From 2e0f1de287a557e7f6fb8aca45bac13045ef4598 Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Tue, 19 Mar 2024 14:43:29 +0100 Subject: [PATCH 1/3] pcscd off by default Signed-off-by: Harald Hoyer --- modules/nixos/services/gui/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/nixos/services/gui/default.nix b/modules/nixos/services/gui/default.nix index 717a4f3..ad079f7 100644 --- a/modules/nixos/services/gui/default.nix +++ b/modules/nixos/services/gui/default.nix @@ -15,7 +15,7 @@ in flatpak.enable = true; - pcscd.enable = false; + pcscd.enable = lib.mkDefault false; # Enable CUPS to print documents. printing.enable = true; From 0e548b42c0dccd5936ccb0462b4c3c038eb5c3ff Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Tue, 19 Mar 2024 14:44:07 +0100 Subject: [PATCH 2/3] flake update Signed-off-by: Harald Hoyer --- flake.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.lock b/flake.lock index 87779ed..b5620ab 100644 --- a/flake.lock +++ b/flake.lock @@ -1361,11 +1361,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1710021367, - "narHash": "sha256-FuMVdWqXMT38u1lcySYyv93A7B8wU0EGzUr4t4jQu8g=", + "lastModified": 1710695816, + "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=", "owner": "nixos", "repo": "nixpkgs", - "rev": "b94a96839afcc56de3551aa7472b8d9a3e77e05d", + "rev": "614b4613980a522ba49f0d194531beddbb7220d3", "type": "github" }, "original": { @@ -2436,11 +2436,11 @@ }, "unstable": { "locked": { - "lastModified": 1709961763, - "narHash": "sha256-6H95HGJHhEZtyYA3rIQpvamMKAGoa8Yh2rFV29QnuGw=", + "lastModified": 1710631334, + "narHash": "sha256-rL5LSYd85kplL5othxK5lmAtjyMOBg390sGBTb3LRMM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "3030f185ba6a4bf4f18b87f345f104e6a6961f34", + "rev": "c75037bbf9093a2acb617804ee46320d6d1fea5a", "type": "github" }, "original": { From a12d6bd417a2b23515ae3cd0df8f44d6dd6c34ce Mon Sep 17 00:00:00 2001 From: Harald Hoyer Date: Tue, 19 Mar 2024 14:46:44 +0100 Subject: [PATCH 3/3] sgx: add raid disks Signed-off-by: Harald Hoyer --- systems/x86_64-linux/sgx/default.nix | 1 + .../sgx/hardware-configuration.nix | 54 +++++++++++++++++++ 2 files changed, 55 insertions(+) diff --git a/systems/x86_64-linux/sgx/default.nix b/systems/x86_64-linux/sgx/default.nix index 5eeeb5a..e8c289f 100644 --- a/systems/x86_64-linux/sgx/default.nix +++ b/systems/x86_64-linux/sgx/default.nix @@ -5,6 +5,7 @@ with lib.plusultra; imports = [ ./hardware-configuration.nix ]; sops.secrets.pccs.sopsFile = ../../../.secrets/sgx/pccs.yaml; + sops.secrets.backup-pw.sopsFile = ../.secrets/sgx/backup-s3.yaml; plusultra = { base.enable = true; diff --git a/systems/x86_64-linux/sgx/hardware-configuration.nix b/systems/x86_64-linux/sgx/hardware-configuration.nix index c776203..3f952c7 100644 --- a/systems/x86_64-linux/sgx/hardware-configuration.nix +++ b/systems/x86_64-linux/sgx/hardware-configuration.nix @@ -34,6 +34,60 @@ swapDevices = [{ device = "/dev/disk/by-uuid/72d061d7-ab18-47b9-beb1-1c465dda1be9"; }]; + boot.initrd.luks.devices."a16" = { + gpgCard.publicKey = ./yubikey-public.asc; + gpgCard.encryptedPass = ./luks-passphrase.asc.gpg; + device = "/dev/disk/by-uuid/6f1c1b24-3c94-44be-8d1b-70db562079c1"; }; + boot.initrd.luks.devices."b16" = { device = "/dev/disk/by-uuid/9540de6d-c907-43e4-b740-2d75dbf37135"; }; + boot.initrd.luks.devices."a4" = { device = "/dev/disk/by-uuid/72924bd6-3d58-4437-aafd-ae6d2b995fbf"; }; + boot.initrd.luks.devices."b4" = { device = "/dev/disk/by-uuid/459c8d9a-6e92-4dec-a998-701ab9e76a2e"; }; + boot.initrd.luks.devices."c4" = { device = "/dev/disk/by-uuid/5c61cbf0-dbca-48e0-948e-71bea3806a6c"; }; + + fileSystems."/mnt/raid" = { + fsType = "btrfs"; + device = "/dev/disk/by-uuid/11727be7-bf9b-4888-8b02-d7eb1f898712"; + options = [ "defaults" "compress=zstd" "subvol=root" "autodefrag" "noatime" "nofail" "x-systemd.device-timeout=5" ]; + }; + + fileSystems."/mnt/backup" = { + fsType = "btrfs"; + device = "/dev/disk/by-uuid/c29e7eac-26ba-41b1-ac3e-11123476b7c5"; + options = [ "defaults" "compress=zstd" "subvol=root" "autodefrag" "noatime" "nofail" "x-systemd.device-timeout=5" ]; + }; + + + systemd.services.hd-idle = { + description = "Set to idle"; + wantedBy = [ "multi-user.target" ]; + after = [ + "dev-sdb.device" + "dev-sdc.device" + "dev-sdd.device" + "dev-sde.device" + "dev-sdf.device" + ]; + bindsTo = [ + "dev-sdb.device" + "dev-sdc.device" + "dev-sdd.device" + "dev-sde.device" + "dev-sdf.device" + ]; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.hdparm}/sbin/hdparm -S 60 /dev/sdb /dev/sdc /dev/sdd /dev/sde /dev/sdf"; + }; + }; + + powerManagement.powerUpCommands = '' + ${pkgs.hdparm}/sbin/hdparm -S 60 /dev/sdb + ${pkgs.hdparm}/sbin/hdparm -S 60 /dev/sdc + ${pkgs.hdparm}/sbin/hdparm -S 60 /dev/sdd + ${pkgs.hdparm}/sbin/hdparm -S 60 /dev/sde + ${pkgs.hdparm}/sbin/hdparm -S 60 /dev/sdf + ''; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's # still possible to use this option, but it's recommended to use it in conjunction