infra-one/configuration.nix

# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).

{ config, lib, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ./ntfy/ntfy.nix
      ./forgejo/forgejo.nix
      ./nginx/nginx.nix
    ];

  # Use the GRUB 2 boot loader.
  boot.loader.grub.enable = true;
  # Define on which hard drive you want to install Grub.
  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only

  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "ext4" ];
  boot.initrd.luks.devices.root = {
    device = "/dev/disk/by-uuid/c43431da-9f1f-45b4-b37f-eda31e4b2365";
    preLVM = true;
    allowDiscards = true;
  };

  # Setting up ssh on boot for disk decryption
  boot.initrd.network = {
    enable = true;
    ssh.enable = true;
    ssh.port = 222;
    ssh.authorizedKeys = [
      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQbbze/eLH6FLEYQbVcevS4QCDqk8cbKhJcF3tots7G infra-one_initrd''
    ];
#    ssh.authorizedKeyFiles = [ "/etc/secrets/sr-one_initrd_id_ed25519.pub" ];
    ssh.hostKeys = [ "/etc/secrets/initrd/ssh_initrd_host_ed25519_key" ];
    # ssh.ignoreEmptyHostKeys = true;
    postCommands = '' echo 'cryptsetup-askpass' >> /root/.profile '';
  };

  networking = {
    hostName = "infra-one";
    domain = "lo-probst.de";
    networkmanager.enable = true; # Configure network connections interactively with nmcli or nmtui.
    useDHCP = false;
    interfaces.enp1s0.useDHCP = true;
    # Open ports in the firewall.
    firewall.allowedTCPPorts = [ 80 443 ];
  #  firewall.allowedUDPPorts = [ ... ];
  };

  # Set your time zone.
  time.timeZone = "Europe/Berlin";

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Select internationalisation properties.
  # i18n.defaultLocale = "en_US.UTF-8";
  console = {
  #   font = "Lat2-Terminus16";
    keyMap = "de";
  #   useXkbConfig = true; # use xkb.options in tty.
  };

  # Enable sound.
  # services.pulseaudio.enable = true;
  # OR
  # services.pipewire = {
  #   enable = true;
  #   pulse.enable = true;
  # };

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILP6qy0iMmkzTRl87DLMHJlWJIHzUKlTqk9/mW6wE5as infra-one'' ];
#  users.users.root.openssh.authorizedKeys.keyFiles = [ /etc/secrets/infra-one_root_id_ed25519.pub ];

  # List packages installed in system profile.
  # You can use https://search.nixos.org/ to find more packages (and options).
  environment.systemPackages = with pkgs; [
#    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
#    wget
#    gptfdisk
#    hdparm
#    mdadm
    htop
    btop
    git
  ];

  # Unlock and boot data storage array
#   environment.etc.crypttab = {
#     mode = "0600";
#     text = ''
#       # <volume-name> <encrypted-device> [key-file] [options]
#       data /dev/disk/by-uuid/8b4aad3e-56c2-4a5b-99d0-cdaa3b32ca54 /etc/secrets/data-luks-keyfile.key
#     '';
#   };
#   fileSystems = {
#     "/mnt/nextcloud" = {
#       device = "/dev/vg-data/nextcloud";
#       fsType = "ext4";
#       options = [
#         "nofail"
#       ];
#     };
#   };

  programs = {
    mosh.enable = true;
    ssh = {
      startAgent = true;
      extraConfig = "
        Host git.lo-probst.de
          Hostname git.lo-probst.de
          Port 23
          User forgejo
      ";
    };
  };
  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services = {
    openssh = {
      enable = true;
      ports = [ 22 ];
      settings = {
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
        PermitRootLogin = "yes";
      };
    };
    fail2ban = {
      enable = true;
      bantime = "12h";
    };
  };

#  services.nginx = {
#    enable = true;
#    recommendedGzipSettings = true;
#    recommendedOptimisation = true;
#    recommendedProxySettings = true;
#    recommendedTlsSettings = true;
#    # pulls in the domainname set for grafana
#    virtualHosts.${config.services.grafana.settings.server.domain} = {
#      enableACME = true;
#      acmeRoot = null;
#      forceSSL = true;
#      # directs traffic to the appropriate port for grafana
#      locations."/" = {
#        proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
#        # proxyPass = "http://localhost:3000";
#        proxyWebsockets = true;
#      };
#    };
#    virtualHosts."cloud.lo-probst.de" = {
#      enableACME = true;
#      acmeRoot = null;
#      forceSSL = true;
#      locations."/" = {
#        proxyPass = "https://192.168.2.225:443";
#      };
#    };
#    virtualHosts."oh.lo-probst.de" = {
#      enableACME = true;
#      acmeRoot = null;
#      forceSSL = true;
#      locations."/" = {
#        proxyPass = "https://192.168.2.221:9443";
#      };
#    };
#  };
#  security.acme = {
#    acceptTerms = true;
#    defaults = {
#      email = "admin-sr-one@lo-probst.de";
#      dnsProvider = "ionos";
#      # API for authentication to DNA provider e.g.
#      # CF_API_EMAIL=<insert-dns-account-email>
#      # specify file if not using agenix
#      credentialFiles = {
#        "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-ddns-updater-sr-one.txt";
#      };
#    };
#  };
#  users.users.nginx.extraGroups = [ "acme" ];



  # This option defines the first version of NixOS you have installed on this particular machine,
  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
  #
  # Most users should NEVER change this value after the initial install, for any reason,
  # even if you've upgraded your system to a new NixOS release.
  #
  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
  # to actually do that.
  #
  # This value being lower than the current NixOS release does NOT mean your system is
  # out of date, out of support, or vulnerable.
  #
  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
  # and migrated your data accordingly.
  #
  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
  system.stateVersion = "25.05"; # Did you read the comment?

}