refactor(flake): add user registry and multi-user host support
Separate user identity (data) from the reusable modules, and let a host declare any number of users instead of exactly one. - users/registry.nix: per-user identity (name, email, groups, authorized and signing keys) as the single source of identity; no user data is hardcoded in the modules. - mkHost takes a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg (extraSpecialArgs is per-host, so it cannot carry per-user data). - modules/users.nix builds accounts from the registry; modules/ssh.nix no longer defines authorized keys (the registry owns them); home/git.nix and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops its now-redundant git identity override. - Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the former lyrathorpe/ and system/ layout. - Add standalone homeConfigurations (the portable subset: shell, git, editor, claude) and an exported homeModules output for use on machines not managed by this flake, or as an input to other flakes. Behaviour-preserving for existing hosts: lyrathorpe-mbp and emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400, lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a repeated authorized_keys entry. Fixes the SSH authorized-key leak (one user's key was applied to every account), the hardcoded default git identity, and the hardcoded EDaaS linger setting.
This commit is contained in:
Emma Thorpe
@@ -0,0 +1,48 @@
|
||||
# ThinkPad T400 — install notes
|
||||
|
||||
Flake host: `lyrathorpe-t400`. Files: `configuration.nix`, the `boot-*.nix`
|
||||
variants, and `hardware-configuration.nix`.
|
||||
|
||||
## Hardware configuration
|
||||
|
||||
`hardware-configuration.nix` here is a hand-written **placeholder**. On the real
|
||||
machine, run `nixos-generate-config`, replace the file, and commit it. It assumes
|
||||
by-label partitions — root `nixos` (ext4) and `swap` — so either label them at
|
||||
install time or swap in the generated UUIDs.
|
||||
|
||||
## Bootloader — import the module matching the flashed firmware
|
||||
|
||||
`configuration.nix` imports exactly one boot module. Default is `boot-bios.nix`;
|
||||
switch by commenting it out and uncommenting the relevant alternative.
|
||||
|
||||
| Firmware | Module | Notes |
|
||||
| ---------------------------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Stock Lenovo BIOS, or coreboot + **SeaBIOS** payload | `boot-bios.nix` | GRUB on the MBR. Set `device` to the real install disk (`/dev/sda` by default). MBR/legacy layout. |
|
||||
| coreboot + **GRUB** payload | `boot-coreboot-grub.nix` | GRUB is config-only (`device = "nodev"`); NixOS does **not** write to a disk. Your coreboot `grub.cfg` (in the flash chip) must `search` for and `configfile` the on-disk `/boot/grub/grub.cfg`, or chainload the disk's GRUB. |
|
||||
| coreboot + **Tianocore/edk2 (UEFI)** payload | `boot-coreboot-uefi.nix` | systemd-boot. `canTouchEfiVariables = true` (coreboot honours NVRAM writes). The module **declares its own ESP** (`/boot` vfat, label `ESP`) — when you regenerate `hardware-configuration.nix`, do **not** let it also define `/boot`. Create + label an `ESP` vfat partition (GPT). |
|
||||
|
||||
## Graphics
|
||||
|
||||
This unit has the optional **discrete ATI Mobility Radeon HD 3470 (RV620)**. The
|
||||
open `radeon` KMS driver is loaded in the initrd for early modesetting; firmware
|
||||
comes from `enableRedistributableFirmware`.
|
||||
|
||||
The T400 has switchable graphics (discrete ATI + Intel GMA 4500MHD). Select
|
||||
**Discrete** in the firmware's graphics setting so only the ATI is live. If you
|
||||
run **Integrated** instead, the Intel `i915` driver takes over with no config
|
||||
change and `radeon` stays idle.
|
||||
|
||||
## Login
|
||||
|
||||
Graphical login via a Wayland greeter — `greetd` running ReGreet inside the
|
||||
`cage` kiosk compositor — configured centrally in `lyrathorpe/swaywm.nix` for
|
||||
every Sway host (gated on `features.swayDesktop.enable`). The greeter is forced
|
||||
to the Dvorak layout to match the console and Sway session. Set the user
|
||||
password (`passwd lyrathorpe`) after install, or the greeter cannot
|
||||
authenticate. Requires working radeon/i915 KMS (see Graphics).
|
||||
|
||||
## Apply
|
||||
|
||||
```sh
|
||||
sudo nixos-rebuild switch --flake .#lyrathorpe-t400
|
||||
```
|
||||
@@ -0,0 +1,11 @@
|
||||
# Boot via legacy BIOS -- the stock Lenovo BIOS, or coreboot with the SeaBIOS
|
||||
# payload (both present a legacy BIOS interface). GRUB is installed to the MBR of
|
||||
# the boot disk. This is the default.
|
||||
{ ... }:
|
||||
{
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
# Must point at the actual install disk -- adjust if it is not /dev/sda.
|
||||
device = "/dev/sda";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
# Boot via coreboot's GRUB payload (e.g. libreboot default). The GRUB in the
|
||||
# flash chip reads the grub.cfg that NixOS generates on disk, so GRUB here is
|
||||
# config-only -- it is NOT installed to any disk MBR (`device = "nodev"`).
|
||||
#
|
||||
# Your coreboot grub.cfg must locate and load the on-disk config, e.g. search
|
||||
# for and `configfile` /boot/grub/grub.cfg (or chainload the disk's GRUB).
|
||||
{ ... }:
|
||||
{
|
||||
boot.loader.grub = {
|
||||
enable = true;
|
||||
device = "nodev";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
# Boot via coreboot's Tianocore/edk2 (UEFI) payload. This turns the T400 into a
|
||||
# real UEFI machine, so use systemd-boot. Unlike Apple's firmware, coreboot's
|
||||
# UEFI honours EFI variable writes, so canTouchEfiVariables is on.
|
||||
#
|
||||
# Requires an EFI System Partition. It is declared here so it travels with this
|
||||
# boot mode; the generated hardware-configuration.nix should NOT also define
|
||||
# /boot. Label the ESP `ESP` at install, or replace with the generated UUID.
|
||||
{ ... }:
|
||||
{
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/ESP";
|
||||
fsType = "vfat";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
# ThinkPad T400 (NixOS). Shared laptop options live in ../../modules/laptop.nix;
|
||||
# only host-specific settings are here. Install notes (boot variants, GPU,
|
||||
# partitions): see ./README.md.
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
# Boot: import exactly ONE, matching the firmware currently flashed.
|
||||
# Stock Lenovo BIOS and coreboot+SeaBIOS both use boot-bios.nix.
|
||||
./boot-bios.nix
|
||||
# ./boot-coreboot-grub.nix # coreboot with the GRUB payload (config-only GRUB)
|
||||
# ./boot-coreboot-uefi.nix # coreboot with the Tianocore/edk2 UEFI payload
|
||||
# # (systemd-boot; carries its own ESP mount)
|
||||
];
|
||||
|
||||
networking.hostName = "T400-NixOS";
|
||||
|
||||
console.font = "Lat2-Terminus16";
|
||||
|
||||
# Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
|
||||
zramSwap.enable = true;
|
||||
|
||||
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
||||
# laptop.nix with a default-deny policy).
|
||||
services.openssh.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
|
||||
# Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
|
||||
# workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
|
||||
# the radeon firmware needed by the discrete GPU below.
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
|
||||
# Battery longevity: cap charging to 75-80%. tlp itself comes from the
|
||||
# nixos-hardware lenovo-thinkpad profile; tp_smapi supplies the threshold
|
||||
# sysfs on this 2008-era ThinkPad (kernel-native natacpi is too new for it).
|
||||
boot.kernelModules = [ "tp_smapi" ];
|
||||
boot.extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
|
||||
services.tlp.settings = {
|
||||
START_CHARGE_THRESH_BAT0 = 75;
|
||||
STOP_CHARGE_THRESH_BAT0 = 80;
|
||||
};
|
||||
|
||||
# This T400 has the optional discrete GPU fitted: an ATI Mobility Radeon HD
|
||||
# 3470 (RV620), driven by the open `radeon` KMS driver. Load it in the initrd
|
||||
# for early modesetting (clean Sway/Wayland start); firmware comes from
|
||||
# enableRedistributableFirmware above.
|
||||
#
|
||||
# The T400 has switchable graphics (this discrete GPU + the Intel GMA
|
||||
# 4500MHD). Select "Discrete" in the firmware's graphics setting so only the
|
||||
# ATI is live; if you instead run "Integrated", the Intel i915 driver takes
|
||||
# over with no extra config and `radeon` simply stays idle.
|
||||
boot.initrd.kernelModules = [ "radeon" ];
|
||||
|
||||
# See `man configuration.nix` / the stateVersion docs before changing.
|
||||
system.stateVersion = "26.05";
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
# PLACEHOLDER -- hand-written, not machine-generated. Regenerate on the real
|
||||
# T400 with `nixos-generate-config` and commit the result. The device labels
|
||||
# below are guesses; replace them with the generated UUIDs (or label the
|
||||
# partitions accordingly at install time).
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [
|
||||
"ahci"
|
||||
"ata_piix"
|
||||
"ehci_pci"
|
||||
"uhci_hcd"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
"sr_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
# Label your root partition `nixos` at install, or replace with the generated UUID.
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/nixos";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{ device = "/dev/disk/by-label/swap"; }
|
||||
];
|
||||
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
Reference in New Issue
Block a user