refactor(flake): add user registry and multi-user host support
Separate user identity (data) from the reusable modules, and let a host declare any number of users instead of exactly one. - users/registry.nix: per-user identity (name, email, groups, authorized and signing keys) as the single source of identity; no user data is hardcoded in the modules. - mkHost takes a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg (extraSpecialArgs is per-host, so it cannot carry per-user data). - modules/users.nix builds accounts from the registry; modules/ssh.nix no longer defines authorized keys (the registry owns them); home/git.nix and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops its now-redundant git identity override. - Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the former lyrathorpe/ and system/ layout. - Add standalone homeConfigurations (the portable subset: shell, git, editor, claude) and an exported homeModules output for use on machines not managed by this flake, or as an input to other flakes. Behaviour-preserving for existing hosts: lyrathorpe-mbp and emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400, lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a repeated authorized_keys entry. Fixes the SSH authorized-key leak (one user's key was applied to every account), the hardcoded default git identity, and the hardcoded EDaaS linger setting.
This commit is contained in:
Emma Thorpe
@@ -0,0 +1,61 @@
|
||||
# Mac Pro 3,1 (Early 2008) — install notes
|
||||
|
||||
Flake host: `lyrathorpe-macpro31`. Desktop (`portable = false`, imports
|
||||
`../../modules/desktop.nix`). Files: `configuration.nix`,
|
||||
`hardware-configuration.nix`.
|
||||
|
||||
## Hardware configuration
|
||||
|
||||
`hardware-configuration.nix` here is the real config generated by
|
||||
`nixos-generate-config` on the machine. Root is an **LVM** logical volume
|
||||
(`/dev/mapper/MacPro-Root`, ext4); the ESP (vfat) and swap are referenced by
|
||||
UUID. The initrd carries `dm-snapshot` for the LVM root. Regenerate and commit
|
||||
if the disk layout changes.
|
||||
|
||||
## Bootloader
|
||||
|
||||
The Mac Pro 3,1 has **64-bit EFI**, so it uses **systemd-boot** (no GRUB/CSM
|
||||
shim). `canTouchEfiVariables = false` because Apple's firmware does not reliably
|
||||
accept `efibootmgr` NVRAM writes.
|
||||
|
||||
Apple-EFI quirk: if the firmware boot picker does not show NixOS after install,
|
||||
either
|
||||
|
||||
- uncomment `boot.loader.efi.efiInstallAsRemovable = true;` in
|
||||
`configuration.nix` (installs the fallback `\EFI\BOOT\BOOTX64.EFI`), and/or
|
||||
- "bless" the ESP from macOS.
|
||||
|
||||
Partition the disk GPT with an ESP (vfat).
|
||||
|
||||
## Graphics
|
||||
|
||||
The stock card varies between units — **ATI Radeon HD 2600 XT** or **NVIDIA
|
||||
GeForce 8800 GT**. No proprietary driver is hardcoded; Sway relies on in-tree KMS:
|
||||
|
||||
- ATI Radeon HD 2600 XT → `radeon` (or `amdgpu`) KMS
|
||||
- NVIDIA GeForce 8800 GT → `nouveau` KMS
|
||||
|
||||
These come up automatically. If a card needs forcing, set
|
||||
`services.xserver.videoDrivers` and/or add the module to
|
||||
`boot.initrd.kernelModules` for early KMS (see the comment in
|
||||
`configuration.nix`).
|
||||
|
||||
## Networking
|
||||
|
||||
Wired Ethernet via NetworkManager (from `desktop.nix`) — the Mac Pro has two
|
||||
gigabit ports.
|
||||
|
||||
## Login
|
||||
|
||||
Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
|
||||
`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
|
||||
every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
|
||||
to the Dvorak layout to match the console and Sway session. Set the user
|
||||
password (`passwd lyrathorpe`) after install, or the greeter cannot
|
||||
authenticate. Requires working KMS (radeon/nouveau — see Graphics).
|
||||
|
||||
## Apply
|
||||
|
||||
```sh
|
||||
sudo nixos-rebuild switch --flake .#lyrathorpe-macpro31
|
||||
```
|
||||
@@ -0,0 +1,52 @@
|
||||
# Apple Mac Pro 3,1 (Early 2008, dual Xeon Harpertown, x86_64). Desktop host:
|
||||
# shared graphical/wired options live in ../../modules/desktop.nix; only
|
||||
# host-specific settings are here. Install notes (EFI booting, GPU, partitions):
|
||||
# see ./README.md.
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# The Mac Pro 3,1 has 64-bit EFI (confirmed by the owner), so boot via
|
||||
# systemd-boot like the MBP -- no GRUB/BIOS shim needed.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
# Apple's EFI does not reliably support efibootmgr NVRAM writes; leave the
|
||||
# firmware vars untouched.
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
# Apple-EFI quirk: if the Mac does not pick up the bootloader at the boot
|
||||
# picker, install it to the fallback path \EFI\BOOT\BOOTX64.EFI and/or
|
||||
# "bless" the ESP from macOS. Uncomment to write the removable fallback path:
|
||||
# boot.loader.efi.efiInstallAsRemovable = true;
|
||||
|
||||
networking.hostName = "MacPro31-NixOS";
|
||||
|
||||
# Elderly host: a compressed RAM swap softens memory pressure (earlyoom in
|
||||
# workstation.nix is the backstop).
|
||||
zramSwap.enable = true;
|
||||
|
||||
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
||||
# workstation.nix with a default-deny policy).
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
|
||||
# enabled in workstation.nix.
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
|
||||
# GPU note: the stock card varies between units -- ATI Radeon HD 2600 XT or
|
||||
# NVIDIA GeForce 8800 GT. Sway needs a working KMS/modesetting driver; do NOT
|
||||
# install a proprietary blob here. Depending on the installed card, rely on
|
||||
# the open kernel driver:
|
||||
# - ATI Radeon HD 2600 XT -> "radeon" (older) or "amdgpu" KMS
|
||||
# - NVIDIA GeForce 8800 GT -> "nouveau" KMS
|
||||
# These come up automatically via the in-tree drivers + KMS, and the graphics
|
||||
# stack itself is enabled by modules/sway.nix. If a card needs to be forced, add it
|
||||
# here, e.g. `services.xserver.videoDrivers = [ "radeon" ];` (or "nouveau"),
|
||||
# and/or `boot.initrd.kernelModules = [ "radeon" ];` in
|
||||
# hardware-configuration.nix for early KMS.
|
||||
|
||||
# See `man configuration.nix` / the stateVersion docs before changing.
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ata_piix" "ahci" "firewire_ohci" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/mapper/MacPro-Root";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/0E9C-C099";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/dec138b4-320f-4b69-acbc-3014a1032cbd"; }
|
||||
];
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
Reference in New Issue
Block a user