mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
d056aece28
* chore(workarounds): re-evaluate stale hardware/kernel fixes Prune workarounds whose root cause is gone, fix one vendor typo, and document the ones we keep: - drop `transparent_hugepage=madvise` on shoryu/shushou/youko: it was tied to the old fixed 1G hugetlb pool, and the VMs now use ordinary memory - shoryu: `hardware.cpu.intel.updateMicrocode` -> `amd` (it is an AMD APU) - ai: drop `i915.enable_guc=3` (GuC/HuC submission is the default on modern i915/Xe) - kernel-hardening: name the Dirty Frag CVEs (CVE-2026-43284 / CVE-2026-43500) and the re-evaluation condition - document re-eval conditions for the Insta360 resume fix, the darwin auto-optimise-store workaround, and the youko USB-SATA bridge mitigations * chore(workarounds): keep the Dirty Frag module blacklist as defence in depth * chore(ai): correct the i915.enable_guc rationale (verified against the kernel) * chore(darwin): drop the auto-optimise-store workaround (nix#7273 fixed)
29 lines
926 B
Nix
29 lines
926 B
Nix
{ config, ... }:
|
|
{
|
|
###################################################################################
|
|
#
|
|
# Core configuration for nix-darwin
|
|
#
|
|
# All the configuration options are documented here:
|
|
# https://daiderd.com/nix-darwin/manual/index.html#sec-options
|
|
#
|
|
# History Issues:
|
|
# 1. Fixed by replace the determined nix-installer by the official one:
|
|
# https://github.com/LnL7/nix-darwin/issues/149#issuecomment-1741720259
|
|
#
|
|
###################################################################################
|
|
|
|
# Determinate uses its own daemon to manage the Nix installation that
|
|
# conflicts with nix-darwin's native Nix management. so we should disable this option.
|
|
nix.enable = false;
|
|
|
|
nix.gc.automatic = false;
|
|
|
|
system.stateVersion = 5;
|
|
|
|
nix.extraOptions = ''
|
|
# decrypted secret: AI agents must not read it
|
|
!include ${config.age.secrets.nix-access-tokens.path}
|
|
'';
|
|
}
|