hosts/patate.nix

   1 { config, pkgs, lib, ... }:
   2 {
   3   imports = [
   4     ../nixos/profiles/dnscrypt-proxy2.nix
   5     ../nixos/profiles/graphical.nix
   6     ../nixos/profiles/lang-fr.nix
   7     ../nixos/profiles/printing.nix
   8     ../nixos/profiles/wireguard/wg-intra.nix
   9     patate/backup.nix
  10     patate/hardware.nix
  11     patate/wireguard.nix
  12   ];
  13
  14   # Lower kernel's security for better performances
  15   boot.kernelParams = [ "mitigations=off" ];
  16
  17   home-manager.users.sevy = {
  18     imports = [ ../homes/sevy.nix ];
  19   };
  20   systemd.services.home-manager-sevy.postStart = ''
  21     ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/sevy/home-manager
  22   '';
  23   users.users.sevy = {
  24     isNormalUser = true;
  25     uid = 1000;
  26     # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
  27     # which is already world readable.
  28     hashedPassword = lib.readFile patate/users/sevy/login/hashedPassword.clear;
  29     extraGroups = [
  30       "adbusers"
  31       config.services.davfs2.davGroup
  32       "lp"
  33       "networkmanager"
  34       "scanner"
  35       "systemd-journal"
  36       "tor"
  37       "vboxusers"
  38       "video"
  39       "wheel"
  40     ];
  41   };
  42
  43   nix = {
  44     settings = {
  45       trusted-users = [ config.users.users."sevy".name ];
  46       substituters = [
  47         #"ssh://nix-ssh@losurdo.wg?priority=30"
  48         #"ssh://nix-ssh@oignon.wg?priority=10"
  49       ];
  50       trusted-public-keys = map lib.readFile [
  51         ../users/root/nix/losurdo.pub
  52         ../users/root/nix/oignon.pub
  53       ];
  54     };
  55   };
  56   install.substituteOnDestination = false;
  57
  58   environment.systemPackages = [
  59     pkgs.riseup-vpn # Can't be installed by home-manager because it needs to install policy-kit rules
  60   ];
  61
  62   services.physlock = {
  63     enable = true;
  64     allowAnyUser = true;
  65     # NOTE: xfconf-query -c xfce4-session -p /general/LockCommand -s "physlock" --create -t string
  66   };
  67
  68   services.xserver = {
  69     desktopManager = {
  70       mate.enable = true;
  71       xfce.enable = true;
  72       xterm.enable = false;
  73     };
  74     displayManager = {
  75       defaultSession = "mate";
  76       autoLogin = {
  77         user = config.users.users.sevy.name;
  78       };
  79     };
  80   };
  81
  82   virtualisation.virtualbox.host.enable = true;
  83
  84   services.openssh.openFirewall = true;
  85
  86   # This value determines the NixOS release with which your system is to be
  87   # compatible, in order to avoid breaking some software such as database
  88   # servers. You should change this only after NixOS release notes say you should.
  89   system.stateVersion = "20.03"; # Did you read the comment?
  90 }