hosts/oignon.nix

   1 { config, pkgs, lib, inputs, private, hostName, ... }:
   2 let
   3   inherit (config.users) users;
   4   inherit (config.services) davfs2;
   5 in
   6 {
   7 imports = [
   8   ../profiles/dnscrypt-proxy2.nix
   9   ../profiles/security.nix
  10   ../networking/wireguard/wg-intra.nix
  11   oignon/hardware.nix
  12   oignon/wireguard.nix
  13   oignon/tor.nix
  14   oignon/backup.nix
  15 ];
  16
  17 home-manager.users.julm = {
  18   imports = [
  19     ../homes/julm.nix
  20   ];
  21   host.hardware = ["ThinkPad" "X201"];
  22 };
  23 systemd.services.home-manager-julm.postStart = ''
  24   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
  25 '';
  26 security.lockKernelModules = false;
  27 users.mutableUsers = false;
  28 users.users.julm = {
  29   isNormalUser = true;
  30   uid = 1000;
  31   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  32   # which is already world readable.
  33   hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
  34   extraGroups = [
  35     "adbusers"
  36     "lp"
  37     "networkmanager"
  38     "scanner"
  39     "tor"
  40     "video"
  41     "wheel"
  42     #"ipfs"
  43     davfs2.davGroup
  44     #"vboxusers"
  45   ];
  46   # If created, zfs-mount.service would require:
  47   # zfs set overlay=yes ${hostName}/home
  48   createHome = false;
  49 };
  50
  51 nix = {
  52   extraOptions = ''
  53     secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
  54   '';
  55   autoOptimiseStore = true;
  56   gc = {
  57     automatic = true;
  58     dates = "weekly";
  59     options = "--delete-older-than 7d";
  60   };
  61   nixPath = [
  62     "nixpkgs=/etc/nixpkgs"
  63     "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix"
  64   ];
  65   trustedUsers = [ users.julm.name ];
  66   binaryCaches = [ "http://nix-localcache.losurdo.wg" ];
  67   binaryCachePublicKeys = [ "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los=" ];
  68 };
  69 documentation = {
  70   enable = true;
  71   dev.enable = true;
  72   doc.enable = true;
  73   info.enable = false;
  74   man.enable = true;
  75   nixos.enable = false;
  76 };
  77 nix.sshServe = {
  78   enable = true;
  79   keys = [ (lib.readFile ../private/world/julm/losurdo/ssh.pub) ];
  80 };
  81 users.users.julm.openssh.authorizedKeys.keys = [
  82   (lib.readFile ../private/world/julm/losurdo/ssh.pub)
  83 ];
  84 services.openssh.openFirewall = false;
  85 services.openssh.forwardX11 = true;
  86 services.openssh.passwordAuthentication = false;
  87
  88 environment.etc."nixpkgs".source = pkgs.path;
  89 environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  90
  91 time.timeZone = "Europe/Paris";
  92 i18n.defaultLocale = "fr_FR.UTF-8";
  93 console.font = "Lat2-Terminus16";
  94 console.keyMap = "fr";
  95
  96 networking = {
  97   hostName = hostName;
  98   domain = "localdomain";
  99   search = [ "sourcephile.fr" ];
 100   networkmanager = {
 101     enable = true;
 102     #dhcp = "dhcpcd";
 103     logLevel = "INFO";
 104     wifi = {
 105       #backend = "iwd";
 106       #backend = "wpa_supplicant";
 107       powersave = false;
 108     };
 109   };
 110   firewall = {
 111     enable = true;
 112     allowPing = false;
 113   };
 114 };
 115
 116 sound.enable = true;
 117 hardware.pulseaudio.enable = true;
 118 hardware.sane.enable = true;
 119 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
 120
 121 environment.variables = {
 122   EDITOR = "vim";
 123   PAGER  = "less -R";
 124   SYSTEMD_LESS = "FKMRX";
 125 };
 126 environment.systemPackages = [
 127   pkgs.mkpasswd
 128   pkgs.gdb
 129   pkgs.riseup-vpn
 130   #pkgs.calyx-vpn
 131 ];
 132
 133 programs = {
 134   bash = {
 135     interactiveShellInit = ''
 136       bind '"\e[A":history-search-backward'
 137       bind '"\e[B":history-search-forward'
 138
 139       # Ignore duplicate commands, ignore commands starting with a space
 140       export HISTCONTROL=erasedups:ignorespace
 141       export HISTSIZE=42000
 142       # Append to the history instead of overwriting (good for multiple connections)
 143       shopt -s histappend
 144
 145       # Utilities
 146       mkcd () { mkdir -p "$1"; cd "$1"; }
 147       fan () {
 148         if [ $# -gt 0 ]
 149         then sudo tee /proc/acpi/ibm/fan <<<"level $1"
 150         else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
 151         fi
 152         acpi -t
 153       }
 154     '';
 155     shellAliases = {
 156       cl = "clear";
 157       grep = "grep --color";
 158       l  = "ls -alh";
 159       ll = "ls -al";
 160       ls = "ls --color=tty";
 161       mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
 162
 163       s="sudo systemctl";
 164       st="sudo systemctl status";
 165       u="systemctl --user";
 166       j="sudo journalctl -u";
 167       jb="sudo journalctl -b";
 168
 169       nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 170       mv = "mv -i";
 171       sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
 172     };
 173   };
 174   dconf.enable = true;
 175   mtr.enable = true;
 176 };
 177
 178 services.avahi = {
 179   enable = true;
 180   nssmdns = true;
 181   openFirewall = false;
 182   publish = {
 183     enable = false;
 184   };
 185 };
 186 services.davfs2 = {
 187   enable = true;
 188   extraConfig = ''
 189   '';
 190 };
 191 fileSystems."/home/julm/mnt/ilico/severine" = {
 192   device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
 193   fsType = "davfs";
 194   options =
 195     let conf = pkgs.writeText "davfs2.conf" ''
 196       backup_dir /home/julm/documents/backup/ilico/severine
 197       cache_dir /home/julm/.cache/davfs2/ilico/severine
 198     ''; in
 199     [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
 200 };
 201 services.dbus = {
 202   packages = [ pkgs.gnome3.dconf ];
 203 };
 204 services.gvfs = {
 205   enable = true;
 206 };
 207 services.ipfs = {
 208   #enable = true;
 209   defaultMode = "online";
 210   autoMount = true;
 211   enableGC = true;
 212   localDiscovery = false;
 213   extraConfig = {
 214     Datastore.StorageMax = "10GB";
 215     Discovery.MDNS.Enabled = false;
 216     #Bootstrap = [
 217     #];
 218     #Swarm.AddrFilters = null;
 219   };
 220   startWhenNeeded = true;
 221 };
 222 services.journald = {
 223   extraConfig = ''
 224     Compress=true
 225     MaxRetentionSec=1month
 226     Storage=persistent
 227     SystemMaxUse=100M
 228   '';
 229 };
 230 services.printing = {
 231   enable = true;
 232   drivers = [
 233     pkgs.gutenprint
 234     pkgs.hplip
 235   ];
 236 };
 237 services.udev = {
 238   packages = [
 239     # Allow members of the "adbusers" group to mount Android devices via MTP.
 240     pkgs.android-udev-rules
 241     # Allow the console user access the Yubikey USB device node,
 242     # needed for challenge/response to work correctly.
 243     pkgs.yubikey-personalization
 244   ];
 245 };
 246 services.xserver = {
 247   enable = true;
 248   layout = "fr";
 249   xkbOptions = "eurosign:e";
 250   libinput.enable = true;
 251   desktopManager = {
 252     session = [
 253       # Let the session be generated by home-manager
 254       { name = "home-manager";
 255         start = ''
 256           ${pkgs.runtimeShell} $HOME/.hm-xsession &
 257           waitPID=$!
 258         '';
 259       }
 260     ];
 261   };
 262   displayManager = {
 263     defaultSession = "home-manager";
 264     #defaultSession = "none+xmonad";
 265     autoLogin = {
 266       enable = true;
 267       user = users.julm.name;
 268     };
 269   };
 270 };
 271
 272 systemd.coredump.enable = true;
 273 #environment.enableDebugInfo = true;
 274
 275 # This value determines the NixOS release with which your system is to be
 276 # compatible, in order to avoid breaking some software such as database
 277 # servers. You should change this only after NixOS release notes say you should.
 278 system.stateVersion = "20.09"; # Did you read the comment?
 279 }