ymatsiuk

# Run me:
#  ❯ nix develop .#work -c vault --version
# mysql  Ver 15.1 Distrib 10.11.6-MariaDB, for Linux (x86_64) using readline 5.1
#  ❯ nix develop .#fun -c mysql --version
# Vault v1.15.6 (615cf6f1dce9aa91bc2035ce33b9f689952218f0), built 2024-02-28T17:07:34Z

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
    flake-utils.url = "github:numtide/flake-utils";

ymatsiuk

Pre-requisites:

• parallel, jq, curl
• GITHUB_TOKEN your personal github API token
• ORG the name of your organization
• REPO_TOTAL which is the total number of repositories your org owns (check curl below)

Get REPO_TOTAL

curl -L \

ymatsiuk

{pkgs, lib, ... }:
{
  nixpkgs.overlays = [
    (self: super: {
      xdg-desktop-portal-wlr = super.xdg-desktop-portal-wlr.overrideAttrs
        (oldAttrs: rec {
          nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ pkgs.makeWrapper ];
          postInstall = ''
            wrapProgram $out/libexec/xdg-desktop-portal-wlr --prefix PATH ":" ${lib.makeBinPath [ pkgs.slurp ]}
          '';

ymatsiuk

{ pkgs, ... }:
{
  hardware.bluetooth = {
    enable = true;
    package = pkgs.bluez-master;
    powerOnBoot = true;
  };
}

ymatsiuk

Standard project structure

This is a project structure I’ve found useful. Looking for any thoughts/comments/feedback. Roughly, I found a tension between the style nixpkgs expects and the style conducive to development, so I extracted the common portion into a derivation.nix which is used by the remaining .nix files. This setup allows me to use nix build, nix-shell, overlays, Hydra, alternate packaging schemes, cross-compiling, etc.

ymatsiuk

setfont latarcyrheb-sun32
wifi-menu
timedatectl set-ntp 1
timedatectl set-timezone Europe/Amsterdam
hwclock --systohc --utc
gdisk /dev/nvme0n1
cryptsetup luksFormat --type=luks2 --verbose -c aes-xts-plain64 -y --use-random /dev/nvme0n1p2
lsblk
mkfs.vfat -F32 /dev/nvme0n1p1
cryptsetup open /dev/nvme0n1p2 luks

ymatsiuk

Arch Linux Full-Disk Encryption Installation Guide

This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS and an encrypted boot partition (GRUB) for UEFI systems.

Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and self-signed kernel and bootloader.

Preface

You will find most of this information pulled from the Arch Wiki and other resources linked thereof.

Note: The system was installed on an NVMe SSD, substitute /dev/nvme0nX with /dev/sdX or your device as needed.

ymatsiuk

# This assumes a wifi only system...
wifi-menu

# Grab latest mirror list for Germany sorted by speed IPv4 only.
curl -o /etc/pacman.d/mirrorlist https://www.archlinux.org/mirrorlist/?country=DE&protocol=https&ip_version=4&use_mirror_status=on
sed -i 's/\#Server/Server/g' /etc/pacman.d/mirrorlist

# Create partitions
cgdisk /dev/nvme0n1
1 512MB EFI partition # Hex code ef00

ymatsiuk

# AUTOMATICALLY GENERATED
# DO NOT EDIT THIS FILE DIRECTLY, USE /Dockerfile.template.erb

FROM alpine:3.5
MAINTAINER TAGOMORI Satoshi <[email protected]>
LABEL Description="Fluentd docker image" Vendor="Fluent Organization" Version="1.1"

ENV DUMB_INIT_VERSION=1.2.0

ENV SU_EXEC_VERSION=0.2

ymatsiuk

<ROOT>
  <source>
    @type forward
  </source>
  <match **>
    @type copy
    <store>
      @type stdout
    </store>
    <store>