hosts/patate.nix

   1 { config, pkgs, lib, inputs, hostName, ... }:
   2 let inherit (config.users) users; in
   3 {
   4 imports = [
   5   ../profiles/dnscrypt-proxy2.nix
   6   ../profiles/security.nix
   7   ../networking/wireguard/wg-intra.nix
   8   patate/backup.nix
   9   patate/hardware.nix
  10 ];
  11
  12 home-manager.users.sevy = {
  13   imports = [ ../homes/sevy.nix ];
  14   host.hardware = ["ThinkPad" "X200"];
  15 };
  16 systemd.services.home-manager-julm.postStart = ''
  17   ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  18 '';
  19 security.lockKernelModules = false;
  20 users.mutableUsers = false;
  21 users.users.sevy = {
  22   isNormalUser = true;
  23   uid = 1000;
  24   # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  25   # which is already world readable.
  26   hashedPassword = lib.readFile ../private/world/sevy/hashedPassword;
  27   extraGroups = [
  28     "adbusers"
  29     config.services.davfs2.davGroup
  30     "lp"
  31     "networkmanager"
  32     "scanner"
  33     "systemd-journal"
  34     "tor"
  35     "vboxusers"
  36     "video"
  37     "wheel"
  38   ];
  39 };
  40
  41 nix = {
  42   extraOptions = ''
  43   '';
  44   autoOptimiseStore = true;
  45   gc = {
  46     automatic = true;
  47     dates = "weekly";
  48     options = "--delete-older-than 7d";
  49   };
  50   nixPath = [
  51     "nixpkgs=/etc/nixpkgs"
  52     "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix"
  53   ];
  54   trustedUsers = [ users.sevy.name ];
  55   binaryCaches = [
  56     "http://nix-localcache.losurdo.wg"
  57     "ssh://nix-ssh@oignon.wg"
  58   ];
  59   binaryCachePublicKeys = [
  60     "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los="
  61     "oignon.sourcephile.fr:slxL7XLsGXlD1r6gvw1imL5uQntW0TTlQgGQt3LBJgQ="
  62   ];
  63 };
  64 services.openssh.passwordAuthentication = false;
  65
  66 nixpkgs.config = {
  67   allowUnfree = true;
  68 };
  69 environment.etc."nixpkgs".source = pkgs.path;
  70 environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
  71 environment.systemPackages = [
  72   pkgs.riseup-vpn
  73 ];
  74
  75 documentation.nixos.enable = true;
  76 time.timeZone = "Europe/Paris";
  77 i18n.defaultLocale = "fr_FR.UTF-8";
  78 console.font = "Lat2-Terminus16";
  79 console.keyMap = "fr";
  80
  81 networking = {
  82   hostName = hostName;
  83   domain = "localdomain";
  84   networkmanager = {
  85     enable = true;
  86     #dhcp = "dhcpcd";
  87     logLevel = "INFO";
  88     wifi = {
  89       #backend = "iwd";
  90       #backend = "wpa_supplicant";
  91       powersave = false;
  92     };
  93   };
  94   firewall = {
  95     enable = true;
  96     allowPing = false;
  97     allowedTCPPorts = [
  98       51413 # transmission-gtk
  99       4662 # edonkey
 100     ];
 101     allowedUDPPorts = [
 102       51413 # transmission-gtk
 103       4667 # edonkey
 104       4672 # edonkey
 105     ];
 106   };
 107 };
 108
 109 sound.enable = true;
 110 hardware.pulseaudio.enable = true;
 111 hardware.sane.enable = true;
 112 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
 113
 114 environment.variables = {
 115   EDITOR = "vim -g";
 116   PAGER  = "less -R";
 117   SYSTEMD_LESS = "FKMRX";
 118 };
 119
 120 programs = {
 121   bash = {
 122     interactiveShellInit = ''
 123       bind '"\e[A":history-search-backward'
 124       bind '"\e[B":history-search-forward'
 125
 126       # Ignore duplicate commands, ignore commands starting with a space
 127       export HISTCONTROL=erasedups:ignorespace
 128       export HISTSIZE=42000
 129       # Append to the history instead of overwriting (good for multiple connections)
 130       shopt -s histappend
 131
 132       # Utilities
 133       mkcd () { mkdir -p "$1"; cd "$1"; }
 134       fan () {
 135         if [ $# -gt 0 ]
 136         then sudo tee /proc/acpi/ibm/fan <<<"level $1"
 137         else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
 138         fi
 139         acpi -t
 140       }
 141     '';
 142     shellAliases = {
 143       cl = "clear";
 144       grep = "grep --color";
 145       l  = "ls -alh";
 146       ll = "ls -al";
 147       ls = "ls --color=tty";
 148       mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
 149
 150       s="sudo systemctl";
 151       st="sudo systemctl status";
 152       u="systemctl --user";
 153       j="sudo journalctl -u";
 154       jb="sudo journalctl -b";
 155
 156       nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 157       mv = "mv -i";
 158       sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
 159     };
 160   };
 161   dconf.enable = true;
 162   mtr.enable = true;
 163 };
 164
 165 services.avahi = {
 166   enable  = true;
 167   nssmdns = true;
 168   openFirewall = false;
 169   publish = {
 170     enable = false;
 171   };
 172 };
 173 services.davfs2 = {
 174   enable = true;
 175   extraConfig = ''
 176   '';
 177 };
 178 fileSystems."/home/sevy/mnt/ilico/severine" = {
 179   device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
 180   fsType = "davfs";
 181   options =
 182     let conf = pkgs.writeText "davfs2.conf" ''
 183       backup_dir /home/sevy/Documents/EnTransfert/ilico/severine
 184       cache_dir /home/sevy/.cache/davfs2/ilico/severine
 185     ''; in
 186     [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
 187 };
 188 services.dbus = {
 189   packages = [ pkgs.gnome3.dconf ];
 190 };
 191 services.gvfs = {
 192   enable = true;
 193 };
 194 services.journald = {
 195   extraConfig = ''
 196     Compress=true
 197     MaxRetentionSec=1month
 198     Storage=persistent
 199     SystemMaxUse=100M
 200   '';
 201 };
 202 services.physlock = {
 203   enable = true;
 204   allowAnyUser = true;
 205   # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
 206 };
 207 services.printing = {
 208   enable = true;
 209   drivers = [
 210     pkgs.gutenprint
 211     pkgs.hplip
 212   ];
 213 };
 214 services.udev = {
 215   packages = [
 216     # Allow members of the "adbusers" group to mount Android devices via MTP
 217     pkgs.android-udev-rules
 218   ];
 219 };
 220 services.xserver = {
 221   enable = true;
 222   layout = "fr";
 223   xkbOptions = "eurosign:e";
 224   libinput.enable = true;
 225   desktopManager = {
 226     xfce = {
 227       enable = true;
 228       thunarPlugins = [
 229         #pkgs.xfce.thunar-archive-plugin
 230       ];
 231     };
 232     xterm.enable = false;
 233   };
 234   displayManager = {
 235     defaultSession = "xfce";
 236     autoLogin = {
 237       enable = true;
 238       user = users.sevy.name;
 239     };
 240   };
 241 };
 242
 243 virtualisation.virtualbox.host.enable = true;
 244
 245 # This value determines the NixOS release with which your system is to be
 246 # compatible, in order to avoid breaking some software such as database
 247 # servers. You should change this only after NixOS release notes say you should.
 248 system.stateVersion = "20.03"; # Did you read the comment?
 249 }