refactor: split base.nix into core.nix + base.nix layers
core.nix is the new minimal layer: user, SSH, fish, nix flakes/gc, locale, and a handful of essential packages. Suitable for any headless host that just needs to be SSHable and manageable. base.nix now imports core.nix and adds the day-to-day quality-of-life layer: avahi, mosh, direnv, nix-ld, earlyoom, zramSwap, CLI tools, and build toolchains. All existing hosts that import base.nix are unchanged. bootstrap is updated to import core.nix directly instead of duplicating the config inline. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
parent
459a8622c9
commit
28e7103375
3 changed files with 81 additions and 184 deletions
|
|
@ -3,91 +3,25 @@
|
|||
{
|
||||
imports = [
|
||||
(modulesPath + "/virtualisation/proxmox-lxc.nix")
|
||||
../modules/core.nix
|
||||
];
|
||||
|
||||
nix.settings = {
|
||||
sandbox = false;
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
auto-optimise-store = true;
|
||||
trusted-users = [ "root" "alex" ];
|
||||
};
|
||||
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
nix.settings.sandbox = false;
|
||||
|
||||
proxmoxLXC = {
|
||||
manageNetwork = false;
|
||||
privileged = false;
|
||||
privileged = true;
|
||||
};
|
||||
|
||||
networking.hostName = "bootstrap";
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_AU.UTF-8";
|
||||
LC_IDENTIFICATION = "en_AU.UTF-8";
|
||||
LC_MEASUREMENT = "en_AU.UTF-8";
|
||||
LC_MONETARY = "en_AU.UTF-8";
|
||||
LC_NAME = "en_AU.UTF-8";
|
||||
LC_NUMERIC = "en_AU.UTF-8";
|
||||
LC_PAPER = "en_AU.UTF-8";
|
||||
LC_TELEPHONE = "en_AU.UTF-8";
|
||||
LC_TIME = "en_AU.UTF-8";
|
||||
};
|
||||
|
||||
console.keyMap = "dvorak";
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
documentation.man.generateCaches = false;
|
||||
|
||||
programs.fish.enable = true;
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns4 = true;
|
||||
nssmdns6 = true;
|
||||
publish = {
|
||||
enable = true;
|
||||
addresses = true;
|
||||
};
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
users.users.alex = {
|
||||
isNormalUser = true;
|
||||
description = "Alexander Wainwright";
|
||||
extraGroups = [ "wheel" ];
|
||||
shell = pkgs.fish;
|
||||
openssh.authorizedKeys.keys = [
|
||||
# TODO: add your SSH public key here
|
||||
];
|
||||
};
|
||||
users.users.alex.openssh.authorizedKeys.keys = [
|
||||
# TODO: add your SSH public key here
|
||||
];
|
||||
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
# TODO: add your SSH public key here
|
||||
];
|
||||
|
||||
environment.variables.EDITOR = "nvim";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
git
|
||||
htop
|
||||
neovim
|
||||
rsync
|
||||
wget
|
||||
];
|
||||
|
||||
system.stateVersion = "25.11";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,42 +1,15 @@
|
|||
{ config, pkgs, inputs, ... }:
|
||||
{
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users = {
|
||||
users.alex = {
|
||||
isNormalUser = true;
|
||||
description = "Alexander Wainwright";
|
||||
extraGroups = [
|
||||
"dialout"
|
||||
"input"
|
||||
"networkmanager"
|
||||
"plugdev"
|
||||
"render"
|
||||
"video"
|
||||
"wheel"
|
||||
];
|
||||
packages = with pkgs; [
|
||||
# thunderbird
|
||||
];
|
||||
shell = pkgs.fish;
|
||||
};
|
||||
groups.pluggdev = {};
|
||||
};
|
||||
imports = [ ./core.nix ];
|
||||
|
||||
services.udev.packages = [ pkgs.rtl-sdr ];
|
||||
services.udev.packages = [ pkgs.rtl-sdr ];
|
||||
|
||||
# this is to avoid some problem that happens apparently only when fish is
|
||||
# enabled, where generating man cahes takes a very long time. note that it may
|
||||
# break fish man completion and apropos.
|
||||
documentation.man.generateCaches = false;
|
||||
|
||||
# enable zram. not totally sure if this does it in physical ram or just swap
|
||||
zramSwap.enable = true;
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
"vm.swappiness" = 10;
|
||||
};
|
||||
|
||||
# enable earlyoom to stop the system becoming unresponsive when out of ram
|
||||
services.earlyoom = {
|
||||
enable = true;
|
||||
freeMemThreshold = 10;
|
||||
|
|
@ -45,31 +18,6 @@
|
|||
|
||||
networking.firewall.allowedTCPPorts = [ 8000 8080 ];
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_AU.UTF-8";
|
||||
LC_IDENTIFICATION = "en_AU.UTF-8";
|
||||
LC_MEASUREMENT = "en_AU.UTF-8";
|
||||
LC_MONETARY = "en_AU.UTF-8";
|
||||
LC_NAME = "en_AU.UTF-8";
|
||||
LC_NUMERIC = "en_AU.UTF-8";
|
||||
LC_PAPER = "en_AU.UTF-8";
|
||||
LC_TELEPHONE = "en_AU.UTF-8";
|
||||
LC_TIME = "en_AU.UTF-8";
|
||||
};
|
||||
|
||||
# Configure console keymap
|
||||
console.keyMap = "dvorak";
|
||||
|
||||
# fish shell
|
||||
programs.fish.enable = true;
|
||||
|
||||
# direnv
|
||||
programs.direnv = {
|
||||
enable = true;
|
||||
package = pkgs.direnv;
|
||||
|
|
@ -82,72 +30,23 @@
|
|||
};
|
||||
};
|
||||
|
||||
# Create a library path that only applies to unpackaged programs by using
|
||||
# nix-ldo
|
||||
# https://nix.dev/guides/faq#how-to-run-non-nix-executables
|
||||
programs.nix-ld.enable = true;
|
||||
programs.nix-ld.libraries = with pkgs; [
|
||||
# Add any missing dynamic libraries for unpackaged programs
|
||||
# here, NOT in environment.systemPackages
|
||||
];
|
||||
programs.nix-ld.libraries = with pkgs; [];
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
programs.mosh.enable = true;
|
||||
|
||||
# Enable the Flakes feature and the accompanying new nix command-line tool
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
# some nix tidy up stuff
|
||||
nix.settings.auto-optimise-store = true;
|
||||
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
# Enable zeroconf
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns4 = true; # Enables Avahi for name service lookups (e.g., in /etc/nsswitch.conf)
|
||||
nssmdns6 = true; # Also resolve IPv6 mDNS addresses via NSS
|
||||
nssmdns4 = true;
|
||||
nssmdns6 = true;
|
||||
publish = {
|
||||
enable = true;
|
||||
addresses = true; # Publish your laptop's IP addresses
|
||||
workstation = true; # Publish your laptop as a workstation
|
||||
# You might also want:
|
||||
# domain = true; # Announce the locally used domain name (usually .local)
|
||||
# userServices = true; # Publish services advertised by users
|
||||
addresses = true;
|
||||
workstation = true;
|
||||
};
|
||||
openFirewall = true;
|
||||
# If you're using systemd-resolved alongside Avahi, ensure mDNS is also enabled there:
|
||||
# services.resolved.enable = true;
|
||||
# services.resolved.extraConfig = "MulticastDNS=yes";
|
||||
};
|
||||
|
||||
environment.variables.EDITOR = "nvim";
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# enable mosh
|
||||
programs.mosh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Packages
|
||||
environment.systemPackages = with pkgs; [
|
||||
avahi
|
||||
bat
|
||||
|
|
@ -157,10 +56,8 @@
|
|||
dust
|
||||
entr
|
||||
fd
|
||||
git
|
||||
gocryptfs
|
||||
mosh
|
||||
neovim
|
||||
python314
|
||||
ripgrep
|
||||
rsync
|
||||
|
|
@ -168,7 +65,6 @@
|
|||
tldr
|
||||
unzip
|
||||
uv
|
||||
wget
|
||||
wireguard-tools
|
||||
zip
|
||||
|
||||
|
|
|
|||
67
hosts/modules/core.nix
Normal file
67
hosts/modules/core.nix
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
{ config, pkgs, inputs, ... }:
|
||||
{
|
||||
users = {
|
||||
users.alex = {
|
||||
isNormalUser = true;
|
||||
description = "Alexander Wainwright";
|
||||
extraGroups = [
|
||||
"dialout"
|
||||
"input"
|
||||
"networkmanager"
|
||||
"plugdev"
|
||||
"render"
|
||||
"video"
|
||||
"wheel"
|
||||
];
|
||||
packages = [];
|
||||
shell = pkgs.fish;
|
||||
};
|
||||
groups.pluggdev = {};
|
||||
};
|
||||
|
||||
programs.fish.enable = true;
|
||||
|
||||
documentation.man.generateCaches = false;
|
||||
|
||||
time.timeZone = "Australia/Brisbane";
|
||||
|
||||
i18n.defaultLocale = "en_GB.UTF-8";
|
||||
i18n.extraLocaleSettings = {
|
||||
LC_ADDRESS = "en_AU.UTF-8";
|
||||
LC_IDENTIFICATION = "en_AU.UTF-8";
|
||||
LC_MEASUREMENT = "en_AU.UTF-8";
|
||||
LC_MONETARY = "en_AU.UTF-8";
|
||||
LC_NAME = "en_AU.UTF-8";
|
||||
LC_NUMERIC = "en_AU.UTF-8";
|
||||
LC_PAPER = "en_AU.UTF-8";
|
||||
LC_TELEPHONE = "en_AU.UTF-8";
|
||||
LC_TIME = "en_AU.UTF-8";
|
||||
};
|
||||
|
||||
console.keyMap = "dvorak";
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
nix.settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
auto-optimise-store = true;
|
||||
trusted-users = [ "root" "alex" ];
|
||||
};
|
||||
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
environment.variables.EDITOR = "nvim";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
git
|
||||
neovim
|
||||
wget
|
||||
];
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue