Consolidated and moved modules/{nixos,darwin} to modules/system

2024-01-02 20:08:20 +01:00 · 2024-01-02 20:08:20 +01:00 · 679496f5b4
commit 679496f5b4
parent 77cf9d4396
20 changed files with 258 additions and 250 deletions
--- a/modules/system/settei/sane-defaults.nix
+++ b/modules/system/settei/sane-defaults.nix
@ -0,0 +1,130 @@
+{isLinux}: {
+  config,
+  lib,
+  username,
+  ...
+} @ args: let
+  options = {
+    settei.sane-defaults = with lib; {
+      enable = mkEnableOption "Personal sane defaults (but they should make sense for anyone)";
+      allSshKeys = mkOption {
+        type = types.attrsOf types.singleLineStr;
+        default = {};
+      };
+      tailnet = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+      };
+    };
+  };
+
+  sharedConfig = let
+    cfg = config.settei;
+    inherit (cfg) username;
+    adminNeedsPassword = isLinux -> config.security.sudo.wheelNeedsPassword;
+  in {
+    _module.args = {
+      username = lib.mkDefault username;
+    };
+
+    # FIXME: Move to common
+    services.tailscale.enable = true;
+
+    networking.hostName = lib.mkDefault (
+      args.configurationName
+      or (throw "pass configurationName to module arguments or set networking.hostName yourself")
+    );
+
+    # Flakes are unusable without git present so pull it into the environment by default
+    settei.user.config.programs.git.enable = lib.mkDefault true;
+
+    nix = {
+      settings = {
+        experimental-features = ["nix-command" "flakes" "repl-flake" "auto-allocate-uids"];
+        trusted-users = lib.optionals (!adminNeedsPassword) [username];
+        auto-allocate-uids = true;
+        extra-substituters = [
+          "https://hyprland.cachix.org"
+          "https://cache.garnix.io"
+          "https://nix-community.cachix.org"
+          "https://hercules-ci.cachix.org"
+          "https://nrabulinski.cachix.org"
+        ];
+        trusted-public-keys = [
+          "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+          "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+          "hercules-ci.cachix.org-1:ZZeDl9Va+xe9j+KqdzoBZMFJHVQ42Uu/c/1/KMC5Lw0="
+          "nrabulinski.cachix.org-1:Q5FD7+1c68uH74CQK66UWNzxhanZW8xcg1LFXxGK8ic="
+        ];
+      };
+    };
+  };
+
+  linuxConfig = lib.optionalAttrs isLinux (let
+    cfg = config.settei.sane-defaults;
+    nmEnabled = config.networking.networkmanager.enable;
+  in {
+    hardware.enableRedistributableFirmware = true;
+
+    services.openssh.enable = true;
+    programs.mosh.enable = lib.mkDefault true;
+
+    users = {
+      mutableUsers = false;
+      users.${username} = {
+        isNormalUser = true;
+        home = "/home/${username}";
+        group = username;
+        extraGroups = ["wheel"];
+        # FIXME: Move to common
+        openssh.authorizedKeys.keys = let
+          configName' =
+            args.configurationName
+            or (throw "pass configurationName to module arguments or set users.users.${username}.openssh.authorizedKeys yourself");
+          filteredKeys = lib.filterAttrs (name: _: name != configName') cfg.allSshKeys;
+        in
+          lib.mkDefault (lib.attrValues filteredKeys);
+      };
+      groups.${username} = {};
+    };
+
+    # TODO: Actually this should be extraRules which makes wheel users without any password set
+    #       be able to use sudo with no password
+    security.sudo.wheelNeedsPassword = false;
+
+    # When NetworkManager isn't in use, add tailscale DNS address manually
+    # FIXME: Move to common
+    networking = lib.mkIf (!nmEnabled && config.services.tailscale.enable && cfg.tailnet != null) {
+      nameservers = [
+        "100.100.100.100"
+        "1.1.1.1"
+        "1.0.0.1"
+      ];
+      search = [cfg.tailnet];
+    };
+
+    # NetworkManager probably means desktop system so we don't want to slow down boot times
+    systemd.services = lib.mkIf nmEnabled {
+      NetworkManager-wait-online.enable = false;
+    };
+  });
+
+  darwinConfig = lib.optionalAttrs (!isLinux) {
+    services.nix-daemon.enable = true;
+
+    security.pam.enableSudoTouchIdAuth = true;
+
+    users.users.${username}.home = "/Users/${username}";
+  };
+in {
+  _file = ./sane-defaults.nix;
+
+  inherit options;
+
+  config = lib.mkIf config.settei.sane-defaults.enable (lib.mkMerge [
+    sharedConfig
+    linuxConfig
+    darwinConfig
+  ]);
+}