flake/nixos/profiles/core/default.nix

139 lines
3 KiB
Nix
Raw Normal View History

{
config,
lib,
2023-12-10 15:56:40 +00:00
inputs,
...
}: {
2023-10-16 08:26:06 +00:00
imports = [
2023-11-20 12:21:34 +00:00
../../modules
2023-11-17 05:38:25 +00:00
./nix
./packages
./sysctl.nix
2023-12-10 15:56:40 +00:00
# Flake modules
inputs.disko.nixosModules.disko
inputs.home-manager.nixosModules.home-manager
inputs.impermanence.nixosModules.impermanence
inputs.lanzaboote.nixosModules.lanzaboote
inputs.sops-nix.nixosModules.sops
];
# Flake overlays
nixpkgs.overlays = [
inputs.berberman.overlays.default
2023-10-16 08:26:06 +00:00
];
2023-11-20 12:21:34 +00:00
boot.initrd.systemd.enable = true;
boot.loader = {
efi.canTouchEfiVariables = true;
systemd-boot = {
enable = lib.mkDefault true; # mkDefault for Lanzaboote
editor = false; # Disabled for security
### Utilities
#netbootxyz.enable = true;
#memtest86.enable = true;
};
};
2023-10-15 00:51:56 +00:00
users.mutableUsers = false;
2023-09-19 00:17:43 +00:00
# Programs
2023-11-20 12:21:34 +00:00
environment.defaultPackages = [];
2023-09-19 00:17:43 +00:00
programs = {
dconf.enable = true;
2023-11-20 12:21:34 +00:00
nano.enable = false; # make sure to add another editor and set the $EDITOR variable, in this case I am using neovim
2023-09-19 00:17:43 +00:00
neovim = {
enable = true;
viAlias = true;
vimAlias = true;
2023-11-08 14:19:15 +00:00
defaultEditor = true;
2023-09-19 00:17:43 +00:00
};
};
# Services
services = {
2023-12-05 06:29:55 +00:00
getty.greetingLine = let
inherit (config.system) nixos;
inherit (config.myFlake.nixos.hardware.components) gpu;
in ''
NixOS ${nixos.label} ${nixos.codeName} (\m) - \l
${lib.strings.optionalString gpu.nvidia.enable
"--my-next-gpu-wont-be-nvidia"}
${lib.strings.optionalString gpu.amd.enable
"[ 5.996722] amdgpu 0000:67:00.0: Fatal error during GPU init"}
'';
2023-10-15 00:51:56 +00:00
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
};
2023-09-19 00:17:43 +00:00
#cron.enable = true;
#dbus.enable = true;
2023-10-15 00:51:56 +00:00
2023-09-19 00:17:43 +00:00
# BTRFS De-Dupe
# bruh how to make it not a background job
# i want to run it manually
#beesd.filesystems = {
# root = {
2023-11-04 10:02:11 +00:00
# spec = "UUID=3e10ff73-e1f7-4b39-88f5-7f31dcc8f38c";
2023-09-19 00:17:43 +00:00
# hashTableSizeMB = 2048;
# verbosity = "crit";
2023-11-04 10:02:11 +00:00
# #extraOptions = [ "--loadavg-target" "5.0" ];
2023-09-19 00:17:43 +00:00
# };
#};
};
2023-11-15 00:39:16 +00:00
2023-12-10 15:56:40 +00:00
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = {inherit inputs;}; # ??? isnt specialArgs imported by default ???
};
2023-11-15 00:39:16 +00:00
### Basic hardening
# ref: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
# ref: https://madaidans-insecurities.github.io/guides/linux-hardening.html
#
2023-11-20 12:21:34 +00:00
# also see: ./sysctl.nix
2023-11-15 00:39:16 +00:00
environment.etc.machine-id.text = "b08dfa6083e7567a1921a715000001fb"; # whonix id
security = {
apparmor.enable = true;
sudo.execWheelOnly = true;
};
boot.blacklistedKernelModules = [
# Obscure network protocols
"ax25"
"netrom"
"rose"
# Old or rare or insufficiently audited filesystems
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
2023-09-19 00:17:43 +00:00
}