greenhousekore / nixos / features / global.nix147 lines · 3358B · raw
1{ inputs, outputs, config, lib, pkgs, ... }:
2
3{
4 imports = [ inputs.impermanence.nixosModules.impermanence ];
5
6 i18n.defaultLocale = "en_US.UTF-8";
7 time.timeZone = "UTC";
8
9 nix = {
10 package = pkgs.nixVersions.latest;
11
12 gc = {
13 automatic = true;
14 dates = "weekly";
15 options = "--delete-older-than 7d";
16 };
17
18 settings = {
19 keep-outputs = false;
20 keep-derivations = false;
21 auto-optimise-store = true;
22
23 trusted-users = [ "@wheel" ];
24 experimental-features = [ "nix-command" "flakes" ];
25 };
26 };
27
28 nixpkgs = {
29 overlays = builtins.attrValues outputs.overlays;
30
31 config = {
32 allowUnfree = lib.mkForce false;
33 allowBroken = lib.mkForce false;
34 };
35 };
36
37 networking = {
38 domain = "lostduk.com";
39
40 useDHCP = true;
41 enableIPv6 = lib.mkForce false;
42
43 firewall = {
44 enable = lib.mkForce true;
45 allowPing = lib.mkForce false;
46 allowedTCPPorts = [];
47 allowedUDPPorts = [];
48 };
49 };
50
51 services = {
52 pcscd.enable = true;
53
54 openssh = {
55 enable = true;
56 settings = {
57 PermitRootLogin = "no";
58 PasswordAuthentication = false;
59 KbdInteractiveAuthentication = false;
60 };
61 hostKeys = [{
62 path = "/persist/etc/ssh/ssh_host_ed25519_key";
63 type = "ed25519";
64 }];
65 };
66 };
67
68 security = {
69 protectKernelImage = true;
70
71 audit = {
72 enable = true;
73 rules = [ "-a exit,always -F arch=b64 -S execve" ];
74 };
75
76 sudo = {
77 execWheelOnly = true;
78 wheelNeedsPassword = lib.mkForce true;
79 };
80
81 auditd.enable = true;
82 pam.enableSSHAgentAuth = true;
83 };
84
85 users = {
86 mutableUsers = lib.mkForce false;
87
88 users.root.hashedPassword = lib.mkForce "!";
89 };
90
91 environment = {
92 defaultPackages = lib.mkForce [];
93
94 persistence."/persist" = {
95 hideMounts = false;
96
97 directories = [
98 "/srv"
99 "/var/lib/nixos"
100 "/var/lib/systemd"
101 ];
102 };
103 };
104
105 boot.initrd = let
106 rootDevice = config.fileSystems."/".device;
107 systemdStage1 = config.boot.initrd.systemd.enable;
108 # TODO: Delete old root, but I can't get this to work since something
109 # is wrong. In the "Creating a new root" part, our root is not /@, but it's
110 # /@_(date) I'm not sure why. Maybe it works as intended since i wrote this
111 # a long, long time ago.
112 script = ''
113 echo "Mounting..."
114 mkdir -p /tmp
115 MNTPOINT=$(mktemp -d)
116 (
117 mount ${rootDevice} "$MNTPOINT"
118 trap 'umount "$MNTPOINT"' EXIT
119
120 echo "Creating a new root..."
121 mv "$MNTPOINT/@" "$MNTPOINT/@_$(date "+%Y-%m-%-d_%H:%M:%S")"
122
123 echo "Creating a blank subvolume..."
124 btrfs sub cre "$MNTPOINT/@"
125 )
126 '';
127 in {
128 supportedFilesystems = [ "btrfs" ];
129 postDeviceCommands = lib.mkIf (!systemdStage1) (lib.mkBefore script);
130
131 systemd.services.wipe-root = lib.mkIf (systemdStage1) {
132 description = "Wipe root";
133 wantedBy = [ "initrd.target" ];
134 requires = [ "dev-mapper-crypted.device" ];
135 before = [ "sysroot.mount" ];
136 after = [
137 "dev-mapper-crypted.device"
138 "[email protected]"
139 ];
140 unitConfig.DefaultDependencies = "no";
141 serviceConfig.type = "oneshot";
142 script = script;
143 };
144 };
145
146 fileSystems."/persist".neededForBoot = true;
147}