hosts/aubergine.nix

   1 { config, pkgs, lib, inputs, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/server.nix
   5     #../nixos/profiles/debug.nix
   6     ../nixos/profiles/lang-fr.nix
   7     #../nixos/profiles/tor.nix
   8     aubergine/hardware.nix
   9     aubergine/networking.nix
  10     aubergine/nginx.nix
  11     aubergine/backup.nix
  12     aubergine/sftp.nix
  13   ];
  14
  15   # Lower kernel's security for better performances
  16   boot.kernelParams = [ "mitigations=off" ];
  17
  18   home-manager.users.julm = {
  19     imports = [ ../homes/julm.nix ];
  20   };
  21   users = {
  22     users.julm = {
  23       isNormalUser = true;
  24       uid = 1000;
  25       # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  26       # which is already world readable.
  27       # printf %s $(mkpasswd -m yescrypt)
  28       hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
  29       extraGroups = [
  30         "adbusers"
  31         "dialout"
  32         "networkmanager"
  33         "tor"
  34         "wheel"
  35       ];
  36       createHome = true;
  37       openssh.authorizedKeys.keys = map lib.readFile [
  38         ../users/root/ssh/losurdo.pub
  39         ../users/julm/ssh/losurdo.pub
  40         ../users/julm/ssh/oignon.pub
  41         ../users/julm/ssh/redmi.pub
  42       ];
  43     };
  44     users.root = {
  45       hashedPassword = "!";
  46       openssh.authorizedKeys.keys =
  47         config.users.users.julm.openssh.authorizedKeys.keys;
  48     };
  49     users.sevy = {
  50       isNormalUser = true;
  51       uid = 1001;
  52       hashedPassword = "!";
  53       extraGroups = [
  54       ];
  55       createHome = true;
  56       openssh.authorizedKeys.keys = map lib.readFile [
  57         ../users/sevy/ssh/patate.pub
  58       ];
  59     };
  60   };
  61
  62   #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
  63   #  "secret-key-files:" + aubergine/nix/secret-key-files;
  64   nix = {
  65     extraOptions = ''
  66       #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
  67     '';
  68     settings = {
  69       substituters = [
  70         #"http://nix-localcache.losurdo.wg"
  71         #"ssh://nix-ssh@losurdo.wg?priority=30"
  72         #"ssh://nix-ssh@oignon.wg?priority=30"
  73       ];
  74       trusted-public-keys = map lib.readFile [
  75         ../users/root/nix/oignon.pub
  76       ];
  77     };
  78     nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  79   };
  80   #environment.etc."nixpkgs".source = pkgs.path;
  81   #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  82
  83   nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  84   nix.sshServe = {
  85     enable = true;
  86     keys = map lib.readFile [
  87       ../users/julm/ssh/losurdo.pub
  88       ../users/sevy/ssh/patate.pub
  89       ../users/julm/ssh/oignon.pub
  90     ];
  91   };
  92
  93   environment.systemPackages = [
  94   ];
  95
  96   boot.extraModulePackages = [
  97     #config.boot.kernelPackages.v4l2loopback
  98   ];
  99
 100   # This value determines the NixOS release with which your system is to be
 101   # compatible, in order to avoid breaking some software such as database
 102   # servers. You should change this only after NixOS release notes say you should.
 103   system.stateVersion = "22.11"; # Did you read the comment?
 104 }