53 lines
1.6 KiB
Nix
53 lines
1.6 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.modules.host;
|
|
inherit (config) user;
|
|
hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
|
|
passwordSecret = "${user.name}-password";
|
|
in
|
|
{
|
|
options.modules.host.enable = lib.mkEnableOption "physical-host base configuration";
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
|
|
nix.settings.extra-trusted-public-keys = [
|
|
"nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
|
|
];
|
|
|
|
nix.gc.automatic = true;
|
|
nix.gc.dates = "Mon 03:15";
|
|
nix.gc.options = "--delete-older-than 30d";
|
|
|
|
nix.optimise.automatic = true;
|
|
nix.optimise.dates = [ "Thu 03:45" ];
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.systemd-boot.configurationLimit = 15;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
hardware.enableRedistributableFirmware = true;
|
|
zramSwap.enable = true;
|
|
|
|
modules.network.ssh.enable = true;
|
|
modules.network.ssh.hostKeys.sopsFile = hostSecrets;
|
|
modules.network.ssh.userKey.sopsFile = hostSecrets;
|
|
|
|
services.xserver.xkb.layout = "us";
|
|
services.xserver.xkb.options = "caps:escape_shifted_capslock";
|
|
console.useXkbConfig = true;
|
|
|
|
sops.defaultSopsFile = ../secrets/shared.yaml;
|
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
sops.age.sshKeyPaths = [ ];
|
|
sops.gnupg.sshKeyPaths = [ ];
|
|
|
|
users.mutableUsers = false;
|
|
sops.secrets.${passwordSecret}.neededForUsers = true;
|
|
users.users.${user.name}.hashedPasswordFile = config.sops.secrets.${passwordSecret}.path;
|
|
};
|
|
}
|