nixos/hosts/media/default.nix

106 lines
2.4 KiB
Nix
Raw Normal View History

2024-05-16 11:55:24 +01:00
{ inputs, config, lib, pkgs, outputs,... }:
{
imports =
[
2024-05-16 20:19:01 +01:00
# Disk configuration
2024-05-17 01:07:42 +01:00
#inputs.disko.nixosModules.disko
#(import ../common/disks/std-disk-config.nix { device = "/dev/vda"; })
../common/optional/btrfs-impermanence.nix
2024-05-17 01:07:42 +01:00
inputs.impermanence.nixosModules.impermanence
2024-05-16 20:19:01 +01:00
2024-05-16 11:55:24 +01:00
# Import core options
./hardware-configuration.nix
../common/core
# Create users for this host
2024-05-16 20:19:01 +01:00
../common/users/media
2024-05-16 11:55:24 +01:00
];
2024-05-17 01:07:42 +01:00
fileSystems."/persist".neededForBoot = true;
2024-05-17 09:15:46 +01:00
environment.persistence."/persist" = {
2024-05-17 01:07:42 +01:00
hideMounts = true;
directories = [
"/etc/nixos"
"/var/log"
"/var/lib/nixos"
"/var/lib/systemd/coredump"
"/etc/NetworkManager/system-connections"
];
2024-05-17 09:15:46 +01:00
users.talyz = {
directories = [
".ssh"
];
2024-05-17 09:16:33 +01:00
};
2024-05-17 01:07:42 +01:00
};
2024-05-16 11:55:24 +01:00
nixpkgs = {
overlays = [
outputs.overlays.additions
outputs.overlays.modifications
outputs.overlays.unstable-packages
];
config = {
allowUnfree = true;
};
};
2024-05-16 20:19:01 +01:00
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
timeout = 3;
};
};
i18n.defaultLocale = "en_GB.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "uk";
useXkbConfig = false;
};
networking = {
hostName = "media";
networkmanager.enable = true;
enableIPv6 = false;
};
services = {
qemuGuest.enable = true;
openssh = {
enable = true;
ports = [22]; # FIXME: Make this use configVars.networking
settings.PermitRootLogin = "yes";
# Fix LPE vulnerability with sudo use SSH_AUTH_SOCK: https://github.com/NixOS/nixpkgs/issues/31611
# this mitigates the security issue caused by enabling u2fAuth in pam
authorizedKeysFiles = lib.mkForce ["/etc/ssh/authorized_keys.d/%u"];
};
};
security.pam = {
sshAgentAuth.enable = true;
#FIXME the above is deprecated in 24.05 but we will wait until release
#sshAgentAuth.enable = true;
services = {
sudo.u2fAuth = true;
};
};
# ssh-agent is used to pull my private secrets repo from gitlab when deploying nix-config.
# programs.ssh.startAgent = true;
environment.systemPackages = builtins.attrValues {
inherit(pkgs)
wget
curl
git
rsync;
};
2024-05-16 11:55:24 +01:00
nix.settings.experimental-features = [ "nix-command" "flakes" ];
2024-05-16 20:19:01 +01:00
system.stateVersion = "23.11";
}