1 { config, pkgs, lib, private, hostName, ... }:
4 ../nixos/profiles/dnscrypt-proxy2.nix
5 ../nixos/profiles/security.nix
6 ../nixos/profiles/wireguard/wg-intra.nix
13 home-manager.users.julm = {
14 imports = [ ../homes/julm.nix ];
15 host.hardware = [ "ThinkPad" "X201" ];
17 systemd.services.home-manager-julm.postStart = ''
18 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
20 security.lockKernelModules = false;
21 users.mutableUsers = false;
25 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
26 # which is already world readable.
27 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
37 config.services.davfs2.davGroup
40 # If created, zfs-mount.service would require:
41 # zfs set overlay=yes ${hostName}/home
47 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
49 autoOptimiseStore = true;
52 gc.options = "--delete-older-than 7d";
53 nixPath = lib.mkForce [];
54 trustedUsers = [ config.users.users.julm.name ];
56 "http://nix-localcache.losurdo.wg"
58 binaryCachePublicKeys = map lib.readFile [
59 ../private/shared/nix/losurdo.pub
62 #environment.etc."nixpkgs".source = pkgs.path;
63 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
74 nix.allowedUsers = [ config.users.users."nix-ssh".name ];
77 keys = map lib.readFile [
78 ../private/shared/ssh/julm/losurdo.pub
79 ../private/shared/ssh/sevy/patate.pub
80 ../private/shared/ssh/julm/oignon.pub
83 users.users.julm.openssh.authorizedKeys.keys = map lib.readFile [
84 ../private/shared/ssh/julm/losurdo.pub
87 time.timeZone = "Europe/Paris";
88 i18n.defaultLocale = "fr_FR.UTF-8";
89 console.font = "Lat2-Terminus16";
90 console.keyMap = "fr";
94 domain = "localdomain";
95 search = [ "sourcephile.fr" ];
102 #backend = "wpa_supplicant";
113 hardware.pulseaudio.enable = true;
114 hardware.sane.enable = true;
115 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
117 environment.variables = {
120 SYSTEMD_LESS = "FKMRX";
123 programs.bash.interactiveShellInit = ''
126 then sudo tee /proc/acpi/ibm/fan <<<"level $1"
127 else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
132 programs.dconf.enable = true;
133 programs.mtr.enable = true;
138 openFirewall = false;
143 services.davfs2.enable = true;
144 fileSystems."/home/julm/mnt/ilico/severine" = {
145 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
148 let conf = pkgs.writeText "davfs2.conf" ''
149 backup_dir /home/julm/documents/backup/ilico/severine
150 cache_dir /home/julm/.cache/davfs2/ilico/severine
152 [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
154 environment.systemPackages = [pkgs.glib.bin];
155 programs.fuse.userAllowOther = true;
156 fileSystems."/mnt/losurdo" = {
157 device = "${pkgs.sshfsFuse}/bin/sshfs#julm@losurdo.wg:/";
160 # Use the user's gpg-agent session to query
161 # for the password of the SSH key when auto-mounting.
162 let sshAsUser = user:
163 pkgs.writeScript "sshAsUser-${user}" ''
164 exec ${pkgs.sudo}/bin/sudo -i -u ${user} \
165 ${pkgs.openssh}/bin/ssh "$@"
168 "noatime" "noexec" "nosuid"
169 "user" "uid=julm" "gid=users" "allow_other"
170 "_netdev" "ssh_command=${sshAsUser "julm"}" # "reconnect"
171 "noauto" "x-gvfs-hide" "x-systemd.automount"
172 #"Compression=yes" # YMMV
173 # Disconnect approximately 2*15=30 seconds after a network failure
174 "ServerAliveCountMax=1"
175 "ServerAliveInterval=15"
179 packages = [ pkgs.gnome3.dconf ];
181 services.gvfs.enable = true;
184 defaultMode = "online";
187 localDiscovery = false;
189 Datastore.StorageMax = "10GB";
190 Discovery.MDNS.Enabled = false;
193 #Swarm.AddrFilters = null;
195 startWhenNeeded = true;
201 services.printing = {
210 # Allow members of the "adbusers" group to mount Android devices via MTP.
211 pkgs.android-udev-rules
212 # Allow the console user access the Yubikey USB device node,
213 # needed for challenge/response to work correctly.
214 pkgs.yubikey-personalization
220 xkbOptions = "eurosign:e";
221 libinput.enable = true;
224 # Let the session be generated by home-manager
225 { name = "home-manager";
227 ${pkgs.runtimeShell} $HOME/.hm-xsession &
234 defaultSession = "home-manager";
235 #defaultSession = "none+xmonad";
238 user = config.users.users.julm.name;
243 systemd.coredump.enable = true;
244 #environment.enableDebugInfo = true;
246 # This value determines the NixOS release with which your system is to be
247 # compatible, in order to avoid breaking some software such as database
248 # servers. You should change this only after NixOS release notes say you should.
249 system.stateVersion = "20.09"; # Did you read the comment?