harald/nixcfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

chore(nix): refactor SGX configuration for nixtee1

Browse source 
- Removed SGX-specific settings including `aesmd_dcap`, `sgx_default_qcnl.conf`, and `security.tpm2` configurations.
- Updated `system.stateVersion` and switched kernel modules to `kvm-amd`.
- Adjusted disk UUIDs and removed unused `/boot` filesystem definition.
This commit is contained in:
Harald Hoyer 2025-11-13 16:01:58 +01:00
parent 1511e72e83
commit 811457161a
2 changed files with 6 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

86
systems/x86_64-linux/sgx-nixos/default.nix
View file

@ -1,86 +0,0 @@
{
pkgs,
lib,
config,
...
}:
with lib;
with lib.metacfg;
{
imports = [ ./hardware-configuration.nix ];
boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
boot.kernelPackages = lib.mkOverride 0 pkgs.linuxPackages_latest;
networking.firewall.extraCommands = ''
iptables -t nat -A OUTPUT -o lo -p tcp --dport 8081 -j DNAT --to-destination 192.168.122.1:8081
iptables -t nat -A POSTROUTING -j MASQUERADE
'';
metacfg = {
base.enable = true;
nix-ld.enable = true;
nix.enable = true;
aesmd_dcap.enable = true;
podman.enable = true;
user.extraGroups = [
"docker"
"sgx"
];
tools = {
direnv.enable = true;
};
};
environment.etc."sgx_default_qcnl.conf".text = ''
{
"pccs_url": "https://192.168.122.1:8081/sgx/certification/v4/",
"use_secure_cert": false,
"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/",
"retry_times": 6,
"retry_delay": 10,
"pck_cache_expire_hours": 168,
"verify_collateral_cache_expire_hours": 168,
"local_cache_only": false
}
'';
virtualisation = {
docker.enable = true;
podman.dockerCompat = false;
};
system.autoUpgrade = {
enable = true;
operation = "switch";
allowReboot = true;
};
security.tpm2.enable = false;
security.tpm2.abrmd.enable = false;
networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.
networking.firewall.allowPing = true;
powerManagement.cpuFreqGovernor = "ondemand";
systemd.user.extraConfig = "DefaultLimitNOFILE=32768";
security.pam.loginLimits = [
{
domain = "*";
item = "nofile";
type = "-";
value = "32768";
}
{
domain = "*";
item = "memlock";
type = "-";
value = "32768";
}
];
system.stateVersion = "23.11";
}