diff --git a/@matic/readme.md b/@matic/readme.md new file mode 100644 index 000000000..40ef839c8 --- /dev/null +++ b/@matic/readme.md @@ -0,0 +1,25 @@ +# NixOS (matic - Framework 13 AMD AI 300) + +## Full Disk Encryption (LUKS + TPM2) + +The root partition is encrypted with LUKS2. TPM2 auto-unlock is configured so no passphrase is needed on boot. + +After a fresh install or kernel update, enroll the TPM2 key: + +```bash +sudo systemd-cryptenroll --tpm2-device=auto /dev/nvme0n1p2 +``` + +If the boot chain changes (firmware/kernel update), TPM2 will refuse and fall back to the passphrase. Re-enroll after booting with the passphrase. + +## Building and Switching + +```bash +make build HOST=matic && make switch HOST=matic +``` + +Or use `boot` instead of `switch` for major config changes (avoids dbus reload issues): + +```bash +sudo nixos-rebuild boot --flake .#matic --impure && sudo reboot +``` diff --git a/README.md b/README.md index 65c5f9acd..94868d47d 100644 --- a/README.md +++ b/README.md @@ -8,32 +8,6 @@ For troubleshooting and frequently asked questions, see [FAQ.md](./FAQ.md). -## NixOS (matic - Framework 13 AMD AI 300) - -### Full Disk Encryption (LUKS + TPM2) - -The root partition is encrypted with LUKS2. TPM2 auto-unlock is configured so no passphrase is needed on boot. - -After a fresh install or kernel update, enroll the TPM2 key: - -```bash -sudo systemd-cryptenroll --tpm2-device=auto /dev/nvme0n1p2 -``` - -If the boot chain changes (firmware/kernel update), TPM2 will refuse and fall back to the passphrase. Re-enroll after booting with the passphrase. - -### Building and Switching - -```bash -make build HOST=matic && make switch HOST=matic -``` - -Or use `boot` instead of `switch` for major config changes (avoids dbus reload issues): - -```bash -sudo nixos-rebuild boot --flake .#matic --impure && sudo reboot -``` - ## Credits See [REFERENCES.md](./REFERENCES.md) for more information. diff --git a/config/hyprland/hypridle.conf b/config/hyprland/hypridle.conf index 6dc5c9571..ae4006e05 100644 --- a/config/hyprland/hypridle.conf +++ b/config/hyprland/hypridle.conf @@ -25,8 +25,8 @@ listener { on-resume = hyprctl dispatch dpms on } -# Suspend after 30 minutes +# Suspend after 30 minutes (only on battery) listener { timeout = 1800 - on-timeout = systemctl suspend + on-timeout = bash -c 'cat /sys/class/power_supply/AC*/online | grep -q 1 || systemctl suspend' } diff --git a/named-hosts/matic/default.nix b/named-hosts/matic/default.nix index 2a3f4b632..69d6684cd 100644 --- a/named-hosts/matic/default.nix +++ b/named-hosts/matic/default.nix @@ -132,6 +132,9 @@ inputs.nixpkgs.lib.nixosSystem { # Power button behavior - lock screen instead of shutdown services.logind.settings.Login.HandlePowerKey = "lock"; + # Ignore lid close — let hypridle's 30-min idle timer handle suspension + services.logind.settings.Login.HandleLidSwitch = "ignore"; + services.logind.settings.Login.HandleLidSwitchExternalPower = "ignore"; # Auto timezone (via geolocation) services.geoclue2.enable = true;