mirror of
https://github.com/Nexoniarz/nexoniarz-config-nixos-laptop.git
synced 2026-11-03 04:24:27 +00:00
654a689fe1
The laptop was still on the Hyprland-era Pantheon commit while the desktop moved to KDE Plasma 6 + Limine and split system.nix into focused modules. This brings over everything that isn't hardware, unchanged, so both machines stay diffable: - Plasma 6 on Wayland with SDDM, Konsole, gruvbox icons, KDE MIME defaults (replaces Pantheon/LightDM; libreoffice-qt6 replaces the GTK build) - Limine bootloader with the gruvbox theme, replacing systemd-boot - system.nix split into boot/networking/locale/nix-settings/security - flakes + nix-command, sysctl hardening extras (yama, tcp_timestamps), geoclue off, captive-portal probe off - package parity: obs-studio, lmms, go, qemu, KDE utilities, lean SDR++ and rtl_433 overrides with hardware.rtl-sdr Hardware and power are adapted rather than copied: - hardware.nix keeps the AMD 680M + RTX 4050 PRIME offload setup, asusd and supergfxd, v4l2loopback webcam and the DualSense ERTM fix; OpenRGB and the desktop's single-GPU block are dropped, keyboard lighting is asusctl - power.nix is new: power-profiles-daemon for Plasma's profile switcher, lid-close handling via the current logind.settings.Login spelling, powertop/acpi, notes on asusctl charge limits - no acpi_enforce_resources=lax, ACPI owns the EC asusd drives here - touchpad defaults, and firewall openings so the hotspot script's shared connection can hand out DHCP/DNS - pinentry-qt instead of the desktop's leftover pinentry-rofi, blueman dropped in favour of Plasma's bluedevil hardware-configuration.nix stays tracked here (unlike the desktop, which gitignores it) since it's the only record of this machine's disk layout. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
1.9 KiB
Nix
52 lines
1.9 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
networking.hostName = "nixos";
|
|
networking.networkmanager.enable = true;
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowPing = true;
|
|
allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
|
|
allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
|
|
allowedTCPPorts = [ 80 443 ];
|
|
|
|
# modules/scripts/hotspot-start.sh brings up an AP with
|
|
# `ipv4.method shared`, which has NetworkManager spawn dnsmasq on the
|
|
# Wi-Fi interface. Without these the hotspot associates but clients never
|
|
# get a lease, because the global firewall drops their DHCP and DNS
|
|
# queries. Scoped to the Wi-Fi interface only ("wl+" is the iptables
|
|
# wildcard, so it covers wlan0/wlp*), and dnsmasq only listens while the
|
|
# hotspot profile is up — the same NIC can't be AP and client at once.
|
|
interfaces."wl+" = {
|
|
allowedUDPPorts = [ 53 67 ];
|
|
allowedTCPPorts = [ 53 ];
|
|
};
|
|
};
|
|
|
|
# DNS-over-TLS via systemd-resolved; NetworkManager defers to it rather
|
|
# than writing its own /etc/resolv.conf.
|
|
networking.nameservers = [ "1.1.1.1#cloudflare-dns.com" "9.9.9.9#dns.quad9.net" ];
|
|
services.resolved = {
|
|
enable = true;
|
|
settings.Resolve = {
|
|
DNSSEC = "allow-downgrade";
|
|
DNSOverTLS = "true";
|
|
};
|
|
};
|
|
networking.networkmanager.dns = "systemd-resolved";
|
|
|
|
# Ethernet stays "stable" (pseudonymous but consistent) so static DHCP
|
|
# reservations on the router keep working; Wi-Fi is fully random, which
|
|
# matters more here than on the desktop — this machine joins other
|
|
# people's networks.
|
|
networking.networkmanager.wifi.macAddress = "random";
|
|
networking.networkmanager.wifi.scanRandMacAddress = true;
|
|
networking.networkmanager.ethernet.macAddress = "stable";
|
|
|
|
# Disable NetworkManager's periodic captive-portal probe.
|
|
networking.networkmanager.settings.connectivity = {
|
|
uri = "";
|
|
interval = 0;
|
|
};
|
|
}
|