nixos-config/modules/host.nix

227 lines
5.9 KiB
Nix

{
lib, pkgs
}:
config: {
userName
, hostName
, wireless ? false
, wifiInterface ? ""
, primaryInterface ? ""
, overlays ? []
, hardwareImports ? [ "generic" ]
, programImports ? []
, extraImports ? []
, isVM ? false
, fileSystems
, swapDevices ? []
, extraPackages ? pkgs: []
, extraOptions ? old: {}
}:
let
overlaysSet = import ../overlays { pkgs = pkgs; lib = lib; };
network = import ./network.nix;
home-manager = builtins.fetchGit {
url = "https://github.com/nix-community/home-manager.git";
rev = "35a24648d155843a4d162de98c17b1afd5db51e4";
ref = "release-21.05";
};
primaryInterfaceWrapper = if wifiInterface != "" && primaryInterface == "" then wifiInterface else primaryInterface;
baseConfig = {
# Install home-manager
imports = [
"${home-manager}/nixos"
./users # For system.singleUser
(./users + "/${userName}.nix")
((import (fetchTarball https://github.com/edolstra/flake-compat/archive/master.tar.gz) {
src = builtins.fetchGit {
url = "https://dev.ostylk.de/NixDistro/Config.git";
rev = "703d3d727a86c5c45d59608b35e0dea62a3f8486";
};
}).defaultNix.nixosModules.nftables)
] ++ (map (item: ./programs + "/${item}") programImports)
++ (map (item: ./hardware + "/${item}.nix") hardwareImports)
++ lib.optional wireless ./hardware/wifi.nix
++ (map (item: ./. + "/${item}") extraImports);
home-manager.useGlobalPkgs = true;
nixpkgs.overlays = (map (item: lib.getAttr item overlaysSet) overlays);
time.timeZone = "Europe/Berlin";
ostylk.nftables = {
enable = true;
tables.firewall = {
family = "inet";
chains = {
non-libvirt.extraConfig = let
deviceIPString = lib.concatStringsSep "," (with network; [
miku nishimiya ayame tamaki mashu
]);
in ''
# Accept traffic from my devices
ip saddr != { ${deviceIPString} } drop
'';
input.extraConfig = ''
type filter hook input priority 0
ct state { established, related } accept
iif lo accept
iif ${primaryInterfaceWrapper} goto non-libvirt
'';
};
};
};
networking = {
useDHCP = false; # Done by the network manager
networkmanager.enable = false;
#interfaces.*.useDHCP = false;
hostName = hostName;
wireless.enable = (if wireless then true else lib.mkForce false);
hosts = lib.mkIf (!isVM) {
"${network.miku}" = [ "miku.local" ];
"${network.nishimiya}" = [ "nishimiya.local" ];
"${network.ayame}" = [ "ayame.local" ];
"${network.tamaki}" = [ "tamaki.local" ];
"${network.mashu}" = [ "mashu.local" ];
};
};
i18n.defaultLocale = "en_GB.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "de";
};
users = {
mutableUsers = false;
extraUsers = {
root = {
# Disable root login
hashedPassword = "*";
};
};
};
environment = {
systemPackages = with pkgs; [
htop
vim
git # Otherwise we cannot install home-manager
git-crypt
gnupg
python3
# RT scheduling
rtkit
] ++ extraPackages pkgs
++ lib.optionals (!isVM) (with pkgs; [ gopass ]);
sessionVariables = {
# Prevent us from having to always type it out
NIXOS_CONFIG = "/home/${config.system.singleUser}/Development/Personal/nixos-config/hosts/${config.networking.hostName}.nix";
};
};
fonts.fonts = with pkgs; [
# CJK fonts
source-han-sans source-han-serif
];
# We don't tolerate non-free software, except for Steam and Linux firmware
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
"firmwareLinuxNonfree" "microcodeAmd" "microcodeIntel"
"steam" "steam-original" "steam-runtime"
"discord"
];
nixpkgs.config.allowUnfree = true;
services = {
connman = {
enable = true;
extraFlags = [ "--nodnsproxy" ];
wifi = lib.mkIf wireless {
backend = "iwd";
};
};
# TODO: Is this correct? Maybe run once
timesyncd.enable = false;
# Everyone needs sound
pipewire = {
enable = true;
pulse.enable = true;
jack.enable = true;
alsa.enable = true;
alsa.support32Bit = true;
};
# On desktop: Monitor keyboards, mice, ...
# On portable devices: Monitor their battery
upower.enable = true;
# What generated entropy?
haveged.enable = true;
printing.enable = lib.mkDefault false;
avahi.enable = false;
# For debugging.
# TODO: Lock to known IPs and keys
sshd.enable = true;
# Prevent unexpected OOM situations with heavy swapping
earlyoom = {
enable = true;
enableNotifications = true;
};
};
# Don't wait for a network connection
systemd.services.NetworkManager-wait-online.enable = false;
security.sudo.extraConfig = ''
Defaults env_keep += "NIXOS_CONFIG"
'';
hardware = {
enableRedistributableFirmware = true;
# This is a Pipewire household!
pulseaudio.enable = false;
opengl = {
enable = true;
driSupport32Bit = true;
driSupport = true;
extraPackages = with pkgs; [ vaapiVdpau libvdpau-va-gl ];
};
# Only a subset of my devices have bluetooth
bluetooth = lib.mkIf wireless {
enable = true;
};
} // (if wireless then {
wifiInterface = wifiInterface;
} else {});
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
};
fileSystems = fileSystems;
swapDevices = swapDevices;
system.stateVersion = "21.05";
};
in lib.attrsets.recursiveUpdate baseConfig (extraOptions baseConfig)