blob: ca696dd2bdbc6eda45884654949f9bd3d4be912b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
{
config,
lib,
pkgs,
inputs,
...
}: let
inherit (lib) mkDefault;
channelPath = i: "/etc/nix/channels/${i}";
mapInputs = fn: map fn (builtins.filter (n: n != "self") (builtins.attrNames inputs));
# yes this is a bad way to detect which option should be used (or exists)
# but i'm lazy. please do not copy this
passwordFile =
if lib.versionAtLeast config.system.stateVersion "23.11"
then "hashedPasswordFile"
else "passwordFile";
in {
imports = [
../shared
];
environment.systemPackages = with pkgs; [man-pages man-pages-posix];
documentation.man = {
generateCaches = mkDefault true;
man-db.enable = mkDefault true;
};
i18n = {
supportedLocales = [
"en_US.UTF-8/UTF-8"
];
defaultLocale = "en_US.UTF-8";
};
networking.networkmanager = {
enable = mkDefault true;
dns = mkDefault "systemd-resolved";
};
nix = {
nixPath = mapInputs (i: "${i}=${channelPath i}");
gc.dates = mkDefault "weekly";
settings.trusted-users = ["root" "@wheel"];
};
programs = {
git.enable = mkDefault true;
vim.defaultEditor = mkDefault true;
};
security = {
apparmor.enable = mkDefault true;
audit.enable = mkDefault true;
auditd.enable = mkDefault true;
polkit.enable = mkDefault true;
rtkit.enable = mkDefault true;
sudo.execWheelOnly = true;
};
services = {
dbus.apparmor = mkDefault "enabled";
resolved = {
enable = mkDefault true;
dnssec = mkDefault "allow-downgrade";
extraConfig = mkDefault ''
[Resolve]
DNS=1.1.1.1 1.0.0.1
DNSOverTLS=yes
'';
};
journald.extraConfig = ''
MaxRetentionSec=1w
'';
};
system.activationScripts."upgrade-diff" = {
supportsDryActivation = true;
text = ''
${pkgs.nvd}/bin/nvd --nix-bin-dir=${config.nix.package}/bin diff /run/current-system "$systemConfig"
'';
};
systemd.tmpfiles.rules =
mapInputs (i: "L+ ${channelPath i} - - - - ${inputs.${i}.outPath}");
users = {
defaultUserShell = pkgs.bash;
mutableUsers = false;
users.root = {
home = mkDefault "/root";
uid = mkDefault config.ids.uids.root;
group = mkDefault "root";
"${passwordFile}" = mkDefault config.age.secrets.rootPassword.path;
};
};
}
|
