profiles/core.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

{
  pkgs,
  lib,
  config,
  inputs,
  ...
}: {
  imports = [
    ../profiles/security.nix
    ../profiles/network.nix
  ];
  config = {
    system.stateVersion = "22.5";
    nix = {
      registry.nixpkgs.flake = inputs.nixpkgs;
      gc.automatic = true;
      optimise.automatic = true;
      settings = {
        allowed-users = ["root"];
        trusted-users = ["root"];
        sandbox = true;
      };
      extraOptions = ''
        experimental-features = nix-command flakes
      '';
    };
    users.mutableUsers = false;
    environment.defaultPackages = lib.mkForce [];

    age.identityPaths = ["/nix/persist/etc/ssh/ssh_host_ed25519_key"];
    programs.command-not-found.dbPath = inputs.programsdb.packages.${pkgs.system}.programs-sqlite;

    # save uid/guid
    environment.persistence."/nix/persist".directories = ["/var/lib/nixos"];

    boot = {
      tmp.cleanOnBoot = true;
      kernelParams = [
        "init_on_free=1"
        "page_poison=1"
        "page_alloc.shuffle=1"
        "slab_nomerge"
        "vsyscall=none"
      ];
    };
  };
}