diff --git a/hosts/apollo/boot.nix b/hosts/apollo/boot.nix index 2560f94..a6d9d33 100644 --- a/hosts/apollo/boot.nix +++ b/hosts/apollo/boot.nix @@ -1,9 +1,10 @@ { pkgs, lib, inputs, ... }: { + boot.kernelParams = [ "rd.luks.options=timeout=0,tries=1" ]; boot.initrd = { supportedFilesystems = [ "ext4" "zfs" ]; - availableKernelModules = [ "hid_apple" ]; + availableKernelModules = [ "hid_apple" "igc" ]; systemd = { enable = true; fido2.enable = true; @@ -24,11 +25,33 @@ crypttabExtraOpts = [ "fido2-device=auto" ]; }; + systemd.services."systemd-cryptsetup@" = { + overrideStrategy = "asDropin"; + serviceConfig = { + Restart = "no"; + OnFailureJobMode = "fail"; + }; + }; + systemd.services."zfs-import-nix-root" = { wants = [ "keys.mount" ]; after = [ "keys.mount" ]; }; + network = { + enable = true; + ssh = { + enable = true; + port = 2222; + hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ]; + + # Use an inline string to prepend the forced systemd command to your key + authorizedKeys = [ + ''command="${pkgs.systemd}/bin/systemd-tty-ask-password-agent --watch" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjed9TzAaS6afEilS6CQAyz7DRJUNeLWGeboB3Ma3Rb remote-fido-unlock'' + ]; + }; + }; + }; systemd.services."zfs-import-nix-main" = { diff --git a/hosts/apollo/default.nix b/hosts/apollo/default.nix index 053b185..7f05f9a 100644 --- a/hosts/apollo/default.nix +++ b/hosts/apollo/default.nix @@ -9,20 +9,4 @@ networking.hostName = "apollo"; networking.hostId = "40ced703"; networking.networkmanager.insertNameservers = [ "10.5.0.1" "1.1.1.1" ]; - - programs.hyprland = { - enable = true; - withUWSM = true; - xwayland.enable = true; - }; - - environment.systemPackages = with pkgs; [ - kitty - ]; - - programs.zsh.loginShellInit = '' - if [[ $(tty) == "/dev/tty1" ] && uwsm check may-start; then - exec uwsm start hyprland-uwsm.desktop - fi - ''; } \ No newline at end of file diff --git a/hosts/base.nix b/hosts/base.nix index 4eaedcb..1d15c54 100644 --- a/hosts/base.nix +++ b/hosts/base.nix @@ -61,9 +61,6 @@ variant = ""; }; - programs.zsh.enable = true; - users.defaultUserShell = pkgs.zsh; - users.users.nyxerinys = { isNormalUser = true; description = "Nyx";