Basic configuration for nki-home
nki-home tinc working Don't route tinc through vpn Don't do it lol Integrate home-manager Merge nki-home/flake into main flake Add MacOS clipboard compat Make VPN input a secret
This commit is contained in:
parent
1c3fd3f47b
commit
466f5f1e90
105
flake.lock
105
flake.lock
|
|
@ -21,16 +21,35 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"home-manager-21_05": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1635123562,
|
||||
"narHash": "sha256-kYuwQqHXDYxy5ijpm8SvCoPNx0br1TpoWeTIOEwOYvA=",
|
||||
"lastModified": 1634544068,
|
||||
"narHash": "sha256-RlRQBaAHfdWqfRyHdWuDPMkplBTYwuyDQqDcNbP/Sog=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "da8a78eec9f7adb57f9e961d1da64805efacff37",
|
||||
"rev": "ff2bed9dac84fb202bbb3c49fdcfe30c29d0b12f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"ref": "release-21.05",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager-unstable": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1635473360,
|
||||
"narHash": "sha256-sxb4xuP/9f6z29y4Sxzk0g6gzFKUX9r3vNzga/pCROw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "cf4866d2187399117d3aed47a58e6f8ef58e5afd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -41,11 +60,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1635268020,
|
||||
"narHash": "sha256-oaWU7ZvobClXLrQGj7Xvjs2vSlItPFkw/usKh/2c56Y=",
|
||||
"lastModified": 1635471979,
|
||||
"narHash": "sha256-qlpiKdJ5gF7hU1TuNoz4xTsroUSrdErwovu3rD5cy2c=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "89a27a2e6f54993224f804e50a29e48b8c83d1ca",
|
||||
"rev": "3f33a306a55bd7ecedf586a627063a211ffdc6f0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -70,6 +89,20 @@
|
|||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1635471979,
|
||||
"narHash": "sha256-qlpiKdJ5gF7hU1TuNoz4xTsroUSrdErwovu3rD5cy2c=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3f33a306a55bd7ecedf586a627063a211ffdc6f0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"id": "nixpkgs",
|
||||
"type": "indirect"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1622516815,
|
||||
"narHash": "sha256-ZjBd81a6J3TwtlBr3rHsZspYUwT9OdhDk+a/SgSEf7I=",
|
||||
|
|
@ -85,12 +118,64 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1625223284,
|
||||
"narHash": "sha256-jjLcDSU1rRiJb+n3uez23XAa7kbnPcGZTa6jIKh1GMQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "357d2c8f6087685fe35cb1889a005a4dd4cce7b8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nur": {
|
||||
"locked": {
|
||||
"lastModified": 1635473664,
|
||||
"narHash": "sha256-teOeaFqN6gpUaOaU698Ux5GV/mcFwefT/8WbwpdjRKI=",
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"rev": "7d89d7eba61c4fa1a482febe0714e43f3e022bec",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "NUR",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"darwin": "darwin",
|
||||
"home-manager": "home-manager",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||
"home-manager-21_05": "home-manager-21_05",
|
||||
"home-manager-unstable": "home-manager-unstable",
|
||||
"nixpkgs": "nixpkgs_3",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"nur": "nur",
|
||||
"sops-nix": "sops-nix"
|
||||
}
|
||||
},
|
||||
"sops-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1633273832,
|
||||
"narHash": "sha256-oOjpMVYpkIUpiML61PeqTk+sg4juRvF7P6jroI/YvTw=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "2e86e1698d53e5bd71d9de5f8b7e8f2f5458633c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
|
|||
45
flake.nix
45
flake.nix
|
|
@ -1,32 +1,59 @@
|
|||
{
|
||||
description = "nki's darwin system";
|
||||
description = "nki's systems";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/21.05";
|
||||
nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
|
||||
darwin.url = "github:lnl7/nix-darwin/master";
|
||||
darwin.inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
home-manager.url = "github:nix-community/home-manager";
|
||||
home-manager-unstable.url = "github:nix-community/home-manager";
|
||||
home-manager-21_05.url = "github:nix-community/home-manager/release-21.05";
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
nur.url = "github:nix-community/NUR";
|
||||
};
|
||||
|
||||
outputs = { self, darwin, nixpkgs, nixpkgs-unstable, home-manager }: {
|
||||
outputs = { self, darwin, nixpkgs, nixpkgs-unstable, home-manager-unstable, home-manager-21_05, sops-nix, nur }: {
|
||||
# MacBook configuration: nix-darwin + home-manager
|
||||
darwinConfigurations."nki-macbook" = darwin.lib.darwinSystem rec {
|
||||
darwinConfigurations."nki-macbook" = darwin.lib.darwinSystem {
|
||||
system = "aarch64-darwin";
|
||||
modules = [
|
||||
./darwin/configuration.nix
|
||||
home-manager.darwinModules.home-manager
|
||||
home-manager-unstable.darwinModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.extraSpecialArgs = { inherit nixpkgs-unstable; };
|
||||
home-manager.users.nki = import ./home/macbook-home.nix;
|
||||
}
|
||||
];
|
||||
inputs = {
|
||||
inherit darwin nixpkgs-unstable;
|
||||
nixpkgs = nixpkgs-unstable;
|
||||
};
|
||||
|
||||
# Home configuration
|
||||
nixosConfigurations."nki-home" = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
./modules/my-tinc
|
||||
sops-nix.nixosModules.sops
|
||||
./nki-home/configuration.nix
|
||||
home-manager-21_05.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.users.nki = import ./home/kagami-pc-home.nix;
|
||||
}
|
||||
(let
|
||||
overlay-unstable = final: prev: {
|
||||
unstable = import nixpkgs-unstable { config.allowUnfree = true; system = prev.system; };
|
||||
unfree = import nixpkgs { config.allowUnfree = true; system = prev.system; };
|
||||
};
|
||||
overlay-needs-unstable = final: prev: {
|
||||
# override some packages that needs unstable that cannot be changed in the setup.
|
||||
nix-direnv = prev.unstable.nix-direnv;
|
||||
};
|
||||
in
|
||||
{
|
||||
nixpkgs.overlays = [ overlay-unstable overlay-needs-unstable nur.overlay ]; # we assign the overlay created before to the overlays of nixpkgs.
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,15 +1,12 @@
|
|||
{ pkgs, config, lib, ... } :
|
||||
|
||||
let
|
||||
pkgsUnstable = import <nixpkgs-unstable> {};
|
||||
in
|
||||
{
|
||||
home.packages = [
|
||||
];
|
||||
|
||||
programs.alacritty = {
|
||||
enable = true;
|
||||
package = pkgsUnstable.alacritty;
|
||||
package = pkgs.unstable.alacritty;
|
||||
|
||||
settings = {
|
||||
background_opacity = 0.95;
|
||||
|
|
|
|||
|
|
@ -34,4 +34,14 @@
|
|||
"x-scheme-handler/ftps" = [ "firefox.desktop" ];
|
||||
"x-scheme-handler/mailspring" = [ "Mailspring.desktop" ];
|
||||
};
|
||||
|
||||
# Mimic the clipboard stuff in MacOS
|
||||
home.packages = [
|
||||
(pkgs.writeShellScriptBin "pbcopy" ''
|
||||
exec ${pkgs.xsel}/bin/xsel -ib
|
||||
'')
|
||||
(pkgs.writeShellScriptBin "pbpaste" ''
|
||||
exec ${pkgs.xsel}/bin/xsel -ob
|
||||
'')
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,8 @@
|
|||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
pkgsUnstable = import <nixpkgs-unstable> {};
|
||||
# Override nss to open links in Firefox (https://github.com/NixOS/nixpkgs/issues/78961)
|
||||
discordPkg = pkgsUnstable.discord.override { nss = pkgs.nss_latest; };
|
||||
discordPkg = pkgs.unstable.discord.override { nss = pkgs.unstable.nss; };
|
||||
in
|
||||
{
|
||||
imports = [ ./alacritty.nix ./i3.nix ];
|
||||
|
|
|
|||
|
|
@ -1,12 +1,9 @@
|
|||
{ config, pkgs, nixpkgs-unstable, ... }:
|
||||
|
||||
let
|
||||
pkgsUnstable = import nixpkgs-unstable { system = pkgs.system; };
|
||||
in
|
||||
{
|
||||
programs.fish = {
|
||||
enable = true;
|
||||
package = pkgsUnstable.fish;
|
||||
package = pkgs.unstable.fish;
|
||||
functions = {
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ pkgs, config, lib, ... }:
|
||||
|
||||
let
|
||||
pkgsUnstableOsu = import "/home/nki/nixpkgs/osu-lazer" {};
|
||||
# pkgsUnstableOsu = import "/home/nki/nixpkgs/osu-lazer" {};
|
||||
# osu = pkgs.osu-lazer.overrideAttrs (oldAttrs : rec {
|
||||
# version = "2021.1006.1";
|
||||
# src = pkgs.fetchFromGitHub {
|
||||
|
|
@ -13,5 +13,5 @@ let
|
|||
# });
|
||||
in
|
||||
{
|
||||
home.packages = [ pkgsUnstableOsu.osu-lazer ];
|
||||
home.packages = [ pkgs.unstable.osu-lazer ];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -29,6 +29,11 @@ in
|
|||
type = types.enum hostNames;
|
||||
description = "The configured host name";
|
||||
};
|
||||
bindPort = mkOption {
|
||||
type = types.port;
|
||||
default = 655;
|
||||
description = "The port to listen on";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable (builtins.seq
|
||||
|
|
@ -83,6 +88,8 @@ in
|
|||
chroot = false; # otherwise addresses can't be a DNS
|
||||
interfaceType = "tap"; # tun might also work.
|
||||
|
||||
bindToAddress = "* ${toString cfg.bindPort}";
|
||||
|
||||
ed25519PrivateKeyFile = cfg.ed25519PrivateKey;
|
||||
rsaPrivateKeyFile = cfg.rsaPrivateKey;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -6,6 +6,12 @@
|
|||
rsaPublicKey = builtins.readFile ./nki-cloud.pub;
|
||||
};
|
||||
|
||||
home = {
|
||||
subnetAddr = "11.0.0.2";
|
||||
rsaPublicKey = builtins.readFile ./nki-home.pub;
|
||||
ed25519PublicKey = "Ts5OdPtBNLIRfosoYRcb6Z2iwWyOz/VKTKB9J0p5LlH";
|
||||
};
|
||||
|
||||
macbook = {
|
||||
subnetAddr = "11.0.0.3";
|
||||
rsaPublicKey = builtins.readFile ./nki-macbook.pub;
|
||||
|
|
|
|||
24
modules/my-tinc/hosts/nki-home.pub
Normal file
24
modules/my-tinc/hosts/nki-home.pub
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN RSA PUBLIC KEY-----
|
||||
MIIECgKCBAEAxL0DTIcnBOhBCMdimixjZmvPdlN4fO+W2bXfYnqQuqZ3eak+vUv5
|
||||
Q0fddRIZHLFKh+97gacdoyRxvhGWod5kI0jiLypcAvF2IW/0RpbYMrLZDF/zKzQS
|
||||
COI5f+h3BjM/gjlkiuPscF2i53HjcytH4OkGbXMnNP0IYalB5ZYCiTveF+caECgO
|
||||
KyERSPCNwD9L5OXkmIJwh9ij+V5uvUj0+Khweq6f50R23DBmnWb4qmV+1VLCvY+z
|
||||
qvOkfXW0F06X00oPc9G/rTTLYq6A++/w7slO+fBiQfhw59QHnDcrqbbkaeL+3s/b
|
||||
haLUNXf47AFLCCKcj9Pg28whMcKRhSW1+f6Z1B5Yn5Ohf2JZnfNTOWb6AVS65rN1
|
||||
WkO+Dtc8BBQKC33xcDEcIp6muV2LF2J561zV+Wz5kZaBGEsERo55ctvazRi69MTt
|
||||
MsNKAIAMZNwv7QQ9+NdrV4ErlydidUXUXLg2VARPhEMi8Jlgd7u7Uf9nnk0sQyXo
|
||||
ML3HerTfydM+9SE6JtpM71B9a7J8fw4i9uf25PMqTK6GhfJtJmyaB8rp4O6gsrKm
|
||||
dUA8k4CGBWMi6jQxVksF0klew0vLVJWhA+izR6HwvXNEBTmjDqlEtRBdIVRXEBVf
|
||||
BiRS0u63Bi/S811KmzPnalYzj9OBHzAdD8k5TfipkHXF50bIi5YLNlSKkUafMXcv
|
||||
TsfXTVhDpptqwjMC8VddHPug9emavfoDuRpa+6zMjZUdVbGZp2V+RCAh3V9N8Xhc
|
||||
tKS9tNKX//E5rGpj2LCd4yZe+NPSUEwRk55NGrVXY6DeCB4bdIp/HqMWcsnLCP8I
|
||||
BQooOfRKwFd78QHkeoon7Ky4yfwyyoDoDRr+i0KhbVJIBSBBhjxrB2yH5s8bKz6u
|
||||
GyBo9csYoPH0TrrNnhHI7fXOC0I/Yn/zPEhdSnKDIqja/xtqlY4opNR9Ezmi3nCt
|
||||
EqNvfP8PRYjIGBpy6MfVdVomIPtJ3Y9wBEC29PXjElARGw6a8VR5KWy8n6CLbSq2
|
||||
b+iPVb9kP1/R0P9xGFyIbpvcgxAuSCsnwFmYIVUHAda3fd3hSHlV95Pu09QeVrTi
|
||||
SPNrgbX+1uJ/q3bEFpltmHNX2/XpnKFtd9FqDKELJTyQ1zG15FI93YPO80CPdp/w
|
||||
9ktj7BnR73Yc8l1c/rBaQ9/V71pnBwrUPqznXo1ilfI4oBcz4YKMqMNDWUCbCcES
|
||||
MLCiIHqHpodrC09xtldrAd3HyRDNhFsS53BpSKFvjKSKrhwHFN1nSXr5JUTc3Xun
|
||||
HcIAG0F38DgzvdUf+nvI79pSEzDGG+/jWI3nO9KzHHsxF0K2RBIuxTgmOj1Yo6ek
|
||||
01jlKDZgPWOs4wPYsQwYo/nwlba/zIm1qwIDAQAB
|
||||
-----END RSA PUBLIC KEY-----
|
||||
1
nki-home/.gitignore
vendored
Normal file
1
nki-home/.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
/result
|
||||
246
nki-home/configuration.nix
Normal file
246
nki-home/configuration.nix
Normal file
|
|
@ -0,0 +1,246 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ lib, config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
# secret management
|
||||
./secrets
|
||||
];
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot = {
|
||||
plymouth.enable = true;
|
||||
loader.timeout = 60;
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
};
|
||||
## Encryption
|
||||
# Kernel modules needed for mounting USB VFAT devices in initrd stage
|
||||
boot.initrd.kernelModules = [ "usb_storage" ];
|
||||
boot.initrd.luks.devices = {
|
||||
root = {
|
||||
keyFile = "/dev/disk/by-id/usb-090c___B1608112001295-0:0";
|
||||
keyFileSize = 4096;
|
||||
fallbackToPassword = true;
|
||||
device = "/dev/disk/by-uuid/7c6e40a8-900b-4f85-9712-2b872caf1892";
|
||||
preLVM = true;
|
||||
allowDiscards = true;
|
||||
};
|
||||
};
|
||||
|
||||
networking.hostName = "kagamiPC"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Toronto";
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.enp8s0.useDHCP = true;
|
||||
networking.interfaces.wlp7s0.useDHCP = true;
|
||||
|
||||
# Configure network proxy if necessary
|
||||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||||
|
||||
nix = {
|
||||
package = pkgs.nixUnstable;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "ja_JP.UTF-8";
|
||||
i18n.inputMethod.enabled = "ibus";
|
||||
i18n.inputMethod.ibus.engines = (with pkgs.ibus-engines; [bamboo mozc libpinyin]);
|
||||
# console = {
|
||||
# font = "Lat2-Terminus16";
|
||||
# keyMap = "us";
|
||||
# };
|
||||
|
||||
# Enable the X11 windowing system.
|
||||
services.xserver.enable = true;
|
||||
|
||||
# Configure keymap in X11
|
||||
services.xserver.layout = "jp";
|
||||
# services.xserver.xkbOptions = "";
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
# services.printing.enable = true;
|
||||
|
||||
# Enable sound.
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio = {
|
||||
enable = true;
|
||||
extraModules = [ pkgs.pulseaudio-modules-bt ];
|
||||
package = pkgs.pulseaudioFull;
|
||||
};
|
||||
# Enable touchpad support (enabled default in most desktopManager).
|
||||
# services.xserver.libinput.enable = true;
|
||||
|
||||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||||
users.users.nki = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
|
||||
};
|
||||
|
||||
# Allow all packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
kakoune # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
fish
|
||||
firefox
|
||||
|
||||
## System monitoring tools
|
||||
busybox
|
||||
|
||||
## Security stuff
|
||||
qtkeychain
|
||||
|
||||
## Enable nix-flakes
|
||||
# (pkgs.writeShellScriptBin "nixFlakes" ''
|
||||
# exec ${pkgs.nixUnstable}/bin/nix --experimental-features "nix-command flakes" "$@"
|
||||
# '')
|
||||
];
|
||||
|
||||
# Nix config
|
||||
nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
|
||||
nix.binaryCaches = [ "https://hydra.iohk.io" ];
|
||||
|
||||
|
||||
# Terminal
|
||||
programs.gnome-terminal.enable = true;
|
||||
|
||||
# Environment variables
|
||||
environment.variables = {
|
||||
# Input method overrides
|
||||
GTK_IM_MODULE = "ibus";
|
||||
QT_IM_MODULE = "ibus";
|
||||
"XMODIFIERS=@im" = "ibus";
|
||||
|
||||
# Basic editor setup
|
||||
EDITOR = "kak";
|
||||
VISUAL = "kak";
|
||||
};
|
||||
|
||||
# Fonts
|
||||
fonts = {
|
||||
enableDefaultFonts = false;
|
||||
fonts = with pkgs; [
|
||||
noto-fonts-emoji-blob-bin
|
||||
ibm-plex
|
||||
(nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
|
||||
noto-fonts
|
||||
noto-fonts-cjk
|
||||
];
|
||||
fontconfig = {
|
||||
defaultFonts = {
|
||||
emoji = lib.mkBefore [ "Blobmoji" ];
|
||||
serif = lib.mkBefore [ "IBM Plex Serif" ];
|
||||
sansSerif = lib.mkBefore [ "IBM Plex Sans" ];
|
||||
monospace = lib.mkBefore [ "IBM Plex Mono" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Enable Desktop Environment.
|
||||
services.xserver.displayManager = {
|
||||
lightdm.enable = true;
|
||||
};
|
||||
services.xserver.desktopManager.cinnamon.enable = true;
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
programs.mtr.enable = true;
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# List services that you want to enable:
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.allowedTCPPorts = [ 22 ];
|
||||
networking.firewall.allowedUDPPorts = [ 22 ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
#
|
||||
|
||||
## Bluetooth
|
||||
#
|
||||
hardware.bluetooth.enable = true;
|
||||
|
||||
# Peripherals
|
||||
hardware.opentabletdriver.enable = true;
|
||||
|
||||
# VPN
|
||||
sops.secrets."windscribe/privateKey" = { mode = "0755"; };
|
||||
sops.secrets."windscribe/presharedKey" = { mode = "0755"; };
|
||||
networking.wg-quick.interfaces = {
|
||||
windscribe = {
|
||||
privateKeyFile = config.sops.secrets."windscribe/privateKey".path;
|
||||
address = [ "100.70.42.56/32" ];
|
||||
dns = [ "10.255.255.2" ];
|
||||
peers = [
|
||||
{
|
||||
allowedIPs = [ "0.0.0.0/0" ];
|
||||
endpoint = "yyz-197-wg.whiskergalaxy.com:443";
|
||||
presharedKeyFile = config.sops.secrets."windscribe/presharedKey".path;
|
||||
publicKey = "U5s7Yy/2fCqlaFcI96dFKupqEVCn+BYF04LRLD1zOhg=";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
|
||||
# PAM
|
||||
security.pam.services.lightdm.enableKwallet = true;
|
||||
security.pam.services.lightdm.enableGnomeKeyring = true;
|
||||
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "21.05"; # Did you read the comment?
|
||||
system.autoUpgrade.channel = "https://nixos.org/channels/nixos-21.05/";
|
||||
|
||||
# tinc network
|
||||
sops.secrets."tinc/ed25519-private-key" = {};
|
||||
sops.secrets."tinc/rsa-private-key" = {};
|
||||
services.my-tinc = {
|
||||
enable = true;
|
||||
hostName = "home";
|
||||
rsaPrivateKey = config.sops.secrets."tinc/rsa-private-key".path;
|
||||
ed25519PrivateKey = config.sops.secrets."tinc/ed25519-private-key".path;
|
||||
bindPort = 6565;
|
||||
};
|
||||
|
||||
# extra host for my personal server
|
||||
sops.secrets.hosts = {
|
||||
mode = "0755";
|
||||
};
|
||||
services.dnsmasq.enable = true;
|
||||
services.dnsmasq.extraConfig = ''
|
||||
addn-hosts=${config.sops.secrets.hosts.path}
|
||||
'';
|
||||
}
|
||||
|
||||
32
nki-home/hardware-configuration.nix
Normal file
32
nki-home/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/32a74827-4624-43ef-b066-b52e1f11793d";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/549C-7877";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/e08ed857-e553-4af1-9239-40f13d8ea854"; }
|
||||
];
|
||||
|
||||
# high-resolution display
|
||||
hardware.video.hidpi.enable = lib.mkDefault true;
|
||||
}
|
||||
6
nki-home/secrets/default.nix
Normal file
6
nki-home/secrets/default.nix
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
}
|
||||
27
nki-home/secrets/secrets.yaml
Normal file
27
nki-home/secrets/secrets.yaml
Normal file
File diff suppressed because one or more lines are too long
Loading…
Reference in a new issue