lyrathorpeandEmma Thorpe
c06a57f249
CI / flake (push) Successful in 3m30s
## Summary
Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).
## Changes
- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.
## Deferred (from #53, noted in the commit)
- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.
## Verification
- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).
Closes #50, #51, #52, #53.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54
56 lines
2.4 KiB
Nix
56 lines
2.4 KiB
Nix
# ThinkPad T400 (NixOS). Shared laptop options live in ../../modules/laptop.nix;
|
|
# only host-specific settings are here. Install notes (boot variants, GPU,
|
|
# partitions): see ./README.md.
|
|
{ config, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
# Boot: import exactly ONE, matching the firmware currently flashed.
|
|
# Stock Lenovo BIOS and coreboot+SeaBIOS both use boot-bios.nix.
|
|
./boot-bios.nix
|
|
# ./boot-coreboot-grub.nix # coreboot with the GRUB payload (config-only GRUB)
|
|
# ./boot-coreboot-uefi.nix # coreboot with the Tianocore/edk2 UEFI payload
|
|
# # (systemd-boot; carries its own ESP mount)
|
|
];
|
|
|
|
networking.hostName = "T400-NixOS";
|
|
|
|
console.font = "Lat2-Terminus16";
|
|
|
|
# Low-RAM host (4 GiB max): a compressed RAM swap reduces disk paging.
|
|
zramSwap.enable = true;
|
|
|
|
# sshd (daemon, port 22, key-only policy) comes from ../../modules/ssh.nix;
|
|
# the firewall itself is enabled in laptop.nix with a default-deny policy.
|
|
|
|
# Intel Core 2 (Penryn) microcode. Redistributable firmware (enabled in
|
|
# workstation.nix) supplies the iwlwifi blobs (Intel WiFi Link 5100/5300) and
|
|
# the radeon firmware needed by the discrete GPU below.
|
|
hardware.cpu.intel.updateMicrocode = true;
|
|
|
|
# Battery longevity: cap charging to 75-80%. tlp itself comes from the
|
|
# nixos-hardware lenovo-thinkpad profile; tp_smapi supplies the threshold
|
|
# sysfs on this 2008-era ThinkPad (kernel-native natacpi is too new for it).
|
|
boot.kernelModules = [ "tp_smapi" ];
|
|
boot.extraModulePackages = [ config.boot.kernelPackages.tp_smapi ];
|
|
services.tlp.settings = {
|
|
START_CHARGE_THRESH_BAT0 = 75;
|
|
STOP_CHARGE_THRESH_BAT0 = 80;
|
|
};
|
|
|
|
# This T400 has the optional discrete GPU fitted: an ATI Mobility Radeon HD
|
|
# 3470 (RV620), driven by the open `radeon` KMS driver. Load it in the initrd
|
|
# for early modesetting (clean Sway/Wayland start); firmware comes from
|
|
# enableRedistributableFirmware above.
|
|
#
|
|
# The T400 has switchable graphics (this discrete GPU + the Intel GMA
|
|
# 4500MHD). Select "Discrete" in the firmware's graphics setting so only the
|
|
# ATI is live; if you instead run "Integrated", the Intel i915 driver takes
|
|
# over with no extra config and `radeon` simply stays idle.
|
|
boot.initrd.kernelModules = [ "radeon" ];
|
|
|
|
# See `man configuration.nix` / the stateVersion docs before changing.
|
|
system.stateVersion = "26.05";
|
|
}
|