Incorporate NixOS configuration
TL;DR: - Move /etc/nixos/configuration.nix -> //nixos/configuration.nix - Move /etc/nixos/hardware-configuration.nix -> //nixos/harware.nix - Document installer.nix - Create rebuild.nix wrapper around `sudo nixos-rebuild switch` Previously I sketched ideas for the configuration.nix for socrates -- also known as flattop -- the inexpensive Acer laptop residing in my flat and stored that configuration.nix file in briefcase. Now, however, I have successfully installed NixOS onto socrates. By default NixOS saves the configuration.nix and hardware-configuration.nix files to /etc/nixos/. I'm moving both of these files into briefcase. Because the command `nixos-rebuild` looks for the NixOS configuration file in /etc/nixos, I wrote rebuild.nix, which creates a program to call `nixos-rebuild` with the new location of my configuration.nix.
This commit is contained in:
		
							parent
							
								
									b53ae61db2
								
							
						
					
					
						commit
						695de12482
					
				
					 4 changed files with 166 additions and 21 deletions
				
			
		| 
						 | 
				
			
			@ -1,35 +1,140 @@
 | 
			
		|||
{ config, pkgs, ... }:
 | 
			
		||||
{ pkgs ? import <nixpkgs> {}, ... }:
 | 
			
		||||
 | 
			
		||||
# TODO(wpcarro): Refactor to prefer nested attribute for configuration values
 | 
			
		||||
# instead of using one-liner field accessors.
 | 
			
		||||
{
 | 
			
		||||
  imports = [
 | 
			
		||||
    ./hardware-configuration.nix
 | 
			
		||||
  ];
 | 
			
		||||
  imports = [ ./hardware.nix ];
 | 
			
		||||
 | 
			
		||||
  # TODO(wpcarro): Is this correct? I believe my laptop only supports BIOS and
 | 
			
		||||
  # not UEFI.
 | 
			
		||||
  boot.loader.grub.device = "/dev/sda";
 | 
			
		||||
  # Use the systemd-boot EFI boot loader.
 | 
			
		||||
  boot.loader.systemd-boot.enable = true;
 | 
			
		||||
  boot.loader.efi.canTouchEfiVariables = true;
 | 
			
		||||
 | 
			
		||||
  networking.hostName = "socrates";
 | 
			
		||||
  networking.wireless.enable = true;
 | 
			
		||||
  # Don't remove this.
 | 
			
		||||
  networking.useDHCP = false;
 | 
			
		||||
  networking.interfaces.enp2s0f1.useDHCP = true;
 | 
			
		||||
  networking.interfaces.wlp3s0.useDHCP = true;
 | 
			
		||||
  networking = {
 | 
			
		||||
    hostName = "socrates";
 | 
			
		||||
    # The global useDHCP flag is deprecated, therefore explicitly set to false
 | 
			
		||||
    # here.  Per-interface useDHCP will be mandatory in the future, so this
 | 
			
		||||
    # generated config replicates the default behaviour.
 | 
			
		||||
    useDHCP = false;
 | 
			
		||||
    networkmanager.enable = true;
 | 
			
		||||
    interfaces.enp2s0f1.useDHCP = true;
 | 
			
		||||
    interfaces.wlp3s0.useDHCP = true;
 | 
			
		||||
    firewall.allowedTCPPorts = [ 9418 80 443 ];
 | 
			
		||||
  };
 | 
			
		||||
 | 
			
		||||
  time.timeZone = "UTC";
 | 
			
		||||
 | 
			
		||||
  programs.fish.enable = true;
 | 
			
		||||
  programs.mosh.enable = true;
 | 
			
		||||
 | 
			
		||||
  environment.systemPackages = with pkgs; [
 | 
			
		||||
    emacs
 | 
			
		||||
    curl
 | 
			
		||||
    direnv
 | 
			
		||||
    emacs26-nox
 | 
			
		||||
    gnupg
 | 
			
		||||
    htop
 | 
			
		||||
    pass
 | 
			
		||||
    vim
 | 
			
		||||
    certbot
 | 
			
		||||
    tree
 | 
			
		||||
    git
 | 
			
		||||
  ];
 | 
			
		||||
 | 
			
		||||
  services.openssh.enable = true;
 | 
			
		||||
  users = {
 | 
			
		||||
    # I need a git group to run the git server.
 | 
			
		||||
    groups.git = {};
 | 
			
		||||
 | 
			
		||||
  users.users.wpcarro = {
 | 
			
		||||
    isNormalUser = true;
 | 
			
		||||
    extraGroups = [ "wheel" ];
 | 
			
		||||
    users.wpcarro = {
 | 
			
		||||
      isNormalUser = true;
 | 
			
		||||
      extraGroups = [ "git" "wheel" ];
 | 
			
		||||
      shell = pkgs.fish;
 | 
			
		||||
    };
 | 
			
		||||
 | 
			
		||||
    users.git = {
 | 
			
		||||
      group = "git";
 | 
			
		||||
      isNormalUser = false;
 | 
			
		||||
    };
 | 
			
		||||
  };
 | 
			
		||||
 | 
			
		||||
  system.stateVersion = "20.09";
 | 
			
		||||
  nix = {
 | 
			
		||||
    # Expose depot as <depot>, nixpkgs as <nixpkgs>
 | 
			
		||||
    nixPath = [
 | 
			
		||||
      "briefcase=/home/wpcarro/briefcase"
 | 
			
		||||
      "depot=/home/wpcarro/depot"
 | 
			
		||||
      "nixpkgs=/home/wpcarro/nixpkgs"
 | 
			
		||||
    ];
 | 
			
		||||
 | 
			
		||||
    # Allow wpcarro to call nixos-rebuild
 | 
			
		||||
    trustedUsers = [ "root" "wpcarro" ];
 | 
			
		||||
  };
 | 
			
		||||
 | 
			
		||||
  ##############################################################################
 | 
			
		||||
  # Services
 | 
			
		||||
  ##############################################################################
 | 
			
		||||
  services.openssh.enable = true;
 | 
			
		||||
 | 
			
		||||
  services.lorri.enable = true;
 | 
			
		||||
 | 
			
		||||
  # TODO(wpcarro): Expose the Monzo credentials to this job. Currently they're
 | 
			
		||||
  # managed with direnv and pass, which presumably systemd isn't accessing.
 | 
			
		||||
  systemd.user.services.monzo-token-server = {
 | 
			
		||||
    enable = true;
 | 
			
		||||
    description = "Ensure my Monzo access token is valid";
 | 
			
		||||
    script = "/home/wpcarro/.nix-profile/bin/token-server";
 | 
			
		||||
 | 
			
		||||
    serviceConfig = {
 | 
			
		||||
      WorkingDirectory = "%h/briefcase/monzo_ynab";
 | 
			
		||||
      Type = "oneshot";
 | 
			
		||||
    };
 | 
			
		||||
  };
 | 
			
		||||
 | 
			
		||||
  services.gitDaemon = {
 | 
			
		||||
    enable = true;
 | 
			
		||||
    basePath = "/srv/git";
 | 
			
		||||
    exportAll = true;
 | 
			
		||||
    repositories = [ "/srv/git/briefcase" ];
 | 
			
		||||
  };
 | 
			
		||||
 | 
			
		||||
  # Since I'm using this laptop as a server in my flat, I'd prefer to close its
 | 
			
		||||
  # lid.
 | 
			
		||||
  services.logind.lidSwitch = "ignore";
 | 
			
		||||
 | 
			
		||||
  # Provision SSL certificates to support HTTPS connections.
 | 
			
		||||
  security.acme.acceptTerms = true;
 | 
			
		||||
  security.acme.certs."wpcarro.dev".email = "wpcarro@gmail.com";
 | 
			
		||||
 | 
			
		||||
  services.nginx = {
 | 
			
		||||
    enable = true;
 | 
			
		||||
    enableReload = true;
 | 
			
		||||
 | 
			
		||||
    recommendedTlsSettings = true;
 | 
			
		||||
    recommendedGzipSettings = true;
 | 
			
		||||
    recommendedProxySettings = true;
 | 
			
		||||
 | 
			
		||||
    commonHttpConfig = ''
 | 
			
		||||
      log_format json_combined escape=json
 | 
			
		||||
      '{'
 | 
			
		||||
          '"time_local":"$time_local",'
 | 
			
		||||
          '"remote_addr":"$remote_addr",'
 | 
			
		||||
          '"remote_user":"$remote_user",'
 | 
			
		||||
          '"request":"$request",'
 | 
			
		||||
          '"status": "$status",'
 | 
			
		||||
          '"body_bytes_sent":"$body_bytes_sent",'
 | 
			
		||||
          '"request_time":"$request_time",'
 | 
			
		||||
          '"http_referrer":"$http_referer",'
 | 
			
		||||
          '"http_user_agent":"$http_user_agent"'
 | 
			
		||||
      '}';
 | 
			
		||||
      access_log syslog:server=unix:/dev/log json_combined;
 | 
			
		||||
    '';
 | 
			
		||||
 | 
			
		||||
    virtualHosts.blog = {
 | 
			
		||||
      serverName = "blog.wpcarro.dev";
 | 
			
		||||
      useACMEHost = "wpcarro.dev";
 | 
			
		||||
      addSSL = true;
 | 
			
		||||
      extraConfig = ''
 | 
			
		||||
        location / {
 | 
			
		||||
          proxy_pass http://localhost:80
 | 
			
		||||
        }
 | 
			
		||||
      '';
 | 
			
		||||
    };
 | 
			
		||||
  };
 | 
			
		||||
 | 
			
		||||
  system.stateVersion = "20.09"; # Did you read the comment?
 | 
			
		||||
}
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
							
								
								
									
										30
									
								
								nixos/hardware.nix
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										30
									
								
								nixos/hardware.nix
									
										
									
									
									
										Normal file
									
								
							| 
						 | 
				
			
			@ -0,0 +1,30 @@
 | 
			
		|||
# Do not modify this file!  It was generated by ‘nixos-generate-config’
 | 
			
		||||
# and may be overwritten by future invocations.  Please make changes
 | 
			
		||||
# to /etc/nixos/configuration.nix instead.
 | 
			
		||||
{ config, lib, pkgs, ... }:
 | 
			
		||||
 | 
			
		||||
{
 | 
			
		||||
  imports =
 | 
			
		||||
    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
 | 
			
		||||
    ];
 | 
			
		||||
 | 
			
		||||
  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
 | 
			
		||||
  boot.initrd.kernelModules = [ ];
 | 
			
		||||
  boot.kernelModules = [ "kvm-intel" ];
 | 
			
		||||
  boot.extraModulePackages = [ ];
 | 
			
		||||
 | 
			
		||||
  fileSystems."/" =
 | 
			
		||||
    { device = "/dev/disk/by-uuid/aadf1a77-1e98-4b5f-8e74-abf8e77bda34";
 | 
			
		||||
      fsType = "ext4";
 | 
			
		||||
    };
 | 
			
		||||
 | 
			
		||||
  fileSystems."/boot" =
 | 
			
		||||
    { device = "/dev/disk/by-uuid/1613-35B9";
 | 
			
		||||
      fsType = "vfat";
 | 
			
		||||
    };
 | 
			
		||||
 | 
			
		||||
  swapDevices = [ ];
 | 
			
		||||
 | 
			
		||||
  nix.maxJobs = lib.mkDefault 2;
 | 
			
		||||
  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 | 
			
		||||
}
 | 
			
		||||
| 
						 | 
				
			
			@ -1,3 +1,4 @@
 | 
			
		|||
# This expression can be used to create NixOS .iso images.
 | 
			
		||||
{ config, pkgs, ...  }:
 | 
			
		||||
 | 
			
		||||
{
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
							
								
								
									
										9
									
								
								nixos/rebuild.nix
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								nixos/rebuild.nix
									
										
									
									
									
										Normal file
									
								
							| 
						 | 
				
			
			@ -0,0 +1,9 @@
 | 
			
		|||
{ pkgs ? import <nixpkgs> {}, ... }:
 | 
			
		||||
 | 
			
		||||
pkgs.writeShellScriptBin "rebuild" ''
 | 
			
		||||
  set -ue
 | 
			
		||||
  sudo nixos-rebuild \
 | 
			
		||||
    -I nixos-config=/home/wpcarro/briefcase/nixos/configuration.nix \
 | 
			
		||||
    -I nixpkgs=/home/wpcarro/nixpkgs \
 | 
			
		||||
    switch
 | 
			
		||||
''
 | 
			
		||||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue