nixos/profiles/system.nix

   1 { config, pkgs, lib, inputs, ... }:
   2 with lib;
   3 {
   4   boot.tmp.cleanOnBoot = mkDefault true;
   5   boot.tmp.useTmpfs = mkDefault true;
   6   services.logrotate.enable = true;
   7   # NOTE: mostly useless on a server, and CPU intensive.
   8   documentation = {
   9     enable = mkDefault true;
  10     dev.enable = mkDefault false;
  11     doc.enable = mkDefault true;
  12     info.enable = mkDefault false;
  13     man.enable = mkDefault true;
  14     nixos.enable = mkDefault false;
  15   };
  16   programs.vim.defaultEditor = mkDefault true;
  17   environment.variables = {
  18     EDITOR = "vim";
  19     NIXPKGS_CONFIG = mkForce "";
  20     PAGER = "less -R";
  21     SYSTEMD_LESS = "FKMRX";
  22     # Setting TZ= avoids a lot of useless syscalls reading /etc/localtime
  23     # but requires to restart the session to change the time zone for all programs.
  24     TZ = lib.mkDefault (if config.time.timeZone != null then config.time.timeZone else "Europe/Paris");
  25   };
  26   home-manager.users.root = {
  27     imports = [
  28       ../../home-manager/options.nix
  29       ../../home-manager/profiles/essential.nix
  30     ];
  31     services.gpg-agent.pinentryFlavor = "curses";
  32   };
  33   nix = {
  34     settings.auto-optimise-store = mkDefault true;
  35     gc.automatic = mkDefault true;
  36     gc.dates = mkDefault "weekly";
  37     gc.options = mkDefault "--delete-older-than 7d";
  38     nixPath = mkForce [ ];
  39     registry.nixpkgs = mkDefault { flake = inputs.nixpkgs; };
  40     package = pkgs.nixFlakes;
  41     settings.experimental-features = [ "nix-command" "flakes" "repl-flake" ];
  42   };
  43   security.lockKernelModules = false;
  44   services.journald = {
  45     extraConfig = ''
  46       Compress=true
  47       MaxRetentionSec=1month
  48       Storage=persistent
  49       SystemMaxUse=100M
  50     '';
  51   };
  52   systemd.oomd = {
  53     enable = mkDefault true;
  54     enableRootSlice = mkDefault true;
  55     enableSystemSlice = mkDefault true;
  56     enableUserServices = mkDefault true;
  57   };
  58   systemd.services.openssh = {
  59     serviceConfig = {
  60       ManagedOOMPreference = "omit";
  61     };
  62   };
  63   /*
  64     system.nixos.versionSuffix = ".${
  65     substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
  66     inputs.self.shortRev or "dirty"}";
  67     system.nixos.revision = mkIf (inputs.self ? rev) inputs.self.rev;
  68   */
  69   # Let 'nixos-version --json' know about the Git revision of this flake.
  70   system.configurationRevision = mkIf (inputs.self ? rev) inputs.self.rev;
  71   /*
  72     system.configurationRevision =
  73     if inputs.self ? rev
  74     then inputs.self.rev
  75     else throw "Refusing to build from a dirty Git tree!";
  76   */
  77   users.mutableUsers = false;
  78 }