rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: clean up tree-wide

Browse source
This commit is contained in:
Mohammad Rafiq 2025-07-02 06:02:47 +08:00
parent 45afd6bea5
commit b9ad8ac2ca
No known key found for this signature in database
50 changed files with 247 additions and 511 deletions
Download patch file Download diff file Expand all files Collapse all files

37
modules/nixos/default.nix
View file

@ -2,7 +2,6 @@
inputs,
lib,
config,
system,
...
}:
let
@ -50,7 +49,6 @@ in
default = [ ];
};
};
config = {
# Helper options
environment.persistence."/persist".directories = config.persistDirs;
@ -60,63 +58,50 @@ in
"/var/lib/systemd"
"/var/lib/nixos"
];
stylix.enable = true;
nixpkgs = {
hostPlatform = system;
config.allowUnfree = true;
};
nix.settings = {
experimental-features = [
"nix-command"
"flakes"
"pipe-operators"
];
trusted-users = [ "@wheel" ];
};
system.stateVersion = "25.05"; # Did you read the comment?
nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [
"nix-command"
"flakes"
"pipe-operators"
];
nix.settings.trusted-users = [ "@wheel" ];
system.stateVersion = "25.05";
time.timeZone = "Asia/Singapore";
i18n.defaultLocale = "en_US.UTF-8";
users = {
# Don't allow imperative configuration
mutableUsers = false;
users.root.openssh.authorizedKeys.keys = [ config.mainUser.publicKey ];
groups.users = {
gid = 100;
members = [ "${config.mainUser.name}" ];
};
users."${config.mainUser.name}" = {
linger = true;
uid = 1000;
isNormalUser = true;
hashedPasswordFile = config.sops.secrets."${config.mainUser.name}/hashedPassword".path;
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = [ config.mainUser.publicKey ];
};
users.root.openssh.authorizedKeys.keys = singleton config.mainUser.publicKey;
};
services.getty.autologinUser = config.mainUser.name;
security.sudo.wheelNeedsPassword = false;
sops = {
defaultSopsFile = get-file "secrets/secrets.yaml";
age.sshKeyPaths = [ "/persist/home/rafiq/.ssh/id_ed25519" ];
age.sshKeyPaths = [ "/persist/home/${config.mainUser.name}/.ssh/id_ed25519" ];
secrets = {
"keys/openrouter" = { };
"keys/gemini" = { };
"keys/cvt-jira" = { };
"keys/cloudflare" = { };
"keys/telegram_bot" = { };
"misc/cvt-jira-link" = { };
"rafiq/hashedPassword".neededForUsers = true;
"rafiq/personalEmailPassword" = { };
"rafiq/workEmailPassword" = { };
"tailscale/client-id" = { };
"tailscale/client-secret" = { };
};
};
environment.shellInit = # sh
''
export GEMINI_API_KEY=$(sudo cat ${config.sops.secrets."keys/gemini".path})
export CVT_JIRA_KEY=$(sudo cat ${config.sops.secrets."keys/cvt-jira".path})
export CVT_JIRA_LINK=$(sudo cat ${config.sops.secrets."misc/cvt-jira-link".path})
'';
};
}