Nix-Vibe public snapshot (squashed history)

2026-09-19 13:54:34 +01:00
commit cff83a473b
118 changed files with 18716 additions and 0 deletions
@@ -0,0 +1,79 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  imports = [
+    ./settings.nix
+    ./fonts.nix
+    ./sops.nix
+    ./users.nix
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  programs.zsh.enable = true;
+
+  # SSH is key-only on all hosts. petere (the only SSH user) authenticates with
+  # an authorized key; GUI users keep their local password for console/GUI login
+  # but cannot use it over SSH. Root SSH is fully disabled.
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # Passwordless sudo for the admin/agent user only. Other wheel members
+  # (e.g. caitlin, mary) must enter their password for sudo.
+  security.sudo.extraRules = [
+    {
+      users = [ "petere" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
+  system.activationScripts.exportAgeKey = {
+    text = ''
+      if [ -f /root/.config/sops/age/keys.txt ]; then
+        ${pkgs.age}/bin/age-keygen -y < /root/.config/sops/age/keys.txt > /tmp/age-public-key.txt
+        chmod 644 /tmp/age-public-key.txt
+      fi
+    '';
+    deps = [ ];
+  };
+
+  # Automatic Nix store garbage collection and optimisation to prevent disk
+  # creep. Runs every 2 hours; persistent ensures missed runs are caught up on boot.
+  nix.gc = {
+    automatic = true;
+    dates = "*-*-* 0/2:00:00";
+    persistent = true;
+  };
+
+  # Keep the last 5 system generations (regardless of age), then collect garbage.
+  # nix.gc.options only accepts nix-collect-garbage flags (age-based), so we
+  # override the service to add count-based generation pruning.
+  systemd.services.nix-gc.script = lib.mkForce ''
+    ${pkgs.nix}/bin/nix-env --profile /nix/var/nix/profiles/system --delete-generations +5
+    exec ${pkgs.nix}/bin/nix-collect-garbage
+  '';
+
+  nix.optimise.automatic = true;
+
+  environment.systemPackages = with pkgs; [
+    # Antigravity removed - no longer used
+  ];
+
+  system.stateVersion = "23.11";
+}