diff --git a/firmware/README.md b/firmware/README.md index 79c2967..56acca6 100644 --- a/firmware/README.md +++ b/firmware/README.md @@ -1,15 +1,18 @@ # Asahi peripheral firmware (vendored) `hardware.asahi.peripheralFirmwareDirectory` points here. A **pure** flake -cannot read `/boot/asahi`, so the Wi-Fi/Bluetooth firmware must live inside the -repo tree and be git-tracked. +cannot read `/boot/vendorfw`, so the Wi-Fi/Bluetooth firmware must live inside +the repo tree and be git-tracked. + +Since nixos-apple-silicon 66d8dd2 the module expects the pre-extracted +`firmware.cpio` (placed on the ESP by the Asahi installer) instead of +`all_firmware.tar.gz` + `kernelcache.*`. ## During install, on the Mac: ```sh -cp /boot/asahi/all_firmware.tar.gz ~/.dotfiles/firmware/ -cp /boot/asahi/kernelcache* ~/.dotfiles/firmware/ -git -C ~/.dotfiles add -f firmware/all_firmware.tar.gz firmware/kernelcache* +cp /boot/vendorfw/firmware.cpio ~/.dotfiles/firmware/ +git -C ~/.dotfiles add -f firmware/firmware.cpio ``` (They're `.gitignore`-exempt via `-f` if needed — but the flake only sees diff --git a/firmware/firmware.cpio b/firmware/firmware.cpio new file mode 100644 index 0000000..ece822c Binary files /dev/null and b/firmware/firmware.cpio differ diff --git a/flake.lock b/flake.lock index 1208f83..44af1e9 100644 --- a/flake.lock +++ b/flake.lock @@ -8,11 +8,11 @@ ] }, "locked": { - "lastModified": 1782749693, - "narHash": "sha256-Dj2m93PXWyOoXyp9tQlyjtBPbpVobKUrgnVDNNsNT1o=", + "lastModified": 1785426242, + "narHash": "sha256-QHAP8KsJQmI+dpNS/wfWAtEBQ0Zby+B0Ty+qZIO/U2w=", "owner": "nix-community", "repo": "nixos-apple-silicon", - "rev": "b6ed8c114eee6739e3a2c06d99e2e19ac608dedf", + "rev": "66d8dd2c27f99bd5420c99938b60695aac1785c4", "type": "github" }, "original": { @@ -29,11 +29,11 @@ }, "locked": { "dir": "pkgs/firefox-addons", - "lastModified": 1782878575, - "narHash": "sha256-sw0B1D//VBGXLQZJXXFLjunnMfO7hCZ5S1kv06BBO5A=", + "lastModified": 1786334532, + "narHash": "sha256-C/efnaEGK18irNAyDM7JtNG6QhMNewTTp/JZNdyStWs=", "owner": "rycee", "repo": "nur-expressions", - "rev": "e5d8f0375b4613d200e8efd64df2183a75290c4e", + "rev": "89326e8b272f25875f3dbebe3ec2b510016f57e0", "type": "gitlab" }, "original": { @@ -65,11 +65,11 @@ ] }, "locked": { - "lastModified": 1782881387, - "narHash": "sha256-HvlS1KDGXDjd1bNzzPvH1mkDJATlDAfVYfTh//wJBEA=", + "lastModified": 1786356609, + "narHash": "sha256-ou8fYz5w9yhXC8YbvvExybFIa19MyW5G/8dEPqa90hM=", "owner": "nix-community", "repo": "home-manager", - "rev": "d32537981c036473cf6990ae03176a5d84c43b29", + "rev": "c30c7955cec30d664a9baced6bc0112e263d4647", "type": "github" }, "original": { @@ -80,11 +80,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1782723713, - "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=", + "lastModified": 1786106723, + "narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8", + "rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238", "type": "github" }, "original": { @@ -113,11 +113,11 @@ ] }, "locked": { - "lastModified": 1782812215, - "narHash": "sha256-OPVK9WW9QsO2aj1R+Ln3p7fniFj5h441vb3LyrzpeE4=", + "lastModified": 1786347712, + "narHash": "sha256-yH+jWXH2TVd5h3J5KoZiE8/4O4HqoggfB0zl9uVj39w=", "owner": "0xc000022070", "repo": "zen-browser-flake", - "rev": "a7c2a9a5e492e0e62072547f7e4c2abf138425c5", + "rev": "945efbc704b7f8c1731a922aabbc5d95edc9eb74", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index d74ad5f..49a9e23 100644 --- a/flake.nix +++ b/flake.nix @@ -96,6 +96,7 @@ }; home.pointerCursor = { + enable = true; package = pkgs.bibata-cursors; name = "Bibata-Modern-Ice"; size = 24; @@ -179,6 +180,8 @@ }; programs.starship.enable = true; + + # SSH auth via the 1Password agent — private keys stay in the vault, # never on disk or in the Nix store. programs.ssh = { @@ -211,9 +214,42 @@ # ───────────────────── shared system (both hosts) ───────────────────── common = { pkgs, ... }: { nix.settings.experimental-features = [ "nix-command" "flakes" ]; + # Trusted so client-side nix config takes effect — the deepvis repo's + # flake nixConfig advertises the team dev cache (attic on the builder, + # over the tailnet), and the daemon ignores it for untrusted users. + nix.settings.trusted-users = [ "mads" ]; + # x86_64 derivations build on the build host instead of under local + # qemu emulation — anything the dev cache doesn't already have ships + # there as a remote build (tailnet; the builder's `builder` user + # exists for exactly this). + # + # The host key is pinned system-wide because the ssh'ing party is the + # root daemon, which has no known_hosts and never gets a tty to + # answer a trust prompt. + programs.ssh.knownHosts."builder" = { + extraHostNames = [ "5.9.71.104" "builder.tailf5eaab.ts.net" ]; + publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHnKIrxYtlovvYGgkpEZXY8wG/CuSLMGOM/84eIlyeVW"; + }; + nix.distributedBuilds = true; + nix.buildMachines = [{ + hostName = "builder"; + sshUser = "builder"; + # The daemon (root) does the ssh'ing, so it needs an explicit + # on-disk key — it has no access to a user's agent. + sshKey = "/home/mads/.ssh/id_ed25519"; + protocol = "ssh-ng"; + system = "x86_64-linux"; + maxJobs = 16; + supportedFeatures = [ "big-parallel" "kvm" "nixos-test" ]; + }]; networking.networkmanager.enable = true; - networking.networkmanager.wifi.backend = "wpa_supplicant"; + networking.networkmanager.wifi.backend = "iwd"; + + # Secret Service (org.freedesktop.secrets) provider, D-Bus-activated on + # demand. Without it 1Password can't persist the 2FA device token + # ("unable to save your two-factor token") and re-prompts every unlock. + services.gnome.gnome-keyring.enable = true; programs._1password.enable = true; programs._1password-gui = { @@ -304,17 +340,33 @@ # Wi-Fi/BT firmware, vendored (a pure flake can't read /boot/asahi). hardware.asahi.peripheralFirmwareDirectory = ./firmware; + hardware.asahi.enable = true; boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.configurationLimit = 3; # 500M ESP is small boot.extraModprobeConfig = "options hid_apple fnmode=1"; boot.blacklistedKernelModules = [ "pcspkr" ]; - # Asahi kernel + Mesa cache (else compile from source). + # Build x86_64 derivations (packing-station iso/deploys) via qemu. + boot.binfmt.emulatedSystems = [ "x86_64-linux" ]; + + # Resolve .local names, so the packing stations can be reached and + # deployed to by hostname instead of by address. + services.avahi = { + enable = true; + nssmdns4 = true; + }; + + # Asahi kernel + Mesa cache, and the Raspberry Pi vendor + # kernel/firmware cache (else both compile from source). nix.settings = { - extra-substituters = [ "https://nixos-apple-silicon.cachix.org" ]; + extra-substituters = [ + "https://nixos-apple-silicon.cachix.org" + "https://nixos-raspberrypi.cachix.org" + ]; extra-trusted-public-keys = [ "nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20=" + "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=" ]; }; })