157 lines
3.8 KiB
Nix
157 lines
3.8 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
nodeName,
|
|
repoFlake,
|
|
...
|
|
}: let
|
|
passwords = import ../../../variables/passwords.crypt.nix;
|
|
in {
|
|
nix.settings = {
|
|
substituters = [
|
|
"https://holochain-ci.cachix.org"
|
|
"https://holochain-ci-internal.cachix.org"
|
|
# "https://cache.holo.host/"
|
|
];
|
|
trusted-public-keys = [
|
|
"holochain-ci.cachix.org-1:5IUSkZc0aoRS53rfkvH9Kid40NpyjwCMCzwRTXy+QN8="
|
|
"holochain-ci-internal.cachix.org-1:QvVsSrTiearCjrLTVtNtJOdQCDTseXh7UXUuSMx46NE="
|
|
"cache.holo.host-1:lNXIXtJgS9Iuw4Cu6X0HINLu9sTfcjEntnrgwMQIMcE="
|
|
"cache.holo.host-2:ZJCkX3AUYZ8soxTLfTb60g+F3MkWD7hkH9y8CgqwhDQ="
|
|
];
|
|
|
|
extra-experimental-features = ["impure-derivations"];
|
|
system-features = ["recursive-nix" "big-parallel"];
|
|
};
|
|
|
|
networking.extraHosts = ''
|
|
'';
|
|
|
|
networking.bridges."virbr1".interfaces = [];
|
|
networking.interfaces."virbr1".ipv4.addresses = [
|
|
{
|
|
address = "10.254.254.254";
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
|
|
# needed to make wireguard managed by networkmanager route all traffic through it
|
|
networking.firewall.checkReversePath = false;
|
|
|
|
networking.firewall.enable = true;
|
|
services.openssh.openFirewall = false;
|
|
|
|
# TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
|
|
networking.firewall.interfaces."eth+".allowedTCPPorts = [
|
|
22
|
|
|
|
# syncthing
|
|
22000
|
|
|
|
# iperf3
|
|
5201
|
|
|
|
# used on holochain hackathon for cache reverse proxy
|
|
80
|
|
];
|
|
networking.firewall.interfaces."eth+".allowedUDPPorts = [
|
|
# syncthing
|
|
22000
|
|
21027
|
|
];
|
|
|
|
networking.firewall.interfaces."wlan+".allowedTCPPorts = [
|
|
# used on holochain hackathon for cache reverse proxy
|
|
80
|
|
];
|
|
|
|
networking.firewall.logRefusedConnections = false;
|
|
networking.usePredictableInterfaceNames = false;
|
|
|
|
services.fwupd.enable = true;
|
|
|
|
services.fprintd.enable = true;
|
|
security.pam.services = {
|
|
login.fprintAuth = true;
|
|
sudo.fprintAuth = true;
|
|
};
|
|
|
|
# virtualization
|
|
virtualisation = {
|
|
libvirtd = {enable = true;};
|
|
|
|
virtualbox.host = {
|
|
enable = false;
|
|
addNetworkInterface = false;
|
|
};
|
|
|
|
podman = {
|
|
enable = true;
|
|
dockerCompat = true;
|
|
# defaultNetwork.dnsname.enable = true;
|
|
};
|
|
};
|
|
|
|
services.samba.extraConfig = ''
|
|
# client min protocol = NT1
|
|
'';
|
|
services.gvfs = {
|
|
enable = true;
|
|
package = lib.mkForce pkgs.gnome3.gvfs;
|
|
};
|
|
environment.systemPackages = with pkgs; [lxqt.lxqt-policykit]; # provides a default authentification client for policykit
|
|
|
|
security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];
|
|
|
|
services.xserver.videoDrivers = lib.mkForce ["amdgpu"];
|
|
services.xserver.serverFlagsSection = ''
|
|
Option "BlankTime" "0"
|
|
Option "StandbyTime" "0"
|
|
Option "SuspendTime" "0"
|
|
Option "OffTime" "0"
|
|
'';
|
|
|
|
time.timeZone = lib.mkForce passwords.timeZone.stefan;
|
|
|
|
hardware.ledger.enable = true;
|
|
|
|
services.zerotierone = {
|
|
enable = true;
|
|
joinNetworks = [
|
|
# moved to the service below as it's now secret
|
|
];
|
|
};
|
|
|
|
systemd.services.zerotieroneSecretNetworks = {
|
|
enable = true;
|
|
requiredBy = ["zerotierone.service"];
|
|
partOf = ["zerotierone.service"];
|
|
|
|
serviceConfig.Type = "oneshot";
|
|
serviceConfig.RemainAfterExit = true;
|
|
|
|
script = let
|
|
secret = config.sops.secrets.zerotieroneNetworks;
|
|
in ''
|
|
# include the secret's hash to trigger a restart on change
|
|
# ${builtins.hashString "sha256" (builtins.toJSON secret)}
|
|
|
|
${config.systemd.services.zerotierone.preStart}
|
|
|
|
rm -rf /var/lib/zerotier-one/networks.d/*.conf
|
|
for network in `grep -v '#' ${secret.path}`; do
|
|
touch /var/lib/zerotier-one/networks.d/''${network}.conf
|
|
done
|
|
'';
|
|
};
|
|
|
|
sops.secrets.zerotieroneNetworks = {
|
|
sopsFile = ../../../../secrets/zerotierone.txt;
|
|
format = "binary";
|
|
};
|
|
|
|
boot.binfmt.emulatedSystems = [
|
|
"aarch64-linux"
|
|
];
|
|
}
|