zuckerberg/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Activity

nixpkgs-fmt everything

Browse Source
This commit is contained in:
Zuckerberg
2023-04-04 23:30:28 -06:00
parent 3c683e7b9e
commit f68a4f4431
67 changed files with 400 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
common/boot/bios.nix
View File

@@ -3,7 +3,8 @@
with lib;
let
cfg = config.bios;
in {
in
{
options.bios = {
enable = mkEnableOption "enable bios boot";
device = mkOption {
@@ -25,4 +26,4 @@ in {
};
};
};
}
}

2
common/boot/default.nix
View File

@@ -7,4 +7,4 @@
./bios.nix
./remote-luks-unlock.nix
];
}
}

5
common/boot/efi.nix
View File

@@ -3,7 +3,8 @@
with lib;
let
cfg = config.efi;
in {
in
{
options.efi = {
enable = mkEnableOption "enable efi boot";
};
@@ -19,7 +20,7 @@ in {
version = 2;
efiSupport = true;
useOSProber = true;
# memtest86.enable = true;
# memtest86.enable = true;
configurationLimit = 20;
theme = pkgs.nixos-grub2-theme;
};

5
common/boot/firmware.nix
View File

@@ -3,7 +3,8 @@
with lib;
let
cfg = config.firmware;
in {
in
{
options.firmware.x86_64 = {
enable = mkEnableOption "enable x86_64 firmware";
};
@@ -14,4 +15,4 @@ in {
};
# services.fwupd.enable = true;
}
}

56
common/boot/remote-luks-unlock.nix
View File

@@ -2,7 +2,8 @@
let
cfg = config.remoteLuksUnlock;
in {
in
{
options.remoteLuksUnlock = {
enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
enableTorUnlock = lib.mkOption {
@@ -61,33 +62,38 @@ in {
copy_bin_and_libs ${pkgs.haveged}/bin/haveged
'';
boot.initrd.network.postCommands = lib.mkMerge [
(''
# Add nice prompt for giving LUKS passphrase over ssh
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
'')
(let torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort 22 127.0.0.1:22
''); in lib.mkIf cfg.enableTorUnlock ''
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
(
''
# Add nice prompt for giving LUKS passphrase over ssh
echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
''
)
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
ip link set lo up
(
let torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort 22 127.0.0.1:22
''); in
lib.mkIf cfg.enableTorUnlock ''
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
echo "haveged: starting haveged"
haveged -F &
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
ip link set lo up
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
'')
echo "haveged: starting haveged"
haveged -F &
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
''
)
];
};
}