139 lines
3.8 KiB
Nix
139 lines
3.8 KiB
Nix
{ config, pkgs, modulesPath, lib, system, ... }:
|
|
|
|
{
|
|
imports = [
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
(modulesPath + "/profiles/minimal.nix")
|
|
# If for some reason "minimal" fails...
|
|
#(modulesPath + "/profiles/base.nix")
|
|
../virtualization/podman-utils.nix
|
|
../virtualization/nebula-sync-oci.nix
|
|
];
|
|
|
|
config = {
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
# Use the boot drive for grub
|
|
boot.loader.grub.enable = lib.mkDefault true;
|
|
boot.loader.grub.devices = [ "nodev" ];
|
|
|
|
boot.growPartition = lib.mkDefault true;
|
|
|
|
# Workaround for busted ZFS kernels
|
|
boot.supportedFilesystems = {
|
|
zfs = lib.mkForce false;
|
|
};
|
|
|
|
# Allow remote updates with flakes and non-root users
|
|
nix.settings.trusted-users = [ "root" "@wheel" ];
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
|
|
# Provide a default hostname
|
|
networking.hostName = lib.mkDefault "crowsnest";
|
|
|
|
# Activate firewall
|
|
networking.firewall.enable = true;
|
|
|
|
# Open firewall ports for Portainer
|
|
networking.firewall.allowedTCPPorts = [80 443 2112 8000];
|
|
|
|
# Time Zone
|
|
time.timeZone = "America/Chicago";
|
|
|
|
# Enable QEMU Guest for Proxmox
|
|
services.qemuGuest.enable = lib.mkDefault true;
|
|
|
|
#OpenSSH
|
|
security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
|
|
services.openssh = {
|
|
enable = true;
|
|
settings.PasswordAuthentication = false;
|
|
settings.KbdInteractiveAuthentication = false;
|
|
ports = [ 2112 ];
|
|
};
|
|
programs.ssh.startAgent = true;
|
|
|
|
#SOPS
|
|
sops.defaultSopsFile = ../secrets/secrets.yaml;
|
|
sops.defaultSopsFormat = "yaml";
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
# sops.secrets."nebula-sync-primary" = {
|
|
# owner = "nebula";
|
|
# };
|
|
# sops.secrets."nebula-sync-replicas" = {
|
|
# owner = "nebula";
|
|
# };
|
|
#sops.age.keyFile = "/home/shawnb/Development/falcon_nest/sops/age/keys.txt";
|
|
#sops.secrets."nebula-sync" = {
|
|
# owner = config.users.users.nebula.name;
|
|
#};
|
|
|
|
# Some sane packages we need on every system
|
|
environment.systemPackages = with pkgs; [
|
|
vim # for emergencies
|
|
git # for pulling nix flakes
|
|
zsh
|
|
bat
|
|
eza
|
|
podman-tui
|
|
];
|
|
|
|
environment.shells = with pkgs; [ zsh ];
|
|
users.defaultUserShell = pkgs.zsh;
|
|
|
|
programs.zsh = {
|
|
shellAliases = {
|
|
#.. = "cd ..";
|
|
h = "cd ~";
|
|
ls = "eza --icons -l -T -L=1";
|
|
cat = "bat";
|
|
};
|
|
enable = lib.mkDefault true;
|
|
autosuggestions.enable = lib.mkDefault true;
|
|
};
|
|
|
|
#oh-my-zsh
|
|
programs.zsh.ohMyZsh = {
|
|
enable = lib.mkDefault true;
|
|
theme = lib.mkDefault "jtriley";
|
|
};
|
|
|
|
# Default filesystem
|
|
fileSystems."/" = lib.mkDefault {
|
|
device = "/dev/disk/by-label/nixos";
|
|
autoResize = true;
|
|
fsType = "ext4";
|
|
};
|
|
|
|
fileSystems."/mnt/gitlab" = {
|
|
device = "//10.0.0.49/Gitlab";
|
|
fsType = "cifs";
|
|
# options = [ "username=eddie" "password=yoursambapassword" "x-systemd.automount" "noauto" ];
|
|
options = [ "x-systemd.automount" "noauto" ];
|
|
}
|
|
|
|
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
system.stateVersion = lib.mkDefault "25.05";
|
|
|
|
# Let the VM take care of its own upgrades.
|
|
system.autoUpgrade.enable = true;
|
|
|
|
# Clean Nix up after upgrades.
|
|
programs.nh = {
|
|
enable = true;
|
|
clean.enable = true;
|
|
clean.extraArgs = "--keep 5";
|
|
};
|
|
|
|
# Add an admin user
|
|
users.users.shawnb = lib.mkDefault {
|
|
isNormalUser = true;
|
|
hashedPassword = "";
|
|
description = "Shawn Borton";
|
|
extraGroups = [ "networkmanager" "wheel" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
|
|
];
|
|
};
|
|
};
|
|
}
|