hosts/aubergine.nix

   1 { config, pkgs, lib, inputs, hostName, ... }:
   2 {
   3 imports = [
   4   #../nixos/profiles/debug.nix
   5   ../nixos/profiles/lang-fr.nix
   6   ../nixos/profiles/security.nix
   7   ../nixos/profiles/system.nix
   8   #../nixos/profiles/tor.nix
   9   aubergine/hardware.nix
  10   aubergine/networking.nix
  11 ];
  12
  13 # Lower kernel's security for better performances
  14 boot.kernelParams = [ "mitigations=off" ];
  15
  16 home-manager.users.julm = {
  17   imports = [ ../homes/julm.nix ];
  18 };
  19 systemd.services.home-manager-julm.postStart = ''
  20   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
  21 '';
  22 users.users.julm = {
  23   isNormalUser = true;
  24   uid = 1000;
  25   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  26   # which is already world readable.
  27   # printf %s $(mkpasswd -m md5crypt)
  28   hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
  29   extraGroups = [
  30     "adbusers"
  31     "dialout"
  32     "networkmanager"
  33     "tor"
  34     "wheel"
  35   ];
  36   # If created, zfs-mount.service would require:
  37   # zfs set overlay=yes ${hostName}/home
  38   createHome = true;
  39   openssh.authorizedKeys.keys = map lib.readFile [
  40     ../users/root/ssh/losurdo.pub
  41     ../users/julm/ssh/losurdo.pub
  42     ../users/julm/ssh/oignon.pub
  43     ../users/julm/ssh/redmi.pub
  44   ];
  45 };
  46 users.users.root = {
  47   hashedPassword = "!";
  48   openssh.authorizedKeys.keys =
  49     config.users.users.julm.openssh.authorizedKeys.keys;
  50 };
  51
  52 #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
  53 #  "secret-key-files:" + aubergine/nix/secret-key-files;
  54 nix = {
  55   extraOptions = ''
  56     #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
  57   '';
  58   settings = {
  59     trusted-users = [ config.users.users."julm".name ];
  60     substituters = [
  61       #"http://nix-localcache.losurdo.wg"
  62       #"ssh://nix-ssh@losurdo.wg?priority=30"
  63       #"ssh://nix-ssh@oignon.wg?priority=30"
  64     ];
  65     trusted-public-keys = map lib.readFile [
  66       ../users/root/nix/oignon.pub
  67     ];
  68   };
  69   nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  70 };
  71 #environment.etc."nixpkgs".source = pkgs.path;
  72 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  73
  74 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  75 nix.sshServe = {
  76   enable = true;
  77   keys = map lib.readFile [
  78     ../users/julm/ssh/losurdo.pub
  79     ../users/sevy/ssh/patate.pub
  80     ../users/julm/ssh/oignon.pub
  81   ];
  82 };
  83
  84 environment.systemPackages = [
  85 ];
  86
  87 boot.extraModulePackages = [
  88   #config.boot.kernelPackages.v4l2loopback
  89 ];
  90
  91 # This value determines the NixOS release with which your system is to be
  92 # compatible, in order to avoid breaking some software such as database
  93 # servers. You should change this only after NixOS release notes say you should.
  94 system.stateVersion = "22.11"; # Did you read the comment?
  95 }