370 lines
8.7 KiB
Nix
370 lines
8.7 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
my-python-packages = python-packages: with python-packages; [
|
|
pip
|
|
pipx
|
|
#recipe-scrapers
|
|
#tldextract
|
|
#setuptools
|
|
];
|
|
python-with-my-packages = pkgs.python311Full.withPackages my-python-packages;
|
|
in
|
|
{
|
|
# Bootloader.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.loader.efi.efiSysMountPoint = "/boot";
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
# Enable networking
|
|
networking.networkmanager.enable = true;
|
|
networking.enableIPv6 = false; # FIXME this is to test connectivity @ the office via wireguard
|
|
networking.networkmanager.wifi.powersave = true;
|
|
networking.useDHCP = false;
|
|
# networking.extraHosts =
|
|
# ''
|
|
# 100.75.7.116 harper.tail harper bandwidth.duckland.org bandwidth2.duckland.org cal.duckland.org cloud.duckland.org dash.duckland.org git.duckland.org jelly.duckland.org music.duckland.org photos.duckland.org plex.duckland.org rss.duckland.org smart.duckland.org vault.duckland.org webhook.home.duckland.org
|
|
# '';
|
|
|
|
# Set your time zone.
|
|
time.timeZone = "America/Chicago";
|
|
|
|
# Select internationalisation properties.
|
|
i18n.defaultLocale = "en_US.utf8";
|
|
i18n.inputMethod = {
|
|
enabled = "fcitx5";
|
|
fcitx5.addons = with pkgs; [
|
|
fcitx5-mozc
|
|
fcitx5-gtk
|
|
];
|
|
};
|
|
|
|
# Splash screen
|
|
boot.plymouth.enable = true;
|
|
boot.plymouth.theme = "breeze";
|
|
|
|
security.polkit.enable = true;
|
|
# Enable doas instead of sudo
|
|
security.sudo.enable = false;
|
|
security.doas.enable = true;
|
|
security.doas.extraRules = [{
|
|
users = [ "don" ];
|
|
keepEnv = true;
|
|
noPass = true;
|
|
}];
|
|
|
|
services = {
|
|
avahi = {
|
|
enable = true;
|
|
nssmdns = true;
|
|
};
|
|
printing = {
|
|
enable = true;
|
|
};
|
|
udisks2 = {
|
|
enable = true;
|
|
};
|
|
nscd = {
|
|
enableNsncd = true;
|
|
};
|
|
flatpak = {
|
|
enable = true;
|
|
};
|
|
pipewire = {
|
|
enable = true;
|
|
alsa = {
|
|
enable = true;
|
|
support32Bit = true;
|
|
};
|
|
pulse = {
|
|
enable = true;
|
|
};
|
|
};
|
|
tailscale = {
|
|
enable = true;
|
|
};
|
|
logind = {
|
|
lidSwitchExternalPower = "ignore";
|
|
lidSwitchDocked = "ignore";
|
|
};
|
|
locate = {
|
|
enable = true;
|
|
locate = pkgs.mlocate;
|
|
localuser = null;
|
|
};
|
|
openssh = {
|
|
enable = true;
|
|
settings = {
|
|
passwordAuthentication = false;
|
|
kbdInteractiveAuthentication = false;
|
|
#permitRootLogin = "yes";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Enable sound with pipewire.
|
|
sound.enable = true;
|
|
hardware.bluetooth.enable = true;
|
|
hardware.pulseaudio.enable = false;
|
|
hardware.sane = {
|
|
enable = true;
|
|
extraBackends = [ pkgs.sane-airscan ];
|
|
};
|
|
security.rtkit.enable = true;
|
|
|
|
xdg.portal.enable = true; # only needed if you are not doing Gnome
|
|
|
|
users.users.don = {
|
|
isNormalUser = true;
|
|
description = "Don Harper";
|
|
extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"git ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
|
|
];
|
|
};
|
|
|
|
# Allow unfree packages
|
|
nixpkgs.config.allowUnfree = true;
|
|
nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" ];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
python-with-my-packages
|
|
acpi
|
|
aspell
|
|
authy
|
|
bash-completion
|
|
nix-bash-completions
|
|
bc
|
|
bitwarden
|
|
bitwarden-cli
|
|
blueberry
|
|
btop
|
|
cantarell-fonts
|
|
citrix_workspace
|
|
clipman
|
|
cura
|
|
darktable
|
|
diff-so-fancy
|
|
dmenu-wayland
|
|
espeak-classic
|
|
exiftool
|
|
feh
|
|
figlet
|
|
file
|
|
firefox
|
|
flameshot
|
|
font-awesome
|
|
fractal-next
|
|
fuzzel
|
|
fzf
|
|
git-crypt
|
|
gitFull
|
|
gnome.gnome-tweaks
|
|
gnome.simple-scan
|
|
gnumake
|
|
gnumeric
|
|
gnupg
|
|
gtop
|
|
headset-charge-indicator
|
|
headsetcontrol
|
|
hugo
|
|
hunspell
|
|
hunspellDicts.en_US
|
|
imagemagick
|
|
imv
|
|
isync
|
|
jellyfin-media-player
|
|
jq
|
|
kanshi
|
|
keychain
|
|
keyutils
|
|
khal
|
|
khard
|
|
kitty
|
|
ktimer
|
|
libappindicator
|
|
libnotify
|
|
libreoffice-fresh
|
|
links2
|
|
lsb-release
|
|
mairix
|
|
moreutils
|
|
mosh
|
|
#mpv
|
|
mutt
|
|
mutt-ics
|
|
ncdu
|
|
neofetch
|
|
neovim-qt
|
|
nerdfonts
|
|
newsboat
|
|
nextcloud-client
|
|
nmap
|
|
noto-fonts
|
|
obsidian
|
|
pandoc
|
|
pasystray
|
|
pavucontrol
|
|
pkg-config
|
|
playerctl
|
|
poppler_utils
|
|
poweralertd
|
|
powerline-fonts
|
|
ps_mem
|
|
psmisc
|
|
pulseaudio
|
|
python3
|
|
qpwgraph
|
|
qutebrowser
|
|
ranger
|
|
rapid-photo-downloader
|
|
rofi
|
|
ruby
|
|
signal-desktop
|
|
sshuttle
|
|
source-code-pro
|
|
steam
|
|
stellarium
|
|
sublime-music
|
|
syncthing
|
|
tailscale
|
|
tasksh
|
|
taskwarrior
|
|
tdesktop
|
|
terminus-nerdfont
|
|
texlive.combined.scheme-medium
|
|
tig
|
|
timewarrior
|
|
thunderbird
|
|
tmux
|
|
tmux-cssh
|
|
tmuxp
|
|
toot
|
|
topgrade
|
|
tut
|
|
ubuntu_font_family
|
|
udiskie
|
|
urlview
|
|
vdirsyncer
|
|
vifm-full
|
|
vit
|
|
wget
|
|
widevine-cdm
|
|
wlsunset
|
|
xdg-utils
|
|
xfce.thunar
|
|
zathura
|
|
zoom-us
|
|
];
|
|
|
|
programs.steam = {
|
|
enable = true;
|
|
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
|
|
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
|
|
};
|
|
programs.dconf.enable = true;
|
|
programs.light.enable = true;
|
|
programs.mtr.enable = true;
|
|
#programs.mtr.package = "pkgs.mtr-gui";
|
|
programs.kdeconnect.enable = true;
|
|
|
|
|
|
nixpkgs.overlays = [
|
|
(final: prev: { qutebrowser = prev.qutebrowser.override { enableWideVine = true; }; })
|
|
(final: super:{ khal = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
|
|
];
|
|
|
|
systemd.services = {
|
|
tailscale-autoconnect = {
|
|
description = "Automatic connection to Tailscale";
|
|
|
|
# make sure tailscale is running before trying to connect to tailscale
|
|
after = [ "network-pre.target" "tailscale.service" ];
|
|
wants = [ "network-pre.target" "tailscale.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
# set this service as a oneshot job
|
|
serviceConfig.Type = "oneshot";
|
|
|
|
# have the job run this shell script
|
|
script = with pkgs; ''
|
|
# wait for tailscaled to settle
|
|
sleep 2
|
|
|
|
# check if we are already authenticated to tailscale
|
|
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
|
|
if [ $status = "Running" ]; then # if so, then do nothing
|
|
exit 0
|
|
fi
|
|
|
|
# otherwise authenticate with tailscale
|
|
${tailscale}/bin/tailscale up --operator=don --authkey tskey-api-kDQcva6CNTRL-kvcJzSix6yLb2dgjr1Pi
|
|
'';
|
|
};
|
|
|
|
clean-keychain = {
|
|
description = "Clean up .keychain on boot";
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.coreutils-full}/bin/rm -rf /home/don/.keychain";
|
|
};
|
|
};
|
|
};
|
|
|
|
|
|
|
|
|
|
# Open ports in the firewall.
|
|
networking.firewall = {
|
|
enable = true;
|
|
# always allow traffic from your Tailscale network
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
checkReversePath = "loose";
|
|
|
|
# allow the Tailscale UDP port through the firewall
|
|
allowedUDPPorts = [ config.services.tailscale.port ];
|
|
#allowedUDPPortRanges = [ { from = 1714 ; to = 1764; }];
|
|
|
|
# allow you to SSH in over the public internet
|
|
allowedTCPPorts = [ 22 ];
|
|
#allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
|
|
};
|
|
|
|
|
|
# This value determines the NixOS release from which the default
|
|
# settings for stateful data, like file locations and database versions
|
|
# on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
|
|
# this value at the release version of the first install of this system.
|
|
# Before changing this value read the documentation for this option
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
system.stateVersion = "22.11"; # Did you read the comment?
|
|
programs.msmtp = {
|
|
enable = true;
|
|
accounts = {
|
|
default = {
|
|
auth = true;
|
|
tls = true;
|
|
port = 587;
|
|
from = "duck@duckland.org";
|
|
host = "smtp.gmail.com";
|
|
user = "duckunix@gmail.com";
|
|
passwordeval = "cat /home/don/.smtp_password.txt";
|
|
};
|
|
};
|
|
};
|
|
nix.gc = {
|
|
automatic = true;
|
|
options = "-d";
|
|
};
|
|
xdg.mime.enable = true;
|
|
xdg.mime.defaultApplications = {
|
|
"text/html" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
|
|
};
|
|
environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
|
|
}
|