This repository has no description
3.1 kB
96 lines
1{ self, pkgs, ... }:
2{
3 imports = [
4 ../../2configs
5 ../../2configs/network-manager.nix
6 ../../2configs/pipewire.nix
7 ../../2configs/yubikey.nix
8 ../../2configs/tpm2.nix
9 ../../2configs/desktops/sway/default.nix
10 ../../2configs/power-action.nix
11 ../../2configs/rtl-sdr.nix
12 ../../2configs/browsers.nix
13 ../../2configs/container-bridge.nix
14 ../../2configs/android-webcam.nix
15 ../../2configs/ipfs.nix
16 ../../2configs/steam.nix
17 ../../2configs/games.nix
18 ../../2configs/auto-timezone.nix
19 self.wrapperModules.workspace-manager
20 ];
21 system.stateVersion = "25.05";
22
23 # bitwarden-desktop pulls electron_39, which nixpkgs marks insecure (EOL).
24 # secureify it via an overlay rather than nixpkgs.config.permittedInsecurePackages,
25 # which doesn't list-merge across modules. See lib/secureify.nix.
26 nixpkgs.overlays = [
27 (_final: prev: {
28 electron_39 = self.lib.secureify prev.electron_39;
29 })
30 ];
31
32 boot.tmp.cleanOnBoot = true;
33
34 krebs.build.host = self.inputs.stockholm.kartei.hosts.xerxes;
35
36 environment.systemPackages = [
37 pkgs.bitwarden-desktop
38 pkgs.rbw
39 # retroarch with patched dolphin core (fixes shader compiler thread issue)
40 (pkgs.retroarch.withCores (
41 _cores:
42 builtins.filter (c: c.pname or "" != "libretro-dolphin") pkgs.retroarch-free.cores
43 ++ [ self.packages.${pkgs.system}.libretro-dolphin ]
44 ))
45 pkgs.pavucontrol
46 self.legacyPackages.${pkgs.system}.llm.claude-code
47 pkgs.ripgrep
48 self.packages.${pkgs.system}.mpv
49 pkgs.gh
50 # marked insecure in nixpkgs (private repos unencrypted)
51 (self.lib.secureify pkgs.radicle-node)
52 ];
53
54 documentation.nixos.enable = true;
55 lass.workspace-manager.enable = true;
56
57 # llama-swap: on-demand model hot-swapping proxy for llama.cpp
58 # Models are stored in /data/models/ as GGUF files
59 services.llama-swap =
60 let
61 llama-server = "${pkgs.llama-cpp-rocm}/bin/llama-server";
62 in
63 {
64 enable = true;
65 port = 11434;
66 settings = {
67 healthCheckTimeout = 300;
68 models = {
69 qwen3-32b = {
70 cmd = "${llama-server} --port \${PORT} --model /data/models/qwen3-32b.gguf --ctx-size 16384 --jinja";
71 ttl = 300;
72 };
73 qwen-coder-next = {
74 cmd = "${llama-server} --port \${PORT} --model /data/models/Qwen3-Coder-Next-Q4_K_M/Qwen3-Coder-Next-Q4_K_M-00001-of-00004.gguf --ctx-size 16384 --jinja";
75 ttl = 300;
76 };
77 };
78 };
79 };
80 # ROCm GPU access and environment for llama-swap spawned llama-server processes
81 systemd.services.llama-swap.environment.HSA_OVERRIDE_GFX_VERSION = "11.0.0"; # Radeon 890M (gfx1150/RDNA 3.5) - fallback to gfx1100
82 systemd.services.llama-swap.serviceConfig.SupplementaryGroups = [
83 "render"
84 "video"
85 ];
86
87 # extra-container for testing declarative containers without full rebuilds
88 programs.extra-container.enable = true;
89
90 nix.settings.trusted-users = [
91 "root"
92 "lass"
93 ];
94
95 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1000/ssh-tpm-agent.sock";
96}