{ pkgs, config, lib, ... }: { imports = [ ./hardware-configuration.nix ]; boot = { loader.systemd-boot.enable = true; }; time.timeZone = "Europe/Amsterdam"; i18n.defaultLocale = "en_US.UTF-8"; services = { gnome.gnome-keyring.enable = lib.mkForce false; xserver = { enable = true; displayManager.gdm = { enable = true; }; desktopManager.gnome.enable = true; excludePackages = with pkgs; [ xterm ]; }; printing = { enable = true; drivers = [ pkgs.hplip pkgs.gutenprint ]; }; fprintd = { enable = true; tod = { enable = true; driver = pkgs.libfprint-2-tod1-vfs0090; }; }; }; users = { users.pim = { isNormalUser = true; extraGroups = [ "wheel" "docker" "input" "wireshark" "dialout" ]; }; }; environment = { systemPackages = with pkgs; [ wget curl git btop ripgrep vim dogdns tree dig ]; gnome.excludePackages = with pkgs; [ gnome.totem gnome-tour gnome.epiphany gnome.geary gnome-console gnome.gnome-music ]; }; system = { stateVersion = "23.05"; activationScripts.diff = '' if [[ -e /run/current-system ]]; then ${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig" fi ''; }; programs.ssh = { startAgent = true; knownHosts = { dmz = { hostNames = [ "*.dmz" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x"; certAuthority = true; }; hypervisors = { hostNames = [ "*.hyp" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzRkH3d/KVJQouswY/DMpenWbDFVOnI3Vut0xR0e1tb"; certAuthority = true; }; }; }; security.sudo.extraConfig = '' Defaults timestamp_timeout=30 ''; nix = { package = pkgs.nixFlakes; extraOptions = '' experimental-features = nix-command flakes ''; gc = { automatic = true; persistent = true; dates = "weekly"; options = "--delete-older-than 7d"; }; }; age = { identityPaths = [ "/home/pim/.ssh/age_ed25519" ]; secrets = { wg-quick-home-privkey.file = ../secrets/wg-quick-home-privkey.age; wg-quick-home-preshared-key.file = ../secrets/wg-quick-home-preshared-key.age; }; }; networking = { hostName = "x260"; wg-quick.interfaces = { home = { privateKeyFile = config.age.secrets.wg-quick-home-privkey.path; address = [ "10.225.191.4/24" "fd11:5ee:bad:c0de::4/128" ]; dns = [ "192.168.30.8" "2a0d:6e00:1a77:30:c8fe:c0ff:feff:ee08" ]; autostart = false; peers = [{ presharedKeyFile = config.age.secrets.wg-quick-home-preshared-key.path; endpoint = "wg.geokunis2.nl:51820"; publicKey = "fa3mQ7ximJbH7cu2ZbWidto5xBGxEEfWvCCiUDk00Hg="; allowedIPs = [ "0.0.0.0/0" "::/0" ]; }]; }; home-no-pihole = { privateKeyFile = config.age.secrets.wg-quick-home-privkey.path; address = [ "10.225.191.4/24" "fd11:5ee:bad:c0de::4/128" ]; dns = [ "192.168.30.1" "2a0d:6e00:1a77::1" ]; autostart = false; peers = [{ presharedKeyFile = config.age.secrets.wg-quick-home-preshared-key.path; endpoint = "wg.geokunis2.nl:51820"; publicKey = "fa3mQ7ximJbH7cu2ZbWidto5xBGxEEfWvCCiUDk00Hg="; allowedIPs = [ "0.0.0.0/0" "::/0" ]; }]; }; }; }; virtualisation.docker = { enable = true; rootless = { enable = true; setSocketVariable = true; }; }; nixpkgs.config.permittedInsecurePackages = [ "electron-25.9.0" ]; }