blob: 83dae2ff65c867de8582670b75505855604d4a1f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
{
inputs,
modulesPath,
lib,
pkgs,
sops,
config,
...
}@args:
{
imports = [
inputs.determinate.nixosModules.default
inputs.disko.nixosModules.disko
./disk-config.nix
inputs.sops-nix.nixosModules.sops
./secureboot.nix
./network.nix
./alt-arrow-vt.nix
inputs.home-manager.nixosModules.home-manager
./homes.nix
];
hardware.facter.reportPath = ./facter.json;
nix = {
extraOptions = ''
experimental-features = ca-derivations nix-command flakes
'';
settings = {
trusted-users = [ "root" "kjtsanaktsidis" ];
substituters = [
"https://cache.nixos.org"
# the ca-derivations cache seems to be down
# "https://cache.ngi0.nixos.org/"
];
trusted-public-keys = [
"cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="
];
};
};
sops = {
defaultSopsFile = ./secrets.yaml;
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.generateKey = false;
secrets = {
luks_passphrase = { };
kj_hashed_password = {
neededForUsers = true;
};
ssh_host_key_ed25519 = { };
ssh_host_key_rsa = { };
};
};
system.stateVersion = "25.11";
swapDevices = [
{
device = "/swap/swapfile";
size = 32768;
}
];
security.sudo.enable = true;
users.mutableUsers = false;
users.groups.kjtsanaktsidis = { };
users.users = {
kjtsanaktsidis = {
createHome = true;
isNormalUser = true;
description = "KJ Tsanaktsidis";
group = "kjtsanaktsidis";
extraGroups = [
"wheel"
"networkmanager"
];
shell = pkgs.zsh;
hashedPasswordFile = config.sops.secrets.kj_hashed_password.path;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAC/BtvW1c1RbBI8eeGo7oOH2y9byBaxWVDHsErgaE+s kjtsanaktsidis@KJMacbookGroq.local"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHsyhMLrlNiffDrqz0s46hZF8IdR9/qX63TUyllK0LCA kj@KJ-PC"
];
};
};
services.openssh = {
enable = true;
hostKeys = [
{
type = "ed25519";
path = config.sops.secrets.ssh_host_key_ed25519.path;
}
{
type = "rsa";
path = config.sops.secrets.ssh_host_key_rsa.path;
}
];
};
services.fwupd.enable = true;
# Enable zsh system-wide
programs.zsh.enable = true;
}
|
