common.nix (5618B)
1 { pkgs, ... }: { 2 # Set your time zone. 3 time.timeZone = "America/Toronto"; 4 5 # Select internationalisation properties. 6 i18n.defaultLocale = "en_US.UTF-8"; 7 console = { 8 font = "Lat2-Terminus16"; 9 }; 10 11 # enable flakes and nix cli 12 nix.settings.experimental-features = [ 13 "nix-command" 14 "flakes" 15 ]; 16 17 # I like my ethX/wlanX names 18 networking.usePredictableInterfaceNames = false; 19 20 21 # use local dns on each host 22 services.unbound = { 23 enable = true; 24 settings = { 25 server = { 26 interface = [ 27 "127.0.0.1" 28 "10.0.13.2" 29 #"fd00:b0ba:cafe:babe::2" 30 "::1" 31 ]; 32 access-control = [ 33 "0.0.0.0/0 allow" 34 "::0/0 allow" 35 ]; 36 37 hide-identity = true; 38 hide-version = true; 39 40 # Synthesize NXDOMAINs from DNSSEC NSEC chains. 41 # https://tools.ietf.org/html/rfc8198 42 aggressive-nsec = false; 43 44 module-config = "\"respip validator iterator\""; 45 46 local-data = [ 47 "\"saklas.epistemia. 86400 IN A 10.0.13.1\"" 48 "\"demiurge.epistemia. 86400 IN A 10.0.13.2\"" 49 "\"hastur.epistemia. 86400 IN A 10.0.13.3\"" 50 "\"iphonebob.epistemia. 86400 IN A 10.0.13.4\"" 51 "\"lab.epistemia. 86400 IN A 10.0.13.5\"" 52 ]; 53 54 local-zone = [ 55 "\"saklas.epistemia.\" redirect" 56 "\"demiurge.epistemia.\" redirect" 57 "\"hastur.epistemia.\" redirect" 58 "\"iphonebob.epistemia.\" redirect" 59 "\"lab.epistemia.\" redirect" 60 ]; 61 }; 62 63 # hagezi for dns-based adblocking (in addition to others) 64 rpz = { 65 name = "hagezi.ultimate"; 66 zonefile = "hagezi.ultimate"; 67 url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"; 68 }; 69 70 # go through mullvad for regular dns queries 71 forward-zone = { 72 name = "."; 73 forward-addr = [ "194.242.2.2" ]; 74 }; 75 }; 76 }; 77 environment.etc."resolv.conf".text = '' 78 nameserver 127.0.0.1 79 search epistemia 80 ''; 81 82 # Define a user account. 83 users = { 84 groups.vin = {}; 85 users.vin = { 86 isNormalUser = true; 87 88 group = "vin"; 89 extraGroups = [ 90 "transmission" 91 "wheel" 92 ]; 93 94 shell = pkgs.zsh; 95 96 openssh.authorizedKeys.keys = [ 97 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge" 98 ]; 99 }; 100 }; 101 102 # default packages for both me and root 103 environment = { 104 systemPackages = with pkgs; [ 105 doas-sudo-shim 106 git 107 wget 108 ]; 109 110 pathsToLink = [ "/share/zsh" ]; 111 }; 112 113 # enable bluetooth and add some udev rules 114 hardware = { 115 bluetooth.enable = true; 116 flipperzero.enable = true; 117 keyboard.qmk.enable = true; 118 }; 119 120 programs = { 121 # for gtk in home-manager 122 dconf.enable = true; 123 124 # gpg 125 gnupg.agent = { 126 enable = true; 127 enableSSHSupport = false; 128 pinentryPackage = pkgs.pinentry-rofi; 129 settings.default-cache-ttl = 600; 130 }; 131 132 # disable nano. I don't like nano. 133 nano.enable = false; 134 135 # steam, proprietary. I sometimes like playing nonfree games too. 136 steam.enable = true; 137 138 # configuration in home-manager 139 zsh.enable = true; 140 zsh.promptInit = "PS1='$ '"; 141 }; 142 143 security = { 144 # I prefer doas over sudo for simplicity 145 doas = { 146 enable = true; 147 extraRules = [ 148 { 149 users = [ "vin" ]; 150 keepEnv = true; 151 persist = true; 152 } 153 ]; 154 }; 155 sudo.enable = false; 156 157 # needed to give realtime privileges to pipewire 158 rtkit.enable = true; 159 160 # trust certificate for *.demiurge.epistemia 161 pki.certificates = [ 162 '' 163 -----BEGIN CERTIFICATE----- 164 MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw 165 ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A 166 ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu 167 QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y 168 NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0 169 aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF 170 AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G 171 yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr 172 al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8 173 GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl 174 u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM 175 X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B 176 Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ 177 idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw 178 DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d 179 /jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr 180 jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL 181 1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf 182 ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw 183 2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt 184 i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9 185 vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF 186 SivxomFBHWe4CLwWy/mDaC18/g== 187 -----END CERTIFICATE----- 188 '' 189 ]; 190 }; 191 192 # create caches and use mandoc 193 documentation.man = { 194 enable = true; 195 generateCaches = true; 196 man-db.enable = false; 197 mandoc.enable = true; 198 }; 199 }