finn.markwitz
a00916864c
Proves the sops-nix pipeline end to end on mibook: encrypts a throwaway secret to the operator + mibook host keys, declares it in machines/mibook/secrets.nix, and verifies it decrypts to /run/secrets/placeholder (root:root, 0400) on nixos-rebuild switch. Also removes the dead `let secrets = config.sops.secrets;` binding from both environments.nix files — leftover from an earlier abandoned plan, never referenced.
60 lines
1.1 KiB
Nix
60 lines
1.1 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
|
|
./disks.nix
|
|
./hardware-configuration.nix
|
|
./environments.nix
|
|
./network.nix
|
|
./secrets.nix
|
|
# ./system.nix use docker here
|
|
];
|
|
|
|
networking.hostName = "mibook";
|
|
boot.loader.grub = {
|
|
enable = true;
|
|
device = "/dev/nvme0n1";
|
|
useOSProber = true;
|
|
};
|
|
|
|
# Configure keymap in X11
|
|
services.xserver.xkb = {
|
|
layout = "de";
|
|
variant = "";
|
|
};
|
|
|
|
# Configure console keymap
|
|
console.keyMap = "de";
|
|
|
|
# Enable CUPS to print documents.
|
|
services.printing.enable = true;
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
hardware.nvidia.prime = {
|
|
sync.enable = false;
|
|
|
|
nvidiaBusId = "PCI:01:00:0";
|
|
intelBusId = "PCI:00:2:0";
|
|
};
|
|
|
|
services.openssh.enable = true;
|
|
|
|
# KDE (PowerDevil) power settings: do nothing on lid close while on AC power.
|
|
# Shipped as a system-wide default; KConfig cascades so a user's own
|
|
# ~/.config/powerdevilrc will override this if present.
|
|
environment.etc."xdg/powerdevilrc".text = ''
|
|
[AC][SuspendAndShutdown]
|
|
LidAction=0
|
|
'';
|
|
|
|
system = {
|
|
stateVersion = "23.05";
|
|
autoUpgrade.enable = true;
|
|
};
|
|
}
|