]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine.nix
tmux: remove upstreamed patch and config
[julm/julm-nix.git] / hosts / aubergine.nix
1 { config, pkgs, lib, inputs, private, hostName, ... }:
2 {
3 imports = [
4 #../nixos/profiles/debug.nix
5 ../nixos/profiles/lang-fr.nix
6 ../nixos/profiles/security.nix
7 ../nixos/profiles/system.nix
8 #../nixos/profiles/tor.nix
9 aubergine/hardware.nix
10 aubergine/networking.nix
11 ];
12
13 # Lower kernel's security for better performances
14 boot.kernelParams = [ "mitigations=off" ];
15
16 environment.etc.machine-id.source = ../private + "/hosts/${hostName}/root/machine-id";
17
18 home-manager.users.julm = {
19 imports = [ ../homes/julm.nix ];
20 # /sys/devices/virtual/dmi/id/product_name
21 host.hardware = [ "apu6" ];
22 };
23 systemd.services.home-manager-julm.postStart = ''
24 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
25 '';
26 users.users.julm = {
27 isNormalUser = true;
28 uid = 1000;
29 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
30 # which is already world readable.
31 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
32 extraGroups = [
33 "adbusers"
34 "dialout"
35 "networkmanager"
36 "tor"
37 "wheel"
38 ];
39 # If created, zfs-mount.service would require:
40 # zfs set overlay=yes ${hostName}/home
41 createHome = true;
42 openssh.authorizedKeys.keys = map lib.readFile [
43 ../private/shared/ssh/julm/losurdo.pub
44 ../private/shared/ssh/julm/oignon.pub
45 ../private/shared/ssh/julm/redmi.pub
46 ];
47 };
48 users.users.root = {
49 hashedPassword = "!";
50 openssh.authorizedKeys.keys = map lib.readFile [
51 ../private/shared/ssh/julm/losurdo.pub
52 ../private/shared/ssh/julm/oignon.pub
53 ../private/shared/ssh/julm/redmi.pub
54 ];
55 };
56
57 nix = {
58 extraOptions = ''
59 #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
60 #secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
61 '';
62 settings = {
63 trusted-users = [ config.users.users."julm".name ];
64 substituters = [
65 #"http://nix-localcache.losurdo.wg"
66 #"ssh://nix-ssh@losurdo.wg?priority=30"
67 ];
68 trusted-public-keys = map lib.readFile [
69 #../private/shared/nix/losurdo.pub
70 ];
71 };
72 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
73 };
74 #environment.etc."nixpkgs".source = pkgs.path;
75 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
76
77 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
78 nix.sshServe = {
79 enable = true;
80 keys = map lib.readFile [
81 ../private/shared/ssh/julm/losurdo.pub
82 ../private/shared/ssh/sevy/patate.pub
83 ../private/shared/ssh/julm/oignon.pub
84 ];
85 };
86
87 environment.systemPackages = [
88 ];
89
90 boot.extraModulePackages = [
91 #config.boot.kernelPackages.v4l2loopback
92 ];
93
94 # This value determines the NixOS release with which your system is to be
95 # compatible, in order to avoid breaking some software such as database
96 # servers. You should change this only after NixOS release notes say you should.
97 system.stateVersion = "22.11"; # Did you read the comment?
98 }