Zuckerberg
71baa09bd2
Highlights - No need to update flake for every machine anymore, just add a properties.nix file. - Roles are automatically generated from all machine configurations. - Roles and their secrets automatically are grouped and show up in agenix secrets.nix - Machines and their service configs may now query the properties of all machines. - Machine configuration and secrets are now competely isolated into each machine's directory. - Safety checks to ensure no mixing of luks unlocking secrets and hosts with primary ones. - SSH pubkeys no longer centrally stored but instead per machine where the private key lies for better cleanup.
58 lines
1.6 KiB
Nix
58 lines
1.6 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
];
|
|
|
|
networking.hostName = "ray";
|
|
|
|
# for luks onlock over tor
|
|
services.tor.enable = true;
|
|
services.tor.client.enable = true;
|
|
|
|
# services.howdy.enable = true;
|
|
|
|
hardware.openrazer.enable = true;
|
|
hardware.openrazer.users = [ "googlebot" ];
|
|
hardware.openrazer.devicesOffOnScreensaver = false;
|
|
users.users.googlebot.packages = [ pkgs.polychromatic ];
|
|
|
|
services.udev.extraRules = ''
|
|
# depthai
|
|
SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
|
|
|
|
# Moonlander
|
|
# Rules for Oryx web flashing and live training
|
|
KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
|
|
KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
|
|
# Wally Flashing rules for the Moonlander and Planck EZ
|
|
SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
|
|
'';
|
|
users.groups.plugdev = {
|
|
members = [ "googlebot" ];
|
|
};
|
|
|
|
# virt-manager
|
|
virtualisation.libvirtd.enable = true;
|
|
programs.dconf.enable = true;
|
|
virtualisation.spiceUSBRedirection.enable = true;
|
|
environment.systemPackages = with pkgs; [ virt-manager ];
|
|
users.users.googlebot.extraGroups = [ "libvirtd" ];
|
|
|
|
# allow building ARM derivations
|
|
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
|
|
|
services.spotifyd.enable = true;
|
|
|
|
virtualisation.docker.enable = true;
|
|
|
|
virtualisation.appvm.enable = true;
|
|
virtualisation.appvm.user = "googlebot";
|
|
|
|
services.mount-samba.enable = true;
|
|
|
|
de.enable = true;
|
|
de.touchpad.enable = true;
|
|
}
|