]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine.nix
firefox: user browserpass instead of passff
[julm/julm-nix.git] / hosts / aubergine.nix
1 { config, pkgs, lib, inputs, ... }:
2 {
3 imports = [
4 #../nixos/profiles/debug.nix
5 ../nixos/profiles/lang-fr.nix
6 #../nixos/profiles/tor.nix
7 aubergine/hardware.nix
8 aubergine/networking.nix
9 ];
10
11 # Lower kernel's security for better performances
12 boot.kernelParams = [ "mitigations=off" ];
13
14 home-manager.users.julm = {
15 imports = [ ../homes/julm.nix ];
16 };
17 systemd.services.home-manager-julm.postStart = ''
18 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
19 '';
20 users.users.julm = {
21 isNormalUser = true;
22 uid = 1000;
23 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
24 # which is already world readable.
25 # printf %s $(mkpasswd -m md5crypt)
26 hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
27 extraGroups = [
28 "adbusers"
29 "dialout"
30 "networkmanager"
31 "tor"
32 "wheel"
33 ];
34 # If created, zfs-mount.service would require:
35 # zfs set overlay=yes ${hostName}/home
36 createHome = true;
37 openssh.authorizedKeys.keys = map lib.readFile [
38 ../users/root/ssh/losurdo.pub
39 ../users/julm/ssh/losurdo.pub
40 ../users/julm/ssh/oignon.pub
41 ../users/julm/ssh/redmi.pub
42 ];
43 };
44 users.users.root = {
45 hashedPassword = "!";
46 openssh.authorizedKeys.keys =
47 config.users.users.julm.openssh.authorizedKeys.keys;
48 };
49
50 #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
51 # "secret-key-files:" + aubergine/nix/secret-key-files;
52 nix = {
53 extraOptions = ''
54 #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
55 '';
56 settings = {
57 trusted-users = [ config.users.users."julm".name ];
58 substituters = [
59 #"http://nix-localcache.losurdo.wg"
60 #"ssh://nix-ssh@losurdo.wg?priority=30"
61 #"ssh://nix-ssh@oignon.wg?priority=30"
62 ];
63 trusted-public-keys = map lib.readFile [
64 ../users/root/nix/oignon.pub
65 ];
66 };
67 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
68 };
69 #environment.etc."nixpkgs".source = pkgs.path;
70 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
71
72 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
73 nix.sshServe = {
74 enable = true;
75 keys = map lib.readFile [
76 ../users/julm/ssh/losurdo.pub
77 ../users/sevy/ssh/patate.pub
78 ../users/julm/ssh/oignon.pub
79 ];
80 };
81
82 environment.systemPackages = [
83 ];
84
85 boot.extraModulePackages = [
86 #config.boot.kernelPackages.v4l2loopback
87 ];
88
89 # This value determines the NixOS release with which your system is to be
90 # compatible, in order to avoid breaking some software such as database
91 # servers. You should change this only after NixOS release notes say you should.
92 system.stateVersion = "22.11"; # Did you read the comment?
93 }