rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(nixos): move system config options to main nixos module

Browse source
This commit is contained in:
Mohammad Rafiq 2025-06-16 19:17:47 +08:00
parent bf63f44875
commit 91c2790b62
No known key found for this signature in database
20 changed files with 124 additions and 149 deletions
Download patch file Download diff file Expand all files Collapse all files

84
modules/nixos/default.nix
View file

@ -1,4 +1,10 @@
{ lib, config, ... }:
{
inputs,
lib,
config,
pkgs,
...
}:
let
inherit (lib) mkOption;
inherit (lib.types)
@ -7,6 +13,7 @@ let
coercedTo
submodule
;
inherit (lib.pantheon) mkStrOption;
rootDir = submodule {
options = {
directory = mkOption { type = str; };
@ -27,6 +34,12 @@ let
in
{
options = {
hostname = mkStrOption;
mainUser = {
name = mkStrOption;
publicKey = mkStrOption;
email = mkStrOption;
};
persistDirs = mkOption {
type = listOf (coercedTo str (d: { directory = d; }) rootDir);
default = [ ];
@ -42,5 +55,74 @@ in
"/var/lib/systemd"
"/var/lib/nixos"
];
stylix = {
enable = true;
base16Scheme = "${pkgs.base16-schemes}/share/themes/atelier-cave.yaml";
};
nixpkgs.config.allowUnfree = true;
nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
nix.settings = {
experimental-features = [
"nix-command"
"flakes"
"pipe-operators"
];
trusted-users = [ "@wheel" ];
};
time.timeZone = "Asia/Singapore";
i18n.defaultLocale = "en_US.UTF-8";
users.mutableUsers = false;
users.groups.users = {
gid = 100;
members = [ "${config.mainUser.name}" ];
};
users.users."${config.mainUser.name}" = {
linger = true;
uid = 1000;
isNormalUser = true;
hashedPasswordFile = config.sops.secrets."${config.mainUser.name}/hashedPassword".path;
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = [ config.mainUser.publicKey ];
};
users.users.root.openssh.authorizedKeys.keys = lib.singleton config.mainUser.publicKey;
services.getty.autologinUser = config.mainUser.name;
security.sudo.wheelNeedsPassword = false;
sops = {
defaultSopsFile = lib.snowfall.fs.get-file "secrets/secrets.yaml";
age.sshKeyPaths = [ "/persist/home/rafiq/.ssh/id_ed25519" ];
secrets = {
"keys/openrouter" = { };
"keys/tailscale" = { };
"keys/gemini" = { };
"keys/cvt-jira" = { };
"keys/cloudflare" = { };
"keys/telegram_bot" = { };
"misc/cvt-jira-link" = { };
"rafiq/hashedPassword".neededForUsers = true;
"rafiq/personalEmailPassword" = { };
"rafiq/workEmailPassword" = { };
"rafiq/oldSMBCredentials" = { };
"librechat/creds_key" = { };
"librechat/creds_iv" = { };
"librechat/jwt_secret" = { };
"librechat/jwt_refresh_secret" = { };
"librechat/meili_master_key" = { };
};
templates = {
"smb-credentials".content = ''
username=rafiq
password=${config.sops.placeholder."rafiq/oldSMBCredentials"}
'';
};
};
environment.shellInit = # sh
''
export GEMINI_API_KEY=$(sudo cat ${config.sops.secrets."keys/gemini".path})
export CVT_JIRA_KEY=$(sudo cat ${config.sops.secrets."keys/cvt-jira".path})
export CVT_JIRA_LINK=$(sudo cat ${config.sops.secrets."misc/cvt-jira-link".path})
'';
system.stateVersion = "25.05"; # Did you read the comment?
};
}

0
modules/nixos/hardware/audio.nix → modules/nixos/desktop/audio/default.nix
View file

4
modules/nixos/desktop/services/default.nix
View file

@ -22,7 +22,7 @@ in
capSysAdmin = true;
openFirewall = true;
settings = {
sunshine_name = config.system.hostname;
sunshine_name = config.hostname;
origin_web_ui_allowed = "wan";
};
applications = { };
@ -35,7 +35,7 @@ in
home-manager.sharedModules = singleton {
services.spotifyd.enable = true;
services.spotifyd.settings.global = {
device_name = "${config.system.hostname}";
device_name = "${config.hostname}";
device_type = "computer";
zeroconf_port = 5353;
};

40
modules/nixos/hardware/default.nix
View file

@ -1,37 +1,15 @@
{
lib,
config,
...
}:
{ lib, ... }:
let
inherit (lib) singleton;
in
{
imports = [
./audio.nix
];
options.hardware = {
platform = lib.pantheon.mkStrOption;
config = {
services.fwupd.enable = true;
persistDirs = singleton "/var/lib/bluetooth";
hardware.bluetooth = {
enable = true;
settings.General.Experimental = true;
};
hardware.xone.enable = true;
};
config = lib.mkMerge [
{
services.fwupd.enable = true;
persistDirs = singleton "/var/lib/bluetooth";
hardware.bluetooth = {
enable = true;
settings.General.Experimental = true;
};
hardware.xone.enable = true;
}
(lib.mkIf (config.hardware.platform == "amd") {
hardware.cpu.amd.updateMicrocode = true;
boot.kernelModules = [ "kvm-amd" ];
})
(lib.mkIf (config.hardware.platform == "intel") {
hardware.cpu.intel.updateMicrocode = true;
boot.kernelModules = [ "kvm-intel" ];
})
];
}

3
modules/nixos/hardware/platform/default.nix Normal file
View file

@ -0,0 +1,3 @@
{
imports = [ ./x86_64.nix ];
}

18
modules/nixos/hardware/platform/x86_64.nix Normal file
View file

@ -0,0 +1,18 @@
{ config, lib, ... }:
let
inherit (lib) singleton mkOption;
inherit (lib.types) enum;
cfg = config.hardware.platform;
in
{
options.hardware.platform = mkOption {
type = enum [
"amd"
"intel"
];
};
config = {
hardware.cpu.${cfg}.updateMicrocode = true;
boot.kernelModules = singleton "kvm-${cfg}";
};
}

2
modules/nixos/networking/default.nix
View file

@ -6,7 +6,7 @@ in
networking = {
enableIPv6 = false;
useDHCP = mkDefault true;
hostName = config.system.hostname;
hostName = config.hostname;
networkmanager.enable = true;
};

2
modules/nixos/server/web-apps/librechat/default.nix
View file

@ -20,7 +20,7 @@ mkWebApp {
inherit (upstreamCfg) user group;
};
extraOptions.mongodbURI = mkStrOption // {
default = "mongodb://${config.system.hostname}:27017/LibreChat";
default = "mongodb://${config.hostname}:27017/LibreChat";
};
extraConfig = {
services.librechat = {

2
modules/nixos/server/web-servers/default.nix
View file

@ -18,7 +18,7 @@ in
security.acme = {
acceptTerms = true;
defaults = {
inherit (config.system.mainUser) email;
inherit (config.mainUser) email;
dnsProvider = "cloudflare";
credentialFiles."CLOUDFLARE_DNS_API_TOKEN_FILE" = config.sops.secrets."keys/cloudflare".path;
};

16
modules/nixos/system/default.nix
View file

@ -7,25 +7,9 @@
{
imports = [
./boot.nix
./users.nix
./localisation.nix
./nix-config.nix
./secrets.nix
];
options.system = {
hostname = lib.pantheon.mkStrOption;
mainUser.name = lib.pantheon.mkStrOption;
mainUser.publicKey = lib.pantheon.mkStrOption;
mainUser.email = lib.pantheon.mkStrOption;
bootloader = lib.pantheon.mkStrOption;
};
config = {
stylix = {
enable = true;
base16Scheme = "${pkgs.base16-schemes}/share/themes/atelier-cave.yaml";
};
system.stateVersion = "25.05"; # Did you read the comment?
};
}

9
modules/nixos/system/localisation.nix
View file

@ -1,9 +0,0 @@
{ config, lib, ... }:
{
config = lib.mkMerge [
{
time.timeZone = "Asia/Singapore";
i18n.defaultLocale = "en_US.UTF-8";
}
];
}

17
modules/nixos/system/nix-config.nix
View file

@ -1,17 +0,0 @@
{ config, inputs, ... }:
{
config = {
nixpkgs.config.allowUnfree = true;
nix.nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
nix.settings = {
experimental-features = [
"nix-command"
"flakes"
"pipe-operators"
];
trusted-users = [ "@wheel" ];
};
};
}

37
modules/nixos/system/secrets.nix
View file

@ -1,37 +0,0 @@
{ lib, config, ... }:
{
sops = {
defaultSopsFile = lib.snowfall.fs.get-file "secrets/secrets.yaml";
age.sshKeyPaths = [ "/persist/home/rafiq/.ssh/id_ed25519" ];
secrets = {
"keys/openrouter" = { };
"keys/tailscale" = { };
"keys/gemini" = { };
"keys/cvt-jira" = { };
"keys/cloudflare" = { };
"keys/telegram_bot" = { };
"misc/cvt-jira-link" = { };
"rafiq/hashedPassword".neededForUsers = true;
"rafiq/personalEmailPassword" = { };
"rafiq/workEmailPassword" = { };
"rafiq/oldSMBCredentials" = { };
"librechat/creds_key" = { };
"librechat/creds_iv" = { };
"librechat/jwt_secret" = { };
"librechat/jwt_refresh_secret" = { };
"librechat/meili_master_key" = { };
};
templates = {
"smb-credentials".content = ''
username=rafiq
password=${config.sops.placeholder."rafiq/oldSMBCredentials"}
'';
};
};
environment.shellInit = # sh
''
export GEMINI_API_KEY=$(sudo cat ${config.sops.secrets."keys/gemini".path})
export CVT_JIRA_KEY=$(sudo cat ${config.sops.secrets."keys/cvt-jira".path})
export CVT_JIRA_LINK=$(sudo cat ${config.sops.secrets."misc/cvt-jira-link".path})
'';
}

27
modules/nixos/system/users.nix
View file

@ -1,27 +0,0 @@
{
config,
lib,
...
}:
{
config = lib.mkMerge [
{
users.mutableUsers = false;
users.groups.users = {
gid = 100;
members = [ "${config.system.mainUser.name}" ];
};
users.users."${config.system.mainUser.name}" = {
linger = true;
uid = 1000;
isNormalUser = true;
hashedPasswordFile = config.sops.secrets."${config.system.mainUser.name}/hashedPassword".path;
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = [ config.system.mainUser.publicKey ];
};
users.users.root.openssh.authorizedKeys.keys = lib.singleton config.system.mainUser.publicKey;
services.getty.autologinUser = config.system.mainUser.name;
security.sudo.wheelNeedsPassword = false;
}
];
}