mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
0dcbbb02e9
Hosts now accept only the two CanoKeys' resident SSH keys for ryan, plus the romantic recovery key for root; per-host user keys stop working. Darwin builds work again: the shared base no longer sets nixpkgs.config next to nix-darwin's nixpkgs.pkgs. Assisted-by: DeepSeek Harness (claude-opus-5-5) Assisted-by: DeepSeek Harness (deepseek-flash)
57 lines
2.2 KiB
Nix
57 lines
2.2 KiB
Nix
{
|
|
lib,
|
|
pkgs,
|
|
nixpkgsConfig,
|
|
...
|
|
}:
|
|
{
|
|
# Nix 2.35 is newer than nixpkgs' nixVersions.stable (still 2.34), so opt into
|
|
# the latest released version until stable catches up.
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/tools/package-management/nix/default.nix
|
|
nix.package = pkgs.nixVersions.latest;
|
|
warnings = lib.optional (lib.versionAtLeast pkgs.nixVersions.stable.version "2.35") "nixVersions.stable is 2.35+: drop the nixVersions.latest override (WA-023)";
|
|
|
|
# https://lix.systems/add-to-config/
|
|
# nix.package = pkgs.lix;
|
|
|
|
# NixOS only: darwin's nixpkgs.pkgs instance already carries it (lib/macosSystem.nix),
|
|
# and nixpkgs rejects nixpkgs.config next to nixpkgs.pkgs.
|
|
nixpkgs.config = nixpkgsConfig;
|
|
|
|
# do garbage collection weekly to keep disk usage low
|
|
nix.gc = {
|
|
automatic = lib.mkDefault true;
|
|
dates = lib.mkDefault "weekly";
|
|
options = lib.mkDefault "--delete-older-than 7d";
|
|
};
|
|
|
|
# Manual optimise storage: nix-store --optimise
|
|
# https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-auto-optimise-store
|
|
nix.settings = {
|
|
auto-optimise-store = true;
|
|
|
|
# Required to run nixpkgs' systemd-nspawn based NixOS tests locally (used
|
|
# by the nixpkgs-review workflow). These are daemon-wide settings, so every
|
|
# local build pays the small uid/cgroup allocation overhead; drop them if
|
|
# you stop running those tests.
|
|
# Reference: https://github.com/NixOS/nixpkgs/pull/478109
|
|
auto-allocate-uids = true;
|
|
extra-system-features = [ "uid-range" ];
|
|
experimental-features = [
|
|
"auto-allocate-uids"
|
|
"cgroups"
|
|
];
|
|
# Use extra-sandbox-paths instead of sandbox-paths here. The plain
|
|
# sandbox-paths setting replaces Nix's compiled sandbox defaults, including
|
|
# the sandbox shell that provides /bin/sh for builders with legacy shebangs.
|
|
# extra-sandbox-paths keeps those defaults and only adds the paths we need.
|
|
# After deploying, verify the effective daemon config with:
|
|
# nix config show | grep sandbox-paths
|
|
extra-sandbox-paths = [
|
|
"/dev/net"
|
|
];
|
|
};
|
|
|
|
nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.
|
|
}
|