RadiantWaveTech/KioskConfig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Organize flakes and cleanup things.

Browse Source 
Update SSH keys
Remove ISO 'VM' configuration
This commit is contained in:
NeilClack
2026-08-02 00:56:34 -05:00
parent 0d5f2914d2
commit ab64880281
3 changed files with 144 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configuration.nix
+92 -115
View File
@@ -1,14 +1,18 @@
{ pkgs, radiantwave, upgradeFlakeRef, ... }:
{ pkgs, radiantwave, upgradeFlakeRef, ... }:
let
radiantApp = radiantwave.packages.${pkgs.system}.default;
myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" ];
myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ];
in
{
############################################################
# System configuration
############################################################
# Included packages
environment.systemPackages = [
environment.systemPackages = [
pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
radiantApp
radiantApp
];
# This populates the EFI partition and tells the NUC how to start NixOS.
@@ -16,15 +20,15 @@ in
boot.loader.efi.canTouchEfiVariables = true;
# Hardware-specific: NUC 14 needs these for the NVMe and Graphics
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
boot.kernelParams = [ "quiet" "splash" ];
# --- Essential Services ---
services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
services.seatd.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
hardware.graphics.enable = true;
time.timeZone = "America/Chicago";
networking.networkmanager.enable = true;
system.autoUpgrade = {
enable = true;
flake = upgradeFlakeRef;
@@ -32,15 +36,40 @@ in
flags = [ "--refresh" "-L" ];
operation = "switch";
};
time.timeZone = "America/Chicago";
# Networking Network-Manager
services.resolved.enable = false;
networking.networkmanager.enable = true;
systemd.services.NetworkManager-wait-online.enable = false;
systemd.network.wait-online.enable = false;
system.activationScripts.cleanRadiantFiles = ''
rm -rf /home/kiosk/.local/share/radiantwave/audio
'';
# Virtual machine declaration
virtualisation.vmVariant = {
boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
virtualisation.forwardPorts = [
{ from = "host"; host.port = 2222; guest.port = 22; }
];
virtualisation.qemu.options = [
"-device intel-hda"
"-device hda-duplex"
"-vga virtio"
];
virtualisation = {
cores = 8;
memorySize = 8192;
};
services.logrotate.enable = false;
};
virtualisation.diskSize = 10485760;
# NixOS settings.
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.accept-flake-config = true;
system.stateVersion = "24.05";
############################################################
# User configuration
############################################################
# --- Users & SSH Keys ---
users.users.root.openssh.authorizedKeys.keys = myKey;
users.users.kiosk = {
isNormalUser = true;
@@ -49,17 +78,57 @@ in
openssh.authorizedKeys.keys = myKey;
password = "Fuckp@ssw0rds";
};
services.getty.autologinUser = "kiosk";
# --- Set ownership of Radiantwave files ---
# --- The Kiosk Startup Script ---
environment.loginShellInit = ''
if [ "$(tty)" = "/dev/tty1" ]; then
export GODEBUG=netdns=cgo
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
# Smart Network Wait
for i in {1..10}; do
if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
break
fi
sleep 1
done
# Graphics fixes
export SDL_VIDEODRIVER=wayland
export QT_QPA_PLATFORM=wayland
export XDG_SESSION_TYPE=wayland
export WLR_RENDERER=pixman
export WLR_NO_HARDWARE_CURSORS=1
# Asset sync + start app
mkdir -p /home/kiosk/.local/share/radiantwave
${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/
exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
fi
'';
############################################################
# Service configuration
############################################################
services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
services.seatd.enable = true;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
# Networking Network-Manager
services.resolved.enable = false;
systemd.services.NetworkManager-wait-online.enable = false;
systemd.network.wait-online.enable = false;
# --- Set ownership of Radiantwave files ---
systemd.tmpfiles.rules = [
"d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -"
];
system.activationScripts.cleanRadiantFiles = ''
rm -rf /home/kiosk/.local/share/radiantwave/audio
'';
# --- Backup service: runs before nixos-upgrade ---
systemd.services.radiantwave-backup = {
description = "Backup RadiantWave user data before upgrade";
@@ -107,96 +176,4 @@ in
echo "Rollback completed at $(date)"
'';
};
# --- 3. The Kiosk Startup Script ---
environment.loginShellInit = ''
if [ "$(tty)" = "/dev/tty1" ]; then
export GODEBUG=netdns=cgo
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
# Smart Network Wait
for i in {1..10}; do
if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
break
fi
sleep 1
done
# Graphics fixes
export SDL_VIDEODRIVER=wayland
export QT_QPA_PLATFORM=wayland
export XDG_SESSION_TYPE=wayland
export WLR_RENDERER=pixman
export WLR_NO_HARDWARE_CURSORS=1
# Asset sync + start app
mkdir -p /home/kiosk/.local/share/radiantwave
${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/
exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
fi
'';
# # Tailscale Configuration
# systemd.tmpfiles.rules = [
# "d /etc/tailscale 0700 root root -"
# "f /etc/tailscale/preauth-key 0600 root root - ${preAuthKey}"
# ];
# services.tailscale = {
# enable = true;
# authKeyFile = "/etc/tailscale/preauth-key";
# openFirewall = true;
# authKeyParameters.preauthorized = true;
# extraUpFlags = [
# "--login-server" headscaleUrl
# ];
# };
# systemd.services.tailscale-set-hostname = {
# description = "Set Tailscale hostname based on the RadiantWave license key";
# after = [ "tailscale-autoconnect.service" ];
# wants = [ "tailscaled.service" ];
# wantedBy = [ "multi-user.target" ];
# serviceConfig = {
# Type = "oneshot";
# RemainAfterExit = true;
# };
# script = ''
# if [ -f "${licenseKeyFile}" ]; then
# KEY=$(cat "${licenseKeyFile}" | tr -d '[:space:]')
# if [ -n "$KEY" ]; then
# echo "Setting Tailscale hostname to: $KEY"
# ${pkgs.lib.getExe pkgs.tailscale} set --hostname="$KEY"
# exit 0
# fi
# fi
# echo "No license key found, skipping hostname override"
# '';
# };
# Virtual machine declaration
virtualisation.vmVariant = {
boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
virtualisation.forwardPorts = [
{ from = "host"; host.port = 2222; guest.port = 22; }
];
virtualisation.qemu.options = [
"-device intel-hda"
"-device hda-duplex"
"-vga virtio"
];
virtualisation = {
cores = 8;
memorySize = 8192;
};
services.logrotate.enable = false;
};
virtualisation.diskSize = 10485760;
# NixOS settings.
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.accept-flake-config = true;
system.stateVersion = "24.05";
}
}