kore

kore / nixos / features / global.nix150 lines · 3331B · raw
1{ inputs, outputs, config, lib, pkgs, ... }:
2
3{
4  imports = [ inputs.impermanence.nixosModules.impermanence ];
5
6  i18n.defaultLocale = "en_US.UTF-8";
7  time.timeZone = "UTC";
8
9  nix = {
10    package = pkgs.nixVersions.latest;
11
12    gc = {
13      automatic = true;
14      dates = "daily";
15      options = "--delete-older-than 7d";
16    };
17
18    settings = {
19      keep-outputs = false;
20      keep-derivations = false;
21      auto-optimise-store = true;
22
23      trusted-users = [ "root" "@wheel" ];
24      experimental-features = [ "nix-command" "flakes" ];
25    };
26  };
27
28  nixpkgs = {
29    overlays = builtins.attrValues outputs.overlays;
30
31    config = {
32      allowUnfree = lib.mkForce false;
33      allowBroken = lib.mkForce false;
34    };
35  };
36
37  networking = {
38    domain = "lostduk.com";
39
40    useDHCP = true;
41    enableIPv6 = lib.mkForce false;
42
43    firewall = {
44      enable = lib.mkForce true;
45      allowPing = lib.mkForce false;
46      allowedTCPPorts = [];
47      allowedUDPPorts = [];
48    };
49  };
50
51  services = {
52    pcscd.enable = true;
53
54    openssh = {
55      enable = true;
56      settings = {
57        PermitRootLogin = "no";
58        PasswordAuthentication = false;
59        KbdInteractiveAuthentication = false;
60      };
61      hostKeys = [{
62        path = "/persist/etc/ssh/ssh_host_ed25519_key";
63        type = "ed25519";
64      }];
65    };
66  };
67
68  security = {
69    protectKernelImage = true;
70
71    audit = {
72      enable = true;
73      rules = [ "-a exit,always -F arch=b64 -S execve" ];
74    };
75
76    sudo = {
77      execWheelOnly = true;
78      wheelNeedsPassword = lib.mkForce true;
79    };
80
81    auditd.enable = true;
82    pam.enableSSHAgentAuth = true;
83  };
84
85  users = {
86    mutableUsers = lib.mkForce false;
87
88    users.root.hashedPassword = lib.mkForce "!";
89  };
90
91  environment = {
92    defaultPackages = lib.mkForce [];
93
94    persistence."/persist" = {
95      hideMounts = false;
96
97      directories = [
98        "/srv"
99        "/var/lib/nixos"
100        "/var/lib/systemd"
101      ];
102    };
103  };
104
105  boot.initrd = let
106    rootDevice = config.fileSystems."/".device;
107    systemdStage1 = config.boot.initrd.systemd.enable;
108
109    script = ''
110      mkdir -p /tmp
111      MNTPOINT=$(mktemp -d)
112      (
113        mount ${rootDevice} "$MNTPOINT"
114        trap 'umount "$MNTPOINT"' EXIT
115
116        if [[ -e $MNTPOINT/@ ]]; then
117          echo "Backing up root..."
118          mkdir -p $MNTPOINT/old_roots
119          mv "$MNTPOINT/@" "$MNTPOINT/old_roots/@_$(date "+%Y-%m-%-d_%H:%M:%S")"
120        fi
121
122        echo "Deleting 7+ days old roots..."
123        find "$MNTPOINT/old_roots" -mindepth 1 -maxdepth 1 \
124          -mtime +7 \
125          -exec btrfs sub del -R {} +
126
127        echo "Creating new root..."
128        btrfs sub cre "$MNTPOINT/@"
129      )
130    '';
131  in {
132    supportedFilesystems = [ "btrfs" ];
133    postDeviceCommands = lib.mkIf (!systemdStage1) (lib.mkBefore script);
134
135    systemd.services.wipe-root = lib.mkIf (systemdStage1) {
136      wantedBy = [ "initrd.target" ];
137      requires = [ "dev-mapper-crypted.device" ];
138      before = [ "sysroot.mount" ];
139      after = [ "dev-mapper-crypted.device" "[email protected]" ];
140      unitConfig.DefaultDependencies = "no";
141      serviceConfig = {
142        Type = "oneshot";
143        RemainAfterExit = true;
144      };
145      script = script;
146    };
147  };
148
149  fileSystems."/persist".neededForBoot = true;
150}