hosts/patate.nix

   1 { config, pkgs, lib, inputs, hostName, ... }:
   2 {
   3 imports = [
   4   ../nixos/profiles/dnscrypt-proxy2.nix
   5   ../nixos/profiles/security.nix
   6   ../nixos/profiles/wireguard/wg-intra.nix
   7   patate/backup.nix
   8   patate/hardware.nix
   9 ];
  10
  11 home-manager.users.sevy = {
  12   imports = [ ../homes/sevy.nix ];
  13   host.hardware = ["ThinkPad" "X200"];
  14 };
  15 systemd.services.home-manager-sevy.postStart = ''
  16   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  17 '';
  18 security.lockKernelModules = false;
  19 users.mutableUsers = false;
  20 users.users.sevy = {
  21   isNormalUser = true;
  22   uid = 1000;
  23   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  24   # which is already world readable.
  25   hashedPassword = lib.readFile ../private/world/sevy/hashedPassword;
  26   extraGroups = [
  27     "adbusers"
  28     config.services.davfs2.davGroup
  29     "lp"
  30     "networkmanager"
  31     "scanner"
  32     "systemd-journal"
  33     "tor"
  34     "vboxusers"
  35     "video"
  36     "wheel"
  37   ];
  38 };
  39
  40 nix = {
  41   extraOptions = ''
  42   '';
  43   autoOptimiseStore = true;
  44   gc.automatic = true;
  45   gc.dates = "weekly";
  46   gc.options = "--delete-older-than 7d";
  47   nixPath = lib.mkForce [ ];
  48   trustedUsers = [ users.sevy.name ];
  49   binaryCaches = [
  50     "http://nix-localcache.losurdo.wg"
  51     "ssh://nix-ssh@oignon.wg"
  52   ];
  53   binaryCachePublicKeys = [
  54     "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los="
  55     "oignon.sourcephile.fr:slxL7XLsGXlD1r6gvw1imL5uQntW0TTlQgGQt3LBJgQ="
  56   ];
  57 };
  58 services.openssh.passwordAuthentication = false;
  59
  60 environment.systemPackages = [
  61   pkgs.riseup-vpn
  62 ];
  63
  64 documentation.nixos.enable = true;
  65 time.timeZone = "Europe/Paris";
  66 i18n.defaultLocale = "fr_FR.UTF-8";
  67 console.font = "Lat2-Terminus16";
  68 console.keyMap = "fr";
  69
  70 networking = {
  71   hostName = hostName;
  72   domain = "localdomain";
  73   networkmanager = {
  74     enable = true;
  75     #dhcp = "dhcpcd";
  76     logLevel = "INFO";
  77     wifi = {
  78       #backend = "iwd";
  79       #backend = "wpa_supplicant";
  80       powersave = false;
  81     };
  82   };
  83   firewall = {
  84     enable = true;
  85     allowPing = false;
  86     allowedTCPPorts = [
  87       51413 # transmission-gtk
  88       4662 # edonkey
  89     ];
  90     allowedUDPPorts = [
  91       51413 # transmission-gtk
  92       4667 # edonkey
  93       4672 # edonkey
  94     ];
  95   };
  96 };
  97
  98 sound.enable = true;
  99 hardware.pulseaudio.enable = true;
 100 hardware.sane.enable = true;
 101 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
 102
 103 environment.variables = {
 104   EDITOR = "vim -g";
 105   PAGER  = "less -R";
 106   SYSTEMD_LESS = "FKMRX";
 107 };
 108
 109 programs = {
 110   bash = {
 111     interactiveShellInit = ''
 112       bind '"\e[A":history-search-backward'
 113       bind '"\e[B":history-search-forward'
 114
 115       # Ignore duplicate commands, ignore commands starting with a space
 116       export HISTCONTROL=erasedups:ignorespace
 117       export HISTSIZE=42000
 118       # Append to the history instead of overwriting (good for multiple connections)
 119       shopt -s histappend
 120
 121       # Utilities
 122       mkcd () { mkdir -p "$1"; cd "$1"; }
 123       fan () {
 124         if [ $# -gt 0 ]
 125         then sudo tee /proc/acpi/ibm/fan <<<"level $1"
 126         else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
 127         fi
 128         acpi -t
 129       }
 130     '';
 131     shellAliases = {
 132       cl = "clear";
 133       grep = "grep --color";
 134       l  = "ls -alh";
 135       ll = "ls -al";
 136       ls = "ls --color=tty";
 137       mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
 138
 139       s="sudo systemctl";
 140       st="sudo systemctl status";
 141       u="systemctl --user";
 142       j="sudo journalctl -u";
 143       jb="sudo journalctl -b";
 144
 145       nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 146       mv = "mv -i";
 147       sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
 148     };
 149   };
 150   dconf.enable = true;
 151   mtr.enable = true;
 152 };
 153
 154 services.avahi = {
 155   enable  = true;
 156   nssmdns = true;
 157   openFirewall = false;
 158   publish = {
 159     enable = false;
 160   };
 161 };
 162 services.davfs2 = {
 163   enable = true;
 164   extraConfig = ''
 165   '';
 166 };
 167 fileSystems."/home/sevy/mnt/ilico/severine" = {
 168   device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
 169   fsType = "davfs";
 170   options =
 171     let conf = pkgs.writeText "davfs2.conf" ''
 172       backup_dir /home/sevy/Documents/EnTransfert/ilico/severine
 173       cache_dir /home/sevy/.cache/davfs2/ilico/severine
 174     ''; in
 175     [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
 176 };
 177 services.dbus = {
 178   packages = [ pkgs.gnome3.dconf ];
 179 };
 180 services.gvfs = {
 181   enable = true;
 182 };
 183 services.journald = {
 184   extraConfig = ''
 185     Compress=true
 186     MaxRetentionSec=1month
 187     Storage=persistent
 188     SystemMaxUse=100M
 189   '';
 190 };
 191 services.physlock = {
 192   enable = true;
 193   allowAnyUser = true;
 194   # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
 195 };
 196 services.printing = {
 197   enable = true;
 198   drivers = [
 199     pkgs.gutenprint
 200     pkgs.hplip
 201   ];
 202 };
 203 services.udev = {
 204   packages = [
 205     # Allow members of the "adbusers" group to mount Android devices via MTP
 206     pkgs.android-udev-rules
 207   ];
 208 };
 209 services.xserver = {
 210   enable = true;
 211   layout = "fr";
 212   xkbOptions = "eurosign:e";
 213   libinput.enable = true;
 214   desktopManager = {
 215     xfce = {
 216       enable = true;
 217       thunarPlugins = [
 218         #pkgs.xfce.thunar-archive-plugin
 219       ];
 220     };
 221     xterm.enable = false;
 222   };
 223   displayManager = {
 224     defaultSession = "xfce";
 225     autoLogin = {
 226       enable = true;
 227       user = config.users.users.sevy.name;
 228     };
 229   };
 230 };
 231
 232 virtualisation.virtualbox.host.enable = true;
 233
 234 # This value determines the NixOS release with which your system is to be
 235 # compatible, in order to avoid breaking some software such as database
 236 # servers. You should change this only after NixOS release notes say you should.
 237 system.stateVersion = "20.03"; # Did you read the comment?
 238 }