a
This commit is contained in:
parent
3e1538d457
commit
1d06c2f1f6
136
common/base.nix
136
common/base.nix
|
@ -7,29 +7,37 @@
|
||||||
...
|
...
|
||||||
}: {
|
}: {
|
||||||
imports = [
|
imports = [
|
||||||
|
./components/bootloader.nix
|
||||||
|
./components/networking.nix
|
||||||
|
./components/packages.nix
|
||||||
|
./components/security.nix
|
||||||
|
|
||||||
./locales/paris.nix
|
./locales/paris.nix
|
||||||
|
|
||||||
./services/sshd.nix
|
|
||||||
./programs/neovim.nix
|
./programs/neovim.nix
|
||||||
./programs/zsh.nix
|
./programs/zsh.nix
|
||||||
./programs/git.nix
|
./programs/git.nix
|
||||||
|
|
||||||
|
./services/sshd.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
nixpkgs = {
|
nix = {
|
||||||
overlays = [
|
settings = {
|
||||||
outputs.overlays.additions
|
# Enable flakes and new 'nix' command
|
||||||
outputs.overlays.modifications
|
experimental-features = "nix-command flakes";
|
||||||
outputs.overlays.unstable-packages
|
# Deduplicate and optimize nix store
|
||||||
];
|
auto-optimise-store = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# This will add each flake input as a registry
|
||||||
|
# To make nix3 commands consistent with your flake
|
||||||
|
registry = (lib.mapAttrs (_: flake: {inherit flake;})) ((lib.filterAttrs (_: lib.isType "flake")) inputs);
|
||||||
|
|
||||||
|
# This will additionally add your inputs to the system's legacy channels
|
||||||
|
# Making legacy nix commands consistent as well, awesome!
|
||||||
|
nixPath = ["/etc/nix/path"];
|
||||||
};
|
};
|
||||||
|
|
||||||
# This will add each flake input as a registry
|
|
||||||
# To make nix3 commands consistent with your flake
|
|
||||||
nix.registry = (lib.mapAttrs (_: flake: {inherit flake;})) ((lib.filterAttrs (_: lib.isType "flake")) inputs);
|
|
||||||
|
|
||||||
# This will additionally add your inputs to the system's legacy channels
|
|
||||||
# Making legacy nix commands consistent as well, awesome!
|
|
||||||
nix.nixPath = ["/etc/nix/path"];
|
|
||||||
environment.etc =
|
environment.etc =
|
||||||
lib.mapAttrs'
|
lib.mapAttrs'
|
||||||
(name: value: {
|
(name: value: {
|
||||||
|
@ -38,112 +46,24 @@
|
||||||
})
|
})
|
||||||
config.nix.registry;
|
config.nix.registry;
|
||||||
|
|
||||||
nix.settings = {
|
nixpkgs = {
|
||||||
# Enable flakes and new 'nix' command
|
overlays = [
|
||||||
experimental-features = "nix-command flakes";
|
outputs.overlays.additions
|
||||||
# Deduplicate and optimize nix store
|
outputs.overlays.modifications
|
||||||
auto-optimise-store = true;
|
outputs.overlays.unstable-packages
|
||||||
};
|
|
||||||
|
|
||||||
# Unfree packages that can be installe even if "allow-unfree.nix" isn't imported
|
|
||||||
nixpkgs.config.allowUnfreePredicate = pkg:
|
|
||||||
builtins.elem (lib.getName pkg) [
|
|
||||||
# Steam
|
|
||||||
"steam"
|
|
||||||
"steam-original"
|
|
||||||
"steam-run"
|
|
||||||
|
|
||||||
# Nvidia drivers
|
|
||||||
"nvidia-x11"
|
|
||||||
"nvidia-settings"
|
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.loader = {
|
|
||||||
systemd-boot = {
|
|
||||||
enable = true;
|
|
||||||
editor = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
efi.canTouchEfiVariables = true;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
# boot.initrd.enable = true;
|
|
||||||
# boot.initrd.systemd.enable = true;
|
|
||||||
# boot.plymouth = {
|
|
||||||
# enable = true;
|
|
||||||
# font = "${pkgs.jetbrains-mono}/share/fonts/truetype/JetBrainsMono-Regular.ttf";
|
|
||||||
# themePackages = [ pkgs.catppuccin-plymouth ];
|
|
||||||
# theme = "catppuccin-macchiato";
|
|
||||||
# logo = pkgs.fetchurl {
|
|
||||||
# url = "https://nixos.org/logo/nixos-hires.png";
|
|
||||||
# sha256 = "1ivzgd7iz0i06y36p8m5w48fd8pjqwxhdaavc0pxs7w1g7mcy5si";
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
networkmanager = {
|
|
||||||
enable = true;
|
|
||||||
wifi = {
|
|
||||||
powersave = true;
|
|
||||||
scanRandMacAddress = true;
|
|
||||||
# XXX https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1091
|
|
||||||
#backend = "iwd";
|
|
||||||
# Generate a random MAC for each WiFi and associate the two permanently.
|
|
||||||
macAddress = "stable";
|
|
||||||
};
|
|
||||||
# Randomize MAC for every ethernet connetion
|
|
||||||
ethernet.macAddress = "random";
|
|
||||||
connectionConfig = {
|
|
||||||
# IPv6 Privacy Extensions
|
|
||||||
"ipv6.ip6-privacy" = 2;
|
|
||||||
|
|
||||||
# unique DUID per connection
|
|
||||||
"ipv6.dhcp-duid" = "stable-uuid";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
firewall = {
|
|
||||||
enable = true;
|
|
||||||
trustedInterfaces = ["tailscale0"];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# sudo and nix can only be used by the wheel group
|
|
||||||
nix.settings.allowed-users = ["@wheel"];
|
|
||||||
security.sudo.execWheelOnly = true;
|
|
||||||
|
|
||||||
# Some programs need SUID wrappers, can be configured further or are
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
# started in user sessions.
|
# started in user sessions.
|
||||||
programs.mtr.enable = true;
|
programs.mtr.enable = true;
|
||||||
programs.gnupg.agent = {
|
programs.gnupg.agent = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enableSSHSupport = true;
|
enableSSHSupport = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
|
||||||
wget
|
|
||||||
dig
|
|
||||||
nmap
|
|
||||||
btop
|
|
||||||
gitFull
|
|
||||||
smartmontools
|
|
||||||
lm_sensors
|
|
||||||
pciutils
|
|
||||||
gcc
|
|
||||||
gnumake
|
|
||||||
sysstat
|
|
||||||
file
|
|
||||||
ffmpeg
|
|
||||||
usbutils
|
|
||||||
];
|
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
fwupd.enable = true;
|
fwupd.enable = true;
|
||||||
tailscale.enable = true;
|
tailscale.enable = true;
|
||||||
};
|
};
|
||||||
# console = {
|
|
||||||
# earlySetup = true;
|
|
||||||
# };
|
|
||||||
|
|
||||||
# boot.blacklistedKernelModules = [ "nvidia_drm" ];
|
|
||||||
}
|
}
|
||||||
|
|
23
common/components/bootloader.nix
Normal file
23
common/components/bootloader.nix
Normal file
|
@ -0,0 +1,23 @@
|
||||||
|
{
|
||||||
|
boot.loader = {
|
||||||
|
systemd-boot = {
|
||||||
|
enable = true;
|
||||||
|
editor = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
efi.canTouchEfiVariables = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# boot.initrd.enable = true;
|
||||||
|
# boot.initrd.systemd.enable = true;
|
||||||
|
# boot.plymouth = {
|
||||||
|
# enable = true;
|
||||||
|
# font = "${pkgs.jetbrains-mono}/share/fonts/truetype/JetBrainsMono-Regular.ttf";
|
||||||
|
# themePackages = [ pkgs.catppuccin-plymouth ];
|
||||||
|
# theme = "catppuccin-macchiato";
|
||||||
|
# logo = pkgs.fetchurl {
|
||||||
|
# url = "https://nixos.org/logo/nixos-hires.png";
|
||||||
|
# sha256 = "1ivzgd7iz0i06y36p8m5w48fd8pjqwxhdaavc0pxs7w1g7mcy5si";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
}
|
29
common/components/networking.nix
Normal file
29
common/components/networking.nix
Normal file
|
@ -0,0 +1,29 @@
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
networkmanager = {
|
||||||
|
enable = true;
|
||||||
|
wifi = {
|
||||||
|
powersave = true;
|
||||||
|
scanRandMacAddress = true;
|
||||||
|
# XXX https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1091
|
||||||
|
#backend = "iwd";
|
||||||
|
# Generate a random MAC for each WiFi and associate the two permanently.
|
||||||
|
macAddress = "stable";
|
||||||
|
};
|
||||||
|
# Randomize MAC for every ethernet connetion
|
||||||
|
ethernet.macAddress = "random";
|
||||||
|
connectionConfig = {
|
||||||
|
# IPv6 Privacy Extensions
|
||||||
|
"ipv6.ip6-privacy" = 2;
|
||||||
|
|
||||||
|
# unique DUID per connection
|
||||||
|
"ipv6.dhcp-duid" = "stable-uuid";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
firewall = {
|
||||||
|
enable = true;
|
||||||
|
trustedInterfaces = ["tailscale0"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
31
common/components/packages.nix
Normal file
31
common/components/packages.nix
Normal file
|
@ -0,0 +1,31 @@
|
||||||
|
{pkgs, ...}: {
|
||||||
|
# Unfree packages that can be installes regardless of whether "allow-unfree.nix" is imported
|
||||||
|
nixpkgs.config.allowUnfreePredicate = pkg:
|
||||||
|
builtins.elem (lib.getName pkg) [
|
||||||
|
# Steam
|
||||||
|
"steam"
|
||||||
|
"steam-original"
|
||||||
|
"steam-run"
|
||||||
|
|
||||||
|
# Nvidia drivers
|
||||||
|
"nvidia-x11"
|
||||||
|
"nvidia-settings"
|
||||||
|
];
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
wget
|
||||||
|
dig
|
||||||
|
nmap
|
||||||
|
btop
|
||||||
|
gitFull
|
||||||
|
smartmontools
|
||||||
|
lm_sensors
|
||||||
|
pciutils
|
||||||
|
gcc
|
||||||
|
gnumake
|
||||||
|
sysstat
|
||||||
|
file
|
||||||
|
ffmpeg
|
||||||
|
usbutils
|
||||||
|
];
|
||||||
|
}
|
5
common/components/security.nix
Normal file
5
common/components/security.nix
Normal file
|
@ -0,0 +1,5 @@
|
||||||
|
{
|
||||||
|
# sudo and nix can only be used by the wheel group
|
||||||
|
nix.settings.allowed-users = ["@wheel"];
|
||||||
|
security.sudo.execWheelOnly = true;
|
||||||
|
}
|
|
@ -22,7 +22,7 @@ in {
|
||||||
../../common/hardware/latest-kernel.nix
|
../../common/hardware/latest-kernel.nix
|
||||||
|
|
||||||
../../common/de/greetd.nix
|
../../common/de/greetd.nix
|
||||||
../../common/de/plasma6.nix
|
../../common/de/plasma6.nix
|
||||||
../../common/de/hyprland.nix
|
../../common/de/hyprland.nix
|
||||||
|
|
||||||
../../common/programs/steam.nix
|
../../common/programs/steam.nix
|
||||||
|
|
Loading…
Reference in a new issue