dotfiles

commit 53e40eb5360bddb2fc8f98af363d23ac2cf08ae7
parent 22bc173708948af357690fc5106c9bd01834a712
Author: maydayv7 <maydayv7@gmail.com>
Date:   Sun, 22 Oct 2023 11:44:42 +0530

feat: Rework Recovery Settings

Also update README

Diffstat:

12 files changed, 50 insertions(+), 59 deletions(-)
diff --git a/README.md b/README.md
@@ -194,7 +194,7 @@ github:maydayv7/dotfiles
 
 In case you want to use my configuration as-is for a fresh NixOS install, you can try the following steps:
 
-**_Note:_** You can run `nix develop` or `nix-shell ./lib/compat/shell.nix` in the repository to install all required dependencies
+**_Note:_** You can run `nix develop` in the repository to install all required dependencies
 
 1. Prepare `/etc/nixos`: <pre><code>sudo mkdir /etc/nixos
    sudo chown $USER /etc/nixos && sudo chmod ugo+rw /etc/nixos
@@ -264,12 +264,15 @@ _Replace_ **_DEVICE_** _with the name of Device to build_
 
 _Note that the `install` script automatically creates and labels all the required partitions, so it is recommended that only the partition table on the disk be created and have enough free space_
 
-| Name           | Label  |   Format   | Size (minimum) |
-| :------------- | :----: | :--------: | :------------: |
-| BOOT Partition |  ESP   |    vfat    |      500M      |
-| ROOT Partition | System | ext4/BTRFS |      25G       |
-| SWAP Area      |  swap  |    swap    |       8G       |
-| DATA Partition | Files  |    NTFS    |      10G       |
+| Name           | Label  | Format | Size (minimum) |
+| :------------- | :----: | :----: | :------------: |
+| BOOT Partition |  ESP   |  vfat  |      500M      |
+| ROOT Partition | System |  ZFS   |      25G       |
+| SWAP Area      |  swap  |  swap  |       4G       |
+| DATA Partition | Files  |  ZFS   |      10G       |
+
+> **Note**
+> For the `advanced` filesystem scheme only
 
 #### Procedure
 
diff --git a/devices/Vortex/default.nix b/devices/Vortex/default.nix
@@ -6,7 +6,7 @@
   timezone = "Asia/Kolkata";
   locale = "IN";
 
-  kernel = "lqx";
+  kernel = "zen";
   kernelModules = ["nvme" "thunderbolt"];
 
   imports = [./secrets];
@@ -33,6 +33,5 @@
     uid = 1000;
     shell = "zsh";
     shells = ["bash"];
-    recovery = true;
   };
 }
diff --git a/files/gnome/dconf.nix b/files/gnome/dconf.nix
@@ -8,9 +8,7 @@
 with lib.hm.gvariant; let
   inherit (builtins) head elem;
   homeDir = config.home.homeDirectory;
-  android = sys.hardware.vm.android.enable;
   fonts = sys.fonts.fontconfig.defaultFonts;
-  wine = elem "wine" sys.apps.list;
 in {
   # Home Directory
   home.file = {
@@ -320,14 +318,13 @@ in {
     };
 
     "org/gnome/desktop/app-folders" = {
-      folder-children =
-        [
-          "4f9e09f6-cbd8-4a4a-beb3-9ec7b3e672ff"
-          "a136187d-1d93-4d35-8423-082f15957be9"
-          "b79e9b82-2127-459b-9e82-11bd3be09d04"
-        ]
-        ++ lib.optionals android ["cb1c8797-b52e-4df5-80d6-2c46e8f7ef22"]
-        ++ lib.optionals wine ["1c3e59e4-a571-4ada-af1d-ed1ced384cfb"];
+      folder-children = [
+        "1c3e59e4-a571-4ada-af1d-ed1ced384cfb"
+        "4f9e09f6-cbd8-4a4a-beb3-9ec7b3e672ff"
+        "a136187d-1d93-4d35-8423-082f15957be9"
+        "b79e9b82-2127-459b-9e82-11bd3be09d04"
+        "cb1c8797-b52e-4df5-80d6-2c46e8f7ef22"
+      ];
     };
 
     "org/gnome/desktop/app-folders/folders/4f9e09f6-cbd8-4a4a-beb3-9ec7b3e672ff" = {
diff --git a/modules/README.md b/modules/README.md
@@ -56,7 +56,6 @@ The `modules` directory contains custom-made pure Flakes-compatible configuratio
   - `settings`: User Settings (Alias for `users.users.${username}`) -
     - `autologin`: Enable Automatic User Login - `"true" / "false"`
     - `minimal`: Enable Minimal User Configuration - `"true" / "false"`
-    - `recovery`: Enable User Recovery Settings - `"true" / "false"`
     - `homeConfig`: User Specific Home Configuration
 
 - [`shell`](./shell): Module that contains User Shell Environment Configuration -
diff --git a/modules/base/firmware.nix b/modules/base/firmware.nix
@@ -3,8 +3,7 @@
   inputs,
   pkgs,
   ...
-}:
-with {inherit (lib) mkAfter mkForce;}; {
+}: {
   imports = [inputs.gaming.nixosModules.pipewireLowLatency];
 
   ## Device Firmware ##
@@ -14,7 +13,7 @@ with {inherit (lib) mkAfter mkForce;}; {
       opengl.enable = true;
       cpu.intel.updateMicrocode = true;
       enableRedistributableFirmware = true;
-      pulseaudio.enable = mkForce false;
+      pulseaudio.enable = lib.mkForce false;
     };
 
     services = {
@@ -99,7 +98,7 @@ with {inherit (lib) mkAfter mkForce;}; {
       enable = true;
       settings = {
         PasswordAuthentication = true;
-        PermitRootLogin = mkForce "no";
+        PermitRootLogin = lib.mkForce "no";
       };
       hostKeys = [
         {
diff --git a/modules/default.nix b/modules/default.nix
@@ -59,10 +59,9 @@ in {
       shells ? [],
       home ? {},
       minimal ? false,
-      recovery ? true,
     }: {
       user.settings."${name}" = {
-        inherit name description uid autologin minimal recovery;
+        inherit name description uid autologin minimal;
         homeConfig = home;
         extraGroups = groups;
         initialHashedPassword = password;
diff --git a/modules/hardware/boot.nix b/modules/hardware/boot.nix
@@ -45,7 +45,7 @@ in {
 
           # Boot Loader
           loader = {
-            timeout = lib.mkDefault 0;
+            timeout = mkDefault 0;
             grub.enable = mkDefault false;
             efi.canTouchEfiVariables = true;
           };
@@ -53,7 +53,7 @@ in {
       }
 
       ## GRUB MBR Boot Loader ##
-      (mkIf (config.hardware.boot == "mbr") {
+      (mkIf (loader == "mbr") {
         boot.loader.grub = {
           enable = mkForce true;
           device = "nodev";
@@ -66,7 +66,7 @@ in {
       })
 
       ## SystemD EFI Boot Loader ##
-      (mkIf (config.hardware.boot == "efi") {
+      (mkIf (loader == "efi") {
         boot.loader.systemd-boot = {
           enable = true;
           editor = false;
diff --git a/modules/hardware/filesystem.nix b/modules/hardware/filesystem.nix
@@ -12,7 +12,6 @@
     (lib)
     filterAttrs
     hasPrefix
-    mkAfter
     mkAliasOptionModule
     mkIf
     mkMerge
diff --git a/modules/user/default.nix b/modules/user/default.nix
@@ -69,11 +69,6 @@ in {
                 type = listOf (enum (util.map.module' ../shell));
                 default = ["bash"];
               };
-              recovery = mkOption {
-                description = "Enable User Recovery Settings";
-                type = bool;
-                default = false;
-              };
               homeConfig = mkOption {
                 description = "User Specific Home Configuration";
                 type = util.types.mergedAttrs;
diff --git a/modules/user/security.nix b/modules/user/security.nix
@@ -4,12 +4,11 @@
   files,
   ...
 }: let
-  inherit (lib) filterAttrs mkForce mkIf optional util;
-  inherit (builtins) all any attrNames attrValues hasAttr mapAttrs readFile;
+  inherit (lib) filterAttrs mkAfter mkForce mkIf util;
+  inherit (builtins) all attrNames attrValues hasAttr mapAttrs readFile;
   inherit (config.sops) secrets;
   inherit (config.user) settings;
   enable = all (value: value.minimal) (attrValues settings);
-  recovery = any (value: value.recovery) (attrValues settings);
 in {
   ## Security Settings ##
   config = {
@@ -26,23 +25,8 @@ in {
           hashedPasswordFile = mkIf (!value.minimal) secrets."${name}.secret".path;
         })
         settings;
-
-      extraUsers = {
-        root.hashedPasswordFile =
-          mkIf (hasAttr "root.secret" secrets) secrets."root.secret".path;
-
-        # Recovery Account
-        recovery = mkIf recovery {
-          name = "recovery";
-          description = "Recovery Account";
-          isNormalUser = true;
-          uid = 1100;
-          group = "users";
-          extraGroups = ["wheel"];
-          useDefaultShell = true;
-          initialHashedPassword = readFile ./passwords/default;
-        };
-      };
+      extraUsers.root.hashedPasswordFile =
+        mkIf (hasAttr "root.secret" secrets) secrets."root.secret".path;
     };
 
     # Authentication
@@ -56,9 +40,7 @@ in {
       # Passwordless Access
       extraRules = [
         {
-          users =
-            attrNames (filterAttrs (_: value: value.minimal) settings)
-            ++ optional recovery "recovery";
+          users = attrNames (filterAttrs (_: value: value.minimal) settings);
           commands = [
             {
               command = "ALL";
@@ -68,5 +50,22 @@ in {
         }
       ];
     };
+
+    # Recovery Account
+    specialisation.recovery.configuration =
+      mkIf (!(all (value: value.minimal) (attrValues settings)))
+      {
+        security.sudo.extraConfig = mkAfter "recovery ALL=(ALL:ALL) NOPASSWD:ALL";
+        users.extraUsers.recovery = {
+          name = "recovery";
+          description = "Recovery Account";
+          isNormalUser = true;
+          uid = 1100;
+          group = "users";
+          extraGroups = ["wheel"];
+          useDefaultShell = true;
+          initialHashedPassword = readFile ./passwords/default;
+        };
+      };
   };
 }
diff --git a/scripts/nixos.nix b/scripts/nixos.nix
@@ -145,7 +145,7 @@ in
           ;;
           list)
             echo "# System Generations #"
-            sudo nix-env --list-generations -p "$profile"
+            nixos-rebuild list-generations
           ;;
           *)
             echo "Rolling Back to Generation '$3'..."
diff --git a/users/README.md b/users/README.md
@@ -1,3 +1,5 @@
 ### Users
 
 The `users` directory contains the individual user-specific configurations for multiple users (of a single PC or multiple ones). To add a new user, simply create a configuration file for it (name of the file/directory must be the same as the `username` of the user) and write down the configuration using the `home-manager` module [options](https://mipmip.github.io/home-manager-option-search/). The configuration is automatically imported by `lib.build`, if present. Do not forget to create a `USERNAME.secret` file (using `nixos secret create`) in [`modules/user/passwords`](../modules/user/passwords/) containing the user password
+
+There is also a `recovery` user defined in the system configuration as a [specialisation](https://nixos.wiki/wiki/Specialisation)