hosts/blackberry.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   inputs,
   6   hostName,
   7   ...
   8 }:
   9 {
  10   imports = [
  11     #../nixos/profiles/debug.nix
  12     ../nixos/profiles/graphical.nix
  13     #../nixos/profiles/irssi.nix
  14     ../nixos/profiles/lang-fr.nix
  15     ../nixos/profiles/desktop.nix
  16     ../nixos/profiles/printing.nix
  17     #../nixos/profiles/radio.nix
  18     ../nixos/profiles/tor.nix
  19     ../nixos/profiles/bluetooth.nix
  20     ../nixos/profiles/home.nix
  21     #blackberry/backup.nix
  22     blackberry/hardware.nix
  23     blackberry/nebula.nix
  24     blackberry/networking.nix
  25     #blackberry/pixiecore.nix
  26     blackberry/nix-ssh.nix
  27   ];
  28
  29   # Lower kernel's security for better performances
  30   security.kernel.mitigations = "off";
  31
  32   home-manager.users.julm = {
  33     imports = [ ../homes/julm.nix ];
  34   };
  35   users.users.root = {
  36     openssh.authorizedKeys.keys = map lib.readFile [
  37       # For nix -L run .#pumpkin.switch
  38       ../users/julm/ssh/oignon.pub
  39       ../users/julm/ssh/pumpkin.pub
  40       ../users/julm/ssh/blackberry.pub
  41     ];
  42   };
  43   users.users.julm = {
  44     isNormalUser = true;
  45     uid = 1000;
  46     # Put the hashedPassword in /nix/store,
  47     # though /etc/shadow is not world readable...
  48     # printf %s $(mkpasswd -m md5crypt)
  49     hashedPassword = lib.readFile blackberry/users/julm/login/hashedPassword.clear;
  50     extraGroups = [
  51       "adbusers"
  52       "dialout"
  53       "lp"
  54       "networkmanager"
  55       "plugdev" # For rtl-sdr
  56       "scanner"
  57       "tor"
  58       "video"
  59       "wheel"
  60       "wireshark"
  61       #"ipfs"
  62       config.services.davfs2.davGroup
  63       #"vboxusers"
  64     ];
  65     # If created, zfs-mount.service would require:
  66     # zfs set overlay=yes ${hostName}/home
  67     createHome = false;
  68     openssh.authorizedKeys.keys = map lib.readFile [
  69       ../users/julm/ssh/oignon.pub
  70       ../users/julm/ssh/pumpkin.pub
  71       ../users/julm/ssh/losurdo.pub
  72     ];
  73   };
  74
  75   nix = {
  76     extraOptions = '''';
  77     settings = {
  78       substituters = [
  79       ];
  80       trusted-public-keys = map lib.readFile [
  81       ];
  82     };
  83     nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  84   };
  85
  86   environment.systemPackages = [
  87     #pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
  88   ];
  89
  90   boot.extraModulePackages = [
  91     #config.boot.kernelPackages.v4l2loopback
  92   ];
  93
  94   programs.fuse.userAllowOther = true;
  95
  96   systemd.automounts = [
  97     {
  98       where = "/mnt/aubergine";
  99       automountConfig.TimeoutIdleSec = "5 min";
 100     }
 101   ];
 102   fileSystems =
 103     let
 104       # Use the user's gpg-agent session to query
 105       # for the password of the SSH key when auto-mounting.
 106       sshAsUser = pkgs.writeScript "sshAsUser" ''
 107         user="$1"; shift
 108         exec ${pkgs.sudo}/bin/sudo -i -u "$user" \
 109           ${pkgs.openssh}/bin/ssh "$@"
 110       '';
 111       options = [
 112         "user"
 113         "uid=julm"
 114         "gid=users"
 115         "allow_other"
 116         "exec" # Override "user"'s noexec
 117         "noatime"
 118         "nosuid"
 119         "_netdev"
 120         "ssh_command=${sshAsUser}\\040julm"
 121         "noauto"
 122         "x-gvfs-hide"
 123         "x-systemd.automount"
 124         #"Compression=yes" # YMMV
 125         # Disconnect approximately 2*15=30 seconds after a network failure
 126         "ServerAliveCountMax=1"
 127         "ServerAliveInterval=15"
 128         "dir_cache=no"
 129         #"reconnect"
 130       ];
 131     in
 132     {
 133       "/mnt/aubergine" = {
 134         device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@aubergine.sp:/";
 135         fsType = "fuse";
 136         inherit options;
 137       };
 138     };
 139
 140   networking.firewall.extraCommands = ''
 141     ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 8000 -j ACCEPT
 142   '';
 143
 144   services.xserver = {
 145     xkb = {
 146       layout = "fr,us(altgr-intl)";
 147     };
 148     desktopManager = {
 149       session = [
 150         # Let the session be generated by home-manager
 151         {
 152           name = "home-manager";
 153           start = ''
 154             ${pkgs.runtimeShell} $HOME/.hm-xsession &
 155             waitPID=$!
 156           '';
 157         }
 158       ];
 159     };
 160   };
 161
 162   services.displayManager = {
 163     defaultSession = "home-manager";
 164     #defaultSession = "none+xmonad";
 165     #defaultSession = "mate";
 166     #defaultSession = "cinnamon";
 167     autoLogin = {
 168       user = config.users.users.julm.name;
 169     };
 170   };
 171
 172   # This value determines the NixOS release with which your system is to be
 173   # compatible, in order to avoid breaking some software such as database
 174   # servers. You should change this only after NixOS release notes say you should.
 175   system.stateVersion = "24.05"; # Did you read the comment?
 176 }