hosts/oignon.nix

   1 { config, pkgs, lib, inputs, private, hostName, ... }:
   2 let
   3   inherit (config.users) users;
   4   inherit (config.services) davfs2;
   5 in
   6 {
   7 imports = [
   8   ../profiles/dnscrypt-proxy2.nix
   9   ../profiles/security.nix
  10   ../networking/wireguard/wg-intra.nix
  11   oignon/hardware.nix
  12   oignon/openvpn.nix
  13   oignon/wireguard.nix
  14   oignon/tor.nix
  15   oignon/backup.nix
  16 ];
  17
  18 home-manager.users.julm = {
  19   imports = [
  20     ../homes/julm.nix
  21     inputs.nix-doom-emacs.hmModule
  22   ];
  23   host.hardware = ["ThinkPad" "X201"];
  24 };
  25 systemd.services.home-manager-julm.postStart = ''
  26   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
  27 '';
  28 security.lockKernelModules = false;
  29 users.mutableUsers = false;
  30 users.users.julm = {
  31   isNormalUser = true;
  32   uid = 1000;
  33   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  34   # which is already world readable.
  35   hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
  36   extraGroups = [
  37     "adbusers"
  38     "lp"
  39     "networkmanager"
  40     "scanner"
  41     "tor"
  42     "video"
  43     "wheel"
  44     #"ipfs"
  45     davfs2.davGroup
  46     #"vboxusers"
  47   ];
  48   # If created, zfs-mount.service would require:
  49   # zfs set overlay=yes ${hostName}/home
  50   createHome = false;
  51 };
  52
  53 nix = {
  54   extraOptions = ''
  55     secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
  56   '';
  57   autoOptimiseStore = true;
  58   gc = {
  59     automatic = true;
  60     dates = "weekly";
  61     options = "--delete-older-than 7d";
  62   };
  63   nixPath = [
  64     "nixpkgs=/etc/nixpkgs"
  65     "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix"
  66   ];
  67   trustedUsers = [ users.julm.name ];
  68   binaryCaches = [ "http://nix-localcache.losurdo.wg" ];
  69   binaryCachePublicKeys = [ "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los=" ];
  70 };
  71 documentation = {
  72   enable = true;
  73   dev.enable = true;
  74   doc.enable = true;
  75   info.enable = false;
  76   man.enable = true;
  77   nixos.enable = false;
  78 };
  79 nix.sshServe = {
  80   enable = true;
  81   keys = [ (lib.readFile ../private/world/julm/losurdo/ssh.pub) ];
  82 };
  83 users.users.julm.openssh.authorizedKeys.keys = [
  84   (lib.readFile ../private/world/julm/losurdo/ssh.pub)
  85 ];
  86 services.openssh.openFirewall = false;
  87 services.openssh.forwardX11 = true;
  88 services.openssh.passwordAuthentication = false;
  89
  90 nixpkgs.config.allowUnfree = true;
  91 environment.etc."nixpkgs".source = pkgs.path;
  92 environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  93
  94 time.timeZone = "Europe/Paris";
  95 i18n.defaultLocale = "fr_FR.UTF-8";
  96 console.font = "Lat2-Terminus16";
  97 console.keyMap = "fr";
  98
  99 networking = {
 100   hostName = hostName;
 101   domain = "localdomain";
 102   search = [ "sourcephile.fr" ];
 103   networkmanager = {
 104     enable = true;
 105     #dhcp = "dhcpcd";
 106     logLevel = "INFO";
 107     wifi = {
 108       #backend = "iwd";
 109       #backend = "wpa_supplicant";
 110       powersave = false;
 111     };
 112   };
 113   firewall = {
 114     enable = true;
 115     allowPing = false;
 116   };
 117 };
 118
 119 sound.enable = true;
 120 hardware.pulseaudio.enable = true;
 121 hardware.sane.enable = true;
 122 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
 123
 124 environment.variables = {
 125   EDITOR = "vim";
 126   PAGER  = "less -R";
 127   SYSTEMD_LESS = "FKMRX";
 128 };
 129 environment.systemPackages = [
 130   pkgs.mkpasswd
 131   pkgs.gdb
 132 ];
 133
 134 programs = {
 135   bash = {
 136     interactiveShellInit = ''
 137       bind '"\e[A":history-search-backward'
 138       bind '"\e[B":history-search-forward'
 139
 140       # Ignore duplicate commands, ignore commands starting with a space
 141       export HISTCONTROL=erasedups:ignorespace
 142       export HISTSIZE=42000
 143       # Append to the history instead of overwriting (good for multiple connections)
 144       shopt -s histappend
 145
 146       # Utilities
 147       mkcd () { mkdir -p "$1"; cd "$1"; }
 148       fan () {
 149         if [ $# -gt 0 ]
 150         then sudo tee /proc/acpi/ibm/fan <<<"level $1"
 151         else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
 152         fi
 153         acpi -t
 154       }
 155     '';
 156     shellAliases = {
 157       cl = "clear";
 158       grep = "grep --color";
 159       l  = "ls -alh";
 160       ll = "ls -al";
 161       ls = "ls --color=tty";
 162       mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
 163
 164       s="sudo systemctl";
 165       st="sudo systemctl status";
 166       u="systemctl --user";
 167       j="sudo journalctl -u";
 168       jb="sudo journalctl -b";
 169
 170       nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 171       mv = "mv -i";
 172       sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
 173     };
 174   };
 175   dconf.enable = true;
 176   mtr.enable = true;
 177 };
 178
 179 services.avahi = {
 180   enable = true;
 181   nssmdns = true;
 182   openFirewall = false;
 183   publish = {
 184     enable = false;
 185   };
 186 };
 187 services.davfs2 = {
 188   enable = true;
 189   extraConfig = ''
 190   '';
 191 };
 192 fileSystems."/home/julm/mnt/ilico/severine" = {
 193   device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
 194   fsType = "davfs";
 195   options =
 196     let conf = pkgs.writeText "davfs2.conf" ''
 197       backup_dir /home/julm/documents/backup/ilico/severine
 198       cache_dir /home/julm/.cache/davfs2/ilico/severine
 199     ''; in
 200     [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
 201 };
 202 services.dbus = {
 203   packages = [ pkgs.gnome3.dconf ];
 204 };
 205 services.gvfs = {
 206   enable = true;
 207 };
 208 services.ipfs = {
 209   #enable = true;
 210   defaultMode = "online";
 211   autoMount = true;
 212   enableGC = true;
 213   localDiscovery = false;
 214   extraConfig = {
 215     Datastore.StorageMax = "10GB";
 216     Discovery.MDNS.Enabled = false;
 217     #Bootstrap = [
 218     #];
 219     #Swarm.AddrFilters = null;
 220   };
 221   startWhenNeeded = true;
 222 };
 223 services.journald = {
 224   extraConfig = ''
 225     Compress=true
 226     MaxRetentionSec=1month
 227     Storage=persistent
 228     SystemMaxUse=100M
 229   '';
 230 };
 231 services.printing = {
 232   enable = true;
 233   drivers = [
 234     pkgs.gutenprint
 235     pkgs.hplip
 236   ];
 237 };
 238 services.udev = {
 239   packages = [
 240     # Allow members of the "adbusers" group to mount Android devices via MTP.
 241     pkgs.android-udev-rules
 242     # Allow the console user access the Yubikey USB device node,
 243     # needed for challenge/response to work correctly.
 244     pkgs.yubikey-personalization
 245   ];
 246 };
 247 services.xserver = {
 248   enable = true;
 249   layout = "fr";
 250   xkbOptions = "eurosign:e";
 251   libinput.enable = true;
 252   desktopManager = {
 253     session = [
 254       # Let the session be generated by home-manager
 255       { name = "home-manager";
 256         start = ''
 257           ${pkgs.runtimeShell} $HOME/.hm-xsession &
 258           waitPID=$!
 259         '';
 260       }
 261     ];
 262   };
 263   displayManager = {
 264     defaultSession = "home-manager";
 265     #defaultSession = "none+xmonad";
 266     autoLogin = {
 267       enable = true;
 268       user = users.julm.name;
 269     };
 270   };
 271 };
 272
 273 systemd.coredump.enable = true;
 274 #environment.enableDebugInfo = true;
 275
 276 # This value determines the NixOS release with which your system is to be
 277 # compatible, in order to avoid breaking some software such as database
 278 # servers. You should change this only after NixOS release notes say you should.
 279 system.stateVersion = "20.09"; # Did you read the comment?
 280 }