{ config, pkgs, lib, inputs, private, hostName, ... }: let inherit (config.users) users; inherit (config.services) davfs2; in { imports = [ ../profiles/dnscrypt-proxy2.nix ../profiles/security.nix oignon/hardware.nix oignon/openvpn.nix oignon/wireguard.nix oignon/tor.nix oignon/backup.nix ]; home-manager.users.julm = { imports = [ ../homes/julm.nix inputs.nix-doom-emacs.hmModule ]; host.hardware = ["ThinkPad" "X201"]; }; systemd.services.home-manager-julm.postStart = '' ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager ''; security.lockKernelModules = false; users.mutableUsers = false; users.users.julm = { isNormalUser = true; uid = 1000; # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd # which is already world readable. hashedPassword = lib.readFile ../private/world/julm/hashedPassword; extraGroups = [ "adbusers" "lp" "networkmanager" "scanner" "tor" "video" "wheel" #"ipfs" davfs2.davGroup #"vboxusers" ]; # If created, zfs-mount.service would require: # zfs set overlay=yes ${hostName}/home createHome = false; }; nix = { extraOptions = '' secret-key-files = ${private}/${hostName}/nix/binary-cache/priv.pem ''; autoOptimiseStore = true; gc = { automatic = true; dates = "weekly"; options = "--delete-older-than 7d"; }; nixPath = [ "nixpkgs=/etc/nixpkgs" "nixpkgs-overlays=/etc/nixpkgs-overlays/overlays.nix" ]; trustedUsers = [ users.julm.name ]; binaryCaches = [ "https://nix-localcache.sourcephile.fr" ]; binaryCachePublicKeys = [ "losurdo.sourcephile.fr-1:XGeaIE2AA2mZskSZ5bIDrfx53q+TDDWJOUEpZDX7los=" ]; }; documentation = { enable = true; dev.enable = true; doc.enable = true; info.enable = false; man.enable = true; nixos.enable = false; }; nix.sshServe = { enable = true; keys = [ (lib.readFile ../private/world/julm/losurdo/ssh.pub) ]; }; users.users.julm.openssh.authorizedKeys.keys = [ (lib.readFile ../private/world/julm/losurdo/ssh.pub) ]; services.openssh.openFirewall = false; services.openssh.forwardX11 = true; services.openssh.passwordAuthentication = false; nixpkgs.config.allowUnfree = true; environment.etc."nixpkgs".source = pkgs.path; environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs"; time.timeZone = "Europe/Paris"; i18n.defaultLocale = "fr_FR.UTF-8"; console.font = "Lat2-Terminus16"; console.keyMap = "fr"; networking = { hostName = hostName; domain = "localdomain"; search = [ "sourcephile.fr" ]; networkmanager = { enable = true; #dhcp = "dhcpcd"; logLevel = "INFO"; wifi = { #backend = "iwd"; #backend = "wpa_supplicant"; powersave = false; }; }; firewall = { enable = true; allowPing = false; }; }; sound.enable = true; hardware.pulseaudio.enable = true; hardware.sane.enable = true; hardware.sane.extraBackends = [ pkgs.hplipWithPlugin ]; environment.variables = { EDITOR = "vim"; PAGER = "less -R"; SYSTEMD_LESS = "FKMRX"; }; environment.systemPackages = [ pkgs.mkpasswd pkgs.gdb ]; programs = { bash = { interactiveShellInit = '' bind '"\e[A":history-search-backward' bind '"\e[B":history-search-forward' # Ignore duplicate commands, ignore commands starting with a space export HISTCONTROL=erasedups:ignorespace export HISTSIZE=42000 # Append to the history instead of overwriting (good for multiple connections) shopt -s histappend # Utilities mkcd () { mkdir -p "$1"; cd "$1"; } fan () { if [ $# -gt 0 ] then sudo tee /proc/acpi/ibm/fan <<<"level $1" else grep '^\(level\|speed\):' /proc/acpi/ibm/fan fi acpi -t } ''; shellAliases = { cl = "clear"; grep = "grep --color"; l = "ls -alh"; ll = "ls -al"; ls = "ls --color=tty"; mem = "ps -e -orss=,user=,args= | sort -b -k1,1n"; s="sudo systemctl"; st="sudo systemctl status"; u="systemctl --user"; j="sudo journalctl -u"; jb="sudo journalctl -b"; nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system"; mv = "mv -i"; sshfs = "sshfs -o ServerAliveInterval=15 -o reconnect -f"; }; }; dconf.enable = true; mtr.enable = true; }; services.avahi = { enable = true; nssmdns = true; openFirewall = false; publish = { enable = false; }; }; services.davfs2 = { enable = true; extraConfig = '' ''; }; fileSystems."/home/julm/mnt/ilico/severine" = { device = "https://nuage.ilico.org/remote.php/dav/files/severine/"; fsType = "davfs"; options = let conf = pkgs.writeText "davfs2.conf" '' backup_dir /home/julm/documents/backup/ilico/severine cache_dir /home/julm/.cache/davfs2/ilico/severine ''; in [ "conf=${conf}" "user" "noexec" "nosuid" "noauto" ]; # "x-systemd.automount" }; services.dbus = { packages = [ pkgs.gnome3.dconf ]; }; services.gvfs = { enable = true; }; services.ipfs = { #enable = true; defaultMode = "online"; autoMount = true; enableGC = true; localDiscovery = false; extraConfig = { Datastore.StorageMax = "10GB"; Discovery.MDNS.Enabled = false; #Bootstrap = [ #]; #Swarm.AddrFilters = null; }; startWhenNeeded = true; }; services.journald = { extraConfig = '' Compress=true MaxRetentionSec=1month Storage=persistent SystemMaxUse=100M ''; }; services.printing = { enable = true; drivers = [ pkgs.gutenprint pkgs.hplip ]; }; services.udev = { packages = [ # Allow members of the "adbusers" group to mount Android devices via MTP. pkgs.android-udev-rules # Allow the console user access the Yubikey USB device node, # needed for challenge/response to work correctly. pkgs.yubikey-personalization ]; }; services.xserver = { enable = true; layout = "fr"; xkbOptions = "eurosign:e"; libinput.enable = true; desktopManager = { session = [ # Let the session be generated by home-manager { name = "home-manager"; start = '' ${pkgs.runtimeShell} $HOME/.hm-xsession & waitPID=$! ''; } ]; }; displayManager = { defaultSession = "home-manager"; #defaultSession = "none+xmonad"; autoLogin = { enable = true; user = users.julm.name; }; }; }; systemd.coredump.enable = true; #environment.enableDebugInfo = true; # This value determines the NixOS release with which your system is to be # compatible, in order to avoid breaking some software such as database # servers. You should change this only after NixOS release notes say you should. system.stateVersion = "20.09"; # Did you read the comment? }