]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
firefox: fix tor-browser install
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, private, hostName, ... }:
2 {
3 imports = [
4 ../nixos/profiles/dnscrypt-proxy2.nix
5 ../nixos/profiles/graphical.nix
6 ../nixos/profiles/lang-fr.nix
7 ../nixos/profiles/networking.nix
8 ../nixos/profiles/printing.nix
9 ../nixos/profiles/security.nix
10 ../nixos/profiles/system.nix
11 ../nixos/profiles/wireguard/wg-intra.nix
12 oignon/hardware.nix
13 oignon/wireguard.nix
14 oignon/backup.nix
15 ];
16
17 home-manager.users.julm = {
18 imports = [ ../homes/julm.nix ];
19 host.hardware = [ "ThinkPad" "X201" ];
20 };
21 systemd.services.home-manager-julm.postStart = ''
22 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
23 '';
24 users.users.julm = {
25 isNormalUser = true;
26 uid = 1000;
27 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
28 # which is already world readable.
29 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
30 extraGroups = [
31 "adbusers"
32 "lp"
33 "networkmanager"
34 "scanner"
35 "tor"
36 "video"
37 "wheel"
38 #"ipfs"
39 config.services.davfs2.davGroup
40 #"vboxusers"
41 ];
42 # If created, zfs-mount.service would require:
43 # zfs set overlay=yes ${hostName}/home
44 createHome = false;
45 openssh.authorizedKeys.keys = map lib.readFile [
46 ../private/shared/ssh/julm/losurdo.pub
47 ];
48 };
49
50 nix = {
51 extraOptions = ''
52 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
53 '';
54 trustedUsers = [ config.users.users."julm".name ];
55 binaryCaches = [
56 "http://nix-localcache.losurdo.wg"
57 ];
58 binaryCachePublicKeys = map lib.readFile [
59 ../private/shared/nix/losurdo.pub
60 ];
61 };
62 #environment.etc."nixpkgs".source = pkgs.path;
63 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
64
65 nix.allowedUsers = [ config.users.users."nix-ssh".name ];
66 nix.sshServe = {
67 enable = true;
68 keys = map lib.readFile [
69 ../private/shared/ssh/julm/losurdo.pub
70 ../private/shared/ssh/sevy/patate.pub
71 ../private/shared/ssh/julm/oignon.pub
72 ];
73 };
74
75 environment.systemPackages = [
76 pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
77 ];
78
79 programs.fuse.userAllowOther = true;
80 fileSystems."/mnt/losurdo" = {
81 device = "${pkgs.sshfsFuse}/bin/sshfs#julm@losurdo.wg:/";
82 fsType = "fuse";
83 options =
84 # Use the user's gpg-agent session to query
85 # for the password of the SSH key when auto-mounting.
86 let sshAsUser = user:
87 pkgs.writeScript "sshAsUser-${user}" ''
88 exec ${pkgs.sudo}/bin/sudo -i -u ${user} \
89 ${pkgs.openssh}/bin/ssh "$@"
90 '';
91 in [
92 "noatime" "noexec" "nosuid"
93 "user" "uid=julm" "gid=users" "allow_other"
94 "_netdev" "ssh_command=${sshAsUser "julm"}" # "reconnect"
95 "noauto" "x-gvfs-hide" "x-systemd.automount"
96 #"Compression=yes" # YMMV
97 # Disconnect approximately 2*15=30 seconds after a network failure
98 "ServerAliveCountMax=1"
99 "ServerAliveInterval=15"
100 ];
101 };
102
103 services.ipfs = {
104 #enable = true;
105 defaultMode = "online";
106 autoMount = true;
107 enableGC = true;
108 localDiscovery = false;
109 extraConfig = {
110 Datastore.StorageMax = "10GB";
111 Discovery.MDNS.Enabled = false;
112 #Bootstrap = [
113 #];
114 #Swarm.AddrFilters = null;
115 };
116 startWhenNeeded = true;
117 };
118
119 services.udev = {
120 packages = [
121 # Allow the console user access the Yubikey USB device node,
122 # needed for challenge/response to work correctly.
123 pkgs.yubikey-personalization
124 ];
125 };
126
127 services.xserver = {
128 desktopManager = {
129 session = [
130 # Let the session be generated by home-manager
131 { name = "home-manager";
132 start = ''
133 ${pkgs.runtimeShell} $HOME/.hm-xsession &
134 waitPID=$!
135 '';
136 }
137 ];
138 };
139 displayManager = {
140 defaultSession = "home-manager";
141 #defaultSession = "none+xmonad";
142 #defaultSession = "mate";
143 #defaultSession = "cinnamon";
144 autoLogin = {
145 user = config.users.users.julm.name;
146 };
147 };
148 };
149
150 systemd.coredump.enable = true;
151 #environment.enableDebugInfo = true;
152
153 # This value determines the NixOS release with which your system is to be
154 # compatible, in order to avoid breaking some software such as database
155 # servers. You should change this only after NixOS release notes say you should.
156 system.stateVersion = "20.09"; # Did you read the comment?
157 }