hosts/pumpkin.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   inputs,
   6   hostName,
   7   ...
   8 }:
   9 {
  10   imports = [
  11     ../nixos/profiles/builder.nix
  12     ../nixos/profiles/debug.nix
  13     ../nixos/profiles/graphical.nix
  14     ../nixos/profiles/irssi.nix
  15     ../nixos/profiles/lang-fr.nix
  16     ../nixos/profiles/laptop.nix
  17     ../nixos/profiles/printing.nix
  18     ../nixos/profiles/radio.nix
  19     ../nixos/profiles/tor.nix
  20     ../nixos/profiles/bluetooth.nix
  21     ../nixos/profiles/home.nix
  22     pumpkin/backup.nix
  23     pumpkin/syncoid.nix
  24     pumpkin/hardware.nix
  25     pumpkin/nebula.nix
  26     pumpkin/networking.nix
  27   ];
  28
  29   # Lower kernel's security for better performances
  30   security.kernel.mitigations = "off";
  31
  32   home-manager.users.julm = {
  33     imports = [ ../homes/julm.nix ];
  34   };
  35   users.users.root = {
  36     openssh.authorizedKeys.keys = map lib.readFile [
  37       # For nix -L run .#pumpkin.switch
  38       ../users/julm/ssh/pumpkin.pub
  39     ];
  40   };
  41   users.users.julm = {
  42     isNormalUser = true;
  43     uid = 1000;
  44     # Put the hashedPassword in /nix/store,
  45     # though /etc/shadow is not world readable...
  46     # printf %s $(mkpasswd -m md5crypt)
  47     hashedPassword = lib.readFile pumpkin/users/julm/login/hashedPassword.clear;
  48     extraGroups = [
  49       "adbusers"
  50       "dialout"
  51       "lp"
  52       "networkmanager"
  53       "plugdev" # For rtl-sdr
  54       "scanner"
  55       "tor"
  56       "video"
  57       "wheel"
  58       "wireshark"
  59       #"ipfs"
  60       config.services.davfs2.davGroup
  61       config.services.kubo.group
  62       #"vboxusers"
  63     ];
  64     # If created, zfs-mount.service would require:
  65     # zfs set overlay=yes ${hostName}/home
  66     createHome = false;
  67     openssh.authorizedKeys.keys = map lib.readFile [
  68       ../users/julm/ssh/losurdo.pub
  69     ];
  70   };
  71
  72   nix = {
  73     settings = {
  74       substituters = [
  75         #"http://nix-localcache.losurdo.sp"
  76         #"file:///mnt/off4/julm/nix?priority=10&trusted=true"
  77         "ssh://nix-ssh@losurdo.sp?priority=30"
  78       ];
  79       trusted-public-keys = map lib.readFile [
  80         ../users/nix/ssh/losurdo.pub
  81       ];
  82     };
  83   };
  84   #environment.etc."nixpkgs".source = pkgs.path;
  85   #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  86
  87   nix.settings.allowed-users = [
  88     #config.users.users."nix-ssh".name
  89   ];
  90   nix.sshServe = {
  91     #enable = true;
  92     keys = map lib.readFile [
  93       ../users/julm/ssh/losurdo.pub
  94       ../users/julm/ssh/pumpkin.pub
  95       ../users/sevy/ssh/patate.pub
  96     ];
  97   };
  98
  99   environment.systemPackages = [
 100     #pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
 101   ];
 102
 103   boot.extraModulePackages = [
 104     #config.boot.kernelPackages.v4l2loopback
 105   ];
 106
 107   programs.adb.enable = true;
 108
 109   programs.fuse.userAllowOther = true;
 110
 111   services.davfs2.enable = true;
 112
 113   systemd.automounts = [
 114     {
 115       where = "/mnt/aubergine";
 116       automountConfig.TimeoutIdleSec = "5 min";
 117     }
 118   ];
 119   fileSystems =
 120     let
 121       # Use the user's gpg-agent session to query
 122       # for the password of the SSH key when auto-mounting.
 123       sshAsUser = pkgs.writeScript "sshAsUser" ''
 124         user="$1"; shift
 125         exec ${pkgs.sudo}/bin/sudo -i -u "$user" \
 126           ${pkgs.openssh}/bin/ssh "$@"
 127       '';
 128       options = [
 129         "user"
 130         "uid=julm"
 131         "gid=users"
 132         "allow_other"
 133         "exec" # Override "user"'s noexec
 134         "noatime"
 135         "nosuid"
 136         "_netdev"
 137         "ssh_command=${sshAsUser}\\040julm"
 138         "noauto"
 139         "x-gvfs-hide"
 140         "x-systemd.automount"
 141         #"Compression=yes" # YMMV
 142         # Disconnect approximately 2*15=30 seconds after a network failure
 143         "ServerAliveCountMax=1"
 144         "ServerAliveInterval=15"
 145         "dir_cache=no"
 146         #"reconnect"
 147       ];
 148     in
 149     {
 150       "/mnt/aubergine" = {
 151         device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@aubergine.sp:/";
 152         fsType = "fuse";
 153         inherit options;
 154       };
 155       "/mnt/losurdo" = {
 156         device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@losurdo.sp:/";
 157         fsType = "fuse";
 158         inherit options;
 159       };
 160       "/mnt/mermet" = {
 161         device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@mermet.sp:/";
 162         fsType = "fuse";
 163         inherit options;
 164       };
 165       /*
 166         "/mnt/ilico/severine" = {
 167           device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
 168           fsType = "davfs";
 169           options =
 170             let
 171               conf = pkgs.writeText "davfs2.conf" ''
 172                 backup_dir /home/julm/.local/share/davfs2/ilico/severine
 173                 secrets /home/julm/.davfs2/secrets
 174               '';
 175             in
 176             [
 177               "conf=${conf}"
 178               "user"
 179               "noexec"
 180               "nosuid"
 181               "noauto"
 182               "nofail"
 183               "_netdev"
 184               "reconnect"
 185               "x-systemd.automount"
 186               "x-systemd.device-timeout=1m"
 187               "x-systemd.idle-timeout=1m"
 188               "x-systemd.mount-timeout=10s"
 189             ];
 190         };
 191       */
 192     };
 193
 194   services.udev.packages = [
 195     # Allow the console user access the Yubikey USB device node,
 196     # needed for challenge/response to work correctly.
 197     pkgs.yubikey-personalization
 198   ];
 199
 200   services.xserver = {
 201     xkb = {
 202       layout = "fr,us(altgr-intl)";
 203     };
 204     desktopManager = {
 205       session = [
 206         # Let the session be generated by home-manager
 207         {
 208           name = "home-manager";
 209           start = ''
 210             ${pkgs.runtimeShell} $HOME/.hm-xsession &
 211             waitPID=$!
 212           '';
 213         }
 214       ];
 215     };
 216   };
 217
 218   services.displayManager = {
 219     defaultSession = "home-manager";
 220     #defaultSession = "none+xmonad";
 221     #defaultSession = "mate";
 222     #defaultSession = "cinnamon";
 223     autoLogin = {
 224       user = config.users.users.julm.name;
 225     };
 226   };
 227
 228   nixpkgs.config.allowUnfreePredicate =
 229     pkg:
 230     builtins.elem (lib.getName pkg) [
 231       "canon-cups-ufr2"
 232       "cuda_cccl"
 233       "cuda_cudart"
 234       "cuda_cupti"
 235       "cuda_nvcc"
 236       "cuda_nvrtc"
 237       "cuda_nvtx"
 238       "cudnn"
 239       "geogebra"
 240       "hplip"
 241       "libcublas"
 242       "libcufft"
 243       "libcurand"
 244       "libcusolver"
 245       "libcusparse"
 246       "libnvjitlink"
 247       "memtest86-efi"
 248       "shipwright"
 249       "steam"
 250       "steam-unwrapped"
 251       "synthesia"
 252       "torch"
 253       "triton"
 254     ];
 255
 256   # This value determines the NixOS release with which your system is to be
 257   # compatible, in order to avoid breaking some software such as database
 258   # servers. You should change this only after NixOS release notes say you should.
 259   system.stateVersion = "24.11"; # Did you read the comment?
 260 }