299 lines
8.3 KiB
Nix
Executable File
299 lines
8.3 KiB
Nix
Executable File
# Edit this configuration file to define what should be installed on
|
||
# your system. Help is available in the configuration.nix(5) man page, on
|
||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||
|
||
{
|
||
outputs,
|
||
config,
|
||
pkgs,
|
||
...
|
||
}:
|
||
let
|
||
user = "admin";
|
||
passwordFile = config.sops.secrets."jallen-nas/admin_password".path;
|
||
in
|
||
{
|
||
imports = [
|
||
# Include the results of the hardware scan.
|
||
./hardware-configuration.nix
|
||
./filesystems.nix
|
||
./boot.nix
|
||
./apps.nix
|
||
./grafana.nix
|
||
./networking.nix
|
||
./ups.nix
|
||
./samba.nix
|
||
./services.nix
|
||
./sops.nix
|
||
../default.nix
|
||
];
|
||
|
||
nix.settings.experimental-features = [
|
||
"nix-command"
|
||
"flakes"
|
||
];
|
||
|
||
# Cockpit
|
||
services.cockpit = {
|
||
enable = false;
|
||
port = 9090;
|
||
settings = {
|
||
WebService = {
|
||
AllowUnencrypted = true;
|
||
};
|
||
};
|
||
};
|
||
|
||
nix.settings.trusted-users = [ "@wheel" ];
|
||
powerManagement.cpuFreqGovernor = "powersave";
|
||
|
||
share.hardware.nvidia = {
|
||
enable = true;
|
||
enableBeta = true;
|
||
enableOpen = true;
|
||
nvidiaSettings = true;
|
||
enableNvidiaDocker = true;
|
||
};
|
||
|
||
security.tpm2 = {
|
||
enable = true;
|
||
};
|
||
|
||
# Configure environment
|
||
environment = {
|
||
etc.crypttab.text = ''
|
||
ssd1 UUID=eff4b19c-aba7-41ab-b452-a8c6654d8754 none tpm2-device=auto
|
||
ssd2 UUID=c8640e19-6cd9-49d0-a355-bac09d17ea0d none tpm2-device=auto
|
||
hdd1 UUID=8d7dd657-d9b0-47ed-97e1-a9d1eba12b56 none tpm2-device=auto
|
||
hdd2 UUID=11ee92b0-6334-4be7-bb2d-d85f5a3f51a6 none tpm2-device=auto
|
||
hdd3 UUID=4463ea6f-3fcf-4e49-80c8-ba7f424471f0 none tpm2-device=auto
|
||
hdd4 UUID=13fe7737-b72b-4d5f-a79d-1ca0d438f8f0 none tpm2-device=auto
|
||
hdd5 UUID=2b4be219-613d-4512-8277-0260989d5377 none tpm2-device=auto
|
||
'';
|
||
|
||
etc.machine-id.source = ./machine-id;
|
||
|
||
# List packages installed in system profile. To search, run:
|
||
# $ nix search wget
|
||
|
||
sessionVariables = {
|
||
CACHIX_AGENT_TOKEN = "eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJkYmNkZWNjYi04ZTI4LTQwOTAtYWIxOC02MTU5OTYwZTgxMTAiLCJzY29wZXMiOiJjYWNoZSJ9.G-9wCfKc3d8ld_zDJNjTxNWlkS3_yojI-6gaRpUT-i0";
|
||
};
|
||
|
||
systemPackages = with pkgs; [
|
||
authentik
|
||
binutils
|
||
cryptsetup
|
||
clinfo
|
||
cmake
|
||
coolercontrol.coolercontrol-gui
|
||
deconz
|
||
duperemove
|
||
efibootmgr
|
||
ffmpeg
|
||
gcc
|
||
git
|
||
glances
|
||
gparted
|
||
htop
|
||
ipset
|
||
jq
|
||
lm_sensors
|
||
nano
|
||
ninja
|
||
nixfmt-rfc-style
|
||
nix-inspect
|
||
nix-ld
|
||
networkmanagerapplet
|
||
nmon
|
||
nodejs-18_x
|
||
nut
|
||
packagekit
|
||
pass
|
||
pciutils
|
||
protonmail-bridge
|
||
protonvpn-cli
|
||
python3
|
||
qrencode
|
||
rcon
|
||
sbctl
|
||
speedtest-cli
|
||
tailscale
|
||
tigervnc
|
||
tpm2-tools
|
||
tpm2-tss
|
||
usbutils
|
||
vim
|
||
vulkan-tools
|
||
wget
|
||
xorg.xinit
|
||
xorg.xauth
|
||
];
|
||
};
|
||
|
||
# Configure programs
|
||
programs = {
|
||
fish.enable = false;
|
||
virt-manager.enable = true;
|
||
nix-ld.enable = true;
|
||
screen.enable = true;
|
||
coolercontrol = {
|
||
enable = true;
|
||
nvidiaSupport = true;
|
||
};
|
||
};
|
||
|
||
# Configure nixpkgs
|
||
nixpkgs = {
|
||
overlays = [
|
||
outputs.overlays.nixpkgs-unstable
|
||
outputs.overlays.nixpkgs-stable
|
||
];
|
||
|
||
config = {
|
||
# Enable non free
|
||
allowUnfree = true;
|
||
|
||
permittedInsecurePackages = [
|
||
# ...
|
||
"authentik-2024.6.4" # todo: remove these
|
||
"python3.12-authentik-django-2024.6.4"
|
||
"authentik-webui-2024.6.4"
|
||
"authentik-client-api-2024.6.4"
|
||
"authentik-website-2024.6.4"
|
||
"authentik-proxy-2024.6.4"
|
||
"aspnetcore-runtime-6.0.36"
|
||
"aspnetcore-runtime-wrapped-6.0.36"
|
||
"dotnet-sdk-6.0.428"
|
||
"dotnet-sdk-wrapped-6.0.428"
|
||
];
|
||
};
|
||
};
|
||
|
||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||
users = {
|
||
# See https://search.nixos.org/options?channel=unstable&show=users.mutableUsers&from=0&size=50&sort=relevance&type=packages&query=users.users
|
||
mutableUsers = false;
|
||
groups.jallen-nas.gid = 1000; # create nas group cause truenas perms
|
||
|
||
# Admin account
|
||
users."${user}" = {
|
||
isNormalUser = true;
|
||
linger = true;
|
||
extraGroups = [
|
||
"wheel"
|
||
"networkmanager"
|
||
"docker"
|
||
"podman"
|
||
"libvirtd"
|
||
"nix-apps"
|
||
"jallen-nas"
|
||
"media"
|
||
"nscd"
|
||
]; # Enable ‘sudo’ for the user.
|
||
hashedPasswordFile = passwordFile;
|
||
shell = pkgs.zsh;
|
||
openssh.authorizedKeys.keys = [
|
||
# macBook
|
||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCw9zq8DLGByI5v2gAn95hKNyOsm3g61a2buxu2BBMFysQJgmZPCCLUqRJKhSM5Vm/JOgsAmdpRBRZQoHD+6S844CJHb4v4VIbjkyQgYCuM7Rst2IOZ5QybvsA2/D0nwytZ+HXQqDj2AagUYDbz0gyyIHkDQ5YGBMkvkWz/h1Vci6aoBM7VihEDM4KlWoTVuPeASGM8r5IZ2FS83Djbqo4ov6AYvLMrKB9Z7hmFgH6R3LE0gxOkzbGVXtSuvJyrjvgytoT22UhATjjxSQ9D+YJXXkQoB3lUdg8OoIquUPjMZpl4mR8ffvseWPfcvD1XlD5t+TOHFqKpESO547tlOBYhdpew+NSgAXpamCU6oyV8tDCywLQu2ucxHRn78u6WXzWHkDtffdhzmk6TZaPhWqVHuTGjR4higBgGqUfSaKOMszt+FDRZAr3HtuQ2+zJ8bowK9fW5OqilTtK2HtQqroD9ApegDNbqOz6kGy5IycSXvqPURy/M4lxZxbtBPuemcJs= mattjallen@MacBook-Pro.local"
|
||
# desktop windows
|
||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZ2PYPjZddOzR8OJj16G88KcUhCDLkvrEmpUQP0wKHDUuA27HQQ2ORo66asadwGHY3k1VDZ1ei9l9H++SIIeKOaaUr5yZdktvj4POUNtbd9ZhcS7sZU7BSF+NMDM+h3tImh6z0S7mWvRQOUv3ZM+ZER+5xTWJVG1OOJEpb1drxJk6Qz0wbZKSR7TPNFBLLXlVy7hkNYf07RtDyhCCxNB3hJfa8c+oztnWumwDhDQWLqiUXWIU2QH6iRLGl/WYnujtNvVVaV/Hn3JJkS6MM9dnV3cpoIO0+J7+WfsN9rZ0wXt5yY3GhiGXwmcO5eYVli8lHlLWtK7aYSETyry6CBsLbojzOQO5rSqhpwfF2njAAFAQU0UjLc8PahisIuFKCwHH4iyXXOagiv5K1Mc/0Ak+WhhMPee6vV2p7NTyNpXRvouDbWy5cSRH31WgQ9fK5mIGe5v8nGGqtEhUubUkiOgP+H3UbT2V/nTv/TFKdJcKw+WmizvTrxBmaMjWALlkYl+s= mattl@Jallen-PC"
|
||
# desktop nixos
|
||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTBMydhOc6SnOdB5WrEd7X07DrboAtagCUgXiOJjLov matt@matt-nixos"
|
||
];
|
||
packages = with pkgs; [
|
||
cachix
|
||
fastfetch
|
||
git
|
||
parted
|
||
aspell
|
||
aspellDicts.en
|
||
aspellDicts.en-computers
|
||
aspellDicts.en-science
|
||
aha
|
||
papirus-icon-theme
|
||
firefox
|
||
swtpm
|
||
tigervnc
|
||
];
|
||
};
|
||
|
||
# Nix app account
|
||
users.nix-apps = {
|
||
isSystemUser = true;
|
||
uid = 911;
|
||
group = "jallen-nas";
|
||
extraGroups = [
|
||
"jallen-nas"
|
||
"docker"
|
||
"podman"
|
||
]; # Enable ‘sudo’ for the user.
|
||
hashedPasswordFile = passwordFile;
|
||
};
|
||
|
||
groups.nut.name = "nut";
|
||
users.upsuser = {
|
||
group = "nut";
|
||
isNormalUser = false;
|
||
isSystemUser = true;
|
||
createHome = true;
|
||
home = "/var/lib/nut";
|
||
homeMode = "750";
|
||
hashedPasswordFile = passwordFile;
|
||
};
|
||
|
||
users.nextcloud = {
|
||
isNormalUser = true;
|
||
extraGroups = [
|
||
"jallen-nas"
|
||
"nix-apps"
|
||
];
|
||
hashedPasswordFile = passwordFile;
|
||
};
|
||
};
|
||
|
||
hardware.fancontrol = {
|
||
enable = false;
|
||
config = ''
|
||
# Configuration file generated by pwmconfig, changes will be lost
|
||
# hwmon6/temp9_input -- chipset temp?
|
||
# hwmon2/temp1_input -- cpu temp?
|
||
# hwmon6/pwm5 -- chipset fan?
|
||
# hwmon6/pwm2, hwmon6/pwm3 -- cpu fans?
|
||
# hwmon6/pwm4 -- case fans?
|
||
|
||
INTERVAL=10
|
||
DEVPATH=hwmon2=devices/pci0000:00/0000:00:18.3 hwmon6=devices/platform/nct6775.656
|
||
DEVNAME=hwmon2=k10temp hwmon6=nct6798
|
||
FCTEMPS=hwmon6/pwm5=hwmon6/temp9_input hwmon6/pwm2=hwmon2/temp1_input hwmon6/pwm3=hwmon2/temp1_input hwmon6/pwm4=hwmon2/temp1_input
|
||
FCFANS=hwmon6/pwm5=hwmon6/fan5_input hwmon6/pwm2=hwmon6/fan2_input hwmon6/pwm3=hwmon6/fan3_input hwmon6/pwm4=hwmon6/fan4_input
|
||
MINTEMP=hwmon6/pwm5=20 hwmon6/pwm2=20 hwmon6/pwm3=20 hwmon6/pwm4=20
|
||
MAXTEMP=hwmon6/pwm5=60 hwmon6/pwm2=90 hwmon6/pwm3=90 hwmon6/pwm4=90
|
||
MINSTART=hwmon6/pwm5=16 hwmon6/pwm2=90 hwmon6/pwm3=45 hwmon6/pwm4=60
|
||
MINSTOP=hwmon6/pwm5=14 hwmon6/pwm2=0 hwmon6/pwm3=30 hwmon6/pwm4=45
|
||
MINPWM=hwmon6/pwm5=14 hwmon6/pwm2=0 hwmon6/pwm3=0 hwmon6/pwm4=0
|
||
MAXPWM=hwmon6/pwm5=255 hwmon6/pwm2=255 hwmon6/pwm3=255 hwmon6/pwm4=255
|
||
'';
|
||
};
|
||
|
||
# Enable binfmt emulation for ARM
|
||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||
|
||
# Virtualisation
|
||
virtualisation = {
|
||
podman = {
|
||
enable = true;
|
||
dockerCompat = true;
|
||
autoPrune.enable = true;
|
||
defaultNetwork.settings = {
|
||
dns_enabled = true;
|
||
};
|
||
};
|
||
|
||
libvirtd.enable = true;
|
||
|
||
# tpm.enable = true;
|
||
# useSecureBoot = true;
|
||
};
|
||
}
|