]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
nebula: comment about possible cipher
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, inputs, hostName, ... }:
2 {
3 imports = [
4 ../nixos/profiles/debug.nix
5 ../nixos/profiles/graphical.nix
6 ../nixos/profiles/irssi.nix
7 ../nixos/profiles/lang-fr.nix
8 ../nixos/profiles/laptop.nix
9 ../nixos/profiles/printing.nix
10 ../nixos/profiles/radio.nix
11 ../nixos/profiles/tor.nix
12 ../nixos/profiles/bluetooth.nix
13 oignon/backup.nix
14 oignon/hardware.nix
15 oignon/nebula.nix
16 oignon/networking.nix
17 oignon/wireguard.nix
18 ];
19
20 # Lower kernel's security for better performances
21 security.kernel.mitigations = "off";
22
23 home-manager.users.julm = {
24 imports = [ ../homes/julm.nix ];
25 };
26 users.users.root = {
27 openssh.authorizedKeys.keys = map lib.readFile [
28 # For nix -L run .#oignon.switch
29 ../users/julm/ssh/oignon.pub
30 ];
31 };
32 users.users.julm = {
33 isNormalUser = true;
34 uid = 1000;
35 # Put the hashedPassword in /nix/store,
36 # though /etc/shadow is not world readable...
37 # printf %s $(mkpasswd -m md5crypt)
38 hashedPassword = lib.readFile oignon/users/julm/login/hashedPassword.clear;
39 extraGroups = [
40 "adbusers"
41 "dialout"
42 "lp"
43 "networkmanager"
44 "plugdev" # For rtl-sdr
45 "scanner"
46 "tor"
47 "video"
48 "wheel"
49 #"ipfs"
50 config.services.davfs2.davGroup
51 #"vboxusers"
52 ];
53 # If created, zfs-mount.service would require:
54 # zfs set overlay=yes ${hostName}/home
55 createHome = false;
56 openssh.authorizedKeys.keys = map lib.readFile [
57 ../users/julm/ssh/losurdo.pub
58 ];
59 };
60
61 systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted = [
62 "${hostName}.key:${builtins.path { path = ./. + "/${hostName}/nix/secret-key-files.priv.pem.cred"; }}"
63 ];
64 nix = {
65 extraOptions = ''
66 secret-key-files = /run/credentials/nix-daemon.service/${hostName}.key
67 '';
68 settings = {
69 substituters = [
70 #"http://nix-localcache.losurdo.sp"
71 "ssh://nix-ssh@losurdo.sp?priority=30"
72 ];
73 trusted-public-keys = map lib.readFile [
74 ../users/nix/ssh/losurdo.pub
75 ];
76 };
77 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
78 };
79 #environment.etc."nixpkgs".source = pkgs.path;
80 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
81
82 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
83 nix.sshServe = {
84 enable = true;
85 keys = map lib.readFile [
86 ../users/julm/ssh/losurdo.pub
87 ../users/julm/ssh/oignon.pub
88 ../users/sevy/ssh/patate.pub
89 ];
90 };
91
92 environment.systemPackages = [
93 pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
94 ];
95
96 boot.extraModulePackages = [
97 #config.boot.kernelPackages.v4l2loopback
98 ];
99
100 programs.fuse.userAllowOther = true;
101
102 services.davfs2.enable = true;
103
104 systemd.automounts = [
105 { where = "/mnt/aubergine"; automountConfig.TimeoutIdleSec = "5 min"; }
106 ];
107 fileSystems =
108 let
109 # Use the user's gpg-agent session to query
110 # for the password of the SSH key when auto-mounting.
111 sshAsUser =
112 pkgs.writeScript "sshAsUser" ''
113 user="$1"; shift
114 exec ${pkgs.sudo}/bin/sudo -i -u "$user" \
115 ${pkgs.openssh}/bin/ssh "$@"
116 '';
117 options =
118 [
119 "user"
120 "uid=julm"
121 "gid=users"
122 "allow_other"
123 "exec" # Override "user"'s noexec
124 "noatime"
125 "nosuid"
126 "_netdev"
127 "ssh_command=${sshAsUser}\\040julm"
128 "noauto"
129 "x-gvfs-hide"
130 "x-systemd.automount"
131 #"Compression=yes" # YMMV
132 # Disconnect approximately 2*15=30 seconds after a network failure
133 "ServerAliveCountMax=1"
134 "ServerAliveInterval=15"
135 "dir_cache=no"
136 #"reconnect"
137 ];
138 in
139 {
140 "/mnt/aubergine" = {
141 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@aubergine.sp:/";
142 fsType = "fuse";
143 inherit options;
144 };
145 "/mnt/losurdo" = {
146 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@losurdo.sp:/";
147 fsType = "fuse";
148 inherit options;
149 };
150 "/mnt/mermet" = {
151 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@mermet.sp:/";
152 fsType = "fuse";
153 inherit options;
154 };
155 "/mnt/ilico/severine" = {
156 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
157 fsType = "davfs";
158 options =
159 let
160 conf = pkgs.writeText "davfs2.conf" ''
161 backup_dir /home/julm/.local/share/davfs2/ilico/severine
162 secrets /home/julm/.davfs2/secrets
163 '';
164 in
165 [
166 "conf=${conf}"
167 "user"
168 "noexec"
169 "nosuid"
170 "noauto"
171 "nofail"
172 "_netdev"
173 "reconnect"
174 "x-systemd.automount"
175 "x-systemd.device-timeout=1m"
176 "x-systemd.idle-timeout=1m"
177 "x-systemd.mount-timeout=10s"
178 ];
179 };
180 };
181
182 networking.firewall.extraCommands = ''
183 ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 8000 -j ACCEPT
184 '';
185
186 services.kubo = {
187 #enable = true;
188 defaultMode = "online";
189 autoMount = true;
190 enableGC = true;
191 localDiscovery = false;
192 settings = {
193 Datastore.StorageMax = "10GB";
194 Discovery.MDNS.Enabled = false;
195 #Bootstrap = [
196 #];
197 #Swarm.AddrFilters = null;
198 };
199 startWhenNeeded = true;
200 };
201
202 services.udev.packages = [
203 # Allow the console user access the Yubikey USB device node,
204 # needed for challenge/response to work correctly.
205 pkgs.yubikey-personalization
206 ];
207
208 services.xserver = {
209 layout = "fr,us(altgr-intl)";
210 desktopManager = {
211 session = [
212 # Let the session be generated by home-manager
213 {
214 name = "home-manager";
215 start = ''
216 ${pkgs.runtimeShell} $HOME/.hm-xsession &
217 waitPID=$!
218 '';
219 }
220 ];
221 };
222 displayManager = {
223 defaultSession = "home-manager";
224 #defaultSession = "none+xmonad";
225 #defaultSession = "mate";
226 #defaultSession = "cinnamon";
227 autoLogin = {
228 user = config.users.users.julm.name;
229 };
230 };
231 };
232
233 # This value determines the NixOS release with which your system is to be
234 # compatible, in order to avoid breaking some software such as database
235 # servers. You should change this only after NixOS release notes say you should.
236 system.stateVersion = "20.09"; # Did you read the comment?
237 }