82 lines
2.4 KiB
Nix
82 lines
2.4 KiB
Nix
{ lib, pkgs, config, inputs, utils, ... }:
|
|
{
|
|
imports = [ ./generic.nix ];
|
|
options.vacu.acmeCertDependencies = lib.mkOption {
|
|
default = {};
|
|
example = ''
|
|
vacu.acmeCertDependencies."mail.example.com" = [ "postfix.service" ];
|
|
'';
|
|
type = lib.types.attrsOf (lib.types.listOf utils.systemdUtils.lib.unitNameType);
|
|
};
|
|
config = let
|
|
for-systemd-services = lib.concatMapAttrs
|
|
(cert: units:
|
|
{
|
|
"acme-selfsigned-${cert}" = {
|
|
wantedBy = units;
|
|
before = units;
|
|
};
|
|
}
|
|
)
|
|
config.vacu.acmeCertDependencies;
|
|
for-security-acme-certs = lib.concatMapAttrs
|
|
(cert: units:
|
|
{
|
|
${cert}.reloadServices = units;
|
|
}
|
|
)
|
|
config.vacu.acmeCertDependencies;
|
|
in {
|
|
console = {
|
|
keyMap = lib.mkDefault "us";
|
|
};
|
|
vacu.packages."xorg-xev" = {
|
|
enable = config.services.xserver.enable;
|
|
package = pkgs.xorg.xev;
|
|
};
|
|
environment.systemPackages = config.vacu.packageList;
|
|
|
|
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
|
time.timeZone = "America/Los_Angeles";
|
|
|
|
users.users.shelvacu = {
|
|
openssh.authorizedKeys.keys = config.vacu.ssh.authorizedKeys;
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" ];
|
|
};
|
|
systemd.services = for-systemd-services;
|
|
security.acme.certs = for-security-acme-certs;
|
|
services.openssh = {
|
|
# require public key authentication for better security
|
|
settings.PasswordAuthentication = false;
|
|
settings.KbdInteractiveAuthentication = false;
|
|
settings.PermitRootLogin = "prohibit-password";
|
|
};
|
|
|
|
nix.settings.trusted-users = [ "shelvacu" ];
|
|
security.sudo.wheelNeedsPassword = lib.mkDefault false;
|
|
|
|
programs.screen = {
|
|
screenrc = ''
|
|
defscrollback 10000
|
|
termcapinfo xterm* ti@:te@
|
|
'';
|
|
} // (if config.system.nixos.release == "23.11" then {} else { enable = true; });
|
|
|
|
programs.tmux.enable = true;
|
|
programs.tmux.extraConfig = "setw mouse";
|
|
programs.tmux.clock24 = true;
|
|
|
|
nix.settings = {
|
|
experimental-features = [ "nix-command" "flakes" ];
|
|
substituters = config.vacu.nix.extraSubstituters;
|
|
trusted-public-keys = config.vacu.nix.extraTrustedKeys;
|
|
};
|
|
nixpkgs.config.allowUnfree = lib.mkDefault true;
|
|
|
|
programs.mosh.enable = lib.mkDefault true;
|
|
|
|
programs.ssh.extraConfig = config.vacu.ssh.config;
|
|
};
|
|
}
|