1 { config, pkgs, lib, inputs, private, hostName, ... }:
4 ../nixos/profiles/builder.nix
5 ../nixos/profiles/debug.nix
6 ../nixos/profiles/dnscrypt-proxy2.nix
7 ../nixos/profiles/graphical.nix
8 ../nixos/profiles/lang-fr.nix
9 ../nixos/profiles/networking.nix
10 ../nixos/profiles/printing.nix
11 ../nixos/profiles/security.nix
12 ../nixos/profiles/system.nix
13 ../nixos/profiles/tor.nix
14 ../nixos/profiles/irssi.nix
15 ../nixos/profiles/wireguard/wg-intra.nix
21 home-manager.users.julm = {
22 imports = [ ../homes/julm.nix ];
23 host.hardware = [ "ThinkPad" "X201" ];
25 systemd.services.home-manager-julm.postStart = ''
26 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
31 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
32 # which is already world readable.
33 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
43 config.services.davfs2.davGroup
46 # If created, zfs-mount.service would require:
47 # zfs set overlay=yes ${hostName}/home
49 openssh.authorizedKeys.keys = map lib.readFile [
50 ../private/shared/ssh/julm/losurdo.pub
56 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
59 trusted-users = [ config.users.users."julm".name ];
61 #"http://nix-localcache.losurdo.wg"
62 "ssh://nix-ssh@losurdo.wg?priority=30"
64 trusted-public-keys = map lib.readFile [
65 ../private/shared/nix/losurdo.pub
68 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
70 #environment.etc."nixpkgs".source = pkgs.path;
71 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
73 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
76 keys = map lib.readFile [
77 ../private/shared/ssh/julm/losurdo.pub
78 ../private/shared/ssh/sevy/patate.pub
79 ../private/shared/ssh/julm/oignon.pub
83 environment.systemPackages = [
84 pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
87 boot.extraModulePackages = [
88 #config.boot.kernelPackages.v4l2loopback
91 programs.fuse.userAllowOther = true;
93 services.davfs2.enable = true;
96 # Use the user's gpg-agent session to query
97 # for the password of the SSH key when auto-mounting.
100 pkgs.writeScript "sshAsUser-${user}" ''
101 exec ${pkgs.sudo}/bin/sudo -i -u ${user} \
102 ${pkgs.openssh}/bin/ssh "$@"
106 "noatime" "noexec" "nosuid"
107 "user" "uid=julm" "gid=users" "allow_other"
108 "_netdev" "ssh_command=${sshAsUser "julm"}" # "reconnect"
109 "noauto" "x-gvfs-hide" "x-systemd.automount"
110 #"Compression=yes" # YMMV
111 # Disconnect approximately 2*15=30 seconds after a network failure
112 "ServerAliveCountMax=1"
113 "ServerAliveInterval=15"
117 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@losurdo.wg:/";
122 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@mermet.wg:/";
126 "/mnt/ilico/severine" = {
127 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
130 let conf = pkgs.writeText "davfs2.conf" ''
131 backup_dir /home/julm/.local/share/davfs2/ilico/severine
132 secrets /home/julm/.davfs2/secrets
134 [ "conf=${conf}" "user" "noexec" "nosuid"
135 "noauto" "nofail" "_netdev" "reconnect"
136 "x-systemd.automount"
137 "x-systemd.device-timeout=1m"
138 "x-systemd.idle-timeout=1m"
139 "x-systemd.mount-timeout=10s"
144 networking.firewall.extraCommands = ''
145 ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 8000 -j ACCEPT
150 defaultMode = "online";
153 localDiscovery = false;
155 Datastore.StorageMax = "10GB";
156 Discovery.MDNS.Enabled = false;
159 #Swarm.AddrFilters = null;
161 startWhenNeeded = true;
164 services.udev.packages = [
165 # Allow the console user access the Yubikey USB device node,
166 # needed for challenge/response to work correctly.
167 pkgs.yubikey-personalization
173 # Let the session be generated by home-manager
174 { name = "home-manager";
176 ${pkgs.runtimeShell} $HOME/.hm-xsession &
183 defaultSession = "home-manager";
184 #defaultSession = "none+xmonad";
185 #defaultSession = "mate";
186 #defaultSession = "cinnamon";
188 user = config.users.users.julm.name;
193 # This value determines the NixOS release with which your system is to be
194 # compatible, in order to avoid breaking some software such as database
195 # servers. You should change this only after NixOS release notes say you should.
196 system.stateVersion = "20.09"; # Did you read the comment?