···

       
30
       
 
       
```

     

       
31
       
 
       


     

       
32
       
 
       
The second mechanism is to add the OpenCL driver package to

     

       
33
       
-
       
[`hardware.opengl.extraPackages`](options.html#opt-hardware.opengl.extraPackages).

     

       
34
       
 
       
This links the ICD file under `/run/opengl-driver`, where it will be visible

     

       
35
       
 
       
to the ICD loader.

     

       
36
       
 
       


     
···

       
51
       
 
       
Modern AMD [Graphics Core

     

       
52
       
 
       
Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are

     

       
53
       
 
       
supported through the rocm-opencl-icd package. Adding this package to

     

       
54
       
-
       
[`hardware.opengl.extraPackages`](options.html#opt-hardware.opengl.extraPackages)

     

       
55
       
 
       
enables OpenCL support:

     

       
56
       
 
       


     

       
57
       
 
       
```nix

     
···

       
71
       
 
       
alternative for Gen7 GPUs.

     

       
72
       
 
       


     

       
73
       
 
       
The intel-compute-runtime, beignet, or intel-ocl package can be added to

     

       
74
       
-
       
[`hardware.opengl.extraPackages`](options.html#opt-hardware.opengl.extraPackages)

     

       
75
       
 
       
to enable OpenCL support. For example, for Gen8 and later GPUs, the following

     

       
76
       
 
       
configuration can be used:

     

       
77
       
 
       


     
···

       
88
       
 
       
compatibility layers like

     

       
89
       
 
       
[DXVK](https://github.com/doitsujin/dxvk/wiki).

     

       
90
       
 
       


     

       
91
       
-
       
By default, if [`hardware.opengl.driSupport`](options.html#opt-hardware.opengl.driSupport)

     

       
92
       
 
       
is enabled, mesa is installed and provides Vulkan for supported hardware.

     

       
93
       
 
       


     

       
94
       
 
       
Similar to OpenCL, Vulkan drivers are loaded through the *Installable

     
···

       
108
       
 
       
```

     

       
109
       
 
       


     

       
110
       
 
       
The second mechanism is to add the Vulkan driver package to

     

       
111
       
-
       
[`hardware.opengl.extraPackages`](options.html#opt-hardware.opengl.extraPackages).

     

       
112
       
 
       
This links the ICD file under `/run/opengl-driver`, where it will be

     

       
113
       
 
       
visible to the ICD loader.

     

       
114
       
 
       


     
···

       
138
       
 
       
Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are

     

       
139
       
 
       
supported through either radv, which is part of mesa, or the amdvlk

     

       
140
       
 
       
package. Adding the amdvlk package to

     

       
141
       
-
       
[`hardware.opengl.extraPackages`](options.html#opt-hardware.opengl.extraPackages)

     

       
142
       
 
       
makes amdvlk the default driver and hides radv and lavapipe from the device list.

     

       
143
       
 
       
A specific driver can be forced as follows:

     

       
144
       
 
       


     

···

       
30
       
 
       
```

     

       
31
       
 
       


     

       
32
       
 
       
The second mechanism is to add the OpenCL driver package to

     

       
33
       
+
       
[](#opt-hardware.opengl.extraPackages).

     

       
34
       
 
       
This links the ICD file under `/run/opengl-driver`, where it will be visible

     

       
35
       
 
       
to the ICD loader.

     

       
36
       
 
       


     
···

       
51
       
 
       
Modern AMD [Graphics Core

     

       
52
       
 
       
Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are

     

       
53
       
 
       
supported through the rocm-opencl-icd package. Adding this package to

     

       
54
       
+
       
[](#opt-hardware.opengl.extraPackages)

     

       
55
       
 
       
enables OpenCL support:

     

       
56
       
 
       


     

       
57
       
 
       
```nix

     
···

       
71
       
 
       
alternative for Gen7 GPUs.

     

       
72
       
 
       


     

       
73
       
 
       
The intel-compute-runtime, beignet, or intel-ocl package can be added to

     

       
74
       
+
       
[](#opt-hardware.opengl.extraPackages)

     

       
75
       
 
       
to enable OpenCL support. For example, for Gen8 and later GPUs, the following

     

       
76
       
 
       
configuration can be used:

     

       
77
       
 
       


     
···

       
88
       
 
       
compatibility layers like

     

       
89
       
 
       
[DXVK](https://github.com/doitsujin/dxvk/wiki).

     

       
90
       
 
       


     

       
91
       
+
       
By default, if [](#opt-hardware.opengl.driSupport)

     

       
92
       
 
       
is enabled, mesa is installed and provides Vulkan for supported hardware.

     

       
93
       
 
       


     

       
94
       
 
       
Similar to OpenCL, Vulkan drivers are loaded through the *Installable

     
···

       
108
       
 
       
```

     

       
109
       
 
       


     

       
110
       
 
       
The second mechanism is to add the Vulkan driver package to

     

       
111
       
+
       
[](#opt-hardware.opengl.extraPackages).

     

       
112
       
 
       
This links the ICD file under `/run/opengl-driver`, where it will be

     

       
113
       
 
       
visible to the ICD loader.

     

       
114
       
 
       


     
···

       
138
       
 
       
Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are

     

       
139
       
 
       
supported through either radv, which is part of mesa, or the amdvlk

     

       
140
       
 
       
package. Adding the amdvlk package to

     

       
141
       
+
       
[](#opt-hardware.opengl.extraPackages)

     

       
142
       
 
       
makes amdvlk the default driver and hides radv and lavapipe from the device list.

     

       
143
       
 
       
A specific driver can be forced as follows:

     

       
144
       
 
       


     

···

       
39
       
 
       
```

     

       
40
       
 
       


     

       
41
       
 
       
Note: Assigning either role will also default both

     

       
42
       
-
       
[`services.kubernetes.flannel.enable`](options.html#opt-services.kubernetes.flannel.enable)

     

       
43
       
-
       
and [`services.kubernetes.easyCerts`](options.html#opt-services.kubernetes.easyCerts)

     

       
44
       
 
       
to true. This sets up flannel as CNI and activates automatic PKI bootstrapping.

     

       
45
       
 
       


     

       
46
       
 
       
As of kubernetes 1.10.X it has been deprecated to open non-tls-enabled

     
···

       
48
       
 
       
ports have been disabled by default. While opening insecure ports is

     

       
49
       
 
       
still possible, it is recommended not to bind these to other interfaces

     

       
50
       
 
       
than loopback. To re-enable the insecure port on the apiserver, see options:

     

       
51
       
-
       
[`services.kubernetes.apiserver.insecurePort`](options.html#opt-services.kubernetes.apiserver.insecurePort) and

     

       
52
       
-
       
[`services.kubernetes.apiserver.insecureBindAddress`](options.html#opt-services.kubernetes.apiserver.insecureBindAddress)

     

       
53
       
 
       


     

       
54
       
 
       
::: {.note}

     

       
55
       
 
       
As of NixOS 19.03, it is mandatory to configure:

     

       
56
       
-
       
[`services.kubernetes.masterAddress`](options.html#opt-services.kubernetes.masterAddress).

     

       
57
       
 
       
The masterAddress must be resolveable and routeable by all cluster nodes.

     

       
58
       
 
       
In single node clusters, this can be set to `localhost`.

     

       
59
       
 
       
:::

     
···

       
69
       
 
       


     

       
70
       
 
       
The NixOS kubernetes module provides an option for automatic certificate

     

       
71
       
 
       
bootstrapping and configuration,

     

       
72
       
-
       
[`services.kubernetes.easyCerts`](options.html#opt-services.kubernetes.easyCerts).

     

       
73
       
 
       
The PKI bootstrapping process involves setting up a certificate authority (CA)

     

       
74
       
 
       
daemon (cfssl) on the kubernetes master node. cfssl generates a CA-cert

     

       
75
       
 
       
for the cluster, and uses the CA-cert for signing subordinate certs issued

     

       
76
       
 
       
to each of the cluster components. Subsequently, the certmgr daemon monitors

     

       
77
       
 
       
active certificates and renews them when needed. For single node Kubernetes

     

       
78
       
-
       
clusters, setting [`services.kubernetes.easyCerts`](options.html#opt-services.kubernetes.easyCerts)

     

       
79
       
 
       
= true is sufficient and no further action is required. For joining extra node

     

       
80
       
 
       
machines to an existing cluster on the other hand, establishing initial

     

       
81
       
 
       
trust is mandatory.

     

       
82
       
 
       


     

       
83
       
 
       
To add new nodes to the cluster: On any (non-master) cluster node where

     

       
84
       
-
       
[`services.kubernetes.easyCerts`](options.html#opt-services.kubernetes.easyCerts)

     

       
85
       
 
       
is enabled, the helper script `nixos-kubernetes-node-join` is available on PATH.

     

       
86
       
 
       
Given a token on stdin, it will copy the token to the kubernetes secrets directory

     

       
87
       
 
       
and restart the certmgr service. As requested certificates are issued, the

     
···

       
96
       
 
       
one needs to have cluster-admin privileges. By default, when easyCerts

     

       
97
       
 
       
is enabled, a cluster-admin kubeconfig file is generated and linked into

     

       
98
       
 
       
`/etc/kubernetes/cluster-admin.kubeconfig` as determined by

     

       
99
       
-
       
[`services.kubernetes.pki.etcClusterAdminKubeconfig`](options.html#opt-services.kubernetes.pki.etcClusterAdminKubeconfig).

     

       
100
       
 
       
`export KUBECONFIG=/etc/kubernetes/cluster-admin.kubeconfig` will make

     

       
101
       
 
       
kubectl use this kubeconfig to access and authenticate the cluster. The

     

       
102
       
 
       
cluster-admin kubeconfig references an auto-generated keypair owned by

     

···

       
39
       
 
       
```

     

       
40
       
 
       


     

       
41
       
 
       
Note: Assigning either role will also default both

     

       
42
       
+
       
[](#opt-services.kubernetes.flannel.enable)

     

       
43
       
+
       
and [](#opt-services.kubernetes.easyCerts)

     

       
44
       
 
       
to true. This sets up flannel as CNI and activates automatic PKI bootstrapping.

     

       
45
       
 
       


     

       
46
       
 
       
As of kubernetes 1.10.X it has been deprecated to open non-tls-enabled

     
···

       
48
       
 
       
ports have been disabled by default. While opening insecure ports is

     

       
49
       
 
       
still possible, it is recommended not to bind these to other interfaces

     

       
50
       
 
       
than loopback. To re-enable the insecure port on the apiserver, see options:

     

       
51
       
+
       
[](#opt-services.kubernetes.apiserver.insecurePort) and

     

       
52
       
+
       
[](#opt-services.kubernetes.apiserver.insecureBindAddress)

     

       
53
       
 
       


     

       
54
       
 
       
::: {.note}

     

       
55
       
 
       
As of NixOS 19.03, it is mandatory to configure:

     

       
56
       
+
       
[](#opt-services.kubernetes.masterAddress).

     

       
57
       
 
       
The masterAddress must be resolveable and routeable by all cluster nodes.

     

       
58
       
 
       
In single node clusters, this can be set to `localhost`.

     

       
59
       
 
       
:::

     
···

       
69
       
 
       


     

       
70
       
 
       
The NixOS kubernetes module provides an option for automatic certificate

     

       
71
       
 
       
bootstrapping and configuration,

     

       
72
       
+
       
[](#opt-services.kubernetes.easyCerts).

     

       
73
       
 
       
The PKI bootstrapping process involves setting up a certificate authority (CA)

     

       
74
       
 
       
daemon (cfssl) on the kubernetes master node. cfssl generates a CA-cert

     

       
75
       
 
       
for the cluster, and uses the CA-cert for signing subordinate certs issued

     

       
76
       
 
       
to each of the cluster components. Subsequently, the certmgr daemon monitors

     

       
77
       
 
       
active certificates and renews them when needed. For single node Kubernetes

     

       
78
       
+
       
clusters, setting [](#opt-services.kubernetes.easyCerts)

     

       
79
       
 
       
= true is sufficient and no further action is required. For joining extra node

     

       
80
       
 
       
machines to an existing cluster on the other hand, establishing initial

     

       
81
       
 
       
trust is mandatory.

     

       
82
       
 
       


     

       
83
       
 
       
To add new nodes to the cluster: On any (non-master) cluster node where

     

       
84
       
+
       
[](#opt-services.kubernetes.easyCerts)

     

       
85
       
 
       
is enabled, the helper script `nixos-kubernetes-node-join` is available on PATH.

     

       
86
       
 
       
Given a token on stdin, it will copy the token to the kubernetes secrets directory

     

       
87
       
 
       
and restart the certmgr service. As requested certificates are issued, the

     
···

       
96
       
 
       
one needs to have cluster-admin privileges. By default, when easyCerts

     

       
97
       
 
       
is enabled, a cluster-admin kubeconfig file is generated and linked into

     

       
98
       
 
       
`/etc/kubernetes/cluster-admin.kubeconfig` as determined by

     

       
99
       
+
       
[](#opt-services.kubernetes.pki.etcClusterAdminKubeconfig).

     

       
100
       
 
       
`export KUBECONFIG=/etc/kubernetes/cluster-admin.kubeconfig` will make

     

       
101
       
 
       
kubectl use this kubeconfig to access and authenticate the cluster. The

     

       
102
       
 
       
cluster-admin kubeconfig references an auto-generated keypair owned by

     

···

       
42
       
 
       


     

       
43
       
 
       
Kernel modules for hardware devices are generally loaded automatically

     

       
44
       
 
       
by `udev`. You can force a module to be loaded via

     

       
45
       
-
       
[`boot.kernelModules`](options.html#opt-boot.kernelModules), e.g.

     

       
46
       
 
       


     

       
47
       
 
       
```nix

     

       
48
       
 
       
boot.kernelModules = [ "fuse" "kvm-intel" "coretemp" ];

     

       
49
       
 
       
```

     

       
50
       
 
       


     

       
51
       
 
       
If the module is required early during the boot (e.g. to mount the root

     

       
52
       
-
       
file system), you can use [`boot.initrd.kernelModules`](options.html#opt-boot.initrd.kernelModules):

     

       
53
       
 
       


     

       
54
       
 
       
```nix

     

       
55
       
 
       
boot.initrd.kernelModules = [ "cifs" ];

     
···

       
59
       
 
       
the initial ramdisk.

     

       
60
       
 
       


     

       
61
       
 
       
Kernel runtime parameters can be set through

     

       
62
       
-
       
[`boot.kernel.sysctl`](options.html#opt-boot.kernel.sysctl), e.g.

     

       
63
       
 
       


     

       
64
       
 
       
```nix

     

       
65
       
 
       
boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 120;

     

···

       
42
       
 
       


     

       
43
       
 
       
Kernel modules for hardware devices are generally loaded automatically

     

       
44
       
 
       
by `udev`. You can force a module to be loaded via

     

       
45
       
+
       
[](#opt-boot.kernelModules), e.g.

     

       
46
       
 
       


     

       
47
       
 
       
```nix

     

       
48
       
 
       
boot.kernelModules = [ "fuse" "kvm-intel" "coretemp" ];

     

       
49
       
 
       
```

     

       
50
       
 
       


     

       
51
       
 
       
If the module is required early during the boot (e.g. to mount the root

     

       
52
       
+
       
file system), you can use [](#opt-boot.initrd.kernelModules):

     

       
53
       
 
       


     

       
54
       
 
       
```nix

     

       
55
       
 
       
boot.initrd.kernelModules = [ "cifs" ];

     
···

       
59
       
 
       
the initial ramdisk.

     

       
60
       
 
       


     

       
61
       
 
       
Kernel runtime parameters can be set through

     

       
62
       
+
       
[](#opt-boot.kernel.sysctl), e.g.

     

       
63
       
 
       


     

       
64
       
 
       
```nix

     

       
65
       
 
       
boot.kernel.sysctl."net.ipv4.tcp_keepalive_time" = 120;

     

···

       
34
       
 
       
To keep the key safe, change the ownership to `root:root` and make sure the permissions are `600`:

     

       
35
       
 
       
OpenSSH normally refuses to use the key if it's not well-protected.

     

       
36
       
 
       


     

       
37
       
-
       
The file system can be configured in NixOS via the usual [fileSystems](options.html#opt-fileSystems) option.

     

       
38
       
 
       
Here's a typical setup:

     

       
39
       
 
       
```nix

     

       
40
       
 
       
{

     

···

       
34
       
 
       
To keep the key safe, change the ownership to `root:root` and make sure the permissions are `600`:

     

       
35
       
 
       
OpenSSH normally refuses to use the key if it's not well-protected.

     

       
36
       
 
       


     

       
37
       
+
       
The file system can be configured in NixOS via the usual [fileSystems](#opt-fileSystems) option.

     

       
38
       
 
       
Here's a typical setup:

     

       
39
       
 
       
```nix

     

       
40
       
 
       
{

     

···

       
17
       
 
       
book](http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd).

     

       
18
       
 
       


     

       
19
       
 
       
To configure, include in `/etc/nixos/configuration.nix` code to activate

     

       
20
       
-
       
Apache HTTP, setting [`services.httpd.adminAddr`](options.html#opt-services.httpd.adminAddr)

     

       
21
       
 
       
appropriately:

     

       
22
       
 
       


     

       
23
       
 
       
```nix

     

···

       
17
       
 
       
book](http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd).

     

       
18
       
 
       


     

       
19
       
 
       
To configure, include in `/etc/nixos/configuration.nix` code to activate

     

       
20
       
+
       
Apache HTTP, setting [](#opt-services.httpd.adminAddr)

     

       
21
       
 
       
appropriately:

     

       
22
       
 
       


     

       
23
       
 
       
```nix

     

···

       
24
       
 
       
`passwd` program to set a password, which is retained across invocations

     

       
25
       
 
       
of `nixos-rebuild`.

     

       
26
       
 
       


     

       
27
       
-
       
If you set [`users.mutableUsers`](options.html#opt-users.mutableUsers) to

     

       
28
       
 
       
false, then the contents of `/etc/passwd` and `/etc/group` will be congruent

     

       
29
       
 
       
to your NixOS configuration. For instance, if you remove a user from

     

       
30
       
-
       
[`users.users`](options.html#opt-users.users) and run nixos-rebuild, the user

     

       
31
       
 
       
account will cease to exist. Also, imperative commands for managing users and

     

       
32
       
 
       
groups, such as useradd, are no longer available. Passwords may still be

     

       
33
       
 
       
assigned by setting the user\'s

     

···

       
24
       
 
       
`passwd` program to set a password, which is retained across invocations

     

       
25
       
 
       
of `nixos-rebuild`.

     

       
26
       
 
       


     

       
27
       
+
       
If you set [](#opt-users.mutableUsers) to

     

       
28
       
 
       
false, then the contents of `/etc/passwd` and `/etc/group` will be congruent

     

       
29
       
 
       
to your NixOS configuration. For instance, if you remove a user from

     

       
30
       
+
       
[](#opt-users.users) and run nixos-rebuild, the user

     

       
31
       
 
       
account will cease to exist. Also, imperative commands for managing users and

     

       
32
       
 
       
groups, such as useradd, are no longer available. Passwords may still be

     

       
33
       
 
       
assigned by setting the user\'s

     

···

       
23
       
 
       
```

     

       
24
       
 
       


     

       
25
       
 
       
and configure Pipewire using

     

       
26
       
-
       
[`services.pipewire.enable`](options.html#opt-services.pipewire.enable)

     

       
27
       
 
       
and related options.

     

···

       
23
       
 
       
```

     

       
24
       
 
       


     

       
25
       
 
       
and configure Pipewire using

     

       
26
       
+
       
[](#opt-services.pipewire.enable)

     

       
27
       
 
       
and related options.

     

···

       
115
       
 
       


     

       
116
       
 
       
The results vary depending on the hardware, so you may have to try both

     

       
117
       
 
       
drivers. Use the option

     

       
118
       
-
       
[`services.xserver.videoDrivers`](options.html#opt-services.xserver.videoDrivers)

     

       
119
       
 
       
to set one. The recommended configuration for modern systems is:

     

       
120
       
 
       


     

       
121
       
 
       
```nix

     
···

       
183
       
 
       
services.xserver.libinput.enable = true;

     

       
184
       
 
       
```

     

       
185
       
 
       


     

       
186
       
-
       
The driver has many options (see [Appendix A, Configuration Options](options.html)).

     

       
187
       
 
       
For instance, the following disables tap-to-click behavior:

     

       
188
       
 
       


     

       
189
       
 
       
```nix

     

···

       
115
       
 
       


     

       
116
       
 
       
The results vary depending on the hardware, so you may have to try both

     

       
117
       
 
       
drivers. Use the option

     

       
118
       
+
       
[](#opt-services.xserver.videoDrivers)

     

       
119
       
 
       
to set one. The recommended configuration for modern systems is:

     

       
120
       
 
       


     

       
121
       
 
       
```nix

     
···

       
183
       
 
       
services.xserver.libinput.enable = true;

     

       
184
       
 
       
```

     

       
185
       
 
       


     

       
186
       
+
       
The driver has many options (see [](#ch-options)).

     

       
187
       
 
       
For instance, the following disables tap-to-click behavior:

     

       
188
       
 
       


     

       
189
       
 
       
```nix

     

···

       
22
       
 
       


     

       
23
       
 
       
Some Xfce programs are not installed automatically. To install them

     

       
24
       
 
       
manually (system wide), put them into your

     

       
25
       
-
       
[`environment.systemPackages`](options.html#opt-environment.systemPackages) from `pkgs.xfce`.

     

       
26
       
 
       


     

       
27
       
 
       
## Thunar Plugins {#sec-xfce-thunar-plugins .unnumbered}

     

       
28
       
 
       


     

       
29
       
 
       
If you\'d like to add extra plugins to Thunar, add them to

     

       
30
       
-
       
[`services.xserver.desktopManager.xfce.thunarPlugins`](options.html#opt-services.xserver.desktopManager.xfce.thunarPlugins).

     

       
31
       
-
       
You shouldn\'t just add them to [`environment.systemPackages`](options.html#opt-environment.systemPackages).

     

       
32
       
 
       


     

       
33
       
 
       
## Troubleshooting {#sec-xfce-troubleshooting .unnumbered}

     

       
34
       
 
       


     

···

       
22
       
 
       


     

       
23
       
 
       
Some Xfce programs are not installed automatically. To install them

     

       
24
       
 
       
manually (system wide), put them into your

     

       
25
       
+
       
[](#opt-environment.systemPackages) from `pkgs.xfce`.

     

       
26
       
 
       


     

       
27
       
 
       
## Thunar Plugins {#sec-xfce-thunar-plugins .unnumbered}

     

       
28
       
 
       


     

       
29
       
 
       
If you\'d like to add extra plugins to Thunar, add them to

     

       
30
       
+
       
[](#opt-services.xserver.desktopManager.xfce.thunarPlugins).

     

       
31
       
+
       
You shouldn\'t just add them to [](#opt-environment.systemPackages).

     

       
32
       
 
       


     

       
33
       
 
       
## Troubleshooting {#sec-xfce-troubleshooting .unnumbered}

     

       
34
       
 
       


     

···

       
36
       
 
       
</programlisting>

     

       
37
       
 
       
    <para>

     

       
38
       
 
       
      The second mechanism is to add the OpenCL driver package to

     

       
39
       
-
       
      <link xlink:href="options.html#opt-hardware.opengl.extraPackages"><literal>hardware.opengl.extraPackages</literal></link>.

     

       
40
       
-
       
      This links the ICD file under

     

       
41
       
-
       
      <literal>/run/opengl-driver</literal>, where it will be visible to

     

       
42
       
-
       
      the ICD loader.

     

       
43
       
 
       
    </para>

     

       
44
       
 
       
    <para>

     

       
45
       
 
       
      The proper installation of OpenCL drivers can be verified through

     
···

       
60
       
 
       
        <link xlink:href="https://en.wikipedia.org/wiki/Graphics_Core_Next">Graphics

     

       
61
       
 
       
        Core Next</link> (GCN) GPUs are supported through the

     

       
62
       
 
       
        rocm-opencl-icd package. Adding this package to

     

       
63
       
-
       
        <link xlink:href="options.html#opt-hardware.opengl.extraPackages"><literal>hardware.opengl.extraPackages</literal></link>

     

       
64
       
-
       
        enables OpenCL support:

     

       
65
       
 
       
      </para>

     

       
66
       
 
       
      <programlisting language="bash">

     

       
67
       
 
       
hardware.opengl.extraPackages = [

     
···

       
82
       
 
       
      </para>

     

       
83
       
 
       
      <para>

     

       
84
       
 
       
        The intel-compute-runtime, beignet, or intel-ocl package can be

     

       
85
       
-
       
        added to

     

       
86
       
-
       
        <link xlink:href="options.html#opt-hardware.opengl.extraPackages"><literal>hardware.opengl.extraPackages</literal></link>

     

       
87
       
-
       
        to enable OpenCL support. For example, for Gen8 and later GPUs,

     

       
88
       
-
       
        the following configuration can be used:

     

       
89
       
 
       
      </para>

     

       
90
       
 
       
      <programlisting language="bash">

     

       
91
       
 
       
hardware.opengl.extraPackages = [

     
···

       
103
       
 
       
      <link xlink:href="https://github.com/doitsujin/dxvk/wiki">DXVK</link>.

     

       
104
       
 
       
    </para>

     

       
105
       
 
       
    <para>

     

       
106
       
-
       
      By default, if

     

       
107
       
-
       
      <link xlink:href="options.html#opt-hardware.opengl.driSupport"><literal>hardware.opengl.driSupport</literal></link>

     

       
108
       
 
       
      is enabled, mesa is installed and provides Vulkan for supported

     

       
109
       
 
       
      hardware.

     

       
110
       
 
       
    </para>

     
···

       
129
       
 
       
</programlisting>

     

       
130
       
 
       
    <para>

     

       
131
       
 
       
      The second mechanism is to add the Vulkan driver package to

     

       
132
       
-
       
      <link xlink:href="options.html#opt-hardware.opengl.extraPackages"><literal>hardware.opengl.extraPackages</literal></link>.

     

       
133
       
-
       
      This links the ICD file under

     

       
134
       
-
       
      <literal>/run/opengl-driver</literal>, where it will be visible to

     

       
135
       
-
       
      the ICD loader.

     

       
136
       
 
       
    </para>

     

       
137
       
 
       
    <para>

     

       
138
       
 
       
      The proper installation of Vulkan drivers can be verified through

     
···

       
162
       
 
       
        <link xlink:href="https://en.wikipedia.org/wiki/Graphics_Core_Next">Graphics

     

       
163
       
 
       
        Core Next</link> (GCN) GPUs are supported through either radv,

     

       
164
       
 
       
        which is part of mesa, or the amdvlk package. Adding the amdvlk

     

       
165
       
-
       
        package to

     

       
166
       
-
       
        <link xlink:href="options.html#opt-hardware.opengl.extraPackages"><literal>hardware.opengl.extraPackages</literal></link>

     

       
167
       
 
       
        makes amdvlk the default driver and hides radv and lavapipe from

     

       
168
       
 
       
        the device list. A specific driver can be forced as follows:

     

       
169
       
 
       
      </para>

     

···

       
36
       
 
       
</programlisting>

     

       
37
       
 
       
    <para>

     

       
38
       
 
       
      The second mechanism is to add the OpenCL driver package to

     

       
39
       
+
       
      <xref linkend="opt-hardware.opengl.extraPackages" />. This links

     

       
40
       
+
       
      the ICD file under <literal>/run/opengl-driver</literal>, where it

     

       
41
       
+
       
      will be visible to the ICD loader.

     

       
0
       
 
       

     

       
42
       
 
       
    </para>

     

       
43
       
 
       
    <para>

     

       
44
       
 
       
      The proper installation of OpenCL drivers can be verified through

     
···

       
59
       
 
       
        <link xlink:href="https://en.wikipedia.org/wiki/Graphics_Core_Next">Graphics

     

       
60
       
 
       
        Core Next</link> (GCN) GPUs are supported through the

     

       
61
       
 
       
        rocm-opencl-icd package. Adding this package to

     

       
62
       
+
       
        <xref linkend="opt-hardware.opengl.extraPackages" /> enables

     

       
63
       
+
       
        OpenCL support:

     

       
64
       
 
       
      </para>

     

       
65
       
 
       
      <programlisting language="bash">

     

       
66
       
 
       
hardware.opengl.extraPackages = [

     
···

       
81
       
 
       
      </para>

     

       
82
       
 
       
      <para>

     

       
83
       
 
       
        The intel-compute-runtime, beignet, or intel-ocl package can be

     

       
84
       
+
       
        added to <xref linkend="opt-hardware.opengl.extraPackages" /> to

     

       
85
       
+
       
        enable OpenCL support. For example, for Gen8 and later GPUs, the

     

       
86
       
+
       
        following configuration can be used:

     

       
0
       
 
       

     

       
87
       
 
       
      </para>

     

       
88
       
 
       
      <programlisting language="bash">

     

       
89
       
 
       
hardware.opengl.extraPackages = [

     
···

       
101
       
 
       
      <link xlink:href="https://github.com/doitsujin/dxvk/wiki">DXVK</link>.

     

       
102
       
 
       
    </para>

     

       
103
       
 
       
    <para>

     

       
104
       
+
       
      By default, if <xref linkend="opt-hardware.opengl.driSupport" />

     

       
0
       
 
       

     

       
105
       
 
       
      is enabled, mesa is installed and provides Vulkan for supported

     

       
106
       
 
       
      hardware.

     

       
107
       
 
       
    </para>

     
···

       
126
       
 
       
</programlisting>

     

       
127
       
 
       
    <para>

     

       
128
       
 
       
      The second mechanism is to add the Vulkan driver package to

     

       
129
       
+
       
      <xref linkend="opt-hardware.opengl.extraPackages" />. This links

     

       
130
       
+
       
      the ICD file under <literal>/run/opengl-driver</literal>, where it

     

       
131
       
+
       
      will be visible to the ICD loader.

     

       
0
       
 
       

     

       
132
       
 
       
    </para>

     

       
133
       
 
       
    <para>

     

       
134
       
 
       
      The proper installation of Vulkan drivers can be verified through

     
···

       
158
       
 
       
        <link xlink:href="https://en.wikipedia.org/wiki/Graphics_Core_Next">Graphics

     

       
159
       
 
       
        Core Next</link> (GCN) GPUs are supported through either radv,

     

       
160
       
 
       
        which is part of mesa, or the amdvlk package. Adding the amdvlk

     

       
161
       
+
       
        package to <xref linkend="opt-hardware.opengl.extraPackages" />

     

       
0
       
 
       

     

       
162
       
 
       
        makes amdvlk the default driver and hides radv and lavapipe from

     

       
163
       
 
       
        the device list. A specific driver can be forced as follows:

     

       
164
       
 
       
      </para>

     

···

       
43
       
 
       
</programlisting>

     

       
44
       
 
       
  <para>

     

       
45
       
 
       
    Note: Assigning either role will also default both

     

       
46
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.flannel.enable"><literal>services.kubernetes.flannel.enable</literal></link>

     

       
47
       
-
       
    and

     

       
48
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.easyCerts"><literal>services.kubernetes.easyCerts</literal></link>

     

       
49
       
-
       
    to true. This sets up flannel as CNI and activates automatic PKI

     

       
50
       
-
       
    bootstrapping.

     

       
51
       
 
       
  </para>

     

       
52
       
 
       
  <para>

     

       
53
       
 
       
    As of kubernetes 1.10.X it has been deprecated to open

     
···

       
56
       
 
       
    opening insecure ports is still possible, it is recommended not to

     

       
57
       
 
       
    bind these to other interfaces than loopback. To re-enable the

     

       
58
       
 
       
    insecure port on the apiserver, see options:

     

       
59
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.apiserver.insecurePort"><literal>services.kubernetes.apiserver.insecurePort</literal></link>

     

       
60
       
 
       
    and

     

       
61
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.apiserver.insecureBindAddress"><literal>services.kubernetes.apiserver.insecureBindAddress</literal></link>

     

       
62
       
 
       
  </para>

     

       
63
       
 
       
  <note>

     

       
64
       
 
       
    <para>

     

       
65
       
 
       
      As of NixOS 19.03, it is mandatory to configure:

     

       
66
       
-
       
      <link xlink:href="options.html#opt-services.kubernetes.masterAddress"><literal>services.kubernetes.masterAddress</literal></link>.

     

       
67
       
-
       
      The masterAddress must be resolveable and routeable by all cluster

     

       
68
       
 
       
      nodes. In single node clusters, this can be set to

     

       
69
       
 
       
      <literal>localhost</literal>.

     

       
70
       
 
       
    </para>

     
···

       
83
       
 
       
  <para>

     

       
84
       
 
       
    The NixOS kubernetes module provides an option for automatic

     

       
85
       
 
       
    certificate bootstrapping and configuration,

     

       
86
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.easyCerts"><literal>services.kubernetes.easyCerts</literal></link>.

     

       
87
       
-
       
    The PKI bootstrapping process involves setting up a certificate

     

       
88
       
-
       
    authority (CA) daemon (cfssl) on the kubernetes master node. cfssl

     

       
89
       
-
       
    generates a CA-cert for the cluster, and uses the CA-cert for

     

       
90
       
-
       
    signing subordinate certs issued to each of the cluster components.

     

       
91
       
 
       
    Subsequently, the certmgr daemon monitors active certificates and

     

       
92
       
 
       
    renews them when needed. For single node Kubernetes clusters,

     

       
93
       
-
       
    setting

     

       
94
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.easyCerts"><literal>services.kubernetes.easyCerts</literal></link>

     

       
95
       
-
       
    = true is sufficient and no further action is required. For joining

     

       
96
       
-
       
    extra node machines to an existing cluster on the other hand,

     

       
97
       
-
       
    establishing initial trust is mandatory.

     

       
98
       
 
       
  </para>

     

       
99
       
 
       
  <para>

     

       
100
       
 
       
    To add new nodes to the cluster: On any (non-master) cluster node

     

       
101
       
-
       
    where

     

       
102
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.easyCerts"><literal>services.kubernetes.easyCerts</literal></link>

     

       
103
       
-
       
    is enabled, the helper script

     

       
104
       
 
       
    <literal>nixos-kubernetes-node-join</literal> is available on PATH.

     

       
105
       
 
       
    Given a token on stdin, it will copy the token to the kubernetes

     

       
106
       
 
       
    secrets directory and restart the certmgr service. As requested

     
···

       
120
       
 
       
    is generated and linked into

     

       
121
       
 
       
    <literal>/etc/kubernetes/cluster-admin.kubeconfig</literal> as

     

       
122
       
 
       
    determined by

     

       
123
       
-
       
    <link xlink:href="options.html#opt-services.kubernetes.pki.etcClusterAdminKubeconfig"><literal>services.kubernetes.pki.etcClusterAdminKubeconfig</literal></link>.

     

       
124
       
 
       
    <literal>export KUBECONFIG=/etc/kubernetes/cluster-admin.kubeconfig</literal>

     

       
125
       
 
       
    will make kubectl use this kubeconfig to access and authenticate the

     

       
126
       
 
       
    cluster. The cluster-admin kubeconfig references an auto-generated

     

···

       
43
       
 
       
</programlisting>

     

       
44
       
 
       
  <para>

     

       
45
       
 
       
    Note: Assigning either role will also default both

     

       
46
       
+
       
    <xref linkend="opt-services.kubernetes.flannel.enable" /> and

     

       
47
       
+
       
    <xref linkend="opt-services.kubernetes.easyCerts" /> to true. This

     

       
48
       
+
       
    sets up flannel as CNI and activates automatic PKI bootstrapping.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
49
       
 
       
  </para>

     

       
50
       
 
       
  <para>

     

       
51
       
 
       
    As of kubernetes 1.10.X it has been deprecated to open

     
···

       
54
       
 
       
    opening insecure ports is still possible, it is recommended not to

     

       
55
       
 
       
    bind these to other interfaces than loopback. To re-enable the

     

       
56
       
 
       
    insecure port on the apiserver, see options:

     

       
57
       
+
       
    <xref linkend="opt-services.kubernetes.apiserver.insecurePort" />

     

       
58
       
 
       
    and

     

       
59
       
+
       
    <xref linkend="opt-services.kubernetes.apiserver.insecureBindAddress" />

     

       
60
       
 
       
  </para>

     

       
61
       
 
       
  <note>

     

       
62
       
 
       
    <para>

     

       
63
       
 
       
      As of NixOS 19.03, it is mandatory to configure:

     

       
64
       
+
       
      <xref linkend="opt-services.kubernetes.masterAddress" />. The

     

       
65
       
+
       
      masterAddress must be resolveable and routeable by all cluster

     

       
66
       
 
       
      nodes. In single node clusters, this can be set to

     

       
67
       
 
       
      <literal>localhost</literal>.

     

       
68
       
 
       
    </para>

     
···

       
81
       
 
       
  <para>

     

       
82
       
 
       
    The NixOS kubernetes module provides an option for automatic

     

       
83
       
 
       
    certificate bootstrapping and configuration,

     

       
84
       
+
       
    <xref linkend="opt-services.kubernetes.easyCerts" />. The PKI

     

       
85
       
+
       
    bootstrapping process involves setting up a certificate authority

     

       
86
       
+
       
    (CA) daemon (cfssl) on the kubernetes master node. cfssl generates a

     

       
87
       
+
       
    CA-cert for the cluster, and uses the CA-cert for signing

     

       
88
       
+
       
    subordinate certs issued to each of the cluster components.

     

       
89
       
 
       
    Subsequently, the certmgr daemon monitors active certificates and

     

       
90
       
 
       
    renews them when needed. For single node Kubernetes clusters,

     

       
91
       
+
       
    setting <xref linkend="opt-services.kubernetes.easyCerts" /> = true

     

       
92
       
+
       
    is sufficient and no further action is required. For joining extra

     

       
93
       
+
       
    node machines to an existing cluster on the other hand, establishing

     

       
94
       
+
       
    initial trust is mandatory.

     

       
0
       
 
       

     

       
95
       
 
       
  </para>

     

       
96
       
 
       
  <para>

     

       
97
       
 
       
    To add new nodes to the cluster: On any (non-master) cluster node

     

       
98
       
+
       
    where <xref linkend="opt-services.kubernetes.easyCerts" /> is

     

       
99
       
+
       
    enabled, the helper script

     

       
0
       
 
       

     

       
100
       
 
       
    <literal>nixos-kubernetes-node-join</literal> is available on PATH.

     

       
101
       
 
       
    Given a token on stdin, it will copy the token to the kubernetes

     

       
102
       
 
       
    secrets directory and restart the certmgr service. As requested

     
···

       
116
       
 
       
    is generated and linked into

     

       
117
       
 
       
    <literal>/etc/kubernetes/cluster-admin.kubeconfig</literal> as

     

       
118
       
 
       
    determined by

     

       
119
       
+
       
    <xref linkend="opt-services.kubernetes.pki.etcClusterAdminKubeconfig" />.

     

       
120
       
 
       
    <literal>export KUBECONFIG=/etc/kubernetes/cluster-admin.kubeconfig</literal>

     

       
121
       
 
       
    will make kubectl use this kubeconfig to access and authenticate the

     

       
122
       
 
       
    cluster. The cluster-admin kubeconfig references an auto-generated

     

···

       
48
       
 
       
  <para>

     

       
49
       
 
       
    Kernel modules for hardware devices are generally loaded

     

       
50
       
 
       
    automatically by <literal>udev</literal>. You can force a module to

     

       
51
       
-
       
    be loaded via

     

       
52
       
-
       
    <link xlink:href="options.html#opt-boot.kernelModules"><literal>boot.kernelModules</literal></link>,

     

       
53
       
-
       
    e.g.

     

       
54
       
 
       
  </para>

     

       
55
       
 
       
  <programlisting language="bash">

     

       
56
       
 
       
boot.kernelModules = [ &quot;fuse&quot; &quot;kvm-intel&quot; &quot;coretemp&quot; ];

     
···

       
58
       
 
       
  <para>

     

       
59
       
 
       
    If the module is required early during the boot (e.g. to mount the

     

       
60
       
 
       
    root file system), you can use

     

       
61
       
-
       
    <link xlink:href="options.html#opt-boot.initrd.kernelModules"><literal>boot.initrd.kernelModules</literal></link>:

     

       
62
       
 
       
  </para>

     

       
63
       
 
       
  <programlisting language="bash">

     

       
64
       
 
       
boot.initrd.kernelModules = [ &quot;cifs&quot; ];

     
···

       
69
       
 
       
  </para>

     

       
70
       
 
       
  <para>

     

       
71
       
 
       
    Kernel runtime parameters can be set through

     

       
72
       
-
       
    <link xlink:href="options.html#opt-boot.kernel.sysctl"><literal>boot.kernel.sysctl</literal></link>,

     

       
73
       
-
       
    e.g.

     

       
74
       
 
       
  </para>

     

       
75
       
 
       
  <programlisting language="bash">

     

       
76
       
 
       
boot.kernel.sysctl.&quot;net.ipv4.tcp_keepalive_time&quot; = 120;

     

···

       
48
       
 
       
  <para>

     

       
49
       
 
       
    Kernel modules for hardware devices are generally loaded

     

       
50
       
 
       
    automatically by <literal>udev</literal>. You can force a module to

     

       
51
       
+
       
    be loaded via <xref linkend="opt-boot.kernelModules" />, e.g.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
52
       
 
       
  </para>

     

       
53
       
 
       
  <programlisting language="bash">

     

       
54
       
 
       
boot.kernelModules = [ &quot;fuse&quot; &quot;kvm-intel&quot; &quot;coretemp&quot; ];

     
···

       
56
       
 
       
  <para>

     

       
57
       
 
       
    If the module is required early during the boot (e.g. to mount the

     

       
58
       
 
       
    root file system), you can use

     

       
59
       
+
       
    <xref linkend="opt-boot.initrd.kernelModules" />:

     

       
60
       
 
       
  </para>

     

       
61
       
 
       
  <programlisting language="bash">

     

       
62
       
 
       
boot.initrd.kernelModules = [ &quot;cifs&quot; ];

     
···

       
67
       
 
       
  </para>

     

       
68
       
 
       
  <para>

     

       
69
       
 
       
    Kernel runtime parameters can be set through

     

       
70
       
+
       
    <xref linkend="opt-boot.kernel.sysctl" />, e.g.

     

       
0
       
 
       

     

       
71
       
 
       
  </para>

     

       
72
       
 
       
  <programlisting language="bash">

     

       
73
       
 
       
boot.kernel.sysctl.&quot;net.ipv4.tcp_keepalive_time&quot; = 120;

     

···

       
51
       
 
       
    </para>

     

       
52
       
 
       
    <para>

     

       
53
       
 
       
      The file system can be configured in NixOS via the usual

     

       
54
       
-
       
      <link xlink:href="options.html#opt-fileSystems">fileSystems</link>

     

       
55
       
-
       
      option. Here’s a typical setup:

     

       
56
       
 
       
    </para>

     

       
57
       
 
       
    <programlisting language="bash">

     

       
58
       
 
       
{

     

···

       
51
       
 
       
    </para>

     

       
52
       
 
       
    <para>

     

       
53
       
 
       
      The file system can be configured in NixOS via the usual

     

       
54
       
+
       
      <link linkend="opt-fileSystems">fileSystems</link> option. Here’s

     

       
55
       
+
       
      a typical setup:

     

       
56
       
 
       
    </para>

     

       
57
       
 
       
    <programlisting language="bash">

     

       
58
       
 
       
{

     

···

       
23
       
 
       
      To configure, include in

     

       
24
       
 
       
      <literal>/etc/nixos/configuration.nix</literal> code to activate

     

       
25
       
 
       
      Apache HTTP, setting

     

       
26
       
-
       
      <link xlink:href="options.html#opt-services.httpd.adminAddr"><literal>services.httpd.adminAddr</literal></link>

     

       
27
       
-
       
      appropriately:

     

       
28
       
 
       
    </para>

     

       
29
       
 
       
    <programlisting language="bash">

     

       
30
       
 
       
services.httpd.enable = true;

     

···

       
23
       
 
       
      To configure, include in

     

       
24
       
 
       
      <literal>/etc/nixos/configuration.nix</literal> code to activate

     

       
25
       
 
       
      Apache HTTP, setting

     

       
26
       
+
       
      <xref linkend="opt-services.httpd.adminAddr" /> appropriately:

     

       
0
       
 
       

     

       
27
       
 
       
    </para>

     

       
28
       
 
       
    <programlisting language="bash">

     

       
29
       
 
       
services.httpd.enable = true;

     

···

       
29
       
 
       
    retained across invocations of <literal>nixos-rebuild</literal>.

     

       
30
       
 
       
  </para>

     

       
31
       
 
       
  <para>

     

       
32
       
-
       
    If you set

     

       
33
       
-
       
    <link xlink:href="options.html#opt-users.mutableUsers"><literal>users.mutableUsers</literal></link>

     

       
34
       
-
       
    to false, then the contents of <literal>/etc/passwd</literal> and

     

       
35
       
 
       
    <literal>/etc/group</literal> will be congruent to your NixOS

     

       
36
       
 
       
    configuration. For instance, if you remove a user from

     

       
37
       
-
       
    <link xlink:href="options.html#opt-users.users"><literal>users.users</literal></link>

     

       
38
       
-
       
    and run nixos-rebuild, the user account will cease to exist. Also,

     

       
39
       
-
       
    imperative commands for managing users and groups, such as useradd,

     

       
40
       
-
       
    are no longer available. Passwords may still be assigned by setting

     

       
41
       
-
       
    the user's

     

       
42
       
 
       
    <link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link>

     

       
43
       
 
       
    option. A hashed password can be generated using

     

       
44
       
 
       
    <literal>mkpasswd -m sha-512</literal>.

     

···

       
29
       
 
       
    retained across invocations of <literal>nixos-rebuild</literal>.

     

       
30
       
 
       
  </para>

     

       
31
       
 
       
  <para>

     

       
32
       
+
       
    If you set <xref linkend="opt-users.mutableUsers" /> to false, then

     

       
33
       
+
       
    the contents of <literal>/etc/passwd</literal> and

     

       
0
       
 
       

     

       
34
       
 
       
    <literal>/etc/group</literal> will be congruent to your NixOS

     

       
35
       
 
       
    configuration. For instance, if you remove a user from

     

       
36
       
+
       
    <xref linkend="opt-users.users" /> and run nixos-rebuild, the user

     

       
37
       
+
       
    account will cease to exist. Also, imperative commands for managing

     

       
38
       
+
       
    users and groups, such as useradd, are no longer available.

     

       
39
       
+
       
    Passwords may still be assigned by setting the user's

     

       
0
       
 
       

     

       
40
       
 
       
    <link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link>

     

       
41
       
 
       
    option. A hashed password can be generated using

     

       
42
       
 
       
    <literal>mkpasswd -m sha-512</literal>.

     

···

       
26
       
 
       
</programlisting>

     

       
27
       
 
       
  <para>

     

       
28
       
 
       
    and configure Pipewire using

     

       
29
       
-
       
    <link xlink:href="options.html#opt-services.pipewire.enable"><literal>services.pipewire.enable</literal></link>

     

       
30
       
-
       
    and related options.

     

       
31
       
 
       
  </para>

     

       
32
       
 
       
</chapter>

     

···

       
26
       
 
       
</programlisting>

     

       
27
       
 
       
  <para>

     

       
28
       
 
       
    and configure Pipewire using

     

       
29
       
+
       
    <xref linkend="opt-services.pipewire.enable" /> and related options.

     

       
0
       
 
       

     

       
30
       
 
       
  </para>

     

       
31
       
 
       
</chapter>

     

···

       
128
       
 
       
    <para>

     

       
129
       
 
       
      The results vary depending on the hardware, so you may have to try

     

       
130
       
 
       
      both drivers. Use the option

     

       
131
       
-
       
      <link xlink:href="options.html#opt-services.xserver.videoDrivers"><literal>services.xserver.videoDrivers</literal></link>

     

       
132
       
-
       
      to set one. The recommended configuration for modern systems is:

     

       
133
       
 
       
    </para>

     

       
134
       
 
       
    <programlisting language="bash">

     

       
135
       
 
       
services.xserver.videoDrivers = [ &quot;modesetting&quot; ];

     
···

       
204
       
 
       
services.xserver.libinput.enable = true;

     

       
205
       
 
       
</programlisting>

     

       
206
       
 
       
    <para>

     

       
207
       
-
       
      The driver has many options (see

     

       
208
       
-
       
      <link xlink:href="options.html">Appendix A, Configuration

     

       
209
       
-
       
      Options</link>). For instance, the following disables tap-to-click

     

       
210
       
-
       
      behavior:

     

       
211
       
 
       
    </para>

     

       
212
       
 
       
    <programlisting language="bash">

     

       
213
       
 
       
services.xserver.libinput.touchpad.tapping = false;

     

···

       
128
       
 
       
    <para>

     

       
129
       
 
       
      The results vary depending on the hardware, so you may have to try

     

       
130
       
 
       
      both drivers. Use the option

     

       
131
       
+
       
      <xref linkend="opt-services.xserver.videoDrivers" /> to set one.

     

       
132
       
+
       
      The recommended configuration for modern systems is:

     

       
133
       
 
       
    </para>

     

       
134
       
 
       
    <programlisting language="bash">

     

       
135
       
 
       
services.xserver.videoDrivers = [ &quot;modesetting&quot; ];

     
···

       
204
       
 
       
services.xserver.libinput.enable = true;

     

       
205
       
 
       
</programlisting>

     

       
206
       
 
       
    <para>

     

       
207
       
+
       
      The driver has many options (see <xref linkend="ch-options" />).

     

       
208
       
+
       
      For instance, the following disables tap-to-click behavior:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
209
       
 
       
    </para>

     

       
210
       
 
       
    <programlisting language="bash">

     

       
211
       
 
       
services.xserver.libinput.touchpad.tapping = false;

     

···

       
23
       
 
       
  <para>

     

       
24
       
 
       
    Some Xfce programs are not installed automatically. To install them

     

       
25
       
 
       
    manually (system wide), put them into your

     

       
26
       
-
       
    <link xlink:href="options.html#opt-environment.systemPackages"><literal>environment.systemPackages</literal></link>

     

       
27
       
-
       
    from <literal>pkgs.xfce</literal>.

     

       
28
       
 
       
  </para>

     

       
29
       
 
       
  <section xml:id="sec-xfce-thunar-plugins">

     

       
30
       
 
       
    <title>Thunar Plugins</title>

     

       
31
       
 
       
    <para>

     

       
32
       
 
       
      If you'd like to add extra plugins to Thunar, add them to

     

       
33
       
-
       
      <link xlink:href="options.html#opt-services.xserver.desktopManager.xfce.thunarPlugins"><literal>services.xserver.desktopManager.xfce.thunarPlugins</literal></link>.

     

       
34
       
 
       
      You shouldn't just add them to

     

       
35
       
-
       
      <link xlink:href="options.html#opt-environment.systemPackages"><literal>environment.systemPackages</literal></link>.

     

       
36
       
 
       
    </para>

     

       
37
       
 
       
  </section>

     

       
38
       
 
       
  <section xml:id="sec-xfce-troubleshooting">

     

···

       
23
       
 
       
  <para>

     

       
24
       
 
       
    Some Xfce programs are not installed automatically. To install them

     

       
25
       
 
       
    manually (system wide), put them into your

     

       
26
       
+
       
    <xref linkend="opt-environment.systemPackages" /> from

     

       
27
       
+
       
    <literal>pkgs.xfce</literal>.

     

       
28
       
 
       
  </para>

     

       
29
       
 
       
  <section xml:id="sec-xfce-thunar-plugins">

     

       
30
       
 
       
    <title>Thunar Plugins</title>

     

       
31
       
 
       
    <para>

     

       
32
       
 
       
      If you'd like to add extra plugins to Thunar, add them to

     

       
33
       
+
       
      <xref linkend="opt-services.xserver.desktopManager.xfce.thunarPlugins" />.

     

       
34
       
 
       
      You shouldn't just add them to

     

       
35
       
+
       
      <xref linkend="opt-environment.systemPackages" />.

     

       
36
       
 
       
    </para>

     

       
37
       
 
       
  </section>

     

       
38
       
 
       
  <section xml:id="sec-xfce-troubleshooting">