Wateir/NixServerConfig
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: Refractor

Browse source
This commit is contained in:
Wateir 2025-12-21 15:33:03 +01:00
parent 271115fc3a
commit 9453773af6
1 changed files with 85 additions and 97 deletions
Download patch file Download diff file Expand all files Collapse all files

182
configuration.nix
View file

@ -1,10 +1,8 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config,pkgs,lib, ... }: { config,pkgs,lib, ... }:
{ {
system.stateVersion = "25.11";
imports = imports =
[ [
./hardware-configuration.nix ./hardware-configuration.nix
@ -20,35 +18,40 @@
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [ "nix-command" "flakes" ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
# Use latest kernel. boot = {
boot.kernelPackages = pkgs.linuxPackages_latest; loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
kernelPackages = pkgs.linuxPackages_latest; # Use latest kernel.
};
networking.hostName = "ThinkCentre-Server-004"; # Define your hostname. networking = {
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. hostName = "ThinkCentre-Server-004"; # Define your hostname.
#wireless.enable = true; # Enables wireless support via wpa_supplicant.
# Configure network proxy if necessary #proxy.default = "http://user:password@proxy:port/";
# networking.proxy.default = "http://user:password@proxy:port/"; #proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; networkmanager.enable = true;
firewall.enable = true;
networking.networkmanager.enable = true; };
console.keyMap = "fr";
time.timeZone = "Europe/Paris"; time.timeZone = "Europe/Paris";
i18n.defaultLocale = "en_US.UTF-8"; i18n = {
defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = { extraLocaleSettings = {
LC_ADDRESS = "fr_FR.UTF-8"; LC_ADDRESS = "fr_FR.UTF-8";
LC_IDENTIFICATION = "fr_FR.UTF-8"; LC_IDENTIFICATION = "fr_FR.UTF-8";
LC_MEASUREMENT = "fr_FR.UTF-8"; LC_MEASUREMENT = "fr_FR.UTF-8";
LC_MONETARY = "fr_FR.UTF-8"; LC_MONETARY = "fr_FR.UTF-8";
LC_NAME = "fr_FR.UTF-8"; LC_NAME = "fr_FR.UTF-8";
LC_NUMERIC = "fr_FR.UTF-8"; LC_NUMERIC = "fr_FR.UTF-8";
LC_PAPER = "fr_FR.UTF-8"; LC_PAPER = "fr_FR.UTF-8";
LC_TELEPHONE = "fr_FR.UTF-8"; LC_TELEPHONE = "fr_FR.UTF-8";
LC_TIME = "fr_FR.UTF-8"; LC_TIME = "fr_FR.UTF-8";
};
}; };
services.xserver.xkb = { services.xserver.xkb = {
@ -56,7 +59,7 @@
variant = "azerty"; variant = "azerty";
}; };
console.keyMap = "fr";
programs.zsh.enable = true; programs.zsh.enable = true;
users.users.manager = { users.users.manager = {
@ -67,83 +70,68 @@
shell = pkgs.zsh; shell = pkgs.zsh;
}; };
security.sudo.enable = true; security = {
sudo = {
security.sudo.extraRules = [ enable = true;
{ extraRules = [
groups = [ "wheel" ];
commands = [
{ {
command = "/run/current-system/sw/bin/shutdown"; groups = [ "wheel" ];
options = [ "NOPASSWD" ]; commands = [
} {
{ command = "/run/current-system/sw/bin/shutdown";
command = "/run/current-system/sw/bin/reboot"; options = [ "NOPASSWD" ];
options = [ "NOPASSWD" ]; }
{
command = "/run/current-system/sw/bin/reboot";
options = [ "NOPASSWD" ];
}
];
} }
]; ];
} };
];
polkit.extraConfig = ''
polkit.addRule(function (action, subject) {
if (
subject.isInGroup("wheel") &&networking.firewall.
[
"org.freedesktop.login1.reboot",
"org.freedesktop.login1.reboot-multiple-sessions",
"org.freedesktop.login1.power-off",
"org.freedesktop.login1.power-off-multiple-sessions",
].indexOf(action.id) !== -1
) {
return polkit.Result.YES;
}
});
'';
};
security.polkit.extraConfig = '' programs = {
polkit.addRule(function (action, subject) { zsh.enable = true;
if (
subject.isInGroup("wheel") &&
[
"org.freedesktop.login1.reboot",
"org.freedesktop.login1.reboot-multiple-sessions",
"org.freedesktop.login1.power-off",
"org.freedesktop.login1.power-off-multiple-sessions",
].indexOf(action.id) !== -1
) {
return polkit.Result.YES;
}
});
'';
services.tailscale = { # Some programs need SUID wrappers, can be configured further or are
enable = true; # started in user sessions.
extraDaemonFlags = [ #mtr.enable = true;
"--no-logs-no-support" #gnupg.agent = {
]; # enable = true;
# enableSSHSupport = true;
extraSetFlags = [ # };
"--ssh=false" };
];
useRoutingFeatures = "server"; # or "client" / "both"
};
networking.firewall = {
enable = true;
allowedTCPPorts = [ 443 ];
allowedUDPPorts = [ 41641 3478 ];
};
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
environment.variables = { environment.variables = {
TERM = "xterm-256color"; TERM = "xterm-256color";
}; };
services.openssh.enable = true; services.openssh = {
enable = true;
services.openssh.settings.Macs = [ settings.Macs = [
# Current defaults: # Current defaults:
"hmac-sha2-512-etm@openssh.com" "hmac-sha2-512-etm@openssh.com"
"hmac-sha2-256-etm@openssh.com" "hmac-sha2-256-etm@openssh.com"
"umac-128-etm@openssh.com" "umac-128-etm@openssh.com"
# Cloudfare: # Cloudfare:
"hmac-sha2-256" "hmac-sha2-256"
]; ];
};
system.stateVersion = "25.11";
} }