From e44c078ebcea9d81da6d61a0ae596a3e46e9a12d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= Date: Fri, 14 Nov 2025 09:18:36 +0100 Subject: treewide: full update in some time --- nixos/modules/desktop.nix | 8 +-- nixos/modules/develop.nix | 5 +- nixos/modules/generic.nix | 2 +- nixos/modules/hosts.nix | 10 +++- nixos/modules/openwrtone.nix | 120 +++++++++++++++++++++++++++++++++++++++++++ nixos/modules/packages.nix | 10 ++-- nixos/modules/router.nix | 2 +- nixos/modules/users.nix | 4 +- nixos/modules/wireguard.nix | 17 +++++- 9 files changed, 160 insertions(+), 18 deletions(-) create mode 100644 nixos/modules/openwrtone.nix (limited to 'nixos/modules') diff --git a/nixos/modules/desktop.nix b/nixos/modules/desktop.nix index 618e9cd..0b0b7c6 100644 --- a/nixos/modules/desktop.nix +++ b/nixos/modules/desktop.nix @@ -101,7 +101,7 @@ in { pulsemixer mpd - mpc-cli + mpc ncmpcpp feh shotwell @@ -161,7 +161,7 @@ in { # Writing typst - typstfmt + typstyle typst-live tinymist vale @@ -318,9 +318,9 @@ in { libertine nerd-fonts.hack noto-fonts - noto-fonts-emoji + noto-fonts-color-emoji terminus_font_ttf - ubuntu_font_family + ubuntu-classic unifont ]; diff --git a/nixos/modules/develop.nix b/nixos/modules/develop.nix index 8e24707..14cf55f 100644 --- a/nixos/modules/develop.nix +++ b/nixos/modules/develop.nix @@ -32,6 +32,7 @@ in { vim-vint nodePackages.vim-language-server vale + can-utils # Required for neovim plugins editorconfig-checker @@ -49,6 +50,7 @@ in { deadnix agenix nix-tree + nix-output-monitor # Shell dash # Posix shell @@ -63,7 +65,6 @@ in { # C clang-tools massif-visualizer - #qcachegrind # Python (python3.withPackages (pypkgs: @@ -88,7 +89,7 @@ in { pygal python-gitlab - PyGithub + pygithub schema jinja2 diff --git a/nixos/modules/generic.nix b/nixos/modules/generic.nix index e6e96a4..c57cc19 100644 --- a/nixos/modules/generic.nix +++ b/nixos/modules/generic.nix @@ -38,7 +38,7 @@ in { kernelParams = ["boot.shell_on_fail"]; }; hardware.enableAllFirmware = mkDefault true; - services.fwupd.enable = mkDefault (pkgs.system == "x86_64-linux"); + services.fwupd.enable = mkDefault (pkgs.stdenv.hostPlatform.system == "x86_64-linux"); systemd.oomd.enable = false; networking = { diff --git a/nixos/modules/hosts.nix b/nixos/modules/hosts.nix index 9affe19..bd5a5ab 100644 --- a/nixos/modules/hosts.nix +++ b/nixos/modules/hosts.nix @@ -29,7 +29,12 @@ in { config = { cynerd.hosts = { zd = { + # Network "mox" = "10.8.0.1"; + "one0" = "10.8.0.2"; + # Local + "ridcully" = "10.8.0.59"; + "tc" = "10.8.0.99"; # Portable "binky" = "10.8.0.63"; }; @@ -53,7 +58,6 @@ in { # Local "mpd" = "10.8.2.51"; "errol" = "10.8.2.60"; - "ridcully" = "10.8.2.59"; "printer" = "10.8.2.90"; # Portable "albert" = "10.8.2.61"; @@ -76,6 +80,9 @@ in { networking.hosts = mkIf cnf.enable { # Zd "${cnf.zd.mox}" = ["mox.zd"]; + "${cnf.zd.one0}" = ["one0.zd"]; + "${cnf.zd.ridcully}" = ["ridcully"]; + "${cnf.zd.tc}" = ["tc.zd"]; "${cnf.zd.binky}" = ["binky.zd"]; # Wireguard "${cnf.wg.lipwig}" = ["lipwig.wg"]; @@ -92,7 +99,6 @@ in { "10.8.2.4" = ["mi3g.spt"]; "${cnf.spt.mpd}" = ["mpd.spt"]; "${cnf.spt.errol}" = ["errol"]; - "${cnf.spt.ridcully}" = ["ridcully"]; "${cnf.spt.albert}" = ["albert.spt"]; "${cnf.spt.binky}" = ["binky.spt"]; # Adm diff --git a/nixos/modules/openwrtone.nix b/nixos/modules/openwrtone.nix new file mode 100644 index 0000000..85ddbd2 --- /dev/null +++ b/nixos/modules/openwrtone.nix @@ -0,0 +1,120 @@ +{ + config, + lib, + pkgs, + modulesPath, + extendModules, + ... +}: let + inherit (lib) mkEnableOption mkIf mkDefault; + variant = extendModules { + modules = [ + { + boot.postBootCommands = '' + # On the first boot do some maintenance tasks + if [ -f /nix-path-registration ]; then + set -euo pipefail + + # Register the contents of the initial Nix store + ${config.nix.package.out}/bin/nix-store --load-db < /nix-path-registration + + # nixos-rebuild also requires a "system" profile and an /etc/NIXOS tag. + touch /etc/NIXOS + ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system + + # Prevents this from running on later boots. + rm -f /nix-path-registration + fi + ''; + # We do not have generations in the initial image + boot.loader.generic-extlinux-compatible.configurationLimit = 0; + } + ]; + }; + inherit (variant.config.system.build) toplevel; +in { + options.cynerd.openwrtone = mkEnableOption "Configuration for OpenWrt One"; + + config = mkIf config.cynerd.openwrtone { + nixpkgs = { + hostPlatform = { + config = "aarch64-unknown-linux-gnu"; + system = "aarch64-linux"; + }; + buildPlatform = { + config = "x86_64-unknown-linux-gnu"; + system = "x86_64-linux"; + }; + }; + + # We do not need Grub as U-Boot supports boot using extlinux like file + boot = { + loader = { + grub.enable = mkDefault false; + systemd-boot.enable = mkDefault false; + generic-extlinux-compatible.enable = mkDefault true; + }; + + # Use OpenWrt One specific kernel. It fixes SError with patch. + kernelPackages = mkDefault (pkgs.linuxPackagesFor pkgs.linuxOpenWrtOne); + kernelParams = [ + "fw_devlink=permissive" + "clk_ignore_unused" + "pcie_aspm=off" + ]; + + initrd = { + kernelModules = ["pcie-mediatek-gen3" "nvme"]; + # This includes modules to support common PC manufacturers but is not + # something required on embedded device. + includeDefaultModules = false; + supportedFilesystems = ["btrfs"]; + }; + supportedFilesystems = ["btrfs"]; + }; + hardware.deviceTree.name = mkDefault "mediatek/mt7981b-openwrt-one.dtb"; + + # Cover nix memory consumption peaks by compressing the RAM + zramSwap = mkDefault { + enable = true; + memoryPercent = 80; + }; + + fileSystems = { + "/boot" = mkDefault { + device = "/dev/nvme0n1p1"; + fsType = "vfat"; + }; + "/" = mkDefault { + device = "/dev/nvme0n1p2"; + fsType = "btrfs"; + }; + }; + + environment.systemPackages = with pkgs; [ + iw + ]; + + # No need for installer tools in standard system + system.disableInstallerTools = true; + # No need for NixOS documentation in headless system + documentation.nixos.enable = mkDefault false; + + system.build.tarball = pkgs.callPackage "${modulesPath}/../lib/make-system-tarball.nix" { + extraCommands = pkgs.buildPackages.writeShellScript "tarball-extra-commands" '' + ${variant.config.boot.loader.generic-extlinux-compatible.populateCmd} \ + -c ${toplevel} -d ./boot + ''; + contents = []; + + storeContents = + map (x: { + object = x; + symlink = "none"; + }) [ + toplevel + pkgs.stdenv + ]; + }; + }; +} diff --git a/nixos/modules/packages.nix b/nixos/modules/packages.nix index 96e9a2e..f6961af 100644 --- a/nixos/modules/packages.nix +++ b/nixos/modules/packages.nix @@ -1,11 +1,11 @@ { - config, lib, pkgs, ... }: let inherit (lib) optionals; - isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform; + inherit (pkgs.stdenv.hostPlatform) isx86_64; + isNative = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform; in { nixpkgs = { config.allowUnfree = true; @@ -63,14 +63,14 @@ in { wakeonlan speedtest-cli librespeed-cli - #termshark + termshark w3m lm_sensors ] - ++ optionals (system == "x86_64-linux") [ + ++ optionals isx86_64 [ nmap - ltrace + #ltrace pv screen ] diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix index 224037b..01110ae 100644 --- a/nixos/modules/router.nix +++ b/nixos/modules/router.nix @@ -178,7 +178,7 @@ in { services.resolved = { enable = true; - dnssec = "true"; + #dnssec = "true"; fallbackDns = ["1.1.1.1" "8.8.8.8"]; extraConfig = '' DNSStubListenerExtra=${cnf.lanIP} diff --git a/nixos/modules/users.nix b/nixos/modules/users.nix index f3b7fbe..9c65f8b 100644 --- a/nixos/modules/users.nix +++ b/nixos/modules/users.nix @@ -3,8 +3,8 @@ config, ... }: let - isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform; - isArm = pkgs.hostPlatform.isAarch; + isNative = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform; + isArm = pkgs.stdenv.hostPlatform.isAarch; in { users = { mutableUsers = false; diff --git a/nixos/modules/wireguard.nix b/nixos/modules/wireguard.nix index b49eaae..4fd942c 100644 --- a/nixos/modules/wireguard.nix +++ b/nixos/modules/wireguard.nix @@ -6,7 +6,7 @@ }: let inherit (lib) any all mkEnableOption mkIf mapAttrsToList optional optionals optionalAttrs filterAttrs; inherit (config.networking) hostName; - endpoints = ["lipwig" "spt-omnia" "adm-omnia"]; + endpoints = ["lipwig" "spt-omnia" "adm-omnia" "zd-mox"]; is_endpoint = any (v: v == hostName) endpoints; in { options = { @@ -53,6 +53,15 @@ in { PublicKey = config.secrets.wireguardPubs.adm-omnia; } // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;})) + ({ + Endpoint = "zd.cynerd.cz:51820"; + AllowedIPs = [ + "${config.cynerd.hosts.wg.zd-mox}/32" + "10.8.0.0/24" + ]; + PublicKey = config.secrets.wireguardPubs.zd-mox; + } + // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;})) ] ++ (optionals is_endpoint (mapAttrsToList (n: v: { AllowedIPs = "${config.cynerd.hosts.wg."${n}"}/32"; @@ -77,6 +86,12 @@ in { Gateway = config.cynerd.hosts.wg.adm-omnia; Destination = "10.8.3.0/24"; Metric = 2048; + }) + ++ (optional (hostName != "zd-mox") { + # ZD network + Gateway = config.cynerd.hosts.wg.zd-mox; + Destination = "10.8.0.0/24"; + Metric = 2048; }); }; }; -- cgit v1.2.3