159 lines
3.6 KiB
Nix
159 lines
3.6 KiB
Nix
with import <stockholm/lib>;
|
|
{ config, pkgs, ... }: {
|
|
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
boot.tmpOnTmpfs = true;
|
|
|
|
krebs.enable = true;
|
|
|
|
krebs.build.user = config.krebs.users.tv;
|
|
|
|
networking.hostName = config.krebs.build.host.name;
|
|
|
|
imports = [
|
|
<secrets>
|
|
./backup.nix
|
|
./bash
|
|
./htop.nix
|
|
./nginx
|
|
./ssh.nix
|
|
./sshd.nix
|
|
./vim.nix
|
|
./xdg.nix
|
|
{
|
|
users = {
|
|
defaultUserShell = "/run/current-system/sw/bin/bash";
|
|
mutableUsers = false;
|
|
users = {
|
|
tv = {
|
|
inherit (config.krebs.users.tv) home uid;
|
|
isNormalUser = true;
|
|
extraGroups = [ "tv" ];
|
|
};
|
|
};
|
|
};
|
|
}
|
|
{
|
|
security.hideProcessInformation = true;
|
|
security.sudo.extraConfig = ''
|
|
Defaults env_keep+="SSH_CLIENT XMONAD_SPAWN_WORKSPACE"
|
|
Defaults mailto="${config.krebs.users.tv.mail}"
|
|
Defaults !lecture
|
|
'';
|
|
time.timeZone = "Europe/Berlin";
|
|
}
|
|
|
|
{
|
|
# TODO check if both are required:
|
|
nix.sandboxPaths = [ "/etc/protocols" pkgs.iana_etc.outPath ];
|
|
|
|
nix.requireSignedBinaryCaches = true;
|
|
|
|
nix.binaryCaches = ["https://cache.nixos.org"];
|
|
|
|
nix.useSandbox = true;
|
|
}
|
|
{
|
|
nixpkgs.config.allowUnfree = false;
|
|
}
|
|
{
|
|
environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
rxvt_unicode.terminfo
|
|
];
|
|
|
|
environment.shellAliases = mkForce {
|
|
# alias cal='cal -m3'
|
|
gp = "${pkgs.pari}/bin/gp -q";
|
|
df = "df -h";
|
|
du = "du -h";
|
|
# alias grep='grep --color=auto'
|
|
|
|
# TODO alias cannot contain #\'
|
|
# "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
|
|
|
|
# alias la='ls -lA'
|
|
lAtr = "ls -lAtr";
|
|
# alias ll='ls -l'
|
|
ls = "ls -h --color=auto --group-directories-first";
|
|
dmesg = "dmesg -L --reltime";
|
|
view = "vim -R";
|
|
|
|
deploy = pkgs.writeDash "deploy" ''
|
|
set -eu
|
|
cd ~/stockholm
|
|
export SYSTEM="$1"
|
|
exec nix-shell -I stockholm="$PWD" --run 'deploy --system="$SYSTEM"'
|
|
'';
|
|
reload = "systemctl reload";
|
|
restart = "systemctl restart";
|
|
start = "systemctl start";
|
|
status = "systemctl status";
|
|
stop = "systemctl stop";
|
|
};
|
|
|
|
environment.variables = {
|
|
NIX_PATH = mkForce (concatStringsSep ":" [
|
|
"secrets=/var/src/stockholm/null"
|
|
"nixpkgs-overlays=${config.tv.nixpkgs-overlays}"
|
|
"/var/src"
|
|
]);
|
|
};
|
|
}
|
|
|
|
{
|
|
environment.variables =
|
|
flip genAttrs (_: "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt") [
|
|
"CURL_CA_BUNDLE"
|
|
"GIT_SSL_CAINFO"
|
|
"SSL_CERT_FILE"
|
|
];
|
|
}
|
|
|
|
{
|
|
services.cron.enable = false;
|
|
services.nscd.enable = false;
|
|
services.ntp.enable = false;
|
|
services.timesyncd.enable = true;
|
|
}
|
|
|
|
{
|
|
boot.kernel.sysctl = {
|
|
# Enable IPv6 Privacy Extensions
|
|
"net.ipv6.conf.all.use_tempaddr" = 2;
|
|
"net.ipv6.conf.default.use_tempaddr" = 2;
|
|
};
|
|
}
|
|
|
|
{
|
|
tv.iptables.enable = true;
|
|
tv.iptables.accept-echo-request = "internet";
|
|
}
|
|
|
|
{
|
|
services.journald.extraConfig = ''
|
|
SystemMaxUse=1G
|
|
RuntimeMaxUse=128M
|
|
'';
|
|
}
|
|
|
|
{
|
|
environment.systemPackages = [
|
|
pkgs.get
|
|
pkgs.git
|
|
pkgs.git-crypt
|
|
pkgs.git-preview
|
|
pkgs.hashPassword
|
|
pkgs.htop
|
|
pkgs.kpaste
|
|
pkgs.krebspaste
|
|
pkgs.nix-prefetch-scripts
|
|
pkgs.ovh-zone
|
|
pkgs.push
|
|
];
|
|
}
|
|
];
|
|
}
|