]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
nix: update nixpkgs
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, inputs, private, hostName, ... }:
2 {
3 imports = [
4 ../nixos/profiles/builder.nix
5 ../nixos/profiles/debug.nix
6 ../nixos/profiles/dnscrypt-proxy2.nix
7 ../nixos/profiles/graphical.nix
8 ../nixos/profiles/lang-fr.nix
9 ../nixos/profiles/networking.nix
10 ../nixos/profiles/printing.nix
11 ../nixos/profiles/security.nix
12 ../nixos/profiles/system.nix
13 ../nixos/profiles/tor.nix
14 ../nixos/profiles/irssi.nix
15 ../nixos/profiles/wireguard/wg-intra.nix
16 oignon/backup.nix
17 oignon/hardware.nix
18 oignon/wireguard.nix
19 ];
20
21 home-manager.users.julm = {
22 imports = [ ../homes/julm.nix ];
23 host.hardware = [ "ThinkPad" "X201" ];
24 };
25 systemd.services.home-manager-julm.postStart = ''
26 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
27 '';
28 users.users.julm = {
29 isNormalUser = true;
30 uid = 1000;
31 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
32 # which is already world readable.
33 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
34 extraGroups = [
35 "adbusers"
36 "lp"
37 "networkmanager"
38 "scanner"
39 "tor"
40 "video"
41 "wheel"
42 #"ipfs"
43 config.services.davfs2.davGroup
44 #"vboxusers"
45 ];
46 # If created, zfs-mount.service would require:
47 # zfs set overlay=yes ${hostName}/home
48 createHome = false;
49 openssh.authorizedKeys.keys = map lib.readFile [
50 ../private/shared/ssh/julm/losurdo.pub
51 ];
52 };
53
54 nix = {
55 extraOptions = ''
56 #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
57 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
58 '';
59 settings = {
60 trusted-users = [ config.users.users."julm".name ];
61 substituters = [
62 #"http://nix-localcache.losurdo.wg"
63 "ssh://nix-ssh@losurdo.wg?priority=30"
64 ];
65 trusted-public-keys = map lib.readFile [
66 ../private/shared/nix/losurdo.pub
67 ];
68 };
69 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
70 };
71 #environment.etc."nixpkgs".source = pkgs.path;
72 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
73
74 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
75 nix.sshServe = {
76 enable = true;
77 keys = map lib.readFile [
78 ../private/shared/ssh/julm/losurdo.pub
79 ../private/shared/ssh/sevy/patate.pub
80 ../private/shared/ssh/julm/oignon.pub
81 ];
82 };
83
84 environment.systemPackages = [
85 pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
86 ];
87
88 boot.extraModulePackages = [
89 #config.boot.kernelPackages.v4l2loopback
90 ];
91
92 programs.fuse.userAllowOther = true;
93
94 services.davfs2.enable = true;
95
96 fileSystems =
97 # Use the user's gpg-agent session to query
98 # for the password of the SSH key when auto-mounting.
99 let
100 sshAsUser = user:
101 pkgs.writeScript "sshAsUser-${user}" ''
102 exec ${pkgs.sudo}/bin/sudo -i -u ${user} \
103 ${pkgs.openssh}/bin/ssh "$@"
104 '';
105 options =
106 [
107 "noatime" "noexec" "nosuid"
108 "user" "uid=julm" "gid=users" "allow_other"
109 "_netdev" "ssh_command=${sshAsUser "julm"}" # "reconnect"
110 "noauto" "x-gvfs-hide" "x-systemd.automount"
111 #"Compression=yes" # YMMV
112 # Disconnect approximately 2*15=30 seconds after a network failure
113 "ServerAliveCountMax=1"
114 "ServerAliveInterval=15"
115 ];
116 in {
117 "/mnt/losurdo" = {
118 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@losurdo.wg:/";
119 fsType = "fuse";
120 inherit options;
121 };
122 "/mnt/mermet" = {
123 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@mermet.wg:/";
124 fsType = "fuse";
125 inherit options;
126 };
127 "/mnt/ilico/severine" = {
128 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
129 fsType = "davfs";
130 options =
131 let conf = pkgs.writeText "davfs2.conf" ''
132 backup_dir /home/julm/.local/share/davfs2/ilico/severine
133 secrets /home/julm/.davfs2/secrets
134 ''; in
135 [ "conf=${conf}" "user" "noexec" "nosuid"
136 "noauto" "nofail" "_netdev" "reconnect"
137 "x-systemd.automount"
138 "x-systemd.device-timeout=1m"
139 "x-systemd.idle-timeout=1m"
140 "x-systemd.mount-timeout=10s"
141 ];
142 };
143 };
144
145 networking.firewall.extraCommands = ''
146 ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 8000 -j ACCEPT
147 '';
148
149 services.ipfs = {
150 #enable = true;
151 defaultMode = "online";
152 autoMount = true;
153 enableGC = true;
154 localDiscovery = false;
155 extraConfig = {
156 Datastore.StorageMax = "10GB";
157 Discovery.MDNS.Enabled = false;
158 #Bootstrap = [
159 #];
160 #Swarm.AddrFilters = null;
161 };
162 startWhenNeeded = true;
163 };
164
165 services.udev.packages = [
166 # Allow the console user access the Yubikey USB device node,
167 # needed for challenge/response to work correctly.
168 pkgs.yubikey-personalization
169 ];
170
171 services.xserver = {
172 desktopManager = {
173 session = [
174 # Let the session be generated by home-manager
175 { name = "home-manager";
176 start = ''
177 ${pkgs.runtimeShell} $HOME/.hm-xsession &
178 waitPID=$!
179 '';
180 }
181 ];
182 };
183 displayManager = {
184 defaultSession = "home-manager";
185 #defaultSession = "none+xmonad";
186 #defaultSession = "mate";
187 #defaultSession = "cinnamon";
188 autoLogin = {
189 user = config.users.users.julm.name;
190 };
191 };
192 };
193
194 # This value determines the NixOS release with which your system is to be
195 # compatible, in order to avoid breaking some software such as database
196 # servers. You should change this only after NixOS release notes say you should.
197 system.stateVersion = "20.09"; # Did you read the comment?
198 }