hosts/patate.nix

   1 { config, pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/dnscrypt-proxy2.nix
   5     ../nixos/profiles/graphical.nix
   6     ../nixos/profiles/lang-fr.nix
   7     ../nixos/profiles/networking.nix
   8     ../nixos/profiles/printing.nix
   9     ../nixos/profiles/security.nix
  10     ../nixos/profiles/system.nix
  11     ../nixos/profiles/wireguard/wg-intra.nix
  12     patate/backup.nix
  13     patate/hardware.nix
  14     patate/wireguard.nix
  15   ];
  16
  17   # Lower kernel's security for better performances
  18   boot.kernelParams = [ "mitigations=off" ];
  19
  20   home-manager.users.sevy = {
  21     imports = [ ../homes/sevy.nix ];
  22   };
  23   systemd.services.home-manager-sevy.postStart = ''
  24     ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  25   '';
  26   users.users.sevy = {
  27     isNormalUser = true;
  28     uid = 1000;
  29     # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  30     # which is already world readable.
  31     hashedPassword = lib.readFile patate/users/sevy/login/hashedPassword.clear;
  32     extraGroups = [
  33       "adbusers"
  34       config.services.davfs2.davGroup
  35       "lp"
  36       "networkmanager"
  37       "scanner"
  38       "systemd-journal"
  39       "tor"
  40       "vboxusers"
  41       "video"
  42       "wheel"
  43     ];
  44   };
  45
  46   nix = {
  47     settings = {
  48       trusted-users = [ config.users.users."sevy".name ];
  49       substituters = [
  50         #"ssh://nix-ssh@losurdo.wg?priority=30"
  51         "ssh://nix-ssh@oignon.wg?priority=10"
  52       ];
  53       trusted-public-keys = map lib.readFile [
  54         ../users/root/nix/losurdo.pub
  55         ../users/root/nix/oignon.pub
  56       ];
  57     };
  58   };
  59
  60   environment.systemPackages = [
  61     pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
  62   ];
  63
  64   services.physlock = {
  65     enable = true;
  66     allowAnyUser = true;
  67     # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
  68   };
  69
  70   services.xserver = {
  71     desktopManager = {
  72       mate.enable = true;
  73       xfce.enable = true;
  74       xterm.enable = false;
  75     };
  76     displayManager = {
  77       defaultSession = "mate";
  78       autoLogin = {
  79         user = config.users.users.sevy.name;
  80       };
  81     };
  82   };
  83
  84   virtualisation.virtualbox.host.enable = true;
  85
  86   # This value determines the NixOS release with which your system is to be
  87   # compatible, in order to avoid breaking some software such as database
  88   # servers. You should change this only after NixOS release notes say you should.
  89   system.stateVersion = "20.03"; # Did you read the comment?
  90 }