nix-config-ryan4yin/hosts/12kingdoms-shoukei/hardware-configuration.nix

# Do not modify this file!  It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations.  Please make changes
# to /etc/nixos/configuration.nix instead.
{
  lib,
  modulesPath,
  ...
}:
let
  device = "/dev/disk/by-uuid/c2e8b249-240e-4eef-bf4e-81e7dbbf4887";
in
{
  imports = [
    (modulesPath + "/installer/scan/not-detected.nix")
    ./apple-silicon.nix
  ];

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = false;
  # depending on how you configured your disk mounts, change this to /boot or /boot/efi.
  boot.loader.efi.efiSysMountPoint = "/boot";

  # Foreign-architecture emulation is not used on this host: x86/x86_64 programs
  # run through `./game` (FEX inside a muvm microVM), which owns the x86_64/i686
  # ELF handlers, and qemu-user cannot run them on 16K pages anyway.

  # supported file systems, so we can mount any removable disks with these filesystems.
  boot.supportedFilesystems = [
    "ext4"
    "btrfs"
    "xfs"
    "ntfs"
    "fat"
    "vfat"
    "exfat"
  ];

  # clear /tmp on boot to get a stateless /tmp directory.
  boot.tmp.cleanOnBoot = true;
  boot.initrd = {
    # unlocked luks devices via a keyfile or prompt a passphrase.
    luks.devices."crypted-nixos" = {
      device = "/dev/disk/by-uuid/1c37820e-2501-46e4-bec4-27c28691a5b4";
      # the keyfile(or device partition) that should be used as the decryption key for the encrypted device.
      # if not specified, you will be prompted for a passphrase instead.
      #keyFile = "/root-part.key";

      # whether to allow TRIM requests to the underlying device.
      # it's less secure, but faster.
      allowDiscards = true;
      # Whether to bypass dm-crypt’s internal read and write workqueues.
      # Enabling this should improve performance on SSDs;
      # https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Disable_workqueue_for_increased_solid_state_drive_(SSD)_performance
      bypassWorkqueues = true;
      # Unlock with the CanoKey (FIDO2 PIN + touch); the passphrase slot stays.
      # Without the key, the passphrase prompt appears after token-timeout.
      # Enroll before deploying: docs/security-keys.md.
      crypttabExtraOpts = [
        "fido2-device=auto"
        "token-timeout=10s"
      ];
    };
  };

  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/01CE-1DFD";
    fsType = "vfat";
    options = [
      "fmask=0177" # File mask: 777-177=600 (Owner: rw-, Group/Others: ---)
      "dmask=0077" # Directory mask: 777-077=700 (Owner: rwx, Group/Others: ---)
      "noexec,nosuid,nodev" # Security: Block execution, ignore setuid, and disable device nodes
    ];
  };

  # equal to `mount -t tmpfs tmpfs /`
  fileSystems."/" = {
    device = "tmpfs";
    fsType = "tmpfs";
    # set mode to 755, otherwise systemd will set it to 777, which cause problems.
    # relatime: Update inode access times relative to modify or change time.
    options = [
      "size=1G"
      "relatime"
      "mode=755"
    ];
  };

  fileSystems."/nix" = {
    inherit device;
    fsType = "btrfs";
    options = [
      "subvol=@nix"
      "noatime"
      "compress-force=zstd:1"
    ];
  };

  fileSystems."/tmp" = {
    inherit device;
    fsType = "btrfs";
    options = [
      "subvol=@tmp"
      "noatime"
      "compress-force=zstd:1"
    ];
  };

  fileSystems."/persistent" = {
    inherit device;
    fsType = "btrfs";
    options = [
      "subvol=@persistent"
      "noatime"
      "compress-force=zstd:1"
    ];
    # preservation's data is required for booting.
    neededForBoot = true;
  };

  fileSystems."/snapshots" = {
    inherit device;
    fsType = "btrfs";
    options = [
      "subvol=@snapshots"
      "noatime"
      "compress-force=zstd:1"
    ];
  };

  # mount swap subvolume in readonly mode.
  fileSystems."/swap" = {
    inherit device;
    fsType = "btrfs";
    options = [
      "subvol=@swap"
      "ro"
    ];
  };

  # remount swapfile in read-write mode
  fileSystems."/swap/swapfile" = {
    # the swapfile is located in /swap subvolume, so we need to mount /swap first.
    depends = [ "/swap" ];

    device = "/swap/swapfile";
    fsType = "none";
    options = [
      "bind"
      "rw"
    ];
  };

  swapDevices = [
    { device = "/swap/swapfile"; }
  ];

  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
}