blob: a2198504a7b74353200bc24d3de158760600d580 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
{ pkgs, lib, ... }:
{
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
# Per-host configuration.nix can override either of these without
# conflicting, since they're set with mkDefault here.
time.timeZone = lib.mkDefault "Etc/UTC";
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
users.users.tom = {
isNormalUser = true;
extraGroups = [ "wheel" ];
shell = pkgs.bash;
# Fetched once from https://github.com/tomvanderlee.keys and pinned here
# as a static literal (not fetched at build time, which would require
# --impure) — update this list by hand if keys are added/rotated on
# GitHub.
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZQd4C53B3v7Si6NjNH8uXTrLOx5NXIWhF6R9Mk7hpDWQWwvXzCL6I/aY7cai2s8QgM5ptdVlx5pkogedPJCFEzLQoal/X6hOfNj1xAhDxEyEf7h+tflsnWqMFy92H7cC5o/xM48JRX1Fpm62xN7MrkUsZvV/t+HV6rISCNxOVXI7m0PowQT9zDGrAI2Q0dSLiqxvq/lMsU6aSJJz1kkQhcxLHJbm72mhZxf7NrF4I1OoEyuLTLpsgx8VpZwDlkp1m6+wy8xS/jNzr3ukjlTFy2RtDFyhiYTtwZI8j0ESNF3bp+FApUtHQ6dtcHGf5qHO9DaMYL94hPXuyebih723vQLVXqXDyXn7rHXD/laCPoE/2NeMA9h+g+MH6xqxbASVzWJuRq3RE+7VdIR+Y6Du1QkxLlNoPlDJTGb+n1OSMvVKum+XzNdneEP4txeXjvg/sfB/d53BCLaWB9tQEelNJaSue6JxckYNug4NE68b5dx4gvPw5qiKM8fzDZJSyvS0="
];
};
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
};
};
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 ];
};
services.xserver.enable = true;
services.displayManager.gdm.enable = true;
services.desktopManager.gnome.enable = true;
# Defaults GNOME to dark mode without locking it - GNOME Settings'
# Appearance toggle still writes to the user's own dconf database, which
# is searched before this default database.
programs.dconf.enable = true;
programs.dconf.profiles.user.databases = [
{ settings."org/gnome/desktop/interface".color-scheme = "prefer-dark"; }
];
networking.networkmanager.enable = true;
services.pipewire = {
enable = true;
pulse.enable = true;
};
security.rtkit.enable = true;
services.printing.enable = true;
services.avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
}
|
