ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

attempting impermanence on testbed machine

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-11-26 14:57:29 -06:00
parent 35589dad72
commit e90513a890
6 changed files with 353 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

6
flakes/common/nix_modules/essentials/default.nix
View file

@ -5,6 +5,12 @@
}:
with lib;
{
security.sudo = {
extraConfig = ''
Defaults lecture="never"
'';
};
environment.systemPackages = with pkgs; [
# Essentials
vim

127
utilities/nixos-installers/examples/flake.nix Normal file
View file

@ -0,0 +1,127 @@
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
home-manager.url = "github:rycee/home-manager/release-25.05";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
impermanence.url = "github:nix-community/impermanence";
};
outputs =
{
nixpkgs,
home-manager,
common,
ros_neovim,
...
}@inputs:
let
configurationName = "testbed";
system = "x86_64-linux";
primaryUser = "luser";
configLocation = "/home/${primaryUser}/.config/nixos-config";
# configLocation = "/home/${primaryUser}/.config/nixos-config/hosts/${configurationName}";
lib = nixpkgs.lib;
in
{
nixosConfigurations = {
"${configurationName}" = (
lib.nixosSystem {
inherit system;
specialArgs = {
inherit inputs;
};
modules = [
inputs.impermanence.nixosModules.impermanence
inputs.home-manager.nixosModules.default
ros_neovim.nixosModules.default
(
{ ... }:
{
ringofstorms-nvim.includeAllRuntimeDependencies = true;
}
)
common.nixosModules.essentials
common.nixosModules.git
common.nixosModules.tmux
common.nixosModules.boot_systemd
common.nixosModules.hardening
common.nixosModules.jetbrains_font
common.nixosModules.nix_options
common.nixosModules.no_sleep
common.nixosModules.timezone_auto
common.nixosModules.tty_caps_esc
common.nixosModules.zsh
./hardware-configuration.nix
./impermanence.nix
(
{
config,
pkgs,
upkgs,
lib,
...
}:
rec {
system.stateVersion = "25.05";
services.openssh.settings.PasswordAuthentication = lib.mkForce true;
# Home Manager
home-manager = {
useUserPackages = true;
useGlobalPkgs = true;
backupFileExtension = "bak";
# add all normal users to home manager so it applies to them
users = lib.mapAttrs (name: user: {
home.stateVersion = "25.05";
programs.home-manager.enable = true;
}) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
sharedModules = [
common.homeManagerModules.tmux
common.homeManagerModules.atuin
common.homeManagerModules.direnv
common.homeManagerModules.git
common.homeManagerModules.postgres_cli_options
common.homeManagerModules.starship
common.homeManagerModules.zoxide
common.homeManagerModules.zsh
];
extraSpecialArgs = {
inherit inputs;
inherit upkgs;
};
};
# System configuration
networking.hostName = configurationName;
programs.nh.flake = configLocation;
nixpkgs.config.allowUnfree = true;
users.mutableUsers = false;
users.users = {
"${primaryUser}" = {
isNormalUser = true;
hashedPassword = "$y$j9T$v1QhXiZMRY1pFkPmkLkdp0$451GvQt.XFU2qCAi4EQNd1BEqjM/CH6awU8gjcULps6"; # "test" password
extraGroups = [
"wheel"
"networkmanager"
];
openssh.authorizedKeys.keys = [
];
};
};
}
)
];
}
);
};
};
}

120
utilities/nixos-installers/examples/hardware-configuration.nix Normal file
View file

@ -0,0 +1,120 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
let
NIXBOOT = "/dev/disk/by-uuid/641A-6BDB";
NIXROOT ="/dev/disk/by-uuid/ae94db42-ec46-4e2f-a98a-118359428a68";
cryptroot = "/dev/disk/by-uuid/49f11bf1-d4b7-4188-9203-4d7a42569afa";
USB_KEY = "/dev/disk/by-uuid/9985-EBD1";
in
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" "ehci_pci" "uas" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/boot" =
{ device = NIXBOOT;
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
boot.initrd.luks.devices."cryptroot" = {
device = NIXROOT;
# Auto decrypt
keyFile = USB_KEY;
keyFileSize = 5000;
keyFileOffset = 5443;
tryEmptyPassphrase = true;
fallbackToPassword = true;
crypttabExtraOpts = [ "tries=2" ];
};
fileSystems."/" =
{ device = cryptroot;
fsType = "btrfs";
options = [ "subvol=@root" "compress=zstd" ];
};
fileSystems."/nix" =
{ device = cryptroot;
fsType = "btrfs";
options = [ "subvol=@nix" "compress=zstd" "noatime" ];
};
fileSystems."/persist" =
{ device = cryptroot;
neededForBoot = true;
fsType = "btrfs";
options = [ "subvol=@persist" "compress=zstd" ];
};
fileSystems."/.swap" =
{ device = cryptroot;
fsType = "btrfs";
options = [ "subvol=@swap" "noatime" ];
};
fileSystems."/.snapshots" =
{ device = cryptroot;
fsType = "btrfs";
options = [ "subvol=@snapshots" "compress=zstd" "noatime"];
};
services.btrfs.autoScrub = {
enable = true;
# syntax as defined by https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Event s
interval = "monthly";
fileSystems = ["/"];
};
swapDevices = [{
device = "/.swap/swapfile";
size = 8*1024; # Creates an 8GB swap file
}];
boot.initrd.postResumeCommands = lib.mkAfter ''
mkdir /btrfs_tmp
mount ${cryptroot} /btrfs_tmp
if [[ -e /btrfs_tmp/@root ]]; then
mkdir -p /btrfs_tmp/old_roots
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/@root)" "+%Y-%m-%-d_%H:%M:%S")
mv /btrfs_tmp/@root "/btrfs_tmp/old_roots/$timestamp"
fi
delete_subvolume_recursively() {
IFS=$'\n'
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
delete_subvolume_recursively "/btrfs_tmp/$i"
done
btrfs subvolume delete "$1"
}
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
delete_subvolume_recursively "$i"
done
btrfs subvolume create /btrfs_tmp/@root
umount /btrfs_tmp
'';
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
# networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

37
utilities/nixos-installers/examples/impermanence.nix Normal file
View file

@ -0,0 +1,37 @@
{ ... }:
{
environment.persistence."/persist" = {
enable = true;
hideMounts = true;
directories = [
"/var/log"
"/var/lib/nixos"
"/var/lib/systemd/coredump"
"/var/lib/systemd/timers"
"/etc/nixos"
"/etc/ssh"
"/etc/NetworkManager/system-connections"
"/var/lib/bluetooth"
];
files = [
"/etc/machine-id"
];
users.luser = {
directories = [
"projects"
".config/nixos-config"
".config/atuin"
".local/share/atuin"
".local/share/zoxide"
];
files = [
];
};
};
}

31
utilities/nixos-installers/install_notes.md
View file

@ -69,6 +69,7 @@ nixos-generate-config --root /mnt
# @swap options + "noatime"
# @snapshots options + "compress=zstd" "noatime"
# @persist options + "compress=zstd"
# + neededForBoot = true;
# add Swap device
swapDevices = [{
@ -132,6 +133,36 @@ In hardware-configuration ensure these are all added:
};
```
### Impermanence BTRFS setup (optional)
```hardware-configuration.nix
boot.initrd.postResumeCommands = lib.mkAfter ''
mkdir /btrfs_tmp
mount /dev/ROOT_FILESYSTEM /btrfs_tmp
if [[ -e /btrfs_tmp/@root ]]; then
mkdir -p /btrfs_tmp/old_roots
timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
fi
delete_subvolume_recursively() {
IFS=$'\n'
for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
delete_subvolume_recursively "/btrfs_tmp/$i"
done
btrfs subvolume delete "$1"
}
for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
delete_subvolume_recursively "$i"
done
btrfs subvolume create /btrfs_tmp/@root
umount /btrfs_tmp
'';
```
### Install nixos
`sudo nixos-install`

61
utilities/nixos-installers/new-flake.nix
View file

@ -5,14 +5,12 @@
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
# impermanence.url = "github:nix-community/impermanence";
};
outputs =
{
nixpkgs,
home-manager,
common,
ros_neovim,
...
}@inputs:
let
@ -21,7 +19,7 @@
primaryUser = "luser";
configLocation = "/etc/nixos";
# configLocation = "/home/${primaryUser}/.config/nixos-config/hosts/${configurationName}";
lib = nixpkgs.lib;
lib = inputs.nixpkgs.lib;
in
{
nixosConfigurations = {
@ -32,9 +30,10 @@
inherit inputs;
};
modules = [
home-manager.nixosModules.default
# inputs.impermanence.nixosModules.impermanence
inputs.home-manager.nixosModules.default
ros_neovim.nixosModules.default
inputs.ros_neovim.nixosModules.default
(
{ ... }:
{
@ -42,18 +41,19 @@
}
)
common.nixosModules.essentials
common.nixosModules.git
common.nixosModules.tmux
# common.nixosModules.boot_systemd
# common.nixosModules.boot_grub
common.nixosModules.hardening
common.nixosModules.jetbrains_font
common.nixosModules.nix_options
common.nixosModules.no_sleep
common.nixosModules.timezone_auto
common.nixosModules.tty_caps_esc
common.nixosModules.zsh
inputs.common.nixosModules.essentials
inputs.common.nixosModules.git
inputs.common.nixosModules.tmux
# TODO PICK ONE
# inputs.common.nixosModules.boot_systemd
# inputs.common.nixosModules.boot_grub
inputs.common.nixosModules.hardening
inputs.common.nixosModules.jetbrains_font
inputs.common.nixosModules.nix_options
inputs.common.nixosModules.no_sleep
inputs.common.nixosModules.timezone_auto
inputs.common.nixosModules.tty_caps_esc
inputs.common.nixosModules.zsh
./hardware-configuration.nix
(
@ -65,8 +65,9 @@
...
}:
rec {
# TODO ensure matches configuration.nix, and add anything else from there that is needed
system.stateVersion = "25.05";
# No ssh pub keys setup yet, allow password login
# No ssh pub keys setup yet, allow password login, TODO remove
services.openssh.settings.PasswordAuthentication = lib.mkForce true;
# Home Manager
@ -81,14 +82,14 @@
}) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
sharedModules = [
common.homeManagerModules.tmux
common.homeManagerModules.atuin
common.homeManagerModules.direnv
common.homeManagerModules.git
common.homeManagerModules.postgres_cli_options
common.homeManagerModules.starship
common.homeManagerModules.zoxide
common.homeManagerModules.zsh
inputs.common.homeManagerModules.tmux
inputs.common.homeManagerModules.atuin
inputs.common.homeManagerModules.direnv
inputs.common.homeManagerModules.git
inputs.common.homeManagerModules.postgres_cli_options
inputs.common.homeManagerModules.starship
inputs.common.homeManagerModules.zoxide
inputs.common.homeManagerModules.zsh
];
extraSpecialArgs = {
@ -101,15 +102,17 @@
networking.hostName = configurationName;
programs.nh.flake = configLocation;
nixpkgs.config.allowUnfree = true;
users.mutableUsers = false;
users.users = {
"${primaryUser}" = {
isNormalUser = true;
initialPassword = "password1";
hashedPassword = "$y$j9T$v1QhXiZMRY1pFkPmkLkdp0$451GvQt.XFU2qCAi4EQNd1BEqjM/CH6awU8gjcULps6"; # "test" password
extraGroups = [
"wheel"
"networkmanager"
];
openssh.authorizedKeys.keys = [
# TODO set a public key for access
];
};
};