blob: d613bf834dec1e375f0511fad6e5c7fa5c1c7971 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
|
{ pkgs, ... }: {
# Set your time zone.
time.timeZone = "America/Toronto";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
};
# enable flakes and nix cli
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
# I like my ethX/wlanX names
networking.usePredictableInterfaceNames = false;
# use local dns on each host
services.unbound = {
enable = true;
settings = {
server = {
interface = [
"127.0.0.1"
"100.64.0.2"
#"fd00:b0ba:cafe:babe::2"
"::1"
];
access-control = [
"0.0.0.0/0 allow"
"::0/0 allow"
];
hide-identity = true;
hide-version = true;
# Synthesize NXDOMAINs from DNSSEC NSEC chains.
# https://tools.ietf.org/html/rfc8198
aggressive-nsec = false;
module-config = "\"respip validator iterator\"";
local-data = [
"\"saklas.epistemia. 86400 IN A 100.64.0.1\""
"\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
"\"hastur.epistemia. 86400 IN A 100.64.0.3\""
"\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
"\"lab.epistemia. 86400 IN A 100.64.0.5\""
];
local-zone = [
"\"saklas.epistemia.\" redirect"
"\"demiurge.epistemia.\" redirect"
"\"hastur.epistemia.\" redirect"
"\"iphonebob.epistemia.\" redirect"
"\"lab.epistemia.\" redirect"
];
};
# hagezi for dns-based adblocking (in addition to others)
rpz = {
name = "hagezi.ultimate";
zonefile = "hagezi.ultimate";
url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
};
# go through mullvad for regular dns queries
forward-zone = {
name = ".";
forward-addr = [ "194.242.2.2" ];
};
};
};
environment.etc."resolv.conf".text = ''
nameserver 127.0.0.1
search epistemia
'';
# Define a user account.
users = {
groups.vin = {};
users.vin = {
isNormalUser = true;
group = "vin";
extraGroups = [
"transmission"
"wheel"
];
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
];
};
};
# default packages for both me and root
environment = {
systemPackages = with pkgs; [
doas-sudo-shim
git
wget
];
pathsToLink = [ "/share/zsh" ];
};
# enable bluetooth and add some udev rules
hardware = {
bluetooth.enable = true;
flipperzero.enable = true;
keyboard.qmk.enable = true;
};
programs = {
# for gtk in home-manager
dconf.enable = true;
# gpg
gnupg.agent = {
enable = true;
enableSSHSupport = false;
pinentryPackage = pkgs.pinentry-rofi;
settings.default-cache-ttl = 600;
};
# disable nano. I don't like nano.
nano.enable = false;
# steam, proprietary. I sometimes like playing nonfree games too.
steam.enable = true;
# configuration in home-manager
zsh.enable = true;
zsh.promptInit = "PS1='$ '";
};
security = {
# I prefer doas over sudo for simplicity
doas = {
enable = true;
extraRules = [
{
users = [ "vin" ];
keepEnv = true;
persist = true;
}
];
};
sudo.enable = false;
# needed to give realtime privileges to pipewire
rtkit.enable = true;
# trust certificate for *.demiurge.epistemia
pki.certificates = [
''
-----BEGIN CERTIFICATE-----
MIIELzCCApegAwIBAgIRANnOZgETCYAX7+HrLIGpk5AwDQYJKoZIhvcNAQELBQAw
ezEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSgwJgYDVQQLDB92aW5A
ZGVtaXVyZ2UuZXBpc3RlbWlhIChWaW5lZXQpMS8wLQYDVQQDDCZta2NlcnQgdmlu
QGRlbWl1cmdlLmVwaXN0ZW1pYSAoVmluZWV0KTAeFw0yNTA5MjEyMzE4MDFaFw0y
NzEyMjIwMDE4MDFaMEAxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9wbWVudCBjZXJ0
aWZpY2F0ZTEVMBMGA1UECwwMdmluQGRlbWl1cmdlMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA7RhsOzlGqpgKVV02WFoT0bIeqUNQ5d6MFl+w9TsKSy7G
yhWMOjUMchm5oco33QMwmzUpejqFuRtGIm9Gj1IoPKgK4hb+UVzJb1ZwevhWyQzr
al7rg2beb9dBYNXlZhpYjzLrom6FS/QrEEudjsrVwR5DdvYb+NeirXqWfL0NCiF8
GtDDAQdbdmLWJBrjfEO0YbLplgEvwJphxEdDuJsjqLOEGj+Q1ZONjQMTVxZOgIRl
u5DYItMESV/Rc0elBlapOeBatp01rvcdm2hGz3TaFusR4SeIcYOMoX+P4wK6sQZM
X9fR95cHv/Vx02S90I9LMpleti8tXwBNLgoho2fsmwIDAQABo2kwZzAOBgNVHQ8B
Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHwYDVR0jBBgwFoAUwZNUYxIJ
idGGuM7Kz8ysS+8Zc4cwHwYDVR0RBBgwFoIUKi5kZW1pdXJnZS5lcGlzdGVtaWEw
DQYJKoZIhvcNAQELBQADggGBAFdUThVUJpatQtnAxB6kV2mh0vdKzwhf4Mk+Su4d
/jAwNcM3m2xjSbjU+U5QyTI99qe+zvQF5WhVik+hWqcRPBF8NkeF47pZuAmiB+Vr
jL8iWyD8x7BER0PpCAGTCusNXXg3+Ttb2gygOOk+JJqvXpMXbbhCTgc1qJD3EziL
1hXZovZFTmdcPFV6iu+oyyMmzLQl0SIIgqIICs1F21HMNdwAWKX25NMK3YCJVuTf
ZxUfmLaqwnr5liS7aa7xZRzaee58VouUL9RtLT+JxLsg9EYV31dHJ57fNTBqzGsw
2X03iE9+p87UHwd/7SnO5K+y7FpUu96LsAyeNnRuO2ys+3XwCVS7xjA7MwyAnfJt
i8WMWzlQbxhppK/QO/R8/rt0RcNHY9fp8ZK7qVZWF/rnTVUbw1ZmFLBDbuY9ehq9
vgQF6lZFCIKkf7am2vqwZHVtx1R+Cgl9/+4YlLPOeMmRyI3SFaIERRiHT0SuvqzF
SivxomFBHWe4CLwWy/mDaC18/g==
-----END CERTIFICATE-----
''
];
};
# create caches and use mandoc
documentation.man = {
enable = true;
generateCaches = true;
man-db.enable = false;
mandoc.enable = true;
};
}
|
