flake/hosts/dust/default.nix

219 lines
5.1 KiB
Nix
Raw Normal View History

2024-07-23 16:14:27 +00:00
{
lib,
2024-08-27 21:44:22 +00:00
config,
2024-07-23 16:14:27 +00:00
pkgs,
2024-08-27 21:44:22 +00:00
inputs,
2024-07-23 16:14:27 +00:00
...
}:
{
2024-07-23 16:14:27 +00:00
imports = [
2024-08-24 08:10:54 +00:00
../../nixos/profiles/sing-box
../../nixos/profiles/wireless
2024-07-23 16:14:27 +00:00
./anti-feature.nix
./disko.nix
./hardware-configuration.nix
./impermanence.nix
./lanzaboote.nix
];
networking.hostName = "dust";
time.timeZone = "Asia/Shanghai";
2024-08-12 07:25:36 +00:00
system.stateVersion = "24.05";
2024-07-23 16:14:27 +00:00
2024-08-27 21:44:22 +00:00
users.users = {
"guanranwang" = {
isNormalUser = true;
description = "Guanran Wang";
hashedPasswordFile = config.sops.secrets."hashed-passwd".path;
shell = pkgs.fish;
extraGroups = [
"wheel"
"nix-access-tokens"
];
};
};
home-manager = {
users.guanranwang = import ../../home;
useGlobalPkgs = true;
useUserPackages = true;
extraSpecialArgs = {
inherit inputs;
};
};
2024-07-23 16:14:27 +00:00
2024-08-19 14:45:14 +00:00
boot.tmp.useTmpfs = true;
2024-07-23 16:14:27 +00:00
services.tailscale = {
enable = true;
openFirewall = true;
};
environment.systemPackages = with pkgs; [
yubikey-manager
];
networking.firewall.allowedTCPPorts = [ 53317 ];
networking.firewall.allowedUDPPorts = [ 53317 ];
2024-07-23 16:14:27 +00:00
programs.adb.enable = true;
2024-08-27 21:44:22 +00:00
programs.dconf.enable = true;
programs.fish.enable = true;
2024-07-24 16:53:10 +00:00
programs.localsend.enable = true;
2024-07-23 16:14:27 +00:00
programs.seahorse.enable = true;
programs.ssh = {
startAgent = true;
enableAskPassword = true;
};
2024-07-23 16:14:27 +00:00
services.power-profiles-daemon.enable = true;
services.gvfs.enable = true;
services.gnome = {
gnome-keyring.enable = true;
sushi.enable = true;
};
# yubikey
services.pcscd.enable = true;
services.udev.packages = [ pkgs.yubikey-personalization ];
2024-07-23 16:14:27 +00:00
fonts = {
enableDefaultPackages = false;
packages = with pkgs; [
(nerdfonts.override {
fonts = [ "NerdFontsSymbolsOnly" ];
2024-07-23 16:14:27 +00:00
})
(inter.overrideAttrs {
installPhase = ''
runHook preInstall
install -Dm644 -t $out/share/fonts/truetype/ InterVariable*.ttf
runHook postInstall
'';
})
(jetbrains-mono.overrideAttrs {
installPhase = ''
runHook preInstall
install -Dm644 -t $out/share/fonts/truetype/ fonts/variable/*.ttf
runHook postInstall
'';
})
(source-serif.overrideAttrs {
installPhase = ''
runHook preInstall
install -Dm444 VAR/*.otf -t $out/share/fonts/variable
runHook postInstall
'';
})
source-han-sans-vf-otf
source-han-serif-vf-otf
2024-08-15 15:32:56 +00:00
noto-fonts
2024-07-23 16:14:27 +00:00
noto-fonts-color-emoji
];
2024-08-15 15:32:56 +00:00
fontconfig = {
defaultFonts = {
emoji = [
"Noto Color Emoji"
];
# Append emoji font for Qt apps, they might use the monochrome emoji
monospace = [
"JetBrains Mono"
"Source Han Sans SC VF"
"Symbols Nerd Font"
"Noto Color Emoji"
];
sansSerif = [
"Inter Variable"
"Source Han Sans SC VF"
"Noto Color Emoji"
];
serif = [
"Source Serif 4 Variable"
"Source Han Serif SC VF"
"Noto Color Emoji"
];
};
# GitHub perfers Noto Sans...
localConf = ''
<selectfont>
<rejectfont>
<pattern>
<patelt name="family">
<string>Noto Sans</string>
</patelt>
</pattern>
</rejectfont>
</selectfont>
'';
2024-07-23 16:14:27 +00:00
};
};
console = {
earlySetup = true;
keyMap = "dvorak";
};
services.greetd = {
enable = true;
2024-08-01 22:17:30 +00:00
settings.default_session.command = "${lib.getExe pkgs.greetd.tuigreet} --cmd ${pkgs.writeShellScript "sway" ''
2024-08-15 15:33:15 +00:00
dbus-update-activation-environment --all --systemd
2024-08-01 22:17:30 +00:00
exec systemd-cat --identifier=sway sway
''}";
2024-07-23 16:14:27 +00:00
};
security.polkit.enable = true;
systemd.user.services.polkit-gnome-authentication-agent-1 = {
description = "polkit-gnome-authentication-agent-1";
wantedBy = [ "graphical-session.target" ];
wants = [ "graphical-session.target" ];
after = [ "graphical-session.target" ];
2024-07-23 16:14:27 +00:00
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
Restart = "on-failure";
RestartSec = 1;
TimeoutStopSec = 10;
};
};
security.pam.services.swaylock = { };
2024-07-23 16:14:27 +00:00
xdg.portal = {
enable = true;
wlr.enable = true;
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
2024-07-23 16:14:27 +00:00
# https://gitlab.archlinux.org/archlinux/packaging/packages/sway/-/blob/main/sway-portals.conf
config."sway" = {
default = "gtk";
"org.freedesktop.impl.portal.ScreenCast" = "wlr";
"org.freedesktop.impl.portal.Screenshot" = "wlr";
"org.freedesktop.impl.portal.Inhibit" = "none";
};
};
2024-08-27 21:02:01 +00:00
services.sing-box.settings = {
outbounds = [
{
type = "selector";
tag = "select";
outbounds = [
"tyo0"
"direct"
];
default = "tyo0";
}
];
route = {
final = "select";
};
experimental = {
clash_api = {
external_controller = "127.0.0.1:9090";
external_ui = pkgs.metacubexd;
secret = "hunter2";
};
};
};
2024-07-23 16:14:27 +00:00
}