]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/oignon.nix
nix: update nixpkgs
[julm/julm-nix.git] / hosts / oignon.nix
1 { config, pkgs, lib, inputs, private, hostName, ... }:
2 let
3 inherit (config.users) users;
4 inherit (config.services) davfs2;
5 in
6 {
7 imports = [
8 ../profiles/dnscrypt-proxy2.nix
9 ../profiles/security.nix
10 ../networking/wireguard/wg-intra.nix
11 oignon/hardware.nix
12 oignon/openvpn.nix
13 oignon/wireguard.nix
14 oignon/tor.nix
15 oignon/backup.nix
16 ];
17
18 home-manager.users.julm = {
19 imports = [
20 ../homes/julm.nix
21 inputs.nix-doom-emacs.hmModule
22 ];
23 host.hardware = ["ThinkPad" "X201"];
24 };
25 systemd.services.home-manager-julm.postStart = ''
26 ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
27 '';
28 security.lockKernelModules = false;
29 users.mutableUsers = false;
30 users.users.julm = {
31 isNormalUser = true;
32 uid = 1000;
33 # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
34 # which is already world readable.
35 hashedPassword = lib.readFile ../private/world/julm/hashedPassword;
36 extraGroups = [
37 "adbusers"
38 "lp"
39 "networkmanager"
40 "scanner"
41 "tor"
42 "video"
43 "wheel"
44 #"ipfs"
45 davfs2.davGroup
46 #"vboxusers"
47 ];
48 # If created, zfs-mount.service would require:
49 # zfs set overlay=yes ${hostName}/home
50 createHome = false;
51 };
52
53 nix = {
54 extraOptions = ''
55 secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem
56 '';
57 autoOptimiseStore = true;
58 gc = {
59 automatic = true;
60 dates = "weekly";
61 options = "--delete-older-than 7d";
62 };
63 nixPath = [
64 "nixpkgs=/etc/nixpkgs"
65 "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix"
66 ];
67 trustedUsers = [ users.julm.name ];
68 binaryCaches = [ "http://nix-localcache.losurdo.wg" ];
69 binaryCachePublicKeys = [ "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los=" ];
70 };
71 documentation = {
72 enable = true;
73 dev.enable = true;
74 doc.enable = true;
75 info.enable = false;
76 man.enable = true;
77 nixos.enable = false;
78 };
79 nix.sshServe = {
80 enable = true;
81 keys = [ (lib.readFile ../private/world/julm/losurdo/ssh.pub) ];
82 };
83 users.users.julm.openssh.authorizedKeys.keys = [
84 (lib.readFile ../private/world/julm/losurdo/ssh.pub)
85 ];
86 services.openssh.openFirewall = false;
87 services.openssh.forwardX11 = true;
88 services.openssh.passwordAuthentication = false;
89
90 nixpkgs.config.allowUnfree = true;
91 environment.etc."nixpkgs".source = pkgs.path;
92 environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";
93
94 time.timeZone = "Europe/Paris";
95 i18n.defaultLocale = "fr_FR.UTF-8";
96 console.font = "Lat2-Terminus16";
97 console.keyMap = "fr";
98
99 networking = {
100 hostName = hostName;
101 domain = "localdomain";
102 search = [ "sourcephile.fr" ];
103 networkmanager = {
104 enable = true;
105 #dhcp = "dhcpcd";
106 logLevel = "INFO";
107 wifi = {
108 #backend = "iwd";
109 #backend = "wpa_supplicant";
110 powersave = false;
111 };
112 };
113 firewall = {
114 enable = true;
115 allowPing = false;
116 };
117 };
118
119 sound.enable = true;
120 hardware.pulseaudio.enable = true;
121 hardware.sane.enable = true;
122 hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ];
123
124 environment.variables = {
125 EDITOR = "vim";
126 PAGER = "less -R";
127 SYSTEMD_LESS = "FKMRX";
128 };
129 environment.systemPackages = [
130 pkgs.mkpasswd
131 pkgs.gdb
132 ];
133
134 programs = {
135 bash = {
136 interactiveShellInit = ''
137 bind '"\e[A":history-search-backward'
138 bind '"\e[B":history-search-forward'
139
140 # Ignore duplicate commands, ignore commands starting with a space
141 export HISTCONTROL=erasedups:ignorespace
142 export HISTSIZE=42000
143 # Append to the history instead of overwriting (good for multiple connections)
144 shopt -s histappend
145
146 # Utilities
147 mkcd () { mkdir -p "$1"; cd "$1"; }
148 fan () {
149 if [ $# -gt 0 ]
150 then sudo tee /proc/acpi/ibm/fan <<<"level $1"
151 else grep '^\(level\|speed\):' /proc/acpi/ibm/fan
152 fi
153 acpi -t
154 }
155 '';
156 shellAliases = {
157 cl = "clear";
158 grep = "grep --color";
159 l = "ls -alh";
160 ll = "ls -al";
161 ls = "ls --color=tty";
162 mem = "ps -e -orss=,user=,args= | sort -b -k1,1n";
163
164 s="sudo systemctl";
165 st="sudo systemctl status";
166 u="systemctl --user";
167 j="sudo journalctl -u";
168 jb="sudo journalctl -b";
169
170 nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
171 mv = "mv -i";
172 sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f";
173 };
174 };
175 dconf.enable = true;
176 mtr.enable = true;
177 };
178
179 services.avahi = {
180 enable = true;
181 nssmdns = true;
182 openFirewall = false;
183 publish = {
184 enable = false;
185 };
186 };
187 services.davfs2 = {
188 enable = true;
189 extraConfig = ''
190 '';
191 };
192 fileSystems."/home/julm/mnt/ilico/severine" = {
193 device = "https://nuage.ilico.org/remote.php/dav/files/severine/";
194 fsType = "davfs";
195 options =
196 let conf = pkgs.writeText "davfs2.conf" ''
197 backup_dir /home/julm/documents/backup/ilico/severine
198 cache_dir /home/julm/.cache/davfs2/ilico/severine
199 ''; in
200 [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount"
201 };
202 services.dbus = {
203 packages = [ pkgs.gnome3.dconf ];
204 };
205 services.gvfs = {
206 enable = true;
207 };
208 services.ipfs = {
209 #enable = true;
210 defaultMode = "online";
211 autoMount = true;
212 enableGC = true;
213 localDiscovery = false;
214 extraConfig = {
215 Datastore.StorageMax = "10GB";
216 Discovery.MDNS.Enabled = false;
217 #Bootstrap = [
218 #];
219 #Swarm.AddrFilters = null;
220 };
221 startWhenNeeded = true;
222 };
223 services.journald = {
224 extraConfig = ''
225 Compress=true
226 MaxRetentionSec=1month
227 Storage=persistent
228 SystemMaxUse=100M
229 '';
230 };
231 services.printing = {
232 enable = true;
233 drivers = [
234 pkgs.gutenprint
235 pkgs.hplip
236 ];
237 };
238 services.udev = {
239 packages = [
240 # Allow members of the "adbusers" group to mount Android devices via MTP.
241 pkgs.android-udev-rules
242 # Allow the console user access the Yubikey USB device node,
243 # needed for challenge/response to work correctly.
244 pkgs.yubikey-personalization
245 ];
246 };
247 services.xserver = {
248 enable = true;
249 layout = "fr";
250 xkbOptions = "eurosign:e";
251 libinput.enable = true;
252 desktopManager = {
253 session = [
254 # Let the session be generated by home-manager
255 { name = "home-manager";
256 start = ''
257 ${pkgs.runtimeShell} $HOME/.hm-xsession &
258 waitPID=$!
259 '';
260 }
261 ];
262 };
263 displayManager = {
264 defaultSession = "home-manager";
265 #defaultSession = "none+xmonad";
266 autoLogin = {
267 enable = true;
268 user = users.julm.name;
269 };
270 };
271 };
272
273 systemd.coredump.enable = true;
274 #environment.enableDebugInfo = true;
275
276 # This value determines the NixOS release with which your system is to be
277 # compatible, in order to avoid breaking some software such as database
278 # servers. You should change this only after NixOS release notes say you should.
279 system.stateVersion = "20.09"; # Did you read the comment?
280 }