From f4363c36f64d0fb1da5fd1cb6ebf79803127d9e9 Mon Sep 17 00:00:00 2001 From: Kyattsukuro Date: Thu, 21 May 2026 04:49:53 +0200 Subject: [PATCH] nixMain cryptorootm, shared power managment --- README.md | 39 ++++++++++++++++++ eggs/dconfNixMain/user | Bin 15659 -> 15707 bytes eggs/misc/ssh.config | 2 +- eggs/thunar/thunar/accels.scm | 2 +- .../xfconf/xfce-perchannel-xml/thunar.xml | 4 +- eggs/zed/settings.json | 2 +- root-conf/nixos/nixLap/configuration.nix | 21 +--------- root-conf/nixos/nixMain/configuration.nix | 35 +++++++--------- .../nixos/nixMain/hardware-configuration.nix | 30 +++++++------- root-conf/nixos/shared-conf.nix | 20 +++++++++ use_nix.sh | 2 - 11 files changed, 93 insertions(+), 64 deletions(-) diff --git a/README.md b/README.md index 21c89372..682fc921 100644 --- a/README.md +++ b/README.md @@ -17,3 +17,42 @@ Deployment: Used as kde config finder, in `~./config` and `~./local/share`: - `find . -type f -regex '.*\(k\|rc\|pulse\|session\|gtk\|autostart\|xbel\).*'` +### Disc encryption steps +```bash +# Cryptoroot, fs and mount +cryptsetup luksFormat /dev/nvme0n1p2 +cryptsetup luksOpen /dev/nvme0n1p2 cryptroot +mkfs.btrfs -L root /dev/mapper/cryptroot +mount /dev/disk/by-label/root /mnt/ + +# Mount boot +# change type of boot to uefi via fdisk +mkdir /mnt/boot +mount /dev/nvme0n1p1 /mnt/boot/ + +# Cryptoswap and makeswap +cryptsetup luksFormat /dev/nvme0n1p3 --label cryptoswap +cryptsetup luksOpen /dev/disk/by-label/cryptoswap swap +sudo mkswap /dev/mapper/swap -L swap + +# get hw-config +nixos-generate-config --root /mnt/ +cp /mnt/etc/nixos/hardware-configuration.nix / +vim /hardware-configuration.nix +# Append: +# swapDevices = [{ +# device = "/dev/disk/by-label/swap"; +# encrypted = { +# enable = true; +# label = "swap"; +# blkDev = "/dev/disk/by-label/cryptoswap"; +# }; +# }]; + +# Deploy config +rm -r /mnt/etc/nixos/ +cp -r dotfiles-master/dotfiles/root-conf/nixos/ /mnt/etc +cp /hardware-configuration.nix /mnt/etc/nixos/DESTINATION + +nixos-install --root /mnt --flake /mnt/etc/nixos#DESTINATION +``` diff --git a/eggs/dconfNixMain/user b/eggs/dconfNixMain/user index a8b10d9ecb58ccb3913186f7421f6558cb84cf36..ac4af5544242b166c32bda7af8254af165d2e126 100644 GIT binary patch delta 2880 zcmXYz4OEm>9>(vQ=pcfaLX#g!X~9u+##Kv!ij$oa)j*u1ZbX{8I4CeU#D{vsdZz`A zgbY6_jE|6X4;tmz?D|nC9IdT2DkwKO%DS1RROEvd#BvCX)Q53fQ8GPa+%nOuA;xgT#u^FL}UzMEVePTqlE zLw~8*I4P4{9AVZN+caas(9V!=UWpS!Haj=GyYM@z`X8bB3ZhmKTSKeLEjtb8}#jQoeDI7g8;PqT~} zMuVTQ9of&VXmQaX)&n~6&r#_M=ib%}iNnZy@jmo*Ti3rmQLLwRnz1T*!hX%1aO2N}m-=@T?9&)krWq3Z?^ThpS%gM!h zQ6FB0mj1afw~<^thP(!^MJ?X0m|SwPUdWGsfvm=gV{gUMpo>r%`tbp@qse_{54kvu zH#O6Zi9x%(Jp+;CVl9mmPe7NyoAkEUUK|_%o`#x!zh4|&N<0^RkXk!f#q)y~YFJ0; zn_O3kEZ_`yusq%>6=;x<7jAr^#MQrDLOo9?YLBOaR?9S z#(U6?B|R_m@ev$0Is4eeGsrnIX34X+XLH~(5)UDzbYvv-I#zdnTEkpXOS7^|M zwnq#ehrUajI69qNtd8d5iRi)n_e%ZbV%>i~o`TlbhIM$z#gW{ffj^EmCft5WODWb; zZotdYbGH1w>Ey5#T$^gbIyA8D!Y3NBSX1Q31L*jTo5OaKi?wYIfbh#{Xc3ZC)W12u0_%yj;0|FfBuigoH@|- zqMux>5!c{#=up9ddHc!5no>XBjwY7}CR5cx);8-TGqa4@db)B;At=^)W5Y+H0c+U& z+Qa0!2o@cF3z}c*e@Rm+*2tWA0!oZs{-sVdu|}4Hr=!^B_Rval@mTI(h3BE@zmDFk zeu7M1K~{-MjuxKRd1L89MOTA2py7{=={Z7!SR-!6+fhVxy-&L!$mE@5-6*Ge%)$V< z_(uBa$G=BQC$2sE61i9du+63qRDb;JQ96k-Do-B`g zm|Uy_YA&9LLaxtwKqD4w2~zMhbUihuBtS0K3oXO5kv$`AvT8*E#cc73DPjxmYjSjh{ssjbkq=7l)94fnP#{p9L0Z zmx&|j=NfLi)0hoUHym5U^Me;!%dv!0P}TT3i&ed1?eBQpiFP~`a$*CySO-oLo{U^0 ze*R}VxmZ)3j%T8MSN2R*QHxcKtMG5hD9$ul$MsK>yVV z?El?dyq{Nm_ys;7)|ZVR{~H>(ICtSra&b zuRx`lpFgJ=66*mqcmqniZ=GvAxj1;V;|I}`t@X~yV3&Hh_%MO zct0BaA=#&qiGw3Z;=Di)p8rR-YDFBygJbYJkZaDznTyE9sv#$yf(}jG6|P+)*6#yr z8IXncPdL9>Cz@Ehpa5Tk1{OS1r*AE>wx18LLP@*EY*%rK?c~k)n<(?LZ^bj@Vik2O z{w_-Vb$p_}w8UECPW)7odBTKGoAs$i#zkkb#_i+z9aC+)X>NwVc~(ygsvgK E0U;x6)Bpeg delta 2832 zcmXYz3s6*59L7%;3Mz^zy1prGXhd@hDFiG=dzdc943Zn+t4t9WFoR^oyj$X%F$&8R zsFkuo*+!63e8Om%8L1>Gqez*GSeY7DkdOL(J2~_D{qA?}o_ikub1!EWl`SeC(Aj!w zm@)1nwca>mjM(2eOgx^9Dx3ue`;v?ABX{F@Xxw+znPbSsf#gN_m*}mP%LXTri@TZE zO#^-gZSebLV=%e6D|rk4D{?NZx0a>RpbK@>h7SlcX6f>Ga^lIwf&9RZN28MG1~;uC z7ptT3_+->j>e`n@F4hE+aTnUP^7iROa_&tLx6X$i>Q!<0sI&OG_V{O)l0-wBUcDPWS))tp+N- zhv(k10RQ2}T)(^UKm-k9b!5W_p{vWIue->_%I)|Vw0YW-OJ|acHPCoG0Zo7DYO04^ z+><;7pNG5|bs?$bVhzZRmm|xwa{u;F8gvmrLk)fqtt)xu^k#B#7e;yluTO zJCT1*wii{;yON`R#M*+x_)+v@@XiJmuUISh6W)v-@^-jtZKOdLIv&^XHuT4&fj#sC zu{!d%n{K+6Cldy>A-uM$~F`99LLHgD!kUhyRYo<&?j# zB^7ICCY&lp(V;Vc)*DT%nc46V6k1vnu!daRi~A$-Xw>`D9$VCpkI9{6FQTk{3(o0% zW9dRgmx8CGPA~Lq+(m;}GtS2IQMca3Zk+-jlY7WY(cJu=zT+ppmwsySLumTIh5O#; zez7LdfH$Gy17|J;kc%l^%d`N$p^}2FNkeH6>%6w%H&NV?+~A4iV!fdJN6{hjyB+b2 zW-Qhg*ziHo1!6#M_MD{GHljR^$mXa=6b+U)J! zRIKV1t9tYBBJ{?c+9?U-VhywuFGEgGuM5h>e&pr&4%B|4GC`+I+>L&|#2e7!B_Hlj z52y-N9SAL#1o6P)FJpVwDrp7 zVL{|#6=Nj6XS6Z1bFZwIl7pqp<@H=Su z*Pm6aAQ$TaK~bzC>KD7eSw$_@N;vUpsQ!x%=3oAa@1p-1QJnuwF20_ZS@kwQ5bI;( z#&c2Yg~-Vp$iQns>Rv@5AH=-epBb_6)x65tMF>nURE+k{fO1iar`WD zj<8bq^rb-;+G7*V4^hjg*j-+7v1S&6k3hESjAY#}*8TCg6XhhGT%{Ef>j5cvI+`># z+tHs~?0dE2%h9WQi|s?mms`FDhgpYvQS8UX?pPYc+T$v`2DSek>(;bh7zU4a4%`%|QzO>j2bLWON81LRTdg;mSf?Nse;TzW zyji5LmRQFx9#2Lwn|cimh>9_7y2k*MYz6xVhz;r7iw7L t#a;=)edeTR&7TuBawPf8*Iv#@pFMX$8lSdGYgj-~hdX|itE1{V{0C8ZXZZjC diff --git a/eggs/misc/ssh.config b/eggs/misc/ssh.config index 5483b4b4..847a3711 100644 --- a/eggs/misc/ssh.config +++ b/eggs/misc/ssh.config @@ -1,4 +1,4 @@ -Host 78.46.239.229 168.119.171.217 78.47.196.196 5.75.139.112 mail.bak-it.de web.bak-it.de forum.linksjugend-solid.de backuppc.bak-it.de login.bak-it.de stuff.bak-it.de +Host 78.46.239.229 168.119.171.217 78.47.196.196 5.75.139.112 mail.bak-it.de web.bak-it.de cloud.linksjugend-solid.de forum.linksjugend-solid.de backuppc.bak-it.de login.bak-it.de login.linksjugend-solid.de stuff.bak-it.de User root IdentityFile ~/.ssh/solidProd diff --git a/eggs/thunar/thunar/accels.scm b/eggs/thunar/thunar/accels.scm index 62ad89d6..32025e73 100644 --- a/eggs/thunar/thunar/accels.scm +++ b/eggs/thunar/thunar/accels.scm @@ -1,4 +1,4 @@ -; Thunar GtkAccelMap rc-file -*- scheme -*- +; thunar GtkAccelMap rc-file -*- scheme -*- ; this file is an automated accelerator map dump ; ; (gtk_accel_path "/ThunarDetailsView/expandable-folders" "") diff --git a/eggs/thunar/xfce/xfconf/xfce-perchannel-xml/thunar.xml b/eggs/thunar/xfce/xfconf/xfce-perchannel-xml/thunar.xml index 4a35d116..ba956d22 100644 --- a/eggs/thunar/xfce/xfconf/xfce-perchannel-xml/thunar.xml +++ b/eggs/thunar/xfce/xfconf/xfce-perchannel-xml/thunar.xml @@ -6,7 +6,7 @@ - + @@ -32,7 +32,7 @@ - + diff --git a/eggs/zed/settings.json b/eggs/zed/settings.json index 8583faf2..5827b7de 100644 --- a/eggs/zed/settings.json +++ b/eggs/zed/settings.json @@ -190,7 +190,7 @@ "debugger": { "dock": "bottom", }, - "disable_ai": false, + "disable_ai": true, "terminal": { "toolbar": { "breadcrumbs": false, diff --git a/root-conf/nixos/nixLap/configuration.nix b/root-conf/nixos/nixLap/configuration.nix index 2542b4ff..960dd42c 100644 --- a/root-conf/nixos/nixLap/configuration.nix +++ b/root-conf/nixos/nixLap/configuration.nix @@ -24,26 +24,6 @@ in networking.hostName = "nixLap"; - powerManagement.enable = true; - services.power-profiles-daemon.enable = true; - # Suspend first then hibernate when closing the lid - services.logind.settings.Login.lidSwitch = "suspend-then-hibernate"; - # Hibernate on power button pressed - services.logind.settings.Login.powerKey = "hibernate"; - services.logind.settings.Login.powerKeyLongPress = "poweroff"; - - # Hibernation - boot.resumeDevice = "/dev/disk/by-label/swap"; - # resume offset from: filefrag -v /swapfile # under 0. physical offset - boot.kernelParams = ["mem_sleep_default=freeze" "resume_offset=0" ]; - - - # Define time delay for hibernation - systemd.sleep.settings.Sleep = { - HibernateDelaySec = "30m"; - SuspendState = "mem"; - }; - # Start the driver at boot systemd.services.fprintd = { wantedBy = [ "multi-user.target" ]; @@ -144,6 +124,7 @@ in users.groups.wireshark = {}; users.users.someone = { isNormalUser = true; + uid = 1000; description = "someone"; extraGroups = [ "networkmanager" "wheel" "libvirtd" "wireshark"]; packages = with pkgs; []; diff --git a/root-conf/nixos/nixMain/configuration.nix b/root-conf/nixos/nixMain/configuration.nix index d4deb663..88479229 100644 --- a/root-conf/nixos/nixMain/configuration.nix +++ b/root-conf/nixos/nixMain/configuration.nix @@ -1,7 +1,3 @@ - -# Edit this configuration file to define what should be installed on your system. Help is available in the configuration.nix(5) man page and in the NixOS manual -# (accessible by running ‘nixos-help’). - { config, pkgs, pkgs-unstable, ... }: let optionalPkgs = import ../optional-packages.nix { inherit pkgs; }; @@ -18,9 +14,6 @@ in services.flatpak.enable = true; - - # Hybrantion - boot.resumeDevice = "/dev/disk/by-uuid/1942318f-792a-4c0c-9b42-6e146d835bd7"; # Bootloader. boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; @@ -44,15 +37,6 @@ in SUBSYSTEM=="gpio", KERNEL=="gpiochip*", GROUP="gpio", MODE="0660" ''; - services.logind.settings.Login.powerKey = "ignore"; - services.logind.settings.Login.powerKeyLongPress = "ignore"; - services.logind.settings.Login.rebootKey = "ignore"; - - systemd.sleep.settings.Sleep = { - SuspendState = "freeze"; - }; - - # Enable openrgb services.hardware.openrgb.enable = true; @@ -100,6 +84,7 @@ in users.groups.gpio = {}; users.groups.wireshark = {}; users.users.someone = { + uid = 1000; isNormalUser = true; description = "someone"; extraGroups = [ "wheel" "docker" "libvirtd" "gpio" "wireshark" "adbusers" ]; @@ -115,12 +100,19 @@ in shell = pkgs.bash; }; - # Use lemurs as display manager - services.displayManager.ly = { - enable = true; - settings = { - tty = 1; + # Use ly as display manager + services.displayManager = { + ly = { + enable = true; + settings = { + tty = 1; + }; }; + autoLogin = { + enable = true; + user = "someone"; + }; + defaultSession = "hyprland"; }; # Docker @@ -168,6 +160,7 @@ in bind # dig, nslookup # Hyprland stuff + uwsm # might not be needet, test login without kitty dunst waybar diff --git a/root-conf/nixos/nixMain/hardware-configuration.nix b/root-conf/nixos/nixMain/hardware-configuration.nix index 7ac5e834..45109999 100644 --- a/root-conf/nixos/nixMain/hardware-configuration.nix +++ b/root-conf/nixos/nixMain/hardware-configuration.nix @@ -1,7 +1,7 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, nixpkgs, modulesPath, ... }: +{ config, lib, pkgs, modulesPath, ... }: { imports = @@ -14,28 +14,26 @@ boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/4b53ce3e-72b3-4ea4-8656-e90b48da3b65"; + { device = "/dev/mapper/cryptroot"; fsType = "btrfs"; - options = [ "subvol=@" ]; }; + boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/52e65cdf-08a0-45af-87f2-d83d6a5c2321"; + fileSystems."/boot" = - { device = "/dev/disk/by-uuid/9810-0A10"; + { device = "/dev/disk/by-uuid/08D8-2E5B"; fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; + options = [ "fmask=0022" "dmask=0022" ]; }; - swapDevices = - [ { device = "/dev/disk/by-uuid/1942318f-792a-4c0c-9b42-6e146d835bd7"; } - ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true; - # networking.interfaces.wlp5s0.useDHCP = lib.mkDefault true; + swapDevices = [{ + device = "/dev/disk/by-label/swap"; + encrypted = { + enable = true; + label = "swap"; + blkDev = "/dev/disk/by-label/cryptoswap"; + }; + }]; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; diff --git a/root-conf/nixos/shared-conf.nix b/root-conf/nixos/shared-conf.nix index 4953578b..27180f6b 100644 --- a/root-conf/nixos/shared-conf.nix +++ b/root-conf/nixos/shared-conf.nix @@ -36,6 +36,26 @@ networkmanager.enable = true; }; + powerManagement.enable = true; + services.power-profiles-daemon.enable = true; + # Suspend first then hibernate when closing the lid + services.logind.settings.Login.lidSwitch = "suspend-then-hibernate"; + # Hibernate on power button pressed + services.logind.settings.Login.powerKey = "hibernate"; + services.logind.settings.Login.powerKeyLongPress = "poweroff"; + + # Hibernation + boot.resumeDevice = "/dev/disk/by-label/swap"; + # resume offset from: filefrag -v /swapfile # under 0. physical offset + boot.kernelParams = ["mem_sleep_default=freeze" "resume_offset=0" ]; + + + # Define time delay for hibernation + systemd.sleep.settings.Sleep = { + HibernateDelaySec = "30m"; + SuspendState = "mem"; + }; + programs.wireshark = { enable = true; usbmon.enable = true; # Allow USB monitoring diff --git a/use_nix.sh b/use_nix.sh index 956b333a..24e1fea2 100644 --- a/use_nix.sh +++ b/use_nix.sh @@ -95,8 +95,6 @@ if [[ $UPGRADE -eq 1 ]]; then fi ARGS+="--flake /etc/nixos" -echo $ARGS - echo "Running: nixos-rebuild $ARGS" nixos-rebuild $ARGS cp /etc/nixos/flake.lock root-conf/nixos/flake.lock