Emma Thorpe
10cc6cceed
Separate user identity (data) from the reusable modules, and let a host declare any number of users instead of exactly one. - users/registry.nix: per-user identity (name, email, groups, authorized and signing keys) as the single source of identity; no user data is hardcoded in the modules. - mkHost takes a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg (extraSpecialArgs is per-host, so it cannot carry per-user data). - modules/users.nix builds accounts from the registry; modules/ssh.nix no longer defines authorized keys (the registry owns them); home/git.nix and home/desktop.nix read `identity`; users/emmathorpe/work.nix drops its now-redundant git identity override. - Restructure the tree: users/, home/, modules/, hosts/, lib/ replace the former lyrathorpe/ and system/ layout. - Add standalone homeConfigurations (the portable subset: shell, git, editor, claude) and an exported homeModules output for use on machines not managed by this flake, or as an input to other flakes. Behaviour-preserving for existing hosts: lyrathorpe-mbp and emmathorpe-edaas evaluate to identical derivations; lyrathorpe-t400, lyrathorpe-macpro31 and lyrathorpe-rpi5 differ only by de-duplicating a repeated authorized_keys entry. Fixes the SSH authorized-key leak (one user's key was applied to every account), the hardcoded default git identity, and the hardcoded EDaaS linger setting.
53 lines
2.3 KiB
Nix
53 lines
2.3 KiB
Nix
# Apple Mac Pro 3,1 (Early 2008, dual Xeon Harpertown, x86_64). Desktop host:
|
|
# shared graphical/wired options live in ../../modules/desktop.nix; only
|
|
# host-specific settings are here. Install notes (EFI booting, GPU, partitions):
|
|
# see ./README.md.
|
|
{ ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
];
|
|
|
|
# The Mac Pro 3,1 has 64-bit EFI (confirmed by the owner), so boot via
|
|
# systemd-boot like the MBP -- no GRUB/BIOS shim needed.
|
|
boot.loader.systemd-boot.enable = true;
|
|
# Apple's EFI does not reliably support efibootmgr NVRAM writes; leave the
|
|
# firmware vars untouched.
|
|
boot.loader.efi.canTouchEfiVariables = false;
|
|
# Apple-EFI quirk: if the Mac does not pick up the bootloader at the boot
|
|
# picker, install it to the fallback path \EFI\BOOT\BOOTX64.EFI and/or
|
|
# "bless" the ESP from macOS. Uncomment to write the removable fallback path:
|
|
# boot.loader.efi.efiInstallAsRemovable = true;
|
|
|
|
networking.hostName = "MacPro31-NixOS";
|
|
|
|
# Elderly host: a compressed RAM swap softens memory pressure (earlyoom in
|
|
# workstation.nix is the backstop).
|
|
zramSwap.enable = true;
|
|
|
|
# This host accepts SSH, so open 22 (the firewall itself is enabled in
|
|
# workstation.nix with a default-deny policy).
|
|
services.openssh.enable = true;
|
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
|
|
|
# Dual Harpertown Xeon microcode. Redistributable firmware (GPU/NIC blobs) is
|
|
# enabled in workstation.nix.
|
|
hardware.cpu.intel.updateMicrocode = true;
|
|
|
|
# GPU note: the stock card varies between units -- ATI Radeon HD 2600 XT or
|
|
# NVIDIA GeForce 8800 GT. Sway needs a working KMS/modesetting driver; do NOT
|
|
# install a proprietary blob here. Depending on the installed card, rely on
|
|
# the open kernel driver:
|
|
# - ATI Radeon HD 2600 XT -> "radeon" (older) or "amdgpu" KMS
|
|
# - NVIDIA GeForce 8800 GT -> "nouveau" KMS
|
|
# These come up automatically via the in-tree drivers + KMS, and the graphics
|
|
# stack itself is enabled by modules/sway.nix. If a card needs to be forced, add it
|
|
# here, e.g. `services.xserver.videoDrivers = [ "radeon" ];` (or "nouveau"),
|
|
# and/or `boot.initrd.kernelModules = [ "radeon" ];` in
|
|
# hardware-configuration.nix for early KMS.
|
|
|
|
# See `man configuration.nix` / the stateVersion docs before changing.
|
|
system.stateVersion = "26.05";
|
|
}
|