2021-07-09 10:46:19 +02:00
|
|
|
|
{ config, pkgs, lib, ... }:
|
2021-05-19 23:08:18 +02:00
|
|
|
|
|
2021-06-05 16:01:32 +02:00
|
|
|
|
let
|
|
|
|
|
pamLogin = ''
|
|
|
|
|
# Account management.
|
|
|
|
|
account required pam_unix.so
|
|
|
|
|
# Authentication management.
|
2021-09-11 13:37:35 +02:00
|
|
|
|
auth sufficient ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=challenge-response
|
|
|
|
|
auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
|
2021-06-05 16:01:32 +02:00
|
|
|
|
auth sufficient pam_unix.so nullok likeauth try_first_pass
|
|
|
|
|
auth required pam_deny.so
|
|
|
|
|
# Password management.
|
|
|
|
|
password sufficient pam_unix.so nullok sha512
|
|
|
|
|
# Session management.
|
2021-09-11 13:37:35 +02:00
|
|
|
|
session required pam_env.so conffile=/etc/pam/environment readenv=0
|
2021-06-05 16:01:32 +02:00
|
|
|
|
session required pam_unix.so
|
|
|
|
|
session required pam_loginuid.so
|
2021-09-11 13:37:35 +02:00
|
|
|
|
session required ${pkgs.linux-pam}/lib/security/pam_lastlog.so silent
|
|
|
|
|
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
|
2021-06-05 16:01:32 +02:00
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
in {
|
2021-05-28 00:15:51 +02:00
|
|
|
|
boot = {
|
|
|
|
|
# Use the systemd-boot EFI boot loader.
|
|
|
|
|
loader = {
|
|
|
|
|
systemd-boot.enable = true;
|
|
|
|
|
efi.canTouchEfiVariables = true;
|
|
|
|
|
};
|
2021-05-23 15:58:16 +02:00
|
|
|
|
};
|
2021-05-19 23:08:18 +02:00
|
|
|
|
|
2021-05-28 00:15:51 +02:00
|
|
|
|
networking = {
|
|
|
|
|
hostName = "helix-texta";
|
|
|
|
|
# nm ftw
|
2021-11-23 12:54:30 +01:00
|
|
|
|
networkmanager = {
|
|
|
|
|
enable = true;
|
|
|
|
|
packages = with pkgs; [ networkmanager-vpnc ];
|
|
|
|
|
};
|
2021-05-19 23:08:18 +02:00
|
|
|
|
};
|
2021-05-25 15:02:16 +02:00
|
|
|
|
|
2021-11-06 09:27:57 +01:00
|
|
|
|
system.fsPackages = [ pkgs.sshfs ];
|
2021-07-21 09:11:00 +02:00
|
|
|
|
|
2021-05-28 00:15:51 +02:00
|
|
|
|
# Pipewire for my wayland
|
2021-05-25 15:02:16 +02:00
|
|
|
|
sound.enable = false;
|
|
|
|
|
security.rtkit.enable = true;
|
|
|
|
|
services.pipewire = {
|
|
|
|
|
enable = true;
|
2021-06-05 12:07:55 +02:00
|
|
|
|
alsa.enable = true;
|
2021-06-26 21:10:47 +02:00
|
|
|
|
alsa.support32Bit = true;
|
2021-05-25 15:02:16 +02:00
|
|
|
|
pulse.enable = true;
|
2021-06-10 20:57:35 +02:00
|
|
|
|
jack.enable = true;
|
2021-06-05 12:07:55 +02:00
|
|
|
|
|
2021-10-14 16:58:38 +02:00
|
|
|
|
config.pipewire-pulse."stream.properties" = {
|
|
|
|
|
"channelmix.upmix" = true;
|
|
|
|
|
"channelmix.lfe-cutoff" = 150;
|
|
|
|
|
};
|
|
|
|
|
|
2021-12-26 23:02:32 +01:00
|
|
|
|
config.pipewire = { "default.clock.allowed-rates" = [ 48000 44100 ]; };
|
|
|
|
|
|
2021-06-05 12:07:55 +02:00
|
|
|
|
media-session.config.alsa-monitor = {
|
|
|
|
|
rules = [{
|
|
|
|
|
matches = [{
|
|
|
|
|
"node.name" =
|
|
|
|
|
"alsa_output.usb-Focusrite_Scarlett_Solo_USB_Y7ENM550A6399B-00.pro-output-0";
|
|
|
|
|
}];
|
|
|
|
|
actions = {
|
|
|
|
|
update-props = {
|
2021-06-05 17:27:02 +02:00
|
|
|
|
#"audio.rate" = 96000;
|
2021-06-05 12:07:55 +02:00
|
|
|
|
"api.alsa.headroom" = 1024;
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
}];
|
|
|
|
|
};
|
|
|
|
|
};
|
2021-07-06 18:23:17 +02:00
|
|
|
|
xdg.portal = {
|
|
|
|
|
enable = true;
|
2021-07-10 16:44:09 +02:00
|
|
|
|
extraPortals = [ pkgs.xdg-desktop-portal-wlr pkgs.xdg-desktop-portal-gtk ];
|
2021-07-06 18:23:17 +02:00
|
|
|
|
gtkUsePortal = true;
|
|
|
|
|
};
|
2021-06-05 12:07:55 +02:00
|
|
|
|
|
2021-11-29 16:36:30 +01:00
|
|
|
|
services.udev.customRules = [
|
|
|
|
|
# Rename the Scarlett Solo using udev
|
|
|
|
|
{
|
|
|
|
|
name = "85-scarlett-solo";
|
|
|
|
|
rules = ''
|
|
|
|
|
SUBSYSTEM=="usb", ENV{ID_MODEL_ID}=="8211", ENV{ID_VENDOR_ID}=="1235", TAG+="systemd", SYMLINK+="scarlett_solo"
|
|
|
|
|
'';
|
|
|
|
|
}
|
|
|
|
|
{
|
|
|
|
|
name = "85-yubikey";
|
|
|
|
|
rules = ''
|
|
|
|
|
SUBSYSTEM=="usb", ENV{ID_MODEL_ID}=="0407", ENV{ID_VENDOR_ID}=="1050", TAG+="systemd", SYMLINK+="yubikey"
|
|
|
|
|
'';
|
|
|
|
|
}
|
|
|
|
|
];
|
2021-08-16 20:09:08 +02:00
|
|
|
|
|
2021-06-05 16:01:32 +02:00
|
|
|
|
security.pam = {
|
|
|
|
|
yubico = {
|
|
|
|
|
enable = true;
|
|
|
|
|
#id = "ccccccvblrrf";
|
|
|
|
|
control = "required";
|
|
|
|
|
mode = "challenge-response";
|
|
|
|
|
debug = false;
|
|
|
|
|
};
|
|
|
|
|
services.login = {
|
|
|
|
|
name = "login";
|
|
|
|
|
# Fix when https://github.com/NixOS/nixpkgs/pull/105319 lands..
|
|
|
|
|
text = pamLogin;
|
|
|
|
|
};
|
|
|
|
|
#services.swaylock = {
|
|
|
|
|
# name = "swaylock";
|
|
|
|
|
# fprintAuth = true;
|
|
|
|
|
# unixAuth = true;
|
|
|
|
|
#};
|
2021-05-25 15:02:16 +02:00
|
|
|
|
};
|
2021-06-05 16:01:32 +02:00
|
|
|
|
services.fprintd.enable = true;
|
2021-05-19 23:08:18 +02:00
|
|
|
|
|
2021-05-28 00:15:51 +02:00
|
|
|
|
users = {
|
|
|
|
|
# I like my users unmutable
|
|
|
|
|
mutableUsers = false;
|
|
|
|
|
|
|
|
|
|
# Myself
|
|
|
|
|
users.malte = {
|
|
|
|
|
description = "Malte Tammena";
|
2021-06-15 18:56:08 +02:00
|
|
|
|
hashedPassword =
|
2021-07-02 16:13:59 +02:00
|
|
|
|
"$6$zqEC2iJJ98Ne$lRERO30msyjJm7oJCqRD/xj3NIm4De37gD.VUzfg7aceosE/6S6eNAaruIakgUtSC970MHRPoNlCEy1RoFuyh.";
|
2021-05-28 00:15:51 +02:00
|
|
|
|
isNormalUser = true;
|
2021-11-05 18:29:45 +01:00
|
|
|
|
extraGroups = [
|
|
|
|
|
"wheel"
|
|
|
|
|
"networkmanager"
|
|
|
|
|
"video"
|
|
|
|
|
"lp"
|
|
|
|
|
"kvm"
|
|
|
|
|
"libvirtd"
|
|
|
|
|
"podman"
|
|
|
|
|
"scanner"
|
2021-12-04 12:47:59 +01:00
|
|
|
|
config.users.groups.keys.name
|
2021-11-05 18:29:45 +01:00
|
|
|
|
];
|
2021-05-28 00:15:51 +02:00
|
|
|
|
# Yes, use the best, please
|
|
|
|
|
shell = pkgs.fish;
|
|
|
|
|
};
|
|
|
|
|
};
|
2021-12-26 23:01:36 +01:00
|
|
|
|
home-manager.users.malte.imports = [ ../malte/home.nix ];
|
2021-05-28 00:15:51 +02:00
|
|
|
|
|
2021-07-08 11:44:14 +02:00
|
|
|
|
programs.fish.enable = true;
|
|
|
|
|
|
2021-05-28 00:15:51 +02:00
|
|
|
|
# Use some fonts
|
2021-07-09 10:46:19 +02:00
|
|
|
|
fonts = {
|
|
|
|
|
enableDefaultFonts = true;
|
2021-12-04 13:35:34 +01:00
|
|
|
|
fonts = with pkgs; [ firaCodeNerd noto-fonts noto-fonts-cjk joypixels ];
|
2021-07-09 10:46:19 +02:00
|
|
|
|
fontconfig = {
|
|
|
|
|
enable = true;
|
|
|
|
|
defaultFonts.monospace = [ "FiraCode Nerd Font" ];
|
|
|
|
|
};
|
|
|
|
|
};
|
2021-05-28 00:15:51 +02:00
|
|
|
|
|
|
|
|
|
# Configure GPG with SSH support and enable the yubikey
|
2021-05-22 22:17:13 +02:00
|
|
|
|
programs.gnupg.agent = {
|
|
|
|
|
enable = true;
|
|
|
|
|
enableSSHSupport = true;
|
|
|
|
|
pinentryFlavor = "qt";
|
|
|
|
|
};
|
2021-05-19 23:08:18 +02:00
|
|
|
|
|
2021-07-04 12:20:47 +02:00
|
|
|
|
virtualisation = {
|
|
|
|
|
podman = {
|
|
|
|
|
enable = true;
|
|
|
|
|
# Create a `docker` alias for podman, to use it as a drop-in replacement
|
|
|
|
|
dockerCompat = true;
|
2021-09-11 12:38:30 +02:00
|
|
|
|
dockerSocket.enable = true;
|
|
|
|
|
defaultNetwork.dnsname.enable = true;
|
2021-07-04 12:20:47 +02:00
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2021-06-05 12:08:33 +02:00
|
|
|
|
programs.dconf.enable = true;
|
2021-07-15 14:12:24 +02:00
|
|
|
|
|
2021-06-15 18:15:54 +02:00
|
|
|
|
programs.steam.enable = true;
|
2021-07-18 13:33:50 +02:00
|
|
|
|
nixpkgs.config.packageOverrides = pkgs: {
|
2021-07-15 14:12:24 +02:00
|
|
|
|
steam = pkgs.steam.override {
|
2021-07-18 13:33:50 +02:00
|
|
|
|
extraPkgs = pkgs: [ pkgs.openssl ];
|
2021-07-15 14:12:24 +02:00
|
|
|
|
#nativeOnly = true;
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2021-06-05 12:08:33 +02:00
|
|
|
|
programs.sway.enable = true;
|
2021-06-15 18:15:54 +02:00
|
|
|
|
services.dbus.packages = [ pkgs.gnome3.dconf ];
|
2021-11-20 10:36:41 +01:00
|
|
|
|
services.udev.packages = with pkgs; [ yubikey-personalization chrysalis ];
|
2021-05-28 00:15:51 +02:00
|
|
|
|
|
2021-11-20 10:36:41 +01:00
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
|
|
|
thunderbolt
|
|
|
|
|
qt5.qtwayland
|
2021-12-22 18:45:44 +01:00
|
|
|
|
chrysalis
|
2021-11-20 10:36:41 +01:00
|
|
|
|
];
|
2021-05-28 00:15:51 +02:00
|
|
|
|
|
|
|
|
|
services.printing.enable = true;
|
2021-05-31 14:39:02 +02:00
|
|
|
|
services.fwupd.enable = true;
|
2021-06-01 22:42:38 +02:00
|
|
|
|
services.devmon.enable = true;
|
2021-05-19 23:08:18 +02:00
|
|
|
|
|
2021-12-04 12:47:59 +01:00
|
|
|
|
sops.defaultSopsFile = ../secrets/helix-texta/secrets.yaml;
|
|
|
|
|
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
|
# This is the actual specification of the secrets.
|
|
|
|
|
#sops.secrets."multimc/clientID" = { };
|
|
|
|
|
|
2021-05-19 23:08:18 +02:00
|
|
|
|
# This value determines the NixOS release from which the default
|
|
|
|
|
# settings for stateful data, like file locations and database versions
|
|
|
|
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
|
|
|
# this value at the release version of the first install of this system.
|
|
|
|
|
# Before changing this value read the documentation for this option
|
|
|
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
|
|
|
system.stateVersion = "20.09"; # Did you read the comment?
|
|
|
|
|
}
|
|
|
|
|
|