nixos/profiles/system.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   inputs,
   6   ...
   7 }:
   8 with lib;
   9 {
  10   boot.tmp.cleanOnBoot = mkDefault true;
  11   boot.tmp.useTmpfs = mkDefault true;
  12   boot.tmp.tmpfsHugeMemoryPages = mkDefault "within_size";
  13   fileSystems = mkIf config.boot.tmp.useTmpfs {
  14     # NIX_STATE_DIR, where nix (>= 2.30) builds.
  15     "/nix/var/nix/builds" = {
  16       fsType = "tmpfs";
  17       options = [
  18         #"mode=755"
  19         "nosuid"
  20         "nodev"
  21         "rw"
  22         "size=${toString config.boot.tmp.tmpfsSize}"
  23         "huge=${config.boot.tmp.tmpfsHugeMemoryPages}"
  24       ];
  25     };
  26   };
  27
  28   services.logrotate.enable = true;
  29   # NOTE: mostly useless on a server, and CPU intensive.
  30   documentation = {
  31     enable = mkDefault true;
  32     dev.enable = mkDefault false;
  33     doc.enable = mkDefault true;
  34     info.enable = mkDefault false;
  35     man.enable = mkDefault true;
  36     nixos.enable = mkDefault false;
  37   };
  38   programs.ssh.systemd-ssh-proxy.enable = true;
  39   programs.vim.defaultEditor = mkDefault true;
  40   programs.vim.enable = mkDefault true;
  41   environment.variables = {
  42     EDITOR = "vim";
  43     NIXPKGS_CONFIG = mkForce "";
  44     PAGER = "less -R";
  45     SYSTEMD_LESS = "FKMRX";
  46     # Setting TZ= avoids a lot of useless syscalls reading /etc/localtime
  47     # but requires to restart the session to change the time zone for all programs.
  48     TZ = lib.mkDefault (if config.time.timeZone != null then config.time.timeZone else "Europe/Paris");
  49   };
  50   home-manager.users.root = {
  51     imports = [
  52       ../../home-manager/options.nix
  53       ../../home-manager/profiles/essential.nix
  54     ];
  55     services.gpg-agent.pinentry.package = pkgs.pinentry-curses;
  56   };
  57   nix = {
  58     settings.auto-optimise-store = mkDefault true;
  59     gc.automatic = mkDefault true;
  60     gc.dates = mkDefault "weekly";
  61     gc.options = mkDefault "--delete-older-than 7d";
  62     package = pkgs.nixVersions.stable;
  63     settings.experimental-features = [
  64       "nix-command"
  65       "flakes"
  66     ];
  67   };
  68   nixpkgs.flake = {
  69     # ExplanationNote: avoid the NixOS closure
  70     # to depend on the nixpkgs sources,
  71     # which adds useless closure size
  72     # for systems where nix commands are not run.
  73     setNixPath = lib.mkDefault false;
  74     setFlakeRegistry = lib.mkDefault false;
  75   };
  76   security.lockKernelModules = false;
  77   services.journald = {
  78     extraConfig = ''
  79       Compress=true
  80       MaxRetentionSec=1month
  81       Storage=persistent
  82       SystemMaxUse=100M
  83     '';
  84   };
  85   # none is the recommended elevator for SSD, whereas HDD could use mq-deadline.
  86   services.udev.extraRules = ''
  87     ACTION=="add|change", KERNEL=="sd[a-z][0-9]*", ATTR{../queue/rotational}=="0", ATTR{../queue/scheduler}="none"
  88     ACTION=="add|change", KERNEL=="nvme[0-9]*n[0-9]*p[0-9]*", ATTR{../queue/rotational}=="0", ATTR{../queue/scheduler}="none"
  89   '';
  90   systemd.oomd = {
  91     enable = mkDefault true;
  92     enableRootSlice = mkDefault true;
  93     enableSystemSlice = mkDefault true;
  94     enableUserSlices = mkDefault true;
  95   };
  96   systemd.services.sshd = {
  97     serviceConfig = {
  98       ManagedOOMPreference = "omit";
  99     };
 100   };
 101   /*
 102     system.nixos.versionSuffix = ".${
 103     substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
 104     inputs.self.shortRev or "dirty"}";
 105     system.nixos.revision = mkIf (inputs.self ? rev) inputs.self.rev;
 106   */
 107   # Let 'nixos-version --json' know about the Git revision of this flake.
 108   system.configurationRevision = mkIf (inputs.self ? rev) inputs.self.rev;
 109   /*
 110     system.configurationRevision =
 111     if inputs.self ? rev
 112     then inputs.self.rev
 113     else throw "Refusing to build from a dirty Git tree!";
 114   */
 115   users.mutableUsers = false;
 116 }