1582 lines
44 KiB
Nix
1582 lines
44 KiB
Nix
{
|
||
config,
|
||
lib,
|
||
pkgs,
|
||
# hl,
|
||
...
|
||
}:
|
||
let
|
||
tailnet = "tail530c7.ts.net";
|
||
usr = "mko";
|
||
xlsx_to_csv =
|
||
pkgs.writers.writePython3Bin "xlsx-to-csv"
|
||
{
|
||
libraries = [
|
||
pkgs.python3Packages.pandas
|
||
pkgs.python3Packages.openpyxl
|
||
];
|
||
}
|
||
''
|
||
import sys
|
||
import pandas as pd
|
||
|
||
xlsx_file = sys.argv[1]
|
||
csv_file = sys.argv[2]
|
||
|
||
df = pd.read_excel(xlsx_file)
|
||
df.to_csv(csv_file, index=False)
|
||
'';
|
||
in
|
||
{
|
||
imports = [
|
||
# Include the results of the hardware scan.
|
||
./hardware-configuration.nix
|
||
(
|
||
let
|
||
username = "${usr}";
|
||
in
|
||
with username;
|
||
./disko-config.nix
|
||
)
|
||
|
||
# ./modules/podman.nix
|
||
./modules/promtail/promtail.nix
|
||
|
||
../../modules/base.nix
|
||
../../modules/dnscrypt.nix
|
||
../../modules/firejail.nix
|
||
# ../../modules/waydroid.nix
|
||
../../modules/sanoid.nix
|
||
../../modules/zram.nix
|
||
];
|
||
|
||
sops = {
|
||
defaultSopsFile = ./secrets.yaml;
|
||
gnupg.sshKeyPaths = [ ];
|
||
age = {
|
||
sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||
generateKey = false;
|
||
};
|
||
|
||
secrets.rootPassphrase = {
|
||
neededForUsers = true;
|
||
};
|
||
secrets.mkoPassphrase = {
|
||
neededForUsers = true;
|
||
};
|
||
# # used as "cloaking_rules"
|
||
# secrets.extraHosts = {
|
||
# owner = "dnscrypt-proxy";
|
||
# group = "dnscrypt-proxy";
|
||
# restartUnits = ["dnscrypt-proxy2.service"];
|
||
# };
|
||
secrets.dnscrypt-proxy-forwardingRules = {
|
||
sopsFile = lib.mkForce ./secrets.yaml;
|
||
restartUnits = [ "dnscrypt-proxy2.service" ];
|
||
};
|
||
secrets.dnscrypt-proxy-cloaked = {
|
||
owner = "dnscrypt-proxy";
|
||
group = "dnscrypt-proxy";
|
||
restartUnits = [ "dnscrypt-proxy2.service" ];
|
||
};
|
||
secrets.sopsFile.owner = "root";
|
||
secrets.domainName = {
|
||
sopsFile = ../../secrets/net.yaml;
|
||
restartUnits = [ "promtail.service" ];
|
||
};
|
||
secrets."attic/netrc" = {
|
||
# also let user read the file.
|
||
group = usr;
|
||
mode = "0440";
|
||
};
|
||
secrets."wireless.env" = { };
|
||
secrets."ipinfoToken" = {
|
||
owner = usr;
|
||
path = "/home/${usr}/.asn/ipinfo_token";
|
||
};
|
||
secrets."ipqsToken" = {
|
||
owner = usr;
|
||
path = "/home/${usr}/.asn/iqs_token";
|
||
};
|
||
secrets."groqToken" = {
|
||
owner = usr;
|
||
path = "/run/user/1000/.groq";
|
||
};
|
||
secrets."openaiToken" = {
|
||
owner = usr;
|
||
path = "/run/user/1000/.oai";
|
||
};
|
||
secrets."codestralToken" = {
|
||
owner = usr;
|
||
path = "/run/user/1000/.codestral";
|
||
};
|
||
# secrets.zabbixToken = {owner = usr;};
|
||
secrets.zabbixToken = { };
|
||
# secrets.netboxToken = {neededForUsers = true;};
|
||
secrets.netboxToken = { };
|
||
# u2f authMapping.
|
||
secrets.yubiPls = { };
|
||
secrets."wlan/ton.env" = { };
|
||
|
||
templates = {
|
||
user-vars-yml = {
|
||
content = ''
|
||
netbox_token: ${config.sops.placeholder.netboxToken}
|
||
zabbix_token: ${config.sops.placeholder.zabbixToken}
|
||
'';
|
||
path = "/home/${usr}/src/voidsoc/infra/ansible/group_vars/all/001_user_vars.yml";
|
||
owner = usr;
|
||
group = usr;
|
||
mode = "0700";
|
||
};
|
||
# an actual file utilising the u2f authMapping.
|
||
yubiPls = {
|
||
content = ''
|
||
${usr}${config.sops.placeholder.yubiPls}
|
||
'';
|
||
};
|
||
sopsFile = {
|
||
owner = config.users.users.mko.name;
|
||
# path = "/run/user/1000/sops";
|
||
content = ''
|
||
${config.sops.placeholder.sopsFile}
|
||
'';
|
||
};
|
||
};
|
||
};
|
||
|
||
# nixpkgs.currentSystem = "x86_64-linux";
|
||
nix.settings = {
|
||
trusted-users = [
|
||
"@wheel"
|
||
"root"
|
||
usr
|
||
];
|
||
netrc-file = config.sops.secrets."attic/netrc".path;
|
||
};
|
||
|
||
boot = {
|
||
enableContainers = true;
|
||
consoleLogLevel = 3;
|
||
kernelParams = [
|
||
"thinkpad_acpi.fan_control=1"
|
||
# "spl.spl_hostid=deadb33f"
|
||
"psmouse.synaptics_intertouch=1"
|
||
"consoleblank=600"
|
||
"amd_pstate=active"
|
||
## forbid hibernation due to zfs-on-root --> no need to manually specify
|
||
## this as NixOS does adds by default when booting from zfs.
|
||
# "nohibernate" #
|
||
"amdgpu.backlight=0"
|
||
"systemd.log_level=notice"
|
||
"rd.udev.log_level=3"
|
||
"udev.log_priority=3"
|
||
# "boot.shell_on_fail"
|
||
];
|
||
# kernelPackages = pkgs.linuxPackages_6_12;
|
||
kernelPackages = pkgs.linuxPackages_6_17;
|
||
# kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||
|
||
loader = {
|
||
timeout = 7;
|
||
# Use the systemd-boot EFI boot loader.
|
||
systemd-boot = {
|
||
enable = true;
|
||
configurationLimit = 75;
|
||
netbootxyz.enable = true;
|
||
memtest86.enable = true;
|
||
# :( https://github.com/NixOS/nixpkgs/pull/334526
|
||
# bootCounting.enable = true;
|
||
};
|
||
efi.canTouchEfiVariables = true;
|
||
};
|
||
plymouth.enable = false;
|
||
tmp = {
|
||
useTmpfs = true;
|
||
cleanOnBoot = true;
|
||
};
|
||
|
||
supportedFilesystems = [ "zfs" ];
|
||
zfs.forceImportRoot = true;
|
||
|
||
initrd.kernelModules = [
|
||
"zfs"
|
||
"amdgpu"
|
||
]; # "wl"
|
||
# initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" "thinkpad_acpi" ];
|
||
kernelModules = [ "kvm-amd" ]; # "wl"
|
||
|
||
# extraModprobeConfig = "options kvm_amd nested=1";
|
||
|
||
binfmt = {
|
||
emulatedSystems = [
|
||
"wasm32-wasi"
|
||
"aarch64-linux"
|
||
];
|
||
preferStaticEmulators = true; # required for podman to run different arch.
|
||
};
|
||
};
|
||
|
||
# environment.memoryAllocator.provider = "graphene-hardened"; # default is libc, alt scudo.
|
||
# environment.memoryAllocator.provider = "scudo"; # default is libc, alt scudo.
|
||
environment.memoryAllocator.provider = "libc";
|
||
# environment.noXlibs = true; # graphical stuff breaks...
|
||
environment.etc = {
|
||
"greetd/environments".text = ''
|
||
sway
|
||
'';
|
||
"walls/2020-August-11-Churning-Clouds-on-Jupiter.jpg".source =
|
||
./walls/2020-August-11-Churning-Clouds-on-Jupiter.jpg;
|
||
"walls/PIA06254.jpg".source = ./walls/PIA06254.jpg;
|
||
"walls/PIA20522enceladus.jpg".source = ./walls/PIA20522enceladus.jpg;
|
||
};
|
||
|
||
#sound = {
|
||
# enable = true;
|
||
# mediaKeys = {enable = true;};
|
||
#};
|
||
|
||
fonts = {
|
||
packages = with pkgs; [
|
||
# font-awesome
|
||
# google-fonts
|
||
noto-fonts
|
||
# XXX: deprecated in 24.11
|
||
# noto-fonts-cjk
|
||
noto-fonts-cjk-sans
|
||
# XXX: deprecated in 25.11
|
||
# noto-fonts-emoji
|
||
noto-fonts-color-emoji
|
||
fira-code
|
||
cascadia-code
|
||
material-design-icons
|
||
nerd-fonts.fira-code
|
||
nerd-fonts.iosevka
|
||
nerd-fonts.jetbrains-mono
|
||
nerd-fonts.caskaydia-cove
|
||
# XXX 2505
|
||
#(nerdfonts.override {
|
||
# fonts = ["FiraCode" "JetBrainsMono" "CascadiaCode" "Iosevka"];
|
||
#})
|
||
];
|
||
|
||
enableDefaultPackages = true;
|
||
fontDir.enable = true;
|
||
|
||
fontconfig = {
|
||
enable = true;
|
||
defaultFonts = {
|
||
monospace = [
|
||
"FiraCode Nerd Font"
|
||
"Iosevka"
|
||
"CascadiaCode"
|
||
];
|
||
sansSerif = [ "Noto Sans" ];
|
||
serif = [ "Noto Serif" ];
|
||
emoji = [ "Noto Color Emoji" ];
|
||
};
|
||
};
|
||
};
|
||
|
||
environment = {
|
||
variables = {
|
||
EDITOR = "vim";
|
||
VISUAL = "vim";
|
||
MOZ_ENABLE_WAYLAND = "1";
|
||
NIXOS_OZONE_WL = "1";
|
||
NIXPKGS_ALLOW_UNFREE = "0";
|
||
TERMINAL = "kitty";
|
||
WLR_NO_HARDWARE_CURSORS = "1";
|
||
# XCURSOR_SIZE = "24";
|
||
XCURSOR_SIZE = "20";
|
||
XDG_CURRENT_DESKTOP = "sway";
|
||
XDG_SESSION_TYPE = "wayland";
|
||
_JAVA_AWT_WM_NONREPARENTING = "1";
|
||
GDK_BACKEND = "wayland";
|
||
};
|
||
systemPackages =
|
||
with pkgs;
|
||
let
|
||
jupyterWithStuff = jupyter.override {
|
||
definitions = {
|
||
# python3 = let
|
||
# env = pypy3.withPackages(ps: with ps; [
|
||
python3 =
|
||
let
|
||
env = python3.withPackages (
|
||
ps: with ps; [
|
||
pip
|
||
notebook
|
||
ipython
|
||
numpy
|
||
matplotlib
|
||
# matplotlib-venn
|
||
pandas
|
||
seaborn
|
||
scipy
|
||
]
|
||
);
|
||
#python3.withPackages(ps: with ps; [
|
||
# pip
|
||
# notebook
|
||
# ipython
|
||
# numpy
|
||
# matplotlib
|
||
# # matplotlib-venn
|
||
# # pypy3.pkgs.matplotlib_venn
|
||
# pandas
|
||
# seaborn
|
||
# scipy
|
||
# ]);
|
||
in
|
||
{
|
||
displayName = "Python 3";
|
||
argv = [
|
||
"${env.interpreter}"
|
||
"-m"
|
||
"ipykernel_launcher"
|
||
"-f"
|
||
"{connection_file}"
|
||
];
|
||
language = "python";
|
||
logo32 = "${env.sitePackages}/ipykernel/resources/logo-32x32.png";
|
||
logo64 = "${env.sitePackages}/ipykernel/resources/logo-64x64.png";
|
||
# extraLibs = with pypy3.
|
||
#packagesExtra = [
|
||
# "https://files.pythonhosted.org/packages/ca/e8/53441d7feb29ab10de3bd46c05358c41f0ba2f57395e88ffbb62d6b69df3/matplotlib-venn-0.11.6.tar.gz"
|
||
#];
|
||
};
|
||
};
|
||
};
|
||
# let
|
||
pp = python3.withPackages (
|
||
ps: with ps; [
|
||
xlsxgrep
|
||
]
|
||
);
|
||
secPkgs = [
|
||
wireshark
|
||
wireshark-cli
|
||
suricata
|
||
|
||
chainsaw
|
||
topgrade
|
||
vulnix
|
||
|
||
hexdino # Hex editor with vim like keybindings written in Rust
|
||
hexd
|
||
pixd
|
||
hexyl
|
||
# hex # futuristic hexdump, made in rust.
|
||
hexxy
|
||
hextazy
|
||
hexbinhex # Six utility programs to convert between hex, binary, ascii-binary and the oddball NIST format for 90B testing.
|
||
pwntools
|
||
plecost # wordpress fingerprinter
|
||
rsbkb
|
||
thc-hydra
|
||
ghidra
|
||
# ghidra-extensions.machinelearning
|
||
# ghidra-extensions.gnudisassemble
|
||
gdb
|
||
strace
|
||
ltrace
|
||
asn
|
||
cotp # cli otp tool
|
||
|
||
pdfid # Scan a file to look for certain PDF keywords
|
||
pdf-parser # Parse a PDF document
|
||
pdfcrack
|
||
pdfrip
|
||
|
||
yara # the original
|
||
yara-x # vt-reimpl
|
||
spyre # golang yara-based ioc scanner
|
||
yallback # Callbacks for YARA rule matches
|
||
yarGen # A generator for YARA rules
|
||
|
||
subfinder
|
||
assetfinder
|
||
dirbuster
|
||
# gobuster from sources
|
||
nikto
|
||
# nuclei # installed from source
|
||
gost # simple tunnel written in golang
|
||
dnsrecon
|
||
zap
|
||
wpscan
|
||
powersploit
|
||
|
||
hashcat
|
||
hashcat-utils
|
||
john
|
||
johnny
|
||
|
||
sigma-cli
|
||
zircolite # sigma-based detection tool for evtx, auditd and sysmon
|
||
unicorn # qemu-based instruction emulator
|
||
cyberchef
|
||
|
||
spike
|
||
aflplusplus
|
||
iodine
|
||
# rarcrack
|
||
unar
|
||
crunch
|
||
|
||
sqlmap
|
||
binocle
|
||
bpftrace
|
||
|
||
unhide
|
||
# smap # shodan+nmap XXX in UNSTABLE
|
||
|
||
# angr.io binary analysis platform.
|
||
# python3.pkgs.angr # |XXX: broken :( |
|
||
|
||
# unfree
|
||
# volatility3
|
||
|
||
elf-info
|
||
# elf-dissector
|
||
|
||
trufflehog
|
||
|
||
# autopsy
|
||
|
||
enum4linux
|
||
smbmap
|
||
smbscan
|
||
smbcrawler
|
||
ntlm-challenger
|
||
responder # fake SQLserver, etc...
|
||
proxychains
|
||
|
||
vt-cli
|
||
binwalk
|
||
];
|
||
in
|
||
secPkgs
|
||
++ [
|
||
home-manager
|
||
openssl
|
||
thinkfan
|
||
libinput
|
||
dmidecode
|
||
fwupd
|
||
incron
|
||
bridge-utils
|
||
moreutils # moar better
|
||
wol
|
||
vim
|
||
evil-helix # better vim keybindings
|
||
zed-editor
|
||
|
||
# cli file managers
|
||
ranger
|
||
yazi
|
||
# hunter # fastest file manager in the galaxy
|
||
nnn # unorthodox file manager
|
||
superfile # Pretty fancy and modern terminal file manager
|
||
xplr
|
||
|
||
# cli pdf viewers
|
||
# fancy-cat
|
||
tdf
|
||
# hl.packages.${system}.bin
|
||
|
||
fffuu # FFFUU -- Fancy Formal Firewall Universal Understander
|
||
|
||
mdcat # markdown cat
|
||
presenterm # md slideshow tool
|
||
# zed-editor
|
||
git
|
||
uv # a single tool to replace pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv - https://docs.astral.sh/uv/
|
||
# euporie # tui for jupyter notebooks
|
||
|
||
# awrit # chromium-browser in the terminal
|
||
|
||
smartcat
|
||
|
||
fio
|
||
yaegi
|
||
viddy # watch reimplementation
|
||
watchexec
|
||
tmux-cssh # cluster ssh - parallel ssh
|
||
# rich-cli
|
||
|
||
passage # pass w/ support for age encryption
|
||
pass-wayland
|
||
# passExtensions.pass-tomb
|
||
tomb
|
||
passExtensions.pass-file
|
||
passExtensions.pass-audit
|
||
passExtensions.pass-update
|
||
passExtensions.pass-import
|
||
passExtensions.pass-genphrase
|
||
|
||
btrfs-progs
|
||
btrfs-heatmap
|
||
ntfs3g
|
||
cryptsetup
|
||
squashfsTools
|
||
sasquatch
|
||
libguestfs
|
||
parted
|
||
gptfdisk
|
||
gphoto2fs
|
||
|
||
pv
|
||
ddrescue
|
||
testdisk
|
||
#scrounge-ntfs
|
||
#python3.pkgs.dissect-ntfs
|
||
#python3.pkgs.dissect
|
||
#python3.pkgs.dissect-util
|
||
#python3.pkgs.dissect-volume
|
||
#python3.pkgs.dissect-thumbcache
|
||
#python3.pkgs.dissect-shellitem
|
||
#python3.pkgs.dissect-xfs
|
||
#python3.pkgs.dissect-fat
|
||
#python3.pkgs.dissect-target
|
||
#python3.pkgs.dissect-sql
|
||
## python3.pkgs.dissect-fve
|
||
#python3.pkgs.dissect-archive
|
||
#python3.pkgs.dissect-regf
|
||
#python3.pkgs.dissect-etl
|
||
#python3.pkgs.dissect-evidence
|
||
#python3.pkgs.dissect-ole
|
||
#python3.pkgs.dissect-cim
|
||
#python3.pkgs.dissect-executable
|
||
#python3.pkgs.dissect-eventlog
|
||
#python3.pkgs.dissect-clfs
|
||
python3.pkgs.fusepy
|
||
|
||
android-backup-extractor
|
||
|
||
httm # zfs time machine-like tool
|
||
htmlq # like jq, but for html
|
||
# httplz # a basic http server for hosting a folder
|
||
htmldoc # convert html top postscript and pdf
|
||
httperf # http load generator
|
||
htmx-lsp # langserver for htmx
|
||
htmlhint # static code analysis for html
|
||
# http-prompt # An interactive command-line HTTP client featuring autocomplete and syntax highlighting
|
||
#http-prompt # An interactive command-line HTTP client featuring autocomplete and syntax highlighting
|
||
|
||
tg
|
||
|
||
graphviz-nox
|
||
feedgnuplot
|
||
bgpdump
|
||
# squid-6.8
|
||
|
||
wireguard-tools
|
||
wget
|
||
curl
|
||
inetutils # telnet
|
||
httpx
|
||
traceroute
|
||
dublin-traceroute
|
||
mtr # a network diagnostic tool
|
||
|
||
kitty
|
||
starship
|
||
zellij
|
||
zoxide
|
||
ripgrep-all # provides rga with support for pdfs, zip files and such.
|
||
delta # diff enrichment
|
||
sad # like sed
|
||
fzf
|
||
fzy # a better fuzzy finder
|
||
skim # a command-line fuzzy finder written in Rust
|
||
ddh # a fast duplicate file finder
|
||
docfd # a multiline fuzzy document finder
|
||
zf # a fuzzy finder that prioritizes matches on filenames
|
||
skim # a rust fuzzy finder
|
||
fuzzel
|
||
nodePackages.json-diff
|
||
pandoc
|
||
|
||
fastfetch
|
||
freshfetch
|
||
ghfetch
|
||
# deploy
|
||
|
||
brave
|
||
# firefox-wayland
|
||
firefox
|
||
# ladybird
|
||
w3m
|
||
lynx
|
||
|
||
# go_1_23
|
||
go_1_25
|
||
rustc
|
||
cargo
|
||
sccache
|
||
|
||
# jupyterWithStuff
|
||
python3.pkgs.pip
|
||
python3.pkgs.numpy
|
||
python3.pkgs.pandas
|
||
# python3.pkgs.netaddr
|
||
# pp
|
||
|
||
keepassxc
|
||
# bitwarden # XXX: issues on 2505
|
||
bitwarden-cli
|
||
rbw
|
||
rofi-rbw-wayland
|
||
pinentry-curses # a dep of rbw. can also use pinentry (gtk2?).
|
||
|
||
bsd-finger
|
||
# poppler_utils
|
||
poppler-utils
|
||
zbar
|
||
qrencode
|
||
# flatpak
|
||
# thunderbird
|
||
# evolution
|
||
aerc
|
||
|
||
# drawio
|
||
libreoffice
|
||
# kdeconnect
|
||
# rquickshare
|
||
localsend
|
||
|
||
quickemu
|
||
virt-manager
|
||
remmina
|
||
|
||
# trilium-desktop
|
||
|
||
#openldap
|
||
#python3.pkgs.python-ldap
|
||
#gsasl
|
||
# python-ldap build deps
|
||
openldap.dev
|
||
cyrus_sasl.dev
|
||
|
||
logger # syslog client
|
||
|
||
sshpass
|
||
ssh-audit
|
||
sshchecker
|
||
ssh-key-confirmer
|
||
ssh-mitm
|
||
sshesame
|
||
|
||
pssh
|
||
ssh-to-age
|
||
|
||
lychee
|
||
notcurses
|
||
# openssl_3_3.dev
|
||
|
||
msgviewer # convert .msg to .eml
|
||
libpst # read outlook profile files
|
||
|
||
skopeo
|
||
|
||
cmatrix
|
||
|
||
# qbittorrent
|
||
transmission_4-gtk
|
||
immich-go
|
||
sdcv # console version of StarDict
|
||
|
||
tmux
|
||
tmate
|
||
circumflex # hackernews in the terminal
|
||
obfs4 # tor client-bridge transport mechanism
|
||
|
||
sysstat
|
||
ioztat # storage load analysis fro openzfs
|
||
pciutils
|
||
sysfsutils
|
||
lshw
|
||
sanoid
|
||
hdparm
|
||
|
||
turbovnc
|
||
|
||
powershell
|
||
|
||
perl
|
||
exiftool
|
||
exiflooter
|
||
|
||
clinfo
|
||
gpu-viewer
|
||
opencl-headers
|
||
ocl-icd
|
||
#khronos-ocl-icd-loader
|
||
#rocmPackages.clr
|
||
# toybox # unix utils
|
||
# gnat14 # contains `strings` and other useful commands.
|
||
gnat15 # contains `strings` and other useful commands.
|
||
ctags
|
||
gotags
|
||
|
||
nvme-cli
|
||
openconnect
|
||
rusty-diceware
|
||
pwgen
|
||
pwgen-secure
|
||
sshfs
|
||
minicom # serial terminal
|
||
|
||
qbittorrent
|
||
gnome-online-accounts-gtk
|
||
# gnome's archive manager.
|
||
file-roller
|
||
# networkminer # network forensics gui in dotnet
|
||
# sublime-music
|
||
termsonic
|
||
picard
|
||
|
||
switcheroo # image converter
|
||
darktable
|
||
|
||
# signal-desktop
|
||
signalbackup-tools
|
||
|
||
feishin # subsonic music player
|
||
|
||
xlsx_to_csv
|
||
];
|
||
};
|
||
|
||
networking = {
|
||
# hostId = pkgs.lib.mkForce "00000000";
|
||
hostId = "deadb33f";
|
||
hostName = "t14";
|
||
|
||
nftables.enable = true;
|
||
|
||
networkmanager = {
|
||
enable = true;
|
||
dns = "none";
|
||
plugins = with pkgs; [
|
||
networkmanager-openvpn
|
||
networkmanager-openconnect
|
||
networkmanager-fortisslvpn
|
||
networkmanager-vpnc
|
||
];
|
||
ensureProfiles = {
|
||
environmentFiles = [
|
||
config.sops.secrets."wlan/ton.env".path
|
||
];
|
||
profiles = {
|
||
t = {
|
||
connection.id = "ton";
|
||
connection.type = "wifi";
|
||
wifi.ssid = "$T_NAME";
|
||
wifi-security = {
|
||
auth-alg = "open";
|
||
key-mgmt = "wpa-psk";
|
||
psk = "$T_PASSWD";
|
||
};
|
||
};
|
||
};
|
||
};
|
||
};
|
||
dhcpcd.extraConfig = "nohook resolv.conf";
|
||
nameservers = [
|
||
"127.0.0.1"
|
||
"::1"
|
||
];
|
||
resolvconf.dnsSingleRequest = true;
|
||
resolvconf.extraOptions = [
|
||
"single-request-reopen"
|
||
"attempts:5"
|
||
"timeout:3"
|
||
# "rotate"
|
||
"ndots:1"
|
||
# Sets RES_NOCHECKNAME in _res.options, which disables the modern BIND
|
||
# checking of incoming hostnames and mail names for invalid characters such
|
||
# as underscore (_), non-ASCII, or control characters.
|
||
# "no-check-names"
|
||
"trust-ad"
|
||
];
|
||
|
||
# interfaces.enp0s25.wakeOnLan.enable = true;
|
||
|
||
stevenblack.enable = true;
|
||
stevenblack.block = [
|
||
"fakenews"
|
||
"gambling"
|
||
];
|
||
|
||
firewall = rec {
|
||
allowPing = true;
|
||
## spice
|
||
# allowedTCPPortRanges = [
|
||
# { from = 5900; to = 5999; }
|
||
# ];
|
||
# allowedTCPPorts = [3128];
|
||
|
||
allowedTCPPortRanges = [
|
||
# kdeconnect
|
||
{
|
||
from = 1714;
|
||
to = 1764;
|
||
}
|
||
];
|
||
allowedUDPPortRanges = allowedTCPPortRanges;
|
||
|
||
checkReversePath = lib.mkForce false; # FIXME: fix the root issue instead.
|
||
logReversePathDrops = true;
|
||
logRefusedConnections = true;
|
||
trustedInterfaces = [
|
||
"virbr0"
|
||
# "bro"
|
||
"tailscale0"
|
||
];
|
||
};
|
||
|
||
# Configure network proxy if necessary
|
||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||
|
||
#wireless.networks = {
|
||
# "@homewlan_ssid@" = {
|
||
# psk = "@homewlan_psk@";
|
||
# };
|
||
#};
|
||
};
|
||
|
||
users.users = {
|
||
root = {
|
||
shell = pkgs.zsh;
|
||
openssh.authorizedKeys.keys = [
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtG6NCgdLHX4ztpfvYNRaslKWZcl6KdTc1DehVH4kAL"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaXmXbNegxiXLldy/sMYX8kCsghY1SGqn2FZ5Jk7QJw"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZbkw9vjCfbMPEH7ZAFq20XE9oIJ4w/HRIMu2ivNcej caelum's nixbldr key"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKzPC0ZK4zrOEBUdu1KNThEleVb1T5Pl3+n3KB3o0b8 surtur's nixbldr key"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5u4sBsu4ZpVRHJ9J2CfQ4JoojsdfsS0WzaFgiMCOe5 loki's nixbldr key"
|
||
];
|
||
# hashedPasswordFile = config.sops.secrets.rootPassphrase.path;
|
||
hashedPassword = "$y$j9T$yNhN6CYvKBWz/HnLv2gp//$0fFgtV4xzBijxWxUg1oTH74GoekdMK6UZUQWby5fZi4";
|
||
subUidRanges = [
|
||
{
|
||
count = 65535;
|
||
startUid = 65536 * 28; # 1835008, docker
|
||
}
|
||
];
|
||
};
|
||
|
||
mko = {
|
||
isNormalUser = true;
|
||
createHome = true;
|
||
shell = pkgs.zsh;
|
||
openssh.authorizedKeys.keys = [
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBtG6NCgdLHX4ztpfvYNRaslKWZcl6KdTc1DehVH4kAL"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaXmXbNegxiXLldy/sMYX8kCsghY1SGqn2FZ5Jk7QJw"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZbkw9vjCfbMPEH7ZAFq20XE9oIJ4w/HRIMu2ivNcej caelum's nixbldr key"
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKzPC0ZK4zrOEBUdu1KNThEleVb1T5Pl3+n3KB3o0b8 surtur's nixbldr key"
|
||
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrlXIj3oWbWrFUZnhccd/uqM2D/yRiKOEwfD6xbngJ7 syncoid pull backups"
|
||
];
|
||
hashedPasswordFile = config.sops.secrets.mkoPassphrase.path;
|
||
extraGroups = [
|
||
"systemd-journal"
|
||
"wheel"
|
||
"networkmanager"
|
||
"audio"
|
||
"camera"
|
||
"kvm"
|
||
"lp"
|
||
"scanner"
|
||
"video"
|
||
"console"
|
||
"dialout"
|
||
"docker"
|
||
"libvirtd"
|
||
"render"
|
||
"adbusers"
|
||
"wireshark"
|
||
"dbus"
|
||
];
|
||
autoSubUidGidRange = true;
|
||
group = usr;
|
||
};
|
||
};
|
||
# users.users.mko.group = usr;
|
||
users.groups = {
|
||
mko = { };
|
||
wheel.members = [ usr ];
|
||
};
|
||
|
||
nix.registry = {
|
||
nixpkgs.to = {
|
||
type = "github";
|
||
owner = "nixos";
|
||
repo = "nixpkgs";
|
||
};
|
||
};
|
||
|
||
# services.xserver.enable = true;
|
||
# services.xserver.displayManager.gdm.enable = true;
|
||
# # services.xserver.displayManager.defaultSession = "plasmawayland";
|
||
# services.xserver.displayManager.defaultSession = "sway";
|
||
# services.xserver.desktopManager = {
|
||
# xterm.enable = false;
|
||
# # xfce.enable = true;
|
||
# # gnome.enable = true;
|
||
# plasma5.enable = true;
|
||
# };
|
||
|
||
# environment.plasma5.excludePackages = with pkgs.libsForQt5; [
|
||
# elisa
|
||
# gwenview
|
||
# okular
|
||
# oxygen
|
||
# khelpcenter
|
||
# konsole
|
||
# # plasma-browser-integration
|
||
# print-manager
|
||
# ];
|
||
|
||
qt = {
|
||
enable = true;
|
||
platformTheme = "gnome"; # gnome/kde
|
||
style = "adwaita-dark";
|
||
};
|
||
|
||
programs = {
|
||
adb.enable = true;
|
||
# https://nixos.wiki/wiki/Appimage
|
||
appimage.binfmt = true;
|
||
# responsiveness over 9000.
|
||
cfs-zen-tweaks.enable = true;
|
||
dconf.enable = true;
|
||
gnupg.agent = {
|
||
enable = true;
|
||
# pinentryFlavor = "curses"; # or "gnome3"
|
||
pinentryPackage = pkgs.pinentry-curses;
|
||
enableSSHSupport = false;
|
||
};
|
||
ssh.startAgent = true; # XXX: 25.11
|
||
# kdeconnect.enable = true;
|
||
sway = {
|
||
enable = true;
|
||
# package = pkgs.swayfx;
|
||
wrapperFeatures.gtk = true;
|
||
};
|
||
|
||
# enabled in home-manager
|
||
# captive-browser.enable = true;
|
||
|
||
chromium = {
|
||
enable = true;
|
||
extensions = [
|
||
"cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
|
||
];
|
||
extraOpts = {
|
||
"BrowserSignin" = 0;
|
||
"SyncDisabled" = true;
|
||
"PasswordManagerEnabled" = false;
|
||
"BuiltInDnsClientEnabled" = false;
|
||
"DnsOverHttpsMode" = "secure";
|
||
"NameServer" = "https://dns.dotya.ml/dns-query";
|
||
"MetricsReportingEnabled" = false; # was true?
|
||
"SafeBrowsingProtectionLevel" = 0;
|
||
"ShowFullUrlsInAddressBar" = 1;
|
||
# disable punycode.
|
||
"DisableIdnEncoding" = true;
|
||
"SpellcheckEnabled" = true;
|
||
"SpellcheckLanguage" = [
|
||
"en-GB"
|
||
"en-US"
|
||
"en"
|
||
];
|
||
"CloudPrintSubmitEnabled" = false;
|
||
# ref: https://chromeenterprise.google/policies/#ExtensionManifestV2Availability
|
||
"ExtensionManifestV2Availability" = 2; # 2 = Manifestv2 is enabled.
|
||
"ExtensionManifestV2Unsupported" = false;
|
||
"ExtensionManifestV2Disabled" = false;
|
||
# --disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabled
|
||
};
|
||
};
|
||
corectrl.enable = true;
|
||
# macOS compatibility;
|
||
# darling.enable = true;
|
||
direnv.enable = true;
|
||
# gnome's archive manager.
|
||
# file-roller.enable = true;
|
||
firefox = {
|
||
enable = true;
|
||
# package = pkgs.firefox-wayland;
|
||
package = pkgs.firefox;
|
||
# https://mozilla.github.io/policy-templates/
|
||
#extraPolicies = {
|
||
# DisableFirefoxStudies = true;
|
||
# DisablePocket = true;
|
||
#};
|
||
policies.preferences.ExtensionSettings = {
|
||
"uBlock0@raymondhill.net" = {
|
||
install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
|
||
installation_mode = "force_installed";
|
||
};
|
||
};
|
||
## set stuff from about.config.
|
||
preferences = {
|
||
# "widget.use-xdg-desktop-portal.file-picker" = 1;
|
||
"extensions.pocket.enabled" = false;
|
||
# "privacy.fingerprintingProtection" = true;
|
||
# "privacy.trackingprotection.enabled" = true;
|
||
"privacy.trackingprotection.socialtracking.enabled" = true;
|
||
"gfx.webrender.all" = true;
|
||
"gfx.webrender.compositor" = true;
|
||
"browser.cache.disk.enable" = false;
|
||
"browser.cache.disk.capacity" = 0;
|
||
"browser.cache.memory.enable" = true;
|
||
"browser.cache.memory.max_entry_size" = 51200;
|
||
"devtools.cache.disabled" = true;
|
||
"network.dns.echconfig.enabled" = true;
|
||
# ideally should be 2.
|
||
"network.trr.mode" = 5;
|
||
"network.trr.custom_uri" = "https://dns.dotya.ml/dns-query";
|
||
"network.trr.excluded-domains" = "example.com,dc-wifi.tech,trenkwalder2000";
|
||
"network.http.http3.enable_kyber" = true;
|
||
"security.tls.enable_kyber" = true;
|
||
"media.autoplay.default" = 5; # disable autoplay of both audio and video.
|
||
"browser.tabs.warnOnClose" = true;
|
||
"media.ffmpeg.vaapi.enabled" = true;
|
||
};
|
||
nativeMessagingHosts.packages = with pkgs; [
|
||
tridactyl-native
|
||
];
|
||
};
|
||
|
||
gphoto2.enable = true;
|
||
gnome-disks.enable = true;
|
||
seahorse.enable = true;
|
||
|
||
nano.enable = false;
|
||
vim.defaultEditor = true;
|
||
|
||
# nm-applet.enable = true;
|
||
wireshark.enable = true;
|
||
wshowkeys.enable = true;
|
||
|
||
# XXX: unfree...
|
||
# winbox.enable = true;
|
||
};
|
||
|
||
security = {
|
||
# void ca for docker to stop whining.
|
||
pki.certificates = [
|
||
"-----BEGIN CERTIFICATE-----
|
||
MIIGOTCCBCGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBsMRMwEQYKCZImiZPyLGQB
|
||
GRYDY29tMRcwFQYKCZImiZPyLGQBGRYHdm9pZHNvYzEQMA4GA1UECgwHVm9pZFNP
|
||
QzEQMA4GA1UECwwHUm9vdCBDQTEYMBYGA1UEAwwPVm9pZFNPQyBSb290IENBMB4X
|
||
DTE5MDIwNjAxMDIzNFoXDTI5MDIwNTAxMDIzNFowcjETMBEGCgmSJomT8ixkARkW
|
||
A2NvbTEXMBUGCgmSJomT8ixkARkWB3ZvaWRzb2MxEDAOBgNVBAoMB1ZvaWRTT0Mx
|
||
EzARBgNVBAsMClNpZ25pbmcgQ0ExGzAZBgNVBAMMElZvaWRTT0MgU2lnbmluZyBD
|
||
QTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALMsi7AZpRqnhnUHFsBd
|
||
MwmZmG/Vv1YqrFMLeegWDMZPt+/VfGZCD0uW20/fSNRAzs+q/QDCLo7JuN6XYRWV
|
||
wX0sAnRZDUiuJL60imnBJ0WozJxv+ELWLYc62hoWnk8FyqCiT/XDIKAquKKd/0KF
|
||
m+ucrm/0AJqzQkr3vcPMwYoGjXRxl3ICTBx/5B5m2cV/Vrl6IoM5Zl8q6KcQGO4g
|
||
2KNrEaL1stNpuO6/411+hK++v5B5pjLLY3XwRyIi9mb21caQnfZ2d/2xhvuKXxg/
|
||
dY4x50OMOTdvlLLvJXR+H08Tho5V/MKbHip08b/EriQyO1ZTpuv/s0M39lYlNnuw
|
||
d4fIEjk8vZrORbmGE7zKFdYksefcaqEacHd9Dcu40LeAkqCnsiJ1uU+iptf3qOkl
|
||
mLz9XMYG5EWAjsH07qWIusZUW34yKKa7FjhQH0fojGQomE5oXEyZhSjKFhr7i9Dz
|
||
AV+Nc35pV9k5sqDyRegGPtdFkiVjAWCqPD1EGcvdSz32M5yz548WxFbw5u0lajAr
|
||
Q0P0Dlliu251pMdbwq6jhpDY9YIZQEy89jzwPbtZ4jFWWLsi561cihVqTy+9thNl
|
||
veDziCKkeCou87xjNXsV4tn9iytvdlQa6o5aBVeZ/3sIhiQANUWtt5Gk778JUnOK
|
||
C7YmtJ5VJ1fEUGpqCy4F0qoTAgMBAAGjgd8wgdwwDgYDVR0PAQH/BAQDAgEGMBIG
|
||
A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLMTXvyp1X9mKMm6VOHpVKKLS+gL
|
||
MIGWBgNVHSMEgY4wgYuAFJ2Q9BMJ3M6HyC95j4OEzl6cqxgboXCkbjBsMRMwEQYK
|
||
CZImiZPyLGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHdm9pZHNvYzEQMA4GA1UE
|
||
CgwHVm9pZFNPQzEQMA4GA1UECwwHUm9vdCBDQTEYMBYGA1UEAwwPVm9pZFNPQyBS
|
||
b290IENBggEBMA0GCSqGSIb3DQEBCwUAA4ICAQA6YD2sv6p4j18CQgWNG7N3d5/x
|
||
qZwzzKFFILNFWxW/ggCu1knmjxQ6xPKa9xbN+22GCZ8KwwZz58K9BjXfL0vuB2AU
|
||
YMc8DUpKBE65eoWFanOcQDxbxfOojiqV1I7MhA9Fg/yuBFZtP58zXWi8tnbUxe6z
|
||
6a74EV8Lli2TT6/6+Y12rDOxMItQTfLbv+a5sAkWKgbI3bX40hTxMPpPaEmsSCAN
|
||
2u5uN4Un0xCoDJl7jFu0wgj7wXqZ5SinduG8KOYBGqRN5ljzycR3qcZP70pqxstH
|
||
32ht/NBj1A+LSFAPkJ3tvXgBdGImIM0Sv/1gxinQZhJwL3VKVM+IZv0WE5vIrRgh
|
||
iiMyzC+TPqJ8530/NSpwySxfLBfOUGCJCApdLo5G0O8hCE20hiHoInl3m2yONxPZ
|
||
Q9e6qDO/7W0FluWcXf01bdaRTpWjUBCM/y7T0jDIuSbFuWG2//6VSO7Nz1q66KLr
|
||
9ECWUrLGlLpsh3xvYIBhPYMJ6PyRaXjM1+hQMfXZBbj3zn261F84FCS/pEIvR7XD
|
||
FRMeFND4sQLfDLFFpy3wpap4o/9tvFUfrdmqg7IVeN1OYkyw0sQUoivLFZacun+W
|
||
RJfq2+1K5jB6Eymw+iaTJ9J+taPmaTHd8gqpdtJdh0+8ZHtqucwXV/JvjQkfy2y1
|
||
/4/yn1tSvqHOSJV6eA==
|
||
-----END CERTIFICATE-----"
|
||
# zap CA
|
||
"-----BEGIN CERTIFICATE-----
|
||
MIIE5jCCA86gAwIBAgIEk9bCtzANBgkqhkiG9w0BAQsFADB0MSEwHwYDVQQDDBha
|
||
ZWQgQXR0YWNrIFByb3h5IFJvb3QgQ0ExFjAUBgNVBAcMDTFhNjkxMWI4NGQyOTAx
|
||
FDASBgNVBAoMC1pBUCBSb290IENBMRQwEgYDVQQLDAtaQVAgUm9vdCBDQTELMAkG
|
||
A1UEBhMCeHgwHhcNMjUxMTEwMTExOTUwWhcNMjYxMTEwMTExOTUwWjB0MSEwHwYD
|
||
VQQDDBhaZWQgQXR0YWNrIFByb3h5IFJvb3QgQ0ExFjAUBgNVBAcMDTFhNjkxMWI4
|
||
NGQyOTAxFDASBgNVBAoMC1pBUCBSb290IENBMRQwEgYDVQQLDAtaQVAgUm9vdCBD
|
||
QTELMAkGA1UEBhMCeHgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDV
|
||
mKj7K+835qPnV7GtRdSYjCFaQkk9ABQGWk/pv5lTNNuOvpt/kdWCrc4tojQQQZbI
|
||
vjDmLHdI1DhSgLmBLIcbVr5UOog6l/2BzvCiheqyepW3eBL5SbIFGSj6SY8V4J2J
|
||
qcLause9ODnl+T8SP94k5lG9Ea1xQmoItEmPGlKihFPFvp0jyt5TKuYn1eLxHzZ1
|
||
kLwhXyrModYdS/2LqRxvgE1zOIKz+1gCFq/j3MhUDaPamU8uNfLWFILnwpQAXAIP
|
||
7zbw55tb1PIoKVHMeLcL9TnGcpmAbMm7p2NJgeinZHrAffE+Njb4rLtLaxIZ4SFb
|
||
NKbl7p7BCjZPRoXO3kOdAgMBAAGjggF+MIIBejCCATMGA1UdDgSCASoEggEmMIIB
|
||
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Zio+yvvN+aj51exrUXUmIwh
|
||
WkJJPQAUBlpP6b+ZUzTbjr6bf5HVgq3OLaI0EEGWyL4w5ix3SNQ4UoC5gSyHG1a+
|
||
VDqIOpf9gc7wooXqsnqVt3gS+UmyBRko+kmPFeCdianC2rrHvTg55fk/Ej/eJOZR
|
||
vRGtcUJqCLRJjxpSooRTxb6dI8reUyrmJ9Xi8R82dZC8IV8qzKHWHUv9i6kcb4BN
|
||
cziCs/tYAhav49zIVA2j2plPLjXy1hSC58KUAFwCD+828OebW9TyKClRzHi3C/U5
|
||
xnKZgGzJu6djSYHop2R6wH3xPjY2+Ky7S2sSGeEhWzSm5e6ewQo2T0aFzt5DnQID
|
||
AQABMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgG2MCMGA1UdJQQcMBoGCCsG
|
||
AQUFBwMBBggrBgEFBQcDAgYEVR0lADANBgkqhkiG9w0BAQsFAAOCAQEAqnyleWcW
|
||
RCrYpurOppEC00tGLcWJnAS0TlS+/LB7CKID1M0H2BqYGSQ1hJlTphVjzcbPdXM/
|
||
xeACYrYL6t7WNTYkXwPCzKZHb1HW32/IDe2UvG5g1MJR248CeVOe1Z0GFzTmwA1W
|
||
QIBWW/vxJUTShpEMPAmK6ZkMGvFWXsxJY+Kb71Sm5IPp8IBkKbsbPBZYgoBXwq/d
|
||
KaufM+aqfouAb4afFikYAdDPEkHMzZy4u6TtkgnCehAdt3fERqsS7Qrmsny8Ufho
|
||
vpKRdOIgVfoxEbgUQ9wocUsyXPgTOknGMdRlSUrIQ+513br8+/NyV3E5O6AlOsQM
|
||
rE3y5ut7BvuF4g==
|
||
-----END CERTIFICATE-----"
|
||
];
|
||
#doas = {
|
||
# enable = false;
|
||
# extraRules = [
|
||
# {
|
||
# users = [usr];
|
||
# keepEnv = true; # Optional, retains environment variables while running commands
|
||
# persist = true; # Optional, only require password verification a single time
|
||
# }
|
||
# ];
|
||
#};
|
||
sudo = {
|
||
enable = true;
|
||
# prevent's CVE-2021-3156-style exploits.
|
||
execWheelOnly = true;
|
||
# for wheel and root, kitty likes this.
|
||
keepTerminfo = true;
|
||
#extraConfig = ''
|
||
# Defaults lecture=always
|
||
# Defaults lecture_file=${./misc/groot.txt}
|
||
#'';
|
||
extraRules = [
|
||
{
|
||
commands = [
|
||
{
|
||
command = "${pkgs.systemd}/bin/systemctl suspend";
|
||
options = [ "NOPASSWD" ];
|
||
}
|
||
{
|
||
command = "${pkgs.systemd}/bin/reboot";
|
||
options = [ "NOPASSWD" ];
|
||
}
|
||
{
|
||
command = "${pkgs.systemd}/bin/poweroff";
|
||
options = [ "NOPASSWD" ];
|
||
}
|
||
];
|
||
groups = [ "wheel" ];
|
||
}
|
||
];
|
||
};
|
||
pam = {
|
||
# refs:
|
||
# https://nixos.wiki/wiki/Yubikey#Locking_the_screen_when_a_Yubikey_is_unplugged
|
||
# https://joinemm.dev/blog/yubikey-nixos-guide
|
||
u2f = {
|
||
enable = true;
|
||
# interactive = true;
|
||
# XXX: deprecated in 24.11
|
||
# cue = true;
|
||
# origin = "pam://yubi";
|
||
# authFile = config.sops.templates.yubiPls.path;
|
||
settings = {
|
||
cue = true;
|
||
origin = "pam://yubi";
|
||
authFile = config.sops.templates.yubiPls.path;
|
||
interactive = true;
|
||
};
|
||
};
|
||
services = {
|
||
# swaylock = {};
|
||
swaylock = {
|
||
u2fAuth = true;
|
||
rules.auth.u2f.args = lib.mkAfter [
|
||
"pinverification=0"
|
||
"userverification=1"
|
||
];
|
||
};
|
||
sudo.u2fAuth = true;
|
||
login = {
|
||
u2fAuth = true;
|
||
fprintAuth = true;
|
||
enableGnomeKeyring = true;
|
||
};
|
||
# xscreensaver.fprintAuth = false;
|
||
};
|
||
};
|
||
polkit.enable = true;
|
||
rtkit.enable = true;
|
||
|
||
auditd.enable = true;
|
||
audit = {
|
||
enable = true;
|
||
rules = config.wanderllama.auditdRules ++ [
|
||
# a rule to log every single time a program is attempted to be run
|
||
# XXX: this overloads us
|
||
# "-a exit,always -F arch=b64 -S execve"
|
||
|
||
### XXX: overload
|
||
### # The following rule shows how to audit failed access to files due to permission problems. Note that it takes two rules for
|
||
### # each arch ABI to audit this since file access can fail with two different failure codes indicating permission problems.
|
||
### "-a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access"
|
||
### "-a always,exit -F arch=b32 -S open -S openat -F exit=-EPERM -k access"
|
||
### "-a always,exit -F arch=b64 -S open -S openat -F exit=-EACCES -k access"
|
||
### "-a always,exit -F arch=b64 -S open -S openat -F exit=-EPERM -k access"
|
||
### # any non-system user file access
|
||
### "-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access"
|
||
|
||
# replace using new-style - and only for uids>=1000 (user activity)
|
||
"-a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -k passwd_changes"
|
||
"-a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -k passwd_changes"
|
||
# /etc/shadow writes/attribute changes
|
||
"-a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -k passwd_changes"
|
||
"-a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -k passwd_changes"
|
||
];
|
||
};
|
||
};
|
||
|
||
systemd.services = {
|
||
zfs-zed.serviceConfig = {
|
||
LogLevelMax = "notice";
|
||
# StandardOutput = lib.mkForce "/dev/null";
|
||
StandardOutput = lib.mkForce "null";
|
||
StandardError = lib.mkForce "null";
|
||
};
|
||
tailscaled.serviceConfig = {
|
||
LogLevelMax = "notice";
|
||
# StandardOutput = "null";
|
||
LogsDirectory = "tailscaled";
|
||
StandardOutput = "append:%L/stdout.log";
|
||
};
|
||
NetworkManager-wait-online.serviceConfig.ExecStart = "${pkgs.coreutils}/bin/true";
|
||
# NetworkManager-wait-online.enable = false;
|
||
};
|
||
|
||
services = {
|
||
# fprintd.enable = true;
|
||
# fprintd.tod.enable = true;
|
||
# fprintd.tod.driver = pkgs.libfprint-2-tod1-vfs0090;
|
||
|
||
#vsftpd = {
|
||
# enable = false;
|
||
# anonymousUser = true;
|
||
# anonymousMkdirEnable = true;
|
||
#};
|
||
atd.enable = true;
|
||
|
||
earlyoom = lib.mkIf config.services.earlyoom.enable {
|
||
freeMemThreshold = lib.mkForce 2;
|
||
extraArgs = lib.mkForce [
|
||
"-g"
|
||
"--avoid=^(sway|kitty|firefox|qutebrowser|brave|qemu)$"
|
||
"--prefer=^(electron|libreoffice|gimp|chromium)$"
|
||
];
|
||
};
|
||
|
||
clamav = {
|
||
updater.enable = true;
|
||
daemon.enable = true;
|
||
};
|
||
|
||
fstrim.enable = true;
|
||
fwupd.enable = true;
|
||
|
||
gnome.gcr-ssh-agent.enable = lib.mkForce false;
|
||
logind = {
|
||
# XXX: deprecated in 25.11
|
||
#lidSwitch = "ignore";
|
||
#lidSwitchDocked = "ignore";
|
||
#extraConfig = "HandlePowerKey=suspend";
|
||
settings.Login = {
|
||
# don’t shutdown when power button is short-pressed.
|
||
HandleLidSwitch = "ignore";
|
||
HandleLidSwitchDocked = "ignore";
|
||
HandlePowerKey = "ignore";
|
||
};
|
||
};
|
||
|
||
# nixos-cli.enable = true;
|
||
|
||
udev.extraRules = ''
|
||
# wol
|
||
ACTION=="add", SUBSYSTEM=="net", NAME=="en*", RUN+="${pkgs.ethtool}/bin/ethtool -s $name wol g"
|
||
|
||
# lock screen on yubi removal.
|
||
ACTION=="remove",\
|
||
ENV{ID_BUS}=="usb",\
|
||
ENV{ID_MODEL_ID}=="0402",\
|
||
ENV{ID_VENDOR_ID}=="1050",\
|
||
ENV{ID_VENDOR}=="Yubico",\
|
||
RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
|
||
|
||
|
||
# ref: https://gist.github.com/Trucido/5bea07ed3888fcf481c00ecd998c1226
|
||
# Ignore ZFS vdev filesystem type "zfs_member" with partition ID "Solaris /usr & Apple ZFS"
|
||
ENV{ID_PART_ENTRY_SCHEME}=="gpt", ENV{ID_FS_TYPE}=="zfs_member", ENV{ID_PART_ENTRY_TYPE}=="6a898cc3-1dd2-11b2-99a6-080020736631", ENV{UDISKS_IGNORE}="1"
|
||
'';
|
||
|
||
pipewire = {
|
||
enable = true;
|
||
alsa = {
|
||
enable = true;
|
||
support32Bit = true;
|
||
};
|
||
pulse.enable = true;
|
||
wireplumber.enable = true;
|
||
};
|
||
|
||
gnome = {
|
||
# XXX: deprecated in 24.11
|
||
# gnome.tracker.enable = false;
|
||
tinysparql.enable = false;
|
||
gnome-keyring.enable = true;
|
||
# optional to use google/nextcloud calendar
|
||
gnome-online-accounts.enable = true;
|
||
# optional to use google/nextcloud calendar
|
||
evolution-data-server.enable = true;
|
||
gnome-settings-daemon.enable = true;
|
||
};
|
||
|
||
gvfs.enable = true;
|
||
printing.enable = true;
|
||
# printing.enable = false;
|
||
geoclue2.enable = true; # geolocation.
|
||
|
||
blueman.enable = true;
|
||
|
||
dbus.enable = true;
|
||
|
||
# dnscrypt-proxy2.settings.cloaking_rules = config.sops.secrets.extraHosts.path;
|
||
dnscrypt-proxy2.settings.cloaking_rules = config.sops.secrets.dnscrypt-proxy-cloaked.path;
|
||
dnscrypt-proxy2.settings.forwarding_rules = config.sops.secrets.dnscrypt-proxy-forwardingRules.path;
|
||
dnscrypt-proxy2.settings.query_log.file = "/tmp/.query.log";
|
||
dnscrypt-proxy2.settings.log_level = 2;
|
||
|
||
flatpak.enable = true;
|
||
|
||
# kmscon.enable = true;
|
||
greetd = {
|
||
enable = true;
|
||
settings = {
|
||
# 25.11 renamed
|
||
# ${pkgs.greetd.tuigreet}/bin/tuigreet \
|
||
default_session.command = ''
|
||
${pkgs.tuigreet}/bin/tuigreet \
|
||
--time \
|
||
--asterisks \
|
||
--user-menu \
|
||
--cmd sway
|
||
'';
|
||
};
|
||
};
|
||
|
||
pcscd.enable = true;
|
||
|
||
power-profiles-daemon.enable = true;
|
||
#tlp.enable =
|
||
# lib.mkDefault ((lib.versionOlder (lib.versions.majorMinor lib.version) "23.11")
|
||
# || !config.services.power-profiles-daemon.enable);
|
||
#auto-cpufreq.enable = true;
|
||
#auto-cpufreq.settings = {
|
||
# battery = {
|
||
# governor = "powersave";
|
||
# turbo = "never";
|
||
# };
|
||
# charger = {
|
||
# governor = "schedutil";
|
||
# turbo = "auto";
|
||
# };
|
||
#};
|
||
|
||
prometheus = {
|
||
enable = false;
|
||
exporters = {
|
||
node = {
|
||
enable = true;
|
||
enabledCollectors = [
|
||
"logind"
|
||
"systemd"
|
||
"sysctl"
|
||
"network_route"
|
||
"zfs"
|
||
];
|
||
disabledCollectors = [
|
||
"arp"
|
||
"tapestats"
|
||
];
|
||
listenAddress = "t14.${tailnet}";
|
||
port = 9100;
|
||
};
|
||
smartctl = {
|
||
enable = true;
|
||
listenAddress = "t14.${tailnet}";
|
||
devices = [ "/dev/nvme0n1" ];
|
||
};
|
||
};
|
||
};
|
||
|
||
pulseaudio = {
|
||
enable = false;
|
||
# extraModules = [ pkgs.pulseaudio-modules-bt ];
|
||
};
|
||
|
||
sanoid = {
|
||
enable = true;
|
||
interval = "*:0/5";
|
||
datasets = {
|
||
"zroot/userdata" = {
|
||
useTemplate = [ "frequent" ];
|
||
# recursive = "zfs";
|
||
recursive = true;
|
||
# processChildrenOnly = true;
|
||
};
|
||
"zroot/system/nixos" = {
|
||
useTemplate = [ "production" ];
|
||
# recursive = "zfs";
|
||
recursive = true;
|
||
};
|
||
"zroot/local/nix" = {
|
||
useTemplate = [ "production" ];
|
||
};
|
||
"zroot/local/home/${usr}/xper" = {
|
||
useTemplate = [ "production" ];
|
||
recursive = true;
|
||
};
|
||
};
|
||
};
|
||
|
||
syncthing = {
|
||
enable = true;
|
||
openDefaultPorts = true;
|
||
dataDir = "/home/${usr}/sync";
|
||
configDir = "/home/${usr}/.config/syncthing";
|
||
user = usr;
|
||
group = usr;
|
||
guiAddress = "127.0.0.1:8384";
|
||
};
|
||
|
||
SystemdJournal2Gelf = {
|
||
enable = false;
|
||
graylogServer = "loki.tail530c7.ts.net:12201";
|
||
};
|
||
|
||
# TS is enabled in the imported module, this is additional config.
|
||
tailscale = {
|
||
useRoutingFeatures = "both";
|
||
# accept-routes = true;
|
||
};
|
||
|
||
libinput.enable = true;
|
||
|
||
zfs = {
|
||
autoScrub = {
|
||
enable = true;
|
||
interval = "weekly";
|
||
};
|
||
trim.enable = true;
|
||
};
|
||
|
||
systemd-lock-handler.enable = true;
|
||
};
|
||
|
||
virtualisation.spiceUSBRedirection.enable = true;
|
||
|
||
# virtualisation.virtualbox.host.enable = true;
|
||
# virtualisation.virtualbox.host.enableHardening = true;
|
||
# users.extraGroups.vboxusers.members = [ "mko" ];
|
||
|
||
virtualisation.libvirtd.enable = true;
|
||
# virtualisation.useSecureBoot = true;
|
||
# virtualisation.useBootLoader = true; # allows for testing of bootloader.
|
||
|
||
virtualisation.podman.enable = true;
|
||
virtualisation.docker.enable = true;
|
||
#virtualisation.docker.daemon.settings = {userns-remap = "dockremap:dockremap";};
|
||
## rootless.
|
||
#virtualisation.docker.rootless = {
|
||
# enable = true;
|
||
# setSocketVariable = true;
|
||
#};
|
||
virtualisation.docker.storageDriver = "zfs";
|
||
#users.users.dockremap = {
|
||
# isNormalUser = false;
|
||
# isSystemUser = true;
|
||
# createHome = false;
|
||
# shell = pkgs.zsh;
|
||
# extraGroups = [
|
||
# "docker"
|
||
# ];
|
||
# subUidRanges = [
|
||
# {
|
||
# count = 65535;
|
||
# startUid = 65536 * 30;
|
||
# }
|
||
# ];
|
||
# subGidRanges = [
|
||
# {
|
||
# count = 65535;
|
||
# startGid = 65536 * 30;
|
||
# }
|
||
# ];
|
||
#};
|
||
#users.users.dockremap.group = "dockremap";
|
||
#users.groups.dockremap = {};
|
||
|
||
hardware = {
|
||
# amdgpu.amdvlk.enable = false;
|
||
cpu.amd.updateMicrocode = true;
|
||
enableRedistributableFirmware = true;
|
||
mcelog.enable = true;
|
||
|
||
bluetooth = {
|
||
enable = true;
|
||
# HSP & HFP daemon (apparently needs to be false now because of wire plumber)
|
||
hsphfpd.enable = false;
|
||
settings = {
|
||
General = {
|
||
Enable = "Source,Sink,Media,Socket";
|
||
};
|
||
};
|
||
};
|
||
|
||
graphics = {
|
||
# Mesa
|
||
enable = true;
|
||
# XXX: deprecated in 24.11
|
||
# driSupport = true;
|
||
|
||
extraPackages = with pkgs; [
|
||
libva-vdpau-driver # renamed in 25.11 from vaapiVdpau
|
||
libvdpau-va-gl
|
||
# amdvlk # XXX deprecated in 25.11
|
||
];
|
||
};
|
||
};
|
||
|
||
xdg = {
|
||
portal = {
|
||
enable = true;
|
||
wlr.enable = true;
|
||
extraPortals = with pkgs; [
|
||
xdg-desktop-portal-wlr
|
||
xdg-desktop-portal-gtk
|
||
];
|
||
};
|
||
};
|
||
|
||
# Copy the NixOS configuration file and link it from the resulting system
|
||
# (/run/current-system/configuration.nix). This is useful in case you
|
||
# accidentally delete configuration.nix.
|
||
# Does not work with flakes - yet™.
|
||
system.copySystemConfiguration = false;
|
||
# system.stateVersion = lib.mkForce "23.11";
|
||
}
|