nix-conf/hosts/Nixstation/default.nix
Thiago Sposito 2a8494b24b
feat: add sops, nitrokey support, update deps
* add `.sops.yaml`, secrets, pgp keys
* add nitrokey + smartcard pkgs, udev rules
* update flake inputs
* comment out ollama-cuda
2025-09-24 01:13:03 -03:00

162 lines
3.2 KiB
Nix

{ pkgs
, ...
}:
{
imports = [
../common/default.nix
../common/network.nix
../common/nvidia/default.nix
./hardware-configuration.nix
];
boot = {
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
kernelPackages = pkgs.linuxPackages_latest;
};
environment = {
systemPackages = with pkgs; [
act
btrfs-progs
cudatoolkit
];
};
hardware = {
sane.enable = true;
graphics.enable = true;
};
i18n.defaultLocale = "en_US.UTF-8";
i18n.extraLocaleSettings = {
LC_ADDRESS = "pt_BR.UTF-8";
LC_IDENTIFICATION = "pt_BR.UTF-8";
LC_MEASUREMENT = "pt_BR.UTF-8";
LC_MONETARY = "pt_BR.UTF-8";
LC_NAME = "pt_BR.UTF-8";
LC_NUMERIC = "pt_BR.UTF-8";
LC_PAPER = "pt_BR.UTF-8";
LC_TELEPHONE = "pt_BR.UTF-8";
LC_TIME = "pt_BR.UTF-8";
};
networking = {
hostName = "Nixstation";
firewall = {
allowedTCPPorts = [
11434
8000
8080
8888
];
allowPing = true;
enable = true;
};
};
nix = {
settings = {
auto-optimise-store = true;
};
};
programs = {
dconf.enable = true;
virt-manager.enable = true;
};
security = {
pam.services.gdm.enableGnomeKeyring = true;
polkit.enable = true;
polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
if (action.id == "org.bluez.GattProfile1.Release") {
return polkit.Result.YES;
}
});
'';
rtkit.enable = true;
};
services = {
xserver = {
xkb = {
layout = "us";
variant = "alt-intl";
};
};
desktopManager.gnome.enable = true;
displayManager = {
gdm.enable = true;
gdm.wayland = true;
defaultSession = "gnome";
};
avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
extraConfig = ''
[server]
allow-interfaces=wlp7s0
'';
};
earlyoom = {
enable = true;
freeMemThreshold = 5;
freeSwapThreshold = 10;
};
flatpak.enable = true;
pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};
};
systemd = {
services."getty@tty1".enable = false;
services."autovt@tty1".enable = false;
};
systemd.timers.btrfs-scrub = {
description = "Run Btrfs Scrub Daily";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "daily";
Persistent = true;
};
};
systemd.services = {
btrfs-scrub = {
description = "Daily Btrfs Scrub";
serviceConfig = {
Type = "oneshot";
Nice = 19;
IOSchedulingClass = "idle";
ExecStart = "${pkgs.btrfs-progs}/bin/btrfs scrub start -n 2 -B / && ${pkgs.btrfs-progs}/bin/btrfs scrub start -n 2 -B /mnt/hdd0";
};
};
};
system.stateVersion = "25.11"; # keep it!
time.timeZone = "America/Sao_Paulo";
virtualisation = {
vmware.host.enable = false;
spiceUSBRedirection.enable = true;
libvirtd = {
enable = true;
qemu.ovmf.enable = true;
# qemu.package = pkgs.qemu_full;
};
};
zramSwap = {
enable = true;
memoryPercent = 25;
algorithm = "zstd";
};
}