hosts/patate.nix

   1 { config, pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/dnscrypt-proxy2.nix
   5     ../nixos/profiles/graphical.nix
   6     ../nixos/profiles/lang-fr.nix
   7     ../nixos/profiles/printing.nix
   8     ../nixos/profiles/wireguard/wg-intra.nix
   9     patate/backup.nix
  10     patate/hardware.nix
  11     patate/wireguard.nix
  12   ];
  13
  14   # Lower kernel's security for better performances
  15   boot.kernelParams = [ "mitigations=off" ];
  16
  17   home-manager.users.sevy = {
  18     imports = [ ../homes/sevy.nix ];
  19   };
  20   systemd.services.home-manager-sevy.postStart = ''
  21     ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  22   '';
  23   users.users.sevy = {
  24     isNormalUser = true;
  25     uid = 1000;
  26     # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  27     # which is already world readable.
  28     hashedPassword = lib.readFile patate/users/sevy/login/hashedPassword.clear;
  29     extraGroups = [
  30       "adbusers"
  31       config.services.davfs2.davGroup
  32       "lp"
  33       "networkmanager"
  34       "scanner"
  35       "systemd-journal"
  36       "tor"
  37       "vboxusers"
  38       "video"
  39       "wheel"
  40     ];
  41   };
  42
  43   nix = {
  44     settings = {
  45       substituters = [
  46         #"ssh://nix-ssh@losurdo.wg?priority=30"
  47         #"ssh://nix-ssh@oignon.wg?priority=10"
  48       ];
  49       trusted-public-keys = map lib.readFile [
  50         ../users/root/nix/losurdo.pub
  51         ../users/root/nix/oignon.pub
  52       ];
  53     };
  54   };
  55   install.substituteOnDestination = false;
  56
  57   environment.systemPackages = [
  58     pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
  59   ];
  60
  61   services.physlock = {
  62     enable = true;
  63     allowAnyUser = true;
  64     # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
  65   };
  66
  67   services.xserver = {
  68     desktopManager = {
  69       mate.enable = true;
  70       xfce.enable = true;
  71       xterm.enable = false;
  72     };
  73     displayManager = {
  74       defaultSession = "mate";
  75       autoLogin = {
  76         user = config.users.users.sevy.name;
  77       };
  78     };
  79   };
  80
  81   virtualisation.virtualbox.host.enable = true;
  82
  83   services.openssh.openFirewall = true;
  84
  85   # This value determines the NixOS release with which your system is to be
  86   # compatible, in order to avoid breaking some software such as database
  87   # servers. You should change this only after NixOS release notes say you should.
  88   system.stateVersion = "20.03"; # Did you read the comment?
  89 }