From ab6488028120e5863fc2f759c0c0197636f440cf Mon Sep 17 00:00:00 2001 From: NeilClack Date: Sun, 2 Aug 2026 00:56:34 -0500 Subject: [PATCH] Organize flakes and cleanup things. Update SSH keys Remove ISO 'VM' configuration --- configuration.nix | 207 +++++++++++++++++++++------------------------- flake.nix | 24 +++--- iso-config.nix | 66 ++++++++------- 3 files changed, 144 insertions(+), 153 deletions(-) diff --git a/configuration.nix b/configuration.nix index cfc3a56..ae61768 100644 --- a/configuration.nix +++ b/configuration.nix @@ -1,14 +1,18 @@ -{ pkgs, radiantwave, upgradeFlakeRef, ... }: +{ pkgs, radiantwave, upgradeFlakeRef, ... }: let radiantApp = radiantwave.packages.${pkgs.system}.default; - myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" ]; + myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ]; in { + ############################################################ + # System configuration + ############################################################ + # Included packages - environment.systemPackages = [ + environment.systemPackages = [ pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite - radiantApp + radiantApp ]; # This populates the EFI partition and tells the NUC how to start NixOS. @@ -16,15 +20,15 @@ in boot.loader.efi.canTouchEfiVariables = true; # Hardware-specific: NUC 14 needs these for the NVMe and Graphics - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ]; + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ]; boot.kernelParams = [ "quiet" "splash" ]; - # --- Essential Services --- - services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; }; - services.seatd.enable = true; - services.openssh.enable = true; - services.openssh.settings.PermitRootLogin = "prohibit-password"; hardware.graphics.enable = true; + + time.timeZone = "America/Chicago"; + + networking.networkmanager.enable = true; + system.autoUpgrade = { enable = true; flake = upgradeFlakeRef; @@ -32,15 +36,40 @@ in flags = [ "--refresh" "-L" ]; operation = "switch"; }; - time.timeZone = "America/Chicago"; - # Networking Network-Manager - services.resolved.enable = false; - networking.networkmanager.enable = true; - systemd.services.NetworkManager-wait-online.enable = false; - systemd.network.wait-online.enable = false; + system.activationScripts.cleanRadiantFiles = '' + rm -rf /home/kiosk/.local/share/radiantwave/audio + ''; + + # Virtual machine declaration + virtualisation.vmVariant = { + boot.loader.systemd-boot.enable = pkgs.lib.mkForce false; + boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false; + virtualisation.forwardPorts = [ + { from = "host"; host.port = 2222; guest.port = 22; } + ]; + virtualisation.qemu.options = [ + "-device intel-hda" + "-device hda-duplex" + "-vga virtio" + ]; + virtualisation = { + cores = 8; + memorySize = 8192; + }; + services.logrotate.enable = false; + }; + virtualisation.diskSize = 10485760; + + # NixOS settings. + nix.settings.experimental-features = [ "nix-command" "flakes" ]; + nix.settings.accept-flake-config = true; + system.stateVersion = "24.05"; + + ############################################################ + # User configuration + ############################################################ - # --- Users & SSH Keys --- users.users.root.openssh.authorizedKeys.keys = myKey; users.users.kiosk = { isNormalUser = true; @@ -49,17 +78,57 @@ in openssh.authorizedKeys.keys = myKey; password = "Fuckp@ssw0rds"; }; + services.getty.autologinUser = "kiosk"; - # --- Set ownership of Radiantwave files --- + # --- The Kiosk Startup Script --- + environment.loginShellInit = '' + if [ "$(tty)" = "/dev/tty1" ]; then + export GODEBUG=netdns=cgo + export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt + + # Smart Network Wait + for i in {1..10}; do + if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then + break + fi + sleep 1 + done + + # Graphics fixes + export SDL_VIDEODRIVER=wayland + export QT_QPA_PLATFORM=wayland + export XDG_SESSION_TYPE=wayland + export WLR_RENDERER=pixman + export WLR_NO_HARDWARE_CURSORS=1 + + # Asset sync + start app + mkdir -p /home/kiosk/.local/share/radiantwave + ${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/ + + exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1 + fi + ''; + + ############################################################ + # Service configuration + ############################################################ + + services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; }; + services.seatd.enable = true; + services.openssh.enable = true; + services.openssh.settings.PermitRootLogin = "prohibit-password"; + + # Networking Network-Manager + services.resolved.enable = false; + systemd.services.NetworkManager-wait-online.enable = false; + systemd.network.wait-online.enable = false; + + # --- Set ownership of Radiantwave files --- systemd.tmpfiles.rules = [ "d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -" ]; - system.activationScripts.cleanRadiantFiles = '' - rm -rf /home/kiosk/.local/share/radiantwave/audio - ''; - # --- Backup service: runs before nixos-upgrade --- systemd.services.radiantwave-backup = { description = "Backup RadiantWave user data before upgrade"; @@ -107,96 +176,4 @@ in echo "Rollback completed at $(date)" ''; }; - - # --- 3. The Kiosk Startup Script --- - environment.loginShellInit = '' - if [ "$(tty)" = "/dev/tty1" ]; then - export GODEBUG=netdns=cgo - export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt - - # Smart Network Wait - for i in {1..10}; do - if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then - break - fi - sleep 1 - done - - # Graphics fixes - export SDL_VIDEODRIVER=wayland - export QT_QPA_PLATFORM=wayland - export XDG_SESSION_TYPE=wayland - export WLR_RENDERER=pixman - export WLR_NO_HARDWARE_CURSORS=1 - - # Asset sync + start app - mkdir -p /home/kiosk/.local/share/radiantwave - ${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/ - - exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1 - fi - ''; - - # # Tailscale Configuration - # systemd.tmpfiles.rules = [ - # "d /etc/tailscale 0700 root root -" - # "f /etc/tailscale/preauth-key 0600 root root - ${preAuthKey}" - # ]; - - # services.tailscale = { - # enable = true; - # authKeyFile = "/etc/tailscale/preauth-key"; - # openFirewall = true; - # authKeyParameters.preauthorized = true; - # extraUpFlags = [ - # "--login-server" headscaleUrl - # ]; - # }; - - # systemd.services.tailscale-set-hostname = { - # description = "Set Tailscale hostname based on the RadiantWave license key"; - # after = [ "tailscale-autoconnect.service" ]; - # wants = [ "tailscaled.service" ]; - # wantedBy = [ "multi-user.target" ]; - # serviceConfig = { - # Type = "oneshot"; - # RemainAfterExit = true; - # }; - # script = '' - # if [ -f "${licenseKeyFile}" ]; then - # KEY=$(cat "${licenseKeyFile}" | tr -d '[:space:]') - # if [ -n "$KEY" ]; then - # echo "Setting Tailscale hostname to: $KEY" - # ${pkgs.lib.getExe pkgs.tailscale} set --hostname="$KEY" - # exit 0 - # fi - # fi - # echo "No license key found, skipping hostname override" - # ''; - # }; - - # Virtual machine declaration - virtualisation.vmVariant = { - boot.loader.systemd-boot.enable = pkgs.lib.mkForce false; - boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false; - virtualisation.forwardPorts = [ - { from = "host"; host.port = 2222; guest.port = 22; } - ]; - virtualisation.qemu.options = [ - "-device intel-hda" - "-device hda-duplex" - "-vga virtio" - ]; - virtualisation = { - cores = 8; - memorySize = 8192; - }; - services.logrotate.enable = false; - }; - virtualisation.diskSize = 10485760; - - # NixOS settings. - nix.settings.experimental-features = [ "nix-command" "flakes" ]; - nix.settings.accept-flake-config = true; - system.stateVersion = "24.05"; -} +} \ No newline at end of file diff --git a/flake.nix b/flake.nix index 9b92c9e..7dcc7d4 100644 --- a/flake.nix +++ b/flake.nix @@ -62,13 +62,6 @@ ./configuration.nix radiantwave.nixosModules.default { - # system.autoUpgrade = { - # enable = enableAutoUpgrade; - # flake = upgradeFlakeRef; - # dates = "*:00/10"; - # allowReboot = true; - # flags = [ "--refresh" ]; - # }; boot.loader.systemd-boot.enable = nixpkgs.lib.mkForce false; boot.loader.efi.canTouchEfiVariables = nixpkgs.lib.mkForce false; boot.loader.raspberry-pi.bootloader = "kernel"; @@ -88,6 +81,7 @@ packages.x86_64-linux.radiantwavekiosk-dev = self.nixosConfigurations.radiantwavekiosk-dev.config.system.build.toplevel; packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel; packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel; + # Kiosk nixosConfigurations = { radiantwavekiosk = mkKioskSystem { system = "x86_64-linux"; @@ -96,6 +90,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk"; extraModules = []; }; + # Kiosk-dev radiantwavekiosk-dev = mkKioskSystem { system = "x86_64-linux"; radiantwave = radiantwave-dev; @@ -103,6 +98,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev"; extraModules = []; }; + # Commercial radiantwavekiosk-commercial = mkKioskSystem { system = "x86_64-linux"; radiantwave = radiantwave; @@ -110,6 +106,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-commercial"; extraModules = []; }; + # Commercial-dev radiantwavekiosk-commercial-dev = mkKioskSystem { system = "x86_64-linux"; radiantwave = radiantwave; @@ -117,6 +114,7 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial"; extraModules = []; }; + # Kiosk - rotated screen for android displays radiantwavekiosk-android = mkKioskSystem { system = "x86_64-linux"; radiantwave = radiantwave; @@ -124,15 +122,19 @@ upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-android"; extraModules = [./rotated_display.nix ]; }; + # Raspberry pi 5 radiantwavekiosk-rpi = mkRpiKioskSystem { radiantwave = radiantwave; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git#radiantwavekiosk-rpi"; }; + # Raspberry pi 5 dev radiantwavekiosk-rpi-dev = mkRpiKioskSystem { radiantwave = radiantwave-dev; upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev"; }; - usb-iso = nixpkgs.lib.nixosSystem { + # === USB Images === + # Kiosk USB + kiosk-iso = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; @@ -154,7 +156,8 @@ }) ]; }; - commercial-usb-iso = nixpkgs.lib.nixosSystem { + # Commercial iso + commercial-iso = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; @@ -176,7 +179,7 @@ }) ]; }; - + # kiosk rotated screen android-iso = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { @@ -199,6 +202,7 @@ }) ]; }; + # Kiosk iso development branch dev-iso = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { diff --git a/iso-config.nix b/iso-config.nix index 6ffa63b..cd65196 100644 --- a/iso-config.nix +++ b/iso-config.nix @@ -12,6 +12,10 @@ let self.nixosConfigurations.radiantwavekiosk.config.system.build.diskoScript; in { + ############################################################ + # System configuration + ############################################################ + nix.settings = { experimental-features = [ "nix-command" @@ -23,6 +27,8 @@ in ]; flake-registry = ""; + + connect-timeout = 0; }; nix.registry.nixpkgs = pkgs.lib.mkForce { @@ -32,19 +38,11 @@ in }; }; - environment.variables.KIOSK_FLAKE = "${self}"; + nix.extraOptions = '' + netrc-file = /etc/nix/netrc + ''; - virtualisation.vmVariant = { - virtualisation.memorySize = 8096; - virtualisation.diskSize = 100000; - virtualisation.cores = 4; - virtualisation.qemu.options = [ - # "-nic none" - ]; - virtualisation.forwardPorts = [ - { from = "host"; host.port = 2222; guest.port = 22; } - ]; - }; + environment.variables.KIOSK_FLAKE = "${self}"; environment.etc."nix/netrc" = { text = '' @@ -53,29 +51,33 @@ in mode = "0400"; }; - nix.extraOptions = '' - netrc-file = /etc/nix/netrc - ''; - networking.networkmanager.enable = true; - systemd.services.NetworkManager-wait-online.enable = false; + ############################################################ + # User configuration + ############################################################ - nix.settings.connect-timeout = 0; + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" + ]; + + ############################################################ + # Service configuration + ############################################################ services.openssh.enable = true; - users.users.root.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" - ]; + systemd.services.NetworkManager-wait-online.enable = false; systemd.services.zero-touch-install = { description = "Zero-Touch Kiosk Installation"; wantedBy = [ "multi-user.target" ]; - wants = [ ]; - after = [ "systemd-udev-settle.service" ]; + # Make sure we own tty1 exclusively - getty@tty1 will otherwise + # try to spawn a login prompt on the same console. + conflicts = [ "getty@tty1.service" ]; + after = [ "systemd-udev-settle.service" "getty@tty1.service" ]; path = with pkgs; [ nix @@ -95,8 +97,17 @@ in DISKO_SCRIPT = "${diskoScript}"; }; + serviceConfig = { + StandardInput = "tty"; + StandardOutput = "tty"; + StandardError = "tty"; + TTYPath = "/dev/tty1"; + TTYReset = true; + TTYVHangup = true; + TTYVTDisallocate = true; + }; -script = '' + script = '' set -euo pipefail echo "Running disko script..." @@ -114,10 +125,9 @@ script = '' echo "============================================" echo " Installation complete!" - echo " Rebooting in 5 seconds..." + echo " Please shut down and remove the flash drive before restarting" echo "============================================" - sleep 5 - systemctl reboot --force + sleep 10000000 ''; }; -} +} \ No newline at end of file