hosts/patate.nix

   1 { config, pkgs, lib, inputs, hostName, ... }:
   2 let inherit (config.users) users; in
   3 {
   4 imports = [
   5   ../profiles/dnscrypt-proxy2.nix
   6   ../profiles/security.nix
   7   patate/backup.nix
   8   patate/hardware.nix
   9 ];
  10
  11 home-manager.users.sevy = {
  12   imports = [ ../homes/sevy.nix ];
  13   host.name = hostName;
  14   host.hardware = ["ThinkPad" "X200"];
  15 };
  16 systemd.services.home-manager-julm.postStart = ''
  17   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  18 '';
  19 users.mutableUsers = false;
  20 users.users.sevy = {
  21   isNormalUser = true;
  22   uid = 1000;
  23   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  24   # which is already world readable.
  25   hashedPassword = lib.readFile ../private/world/sevy/hashedPassword;
  26   extraGroups = [
  27     "adbusers"
  28     config.services.davfs2.davGroup
  29     "lp"
  30     "networkmanager"
  31     "scanner"
  32     "systemd-journal"
  33     "tor"
  34     "vboxusers"
  35     "video"
  36     "wheel"
  37   ];
  38 };
  39
  40 nix = {
  41   extraOptions = ''
  42     auto-optimise-store = true
  43   '';
  44   gc = {
  45     automatic = true;
  46     dates = "weekly";
  47     options = "--delete-older-than 7d";
  48   };
  49   nixPath = [
  50     "nixpkgs=/etc/nixpkgs"
  51     "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix"
  52   ];
  53   trustedUsers = [ users.sevy.name ];
  54   binaryCaches = [
  55     "https://nix-localcache.sourcephile.fr"
  56     #"ssh://nix-ssh@192.168.0.115" # FIXME: use wireguard
  57   ];
  58   binaryCachePublicKeys = [
  59     "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los="
  60     "oignon.sourcephile.fr:slxL7XLsGXlD1r6gvw1imL5uQntW0TTlQgGQt3LBJgQ="
  61   ];
  62 };
  63 services.openssh.passwordAuthentication = false;
  64
  65 nixpkgs.config = {
  66   allowUnfree = true;
  67 };
  68 environment.etc."nixpkgs".source = pkgs.path;
  69 environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  70
  71 documentation.nixos.enable = true;
  72 time.timeZone = "Europe/Paris";
  73 i18n.defaultLocale = "fr_FR.UTF-8";
  74 console.font = "Lat2-Terminus16";
  75 console.keyMap = "fr";
  76
  77 networking = {
  78   hostName = hostName;
  79   domain = "localdomain";
  80   networkmanager = {
  81     enable = true;
  82     #dhcp = "dhcpcd";
  83     logLevel = "INFO";
  84     wifi = {
  85       #backend = "iwd";
  86       #backend = "wpa_supplicant";
  87       powersave = false;
  88     };
  89   };
  90   firewall = {
  91     enable = true;
  92     allowPing = false;
  93     allowedTCPPorts = [
  94       51413 # transmission-gtk
  95       4662 # edonkey
  96     ];
  97     allowedUDPPorts = [
  98       51413 # transmission-gtk
  99       4667 # edonkey
 100       4672 # edonkey
 101     ];
 102   };
 103 };
 104
 105 sound.enable = true;
 106 hardware.pulseaudio.enable = true;
 107 hardware.sane.enable = true;
 108 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
 109
 110 environment.variables = {
 111   EDITOR = "vim -g";
 112   PAGER  = "less -R";
 113   SYSTEMD_LESS = "FKMRX";
 114 };
 115
 116 programs = {
 117   bash = {
 118     interactiveShellInit = ''
 119       bind '"\e[A":history-search-backward'
 120       bind '"\e[B":history-search-forward'
 121
 122       # Ignore duplicate commands, ignore commands starting with a space
 123       export HISTCONTROL=erasedups:ignorespace
 124       export HISTSIZE=42000
 125       # Append to the history instead of overwriting (good for multiple connections)
 126       shopt -s histappend
 127
 128       # Utilities
 129       mkcd () { mkdir -p "$1"; cd "$1"; }
 130       fan () {
 131         if [ $# -gt 0 ]
 132         then sudo tee /proc/acpi/ibm/fan <<<"level $1"
 133         else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
 134         fi
 135         acpi -t
 136       }
 137     '';
 138     shellAliases = {
 139       cl = "clear";
 140       grep = "grep --color";
 141       l  = "ls -alh";
 142       ll = "ls -al";
 143       ls = "ls --color=tty";
 144       mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
 145
 146       s="sudo systemctl";
 147       st="sudo systemctl status";
 148       u="systemctl --user";
 149       j="sudo journalctl -u";
 150       jb="sudo journalctl -b";
 151
 152       nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 153       mv = "mv -i";
 154       sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
 155     };
 156   };
 157   dconf.enable = true;
 158   mtr.enable = true;
 159 };
 160
 161 services.avahi = {
 162   enable  = true;
 163   nssmdns = true;
 164   openFirewall = false;
 165   publish = {
 166     enable = false;
 167   };
 168 };
 169 services.davfs2 = {
 170   enable = true;
 171   extraConfig = ''
 172   '';
 173 };
 174 fileSystems."/home/sevy/mnt/ilico/severine" = {
 175   device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
 176   fsType = "davfs";
 177   options =
 178     let conf = pkgs.writeText "davfs2.conf" ''
 179       backup_dir /home/sevy/Documents/EnTransfert/ilico/severine
 180       cache_dir /home/sevy/.cache/davfs2/ilico/severine
 181     ''; in
 182     [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
 183 };
 184 services.dbus = {
 185   packages = [ pkgs.gnome3.dconf ];
 186 };
 187 services.gvfs = {
 188   enable = true;
 189 };
 190 services.journald = {
 191   extraConfig = ''
 192     Compress=true
 193     MaxRetentionSec=1month
 194     Storage=persistent
 195     SystemMaxUse=100M
 196   '';
 197 };
 198 services.physlock = {
 199   enable = true;
 200   allowAnyUser = true;
 201   # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
 202 };
 203 services.printing = {
 204   enable = true;
 205   drivers = [
 206     pkgs.gutenprint
 207     pkgs.hplip
 208   ];
 209 };
 210 services.udev = {
 211   packages = [
 212     # Allow members of the "adbusers" group to mount Android devices via MTP
 213     pkgs.android-udev-rules
 214   ];
 215 };
 216 services.xserver = {
 217   enable = true;
 218   layout = "fr";
 219   xkbOptions = "eurosign:e";
 220   libinput.enable = true;
 221   desktopManager = {
 222     xfce = {
 223       enable = true;
 224       thunarPlugins = [
 225         #pkgs.xfce.thunar-archive-plugin
 226       ];
 227     };
 228     xterm.enable = false;
 229   };
 230   displayManager = {
 231     defaultSession = "xfce";
 232     autoLogin = {
 233       enable = true;
 234       user = users.sevy.name;
 235     };
 236   };
 237 };
 238
 239 virtualisation.virtualbox.host.enable = true;
 240
 241 # This value determines the NixOS release with which your system is to be
 242 # compatible, in order to avoid breaking some software such as database
 243 # servers. You should change this only after NixOS release notes say you should.
 244 system.stateVersion = "20.03"; # Did you read the comment?
 245 }