From 10ebee18b86ba698e678464a03aef8a2fcbdb71c Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Sun, 10 Jan 2021 01:25:31 +1000 Subject: [PATCH] updated --- box.nix | 29 ++++ common.nix | 115 +++++++++++++++ configuration.nix | 147 ++++++++++++++++++ hardware-configuration.nix | 32 ++++ musician.nix | 24 +++ musnix.nix | 6 + nixos-legacy-bios-encrypted.sh | 104 +++++++++++++ nvim.nix | 262 +++++++++++++++++++++++++++++++++ unstable.nix | 13 ++ 9 files changed, 732 insertions(+) create mode 100644 box.nix create mode 100644 common.nix create mode 100644 configuration.nix create mode 100644 hardware-configuration.nix create mode 100644 musician.nix create mode 100644 musnix.nix create mode 100644 nixos-legacy-bios-encrypted.sh create mode 100644 nvim.nix create mode 100644 unstable.nix diff --git a/box.nix b/box.nix new file mode 100644 index 00000000..d7c291d3 --- /dev/null +++ b/box.nix @@ -0,0 +1,29 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./common.nix + ./musician.nix + ]; + + + users.extraUsers."anish".extraGroups = [ "jackaudio" ]; + + services.xserver = { + enable = true; + displayManager.gdm.enable = true; + desktopManager.gnome3.enable = true; + }; + + # task whisperer broken + #nixpkgs.config.allowBroken = true; + + # virtual box + virtualisation.virtualbox.host.enable = true; + + # ErgoDox Firmware (doesn't compile) + # environment.systemPackages = with pkgs; [ + # qmk_firmware + # ]; +} + diff --git a/common.nix b/common.nix new file mode 100644 index 00000000..b9887b83 --- /dev/null +++ b/common.nix @@ -0,0 +1,115 @@ +{ config, pkgs, ... }: + +{ + imports = [ + ./nvim.nix +# ./unstable.nix + ]; + + + environment.systemPackages = with pkgs; [ + htop + iftop + wget + curl + exa + bat + fd + ag + tcpdump + whois + mtr + file + lsof + atool + inotify-tools + strace + zip + unzip + rsync + tmux + pwgen + glow + jq + gitAndTools.gitFull + #neovim defined in ./nvim.nix + wofi + firefox + fractal + pinentry_gnome + pass + gcc + less + mpv + zathura + #qmk_firmware + python3 + gdb + vcv-rack + #xdotool + #neofetch + #calibre + #openvpn + gimp + xxd + tilix + kitty + taskwarrior + gnupg + openjdk + glslviewer + filezilla + signal-desktop + wire-desktop + tdesktop + feedreader + newsflash + syncthing + dijo + #kdeconnect + #ssb-patchwork + gnome3.gnome-tweaks + gnome3.pomodoro + gnomeExtensions.gsconnect + #gnomeExtensions.taskwhisperer + #gnome3.networkmanager-openvpn + #python3Packages.youtube-dl + appimage-run + home-manager + libreoffice + fontconfig + hugo + #processing + #nextcloud-client + zsh-powerlevel10k + powerline-fonts + supercollider + haskellPackages.tidal + # vim-zettel + pandoc + ]; + + programs.bash.enableCompletion = true; + + # needed for vcv-rack + nixpkgs.config.allowUnfree = true; + + system.copySystemConfiguration = true; + services.syncthing = { + enable = true; + openDefaultPorts = true; + systemService = true; + user = "anish"; + dataDir = "/home/anish/usr/syncthing"; + }; + + #zsh powerlevel10k + programs.zsh.enable = true; + programs.zsh.promptInit = "source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme"; + users.users.anish.shell = pkgs.zsh; + + #android + programs.adb.enable = true; + users.users.anish.extraGroups = ["adbusers"]; + +} diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 00000000..de14efb9 --- /dev/null +++ b/configuration.nix @@ -0,0 +1,147 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ./common.nix + ./box.nix + ]; + + # Use the GRUB 2 boot loader. + boot.loader.efi.canTouchEfiVariables = true; + boot.loader.efi.efiSysMountPoint = "/boot/efi"; + boot.loader.grub = { + enable = true; + device = "nodev"; + version = 2; + efiSupport = true; + enableCryptodisk = true; + }; + + boot.initrd.secrets = { + "/keyfile0.bin" = /etc/secrets/initrd/keyfile0.bin; + "/keyfile1.bin" = /etc/secrets/initrd/keyfile1.bin; + }; + + boot.initrd.luks.devices = { + "root" = { + #name = "root"; + device = "/dev/disk/by-uuid/f37f3222-47d7-42d8-b400-363320a31853"; # UUID for /dev/nvme01np2 + preLVM = true; + allowDiscards = true; + keyFile = "/keyfile0.bin"; + }; + }; + + # Data mount + fileSystems."/data" = { + device = "/dev/disk/by-uuid/3276a297-9ee4-4998-b262-1ed100366c06"; # UUID for /dev/mapper/crypted-data + encrypted = { + enable = true; + label = "crypted-data"; + blkDev = "/dev/disk/by-uuid/8a317bf4-fe13-4334-a6df-5fe5a5048b5e"; # UUID for /dev/sda1 + keyFile = "/keyfile1.bin"; + }; + }; + + # boot.loader.grub.efiInstallAsRemovable = true; + # boot.loader.efi.efiSysMountPoint = "/boot/efi"; + # Define on which hard drive you want to install Grub. + # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only + + networking.hostName = "box"; # Define your hostname. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + + # The global useDHCP flag is deprecated, therefore explicitly set to false here. + # Per-interface useDHCP will be mandatory in the future, so this generated config + # replicates the default behaviour. + networking.useDHCP = false; + networking.interfaces.enp0s31f6.useDHCP = true; + networking.interfaces.enp3s0.useDHCP = true; + networking.interfaces.wlp4s0.useDHCP = true; + + # OpenVPN + services.openvpn.servers = { + officeVPN = + { config = '' + config /home/anish/usr/work/ThreatDefence/vpn/anishcarbon19.ovpn ''; + autoStart = false; + updateResolvConf = true; + }; + }; + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + # i18n = { + # consoleFont = "Lat2-Terminus16"; + # consoleKeyMap = "us"; + # defaultLocale = "en_US.UTF-8"; + # }; + + # Set your time zone. + # time.timeZone = "Europe/Amsterdam"; + + # List packages installed in system profile. To search, run: + # $ nix search wget + # environment.systemPackages = with pkgs; [ + # wget vim + # ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.permitRootLogin = "yes"; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + # Enable CUPS to print documents. + # services.printing.enable = true; + + # Enable sound. + sound.enable = true; + # hardware.pulseaudio.enable = true; + + # Enable the X11 windowing system. + # services.xserver.enable = true; + # services.xserver.layout = "us"; + # services.xserver.xkbOptions = "eurosign:e"; + + # Enable touchpad support. + # services.xserver.libinput.enable = true; + + # Enable the KDE Desktop Environment. + # services.xserver.displayManager.sddm.enable = true; + # services.xserver.desktopManager.plasma5.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.anish = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + hashedPassword = "MO0Pbd2O4eIlA"; + }; + + # This value determines the NixOS release with which your system is to be + # compatible, in order to avoid breaking some software such as database + # servers. You should change this only after NixOS release notes say you + # should. + system.stateVersion = "19.09"; # Did you read the comment? + +} + diff --git a/hardware-configuration.nix b/hardware-configuration.nix new file mode 100644 index 00000000..a8db8d4e --- /dev/null +++ b/hardware-configuration.nix @@ -0,0 +1,32 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/ade0752d-84d3-4e39-865b-9027ba2d5c67"; + fsType = "ext4"; + }; + + fileSystems."/boot/efi" = + { device = "/dev/disk/by-uuid/1715-278E"; + fsType = "vfat"; + }; + + swapDevices = + [ { device = "/dev/disk/by-uuid/b790abb4-ba5f-4476-8f09-b0fc575414aa"; } + ]; + + nix.maxJobs = lib.mkDefault 4; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; +} diff --git a/musician.nix b/musician.nix new file mode 100644 index 00000000..0dc95059 --- /dev/null +++ b/musician.nix @@ -0,0 +1,24 @@ +{pkgs, config, ... }: +{ + imports = [ + /home/anish/usr/musnix + ]; + + musnix.enable = true; + users.users.anish.extraGroups = [ "audio" ]; + + environment.systemPackages = with pkgs; [ ardour patchage helm ]; + #services.jack = { + # jackd.enable = true; + # # support ALSA only programs via ALSA JACK PCM plugin + # alsa.enable = false; + # # support ALSA only programs via loopback device (supports programs like Steam) + # loopback = { + # enable = true; + # # buffering parameters for dmix device to work with ALSA only semi-professional sound programs + # #dmixConfig = '' + # # period_size 2048 + # #''; + # }; + #}; +} diff --git a/musnix.nix b/musnix.nix new file mode 100644 index 00000000..b924f30f --- /dev/null +++ b/musnix.nix @@ -0,0 +1,6 @@ +{ + imports = [ ]; + musnix.enable = true; + + users.users."anish".extraGroups = [ "audio" ]; +} diff --git a/nixos-legacy-bios-encrypted.sh b/nixos-legacy-bios-encrypted.sh new file mode 100644 index 00000000..e3ed8395 --- /dev/null +++ b/nixos-legacy-bios-encrypted.sh @@ -0,0 +1,104 @@ +#!/usr/bin/env bash +set -eux + +hostname="bowl" +password="xxx" + +diskdev=/dev/sda +rootpart=/dev/sda2 + +# -o clear +# -g convert to gpt disk +# -n new partition num:start:end +size +# ef00 EFI / 8300 linux fs +sgdisk -o -g -n 1::+5M -t 1:ef02 -n 2:: -t 2:8300 $diskdev + +# LVM part +echo "$password" | cryptsetup luksFormat --type luks1 -h sha512 $rootpart +echo "$password" | cryptsetup luksOpen $rootpart enc-pv + +pvcreate /dev/mapper/enc-pv +vgcreate vg0 /dev/mapper/enc-pv +lvcreate -L 8G -n swap vg0 +lvcreate -L 40G -n nixos vg0 +lvcreate -l '100%FREE' -n home vg0 + +# format disk +mkfs.ext4 -L root /dev/vg0/nixos +mkfs.ext4 -L home /dev/vg0/home +mkswap -L swap /dev/vg0/swap + +swapon /dev/vg0/swap +mount /dev/vg0/nixos /mnt + +nix-channel --add https://nixos.org/channels/nixos-unstable nixos +nix-channel --update + +nixos-generate-config --root /mnt + +for uuid in /dev/disk/by-uuid/* +do + if test $(readlink -f $uuid) = $rootpart + then + luksuuid=$uuid + break + fi +done + +cat << EOF > /mnt/etc/nixos/configuration.nix +{ config, pkgs, ... }: +{ +imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + boot.loader.grub.devices = [ "/dev/sda" ]; + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.enableCryptodisk = true; + boot.loader.supportsInitrdSecrets = true; + + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.initrd.availableKernelModules = ["virtio-pci"]; + boot.initrd.network = { + enable = true; + ssh = { + enable = true; + port = 2222; + authorizedKeys = ["ssh-rsa xxx"]; + hostKeys = [ "/host_ecdsa_key" ]; + }; + }; + + boot.initrd.luks.devices = [ + { + name = "enc-pv"; + preLVM = true; + device = "$luksuuid"; + allowDiscards = true; + } + ]; + + boot.initrd.secrets = { + "/host_ecdsa_key" = "/host_ecdsa_key"; + }; + + boot.cleanTmpDir = true; + boot.kernelModules = [ "dm-snapshot" ]; + nixpkgs.config.allowUnfree = true; + users.users.root.initialHashedPassword = ""; + services.openssh.permitRootLogin = "prohibit-password"; + networking.hostName = "$hostname"; + time.timeZone = "Europe/Paris"; + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = ["ssh-rsa xxx"]; + system.stateVersion = "20.03"; +} +EOF + +ssh-keygen -t ecdsa -N "" -f host_ecdsa_key + +cp host_ecdsa_key /mnt/ + +nixos-install --no-root-passwd + diff --git a/nvim.nix b/nvim.nix new file mode 100644 index 00000000..f7319d73 --- /dev/null +++ b/nvim.nix @@ -0,0 +1,262 @@ +{ pkgs, ... }: + + + #nvim + { + environment.variables.EDITOR = "nvim"; + environment.shellAliases = { + k = "vim -c :VimwikiIndex"; + kz = "vim -c :VimwikiIndex -c :ZettelNew"; + }; + environment.systemPackages = with pkgs; [ + nodejs + ( neovim.override { + vimAlias = true; + configure = { + packages.myPlugins = with pkgs.vimPlugins; { + start = [ + vim-nix + fzf-vim + vim-elixir + emmet-vim + nerdtree + goyo-vim + vim-sneak + lightline-vim + csv-vim + vimwiki + coc-nvim + coc-json + coc-python + coc-pairs + coc-emmet + emmet-vim + LanguageClient-neovim + ayu-vim + rainbow_parentheses-vim + vim-surround + vim-fugitive + #iron-nvim + #nvim-colorizer + vim-devicons + + # testing + #vim-processing + #vim-tidal + taskwiki + vim-zettel + vimwiki-sync + ]; + }; + customRC = '' + set tabstop=2 + set showmatch + set shiftwidth=2 + set noexpandtab + set autoindent + + set foldmethod=indent " fold based on indent + set number + set nocompatible + set relativenumber + set showtabline=2 + set autowriteall + syntax on + set list lcs=tab:\|\ + filetype plugin on + + set termguicolors + let ayucolor="dark" + colorscheme ayu + + " window + nmap wh :topleft vnew + nmap wl :botright vnew + nmap wk :topleft new + nmap wj :botright new + + let mapleader = "\" + + " lightline colorscheme + let g:lightline = { + \ 'colorscheme': 'seoul256', + \ } + + " moving splits with vim movements. + :tnoremap h + :tnoremap j + :tnoremap k + :tnoremap l + :inoremap h + :inoremap j + :inoremap k + :inoremap l + :nnoremap h + :nnoremap j + :nnoremap k + :nnoremap l + :nnoremap "=strftime("%Y-%m-%d %H:%M:") + :inoremap =strftime("%Y-%m-%d %H:%M:") + + " exit normal mode in terminal + :tnoremap + + let g:syntastic_always_populate_loc_list = 1 + let g:syntastic_auto_loc_list = 1 + let g:syntastic_check_on_open = 1 + let g:syntastic_check_on_wq = 0 + + let g:rainbow_active = 0 + autocmd BufReadPost,BufNewFile c,py,nix RainbowParenthesesToggleAll + + " keyboard commands + map t :NERDTreeToggle + map s :w + map q :wq + map r :RainbowParenthesesToggleAll + map zs :ZettelSearch + map zo :ZettelOpen + map zn :ZettelNew + + + " NERDTree + " open on directory + autocmd StdinReadPre * let s:std_in=1 + + " coc + " + " if hidden is not set, TextEdit might fail. + set hidden + + " Some servers have issues with backup files, see #649 + set nobackup + set nowritebackup + + " Better display for messages + set cmdheight=2 + + " You will have bad experience for diagnostic messages when it's default 4000. + set updatetime=300 + + " don't give |ins-completion-menu| messages. + set shortmess+=c + + " always show signcolumns + set signcolumn=yes + + " Use tab for trigger completion with characters ahead and navigate. + " Use command ':verbose imap ' to make sure tab is not mapped by other plugin. + inoremap + \ pumvisible() ? "\" : + \ check_back_space() ? "\" : + \ coc#refresh() + inoremap pumvisible() ? "\" : "\" + + function! s:check_back_space() abort + let col = col('.') - 1 + return !col || getline('.')[col - 1] =~# '\s' + endfunction + + " Use to trigger completion. + inoremap coc#refresh() + + " Use to confirm completion, `u` means break undo chain at current position. + " Coc only does snippet and additional edit on confirm. + inoremap pumvisible() ? "\" : "\u\" + " Or use `complete_info` if your vim support it, like: + " inoremap complete_info()["selected"] != "-1" ? "\" : "\u\" + + " Use `[g` and `]g` to navigate diagnostics + nmap [g (coc-diagnostic-prev) + nmap ]g (coc-diagnostic-next) + + " Remap keys for gotos + nmap gd (coc-definition) + nmap gy (coc-type-definition) + nmap gi (coc-implementation) + nmap gr (coc-references) + + " Use K to show documentation in preview window + nnoremap K :call show_documentation() + + function! s:show_documentation() + if (index(['vim','help'], &filetype) >= 0) + execute 'h '.expand('') + else + call CocAction('doHover') + endif + endfunction + + " Highlight symbol under cursor on CursorHold + autocmd CursorHold * silent call CocActionAsync('highlight') + + " Remap for rename current word + nmap rn (coc-rename) + + " Remap for format selected region + xmap f (coc-format-selected) + nmap f (coc-format-selected) + + augroup mygroup + autocmd! + " Setup formatexpr specified filetype(s). + autocmd FileType typescript,json setl formatexpr=CocAction('formatSelected') + " Update signature help on jump placeholder + autocmd User CocJumpPlaceholder call CocActionAsync('showSignatureHelp') + augroup end + + " Remap for do codeAction of selected region, ex: `aap` for current paragraph + xmap a (coc-codeaction-selected) + nmap a (coc-codeaction-selected) + + " Remap for do codeAction of current line + nmap ac (coc-codeaction) + " Fix autofix problem of current line + nmap qf (coc-fix-current) + + " Create mappings for function text object, requires document symbols feature of languageserver. + xmap if (coc-funcobj-i) + xmap af (coc-funcobj-a) + omap if (coc-funcobj-i) + omap af (coc-funcobj-a) + + " Use for select selections ranges, needs server support, like: coc-tsserver, coc-python + nmap (coc-range-select) + xmap (coc-range-select) + + " Use `:Format` to format current buffer + command! -nargs=0 Format :call CocAction('format') + + " Use `:Fold` to fold current buffer + command! -nargs=? Fold :call CocAction('fold', ) + + " use `:OR` for organize import of current buffer + command! -nargs=0 OR :call CocAction('runCommand', 'editor.action.organizeImport') + + " Add status line support, for integration with other plugin, checkout `:h coc-status` + " set statusline^=%{coc#status()}%{get(b:,'coc_current_function',"")} + + " Using CocList + " Show all diagnostics + nnoremap a :CocList diagnostics + " Manage extensions + nnoremap e :CocList extensions + " Show commands + nnoremap c :CocList commands + " Find symbol of current document + nnoremap o :CocList outline + " Search workspace symbols + nnoremap s :CocList -I symbols + " Do default action for next item. + nnoremap j :CocNext + " Do default action for previous item. + nnoremap k :CocPrev + " Resume latest coc list + nnoremap p :CocListResume + + au BufNewFile,BufRead *.frag,*.vert,*.fp,*.vp,*.glsl setf glsl + ''; + }; + } + )]; +} diff --git a/unstable.nix b/unstable.nix new file mode 100644 index 00000000..983a4ed8 --- /dev/null +++ b/unstable.nix @@ -0,0 +1,13 @@ +{ config, pkgs, ... }: + + +let + unstable = import {}; +in { + nix.nixPath = [ + "nixos-unstable=https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz" + ]; + + #currently installed this software through nix-env -f https://nixos.org/channels/nixos-unstable -iA [ packages ] + environment.systemPackages = [ unstable.ripcord ]; +}