bdf20f2d8e
Harden the hardware-enablement broad seed for newer hardware: - xe vs i915: intel.guc emits the i915 param (i915.enable_guc=3), which the newer `xe` driver (Lunar Lake / Battlemage / Panther Lake, recent Xe GPUs) ignores — it enables GuC by default. hardware-db.sh now reads the in-use GPU driver (lspci -k) and writes `intel.guc = false` on xe hardware, so the toggle isn't a misleading no-op there. - NPU detection by PCI accelerator class [1200] (+ keywords), attributing the vendor, instead of a fixed device-ID list — so new NPUs (e.g. Panther Lake) are caught without a code change. Known IDs kept as a fallback/reference. - Kernel awareness: a nomarchy.hardware.latestKernel escape hatch (linuxPackages_latest) for very-new hardware whose drivers only just landed, and a build-time warning when npu.enable predates the shipped kernel (amdxdna needs 6.14+, intel_vpu wants recent). Downstream default is 6.18, which already carries amd-pstate + amdxdna; the reference host pins latest. - VM test (checks.hardware-toggles, pkgs.testers.runNixOSTest): boots a minimal VM with the toggles on and asserts the config landed — amd_pstate + i915.enable_guc in /proc/cmdline, fprintd.service present, pam_fprintd in /etc/pam.d/sudo. Passing. (Hardware behaviour still needs bare metal.) Docs: README + template note latestKernel; ROADMAP records the hardening. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
71 lines
4.1 KiB
Nix
71 lines
4.1 KiB
Nix
# Your machine: bootloader, hostname, users, services.
|
|
# The distro itself comes from nomarchy.nixosModules.nomarchy — override
|
|
# any of its defaults here with plain NixOS options (they use mkDefault),
|
|
# or via the nomarchy.system.* toggles.
|
|
{ pkgs, username, ... }:
|
|
|
|
{
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
networking.hostName = "my-nomarchy";
|
|
time.timeZone = "UTC";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
# Your login user — `username` flows in from flake.nix automatically.
|
|
users.users.${username} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "networkmanager" "video" "input" ];
|
|
};
|
|
|
|
# ── Overrides (uncomment to change) ─────────────────────────────────
|
|
# nomarchy.system.greeter.enable = false; # bring your own login manager
|
|
# environment.systemPackages = [ pkgs.htop ];
|
|
|
|
# ── Opt-in features — uncomment and tweak to enable ─────────────────
|
|
# nomarchy.system.power = { # active power management (laptops)
|
|
# enable = true;
|
|
# backend = "ppd"; # "ppd" (default) or "tlp"
|
|
# laptop = true; # required by batteryChargeLimit
|
|
# batteryChargeLimit = 80; # cap charging for longevity
|
|
# thermal.enable = true; # thermald (Intel CPUs)
|
|
# };
|
|
#
|
|
# nomarchy.hardware = { # enablement above nixos-hardware (installer-detected)
|
|
# intel.enable = true; # GuC/HuC firmware; installer sets this on Intel
|
|
# intel.computeRuntime = true; # OpenCL/oneVPL GPU compute (opt-in)
|
|
# amd.enable = true; # amd-pstate + radeonsi VA-API; installer-set on AMD
|
|
# amd.rocm.enable = true; # ROCm GPU compute (multi-GB, opt-in)
|
|
# amd.rocm.gfxOverride = "11.0.0"; # HSA override for an unlisted iGPU
|
|
# fingerprint.enable = true; # fprintd; installer-set when a reader is detected
|
|
# fingerprint.pam = true; # use the fingerprint for login + sudo
|
|
# npu.enable = true; # on-die NPU driver (experimental; userspace runtime BYO)
|
|
# latestKernel = true; # newest kernel for very-new hardware (drivers not yet in the default)
|
|
# };
|
|
#
|
|
# nomarchy.services.tailscale.enable = true; # mesh VPN — then `sudo tailscale up`
|
|
# nomarchy.services.syncthing.enable = true; # file sync — GUI at http://127.0.0.1:8384
|
|
# nomarchy.services.podman.enable = true; # rootless containers (docker → podman)
|
|
# nomarchy.services.flatpak.enable = true; # Flatpak + the Flathub remote
|
|
# nomarchy.services.pika.enable = true; # Pika Backup (GUI Borg backups)
|
|
# nomarchy.services.steam.enable = true; # Steam (32-bit libs, controllers, ports)
|
|
# nomarchy.services.libvirt.enable = true; # libvirt/KVM + virt-manager GUI
|
|
# nomarchy.services.obs.enable = true; # OBS Studio + v4l2loopback virtual camera
|
|
# nomarchy.services.docker.enable = true; # Docker rootful (not alongside podman)
|
|
# nomarchy.services.kdeconnect.enable = true;# KDE Connect phone integration (opens ports)
|
|
# nomarchy.services.gamemode.enable = true; # Feral GameMode performance daemon
|
|
# nomarchy.services.adb.enable = true; # Android adb/fastboot tools
|
|
# nomarchy.services.wireshark.enable = true; # Wireshark GUI (wireshark group, no root)
|
|
# nomarchy.services.ollama.enable = true; # local LLM runtime (127.0.0.1:11434)
|
|
# nomarchy.services.printing.enable = true; # CUPS + Avahi network printer discovery
|
|
# nomarchy.services.openrgb.enable = true; # RGB peripheral/motherboard lighting daemon
|
|
# nomarchy.services.restic = { # scheduled (daily) restic backup
|
|
# enable = true;
|
|
# repository = "/mnt/backup/restic"; # path or URL (sftp:/b2:/…)
|
|
# passwordFile = "/etc/nomarchy/restic-password"; # absolute path, NOT in the flake
|
|
# paths = [ "/home" ];
|
|
# };
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|