greenhousekore / nixos / features / global.nix150 lines · 3400B · raw
1{ inputs, outputs, config, lib, pkgs, ... }:
2
3{
4 imports = [ inputs.impermanence.nixosModules.impermanence ];
5
6 i18n.defaultLocale = "en_US.UTF-8";
7 time.timeZone = "UTC";
8
9 nix = {
10 package = pkgs.nixVersions.latest;
11
12 gc = {
13 automatic = true;
14 dates = "daily";
15 options = "--delete-older-than 7d";
16 };
17
18 settings = {
19 keep-outputs = false;
20 keep-derivations = false;
21 auto-optimise-store = true;
22
23 trusted-users = [ "root" "@wheel" ];
24 experimental-features = [ "nix-command" "flakes" ];
25 };
26 };
27
28 nixpkgs = {
29 overlays = builtins.attrValues outputs.overlays;
30
31 config = {
32 allowUnfree = lib.mkForce false;
33 allowBroken = lib.mkForce false;
34 };
35 };
36
37 networking = {
38 domain = "lostduk.com";
39
40 useDHCP = true;
41 enableIPv6 = lib.mkForce false;
42
43 firewall = {
44 enable = lib.mkForce true;
45 allowPing = lib.mkForce false;
46 allowedTCPPorts = [];
47 allowedUDPPorts = [];
48 };
49 };
50
51 services = {
52 pcscd.enable = true;
53
54 openssh = {
55 enable = true;
56 settings = {
57 PermitRootLogin = "no";
58 PasswordAuthentication = false;
59 KbdInteractiveAuthentication = false;
60 };
61 hostKeys = [{
62 path = "/persist/etc/ssh/ssh_host_ed25519_key";
63 type = "ed25519";
64 }];
65 };
66 };
67
68 security = {
69 protectKernelImage = true;
70
71 audit = {
72 enable = true;
73 rules = [ "-a exit,always -F arch=b64 -S execve" ];
74 };
75
76 sudo = {
77 execWheelOnly = true;
78 wheelNeedsPassword = lib.mkForce true;
79 };
80
81 auditd.enable = true;
82 pam.sshAgentAuth.enable = true;
83 };
84
85 users = {
86 mutableUsers = lib.mkForce false;
87
88 users.root.hashedPassword = lib.mkForce "!";
89 };
90
91 environment = {
92 defaultPackages = lib.mkForce [];
93
94 persistence."/persist" = {
95 hideMounts = false;
96
97 directories = [
98 "/srv"
99 "/var/lib/nixos"
100 "/var/lib/systemd"
101 ];
102 };
103 };
104
105 boot.initrd = let
106 rootDevice = config.fileSystems."/".device;
107 systemdStage1 = config.boot.initrd.systemd.enable;
108
109 script = ''
110 mkdir -p /tmp
111 MNTPOINT=$(mktemp -d)
112 (
113 mount ${rootDevice} "$MNTPOINT"
114 trap 'umount "$MNTPOINT"' EXIT
115
116 if [[ -e $MNTPOINT/@ ]]; then
117 echo "Backing up root..."
118 mkdir -p $MNTPOINT/old_roots
119 mv "$MNTPOINT/@" "$MNTPOINT/old_roots/@_$(date "+%Y-%m-%-d_%H:%M:%S")"
120 fi
121
122 echo "Deleting 7+ days old roots..."
123 find "$MNTPOINT/old_roots" -mindepth 1 -maxdepth 1 \
124 -mtime +7 \
125 -exec btrfs sub del -R {} +
126
127 echo "Creating new root..."
128 btrfs sub cre "$MNTPOINT/@"
129 )
130 '';
131 in lib.mkIf (config ? "disko" && config.disko.devices.disk ? "main") ({
132 supportedFilesystems = [ "btrfs" ];
133 postDeviceCommands = lib.mkIf (!systemdStage1) (lib.mkBefore script);
134
135 systemd.services.wipe-root = lib.mkIf (systemdStage1) {
136 wantedBy = [ "initrd.target" ];
137 requires = [ "dev-mapper-crypted.device" ];
138 before = [ "sysroot.mount" ];
139 after = [ "dev-mapper-crypted.device" "[email protected]" ];
140 unitConfig.DefaultDependencies = "no";
141 serviceConfig = {
142 Type = "oneshot";
143 RemainAfterExit = true;
144 };
145 script = script;
146 };
147 });
148
149 fileSystems."/persist".neededForBoot = true;
150}