refactor(modules): split monolithic system/desktop config
This commit is contained in:
randogoth
parent
c299acb87d
commit
febdf2702c
13 changed files with 249 additions and 209 deletions
|
|
@ -1,124 +1,13 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
time.timeZone = "UTC";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console.keyMap = "us";
|
||||
|
||||
boot.supportedFilesystems = [
|
||||
"btrfs"
|
||||
"ext4"
|
||||
"vfat"
|
||||
"xfs"
|
||||
imports = [
|
||||
./locale.nix
|
||||
./boot-efi.nix
|
||||
./nix-core.nix
|
||||
./services.nix
|
||||
./networking.nix
|
||||
./virtualization.nix
|
||||
./security.nix
|
||||
];
|
||||
boot.loader = {
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
# Only keep 10 generations maximum
|
||||
configurationLimit = lib.mkDefault 10;
|
||||
};
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
|
||||
nix.settings = {
|
||||
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
|
||||
# Only allow root and sudoers to run Nix commands
|
||||
allowed-users = [
|
||||
"root"
|
||||
"@wheel"
|
||||
];
|
||||
|
||||
substituters = lib.mkBefore [
|
||||
"https://cache.lix.systems"
|
||||
];
|
||||
trusted-public-keys = lib.mkBefore [
|
||||
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
|
||||
];
|
||||
};
|
||||
|
||||
services = {
|
||||
openssh.enable = true;
|
||||
gvfs.enable = true;
|
||||
tumbler.enable = true;
|
||||
};
|
||||
|
||||
networking = {
|
||||
useDHCP = lib.mkDefault true;
|
||||
firewall.trustedInterfaces = [ "virbr0" ];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
programs = {
|
||||
nix-index = {
|
||||
enable = lib.mkDefault true;
|
||||
enableBashIntegration = lib.mkDefault true;
|
||||
};
|
||||
nix-index-database.comma.enable = lib.mkDefault true;
|
||||
thunar = {
|
||||
enable = true;
|
||||
plugins = [
|
||||
pkgs.xfce.thunar-archive-plugin
|
||||
pkgs.xfce.thunar-media-tags-plugin
|
||||
pkgs.xfce.thunar-vcs-plugin
|
||||
pkgs.xfce.thunar-volman
|
||||
];
|
||||
};
|
||||
virt-manager.enable = true;
|
||||
xfconf.enable = true;
|
||||
};
|
||||
|
||||
# Optimise the Nix store once a day
|
||||
nix.optimise = lib.mkDefault {
|
||||
automatic = true;
|
||||
dates = [ "daily" ];
|
||||
};
|
||||
|
||||
# Clean the Nix store once a day
|
||||
nix.gc = lib.mkDefault {
|
||||
automatic = true;
|
||||
dates = "daily";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
system.stateVersion = "25.11";
|
||||
|
||||
virtualisation = {
|
||||
containers.enable = true;
|
||||
# docker.enable = true;
|
||||
podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
# Required for containers under podman-compose to be able to talk to each other.
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
};
|
||||
libvirtd.enable = true;
|
||||
};
|
||||
|
||||
security.sudo = {
|
||||
enable = lib.mkDefault true;
|
||||
wheelNeedsPassword = lib.mkForce false;
|
||||
};
|
||||
|
||||
# Locked down root user as a default
|
||||
users.users.root = lib.mkDefault {
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
hashedPassword = lib.mkDefault "!";
|
||||
initialHashedPassword = lib.mkDefault "!";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
18
modules/system/boot-efi.nix
Normal file
18
modules/system/boot-efi.nix
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{ lib, ... }:
|
||||
|
||||
{
|
||||
boot.supportedFilesystems = [
|
||||
"btrfs"
|
||||
"ext4"
|
||||
"vfat"
|
||||
"xfs"
|
||||
];
|
||||
|
||||
boot.loader = {
|
||||
systemd-boot = {
|
||||
enable = true;
|
||||
configurationLimit = lib.mkDefault 10;
|
||||
};
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
}
|
||||
8
modules/system/locale.nix
Normal file
8
modules/system/locale.nix
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
time.timeZone = "UTC";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
console.keyMap = "us";
|
||||
}
|
||||
5
modules/system/networking.nix
Normal file
5
modules/system/networking.nix
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{ lib, ... }:
|
||||
|
||||
{
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
}
|
||||
41
modules/system/nix-core.nix
Normal file
41
modules/system/nix-core.nix
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
{ lib, ... }:
|
||||
|
||||
{
|
||||
nix.settings = {
|
||||
experimental-features = [
|
||||
"nix-command"
|
||||
"flakes"
|
||||
];
|
||||
|
||||
allowed-users = [
|
||||
"root"
|
||||
"@wheel"
|
||||
];
|
||||
|
||||
substituters = lib.mkBefore [
|
||||
"https://cache.lix.systems"
|
||||
];
|
||||
trusted-public-keys = lib.mkBefore [
|
||||
"cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
|
||||
];
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
programs.nix-index = {
|
||||
enable = lib.mkDefault true;
|
||||
enableBashIntegration = lib.mkDefault true;
|
||||
};
|
||||
programs.nix-index-database.comma.enable = lib.mkDefault true;
|
||||
|
||||
nix.optimise = lib.mkDefault {
|
||||
automatic = true;
|
||||
dates = [ "daily" ];
|
||||
};
|
||||
|
||||
nix.gc = lib.mkDefault {
|
||||
automatic = true;
|
||||
dates = "daily";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
}
|
||||
|
|
@ -1,39 +1,8 @@
|
|||
{ lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
# Override Thunar desktop entry to show as "Files".
|
||||
thunarDesktopOverride = pkgs.makeDesktopItem {
|
||||
name = "thunar"; # same filename to shadow upstream entry
|
||||
desktopName = "Files";
|
||||
genericName = "File Manager";
|
||||
tryExec = "thunar";
|
||||
exec = "thunar %U";
|
||||
icon = "org.xfce.thunar";
|
||||
categories = [ "Utility" "FileManager" ];
|
||||
mimeTypes = [ "inode/directory" ];
|
||||
keywords = [ "folder" "manager" "explorer" "files" ];
|
||||
startupNotify = true;
|
||||
startupWMClass = "Thunar";
|
||||
terminal = false;
|
||||
comment = "Browse files";
|
||||
};
|
||||
|
||||
# Override Ghostty desktop entry to show as "Terminal".
|
||||
ghosttyDesktopOverride = pkgs.makeDesktopItem {
|
||||
name = "com.mitchellh.ghostty";
|
||||
desktopName = "Terminal";
|
||||
genericName = "Terminal Emulator";
|
||||
exec = "ghostty";
|
||||
icon = "com.mitchellh.ghostty";
|
||||
categories = [ "System" "TerminalEmulator" "Utility" ];
|
||||
terminal = false;
|
||||
comment = "Fast GPU-accelerated terminal";
|
||||
};
|
||||
in {
|
||||
{
|
||||
# Baseline system tools available everywhere; users run Home Manager standalone.
|
||||
config.environment.systemPackages = lib.mkAfter [
|
||||
(lib.hiPrio thunarDesktopOverride)
|
||||
(lib.hiPrio ghosttyDesktopOverride)
|
||||
pkgs.distrobox
|
||||
pkgs.distroshelf
|
||||
pkgs.dnsmasq
|
||||
|
|
@ -41,34 +10,12 @@ in {
|
|||
pkgs.flatpak
|
||||
pkgs.ghostty
|
||||
pkgs.git
|
||||
pkgs.gnome-browser-connector # lets users install extensions from GNOME Extensions website
|
||||
pkgs.gnome-extension-manager # GUI to browse/install GNOME Shell extensions
|
||||
pkgs.gnomeExtensions.all-in-one-clipboard
|
||||
pkgs.gnomeExtensions.alphabetical-app-grid
|
||||
pkgs.gnomeExtensions.app-hider
|
||||
pkgs.gnomeExtensions.apps
|
||||
pkgs.gnomeExtensions.blur-my-shell
|
||||
pkgs.gnomeExtensions.caffeine
|
||||
(pkgs.gnomeExtensions.logo-menu.overrideAttrs (old: {
|
||||
# Pin extension source so our patch stays compatible.
|
||||
version = "38";
|
||||
src = pkgs.fetchzip {
|
||||
url = "https://extensions.gnome.org/extension-data/logomenuaryan_k.v38.shell-extension.zip";
|
||||
hash = "sha256-GdGn7YKfOOEM0kV1Gd9H5c1KKjs/+/4XCsxO2pFdqu4=";
|
||||
stripRoot = false;
|
||||
};
|
||||
patches = (old.patches or []) ++ [ ../desktop/patches/logo-menu-custom-menu.patch ];
|
||||
}))
|
||||
pkgs.gnomeExtensions.places-status-indicator
|
||||
pkgs.gnomeExtensions.restart-to
|
||||
pkgs.home-manager
|
||||
pkgs.just
|
||||
pkgs.libnotify
|
||||
pkgs.micro
|
||||
pkgs.mission-center
|
||||
pkgs.p7zip
|
||||
pkgs.podman-compose
|
||||
pkgs.papirus-icon-theme
|
||||
pkgs.xdg-utils
|
||||
];
|
||||
}
|
||||
|
|
|
|||
18
modules/system/security.nix
Normal file
18
modules/system/security.nix
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{ lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
security.sudo = {
|
||||
enable = lib.mkDefault true;
|
||||
wheelNeedsPassword = lib.mkForce false;
|
||||
};
|
||||
|
||||
users.users.root = lib.mkDefault {
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
hashedPassword = lib.mkDefault "!";
|
||||
initialHashedPassword = lib.mkDefault "!";
|
||||
};
|
||||
}
|
||||
5
modules/system/services.nix
Normal file
5
modules/system/services.nix
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
}
|
||||
17
modules/system/virtualization.nix
Normal file
17
modules/system/virtualization.nix
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{ lib, ... }:
|
||||
|
||||
{
|
||||
networking.firewall.trustedInterfaces = lib.mkAfter [ "virbr0" ];
|
||||
|
||||
virtualisation = {
|
||||
containers.enable = true;
|
||||
podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
};
|
||||
libvirtd.enable = true;
|
||||
};
|
||||
|
||||
programs.virt-manager.enable = true;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue