RadiantWaveTech/KioskConfig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Organize flakes and cleanup things.

Browse Source 
Update SSH keys
Remove ISO 'VM' configuration
This commit is contained in:
NeilClack
2026-08-02 00:56:34 -05:00
parent 0d5f2914d2
commit ab64880281
3 changed files with 144 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configuration.nix
+92 -115
View File
@@ -1,14 +1,18 @@
{ pkgs, radiantwave, upgradeFlakeRef, ... }:
{ pkgs, radiantwave, upgradeFlakeRef, ... }:
let
radiantApp = radiantwave.packages.${pkgs.system}.default;
myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" ];
myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ];
in
{
############################################################
# System configuration
############################################################
# Included packages
environment.systemPackages = [
environment.systemPackages = [
pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
radiantApp
radiantApp
];
# This populates the EFI partition and tells the NUC how to start NixOS.
@@ -16,15 +20,15 @@ in
boot.loader.efi.canTouchEfiVariables = true;
# Hardware-specific: NUC 14 needs these for the NVMe and Graphics
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
boot.kernelParams = [ "quiet" "splash" ];
# --- Essential Services ---
services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
services.seatd.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
hardware.graphics.enable = true;
time.timeZone = "America/Chicago";
networking.networkmanager.enable = true;
system.autoUpgrade = {
enable = true;
flake = upgradeFlakeRef;
@@ -32,15 +36,40 @@ in
flags = [ "--refresh" "-L" ];
operation = "switch";
};
time.timeZone = "America/Chicago";
# Networking Network-Manager
services.resolved.enable = false;
networking.networkmanager.enable = true;
systemd.services.NetworkManager-wait-online.enable = false;
systemd.network.wait-online.enable = false;
system.activationScripts.cleanRadiantFiles = ''
rm -rf /home/kiosk/.local/share/radiantwave/audio
'';
# Virtual machine declaration
virtualisation.vmVariant = {
boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
virtualisation.forwardPorts = [
{ from = "host"; host.port = 2222; guest.port = 22; }
];
virtualisation.qemu.options = [
"-device intel-hda"
"-device hda-duplex"
"-vga virtio"
];
virtualisation = {
cores = 8;
memorySize = 8192;
};
services.logrotate.enable = false;
};
virtualisation.diskSize = 10485760;
# NixOS settings.
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.accept-flake-config = true;
system.stateVersion = "24.05";
############################################################
# User configuration
############################################################
# --- Users & SSH Keys ---
users.users.root.openssh.authorizedKeys.keys = myKey;
users.users.kiosk = {
isNormalUser = true;
@@ -49,17 +78,57 @@ in
openssh.authorizedKeys.keys = myKey;
password = "Fuckp@ssw0rds";
};
services.getty.autologinUser = "kiosk";
# --- Set ownership of Radiantwave files ---
# --- The Kiosk Startup Script ---
environment.loginShellInit = ''
if [ "$(tty)" = "/dev/tty1" ]; then
export GODEBUG=netdns=cgo
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
# Smart Network Wait
for i in {1..10}; do
if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
break
fi
sleep 1
done
# Graphics fixes
export SDL_VIDEODRIVER=wayland
export QT_QPA_PLATFORM=wayland
export XDG_SESSION_TYPE=wayland
export WLR_RENDERER=pixman
export WLR_NO_HARDWARE_CURSORS=1
# Asset sync + start app
mkdir -p /home/kiosk/.local/share/radiantwave
${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/
exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
fi
'';
############################################################
# Service configuration
############################################################
services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
services.seatd.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
# Networking Network-Manager
services.resolved.enable = false;
systemd.services.NetworkManager-wait-online.enable = false;
systemd.network.wait-online.enable = false;
# --- Set ownership of Radiantwave files ---
systemd.tmpfiles.rules = [
"d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -"
];
system.activationScripts.cleanRadiantFiles = ''
rm -rf /home/kiosk/.local/share/radiantwave/audio
'';
# --- Backup service: runs before nixos-upgrade ---
systemd.services.radiantwave-backup = {
description = "Backup RadiantWave user data before upgrade";
@@ -107,96 +176,4 @@ in
echo "Rollback completed at $(date)"
'';
};
# --- 3. The Kiosk Startup Script ---
environment.loginShellInit = ''
if [ "$(tty)" = "/dev/tty1" ]; then
export GODEBUG=netdns=cgo
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
# Smart Network Wait
for i in {1..10}; do
if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
break
fi
sleep 1
done
# Graphics fixes
export SDL_VIDEODRIVER=wayland
export QT_QPA_PLATFORM=wayland
export XDG_SESSION_TYPE=wayland
export WLR_RENDERER=pixman
export WLR_NO_HARDWARE_CURSORS=1
# Asset sync + start app
mkdir -p /home/kiosk/.local/share/radiantwave
${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/
exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
fi
'';
# # Tailscale Configuration
# systemd.tmpfiles.rules = [
# "d /etc/tailscale 0700 root root -"
# "f /etc/tailscale/preauth-key 0600 root root - ${preAuthKey}"
# ];
# services.tailscale = {
# enable = true;
# authKeyFile = "/etc/tailscale/preauth-key";
# openFirewall = true;
# authKeyParameters.preauthorized = true;
# extraUpFlags = [
# "--login-server" headscaleUrl
# ];
# };
# systemd.services.tailscale-set-hostname = {
# description = "Set Tailscale hostname based on the RadiantWave license key";
# after = [ "tailscale-autoconnect.service" ];
# wants = [ "tailscaled.service" ];
# wantedBy = [ "multi-user.target" ];
# serviceConfig = {
# Type = "oneshot";
# RemainAfterExit = true;
# };
# script = ''
# if [ -f "${licenseKeyFile}" ]; then
# KEY=$(cat "${licenseKeyFile}" | tr -d '[:space:]')
# if [ -n "$KEY" ]; then
# echo "Setting Tailscale hostname to: $KEY"
# ${pkgs.lib.getExe pkgs.tailscale} set --hostname="$KEY"
# exit 0
# fi
# fi
# echo "No license key found, skipping hostname override"
# '';
# };
# Virtual machine declaration
virtualisation.vmVariant = {
boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
virtualisation.forwardPorts = [
{ from = "host"; host.port = 2222; guest.port = 22; }
];
virtualisation.qemu.options = [
"-device intel-hda"
"-device hda-duplex"
"-vga virtio"
];
virtualisation = {
cores = 8;
memorySize = 8192;
};
services.logrotate.enable = false;
};
virtualisation.diskSize = 10485760;
# NixOS settings.
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.accept-flake-config = true;
system.stateVersion = "24.05";
}
}
flake.nix
+14 -10
View File
@@ -62,13 +62,6 @@
./configuration.nix
radiantwave.nixosModules.default
{
# system.autoUpgrade = {
# enable = enableAutoUpgrade;
# flake = upgradeFlakeRef;
# dates = "*:00/10";
# allowReboot = true;
# flags = [ "--refresh" ];
# };
boot.loader.systemd-boot.enable = nixpkgs.lib.mkForce false;
boot.loader.efi.canTouchEfiVariables = nixpkgs.lib.mkForce false;
boot.loader.raspberry-pi.bootloader = "kernel";
@@ -88,6 +81,7 @@
packages.x86_64-linux.radiantwavekiosk-dev = self.nixosConfigurations.radiantwavekiosk-dev.config.system.build.toplevel;
packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
# Kiosk
nixosConfigurations = {
radiantwavekiosk = mkKioskSystem {
system = "x86_64-linux";
@@ -96,6 +90,7 @@
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk";
extraModules = [];
};
# Kiosk-dev
radiantwavekiosk-dev = mkKioskSystem {
system = "x86_64-linux";
radiantwave = radiantwave-dev;
@@ -103,6 +98,7 @@
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev";
extraModules = [];
};
# Commercial
radiantwavekiosk-commercial = mkKioskSystem {
system = "x86_64-linux";
radiantwave = radiantwave;
@@ -110,6 +106,7 @@
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-commercial";
extraModules = [];
};
# Commercial-dev
radiantwavekiosk-commercial-dev = mkKioskSystem {
system = "x86_64-linux";
radiantwave = radiantwave;
@@ -117,6 +114,7 @@
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial";
extraModules = [];
};
# Kiosk - rotated screen for android displays
radiantwavekiosk-android = mkKioskSystem {
system = "x86_64-linux";
radiantwave = radiantwave;
@@ -124,15 +122,19 @@
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-android";
extraModules = [./rotated_display.nix ];
};
# Raspberry pi 5
radiantwavekiosk-rpi = mkRpiKioskSystem {
radiantwave = radiantwave;
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-rpi";
};
# Raspberry pi 5 dev
radiantwavekiosk-rpi-dev = mkRpiKioskSystem {
radiantwave = radiantwave-dev;
upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev";
};
usb-iso = nixpkgs.lib.nixosSystem {
# === USB Images ===
# Kiosk USB
kiosk-iso = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
inherit inputs;
@@ -154,7 +156,8 @@
})
];
};
commercial-usb-iso = nixpkgs.lib.nixosSystem {
# Commercial iso
commercial-iso = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
inherit inputs;
@@ -176,7 +179,7 @@
})
];
};
# kiosk rotated screen
android-iso = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
@@ -199,6 +202,7 @@
})
];
};
# Kiosk iso development branch
dev-iso = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
iso-config.nix
+38 -28
View File
@@ -12,6 +12,10 @@ let
self.nixosConfigurations.radiantwavekiosk.config.system.build.diskoScript;
in
{
############################################################
# System configuration
############################################################
nix.settings = {
experimental-features = [
"nix-command"
@@ -23,6 +27,8 @@ in
];
flake-registry = "";
connect-timeout = 0;
};
nix.registry.nixpkgs = pkgs.lib.mkForce {
@@ -32,19 +38,11 @@ in
};
};
environment.variables.KIOSK_FLAKE = "${self}";
nix.extraOptions = ''
netrc-file = /etc/nix/netrc
'';
virtualisation.vmVariant = {
virtualisation.memorySize = 8096;
virtualisation.diskSize = 100000;
virtualisation.cores = 4;
virtualisation.qemu.options = [
# "-nic none"
];
virtualisation.forwardPorts = [
{ from = "host"; host.port = 2222; guest.port = 22; }
];
};
environment.variables.KIOSK_FLAKE = "${self}";
environment.etc."nix/netrc" = {
text = ''
@@ -53,29 +51,33 @@ in
mode = "0400";
};
nix.extraOptions = ''
netrc-file = /etc/nix/netrc
'';
networking.networkmanager.enable = true;
systemd.services.NetworkManager-wait-online.enable = false;
############################################################
# User configuration
############################################################
nix.settings.connect-timeout = 0;
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook"
];
############################################################
# Service configuration
############################################################
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad"
];
systemd.services.NetworkManager-wait-online.enable = false;
systemd.services.zero-touch-install = {
description = "Zero-Touch Kiosk Installation";
wantedBy = [ "multi-user.target" ];
wants = [ ];
after = [ "systemd-udev-settle.service" ];
# Make sure we own tty1 exclusively - getty@tty1 will otherwise
# try to spawn a login prompt on the same console.
conflicts = [ "getty@tty1.service" ];
after = [ "systemd-udev-settle.service" "getty@tty1.service" ];
path = with pkgs; [
nix
@@ -95,8 +97,17 @@ in
DISKO_SCRIPT = "${diskoScript}";
};
serviceConfig = {
StandardInput = "tty";
StandardOutput = "tty";
StandardError = "tty";
TTYPath = "/dev/tty1";
TTYReset = true;
TTYVHangup = true;
TTYVTDisallocate = true;
};
script = ''
script = ''
set -euo pipefail
echo "Running disko script..."
@@ -114,10 +125,9 @@ script = ''
echo "============================================"
echo " Installation complete!"
echo " Rebooting in 5 seconds..."
echo " Please shut down and remove the flash drive before restarting"
echo "============================================"
sleep 5
systemctl reboot --force
sleep 10000000
'';
};
}
}