diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..04b1b88 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +# Local sensitive source files (do not push) +secrets/users/*.source diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..41504d9 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,5 @@ +creation_rules: + - path_regex: ^secrets/users/.*\.ya?ml$ + key_groups: + - age: + - age1REPLACE_WITH_YOUR_AGE_PUBLIC_KEY diff --git a/README.md b/README.md new file mode 100644 index 0000000..bdc77bc --- /dev/null +++ b/README.md @@ -0,0 +1,18 @@ +# 📦 nixos 配置仓库 + +基于 Flake 的 NixOS 多主机配置。 + +## 🌲 目录树 +```text +📦 nixos +├─ 🏠 home/ # Home Manager 用户配置（default.nix 聚合） +├─ 🖥️ hosts/ # 主机入口 +├─ 🧩 lib/ # 公共函数（mkHost） +├─ 🧱 modules/ # 系统模块（core/server/wsl） +├─ 🎨 overlays/ # 包覆盖 +├─ 📚 profiles/ # 场景组合（desktop/server/wsl） +└─ 🔐 secrets/ # sops 密钥模板与密文 +``` + +## 🔗 引用关系 +`flake.nix` -> `lib/hosts.nix` + `lib/mkHost.nix` -> `hosts/*` + `profiles/*` -> `modules/*/default.nix` -> 子模块 diff --git a/flake.nix b/flake.nix index df68503..7cca9cc 100644 --- a/flake.nix +++ b/flake.nix @@ -2,10 +2,10 @@ description = "My Infra"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05"; home-manager = { - url = "github:nix-community/home-manager"; + url = "github:nix-community/home-manager/release-25.05"; inputs.nixpkgs.follows = "nixpkgs"; }; @@ -17,35 +17,24 @@ nixos-wsl.url = "github:nix-community/NixOS-WSL/main"; vscode-server.url = "github:nix-community/nixos-vscode-server"; + + sops-nix = { + url = "github:Mic92/sops-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; - outputs = inputs@{ self, nixpkgs, home-manager, ... }: + outputs = inputs@{ nixpkgs, home-manager, ... }: let + username = "luochen570"; + hosts = import ./lib/hosts.nix; mkHost = import ./lib/mkHost.nix { inherit nixpkgs home-manager inputs; }; + mkConfiguredHost = hostname: cfg: mkHost ({ + inherit hostname username; + } // cfg); in { - - nixosConfigurations = { - - desktop = mkHost { - hostname = "desktop"; - system = "x86_64-linux"; - profile = "desktop"; - }; - - server = mkHost { - hostname = "server"; - system = "x86_64-linux"; - profile = "server"; - }; - - wsl = mkHost { - hostname = "wsl"; - system = "x86_64-linux"; - profile = "wsl"; - }; - - }; + nixosConfigurations = nixpkgs.lib.mapAttrs mkConfiguredHost hosts; }; -} \ No newline at end of file +} diff --git a/home/README.md b/home/README.md new file mode 100644 index 0000000..545d608 --- /dev/null +++ b/home/README.md @@ -0,0 +1,13 @@ +# 🏠 home 目录说明 + +Home Manager 用户级配置目录。 + +## 🌲 目录树 +```text +🏠 home +├─ 📦 default.nix # 聚合入口，统一 imports +├─ 📝 git.nix # Git 配置 +├─ 🔐 ssh.nix # SSH 配置（从 sops secret 链接） +├─ 💻 zsh.nix # Zsh 与插件 +└─ ✨ nvchad.nix # Neovim(NvChad) +``` diff --git a/home/default.nix b/home/default.nix new file mode 100644 index 0000000..85deb08 --- /dev/null +++ b/home/default.nix @@ -0,0 +1,9 @@ +{ ... }: +{ + imports = [ + ./git.nix + ./ssh.nix + ./zsh.nix + ./nvchad.nix + ]; +} diff --git a/home/git.nix b/home/git.nix index b8d06bf..bbc9b55 100644 --- a/home/git.nix +++ b/home/git.nix @@ -1,5 +1,6 @@ -{ # Git - programs.git = { +{ ... }: +{ + programs.git = { enable = true; settings = { user = { @@ -9,4 +10,4 @@ init.defaultBranch = "main"; }; }; -} \ No newline at end of file +} diff --git a/home/ssh.nix b/home/ssh.nix new file mode 100644 index 0000000..6d61ac8 --- /dev/null +++ b/home/ssh.nix @@ -0,0 +1,8 @@ +{ config, ... }: +{ + programs.ssh.enable = true; + + # ~/.ssh/config comes from a sops secret file. + home.file.".ssh/config".source = + config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config"; +} diff --git a/hosts/README.md b/hosts/README.md new file mode 100644 index 0000000..f09094e --- /dev/null +++ b/hosts/README.md @@ -0,0 +1,23 @@ +# 🖥️ hosts 目录说明 + +主机入口层。每台主机目录固定为三文件结构： +- `default.nix`：统一入口，导入 `configuration.nix` +- `configuration.nix`：主机配置（profile + hostName + 机器项） +- `README.md`：目录说明 + +## 🌲 目录树 +```text +🖥️ hosts +├─ 🧑‍💻 desktop/ +│ ├─ 🧩 default.nix +│ ├─ ⚙️ configuration.nix +│ └─ 📝 README.md +├─ 🗄️ server/ +│ ├─ 🧩 default.nix +│ ├─ ⚙️ configuration.nix +│ └─ 📝 README.md +└─ 🪟 wsl/ + ├─ 🧩 default.nix + ├─ ⚙️ configuration.nix + └─ 📝 README.md +``` diff --git a/hosts/desktop/README.md b/hosts/desktop/README.md new file mode 100644 index 0000000..1c514e1 --- /dev/null +++ b/hosts/desktop/README.md @@ -0,0 +1,11 @@ +# 🧑‍💻 hosts/desktop + +桌面主机入口。 + +## 🌲 目录树 +```text +🧑‍💻 hosts/desktop +├─ 🧩 default.nix # 主机入口，引用 configuration.nix +├─ ⚙️ configuration.nix # profile + hostName + 机器相关配置 +└─ 📝 README.md +``` diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix new file mode 100644 index 0000000..0925398 --- /dev/null +++ b/hosts/desktop/configuration.nix @@ -0,0 +1,11 @@ +{ ... }: +{ + imports = [ + ../../profiles/desktop.nix + ]; + + networking.hostName = "desktop"; + + # Machine-specific config generated by nixos-generate-config can be + # merged here: disk layout, boot loader, filesystem, hardware options. +} diff --git a/hosts/desktop/default.nix b/hosts/desktop/default.nix new file mode 100644 index 0000000..0167962 --- /dev/null +++ b/hosts/desktop/default.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + imports = [ + ./configuration.nix + ]; +} diff --git a/hosts/server/README.md b/hosts/server/README.md new file mode 100644 index 0000000..0d689f1 --- /dev/null +++ b/hosts/server/README.md @@ -0,0 +1,11 @@ +# 🗄️ hosts/server + +服务器主机入口。 + +## 🌲 目录树 +```text +🗄️ hosts/server +├─ 🧩 default.nix # 主机入口，引用 configuration.nix +├─ ⚙️ configuration.nix # profile + hostName + 机器相关配置 +└─ 📝 README.md +``` diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix new file mode 100644 index 0000000..0e8b222 --- /dev/null +++ b/hosts/server/configuration.nix @@ -0,0 +1,11 @@ +{ ... }: +{ + imports = [ + ../../profiles/server.nix + ]; + + networking.hostName = "server"; + + # Machine-specific config generated by nixos-generate-config can be + # merged here: disk layout, boot loader, filesystem, hardware options. +} diff --git a/hosts/server/default.nix b/hosts/server/default.nix index 440ed0b..e9e51d9 100644 --- a/hosts/server/default.nix +++ b/hosts/server/default.nix @@ -2,9 +2,6 @@ { imports = [ - ./hardware.nix - ../../profiles/server.nix + ./configuration.nix ]; - - networking.hostName = "server"; -} \ No newline at end of file +} diff --git a/hosts/wsl/README.md b/hosts/wsl/README.md new file mode 100644 index 0000000..9ac7af1 --- /dev/null +++ b/hosts/wsl/README.md @@ -0,0 +1,11 @@ +# 🪟 hosts/wsl + +WSL 主机入口。 + +## 🌲 目录树 +```text +🪟 hosts/wsl +├─ 🧩 default.nix # 主机入口，引用 configuration.nix +├─ ⚙️ configuration.nix # profile + hostName（可加 WSL 机器项） +└─ 📝 README.md +``` diff --git a/hosts/wsl/configuration.nix b/hosts/wsl/configuration.nix new file mode 100644 index 0000000..b90fa9c --- /dev/null +++ b/hosts/wsl/configuration.nix @@ -0,0 +1,10 @@ +{ ... }: +{ + imports = [ + ../../profiles/wsl.nix + ]; + + networking.hostName = "nixos-wsl"; + + # Keep minimal for WSL. Add machine-specific options here if needed. +} diff --git a/hosts/wsl/default.nix b/hosts/wsl/default.nix new file mode 100644 index 0000000..0167962 --- /dev/null +++ b/hosts/wsl/default.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + imports = [ + ./configuration.nix + ]; +} diff --git a/lib/README.md b/lib/README.md new file mode 100644 index 0000000..22532b7 --- /dev/null +++ b/lib/README.md @@ -0,0 +1,10 @@ +# 🧩 lib 目录说明 + +公共函数目录。 + +## 🌲 目录树 +```text +🧩 lib +├─ ⚙️ mkHost.nix # 组装 NixOS system 与 Home Manager（接收 username） +└─ 📋 hosts.nix # 主机清单（system/profile 映射） +``` diff --git a/lib/hosts.nix b/lib/hosts.nix new file mode 100644 index 0000000..1d532ef --- /dev/null +++ b/lib/hosts.nix @@ -0,0 +1,16 @@ +{ + desktop = { + system = "x86_64-linux"; + profile = "desktop"; + }; + + server = { + system = "x86_64-linux"; + profile = "server"; + }; + + wsl = { + system = "x86_64-linux"; + profile = "wsl"; + }; +} diff --git a/lib/mkHost.nix b/lib/mkHost.nix index 9813558..d07cec2 100644 --- a/lib/mkHost.nix +++ b/lib/mkHost.nix @@ -1,11 +1,35 @@ -{ nixpkgs, home-manager, system }: - -name: modules: +{ nixpkgs, home-manager, inputs }: +{ + hostname, + system, + profile, + username, + extraModules ? [ ], + extraSpecialArgs ? { }, +}: nixpkgs.lib.nixosSystem { inherit system; + specialArgs = { + inherit inputs system username; + } // extraSpecialArgs; - modules = - modules ++ [ - home-manager.nixosModules.home-manager - ]; -} \ No newline at end of file + modules = [ + inputs.sops-nix.nixosModules.sops + ../hosts/${hostname} + ../profiles/${profile}.nix + home-manager.nixosModules.home-manager + { + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.extraSpecialArgs = { + inherit inputs system; + }; + home-manager.users.${username} = { + home.stateVersion = "25.05"; + imports = [ + ../home + ]; + }; + } + ] ++ extraModules; +} diff --git a/modules/README.md b/modules/README.md new file mode 100644 index 0000000..a2f105c --- /dev/null +++ b/modules/README.md @@ -0,0 +1,13 @@ +# 🧱 modules 目录说明 + +系统模块目录。大部分子目录通过 `default.nix` 提供统一入口，驱动目录采用按文件显式引用。 + +## 🌲 目录树 +```text +🧱 modules +├─ 🧭 core/ # 全局基础模块 +├─ 🖥️ desktop/ # 桌面模块（DE/WM/应用） +├─ 🎮 drivers/ # 硬件驱动模块（如 NVIDIA） +├─ 🗄️ server/ # 服务器模块 +└─ 🪟 wsl/ # WSL 模块 +``` diff --git a/modules/core/README.md b/modules/core/README.md new file mode 100644 index 0000000..20cac56 --- /dev/null +++ b/modules/core/README.md @@ -0,0 +1,11 @@ +# 🧭 modules/core + +所有主机场景都会引入的基础模块。 + +## 🌲 目录树 +```text +🧭 modules/core +├─ 🧩 default.nix # 基础 imports + 时区/镜像源/flakes 等默认设置 +├─ 👤 users.nix # 用户、默认 shell、密码与公钥 +└─ 🔐 sops.nix # sops-nix secret 映射 +``` diff --git a/modules/core/default.nix b/modules/core/default.nix new file mode 100644 index 0000000..5189b95 --- /dev/null +++ b/modules/core/default.nix @@ -0,0 +1,46 @@ +{ lib, pkgs, ... }: +{ + imports = [ + ./users.nix + ./sops.nix + ]; + + nix.settings = { + experimental-features = [ "nix-command" "flakes" ]; + auto-optimise-store = true; + substituters = [ + "https://cache.nixos.org" + "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store" + "https://mirror.sjtu.edu.cn/nix-channels/store" + ]; + trusted-public-keys = [ + "cache.nixos.org-1:6NCHdD59X431o0gWypbtr1HEhF2M7wP6+jJj6Jm23UM=" + ]; + }; + + nix.gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 14d"; + }; + + nixpkgs.config.allowUnfree = true; + + time.timeZone = lib.mkDefault "Asia/Shanghai"; + i18n.defaultLocale = lib.mkDefault "zh_CN.UTF-8"; + + networking.firewall.enable = lib.mkDefault true; + + environment.systemPackages = with pkgs; [ + curl + eza + git + htop + ranger + vim + wget + ]; + + system.stateVersion = lib.mkDefault "25.05"; +} + diff --git a/modules/core/sops.nix b/modules/core/sops.nix new file mode 100644 index 0000000..6396de2 --- /dev/null +++ b/modules/core/sops.nix @@ -0,0 +1,24 @@ +{ lib, ... }: +let + secretFile = ../../secrets/users/luochen570.enc.yaml; +in +{ + sops = { + age = { + keyFile = "/var/lib/sops-nix/key.txt"; + generateKey = true; + }; + defaultSopsFile = secretFile; + secrets = lib.mkIf (builtins.pathExists secretFile) { + "users/luochen570/authorized_key" = {}; + "users/luochen570/ssh_config" = { + owner = "luochen570"; + group = "users"; + mode = "0600"; + }; + "users/luochen570/passwordHash" = { + neededForUsers = true; + }; + }; + }; +} diff --git a/modules/core/users.nix b/modules/core/users.nix new file mode 100644 index 0000000..7688356 --- /dev/null +++ b/modules/core/users.nix @@ -0,0 +1,23 @@ +{ lib, pkgs, username, config, ... }: +{ + programs.zsh.enable = true; + users.defaultUserShell = pkgs.zsh; + + users.users.${username} = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + shell = pkgs.zsh; + }; + + users.users.${username}.initialPassword = lib.mkIf + (!(config.sops.secrets ? "users/luochen570/passwordHash")) + "Dly928730@.."; + + users.users.${username}.openssh.authorizedKeys.keyFiles = lib.mkIf + (config.sops.secrets ? "users/luochen570/authorized_key") + [ config.sops.secrets."users/luochen570/authorized_key".path ]; + + users.users.${username}.hashedPasswordFile = lib.mkIf + (config.sops.secrets ? "users/luochen570/passwordHash") + config.sops.secrets."users/luochen570/passwordHash".path; +} diff --git a/modules/desktop/README.md b/modules/desktop/README.md new file mode 100644 index 0000000..bf6c076 --- /dev/null +++ b/modules/desktop/README.md @@ -0,0 +1,12 @@ +# 🖥️ modules/desktop 目录说明 + +桌面能力模块，按“桌面环境（DE）/窗口管理器（WM）/应用”拆分，便于后续扩展到多种桌面方案。 + +## 🌲 目录树 +```text +🖥️ modules/desktop +├─ 📦 default.nix # 聚合入口（de + apps） +├─ 🧭 de/ # 桌面环境模块（例如 KDE） +├─ 🪟 wm/ # 窗口管理器模块（预留） +└─ 📱 apps.nix # 桌面应用与默认浏览器关联 +``` diff --git a/modules/desktop/apps.nix b/modules/desktop/apps.nix new file mode 100644 index 0000000..79b2401 --- /dev/null +++ b/modules/desktop/apps.nix @@ -0,0 +1,19 @@ +{ pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + firefox + google-chrome + linuxqq + wechat-uos + xterm + kdePackages.kate + kdePackages.konsole + ]; + + xdg.mime.enable = true; + xdg.mime.defaultApplications = { + "text/html" = [ "google-chrome.desktop" ]; + "x-scheme-handler/http" = [ "google-chrome.desktop" ]; + "x-scheme-handler/https" = [ "google-chrome.desktop" ]; + }; +} diff --git a/modules/desktop/de/README.md b/modules/desktop/de/README.md new file mode 100644 index 0000000..178e6e1 --- /dev/null +++ b/modules/desktop/de/README.md @@ -0,0 +1,10 @@ +# 🧭 modules/desktop/de 目录说明 + +桌面环境（Desktop Environment）目录。 + +## 🌲 目录树 +```text +🧭 modules/desktop/de +├─ 📦 default.nix # 聚合入口（当前仅 KDE） +└─ ⚙️ kde.nix # SDDM + Plasma 6 +``` diff --git a/modules/desktop/de/default.nix b/modules/desktop/de/default.nix new file mode 100644 index 0000000..b91b786 --- /dev/null +++ b/modules/desktop/de/default.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + imports = [ + ./kde.nix + ]; +} diff --git a/modules/desktop/de/kde.nix b/modules/desktop/de/kde.nix new file mode 100644 index 0000000..926b2e4 --- /dev/null +++ b/modules/desktop/de/kde.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + services.xserver.enable = true; + services.displayManager.sddm.enable = true; + services.desktopManager.plasma6.enable = true; +} diff --git a/modules/desktop/default.nix b/modules/desktop/default.nix new file mode 100644 index 0000000..ea75343 --- /dev/null +++ b/modules/desktop/default.nix @@ -0,0 +1,7 @@ +{ ... }: +{ + imports = [ + ./de + ./apps.nix + ]; +} diff --git a/modules/desktop/wm/README.md b/modules/desktop/wm/README.md new file mode 100644 index 0000000..0ae9bed --- /dev/null +++ b/modules/desktop/wm/README.md @@ -0,0 +1,9 @@ +# 🪟 modules/desktop/wm 目录说明 + +窗口管理器（Window Manager）目录，当前为预留结构。 + +## 🌲 目录树 +```text +🪟 modules/desktop/wm +└─ 📦 default.nix # 预留 future imports（hyprland/sway 等） +``` diff --git a/modules/desktop/wm/default.nix b/modules/desktop/wm/default.nix new file mode 100644 index 0000000..a8c69f4 --- /dev/null +++ b/modules/desktop/wm/default.nix @@ -0,0 +1,8 @@ +{ ... }: +{ + imports = [ + # Future WM modules: + # ./hyprland.nix + # ./sway.nix + ]; +} diff --git a/modules/drivers/README.md b/modules/drivers/README.md new file mode 100644 index 0000000..95c3d78 --- /dev/null +++ b/modules/drivers/README.md @@ -0,0 +1,11 @@ +# 🎮 modules/drivers 目录说明 + +硬件驱动模块目录，用于集中管理显卡等驱动配置。 + +## 🌲 目录树 +```text +🎮 modules/drivers +├─ 🟢 nvidia.nix # NVIDIA 驱动配置与双显卡备用说明 +├─ 🔴 amdgpu.nix # AMD iGPU(9700X) 用户态图形/计算支持 +└─ 📝 README.md +``` diff --git a/modules/drivers/amdgpu.nix b/modules/drivers/amdgpu.nix new file mode 100644 index 0000000..f2ffca2 --- /dev/null +++ b/modules/drivers/amdgpu.nix @@ -0,0 +1,16 @@ +{ pkgs, ... }: +{ + # Ryzen 7 9700X iGPU (RDNA2) related userspace support. + # Keep as a secondary GPU setup; X primary driver is still controlled + # by the desktop profile / nvidia module. + hardware.graphics = { + enable = true; + extraPackages = with pkgs; [ + amdvlk + rocmPackages.clr.icd + ]; + extraPackages32 = with pkgs; [ + driversi686Linux.amdvlk + ]; + }; +} diff --git a/modules/drivers/nvidia.nix b/modules/drivers/nvidia.nix new file mode 100644 index 0000000..0d16e30 --- /dev/null +++ b/modules/drivers/nvidia.nix @@ -0,0 +1,43 @@ +{ config, ... }: +{ + services.xserver.videoDrivers = [ "nvidia" ]; + + hardware.graphics.enable = true; + hardware.nvidia = { + modesetting.enable = true; + open = true; + nvidiaSettings = true; + package = config.boot.kernelPackages.nvidiaPackages.latest; + }; + + # 备用方案（当前禁用）： + # 如果后续要启用 AMD 核显 + NVIDIA 独显切换，请取消下面整段注释。 + # + # 重要提醒： + # 1) 先确认两张显卡的 PCIe Bus ID，再启用；否则图形界面可能无法启动。 + # 2) 获取命令：lspci | grep -E "VGA|3D" + # 3) 示例输出常见为 "01:00.0"、"06:00.0"（16 进制）。 + # 4) Nix 配置常用写法：PCI::: + # 例如 01:00.0 -> PCI:1:0:0；06:00.0 -> PCI:6:0:0 + # + # let + # amdgpuBusId = "PCI:6:0:0"; + # nvidiaBusId = "PCI:1:0:0"; + # in { + # services.xserver.videoDrivers = [ "amdgpu" "nvidia" ]; + # hardware.nvidia.prime = { + # offload.enable = true; + # offload.enableOffloadCmd = true; + # amdgpuBusId = amdgpuBusId; + # nvidiaBusId = nvidiaBusId; + # }; + # specialisation.nvidia-sync.configuration = { + # hardware.nvidia.prime = { + # offload.enable = lib.mkForce false; + # sync.enable = true; + # amdgpuBusId = amdgpuBusId; + # nvidiaBusId = nvidiaBusId; + # }; + # }; + # } +} diff --git a/modules/server/README.md b/modules/server/README.md new file mode 100644 index 0000000..5573b67 --- /dev/null +++ b/modules/server/README.md @@ -0,0 +1,11 @@ +# 🗄️ modules/server + +服务器专用模块。 + +## 🌲 目录树 +```text +🗄️ modules/server +├─ 📦 default.nix # 聚合入口 +├─ 🔐 ssh.nix # OpenSSH 参数 +└─ 🐳 docker.nix # Docker 与清理策略 +``` diff --git a/modules/server/default.nix b/modules/server/default.nix new file mode 100644 index 0000000..6ca2df7 --- /dev/null +++ b/modules/server/default.nix @@ -0,0 +1,7 @@ +{ ... }: +{ + imports = [ + ./docker.nix + ./ssh.nix + ]; +} diff --git a/modules/server/docker.nix b/modules/server/docker.nix new file mode 100644 index 0000000..3bdbe4c --- /dev/null +++ b/modules/server/docker.nix @@ -0,0 +1,11 @@ +{ ... }: +{ + virtualisation.docker = { + enable = true; + autoPrune = { + enable = true; + dates = "weekly"; + }; + }; +} + diff --git a/modules/server/ssh.nix b/modules/server/ssh.nix new file mode 100644 index 0000000..2ce04d2 --- /dev/null +++ b/modules/server/ssh.nix @@ -0,0 +1,14 @@ +{ ... }: +{ + services.openssh = { + enable = true; + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + PermitRootLogin = "no"; + X11Forwarding = false; + }; + openFirewall = true; + }; +} + diff --git a/modules/wsl/README.md b/modules/wsl/README.md new file mode 100644 index 0000000..0ae1b66 --- /dev/null +++ b/modules/wsl/README.md @@ -0,0 +1,11 @@ +# 🪟 modules/wsl + +WSL 集成模块。 + +## 🌲 目录树 +```text +🪟 modules/wsl +├─ 📦 default.nix # 聚合入口 +├─ ⚙️ configuration.nix # WSL 配置实现 +└─ 📝 README.md +``` diff --git a/modules/wsl/configuration.nix b/modules/wsl/configuration.nix new file mode 100644 index 0000000..ec7753e --- /dev/null +++ b/modules/wsl/configuration.nix @@ -0,0 +1,15 @@ +{ inputs, username, ... }: +{ + imports = [ + inputs.nixos-wsl.nixosModules.default + inputs.vscode-server.nixosModules.default + ]; + + wsl = { + enable = true; + defaultUser = username; + }; + + services.vscode-server.enable = true; + users.users.${username}.extraGroups = [ "vscode" "docker" "wheel" ]; +} diff --git a/modules/wsl/default.nix b/modules/wsl/default.nix new file mode 100644 index 0000000..0167962 --- /dev/null +++ b/modules/wsl/default.nix @@ -0,0 +1,6 @@ +{ ... }: +{ + imports = [ + ./configuration.nix + ]; +} diff --git a/modules/wsl/wsl.nix b/modules/wsl/wsl.nix deleted file mode 100644 index e69de29..0000000 diff --git a/overlays/README.md b/overlays/README.md new file mode 100644 index 0000000..031fe61 --- /dev/null +++ b/overlays/README.md @@ -0,0 +1,9 @@ +# 🎨 overlays 目录说明 + +`nixpkgs` 包覆盖目录。 + +## 🌲 目录树 +```text +🎨 overlays +└─ (自定义 overlay 文件) +``` diff --git a/profiles/README.md b/profiles/README.md new file mode 100644 index 0000000..97f6ef2 --- /dev/null +++ b/profiles/README.md @@ -0,0 +1,11 @@ +# 📚 profiles 目录说明 + +场景化组合层，负责选择 `modules/*`。 + +## 🌲 目录树 +```text +📚 profiles +├─ 🧑‍💻 desktop.nix # core + desktop + drivers +├─ 🗄️ server.nix # core + server(default.nix) +└─ 🪟 wsl.nix # core + wsl(default.nix) +``` diff --git a/profiles/desktop.nix b/profiles/desktop.nix new file mode 100644 index 0000000..cf66ab8 --- /dev/null +++ b/profiles/desktop.nix @@ -0,0 +1,9 @@ +{ ... }: +{ + imports = [ + ../modules/core + ../modules/desktop + ../modules/drivers/nvidia.nix + ../modules/drivers/amdgpu.nix + ]; +} diff --git a/profiles/server.nix b/profiles/server.nix index d97e8c5..e0081ea 100644 --- a/profiles/server.nix +++ b/profiles/server.nix @@ -1,7 +1,6 @@ { imports = [ ../modules/core - ../modules/server/docker.nix - ../modules/server/ssh.nix + ../modules/server ]; -} \ No newline at end of file +} diff --git a/profiles/wsl.nix b/profiles/wsl.nix new file mode 100644 index 0000000..6bfa2e1 --- /dev/null +++ b/profiles/wsl.nix @@ -0,0 +1,10 @@ +{ ... }: +{ + imports = [ + ../modules/core + ../modules/wsl + ]; + + networking.firewall.enable = false; +} + diff --git a/secrets/README.md b/secrets/README.md new file mode 100644 index 0000000..27282f9 --- /dev/null +++ b/secrets/README.md @@ -0,0 +1,13 @@ +# 🔐 secrets 目录说明 + +`sops-nix` 密钥目录。 + +## 🌲 目录树 +```text +🔐 secrets +└─ 👤 users/ +``` + +建议： +- 仅提交加密后的 `*.enc.yaml` +- 明文仅保留 `*.example` 模板 diff --git a/secrets/users/README.md b/secrets/users/README.md new file mode 100644 index 0000000..751cfa7 --- /dev/null +++ b/secrets/users/README.md @@ -0,0 +1,14 @@ +# 👤 secrets/users 目录说明 + +用户级 secret 模板与密文。 + +## 🌲 目录树 +```text +👤 secrets/users +├─ 📄 luochen570.enc.yaml.example # 明文模板（不部署） +└─ 🔒 luochen570.enc.yaml # 加密后部署文件 +``` + +## 🔐 本地源文件（Git 黑名单） +- 你可以在本目录维护 `*.source` 文件作为本地敏感源文件（例如真实域名和 IP）。 +- 这些文件已被仓库 `.gitignore` 屏蔽，不会被 Git 收集和推送。 diff --git a/secrets/users/luochen570.enc.yaml.example b/secrets/users/luochen570.enc.yaml.example new file mode 100644 index 0000000..9ef05ba --- /dev/null +++ b/secrets/users/luochen570.enc.yaml.example @@ -0,0 +1,92 @@ +# Create encrypted file from this template: +# cp secrets/users/luochen570.enc.yaml.example secrets/users/luochen570.enc.yaml +# sops --encrypt --in-place secrets/users/luochen570.enc.yaml +users: + luochen570: + authorized_key: "ssh-rsa AAAA... your-comment" + passwordHash: "REPLACE_WITH_mkpasswd_HASH" + ssh_config: | + # ~/.ssh/config + Host jz s0 pikvm nix zen gentoo ali tx jp k3s k3s-a1 k3s-a2 gmk + IdentityFile ~/.ssh/id_rsa + + # + Host jz + Hostname + Port 10000 + User root + + # + Host s0 pikvm nix k3s-1 k3s-2 k3s-3 test + Hostname + User root + + Host nix + User luochen570 + Port 33 + + Host pikvm + Port 53912 + + Host k3s-1 + Port 10000 + + Host k3s-2 + Port 10002 + + Host k3s-3 + Port 10004 + + Host test + Port 10008 + + Host zen + Hostname + User root + Port 10002 + + Host gmk + Hostname + User root + + Host fn + Hostname + User luochen570 + + Host ali + Hostname + User ecs-user + + Host tx + Hostname + User root + + Host jp + Hostname + User root + + Host hk + Hostname + User root + + Host hk2 + Hostname + User root + + Host k3s k3s-a1 k3s-a2 opensuse + User root + Hostname + + Host k3s + Port 10000 + + Host k3s-a1 + Port 10004 + + Host opensuse + Port 10006 + + Host gitea + HostName + User git + Port 222