greenhousekore / nixos / features / global.nix169 lines · 3797B · raw
1{ inputs, outputs, config, lib, pkgs, ... }:
2
3{
4 imports = [ inputs.impermanence.nixosModules.impermanence ];
5
6 i18n = {
7 defaultLocale = "en_US.UTF-8";
8 supportedLocales = [ "en_US.UTF-8/UTF-8" ];
9 };
10 time.timeZone = "UTC";
11
12 documentation = {
13 nixos.enable = false;
14 doc.enable = false;
15 info.enable = false;
16 };
17
18 nix = {
19 package = pkgs.nixVersions.latest;
20
21 gc = {
22 automatic = true;
23 dates = "daily";
24 options = "--delete-older-than 7d";
25 };
26
27 settings = {
28 keep-outputs = false;
29 keep-derivations = false;
30 auto-optimise-store = true;
31
32 trusted-users = [ "root" "@wheel" ];
33 experimental-features = [ "nix-command" "flakes" ];
34 };
35 };
36
37 nixpkgs = {
38 overlays = builtins.attrValues outputs.overlays;
39
40 config = {
41 allowUnfree = lib.mkForce false;
42 allowBroken = lib.mkForce false;
43 };
44 };
45
46 system.tools = {
47 nixos-build-vms.enable = false;
48 nixos-enter.enable = false;
49 nixos-generate-config.enable = false;
50 nixos-install.enable = false;
51 nixos-option.enable = false;
52 };
53
54 networking = {
55 domain = "lostduk.com";
56
57 useDHCP = true;
58 enableIPv6 = lib.mkForce false;
59
60 firewall = {
61 enable = lib.mkForce true;
62 allowPing = lib.mkForce false;
63 allowedTCPPorts = [];
64 allowedUDPPorts = [];
65 };
66 };
67
68 services = {
69 pcscd.enable = true;
70
71 openssh = {
72 enable = true;
73 settings = {
74 PermitRootLogin = "no";
75 PasswordAuthentication = false;
76 KbdInteractiveAuthentication = false;
77 };
78 hostKeys = [{
79 path = "/persist/etc/ssh/ssh_host_ed25519_key";
80 type = "ed25519";
81 }];
82 };
83 };
84
85 security = {
86 protectKernelImage = true;
87
88 audit = {
89 enable = true;
90 rules = [ "-a exit,always -F arch=b64 -S execve" ];
91 };
92
93 sudo = {
94 execWheelOnly = true;
95 wheelNeedsPassword = lib.mkForce true;
96 };
97
98 auditd.enable = true;
99 pam.sshAgentAuth.enable = true;
100 };
101
102 users = {
103 mutableUsers = lib.mkForce false;
104
105 users.root.hashedPassword = lib.mkForce "!";
106 };
107
108 environment = {
109 defaultPackages = lib.mkForce [];
110
111 persistence."/persist" = {
112 hideMounts = false;
113
114 directories = [
115 "/srv"
116 "/var/lib/nixos"
117 "/var/lib/systemd"
118 ];
119 };
120 };
121
122 programs.nano.enable = false;
123
124 boot.initrd = let
125 rootDevice = config.fileSystems."/".device;
126 systemdStage1 = config.boot.initrd.systemd.enable;
127
128 script = ''
129 mkdir -p /tmp
130 MNTPOINT=$(mktemp -d)
131 (
132 mount ${rootDevice} "$MNTPOINT"
133 trap 'umount "$MNTPOINT"' EXIT
134
135 if [[ -e $MNTPOINT/@ ]]; then
136 echo "Backing up root..."
137 mkdir -p $MNTPOINT/old_roots
138 mv "$MNTPOINT/@" "$MNTPOINT/old_roots/@_$(date "+%Y-%m-%-d_%H:%M:%S")"
139 fi
140
141 echo "Deleting 7+ days old roots..."
142 find "$MNTPOINT/old_roots" -mindepth 1 -maxdepth 1 \
143 -mtime +7 \
144 -exec btrfs sub del -R {} +
145
146 echo "Creating new root..."
147 btrfs sub cre "$MNTPOINT/@"
148 )
149 '';
150 in lib.mkIf (config ? "disko" && config.disko.devices.disk ? "main") ({
151 supportedFilesystems = [ "btrfs" ];
152 postDeviceCommands = lib.mkIf (!systemdStage1) (lib.mkBefore script);
153
154 systemd.services.wipe-root = lib.mkIf (systemdStage1) {
155 wantedBy = [ "initrd.target" ];
156 requires = [ "dev-mapper-crypted.device" ];
157 before = [ "sysroot.mount" ];
158 after = [ "dev-mapper-crypted.device" "[email protected]" ];
159 unitConfig.DefaultDependencies = "no";
160 serviceConfig = {
161 Type = "oneshot";
162 RemainAfterExit = true;
163 };
164 script = script;
165 };
166 });
167
168 fileSystems."/persist".neededForBoot = true;
169}