Harden NixOS config defaults and setup guidance #4
24
README.md
24
README.md
@@ -52,18 +52,18 @@ mkdir -p hosts/<hostname>
|
||||
cp /etc/nixos/hardware-configuration.nix hosts/<hostname>/
|
||||
```
|
||||
|
||||
### 2. Replace Placeholders
|
||||
### 2. Review Configuration Defaults
|
||||
|
||||
Edit the following files and replace these placeholders:
|
||||
Defaults are set in `flake.nix` and used across modules. Update them there:
|
||||
|
||||
| Placeholder | Example Value | Files |
|
||||
|-------------|---------------|-------|
|
||||
| `<hostname>` | `desktop` | `flake.nix`, `modules/common.nix` |
|
||||
| `<username>` | `john` | `modules/common.nix`, `modules/dev.nix`, `modules/gaming.nix` |
|
||||
| `<timezone>` | `America/New_York` | `modules/common.nix` |
|
||||
| `<locale>` | `en_US.UTF-8` | `modules/common.nix` |
|
||||
| Setting | Example Value | File |
|
||||
|---------|---------------|------|
|
||||
| `hostname` | `desktop` | `flake.nix` |
|
||||
| `username` | `john` | `flake.nix` |
|
||||
| `time.timeZone` | `America/New_York` | `modules/common.nix` |
|
||||
| `i18n.defaultLocale` | `en_US.UTF-8` | `modules/common.nix` |
|
||||
|
||||
Also rename the `hosts/hostname/` directory to match your actual hostname, and ensure the same hostname is used for all `<hostname>` placeholders (including in `flake.nix`).
|
||||
Also rename the `hosts/<hostname>/` directory to match your actual hostname, and ensure the same hostname is set in `flake.nix`.
|
||||
|
||||
### 3. Stage Files in Git
|
||||
|
||||
@@ -136,10 +136,10 @@ sudo nixos-rebuild boot --profile-name gaming --flake .#gaming
|
||||
|
||||
### Change Password
|
||||
|
||||
Generate a password hash and update `modules/common.nix`:
|
||||
Generate a password hash and save it to `/etc/nixos/secrets/<username>/password.hash`:
|
||||
```bash
|
||||
mkpasswd -m sha-512
|
||||
# Copy the output and replace <replace-with-password-hash> in common.nix
|
||||
# Save the output to /etc/nixos/secrets/<username>/password.hash with 600 permissions
|
||||
```
|
||||
|
||||
### Setup MangoWC
|
||||
@@ -225,4 +225,4 @@ cat /proc/sys/vm/max_map_count # Should be 2147483642 on gaming profile
|
||||
|
||||
## License
|
||||
|
||||
MIT
|
||||
MIT
|
||||
|
||||
@@ -37,15 +37,18 @@
|
||||
outputs = { self, nixpkgs, mango, quickshell, noctalia, nix-gaming, home-manager, ... }@inputs:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
hostname = "atlas";
|
||||
username = "pinj";
|
||||
lib = nixpkgs.lib;
|
||||
specialArgs = { inherit inputs system; };
|
||||
hostConfig = ./hosts + "/${hostname}/hardware-configuration.nix";
|
||||
specialArgs = { inherit inputs system hostname username; };
|
||||
|
||||
|
|
||||
# Verify mango flake exports the expected module
|
||||
mangoModule = assert lib.hasAttrByPath [ "nixosModules" "mango" ] mango;
|
||||
mango.nixosModules.mango;
|
||||
|
||||
commonModules = [
|
||||
The assertion for The assertion for `hostConfig` will fail at evaluation time with a cryptic error if the path doesn't exist. The assert statement should provide a helpful error message to guide users. Consider using a let-binding with an abort statement that provides a clear message like: "Hardware configuration not found at ./hosts/${hostname}/hardware-configuration.nix. Please ensure the directory exists and contains the hardware configuration file."
```suggestion
hostConfig =
let
hardwarePath = ./hosts + "/${hostname}/hardware-configuration.nix";
in
if builtins.pathExists hardwarePath then
hardwarePath
else
builtins.abort "Hardware configuration not found at ./hosts/${hostname}/hardware-configuration.nix. Please ensure the directory exists and contains the hardware configuration file.";
```
|
||||
./hosts/atlas/hardware-configuration.nix
|
||||
hostConfig
|
||||
|
The The `passwordHashPath` is hardcoded to a system location that may not exist on first installation, but there's no validation or assertion to check if this file exists. This will cause the system build to fail with an unclear error. Consider adding an assertion in `common.nix` to check if the password hash file exists, with a helpful error message directing users to the password setup instructions in the README. Alternatively, document that users must create this file before their first build.
```suggestion
passwordHashPath =
let
path = "/etc/nixos/secrets/${username}/password.hash";
in
if builtins.pathExists path then
path
else
builtins.throw ''
Password hash file not found at ${path}.
Please create this file before your first build.
See the password setup instructions in the project README.
'';
```
|
||||
./modules/common.nix
|
||||
mangoModule
|
||||
# Home Manager module - Foundation for user-level package management
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, inputs, system, ... }:
|
||||
{ config, pkgs, inputs, system, hostname, username, ... }:
|
||||
|
||||
{
|
||||
# --------------------------------------------------------------------------
|
||||
@@ -10,7 +10,7 @@
|
||||
# --------------------------------------------------------------------------
|
||||
# SYSTEM
|
||||
# --------------------------------------------------------------------------
|
||||
networking.hostName = "atlas";
|
||||
networking.hostName = hostname;
|
||||
time.timeZone = "Europe/Berlin";
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
@@ -57,12 +57,11 @@
|
||||
# RADV (Mesa) is the default and performs better for gaming
|
||||
};
|
||||
|
||||
# RADV is already the default Vulkan driver
|
||||
# This variable is optional but makes it explicit
|
||||
environment.variables.AMD_VULKAN_ICD = "RADV";
|
||||
|
||||
# Wayland session variables for proper app integration
|
||||
environment.sessionVariables = {
|
||||
# RADV is already the default Vulkan driver
|
||||
# This variable is optional but makes it explicit
|
||||
AMD_VULKAN_ICD = "RADV";
|
||||
QT_QPA_PLATFORM = "wayland";
|
||||
MOZ_ENABLE_WAYLAND = "1";
|
||||
NIXOS_OZONE_WL = "1"; # Electron apps (VS Code, Discord, etc.)
|
||||
@@ -101,19 +100,19 @@
|
||||
enable = true;
|
||||
settings.default_session = {
|
||||
command = "mango";
|
||||
user = "pinj";
|
||||
user = username;
|
||||
};
|
||||
};
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# USER ACCOUNT
|
||||
# --------------------------------------------------------------------------
|
||||
users.users.pinj = {
|
||||
users.users.${username} = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "networkmanager" "video" "seat" ];
|
||||
# IMPORTANT: Generate a password hash with: mkpasswd -m sha-512
|
||||
# Then replace the placeholder below with the generated hash
|
||||
hashedPassword = "<replace-with-password-hash>";
|
||||
# Save it to the path below (ensure permissions are 600)
|
||||
hashedPasswordFile = "/etc/nixos/secrets/${username}/password.hash";
|
||||
packages = with pkgs; [
|
||||
# -- Noctalia Shell --
|
||||
inputs.quickshell.packages.${system}.default
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ pkgs, ... }:
|
||||
{ pkgs, username, ... }:
|
||||
|
||||
{
|
||||
# Identification tag (shows in boot menu and `nixos-version`)
|
||||
@@ -24,7 +24,7 @@
|
||||
|
||||
# NOTE: After first enabling/applying this dev profile, you must log out and
|
||||
# log back in (or reboot) for the docker group membership to take effect.
|
||||
users.users.pinj.extraGroups = [ "docker" ];
|
||||
users.users.${username}.extraGroups = [ "docker" ];
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# DEVELOPMENT TOOLS
|
||||
@@ -34,7 +34,7 @@
|
||||
nix-direnv.enable = true; # Caches nix shells
|
||||
};
|
||||
|
||||
users.users.pinj.packages = with pkgs; [
|
||||
users.users.${username}.packages = with pkgs; [
|
||||
# -- Git --
|
||||
lazygit
|
||||
gh # GitHub CLI
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ pkgs, inputs, ... }:
|
||||
{ pkgs, inputs, username, ... }:
|
||||
|
||||
{
|
||||
# Identification tags (shows in boot menu)
|
||||
@@ -62,12 +62,12 @@
|
||||
# programs to function correctly. These groups are only added when using
|
||||
# the gaming profile. If you need consistent group membership across
|
||||
# both profiles, add these groups to common.nix instead.
|
||||
users.users.pinj.extraGroups = [ "corectrl" "gamemode" ];
|
||||
users.users.${username}.extraGroups = [ "corectrl" "gamemode" ];
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# GAMING PACKAGES
|
||||
# --------------------------------------------------------------------------
|
||||
users.users.pinj.packages = with pkgs; [
|
||||
users.users.${username}.packages = with pkgs; [
|
||||
# -- Performance Overlays --
|
||||
mangohud # FPS counter, GPU stats
|
||||
goverlay # MangoHud GUI config
|
||||
|
||||
Reference in New Issue
Block a user
The username validation regex allows usernames that consist only of underscores followed by other characters (e.g., "___abc"), but the second check
builtins.match "^_+$" username == nullonly rejects usernames that are entirely underscores. According to standard Unix username conventions, usernames starting with underscore are typically reserved for system accounts. Consider strengthening the validation to reject any username starting with underscore unless that's intentionally allowed for system accounts.