nixos/profiles/system.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   inputs,
   6   ...
   7 }:
   8 {
   9   imports = [
  10     ./systemd-oomd.nix
  11     ./zswap.nix
  12   ];
  13   boot.tmp.cleanOnBoot = lib.mkDefault true;
  14   boot.tmp.useTmpfs = lib.mkDefault true;
  15   boot.tmp.tmpfsHugeMemoryPages = lib.mkDefault "within_size";
  16   fileSystems = lib.mkIf config.boot.tmp.useTmpfs {
  17     # NIX_STATE_DIR, where nix (>= 2.30) builds.
  18     "/nix/var/nix/builds" = {
  19       fsType = "tmpfs";
  20       options = [
  21         #"mode=755"
  22         "nosuid"
  23         "nodev"
  24         "rw"
  25         "size=${toString config.boot.tmp.tmpfsSize}"
  26         "huge=${config.boot.tmp.tmpfsHugeMemoryPages}"
  27       ];
  28     };
  29   };
  30
  31   services.logrotate.enable = true;
  32   # NOTE: mostly useless on a server, and CPU intensive.
  33   documentation = {
  34     enable = lib.mkDefault true;
  35     dev.enable = lib.mkDefault false;
  36     doc.enable = lib.mkDefault true;
  37     info.enable = lib.mkDefault false;
  38     man.enable = lib.mkDefault true;
  39     nixos.enable = lib.mkDefault false;
  40   };
  41   programs.ssh.systemd-ssh-proxy.enable = true;
  42   programs.vim.defaultEditor = lib.mkDefault true;
  43   programs.vim.enable = lib.mkDefault true;
  44   environment.variables = {
  45     EDITOR = "vi";
  46     NIXPKGS_CONFIG = lib.mkForce "";
  47     PAGER = "less -R";
  48     SYSTEMD_LESS = "FKMRX";
  49     # Setting TZ= avoids a lot of useless syscalls reading /etc/localtime
  50     # but requires to restart the session to change the time zone for all programs.
  51     TZ = lib.mkDefault (if config.time.timeZone != null then config.time.timeZone else "Europe/Paris");
  52   };
  53   home-manager.users.root = {
  54     imports = [
  55       ../../home-manager/options.nix
  56       ../../home-manager/profiles/essential.nix
  57     ];
  58     services.gpg-agent.pinentry.package = pkgs.pinentry-curses;
  59   };
  60   nix = {
  61     settings.auto-optimise-store = lib.mkDefault true;
  62     gc.automatic = lib.mkDefault true;
  63     gc.dates = lib.mkDefault "weekly";
  64     gc.options = lib.mkDefault "--delete-older-than 7d";
  65     package = pkgs.nixVersions.stable;
  66     settings.experimental-features = [
  67       "nix-command"
  68       "flakes"
  69     ];
  70   };
  71   nixpkgs.flake = {
  72     # Explanation(perf): avoid the NixOS closure
  73     # to depend on the nixpkgs sources,
  74     # which adds useless closure size
  75     # for systems where nix commands are not run.
  76     setNixPath = lib.mkDefault false;
  77     setFlakeRegistry = lib.mkDefault false;
  78   };
  79   security.lockKernelModules = false;
  80   services.journald = {
  81     extraConfig = ''
  82       Compress=true
  83       MaxRetentionSec=1month
  84       Storage=persistent
  85       SystemMaxUse=100M
  86     '';
  87   };
  88   # none is the recommended elevator for SSD, whereas HDD could use mq-deadline.
  89   services.udev.extraRules = ''
  90     ACTION=="add|change", KERNEL=="sd[a-z][0-9]*", ATTR{../queue/rotational}=="0", ATTR{../queue/scheduler}="none"
  91     ACTION=="add|change", KERNEL=="nvme[0-9]*n[0-9]*p[0-9]*", ATTR{../queue/rotational}=="0", ATTR{../queue/scheduler}="none"
  92   '';
  93
  94   systemd.services.sshd = {
  95     serviceConfig = {
  96       ManagedOOMPreference = "omit";
  97     };
  98   };
  99   /*
 100     system.nixos.versionSuffix = ".${
 101     substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
 102     inputs.self.shortRev or "dirty"}";
 103     system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
 104   */
 105   # Let 'nixos-version --json' know about the Git revision of this flake.
 106   system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
 107   /*
 108     system.configurationRevision =
 109     if inputs.self ? rev
 110     then inputs.self.rev
 111     else throw "Refusing to build from a dirty Git tree!";
 112   */
 113   users.mutableUsers = false;
 114 }