222 lines
6.9 KiB
Nix
222 lines
6.9 KiB
Nix
# Edit this configuration file to define what should be installed on
|
||
# your system. Help is available in the configuration.nix(5) man page, on
|
||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||
|
||
{ config, lib, pkgs, ... }:
|
||
|
||
{
|
||
imports =
|
||
[ # Include the results of the hardware scan.
|
||
./hardware-configuration.nix
|
||
./ntfy/ntfy.nix
|
||
./forgejo/forgejo.nix
|
||
./nginx/nginx.nix
|
||
];
|
||
|
||
# Use the GRUB 2 boot loader.
|
||
boot.loader.grub.enable = true;
|
||
# Define on which hard drive you want to install Grub.
|
||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||
|
||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "ext4" ];
|
||
boot.initrd.luks.devices.root = {
|
||
device = "/dev/disk/by-uuid/c43431da-9f1f-45b4-b37f-eda31e4b2365";
|
||
preLVM = true;
|
||
allowDiscards = true;
|
||
};
|
||
|
||
# Setting up ssh on boot for disk decryption
|
||
boot.initrd.network = {
|
||
enable = true;
|
||
ssh.enable = true;
|
||
ssh.port = 222;
|
||
ssh.authorizedKeys = [
|
||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQbbze/eLH6FLEYQbVcevS4QCDqk8cbKhJcF3tots7G infra-one_initrd''
|
||
];
|
||
# ssh.authorizedKeyFiles = [ "/etc/secrets/sr-one_initrd_id_ed25519.pub" ];
|
||
ssh.hostKeys = [ "/etc/secrets/initrd/ssh_initrd_host_ed25519_key" ];
|
||
# ssh.ignoreEmptyHostKeys = true;
|
||
postCommands = '' echo 'cryptsetup-askpass' >> /root/.profile '';
|
||
};
|
||
|
||
networking = {
|
||
hostName = "infra-one";
|
||
domain = "lo-probst.de";
|
||
networkmanager.enable = true; # Configure network connections interactively with nmcli or nmtui.
|
||
useDHCP = false;
|
||
interfaces.enp1s0.useDHCP = true;
|
||
# Open ports in the firewall.
|
||
firewall.allowedTCPPorts = [ 80 443 ];
|
||
# firewall.allowedUDPPorts = [ ... ];
|
||
};
|
||
|
||
# Set your time zone.
|
||
time.timeZone = "Europe/Berlin";
|
||
|
||
# Configure network proxy if necessary
|
||
# networking.proxy.default = "http://user:password@proxy:port/";
|
||
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
|
||
|
||
# Select internationalisation properties.
|
||
# i18n.defaultLocale = "en_US.UTF-8";
|
||
console = {
|
||
# font = "Lat2-Terminus16";
|
||
keyMap = "de";
|
||
# useXkbConfig = true; # use xkb.options in tty.
|
||
};
|
||
|
||
# Enable sound.
|
||
# services.pulseaudio.enable = true;
|
||
# OR
|
||
# services.pipewire = {
|
||
# enable = true;
|
||
# pulse.enable = true;
|
||
# };
|
||
|
||
# Define a user account. Don't forget to set a password with ‘passwd’.
|
||
users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP6qy0iMmkzTRl87DLMHJlWJIHzUKlTqk9/mW6wE5as infra-one'' ];
|
||
# users.users.root.openssh.authorizedKeys.keyFiles = [ /etc/secrets/infra-one_root_id_ed25519.pub ];
|
||
|
||
# List packages installed in system profile.
|
||
# You can use https://search.nixos.org/ to find more packages (and options).
|
||
environment.systemPackages = with pkgs; [
|
||
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
|
||
# wget
|
||
# gptfdisk
|
||
# hdparm
|
||
# mdadm
|
||
htop
|
||
btop
|
||
git
|
||
];
|
||
|
||
# Unlock and boot data storage array
|
||
# environment.etc.crypttab = {
|
||
# mode = "0600";
|
||
# text = ''
|
||
# # <volume-name> <encrypted-device> [key-file] [options]
|
||
# data /dev/disk/by-uuid/8b4aad3e-56c2-4a5b-99d0-cdaa3b32ca54 /etc/secrets/data-luks-keyfile.key
|
||
# '';
|
||
# };
|
||
# fileSystems = {
|
||
# "/mnt/nextcloud" = {
|
||
# device = "/dev/vg-data/nextcloud";
|
||
# fsType = "ext4";
|
||
# options = [
|
||
# "nofail"
|
||
# ];
|
||
# };
|
||
# };
|
||
|
||
programs = {
|
||
mosh.enable = true;
|
||
ssh = {
|
||
startAgent = true;
|
||
extraConfig = "
|
||
Host forgejo@git.lo-probst.de
|
||
Hostname forgejo@git.lo-probst.de
|
||
Port 23
|
||
User forgejo
|
||
";
|
||
};
|
||
};
|
||
# Some programs need SUID wrappers, can be configured further or are
|
||
# started in user sessions.
|
||
# programs.mtr.enable = true;
|
||
# programs.gnupg.agent = {
|
||
# enable = true;
|
||
# enableSSHSupport = true;
|
||
# };
|
||
|
||
# List services that you want to enable:
|
||
|
||
# Enable the OpenSSH daemon.
|
||
services = {
|
||
openssh = {
|
||
enable = true;
|
||
ports = [ 22 ];
|
||
settings = {
|
||
PasswordAuthentication = false;
|
||
KbdInteractiveAuthentication = false;
|
||
PermitRootLogin = "yes";
|
||
};
|
||
};
|
||
fail2ban = {
|
||
enable = true;
|
||
bantime = "12h";
|
||
};
|
||
};
|
||
# testing the capabilities of kate git
|
||
# services.nginx = {
|
||
# enable = true;
|
||
# recommendedGzipSettings = true;
|
||
# recommendedOptimisation = true;
|
||
# recommendedProxySettings = true;
|
||
# recommendedTlsSettings = true;
|
||
# # pulls in the domainname set for grafana
|
||
# virtualHosts.${config.services.grafana.settings.server.domain} = {
|
||
# enableACME = true;
|
||
# acmeRoot = null;
|
||
# forceSSL = true;
|
||
# # directs traffic to the appropriate port for grafana
|
||
# locations."/" = {
|
||
# proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
|
||
# # proxyPass = "http://localhost:3000";
|
||
# proxyWebsockets = true;
|
||
# };
|
||
# };
|
||
# virtualHosts."cloud.lo-probst.de" = {
|
||
# enableACME = true;
|
||
# acmeRoot = null;
|
||
# forceSSL = true;
|
||
# locations."/" = {
|
||
# proxyPass = "https://192.168.2.225:443";
|
||
# };
|
||
# };
|
||
# virtualHosts."oh.lo-probst.de" = {
|
||
# enableACME = true;
|
||
# acmeRoot = null;
|
||
# forceSSL = true;
|
||
# locations."/" = {
|
||
# proxyPass = "https://192.168.2.221:9443";
|
||
# };
|
||
# };
|
||
# };
|
||
# security.acme = {
|
||
# acceptTerms = true;
|
||
# defaults = {
|
||
# email = "admin-sr-one@lo-probst.de";
|
||
# dnsProvider = "ionos";
|
||
# # API for authentication to DNA provider e.g.
|
||
# # CF_API_EMAIL=<insert-dns-account-email>
|
||
# # specify file if not using agenix
|
||
# credentialFiles = {
|
||
# "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-ddns-updater-sr-one.txt";
|
||
# };
|
||
# };
|
||
# };
|
||
# users.users.nginx.extraGroups = [ "acme" ];
|
||
|
||
|
||
|
||
# This option defines the first version of NixOS you have installed on this particular machine,
|
||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
||
#
|
||
# Most users should NEVER change this value after the initial install, for any reason,
|
||
# even if you've upgraded your system to a new NixOS release.
|
||
#
|
||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
||
# to actually do that.
|
||
#
|
||
# This value being lower than the current NixOS release does NOT mean your system is
|
||
# out of date, out of support, or vulnerable.
|
||
#
|
||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
||
# and migrated your data accordingly.
|
||
#
|
||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
||
system.stateVersion = "25.05"; # Did you read the comment?
|
||
|
||
}
|
||
|