hosts/aubergine.nix

   1 { config, pkgs, lib, inputs, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/server.nix
   5     #../nixos/profiles/debug.nix
   6     ../nixos/profiles/lang-fr.nix
   7     #../nixos/profiles/tor.nix
   8     aubergine/hardware.nix
   9     aubergine/networking.nix
  10     aubergine/nginx.nix
  11     aubergine/backup.nix
  12   ];
  13
  14   # Lower kernel's security for better performances
  15   boot.kernelParams = [ "mitigations=off" ];
  16
  17   home-manager.users.julm = {
  18     imports = [ ../homes/julm.nix ];
  19   };
  20   systemd.services.home-manager-julm.postStart = ''
  21     ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
  22   '';
  23   users.users.julm = {
  24     isNormalUser = true;
  25     uid = 1000;
  26     # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  27     # which is already world readable.
  28     # printf %s $(mkpasswd -m md5crypt)
  29     hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
  30     extraGroups = [
  31       "adbusers"
  32       "dialout"
  33       "networkmanager"
  34       "tor"
  35       "wheel"
  36     ];
  37     # If created, zfs-mount.service would require:
  38     # zfs set overlay=yes ${hostName}/home
  39     createHome = true;
  40     openssh.authorizedKeys.keys = map lib.readFile [
  41       ../users/root/ssh/losurdo.pub
  42       ../users/julm/ssh/losurdo.pub
  43       ../users/julm/ssh/oignon.pub
  44       ../users/julm/ssh/redmi.pub
  45     ];
  46   };
  47   users.users.root = {
  48     hashedPassword = "!";
  49     openssh.authorizedKeys.keys =
  50       config.users.users.julm.openssh.authorizedKeys.keys;
  51   };
  52
  53   #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
  54   #  "secret-key-files:" + aubergine/nix/secret-key-files;
  55   nix = {
  56     extraOptions = ''
  57       #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
  58     '';
  59     settings = {
  60       substituters = [
  61         #"http://nix-localcache.losurdo.wg"
  62         #"ssh://nix-ssh@losurdo.wg?priority=30"
  63         #"ssh://nix-ssh@oignon.wg?priority=30"
  64       ];
  65       trusted-public-keys = map lib.readFile [
  66         ../users/root/nix/oignon.pub
  67       ];
  68     };
  69     nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  70   };
  71   #environment.etc."nixpkgs".source = pkgs.path;
  72   #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  73
  74   nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  75   nix.sshServe = {
  76     enable = true;
  77     keys = map lib.readFile [
  78       ../users/julm/ssh/losurdo.pub
  79       ../users/sevy/ssh/patate.pub
  80       ../users/julm/ssh/oignon.pub
  81     ];
  82   };
  83
  84   environment.systemPackages = [
  85   ];
  86
  87   boot.extraModulePackages = [
  88     #config.boot.kernelPackages.v4l2loopback
  89   ];
  90
  91   # This value determines the NixOS release with which your system is to be
  92   # compatible, in order to avoid breaking some software such as database
  93   # servers. You should change this only after NixOS release notes say you should.
  94   system.stateVersion = "22.11"; # Did you read the comment?
  95 }