dotfiles/system-nix/configuration.nix

113 lines
3.4 KiB
Nix
Raw Normal View History

{ lib, pkgs, config, modulesPath, specialArgs, ... }:
let
hostname = specialArgs.hostname;
enableSSH = specialArgs.enableSSH or true;
networking = { hostName = hostname; } // (specialArgs.networking or { });
boot = specialArgs.boot or { };
services = specialArgs.services or { };
includeHardware = specialArgs.includeHardware or true;
in
2022-08-30 14:29:44 +00:00
with lib;
{
imports = (if includeHardware then [
./profiles/${hostname}/hardware-configuration.nix
2022-11-15 22:44:56 +00:00
] else [ ]) ++ [
"${modulesPath}/profiles/minimal.nix"
2022-08-30 14:29:44 +00:00
];
2022-11-14 22:10:46 +00:00
inherit boot;
2022-08-30 14:29:44 +00:00
2022-11-06 10:45:45 +00:00
system.stateVersion = "22.05";
2022-08-30 14:29:44 +00:00
# users.users.<defaultUser>.uid = 1000;
2022-11-06 20:23:10 +00:00
# networking.hostName = "nixos";
2022-08-30 14:29:44 +00:00
# Enable nix flakes
nix.package = pkgs.nixFlakes;
nix.extraOptions = ''
experimental-features = nix-command flakes
'';
2022-11-14 22:10:46 +00:00
users.users.hungtr = {
2022-11-15 22:44:56 +00:00
isNormalUser = true;
home = "/home/hungtr";
description = "pegasust/hungtr";
extraGroups = [ "wheel" "networkmanager" ];
openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../ssh/authorized_keys);
2022-11-14 18:01:39 +00:00
};
2022-08-30 14:29:44 +00:00
2022-11-06 20:23:10 +00:00
# Some basic programs
2022-08-30 14:29:44 +00:00
programs.neovim = {
2022-11-15 22:44:56 +00:00
enable = true;
defaultEditor = true;
2022-08-30 14:29:44 +00:00
};
2022-11-14 18:01:39 +00:00
2022-08-30 14:29:44 +00:00
programs.git = {
2022-11-15 22:44:56 +00:00
enable = true;
# more information should be configured under user level
# See other config at @/home-nix
2022-08-30 14:29:44 +00:00
};
2022-11-14 18:01:39 +00:00
2022-08-30 14:29:44 +00:00
environment.systemPackages = [
2022-11-15 22:44:56 +00:00
pkgs.gnumake
pkgs.wget
pkgs.inetutils # network diag
2022-11-24 02:14:25 +00:00
pkgs.mtr # network diag
pkgs.sysstat # sys diag
2022-11-24 02:14:25 +00:00
pkgs.mosh # ssh-alt; parsec-like
2022-11-24 01:28:46 +00:00
pkgs.tailscale # VPC
2022-08-30 14:29:44 +00:00
];
2022-11-24 02:14:25 +00:00
# tailscale is mandatory : ^)
# inherit services;
services = services // {
tailscale.enable = true;
};
# create a oneshot job to authenticate to Tailscale
systemd.services.tailscale-autoconnect = {
description = "Automatic connection to Tailscale";
# make sure tailscale is running before trying to connect to tailscale
after = [ "network-pre.target" "tailscale.service" ];
wants = [ "network-pre.target" "tailscale.service" ];
wantedBy = [ "multi-user.target" ];
# set this service as a oneshot job
serviceConfig.Type = "oneshot";
# have the job run this shell script
script = ''
# wait for tailscaled to settle
sleep 2
2022-11-24 02:14:25 +00:00
# check if we are already authenticated to tailscale
status="$(${pkgs.tailscale}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing
exit 0
fi
# ${pkgs.tailscale}/bin/tailscale up # blocks, doesn't give url
# This time, configure device auth so that we authenticate from portal
# https://tailscale.com/kb/1099/device-authorization/#enable-device-authorization-for-your-network
${pkgs.tailscale}/bin/tailscale up -authkey tskey-auth-kJcgTG5CNTRL-PUVFkk31z1bThHpfq3FC5b1jcMmkW2EYW
2022-11-24 02:14:25 +00:00
'';
};
# Don't touch networking.firewall.enable, just configure everything else.
# inherit networking;
networking = networking // {
firewall = (networking.firewall.enable and {
trustedInterfaces = networking.firewall.trustedInterfaces or [ ] ++ [
"tailscale0"
];
allowedUDPPorts = networking.firewall.allowedUDPPorts or [ ] ++ [
config.services.tailscale.port
];
allowedTCPPorts = networking.firewall.allowedTCPPorts or [ ] ++ [
22
];
allowedUDPPortRanges = networking.firewall.allowedUDPPortRanges or [ ] ++ [
{ from = 60000; to = 61000; } # mosh
];
2022-11-26 00:03:34 +00:00
checkReversePath = "loose";
}) or {};
2022-11-24 02:14:25 +00:00
};
2022-11-15 22:44:56 +00:00
}
2022-11-14 18:01:39 +00:00