2022-01-18 09:32:55 +01:00
|
|
|
|
{ config, pkgs, ... }:
|
|
|
|
|
|
2022-02-23 12:40:21 +01:00
|
|
|
|
{
|
|
|
|
|
nix = {
|
|
|
|
|
package = pkgs.nixUnstable;
|
|
|
|
|
extraOptions = ''
|
|
|
|
|
experimental-features = nix-command flakes
|
|
|
|
|
'';
|
2022-02-25 18:20:11 +01:00
|
|
|
|
optimise.automatic = true;
|
2022-01-18 09:32:55 +01:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# boot.binfmt.emulatedSystems = [ "aarch64-linux" "qemu-aarch64" ];
|
|
|
|
|
|
|
|
|
|
networking = {
|
|
|
|
|
networkmanager = {
|
|
|
|
|
enable = true;
|
|
|
|
|
wifi = { scanRandMacAddress = false; };
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
useDHCP = false;
|
|
|
|
|
interfaces = { };
|
|
|
|
|
|
|
|
|
|
firewall = {
|
2022-01-31 13:06:18 +01:00
|
|
|
|
|
|
|
|
|
# 51820 is used by wireguard
|
2022-01-18 09:32:55 +01:00
|
|
|
|
allowedUDPPorts = [ 51820 ];
|
|
|
|
|
|
2022-01-31 13:06:18 +01:00
|
|
|
|
# 1714 - 1764 is used by kdeconnect
|
|
|
|
|
allowedTCPPortRanges = [{
|
|
|
|
|
from = 1714;
|
|
|
|
|
to = 1764;
|
|
|
|
|
}];
|
|
|
|
|
allowedUDPPortRanges = [{
|
|
|
|
|
from = 1714;
|
|
|
|
|
to = 1764;
|
|
|
|
|
}];
|
|
|
|
|
|
2022-01-18 09:32:55 +01:00
|
|
|
|
# if packets are still dropped, they will show up in dmesg
|
|
|
|
|
logReversePathDrops = true;
|
|
|
|
|
# wireguard trips rpfilter up
|
|
|
|
|
extraCommands = ''
|
|
|
|
|
ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
|
|
|
|
|
ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
|
|
|
|
|
'';
|
|
|
|
|
extraStopCommands = ''
|
|
|
|
|
ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
|
|
|
|
|
ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# Set your time zone.
|
|
|
|
|
time.timeZone = "Europe/Madrid";
|
|
|
|
|
|
|
|
|
|
# Configure network proxy if necessary
|
|
|
|
|
# networking.proxy.default = "http://user:password@proxy:port/";
|
|
|
|
|
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
|
|
|
|
|
|
|
|
|
# Select internationalisation properties.
|
|
|
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
|
console = {
|
|
|
|
|
font = "Lat2-Terminus16";
|
|
|
|
|
keyMap = "us";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
services.dbus.enable = true;
|
|
|
|
|
|
|
|
|
|
services.xserver = {
|
|
|
|
|
enable = true;
|
|
|
|
|
layout = "us";
|
|
|
|
|
xkbVariant = "altgr-intl";
|
|
|
|
|
xkbOptions = "caps:escape";
|
|
|
|
|
displayManager.startx.enable = true;
|
|
|
|
|
libinput.enable = true;
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
Section "InputClass"
|
|
|
|
|
Identifier "trackball"
|
|
|
|
|
MatchProduct "Clearly Superior Technologies. CST Laser Trackball"
|
|
|
|
|
Driver "libinput"
|
|
|
|
|
Option "ButtonMapping" "3 2 1 4 5"
|
|
|
|
|
Option "AccelerationProfile" "0"
|
|
|
|
|
Option "AccelerationScheme" "predictable"
|
|
|
|
|
Option "AccelerationNumerator" "3"
|
2022-02-06 12:05:49 +01:00
|
|
|
|
Option "AccelSpeed" "-0.9"
|
2022-01-18 09:32:55 +01:00
|
|
|
|
EndSection
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
services.tor.enable = true;
|
|
|
|
|
|
|
|
|
|
services.udev = { packages = [ pkgs.android-udev-rules ]; };
|
|
|
|
|
|
|
|
|
|
services.avahi.enable = true;
|
|
|
|
|
|
|
|
|
|
# Enable CUPS to print documents.
|
|
|
|
|
# services.printing.enable = true;
|
|
|
|
|
|
|
|
|
|
# Enable sound.
|
|
|
|
|
# sound.enable = true;
|
|
|
|
|
# hardware.pulseaudio.enable = true;
|
|
|
|
|
security.rtkit.enable = true;
|
|
|
|
|
services.pipewire = {
|
|
|
|
|
enable = true;
|
|
|
|
|
alsa = {
|
|
|
|
|
enable = true;
|
|
|
|
|
support32Bit = true;
|
|
|
|
|
};
|
|
|
|
|
pulse.enable = true;
|
|
|
|
|
jack.enable = true;
|
|
|
|
|
};
|
|
|
|
|
|
2022-05-25 10:15:46 +02:00
|
|
|
|
services.snapper.configs = {
|
2022-05-25 12:07:35 +02:00
|
|
|
|
persist = {
|
|
|
|
|
subvolume = "/persist";
|
|
|
|
|
fstype = "btrfs";
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
TIMELINE_CREATE=yes
|
|
|
|
|
TIMELINE_CLEANUP=yes
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
data = {
|
|
|
|
|
subvolume = "/data";
|
|
|
|
|
fstype = "btrfs";
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
TIMELINE_CREATE=yes
|
|
|
|
|
TIMELINE_CLEANUP=yes
|
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
};
|
2022-05-25 10:15:46 +02:00
|
|
|
|
};
|
|
|
|
|
|
2022-01-18 09:32:55 +01:00
|
|
|
|
security.doas = {
|
|
|
|
|
enable = true;
|
|
|
|
|
extraRules = [{
|
|
|
|
|
groups = [ "wheel" ];
|
|
|
|
|
keepEnv = true;
|
|
|
|
|
noPass = true;
|
|
|
|
|
}];
|
|
|
|
|
};
|
2022-05-06 20:28:35 +02:00
|
|
|
|
security.sudo.enable = true;
|
2022-01-18 09:32:55 +01:00
|
|
|
|
|
|
|
|
|
security.pam.services = {
|
|
|
|
|
swaylock.text = ''
|
|
|
|
|
auth include login
|
|
|
|
|
'';
|
|
|
|
|
login = {
|
|
|
|
|
allowNullPassword = true;
|
|
|
|
|
setEnvironment = true;
|
|
|
|
|
setLoginUid = true;
|
|
|
|
|
startSession = true;
|
|
|
|
|
unixAuth = true;
|
|
|
|
|
updateWtmp = true;
|
|
|
|
|
|
|
|
|
|
# Unlock keyring on login.
|
|
|
|
|
enableGnomeKeyring = true;
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# List packages installed in system profile. To search, run:
|
|
|
|
|
# $ nix search wget
|
|
|
|
|
# environment.systemPackages = with pkgs; [
|
|
|
|
|
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
|
|
|
|
# wget
|
|
|
|
|
# firefox
|
|
|
|
|
# ];
|
|
|
|
|
environment.systemPackages = with pkgs; [ dmidecode flashrom git ];
|
|
|
|
|
|
|
|
|
|
# Enable touchpad support (enabled default in most desktopManager).
|
|
|
|
|
|
|
|
|
|
# Define a user account. Don't forget to set a password with ‘passwd’.
|
|
|
|
|
users = {
|
|
|
|
|
mutableUsers = false;
|
|
|
|
|
groups = { plugdev = { }; };
|
|
|
|
|
users = {
|
|
|
|
|
root.initialHashedPassword =
|
|
|
|
|
"$6$3TVh31LfZQFaZi8T$9.cNxrApCaAetC8wRJXxA5U9n4Hbta3CoggvG0HntTQ6sCRQWIV01EhIjdzJoZZ1kqF2ItWkF8Sqprl5raUKY0";
|
|
|
|
|
rilla = {
|
|
|
|
|
uid = 1000;
|
|
|
|
|
isNormalUser = true;
|
|
|
|
|
shell = pkgs.zsh;
|
|
|
|
|
extraGroups = [
|
|
|
|
|
"wheel"
|
|
|
|
|
"docker"
|
|
|
|
|
"libvirtd"
|
|
|
|
|
"dialout"
|
|
|
|
|
"plugdev"
|
|
|
|
|
"adbusers"
|
2022-03-05 19:10:35 +01:00
|
|
|
|
"video"
|
2022-01-18 09:32:55 +01:00
|
|
|
|
];
|
|
|
|
|
initialHashedPassword =
|
|
|
|
|
"$6$tzMk5I1KZlx7byaO$BvlSz7Cgo1g09e4RpxAjrZEuCptzjibF8nDWDfnOImTbz61Py/qzATDAa7HwAC3JyiZxb.2slTb.vA.f25ypd1";
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# Some programs need SUID wrappers, can be configured further or are
|
|
|
|
|
# started in user sessions.
|
|
|
|
|
# programs.mtr.enable = true;
|
|
|
|
|
# programs.gnupg.agent = {
|
|
|
|
|
# enable = true;
|
|
|
|
|
# enableSSHSupport = true;
|
|
|
|
|
# };
|
|
|
|
|
programs.mosh.enable = true;
|
|
|
|
|
programs.zsh.enable = true;
|
2022-04-17 19:14:56 +02:00
|
|
|
|
programs.slock.enable = true;
|
2022-01-18 09:32:55 +01:00
|
|
|
|
|
|
|
|
|
programs.fuse.userAllowOther = true;
|
|
|
|
|
|
|
|
|
|
# List services that you want to enable:
|
|
|
|
|
|
|
|
|
|
services.pcscd.enable = true;
|
|
|
|
|
|
|
|
|
|
services.openssh = {
|
|
|
|
|
enable = true;
|
|
|
|
|
passwordAuthentication = false;
|
|
|
|
|
permitRootLogin = "no";
|
2022-09-04 18:02:18 +02:00
|
|
|
|
|
|
|
|
|
hostKeys = [{
|
|
|
|
|
path = "/etc/ssh/ssh_host_ed25519_key";
|
|
|
|
|
type = "ed25519";
|
|
|
|
|
}];
|
|
|
|
|
|
|
|
|
|
knownHosts = {
|
2022-09-26 17:06:35 +02:00
|
|
|
|
"*.monotremata.xyz,10.*,narwhal,suricata,caladan,fugu,snitch,trantor,capibara,axolotl,echidna" =
|
2022-09-04 18:02:18 +02:00
|
|
|
|
{
|
|
|
|
|
certAuthority = true;
|
|
|
|
|
publicKey =
|
|
|
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHperHwojXZeo3QWAu1f3kiCKeaHHSqBXJM6ZZEefxdd host_ca";
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
|
|
|
|
|
TrustedUserCAKeys /etc/ssh/user_ca.pub
|
|
|
|
|
'';
|
2022-01-18 09:32:55 +01:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
virtualisation = {
|
|
|
|
|
docker.enable = true;
|
|
|
|
|
libvirtd.enable = true;
|
2022-04-10 20:22:09 +02:00
|
|
|
|
spiceUSBRedirection.enable = true;
|
2022-01-18 09:32:55 +01:00
|
|
|
|
};
|
2022-07-11 17:28:16 +02:00
|
|
|
|
services.spice-vdagentd.enable = true;
|
2022-01-18 09:32:55 +01:00
|
|
|
|
programs.dconf.enable = true;
|
|
|
|
|
|
2022-01-25 12:27:52 +01:00
|
|
|
|
services.udev.extraRules = ''
|
|
|
|
|
# UDEV rules for Teensy USB devices
|
|
|
|
|
ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1"
|
|
|
|
|
ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1"
|
|
|
|
|
SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", MODE:="0666"
|
|
|
|
|
KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", MODE:="0666"
|
|
|
|
|
ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE="664", GROUP="plugdev"
|
2022-03-05 19:10:35 +01:00
|
|
|
|
|
|
|
|
|
# acpi brightness rulres
|
|
|
|
|
ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="acpi_video0", GROUP="video", MODE="0664"
|
|
|
|
|
RUN+="${pkgs.coreutils-full}/bin/chgrp video /sys/class/backlight/intel_backlight/brightness"
|
|
|
|
|
RUN+="${pkgs.coreutils-full}/bin/chmod g+w /sys/class/backlight/intel_backlight/brightness"
|
2022-01-25 12:27:52 +01:00
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
hardware.opengl.enable = true;
|
|
|
|
|
hardware.bluetooth.enable = true;
|
|
|
|
|
services.blueman.enable = true;
|
|
|
|
|
|
2022-01-28 15:11:30 +01:00
|
|
|
|
fileSystems = {
|
|
|
|
|
"/" = {
|
|
|
|
|
device = "tmpfs";
|
|
|
|
|
fsType = "tmpfs";
|
|
|
|
|
options = [ "defaults" "size=2G" "mode=755" ];
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
swapDevices = [{ device = "/swap/swapfile"; }];
|
|
|
|
|
|
2022-05-25 09:58:20 +02:00
|
|
|
|
environment.persistence = {
|
|
|
|
|
"/persist" = {
|
|
|
|
|
directories = [
|
|
|
|
|
"/etc/NetworkManager/system-connections"
|
|
|
|
|
"/etc/nixos"
|
|
|
|
|
"/etc/wireguard"
|
|
|
|
|
"/var/lib/bluetooth"
|
|
|
|
|
"/var/lib/docker"
|
|
|
|
|
"/var/lib/libvirt"
|
|
|
|
|
"/var/lib/systemd/coredump"
|
|
|
|
|
];
|
|
|
|
|
files = [
|
|
|
|
|
"/etc/machine-id"
|
|
|
|
|
"/etc/ssh/ssh_host_ed25519_key"
|
|
|
|
|
"/etc/ssh/ssh_host_ed25519_key.pub"
|
2022-09-05 11:52:28 +02:00
|
|
|
|
"/etc/ssh/ssh_host_ed25519_key-cert.pub"
|
|
|
|
|
"/etc/ssh/user_ca.pub"
|
2022-05-25 09:58:20 +02:00
|
|
|
|
];
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
"/logs" = { directories = [ "/var/log" ]; };
|
2022-01-28 15:11:30 +01:00
|
|
|
|
};
|
|
|
|
|
|
2022-01-18 09:32:55 +01:00
|
|
|
|
# Open ports in the firewall.
|
|
|
|
|
# networking.firewall.allowedTCPPorts = [ ... ];
|
|
|
|
|
#
|
|
|
|
|
# networking.firewall.allowedUDPPorts = [ ... ];
|
|
|
|
|
# Or disable the firewall altogether.
|
|
|
|
|
# networking.firewall.enable = false;
|
|
|
|
|
|
|
|
|
|
# This value determines the NixOS release from which the default
|
|
|
|
|
# settings for stateful data, like file locations and database versions
|
|
|
|
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
|
|
|
# this value at the release version of the first install of this system.
|
|
|
|
|
# Before changing this value read the documentation for this option
|
|
|
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
|
|
|
system.stateVersion = "21.05"; # Did you read the comment?
|
|
|
|
|
}
|