58 lines
1.6 KiB
Nix
58 lines
1.6 KiB
Nix
|
{ config, lib, pkgs, inputs, modulesPath, ... }:
|
||
|
|
|
||
|
|
{
|
||
|
|
imports = [
|
||
|
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||
|
|
];
|
||
|
|
|
||
|
|
boot = {
|
||
|
|
initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" "nvme" ];
|
||
|
|
initrd.kernelModules = [ "dm-snapshot" ];
|
||
|
|
kernelModules = [ "kvm-intel" ];
|
||
|
|
extraModulePackages = [ ];
|
||
|
|
kernelParams = [
|
||
|
|
# HACK Disables fixes for spectre, meltdown, L1TF and a number of CPU
|
||
|
|
# vulnerabilities. Don't copy this blindly! And especially not for
|
||
|
|
# mission critical or server/headless builds exposed to the world.
|
||
|
|
"mitigations=off"
|
||
|
|
];
|
||
|
|
|
||
|
|
# Refuse ICMP echo requests on my desktop/laptop; nobody has any business
|
||
|
|
# pinging them, unlike my servers.
|
||
|
|
kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1;
|
||
|
|
};
|
||
|
|
|
||
|
|
# Modules
|
||
|
|
modules.hardware = {
|
||
|
|
audio.enable = true;
|
||
|
|
fs = {
|
||
|
|
enable = true;
|
||
|
|
ssd.enable = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
# CPU
|
||
|
|
nix.maxJobs = lib.mkDefault 4;
|
||
|
|
hardware.cpu.intel.updateMicrocode = true;
|
||
|
|
# performance gives better battery life/perf than ondemand on sandy bridge and
|
||
|
|
# newer because of intel pstates.
|
||
|
|
powerManagement.cpuFreqGovernor = "performance";
|
||
|
|
# Without this wpa_supplicant may fail to auto-discover wireless interfaces at
|
||
|
|
# startup (and must be restarted).
|
||
|
|
networking.wireless.interfaces = [ "wlp3s0" ];
|
||
|
|
|
||
|
|
# Storage
|
||
|
|
fileSystems = {
|
||
|
|
"/" = {
|
||
|
|
device = "/dev/disk/by-label/nixos";
|
||
|
|
fsType = "ext4";
|
||
|
|
options = [ "noatime" ];
|
||
|
|
};
|
||
|
|
"/boot" = {
|
||
|
|
device = "/dev/disk/by-label/BOOT";
|
||
|
|
fsType = "vfat";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
swapDevices = [ { device = "/dev/disk/by-label/swap"; }];
|
||
|
|
}
|