blob: 919e2f0ff82941188039afc688d06caaea2c9593 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
{ pkgs, lib, ... }:
{
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
# Per-host configuration.nix can override either of these without
# conflicting, since they're set with mkDefault here. automatic-timezoned
# (below) overrides time.timeZone to null at normal priority once enabled;
# Etc/UTC only remains as the boot-time value until it detects and applies
# the real one.
time.timeZone = lib.mkDefault "Etc/UTC";
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
# Keeps the system timezone in sync with actual location with no manual
# timedatectl step and no interactive auth prompt (unlike GNOME's own
# "Automatic Time Zone" toggle, which nixpkgs' GNOME module doesn't wire up
# to a passwordless polkit rule the way it does for KDE Plasma).
services.automatic-timezoned.enable = true;
users.users.tom = {
isNormalUser = true;
extraGroups = [
"wheel"
"docker"
];
shell = pkgs.bash;
# Fetched once from https://github.com/tomvanderlee.keys and pinned here
# as a static literal (not fetched at build time, which would require
# --impure) — update this list by hand if keys are added/rotated on
# GitHub.
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZQd4C53B3v7Si6NjNH8uXTrLOx5NXIWhF6R9Mk7hpDWQWwvXzCL6I/aY7cai2s8QgM5ptdVlx5pkogedPJCFEzLQoal/X6hOfNj1xAhDxEyEf7h+tflsnWqMFy92H7cC5o/xM48JRX1Fpm62xN7MrkUsZvV/t+HV6rISCNxOVXI7m0PowQT9zDGrAI2Q0dSLiqxvq/lMsU6aSJJz1kkQhcxLHJbm72mhZxf7NrF4I1OoEyuLTLpsgx8VpZwDlkp1m6+wy8xS/jNzr3ukjlTFy2RtDFyhiYTtwZI8j0ESNF3bp+FApUtHQ6dtcHGf5qHO9DaMYL94hPXuyebih723vQLVXqXDyXn7rHXD/laCPoE/2NeMA9h+g+MH6xqxbASVzWJuRq3RE+7VdIR+Y6Du1QkxLlNoPlDJTGb+n1OSMvVKum+XzNdneEP4txeXjvg/sfB/d53BCLaWB9tQEelNJaSue6JxckYNug4NE68b5dx4gvPw5qiKM8fzDZJSyvS0="
];
};
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
};
};
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 ];
};
services.xserver.enable = true;
services.displayManager.gdm.enable = true;
services.desktopManager.gnome.enable = true;
# Defaults GNOME to dark mode without locking it - GNOME Settings'
# Appearance toggle still writes to the user's own dconf database, which
# is searched before this default database.
programs.dconf.enable = true;
programs.dconf.profiles.user.databases = [
{ settings."org/gnome/desktop/interface".color-scheme = "prefer-dark"; }
];
networking.networkmanager.enable = true;
services.pipewire = {
enable = true;
pulse.enable = true;
};
security.rtkit.enable = true;
services.printing.enable = true;
services.avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
# Rootful: standard system service, starts at boot independent of any
# login session (rootless was tried first but its per-user systemd unit
# didn't reliably start in already-logged-in sessions after a switch).
# tom's docker group membership is root-equivalent access, accepted here
# for reliability over the rootless isolation guarantee.
virtualisation.docker.enable = true;
}
|
