixlet/
86 lines
1.7 KiB
Nix
86 lines
1.7 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
modulesPath,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
(modulesPath + "/profiles/image-based-appliance.nix")
|
|
(modulesPath + "/profiles/perlless.nix")
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
];
|
|
|
|
# system.forbiddenDependenciesRegexes = lib.mkForce [ ];
|
|
|
|
nixpkgs.flake.setNixPath = false;
|
|
nixpkgs.flake.setFlakeRegistry = false;
|
|
|
|
networking.hostName = "patos";
|
|
|
|
boot.kernelModules = [
|
|
"zram"
|
|
"usb_storage"
|
|
"uas"
|
|
"sd_mod"
|
|
"r8169"
|
|
"ehci-hcd"
|
|
"ehci-pci"
|
|
"xhci-hcd"
|
|
"xhci-pci"
|
|
"xhci-pci-renesas"
|
|
"nvme"
|
|
"virtio_net"
|
|
];
|
|
|
|
system.etc.overlay.mutable = lib.mkDefault false;
|
|
users.mutableUsers = lib.mkDefault false;
|
|
|
|
|
|
systemd.watchdog = lib.mkDefault {
|
|
runtimeTime = "10s";
|
|
rebootTime = "30s";
|
|
};
|
|
|
|
zramSwap.enable = true;
|
|
|
|
services.openssh.settings.PasswordAuthentication = lib.mkDefault false;
|
|
|
|
users.allowNoPasswordLogin = true;
|
|
security.sudo.enable = lib.mkDefault false;
|
|
|
|
security.polkit = {
|
|
enable = true;
|
|
extraConfig =''
|
|
polkit.addRule(function(action, subject) {
|
|
if (subject.isInGroup("wheel")) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
'';
|
|
};
|
|
|
|
i18n.supportedLocales = [ "en_US.UTF-8/UTF-8" ];
|
|
|
|
systemd.enableEmergencyMode = false;
|
|
console.enable = false;
|
|
systemd.services."getty@tty1".enable = lib.mkDefault false;
|
|
systemd.services."autovt@".enable = lib.mkDefault false;
|
|
|
|
boot.tmp.useTmpfs = true;
|
|
boot.consoleLogLevel = lib.mkDefault 1;
|
|
boot.kernelParams = [
|
|
"panic=1"
|
|
"boot.panic_on_fail"
|
|
"nomodeset"
|
|
];
|
|
|
|
# This is vi country
|
|
programs.nano.enable = false;
|
|
programs.vim.enable = true;
|
|
programs.vim.defaultEditor = lib.mkDefault true;
|
|
|
|
# Logging
|
|
services.journald.storage = "volatile";
|
|
}
|