all repos — nixfiles @ af146e47eecf52b69627f989860ddd6cfc151e03

System and user configuration, managed by nix and home-manager

system/settings/configuration/nix.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
{
  pkgs,
  lib,
  ...
}:
let
  kb = 1000;
  mb = 1000 * kb;
  gb = 1000 * mb;
in
{
  nix = {
    package = pkgs.lix;
    settings = {
      cores = lib.mkDefault 0;
      use-xdg-base-directories = true;
      keep-outputs = true;
      warn-dirty = false;

      # https://jackson.dev/post/nix-reasonable-defaults/
      connect-timeout = 5;
      min-free = 128 * mb;
      max-free = 1 * gb;
      fallback = true;

      trusted-substituters = [
        "https://nix-community.cachix.org"
        "https://cache.lix.systems"
        "https://binarycache.alin.ovh"
      ];
      trusted-public-keys = [
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
        "binarycache.alin.ovh:ZwqO3XMuajPictjwih8OY2+RXnOKpjZEZFHJjGSxAI4="
        "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
      ];

      experimental-features = [
        "nix-command"
        "flakes"
      ];
    };

    gc = {
      automatic = lib.mkDefault true;
      options = lib.mkDefault "--delete-older-than 14d";
    };
  };

  environment.systemPackages = with pkgs; [
    nix-output-monitor
  ];

  services.angrr = {
    enable = true;
    settings = {
      temporary-root-policies = {
        direnv = {
          path-regex = "/\\.direnv/";
          period = "14d";
        };
        result = {
          path-regex = "/result[^/]*$";
          period = "3d";
        };
      };
      profile-policies = {
        system = {
          profile-paths = [ "/nix/var/nix/profiles/system" ];
          keep-since = "30d";
          keep-latest-n = 5;
          keep-booted-system = true;
          keep-current-system = true;
        };
        user = {
          enable = true;
          profile-paths = [
            # `~` at the beginning will be expanded to the home directory of each discovered user
            "~/.local/state/nix/profiles/profile"
            "/nix/var/nix/profiles/per-user/root/profile"
          ];
          keep-since = "3d";
          keep-latest-n = 1;
        };
      };
    };
  };
}