daniil-berg
238528f961
Bare Wayland session ships no `org.freedesktop.secrets` provider, so libsecret/qtkeychain apps can't persist credentials. Run gnome-keyring and unlock it at the greetd login via PAM. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
105 lines
3.0 KiB
Nix
105 lines
3.0 KiB
Nix
# Generic system-level config. Reusable across hosts — nothing machine- or
|
|
# user-specific here. The user account, hostname and system.stateVersion live in
|
|
# the per-host inventory (hosts/<host>/), not in this module.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
# Deduplicate identical store paths via hardlinks.
|
|
nix.settings.auto-optimise-store = true;
|
|
# Weekly GC of generations older than 30 days (frees disk + prunes stale boot
|
|
# entries). Flat age cutoff — Nix has no snapper-style tiered retention.
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
# Bootloader systemd-boot much simpler than GRUB.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
# Show only the newest 5 generations in the boot menu (display cap only; GC
|
|
# above does the actual deletion).
|
|
boot.loader.systemd-boot.configurationLimit = 5;
|
|
|
|
# Use latest kernel.
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
|
|
# Configure network connections interactively with nmcli or nmtui.
|
|
networking.networkmanager.enable = true;
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [
|
|
22000 # syncthing sync transport (TCP)
|
|
];
|
|
allowedUDPPorts = [
|
|
22000 # syncthing sync transport (QUIC)
|
|
21027 # syncthing LAN discovery
|
|
];
|
|
};
|
|
|
|
# Time zone. Template default — override per host/region.
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
# Internationalisation properties. Template defaults — override per region.
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
console = {
|
|
font = "Lat2-Terminus16";
|
|
keyMap = "de";
|
|
};
|
|
|
|
# Programs.
|
|
programs.zsh.enable = true;
|
|
programs.hyprland.enable = true;
|
|
programs.dconf.enable = true;
|
|
|
|
# Packages installed in system profile.
|
|
environment.systemPackages = with pkgs; [
|
|
curl
|
|
git
|
|
neovim
|
|
wget
|
|
];
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
# Install nice font.
|
|
fonts.packages = with pkgs; [
|
|
nerd-fonts.jetbrains-mono
|
|
];
|
|
|
|
# Enable sound.
|
|
services.pipewire = {
|
|
enable = true;
|
|
alsa.enable = true;
|
|
alsa.support32Bit = true;
|
|
pulse.enable = true;
|
|
};
|
|
security.rtkit.enable = true;
|
|
|
|
# Cache sudo credentials for 30 min per terminal (default 5). Tradeoff: an
|
|
# unlocked, unattended terminal can sudo without re-auth for that window.
|
|
security.sudo.extraConfig = "Defaults timestamp_timeout=30";
|
|
|
|
# Login manager.
|
|
services.greetd = {
|
|
enable = true;
|
|
settings = {
|
|
default_session = {
|
|
command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd start-hyprland";
|
|
user = "greeter";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Unlock the login keyring with the login password at the greetd prompt,
|
|
# so the Secret Service is open without a second passphrase.
|
|
security.pam.services.greetd.enableGnomeKeyring = true;
|
|
|
|
# XDG portals (screen sharing, file pickers, and so on).
|
|
xdg.portal = {
|
|
enable = true;
|
|
extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
|
|
};
|
|
}
|