darmanandClaude Sonnet 5
60bef752cb
terra was the only host with real ~/.zshrc/.zshenv (via home-manager), so it never hit the plain-zsh zsh-newuser-install wizard that shows up on first login everywhere else. Wire home-manager.nixosModules.home-manager into jupiter/neptun/mars/mercury (+ mercury-vm/jupiter-vbox test targets) and give darman terra's shared zsh baseline via home/common.nix, imported from common.nix. terra's own home.nix now only carries its desktop/dev-specific profile (Hyprland, alacritty, git identity, direnv, dev packages) layered on top via home-manager.users.darman.imports. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Du1WQRk1F8DenrPhf8TofF
112 lines
4.0 KiB
Nix
112 lines
4.0 KiB
Nix
{ pkgs, ... }:
|
|
|
|
# Shared base for all hosts: user, SSH hardening, nix settings, packages.
|
|
{
|
|
# ---- User ----
|
|
users.users.darman = {
|
|
isNormalUser = true;
|
|
description = "darman";
|
|
extraGroups = [ "wheel" "networkmanager" ];
|
|
shell = pkgs.zsh;
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD5K6AQ0wYYHbNGzC4PyunUQsXbaD0iu1eaadLtv+Xp darman@terra"
|
|
];
|
|
};
|
|
|
|
security.sudo = {
|
|
enable = true;
|
|
wheelNeedsPassword = true;
|
|
extraConfig = ''
|
|
Defaults timestamp_timeout=20
|
|
'';
|
|
};
|
|
|
|
# ---- SSH (key-only) ----
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
};
|
|
};
|
|
|
|
# ---- Nix ----
|
|
nix.settings = {
|
|
experimental-features = [ "nix-command" "flakes" ];
|
|
# trust wheel so `nixos-rebuild --target-host darman@…` can push closures.
|
|
trusted-users = [ "root" "@wheel" ];
|
|
# authentik (services/identity/authentik.nix) comes from authentik-nix,
|
|
# which cache.nixos.org doesn't carry — without this it's ~400 local
|
|
# derivations (npm, rust, python). NOTE: the closure is built on whatever
|
|
# machine runs ./scripts/deploy, so the LAPTOP needs these two lines too,
|
|
# in /etc/nix/nix.custom.conf (Determinate Nix rewrites nix.conf).
|
|
extra-substituters = [ "https://nix-community.cachix.org" ];
|
|
extra-trusted-public-keys = [
|
|
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
|
];
|
|
};
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd ];
|
|
|
|
# ---- home-manager (user-level config for darman, all hosts) ----
|
|
# Requires home-manager.nixosModules.home-manager in the host's own
|
|
# `modules` list (flake.nix) — this only sets values for options that
|
|
# module declares, it doesn't import it, so every nixosSystem using
|
|
# common.nix needs that line too (mirrors terra's original setup).
|
|
home-manager.useGlobalPkgs = true;
|
|
home-manager.useUserPackages = true;
|
|
# Protects activation if a plain (non-symlink) ~/.zshrc etc. already
|
|
# exists from before home-manager managed it — e.g. a host where the
|
|
# zsh-newuser-install wizard's option (0) was used to silence itself.
|
|
home-manager.backupFileExtension = "hm-bak";
|
|
home-manager.users.darman.imports = [ ./home/common.nix ];
|
|
|
|
# ---- zsh / oh-my-zsh / powerlevel10k ----
|
|
programs.zsh = {
|
|
enable = true;
|
|
ohMyZsh = {
|
|
enable = true;
|
|
theme = "robbyrussell"; # prompt itself replaced by p10k below
|
|
};
|
|
shellAliases = {
|
|
ls = "lsd";
|
|
};
|
|
interactiveShellInit = ''
|
|
source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
|
|
source ${./dotfiles/p10k.zsh}
|
|
'';
|
|
};
|
|
|
|
# ---- Boot generations ----
|
|
# Cap every host at 5 generations so none of them can quietly repeat
|
|
# jupiter's 34-generations-on-a-29G-eMMC incident. Both loader options are
|
|
# set unconditionally since only one is ever enabled per host (systemd-boot
|
|
# everywhere except mercury's generic-extlinux-compatible RPi image) — the
|
|
# other one is simply inert.
|
|
boot.loader.systemd-boot.configurationLimit = 5;
|
|
boot.loader.generic-extlinux-compatible.configurationLimit = 5;
|
|
|
|
# Stock journald defaults to ~10% of the filesystem (up to 4G) before it
|
|
# rotates — no scheduled vacuum, just a ceiling it grows into. On jupiter's
|
|
# 29G eMMC that's ~2.9G it could silently accumulate. Cap it well below that
|
|
# everywhere instead of only noticing when a disk fills up again.
|
|
services.journald.extraConfig = ''
|
|
SystemMaxUse=200M
|
|
'';
|
|
|
|
# ---- Locale / firewall base ----
|
|
time.timeZone = "Europe/Berlin";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
console.keyMap = "de";
|
|
|
|
# Firewall on, ssh always allowed. Service modules add their own ports
|
|
# (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0).
|
|
networking.firewall.enable = true;
|
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
|
}
|