flake/nixos/profiles/core/default.nix

133 lines
3.1 KiB
Nix
Raw Normal View History

{
config,
lib,
2023-12-10 15:56:40 +00:00
inputs,
2023-12-25 14:27:42 +00:00
pkgs,
...
}: {
imports =
[
2024-07-09 23:12:02 +00:00
./hardening.nix
./networking.nix
2024-07-09 23:18:57 +00:00
./nix.nix
2024-08-01 22:17:30 +00:00
./zram.nix
]
++ (with inputs; [
disko.nixosModules.disko
home-manager.nixosModules.home-manager
impermanence.nixosModules.impermanence
lanzaboote.nixosModules.lanzaboote
self.nixosModules.default
sops-nix.nixosModules.sops
]);
2023-12-10 15:56:40 +00:00
2024-02-06 10:05:14 +00:00
nixpkgs.overlays = [
inputs.self.overlays.patches
2024-02-06 10:05:14 +00:00
];
2023-12-16 08:58:10 +00:00
home-manager = {
2024-07-09 23:18:57 +00:00
users.guanranwang = import ../../../home;
2023-12-16 08:58:10 +00:00
useGlobalPkgs = true;
useUserPackages = true;
2024-08-01 22:17:30 +00:00
extraSpecialArgs = {inherit inputs;};
2023-12-16 08:58:10 +00:00
};
2023-10-16 08:26:06 +00:00
2024-07-09 23:12:02 +00:00
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
2023-11-20 12:21:34 +00:00
2023-12-25 14:27:42 +00:00
environment.systemPackages = with pkgs; [
unzip
wget
tree
file
htop
lsof
ltrace
strace
2023-12-25 14:27:42 +00:00
dnsutils
pciutils
usbutils
];
2024-08-01 22:17:30 +00:00
users.mutableUsers = false;
2024-06-05 09:50:46 +00:00
users.users = rec {
"guanranwang" = {
isNormalUser = true;
description = "Guanran Wang";
hashedPasswordFile = config.sops.secrets."hashed-passwd".path;
shell = pkgs.fish;
extraGroups = [
"wheel"
"nix-access-tokens"
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMmd/uqiBahzKcKMJ+gT3dkUIdrWQgudspsDchDlx1E/ guanran928@outlook.com"
];
};
"root" = {
openssh.authorizedKeys.keys = guanranwang.openssh.authorizedKeys.keys;
};
2024-01-17 04:47:27 +00:00
};
2024-08-01 22:17:30 +00:00
boot.initrd.systemd.enable = true;
environment.stub-ld.enable = false;
programs.command-not-found.enable = false;
programs.dconf.enable = true;
2024-01-17 04:47:27 +00:00
programs.fish.enable = true;
2024-08-01 22:17:30 +00:00
programs.nano.enable = false;
programs.vim = {
enable = true;
defaultEditor = true;
};
# Avoid TOFU MITM with github by providing their public key here.
programs.ssh.knownHosts = {
"github.com".hostNames = ["github.com"];
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
"gitlab.com".hostNames = ["gitlab.com"];
"gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
"git.sr.ht".hostNames = ["git.sr.ht"];
"git.sr.ht".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
};
# https://archlinux.org/news/making-dbus-broker-our-default-d-bus-daemon/
services.dbus.implementation = lib.mkDefault "broker";
services.openssh = {
enable = true;
settings.PermitRootLogin = lib.mkDefault "no"; # mkDefault for colmena
settings.PasswordAuthentication = false;
};
security.sudo.execWheelOnly = true;
security.sudo.extraConfig = ''
Defaults lecture = never
'';
2024-07-09 23:18:57 +00:00
documentation = {
doc.enable = false;
info.enable = false;
nixos.enable = false;
};
# https://github.com/NixOS/nixpkgs/pull/308801
# nixos/switch-to-configuration: add new implementation
system.switch = {
enable = false;
enableNg = true;
};
2024-01-17 04:47:27 +00:00
### sops-nix
sops = {
2024-07-09 23:12:02 +00:00
defaultSopsFile = ../../../secrets.yaml;
2024-01-17 04:47:27 +00:00
age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
gnupg.sshKeyPaths = [];
2024-07-09 23:18:57 +00:00
secrets."hashed-passwd".neededForUsers = true;
2024-01-17 04:47:27 +00:00
};
2023-09-19 00:17:43 +00:00
}