petere
eb08cd4282
Current state of main at 0240060 feat(hp-laptop): install TeleportFling from its flake. History intentionally collapsed to a single commit; this repo mirrors only the latest state.
80 lines
2.0 KiB
Nix
80 lines
2.0 KiB
Nix
{ config
|
|
, pkgs
|
|
, lib
|
|
, ...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
./settings.nix
|
|
./fonts.nix
|
|
./sops.nix
|
|
./users.nix
|
|
];
|
|
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
programs.zsh.enable = true;
|
|
|
|
# SSH is key-only on all hosts. petere (the only SSH user) authenticates with
|
|
# an authorized key; GUI users keep their local password for console/GUI login
|
|
# but cannot use it over SSH. Root SSH is fully disabled.
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
};
|
|
};
|
|
|
|
# Passwordless sudo for the admin/agent user only. Other wheel members
|
|
# (e.g. caitlin, mary) must enter their password for sudo.
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "petere" ];
|
|
commands = [
|
|
{
|
|
command = "ALL";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
system.activationScripts.exportAgeKey = {
|
|
text = ''
|
|
if [ -f /root/.config/sops/age/keys.txt ]; then
|
|
${pkgs.age}/bin/age-keygen -y < /root/.config/sops/age/keys.txt > /tmp/age-public-key.txt
|
|
chmod 644 /tmp/age-public-key.txt
|
|
fi
|
|
'';
|
|
deps = [ ];
|
|
};
|
|
|
|
# Automatic Nix store garbage collection and optimisation to prevent disk
|
|
# creep. Runs every 2 hours; persistent ensures missed runs are caught up on boot.
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "*-*-* 0/2:00:00";
|
|
persistent = true;
|
|
};
|
|
|
|
# Keep the last 5 system generations (regardless of age), then collect garbage.
|
|
# nix.gc.options only accepts nix-collect-garbage flags (age-based), so we
|
|
# override the service to add count-based generation pruning.
|
|
systemd.services.nix-gc.script = lib.mkForce ''
|
|
${pkgs.nix}/bin/nix-env --profile /nix/var/nix/profiles/system --delete-generations +5
|
|
exec ${pkgs.nix}/bin/nix-collect-garbage
|
|
'';
|
|
|
|
nix.optimise.automatic = true;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
# Antigravity removed - no longer used
|
|
];
|
|
|
|
system.stateVersion = "23.11";
|
|
}
|