up

profiles/nixos/default.nix

@@ -2,32 +2,88 @@
   pkgs,
   nixvim,
   user,
+  agenix,
   ...
-}: {
+}: let
+  sshKeys = import ../../shared/ssh-keys.nix;
+in {
   imports = [
-    ./disks.nix
+    agenix.nixosModules.default
   ];
 
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 30d";
+  time.timeZone = "UTC";
+
+  nix = {
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+    nixPath = ["nixos-config=/home/${user}/.local/share/src/nixos-config:/etc/nixos"];
   };
 
-  users.users.${user} = {
-    isNormalUser = true;
-    home = "/home/${user}";
-    extraGroups = [
-      "wheel"
-      "sudo"
-      "network"
-      "systemd-journal"
-    ];
-    shell = pkgs.fish;
+  virtualisation.docker = {
+    enable = true;
+    logDriver = "json-file";
   };
 
+  programs = {
+    gnupg.agent.enable = true;
+    fish.enable = true;
+  };
+
+  services = {
+    openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "yes";
+        PasswordAuthentication = false;
+      };
+    };
+    tailscale.enable = true;
+  };
+
+  users.users = {
+    ${user} = {
+      isNormalUser = true;
+      home = "/home/${user}";
+      extraGroups = [
+        "wheel"
+        "sudo"
+        "network"
+        "systemd-journal"
+        "docker"
+      ];
+      shell = pkgs.fish;
+      openssh.authorizedKeys.keys = sshKeys.keys;
+    };
+
+    root = {
+      openssh.authorizedKeys.keys = sshKeys.keys;
+    };
+  };
+
+  security.sudo = {
+    enable = true;
+    extraRules = [
+      {
+        commands = [
+          {
+            command = "${pkgs.systemd}/bin/reboot";
+            options = ["NOPASSWD"];
+          }
+        ];
+        groups = ["wheel"];
+      }
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    agenix.packages."${pkgs.system}".default
+    inetutils
+  ];
+
   home-manager = {
-    useGlobalPkgs = true;
     users.${user} = {
       pkgs,
       config,