Basic configuration for nki-home
nki-home tinc working Don't route tinc through vpn Don't do it lol Integrate home-manager Merge nki-home/flake into main flake Add MacOS clipboard compat Make VPN input a secret
This commit is contained in:
parent
1c3fd3f47b
commit
466f5f1e90
105
flake.lock
105
flake.lock
|
|
@ -21,16 +21,35 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"home-manager": {
|
"home-manager-21_05": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": "nixpkgs"
|
"nixpkgs": "nixpkgs"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1635123562,
|
"lastModified": 1634544068,
|
||||||
"narHash": "sha256-kYuwQqHXDYxy5ijpm8SvCoPNx0br1TpoWeTIOEwOYvA=",
|
"narHash": "sha256-RlRQBaAHfdWqfRyHdWuDPMkplBTYwuyDQqDcNbP/Sog=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "da8a78eec9f7adb57f9e961d1da64805efacff37",
|
"rev": "ff2bed9dac84fb202bbb3c49fdcfe30c29d0b12f",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"ref": "release-21.05",
|
||||||
|
"repo": "home-manager",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"home-manager-unstable": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": "nixpkgs_2"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1635473360,
|
||||||
|
"narHash": "sha256-sxb4xuP/9f6z29y4Sxzk0g6gzFKUX9r3vNzga/pCROw=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "home-manager",
|
||||||
|
"rev": "cf4866d2187399117d3aed47a58e6f8ef58e5afd",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -41,11 +60,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1635268020,
|
"lastModified": 1635471979,
|
||||||
"narHash": "sha256-oaWU7ZvobClXLrQGj7Xvjs2vSlItPFkw/usKh/2c56Y=",
|
"narHash": "sha256-qlpiKdJ5gF7hU1TuNoz4xTsroUSrdErwovu3rD5cy2c=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "89a27a2e6f54993224f804e50a29e48b8c83d1ca",
|
"rev": "3f33a306a55bd7ecedf586a627063a211ffdc6f0",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -70,6 +89,20 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_2": {
|
"nixpkgs_2": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1635471979,
|
||||||
|
"narHash": "sha256-qlpiKdJ5gF7hU1TuNoz4xTsroUSrdErwovu3rD5cy2c=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "3f33a306a55bd7ecedf586a627063a211ffdc6f0",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"id": "nixpkgs",
|
||||||
|
"type": "indirect"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs_3": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1622516815,
|
"lastModified": 1622516815,
|
||||||
"narHash": "sha256-ZjBd81a6J3TwtlBr3rHsZspYUwT9OdhDk+a/SgSEf7I=",
|
"narHash": "sha256-ZjBd81a6J3TwtlBr3rHsZspYUwT9OdhDk+a/SgSEf7I=",
|
||||||
|
|
@ -85,12 +118,64 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"nixpkgs_4": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1625223284,
|
||||||
|
"narHash": "sha256-jjLcDSU1rRiJb+n3uez23XAa7kbnPcGZTa6jIKh1GMQ=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "357d2c8f6087685fe35cb1889a005a4dd4cce7b8",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixpkgs-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nur": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1635473664,
|
||||||
|
"narHash": "sha256-teOeaFqN6gpUaOaU698Ux5GV/mcFwefT/8WbwpdjRKI=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "NUR",
|
||||||
|
"rev": "7d89d7eba61c4fa1a482febe0714e43f3e022bec",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "NUR",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"darwin": "darwin",
|
"darwin": "darwin",
|
||||||
"home-manager": "home-manager",
|
"home-manager-21_05": "home-manager-21_05",
|
||||||
"nixpkgs": "nixpkgs_2",
|
"home-manager-unstable": "home-manager-unstable",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable"
|
"nixpkgs": "nixpkgs_3",
|
||||||
|
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||||
|
"nur": "nur",
|
||||||
|
"sops-nix": "sops-nix"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"sops-nix": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": "nixpkgs_4"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1633273832,
|
||||||
|
"narHash": "sha256-oOjpMVYpkIUpiML61PeqTk+sg4juRvF7P6jroI/YvTw=",
|
||||||
|
"owner": "Mic92",
|
||||||
|
"repo": "sops-nix",
|
||||||
|
"rev": "2e86e1698d53e5bd71d9de5f8b7e8f2f5458633c",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "Mic92",
|
||||||
|
"repo": "sops-nix",
|
||||||
|
"type": "github"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
|
||||||
45
flake.nix
45
flake.nix
|
|
@ -1,32 +1,59 @@
|
||||||
{
|
{
|
||||||
description = "nki's darwin system";
|
description = "nki's systems";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "github:nixos/nixpkgs/21.05";
|
nixpkgs.url = "github:nixos/nixpkgs/21.05";
|
||||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
||||||
darwin.url = "github:lnl7/nix-darwin/master";
|
darwin.url = "github:lnl7/nix-darwin/master";
|
||||||
darwin.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
darwin.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||||
home-manager.url = "github:nix-community/home-manager";
|
home-manager-unstable.url = "github:nix-community/home-manager";
|
||||||
|
home-manager-21_05.url = "github:nix-community/home-manager/release-21.05";
|
||||||
|
sops-nix.url = "github:Mic92/sops-nix";
|
||||||
|
nur.url = "github:nix-community/NUR";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, darwin, nixpkgs, nixpkgs-unstable, home-manager }: {
|
outputs = { self, darwin, nixpkgs, nixpkgs-unstable, home-manager-unstable, home-manager-21_05, sops-nix, nur }: {
|
||||||
# MacBook configuration: nix-darwin + home-manager
|
# MacBook configuration: nix-darwin + home-manager
|
||||||
darwinConfigurations."nki-macbook" = darwin.lib.darwinSystem rec {
|
darwinConfigurations."nki-macbook" = darwin.lib.darwinSystem {
|
||||||
system = "aarch64-darwin";
|
system = "aarch64-darwin";
|
||||||
modules = [
|
modules = [
|
||||||
./darwin/configuration.nix
|
./darwin/configuration.nix
|
||||||
home-manager.darwinModules.home-manager
|
home-manager-unstable.darwinModules.home-manager
|
||||||
{
|
{
|
||||||
home-manager.useGlobalPkgs = true;
|
home-manager.useGlobalPkgs = true;
|
||||||
home-manager.useUserPackages = true;
|
home-manager.useUserPackages = true;
|
||||||
home-manager.extraSpecialArgs = { inherit nixpkgs-unstable; };
|
|
||||||
home-manager.users.nki = import ./home/macbook-home.nix;
|
home-manager.users.nki = import ./home/macbook-home.nix;
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
inputs = {
|
|
||||||
inherit darwin nixpkgs-unstable;
|
|
||||||
nixpkgs = nixpkgs-unstable;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Home configuration
|
||||||
|
nixosConfigurations."nki-home" = nixpkgs.lib.nixosSystem {
|
||||||
|
system = "x86_64-linux";
|
||||||
|
modules = [
|
||||||
|
./modules/my-tinc
|
||||||
|
sops-nix.nixosModules.sops
|
||||||
|
./nki-home/configuration.nix
|
||||||
|
home-manager-21_05.nixosModules.home-manager
|
||||||
|
{
|
||||||
|
home-manager.useGlobalPkgs = true;
|
||||||
|
home-manager.useUserPackages = true;
|
||||||
|
home-manager.users.nki = import ./home/kagami-pc-home.nix;
|
||||||
|
}
|
||||||
|
(let
|
||||||
|
overlay-unstable = final: prev: {
|
||||||
|
unstable = import nixpkgs-unstable { config.allowUnfree = true; system = prev.system; };
|
||||||
|
unfree = import nixpkgs { config.allowUnfree = true; system = prev.system; };
|
||||||
|
};
|
||||||
|
overlay-needs-unstable = final: prev: {
|
||||||
|
# override some packages that needs unstable that cannot be changed in the setup.
|
||||||
|
nix-direnv = prev.unstable.nix-direnv;
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
nixpkgs.overlays = [ overlay-unstable overlay-needs-unstable nur.overlay ]; # we assign the overlay created before to the overlays of nixpkgs.
|
||||||
|
})
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,12 @@
|
||||||
{ pkgs, config, lib, ... } :
|
{ pkgs, config, lib, ... } :
|
||||||
|
|
||||||
let
|
|
||||||
pkgsUnstable = import <nixpkgs-unstable> {};
|
|
||||||
in
|
|
||||||
{
|
{
|
||||||
home.packages = [
|
home.packages = [
|
||||||
];
|
];
|
||||||
|
|
||||||
programs.alacritty = {
|
programs.alacritty = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgsUnstable.alacritty;
|
package = pkgs.unstable.alacritty;
|
||||||
|
|
||||||
settings = {
|
settings = {
|
||||||
background_opacity = 0.95;
|
background_opacity = 0.95;
|
||||||
|
|
|
||||||
|
|
@ -34,4 +34,14 @@
|
||||||
"x-scheme-handler/ftps" = [ "firefox.desktop" ];
|
"x-scheme-handler/ftps" = [ "firefox.desktop" ];
|
||||||
"x-scheme-handler/mailspring" = [ "Mailspring.desktop" ];
|
"x-scheme-handler/mailspring" = [ "Mailspring.desktop" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Mimic the clipboard stuff in MacOS
|
||||||
|
home.packages = [
|
||||||
|
(pkgs.writeShellScriptBin "pbcopy" ''
|
||||||
|
exec ${pkgs.xsel}/bin/xsel -ib
|
||||||
|
'')
|
||||||
|
(pkgs.writeShellScriptBin "pbpaste" ''
|
||||||
|
exec ${pkgs.xsel}/bin/xsel -ob
|
||||||
|
'')
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,8 @@
|
||||||
{ pkgs, config, lib, ... }:
|
{ pkgs, config, lib, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
pkgsUnstable = import <nixpkgs-unstable> {};
|
|
||||||
# Override nss to open links in Firefox (https://github.com/NixOS/nixpkgs/issues/78961)
|
# Override nss to open links in Firefox (https://github.com/NixOS/nixpkgs/issues/78961)
|
||||||
discordPkg = pkgsUnstable.discord.override { nss = pkgs.nss_latest; };
|
discordPkg = pkgs.unstable.discord.override { nss = pkgs.unstable.nss; };
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [ ./alacritty.nix ./i3.nix ];
|
imports = [ ./alacritty.nix ./i3.nix ];
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,9 @@
|
||||||
{ config, pkgs, nixpkgs-unstable, ... }:
|
{ config, pkgs, nixpkgs-unstable, ... }:
|
||||||
|
|
||||||
let
|
|
||||||
pkgsUnstable = import nixpkgs-unstable { system = pkgs.system; };
|
|
||||||
in
|
|
||||||
{
|
{
|
||||||
programs.fish = {
|
programs.fish = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgsUnstable.fish;
|
package = pkgs.unstable.fish;
|
||||||
functions = {
|
functions = {
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
{ pkgs, config, lib, ... }:
|
{ pkgs, config, lib, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
pkgsUnstableOsu = import "/home/nki/nixpkgs/osu-lazer" {};
|
# pkgsUnstableOsu = import "/home/nki/nixpkgs/osu-lazer" {};
|
||||||
# osu = pkgs.osu-lazer.overrideAttrs (oldAttrs : rec {
|
# osu = pkgs.osu-lazer.overrideAttrs (oldAttrs : rec {
|
||||||
# version = "2021.1006.1";
|
# version = "2021.1006.1";
|
||||||
# src = pkgs.fetchFromGitHub {
|
# src = pkgs.fetchFromGitHub {
|
||||||
|
|
@ -13,5 +13,5 @@ let
|
||||||
# });
|
# });
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
home.packages = [ pkgsUnstableOsu.osu-lazer ];
|
home.packages = [ pkgs.unstable.osu-lazer ];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -29,6 +29,11 @@ in
|
||||||
type = types.enum hostNames;
|
type = types.enum hostNames;
|
||||||
description = "The configured host name";
|
description = "The configured host name";
|
||||||
};
|
};
|
||||||
|
bindPort = mkOption {
|
||||||
|
type = types.port;
|
||||||
|
default = 655;
|
||||||
|
description = "The port to listen on";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable (builtins.seq
|
config = mkIf cfg.enable (builtins.seq
|
||||||
|
|
@ -83,6 +88,8 @@ in
|
||||||
chroot = false; # otherwise addresses can't be a DNS
|
chroot = false; # otherwise addresses can't be a DNS
|
||||||
interfaceType = "tap"; # tun might also work.
|
interfaceType = "tap"; # tun might also work.
|
||||||
|
|
||||||
|
bindToAddress = "* ${toString cfg.bindPort}";
|
||||||
|
|
||||||
ed25519PrivateKeyFile = cfg.ed25519PrivateKey;
|
ed25519PrivateKeyFile = cfg.ed25519PrivateKey;
|
||||||
rsaPrivateKeyFile = cfg.rsaPrivateKey;
|
rsaPrivateKeyFile = cfg.rsaPrivateKey;
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -6,6 +6,12 @@
|
||||||
rsaPublicKey = builtins.readFile ./nki-cloud.pub;
|
rsaPublicKey = builtins.readFile ./nki-cloud.pub;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
home = {
|
||||||
|
subnetAddr = "11.0.0.2";
|
||||||
|
rsaPublicKey = builtins.readFile ./nki-home.pub;
|
||||||
|
ed25519PublicKey = "Ts5OdPtBNLIRfosoYRcb6Z2iwWyOz/VKTKB9J0p5LlH";
|
||||||
|
};
|
||||||
|
|
||||||
macbook = {
|
macbook = {
|
||||||
subnetAddr = "11.0.0.3";
|
subnetAddr = "11.0.0.3";
|
||||||
rsaPublicKey = builtins.readFile ./nki-macbook.pub;
|
rsaPublicKey = builtins.readFile ./nki-macbook.pub;
|
||||||
|
|
|
||||||
24
modules/my-tinc/hosts/nki-home.pub
Normal file
24
modules/my-tinc/hosts/nki-home.pub
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
-----BEGIN RSA PUBLIC KEY-----
|
||||||
|
MIIECgKCBAEAxL0DTIcnBOhBCMdimixjZmvPdlN4fO+W2bXfYnqQuqZ3eak+vUv5
|
||||||
|
Q0fddRIZHLFKh+97gacdoyRxvhGWod5kI0jiLypcAvF2IW/0RpbYMrLZDF/zKzQS
|
||||||
|
COI5f+h3BjM/gjlkiuPscF2i53HjcytH4OkGbXMnNP0IYalB5ZYCiTveF+caECgO
|
||||||
|
KyERSPCNwD9L5OXkmIJwh9ij+V5uvUj0+Khweq6f50R23DBmnWb4qmV+1VLCvY+z
|
||||||
|
qvOkfXW0F06X00oPc9G/rTTLYq6A++/w7slO+fBiQfhw59QHnDcrqbbkaeL+3s/b
|
||||||
|
haLUNXf47AFLCCKcj9Pg28whMcKRhSW1+f6Z1B5Yn5Ohf2JZnfNTOWb6AVS65rN1
|
||||||
|
WkO+Dtc8BBQKC33xcDEcIp6muV2LF2J561zV+Wz5kZaBGEsERo55ctvazRi69MTt
|
||||||
|
MsNKAIAMZNwv7QQ9+NdrV4ErlydidUXUXLg2VARPhEMi8Jlgd7u7Uf9nnk0sQyXo
|
||||||
|
ML3HerTfydM+9SE6JtpM71B9a7J8fw4i9uf25PMqTK6GhfJtJmyaB8rp4O6gsrKm
|
||||||
|
dUA8k4CGBWMi6jQxVksF0klew0vLVJWhA+izR6HwvXNEBTmjDqlEtRBdIVRXEBVf
|
||||||
|
BiRS0u63Bi/S811KmzPnalYzj9OBHzAdD8k5TfipkHXF50bIi5YLNlSKkUafMXcv
|
||||||
|
TsfXTVhDpptqwjMC8VddHPug9emavfoDuRpa+6zMjZUdVbGZp2V+RCAh3V9N8Xhc
|
||||||
|
tKS9tNKX//E5rGpj2LCd4yZe+NPSUEwRk55NGrVXY6DeCB4bdIp/HqMWcsnLCP8I
|
||||||
|
BQooOfRKwFd78QHkeoon7Ky4yfwyyoDoDRr+i0KhbVJIBSBBhjxrB2yH5s8bKz6u
|
||||||
|
GyBo9csYoPH0TrrNnhHI7fXOC0I/Yn/zPEhdSnKDIqja/xtqlY4opNR9Ezmi3nCt
|
||||||
|
EqNvfP8PRYjIGBpy6MfVdVomIPtJ3Y9wBEC29PXjElARGw6a8VR5KWy8n6CLbSq2
|
||||||
|
b+iPVb9kP1/R0P9xGFyIbpvcgxAuSCsnwFmYIVUHAda3fd3hSHlV95Pu09QeVrTi
|
||||||
|
SPNrgbX+1uJ/q3bEFpltmHNX2/XpnKFtd9FqDKELJTyQ1zG15FI93YPO80CPdp/w
|
||||||
|
9ktj7BnR73Yc8l1c/rBaQ9/V71pnBwrUPqznXo1ilfI4oBcz4YKMqMNDWUCbCcES
|
||||||
|
MLCiIHqHpodrC09xtldrAd3HyRDNhFsS53BpSKFvjKSKrhwHFN1nSXr5JUTc3Xun
|
||||||
|
HcIAG0F38DgzvdUf+nvI79pSEzDGG+/jWI3nO9KzHHsxF0K2RBIuxTgmOj1Yo6ek
|
||||||
|
01jlKDZgPWOs4wPYsQwYo/nwlba/zIm1qwIDAQAB
|
||||||
|
-----END RSA PUBLIC KEY-----
|
||||||
1
nki-home/.gitignore
vendored
Normal file
1
nki-home/.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
/result
|
||||||
246
nki-home/configuration.nix
Normal file
246
nki-home/configuration.nix
Normal file
|
|
@ -0,0 +1,246 @@
|
||||||
|
# Edit this configuration file to define what should be installed on
|
||||||
|
# your system. Help is available in the configuration.nix(5) man page
|
||||||
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||||
|
|
||||||
|
{ lib, config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ # Include the results of the hardware scan.
|
||||||
|
./hardware-configuration.nix
|
||||||
|
# secret management
|
||||||
|
./secrets
|
||||||
|
];
|
||||||
|
|
||||||
|
# Use the systemd-boot EFI boot loader.
|
||||||
|
boot = {
|
||||||
|
plymouth.enable = true;
|
||||||
|
loader.timeout = 60;
|
||||||
|
loader.systemd-boot.enable = true;
|
||||||
|
loader.efi.canTouchEfiVariables = true;
|
||||||
|
};
|
||||||
|
## Encryption
|
||||||
|
# Kernel modules needed for mounting USB VFAT devices in initrd stage
|
||||||
|
boot.initrd.kernelModules = [ "usb_storage" ];
|
||||||
|
boot.initrd.luks.devices = {
|
||||||
|
root = {
|
||||||
|
keyFile = "/dev/disk/by-id/usb-090c___B1608112001295-0:0";
|
||||||
|
keyFileSize = 4096;
|
||||||
|
fallbackToPassword = true;
|
||||||
|
device = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
|
||||||
|
preLVM = true;
|
||||||
|
allowDiscards = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.hostName = "kagamiPC"; # Define your hostname.
|
||||||
|
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||||
|
|
||||||
|
# Set your time zone.
|
||||||
|
time.timeZone = "America/Toronto";
|
||||||
|
|
||||||
|
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||||
|
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||||
|
# replicates the default behaviour.
|
||||||
|
networking.useDHCP = false;
|
||||||
|
networking.interfaces.enp8s0.useDHCP = true;
|
||||||
|
networking.interfaces.wlp7s0.useDHCP = true;
|
||||||
|
|
||||||
|
# Configure network proxy if necessary
|
||||||
|
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||||
|
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||||
|
|
||||||
|
nix = {
|
||||||
|
package = pkgs.nixUnstable;
|
||||||
|
extraOptions = ''
|
||||||
|
experimental-features = nix-command flakes
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
# Select internationalisation properties.
|
||||||
|
i18n.defaultLocale = "ja_JP.UTF-8";
|
||||||
|
i18n.inputMethod.enabled = "ibus";
|
||||||
|
i18n.inputMethod.ibus.engines = (with pkgs.ibus-engines; [bamboo mozc libpinyin]);
|
||||||
|
# console = {
|
||||||
|
# font = "Lat2-Terminus16";
|
||||||
|
# keyMap = "us";
|
||||||
|
# };
|
||||||
|
|
||||||
|
# Enable the X11 windowing system.
|
||||||
|
services.xserver.enable = true;
|
||||||
|
|
||||||
|
# Configure keymap in X11
|
||||||
|
services.xserver.layout = "jp";
|
||||||
|
# services.xserver.xkbOptions = "";
|
||||||
|
|
||||||
|
# Enable CUPS to print documents.
|
||||||
|
# services.printing.enable = true;
|
||||||
|
|
||||||
|
# Enable sound.
|
||||||
|
sound.enable = true;
|
||||||
|
hardware.pulseaudio = {
|
||||||
|
enable = true;
|
||||||
|
extraModules = [ pkgs.pulseaudio-modules-bt ];
|
||||||
|
package = pkgs.pulseaudioFull;
|
||||||
|
};
|
||||||
|
# Enable touchpad support (enabled default in most desktopManager).
|
||||||
|
# services.xserver.libinput.enable = true;
|
||||||
|
|
||||||
|
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||||
|
users.users.nki = {
|
||||||
|
isNormalUser = true;
|
||||||
|
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||||
|
};
|
||||||
|
|
||||||
|
# Allow all packages
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
|
||||||
|
# List packages installed in system profile. To search, run:
|
||||||
|
# $ nix search wget
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
kakoune # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||||
|
wget
|
||||||
|
fish
|
||||||
|
firefox
|
||||||
|
|
||||||
|
## System monitoring tools
|
||||||
|
busybox
|
||||||
|
|
||||||
|
## Security stuff
|
||||||
|
qtkeychain
|
||||||
|
|
||||||
|
## Enable nix-flakes
|
||||||
|
# (pkgs.writeShellScriptBin "nixFlakes" ''
|
||||||
|
# exec ${pkgs.nixUnstable}/bin/nix --experimental-features "nix-command flakes" "$@"
|
||||||
|
# '')
|
||||||
|
];
|
||||||
|
|
||||||
|
# Nix config
|
||||||
|
nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
|
||||||
|
nix.binaryCaches = [ "https://hydra.iohk.io" ];
|
||||||
|
|
||||||
|
|
||||||
|
# Terminal
|
||||||
|
programs.gnome-terminal.enable = true;
|
||||||
|
|
||||||
|
# Environment variables
|
||||||
|
environment.variables = {
|
||||||
|
# Input method overrides
|
||||||
|
GTK_IM_MODULE = "ibus";
|
||||||
|
QT_IM_MODULE = "ibus";
|
||||||
|
"XMODIFIERS=@im" = "ibus";
|
||||||
|
|
||||||
|
# Basic editor setup
|
||||||
|
EDITOR = "kak";
|
||||||
|
VISUAL = "kak";
|
||||||
|
};
|
||||||
|
|
||||||
|
# Fonts
|
||||||
|
fonts = {
|
||||||
|
enableDefaultFonts = false;
|
||||||
|
fonts = with pkgs; [
|
||||||
|
noto-fonts-emoji-blob-bin
|
||||||
|
ibm-plex
|
||||||
|
(nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
|
||||||
|
noto-fonts
|
||||||
|
noto-fonts-cjk
|
||||||
|
];
|
||||||
|
fontconfig = {
|
||||||
|
defaultFonts = {
|
||||||
|
emoji = lib.mkBefore [ "Blobmoji" ];
|
||||||
|
serif = lib.mkBefore [ "IBM Plex Serif" ];
|
||||||
|
sansSerif = lib.mkBefore [ "IBM Plex Sans" ];
|
||||||
|
monospace = lib.mkBefore [ "IBM Plex Mono" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Enable Desktop Environment.
|
||||||
|
services.xserver.displayManager = {
|
||||||
|
lightdm.enable = true;
|
||||||
|
};
|
||||||
|
services.xserver.desktopManager.cinnamon.enable = true;
|
||||||
|
|
||||||
|
# Some programs need SUID wrappers, can be configured further or are
|
||||||
|
# started in user sessions.
|
||||||
|
programs.mtr.enable = true;
|
||||||
|
programs.gnupg.agent = {
|
||||||
|
enable = true;
|
||||||
|
enableSSHSupport = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# List services that you want to enable:
|
||||||
|
services.gnome.gnome-keyring.enable = true;
|
||||||
|
|
||||||
|
# Enable the OpenSSH daemon.
|
||||||
|
services.openssh.enable = true;
|
||||||
|
|
||||||
|
# Open ports in the firewall.
|
||||||
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||||
|
networking.firewall.allowedUDPPorts = [ 22 ];
|
||||||
|
# Or disable the firewall altogether.
|
||||||
|
# networking.firewall.enable = false;
|
||||||
|
#
|
||||||
|
|
||||||
|
## Bluetooth
|
||||||
|
#
|
||||||
|
hardware.bluetooth.enable = true;
|
||||||
|
|
||||||
|
# Peripherals
|
||||||
|
hardware.opentabletdriver.enable = true;
|
||||||
|
|
||||||
|
# VPN
|
||||||
|
sops.secrets."windscribe/privateKey" = { mode = "0755"; };
|
||||||
|
sops.secrets."windscribe/presharedKey" = { mode = "0755"; };
|
||||||
|
networking.wg-quick.interfaces = {
|
||||||
|
windscribe = {
|
||||||
|
privateKeyFile = config.sops.secrets."windscribe/privateKey".path;
|
||||||
|
address = [ "100.70.42.56/32" ];
|
||||||
|
dns = [ "10.255.255.2" ];
|
||||||
|
peers = [
|
||||||
|
{
|
||||||
|
allowedIPs = [ "0.0.0.0/0" ];
|
||||||
|
endpoint = "yyz-197-wg.whiskergalaxy.com:443";
|
||||||
|
presharedKeyFile = config.sops.secrets."windscribe/presharedKey".path;
|
||||||
|
publicKey = "U5s7Yy/2fCqlaFcI96dFKupqEVCn+BYF04LRLD1zOhg=";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# PAM
|
||||||
|
security.pam.services.lightdm.enableKwallet = true;
|
||||||
|
security.pam.services.lightdm.enableGnomeKeyring = true;
|
||||||
|
|
||||||
|
|
||||||
|
# This value determines the NixOS release from which the default
|
||||||
|
# settings for stateful data, like file locations and database versions
|
||||||
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||||
|
# this value at the release version of the first install of this system.
|
||||||
|
# Before changing this value read the documentation for this option
|
||||||
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||||
|
system.stateVersion = "21.05"; # Did you read the comment?
|
||||||
|
system.autoUpgrade.channel = "https://nixos.org/channels/nixos-21.05/";
|
||||||
|
|
||||||
|
# tinc network
|
||||||
|
sops.secrets."tinc/ed25519-private-key" = {};
|
||||||
|
sops.secrets."tinc/rsa-private-key" = {};
|
||||||
|
services.my-tinc = {
|
||||||
|
enable = true;
|
||||||
|
hostName = "home";
|
||||||
|
rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
|
||||||
|
ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
|
||||||
|
bindPort = 6565;
|
||||||
|
};
|
||||||
|
|
||||||
|
# extra host for my personal server
|
||||||
|
sops.secrets.hosts = {
|
||||||
|
mode = "0755";
|
||||||
|
};
|
||||||
|
services.dnsmasq.enable = true;
|
||||||
|
services.dnsmasq.extraConfig = ''
|
||||||
|
addn-hosts=${config.sops.secrets.hosts.path}
|
||||||
|
'';
|
||||||
|
}
|
||||||
|
|
||||||
32
nki-home/hardware-configuration.nix
Normal file
32
nki-home/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||||
|
# and may be overwritten by future invocations. Please make changes
|
||||||
|
# to /etc/nixos/configuration.nix instead.
|
||||||
|
{ config, lib, pkgs, modulesPath, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports =
|
||||||
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||||
|
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||||
|
boot.kernelModules = [ "kvm-amd" ];
|
||||||
|
boot.extraModulePackages = [ ];
|
||||||
|
|
||||||
|
fileSystems."/" =
|
||||||
|
{ device = "/dev/disk/by-uuid/32a74827-4624-43ef-b066-b52e1f11793d";
|
||||||
|
fsType = "ext4";
|
||||||
|
};
|
||||||
|
|
||||||
|
fileSystems."/boot" =
|
||||||
|
{ device = "/dev/disk/by-uuid/549C-7877";
|
||||||
|
fsType = "vfat";
|
||||||
|
};
|
||||||
|
|
||||||
|
swapDevices =
|
||||||
|
[ { device = "/dev/disk/by-uuid/e08ed857-e553-4af1-9239-40f13d8ea854"; }
|
||||||
|
];
|
||||||
|
|
||||||
|
# high-resolution display
|
||||||
|
hardware.video.hidpi.enable = lib.mkDefault true;
|
||||||
|
}
|
||||||
6
nki-home/secrets/default.nix
Normal file
6
nki-home/secrets/default.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
sops.defaultSopsFile = ./secrets.yaml;
|
||||||
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||||
|
}
|
||||||
27
nki-home/secrets/secrets.yaml
Normal file
27
nki-home/secrets/secrets.yaml
Normal file
File diff suppressed because one or more lines are too long
Loading…
Reference in a new issue