init new repo
This commit is contained in:
NeilClack
@@ -0,0 +1,202 @@
|
||||
{ pkgs, rhemawave, upgradeFlakeRef, ... }:
|
||||
|
||||
let
|
||||
rhemaApp = rhemawave.packages.${pkgs.system}.default;
|
||||
myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" ];
|
||||
in
|
||||
{
|
||||
# Included packages
|
||||
environment.systemPackages = [
|
||||
pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
|
||||
rhemaApp
|
||||
];
|
||||
|
||||
# This populates the EFI partition and tells the NUC how to start NixOS.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Hardware-specific: NUC 14 needs these for the NVMe and Graphics
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
|
||||
boot.kernelParams = [ "quiet" "splash" ];
|
||||
|
||||
# --- Essential Services ---
|
||||
services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
|
||||
services.seatd.enable = true;
|
||||
services.openssh.enable = true;
|
||||
services.openssh.settings.PermitRootLogin = "prohibit-password";
|
||||
hardware.graphics.enable = true;
|
||||
system.autoUpgrade = {
|
||||
enable = true;
|
||||
flake = upgradeFlakeRef;
|
||||
dates = "*:00/10";
|
||||
flags = [ "--refresh" "-L" ];
|
||||
operation = "switch";
|
||||
};
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
# Networking Network-Manager
|
||||
services.resolved.enable = false;
|
||||
networking.networkmanager.enable = true;
|
||||
systemd.services.NetworkManager-wait-online.enable = false;
|
||||
systemd.network.wait-online.enable = false;
|
||||
|
||||
# --- Users & SSH Keys ---
|
||||
users.users.root.openssh.authorizedKeys.keys = myKey;
|
||||
users.users.kiosk = {
|
||||
isNormalUser = true;
|
||||
uid = 1000;
|
||||
extraGroups = ["audio" "video" "input" "networkmanager" "wheel"];
|
||||
openssh.authorizedKeys.keys = myKey;
|
||||
password = "Fuckp@ssw0rds";
|
||||
};
|
||||
services.getty.autologinUser = "kiosk";
|
||||
|
||||
# --- Set ownership of Radiantwave files ---
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /home/kiosk/.local/share/rhemawave 0770 kiosk kiosk -"
|
||||
];
|
||||
|
||||
system.activationScripts.cleanRadiantFiles = ''
|
||||
rm -rf /home/kiosk/.local/share/rhemawave/audio
|
||||
'';
|
||||
|
||||
# --- Backup service: runs before nixos-upgrade ---
|
||||
systemd.services.rhemawave-backup = {
|
||||
description = "Backup RadiantWave user data before upgrade";
|
||||
before = [ "nixos-upgrade.service" ];
|
||||
wantedBy = [ "nixos-upgrade.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "kiosk";
|
||||
};
|
||||
script = ''
|
||||
BACKUP_DIR="/home/kiosk/.local/share/rhemawave-backup"
|
||||
SOURCE_DIR="/home/kiosk/.local/share/rhemawave"
|
||||
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
|
||||
${pkgs.rsync}/bin/rsync -a \
|
||||
--exclude='audio/' \
|
||||
"$SOURCE_DIR/" "$BACKUP_DIR/"
|
||||
|
||||
echo "Backup completed at $(date)" > "$BACKUP_DIR/.backup-timestamp"
|
||||
'';
|
||||
};
|
||||
|
||||
# --- Health check service: runs after nixos-upgrade ---
|
||||
systemd.services.rhemawave-healthcheck = {
|
||||
description = "Verify RadiantWave is running after upgrade, rollback if not";
|
||||
after = [ "nixos-upgrade.service" ];
|
||||
wantedBy = [ "nixos-upgrade.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
# Give cage time to start rhemawave after the switch
|
||||
ExecStartPre = "${pkgs.coreutils}/bin/sleep 90";
|
||||
};
|
||||
script = ''
|
||||
if ${pkgs.procps}/bin/pgrep -x rhemawave > /dev/null; then
|
||||
echo "RadiantWave is running, upgrade successful"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "RadiantWave not found after upgrade, rolling back..."
|
||||
|
||||
# Roll back to previous NixOS generation
|
||||
/run/current-system/sw/bin/nixos-rebuild switch --rollback
|
||||
|
||||
echo "Rollback completed at $(date)"
|
||||
'';
|
||||
};
|
||||
|
||||
# --- 3. The Kiosk Startup Script ---
|
||||
environment.loginShellInit = ''
|
||||
if [ "$(tty)" = "/dev/tty1" ]; then
|
||||
export GODEBUG=netdns=cgo
|
||||
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
# Smart Network Wait
|
||||
for i in {1..10}; do
|
||||
if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Graphics fixes
|
||||
export SDL_VIDEODRIVER=wayland
|
||||
export QT_QPA_PLATFORM=wayland
|
||||
export XDG_SESSION_TYPE=wayland
|
||||
export WLR_RENDERER=pixman
|
||||
export WLR_NO_HARDWARE_CURSORS=1
|
||||
|
||||
# Asset sync + start app
|
||||
mkdir -p /home/kiosk/.local/share/rhemawave
|
||||
${pkgs.rsync}/bin/rsync -ru ${rhemaApp}/share/rhemawave/ /home/kiosk/.local/share/rhemawave/
|
||||
|
||||
exec dbus-run-session cage -- ${rhemaApp}/bin/rhemawave -d -s > /tmp/kiosk.log 2>&1
|
||||
fi
|
||||
'';
|
||||
|
||||
# # Tailscale Configuration
|
||||
# systemd.tmpfiles.rules = [
|
||||
# "d /etc/tailscale 0700 root root -"
|
||||
# "f /etc/tailscale/preauth-key 0600 root root - ${preAuthKey}"
|
||||
# ];
|
||||
|
||||
# services.tailscale = {
|
||||
# enable = true;
|
||||
# authKeyFile = "/etc/tailscale/preauth-key";
|
||||
# openFirewall = true;
|
||||
# authKeyParameters.preauthorized = true;
|
||||
# extraUpFlags = [
|
||||
# "--login-server" headscaleUrl
|
||||
# ];
|
||||
# };
|
||||
|
||||
# systemd.services.tailscale-set-hostname = {
|
||||
# description = "Set Tailscale hostname based on the RhemaWave license key";
|
||||
# after = [ "tailscale-autoconnect.service" ];
|
||||
# wants = [ "tailscaled.service" ];
|
||||
# wantedBy = [ "multi-user.target" ];
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# RemainAfterExit = true;
|
||||
# };
|
||||
# script = ''
|
||||
# if [ -f "${licenseKeyFile}" ]; then
|
||||
# KEY=$(cat "${licenseKeyFile}" | tr -d '[:space:]')
|
||||
# if [ -n "$KEY" ]; then
|
||||
# echo "Setting Tailscale hostname to: $KEY"
|
||||
# ${pkgs.lib.getExe pkgs.tailscale} set --hostname="$KEY"
|
||||
# exit 0
|
||||
# fi
|
||||
# fi
|
||||
# echo "No license key found, skipping hostname override"
|
||||
# '';
|
||||
# };
|
||||
|
||||
# Virtual machine declaration
|
||||
virtualisation.vmVariant = {
|
||||
boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
|
||||
boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
|
||||
virtualisation.forwardPorts = [
|
||||
{ from = "host"; host.port = 2222; guest.port = 22; }
|
||||
];
|
||||
virtualisation.qemu.options = [
|
||||
"-device intel-hda"
|
||||
"-device hda-duplex"
|
||||
"-vga virtio"
|
||||
];
|
||||
virtualisation = {
|
||||
cores = 8;
|
||||
memorySize = 8192;
|
||||
};
|
||||
services.logrotate.enable = false;
|
||||
};
|
||||
virtualisation.diskSize = 10485760;
|
||||
|
||||
# NixOS settings.
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
nix.settings.accept-flake-config = true;
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
Reference in New Issue
Block a user