colin
d13bcc49ab
longer-term, i want hosts/by-name to define host-specific data that's accessible via the other hosts (things like pubkeys). also the secrets management needs some rethinking. there's really not much point in me specifiying where *exactly* a secret comes from at its use site. i should really be specifying secret store manifests; i.e. "servo.yaml contains secrets X Y and Z", and leaving the rest up to auto-computing.
37 lines
1.0 KiB
Nix
37 lines
1.0 KiB
Nix
{ pkgs, ... }:
|
|
{
|
|
imports = [
|
|
./fs.nix
|
|
];
|
|
|
|
# sane.packages.enableDevPkgs = true;
|
|
|
|
# sane.users.guest.enable = true;
|
|
sane.gui.sway.enable = true;
|
|
sane.persist.enable = true;
|
|
sane.nixcache.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = false;
|
|
sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
|
|
|
|
sops.secrets.colin-passwd = {
|
|
sopsFile = ../../../secrets/lappy.yaml;
|
|
neededForUsers = true;
|
|
};
|
|
|
|
# default config: https://man.archlinux.org/man/snapper-configs.5
|
|
# defaults to something like:
|
|
# - hourly snapshots
|
|
# - auto cleanup; keep the last 10 hourlies, last 10 daylies, last 10 monthlys.
|
|
services.snapper.configs.nix = {
|
|
# TODO: for the impermanent setup, we'd prefer to just do /nix/persist,
|
|
# but that also requires setting up the persist dir as a subvol
|
|
subvolume = "/nix";
|
|
};
|
|
|
|
# TODO: only here for debugging
|
|
# services.ipfs.enable = true;
|
|
|
|
# docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
|
|
system.stateVersion = "21.05";
|
|
}
|