blob: d80952a7846079cc2e5d07b57e6c7652f8de2527 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
{
pkgs,
lib,
config,
flake,
inputs,
...
}:
let
inherit (builtins)
fetchurl
filter
readFile
;
inherit (lib)
mkDefault
mkForce
mkOption
types
splitString
;
gitKeys = fetchurl {
url = "https://github.com/kbujari.keys";
sha256 = "1ngnml1rg3g40n06cd155vr9ks5v5p12i8996xy021mkn9gx12b3";
};
in
{
imports = [
./disk.nix
./nginx.nix
./persist.nix
# ./net
./gitserver
# ./monitoring
];
options.xnet = {
pubKeys = mkOption {
type = types.listOf types.str;
default = readFile gitKeys |> splitString "\n" |> filter (s: s != "");
};
};
config = {
i18n.defaultLocale = mkDefault "en_US.UTF-8";
time.timeZone = mkDefault "US/Pacific";
nix = {
nixPath = mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
settings = {
auto-optimise-store = true;
experimental-features = [
"nix-command"
"flakes"
"pipe-operators"
];
warn-dirty = false;
# timeout fast from binary cache
connect-timeout = 5;
};
gc = {
automatic = true;
options = mkDefault "--delete-older-than 30d";
};
registry = {
nixpkgs.flake = inputs.nixpkgs;
depot.flake = flake;
};
};
documentation = {
doc.enable = mkDefault false;
info.enable = mkDefault false;
man.enable = mkDefault false;
};
users.mutableUsers = false;
users.users.root = {
initialPassword = mkDefault "";
};
security.sudo = {
execWheelOnly = true;
extraConfig = "Defaults lecture = never";
};
nixpkgs.config.allowUnfree = true;
services.gnome.gcr-ssh-agent.enable = false;
programs.ssh = {
startAgent = true;
knownHosts = {
"github.com".publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
"gitlab.com".publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
"codeberg.org".publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB";
"git.sr.ht".publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
"pascal.ee.ryerson.ca".publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
};
extraConfig = ''
Host github
HostName github.com
User git
PreferredAuthentications publickey
Host codeberg
HostName codeberg.org
User git
PreferredAuthentications publickey
Host sourcehut
HostName git.sr.ht
User git
PreferredAuthentications publickey
Host ee
HostName pascal.ee.ryerson.ca
User kbujari
'';
};
# Doesn't work since channels are disabled
programs.command-not-found.enable = false;
programs.git = {
enable = true;
config = {
init.defaultBranch = "master";
fetch.prune = true;
core.excludesFile = pkgs.writeText "gitignore" ''
# dev shell caching
.direnv/
.envrc
'';
push.default = "upstream";
push.autoSetupRemote = true;
};
};
};
}
|
