modules/nixos/base.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

{
  config,
  lib,
  pkgs,
  ...
}: let
  inherit (lib) mkDefault;
in {
  imports = [
    ../shared
  ];

  environment.systemPackages = with pkgs; [man-pages man-pages-posix];

  documentation.nixos.enable = false;

  i18n = {
    supportedLocales = [
      "en_US.UTF-8/UTF-8"
    ];

    defaultLocale = "en_US.UTF-8";
  };

  networking.networkmanager = {
    enable = mkDefault true;
    dns = mkDefault "systemd-resolved";
  };

  nix = {
    channel.enable = mkDefault false;
    gc.dates = mkDefault "weekly";
    settings.trusted-users = ["root" "@wheel"];
  };

  programs = {
    git.enable = mkDefault true;
    vim.defaultEditor = mkDefault true;
  };

  security = {
    apparmor.enable = mkDefault true;
    audit.enable = mkDefault true;
    auditd.enable = mkDefault true;
    polkit.enable = mkDefault true;
    rtkit.enable = mkDefault true;
    sudo.execWheelOnly = true;
  };

  services = {
    dbus.apparmor = mkDefault "enabled";

    resolved = {
      enable = mkDefault true;
      dnssec = mkDefault "allow-downgrade";
      extraConfig = mkDefault ''
        [Resolve]
        DNS=1.1.1.1 1.0.0.1
        DNSOverTLS=yes
      '';
    };

    journald.extraConfig = ''
      MaxRetentionSec=1w
    '';
  };

  system.activationScripts."upgrade-diff" = {
    supportsDryActivation = true;
    text = ''
      ${pkgs.nvd}/bin/nvd --nix-bin-dir=${config.nix.package}/bin diff /run/current-system "$systemConfig"
    '';
  };

  users = {
    defaultUserShell = pkgs.bash;
    mutableUsers = false;

    users.root = {
      home = mkDefault "/root";
      uid = mkDefault config.ids.uids.root;
      group = mkDefault "root";
      hashedPasswordFile = mkDefault config.age.secrets.rootPassword.path;
    };
  };
}