345 lines
7.4 KiB
Nix
345 lines
7.4 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
my-python-packages = python-packages: with python-packages; [
|
|
pip
|
|
pipx
|
|
#setuptools
|
|
];
|
|
python-with-my-packages = pkgs.python311Full.withPackages my-python-packages;
|
|
in
|
|
{
|
|
imports =
|
|
[
|
|
./detect-reboot-needed.nix
|
|
./systemd.nix
|
|
];
|
|
# Bootloader.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.loader.efi.efiSysMountPoint = "/boot";
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
# Enable networking
|
|
networking.networkmanager.enable = true;
|
|
networking.enableIPv6 = false; # FIXME this is to test connectivity @ the office via tailscale
|
|
networking.networkmanager.wifi.powersave = true;
|
|
networking.useDHCP = false;
|
|
|
|
# Set your time zone.
|
|
time.timeZone = "America/Chicago";
|
|
|
|
# Select internationalisation properties.
|
|
i18n.defaultLocale = "en_US.utf8";
|
|
i18n.inputMethod = {
|
|
enabled = "fcitx5";
|
|
fcitx5.addons = with pkgs; [
|
|
fcitx5-mozc
|
|
fcitx5-gtk
|
|
];
|
|
};
|
|
|
|
# Splash screen
|
|
boot.plymouth.enable = true;
|
|
boot.plymouth.theme = "breeze";
|
|
|
|
security = {
|
|
polkit = {
|
|
enable = true;
|
|
};
|
|
sudo.enable = false;
|
|
doas = {
|
|
enable = true;
|
|
extraRules = [{
|
|
users = [ "don" ];
|
|
keepEnv = true;
|
|
noPass = true;
|
|
}];
|
|
};
|
|
};
|
|
|
|
services = {
|
|
avahi = {
|
|
enable = true;
|
|
nssmdns = true;
|
|
};
|
|
printing = {
|
|
enable = true;
|
|
};
|
|
udisks2 = {
|
|
enable = true;
|
|
};
|
|
nscd = {
|
|
enableNsncd = true;
|
|
};
|
|
flatpak = {
|
|
enable = true;
|
|
};
|
|
pipewire = {
|
|
enable = true;
|
|
alsa = {
|
|
enable = true;
|
|
support32Bit = true;
|
|
};
|
|
pulse = {
|
|
enable = true;
|
|
};
|
|
};
|
|
tailscale = {
|
|
enable = true;
|
|
};
|
|
logind = {
|
|
lidSwitchExternalPower = "ignore";
|
|
lidSwitchDocked = "ignore";
|
|
};
|
|
locate = {
|
|
enable = true;
|
|
locate = pkgs.mlocate;
|
|
localuser = null;
|
|
};
|
|
openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
#permitRootLogin = "yes";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Enable sound with pipewire.
|
|
sound.enable = true;
|
|
hardware.bluetooth.enable = true;
|
|
hardware.pulseaudio.enable = false;
|
|
hardware.sane = {
|
|
enable = true;
|
|
extraBackends = [ pkgs.sane-airscan ];
|
|
};
|
|
security.rtkit.enable = true;
|
|
|
|
xdg.portal.enable = true; # only needed if you are not doing Gnome
|
|
|
|
users.users.don = {
|
|
isNormalUser = true;
|
|
description = "Don Harper";
|
|
extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"git ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
|
|
];
|
|
};
|
|
|
|
# Allow unfree packages
|
|
nixpkgs.config.allowUnfree = true;
|
|
nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" ];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
python-with-my-packages
|
|
acpi
|
|
aspell
|
|
aspellDicts.en
|
|
authy
|
|
bash-completion
|
|
nix-bash-completions
|
|
bc
|
|
#bitwarden
|
|
bitwarden-cli
|
|
blueberry
|
|
btop
|
|
cantarell-fonts
|
|
citrix_workspace
|
|
clipman
|
|
cura
|
|
darktable
|
|
diff-so-fancy
|
|
dmenu-wayland
|
|
espeak-classic
|
|
exiftool
|
|
feh
|
|
figlet
|
|
file
|
|
firefox
|
|
flameshot
|
|
font-awesome
|
|
fractal-next
|
|
fuzzel
|
|
fzf
|
|
git-crypt
|
|
gitFull
|
|
gnome.gnome-tweaks
|
|
gnome.simple-scan
|
|
gnumake
|
|
gnumeric
|
|
gnupg
|
|
gping
|
|
gtop
|
|
headset-charge-indicator
|
|
headsetcontrol
|
|
hugo
|
|
hunspell
|
|
hunspellDicts.en_US
|
|
imagemagick
|
|
imv
|
|
isync
|
|
jellyfin-media-player
|
|
jq
|
|
kanshi
|
|
keychain
|
|
keyutils
|
|
khal
|
|
khard
|
|
kitty
|
|
ktimer
|
|
lapce
|
|
lazygit
|
|
libappindicator
|
|
libnotify
|
|
libreoffice-fresh
|
|
libsForQt5.kwallet
|
|
libsForQt5.qtkeychain
|
|
links2
|
|
lsb-release
|
|
mairix
|
|
moreutils
|
|
mosh
|
|
#mpv
|
|
#mutt
|
|
mutt-ics
|
|
ncdu
|
|
neofetch
|
|
neomutt
|
|
neovim-qt
|
|
nerdfonts
|
|
newsboat
|
|
nextcloud-client
|
|
nmap
|
|
notmuch
|
|
noto-fonts
|
|
obsidian
|
|
pandoc
|
|
pasystray
|
|
pavucontrol
|
|
pkg-config
|
|
playerctl
|
|
poppler_utils
|
|
poweralertd
|
|
powerline-fonts
|
|
ps_mem
|
|
psmisc
|
|
pulseaudio
|
|
#python3
|
|
qpwgraph
|
|
qutebrowser
|
|
ranger
|
|
rofi
|
|
ruby
|
|
signal-desktop
|
|
sshuttle
|
|
sonixd
|
|
source-code-pro
|
|
sqlite
|
|
steam
|
|
stellarium
|
|
#sublime-music
|
|
syncthing
|
|
tailscale
|
|
tasksh
|
|
taskwarrior
|
|
tdesktop
|
|
terminus-nerdfont
|
|
texlive.combined.scheme-medium
|
|
tig
|
|
timewarrior
|
|
thunderbird
|
|
tmux
|
|
tmux-cssh
|
|
tmuxp
|
|
toot
|
|
topgrade
|
|
tut
|
|
ubuntu_font_family
|
|
udiskie
|
|
unzip
|
|
urlview
|
|
vdirsyncer
|
|
vifm-full
|
|
vit
|
|
wget
|
|
widevine-cdm
|
|
wireplumber
|
|
wlsunset
|
|
xdg-utils
|
|
xfce.thunar
|
|
zathura
|
|
zip
|
|
zoom-us
|
|
];
|
|
|
|
programs.steam = {
|
|
enable = true;
|
|
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
|
|
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
|
|
};
|
|
programs.dconf.enable = true;
|
|
programs.light.enable = true;
|
|
programs.mtr.enable = true;
|
|
#programs.mtr.package = "pkgs.mtr-gui";
|
|
programs.kdeconnect.enable = true;
|
|
|
|
|
|
nixpkgs.overlays = [
|
|
(final: prev: { qutebrowser = prev.qutebrowser.override { enableWideVine = true; }; })
|
|
(final: super:{ khal = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
|
|
];
|
|
|
|
# Open ports in the firewall.
|
|
networking.firewall = {
|
|
enable = true;
|
|
# always allow traffic from your Tailscale network
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
checkReversePath = "loose";
|
|
|
|
# allow the Tailscale UDP port through the firewall
|
|
allowedUDPPorts = [ config.services.tailscale.port ];
|
|
#allowedUDPPortRanges = [ { from = 1714 ; to = 1764; }];
|
|
|
|
# allow you to SSH in over the public internet
|
|
allowedTCPPorts = [ 22 ];
|
|
#allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
|
|
};
|
|
|
|
|
|
# This value determines the NixOS release from which the default
|
|
# settings for stateful data, like file locations and database versions
|
|
# on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
|
|
# this value at the release version of the first install of this system.
|
|
# Before changing this value read the documentation for this option
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
system.stateVersion = "23.11"; # Did you read the comment?
|
|
programs.msmtp = {
|
|
enable = true;
|
|
accounts = {
|
|
default = {
|
|
auth = true;
|
|
tls = true;
|
|
port = 587;
|
|
from = "duck@duckland.org";
|
|
host = "smtp.gmail.com";
|
|
user = "duckunix@gmail.com";
|
|
passwordeval = "cat /home/don/.smtp_password.txt";
|
|
};
|
|
};
|
|
};
|
|
nix.gc = {
|
|
automatic = true;
|
|
options = "-d";
|
|
};
|
|
xdg.mime.enable = true;
|
|
xdg.mime.defaultApplications = {
|
|
"text/html" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
|
|
"x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
|
|
};
|
|
environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
|
|
}
|