Commit c3624c175ee7
Changed files (7)
dots
config
claude
systems
dots/config/claude/settings.json
@@ -132,5 +132,6 @@
"/home/vincent/src/home",
"/home/vincent/src/tekton-watcher",
"/home/vincent/src/go-ci"
- ]
+ ],
+ "theme": "light"
}
systems/aomi/boot.nix
@@ -1,54 +0,0 @@
-{ pkgs, ... }:
-{
- boot = {
- loader.systemd-boot.netbootxyz.enable = true;
- # initrd.systemd.enable = lib.mkForce false;
- initrd.availableKernelModules = [
- "nvme"
- "rtsx_pci_sdmmc"
- "thunderbolt"
- "dm-mod"
- ];
- # initrd = {
- # luks.devices."cryptroot" = {
- # crypttabExtraOpts = [ "fido2-device=auto" ];
- # };
- # systemd = {
- # fido2.enable = true;
- # };
- # };
-
- blacklistedKernelModules = [
- "sierra_net" # sierra wireless modules
- "cdc_mbim" # modem mobile broadband modules
- "cdc_ncm" # similar
- ];
- kernelModules = [
- "ahci" # sata controller, might not be needed
- "nvme" # required for nvme disks
- "thunderbolt" # required for thunderbolt (dock, …)
- # from thinkpad x1 gen 9
- "dm-mod"
- "cryptd" # required for encryption
- "xhci_pci" # usb controller related
- "usb_storage" # usb storage related
- "sd_mod" # block device related
- "sdhci_pci" # block device related as well
- "aesni-intel" # advanced encryption for intel
- "kvm_intel"
- ];
-
- kernelParams = [
- # Kernel GPU Savings Options (NOTE i915 chipset only)
- # "i915.enable_rc6=1"
- # "i915.enable_fbc=1"
- # "i915.lvds_use_ssc=0"
- # "drm.debug=0"
- # "drm.vblankoffdelay=1"
- "kvm_intel.nested=1"
- "intel_iommu=on"
- ];
-
- kernelPackages = pkgs.linuxPackages_latest;
- };
-}
systems/aomi/extra.nix
@@ -1,89 +0,0 @@
-{
- pkgs,
- ...
-}:
-{
-
- imports = [
- ../common/hardware/laptop.nix
- ../common/programs/direnv.nix
- ../common/programs/git.nix
- ../common/programs/nix-ld.nix
- ../common/programs/tmux.nix
- # ../common/services/networkmanager.nix
- # ../common/services/fprint.nix # With yubikey I don't really need this to be honest
- ../common/services/ansible.nix
- ../common/services/containers.nix
- ../common/services/docker.nix
- ../common/services/libvirt.nix
- ../common/services/binfmt.nix
-
- ../common/services/oomd.nix
-
- ../redhat
- ];
-
- # Suppress malformed DHCP option 24 (MTU plateau) warnings from router
- networking.dhcpcd.extraConfig = ''
- nooption mtu_plateau
- denyinterfaces wg0
- '';
-
- services = {
- logind.settings.Login = {
- HandleLidSwitch = "ignore";
- HandleLidSwitchExternalPower = "ignore";
- HandleLidSwitchDocked = "ignore";
- };
-
- smartd = {
- enable = true;
- devices = [ { device = "/dev/nvme0n1"; } ];
- };
- hardware.bolt.enable = true;
- # gitea-actions-runner = {
- # instances = {
- # "aomi-codeberg" = {
- # name = "aomi";
- # enable = true;
- # url = "https://codeberg.org";
- # # tokenFile = "/home/vincent/sync/codeberg.token";
- # tokenFile = "/etc/codeberg.token";
- # labels = [
- # # "local:host"
- # "nixos-${pkgs.system}:host"
- # "native:host"
- # "docker:docker://gitea/runner-images:ubuntu-latest"
- # "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
- # "ubuntu-24.04:docker://gitea/runner-images:ubuntu-24.04"
- # "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
- # "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
- # # "nix:docker://localhost:5921/nix-runner"
- # ];
- # hostPackages = with pkgs; [
- # bash
- # direnv
- # coreutils
- # curl
- # gawk
- # nixVersions.stable
- # gitFull
- # gnused
- # docker
- # openssh
- # wget
- # ];
- # };
- # };
- # };
- };
-
- environment.systemPackages = with pkgs; [
- jayrah
- ];
-
- # Firewall
- networking.firewall.allowedTCPPorts = [
- 9000 # Prometheus node exporter
- ];
-}
systems/aomi/hardware.nix
@@ -1,52 +0,0 @@
-{
- globals,
- inputs,
- ...
-}:
-{
- imports = [
- # inputs.disko.nixosModules.diskop # Do this if re-install
- # (import ./disks.nix { inherit lib; })
-
- inputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1-gen3
-
- ../common/hardware/acpid.nix
- # ../common/hardware/bluetooth.nix
- ../common/services/nfs-mounts.nix
- ];
-
- hardware = {
- enableAllFirmware = true;
- };
-
- # FILESYSTEM
- boot.initrd.luks.devices = {
- root = {
- device = "/dev/disk/by-uuid/91b05f64-b97d-4405-8405-8785699ada8f";
- preLVM = true;
- allowDiscards = true;
- keyFile = "/dev/disk/by-id/mmc-SD08G_0x704a5a38";
- keyFileSize = 4096;
- };
- };
-
- fileSystems."/" = {
- # device = "/dev/disk/by-uuid/6bedd234-3179-46f7-9a3f-feeffd880791";
- device = "/dev/mapper/root";
- fsType = "ext4";
- options = [
- "noatime"
- "discard"
- ];
- };
-
- fileSystems."/boot" = {
- device = "/dev/disk/by-uuid/32B9-94CC";
- fsType = "vfat";
- };
-
- swapDevices = [ { device = "/dev/disk/by-uuid/24da6a46-cd28-4bff-9220-6f449e3bd8b5"; } ];
-
- # NFS mounts from globals defaults (rhea + aion)
- services.nfs-mounts.hosts = globals.net.nfs.defaultHosts;
-}
systems/aomi/home.nix
@@ -21,8 +21,15 @@
socketActivation.enable = true;
};
+ # Delay emacs daemon until unscd is ready (system service)
+ # Without this, emacs starts before LDAP user resolution works
+ systemd.user.services.emacs.Unit.After = [ "nss-user-lookup.target" ];
+ systemd.user.services.emacs.Service.ExecStartPre =
+ "-/bin/sh -c 'until test -S /var/run/nscd/socket; do sleep 0.2; done'";
+
home.sessionVariables = {
PASSAGE_IDENTITIES_FILE = pkgs.lib.mkForce "${config.home.homeDirectory}/.ssh/id_ed25519";
+
};
home.packages = with pkgs; [
flake.nix
@@ -84,9 +84,6 @@
desktop = "niri"; # or "sway"
};
# Servers (unstable)
- aomi = libx.mkHost {
- hostname = "aomi";
- };
sakhalin = libx.mkHost {
hostname = "sakhalin";
};
secrets.nix
@@ -8,7 +8,6 @@ let
vincent-yubikey5c2
];
- aomi = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQVlSrUKU0xlM9E+sJ8qgdgqCW6ePctEBD2Yf+OnyME"; # ssh-keyscan -q -t ed25519 aomi.sbr.pm
athena = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/4KRP1rzOwyA2zP1Nf1WlLRHqAGutLtOHYWfH732xh"; # ssh-keyscan -q -t ed25519 athena.sbr.pm
demeter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqQfEyHyjIGglayB9FtCqL7bnYfNSQlBXks2IuyCPmd"; # ssh-keyscan -q -t ed25519 demeter.sbr.pm
kerkouane = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJguVoQYObRLyNxELFc3ai2yDJ25+naiM3tKrBGuxwwA"; # ssh-keyscan -q -t ed25519 kerkouane.sbr.pm
@@ -29,7 +28,6 @@ let
servers = [
aion
aix
- aomi
athena
carthage
demeter
@@ -52,67 +50,54 @@ in
# Red Hat
"secrets/redhat/krb5.conf.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/RHVPN.ovpn.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/AMS2.ovpn.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/RDU2.ovpn.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/BBRQ.ovpn.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/ipa.crt.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/2022-RH-IT-Root-CA.pem.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/Eng-CA.crt.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/newca.crt.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/oracle_ebs.crt.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/pki-ca-chain.crt.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/RH_ITW.crt.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];
"secrets/redhat/win-intermediate-ca.cer.age".publicKeys = users ++ [
- aomi
kyushu
okinawa
];