192 lines
4.1 KiB
Nix
192 lines
4.1 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
inputs,
|
|
self,
|
|
...
|
|
}: {
|
|
imports = [
|
|
inputs.home-manager.nixosModules.home-manager
|
|
inputs.nixos-facter-modules.nixosModules.facter
|
|
inputs.disko.nixosModules.disko
|
|
inputs.sops-nix.nixosModules.sops
|
|
./lanzaboote.nix
|
|
./tidal.nix
|
|
./stylix.nix
|
|
./wireguard.nix
|
|
./gnome.nix
|
|
./compliance.nix
|
|
./cinnamon.nix
|
|
./ssh.nix
|
|
./desktop.nix
|
|
./server.nix
|
|
./prometheus.nix
|
|
];
|
|
|
|
options = {
|
|
pim.sopsKeys = lib.mkOption {
|
|
type = lib.types.attrsOf lib.types.path;
|
|
default = {};
|
|
};
|
|
};
|
|
|
|
config = {
|
|
time.timeZone = "Europe/Amsterdam";
|
|
hardware.pulseaudio.enable = false;
|
|
|
|
i18n = {
|
|
defaultLocale = "en_US.UTF-8";
|
|
|
|
extraLocaleSettings = let
|
|
extraLocale = "nl_NL.UTF-8";
|
|
in {
|
|
LC_ADDRESS = extraLocale;
|
|
LC_IDENTIFICATION = extraLocale;
|
|
LC_MEASUREMENT = extraLocale;
|
|
LC_MONETARY = extraLocale;
|
|
LC_NAME = extraLocale;
|
|
LC_NUMERIC = extraLocale;
|
|
LC_PAPER = extraLocale;
|
|
LC_TELEPHONE = extraLocale;
|
|
LC_TIME = extraLocale;
|
|
};
|
|
};
|
|
|
|
# BUG: this uses root way too much.
|
|
deployment.keys =
|
|
lib.mapAttrs' (user: sopsFile: let
|
|
homeDirectory =
|
|
if user == "root"
|
|
then "/root"
|
|
else "/home/${user}";
|
|
in {
|
|
name = "${user}-sops-age-key";
|
|
value = {
|
|
keyCommand = ["nix" "run" "nixpkgs#sops" "--" "--extract" "[\"sops_age_key\"]" "-d" (builtins.toString sopsFile)];
|
|
name = "keys.txt";
|
|
destDir = "${homeDirectory}/.config/sops/age";
|
|
inherit user;
|
|
group = "users";
|
|
};
|
|
})
|
|
config.pim.sopsKeys;
|
|
|
|
systemd = {
|
|
services.NetworkManager-wait-online.enable = lib.mkForce false;
|
|
network.wait-online.enable = lib.mkForce false;
|
|
};
|
|
|
|
services = {
|
|
xserver.excludePackages = [pkgs.xterm];
|
|
printing.drivers = [pkgs.hplip pkgs.gutenprint];
|
|
tailscale.enable = true;
|
|
|
|
pipewire = {
|
|
alsa.enable = true;
|
|
alsa.support32Bit = true;
|
|
pulse.enable = true;
|
|
jack.enable = true;
|
|
};
|
|
};
|
|
|
|
environment = {
|
|
systemPackages = with pkgs; [
|
|
age
|
|
btop
|
|
btrfs-progs
|
|
curl
|
|
dig
|
|
exfat
|
|
f3
|
|
fastfetch
|
|
file
|
|
git
|
|
jq
|
|
ripgrep
|
|
sbctl
|
|
tree
|
|
vim
|
|
wget
|
|
yq
|
|
ncdu
|
|
lshw
|
|
sops
|
|
];
|
|
};
|
|
|
|
system.activationScripts.diff = ''
|
|
if [[ -e /run/current-system ]]; then
|
|
${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
|
|
fi
|
|
'';
|
|
|
|
security = {
|
|
rtkit.enable = true;
|
|
|
|
sudo.extraConfig = ''
|
|
Defaults timestamp_timeout=30
|
|
'';
|
|
};
|
|
|
|
nix = {
|
|
package = pkgs.nixVersions.stable;
|
|
|
|
extraOptions = ''
|
|
experimental-features = nix-command flakes
|
|
'';
|
|
|
|
gc = {
|
|
automatic = true;
|
|
persistent = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 7d";
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
useDHCP = lib.mkDefault true;
|
|
networkmanager.unmanaged = lib.mkIf config.services.tailscale.enable ["tailscale0"];
|
|
wireless.extraConfig = ''
|
|
p2p_disabled=1
|
|
'';
|
|
};
|
|
|
|
nixpkgs = {
|
|
# hostPlatform = lib.mkDefault "x86_64-linux";
|
|
|
|
config = {
|
|
allowUnfreePredicate = pkg:
|
|
builtins.elem (lib.getName pkg) [
|
|
"libfprint-2-tod1-goodix"
|
|
"steam"
|
|
"steam-original"
|
|
"steam-run"
|
|
"steam-unwrapped"
|
|
];
|
|
};
|
|
|
|
overlays = [
|
|
inputs.nur.overlay
|
|
(final: _prev: {
|
|
unstable = import inputs.nixpkgs-unstable {
|
|
inherit (pkgs) system;
|
|
config.allowUnfree = true;
|
|
};
|
|
})
|
|
];
|
|
};
|
|
|
|
boot.kernel.sysctl = {
|
|
"net.core.default_qdisc" = "fq";
|
|
"net.ipv4.tcp_congestion_control" = "bbr";
|
|
};
|
|
|
|
home-manager = {
|
|
useGlobalPkgs = true;
|
|
useUserPackages = true;
|
|
extraSpecialArgs = {inherit self inputs;};
|
|
sharedModules = ["${self}/home-manager"];
|
|
};
|
|
};
|
|
}
|