daniil-berg
de6c3993cc
Shutdown stalls are hard to debug because journald is torn down mid-way, so late hangs never reach the journal. `modules/shutdown-debug.nix` exposes `local.shutdownDebug.*`: verbose systemd logging routed to kmsg (recoverable from pstore after a forced power-off), an opt-in tty9 debug shell, and a shortened `DefaultTimeoutStopSec` preset (system + user) so a hung unit is killed and logged in seconds instead of spinning at 90s. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
127 lines
4.0 KiB
Nix
127 lines
4.0 KiB
Nix
# Generic system-level config. Reusable across hosts — nothing machine- or
|
|
# user-specific here. The user account, hostname and system.stateVersion live in
|
|
# the per-host inventory (hosts/<host>/), not in this module.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
imports = [ ./shutdown-debug.nix ];
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
# Deduplicate identical store paths via hardlinks.
|
|
nix.settings.auto-optimise-store = true;
|
|
# Weekly GC of generations older than 30 days (frees disk + prunes stale boot
|
|
# entries). Flat age cutoff — Nix has no snapper-style tiered retention.
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
# Bootloader systemd-boot much simpler than GRUB.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
# Show only the newest 5 generations in the boot menu (display cap only; GC
|
|
# above does the actual deletion).
|
|
boot.loader.systemd-boot.configurationLimit = 5;
|
|
|
|
# Use latest kernel.
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
# Configure network connections interactively with nmcli or nmtui.
|
|
networking.networkmanager.enable = true;
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [
|
|
22000 # syncthing sync transport (TCP)
|
|
];
|
|
allowedUDPPorts = [
|
|
22000 # syncthing sync transport (QUIC)
|
|
21027 # syncthing LAN discovery
|
|
];
|
|
};
|
|
|
|
# Time zone. Template default — override per host/region.
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
# Internationalisation properties. Template defaults — override per region.
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
console = {
|
|
font = "Lat2-Terminus16";
|
|
keyMap = "de";
|
|
};
|
|
|
|
# Programs.
|
|
programs.zsh.enable = true;
|
|
programs.hyprland.enable = true;
|
|
programs.dconf.enable = true;
|
|
|
|
# nix-ld: install a stub dynamic linker at the standard FHS path
|
|
# (/lib64/ld-linux-*.so), which NixOS otherwise lacks. Lets unpatched
|
|
# prebuilt binaries run — notably the standalone CPython builds uv downloads
|
|
# and pip wheels with compiled extensions (numpy, pydantic-core, ...). The
|
|
# libraries list is exposed as NIX_LD_LIBRARY_PATH so those binaries find
|
|
# common shared libs; extend it when an import fails with "libFOO.so.N: cannot
|
|
# open shared object file".
|
|
programs.nix-ld = {
|
|
enable = true;
|
|
libraries = with pkgs; [
|
|
stdenv.cc.cc.lib # libstdc++, libgcc_s, libgomp
|
|
zlib # libz
|
|
zstd # libzstd (pyarrow, polars)
|
|
openssl # libssl, libcrypto
|
|
];
|
|
};
|
|
|
|
# Packages installed in system profile.
|
|
environment.systemPackages = with pkgs; [
|
|
curl
|
|
git
|
|
neovim
|
|
wget
|
|
];
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
# Install nice font.
|
|
fonts.packages = with pkgs; [
|
|
nerd-fonts.jetbrains-mono
|
|
];
|
|
|
|
# Enable sound.
|
|
services.pipewire = {
|
|
enable = true;
|
|
alsa.enable = true;
|
|
alsa.support32Bit = true;
|
|
pulse.enable = true;
|
|
};
|
|
security.rtkit.enable = true;
|
|
|
|
# Cache sudo credentials for 30 min per terminal (default 5). Tradeoff: an
|
|
# unlocked, unattended terminal can sudo without re-auth for that window.
|
|
security.sudo.extraConfig = "Defaults timestamp_timeout=30";
|
|
|
|
# Login manager.
|
|
services.greetd = {
|
|
enable = true;
|
|
settings = {
|
|
default_session = {
|
|
command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd start-hyprland";
|
|
user = "greeter";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Unlock the login keyring with the login password at the greetd prompt,
|
|
# so the Secret Service is open without a second passphrase.
|
|
security.pam.services.greetd.enableGnomeKeyring = true;
|
|
|
|
# XDG portals (screen sharing, file pickers, and so on). The GTK portal (for
|
|
# file dialogs) is added at the home-manager layer, not here: home-manager's
|
|
# Hyprland module pins the portal search dir to the user profile, so a portal
|
|
# listed in this system-level extraPortals is never seen. See modules/home.nix.
|
|
xdg.portal = {
|
|
enable = true;
|
|
extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
|
|
};
|
|
}
|