]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
nix: use nix-direnv
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, inputs, private, hostName, ... }:
2 let
3 inherit (config.users) users;
4 inherit (config.services) davfs2;
5 in
6 {
7 imports = [
8 ../profiles/dnscrypt-proxy2.nix
9 oignon/hardware.nix
10 oignon/tor.nix
11 oignon/backup.nix
12 ];
13
14 home-manager.users.julm = {
15 imports = [ ../homes/julm.nix ];
16 host.name = hostName;
17 host.hardware = ["ThinkPad" "X201"];
18 };
19 systemd.services.home-manager-julm.postStart = ''
20 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
21 '';
22 users.mutableUsers = false;
23 users.users.julm = {
24 isNormalUser = true;
25 uid = 1000;
26 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
27 # which is already world readable.
28 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
29 extraGroups = [
30 "adbusers"
31 "lp"
32 "networkmanager"
33 "scanner"
34 "tor"
35 "video"
36 "wheel"
37 davfs2.davGroup
38 #"vboxusers"
39 ];
40 # If created, zfs-mount.service would require:
41 # zfs set overlay=yes ${hostName}/home
42 createHome = false;
43 };
44
45 nix = {
46 extraOptions = ''
47 auto-optimise-store = true
48 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
49 '';
50 gc = {
51 automatic = true;
52 dates = "weekly";
53 options = "--delete-older-than 7d";
54 };
55 nixPath = [
56 "nixpkgs=/etc/nixpkgs"
57 "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix"
58 ];
59 trustedUsers = [ users.julm.name ];
60 binaryCaches = [ "https://nix-localcache.sourcephile.fr" ];
61 binaryCachePublicKeys = [ "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los=" ];
62 };
63 nix.sshServe = {
64 enable = true;
65 keys = [ (lib.readFile ../private/world/julm/losurdo/ssh.pub) ];
66 };
67 users.users.julm.openssh.authorizedKeys.keys = [
68 (lib.readFile ../private/world/julm/losurdo/ssh.pub)
69 ];
70 services.openssh.forwardX11 = true;
71 services.openssh.passwordAuthentication = false;
72
73 nixpkgs.config = {
74 allowUnfree = true;
75 };
76 environment.etc."nixpkgs".source = pkgs.path;
77 environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
78
79 documentation.nixos.enable = true;
80 time.timeZone = "Europe/Paris";
81 i18n.defaultLocale = "fr_FR.UTF-8";
82 console.font = "Lat2-Terminus16";
83 console.keyMap = "fr";
84
85 networking = {
86 hostName = hostName;
87 domain = "localdomain";
88 search = [ "sourcephile.fr" ];
89 networkmanager = {
90 enable = true;
91 #dhcp = "dhcpcd";
92 logLevel = "INFO";
93 wifi = {
94 #backend = "iwd";
95 #backend = "wpa_supplicant";
96 powersave = false;
97 };
98 };
99 firewall = {
100 enable = true;
101 allowPing = false;
102 };
103 };
104
105 sound.enable = true;
106 hardware.pulseaudio.enable = true;
107 hardware.sane.enable = true;
108 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
109
110 environment.variables = {
111 EDITOR = "vim";
112 PAGER = "less -R";
113 SYSTEMD_LESS = "FKMRX";
114 };
115 environment.systemPackages = [
116 pkgs.mkpasswd
117 pkgs.gdb
118 ];
119
120 programs = {
121 bash = {
122 interactiveShellInit = ''
123 bind '"\e[A":history-search-backward'
124 bind '"\e[B":history-search-forward'
125
126 # Ignore duplicate commands, ignore commands starting with a space
127 export HISTCONTROL=erasedups:ignorespace
128 export HISTSIZE=42000
129 # Append to the history instead of overwriting (good for multiple connections)
130 shopt -s histappend
131
132 # Utilities
133 mkcd () { mkdir -p "$1"; cd "$1"; }
134 fan () {
135 if [ $# -gt 0 ]
136 then sudo tee /proc/acpi/ibm/fan <<<"level $1"
137 else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
138 fi
139 acpi -t
140 }
141 '';
142 shellAliases = {
143 cl = "clear";
144 grep = "grep --color";
145 l = "ls -alh";
146 ll = "ls -al";
147 ls = "ls --color=tty";
148 mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
149
150 s="sudo systemctl";
151 st="sudo systemctl status";
152 u="systemctl --user";
153 j="sudo journalctl -u";
154 jb="sudo journalctl -b";
155
156 nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
157 mv = "mv -i";
158 sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
159 };
160 };
161 dconf.enable = true;
162 mtr.enable = true;
163 };
164
165 services.avahi = {
166 enable = true;
167 nssmdns = true;
168 openFirewall = false;
169 publish = {
170 enable = false;
171 };
172 };
173 services.davfs2 = {
174 enable = true;
175 extraConfig = ''
176 '';
177 };
178 fileSystems."/home/julm/mnt/ilico/severine" = {
179 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
180 fsType = "davfs";
181 options =
182 let conf = pkgs.writeText "davfs2.conf" ''
183 backup_dir /home/julm/documents/backup/ilico/severine
184 cache_dir /home/julm/.cache/davfs2/ilico/severine
185 ''; in
186 [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
187 };
188 services.dbus = {
189 packages = [ pkgs.gnome3.dconf ];
190 };
191 services.gvfs = {
192 enable = true;
193 };
194 services.journald = {
195 extraConfig = ''
196 Compress=true
197 MaxRetentionSec=1month
198 Storage=persistent
199 SystemMaxUse=100M
200 '';
201 };
202 services.printing = {
203 enable = true;
204 drivers = [
205 pkgs.gutenprint
206 pkgs.hplip
207 ];
208 };
209 services.udev = {
210 packages = [
211 # Allow members of the "adbusers" group to mount Android devices via MTP
212 pkgs.android-udev-rules
213 ];
214 };
215 services.xserver = {
216 enable = true;
217 layout = "fr";
218 xkbOptions = "eurosign:e";
219 libinput.enable = true;
220 desktopManager = {
221 session = [
222 # Let the session be generated by home-manager
223 { name = "home-manager";
224 start = ''
225 ${pkgs.runtimeShell} $HOME/.hm-xsession &
226 waitPID=$!
227 '';
228 }
229 ];
230 };
231 displayManager = {
232 defaultSession = "home-manager";
233 #defaultSession = "none+xmonad";
234 autoLogin = {
235 enable = true;
236 user = users.julm.name;
237 };
238 };
239 };
240
241 systemd.coredump.enable = true;
242 #environment.enableDebugInfo = true;
243
244 # This value determines the NixOS release with which your system is to be
245 # compatible, in order to avoid breaking some software such as database
246 # servers. You should change this only after NixOS release notes say you should.
247 system.stateVersion = "20.09"; # Did you read the comment?
248 }