madsludvig/dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update

Browse source
This commit is contained in:
Mads Fagerlund 2026-09-07 23:17:20 +02:00
parent 84cc8fe6a2
commit d63aed1aa6
No known key found for this signature in database
4 changed files with 78 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
firmware/README.md
View file

@ -1,15 +1,18 @@
# Asahi peripheral firmware (vendored)
`hardware.asahi.peripheralFirmwareDirectory` points here. A **pure** flake
cannot read `/boot/asahi`, so the Wi-Fi/Bluetooth firmware must live inside the
repo tree and be git-tracked.
cannot read `/boot/vendorfw`, so the Wi-Fi/Bluetooth firmware must live inside
the repo tree and be git-tracked.
Since nixos-apple-silicon 66d8dd2 the module expects the pre-extracted
`firmware.cpio` (placed on the ESP by the Asahi installer) instead of
`all_firmware.tar.gz` + `kernelcache.*`.
## During install, on the Mac:
```sh
cp /boot/asahi/all_firmware.tar.gz ~/.dotfiles/firmware/
cp /boot/asahi/kernelcache* ~/.dotfiles/firmware/
git -C ~/.dotfiles add -f firmware/all_firmware.tar.gz firmware/kernelcache*
cp /boot/vendorfw/firmware.cpio ~/.dotfiles/firmware/
git -C ~/.dotfiles add -f firmware/firmware.cpio
```
(They're `.gitignore`-exempt via `-f` if needed — but the flake only sees

BIN
firmware/firmware.cpio Normal file
View file

Binary file not shown.

30
flake.lock
View file

@ -8,11 +8,11 @@
]
},
"locked": {
"lastModified": 1782749693,
"narHash": "sha256-Dj2m93PXWyOoXyp9tQlyjtBPbpVobKUrgnVDNNsNT1o=",
"lastModified": 1785426242,
"narHash": "sha256-QHAP8KsJQmI+dpNS/wfWAtEBQ0Zby+B0Ty+qZIO/U2w=",
"owner": "nix-community",
"repo": "nixos-apple-silicon",
"rev": "b6ed8c114eee6739e3a2c06d99e2e19ac608dedf",
"rev": "66d8dd2c27f99bd5420c99938b60695aac1785c4",
"type": "github"
},
"original": {
@ -29,11 +29,11 @@
},
"locked": {
"dir": "pkgs/firefox-addons",
"lastModified": 1782878575,
"narHash": "sha256-sw0B1D//VBGXLQZJXXFLjunnMfO7hCZ5S1kv06BBO5A=",
"lastModified": 1786334532,
"narHash": "sha256-C/efnaEGK18irNAyDM7JtNG6QhMNewTTp/JZNdyStWs=",
"owner": "rycee",
"repo": "nur-expressions",
"rev": "e5d8f0375b4613d200e8efd64df2183a75290c4e",
"rev": "89326e8b272f25875f3dbebe3ec2b510016f57e0",
"type": "gitlab"
},
"original": {
@ -65,11 +65,11 @@
]
},
"locked": {
"lastModified": 1782881387,
"narHash": "sha256-HvlS1KDGXDjd1bNzzPvH1mkDJATlDAfVYfTh//wJBEA=",
"lastModified": 1786356609,
"narHash": "sha256-ou8fYz5w9yhXC8YbvvExybFIa19MyW5G/8dEPqa90hM=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "d32537981c036473cf6990ae03176a5d84c43b29",
"rev": "c30c7955cec30d664a9baced6bc0112e263d4647",
"type": "github"
},
"original": {
@ -80,11 +80,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1782723713,
"narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
"lastModified": 1786106723,
"narHash": "sha256-zDSUbpoeo/9ZmD2+wXnzxoo1+uhL8vxc0b8yuYMKYq0=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
"rev": "f13ff45afd1bb73e640eaa08a7066dbed07e3238",
"type": "github"
},
"original": {
@ -113,11 +113,11 @@
]
},
"locked": {
"lastModified": 1782812215,
"narHash": "sha256-OPVK9WW9QsO2aj1R+Ln3p7fniFj5h441vb3LyrzpeE4=",
"lastModified": 1786347712,
"narHash": "sha256-yH+jWXH2TVd5h3J5KoZiE8/4O4HqoggfB0zl9uVj39w=",
"owner": "0xc000022070",
"repo": "zen-browser-flake",
"rev": "a7c2a9a5e492e0e62072547f7e4c2abf138425c5",
"rev": "945efbc704b7f8c1731a922aabbc5d95edc9eb74",
"type": "github"
},
"original": {

58
flake.nix
View file

@ -96,6 +96,7 @@
};
home.pointerCursor = {
enable = true;
package = pkgs.bibata-cursors;
name = "Bibata-Modern-Ice";
size = 24;
@ -179,6 +180,8 @@
};
programs.starship.enable = true;
# SSH auth via the 1Password agent — private keys stay in the vault,
# never on disk or in the Nix store.
programs.ssh = {
@ -211,9 +214,42 @@
# ───────────────────── shared system (both hosts) ─────────────────────
common = { pkgs, ... }: {
nix.settings.experimental-features = [ "nix-command" "flakes" ];
# Trusted so client-side nix config takes effect — the deepvis repo's
# flake nixConfig advertises the team dev cache (attic on the builder,
# over the tailnet), and the daemon ignores it for untrusted users.
nix.settings.trusted-users = [ "mads" ];
# x86_64 derivations build on the build host instead of under local
# qemu emulation — anything the dev cache doesn't already have ships
# there as a remote build (tailnet; the builder's `builder` user
# exists for exactly this).
#
# The host key is pinned system-wide because the ssh'ing party is the
# root daemon, which has no known_hosts and never gets a tty to
# answer a trust prompt.
programs.ssh.knownHosts."builder" = {
extraHostNames = [ "5.9.71.104" "builder.tailf5eaab.ts.net" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHnKIrxYtlovvYGgkpEZXY8wG/CuSLMGOM/84eIlyeVW";
};
nix.distributedBuilds = true;
nix.buildMachines = [{
hostName = "builder";
sshUser = "builder";
# The daemon (root) does the ssh'ing, so it needs an explicit
# on-disk key — it has no access to a user's agent.
sshKey = "/home/mads/.ssh/id_ed25519";
protocol = "ssh-ng";
system = "x86_64-linux";
maxJobs = 16;
supportedFeatures = [ "big-parallel" "kvm" "nixos-test" ];
}];
networking.networkmanager.enable = true;
networking.networkmanager.wifi.backend = "wpa_supplicant";
networking.networkmanager.wifi.backend = "iwd";
# Secret Service (org.freedesktop.secrets) provider, D-Bus-activated on
# demand. Without it 1Password can't persist the 2FA device token
# ("unable to save your two-factor token") and re-prompts every unlock.
services.gnome.gnome-keyring.enable = true;
programs._1password.enable = true;
programs._1password-gui = {
@ -304,17 +340,33 @@
# Wi-Fi/BT firmware, vendored (a pure flake can't read /boot/asahi).
hardware.asahi.peripheralFirmwareDirectory = ./firmware;
hardware.asahi.enable = true;
boot.loader.systemd-boot.enable = true;
boot.loader.systemd-boot.configurationLimit = 3; # 500M ESP is small
boot.extraModprobeConfig = "options hid_apple fnmode=1";
boot.blacklistedKernelModules = [ "pcspkr" ];
# Asahi kernel + Mesa cache (else compile from source).
# Build x86_64 derivations (packing-station iso/deploys) via qemu.
boot.binfmt.emulatedSystems = [ "x86_64-linux" ];
# Resolve .local names, so the packing stations can be reached and
# deployed to by hostname instead of by address.
services.avahi = {
enable = true;
nssmdns4 = true;
};
# Asahi kernel + Mesa cache, and the Raspberry Pi vendor
# kernel/firmware cache (else both compile from source).
nix.settings = {
extra-substituters = [ "https://nixos-apple-silicon.cachix.org" ];
extra-substituters = [
"https://nixos-apple-silicon.cachix.org"
"https://nixos-raspberrypi.cachix.org"
];
extra-trusted-public-keys = [
"nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20="
"nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
];
};
})