]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
nix: update nixpkgs
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, private, hostName, ... }:
2 {
3 imports = [
4 ../nixos/profiles/dnscrypt-proxy2.nix
5 ../nixos/profiles/graphical.nix
6 ../nixos/profiles/lang-fr.nix
7 ../nixos/profiles/networking.nix
8 ../nixos/profiles/printing.nix
9 ../nixos/profiles/security.nix
10 ../nixos/profiles/system.nix
11 ../nixos/profiles/tor.nix
12 ../nixos/profiles/wireguard/wg-intra.nix
13 oignon/backup.nix
14 oignon/hardware.nix
15 oignon/wireguard.nix
16 ];
17
18 home-manager.users.julm = {
19 imports = [ ../homes/julm.nix ];
20 host.hardware = [ "ThinkPad" "X201" ];
21 };
22 systemd.services.home-manager-julm.postStart = ''
23 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
24 '';
25 users.users.julm = {
26 isNormalUser = true;
27 uid = 1000;
28 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
29 # which is already world readable.
30 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
31 extraGroups = [
32 "adbusers"
33 "lp"
34 "networkmanager"
35 "scanner"
36 "tor"
37 "video"
38 "wheel"
39 #"ipfs"
40 config.services.davfs2.davGroup
41 #"vboxusers"
42 ];
43 # If created, zfs-mount.service would require:
44 # zfs set overlay=yes ${hostName}/home
45 createHome = false;
46 openssh.authorizedKeys.keys = map lib.readFile [
47 ../private/shared/ssh/julm/losurdo.pub
48 ];
49 };
50
51 nix = {
52 extraOptions = ''
53 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
54 '';
55 trustedUsers = [ config.users.users."julm".name ];
56 binaryCaches = [
57 "http://nix-localcache.losurdo.wg"
58 ];
59 binaryCachePublicKeys = map lib.readFile [
60 ../private/shared/nix/losurdo.pub
61 ];
62 };
63 #environment.etc."nixpkgs".source = pkgs.path;
64 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
65
66 nix.allowedUsers = [ config.users.users."nix-ssh".name ];
67 nix.sshServe = {
68 enable = true;
69 keys = map lib.readFile [
70 ../private/shared/ssh/julm/losurdo.pub
71 ../private/shared/ssh/sevy/patate.pub
72 ../private/shared/ssh/julm/oignon.pub
73 ];
74 };
75
76 environment.systemPackages = [
77 pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
78 ];
79
80 boot.extraModulePackages = [
81 #config.boot.kernelPackages.v4l2loopback
82 ];
83
84 programs.fuse.userAllowOther = true;
85 fileSystems."/mnt/losurdo" = {
86 device = "${pkgs.sshfsFuse}/bin/sshfs#julm@losurdo.wg:/";
87 fsType = "fuse";
88 options =
89 # Use the user's gpg-agent session to query
90 # for the password of the SSH key when auto-mounting.
91 let sshAsUser = user:
92 pkgs.writeScript "sshAsUser-${user}" ''
93 exec ${pkgs.sudo}/bin/sudo -i -u ${user} \
94 ${pkgs.openssh}/bin/ssh "$@"
95 '';
96 in [
97 "noatime" "noexec" "nosuid"
98 "user" "uid=julm" "gid=users" "allow_other"
99 "_netdev" "ssh_command=${sshAsUser "julm"}" # "reconnect"
100 "noauto" "x-gvfs-hide" "x-systemd.automount"
101 #"Compression=yes" # YMMV
102 # Disconnect approximately 2*15=30 seconds after a network failure
103 "ServerAliveCountMax=1"
104 "ServerAliveInterval=15"
105 ];
106 };
107
108 services.ipfs = {
109 #enable = true;
110 defaultMode = "online";
111 autoMount = true;
112 enableGC = true;
113 localDiscovery = false;
114 extraConfig = {
115 Datastore.StorageMax = "10GB";
116 Discovery.MDNS.Enabled = false;
117 #Bootstrap = [
118 #];
119 #Swarm.AddrFilters = null;
120 };
121 startWhenNeeded = true;
122 };
123
124 services.udev.packages = [
125 # Allow the console user access the Yubikey USB device node,
126 # needed for challenge/response to work correctly.
127 pkgs.yubikey-personalization
128 ];
129
130 services.xserver = {
131 desktopManager = {
132 session = [
133 # Let the session be generated by home-manager
134 { name = "home-manager";
135 start = ''
136 ${pkgs.runtimeShell} $HOME/.hm-xsession &
137 waitPID=$!
138 '';
139 }
140 ];
141 };
142 displayManager = {
143 defaultSession = "home-manager";
144 #defaultSession = "none+xmonad";
145 #defaultSession = "mate";
146 #defaultSession = "cinnamon";
147 autoLogin = {
148 user = config.users.users.julm.name;
149 };
150 };
151 };
152
153 # This value determines the NixOS release with which your system is to be
154 # compatible, in order to avoid breaking some software such as database
155 # servers. You should change this only after NixOS release notes say you should.
156 system.stateVersion = "20.09"; # Did you read the comment?
157 }