sgx-azure

Signed-off-by: Harald Hoyer <harald@hoyer.xyz>

README.md

@@ -0,0 +1,11 @@
+```bash
+❯ nix run  github:numtide/nixos-anywhere -- --flake .#hostname root@hostname --no-reboot --tty -i $HOME/.ssh/id_ed25519
+... enter disk password
+❯ ssh -t  root@hostname systemd-cryptenroll /dev/luksdev --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=1,15
+```
+
+remote git flake
+```bash
+❯ sudo nixos-rebuild boot --refresh --flake git+https://git.hoyer.xyz/harald/nixcfg
+```
+

flake.nix

@@ -56,10 +56,6 @@
         allowUnfree = true;
       };
 
-      homes.users."harald@nix.fedora.fritz.box".modules = with inputs; [
-        neovim-flake.homeManagerModules.default
-      ];
-
       homes.users."harald@sgx-nixos".modules = with inputs; [
         neovim-flake.homeManagerModules.default
       ];
@@ -76,6 +72,10 @@
         neovim-flake.homeManagerModules.default
       ];
 
+      homes.users."harald@sgx-azure".modules = with inputs; [
+        neovim-flake.homeManagerModules.default
+      ];
+
       #      homes.modules = with inputs; [
       #        neovim-flake.homeManagerModules.default
       #      ];

homes/x86_64-linux/harald@sgx-azure/default.nix

@@ -2,8 +2,6 @@
 , pkgs
 , config
 , nixpkgs
-, osConfig ? { }
-, format ? "unknown"
 , ...
 }:
 {
@@ -28,10 +26,7 @@
       git.enable = true;
       direnv.enable = true;
       ssh.enable = true;
-      # jetbrains.enable = true;
     };
   };
-
-  fonts.fontconfig.enable = true;
 }
 

modules/nixos/services/base/default.nix

@@ -58,6 +58,7 @@ in
       };
       enableRedistributableFirmware = lib.mkDefault true;
       enableAllFirmware = true;
+      opengl.extraPackages = with pkgs; [ intel-compute-runtime ];
     };
 
     programs = {
@@ -78,6 +79,7 @@ in
     # powerManagement.cpuFreqGovernor = "ondemand";
 
     services = {
+      btrfs.autoScrub.enable = true;
       dbus.implementation = "broker";
       dbus.packages = [ pkgs.gcr ];
       fwupd.enable = true;
@@ -127,5 +129,7 @@ in
       flake = "git+https://git.hoyer.xyz/harald/nixcfg";
     };
 
+    virtualisation.libvirtd.enable = true;
+
   };
 }

systems/x86_64-linux/sgx/default.nix

@@ -4,6 +4,8 @@ with lib.plusultra;
 {
   imports = [ ./hardware-configuration.nix ];
 
+  sops.secrets.pccs.sopsFile = ../../../.secrets/sgx/pccs.yaml;
+
   plusultra = {
     base.enable = true;
     gui.enable = false;
@@ -25,10 +27,6 @@ with lib.plusultra;
   security.tpm2.enable = false;
   security.tpm2.abrmd.enable = false;
 
-  sops.secrets.pccs = {
-    sopsFile = ../../../.secrets/sgx/pccs.yaml; # bring your own password file
-  };
-
   networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.
 
   services.aesmd.enable = true;