AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

123

Browse Source
This commit is contained in:
Dmitriy Kholkin 2023-03-29 22:55:54 +03:00
parent 64fc29f902
commit e7e03a3cd4
14 changed files with 117 additions and 121 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
machines/AMD-Workstation/boot.nix
View File

@ -52,13 +52,19 @@ in {
persist = {
enable = true;
cache.clean.enable = false;
cache.clean.enable = true;
# state.files = [
# "/etc/machine-id"
# "/etc/NIXOS"
# ];
};
fileSystems."/" = lib.mkForce {
device = "none";
options = [ "defaults" "size=4G" "mode=755" ];
fsType = "tmpfs";
};
fileSystems."/home".neededForBoot = true;
fileSystems."/persist".neededForBoot = true;
boot.initrd.postDeviceCommands = lib.mkAfter ''

8
machines/AMD-Workstation/hardware-configuration.nix
View File

@ -13,10 +13,10 @@
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "rpool/nixos/root";
fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
};
# fileSystems."/" =
# { device = "rpool/nixos/root";
# fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
# };
fileSystems."/home" =
{ device = "rpool/user/home";

7
modules/autoinstall/install.nix
View File

@ -264,7 +264,9 @@ in ''
zfs create -o canmount=on -o mountpoint=/media/bittorrent -o atime=off -o recordsize=16K -o compression=lz4 rpool/persistent/bittorrent
chown 1000:100 /mnt/media/bittorrent
chmod 775 /mnt/media/bittorrent
zfs create -o canmount=on -o mountpoint=/media/libvirt -o atime=off -o recordsize=16K -o compression=lz4 rpool/persistent/libvirt
zfs create -o canmount=on -o mountpoint=/var/lib/libvirt rpool/persistent/libvirt
zfs create -o canmount=on -o mountpoint=/media/libvirt rpool/persistent/libvirt-user
zfs create -o canmount=on -o mountpoint=/media/libvirt/images -o atime=off -o recordsize=16K -o compression=lz4 rpool/persistent/libvirt-user/images
chown 1000:67 /mnt/media/libvirt
chmod 775 /mnt/media/libvirt
@ -285,6 +287,9 @@ in ''
zfs snapshot rpool/persistent/nixos-containers@empty
zfs snapshot rpool/persistent/bittorrent@empty
zfs snapshot rpool/persistent/libvirt@empty
zfs snapshot rpool/persistent/libvirt-user@empty
zfs snapshot rpool/persistent/libvirt-user/images@empty
if [ "${cfg.createBootPool}" = "true" ]; then
pprint "Create ZFS boot pool on $bootPool"

7
modules/passthrough/default.nix
View File

@ -1,8 +1,3 @@
{
# Add your NixOS modules here
#
# libvirt = ./libvirt.nix;
# vfio = ./vfio.nix;
# virtualisation.nix = ./virtualisation.nix;
imports = [ ./virtualisation.nix ./vfio.nix ./libvirt.nix ];
imports = [ ./virtualisation.nix ./vfio.nix ];
}

37
modules/passthrough/libvirt.nix
View File

@ -1,37 +0,0 @@
{ lib, pkgs, config, ... }:
with lib;
let
cfg = config.virtualisation.libvirtd;
boolToZeroOne = x: if x then "1" else "0";
aclString = with lib.strings;
concatMapStringsSep ''
,
'' escapeNixString cfg.deviceACL;
in {
options.virtualisation.libvirtd = {
deviceACL = mkOption {
type = types.listOf types.str;
default = [ ];
};
clearEmulationCapabilities = mkOption {
type = types.bool;
default = true;
};
};
config.users.users."qemu-libvirtd" = {
extraGroups = optionals (!cfg.qemu.runAsRoot) [ "kvm" "input" ];
isSystemUser = true;
};
config.virtualisation.libvirtd.qemu.verbatimConfig = ''
clear_emulation_capabilities = ${
boolToZeroOne cfg.clearEmulationCapabilities
}
cgroup_device_acl = [
${aclString}
]
'';
}

125
modules/passthrough/vfio.nix
View File

@ -2,48 +2,55 @@
with lib;
let
cfg = config.virtualisation.vfio;
acscommit = "1ec4cb0753488353e111496a90bdfbe2a074827e";
cfg-libvirtd = config.virtualisation.libvirtd;
boolToZeroOne = x: if x then "1" else "0";
aclString = with lib.strings;
concatMapStringsSep ''
,
'' escapeNixString cfg.deviceACL;
in {
options.virtualisation.vfio = {
enable = mkEnableOption "VFIO Configuration";
IOMMUType = mkOption {
type = types.enum [ "intel" "amd" ];
example = "intel";
description = "Type of the IOMMU used";
options.virtualisation = {
vfio = {
enable = mkEnableOption "VFIO Configuration";
IOMMUType = mkOption {
type = types.enum [ "intel" "amd" ];
example = "intel";
description = "Type of the IOMMU used";
};
devices = mkOption {
type = types.listOf (types.strMatching "[0-9a-f]{4}:[0-9a-f]{4}");
default = [ ];
example = [ "10de:1b80" "10de:10f0" ];
description = "PCI IDs of devices to bind to vfio-pci";
};
disableEFIfb = mkOption {
type = types.bool;
default = false;
example = true;
description = "Disables the usage of the EFI framebuffer on boot.";
};
blacklistNvidia = mkOption {
type = types.bool;
default = false;
description = "Add Nvidia GPU modules to blacklist";
};
ignoreMSRs = mkOption {
type = types.bool;
default = false;
example = true;
description =
"Enables or disables kvm guest access to model-specific registers";
};
};
devices = mkOption {
type = types.listOf (types.strMatching "[0-9a-f]{4}:[0-9a-f]{4}");
default = [ ];
example = [ "10de:1b80" "10de:10f0" ];
description = "PCI IDs of devices to bind to vfio-pci";
};
disableEFIfb = mkOption {
type = types.bool;
default = false;
example = true;
description = "Disables the usage of the EFI framebuffer on boot.";
};
blacklistNvidia = mkOption {
type = types.bool;
default = false;
description = "Add Nvidia GPU modules to blacklist";
};
ignoreMSRs = mkOption {
type = types.bool;
default = false;
example = true;
description =
"Enables or disables kvm guest access to model-specific registers";
};
applyACSpatch = mkOption {
type = types.bool;
default = false;
description = ''
If set, the following things will happen:
- The ACS override patch is applied
- Applies the i915-vga-arbiter patch
- Adds pcie_acs_override=downstream to the command line
'';
libvirtd = {
deviceACL = mkOption {
type = types.listOf types.str;
default = [ ];
};
clearEmulationCapabilities = mkOption {
type = types.bool;
default = true;
};
};
};
@ -55,8 +62,8 @@ in {
boot.kernelParams = (if cfg.IOMMUType == "intel" then [
"intel_iommu=on"
"intel_iommu=igfx_off"
] else
[ "amd_iommu=on" ]) ++ (optional (builtins.length cfg.devices > 0)
] else [ "amd_iommu=on" ])
++ (optional (builtins.length cfg.devices > 0)
("vfio-pci.ids=" + builtins.concatStringsSep "," cfg.devices))
++ (optionals cfg.applyACSpatch [
"pcie_acs_override=downstream,multifunction"
@ -68,35 +75,21 @@ in {
]);
boot.kernelModules = [ "vfio_virqfd" "vfio_pci" "vfio_iommu_type1" "vfio" ];
boot.initrd.kernelModules =
[ "vfio_virqfd" "vfio_pci" "vfio_iommu_type1" "vfio" ];
boot.blacklistedKernelModules =
optionals cfg.blacklistNvidia [ "nvidia" "nouveau" ];
boot.kernelPatches = optionals cfg.applyACSpatch [
{
name = "add-acs-overrides";
patch = pkgs.fetchurl {
name = "add-acs-overrides.patch";
url =
"https://raw.githubusercontent.com/slowbro/linux-vfio/v5.5.4-arch1/add-acs-overrides.patch";
#url =
# "https://aur.archlinux.org/cgit/aur.git/plain/add-acs-overrides.patch?h=linux-vfio&id=${acscommit}";
sha256 = "0nbmc5bwv7pl84l1mfhacvyp8vnzwhar0ahqgckvmzlhgf1n1bii";
};
users.users."qemu-libvirtd" = {
extraGroups = optionals (!cfg-libvirtd.qemu.runAsRoot) [ "kvm" "input" ];
};
virtualisation.libvirtd.qemu.verbatimConfig = ''
clear_emulation_capabilities = ${
boolToZeroOne cfg-libvirtd.clearEmulationCapabilities
}
{
name = "i915-vga-arbiter";
patch = pkgs.fetchurl {
name = "i915-vga-arbiter.patch";
url =
"https://raw.githubusercontent.com/slowbro/linux-vfio/v5.5.4-arch1/i915-vga-arbiter.patch";
#url =
# "https://aur.archlinux.org/cgit/aur.git/plain/i915-vga-arbiter.patch?h=linux-vfio&id=${acscommit}";
sha256 = "1m5nn9pfkf685g31y31ip70jv61sblvxgskqn8a0ca60mmr38krk";
};
}
];
cgroup_device_acl = [
${aclString}
]
'';
};
}

1
profiles/applications/packages.nix
View File

@ -114,7 +114,6 @@ with config.deviceSpecific; {
".config/pcmanfm"
# ".config/Pinta"
".config/qBittorrent"
".config/rclone"
# ".config/qimgv"
".config/SchildiChat"
".config/Sonixd"

9
profiles/applications/rclone.nix Normal file
View File

@ -0,0 +1,9 @@
{ config, pkgs, lib, ... }: {
home-manager.users.${config.mainuser}.home.packages = [
pkgs.rclone
];
persist.state.homeDirectories = [
".config/rclone"
];
}

4
profiles/applications/steam.nix
View File

@ -18,6 +18,10 @@
persist.state.homeDirectories = [
".local/share/Steam"
".steam"
] ++ [
# Games configs
".config/WarThunder"
];
# Start Steam only after the network is up

1
profiles/security/user.nix
View File

@ -1,4 +1,5 @@
{ config, pkgs, lib, ... }: {
security.apparmor.enable = true;
programs.firejail.enable = true;
users.mutableUsers = false;

18
profiles/virtualisation.nix
View File

@ -49,10 +49,14 @@ with config.deviceSpecific; {
qemu = {
ovmf.enable = true;
ovmf.packages = [
pkgs.OVMFFull.fd
(pkgs.OVMFFull.override {
secureBoot = true;
tpmSupport = true;
}).fd
pkgs.pkgsCross.aarch64-multiplatform.OVMF.fd
];
runAsRoot = false;
swtpm.enable = true;
};
onBoot = "ignore";
onShutdown = "shutdown";
@ -61,6 +65,12 @@ with config.deviceSpecific; {
spiceUSBRedirection.enable = true;
};
users.users."qemu-libvirtd" = {
extraGroups =
lib.optionals (!config.virtualisation.libvirtd.qemu.runAsRoot)
[ "kvm" "input" ];
};
security.unprivilegedUsernsClone = true;
home-manager.users.${config.mainuser} = {
@ -68,6 +78,12 @@ with config.deviceSpecific; {
[storage]
driver = "overlay2"
'';
home.file.".config/libvirt/libvirt.conf".text = ''
uri_default = "qemu:///system"
'';
home.packages = lib.mkIf (!isServer) [
pkgs.virt-manager
];
};
# users.users.${config.mainuser} = {

3
profiles/workspace/gtk.nix
View File

@ -57,4 +57,7 @@ in {
# home.sessionVariables.GTK_THEME = "Generated";
home.sessionVariables.GTK_THEME = "Rosepine-BL";
};
persist.state.homeDirectories = [
".config/dconf"
];
}

1
roles/desktop.nix
View File

@ -21,6 +21,7 @@
mpv
# ncmpcpp
packages
rclone
rofi
spotify
steam

9
todo.md
View File

@ -2,14 +2,15 @@
* config qbittorrent
* telegram theme
* use theme engine from https://github.com/SenchoPens/senixos
* update waybar
* Firejail all the things
* use theme engine from https://github.com/SenchoPens/base16.nix (?)
* fix waybar config
* Firejail all the things (maybe not...)
* change writeShellScript and writeShellScriptBin to writeShellApplication
* add asserts to autoinstall module
* fix mime, fix xray (update on vps), fix aria2
* fix mime, fix aria2
* add updateScript to my packages
* move overlay and packages to root folder
* fix global hotkeys for obs (use hyprland pass dispatcher)
## Tips: