profiles/laptop

modules/profiles/laptop/README.md

@@ -43,6 +43,10 @@ A minimal `configuration.nix` to put alongside the flake snippet above:
     ./hardware-configuration.nix
   ];
 
+  profiles.laptop.enable = true;
+  profiles.laptop.hardwareSupport = "minimal";
+  profiles.laptop.user = "lennart";
+
   networking.hostName = "mylaptop";
 
   programs.niri.enable = true;
@@ -53,12 +57,6 @@ A minimal `configuration.nix` to put alongside the flake snippet above:
   ];
 
   users.users.lennart = {
-    isNormalUser = true;
-    extraGroups =
-      [ "wheel" "video" "audio" ]
-      ++ lib.optionals config.services.networkmanager.enable [ "networkmanager" ]
-      ++ lib.optionals config.services.seatd.enable [ config.services.seatd.group ];
-
     # finix has no plaintext passwords; `password` is the hashed form which you can generate with `mkpasswd`
     password = "$6$...";
   };
@@ -87,32 +85,38 @@ The output assumes nixos, so review it and strip out anything that references mo
 
 ## Picking a stack
 
-Two parallel stacks, switched by device manager:
+Three supported stacks, switched by device manager:
 
 | | device mgr | seat mgr | wifi |
 |---|---|---|---|
-| `"standard"` | `udev` | `elogind` | `NetworkManager` |
-| `"minimal"` | `mdevd` | `seatd` | `iwd` |
+| `full` | `gardendevd` | `elogind` | `NetworkManager` |
+| `standard` | `keventd` | `seatd` | `iwd` |
+| `minimal` | `mdevd` | `seatd` | `iwd` |
 
 Flip with:
 
 ```nix
+profiles.laptop.hardwareSupport = "full";
 profiles.laptop.hardwareSupport = "standard";
 profiles.laptop.hardwareSupport = "minimal"
 ```
 
 Assertions enforce no cross-mixing. With `seatd`, the profile also wires up `providers.privileges.rules` for `poweroff`/`reboot`/`zzz` and adds the `seatd` group to `rtkit` + `power-profiles-daemon`.
 
-Pick `udev` (default) if you want:
+Pick `gardendevd` (default) if you want:
 
 - maximum hardware compatibility
 - to use `NetworkManager` (GUI applets, VPN plugins, captive-portal handling)
 - the least surprise - matches the rest of the nixos ecosystem
 - `elogind` to handle session/seat management, suspend-on-lid, power button, etc. for free
 
+Pick `keventd` if you want:
+
+- `udev` compatible rule engine
+- a `finit` native device manager that integrates with your service manager
+
 Pick `mdevd` if you want:
 
-- to avoid pulling in any of the `systemd` codebase (`eudev` is a fork of the `systemd` component)
 - a smaller, faster device manager - `mdevd` is from the skarnet/`s6` family
 - to stay close to a minimalist system
 - `iwd`'s lighter-weight wifi management instead of `NetworkManager`

modules/profiles/laptop/default.nix

@@ -52,33 +52,49 @@ in
 
     hardwareSupport = lib.mkOption {
       type = lib.types.enum [
+        "full"
         "minimal"
         "standard"
       ];
       default = "standard";
       description = ''
         Determine the level of hardware support and stack desired for this system.
 
-        - `standard` - `udev`, `elogind`, and `NetworkManager`, vs
+        - `full` - `gardendevd`, `elogind`, and `NetworkManager`, vs
+        - `standard` - `keventd`, `seatd`, and `iwd`
         - `minimal` - `mdevd`, `seatd`, and `iwd`
       '';
     };
+
+    user = lib.mkOption {
+      type = with lib.types; nullOr str;
+      default = null;
+      description = ''
+        The user to treat as the primary user for this system and configure necussary access for.
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = config.services.elogind.enable -> config.services.udev.enable;
-        message = "elogind (configured via services.elogind.enable = true) requires the (e)udev device manager; please set services.udev.enable = true;";
+        assertion =
+          config.services.elogind.enable -> config.services.gardendevd.enable || config.services.udev.enable;
+        message = "elogind (configured via services.elogind.enable = true) requires either the gardendevd or (e)udev device manager; please set services.gardendevd.enable = true;";
       }
       {
         assertion =
-          config.services.fwupd.enable -> config.services.udev.enable && config.services.udisks2.enable;
-        message = "fwupd (configured via services.fwupd.enable = true) requires the (e)udev device manager and the udisks2 service; please set services.udev.enable = true; and services.udisks2.enable = true;";
+          config.services.fwupd.enable
+          ->
+            (config.services.gardendevd.enable || config.services.udev.enable)
+            && config.services.udisks2.enable;
+        message = "fwupd (configured via services.fwupd.enable = true) requires either the gardendevd or (e)udev device manager and the udisks2 service; please set services.gardendevd.enable = true; and services.udisks2.enable = true;";
       }
       {
-        assertion = config.services.networkmanager.enable -> config.services.udev.enable;
-        message = "NetworkManager (configured via services.networkmanager.enable = true) requires the (e)udev device manager; please set services.udev.enable = true;";
+        assertion =
+          config.services.networkmanager.enable
+          -> config.services.gardendevd.enable || config.services.udev.enable;
+        message = "NetworkManager (configured via services.networkmanager.enable = true) requires either the gardendevd or (e)udev device manager; please set services.gardendevd.enable = true;";
       }
     ];
 
@@ -124,19 +140,21 @@ in
     programs.zzz.enable = lib.mkDefault true;
 
     # choose *one* device manager
-    services.udev.enable = cfg.hardwareSupport == "standard";
-    services.mdevd.enable = cfg.hardwareSupport == "minimal";
-
-    # required for graphical environments
-    services.mdevd.nlgroups = 4;
+    services.mdevd.enable = lib.mkIf (cfg.hardwareSupport == "minimal") (lib.mkDefault true);
+    services.keventd.enable = lib.mkIf (cfg.hardwareSupport == "standard") (lib.mkDefault true);
+    services.gardendevd.enable = lib.mkIf (cfg.hardwareSupport == "full") (lib.mkDefault true);
 
     # choose *one* seat manager
-    services.elogind.enable = config.services.udev.enable;
-    services.seatd.enable = config.services.mdevd.enable;
+    services.seatd.enable = lib.mkIf (
+      cfg.hardwareSupport == "minimal" || cfg.hardwareSupport == "standard"
+    ) (lib.mkDefault true);
+    services.elogind.enable = lib.mkIf (cfg.hardwareSupport == "full") (lib.mkDefault true);
 
     # choose *one* wifi manager
-    services.iwd.enable = config.services.mdevd.enable;
-    services.networkmanager.enable = config.services.udev.enable;
+    services.iwd.enable = lib.mkIf (
+      cfg.hardwareSupport == "minimal" || cfg.hardwareSupport == "standard"
+    ) (lib.mkDefault true);
+    services.networkmanager.enable = lib.mkIf (cfg.hardwareSupport == "full") (lib.mkDefault true);
 
     services.atd.enable = true;
     services.bluetooth.enable = lib.mkDefault true;
@@ -148,7 +166,10 @@ in
       "3600"
     ];
     services.fcron.enable = lib.mkDefault true;
-    services.fwupd.enable = lib.mkDefault config.services.udev.enable;
+    services.fwupd.enable = lib.mkIf (cfg.hardwareSupport == "full") (lib.mkDefault true);
+    services.getty.package = pkgs.util-linuxMinimal // {
+      meta.mainProgram = "agetty";
+    };
     services.nftables.enable = lib.mkDefault true;
     services.nix-daemon.enable = true;
     services.polkit.enable = true;
@@ -161,7 +182,7 @@ in
       config.services.seatd.group
     ];
     services.sysklogd.enable = true;
-    services.udisks2.enable = lib.mkDefault config.services.udev.enable;
+    services.udisks2.enable = lib.mkIf (cfg.hardwareSupport == "full") (lib.mkDefault true);
     services.upower.enable = lib.mkDefault true;
 
     # https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes#Simple_IP/IPv6_Firewall
@@ -214,6 +235,21 @@ in
     xdg.mime.enable = lib.mkDefault true;
     xdg.portal.enable = lib.mkDefault true;
 
+    users.users = lib.optionalAttrs (cfg.user != null) {
+      ${cfg.user} = {
+        isNormalUser = lib.mkDefault true;
+        extraGroups =
+          lib.optionals config.programs.sudo.enable [ "wheel" ]
+          ++ lib.optionals config.services.seatd.enable [
+            "audio"
+            "input"
+            "video"
+
+            config.services.seatd.group
+          ];
+      };
+    };
+
     providers.privileges.rules =
       lib.optionals config.services.seatd.enable [
         {