120 lines
3 KiB
Nix
120 lines
3 KiB
Nix
{ lib, pkgs, inputs, ... }:
|
|
let
|
|
concordSession = pkgs.writeShellScriptBin "concord-session" ''
|
|
set -eu
|
|
|
|
runtime_dir="''${XDG_RUNTIME_DIR:-/tmp}"
|
|
session_dir="$(mktemp -d "$runtime_dir/concord-session.XXXXXX")"
|
|
|
|
cleanup() {
|
|
rm -rf -- "$session_dir"
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
trap 'exit 129' HUP
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
|
|
config_home="$session_dir/config"
|
|
state_home="$session_dir/state"
|
|
mkdir -p "$config_home" "$state_home"
|
|
|
|
cat > "$config_home/config.toml" <<'EOF'
|
|
[credentials]
|
|
store = "plain"
|
|
EOF
|
|
|
|
XDG_CONFIG_HOME="$config_home" \
|
|
XDG_STATE_HOME="$state_home" \
|
|
"${inputs.concord.packages.${pkgs.system}.default}/bin/concord" "$@"
|
|
'';
|
|
in
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
"${inputs.self}/modules/mizukios/base"
|
|
"${inputs.self}/modules/mizukios/features/system/boot.nix"
|
|
"${inputs.self}/modules/mizukios/features/remote/ssh.nix"
|
|
"${inputs.self}/modules/mizukios/features/management/podman.nix"
|
|
|
|
./services/quadlet/authentik.nix
|
|
./services/quadlet/conduit.nix
|
|
./services/quadlet/paste.nix
|
|
./services/quadlet/thetree.nix
|
|
./services/quadlet/today.nix
|
|
];
|
|
|
|
# 1. 크론 설정
|
|
services.cron = {
|
|
enable = true;
|
|
systemCronJobs = [
|
|
"0 1 * * * imnyang printf '\\n%s : ' \"$(date)\" >> /home/imnyang/codelounge.log && /home/imnyang/codelounge.sh >> /home/imnyang/codelounge.log"
|
|
];
|
|
};
|
|
|
|
services.qemuGuest.enable = true;
|
|
|
|
# 2. 사용자 SSH 키 등록
|
|
users.users.imnyang.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
|
|
];
|
|
|
|
users.users.discord = {
|
|
isNormalUser = true;
|
|
description = "Ephemeral Concord session user";
|
|
shell = pkgs.bashInteractive;
|
|
password = "";
|
|
};
|
|
|
|
services.openssh.extraConfig = ''
|
|
Match User discord
|
|
AuthenticationMethods none
|
|
PasswordAuthentication yes
|
|
PermitEmptyPasswords yes
|
|
ForceCommand ${concordSession}/bin/concord-session
|
|
DisableForwarding yes
|
|
PermitTTY yes
|
|
PermitUserRC no
|
|
'';
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
eza
|
|
neovim
|
|
nil
|
|
nixd
|
|
];
|
|
|
|
programs.git.config = {
|
|
safe.directory = "*";
|
|
};
|
|
|
|
nix.settings.require-sigs = false;
|
|
|
|
networking.firewall.enable = false;
|
|
|
|
# Keep short-lived service memory spikes from turning into a global OOM.
|
|
# The host has 8 GiB RAM and currently had no swap configured.
|
|
swapDevices = [
|
|
{
|
|
# nixpkgs currently requires a label definition for swap submodules,
|
|
# but file-backed swap must still use its real path here.
|
|
label = "hako-swap";
|
|
device = lib.mkForce "/swapfile";
|
|
}
|
|
];
|
|
|
|
boot.kernel.sysctl."vm.swappiness" = 10;
|
|
|
|
# /dev/sdd1 (ext4, UUID efdf753d-282c-4b78-9549-a124b353c6a5)
|
|
fileSystems."/mnt/static" = {
|
|
device = "/dev/disk/by-uuid/efdf753d-282c-4b78-9549-a124b353c6a5";
|
|
fsType = "ext4";
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"L+ /var/static - - - - /mnt/static/static"
|
|
];
|
|
|
|
networking.hostName = "hako";
|
|
system.stateVersion = "26.05";
|
|
}
|