me like nix
1{ inputs, config, ... }:
2
3let
4 nm = config.flake.modules.nixos;
5in
6{
7 flake.nixosConfigurations.kodi-pi = inputs.nixos-raspberrypi.lib.nixosSystemFull {
8 specialArgs = {
9 inherit inputs;
10 inherit (inputs) nixos-raspberrypi;
11 };
12 modules = [
13 (
14 { nixos-raspberrypi, ... }:
15 {
16 imports = with nixos-raspberrypi.nixosModules; [
17 raspberry-pi-5.base
18 raspberry-pi-5.page-size-16k
19 raspberry-pi-5.display-vc4
20 ];
21 }
22 )
23 # Disable SDL3 test suite (testprocess fails in Nix sandbox)
24 (
25 { pkgs, ... }:
26 {
27 nixpkgs.overlays = [
28 (final: prev: {
29 sdl3 = prev.sdl3.overrideAttrs (old: {
30 doCheck = false;
31 });
32 })
33 ];
34 }
35 )
36 inputs.agenix.nixosModules.default
37
38 # Aspect modules
39 nm.pi-wifi
40
41 # Kodi Pi 5 specific settings
42 (
43 { pkgs, lib, ... }:
44 {
45 networking.hostName = "kodi-pi";
46
47 boot.loader.raspberry-pi.bootloader = "kernel";
48 boot.kernelParams = [ "video=HDMI-A-1:3840x2160@30D" ];
49
50 fileSystems."/" = {
51 device = "/dev/disk/by-label/NIXOS_SD";
52 fsType = "ext4";
53 options = [ "noatime" ];
54 };
55 fileSystems."/boot/firmware" = {
56 device = "/dev/disk/by-label/FIRMWARE";
57 fsType = "vfat";
58 options = [
59 "noatime"
60 "noauto"
61 "x-systemd.automount"
62 "x-systemd.idle-timeout=1min"
63 ];
64 };
65
66 hardware.graphics.enable = true;
67
68 hardware.raspberry-pi.config.all.options = {
69 gpu_mem = {
70 enable = true;
71 value = 512;
72 };
73 hdmi_force_hotplug = {
74 enable = true;
75 value = true;
76 };
77 };
78
79 services.pipewire = {
80 enable = true;
81 alsa.enable = true;
82 pulse.enable = true;
83 };
84
85 services.cage = {
86 enable = true;
87 user = "kiosk";
88 program = "${pkgs.jellyfin-media-player}/bin/jellyfinmediaplayer --tv";
89 };
90
91 users.users.kiosk = {
92 isNormalUser = true;
93 extraGroups = [
94 "video"
95 "audio"
96 "input"
97 "render"
98 ];
99 };
100
101 users.users.sean = {
102 isNormalUser = true;
103 extraGroups = [ "wheel" ];
104 openssh.authorizedKeys.keys = [
105 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCIqgZ7kedxo+mOW7YG73Vp3zel3h180y3GKvHtRsXfGlpIIvRDy7pgCBQ4AGXYD4y78URQmFohYSAPqCPOPaWcU2un3XG9KvCzEsHmsbskPonitUmCiKvrKkb6oW4jCBtd7AEtBn+AiajAQFtPZ7NN2Df3AmTypvR6Irg7R+nxnfc9NTIHmGvxSDyWcbb4pguL20sctUSqGL6xGh8q/bqhdOThSimM+z9bEUNxK/5rPhwkNniMrp4pJcUrUiAh5/4DiRFG6KT+oeg+/myoz/Z1sPvAs7u/8JDQI4RshRD8Hu0oTkRBN6Hxj478q2SXbeBUZlD6IdjP3RhGpmSecoDdtWqKbpuV3eVRtQtba3KL86GBeV/bugaOdJ1Aud+1SOFJreAAuvxzMMKT+cdQZk6oOPP148DA/No+mDm/2S43lcdCXh79wA6YRAmKQ8jmZxTCtPutrvuZK1rguvvUlEoG/vhdNHh7eDa4Td07V6bjCRPUl8qk/e4M0E3pwsTlZc="
106 "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOIgEteUEW06dnBHe2z8vNLwz2iMKe8bba6JgMmOUpcBAAAABHNzaDo= sean@framework16"
107 ];
108 };
109
110 services.openssh = {
111 enable = true;
112 settings = {
113 PasswordAuthentication = false;
114 PermitRootLogin = "no";
115 };
116 };
117
118 nix.settings.require-sigs = false;
119 nix.settings.substituters = [
120 "https://nixos-raspberrypi.cachix.org"
121 "https://seanaye.cachix.org"
122 ];
123 nix.settings.trusted-public-keys = [
124 "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
125 "seanaye.cachix.org-1:0Qf3cZ1SwnTwqaiNGltYySksjGHnemzRPiodThnvibA="
126 ];
127
128 networking.useDHCP = true;
129 security.sudo.wheelNeedsPassword = false;
130
131 networking.firewall.allowedTCPPorts = [ 22 ];
132
133 environment.systemPackages = [ pkgs.jellyfin-media-player ];
134
135 system.stateVersion = "24.11";
136 }
137 )
138 ];
139 };
140}