{ host, rpi4 }: { config, pkgs, ... }: { deployment.targetHost = host; nix.nixPath = [ "nixpkgs=${pkgs.path}" ]; programs.command-not-found.dbPath = "${pkgs.path}/programs.sqlite"; nixpkgs.system = "aarch64-linux"; boot.loader.grub.enable = false; boot.loader.generic-extlinux-compatible.enable = true; boot.loader.raspberryPi = pkgs.lib.mkIf rpi4 { enable = true; version = 4; firmwareConfig = '' dtparam=audio=on ''; }; boot.kernelParams = ["cma=64M"]; # work around https://github.com/raspberrypi/linux/issues/3208 boot.kernelPackages = if rpi4 then pkgs.linuxPackages_rpi4 else pkgs.linuxPackages_rpi3; hardware.deviceTree.enable = true; hardware.deviceTree.base = pkgs.device-tree_rpi; hardware.deviceTree.overlays = [ "${pkgs.device-tree_rpi.overlays}/rpi-poe.dtbo" ]; fileSystems = { "/" = { device = "/dev/disk/by-label/NIXOS_SD"; fsType = "ext4"; }; }; services.openssh.enable = true; services.openssh.passwordAuthentication = false; services.openssh.extraConfig = '' StreamLocalBindUnlink yes ''; programs.mosh.enable = true; networking.hostName = host; time.timeZone = "Asia/Hong_Kong"; hardware.enableRedistributableFirmware = true; services.hostapd = { enable = true; interface = "wlan0"; hwMode = "g"; ssid = "M-Labs-ext"; wpaPassphrase = (import /etc/nixos/secret/wifi_ext_password.nix); extraConfig = '' ieee80211d=1 country_code=HK ieee80211n=1 wmm_enabled=1 auth_algs=1 wpa_key_mgmt=WPA-PSK rsn_pairwise=CCMP ''; }; networking.interfaces.eth0 = { ipv4.addresses = [{ address = "192.168.1.30"; prefixLength = 24; }]; ipv6.addresses = [{ address = "2001:470:f821:1:dea6:32ff:fe95:2fcf"; prefixLength = 64; }]; ipv4.routes = [{ address = "0.0.0.0"; prefixLength = 0; via = "192.168.1.1"; }]; ipv6.routes = [{ address = "::"; prefixLength = 0; via = "fe80::523e:aaff:fe0c:e49d"; }]; }; networking.interfaces.wlan0 = { ipv4.addresses = [{ address = "192.168.13.1"; prefixLength = 24; }]; ipv6.addresses = [{ address = "2001:470:f821:3::"; prefixLength = 64; }]; }; services.dnsmasq = { enable = true; servers = ["192.168.1.1#53"]; extraConfig = '' interface=wlan0 bind-interfaces dhcp-range=192.168.13.10,192.168.13.254,24h enable-ra dhcp-range=::,constructor:wlan0,ra-only no-resolv ''; }; boot.kernel.sysctl."net.ipv4.ip_forward" = 1; boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1"; boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1"; users.mutableUsers = false; users.defaultUserShell = pkgs.fish; users.extraUsers = import ./common-users.nix { inherit pkgs; }; security.sudo.wheelNeedsPassword = false; documentation.enable = false; environment.systemPackages = with pkgs; [ psmisc wget vim git sshfs usbutils lm_sensors file telnet mosh tmux ]; programs.fish.enable = true; services.avahi.enable = true; services.avahi.publish.enable = true; services.avahi.publish.userServices = true; services.printing.enable = true; services.printing.drivers = [ pkgs.hplip ]; services.printing.browsing = true; services.printing.listenAddresses = [ "192.168.1.30:631" "192.168.13.1:631" ]; services.printing.defaultShared = true; hardware.sane.enable = true; hardware.sane.extraBackends = [ pkgs.hplip ]; sound.enable = true; hardware.pulseaudio.enable = true; hardware.pulseaudio.systemWide = true; hardware.pulseaudio.tcp.enable = true; hardware.pulseaudio.tcp.anonymousClients.allowedIpRanges = ["192.168.1.0/24"]; networking.firewall.allowedTCPPorts = [ 631 4713 ]; networking.firewall.interfaces.wlan0.allowedUDPPorts = [ 53 67 ]; nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="]; nix.binaryCaches = ["https://cache.nixos.org" "https://nixbld.m-labs.hk"]; nix.trustedUsers = ["root" "nix"]; }