nixos-config/config/hosts/nixos76/default.nix

220 lines
7.5 KiB
Nix
Raw Normal View History

2024-07-26 23:59:54 +00:00
# This file merged the original configuration.nix and hardware-configuration.nix files, refactoring common system config out
2023-06-16 23:08:03 +00:00
2024-07-26 23:59:54 +00:00
{ config, lib, pkgs, modulesPath, ... }:
2023-06-16 23:08:03 +00:00
{
imports =
2023-06-17 17:51:24 +00:00
[
2024-07-27 00:35:51 +00:00
(modulesPath + "/installer/scan/not-detected.nix")
../../modules/system76-pc.nix
2023-06-16 23:08:03 +00:00
];
2024-08-24 15:33:51 +00:00
nix.settings.auto-optimise-store = true;
nix.gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 5d";
};
2023-06-16 23:08:03 +00:00
networking.hostName = "nixos76"; # Define your hostname.
2024-07-27 00:35:51 +00:00
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
environment.etc.crypttab = {
enable = true;
text = ''
# /etc/crypttab: mappings for encrypted partitions.
#
# Each mapped device will be created in /dev/mapper, so your /etc/fstab
# should use the /dev/mapper/<name> paths for encrypted devices.
#
# See crypttab(5) for the supported syntax.
#
# NOTE: Do not list your root (/) partition here, it must be set up
# beforehand by the initramfs (/etc/mkinitcpio.conf). The same applies
# to encrypted swap, which should be set up with mkinitcpio-openswap
# for resume support.
#
# <name> <device> <password> <options>
externaldrive UUID=b9e3979c-9362-4242-a835-6dd702dfb0ee /etc/externalHD_keyfile.bin luks
'';
};
2024-07-30 02:06:38 +00:00
fileSystems =
let
externalPrefix = "/media/external";
homePrefix = "/home/alex";
in
{
"/" = {
device = "/dev/disk/by-uuid/6d62467a-ccc1-44ed-a1cc-f473b3962c64";
fsType = "ext4";
};
"/boot" = {
device = "/dev/disk/by-uuid/2330-1A62";
fsType = "vfat";
};
2024-08-24 14:05:06 +00:00
"/media/external" = {
2024-07-30 02:06:38 +00:00
device = "/dev/mapper/externaldrive";
2024-07-30 15:11:06 +00:00
options = [ "x-gvfs-show" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Documents" = {
device = "${externalPrefix}/Documents";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Games" = {
device = "${externalPrefix}/Games";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Git" = {
device = "${externalPrefix}/Git";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Lutris" = {
device = "${externalPrefix}/Lutris";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Music" = {
device = "${externalPrefix}/Music";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Pictures" = {
device = "${externalPrefix}/Pictures";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
"${homePrefix}/Videos" = {
device = "${externalPrefix}/Videos";
2024-07-30 15:11:06 +00:00
options = [ "bind" "x-gvfs-hide" ];
2024-07-30 02:06:38 +00:00
};
2024-07-27 00:35:51 +00:00
};
swapDevices =
[{ device = "/dev/disk/by-uuid/fda4f9fe-383f-477c-b2a2-c07f7efcc161"; }];
2024-07-26 22:27:47 +00:00
# What was this for? maybe wireguard?
2024-02-11 19:36:13 +00:00
networking.firewall = {
2024-03-01 03:52:43 +00:00
allowedUDPPorts = [ 51820 22000 ]; # Clients and peers can use the same port, see listenport
allowedTCPPorts = [ 22000 48412 62109 ];
2024-08-15 17:49:30 +00:00
allowedTCPPortRanges = [
{ from = 1714; to = 1764; } # KDE Connect
];
allowedUDPPortRanges = [
{ from = 1714; to = 1764; } # KDE Connect
];
2024-02-11 19:36:13 +00:00
};
2024-03-01 03:52:43 +00:00
2024-02-11 19:36:13 +00:00
# Enable WireGuard
networking.wireguard.interfaces = {
# "wg0" is the network interface name. You can name the interface arbitrarily.
wg0 = {
# Determines the IP address and subnet of the client's end of the tunnel interface.
ips = [ "10.100.0.2/24" ];
listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
# Path to the private key file.
#
# Note: The private key can also be included inline via the privateKey option,
# but this makes the private key world-readable; thus, using privateKeyFile is
# recommended.
privateKeyFile = "/home/alex/wireguard-keys/private";
peers = [
# For a client configuration, one peer entry for the server will suffice.
{
# Public key of the server (not a file path).
publicKey = "aD40D1jcgLbIZGkA1AoXkwpmP6hSWcttf3ptq4GRjC0=";
# Forward all the traffic via VPN.
allowedIPs = [ "0.0.0.0/0" ];
# Or forward only particular subnets
#allowedIPs = [ "10.100.0.1" "91.108.12.0/22" ];
# Set this to the server IP and port.
endpoint = "192.168.1.226:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
# Send keepalives every 25 seconds. Important to keep NAT tables alive.
persistentKeepalive = 25;
}
];
};
};
2023-06-16 23:08:03 +00:00
# Enable the X11 windowing system.
2024-07-27 00:20:25 +00:00
# services.xserver.enable = true;
2023-06-16 23:08:03 +00:00
services.xserver.desktopManager.xfce.enable = true;
2024-07-20 13:33:08 +00:00
services.displayManager.defaultSession = "xfce";
2023-06-16 23:08:03 +00:00
2024-03-01 03:43:35 +00:00
# Syncthing
services = {
2024-08-24 15:11:21 +00:00
syncthing = lib.mkForce {
2024-03-01 03:43:35 +00:00
enable = true;
user = "alex";
dataDir = "/home/alex/Sync";
configDir = "/home/alex/Sync/.config/syncthing";
overrideDevices = true; # overrides any devices added or deleted through the WebUI
overrideFolders = true; # overrides any folders added or deleted through the WebUI
settings = {
devices = {
"atauno" = { id = "TXSURD2-XCKOLDG-DJ76OOK-JZXOE3Q-XXTNOIM-XR5LB2B-YWBV2ER-6KRFIQN"; };
};
folders = {
# "Documents" = {
# # Name of folder in Syncthing, also the folder ID
# path = "/home/myusername/Documents"; # Which folder to add to Syncthing
# devices = [ "device1" "device2" ]; # Which devices to share the folder with
# };
"vaults" = {
2024-03-01 15:22:55 +00:00
id = "bbqnm-caya2";
2024-03-01 03:43:35 +00:00
path = "/home/alex/vaults";
devices = [ "atauno" ];
ignorePerms = false; # By default, Syncthing doesn't sync file permissions. This line enables it for this folder.
};
};
};
};
};
2023-06-16 23:08:03 +00:00
services.blueman.enable = true;
2023-12-22 22:33:41 +00:00
services.avahi = {
enable = true;
2024-01-20 00:24:06 +00:00
nssmdns4 = true;
2023-12-22 22:33:41 +00:00
openFirewall = true;
};
2024-07-27 00:35:51 +00:00
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp58s0f1.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp59s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
2023-06-16 23:08:03 +00:00
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It's perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "23.05"; # Did you read the comment?
}