blob: 354f6889f93ee34a2d3c1745c29f5d3217216e7b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
{
modulesPath,
lib,
pkgs,
sops,
config,
...
}@args:
{
imports = [
./disk-config.nix
];
nix = {
extraOptions = ''
experimental-features = ca-derivations nix-command flakes
'';
settings = {
substituters = [
"https://cache.nixos.org"
"https://cache.ngi0.nixos.org/"
];
trusted-public-keys = [
"cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="
];
};
};
sops = {
defaultSopsFile = ./secrets.yaml;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.generateKey = false;
secrets = {
luks_passphrase = { };
kj_hashed_password = {
neededForUsers = true;
};
ssh_host_key_ed25519 = { };
ssh_host_key_rsa = { };
};
};
boot.loader.systemd-boot.enable = true;
system.stateVersion = "25.05";
swapDevices = [
{
device = "/swap/swapfile";
size = 32768;
}
];
security.sudo.enable = true;
users.mutableUsers = false;
users.groups.kjtsanaktsidis = { };
users.users = {
kjtsanaktsidis = {
createHome = true;
isNormalUser = true;
description = "KJ Tsanaktsidis";
group = "kjtsanaktsidis";
extraGroups = [
"wheel"
"networkmanager"
];
shell = pkgs.zsh;
hashedPasswordFile = config.sops.secrets.kj_hashed_password.path;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAC/BtvW1c1RbBI8eeGo7oOH2y9byBaxWVDHsErgaE+s kjtsanaktsidis@KJMacbookGroq.local"
];
};
};
# Enable systemd-resolved for DNS
services.resolved = {
enable = true;
llmnr = "true";
extraConfig = ''
MulticastDNS=yes
'';
};
networking.hostName = "kj-laptop01";
networking.nameservers = [ "127.0.0.53" ];
networking.networkmanager = {
enable = true;
dns = "systemd-resolved";
# Enable mDNS on NetworkManager connections
connectionConfig = {
"connection.mdns" = "2"; # 2 = yes (resolve & register)
};
};
services.openssh = {
enable = true;
hostKeys = [
{
type = "ed25519";
path = config.sops.secrets.ssh_host_key_ed25519.path;
}
{
type = "rsa";
path = config.sops.secrets.ssh_host_key_rsa.path;
}
];
};
environment.systemPackages = with pkgs; [];
# Enable zsh system-wide
programs.zsh.enable = true;
# Disable Alt+Left/Right virtual terminal switching
console.keyMap = pkgs.runCommand "disable-vt-switch.map" {
nativeBuildInputs = [ pkgs.kbd ];
} ''
${pkgs.kbd}/bin/dumpkeys ${pkgs.kbd}/share/keymaps/i386/qwerty/us.map.gz | \
sed 's/alt keycode 105 = Console_12/alt keycode 105 = noop/' | \
sed 's/alt keycode 106 = Console_18/alt keycode 106 = noop/' > $out
'';
}
|
