etc

config.nix

@@ -1,5 +1,6 @@
-{...} : {
-networking.hostName = "nixos";
+{ ... }:
+{
+  networking.hostName = "nixos";
   services.openssh.enable = true;
 
   users.users.stary = {

disable-systemd-security.nix

@@ -1,73 +1,109 @@
-{...}: {            
+{ lib, ... }:
+{
   # who needs security lmao
   systemd.services.systemd-journald = {
     serviceConfig = {
-                  DeviceAllow = "";
-                  IPAddressDeny = "";
-                  LockPersonality = "no";
-                  MemoryDenyWriteExecute = "no";
-                  NoNewPrivileges = "no";
-                  ProtectClock = "no";
-                  RestrictAddressFamilies = "";
-                  RestrictNamespaces = "";
-                  RestrictRealtime = "no";
-                  RestrictSUIDSGID = "no";
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
   systemd.services.systemd-udevd = {
     serviceConfig = {
-                  DeviceAllow = "";
-                  IPAddressDeny = "";
-                  LockPersonality = "no";
-                  MemoryDenyWriteExecute = "no";
-                  NoNewPrivileges = "no";
-                  ProtectClock = "no";
-                  RestrictAddressFamilies = "";
-                  RestrictNamespaces = "";
-                  RestrictRealtime = "no";
-                  RestrictSUIDSGID = "no";
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
   systemd.services.systemd-oomd = {
     serviceConfig = {
-                  DeviceAllow = "";
-                  IPAddressDeny = "";
-                  LockPersonality = "no";
-                  MemoryDenyWriteExecute = "no";
-                  NoNewPrivileges = "no";
-                  ProtectClock = "no";
-                  RestrictAddressFamilies = "";
-                  RestrictNamespaces = "";
-                  RestrictRealtime = "no";
-                  RestrictSUIDSGID = "no";
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
   systemd.services.systemd-timesyncd = {
     serviceConfig = {
-                  DeviceAllow = "";
-                  IPAddressDeny = "";
-                  LockPersonality = "no";
-                  MemoryDenyWriteExecute = "no";
-                  NoNewPrivileges = "no";
-                  ProtectClock = "no";
-                  RestrictAddressFamilies = "";
-                  RestrictNamespaces = "";
-                  RestrictRealtime = "no";
-                  RestrictSUIDSGID = "no";
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
+    };
+  };
+  systemd.services.systemd-timedated = {
+    serviceConfig = {
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
+    };
+  };
+  systemd.services.systemd-hostnamed = {
+    serviceConfig = {
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
   systemd.services.systemd-logind = {
     serviceConfig = {
-                  DeviceAllow = "";
-                  IPAddressDeny = "";
-                  LockPersonality = "no";
-                  MemoryDenyWriteExecute = "no";
-                  NoNewPrivileges = "no";
-                  ProtectClock = "no";
-                  RestrictAddressFamilies = "";
-                  RestrictNamespaces = "";
-                  RestrictRealtime = "no";
-                  RestrictSUIDSGID = "no";
+      DeviceAllow = lib.mkForce "";
+      IPAddressDeny = lib.mkForce "";
+      LockPersonality = lib.mkForce "no";
+      MemoryDenyWriteExecute = lib.mkForce "no";
+      NoNewPrivileges = lib.mkForce "no";
+      ProtectClock = lib.mkForce "no";
+      RestrictAddressFamilies = lib.mkForce "";
+      RestrictNamespaces = lib.mkForce "";
+      RestrictRealtime = lib.mkForce "no";
+      RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
   systemd.services.dhcpcd = {
@@ -82,6 +118,7 @@
       RestrictNamespaces = lib.mkForce "";
       RestrictRealtime = lib.mkForce "no";
       RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
   systemd.services.nginx = {
@@ -96,6 +133,7 @@
       RestrictNamespaces = lib.mkForce "";
       RestrictRealtime = lib.mkForce "no";
       RestrictSUIDSGID = lib.mkForce "no";
+      SystemCallFilter = lib.mkForce "";
     };
   };
 }

flake.nix

@@ -36,6 +36,11 @@
               networking.hostName = "lancom";
               boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.callPackage ./lancom-kernel.nix { });
               system.boot.loader.kernelFile = "uImage";
+
+              fileSystems."/" = {
+                device = "/dev/nvme0n1p2";
+                fsType = "ext4";
+              };
             }
           )
         ];
@@ -50,14 +55,20 @@
           (import ./ppc.nix)
           (import ./nginx.nix)
           (import ./config.nix)
+          (import ./disable-systemd-security.nix)
 
           (
             { pkgs, lib, ... }:
             {
               networking.hostName = "nixos";
-              boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.callPackage ./wiiu-kernel.nix { });
+              boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.callPackage ./wiiu-kernel-6.6.nix { });
 
               system.boot.loader.kernelFile = "dtbImage.wiiu";
+
+              fileSystems."/" = {
+                device = "/dev/sda1";
+                fsType = "ext4";
+              };
             }
           )
         ];

ppc.nix

@@ -32,9 +32,4 @@
 
   # temp hack in config
   systemd.tpm2.enable = false;
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/NIXOS_SD";
-    fsType = "ext4";
-  };
 }

wiiu-kernel-4.19.nix

@@ -0,0 +1,41 @@
+# see https://discourse.nixos.org/t/port-nixos-to-ppc32/11965/13
+
+{
+  buildLinux,
+  fetchFromGitLab,
+  fetchurl,
+  lib,
+  stdenv,
+  ...
+}@args:
+lib.overrideDerivation
+  (buildLinux (
+    args
+    // {
+      version = "4.19.322-wiiu";
+      src = fetchFromGitLab {
+        owner = "linux-wiiu";
+        repo = "linux-wiiu";
+        rev = "18a5a3dd77d992da8b154a9f4d1787d8a3a8b20c"; # rewrite-4.19
+        hash = "sha256-uqH8IPK4wcGKLEFXlwG8FaSTcQ/LmKHT+LZSE2QEvpU=";
+      };
+
+      autoModules = false;
+
+      features = {
+        efiBootStub = false;
+        iwlwifi = false;
+        needsCifsUtils = false;
+      };
+
+      enableCommonConfig = false;
+      defconfig = "wiiu_defconfig";
+    }
+  ))
+  (old: {
+    postInstall =
+      ''
+        cp arch/powerpc/boot/dtbImage.wiiu $out/
+      ''
+      + old.postInstall;
+  })

wiiu-kernel-6.6.nix

@@ -28,6 +28,15 @@ lib.overrideDerivation
         needsCifsUtils = false;
       };
 
+      enableCommonConfig = false;
+      #structuredExtraConfig = import ./stripped-config.nix {
+      #   version = "6.6.75-wiiu";
+      #   inherit lib stdenv ;
+      #   rustAvailable = true;
+
+      #   features = {}; # Ensure we know of all extra patches, etc.
+      #};
+
       defconfig = "wiiu_defconfig";
     }
   ))