]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
julm: oignon: marble: install
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, inputs, hostName, ... }:
2 {
3 imports = [
4 ../nixos/profiles/builder.nix
5 ../nixos/profiles/debug.nix
6 ../nixos/profiles/graphical.nix
7 ../nixos/profiles/irssi.nix
8 ../nixos/profiles/lang-fr.nix
9 ../nixos/profiles/printing.nix
10 ../nixos/profiles/radio.nix
11 ../nixos/profiles/tor.nix
12 oignon/backup.nix
13 oignon/hardware.nix
14 oignon/networking.nix
15 ];
16
17 # Lower kernel's security for better performances
18 boot.kernelParams = [ "mitigations=off" ];
19
20 home-manager.users.julm = {
21 imports = [ ../homes/julm.nix ];
22 };
23 users.users.root = {
24 openssh.authorizedKeys.keys = map lib.readFile [
25 # For nix -L run .#oignon.switch
26 ../users/julm/ssh/oignon.pub
27 ];
28 };
29 users.users.julm = {
30 isNormalUser = true;
31 uid = 1000;
32 # Put the hashedPassword in /nix/store,
33 # though /etc/shadow is not world readable...
34 # printf %s $(mkpasswd -m md5crypt)
35 hashedPassword = lib.readFile oignon/users/julm/login/hashedPassword.clear;
36 extraGroups = [
37 "adbusers"
38 "dialout"
39 "lp"
40 "networkmanager"
41 "plugdev" # For rtl-sdr
42 "scanner"
43 "tor"
44 "video"
45 "wheel"
46 #"ipfs"
47 config.services.davfs2.davGroup
48 #"vboxusers"
49 ];
50 # If created, zfs-mount.service would require:
51 # zfs set overlay=yes ${hostName}/home
52 createHome = false;
53 openssh.authorizedKeys.keys = map lib.readFile [
54 ../users/julm/ssh/losurdo.pub
55 ];
56 };
57
58 systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
59 [ ("${hostName}.key:${inputs.self}/hosts/${hostName}/nix/secret-key-files.priv.pem.cred") ];
60 nix = {
61 extraOptions = ''
62 secret-key-files = /run/credentials/nix-daemon.service/${hostName}.key
63 '';
64 settings = {
65 substituters = [
66 #"http://nix-localcache.losurdo.wg"
67 "ssh://nix-ssh@losurdo.wg?priority=30"
68 ];
69 trusted-public-keys = map lib.readFile [
70 ../users/nix/ssh/losurdo.pub
71 ];
72 };
73 nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
74 };
75 #environment.etc."nixpkgs".source = pkgs.path;
76 #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
77
78 nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
79 nix.sshServe = {
80 enable = true;
81 keys = map lib.readFile [
82 ../users/julm/ssh/losurdo.pub
83 ../users/julm/ssh/oignon.pub
84 ../users/sevy/ssh/patate.pub
85 ];
86 };
87
88 environment.systemPackages = [
89 pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
90 ];
91
92 boot.extraModulePackages = [
93 #config.boot.kernelPackages.v4l2loopback
94 ];
95
96 programs.fuse.userAllowOther = true;
97
98 services.davfs2.enable = true;
99
100 systemd.automounts = [
101 { where = "/mnt/aubergine"; automountConfig.TimeoutIdleSec = "5 min"; }
102 ];
103 fileSystems =
104 let
105 # Use the user's gpg-agent session to query
106 # for the password of the SSH key when auto-mounting.
107 sshAsUser =
108 pkgs.writeScript "sshAsUser" ''
109 user="$1"; shift
110 exec ${pkgs.sudo}/bin/sudo -i -u "$user" \
111 ${pkgs.openssh}/bin/ssh "$@"
112 '';
113 options =
114 [
115 "user"
116 "uid=julm"
117 "gid=users"
118 "allow_other"
119 "exec" # Override "user"'s noexec
120 "noatime"
121 "nosuid"
122 "_netdev"
123 "ssh_command=${sshAsUser}\\040julm"
124 "noauto"
125 "x-gvfs-hide"
126 "x-systemd.automount"
127 #"Compression=yes" # YMMV
128 # Disconnect approximately 2*15=30 seconds after a network failure
129 "ServerAliveCountMax=1"
130 "ServerAliveInterval=15"
131 "dir_cache=no"
132 #"reconnect"
133 ];
134 in
135 {
136 "/mnt/aubergine" = {
137 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@aubergine.wg:/";
138 fsType = "fuse";
139 inherit options;
140 };
141 "/mnt/losurdo" = {
142 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@losurdo.wg:/";
143 fsType = "fuse";
144 inherit options;
145 };
146 "/mnt/mermet" = {
147 device = "${pkgs.sshfs-fuse}/bin/sshfs#julm@mermet.wg:/";
148 fsType = "fuse";
149 inherit options;
150 };
151 "/mnt/ilico/severine" = {
152 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
153 fsType = "davfs";
154 options =
155 let
156 conf = pkgs.writeText "davfs2.conf" ''
157 backup_dir /home/julm/.local/share/davfs2/ilico/severine
158 secrets /home/julm/.davfs2/secrets
159 '';
160 in
161 [
162 "conf=${conf}"
163 "user"
164 "noexec"
165 "nosuid"
166 "noauto"
167 "nofail"
168 "_netdev"
169 "reconnect"
170 "x-systemd.automount"
171 "x-systemd.device-timeout=1m"
172 "x-systemd.idle-timeout=1m"
173 "x-systemd.mount-timeout=10s"
174 ];
175 };
176 };
177
178 networking.firewall.extraCommands = ''
179 ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 8000 -j ACCEPT
180 '';
181
182 services.kubo = {
183 #enable = true;
184 defaultMode = "online";
185 autoMount = true;
186 enableGC = true;
187 localDiscovery = false;
188 settings = {
189 Datastore.StorageMax = "10GB";
190 Discovery.MDNS.Enabled = false;
191 #Bootstrap = [
192 #];
193 #Swarm.AddrFilters = null;
194 };
195 startWhenNeeded = true;
196 };
197
198 services.udev.packages = [
199 # Allow the console user access the Yubikey USB device node,
200 # needed for challenge/response to work correctly.
201 pkgs.yubikey-personalization
202 ];
203
204 services.xserver = {
205 layout = "fr,us(altgr-intl)";
206 desktopManager = {
207 session = [
208 # Let the session be generated by home-manager
209 {
210 name = "home-manager";
211 start = ''
212 ${pkgs.runtimeShell} $HOME/.hm-xsession &
213 waitPID=$!
214 '';
215 }
216 ];
217 };
218 displayManager = {
219 defaultSession = "home-manager";
220 #defaultSession = "none+xmonad";
221 #defaultSession = "mate";
222 #defaultSession = "cinnamon";
223 autoLogin = {
224 user = config.users.users.julm.name;
225 };
226 };
227 };
228
229 # This value determines the NixOS release with which your system is to be
230 # compatible, in order to avoid breaking some software such as database
231 # servers. You should change this only after NixOS release notes say you should.
232 system.stateVersion = "20.09"; # Did you read the comment?
233 }