mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
b726c28c14
* feat(nixpak): sandbox Steam and Heroic in ~/Gaming idols-ai stops preserving ~/.local/share/Steam, ~/.steam, ~/.config/heroic and their game data, which must be moved into ~/Gaming before deploying. Assisted-by: DeepSeek Harness (deepseek-flash) * refactor(nixpak): replace steam-fix.nu with sandboxed protontricks Assisted-by: DeepSeek Harness (claude-opus-5-5) * fix(nixpak): hide host documents and GTK config from game sandboxes Assisted-by: DeepSeek Harness (claude-opus-5-5) * docs(ai): locate the Steam library under ~/Gaming Assisted-by: DeepSeek Harness (claude-opus-5-5) * fix(umu-game): confine writes to ~/Gaming and keep foreign entries Assisted-by: DeepSeek Harness (claude-opus-5-5) * fix(nixpak): keep Steam and Heroic in the application launcher The wrappers only carried bin/, so neither launcher had a desktop entry after replacing programs.steam. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): give the game sandboxes a fontconfig that sees CJK fonts Steam rendered Chinese as tofu: the FHS layers build their own /etc/fonts, whose config lists only DejaVu and the XDG font directory, so neither the host fonts nor the FHS /usr/share/fonts were ever scanned. Point FONTCONFIG_FILE at a small config that includes /usr/share/fonts, and ship WenQuanYi Zen Hei and Noto Sans CJK in all three FHS layers. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): grant the game launchers a StatusNotifier tray icon Steam and Heroic register a tray icon over D-Bus, and the game sandboxes granted no StatusNotifierWatcher access, so the desktop shell had nothing to show for them. Enable desktopIntegration.tray for all three launchers and teach the policy suites to expect it. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): drop the duplicate host CJK font and tidy the font overrides Steam reads the fonts inside its own FHS layer, so the system-wide wqy_zenhei added for it no longer serves any sandbox. Give gaming-policy its own comment for FONTCONFIG_FILE instead of leaving it under the compat-tool one, make the desktop-base value a default, and note the SNI tray grant in the README table. Assisted-by: DeepSeek Harness (deepseek-flash)
79 lines
4.2 KiB
Markdown
79 lines
4.2 KiB
Markdown
# Host - AI
|
||
|
||
Desktop (NixOS + preservation, LUKS + btrfs on nvme). Disk layout is declarative via
|
||
[disko](./disko-fs.nix) (target device: the KINGBANK NVMe by `/dev/disk/by-id/`, set in that file).
|
||
|
||
Desktop on the MSI **MAG B760M MORTAR** with the i5-13600KF, 32G DDR5 and the RTX 4090, on the
|
||
KINGBANK NVMe alone. The platform split is recorded in [hosts/README.md](../README.md); the wired
|
||
NIC and its `en*` match are in [default.nix](./default.nix).
|
||
|
||
TPM2 comes from the CPU's Intel PTT unless a module is plugged into the board's TPM header; check
|
||
_Settings → Security → Trusted Computing_ if `systemd-cryptenroll --tpm2-device=auto` finds no
|
||
device.
|
||
|
||
Related:
|
||
|
||
- [nixos-installer README](../../nixos-installer/README.md) – install from ISO using disko
|
||
- [disko-fs.nix](./disko-fs.nix) – main disk layout (ESP + LUKS + btrfs). From
|
||
`nix-config/nixos-installer`:
|
||
`nix run github:nix-community/disko -- --mode destroy,format,mount ../hosts/idols-ai/disko-fs.nix`
|
||
- [VR.md](./VR.md) – WiVRn headset setup
|
||
|
||
## Info
|
||
|
||
The disk layout is fully declarative — see [disko-fs.nix](./disko-fs.nix) for the root disk. Run
|
||
`df -Th` / `lsblk` on the host if an up-to-date snapshot of the current mounts is needed.
|
||
|
||
Steam libraries live under the persisted `~/Gaming`, the game sandbox's home, so they survive the
|
||
tmpfs root: `~/Gaming/Games/SteamLibrary` (`~/Games/SteamLibrary` inside the sandbox) is the library
|
||
that used to sit on the `/data` disk. Steam finds a moved library when it is added once through
|
||
_Settings → Storage → Add Drive_, or by starting Steam with the `libraryfolders.vdf` already listing
|
||
it.
|
||
|
||
## 4090 water block
|
||
|
||
After the 2026-10-13 platform swap the card's water block stopped moving heat: the pump ran but made
|
||
abnormal noise, and the card still overheated. It had been RMA'd for the same symptom before, came
|
||
back with no fault found, and worked again after the return shipment. Repacking the card in its
|
||
original box and dropping the box five or six times freed it, so a stuck impeller, with transit
|
||
shock as the accidental cure, is the best guess. Treat that as a stopgap before an RMA: the jolt can
|
||
damage the card, and a pump that sticks again should be replaced.
|
||
|
||
## Booting after the platform swap
|
||
|
||
The KINGBANK disk was last enrolled with the Z890 board's TPM2 and its UKI is signed with a key that
|
||
only that board's Secure Boot database trusts. On the B760M board:
|
||
|
||
1. Boot with the LUKS **passphrase** — the old TPM2 enrollment is bound to the previous board's PCR
|
||
values and will not unlock here.
|
||
2. Secure Boot: either leave it off, or enroll a fresh PKI — `sbctl create-keys` +
|
||
`sbctl enroll-keys` in setup mode. lanzaboote signs with `pkiBundle` (`/etc/secureboot` in
|
||
[secureboot.nix](./secureboot.nix)), so the new keys must end up there; `sbctl create-keys`
|
||
writes to its own keydir. Re-enrolling changes PCR7, so re-run the enrollment in step 3
|
||
afterwards.
|
||
3. Re-enroll this board's TPM2 once the Secure Boot state is final. Enroll and wipe in **one** call:
|
||
`--wipe-slot=tpm2` matches every TPM2 slot, so wiping in a separate call would also delete the
|
||
slot just created. Combined, systemd-cryptenroll enrolls first and then wipes the old slots,
|
||
always sparing the new one.
|
||
|
||
```bash
|
||
disk=/dev/disk/by-id/nvme-KINGBANK_KP260_CN092BH3203917-part2
|
||
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --wipe-slot=tpm2 "$disk"
|
||
sudo systemd-cryptenroll "$disk" # read the slot list back: tpm2 + passphrase
|
||
```
|
||
|
||
PCR0 covers the firmware code, so a BIOS update needs this enrollment redone; the passphrase slot
|
||
keeps booting either way. The `0+7` pair is the repo's existing shape — see
|
||
[nixos-installer/README.md](../../nixos-installer/README.md).
|
||
|
||
4. The B760M's NVRAM has no boot entry for this disk. If it does not boot on its own, pick the disk
|
||
once from the one-time boot menu (the ESP also carries `\EFI\BOOT\BOOTX64.EFI`); the first
|
||
activation should then write the entry. If it does not, add one by hand — `ls /boot/EFI/Linux`
|
||
shows the UKI name lanzaboote signed:
|
||
|
||
```bash
|
||
sudo ls /boot/EFI/Linux
|
||
sudo nix run nixpkgs#efibootmgr -- -c -d /dev/disk/by-id/nvme-KINGBANK_KP260_CN092BH3203917 \
|
||
-p 1 -L NixOS -l '\EFI\Linux\nixos-generation-1.efi'
|
||
```
|