refector

modules/nixos/features/system/bluetooth.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General = {
+        Experimental = true;
+        FastConnectable = true;
+      };
+      Policy = {
+        AutoEnable = true;
+      };
+    };
+  };
+}

modules/nixos/features/system/boot.nix

@@ -0,0 +1,32 @@
+{ pkgs, ... }:
+{
+  # boot.plymouth.enable = true;
+  boot.loader = {
+    grub = {
+      enable = true;
+      efiSupport = true;
+      useOSProber = true;
+      efiInstallAsRemovable = true;
+      device = "nodev";
+      enableCryptodisk = true;
+
+      # extraInstallCommands = ''
+      #   mkdir -p /boot/EFI/BOOT
+
+      #   cp -f /boot/EFI/NixOS-boot/grubx64.efi /boot/EFI/BOOT/BOOTX64.EFI
+      # '';
+
+      default = "saved";
+      extraConfig = ''
+        GRUB_SAVEDEFAULT=true
+      '';
+    };
+    # efi.canTouchEfiVariables = true;
+    efi.efiSysMountPoint = "/boot";
+  };
+
+  boot.initrd.systemd.enable = true;
+  boot.initrd.systemd.emergencyAccess = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+}

modules/nixos/features/system/graphics.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+}

modules/nixos/features/system/grub-standalone.nix

@@ -0,0 +1,74 @@
+{ pkgs, config, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    grub2_efi
+  ];
+ 
+  system.activationScripts = {
+    # This, has to be the LAST GRUB script to run.
+    # The reason is that a standalone GRUB image takes with it
+    # the configuration too, apparently.
+    # "90-generate-standalone-grub" = {
+    #   text = ''
+    #     if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+    #       echo "Generating standalone GRUB EFI entry..."
+ 
+    #       ESP="${config.boot.loader.efi.efiSysMountPoint}"
+    #       OUT_DIR="$ESP/EFI/NixOS-boot"
+    #       FALLBACK_DIR="$ESP/EFI/BOOT"
+    #       mkdir -p "$OUT_DIR" "$FALLBACK_DIR"
+ 
+    #       OUT="$OUT_DIR/grubx64.efi"
+    #       FALLBACK="$FALLBACK_DIR/BOOTX64.EFI"
+ 
+    #       # GPT-5 told me to add all those modules, idk.
+    #       ${pkgs.grub2_efi}/bin/grub-mkstandalone -O x86_64-efi -o "$OUT" \
+    #         "boot/grub/grub.cfg=${pkgs.writeText "grub-standalone-template.cfg" ''
+    #           search --file --no-floppy --set=esp /EFI/NixOS-boot/grubx64.efi
+    #           set prefix=($esp)/grub
+    #           if [ -f ($esp)/grub/grubenv ]; then
+    #             load_env ($esp)/grub/grubenv
+    #           fi
+    #           if [ -f ($esp)/grub/grub.cfg ]; then
+    #             configfile ($esp)/grub/grub.cfg
+    #           else
+    #             echo "Error: ($esp)/grub/grub.cfg not found."
+    #             sleep 5
+    #           fi
+    #           ''}" \
+    #         --modules="part_gpt part_msdos fat normal search search_fs_uuid search_label configfile linux gzio efi_gop efi_uga all_video gfxterm gfxmenu png jpeg tga font" \
+    #         --disable-shim-lock
+ 
+    #       # It's so stupid but otherwise it won't boot:
+    #       # https://wejn.org/2021/09/fixing-grub-verification-requested-nobody-cares/
+    #       ${pkgs.gnused}/bin/sed -i 's/SecureBoot/SecureB00t/' "$OUT"
+ 
+    #       cp -f "$OUT" "$FALLBACK"
+    #     fi
+    #   '';
+    # };
+    "99-sign-all" = {
+      text = ''
+        if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+          echo "Signing all EFI binaries with sbctl..."
+          
+          # 1. 파일이 존재하는지 먼저 확인하고, 
+          # 2. 이미 등록되어 있다면 sign-all로 한 번에 처리하거나,
+          # 3. 개별 파일에 대해 에러가 나도 스크립트가 중단되지 않도록 || true를 붙입니다.
+
+          # 주요 바이너리들을 DB에 등록 (이미 등록되어 있으면 sbctl이 알아서 스킵하거나 에러를 낼 텐데, 그걸 무시합니다)
+          ${pkgs.sbctl}/bin/sbctl sign -s /boot/EFI/NixOS-boot/grubx64.efi || true
+          ${pkgs.sbctl}/bin/sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI || true
+          
+          # Windows 부트로더 등 다른 파일들도 필요한 경우 추가
+          if [ -f /boot/EFI/Microsoft/Boot/bootmgfw.efi ]; then
+            ${pkgs.sbctl}/bin/sbctl sign -s /boot/EFI/Microsoft/Boot/bootmgfw.efi || true
+          fi
+
+          # 4. 마지막으로 전체 서명 수행
+          ${pkgs.sbctl}/bin/sbctl sign-all || echo "Some files failed to sign, but continuing..."
+        fi
+      '';
+    };
+  };
+}

modules/nixos/features/system/sbctl.nix

@@ -0,0 +1,37 @@
+{ pkgs, config, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    sbctl
+  ];
+ 
+  # The 99 here ensures that this runs AFTER the grub activation scripts.
+  system.activationScripts."99-sign-all" = {
+    text = ''
+      if [ "$NIXOS_ACTION" = "switch" ] || [ "$NIXOS_ACTION" = "boot" ]; then
+        # `sbctl verify --json` returns "null" if there is an error,
+        # empty string if there are no files in the database.
+        if [ "$(${pkgs.sbctl}/bin/sbctl verify --json)" != "null" ]; then
+ 
+          echo "Signing all EFI binaries with sbctl..."
+ 
+          ESP="${config.boot.loader.efi.efiSysMountPoint}"
+          readarray -t files < <(find "$ESP" -type f -iname "*.efi" -o -iname "*bzImage")
+ 
+          # Removing all the files first.
+          for file in "${"$"}{files[@]}"; do
+            echo "Removing from sbctl: $file"
+            # The `|| true` part is because otherwise some files might not exist and
+            # the script would return an error.
+            ${pkgs.sbctl}/bin/sbctl remove-file "$file" >/dev/null 2>&1 || true
+          done
+ 
+          for file in "${"$"}{files[@]}"; do
+            echo "Signing with sbctl: $file"
+            ${pkgs.sbctl}/bin/sbctl sign -s "$file" >/dev/null 2>&1
+          done
+ 
+        fi
+      fi
+    '';
+  };
+}

modules/nixos/features/system/sound.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  # 사운드
+  services.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+}

modules/nixos/features/system/virtualisation.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+  };
+
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu = {
+      package = pkgs.qemu_kvm;
+      runAsRoot = true;
+      swtpm.enable = true;
+    };
+  };
+
+  # Override the virt-secret-init-encryption service to use correct shell path
+  systemd.services.virt-secret-init-encryption = {
+    serviceConfig.ExecStart = [
+      ""
+      "${pkgs.bash}/bin/bash -c 'umask 0077 && (${pkgs.coreutils}/bin/dd if=/dev/urandom status=none bs=32 count=1 | ${pkgs.systemd}/bin/systemd-creds encrypt --name=secrets-encryption-key - /var/lib/libvirt/secrets/secrets-encryption-key)'"
+    ];
+  };
+}