Secure boot and wsl #10
8 changed files with 28 additions and 42 deletions
|
|
@ -13,13 +13,13 @@ in {
|
||||||
#(modulesPath + "/misc/nixpkgs/read-only.nix")
|
#(modulesPath + "/misc/nixpkgs/read-only.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
|
wsl.enable = config.conf.wsl;
|
||||||
|
|
||||||
# Bootloader.
|
# Bootloader.
|
||||||
boot = {
|
boot = lib.mkIf (!config.conf.wsl) {
|
||||||
consoleLogLevel = 0;
|
consoleLogLevel = 0;
|
||||||
|
|
||||||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
lanzaboote = lib.mkIf config.conf.secureBoot {
|
||||||
|
|
||||||
boot.lanzaboote = lib.mkIf config.conf.secureBoot {
|
|
||||||
enable = true;
|
enable = true;
|
||||||
pkiBundle = "/var/lib/sbctl";
|
pkiBundle = "/var/lib/sbctl";
|
||||||
};
|
};
|
||||||
|
|
@ -29,7 +29,7 @@ in {
|
||||||
enable =
|
enable =
|
||||||
if config.conf.secureBoot
|
if config.conf.secureBoot
|
||||||
then lib.mkForce false
|
then lib.mkForce false
|
||||||
else if config.conf.useSystemdBootloadertrue
|
else if config.conf.useSystemdBootloader
|
||||||
then true
|
then true
|
||||||
else false;
|
else false;
|
||||||
configurationLimit = 5;
|
configurationLimit = 5;
|
||||||
|
|
@ -74,7 +74,6 @@ in {
|
||||||
# Enable the X11 windowing system.
|
# Enable the X11 windowing system.
|
||||||
services = {
|
services = {
|
||||||
lorri.enable = true;
|
lorri.enable = true;
|
||||||
flatpak.enable = true;
|
|
||||||
xserver.enable = true;
|
xserver.enable = true;
|
||||||
fstrim.enable = lib.mkDefault true;
|
fstrim.enable = lib.mkDefault true;
|
||||||
# Enable sound with pipewire.
|
# Enable sound with pipewire.
|
||||||
|
|
|
||||||
|
|
@ -237,7 +237,6 @@ For package lists, please check the individual modules, as the lists can be long
|
||||||
- drives : A drive configuration module
|
- drives : A drive configuration module
|
||||||
- firefox: Enables and configures firefox (extensions and settings)
|
- firefox: Enables and configures firefox (extensions and settings)
|
||||||
- fish: Enables and configures fish shell
|
- fish: Enables and configures fish shell
|
||||||
- flatpak : Installs and enables declarative flatpak
|
|
||||||
- gaming : Configures gaming related features (launchers, gamemode)
|
- gaming : Configures gaming related features (launchers, gamemode)
|
||||||
- git : Git key and config module
|
- git : Git key and config module
|
||||||
- gnome_services : Gnome services for minimal enviroments -> Window managers etc
|
- gnome_services : Gnome services for minimal enviroments -> Window managers etc
|
||||||
|
|
|
||||||
|
|
@ -4,10 +4,11 @@
|
||||||
inputs = {
|
inputs = {
|
||||||
unstable.url = "github:NixOs/nixpkgs/nixos-unstable";
|
unstable.url = "github:NixOs/nixpkgs/nixos-unstable";
|
||||||
stable.url = "github:NixOs/nixpkgs/nixos-24.11";
|
stable.url = "github:NixOs/nixpkgs/nixos-24.11";
|
||||||
|
nixos-wsl.url = "github:nix-community/NixOS-WSL/main";
|
||||||
nur.url = "github:nix-community/NUR";
|
nur.url = "github:nix-community/NUR";
|
||||||
|
lanzaboote = {
|
||||||
nix-flatpak = {
|
url = "github:nix-community/lanzaboote/v0.4.2";
|
||||||
url = "github:gmodena/nix-flatpak";
|
inputs.nixpkgs.follows = "unstable";
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager = {
|
home-manager = {
|
||||||
|
|
|
||||||
|
|
@ -26,10 +26,10 @@ in {
|
||||||
|
|
||||||
keyboard = null;
|
keyboard = null;
|
||||||
|
|
||||||
file.".local/share/flatpak/overrides/global".text = ''
|
#file.".local/share/flatpak/overrides/global".text = lib.mkForce ''
|
||||||
[Context]
|
# [Context]
|
||||||
filesystems=xdg-config/gtk-3.0;xdg-config/gtk-4.0
|
# filesystems=xdg-config/gtk-3.0;xdg-config/gtk-4.0
|
||||||
'';
|
#'';
|
||||||
};
|
};
|
||||||
|
|
||||||
programs.nix-index = {
|
programs.nix-index = {
|
||||||
|
|
|
||||||
|
|
@ -43,6 +43,8 @@
|
||||||
},
|
},
|
||||||
mods ? {
|
mods ? {
|
||||||
nixos = [
|
nixos = [
|
||||||
|
inputs.lanzaboote.nixosModules.lanzaboote
|
||||||
|
inputs.nixos-wsl.nixosModules.default
|
||||||
inputs.home-manager.nixosModules.home-manager
|
inputs.home-manager.nixosModules.home-manager
|
||||||
inputs.stylix.nixosModules.stylix
|
inputs.stylix.nixosModules.stylix
|
||||||
inputs.disko.nixosModules.disko
|
inputs.disko.nixosModules.disko
|
||||||
|
|
@ -62,7 +64,6 @@
|
||||||
inputs.hyprdock.homeManagerModules.default
|
inputs.hyprdock.homeManagerModules.default
|
||||||
inputs.hyprland.homeManagerModules.default
|
inputs.hyprland.homeManagerModules.default
|
||||||
inputs.reset.homeManagerModules.default
|
inputs.reset.homeManagerModules.default
|
||||||
inputs.nix-flatpak.homeManagerModules.nix-flatpak
|
|
||||||
inputs.sops-nix.homeManagerModules.sops
|
inputs.sops-nix.homeManagerModules.sops
|
||||||
inputs.dashvim.homeManagerModules.dashvim
|
inputs.dashvim.homeManagerModules.dashvim
|
||||||
../modules
|
../modules
|
||||||
|
|
|
||||||
|
|
@ -20,6 +20,14 @@
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
wsl = lib.mkOption {
|
||||||
|
default = false;
|
||||||
|
example = true;
|
||||||
|
description = ''
|
||||||
|
Runs Nix in wsl
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
secureBoot = lib.mkOption {
|
secureBoot = lib.mkOption {
|
||||||
default = false;
|
default = false;
|
||||||
example = true;
|
example = true;
|
||||||
|
|
|
||||||
|
|
@ -149,7 +149,7 @@
|
||||||
|
|
||||||
config = (
|
config = (
|
||||||
lib.optionalAttrs (options ? fileSystems) {
|
lib.optionalAttrs (options ? fileSystems) {
|
||||||
fileSystems = lib.mkIf (config.mods.drives.variant == "manual") (
|
fileSystems = lib.mkIf (config.mods.drives.variant == "manual" && !config.conf.wsl) (
|
||||||
builtins.listToAttrs (
|
builtins.listToAttrs (
|
||||||
map (
|
map (
|
||||||
{
|
{
|
||||||
|
|
@ -196,7 +196,7 @@
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
|
|
||||||
swapDevices = lib.mkIf (config.mods.drives.useSwap && config.mods.drives.variant == "manual") [
|
swapDevices = lib.mkIf (config.mods.drives.useSwap && config.mods.drives.variant == "manual" && !config.conf.wsl) [
|
||||||
{device = "/dev/disk/by-label/SWAP";}
|
{device = "/dev/disk/by-label/SWAP";}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -7,37 +7,15 @@
|
||||||
}: {
|
}: {
|
||||||
options.mods.flatpak = {
|
options.mods.flatpak = {
|
||||||
enable = lib.mkOption {
|
enable = lib.mkOption {
|
||||||
default = true;
|
default = false;
|
||||||
example = false;
|
example = true;
|
||||||
type = lib.types.bool;
|
type = lib.types.bool;
|
||||||
description = "Enables the flatpak package manager";
|
description = "Enables the flatpak package manager";
|
||||||
};
|
};
|
||||||
additional_packages = lib.mkOption {
|
|
||||||
default = [];
|
|
||||||
example = [];
|
|
||||||
type = with lib.types; listOf str;
|
|
||||||
description = "Flatpak packages";
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
config = lib.mkIf config.mods.flatpak.enable (
|
config = lib.mkIf config.mods.flatpak.enable (
|
||||||
lib.optionalAttrs (options ? services.flatpak.remote) {
|
lib.optionalAttrs (options ? environment.systemPackages) {
|
||||||
environment.systemPackages = [pkgs.flatpak];
|
environment.systemPackages = [pkgs.flatpak];
|
||||||
services.flatpak.remotes = lib.mkOptionDefault [
|
|
||||||
{
|
|
||||||
name = "flathub-stable";
|
|
||||||
location = "https://dl.flathub.org/repo/flathub.flatpakrepo";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
services.flatpak.uninstallUnmanaged = true;
|
|
||||||
}
|
|
||||||
// lib.optionalAttrs (options ? services.flatpak.packages) {
|
|
||||||
services.flatpak.packages =
|
|
||||||
[
|
|
||||||
# fallback if necessary, but generally avoided as nix is superior :)
|
|
||||||
# default flatseal installation since flatpak permissions are totally not a broken idea
|
|
||||||
"com.github.tchx84.Flatseal"
|
|
||||||
]
|
|
||||||
++ config.mods.flatpak.additional_packages;
|
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue