albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Cleanup
Some checks failed
build-linode-img / build-linode-img (push) Failing after 29s
Details

Browse source
This commit is contained in:
iFargle 2023-12-17 09:06:31 +09:00
parent 1dcec04482
commit 6d0bf60626
6 changed files with 15 additions and 59 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
nixos/common/modules/nixos.nix
View file

@ -2,15 +2,17 @@
# Enable flakes: https://nixos.wiki/wiki/Flakes # Enable flakes: https://nixos.wiki/wiki/Flakes
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [ "nix-command" "flakes" ];
# This is now done with deploy-rs
# Keep the system up-to-date automatically # Keep the system up-to-date automatically
system = { # system = {
autoUpgrade = { # autoUpgrade = {
enable = true; # enable = true;
allowReboot = false; # allowReboot = false;
dates = "daily"; # dates = "daily";
flake = "git+file:/etc/nixos/flake.nix"; # flake = "git+file:/etc/nixos/flake.nix";
}; # };
}; # };
# Garbage collection -- Keep the system clean # Garbage collection -- Keep the system clean
nix.gc = { nix.gc = {

1
nixos/common/services/fwupd.nix
View file

@ -1,3 +1,4 @@
_: { _: {
# https://search.nixos.org/options?channel=23.11&from=0&size=50&sort=relevance&type=packages&query=services.fwupd
services.fwupd.enable = true; services.fwupd.enable = true;
} }

2
nixos/common/services/opensnitch.nix
View file

@ -4,5 +4,7 @@
services.opensnitch = { services.opensnitch = {
enable = true; enable = true;
# https://github.com/evilsocket/opensnitch/wiki/Rules
# https://search.nixos.org/options?channel=23.11&show=services.opensnitch.rules&from=0&size=50&sort=relevance&type=packages&query=opensnitch
}; };
} }

2
nixos/minimal.nix
View file

@ -5,7 +5,7 @@
./common/services/fail2ban.nix ./common/services/fail2ban.nix
# NixOS Modules # NixOS Modules
# ./common/modules/networking.nix # Initial Networking configs ./common/modules/networking.nix # Initial Networking configs
./common/modules/nixos.nix # NixOS related items ./common/modules/nixos.nix # NixOS related items
./common/modules/remote-builders.nix # Add remote builders ./common/modules/remote-builders.nix # Add remote builders

17
nixos/users/albert/default.nix
View file

@ -3,7 +3,7 @@ let
ifExists = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups; ifExists = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
in { in {
# Define a user account. # Define a user account.
imports = [ /*./switcher.nix*/ ] ++ lib.optional (builtins.isString desktop) ./desktop.nix; imports = [ ] ++ lib.optional (builtins.isString desktop) ./desktop.nix;
users.mutableUsers = false; users.mutableUsers = false;
users.users.albert = { users.users.albert = {
isNormalUser = true; isNormalUser = true;
@ -20,19 +20,4 @@ in {
# Make this user trusted # Make this user trusted
nix.settings.trusted-users = [ "albert" ]; nix.settings.trusted-users = [ "albert" ];
# No sudo password - deploy-rs
# security.sudo.extraRules = [
# {
# users = [ "albert" ];
# commands = [
# {
# command = "ALL";
# options = [ "NOPASSWD" ];
# }
# ];
# }
# ];
} }

34
nixos/users/albert/switcher.nix
View file

@ -1,34 +0,0 @@
{self, ...}: {
pkgs,
config,
...
}: {
# https://github.com/NobbZ/nixos-config/blob/a1c99894088f43a0ba31812ad53f0e09dc36f15a/nixos/modules/switcher.nix#L14-L31
_file = ./switcher.nix;
environment.systemPackages = [self.packages."${pkgs.system}".switcher];
security.sudo.extraRules = let
storePrefix = "/nix/store/*";
systemName = "nixos-system-${config.networking.hostName}-*";
in [
{
commands = [
{
command = "${storePrefix}-nix-*/bin/nix-env -p /nix/var/nix/profiles/system --set ${storePrefix}-${systemName}";
options = ["NOPASSWD"];
}
];
groups = ["wheel"];
}
{
commands = [
{
command = "${storePrefix}-${systemName}/bin/switch-to-configuration";
options = ["NOPASSWD"];
}
];
groups = ["wheel"];
}
];
}