flake/nixos/profiles/common/core/default.nix

127 lines
3.5 KiB
Nix
Raw Normal View History

{
config,
lib,
2023-12-10 15:56:40 +00:00
inputs,
2023-12-25 14:27:42 +00:00
pkgs,
...
}: {
2023-10-16 08:26:06 +00:00
imports = [
2023-12-16 08:58:10 +00:00
./hardening
2023-12-27 17:28:28 +00:00
./networking
2023-11-17 05:38:25 +00:00
./nix
2023-12-10 15:56:40 +00:00
# Flake modules
2023-12-15 18:40:41 +00:00
inputs.self.nixosModules.default
2023-12-10 15:56:40 +00:00
inputs.disko.nixosModules.disko
inputs.home-manager.nixosModules.home-manager
inputs.impermanence.nixosModules.impermanence
inputs.lanzaboote.nixosModules.lanzaboote
inputs.sops-nix.nixosModules.sops
inputs.nix-gaming.nixosModules.pipewireLowLatency
2023-12-10 15:56:40 +00:00
];
2024-02-06 10:05:14 +00:00
nixpkgs.overlays = [
2024-02-12 05:27:05 +00:00
inputs.self.overlays.nautilus.typeahead
inputs.self.overlays.prismlauncher.offline-mode
inputs.self.overlays.sway.input-method-popup
inputs.self.overlays.sway.tray-dbus-menu
2024-02-06 10:05:14 +00:00
];
2024-01-17 04:47:27 +00:00
### home-manager
home-manager.users.guanranwang = import ./home;
2023-12-16 08:58:10 +00:00
users.mutableUsers = false;
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = {inherit inputs;}; # ??? isnt specialArgs imported by default ???
};
2023-10-16 08:26:06 +00:00
2023-12-16 08:58:10 +00:00
### Boot
2023-11-20 12:21:34 +00:00
boot.initrd.systemd.enable = true;
2023-12-16 08:58:10 +00:00
boot.loader.efi.canTouchEfiVariables = true;
2024-01-08 10:53:08 +00:00
boot.loader.systemd-boot.enable = lib.mkDefault true; # mkDefault for Lanzaboote
2024-01-09 18:13:52 +00:00
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_zen; # mkDefault for server
2023-11-20 12:21:34 +00:00
2023-12-16 08:58:10 +00:00
### Default Programs
2023-11-20 12:21:34 +00:00
environment.defaultPackages = [];
2023-12-25 14:27:42 +00:00
# In addtion of https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/config/system-path.nix
environment.systemPackages = with pkgs; [
unzip
wget
tree
file
htop
lsof
ltrace
dnsutils
pciutils
usbutils
];
2023-12-16 08:58:10 +00:00
programs.dconf.enable = true;
programs.nano.enable = false; # make sure to add another editor and set the $EDITOR variable
programs.neovim = {
enable = true;
viAlias = true;
vimAlias = true;
defaultEditor = true;
2023-09-19 00:17:43 +00:00
};
2023-12-16 08:58:10 +00:00
services.openssh = {
enable = true;
settings.PermitRootLogin = "no";
settings.PasswordAuthentication = false;
};
services.getty.greetingLine = let
inherit (config.system) nixos;
in ''
NixOS ${nixos.label} ${nixos.codeName} (\m) - \l
${lib.strings.optionalString (builtins.elem "nvidia" config.services.xserver.videoDrivers)
"--my-next-gpu-wont-be-nvidia"}
${lib.strings.optionalString (builtins.elem "amdgpu" config.boot.initrd.kernelModules)
"[ 5.996722] amdgpu 0000:67:00.0: Fatal error during GPU init"}
'';
2023-09-19 00:17:43 +00:00
2024-01-26 23:40:39 +00:00
### WORKAROUND: Use NVIDIA beta version 550.40.07 due to performance issues introduced in version 545.29.06,
2023-12-16 08:58:10 +00:00
# this shouldn't affect non-nvidia machines.
2024-01-26 23:40:39 +00:00
hardware.nvidia.package = config.boot.kernelPackages.nvidiaPackages.beta;
hardware.nvidia.nvidiaSettings = false;
2024-01-17 04:47:27 +00:00
users.users."guanranwang" = {
isNormalUser = true;
description = "Guanran Wang";
extraGroups = [
"wheel" # administrator
"networkmanager" # access to networkmanager
"tss" # access to tpm devices
"vboxusers" # access to virtualbox
"nix-access-tokens" # access to github tokens
"libvirtd" # access to virt-manager
];
hashedPasswordFile = config.sops.secrets."hashed-passwd".path;
shell = pkgs.fish;
packages = [];
};
programs.fish.enable = true;
users.groups."nix-access-tokens" = {};
nix.extraOptions = "!include ${config.sops.secrets.nix-access-tokens.path}";
### sops-nix
sops = {
defaultSopsFile = ../../../../secrets.yaml;
age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
gnupg.sshKeyPaths = [];
secrets = {
"hashed-passwd" = {
neededForUsers = true;
};
"nix-access-tokens" = {
group = config.users.groups."nix-access-tokens".name;
mode = "0440";
};
};
};
2023-09-19 00:17:43 +00:00
}