diff --git a/configuration.nix b/configuration.nix index 6960d54..710942f 100644 --- a/configuration.nix +++ b/configuration.nix @@ -4,54 +4,21 @@ let gitLocalPath = "/var/lib/nixos-config"; in { - # DO NOT import hardware-configuration.nix - we want hardware independenc - # imports = [ ./hardware-configuration.nix ]; + # We still import hardware-configuration.nix but it will be regenerated on first boot + imports = [ ./hardware-configuration.nix ]; - # Boot configuration for physical machines + # Critical boot settings for physical hardware boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; - boot.supportedFilesystems = [ "vfat" "ext4" "crypto_LUKS" ]; - - # Use LABELS instead of UUIDs for portable filesystem setup - fileSystems."/" = { - device = "/dev/disk/by-label/nixos-root"; - fsType = "ext4"; - options = [ "noatime" "nodiratime" ]; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-label/nixos-boot"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; # Generic kernel modules for maximum hardware compatibility boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ohci_pci" "ahci" "usb_storage" "sd_mod" "sr_mod" "usbhid" "hid_generic" "hid_apple" "hid_logitech" "hid_cherry" - "uas" "usb_storage" "nvme" "rtsx_pci_sdmmc" + "uas" "nvme" "mmc_block" "rtsx_pci_sdmmc" ]; - - # First boot setup to handle machine-specific configuration - boot.initrd.postDeviceCommands = pkgs.writeScript "first-boot-initrd" '' - #!/usr/bin/env bash - # Check if this is first boot on this hardware - if [ ! -e /proc/first-boot-done ]; then - echo "First boot detected - setting up hardware-specific configuration" - - # Auto-detect LUKS device if not already set up - if ! [ -e /dev/mapper/luks-root ]; then - echo "No LUKS device found - attempting to find encrypted partition" - for dev in /dev/sd* /dev/nvme* /dev/mmcblk*; do - if cryptsetup isLuks "$dev" 2>/dev/null; then - echo "Found LUKS partition on $dev" - # This is a placeholder - actual decryption would happen interactively - break - fi - done - fi - fi - ''; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; networking.hostName = "nixos-usb"; networking.networkmanager.enable = true; @@ -95,14 +62,12 @@ in description = "user"; extraGroups = [ "networkmanager" "wheel" "audio" "video" "disk" ]; shell = pkgs.bash; - # For cloned systems, don't set a password in config - # Users should set their own passwords after first boot }; # Allow unfree packages nixpkgs.config.allowUnfree = true; - # Essential packages for a portable system + # Essential packages environment.systemPackages = with pkgs; [ git vim @@ -129,8 +94,6 @@ in psmisc lsof strace - pciutils - usbutils ]; programs.firefox.enable = true; @@ -150,41 +113,42 @@ in # Regenerate SSH host keys echo "Regenerating SSH host keys..." rm -f /etc/ssh/ssh_host_* - ssh-keygen -A + ssh-keygen -A >/dev/null 2>&1 # Generate new machine-id echo "Generating new machine ID..." - rm -f /etc/machine-id /var/lib/dbus/machine-id + rm -f /etc/machine-id /var/lib/dbus/machine-id 2>/dev/null || true systemd-machine-id-setup + # Regenerate hardware configuration for this machine + echo "Detecting hardware configuration..." + nixos-generate-config --root / --no-filesystems + # Ensure proper permissions chmod 700 /root - chmod 755 /home/user + if [ -d /home/user ]; then + chmod 755 /home/user + chown -R user:user /home/user + fi # Mark first boot complete + mkdir -p /var/lib touch /var/lib/nixos-firstboot-done echo "First boot setup complete." - else - echo "System already set up - skipping first boot configuration." fi ''; environment.etc."first-boot-setup.sh".mode = "0700"; - # Auto-update script with improved hardware independence + # Auto-update script environment.etc."update-nixos-config.sh".text = '' #!/run/current-system/sw/bin/bash set -e - # Ensure all system tools are available export PATH="/run/current-system/sw/bin:/nix/var/nix/profiles/default/bin" export NIX_PATH="nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos" - LOCAL_PATH="/var/lib/nixos-config" - REPO_URL="${gitRepoUrl}" - - echo "[$(date)] Checking for configuration updates..." - + REPO_URL="https://git.skarockoi.de/ska/nixos-production.git" if [ ! -d "$LOCAL_PATH/.git" ]; then mkdir -p "$LOCAL_PATH" chmod 700 "$LOCAL_PATH" @@ -199,10 +163,7 @@ in if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then echo "New config available. Updating..." git reset --hard origin/main - - # Rebuild the system with the new configuration nixos-rebuild switch -I nixos-config="$LOCAL_PATH/configuration.nix" - echo "System updated successfully." else echo "Config is already up to date." @@ -216,7 +177,7 @@ in systemd.services.first-boot-setup = { description = "One-time setup for cloned NixOS USB"; script = "/etc/first-boot-setup.sh"; - path = with pkgs; [ systemd openssh ]; + path = with pkgs; [ systemd openssh git ]; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; @@ -246,13 +207,11 @@ in }; }; - # Power management for USB devices - powerManagement.enable = true; + # Udev rules for USB devices services.udev.extraRules = '' # Allow all users to mount USB devices ACTION=="add", SUBSYSTEM=="block", ENV{ID_BUS}=="usb", MODE="0660", GROUP="disk" ''; - # NixOS version compatibility system.stateVersion = "25.11"; } \ No newline at end of file