nixos/profiles/system.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   inputs,
   6   ...
   7 }:
   8 with lib;
   9 {
  10   boot.tmp.cleanOnBoot = mkDefault true;
  11   boot.tmp.useTmpfs = mkDefault true;
  12   boot.tmp.tmpfsHugeMemoryPages = mkDefault "within_size";
  13   fileSystems = mkIf config.boot.tmp.useTmpfs {
  14     # NIX_STATE_DIR, where nix (>= 2.30) builds.
  15     "/nix/var/nix/builds" = {
  16       fsType = "tmpfs";
  17       options = [
  18         #"mode=755"
  19         "nosuid"
  20         "nodev"
  21         "rw"
  22         "size=${toString config.boot.tmp.tmpfsSize}"
  23         "huge=${config.boot.tmp.tmpfsHugeMemoryPages}"
  24       ];
  25     };
  26   };
  27
  28   services.logrotate.enable = true;
  29   # NOTE: mostly useless on a server, and CPU intensive.
  30   documentation = {
  31     enable = mkDefault true;
  32     dev.enable = mkDefault false;
  33     doc.enable = mkDefault true;
  34     info.enable = mkDefault false;
  35     man.enable = mkDefault true;
  36     nixos.enable = mkDefault false;
  37   };
  38   programs.vim.defaultEditor = mkDefault true;
  39   programs.vim.enable = mkDefault true;
  40   environment.variables = {
  41     EDITOR = "vim";
  42     NIXPKGS_CONFIG = mkForce "";
  43     PAGER = "less -R";
  44     SYSTEMD_LESS = "FKMRX";
  45     # Setting TZ= avoids a lot of useless syscalls reading /etc/localtime
  46     # but requires to restart the session to change the time zone for all programs.
  47     TZ = lib.mkDefault (if config.time.timeZone != null then config.time.timeZone else "Europe/Paris");
  48   };
  49   home-manager.users.root = {
  50     imports = [
  51       ../../home-manager/options.nix
  52       ../../home-manager/profiles/essential.nix
  53     ];
  54     services.gpg-agent.pinentry.package = pkgs.pinentry-curses;
  55   };
  56   nix = {
  57     settings.auto-optimise-store = mkDefault true;
  58     gc.automatic = mkDefault true;
  59     gc.dates = mkDefault "weekly";
  60     gc.options = mkDefault "--delete-older-than 7d";
  61     package = pkgs.nixVersions.stable;
  62     settings.experimental-features = [
  63       "nix-command"
  64       "flakes"
  65     ];
  66   };
  67   nixpkgs.flake = {
  68     # ExplanationNote: avoid the NixOS closure
  69     # to depend on the nixpkgs sources,
  70     # which adds useless closure size
  71     # for systems where nix commands are not run.
  72     setNixPath = lib.mkDefault false;
  73     setFlakeRegistry = lib.mkDefault false;
  74   };
  75   security.lockKernelModules = false;
  76   services.journald = {
  77     extraConfig = ''
  78       Compress=true
  79       MaxRetentionSec=1month
  80       Storage=persistent
  81       SystemMaxUse=100M
  82     '';
  83   };
  84   # none is the recommended elevator for SSD, whereas HDD could use mq-deadline.
  85   services.udev.extraRules = ''
  86     ACTION=="add|change", KERNEL=="sd[a-z][0-9]*", ATTR{../queue/rotational}=="0", ATTR{../queue/scheduler}="none"
  87     ACTION=="add|change", KERNEL=="nvme[0-9]*n[0-9]*p[0-9]*", ATTR{../queue/rotational}=="0", ATTR{../queue/scheduler}="none"
  88   '';
  89   systemd.oomd = {
  90     enable = mkDefault true;
  91     enableRootSlice = mkDefault true;
  92     enableSystemSlice = mkDefault true;
  93     enableUserSlices = mkDefault true;
  94   };
  95   systemd.services.sshd = {
  96     serviceConfig = {
  97       ManagedOOMPreference = "omit";
  98     };
  99   };
 100   /*
 101     system.nixos.versionSuffix = ".${
 102     substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
 103     inputs.self.shortRev or "dirty"}";
 104     system.nixos.revision = mkIf (inputs.self ? rev) inputs.self.rev;
 105   */
 106   # Let 'nixos-version --json' know about the Git revision of this flake.
 107   system.configurationRevision = mkIf (inputs.self ? rev) inputs.self.rev;
 108   /*
 109     system.configurationRevision =
 110     if inputs.self ? rev
 111     then inputs.self.rev
 112     else throw "Refusing to build from a dirty Git tree!";
 113   */
 114   users.mutableUsers = false;
 115 }