Title: My NixOS configuration

	Title: My NixOS configuration
	Author: Solène
	Date: 21 December 2021
	Tags: nixos linux
	Description: In this text I share my NixOS configuration file.

	# Introduction

	Let me share my NixOS configuration file, the one in
	/etc/nixos/configuration.nix that describe what is installed on my
	Lenovo T470 laptop.

	The base of NixOS is that you declare every user, services, network and
	system settings in a file, and finally it configures itself to match
	your expectations. You can also install global packages and per-user
	packages. It makes a system environment reproducible and reliable.

	# The file

	```NixOS configuration file
	{ config, pkgs, ... }:

	{
	imports =
	[ # Include the results of the hardware scan.
	./hardware-configuration.nix
	];

	# run garbage collector at 19h00 everyday
	# and remove stuff older than 60 days
	nix.gc.automatic = true;
	nix.gc.dates = "19:00";
	nix.gc.persistent = true;
	nix.gc.options = "--delete-older-than 60d";

	# clean /tmp at boot
	boot.cleanTmpDir = true;

	# latest kernel
	boot.kernelPackages = pkgs.linuxPackages_latest;

	# sync disk when buffer reach 6% of memory
	boot.kernel.sysctl = {
	"vm.dirty_ratio" = 6;
	};

	# allow non free stuff
	nixpkgs.config.allowUnfree = true;

	# Use the systemd-boot EFI boot loader.
	boot.loader.systemd-boot.enable = true;
	boot.loader.efi.canTouchEfiVariables = true;

	networking.hostName = "t470";
	time.timeZone = "Europe/Paris";
	networking.networkmanager.enable = true;

	# wireguard VPN
	networking.wireguard.interfaces = {
	wg0 = {
	ips = [ "192.168.5.1/24" ];
	listenPort = 1234;
	privateKeyFile = "/root/wg-private";
	peers = [
	{ # server
	publicKey = "MY PUB KEY";
	endpoint = "SERVER:PORT";
	allowedIPs = [ "192.168.5.0/24" ];
	}];
	};
	};

	# firejail firefox by default
	programs.firejail.wrappedBinaries = {
	firefox = {
	executable = "${pkgs.lib.getBin pkgs.firefox}/bin/firefox";
	profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
	};
	};


	# azerty keyboard <3
	i18n.defaultLocale = "fr_FR.UTF-8";
	console = {
	# font = "Lat2-Terminus16";
	keyMap = "fr";
	};

	# clean logs older than 2d
	services.cron.systemCronJobs = [
	"0 20 * * * root journalctl --vacuum-time=2d"
	];

	# nvidia prime offload rendering for eGPU
	hardware.nvidia.modesetting.enable = true;
	hardware.nvidia.prime.sync.allowExternalGpu = true;
	hardware.nvidia.prime.offload.enable = true;
	hardware.nvidia.prime.nvidiaBusId = "PCI:10:0:0";
	hardware.nvidia.prime.intelBusId = "PCI:0:2:0";
	services.xserver.videoDrivers = ["nvidia" ];

	# programs
	programs.steam.enable = true;
	programs.firejail.enable = true;
	programs.fish.enable = true;
	programs.gamemode.enable = true;
	programs.ssh.startAgent = true;

	# services
	services.acpid.enable = true;
	services.thermald.enable = true;
	services.fwupd.enable = true;
	services.vnstat.enable = true;

	# Enable the X11 windowing system.
	services.xserver.enable = true;
	services.xserver.displayManager.sddm.enable = true;
	services.xserver.desktopManager.plasma5.enable = true;
	services.xserver.desktopManager.xfce.enable = false;
	services.xserver.desktopManager.gnome.enable = false;

	# Configure keymap in X11
	services.xserver.layout = "fr";
	services.xserver.xkbOptions = "eurosign:e";

	# Enable sound.
	sound.enable = true;
	hardware.pulseaudio.enable = true;

	# Enable touchpad support
	services.xserver.libinput.enable = true;

	users.users.solene = {
	isNormalUser = true;
	shell = pkgs.fish;
	packages = with pkgs; [
	gajim audacity chromium dmd dtools
	kate kdeltachat pavucontrol rclone rclone-browser
	zim claws-mail mpv musikcube git-annex
	];
	extraGroups = [ "wheel" "sudo" "networkmanager" ];
	};

	# my gaming users running steam/lutris/emulators
	users.users.gaming = {
	isNormalUser = true;
	shell = pkgs.fish;
	extraGroups = [ "networkmanager" "video" ];
	packages = with pkgs; [ lutris firefox ];
	};

	users.users.aria = {
	isNormalUser = true;
	shell = pkgs.fish;
	packages = with pkgs; [ aria2 ];
	};

	# global packages
	environment.systemPackages = with pkgs; [
	ncdu kakoune git rsync restic tmux fzf
	];

	# Enable the OpenSSH daemon.
	services.openssh.enable = true;

	# Open ports in the firewall.
	networking.firewall.enable = true;
	networking.firewall.allowedTCPPorts = [ 22 ];
	networking.firewall.allowedUDPPorts = [ ];

	# user aria can only use tun0
	networking.firewall.extraCommands = "
	iptables -A OUTPUT -o lo -m owner --uid-owner 1002 -j ACCEPT
	iptables -A OUTPUT -o tun0 -m owner --uid-owner 1002 -j ACCEPT
	iptables -A OUTPUT -m owner --uid-owner 1002 -j REJECT
	";

	# This value determines the NixOS release from which the default
	# settings for stateful data, like file locations and database versions
	# on your system were taken. It‘s perfectly fine and recommended to leave
	# this value at the release version of the first install of this system.
	# Before changing this value read the documentation for this option
	# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
	system.stateVersion = "21.11"; # Did you read the comment?

	}
	```