{"body":"{ config, pkgs, lib, ... }:\n  let\n    options = import ./options.nix;\n    nixpkgs = lib.cleanSource pkgs.path;\n    channelSources = pkgs.runCommand \"nixos-${config.system.nixos.version}\"\n      { preferLocalBuild = true; }\n      ''\n        mkdir -p $out\n        cp -prd ${nixpkgs.outPath} $out/nixos\n        chmod -R u+w $out/nixos\n        if [ ! -e $out/nixos/nixpkgs ]; then\n          ln -s . $out/nixos/nixpkgs\n        fi\n        echo -n ${config.system.nixos.revision} > $out/nixos/.git-revision\n        echo -n ${config.system.nixos.versionSuffix} > $out/nixos/.version-suffix\n        echo ${config.system.nixos.versionSuffix} | sed -e s/pre// > $out/nixos/svn-revision\n      '';\n  in\n    {\n\n      # Bootloader is IPXE\n      boot.loader.grub.enable = false;\n\n      # Kernel\n      boot.kernelPackages = pkgs.linuxPackages_4_19;\n      boot.kernelParams = [];\n\n      hardware.enableRedistributableFirmware = true;\n\n      # Autoload kernel modules by scanning hardware\n      boot.hardwareScan = true;\n\n      # Kernel modules available for loading for stage 1 boot\n      boot.initrd.supportedFilesystems = [];\n      boot.initrd.kernelModules = [ \"loop\" \"intel_agp\" \"i915\" ];\n      boot.initrd.availableKernelModules = [\n        \"ahci\"\n        \"xhci_pci\"\n        \"nvme\"\n        \"usbhid\"\n        \"usb_storage\"\n        \"sd_mod\"\n        \"uas\"\n        \"squashfs\"\n      ];\n\n      # Kernel modules\n      boot.kernelModules = [ \"kvm-intel\" \"coretemp\" ];\n      boot.supportedFilesystems = [ \"zfs\" \"nfs\" ];\n\n      boot.postBootCommands = ''\n        # After booting, register the contents of the Nix store in the Nix database in the tmpfs.\n        ${config.nix.package}/bin/nix-store --load-db < /nix/store/nix-path-registration\n\n        # nixos-rebuild also requires a \"system\" profile and an /etc/NIXOS tag.\n        touch /etc/NIXOS\n        ${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system\n\n        # Setup the default nix channel\n        if ! [ -e /var/lib/nixos/did-channel-init ]; then\n          echo \"unpacking the NixOS/Nixpkgs sources...\"\n          mkdir -p /nix/var/nix/profiles/per-user/root\n          ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/per-user/root/channels \\\n            -i ${channelSources} --quiet --option build-use-substitutes false\n          mkdir -m 0700 -p /root/.nix-defexpr\n          ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels\n          mkdir -m 0755 -p /var/lib/nixos\n          touch /var/lib/nixos/did-channel-init\n        fi\n\n        # Copy over the current configuration\n        if ! [ -e /etc/nixos/configuration.nix ]; then\n          cp -r -n ${./.}/. /etc/nixos\n        fi\n\n      '';\n\n      boot.runSize = \"50%\"; # /run\n      boot.devShmSize = \"50%\"; # /dev/shm\n      boot.devSize = \"5%\"; # /dev\n\n      boot.zfs.devNodes = \"/dev/disk/by-id\";\n      boot.zfs.forceImportAll = true;\n      boot.zfs.forceImportRoot = true;\n\n      fileSystems = {\n        \"/\" = {\n            fsType = \"tmpfs\";\n            options = [ \"mode=0755\" ];\n        };\n        \"/nix/.ro-store\" = {\n          fsType = \"squashfs\";\n          device = \"../nix-store.squashfs\";\n          options = [ \"loop\" ];\n          neededForBoot = true;\n        };\n        \"/nix/.rw-store\" = {\n          fsType = \"tmpfs\";\n          options = [ \"mode=0755\" ];\n          neededForBoot = true;\n        };\n        \"/nix/store\" = {\n          fsType = \"unionfs-fuse\";\n          device = \"unionfs\";\n          options = [\n            \"allow_other\"\n            \"cow\"\n            \"nonempty\"\n            \"chroot=/mnt-root\"\n            \"max_files=32768\"\n            \"hide_meta_files\" \"dirs=/nix/.rw-store=rw:/nix/.ro-store=ro\" ];\n        };\n        \"/srv\" = {\n          device = \"rpool\";\n          fsType = \"zfs\";\n        };\n        \"/tmp\" = {\n            device = \"rpool/tmp\";\n            fsType = \"zfs\";\n        };\n      }\n      // lib.optionalAttrs (options.bootDevice != null)\n      {\n        \"/boot\" = {\n          device = options.bootDevice;\n          fsType = \"vfat\";\n        };\n      };\n\n      swapDevices = builtins.map (p: { device = p; } ) options.swapDevices;\n\n      # CPU\n      hardware.cpu.intel.updateMicrocode = true;\n      powerManagement.cpuFreqGovernor = \"ondemand\";\n\n      # Video acceleration\n      hardware.opengl.enable = true;\n      hardware.opengl.driSupport = true;\n      hardware.opengl.driSupport32Bit = true;\n      hardware.opengl.extraPackages = [\n        pkgs.vaapiIntel\n        pkgs.vaapiVdpau\n        pkgs.libvdpau-va-gl\n      ];\n\n      # Audio\n      sound.enable = false;\n      sound.mediaKeys.enable = false;\n      hardware.pulseaudio.enable = false;\n\n      # Bluetooth\n      hardware.bluetooth.enable = false;\n\n      # Extra peripherals\n      hardware.u2f.enable = true;\n      hardware.sane.enable = false;\n\n      # Networking\n      networking = rec {\n        hostName = options.systemName;\n        hostId = builtins.substring 0 8 (builtins.hashString \"sha256\" hostName);\n        defaultGateway = \"43.245.163.41\";\n        nameservers = import ./nameservers.nix;\n        firewall = {\n          enable = true;\n          allowPing = true;\n          pingLimit = \"--limit 3/second --limit-burst 5\";\n          allowedTCPPorts = [\n            22    # ssh\n            55555 # five 5s for custom TCP\n          ];\n          allowedUDPPorts = [\n            53 # dnsmasq dns\n            67 # dnsmasq dhcp\n            22 # ssh\n            55555 # five 5s for custom UDP\n          ];\n          rejectPackets = false;\n          logRefusedConnections = true;\n          logRefusedPackets = false;\n          logRefusedUnicastsOnly = false;\n        };\n      };\n\n      time.timeZone = \"Australia/Sydney\";\n\n      i18n = {\n        consoleKeyMap = \"us\";\n        defaultLocale = \"en_AU.UTF-8\";\n      };\n\n      nix.maxJobs = 32;\n      nix.buildCores = 0;\n      nix.useSandbox = true;\n      nix.readOnlyStore = true;\n      nix.autoOptimiseStore = true;\n      nix.extraOptions = ''\n        fsync-metadata = true\n      '';\n      nix.sandboxPaths = [ \"/run/keys\" ];\n\n      nixpkgs.config.allowUnfree = true;\n\n      environment.variables = {\n        GC_INITIAL_HEAP_SIZE = \"1M\";\n      };\n\n      environment.systemPackages = with pkgs; [\n        grub2_efi       # needed for building us?\n        coreutils       # basic shell utilities\n        gnused          # sed\n        gnugrep         # grep\n        gawk            # awk\n        ncurses         # tput (terminal control)\n        iw              # wireless configuration\n        iproute         # ip, tc\n        nettools        # hostname, ifconfig\n        dmidecode       # dmidecode\n        lshw            # lshw\n        pciutils        # lspci, setpci\n        usbutils        # lsusb\n        utillinux       # linux system utilities\n        cryptsetup      # luks\n        mtools          # disk labelling\n        smartmontools   # disk monitoring\n        lm_sensors      # fan monitoring\n        xorg.xbacklight # monitor brightness\n        procps          # ps, top, pidof, vmstat, slabtop, skill, w\n        psmisc          # fuser, killall, pstree, peekfd\n        shadow          # passwd, su\n        mkpasswd        # mkpasswd\n        efibootmgr      # efi management\n        openssh         # ssh\n        gnupg           # encryption/decryption/signing\n        hdparm          # disk info\n        git             # needed for content addressed nixpkgs\n      ];\n\n      # Program configuration\n      programs.zsh.enable = true;\n      programs.zsh.enableCompletion = true;\n      programs.bash.enableCompletion = true;\n      programs.gnupg.agent = { enable = true; enableSSHSupport = true; };\n      programs.mtr.enable = true;\n\n      documentation.enable = false;\n      documentation.nixos.enable = false;\n\n      # Virtualisation\n      virtualisation.libvirtd.enable = true;\n      virtualisation.docker = {\n        enable = true;\n        enableNvidia = true;\n      };\n\n      services = {\n        mingetty = {\n          greetingLine = ''[[[ \\l @ \\n (\\s \\r \\m) ]]]'';\n          autologinUser = options.operator;\n        };\n        gpm.enable = true;\n        avahi.enable = true;\n        kmscon.enable = true;\n        kmscon.hwRender = true;\n        dbus.enable = true;\n        haveged.enable = true;\n        locate.enable = true;\n        cron.enable = false;\n        openssh = {\n          enable = true;\n          startWhenNeeded = true;\n          permitRootLogin = \"no\";\n          passwordAuthentication = false;\n          forwardX11 = true;\n          allowSFTP = true;\n          gatewayPorts = \"clientspecified\";\n          ports = [ 22 ];\n          extraConfig = ''\n            PrintLastLog no\n          '';\n        };\n        xserver = {\n          enable = false;\n          videoDrivers = [ \"intel\" \"nvidia\" ];};\n      };\n\n      users = {\n        defaultUserShell = \"/run/current-system/sw/bin/zsh\";\n        enforceIdUniqueness = true;\n        users = {\n          \"${options.operator}\" = {\n            isNormalUser = true;\n            extraGroups = [ \"wheel\" \"networkmanager\" \"video\" \"docker\" ];\n            initialHashedPassword = \"\";\n          };\n          root = {\n            initialHashedPassword = \"\";\n          };\n        };\n      };\n\n      # Security\n      security.sudo.wheelNeedsPassword = false;\n      security.sudo.extraConfig = ''\n        Defaults umask = 0022\n        Defaults umask_override\n      '';\n\n      environment.etc.\"os-release\".text = pkgs.lib.mkForce ''\n        NAME=\"${options.systemDesc}\"\n        ID=\"${options.systemName}\"\n      '';\n\n      system.nixos = {\n        versionSuffix = lib.trivial.versionSuffix;\n        revision = lib.removePrefix \".git.\" lib.trivial.versionSuffix;\n      };\n\n      system.build = {\n        squashfsStore = pkgs.callPackage (pkgs.path + \"/nixos/lib/make-squashfs.nix\") {\n          storeContents = [ config.system.build.toplevel ];\n        };\n        netbootRamdisk = pkgs.makeInitrd {\n          inherit (config.boot.initrd) compressor;\n          prepend = [ \"${config.system.build.initialRamdisk}/initrd\" ];\n          contents = [\n            {\n              object = config.system.build.squashfsStore;\n              symlink = \"/nix-store.squashfs\";\n            }\n          ];\n        };\n        netbootIpxeScript = pkgs.writeTextDir \"netboot.ipxe\" ''\n          #!ipxe\n          kernel ${pkgs.stdenv.hostPlatform.platform.kernelTarget} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams}\n          imgverify bzImage bzImage.sig\n          initrd initrd\n          imgverify initrd initrd.sig\n          boot\n        '';\n      };\n\n    }\n","name":"","extension":"txt","url":"https://www.irccloud.com/pastebin/7zt0bQ2t","modified":1574232959,"id":"7zt0bQ2t","size":10560,"lines":343,"own_paste":false,"theme":"","date":1574232959}