NixBTW/system.nix at main · DuskyElf/NixBTW · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
{
  config,
  lib,
  pkgs,
  ...
}:
let
  # power.sh runs as root via NOPASSWD sudo, so it must never be writable by
  # the user. Content is read from scripts/power.sh at eval time and the
  # activation script symlinks the immutable store copy into /usr/local/sbin.
  # Repo edits only take effect on the next nixos-rebuild, and tampering with
  # the writable ~/.config/scripts copy is useless because sudo only matches
  # the path below.
  powerScript = pkgs.writeTextFile {
    name = "power.sh";
    executable = true;
    text =
      "#!${pkgs.bash}/bin/bash\n"
      + lib.removePrefix "#!/usr/bin/env bash\n" (builtins.readFile ./scripts/power.sh);
  };
in
{
  options.hostOptions = {
    hostName = lib.mkOption {
      type = lib.types.str;
    };
  };

  config = {
    nixpkgs.config.allowUnfree = true;

    console.useXkbConfig = true;

    boot.loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
    };

    boot.initrd.systemd.enable = true;

    networking = {
      networkmanager.enable = true;
      hostName = config.hostOptions.hostName;
      #firewall = {
      #  enable = true;
      #  allowedTCPPorts = [ 9000 ];
      #  allowedUDPPorts = [ 9000 ];
      #};
    };

    services.blueman.enable = true;
    hardware.bluetooth.enable = true;

    # for better battery life keep it at 80%
    systemd.services.battery-threshold-control = {
      script = ''
        echo "80" > /sys/class/power_supply/BAT0/charge_control_end_threshold
      '';
      wantedBy = [ "multi-user.target" ];
    };

    services.auto-cpufreq = {
      enable = true;
      settings = {
        battery = {
          governor = "powersave";
          turbo = "never";
        };
        charger = {
          governor = "powersave";
          turbo = "auto";
        };
      };
    };

    time.timeZone = "Asia/Kolkata";
    i18n.defaultLocale = "en_US.UTF-8";

    nix.settings = {
      trusted-users = [
        "duskyelf"
      ];

      substituters = [
        "https://cache.nixos.org"
        "https://cuda-maintainers.cachix.org"
      ];

      trusted-public-keys = [
        "cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E="
      ];

      experimental-features = [
        "nix-command"
        "flakes"
      ];
    };

    i18n.extraLocaleSettings = {
      LC_ADDRESS = "en_IN";
      LC_IDENTIFICATION = "en_IN";
      LC_MEASUREMENT = "en_IN";
      LC_MONETARY = "en_IN";
      LC_NAME = "en_IN";
      LC_NUMERIC = "en_IN";
      LC_PAPER = "en_IN";
      LC_TELEPHONE = "en_IN";
      LC_TIME = "en_IN";
    };

    system.activationScripts.powerScript = ''
      mkdir -p /usr/local/sbin
      ln -sfn ${powerScript} /usr/local/sbin/power.sh
    '';

    # Disable the credential cache: a fresh sudo timestamp (e.g. from a
    # rebuild) would otherwise let anything running as duskyelf
    # `sudo -n <anything>` within the window. NOPASSWD keybind rule is
    # unaffected, but every other sudo now prompts fresh.
    security.sudo.extraConfig = "Defaults timestamp_timeout=0";

    security.sudo.extraRules = [
      {
        users = [ "duskyelf" ];
        commands = [
          {
            command = "/usr/local/sbin/power.sh";
            options = [ "NOPASSWD" ];
          }
        ];
      }
    ];

    system.stateVersion = "25.11"; # Leave it as it is
  };
}