init

global/default.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./system-configuration.nix
+    ./software-configuration.nix
+    ./user-configuration.nix
+    ./stateless-configuration.nix
+  ];
+}

global/software-configuration.nix

@@ -0,0 +1,94 @@
+{ pkgs, pkgs-unstable, lib, ... }: 
+let
+  databases = [
+    "k3s"
+    "gitea"
+    "vaultwarden"
+    "saysthbot"
+  ];
+in
+{
+  # Enable automatic login for the user.
+  services = {
+    logrotate.checkConfig = false;
+    sshd.enable = true;
+
+    ntp = {
+      enable = true;
+      servers = [
+        "ntp.ntsc.ac.cn" # China
+      ];
+    };
+
+    k3s = {
+      enable = true;
+      package = pkgs-unstable.k3s;
+      configPath = "/etc/rancher/k3s/config.yaml";
+    };
+
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_14;
+      authentication = ''
+        host	all	all	10.42.0.0/16	md5
+        host	all	all	fd01::/56	md5
+      '';
+      enableTCPIP = true;
+      ensureDatabases = databases;
+      ensureUsers = [
+        {
+          name = "k3s";
+          ensurePermissions = {
+            "DATABASE k3s" =  "ALL PRIVILEGES";
+          };
+          ensureClauses = {
+            login = true;
+          };
+        }
+        {
+          name = "gitea";
+          ensurePermissions = {
+            "DATABASE gitea" =  "ALL PRIVILEGES";
+          };
+          ensureClauses = {
+            login = true;
+          };
+        }
+        {
+          name = "vaultwarden";
+          ensurePermissions = {
+            "DATABASE vaultwarden" =  "ALL PRIVILEGES";
+          };
+          ensureClauses = {
+            login = true;
+          };
+        }
+        {
+          name = "saysthbot";
+          ensurePermissions = {
+            "DATABASE saysthbot" =  "ALL PRIVILEGES";
+          };
+          ensureClauses = {
+            login = true;
+          };
+        }
+      ];
+    };
+
+    postgresqlBackup = {
+      enable = true;
+      databases = databases;
+      compressionLevel = 9;
+      location = "/backup/postgresql";
+      startAt = "*-*-* 01:15:00";
+    };
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    nerdctl
+    vim
+    gnumake42
+  ];
+}

global/stateless-configuration.nix

@@ -0,0 +1,42 @@
+{
+  # /nix/persistent 是你实际保存文件的地方
+  environment.persistence."/nix/persistent" = {
+    # 不让这些映射的 mount 出现在文件管理器的侧边栏中
+    hideMounts = true;
+
+    # 你要映射的文件夹
+    directories = [
+      "/etc/rancher"
+      "/root"
+      "/var"
+    ];
+
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+    ];
+  };
+
+  environment.variables.NIX_REMOTE = "daemon";
+
+  systemd.services.nix-daemon = {
+    environment = {
+      # 指定临时文件的位置
+      TMPDIR = "/var/cache/nix";
+    };
+    serviceConfig = {
+      # 在 Nix Daemon 启动时自动创建 /var/cache/nix
+      CacheDirectory = "nix";
+    };
+  };
+
+  # Stateless rootfs
+  fileSystems."/" = {
+    device = "tmpfs";
+    fsType = "tmpfs";
+    options = [ "relatime" "mode=755" "nosuid" "nodev" ];
+  };
+}

global/system-configuration.nix

@@ -0,0 +1,63 @@
+{ pkgs, lib, ... }: {
+  time.timeZone = "Asia/Shanghai";
+  security.sudo.wheelNeedsPassword = true;
+
+  /*
+  hardware = {
+    opengl = {
+      enable = true;
+      extraPackages = with pkgs; [
+        mesa.drivers
+        libvdpau-va-gl
+        vaapiVdpau
+      ];
+    };
+  };
+  */
+
+  # Select internationalisation properties.
+  i18n = {
+    defaultLocale = "zh_CN.UTF-8";
+    extraLocaleSettings = {
+      LC_ADDRESS = "zh_CN.UTF-8";
+      LC_IDENTIFICATION = "zh_CN.UTF-8";
+      LC_MEASUREMENT = "zh_CN.UTF-8";
+      LC_MONETARY = "zh_CN.UTF-8";
+      LC_NAME = "zh_CN.UTF-8";
+      LC_NUMERIC = "zh_CN.UTF-8";
+      LC_PAPER = "zh_CN.UTF-8";
+      LC_TELEPHONE = "zh_CN.UTF-8";
+      LC_TIME = "zh_CN.UTF-8";
+    };
+  };
+
+  nix = {
+    settings = {
+      auto-optimise-store = true;
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+
+      substituters = [
+        "https://mirrors.ustc.edu.cn/nix-channels/store" # 中科大
+        "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store" # 清华
+        "https://mirrors.bfsu.edu.cn/nix-channels/store" # 北外
+        "https://mirror.sjtu.edu.cn/nix-channels/store" # 交大
+        "https://nixos-cn.cachix.org"
+        "https://cache.nixos.org/"
+      ];
+
+      trusted-users = [
+        "root"
+        "@wheel"
+      ];
+    };
+
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 1w";
+    };
+  };
+}

global/user-configuration.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }: {
+  users = {
+    mutableUsers = false;
+    users = {
+      login = {
+        isNormalUser = true;
+        description = "Login user";
+        hashedPassword = "$y$j9T$XMNDyrhWt/0Hml8Lp9e/91$PuqtfFbvUUjJgiEE9KNBRziWppEWbAD54j7ydmD0BY8"; 
+
+        packages = with pkgs; [
+          
+        ];
+
+        extraGroups = [
+          "wheel"
+        ];
+
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4D8YhuKaVoVu5f51SwO8FHmIMxytQ1VXzLr4qe1GnQ tonychyi@TonyChyideMacBook-Pro.local"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpWqnXVD/wC1IyWMNUtvPCnj7NtTfT1GaeKiDYILHIa coder@code-server-7dd77f88fb-5vlbj"
+        ];
+      };
+    };
+  };
+}