NixDaemon

NixOS pentest workstation as one flake — IceBreaker's successor
git clone https://git.daemon-sec.xyz/NixDaemon.git
Log | Files | Refs | README

commit 2e3a77ad5222762d438ec017f5e7301bd7966182
parent db27a1eaf172a49a1acf0ea516003860c4cf2518
Author: DAEMON-404 <zer0sec.xp@icloud.com>
Date:   Wed,  7 Oct 2026 23:30:24 +0100

fan guard: no autostart for fanfix-fan (EC PROCHOT latch), fix profile unit ordering, add jj

Diffstat:
Mhosts/bootstrap/default.nix | 2++
Mhosts/laptop/fan-extras.nix | 4+++-
Mhosts/laptop/fan-throttle-guard.nix | 9++++++++-
3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/hosts/bootstrap/default.nix b/hosts/bootstrap/default.nix @@ -81,6 +81,8 @@ eza fd ripgrep + git + jujutsu # jj, colocated with the existing .git; also in home/modules/tools.nix for Stage B ]; system.stateVersion = "26.05"; diff --git a/hosts/laptop/fan-extras.nix b/hosts/laptop/fan-extras.nix @@ -13,7 +13,9 @@ description = "fanfix: select the performance power profile and re-assert the clock floor"; after = [ "power-profiles-daemon.service" "systemd-tmpfiles-setup.service" ]; requires = [ "power-profiles-daemon.service" ]; - wantedBy = [ "multi-user.target" ]; + # graphical.target, not multi-user: on NixOS power-profiles-daemon is itself + # ordered After=multi-user.target, so multi-user here is an ordering cycle. + wantedBy = [ "graphical.target" ]; serviceConfig = { Type = "oneshot"; ExecStart = "${pkgs.power-profiles-daemon}/bin/powerprofilesctl set performance"; diff --git a/hosts/laptop/fan-throttle-guard.nix b/hosts/laptop/fan-throttle-guard.nix @@ -92,6 +92,13 @@ in ##### 5. Surviving CPU fan at a fixed 60 % duty ############################## # CURVE is "temp:pct …" pairs; a flat 0:60 100:60 is what has been running. # fanfix refuses anything below 30 %. Edit here, not in /etc, then rebuild. + # + # NOT started at boot (wantedBy = []). Measured 2026-10-07 on NixOS: while the + # daemon holds the EC in manual/custom-table fan mode, the EC asserts PROCHOT + # (all cores 399 MHz) the moment any load starts, even at 37 °C. Stopping the + # unit and `fanfix fan auto` cleared it instantly; 10 s all-core test then ran + # at 3112 MHz, peak 53 °C, 0 trips. The 3.2 GHz floor + stability guard are + # enough on their own. Start by hand to experiment: systemctl start fanfix-fan environment.etc."fanfix.conf".text = '' CURVE="0:60 100:60" ''; @@ -99,7 +106,7 @@ in systemd.services.fanfix-fan = { description = "fanfix: temperature → fan-duty curve for the surviving CPU fan (dead GPU fan workaround)"; after = [ "multi-user.target" ]; - wantedBy = [ "multi-user.target" ]; + wantedBy = [ ]; # see note above; manual start only path = fanDeps; serviceConfig = { Type = "simple";