Add 1 git-crypt collaborator

[sourcephile-nix.git] / nixos / defaults.nix

diff --git a/nixos/defaults.nix b/nixos/defaults.nix
index c48636f94ad37f769f042fc735f6ab6dfa7a8414..db52e5bbf32846f50e801cd3209a3d89f461375f 100644 (file)
--- a/nixos/defaults.nix
+++ b/nixos/defaults.nix
@@ -1,30 +1,31 @@
-{ pkgs, lib, config, ... }:
+{ inputs, pkgs, lib, config, ... }:
 let inherit (lib) types;
     inherit (config.networking) hostName domain;
 in
 {
 imports = [
   ./modules.nix
-  defaults/security.nix
+  ./options.nix
+  (inputs.julm-nix + "/nixos/profiles/security.nix")
   defaults/predictable-interface-names.nix
 ];
 nix = {
   #binaryCaches = lib.mkForce [];
   extraOptions = ''
   '';
-  autoOptimiseStore = lib.mkDefault true;
+  settings.auto-optimise-store = lib.mkDefault true;
   # Use gc.automatic to keep disk space under control.
-  gc = {
-    automatic = lib.mkDefault true;
-    dates = lib.mkDefault "weekly";
-    options = lib.mkDefault "--delete-older-than 30d";
-  };
-  nixPath = lib.mkForce [];
+  gc.automatic = lib.mkDefault true;
+  gc.dates = lib.mkDefault "weekly";
+  gc.options = lib.mkDefault "--delete-older-than 30d";
+  # Setting NIX_PATH is useless now that flake.nix are used.
+  nixPath = [];
 };
 environment.variables.NIXPKGS_CONFIG = lib.mkForce "";
 
 documentation.nixos = {
-  enable = lib.mkDefault false; # NOTE: useless on a server, and CPU intensive.
+  # NOTE: useless on a server, and CPU intensive.
+  enable = lib.mkDefault false;
 };
 
 console.font = "Lat2-Terminus16";
@@ -38,9 +39,9 @@ time.timeZone = "Europe/Paris";
 # https://wiki.archlinux.org/index.php/systemd#Disable_emergency_mode_on_remote_host
 systemd.enableEmergencyMode = false;
 
-# This is a remote headless server: always reboot on a kernel panic,
-# to not have to physically go power cycle the apu2e4.
-# Which happens if the wrong ZFS password is used
+# On a remote headless server: always reboot on a kernel panic,
+# to not have to physically go power cycle the server.
+# Which may happen for instance if the wrong ZFS password is used
 # but the boot is manually forced to continue.
 # Using kernelParams instead of kernel.sysctl
 # sets this up as soon as the initrd.
@@ -60,19 +61,9 @@ networking = {
   usePredictableInterfaceNames = true;
 };
 
-services.journald = {
-  extraConfig = ''
-    Compress=true
-    MaxRetentionSec=1month
-    Storage=persistent
-    SystemMaxUse=128M
-  '';
-};
+services.logrotate.enable = true;
 
-services.openssh = {
-  enable = true;
-  passwordAuthentication = false;
-};
+services.openssh.enable = true;
 
 environment.systemPackages = with pkgs; [
   binutils
@@ -86,6 +77,7 @@ environment.systemPackages = with pkgs; [
   inetutils
   iotop
   ldns
+  lf
   lsof
   #mailutils # builds guile
   multitail
@@ -93,15 +85,16 @@ environment.systemPackages = with pkgs; [
   nethogs
   nload
   nmon
+  pciutils # Not supported by a few hardwares
+  psmisc
   pv
-  rdfind
+  #rdfind
   smem
-  swaplist
   tcpdump
   tmux
   tree
   usbutils
-  vim
+  #vim
   which
   #dnsutils
   #ntop
@@ -110,6 +103,15 @@ environment.systemPackages = with pkgs; [
 environment.variables.SYSTEMD_LESS = "FKMRX";
 environment.etc."inputrc".text = lib.readFile defaults/readline/inputrc;
 
+boot.kernel.sysctl = {
+  # Improve MTU detection
+  # This can thaw TCP connections stalled by a host
+  # requiring a lower MTU along the path,
+  # though it would do so after a little delay
+  # so it's better to set a low MTU when possible.
+  "net/ipv4/tcp_mtu_probing" = 1;
+};
+
 programs = {
   bash = {
     interactiveShellInit = ''
@@ -128,7 +130,7 @@ programs = {
 
       # Utilities
       mkcd() { mkdir -p "$1" && cd "$1"; }
-      stress-mem() { fac="$1"; stress-ng --vm 1 --vm-keep --vm-bytes $(awk '/MemAvailable/{ printf "%d\n", $2 * $fac; }' </proc/meminfo)k; }
+      stress-mem() { fac="$1"; stress-ng --vm 1 --vm-keep --vm-bytes $(awk "/MemAvailable/{ printf \"%d\n\", \$2 * $fac; }" </proc/meminfo)k; }
       sysenter() { srv="$1"; shift; nsenter -a -t "$(systemctl show --property MainPID --value "$srv")" "$@"; }
       systrace() { srv="$1"; shift; strace -f -p "$(systemctl show --property MainPID --value "$srv")" "$@"; }
       zfs-mount () { for d in $(zfs list -rH -o name "$@"); do sudo zfs mount -l "$d"; done; }