126 lines
2.9 KiB
Nix
126 lines
2.9 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
inputs,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
./unfree.nix
|
|
./applications.nix
|
|
./overlays.nix
|
|
./security.nix
|
|
];
|
|
|
|
boot.loader.timeout = 2;
|
|
boot.tmp.useTmpfs = true;
|
|
boot.loader.grub.splashImage = null;
|
|
|
|
console.keyMap = "de_CH-latin1";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
boot.kernel.sysctl = {
|
|
"kernel.panic" = 20; # Reboot kernel on panic after this much seconds
|
|
};
|
|
|
|
boot.initrd.network.udhcpc.extraArgs = [
|
|
"-A"
|
|
"900" # Wait for a DHCP lease on boot for 15mins
|
|
];
|
|
|
|
systemd.watchdog = {
|
|
runtimeTime = "5m";
|
|
rebootTime = "10m";
|
|
};
|
|
|
|
users.mutableUsers = false;
|
|
users.users = {
|
|
root.openssh.authorizedKeys.keys =
|
|
with lib;
|
|
concatLists (
|
|
mapAttrsToList (
|
|
name: user:
|
|
if elem "wheel" user.extraGroups && name != "root" then user.openssh.authorizedKeys.keys else [ ]
|
|
) config.users.users
|
|
);
|
|
};
|
|
|
|
# Disable dependency on xorg
|
|
# TODO: Set environment.noXlibs on hosts that don't need any x libraries.
|
|
security.pam.services.su.forwardXAuth = lib.mkForce false;
|
|
|
|
# Package management
|
|
nix = {
|
|
settings =
|
|
let
|
|
substituters = [
|
|
"https://${inputs.self.nixosConfigurations.lindberg-build.config.qois.nixpkgs-cache.hostname}?priority=39"
|
|
"https://cache.nixos.org?priority=40"
|
|
"https://attic.qo.is/qois-infrastructure"
|
|
];
|
|
in
|
|
{
|
|
trusted-users = [
|
|
"root"
|
|
"@wheel"
|
|
];
|
|
trusted-public-keys = [
|
|
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
|
"qois-infrastructure:lh35ymN7Aoxm5Hz0S6JusxE+cYzMU+x9OMKjDVIpfuE="
|
|
];
|
|
trusted-substituters = substituters; # For hosts that limit the subst list
|
|
inherit substituters;
|
|
};
|
|
gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 90d";
|
|
};
|
|
package = pkgs.nixVersions.stable;
|
|
extraOptions = ''
|
|
experimental-features = nix-command flakes
|
|
'';
|
|
};
|
|
|
|
# Network services
|
|
networking.firewall = {
|
|
allowPing = true;
|
|
allowedTCPPorts = [ 22 ];
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
settings.PasswordAuthentication = false;
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "sysadmin@qo.is";
|
|
};
|
|
|
|
# Default Settings
|
|
environment.etc = {
|
|
gitconfig.source = ./etc/gitconfig;
|
|
vimrc.source = ./etc/vimrc;
|
|
};
|
|
|
|
programs.autojump.enable = true;
|
|
programs.vim = {
|
|
enable = true;
|
|
defaultEditor = true;
|
|
};
|
|
|
|
sops.defaultSopsFile =
|
|
let
|
|
defaultSopsPath = "${inputs.private}/nixos-configurations/${config.networking.hostName}/secrets.sops.yaml";
|
|
in
|
|
lib.mkIf (builtins.pathExists defaultSopsPath) defaultSopsPath;
|
|
|
|
services.fstrim.enable = true;
|
|
|
|
qois.outgoing-server-mail.enable = true;
|
|
qois.backup-client.enable = true;
|
|
|
|
systemd.extraConfig = "DefaultLimitNOFILE=4096";
|
|
}
|