Skip to content

Commit b204a34

Browse files
randomizedcoderrandomizedcoder
committed
./hardware-graphics.nix
1 parent d39cb72 commit b204a34

24 files changed

+1049
-253
lines changed

‎containers/nginx/flake.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
description = "OpenTechLab Docker Example";
33

44
inputs = {
5-
nixpkgs.url = github:NixOS/nixpkgs/nixos-24.05;
5+
nixpkgs.url = github:NixOS/nixpkgs/nixos-24.11;
66
};
77

88
outputs = { self, nixpkgs }: {

‎containers/nginx/old.flake.nix.old‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
description = "OpenTechLab Docker Example";
3+
4+
inputs = {
5+
nixpkgs.url = github:NixOS/nixpkgs/nixos-24.05;
6+
};
7+
8+
outputs = { self, nixpkgs }: {
9+
packages."x86_64-linux" =
10+
let
11+
pkgs = import nixpkgs { system = "x86_64-linux"; };
12+
in
13+
rec {
14+
dockerImage =
15+
pkgs.dockerTools.buildLayeredImage (let
16+
nginxPort = "80";
17+
nginxConf = pkgs.writeText "nginx.conf" ''
18+
user nginx nginx;
19+
daemon off;
20+
events {}
21+
http {
22+
server {
23+
listen ${nginxPort};
24+
location / {
25+
root ${./html};
26+
}
27+
}
28+
}
29+
'';
30+
31+
in rec {
32+
name = "otl-nix-demo";
33+
tag = "latest";
34+
35+
contents = with pkgs; [
36+
# Set up users and groups
37+
(writeTextDir "etc/shadow" ''
38+
root:!x:::::::
39+
nginx:!:::::::
40+
'')
41+
(writeTextDir "etc/passwd" ''
42+
root:x:0:0::/root:${runtimeShell}
43+
nginx:x:999:999::/home/nginx:
44+
'')
45+
(writeTextDir "etc/group" ''
46+
root:x:0:
47+
nginx:x:999:
48+
'')
49+
(writeTextDir "etc/gshadow" ''
50+
root:x::
51+
nginx:x::
52+
'')
53+
54+
# Workaround: create directories required by nginx
55+
(writeTextDir "var/cache/nginx/.placeholder" "")
56+
(writeTextDir "var/log/nginx/.placeholder" "")
57+
];
58+
59+
config = {
60+
Cmd = [ "${pkgs.nginx}/bin/nginx" "-c" nginxConf ];
61+
ExposedPorts = {
62+
"${nginxPort}/tcp" = { };
63+
};
64+
};
65+
};
66+
};
67+
};
68+
}

‎hp/hp1/Makefile‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,15 @@ rebuild:
2020
#sudo cp ./*.nix /etc/nixos/
2121
#sudo nix-channel --update
2222
#sudo nixos-rebuild switch
23-
sudo nix flake update;
2423
#sudo nix-channel --update;
2524
sudo nixos-rebuild switch --flake .
25+
systemctl --user restart ffmpeg-stream
26+
27+
rebuild_trace:
28+
sudo nixos-rebuild switch --show-trace --flake .
29+
30+
update:
31+
sudo nix flake update;
2632

2733
sync:
2834
rsync -av /home/das/nixos/hp/hp1/ hp1:/home/das/nixos/hp/hp1/

‎hp/hp1/configuration.nix‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,16 @@
6767
};
6868
};
6969

70+
# find /run/opengl-driver -name "libamfrt64.so.1"
71+
hardware.graphics = {
72+
enable = true;
73+
extraPackages = with pkgs; [
74+
amdvlk # AMD Vulkan driver, includes AMF runtime
75+
#rocm-opencl-runtime # Optional: ROCm OpenCL support
76+
#rocm-smi # AMD System Management Interface (for monitoring GPU)
77+
];
78+
};
79+
7080
# https://nixos.wiki/wiki/Networking
7181
# https://nlewo.github.io/nixos-manual-sphinx/configuration/ipv4-config.xml.html
7282
networking.hostName = "hp1";
@@ -95,7 +105,7 @@
95105
users.users.das = {
96106
isNormalUser = true;
97107
description = "das";
98-
extraGroups = [ "wheel" "libvirtd" "docker" "kubernetes" ];
108+
extraGroups = [ "wheel" "libvirtd" "docker" "kubernetes" "video" ];
99109
packages = with pkgs; [
100110
];
101111
# https://nixos.wiki/wiki/SSH_public_key_authentication
@@ -122,6 +132,9 @@
122132

123133
services.fstrim.enable = true;
124134

135+
# AMD GPU power management
136+
#services.udev.packages = with pkgs; [ rocm-smi ];
137+
125138
# This value determines the NixOS release from which the default
126139
# settings for stateful data, like file locations and database versions
127140
# on your system were taken. It‘s perfectly fine and recommended to leave

‎hp/hp1/ffmpeg_systemd_service.nix‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
#
2+
# nixos/hp/hp1/ffmpeg_systemd_service.nix
3+
#
4+
# systemctl --user restart ffmpeg-stream
5+
# systemctl --user status ffmpeg-stream
6+
#
7+
# [das@hp1:~/nixos/hp/hp1]$ systemctl --user restart ffmpeg-stream
8+
9+
# [das@hp1:~/nixos/hp/hp1]$ systemctl --user status ffmpeg-stream
10+
# ● ffmpeg-stream.service
11+
# Loaded: loaded (/home/das/.config/systemd/user/ffmpeg-stream.service; enabled; preset: ignored)
12+
# Active: active (running) since Sun 2025-02-02 15:16:54 PST; 3min 41s ago
13+
# Invocation: ac9c5b7820cd40fe85f95d610a184c46
14+
# Main PID: 394915 (ffmpeg)
15+
# Tasks: 37 (limit: 37129)
16+
# Memory: 230.4M (peak: 230.9M)
17+
# CPU: 2min 13.669s
18+
# CGroup: /user.slice/user-1000.slice/[email protected]/app.slice/ffmpeg-stream.service
19+
# └─394915 /nix/store/hk1a30i7a4nhc16sc407z0fi1yxgfgjp-ffmpeg-7.1-bin/bin/ffmpeg -f lavfi -re -i testsrc2=rate=30:size=1920x1080 -codec:v libx264 -b:v 10240k -maxrate:v 10000k -bu>
20+
21+
# [das@hp1:~/nixos/hp/hp1]$ journalctl --user -u ffmpeg-stream -f
22+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: [libx264 @ 0x352394c0] using cpu capabilities: MMX2 SSE2Fast SSSE3 SSE4.2 AVX FMA3 BMI2 AVX2
23+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: [libx264 @ 0x352394c0] profile Constrained Baseline, level 4.0, 4:2:0, 8-bit
24+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: Output #0, mpegts, to 'udp://239.0.0.1:6000?ttl=4&pkt_size=1326&localddr=172.16.40.142':
25+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: Metadata:
26+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: encoder : Lavf61.7.100
27+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: Stream #0:0: Video: h264, yuv420p(tv, progressive), 1920x1080 [SAR 1:1 DAR 16:9], q=2-31, 10240 kb/s, 25 fps, 90k tbn
28+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: Metadata:
29+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: encoder : Lavc61.19.100 libx264
30+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: Side data:
31+
# Feb 02 15:16:54 hp1 ffmpeg[394915]: cpb: bitrate max/min/avg: 10000000/0/10240000 buffer size: 10240000 vbv_delay: N/A
32+
33+
# [das@hp1:~/nixos/hp/hp1]$ sudo tcpdump -ni eno1 -c 5 host 239.0.0.1
34+
# tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
35+
# listening on eno1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
36+
# 15:21:39.577834 IP 172.16.40.142.4032 > 239.0.0.1.6000: UDP, length 1326
37+
# 15:21:39.577866 IP 172.16.40.142.4032 > 239.0.0.1.6000: UDP, length 1326
38+
# 15:21:39.577885 IP 172.16.40.142.4032 > 239.0.0.1.6000: UDP, length 1326
39+
# 15:21:39.577907 IP 172.16.40.142.4032 > 239.0.0.1.6000: UDP, length 1326
40+
# 15:21:39.577927 IP 172.16.40.142.4032 > 239.0.0.1.6000: UDP, length 1326
41+
# 5 packets captured
42+
# 35 packets received by filter
43+
# 0 packets dropped by kernel
44+
45+
{
46+
config,
47+
lib,
48+
pkgs,
49+
...
50+
}:
51+
52+
# ${pkgs.ffmpeg}/bin/ffmpeg \
53+
# ${home.packages.ffmpeg-full}/bin/ffmpeg \
54+
# ffmpeg -f lavfi -i "sine=frequency=1000:duration=10" -c:a aac -b:a 128k /home/das/test_audio.aac
55+
let
56+
ffmpegCmd =
57+
58+
''
59+
${pkgs.ffmpeg-full}/bin/ffmpeg -f lavfi -re -i testsrc2=rate=30:size=1920x1080 \
60+
-f lavfi -i "sine=frequency=1000" \
61+
-c:v libx264 -b:v 10000k -preset ultrafast -r 25 \
62+
-x264-params "nal-hrd=cbr:force-cfr=1:aud=1:intra-refresh=1" \
63+
-tune zerolatency \
64+
-bsf:v h264_mp4toannexb \
65+
-c:a aac -b:a 128k -ac 2 \
66+
-max_delay 500000 -bufsize 2000000 -fflags +genpts \
67+
-f rtp_mpegts "rtp://239.0.0.1:6000?pkt_size=1326&ttl=4&localaddr=172.16.40.142"
68+
'';
69+
# Ensures SPS/PPS is sent in every keyframe (prevents decoder from losing parameter sets).
70+
# Forces constant frame rate (force-cfr=1), improving stream stability.
71+
72+
# ''
73+
# ${pkgs.ffmpeg-full}/bin/ffmpeg \
74+
# -f lavfi -re -i testsrc2=rate=30:size=1920x1080 \
75+
# -f lavfi -i "sine=frequency=1000" \
76+
# -c:v libx264 -b:v 10000k -preset ultrafast -r 25 \
77+
# -c:a aac -b:a 128k -ac 2 \
78+
# -x264opts "keyint=50:min-keyint=50:no-scenecut" \
79+
# -bsf:v h264_mp4toannexb \
80+
# -max_delay 500000 -bufsize 2000000 -fflags +genpts \
81+
# -f rtp_mpegts "rtp://239.0.0.1:6000?pkt_size=1326&ttl=4&localaddr=172.16.40.142"
82+
# '';
83+
#-x264opts "keyint=50:min-keyint=50:no-scenecut" ensures regular keyframes.
84+
#-bsf:v h264_mp4toannexb converts H.264 to Annex B format, which is better for streaming.
85+
86+
# ''
87+
# ${pkgs.ffmpeg-full}/bin/ffmpeg \
88+
# -f lavfi -re -i testsrc2=rate=30:size=1920x1080 \
89+
# -f lavfi -i "sine=frequency=1000" \
90+
# -c:v libx264 -b:v 10000k -preset ultrafast -r 25 \
91+
# -c:a aac -b:a 128k -ac 2 \
92+
# -max_delay 500000 -bufsize 2000000 -fflags +genpts \
93+
# -f rtp_mpegts \
94+
# "rtp://239.0.0.1:6000?pkt_size=1326&ttl=4&localaddr=172.16.40.142"
95+
# '';
96+
97+
# ''
98+
# ${pkgs.ffmpeg-full}/bin/ffmpeg \
99+
# -f lavfi -re -i testsrc2=rate=30:size=1920x1080 \
100+
# -re -i /home/das/test_audio/test_audio.aac \
101+
# -c:v libx264 -b:v 10240k -maxrate:v 10000k -bufsize:v 10240k -preset ultrafast -r 25 -g 50 -pix_fmt yuv420p -flags2 local_header \
102+
# -c:a aac -b:a 128k -ac 2 \
103+
# -max_delay 500000 -bufsize 2000000 -fflags +genpts \
104+
# -f rtp_mpegts \
105+
# "rtp://239.0.0.1:6000?ttl=4&pkt_size=1326&localaddr=172.16.40.142"
106+
# '';
107+
# ''
108+
# ${pkgs.ffmpeg}/bin/ffmpeg \
109+
# -f lavfi \
110+
# -re \
111+
# -i testsrc2=rate=30:size=1920x1080 \
112+
# -codec:v libx264 \
113+
# -b:v 10240k \
114+
# -maxrate:v 10000k \
115+
# -bufsize:v 10240k \
116+
# -preset ultrafast \
117+
# -r 25 \
118+
# -g 50 \
119+
# -pix_fmt yuv420p \
120+
# -flags2 local_header \
121+
# -f mpegts \
122+
# -transtype live \
123+
# "rtp://239.0.0.1:6000?ttl=4&pkt_size=1326&localddr=172.16.40.142"
124+
# '';
125+
in
126+
{
127+
systemd.user.services.ffmpeg-stream = {
128+
129+
Unit = {
130+
description = "FFmpeg Multicast Service";
131+
};
132+
133+
Service = {
134+
ExecStart = "${ffmpegCmd}";
135+
Restart = "always";
136+
RestartSec = 2;
137+
StandardOutput = "journal";
138+
StandardError = "journal";
139+
140+
### 🔐 Security Hardening Options ###
141+
NoNewPrivileges = true; # Prevents privilege escalation
142+
PrivateTmp = true; # Isolates service temporary files
143+
ProtectSystem = "strict"; # Restricts access to system files
144+
ProtectHome = "read-only"; # Readonly access to home directory
145+
#ProtectHome = "yes"; # Blocks access to home directory
146+
ProtectKernelModules = true; # Blocks module loading
147+
ProtectKernelLogs = true; # Prevents access to kernel logs
148+
ProtectControlGroups = true; # Restricts cgroup modifications
149+
MemoryDenyWriteExecute = true; # Prevents memory exploits
150+
RestrictRealtime = true; # Blocks real-time priority settings
151+
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; # Restricts network access
152+
SystemCallFilter = [ "~@mount" "~@privileged" "~@resources" ]; # Blocks dangerous system calls
153+
LockPersonality = true; # Prevents personality changes (defense against exploits)
154+
ReadOnlyPaths = "/etc /usr /home/das/test_audio/"; # Makes important paths read-only
155+
#wReadWritePaths = "/var/www/html"; # Only allow writing in this directory
156+
ProtectClock = true; # Blocks modification of system clock
157+
};
158+
159+
Install = {
160+
after = [ "network.target" ];
161+
WantedBy = [ "default.target" ];
162+
};
163+
};
164+
}

‎hp/hp1/flake.nix‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
{
22
description = "HP1 Flake";
33

4+
# https://nix.dev/manual/nix/2.24/command-ref/new-cli/nix3-flake.html#flake-inputs
45
inputs = {
56
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
7+
68
# https://nixos-and-flakes.thiscute.world/nixos-with-flakes/start-using-home-manager
79
home-manager = {
810
url = "github:nix-community/home-manager/release-24.11";

‎hp/hp1/home.nix‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@
77
home.username = "das";
88
home.homeDirectory = "/home/das";
99

10+
imports = [
11+
./ffmpeg_systemd_service.nix
12+
];
13+
1014
# https://nix-community.github.io/home-manager/index.xhtml#ch-installation
1115
#home-manager.users.das = { pkgs, ... }: {
1216

@@ -100,7 +104,7 @@
100104
graphviz
101105
#
102106
#ffmpeg
103-
ffmpeg-full
107+
#ffmpeg-full
104108
];
105109

106110
programs.bash = {
@@ -134,7 +138,7 @@
134138

135139
nixpkgs.config.allowUnfree = true;
136140

137-
home.stateVersion = "24.05";
138141
programs.home-manager.enable = true;
142+
home.stateVersion = "24.11";
139143
#};
140144
}

‎hp/hp1/not.ffmpeg_service.nix.not‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
config,
3+
pkgs,
4+
...
5+
}:
6+
{
7+
systemd.user.services.onedrive-UMFC = {
8+
Unit = {
9+
Description = "start ffmpeg";
10+
};
11+
Service = {
12+
ProtectSystem = "full";
13+
ProtectHostname = true;
14+
ProtectKernelTunables = true;
15+
ProtectControlGroups = true;
16+
RestrictRealtime = true;
17+
Group = "users";
18+
ExecStartPre = "${pkgs.coreutils}/bin/sleep 15";
19+
ExecStart= "${pkgs.ffmpeg}/bin/onedrive --monitor --confdir=/home/kazimierzkrauze/.config/onedrive/onedrive-UMFC";
20+
Restart = "on-failure";
21+
RestartSec = 3;
22+
# Do not restart the service if a --resync is required which is done via a 126 exit code
23+
RestartPreventExitStatus = 126;
24+
# Time to wait for the service to stop gracefully before forcefully terminating it
25+
TimeoutStopSec = 90;
26+
};
27+
Install = {
28+
WantedBy = [ "default.target" ];
29+
};
30+
};
31+
};

‎hp/hp1/systemPackages.nix‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,8 @@
2525
#snmp seems to be needed by lldpd
2626
net-snmp
2727
neofetch
28+
#
29+
ffmpeg-full
30+
radeontop # GPU monitoring tool
2831
];
2932
}

‎hp/hp5/Makefile‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,19 @@ rebuild:
2020
#sudo cp ./*.nix /etc/nixos/
2121
#sudo nix-channel --update
2222
#sudo nixos-rebuild switch
23-
sudo nix flake update;
2423
#sudo nix-channel --update;
2524
sudo nixos-rebuild switch --flake .
25+
sudo systemctl daemon-reexec
26+
sudo systemctl restart create-stream-sdp.service
27+
sudo systemctl restart create-stream-m3u8.service
28+
sudo systemctl restart ffmpeg-hls
29+
30+
31+
rebuild_trace:
32+
sudo nixos-rebuild switch --show-trace --flake .
33+
34+
update:
35+
sudo nix flake update;
2636

2737
sync:
2838
rsync -av /home/das/nixos/hp/hp5/ hp5:/home/das/nixos/hp/hp5/

0 commit comments

Comments
 (0)