Initial commit from system

configuration.nix

@@ -0,0 +1,210 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./ntfy/ntfy.nix
+      ./forgejo/forgejo.nix
+      ./nginx/nginx.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "ext4" ];
+  boot.initrd.luks.devices.root = {
+    device = "/dev/disk/by-uuid/c43431da-9f1f-45b4-b37f-eda31e4b2365";
+    preLVM = true;
+    allowDiscards = true;
+  };
+
+  # Setting up ssh on boot for disk decryption
+  boot.initrd.network = {
+    enable = true;
+    ssh.enable = true;
+    ssh.port = 222;
+    ssh.authorizedKeys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQbbze/eLH6FLEYQbVcevS4QCDqk8cbKhJcF3tots7G infra-one_initrd''
+    ];
+#    ssh.authorizedKeyFiles = [ "/etc/secrets/sr-one_initrd_id_ed25519.pub" ];
+    ssh.hostKeys = [ "/etc/secrets/initrd/ssh_initrd_host_ed25519_key" ];
+    # ssh.ignoreEmptyHostKeys = true;
+    postCommands = '' echo 'cryptsetup-askpass' >> /root/.profile '';
+  };
+
+  networking = {
+    hostName = "infra-one";
+    domain = "lo-probst.de";
+    networkmanager.enable = true; # Configure network connections interactively with nmcli or nmtui.
+    useDHCP = false;
+    interfaces.enp1s0.useDHCP = true;
+    # Open ports in the firewall.
+    firewall.allowedTCPPorts = [ 80 443 ];
+  #  firewall.allowedUDPPorts = [ ... ];
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+  #   font = "Lat2-Terminus16";
+    keyMap = "de";
+  #   useXkbConfig = true; # use xkb.options in tty.
+  };
+
+  # Enable sound.
+  # services.pulseaudio.enable = true;
+  # OR
+  # services.pipewire = {
+  #   enable = true;
+  #   pulse.enable = true;
+  # };
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP6qy0iMmkzTRl87DLMHJlWJIHzUKlTqk9/mW6wE5as infra-one'' ];
+#  users.users.root.openssh.authorizedKeys.keyFiles = [ /etc/secrets/infra-one_root_id_ed25519.pub ];
+
+  # List packages installed in system profile.
+  # You can use https://search.nixos.org/ to find more packages (and options).
+  environment.systemPackages = with pkgs; [
+#    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+#    wget
+#    gptfdisk
+#    hdparm
+#    mdadm
+    htop
+    btop
+    git
+  ];
+
+  # Unlock and boot data storage array
+#   environment.etc.crypttab = {
+#     mode = "0600";
+#     text = ''
+#       # <volume-name> <encrypted-device> [key-file] [options]
+#       data /dev/disk/by-uuid/8b4aad3e-56c2-4a5b-99d0-cdaa3b32ca54 /etc/secrets/data-luks-keyfile.key
+#     '';
+#   };
+#   fileSystems = {
+#     "/mnt/nextcloud" = {
+#       device = "/dev/vg-data/nextcloud";
+#       fsType = "ext4";
+#       options = [
+#         "nofail"
+#       ];
+#     };
+#   };
+
+  programs = {
+    mosh.enable = true;
+    ssh.startAgent = true;
+  };
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services = {
+    openssh = {
+      enable = true;
+      ports = [ 22 ];
+      settings = {
+        PasswordAuthentication = true;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "yes";
+      };
+    };
+  };
+
+#  services.nginx = {
+#    enable = true;
+#    recommendedGzipSettings = true;
+#    recommendedOptimisation = true;
+#    recommendedProxySettings = true;
+#    recommendedTlsSettings = true;
+#    # pulls in the domainname set for grafana
+#    virtualHosts.${config.services.grafana.settings.server.domain} = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      # directs traffic to the appropriate port for grafana
+#      locations."/" = {
+#        proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
+#        # proxyPass = "http://localhost:3000";
+#        proxyWebsockets = true;
+#      };
+#    };
+#    virtualHosts."cloud.lo-probst.de" = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      locations."/" = {
+#        proxyPass = "https://192.168.2.225:443";
+#      };
+#    };
+#    virtualHosts."oh.lo-probst.de" = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      locations."/" = {
+#        proxyPass = "https://192.168.2.221:9443";
+#      };
+#    };
+#  };
+#  security.acme = {
+#    acceptTerms = true;
+#    defaults = {
+#      email = "admin-sr-one@lo-probst.de";
+#      dnsProvider = "ionos";
+#      # API for authentication to DNA provider e.g.
+#      # CF_API_EMAIL=<insert-dns-account-email>
+#      # specify file if not using agenix
+#      credentialFiles = {
+#        "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-ddns-updater-sr-one.txt";
+#      };
+#    };
+#  };
+#  users.users.nginx.extraGroups = [ "acme" ];
+
+
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "25.05"; # Did you read the comment?
+
+}
+