refactoring!
This commit is contained in:
Don Harper
parent
db485e8d3e
commit
04eb69dbc8
21 changed files with 0 additions and 0 deletions
370
workstation/default.nix
Normal file
370
workstation/default.nix
Normal file
|
|
@ -0,0 +1,370 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
my-python-packages = python-packages: with python-packages; [
|
||||
pip
|
||||
pipx
|
||||
#recipe-scrapers
|
||||
#tldextract
|
||||
#setuptools
|
||||
];
|
||||
python-with-my-packages = pkgs.python311Full.withPackages my-python-packages;
|
||||
in
|
||||
{
|
||||
# Bootloader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot";
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
# Enable networking
|
||||
networking.networkmanager.enable = true;
|
||||
networking.enableIPv6 = false; # FIXME this is to test connectivity @ the office via wireguard
|
||||
networking.networkmanager.wifi.powersave = true;
|
||||
networking.useDHCP = false;
|
||||
# networking.extraHosts =
|
||||
# ''
|
||||
# 100.75.7.116 harper.tail harper bandwidth.duckland.org bandwidth2.duckland.org cal.duckland.org cloud.duckland.org dash.duckland.org git.duckland.org jelly.duckland.org music.duckland.org photos.duckland.org plex.duckland.org rss.duckland.org smart.duckland.org vault.duckland.org webhook.home.duckland.org
|
||||
# '';
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "America/Chicago";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.utf8";
|
||||
i18n.inputMethod = {
|
||||
enabled = "fcitx5";
|
||||
fcitx5.addons = with pkgs; [
|
||||
fcitx5-mozc
|
||||
fcitx5-gtk
|
||||
];
|
||||
};
|
||||
|
||||
# Splash screen
|
||||
boot.plymouth.enable = true;
|
||||
boot.plymouth.theme = "breeze";
|
||||
|
||||
security.polkit.enable = true;
|
||||
# Enable doas instead of sudo
|
||||
security.sudo.enable = false;
|
||||
security.doas.enable = true;
|
||||
security.doas.extraRules = [{
|
||||
users = [ "don" ];
|
||||
keepEnv = true;
|
||||
noPass = true;
|
||||
}];
|
||||
|
||||
services = {
|
||||
avahi = {
|
||||
enable = true;
|
||||
nssmdns = true;
|
||||
};
|
||||
printing = {
|
||||
enable = true;
|
||||
};
|
||||
udisks2 = {
|
||||
enable = true;
|
||||
};
|
||||
nscd = {
|
||||
enableNsncd = true;
|
||||
};
|
||||
flatpak = {
|
||||
enable = true;
|
||||
};
|
||||
pipewire = {
|
||||
enable = true;
|
||||
alsa = {
|
||||
enable = true;
|
||||
support32Bit = true;
|
||||
};
|
||||
pulse = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
tailscale = {
|
||||
enable = true;
|
||||
};
|
||||
logind = {
|
||||
lidSwitchExternalPower = "ignore";
|
||||
lidSwitchDocked = "ignore";
|
||||
};
|
||||
locate = {
|
||||
enable = true;
|
||||
locate = pkgs.mlocate;
|
||||
localuser = null;
|
||||
};
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
passwordAuthentication = false;
|
||||
kbdInteractiveAuthentication = false;
|
||||
#permitRootLogin = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Enable sound with pipewire.
|
||||
sound.enable = true;
|
||||
hardware.bluetooth.enable = true;
|
||||
hardware.pulseaudio.enable = false;
|
||||
hardware.sane = {
|
||||
enable = true;
|
||||
extraBackends = [ pkgs.sane-airscan ];
|
||||
};
|
||||
security.rtkit.enable = true;
|
||||
|
||||
xdg.portal.enable = true; # only needed if you are not doing Gnome
|
||||
|
||||
users.users.don = {
|
||||
isNormalUser = true;
|
||||
description = "Don Harper";
|
||||
extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"git ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
|
||||
];
|
||||
};
|
||||
|
||||
# Allow unfree packages
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
python-with-my-packages
|
||||
acpi
|
||||
aspell
|
||||
authy
|
||||
bash-completion
|
||||
nix-bash-completions
|
||||
bc
|
||||
bitwarden
|
||||
bitwarden-cli
|
||||
blueberry
|
||||
btop
|
||||
cantarell-fonts
|
||||
citrix_workspace
|
||||
clipman
|
||||
cura
|
||||
darktable
|
||||
diff-so-fancy
|
||||
dmenu-wayland
|
||||
espeak-classic
|
||||
exiftool
|
||||
feh
|
||||
figlet
|
||||
file
|
||||
firefox
|
||||
flameshot
|
||||
font-awesome
|
||||
fractal-next
|
||||
fuzzel
|
||||
fzf
|
||||
git-crypt
|
||||
gitFull
|
||||
gnome.gnome-tweaks
|
||||
gnome.simple-scan
|
||||
gnumake
|
||||
gnumeric
|
||||
gnupg
|
||||
gtop
|
||||
headset-charge-indicator
|
||||
headsetcontrol
|
||||
hugo
|
||||
hunspell
|
||||
hunspellDicts.en_US
|
||||
imagemagick
|
||||
imv
|
||||
isync
|
||||
jellyfin-media-player
|
||||
jq
|
||||
kanshi
|
||||
keychain
|
||||
keyutils
|
||||
khal
|
||||
khard
|
||||
kitty
|
||||
ktimer
|
||||
libappindicator
|
||||
libnotify
|
||||
libreoffice-fresh
|
||||
links2
|
||||
lsb-release
|
||||
mairix
|
||||
moreutils
|
||||
mosh
|
||||
#mpv
|
||||
mutt
|
||||
mutt-ics
|
||||
ncdu
|
||||
neofetch
|
||||
neovim-qt
|
||||
nerdfonts
|
||||
newsboat
|
||||
nextcloud-client
|
||||
nmap
|
||||
noto-fonts
|
||||
obsidian
|
||||
pandoc
|
||||
pasystray
|
||||
pavucontrol
|
||||
pkg-config
|
||||
playerctl
|
||||
poppler_utils
|
||||
poweralertd
|
||||
powerline-fonts
|
||||
ps_mem
|
||||
psmisc
|
||||
pulseaudio
|
||||
python3
|
||||
qpwgraph
|
||||
qutebrowser
|
||||
ranger
|
||||
rapid-photo-downloader
|
||||
rofi
|
||||
ruby
|
||||
signal-desktop
|
||||
sshuttle
|
||||
source-code-pro
|
||||
steam
|
||||
stellarium
|
||||
sublime-music
|
||||
syncthing
|
||||
tailscale
|
||||
tasksh
|
||||
taskwarrior
|
||||
tdesktop
|
||||
terminus-nerdfont
|
||||
texlive.combined.scheme-medium
|
||||
tig
|
||||
timewarrior
|
||||
thunderbird
|
||||
tmux
|
||||
tmux-cssh
|
||||
tmuxp
|
||||
toot
|
||||
topgrade
|
||||
tut
|
||||
ubuntu_font_family
|
||||
udiskie
|
||||
urlview
|
||||
vdirsyncer
|
||||
vifm-full
|
||||
vit
|
||||
wget
|
||||
widevine-cdm
|
||||
wlsunset
|
||||
xdg-utils
|
||||
xfce.thunar
|
||||
zathura
|
||||
zoom-us
|
||||
];
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
|
||||
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
|
||||
};
|
||||
programs.dconf.enable = true;
|
||||
programs.light.enable = true;
|
||||
programs.mtr.enable = true;
|
||||
#programs.mtr.package = "pkgs.mtr-gui";
|
||||
programs.kdeconnect.enable = true;
|
||||
|
||||
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: { qutebrowser = prev.qutebrowser.override { enableWideVine = true; }; })
|
||||
(final: super:{ khal = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
|
||||
];
|
||||
|
||||
systemd.services = {
|
||||
tailscale-autoconnect = {
|
||||
description = "Automatic connection to Tailscale";
|
||||
|
||||
# make sure tailscale is running before trying to connect to tailscale
|
||||
after = [ "network-pre.target" "tailscale.service" ];
|
||||
wants = [ "network-pre.target" "tailscale.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
# set this service as a oneshot job
|
||||
serviceConfig.Type = "oneshot";
|
||||
|
||||
# have the job run this shell script
|
||||
script = with pkgs; ''
|
||||
# wait for tailscaled to settle
|
||||
sleep 2
|
||||
|
||||
# check if we are already authenticated to tailscale
|
||||
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
|
||||
if [ $status = "Running" ]; then # if so, then do nothing
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# otherwise authenticate with tailscale
|
||||
${tailscale}/bin/tailscale up --operator=don --authkey tskey-api-kDQcva6CNTRL-kvcJzSix6yLb2dgjr1Pi
|
||||
'';
|
||||
};
|
||||
|
||||
clean-keychain = {
|
||||
description = "Clean up .keychain on boot";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.coreutils-full}/bin/rm -rf /home/don/.keychain";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
# always allow traffic from your Tailscale network
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
checkReversePath = "loose";
|
||||
|
||||
# allow the Tailscale UDP port through the firewall
|
||||
allowedUDPPorts = [ config.services.tailscale.port ];
|
||||
#allowedUDPPortRanges = [ { from = 1714 ; to = 1764; }];
|
||||
|
||||
# allow you to SSH in over the public internet
|
||||
allowedTCPPorts = [ 22 ];
|
||||
#allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
|
||||
};
|
||||
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
programs.msmtp = {
|
||||
enable = true;
|
||||
accounts = {
|
||||
default = {
|
||||
auth = true;
|
||||
tls = true;
|
||||
port = 587;
|
||||
from = "duck@duckland.org";
|
||||
host = "smtp.gmail.com";
|
||||
user = "duckunix@gmail.com";
|
||||
passwordeval = "cat /home/don/.smtp_password.txt";
|
||||
};
|
||||
};
|
||||
};
|
||||
nix.gc = {
|
||||
automatic = true;
|
||||
options = "-d";
|
||||
};
|
||||
xdg.mime.enable = true;
|
||||
xdg.mime.defaultApplications = {
|
||||
"text/html" = "org.qutebrowser.qutebrowser.desktop";
|
||||
"x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
|
||||
"x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
|
||||
"x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
|
||||
"x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
|
||||
};
|
||||
environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue