hosts/aubergine.nix

   1 { config, pkgs, lib, inputs, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/router.nix
   5     #../nixos/profiles/debug.nix
   6     ../nixos/profiles/lang-fr.nix
   7     #../nixos/profiles/tor.nix
   8     ../nixos/profiles/networking/remote.nix
   9     ../nixos/profiles/home.nix
  10     aubergine/hardware.nix
  11     aubergine/nebula.nix
  12     aubergine/networking.nix
  13     aubergine/printing.nix
  14     aubergine/nginx.nix
  15     aubergine/backup.nix
  16     aubergine/sftp.nix
  17   ];
  18
  19   # Lower kernel's security for better performances
  20   security.kernel.mitigations = "off";
  21
  22   home-manager.users.julm = {
  23     imports = [ ../homes/julm.nix ];
  24   };
  25   users = {
  26     users.julm = {
  27       isNormalUser = true;
  28       uid = 1000;
  29       # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  30       # which is already world readable.
  31       # printf %s $(mkpasswd -m yescrypt)
  32       hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
  33       extraGroups = [
  34         "adbusers"
  35         "audio"
  36         "dialout"
  37         "networkmanager"
  38         "tor"
  39         "video"
  40         "wheel"
  41         "wireshark"
  42       ];
  43       createHome = true;
  44       openssh.authorizedKeys.keys = map lib.readFile [
  45         ../users/root/ssh/losurdo.pub
  46         ../users/julm/ssh/losurdo.pub
  47         ../users/julm/ssh/oignon.pub
  48         ../users/julm/ssh/pumpkin.pub
  49         ../users/julm/ssh/redmi.pub
  50       ];
  51     };
  52     users.root = {
  53       hashedPassword = "!";
  54       openssh.authorizedKeys.keys =
  55         config.users.users.julm.openssh.authorizedKeys.keys;
  56     };
  57     users.sevy = {
  58       isNormalUser = true;
  59       uid = 1001;
  60       hashedPassword = "!";
  61       extraGroups = [
  62       ];
  63       createHome = true;
  64       openssh.authorizedKeys.keys = map lib.readFile [
  65         ../users/sevy/ssh/patate.pub
  66       ];
  67     };
  68   };
  69
  70   #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
  71   #  "secret-key-files:" + aubergine/nix/secret-key-files;
  72   nix = {
  73     extraOptions = ''
  74       #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
  75     '';
  76     settings = {
  77       substituters = [
  78         #"http://nix-localcache.losurdo.wg"
  79         #"ssh://nix-ssh@losurdo.wg?priority=30"
  80         #"ssh://nix-ssh@oignon.wg?priority=30"
  81       ];
  82       trusted-public-keys = map lib.readFile [
  83         #../users/root/nix/oignon.pub
  84         #../users/root/nix/pumpkin.pub
  85       ];
  86     };
  87     nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  88   };
  89   #environment.etc."nixpkgs".source = pkgs.path;
  90   #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  91
  92   nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  93   nix.sshServe = {
  94     enable = true;
  95     keys = map lib.readFile [
  96       ../users/julm/ssh/losurdo.pub
  97       ../users/sevy/ssh/patate.pub
  98       ../users/julm/ssh/oignon.pub
  99       ../users/julm/ssh/pumpkin.pub
 100     ];
 101   };
 102
 103   environment.systemPackages = [
 104   ];
 105
 106   boot.extraModulePackages = [
 107     #config.boot.kernelPackages.v4l2loopback
 108   ];
 109
 110   # This value determines the NixOS release with which your system is to be
 111   # compatible, in order to avoid breaking some software such as database
 112   # servers. You should change this only after NixOS release notes say you should.
 113   system.stateVersion = "22.11"; # Did you read the comment?
 114 }