hosts/patate.nix

   1 { config, pkgs, lib, ... }:
   2 {
   3 imports = [
   4   ../nixos/profiles/dnscrypt-proxy2.nix
   5   ../nixos/profiles/graphical.nix
   6   ../nixos/profiles/lang-fr.nix
   7   ../nixos/profiles/networking.nix
   8   ../nixos/profiles/printing.nix
   9   ../nixos/profiles/security.nix
  10   ../nixos/profiles/system.nix
  11   ../nixos/profiles/wireguard/wg-intra.nix
  12   patate/backup.nix
  13   patate/hardware.nix
  14   patate/wireguard.nix
  15 ];
  16
  17 # Lower kernel's security for better performances
  18 boot.kernelParams = [ "mitigations=off" ];
  19
  20 home-manager.users.sevy = {
  21   imports = [ ../homes/sevy.nix ];
  22   host.hardware = [ "ThinkPad" "X200" ];
  23 };
  24 systemd.services.home-manager-sevy.postStart = ''
  25   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  26 '';
  27 users.users.sevy = {
  28   isNormalUser = true;
  29   uid = 1000;
  30   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  31   # which is already world readable.
  32   hashedPassword = lib.readFile ../private/world/sevy/hashedPassword;
  33   extraGroups = [
  34     "adbusers"
  35     config.services.davfs2.davGroup
  36     "lp"
  37     "networkmanager"
  38     "scanner"
  39     "systemd-journal"
  40     "tor"
  41     "vboxusers"
  42     "video"
  43     "wheel"
  44   ];
  45 };
  46
  47 nix = {
  48   settings = {
  49     trusted-users = [ config.users.users."sevy".name ];
  50     substituters = [
  51       #"ssh://nix-ssh@losurdo.wg?priority=30"
  52       "ssh://nix-ssh@oignon.wg?priority=10"
  53     ];
  54     trusted-public-keys = map lib.readFile [
  55       ../private/shared/nix/losurdo.pub
  56       ../private/shared/nix/oignon.pub
  57     ];
  58   };
  59 };
  60
  61 environment.systemPackages = [
  62   pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
  63 ];
  64
  65 services.physlock = {
  66   enable = true;
  67   allowAnyUser = true;
  68   # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
  69 };
  70
  71 services.xserver = {
  72   desktopManager = {
  73     mate.enable = true;
  74     xfce.enable = true;
  75     xterm.enable = false;
  76   };
  77   displayManager = {
  78     defaultSession = "mate";
  79     autoLogin = {
  80       user = config.users.users.sevy.name;
  81     };
  82   };
  83 };
  84
  85 virtualisation.virtualbox.host.enable = true;
  86
  87 # This value determines the NixOS release with which your system is to be
  88 # compatible, in order to avoid breaking some software such as database
  89 # servers. You should change this only after NixOS release notes say you should.
  90 system.stateVersion = "20.03"; # Did you read the comment?
  91 }