Commit bcf3c77dabd4
Changed files (7)
systems/kyushu/boot.nix
@@ -1,62 +0,0 @@
-{ pkgs, lib, ... }:
-{
- environment.systemPackages = with pkgs; [
- sbctl
- ];
-
- boot = {
- # Secure boot configuration
- # First boot systemd-boot has to be enabled, then switch to lanzaboote
- loader.systemd-boot.enable = lib.mkForce false;
- lanzaboote = {
- enable = true;
- pkiBundle = "/var/lib/sbctl";
- };
-
- initrd = {
- luks.devices."cryptroot" = {
- crypttabExtraOpts = [ "fido2-device=auto" ];
- };
- systemd = {
- fido2.enable = true;
- };
- };
-
- # extraModprobeConfig = ''
- # options snd_hda_intel power_save=1
- # '';
-
- blacklistedKernelModules = [
- "sierra_net" # sierra wireless modules
- "cdc_mbim" # modem mobile broadband modules
- "cdc_ncm" # similar
- ];
- kernelModules = [
- "ahci" # sata controller, might not be needed
- "nvme" # required for nvme disks
- "thunderbolt" # required for thunderbolt (dock, …)
- # from thinkpad x1 gen 9
- "dm-mod"
- "cryptd" # required for encryption
- "xhci_pci" # usb controller related
- "usb_storage" # usb storage related
- "sd_mod" # block device related
- "sdhci_pci" # block device related as well
- "aesni-intel" # advanced encryption for intel
- "kvm_intel"
- ];
-
- kernelParams = [
- # Kernel GPU Savings Options (NOTE i915 chipset only)
- # "i915.enable_rc6=1"
- # "i915.enable_fbc=1"
- # "i915.lvds_use_ssc=0"
- # "drm.debug=0"
- # "drm.vblankoffdelay=1"
- "kvm_intel.nested=1"
- "intel_iommu=on"
- ];
-
- kernelPackages = pkgs.cachyosKernels.linuxPackages-cachyos-latest-lto-x86_64-v3;
- };
-}
systems/kyushu/disks.nix
@@ -1,55 +0,0 @@
-_: {
- disko.devices = {
- disk = {
- # 512GB root/boot drive. Configured with:
- # - A FAT32 ESP partition for systemd-boot
- # - A LUKS container which contains an EXT4 filesystem
- root = {
- type = "disk";
- device = "/dev/nvme0n1";
- content = {
- type = "gpt";
- partitions = {
- ESP = {
- size = "1G";
- type = "EF00";
- content = {
- type = "filesystem";
- format = "vfat";
- mountpoint = "/boot";
- mountOptions = [ "umask=0077" ];
- };
- };
- root = {
- size = "100%";
- content = {
- # LUKS passphrase will be prompted interactively only
- type = "luks";
- name = "cryptroot";
- askPassword = true;
- settings = {
- # Make sure there is no trailing newline in keyfile if used for interactive unlock.
- # Use `echo -n "password" > /tmp/data.keyfile`
- # keyFile = "/dev/disk/by-id/usb-_USB_DISK_2.0_070D375D84327E87-0:0";
- # keyFileOffset = 30992883712;
- # keyFileSize = 4096;
- allowDiscards = true;
- };
- content = {
- type = "filesystem";
- format = "ext4";
- mountpoint = "/";
- mountOptions = [
- "noatime"
- "nodiratime"
- "discard"
- ];
- };
- };
- };
- };
- };
- };
- };
- };
-}
systems/kyushu/extra.nix
@@ -1,174 +0,0 @@
-{
- pkgs,
- lib,
- ...
-}:
-let
- officemode = pkgs.writeShellScriptBin "officemode" ''
- echo "80" > /sys/class/power_supply/BAT0/charge_control_end_threshold
- echo "70" > /sys/class/power_supply/BAT0/charge_control_start_threshold
- echo "Office mode: charging between 70%–80%"
- '';
- roadmode = pkgs.writeShellScriptBin "roadmode" ''
- echo "100" > /sys/class/power_supply/BAT0/charge_control_end_threshold
- echo "0" > /sys/class/power_supply/BAT0/charge_control_start_threshold
- echo "Road mode: charging to 100%"
- '';
-in
-{
-
- imports = [
- ../common/hardware/laptop.nix
- ../common/programs/direnv.nix
- ../common/programs/git.nix
- ../common/programs/tmux.nix
- ../common/services/networkmanager.nix
- ../common/services/containers.nix
- ../common/services/docker.nix
- ../common/services/libvirt.nix
- ../common/services/binfmt.nix
- ../common/services/oomd.nix
- ../../modules/laptop-keyboard-inhibit
-
- ../redhat
- ];
-
- # It takes.. multiple GB, and I don't really use it...
- programs.obs-studio = {
- enable = false;
- plugins = with pkgs.obs-studio-plugins; [
- wlrobs
- obs-backgroundremoval
- obs-pipewire-audio-capture
- input-overlay
- ];
- };
-
- # Auto-disable internal keyboard when Moonlander (USB) is connected
- services.laptop-keyboard-inhibit = {
- enable = true;
- keyboards = [ ]; # BT monitor disabled (spams D-Bus on reconnect)
- usbKeyboards = [
- {
- vendor = "3297";
- product = "1969";
- }
- ];
- };
-
- services = {
- getty = {
- autologinOnce = true;
- autologinUser = "vincent";
- };
- # TODO probably migrate elsewhere
- kanata = {
- enable = true;
- package = pkgs.kanata-with-cmd;
- keyboards.x1 = {
- devices = [ "/dev/input/event0" ]; # internal keyboard
- config = builtins.readFile (./. + "/main.kbd");
- extraDefCfg = ''
- danger-enable-cmd yes
- process-unmapped-keys yes
- override-release-on-activation yes
- concurrent-tap-hold yes
- '';
- };
- };
- locate = {
- enable = true;
- pruneBindMounts = true;
- };
-
- hardware.bolt.enable = true;
- printing = {
- enable = true;
- drivers = with pkgs; [
- # cnijfilter2 # Disabled: broken in nixpkgs-unstable (bool typedef error)
- gutenprint
- gutenprintBin
- ];
- };
- };
-
- # Canon MX530 printer via Gutenprint driver (driverless/IPP auto-config
- # defaults to Photographic media type, causing documents to print tiny)
- hardware.printers = {
- ensurePrinters = [
- {
- name = "Canon_MX530_Gutenprint";
- description = "Canon MX530 series (Gutenprint)";
- location = "Home";
- deviceUri = "ipp://192.168.1.16:631/ipp/print";
- model = "gutenprint.${lib.versions.majorMinor (lib.getVersion pkgs.gutenprint)}://bjc-MX530-series/expert";
- ppdOptions = {
- PageSize = "A4";
- MediaType = "Plain";
- InputSlot = "Front";
- ColorModel = "RGB";
- Duplex = "None";
- StpQuality = "Standard";
- };
- }
- ];
- ensureDefaultPrinter = "Canon_MX530_Gutenprint";
- };
-
- hardware.keyboard.qmk.enable = true;
-
- services.udev.packages = [ pkgs.sane-airscan ];
- services.udev.extraRules = ''
- # Disable autosuspend for Logitech C920 to prevent xHCI controller resets
- # that cascade to the r8152 USB ethernet adapter, causing packet drops.
- ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="046d", ATTR{idProduct}=="082d", ATTR{power/control}="on"
-
- # Force Gigabit advertisement on ThinkPad dock ethernet (r8152/RTL8153).
- # Without this, auto-negotiation only advertises 100Mbps.
- ACTION=="add", SUBSYSTEM=="net", DRIVERS=="r8152", ATTR{address}=="00:50:b6:b4:2c:14", RUN+="${pkgs.ethtool}/bin/ethtool -s $env{INTERFACE} advertise 0x03F"
- '';
- hardware.sane = {
- enable = true;
- extraBackends = [ pkgs.sane-airscan ];
- openFirewall = true;
- netConf = "192.168.12.70";
- };
-
- # Battery charge thresholds: default to office mode on boot
- systemd.services.battery-charge-threshold = {
- description = "Set battery charge threshold to office mode (80%)";
- wantedBy = [ "multi-user.target" ];
- after = [ "multi-user.target" ];
- serviceConfig = {
- Type = "oneshot";
- ExecStart = "${officemode}/bin/officemode";
- };
- };
-
- security.sudo.extraRules = [
- {
- groups = [ "wheel" ];
- commands = [
- {
- command = "${officemode}/bin/officemode";
- options = [ "NOPASSWD" ];
- }
- {
- command = "${roadmode}/bin/roadmode";
- options = [ "NOPASSWD" ];
- }
- ];
- }
- ];
-
- environment.systemPackages = with pkgs; [
- kanata
- nixos-rebuild-ng
- battery-monitor
- # backup
- virt-manager
- ];
-
- # Make sure we don't start docker until required
- systemd.services.docker.wantedBy = lib.mkForce [ ];
-}
systems/kyushu/hardware.nix
@@ -1,72 +0,0 @@
-{
- globals,
- inputs,
- lib,
- ...
-}:
-{
- imports = [
- inputs.disko.nixosModules.disko
- (import ./disks.nix { inherit lib; })
-
- inputs.nixos-hardware.nixosModules.lenovo-thinkpad-x1-12th-gen
-
- ../common/hardware/acpid.nix
- ../common/hardware/bluetooth.nix
- ../common/services/nfs-mounts.nix
- ];
-
- swapDevices = [
- {
- device = "/swapfile";
- size = 8 * 1024; # 8GB
- }
- ];
-
- hardware = {
- # opengl.extraPackages = with pkgs; [ vaapiIntel libvdpau-va-gl vaapiVdpau intel-ocl intel-media-driver ];
- };
-
- # NFS mounts from globals defaults (rhea + aion)
- services.nfs-mounts.hosts = globals.net.nfs.defaultHosts;
-
- # NFS mounts from synodine (NFSv3)
- fileSystems."/net/synodine/usbshare" = {
- device = "synodine.home:/volumeUSB2/usbshare";
- fsType = "nfs";
- options = [
- "nfsvers=3"
- "x-systemd.automount"
- "noauto"
- "x-systemd.idle-timeout=600"
- "soft"
- "_netdev"
- ];
- };
-
- fileSystems."/net/synodine/downloads" = {
- device = "synodine.home:/volume1/downloads";
- fsType = "nfs";
- options = [
- "nfsvers=3"
- "x-systemd.automount"
- "noauto"
- "x-systemd.idle-timeout=600"
- "soft"
- "_netdev"
- ];
- };
-
- fileSystems."/net/synodine/video" = {
- device = "synodine.home:/volume1/video";
- fsType = "nfs";
- options = [
- "nfsvers=3"
- "x-systemd.automount"
- "noauto"
- "x-systemd.idle-timeout=600"
- "soft"
- "_netdev"
- ];
- };
-}
systems/kyushu/main.kbd
@@ -1,120 +0,0 @@
-;; Variables for tap/hold timings
-(defvar
- tap-time 300
- hold-time 200)
-
-(defchords querty 20
- (h ) h
- ( j ) j
- ( k ) k
- ( l ) l
- ( ;) ;
- ( o ) o
- ( p ) p
-;; ( k l) M-`
-;; ( j l) @backforth
- ( l ;) esc
- ( o p ) @capsword
-)
-
-;; Aliases for custom key behaviors
-(defalias
- chj (chord querty j)
- chk (chord querty k)
- chl (chord querty l)
- chh (chord querty h)
- chscln (chord querty ;)
- cho (chord querty o)
- chp (chord querty p)
-
- hyper (multi lctl lalt lsft lmet)
- capsword (caps-word 2000)
- escctrl (tap-hold 100 100 esc lctl)
- a_met (tap-hold 500 $hold-time a lmet)
- s_alt (tap-hold 500 $hold-time s lalt)
- d_sft (tap-hold 500 $hold-time d lsft)
- f_ctl (tap-hold 500 $hold-time f lctl)
- g_hyp (tap-hold 500 $hold-time g @hyper)
- h_hyp (tap-hold 500 $hold-time @chh @hyper)
- j_ctl (tap-hold 500 $hold-time @chj rctl)
- k_sft (tap-hold 500 $hold-time @chk rsft)
- l_ralt (tap-hold 500 $hold-time @chl ralt)
- scln_met (tap-hold 500 $hold-time @chscln rmet)
- apos_hyp (tap-hold 500 $hold-time apos @hyper)
- s_met (tap-hold 500 $hold-time s lmet)
- d_alt (tap-hold 500 $hold-time d lalt)
- f_sft (tap-hold 500 $hold-time f lsft)
- p_rsft (tap-hold $tap-time $hold-time p rsft)
- i_ralt (tap-hold $tap-time $hold-time i ralt)
- o_rmet (tap-hold $tap-time $hold-time o rmet)
- ;; fnl (one-shot 5000 (layer-while-held fn))
- thyper (tap-hold $tap-time $hold-time spc @hyper)
- backforth (tap-hold 100 $hold-time M-tab rsft)
- ;; nav (layer-toggle nav_layer)
- ;; scln_nav (tap-hold $tap-time $hold-time scln @nav)
- )
-
-(defsrc
- esc f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 home end ins del ;; Row 1
- grv 1 2 3 4 5 6 7 8 9 0 - = bspc ;; Row 2
- tab q w e r t y u i o p [ ] bksl ;; Row 3
- caps a s d f g h j k l scln ' ret ;; Row 4
- lsft z x c v b n m , . / rsft ;; Row 5
- lctl lmet lalt spc ralt rctl pgup up pgdn ;; Row 6
- left down right
-)
-
-(deflayer base
- esc f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 home end ins del ;; Row 1
- grv 1 2 3 4 5 6 7 8 9 0 - = bspc ;; Row 2
- tab q w e r t y u i @cho @chp [ ] bksl ;; Row 3
- caps @a_met @s_alt @d_sft @f_ctl @g_hyp @h_hyp @j_ctl @k_sft @l_ralt @scln_met apos ret ;; Row 4
- lsft z x c v b n m , . / rsft ;; Row 5
- lctl lmet lalt spc ralt rctl pgup up pgdn ;; Row 6
- left down right
-)
-
-;; (deflayer base
-;; ;; Row 1
-;; esc brdn brup vold volu _ _ prev pp next mute vold volu
-;; ;; Row 2
-;; grv 1 2 3 4 5 6 7 8 9 0 - = bspc
-;; ;; Row 3
-;; tab q w e r t y u i o p [ ] bksl
-;; ;; Row 4
-;; @escctrl a @s_met @d_alt @f_sft g @chh @chj @chk @chl @scln_nav ' ret
-;; ;; Row 5
-;; @backforth @nav z x c v b n m , . / rsft up
-;; ;; Row 6
-;; lctl lalt lmet @thyper rmet ralt left down rght
-;; )
-
-;; (deflayer fn
-;; ;; Row 1
-;; _ f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12
-;; ;; Row 2
-;; _ _ _ _ _ _ _ _ _ _ _ _ _ del
-;; ;; Row 3
-;; _ _ _ _ _ _ _ _ _ _ _ _ _ _
-;; ;; Row 4
-;; _ _ _ _ _ _ _ _ _ _ _ _ _
-;; ;; Row 5
-;; _ _ _ _ _ _ _ _ _ _ _ _ _ pgup
-;; ;; Row 6
-;; _ _ _ _ _ _ home pgdn end
-;; )
-;;
-;; (deflayer nav_layer
-;; ;; Row 1
-;; _ _ _ _ _ _ _ _ _ _ _ _ _
-;; ;; Row 2
-;; _ _ _ _ _ _ _ _ _ _ _ _ _ _
-;; ;; Row 3
-;; _ left right _ _ _ _ _ up M-` _ _ _ _
-;; ;; Row 4
-;; _ _ down up _ _ _ left down right _ _ _
-;; ;; Row 5
-;; _ _ left right _ _ _ _ _ _ _ _ _ _
-;; ;; Row 6
-;; _ M-S-[ M-S-] _ M-S-[ M-S-] _ _ _
-;; )
flake.nix
@@ -77,12 +77,6 @@
};
};
nixosConfigurations = {
- # Work laptop (unstable)
- kyushu = libx.mkHost {
- hostname = "kyushu";
- # desktop = "sway";
- desktop = "niri";
- };
# Laptop for LLM workloads (unstable)
okinawa = libx.mkHost {
hostname = "okinawa";
@@ -172,10 +166,6 @@
hostname = "aomi";
system = "x86_64-linux";
};
- kyushu = libx.mkSystemManager {
- hostname = "kyushu";
- system = "x86_64-linux";
- };
nagoya = libx.mkSystemManager {
hostname = "nagoya";
system = "aarch64-linux";
secrets.nix
@@ -12,14 +12,13 @@ let
sakhalin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN/PMBThi4DhgZR8VywbRDzzMVh2Qp3T6NJAcPubfXz6"; # ssh-keyscan -q -t ed25519 sakhalin.sbr.pm
shikoku = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH18c6kcorVbK2TwCgdewL6nQf29Cd5BVTeq8nRYUigm"; # ssh-keyscan -q -t ed25519 shikoku.sbr.pm
# wakasu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrAh07USjRnAdS3mMNGdKee1KumjYDLzgXaiZ5LYi2D"; # ssh-keyscan -q -t ed25519 wakasu.sbr.pm
- kyushu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd795m+P54GlGJdMaGci9pQ9N942VUz8ri2F14+LWxg"; # ssh-keyscan -q -t ed25519 kyushu.sbr.pm
+ # kyushu: decommissioned from NixOS, now Fedora CSB (2026-07-28)
aion = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXDNi2KtoRU83y/V5OWnMbFWmxwBknPmrNWV4RChE7R"; # ssh-keyscan -q -t ed25519 aion.sbr.pm
aix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEoUicDySCGETPAgmI0P3UrgZEXXw3zNsyCIylUP0bML"; # ssh-keyscan -q -t ed25519 aix.sbr.pm
nagoya = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfep1SkMsAPHggXFLfEJNzZb7eoihtkqDeQruG+TbhF";
okinawa = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8vCZ0h6geJZt6i5k6chEDZBggoyq91Z+oNSjvVeSfW"; # From globals.nix
carthage = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDurbEy1PiidOirbiPXz84ySdv3rwosPTAlCqacc73a"; # ssh-keyscan -q -t ed25519 carthage.sbr.pm
desktops = [
- kyushu
okinawa
];
servers = [
@@ -46,55 +45,42 @@ in
# Red Hat
"secrets/redhat/krb5.conf.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/RHVPN.ovpn.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/AMS2.ovpn.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/RDU2.ovpn.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/BBRQ.ovpn.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/ipa.crt.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/2022-RH-IT-Root-CA.pem.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/Eng-CA.crt.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/newca.crt.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/oracle_ebs.crt.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/pki-ca-chain.crt.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/RH_ITW.crt.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/win-intermediate-ca.cer.age".publicKeys = users ++ [
- kyushu
okinawa
];
"secrets/redhat/redhat.pem.age".publicKeys = users ++ systems;