diff options
| -rw-r--r-- | flake.nix | 10 | ||||
| -rw-r--r-- | nixos/environment.nix | 1 | ||||
| -rw-r--r-- | nixos/opt/tailscale.nix | 7 | ||||
| -rw-r--r-- | nixos/services.nix | 8 | ||||
| -rw-r--r-- | tmux/tmux.conf | 1 |
5 files changed, 18 insertions, 9 deletions
@@ -37,7 +37,7 @@ hostname = "pegasus"; opt = { nvidia = true; - tailscale = false; + tailscale = true; vm = true; llm = true; }; @@ -86,6 +86,14 @@ }; modules = [ + { + nixpkgs.config = { + allowUnfree = true; + permittedInsecurePackages = [ + "ventoy-1.1.12" + ]; + }; + } ./nixos/configuration.nix home-manager.nixosModules.home-manager { diff --git a/nixos/environment.nix b/nixos/environment.nix index 9ab3d7e..c29c8bf 100644 --- a/nixos/environment.nix +++ b/nixos/environment.nix @@ -79,6 +79,7 @@ termshark mitmproxy certmitm + ventoy ]; fonts.packages = with pkgs; [ dejavu_fonts diff --git a/nixos/opt/tailscale.nix b/nixos/opt/tailscale.nix index a14c93b..50244cb 100644 --- a/nixos/opt/tailscale.nix +++ b/nixos/opt/tailscale.nix @@ -1,24 +1,17 @@ { config, pkgs, ... }: { - # 1. Enable the service and the firewall services.tailscale.enable = true; networking.nftables.enable = true; networking.firewall = { enable = true; - # Always allow traffic from your Tailscale network trustedInterfaces = [ "tailscale0" ]; - # Allow the Tailscale UDP port through the firewall allowedUDPPorts = [ config.services.tailscale.port ]; }; - # 2. Force tailscaled to use nftables (Critical for clean nftables-only systems) - # This avoids the "iptables-compat" translation layer issues. systemd.services.tailscaled.serviceConfig.Environment = [ "TS_DEBUG_FIREWALL_MODE=nftables" ]; - # 3. Optimization: Prevent systemd from waiting for network online - # (Optional but recommended for faster boot with VPNs) systemd.network.wait-online.enable = false; boot.initrd.systemd.network.wait-online.enable = false; } diff --git a/nixos/services.nix b/nixos/services.nix index 2cbd8b5..38634b2 100644 --- a/nixos/services.nix +++ b/nixos/services.nix @@ -29,7 +29,13 @@ wireplumber.enable = true; }; services.cloudflare-warp.enable = true; - services.openssh.enable = true; + services.openssh = { + enable = true; + settings = { + PasswordAuthentication = false; + PermitRootLogin = "no"; + }; + }; services.flatpak.enable = true; services.kanata = { enable = true; diff --git a/tmux/tmux.conf b/tmux/tmux.conf index 35213d2..4e5becf 100644 --- a/tmux/tmux.conf +++ b/tmux/tmux.conf @@ -9,6 +9,7 @@ set-option -g renumber-windows on set -gq allow-passthrough on set -g visual-activity off set-option -g focus-events on +set -g extended-keys on unbind C-b set -g prefix C-Space |