add nb-new
This commit is contained in:
188
hosts/nb-new.cloonar.com/configuration.nix
Normal file
188
hosts/nb-new.cloonar.com/configuration.nix
Normal file
@@ -0,0 +1,188 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
let
|
||||
unstable = import <nixos-unstable> { config = { allowUnfree = true; }; };
|
||||
impermanence = builtins.fetchTarball "https://github.com/nix-community/impermanence/archive/master.tar.gz";
|
||||
in {
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
"${impermanence}/nixos.nix"
|
||||
./utils/bento.nix
|
||||
|
||||
./utils/modules/sops.nix
|
||||
./utils/modules/nur.nix
|
||||
./modules/sway/sway.nix
|
||||
# ./modules/gnome.nix
|
||||
./modules/printer.nix
|
||||
./modules/nvim/default.nix
|
||||
./utils/modules/autoupgrade.nix
|
||||
|
||||
./users
|
||||
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(import ./utils/overlays/packages.nix)
|
||||
];
|
||||
|
||||
fonts.packages = with pkgs; [
|
||||
open-sans
|
||||
];
|
||||
|
||||
# nixos cross building qemu
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
boot.supportedFilesystems = [ "ntfs" ];
|
||||
boot.plymouth.enable = true;
|
||||
boot.plymouth.theme = "breeze";
|
||||
boot.kernelParams = ["quiet"];
|
||||
|
||||
environment.persistence."/nix/persist/system" = {
|
||||
hideMounts = true;
|
||||
directories = [
|
||||
"/etc/nixos"
|
||||
"/var/bento"
|
||||
"/var/log"
|
||||
"/var/lib/bluetooth"
|
||||
"/var/lib/nixos"
|
||||
];
|
||||
files = [
|
||||
"/etc/machine-id"
|
||||
{ file = "/etc/ssh/ssh_host_ed25519_key"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
|
||||
{ file = "/etc/ssh/ssh_host_ed25519_key.pub"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
|
||||
{ file = "/etc/ssh/ssh_host_rsa_key"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
|
||||
{ file = "/etc/ssh/ssh_host_rsa_key.pub"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
|
||||
];
|
||||
};
|
||||
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
sops.secrets.epicenter_vpn_ca = {};
|
||||
sops.secrets.epicenter_vpn_cert = {};
|
||||
sops.secrets.epicenter_vpn_key = {};
|
||||
sops.secrets.wg_private_key = {};
|
||||
sops.secrets.wg_preshared_key = {};
|
||||
sops.secrets.wg-cloonar-key = {};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
networking.hostName = "nb-01"; # Define your hostname.
|
||||
networking.resolvconf.enable = true;
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
networking.extraHosts = ''
|
||||
10.25.0.25 archive.zeichnemit.at
|
||||
127.0.0.1 wohnservice.local mieterhilfe.local wohnpartner.local wohnberatung.local wienbautvor.local wienwohntbesser.local
|
||||
127.0.0.1 wohnservice-wien.local mieterhilfe.local wohnpartner-wien.local wohnberatung-wien.local wienbautvor.local wienwohntbesser.local
|
||||
127.0.0.1 diabetes.local
|
||||
127.0.0.1 test.cloonar.com
|
||||
'';
|
||||
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
excludePackages = [ pkgs.xterm ];
|
||||
displayManager.gdm.enable = true;
|
||||
displayManager.gdm.wayland = true;
|
||||
# displayManager.sddm.enable = true;
|
||||
displayManager.sessionPackages = [ pkgs.sway ];
|
||||
displayManager.defaultSession = "sway";
|
||||
libinput.enable = true;
|
||||
};
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Vienna";
|
||||
console.keyMap = "de";
|
||||
|
||||
users.users.dominik = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" "disk" "video" "audio" "mysql" "docker" "vboxusers" "networkmanager" "onepassword" "onepassword-cli" "dialout" ]; # Enable ‘sudo’ for the user.
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
bento
|
||||
vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||||
wget
|
||||
docker-compose
|
||||
drone-cli
|
||||
wireguard-tools
|
||||
wineWowPackages.stable
|
||||
wineWowPackages.fonts
|
||||
winetricks
|
||||
git-filter-repo
|
||||
ykfde
|
||||
nix-prefetch-git
|
||||
unstable.rustdesk-flutter
|
||||
];
|
||||
|
||||
environment.variables = {
|
||||
TERMINAL_COMMAND = "alacritty";
|
||||
};
|
||||
|
||||
services.blueman.enable = true;
|
||||
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
|
||||
security.polkit.enable = true;
|
||||
systemd = {
|
||||
user.services.polkit-gnome-authentication-agent-1 = {
|
||||
description = "polkit-gnome-authentication-agent-1";
|
||||
wantedBy = [ "graphical-session.target" ];
|
||||
wants = [ "graphical-session.target" ];
|
||||
after = [ "graphical-session.target" ];
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 1;
|
||||
TimeoutStopSec = 10;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.wireguard.interfaces = {
|
||||
wg0 = {
|
||||
# Determines the IP address and subnet of the client's end of the tunnel interface.
|
||||
ips = [ "10.42.98.201/32" ];
|
||||
# Path to the private key file.
|
||||
#
|
||||
# Note: The private key can also be included inline via the privateKey option,
|
||||
# but this makes the private key world-readable; thus, using privateKeyFile is
|
||||
# recommended.
|
||||
# publicKey: YdlRGsjh4hS3OMJI+t6SZ2eGXKbs0wZBXWudHW4NyS8=
|
||||
privateKeyFile = config.sops.secrets.wg-cloonar-key.path;
|
||||
|
||||
peers = [
|
||||
{
|
||||
publicKey = "TKQVDmBnf9av46kQxLQSBDhAeaK8r1zh8zpU64zuc1Q=";
|
||||
allowedIPs = [ "10.42.96.0/20" "10.14.0.0/16" "10.25.0.0/16" ];
|
||||
endpoint = "vpn.cloonar.com:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nix = {
|
||||
settings.auto-optimise-store = true;
|
||||
# autoOptimiseStore = true;
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
# Free up to 1GiB whenever there is less than 100MiB left.
|
||||
extraOptions = ''
|
||||
min-free = ${toString (100 * 1024 * 1024)}
|
||||
max-free = ${toString (1024 * 1024 * 1024)}
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user