harald/nixcfg
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Compare commits

base: harald:4066b0cd8059547754822aaaf3364eac783d2261
Branches Tags
harald:main
harald:b24.05
..
compare: harald:30e70823447e2a50c5d8a90231d3f482d041fd07
Branches Tags
harald:main
harald:b24.05

No commits in common. "4066b0cd8059547754822aaaf3364eac783d2261" and "30e70823447e2a50c5d8a90231d3f482d041fd07" have entirely different histories.
4066b0cd80 ... 30e7082344

3 changed files with 335 additions and 401 deletions
Show stats Expand all files Collapse all files

687
flake.lock
View file

File diff suppressed because it is too large Load diff

24
systems/x86_64-linux/sgx/default.nix
View file

@ -13,11 +13,12 @@
metacfg = { metacfg = {
base.enable = true; base.enable = true;
gui.enable = false; gui.enable = false;
nix-ld.enable = false; nix-ld.enable = true;
nix.enable = true; nix.enable = true;
aesmd_dcap.enable = true;
podman.enable = true; podman.enable = true;
secureboot.enable = true; secureboot.enable = true;
user.extraGroups = [ "docker" ]; user.extraGroups = [ "docker" "sgx" ];
}; };
virtualisation = { virtualisation = {
@ -25,7 +26,6 @@
libvirtd.enable = true; libvirtd.enable = true;
podman.dockerCompat = false; podman.dockerCompat = false;
}; };
systemd.services.libvirt-guests.after = [ "network-online.target" ]; systemd.services.libvirt-guests.after = [ "network-online.target" ];
system.autoUpgrade = { system.autoUpgrade = {
@ -34,11 +34,19 @@
allowReboot = true; allowReboot = true;
}; };
systemd.targets.sleep.enable = false; services.pcscd.enable = true;
systemd.targets.suspend.enable = false;
systemd.targets.hibernate.enable = false; environment.etc."sgx_default_qcnl.conf".text = ''
systemd.targets.hybrid-sleep.enable = false; {
services.xserver.displayManager.gdm.autoSuspend = false; "pccs_url": "https://api.trustedservices.intel.com/sgx/certification/v4/",
"use_secure_cert": true,
"retry_times": 6,
"retry_delay": 10,
"pck_cache_expire_hours": 168,
"verify_collateral_cache_expire_hours": 168,
"local_cache_only": false
}
'';
system.stateVersion = "23.11"; system.stateVersion = "23.11";
} }

25
systems/x86_64-linux/sgx/hardware-configuration.nix
View file

@ -1,7 +1,7 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’ # Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes # and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead. # to /etc/nixos/configuration.nix instead.
{ pkgs, config, lib, modulesPath, ... }: { config, lib, modulesPath, ... }:
{ {
imports = imports =
@ -54,29 +54,6 @@
c4 /dev/disk/by-uuid/5c61cbf0-dbca-48e0-948e-71bea3806a6c /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256 c4 /dev/disk/by-uuid/5c61cbf0-dbca-48e0-948e-71bea3806a6c /dev/disk/by-id/usb-Ut165_USB2FlashStorage_08050508d213e6-0:0-part1 luks,keyfile-size=256
''; '';
systemd.services.hd-idle = {
description = "Set to idle";
wantedBy = [ "multi-user.target" ];
after = [
"dev-disk-by\\x2did-ata\\x2dST16000NT001\\x2d3LV101_ZRS0K2TX.device"
"dev-disk-by\\x2did-ata\\x2dST16000NT001\\x2d3LV101_ZRS0K3WR.device"
"dev-disk-by\\x2did-ata\\x2dWDC_WD40EFRX\\x2d68WT0N0_WD\\x2dWCC4E0710903.device"
"dev-disk-by\\x2did-ata\\x2dWDC_WD40EFRX\\x2d68WT0N0_WD\\x2dWCC4E0732164.device"
"dev-disk-by\\x2did-ata\\x2dWDC_WD40EFRX\\x2d68WT0N0_WD\\x2dWCC4E0732505.device"
];
bindsTo = [
"dev-disk-by\\x2did-ata\\x2dST16000NT001\\x2d3LV101_ZRS0K2TX.device"
"dev-disk-by\\x2did-ata\\x2dST16000NT001\\x2d3LV101_ZRS0K3WR.device"
"dev-disk-by\\x2did-ata\\x2dWDC_WD40EFRX\\x2d68WT0N0_WD\\x2dWCC4E0710903.device"
"dev-disk-by\\x2did-ata\\x2dWDC_WD40EFRX\\x2d68WT0N0_WD\\x2dWCC4E0732164.device"
"dev-disk-by\\x2did-ata\\x2dWDC_WD40EFRX\\x2d68WT0N0_WD\\x2dWCC4E0732505.device"
];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.hdparm}/sbin/hdparm -S 60 /dev/disk/by-id/ata-*'";
};
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;