add generic system, disable cups

anna328p · Sep 26, 2024 · 5b85350 · 5b85350
1 parent d216fa4
commit 5b85350
Show file tree

Hide file tree

Showing 5 changed files with 84 additions and 43 deletions.
diff --git a/common/workstation/printing.nix b/common/workstation/printing.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
     # PostScript interpreter for printing
@@ -12,7 +12,9 @@
     # CUPS
     # can't be configured more declaratively :(
     services.printing = {
-        enable = true;
+        # CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177
+        enable = lib.mkForce false;
+
         drivers = let p = pkgs; in [
             p.gutenprint p.gutenprintBin
             p.brlaser

diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -158,6 +158,7 @@
                 iris = systems/iris;
 
                 iso = systems/iso;
+                generic = systems/generic;
             };
         };
 
@@ -245,6 +246,9 @@
                 leonardo = [ systems.leonardo ];
                 angelia = [ systems.angelia ];
                 iris = [ systems.iris ];
+
+                generic = [ systems.generic ];
+                generic-small = generic ++ [ common.misc.small ];
             };
         in
             mapAttrValues mkNixosSystem moduleSets;

diff --git a/systems/generic/default.nix b/systems/generic/default.nix
@@ -0,0 +1,35 @@
+{ config, localModules, lib, modulesPath, ... }:
+
+{
+    imports = let
+        inherit (localModules) common;
+    in [
+        common.base
+        common.physical
+        common.workstation
+
+        "${modulesPath}/profiles/all-hardware.nix"
+    ];
+
+    networking = {
+        hostName = "generic";
+        hostId = "91f98e5d";
+    };
+
+    virtualisation.libvirtd.enable = lib.mkForce false;
+
+    time.timeZone = "Etc/UTC";
+
+    boot.kernelParams = [
+        "systemd.setenv=SYSTEMD_SULOGIN_FORCE=1"
+    ];
+
+    misc.uuid = "91f98e5d-dee5-4851-98df-6409bfca1adf";
+
+    boot.initrd.systemd.enable = lib.mkForce false;
+    system.etc.overlay.enable = lib.mkForce false;
+
+    users.users.root.hashedPassword = lib.mkForce "";
+
+    nixpkgs.hostPlatform = lib.systems.examples.gnu64;
+}
diff --git a/systems/theseus/hardware-configuration.nix b/systems/theseus/hardware-configuration.nix
@@ -24,7 +24,7 @@ in {
         nh.common-gpu-amd
     ];
 
-    hardware.amdgpu.opencl = config.misc.buildFull;
+    hardware.amdgpu.opencl.enable = config.misc.buildFull;
 
     fileSystems = let
         btrfsEntry = device: options': {