genebean/dots
1
0
Fork 0
mirror of https://github.com/genebean/dots.git synced 2026-05-31 15:45:21 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Setup remote builds and set Pi mostly readonly

Browse source
This commit is contained in:
Gene Liverman 2026-04-01 17:12:26 -04:00
parent bdc0ca9637
commit 0498ea3e5b
No known key found for this signature in database
4 changed files with 154 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

24
modules/hosts/nixos/kiosk-gene-desk/default.nix
View file

@ -10,6 +10,7 @@
imports = [
# SD card image
"${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
./read-only-root.nix
];
system.stateVersion = "24.11";
@ -49,6 +50,29 @@
};
};
nix = {
distributedBuilds = true;
buildMachines = [
{
hostName = "hetznix02.technicalissues.us";
system = "aarch64-linux";
protocol = "ssh-ng";
maxJobs = 4;
speedFactor = 2;
supportedFeatures = [
"nixos-test"
"benchmark"
"big-parallel"
];
sshUser = "gene";
sshKey = "/root/.ssh/id_ed25519";
}
];
extraOptions = ''
builders-use-substitutes = true
'';
};
nixpkgs.overlays = [
(_final: super: {
makeModulesClosure = x: super.makeModulesClosure (x // { allowMissing = true; });

1
modules/hosts/nixos/kiosk-gene-desk/home-gene.nix
View file

@ -17,6 +17,7 @@
"--hide-crash-restore-bubble"
];
};
zsh.history.path = "/tmp/zsh_history_gene"; # needed becaues of read only fs
};
}

126
modules/hosts/nixos/kiosk-gene-desk/read-only-root.nix Normal file
View file

@ -0,0 +1,126 @@
{
lib,
pkgs,
username,
...
}:
{
# ------------------------------------------------------------------ #
# Read-only SD card mounts and tmpfs for writable paths
# ------------------------------------------------------------------ #
fileSystems = {
"/" = lib.mkForce {
device = "/dev/disk/by-label/NIXOS_SD";
fsType = "ext4";
options = [
"ro"
"noatime"
"nodiratime"
];
};
"/boot/firmware" = lib.mkForce {
device = "/dev/disk/by-label/FIRMWARE";
fsType = "vfat";
options = [
"ro"
"noatime"
"nofail"
"noauto"
];
};
"/var/log" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=64m"
"mode=0755"
"nosuid"
"nodev"
];
neededForBoot = true;
};
"/var/lib" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=256m"
"mode=0755"
"nosuid"
"nodev"
];
neededForBoot = true;
};
"/home/${username}/.cache" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=256m"
"mode=0700"
"uid=1000"
"nosuid"
"nodev"
];
};
"/home/${username}/.local" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=256m"
"mode=0700"
"uid=1000"
"nosuid"
"nodev"
];
};
"/home/${username}/.config/chromium" = {
device = "tmpfs";
fsType = "tmpfs";
options = [
"size=128m"
"mode=0700"
"uid=1000"
"nosuid"
"nodev"
];
};
};
# ------------------------------------------------------------------ #
# tmpfs for paths that need to be writable at runtime
# ------------------------------------------------------------------ #
# /tmp - NixOS built-in option, cleaner than a manual fileSystems entry
boot.tmp.useTmpfs = true;
boot.tmp.tmpfsSize = "20%";
# ------------------------------------------------------------------ #
# systemd-journal needs its directory to exist after /var/log tmpfs
# is mounted
# ------------------------------------------------------------------ #
systemd.tmpfiles.rules = [
"d /var/log/journal 0755 root systemd-journal -"
# create a writable zsh history file in /tmp for gene
"f /tmp/zsh_history_gene 0600 ${username} users -"
];
# ------------------------------------------------------------------ #
# Helper scripts for doing a nixos-rebuild
# ------------------------------------------------------------------ #
environment.systemPackages = [
(pkgs.writeShellScriptBin "remount-rw" ''
echo "Remounting / read-write..."
sudo mount -o remount,rw /
echo "Starting nix-daemon..."
systemctl start nix-daemon.socket nix-daemon.service
echo "Done. Run 'reboot' when finished."
'')
];
}