move users to depot, add gitignore

7 files changed, 95 insertions, 120 deletions

diff --git a/machines/iridium/default.nix b/machines/iridium/default.nix
index 4f755dd..b492f5b 100644
--- a/machines/iridium/default.nix
+++ b/machines/iridium/default.nix
@@ -1,14 +1,13 @@
 { lib, inputs, depot, ... }:
 let
-  gitKeys = builtins.fetchurl {
-    url = "https://github.com/kbujari.keys";
-    sha256 = "0fpa679zkrpx77vangzf3gnidwvmky8ifivn8411xx6albrikaqx";
-  };
-
   inherit (inputs.nixos-hardware.nixosModules)
     common-cpu-intel
     common-gpu-intel
     ;
+
+  inherit (depot.users.kle)
+    gitKeys
+    ;
 in
 {
   system.stateVersion = "24.11";
diff --git a/machines/radon/default.nix b/machines/radon/default.nix
index 839ee6d..c87a3d3 100644
--- a/machines/radon/default.nix
+++ b/machines/radon/default.nix
@@ -2,7 +2,7 @@
 let
   gitKeys = builtins.fetchurl {
     url = "https://github.com/kbujari.keys";
-    sha256 = "0fpa679zkrpx77vangzf3gnidwvmky8ifivn8411xx6albrikaqx";
+    sha256 = "1kskbiyqvjz1wsmcrgh9v0iryf33y70zk503z0m96wmzdjllmc94";
   };
 
   inherit (inputs.nixos-hardware.nixosModules)
diff --git a/machines/t1/default.nix b/machines/t1/default.nix
index d95926b..1a44b07 100644
--- a/machines/t1/default.nix
+++ b/machines/t1/default.nix
@@ -1,10 +1,12 @@
-{ inputs, ... }:
+{ inputs, depot, ... }:
 
 let
   inherit (inputs.nixos-hardware.nixosModules)
     common-cpu-amd
     common-gpu-amd
     ;
+
+  inherit (depot.users) kle;
 in
 {
   imports = [
@@ -14,9 +16,10 @@ in
 
   system.stateVersion = "24.11";
 
+  users.users.kle = kle.nixos;
+
   xnet = {
     desktop.enable = true;
-    users.enable = [ "kle" ];
     net.join = [ "plaza" ];
     disk = {
       enable = true;
diff --git a/machines/t480/default.nix b/machines/t480/default.nix
index 0010f08..bfd695d 100644
--- a/machines/t480/default.nix
+++ b/machines/t480/default.nix
@@ -1,8 +1,12 @@
-{ inputs, ... }:
+{ inputs, depot, ... }:
 let
   inherit (inputs.nixos-hardware.nixosModules)
     lenovo-thinkpad-t480
     ;
+
+  inherit (depot.users)
+    kle
+    ;
 in
 {
   imports = [
@@ -13,18 +17,20 @@ in
 
   xnet = {
     desktop.enable = true;
-    users.enable = [ "kle" ];
+    # users.enable = [ "kle" ];
     disk = {
       enable = true;
       device = "/dev/nvme0n1";
     };
   };
 
+  users.users.kle = kle.nixos;
+
   networking = {
     hostName = "t480";
     useDHCP = false;
     dhcpcd.enable = false;
-    nameservers = [ "9.9.9.9" ];
+    nameservers = [ "127.0.0.1" ];
     networkmanager = {
       enable = true;
       dns = "none";
@@ -35,5 +41,32 @@ in
   programs.nm-applet.enable = true;
   services.fwupd.enable = true;
 
+  services.unbound = {
+    enable = true;
+    settings.server = {
+      interface = [ "127.0.0.1" ];
+      port = 53;
+      access-control = [ "127.0.0.1 allow" ];
+      harden-glue = true;
+      harden-dnssec-stripped = true;
+      use-caps-for-id = false;
+      prefetch = true;
+      edns-buffer-size = 1232;
+      hide-identity = true;
+      hide-version = true;
+    };
+
+    settings.forward-zone = [
+      {
+        name = ".";
+        forward-tls-upstream = true;
+        forward-addr = [
+          "9.9.9.9#dns.quad9.net"
+          "149.112.112.112#dns.quad9.net"
+        ];
+      }
+    ];
+  };
+
   xnet.persist = [ "/etc/NetworkManager/system-connections" ];
 }
diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 578db03..138bd53 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -1,11 +1,10 @@
-{ lib, ... }:
+{ pkgs, lib, ... }:
 let
   inherit (lib) mkDefault;
 in
 {
   imports = [
     ./disk.nix
-    ./users.nix
     ./nginx.nix
     ./persist.nix
     ./net
@@ -36,4 +35,45 @@ in
     doc.enable = mkDefault false;
     info.enable = mkDefault false;
   };
+
+  users.mutableUsers = false;
+
+  security.sudo = {
+    execWheelOnly = true;
+    extraConfig = "Defaults lecture = never";
+  };
+
+  programs.ssh = {
+    knownHosts = {
+      "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+      "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
+      "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
+      "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+    };
+    extraConfig = ''
+      Host github
+        HostName github.com
+        User git
+        PreferredAuthentications publickey
+
+      Host ee
+        HostName pascal.ee.ryerson.ca
+        User kbujari
+    '';
+  };
+
+  programs.git = {
+    enable = true;
+    config = {
+      init.defaultBranch = "master";
+      fetch.prune = true;
+      core.excludesFile = pkgs.writeText "gitignore" ''
+        # dev shell caching
+        .direnv/
+        .envrc
+      '';
+      push.default = "upstream";
+      push.autoSetupRemote = true;
+    };
+  };
 }
diff --git a/machines/xnet/desktop/default.nix b/machines/xnet/desktop/default.nix
index 16c6873..9a1f701 100644
--- a/machines/xnet/desktop/default.nix
+++ b/machines/xnet/desktop/default.nix
@@ -79,7 +79,13 @@ in
     };
 
     programs = {
-      fish.enable = true;
+      fish = {
+        enable = true;
+        interactiveShellInit = ''
+          # disable greeting
+          set fish_greeting
+        '';
+      };
       light.enable = mkDefault true;
       direnv = {
         enable = true;
diff --git a/machines/xnet/users.nix b/machines/xnet/users.nix
deleted file mode 100644
index 7995b94..0000000
--- a/machines/xnet/users.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  inherit (builtins)
-    elem
-    ;
-
-  inherit (lib)
-    mkOption
-    mkIf
-    types
-    ;
-
-  cfg = config.xnet.users;
-
-  userEn = user: elem user cfg.enable;
-
-  gitKeys = builtins.fetchurl {
-    url = "https://github.com/kbujari.keys";
-    sha256 = "0fpa679zkrpx77vangzf3gnidwvmky8ifivn8411xx6albrikaqx";
-  };
-
-in
-{
-
-  options.xnet.users = {
-    enable = mkOption {
-      type = types.listOf (types.enum [ "kle" ]);
-      default = [ ];
-      description = "Users to enable.";
-    };
-  };
-
-  config = {
-    users = {
-      mutableUsers = false;
-      users.root = {
-        initialHashedPassword = "$y$j9T$eGwGb5tZwhk/.K0Lezsx4/$dJ4AODPBo0RBkVoCh1MVZTtkkDRn/C6A/XQIKt2YBNA";
-        openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile gitKeys);
-      };
-      users.kle = mkIf (userEn "kle") {
-        initialHashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
-        isNormalUser = true;
-        shell = pkgs.fish;
-        home = "/persist/usr/kle";
-        createHome = true;
-        extraGroups = [ "wheel" "users" "networkmanager" "video" ];
-        packages = with pkgs; [
-          btop
-          curl
-          fzf
-          jq
-          lynx
-          neovim
-          ranger
-          ripgrep
-          rsync
-          sshfs
-          tree
-          zip
-        ];
-        openssh.authorizedKeys.keys = lib.splitString "\n" (builtins.readFile gitKeys);
-      };
-    };
-
-    disko.devices.zpool.zroot.datasets = { };
-
-    security.sudo = {
-      execWheelOnly = true;
-      extraConfig = "Defaults lecture = never";
-    };
-
-    programs.ssh = {
-      knownHosts = {
-        "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
-        "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
-        "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
-        "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
-      };
-      extraConfig = ''
-        Host github
-          HostName github.com
-          User git
-          PreferredAuthentications publickey
-
-        Host ee
-          HostName pascal.ee.ryerson.ca
-          User kbujari
-      '';
-    };
-
-    programs.git = {
-      enable = true;
-      config = {
-        init.defaultBranch = "master";
-        fetch.prune = true;
-        core.excludesFile = pkgs.writeText "gitignore" ''
-          # dev shell caching
-          .direnv/
-          .envrc
-        '';
-        push.default = "upstream";
-        push.autoSetupRemote = true;
-      };
-    };
-  };
-}