]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine.nix
aubergine: wireshark: enable
[julm/julm-nix.git] / hosts / aubergine.nix
1 { config, pkgs, lib, inputs, ... }:
2 {
3 imports = [
4 ../nixos/profiles/router.nix
5 #../nixos/profiles/debug.nix
6 ../nixos/profiles/lang-fr.nix
7 #../nixos/profiles/tor.nix
8 ../nixos/profiles/networking/remote.nix
9 aubergine/hardware.nix
10 aubergine/nebula.nix
11 aubergine/networking.nix
12 aubergine/nginx.nix
13 aubergine/backup.nix
14 aubergine/sftp.nix
15 ];
16
17 # Lower kernel's security for better performances
18 security.kernel.mitigations = "off";
19
20 home-manager.users.julm = {
21 imports = [ ../homes/julm.nix ];
22 };
23 users = {
24 users.julm = {
25 isNormalUser = true;
26 uid = 1000;
27 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
28 # which is already world readable.
29 # printf %s $(mkpasswd -m yescrypt)
30 hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
31 extraGroups = [
32 "adbusers"
33 "audio"
34 "dialout"
35 "networkmanager"
36 "tor"
37 "video"
38 "wheel"
39 "wireshark"
40 ];
41 createHome = true;
42 openssh.authorizedKeys.keys = map lib.readFile [
43 ../users/root/ssh/losurdo.pub
44 ../users/julm/ssh/losurdo.pub
45 ../users/julm/ssh/oignon.pub
46 ../users/julm/ssh/redmi.pub
47 ];
48 };
49 users.root = {
50 hashedPassword = "!";
51 openssh.authorizedKeys.keys =
52 config.users.users.julm.openssh.authorizedKeys.keys;
53 };
54 users.sevy = {
55 isNormalUser = true;
56 uid = 1001;
57 hashedPassword = "!";
58 extraGroups = [
59 ];
60 createHome = true;
61 openssh.authorizedKeys.keys = map lib.readFile [
62 ../users/sevy/ssh/patate.pub
63 ];
64 };
65 };
66
67 #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
68 # "secret-key-files:" + aubergine/nix/secret-key-files;
69 nix = {
70 extraOptions = ''
71 #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
72 '';
73 settings = {
74 substituters = [
75 #"http://nix-localcache.losurdo.wg"
76 #"ssh://nix-ssh@losurdo.wg?priority=30"
77 #"ssh://nix-ssh@oignon.wg?priority=30"
78 ];
79 trusted-public-keys = map lib.readFile [
80 ../users/root/nix/oignon.pub
81 ];
82 };
83 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
84 };
85 #environment.etc."nixpkgs".source = pkgs.path;
86 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
87
88 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
89 nix.sshServe = {
90 enable = true;
91 keys = map lib.readFile [
92 ../users/julm/ssh/losurdo.pub
93 ../users/sevy/ssh/patate.pub
94 ../users/julm/ssh/oignon.pub
95 ];
96 };
97
98 environment.systemPackages = [
99 ];
100
101 boot.extraModulePackages = [
102 #config.boot.kernelPackages.v4l2loopback
103 ];
104
105 # This value determines the NixOS release with which your system is to be
106 # compatible, in order to avoid breaking some software such as database
107 # servers. You should change this only after NixOS release notes say you should.
108 system.stateVersion = "22.11"; # Did you read the comment?
109 }