nix-config/nixos/common.nix

312 lines
8.4 KiB
Nix
Raw Normal View History

2022-01-18 09:32:55 +01:00
{ config, pkgs, ... }:
2022-02-23 12:40:21 +01:00
{
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
2022-02-25 18:20:11 +01:00
optimise.automatic = true;
2022-01-18 09:32:55 +01:00
};
# boot.binfmt.emulatedSystems = [ "aarch64-linux" "qemu-aarch64" ];
networking = {
networkmanager = {
enable = true;
wifi = { scanRandMacAddress = false; };
};
useDHCP = false;
interfaces = { };
firewall = {
2022-01-31 13:06:18 +01:00
# 51820 is used by wireguard
2022-01-18 09:32:55 +01:00
allowedUDPPorts = [ 51820 ];
2022-01-31 13:06:18 +01:00
# 1714 - 1764 is used by kdeconnect
allowedTCPPortRanges = [{
from = 1714;
to = 1764;
}];
allowedUDPPortRanges = [{
from = 1714;
to = 1764;
}];
2022-01-18 09:32:55 +01:00
# if packets are still dropped, they will show up in dmesg
logReversePathDrops = true;
# wireguard trips rpfilter up
extraCommands = ''
ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
'';
extraStopCommands = ''
ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
'';
};
};
# Set your time zone.
time.timeZone = "Europe/Madrid";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
services.dbus.enable = true;
services.xserver = {
enable = true;
layout = "us";
xkbVariant = "altgr-intl";
xkbOptions = "caps:escape";
displayManager.startx.enable = true;
libinput.enable = true;
extraConfig = ''
Section "InputClass"
Identifier "trackball"
MatchProduct "Clearly Superior Technologies. CST Laser Trackball"
Driver "libinput"
Option "ButtonMapping" "3 2 1 4 5"
Option "AccelerationProfile" "0"
Option "AccelerationScheme" "predictable"
Option "AccelerationNumerator" "3"
2022-02-06 12:05:49 +01:00
Option "AccelSpeed" "-0.9"
2022-01-18 09:32:55 +01:00
EndSection
'';
};
services.tor.enable = true;
services.udev = { packages = [ pkgs.android-udev-rules ]; };
services.avahi.enable = true;
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable sound.
# sound.enable = true;
# hardware.pulseaudio.enable = true;
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa = {
enable = true;
support32Bit = true;
};
pulse.enable = true;
jack.enable = true;
};
2022-05-25 10:15:46 +02:00
services.snapper.configs = {
2022-05-25 12:07:35 +02:00
persist = {
subvolume = "/persist";
fstype = "btrfs";
extraConfig = ''
TIMELINE_CREATE=yes
TIMELINE_CLEANUP=yes
'';
};
data = {
subvolume = "/data";
fstype = "btrfs";
extraConfig = ''
TIMELINE_CREATE=yes
TIMELINE_CLEANUP=yes
'';
};
2022-05-25 10:15:46 +02:00
};
2022-01-18 09:32:55 +01:00
security.doas = {
enable = true;
extraRules = [{
groups = [ "wheel" ];
keepEnv = true;
noPass = true;
}];
};
2022-05-06 20:28:35 +02:00
security.sudo.enable = true;
2022-01-18 09:32:55 +01:00
security.pam.services = {
swaylock.text = ''
auth include login
'';
login = {
allowNullPassword = true;
setEnvironment = true;
setLoginUid = true;
startSession = true;
unixAuth = true;
updateWtmp = true;
# Unlock keyring on login.
enableGnomeKeyring = true;
};
};
# List packages installed in system profile. To search, run:
# $ nix search wget
# environment.systemPackages = with pkgs; [
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
# wget
# firefox
# ];
environment.systemPackages = with pkgs; [ dmidecode flashrom git ];
# Enable touchpad support (enabled default in most desktopManager).
# Define a user account. Don't forget to set a password with passwd.
users = {
mutableUsers = false;
groups = { plugdev = { }; };
users = {
root.initialHashedPassword =
"$6$3TVh31LfZQFaZi8T$9.cNxrApCaAetC8wRJXxA5U9n4Hbta3CoggvG0HntTQ6sCRQWIV01EhIjdzJoZZ1kqF2ItWkF8Sqprl5raUKY0";
rilla = {
uid = 1000;
isNormalUser = true;
shell = pkgs.zsh;
extraGroups = [
"wheel"
"docker"
"libvirtd"
"dialout"
"plugdev"
"adbusers"
2022-03-05 19:10:35 +01:00
"video"
2022-01-18 09:32:55 +01:00
];
initialHashedPassword =
"$6$tzMk5I1KZlx7byaO$BvlSz7Cgo1g09e4RpxAjrZEuCptzjibF8nDWDfnOImTbz61Py/qzATDAa7HwAC3JyiZxb.2slTb.vA.f25ypd1";
};
};
};
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
programs.mosh.enable = true;
programs.zsh.enable = true;
2022-04-17 19:14:56 +02:00
programs.slock.enable = true;
2022-01-18 09:32:55 +01:00
programs.fuse.userAllowOther = true;
# List services that you want to enable:
services.pcscd.enable = true;
services.openssh = {
enable = true;
passwordAuthentication = false;
permitRootLogin = "no";
2022-09-04 18:02:18 +02:00
hostKeys = [{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}];
knownHosts = {
2022-09-26 17:06:35 +02:00
"*.monotremata.xyz,10.*,narwhal,suricata,caladan,fugu,snitch,trantor,capibara,axolotl,echidna" =
2022-09-04 18:02:18 +02:00
{
certAuthority = true;
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHperHwojXZeo3QWAu1f3kiCKeaHHSqBXJM6ZZEefxdd host_ca";
};
};
extraConfig = ''
HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
TrustedUserCAKeys /etc/ssh/user_ca.pub
'';
2022-01-18 09:32:55 +01:00
};
virtualisation = {
docker.enable = true;
libvirtd.enable = true;
2022-04-10 20:22:09 +02:00
spiceUSBRedirection.enable = true;
2022-01-18 09:32:55 +01:00
};
2022-07-11 17:28:16 +02:00
services.spice-vdagentd.enable = true;
2022-01-18 09:32:55 +01:00
programs.dconf.enable = true;
2022-01-25 12:27:52 +01:00
services.udev.extraRules = ''
# UDEV rules for Teensy USB devices
ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1"
ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1"
SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", MODE:="0666"
KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", MODE:="0666"
ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE="664", GROUP="plugdev"
2022-03-05 19:10:35 +01:00
# acpi brightness rulres
ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="acpi_video0", GROUP="video", MODE="0664"
RUN+="${pkgs.coreutils-full}/bin/chgrp video /sys/class/backlight/intel_backlight/brightness"
RUN+="${pkgs.coreutils-full}/bin/chmod g+w /sys/class/backlight/intel_backlight/brightness"
2022-01-25 12:27:52 +01:00
'';
hardware.opengl.enable = true;
hardware.bluetooth.enable = true;
services.blueman.enable = true;
2022-01-28 15:11:30 +01:00
fileSystems = {
"/" = {
device = "tmpfs";
fsType = "tmpfs";
options = [ "defaults" "size=2G" "mode=755" ];
};
};
swapDevices = [{ device = "/swap/swapfile"; }];
2022-05-25 09:58:20 +02:00
environment.persistence = {
"/persist" = {
directories = [
"/etc/NetworkManager/system-connections"
"/etc/nixos"
"/etc/wireguard"
"/var/lib/bluetooth"
"/var/lib/docker"
"/var/lib/libvirt"
"/var/lib/systemd/coredump"
];
files = [
"/etc/machine-id"
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
2022-09-05 11:52:28 +02:00
"/etc/ssh/ssh_host_ed25519_key-cert.pub"
"/etc/ssh/user_ca.pub"
2022-05-25 09:58:20 +02:00
];
};
"/logs" = { directories = [ "/var/log" ]; };
2022-01-28 15:11:30 +01:00
};
2022-01-18 09:32:55 +01:00
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
#
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
}