hosts/aubergine.nix

   1 { config, pkgs, lib, inputs, private, hostName, ... }:
   2 {
   3 imports = [
   4   #../nixos/profiles/debug.nix
   5   ../nixos/profiles/lang-fr.nix
   6   ../nixos/profiles/security.nix
   7   ../nixos/profiles/system.nix
   8   #../nixos/profiles/tor.nix
   9   aubergine/hardware.nix
  10   aubergine/networking.nix
  11 ];
  12
  13 # Lower kernel's security for better performances
  14 boot.kernelParams = [ "mitigations=off" ];
  15
  16 environment.etc.machine-id.source = ../private + "/hosts/${hostName}/root/machine-id";
  17
  18 home-manager.users.julm = {
  19   imports = [ ../homes/julm.nix ];
  20   # /sys/devices/virtual/dmi/id/product_name
  21   host.hardware = [ "apu6" ];
  22 };
  23 systemd.services.home-manager-julm.postStart = ''
  24   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
  25 '';
  26 users.users.julm = {
  27   isNormalUser = true;
  28   uid = 1000;
  29   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  30   # which is already world readable.
  31   hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
  32   extraGroups = [
  33     "adbusers"
  34     "dialout"
  35     "networkmanager"
  36     "tor"
  37     "wheel"
  38   ];
  39   # If created, zfs-mount.service would require:
  40   # zfs set overlay=yes ${hostName}/home
  41   createHome = true;
  42   openssh.authorizedKeys.keys = map lib.readFile [
  43     ../private/shared/ssh/root/losurdo.pub
  44     ../private/shared/ssh/julm/losurdo.pub
  45     ../private/shared/ssh/julm/oignon.pub
  46     ../private/shared/ssh/julm/redmi.pub
  47   ];
  48 };
  49 users.users.root = {
  50   hashedPassword = "!";
  51   openssh.authorizedKeys.keys = map lib.readFile [
  52     ../private/shared/ssh/root/losurdo.pub
  53     ../private/shared/ssh/julm/losurdo.pub
  54     ../private/shared/ssh/julm/oignon.pub
  55     ../private/shared/ssh/julm/redmi.pub
  56   ];
  57 };
  58
  59 nix = {
  60   extraOptions = ''
  61     #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
  62     #secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
  63   '';
  64   settings = {
  65     trusted-users = [ config.users.users."julm".name ];
  66     substituters = [
  67       #"http://nix-localcache.losurdo.wg"
  68       #"ssh://nix-ssh@losurdo.wg?priority=30"
  69     ];
  70     trusted-public-keys = map lib.readFile [
  71       #../private/shared/nix/losurdo.pub
  72     ];
  73   };
  74   nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  75 };
  76 #environment.etc."nixpkgs".source = pkgs.path;
  77 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  78
  79 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  80 nix.sshServe = {
  81   enable = true;
  82   keys = map lib.readFile [
  83     ../private/shared/ssh/julm/losurdo.pub
  84     ../private/shared/ssh/sevy/patate.pub
  85     ../private/shared/ssh/julm/oignon.pub
  86   ];
  87 };
  88
  89 environment.systemPackages = [
  90 ];
  91
  92 boot.extraModulePackages = [
  93   #config.boot.kernelPackages.v4l2loopback
  94 ];
  95
  96 # This value determines the NixOS release with which your system is to be
  97 # compatible, in order to avoid breaking some software such as database
  98 # servers. You should change this only after NixOS release notes say you should.
  99 system.stateVersion = "22.11"; # Did you read the comment?
 100 }