Personal Nix setup
Add secure boot
+215
-26
+167
-3
flake.lock
+167
-3
flake.lock
···
79
79
}
80
80
},
81
81
"flake-compat": {
82
+
"flake": false,
83
+
"locked": {
84
+
"lastModified": 1673956053,
85
+
"narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
86
+
"owner": "edolstra",
87
+
"repo": "flake-compat",
88
+
"rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
89
+
"type": "github"
90
+
},
91
+
"original": {
92
+
"owner": "edolstra",
93
+
"repo": "flake-compat",
94
+
"type": "github"
95
+
}
96
+
},
97
+
"flake-compat_2": {
82
98
"locked": {
83
99
"lastModified": 1680531544,
84
100
"narHash": "sha256-8qbiDTYb1kGaDADRXTItpcMKQ1TeQVkuof6oEwHUvVA=",
···
96
112
"flake-parts": {
97
113
"inputs": {
98
114
"nixpkgs-lib": [
115
+
"lanzaboote",
116
+
"nixpkgs"
117
+
]
118
+
},
119
+
"locked": {
120
+
"lastModified": 1683560683,
121
+
"narHash": "sha256-XAygPMN5Xnk/W2c1aW0jyEa6lfMDZWlQgiNtmHXytPc=",
122
+
"owner": "hercules-ci",
123
+
"repo": "flake-parts",
124
+
"rev": "006c75898cf814ef9497252b022e91c946ba8e17",
125
+
"type": "github"
126
+
},
127
+
"original": {
128
+
"owner": "hercules-ci",
129
+
"repo": "flake-parts",
130
+
"type": "github"
131
+
}
132
+
},
133
+
"flake-parts_2": {
134
+
"inputs": {
135
+
"nixpkgs-lib": [
99
136
"nixpkgs-wayland",
100
137
"nix-eval-jobs",
101
138
"nixpkgs"
···
138
175
"systems": "systems_2"
139
176
},
140
177
"locked": {
178
+
"lastModified": 1681202837,
179
+
"narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
180
+
"owner": "numtide",
181
+
"repo": "flake-utils",
182
+
"rev": "cfacdce06f30d2b68473a46042957675eebb3401",
183
+
"type": "github"
184
+
},
185
+
"original": {
186
+
"owner": "numtide",
187
+
"repo": "flake-utils",
188
+
"type": "github"
189
+
}
190
+
},
191
+
"flake-utils_3": {
192
+
"inputs": {
193
+
"systems": "systems_3"
194
+
},
195
+
"locked": {
141
196
"lastModified": 1685518550,
142
197
"narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
143
198
"owner": "numtide",
···
148
203
"original": {
149
204
"owner": "numtide",
150
205
"repo": "flake-utils",
206
+
"type": "github"
207
+
}
208
+
},
209
+
"gitignore": {
210
+
"inputs": {
211
+
"nixpkgs": [
212
+
"lanzaboote",
213
+
"pre-commit-hooks-nix",
214
+
"nixpkgs"
215
+
]
216
+
},
217
+
"locked": {
218
+
"lastModified": 1660459072,
219
+
"narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
220
+
"owner": "hercules-ci",
221
+
"repo": "gitignore.nix",
222
+
"rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
223
+
"type": "github"
224
+
},
225
+
"original": {
226
+
"owner": "hercules-ci",
227
+
"repo": "gitignore.nix",
151
228
"type": "github"
152
229
}
153
230
},
···
315
392
"url": "https://github.com/fxcl/language-servers.nix"
316
393
}
317
394
},
318
-
"lib-aggregate": {
395
+
"lanzaboote": {
319
396
"inputs": {
397
+
"flake-compat": "flake-compat",
398
+
"flake-parts": "flake-parts",
320
399
"flake-utils": "flake-utils_2",
400
+
"nixpkgs": [
401
+
"nixpkgs"
402
+
],
403
+
"pre-commit-hooks-nix": "pre-commit-hooks-nix"
404
+
},
405
+
"locked": {
406
+
"lastModified": 1687124707,
407
+
"narHash": "sha256-BEC2y7zwDI/Saeupr9rijLvwb0OoqTD9vntlcyciyrM=",
408
+
"owner": "nix-community",
409
+
"repo": "lanzaboote",
410
+
"rev": "c758cdad465e0c8174db57dc493f51a89f0e3372",
411
+
"type": "github"
412
+
},
413
+
"original": {
414
+
"owner": "nix-community",
415
+
"repo": "lanzaboote",
416
+
"type": "github"
417
+
}
418
+
},
419
+
"lib-aggregate": {
420
+
"inputs": {
421
+
"flake-utils": "flake-utils_3",
321
422
"nixpkgs-lib": "nixpkgs-lib"
322
423
},
323
424
"locked": {
···
368
469
},
369
470
"nix-eval-jobs": {
370
471
"inputs": {
371
-
"flake-parts": "flake-parts",
472
+
"flake-parts": "flake-parts_2",
372
473
"nixpkgs": "nixpkgs_3"
373
474
},
374
475
"locked": {
···
448
549
"type": "github"
449
550
}
450
551
},
552
+
"nixpkgs-stable": {
553
+
"locked": {
554
+
"lastModified": 1678872516,
555
+
"narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
556
+
"owner": "NixOS",
557
+
"repo": "nixpkgs",
558
+
"rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",
559
+
"type": "github"
560
+
},
561
+
"original": {
562
+
"owner": "NixOS",
563
+
"ref": "nixos-22.11",
564
+
"repo": "nixpkgs",
565
+
"type": "github"
566
+
}
567
+
},
451
568
"nixpkgs-unstable": {
452
569
"locked": {
453
570
"lastModified": 1686960236,
···
466
583
},
467
584
"nixpkgs-wayland": {
468
585
"inputs": {
469
-
"flake-compat": "flake-compat",
586
+
"flake-compat": "flake-compat_2",
470
587
"lib-aggregate": "lib-aggregate",
471
588
"nix-eval-jobs": "nix-eval-jobs",
472
589
"nixpkgs": [
···
894
1011
"type": "github"
895
1012
}
896
1013
},
1014
+
"pre-commit-hooks-nix": {
1015
+
"inputs": {
1016
+
"flake-compat": [
1017
+
"lanzaboote",
1018
+
"flake-compat"
1019
+
],
1020
+
"flake-utils": [
1021
+
"lanzaboote",
1022
+
"flake-utils"
1023
+
],
1024
+
"gitignore": "gitignore",
1025
+
"nixpkgs": [
1026
+
"lanzaboote",
1027
+
"nixpkgs"
1028
+
],
1029
+
"nixpkgs-stable": "nixpkgs-stable"
1030
+
},
1031
+
"locked": {
1032
+
"lastModified": 1684842236,
1033
+
"narHash": "sha256-rYWsIXHvNhVQ15RQlBUv67W3YnM+Pd+DuXGMvCBq2IE=",
1034
+
"owner": "cachix",
1035
+
"repo": "pre-commit-hooks.nix",
1036
+
"rev": "61e567d6497bc9556f391faebe5e410e6623217f",
1037
+
"type": "github"
1038
+
},
1039
+
"original": {
1040
+
"owner": "cachix",
1041
+
"repo": "pre-commit-hooks.nix",
1042
+
"type": "github"
1043
+
}
1044
+
},
897
1045
"root": {
898
1046
"inputs": {
899
1047
"agenix": "agenix",
···
903
1051
"hyprland": "hyprland",
904
1052
"hyprpaper": "hyprpaper",
905
1053
"language-servers": "language-servers",
1054
+
"lanzaboote": "lanzaboote",
906
1055
"nixos-hardware": "nixos-hardware",
907
1056
"nixpkgs": "nixpkgs_2",
908
1057
"nixpkgs-darwin": "nixpkgs-darwin",
···
927
1076
}
928
1077
},
929
1078
"systems_2": {
1079
+
"locked": {
1080
+
"lastModified": 1681028828,
1081
+
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
1082
+
"owner": "nix-systems",
1083
+
"repo": "default",
1084
+
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
1085
+
"type": "github"
1086
+
},
1087
+
"original": {
1088
+
"owner": "nix-systems",
1089
+
"repo": "default",
1090
+
"type": "github"
1091
+
}
1092
+
},
1093
+
"systems_3": {
930
1094
"locked": {
931
1095
"lastModified": 1681028828,
932
1096
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+5
flake.nix
+5
flake.nix
···
10
10
11
11
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
12
12
13
+
lanzaboote = {
14
+
url = "github:nix-community/lanzaboote";
15
+
inputs.nixpkgs.follows = "nixpkgs";
16
+
};
17
+
13
18
agenix.url = "github:ryantm/agenix";
14
19
15
20
flake-utils.url = "github:numtide/flake-utils";
+8
-5
home/desktop/eww/eww.scss
+8
-5
home/desktop/eww/eww.scss
···
5
5
font-size: 0.9rem;
6
6
font-feature-settings: "tnum";
7
7
font-family: Inter, FontAwesome6Pro;
8
+
transition: 200ms ease;
9
+
}
10
+
11
+
@mixin window {
8
12
color: $color-white;
13
+
background-color: $color-shell;
14
+
border-radius: 2rem;
15
+
padding: 15px;
9
16
}
10
17
11
18
//Global Styles
12
19
.bar {
13
-
background-color: $color-shell;
14
-
border-radius: 1rem;
15
-
padding: 15px;
20
+
@include window;
16
21
}
17
-
18
-
// Styles on classes (see eww.yuck for more information)
19
22
20
23
.sidestuff slider {
21
24
all: unset;
+28
-14
machines/pepper/hardware.nix
+28
-14
machines/pepper/hardware.nix
···
1
-
{ config, lib, pkgs, nixos-hardware, modulesPath, ... }:
1
+
{ config, lib, pkgs, nixos-hardware, lanzaboote, modulesPath, ... }:
2
2
3
3
let
4
4
luksUUID = "8f9546b5-56bb-42d3-a230-e81aef2faba5";
···
8
8
in {
9
9
imports = [
10
10
nixos-hardware.nixosModules.framework-12th-gen-intel
11
+
lanzaboote.nixosModules.lanzaboote
11
12
(modulesPath + "/installer/scan/not-detected.nix")
12
13
];
13
14
14
-
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" ];
15
-
boot.initrd.kernelModules = [ "dm-snapshot" ];
16
-
boot.kernelModules = [ "kvm-intel" ];
17
-
boot.extraModulePackages = [ ];
18
-
boot.supportedFilesystems = [ "btrfs" ];
15
+
boot = {
16
+
bootspec.enable = true;
19
17
20
-
boot.initrd.luks.devices."enc" = {
21
-
device = "/dev/disk/by-uuid/${luksUUID}";
22
-
preLVM = true;
23
-
};
18
+
initrd = {
19
+
availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" ];
20
+
kernelModules = [ "dm-snapshot" ];
21
+
luks.devices."enc" = {
22
+
device = "/dev/disk/by-uuid/${luksUUID}";
23
+
preLVM = true;
24
+
};
25
+
};
26
+
kernelModules = [ "kvm-intel" ];
27
+
extraModulePackages = [ ];
28
+
supportedFilesystems = [ "btrfs" ];
24
29
25
-
boot.loader.systemd-boot.enable = true;
26
-
boot.loader.efi.canTouchEfiVariables = true;
30
+
loader = {
31
+
systemd-boot.enable = lib.mkForce false;
32
+
efi.canTouchEfiVariables = true;
33
+
};
34
+
35
+
lanzaboote = {
36
+
enable = true;
37
+
pkiBundle = "/etc/secureboot";
38
+
configurationLimit = 3;
39
+
};
40
+
41
+
resumeDevice = "/dev/disk/by-uuid/${swapUUID}";
42
+
};
27
43
28
44
fileSystems."/" = {
29
45
device = "/dev/disk/by-uuid/${rootUUID}";
···
57
73
swapDevices = [
58
74
{ device = "/dev/disk/by-uuid/${swapUUID}"; }
59
75
];
60
-
61
-
boot.resumeDevice = "/dev/disk/by-uuid/${swapUUID}";
62
76
63
77
# prefer suspend-then-hibernate
64
78
services.logind = {
+4
-1
modules/base/linux.nix
+4
-1
modules/base/linux.nix
···
4
4
inherit (import ../../lib/colors.nix inputs) hex;
5
5
inherit (lib) mkDefault;
6
6
in helpers.linuxAttrs {
7
+
environment.systemPackages = [ pkgs.sbctl ];
8
+
7
9
console = {
8
10
earlySetup = true;
9
11
font = "${pkgs.terminus_font}/share/consolefonts/ter-u28n.psf.gz";
···
30
32
};
31
33
32
34
boot = {
33
-
consoleLogLevel = 2;
35
+
bootspec.enable = lib.mkDefault true;
36
+
consoleLogLevel = lib.mkDefault 2;
34
37
35
38
loader = {
36
39
timeout = mkDefault 2;
+2
modules/base/nix-config.nix
+2
modules/base/nix-config.nix
···
18
18
# binary caches
19
19
substituters = [
20
20
"https://cache.nixos.org"
21
+
"https://nix-community.cachix.org"
21
22
"https://hyprland.cachix.org"
22
23
"https://nixpkgs-wayland.cachix.org"
23
24
];
24
25
trusted-public-keys = [
25
26
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
27
+
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
26
28
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
27
29
"nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
28
30
];