hosts/aubergine.nix

   1 { config, pkgs, lib, inputs, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/router.nix
   5     #../nixos/profiles/debug.nix
   6     ../nixos/profiles/lang-fr.nix
   7     #../nixos/profiles/tor.nix
   8     ../nixos/profiles/networking/remote.nix
   9     aubergine/hardware.nix
  10     aubergine/nebula.nix
  11     aubergine/networking.nix
  12     aubergine/nginx.nix
  13     aubergine/backup.nix
  14     aubergine/sftp.nix
  15   ];
  16
  17   # Lower kernel's security for better performances
  18   security.kernel.mitigations = "off";
  19
  20   home-manager.users.julm = {
  21     imports = [ ../homes/julm.nix ];
  22   };
  23   users = {
  24     users.julm = {
  25       isNormalUser = true;
  26       uid = 1000;
  27       # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  28       # which is already world readable.
  29       # printf %s $(mkpasswd -m yescrypt)
  30       hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
  31       extraGroups = [
  32         "adbusers"
  33         "audio"
  34         "dialout"
  35         "networkmanager"
  36         "tor"
  37         "video"
  38         "wheel"
  39       ];
  40       createHome = true;
  41       openssh.authorizedKeys.keys = map lib.readFile [
  42         ../users/root/ssh/losurdo.pub
  43         ../users/julm/ssh/losurdo.pub
  44         ../users/julm/ssh/oignon.pub
  45         ../users/julm/ssh/redmi.pub
  46       ];
  47     };
  48     users.root = {
  49       hashedPassword = "!";
  50       openssh.authorizedKeys.keys =
  51         config.users.users.julm.openssh.authorizedKeys.keys;
  52     };
  53     users.sevy = {
  54       isNormalUser = true;
  55       uid = 1001;
  56       hashedPassword = "!";
  57       extraGroups = [
  58       ];
  59       createHome = true;
  60       openssh.authorizedKeys.keys = map lib.readFile [
  61         ../users/sevy/ssh/patate.pub
  62       ];
  63     };
  64   };
  65
  66   #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
  67   #  "secret-key-files:" + aubergine/nix/secret-key-files;
  68   nix = {
  69     extraOptions = ''
  70       #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
  71     '';
  72     settings = {
  73       substituters = [
  74         #"http://nix-localcache.losurdo.wg"
  75         #"ssh://nix-ssh@losurdo.wg?priority=30"
  76         #"ssh://nix-ssh@oignon.wg?priority=30"
  77       ];
  78       trusted-public-keys = map lib.readFile [
  79         ../users/root/nix/oignon.pub
  80       ];
  81     };
  82     nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  83   };
  84   #environment.etc."nixpkgs".source = pkgs.path;
  85   #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  86
  87   nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  88   nix.sshServe = {
  89     enable = true;
  90     keys = map lib.readFile [
  91       ../users/julm/ssh/losurdo.pub
  92       ../users/sevy/ssh/patate.pub
  93       ../users/julm/ssh/oignon.pub
  94     ];
  95   };
  96
  97   environment.systemPackages = [
  98   ];
  99
 100   boot.extraModulePackages = [
 101     #config.boot.kernelPackages.v4l2loopback
 102   ];
 103
 104   # This value determines the NixOS release with which your system is to be
 105   # compatible, in order to avoid breaking some software such as database
 106   # servers. You should change this only after NixOS release notes say you should.
 107   system.stateVersion = "22.11"; # Did you read the comment?
 108 }