{ config, pkgs, ... }: { nix = { package = pkgs.nixUnstable; extraOptions = '' experimental-features = nix-command flakes ''; optimise.automatic = true; }; # boot.binfmt.emulatedSystems = [ "aarch64-linux" "qemu-aarch64" ]; networking = { networkmanager = { enable = true; wifi = { scanRandMacAddress = false; }; }; useDHCP = false; interfaces = { }; firewall = { # 51820 is used by wireguard allowedUDPPorts = [ 51820 ]; # 1714 - 1764 is used by kdeconnect allowedTCPPortRanges = [{ from = 1714; to = 1764; }]; allowedUDPPortRanges = [{ from = 1714; to = 1764; }]; # if packets are still dropped, they will show up in dmesg logReversePathDrops = true; # # wireguard trips rpfilter up # extraCommands = '' # ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN # ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN # ''; # extraStopCommands = '' # ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true # ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true # ''; }; }; # Set your time zone. time.timeZone = "Europe/Madrid"; # Configure network proxy if necessary # networking.proxy.default = "http://user:password@proxy:port/"; # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; # Select internationalisation properties. i18n.defaultLocale = "en_US.UTF-8"; console = { font = "Lat2-Terminus16"; keyMap = "us"; }; services.dbus.enable = true; services.xserver = { enable = true; layout = "us"; xkbVariant = "altgr-intl"; xkbOptions = "caps:escape"; displayManager.startx.enable = true; libinput.enable = true; extraConfig = '' Section "InputClass" Identifier "trackball" MatchProduct "Clearly Superior Technologies. CST Laser Trackball" Driver "libinput" Option "ButtonMapping" "3 2 1 4 5" Option "AccelerationProfile" "0" Option "AccelerationScheme" "predictable" Option "AccelerationNumerator" "3" Option "AccelSpeed" "-0.9" EndSection ''; }; services.tor.enable = true; services.udev = { packages = [ pkgs.android-udev-rules ]; }; services.avahi.enable = true; # Enable CUPS to print documents. # services.printing.enable = true; # Enable sound. # sound.enable = true; # hardware.pulseaudio.enable = true; security.rtkit.enable = true; services.pipewire = { enable = true; alsa = { enable = true; support32Bit = true; }; pulse.enable = true; jack.enable = true; }; security.doas = { enable = true; extraRules = [{ groups = [ "wheel" ]; keepEnv = true; noPass = true; }]; }; security.sudo.enable = true; security.pam.services = { swaylock.text = '' auth include login ''; login = { allowNullPassword = true; setEnvironment = true; setLoginUid = true; startSession = true; unixAuth = true; updateWtmp = true; # Unlock keyring on login. enableGnomeKeyring = true; }; }; # List packages installed in system profile. To search, run: # $ nix search wget # environment.systemPackages = with pkgs; [ # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. # wget # firefox # ]; environment.systemPackages = with pkgs; [ dmidecode flashrom git ]; # Enable touchpad support (enabled default in most desktopManager). # Define a user account. Don't forget to set a password with ‘passwd’. users = { mutableUsers = false; groups = { plugdev = { }; }; users = { root.initialHashedPassword = "$6$3TVh31LfZQFaZi8T$9.cNxrApCaAetC8wRJXxA5U9n4Hbta3CoggvG0HntTQ6sCRQWIV01EhIjdzJoZZ1kqF2ItWkF8Sqprl5raUKY0"; rilla = { uid = 1000; isNormalUser = true; shell = pkgs.zsh; extraGroups = [ "wheel" "docker" "libvirtd" "dialout" "plugdev" "adbusers" "video" ]; initialHashedPassword = "$6$tzMk5I1KZlx7byaO$BvlSz7Cgo1g09e4RpxAjrZEuCptzjibF8nDWDfnOImTbz61Py/qzATDAa7HwAC3JyiZxb.2slTb.vA.f25ypd1"; }; }; }; # Some programs need SUID wrappers, can be configured further or are # started in user sessions. # programs.mtr.enable = true; # programs.gnupg.agent = { # enable = true; # enableSSHSupport = true; # }; programs.mosh.enable = true; programs.zsh.enable = true; programs.slock.enable = true; programs.fuse.userAllowOther = true; # List services that you want to enable: services.pcscd.enable = true; services.openssh = { enable = true; passwordAuthentication = false; permitRootLogin = "no"; hostKeys = [{ path = "/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; }]; knownHosts = { "*.monotremata.xyz,10.*,narwhal,suricata,pikvm,caladan,fugu,snitch,trantor,capibara,axolotl,echidna" = { certAuthority = true; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHperHwojXZeo3QWAu1f3kiCKeaHHSqBXJM6ZZEefxdd host_ca"; }; }; extraConfig = '' HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub TrustedUserCAKeys /etc/ssh/user_ca.pub ''; }; virtualisation = { docker.enable = true; libvirtd.enable = true; spiceUSBRedirection.enable = true; }; services.spice-vdagentd.enable = true; programs.dconf.enable = true; services.udev.extraRules = '' # UDEV rules for Teensy USB devices ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1" ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1" SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", MODE:="0666" KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", MODE:="0666" ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE="664", GROUP="plugdev" # acpi brightness rulres ACTION=="add", SUBSYSTEM=="backlight", KERNEL=="acpi_video0", GROUP="video", MODE="0664" RUN+="${pkgs.coreutils-full}/bin/chgrp video /sys/class/backlight/intel_backlight/brightness" RUN+="${pkgs.coreutils-full}/bin/chmod g+w /sys/class/backlight/intel_backlight/brightness" ''; hardware.opengl.enable = true; hardware.bluetooth.enable = true; services.blueman.enable = true; fileSystems = { "/" = { device = "tmpfs"; fsType = "tmpfs"; options = [ "defaults" "size=2G" "mode=755" ]; }; }; swapDevices = [{ device = "/swap/swapfile"; }]; environment.persistence = { "/persist" = { directories = [ "/etc/NetworkManager/system-connections" "/etc/nixos" "/etc/wireguard" "/var/lib/bluetooth" "/var/lib/docker" "/var/lib/libvirt" "/var/lib/systemd/coredump" ]; files = [ "/etc/machine-id" "/etc/ssh/ssh_host_ed25519_key" "/etc/ssh/ssh_host_ed25519_key.pub" "/etc/ssh/ssh_host_ed25519_key-cert.pub" "/etc/ssh/user_ca.pub" ]; }; "/logs" = { directories = [ "/var/log" ]; }; }; # Open ports in the firewall. # networking.firewall.allowedTCPPorts = [ ... ]; # # networking.firewall.allowedUDPPorts = [ ... ]; # Or disable the firewall altogether. # networking.firewall.enable = false; # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "21.05"; # Did you read the comment? }