aubergine: nginx: fix /perso

[julm/julm-nix.git] / nixos / profiles / system.nix

diff --git a/nixos/profiles/system.nix b/nixos/profiles/system.nix
index 2af4c86cf403257e2068d989eb8ec51ab0abef27..d8106cd49055cb459ecf7e810abe777c23b06ae8 100644 (file)
--- a/nixos/profiles/system.nix
+++ b/nixos/profiles/system.nix
@@ -1,20 +1,26 @@
-{ pkgs, lib, ... }:
+{ config, pkgs, lib, inputs, ... }:
+with lib;
 {
-  imports = [
-    ./bash.nix
-  ];
+  boot.cleanTmpDir = mkDefault true;
+  boot.tmpOnTmpfs = mkDefault true;
+  services.logrotate.enable = true;
+  # NOTE: mostly useless on a server, and CPU intensive.
   documentation = {
-    enable = lib.mkDefault true;
-    dev.enable = lib.mkDefault false;
-    doc.enable = lib.mkDefault true;
-    info.enable = lib.mkDefault false;
-    man.enable = lib.mkDefault true;
-    nixos.enable = lib.mkDefault false;
+    enable = mkDefault true;
+    dev.enable = mkDefault false;
+    doc.enable = mkDefault true;
+    info.enable = mkDefault false;
+    man.enable = mkDefault true;
+    nixos.enable = mkDefault false;
   };
   environment.variables = {
     EDITOR = "vim";
+    NIXPKGS_CONFIG = mkForce "";
     PAGER = "less -R";
     SYSTEMD_LESS = "FKMRX";
+    # Setting TZ= avoids a lot of useless syscalls reading /etc/localtime
+    # but requires to restart the session to change the time zone for all programs.
+    TZ = config.time.timeZone;
   };
   home-manager.users.root = {
     imports = [
@@ -26,11 +32,14 @@
     ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/root/home-manager
   '';
   nix = {
-    settings.auto-optimise-store = lib.mkDefault true;
-    gc.automatic = lib.mkDefault true;
-    gc.dates = lib.mkDefault "weekly";
-    gc.options = lib.mkDefault "--delete-older-than 7d";
-    nixPath = lib.mkForce [ ];
+    settings.auto-optimise-store = mkDefault true;
+    gc.automatic = mkDefault true;
+    gc.dates = mkDefault "weekly";
+    gc.options = mkDefault "--delete-older-than 7d";
+    nixPath = mkForce [ ];
+    registry.nixpkgs = mkDefault { flake = inputs.nixpkgs; };
+    package = pkgs.nixFlakes;
+    extraOptions = "experimental-features = nix-command flakes";
   };
   security.lockKernelModules = false;
   services.journald = {
@@ -41,5 +50,30 @@
       SystemMaxUse=100M
     '';
   };
+  systemd.oomd = {
+    enable = mkDefault true;
+    enableRootSlice = mkDefault true;
+    enableSystemSlice = mkDefault true;
+    enableUserServices = mkDefault true;
+  };
+  systemd.services.openssh = {
+    serviceConfig = {
+      ManagedOOMPreference = "omit";
+    };
+  };
+  /*
+    system.nixos.versionSuffix = ".${
+    substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
+    inputs.self.shortRev or "dirty"}";
+    system.nixos.revision = mkIf (inputs.self ? rev) inputs.self.rev;
+  */
+  # Let 'nixos-version --json' know about the Git revision of this flake.
+  system.configurationRevision = mkIf (inputs.self ? rev) inputs.self.rev;
+  /*
+    system.configurationRevision =
+    if inputs.self ? rev
+    then inputs.self.rev
+    else throw "Refusing to build from a dirty Git tree!";
+  */
   users.mutableUsers = false;
 }