stockholm/tv/2configs/default.nix

141 lines
3.3 KiB
Nix
Raw Normal View History

2022-12-09 00:31:56 +00:00
with import ./lib;
{ config, pkgs, ... }: {
2017-08-01 20:32:14 +00:00
boot.tmpOnTmpfs = true;
krebs.enable = true;
krebs.build.user = config.krebs.users.tv;
2015-11-06 21:36:01 +00:00
networking.hostName = config.krebs.build.host.name;
2015-07-11 14:55:22 +00:00
imports = [
2015-11-08 10:53:29 +00:00
<secrets>
2015-12-28 18:43:31 +00:00
./backup.nix
./bash
2017-03-07 21:40:36 +00:00
./htop.nix
2020-08-19 00:30:51 +00:00
./nets/hkw.nix
./networkd.nix
2016-03-05 11:57:46 +00:00
./nginx
./pki
2016-07-23 10:18:46 +00:00
./ssh.nix
2016-07-23 11:11:50 +00:00
./sshd.nix
2015-11-01 12:28:16 +00:00
./vim.nix
2016-07-23 11:19:44 +00:00
./xdg.nix
2015-07-11 14:55:22 +00:00
{
2015-11-08 10:53:29 +00:00
users = {
defaultUserShell = "/run/current-system/sw/bin/bash";
mutableUsers = false;
users = {
tv = {
2016-02-21 05:56:57 +00:00
inherit (config.krebs.users.tv) home uid;
2015-11-08 10:53:29 +00:00
isNormalUser = true;
extraGroups = [ "tv" ];
2015-11-08 10:53:29 +00:00
};
2015-07-11 14:55:22 +00:00
};
};
}
{
2020-07-14 20:04:02 +00:00
i18n.defaultLocale = mkDefault "C.UTF-8";
2015-07-11 14:55:22 +00:00
security.sudo.extraConfig = ''
Defaults env_keep+="SSH_CLIENT _CURRENT_DESKTOP_NAME"
2015-07-24 23:06:13 +00:00
Defaults mailto="${config.krebs.users.tv.mail}"
2016-02-17 21:28:02 +00:00
Defaults !lecture
2015-07-11 14:55:22 +00:00
'';
time.timeZone = "Europe/Berlin";
}
2015-07-11 14:55:22 +00:00
{
2022-12-05 13:35:20 +00:00
nix.extraOptions = ''
auto-optimise-store = true
'';
2022-12-05 15:54:54 +00:00
# TODO check if both are required:
nix.settings.extra-sandbox-paths = [
"/etc/protocols"
pkgs.iana-etc.outPath
];
2015-07-11 14:55:22 +00:00
}
2016-02-02 19:12:06 +00:00
{
nixpkgs.config.allowUnfree = false;
}
{
environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
environment.systemPackages = with pkgs; [
rxvt_unicode.terminfo
];
2015-07-16 04:26:41 +00:00
environment.shellAliases = mkForce {
2015-07-11 14:55:22 +00:00
gp = "${pkgs.pari}/bin/gp -q";
df = "df -h";
du = "du -h";
# TODO alias cannot contain #\'
# "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
ls = "ls -h --color=auto --group-directories-first";
dmesg = "dmesg -L --reltime";
2015-11-01 12:28:16 +00:00
view = "vim -R";
2015-07-11 14:55:22 +00:00
};
2015-11-08 11:28:53 +00:00
environment.variables = {
2017-09-05 22:45:55 +00:00
NIX_PATH = mkForce (concatStringsSep ":" [
"secrets=/var/src/stockholm/null"
"/var/src"
]);
2015-11-08 11:28:53 +00:00
};
2015-07-11 14:55:22 +00:00
}
{
services.cron.enable = false;
services.ntp.enable = false;
2016-07-03 19:35:34 +00:00
services.timesyncd.enable = true;
2015-07-11 14:55:22 +00:00
}
{
boot.kernel.sysctl = {
# Enable IPv6 Privacy Extensions
#
# XXX use mkForce here because since NixOS 21.11 there's a collision in
# net.ipv6.conf.default.use_tempaddr, and boot.kernel.sysctl incapable
# of merging.
#
# XXX net.ipv6.conf.all.use_tempaddr is set because it was mentioned in
# https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch06s05.html
# TODO check if that is really necessary, otherwise we can rely solely
# on networking.tempAddresses in the future (when nothing is <21.11)
"net.ipv6.conf.all.use_tempaddr" = mkForce 2;
"net.ipv6.conf.default.use_tempaddr" = mkForce 2;
2015-07-11 14:55:22 +00:00
};
}
2016-02-01 16:40:25 +00:00
{
tv.iptables.enable = true;
2016-02-07 02:09:14 +00:00
tv.iptables.accept-echo-request = "internet";
2016-02-01 16:40:25 +00:00
}
{
services.journald.extraConfig = ''
SystemMaxUse=1G
RuntimeMaxUse=128M
'';
}
{
environment.systemPackages = [
2019-08-05 12:09:03 +00:00
pkgs.field
pkgs.get
2017-08-01 09:30:16 +00:00
pkgs.git
2018-10-07 14:37:06 +00:00
pkgs.git-crypt
2017-11-02 20:14:21 +00:00
pkgs.git-preview
2017-08-01 09:30:16 +00:00
pkgs.hashPassword
2017-06-27 08:01:16 +00:00
pkgs.htop
2017-07-12 21:55:42 +00:00
pkgs.kpaste
pkgs.nix-prefetch-scripts
2017-06-27 08:01:16 +00:00
pkgs.ovh-zone
pkgs.push
];
}
2015-07-11 14:55:22 +00:00
];
}