164 lines
3.7 KiB
Nix
164 lines
3.7 KiB
Nix
{ pkgs, config, lib, ... }: {
|
|
imports = [ ./hardware-configuration.nix ];
|
|
|
|
boot = { loader.systemd-boot.enable = true; };
|
|
|
|
time.timeZone = "Europe/Amsterdam";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
services = {
|
|
gnome.gnome-keyring.enable = lib.mkForce false;
|
|
|
|
xserver = {
|
|
enable = true;
|
|
displayManager.gdm = { enable = true; };
|
|
desktopManager.gnome.enable = true;
|
|
excludePackages = with pkgs; [ xterm ];
|
|
};
|
|
|
|
printing = {
|
|
enable = true;
|
|
drivers = [ pkgs.hplip pkgs.gutenprint ];
|
|
};
|
|
|
|
fprintd = {
|
|
enable = true;
|
|
|
|
tod = {
|
|
enable = true;
|
|
driver = pkgs.libfprint-2-tod1-vfs0090;
|
|
};
|
|
};
|
|
};
|
|
|
|
users = {
|
|
users.pim = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "docker" "input" "wireshark" "dialout" ];
|
|
};
|
|
};
|
|
|
|
environment = {
|
|
systemPackages = with pkgs; [
|
|
wget
|
|
curl
|
|
git
|
|
btop
|
|
ripgrep
|
|
vim
|
|
dogdns
|
|
tree
|
|
dig
|
|
];
|
|
gnome.excludePackages = with pkgs; [
|
|
gnome.totem
|
|
gnome-tour
|
|
gnome.epiphany
|
|
gnome.geary
|
|
gnome-console
|
|
gnome.gnome-music
|
|
];
|
|
};
|
|
|
|
system = {
|
|
stateVersion = "23.05";
|
|
|
|
activationScripts.diff = ''
|
|
if [[ -e /run/current-system ]]; then
|
|
${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
|
|
fi
|
|
'';
|
|
};
|
|
|
|
programs.ssh = {
|
|
startAgent = true;
|
|
|
|
knownHosts = {
|
|
dmz = {
|
|
hostNames = [ "*.dmz" ];
|
|
publicKey =
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x";
|
|
certAuthority = true;
|
|
};
|
|
|
|
hypervisors = {
|
|
hostNames = [ "*.hyp" ];
|
|
publicKey =
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzRkH3d/KVJQouswY/DMpenWbDFVOnI3Vut0xR0e1tb";
|
|
certAuthority = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
security.sudo.extraConfig = ''
|
|
Defaults timestamp_timeout=30
|
|
'';
|
|
|
|
nix = {
|
|
package = pkgs.nixFlakes;
|
|
extraOptions = ''
|
|
experimental-features = nix-command flakes
|
|
'';
|
|
|
|
gc = {
|
|
automatic = true;
|
|
persistent = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 7d";
|
|
};
|
|
};
|
|
|
|
age = {
|
|
identityPaths = [ "/home/pim/.ssh/age_ed25519" ];
|
|
|
|
secrets = {
|
|
wg-quick-home-privkey.file = ../secrets/wg-quick-home-privkey.age;
|
|
wg-quick-home-preshared-key.file =
|
|
../secrets/wg-quick-home-preshared-key.age;
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = "x260";
|
|
|
|
wg-quick.interfaces = {
|
|
home = {
|
|
privateKeyFile = config.age.secrets.wg-quick-home-privkey.path;
|
|
address = [ "10.225.191.4/24" "fd11:5ee:bad:c0de::4/128" ];
|
|
dns = [ "192.168.30.8" "2a0d:6e00:1a77:30:c8fe:c0ff:feff:ee08" ];
|
|
autostart = false;
|
|
peers = [{
|
|
presharedKeyFile = config.age.secrets.wg-quick-home-preshared-key.path;
|
|
endpoint = "wg.kun.is:51820";
|
|
publicKey = "fa3mQ7ximJbH7cu2ZbWidto5xBGxEEfWvCCiUDk00Hg=";
|
|
allowedIPs = [ "0.0.0.0/0" "::/0" ];
|
|
}];
|
|
};
|
|
|
|
home-no-pihole = {
|
|
privateKeyFile = config.age.secrets.wg-quick-home-privkey.path;
|
|
address = [ "10.225.191.4/24" "fd11:5ee:bad:c0de::4/128" ];
|
|
dns = [ "192.168.30.1" "2a0d:6e00:1a77::1" ];
|
|
autostart = false;
|
|
peers = [{
|
|
presharedKeyFile = config.age.secrets.wg-quick-home-preshared-key.path;
|
|
endpoint = "wg.kun.is:51820";
|
|
publicKey = "fa3mQ7ximJbH7cu2ZbWidto5xBGxEEfWvCCiUDk00Hg=";
|
|
allowedIPs = [ "0.0.0.0/0" "::/0" ];
|
|
}];
|
|
};
|
|
};
|
|
};
|
|
|
|
virtualisation.docker = {
|
|
enable = true;
|
|
rootless = {
|
|
enable = true;
|
|
setSocketVariable = true;
|
|
};
|
|
};
|
|
|
|
nixpkgs.config.permittedInsecurePackages = [
|
|
"electron-25.9.0"
|
|
];
|
|
}
|