2020-12-06 16:40:47 +01:00
|
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
|
|
|
|
{
|
2020-12-09 22:49:42 +01:00
|
|
|
imports = [
|
|
|
|
../../modules
|
|
|
|
];
|
|
|
|
|
2020-12-06 16:40:47 +01:00
|
|
|
networking.domain = "net.clerie.de";
|
|
|
|
|
2023-02-20 10:11:43 +01:00
|
|
|
networking.firewall.logRefusedConnections = lib.mkDefault false;
|
|
|
|
|
2020-12-06 16:40:47 +01:00
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
|
|
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
console = {
|
|
|
|
keyMap = "de-latin1";
|
|
|
|
};
|
|
|
|
|
2020-12-06 18:23:51 +01:00
|
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
|
2022-10-16 12:56:07 +02:00
|
|
|
nix.settings = {
|
|
|
|
trusted-users = [ "@wheel" ];
|
|
|
|
auto-optimise-store = true;
|
|
|
|
};
|
2020-12-06 18:23:51 +01:00
|
|
|
|
2020-12-06 16:40:47 +01:00
|
|
|
environment.systemPackages = with pkgs; [
|
2022-05-26 01:05:17 +02:00
|
|
|
gptfdisk
|
2020-12-06 16:40:47 +01:00
|
|
|
htop
|
2022-05-26 01:05:17 +02:00
|
|
|
parted
|
2020-12-06 16:40:47 +01:00
|
|
|
tmux
|
2022-10-03 13:14:39 +02:00
|
|
|
colmena
|
2022-10-17 22:14:49 +02:00
|
|
|
vim
|
2023-05-01 12:29:55 +02:00
|
|
|
agenix
|
2020-12-06 16:40:47 +01:00
|
|
|
];
|
|
|
|
|
2020-12-08 19:26:02 +01:00
|
|
|
programs.mtr.enable = true;
|
|
|
|
|
2023-02-28 19:41:03 +01:00
|
|
|
programs.git.enable = true;
|
|
|
|
|
|
|
|
programs.git.config = {
|
|
|
|
user = {
|
|
|
|
name = "clerie";
|
|
|
|
email = "git@clerie.de";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2020-12-06 16:40:47 +01:00
|
|
|
services.openssh.enable = true;
|
2023-04-16 15:31:07 +02:00
|
|
|
services.openssh.settings = {
|
2023-04-21 20:41:49 +02:00
|
|
|
PasswordAuthentication = false;
|
|
|
|
KbdInteractiveAuthentication = false;
|
|
|
|
PermitRootLogin = lib.mkDefault "no";
|
2023-04-16 15:31:07 +02:00
|
|
|
};
|
2020-12-09 22:42:39 +01:00
|
|
|
|
2022-09-29 17:44:05 +02:00
|
|
|
nix.gc = lib.mkDefault {
|
2021-06-18 12:45:26 +02:00
|
|
|
automatic = true;
|
|
|
|
dates = "weekly";
|
|
|
|
options = "--delete-older-than 30d";
|
|
|
|
};
|
|
|
|
|
2021-02-21 21:40:05 +01:00
|
|
|
services.nginx = {
|
|
|
|
enableReload = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
|
|
recommendedOptimisation = true;
|
|
|
|
recommendedProxySettings = true;
|
|
|
|
recommendedTlsSettings = true;
|
2022-09-28 21:09:32 +02:00
|
|
|
|
2023-03-15 20:26:44 +01:00
|
|
|
commonHttpConfig = ''
|
2022-09-28 22:09:16 +02:00
|
|
|
server_names_hash_bucket_size 64;
|
2023-03-15 20:26:44 +01:00
|
|
|
map $remote_addr $remote_addr_anon {
|
|
|
|
~(?P<ip>\d+\.\d+\.\d+)\. $ip.0;
|
|
|
|
~(?P<ip>[^:]*:[^:]*(:[^:]*)?): $ip::;
|
|
|
|
default ::;
|
|
|
|
}
|
|
|
|
log_format combined_anon '$remote_addr_anon - $remote_user [$time_local] '
|
|
|
|
'"$request" $status $body_bytes_sent '
|
|
|
|
'"$http_referer" "$http_user_agent"';
|
2023-03-15 21:00:23 +01:00
|
|
|
log_format vcombined_anon '$host: $remote_addr_anon - $remote_user [$time_local] '
|
|
|
|
'"$request" $status $body_bytes_sent '
|
|
|
|
'"$http_referer" "$http_user_agent"';
|
|
|
|
access_log /var/log/nginx/access.log vcombined_anon;
|
2022-09-28 22:09:16 +02:00
|
|
|
'';
|
|
|
|
|
2022-09-28 21:09:32 +02:00
|
|
|
virtualHosts = {
|
|
|
|
"default" = {
|
|
|
|
default = true;
|
2022-09-28 22:09:16 +02:00
|
|
|
rejectSSL = true;
|
2022-09-28 21:09:32 +02:00
|
|
|
locations."/" = {
|
|
|
|
return = ''200 "Some piece of infrastructure\n"'';
|
|
|
|
extraConfig = ''
|
|
|
|
types { } default_type "text/plain; charset=utf-8";
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
2021-02-21 21:40:05 +01:00
|
|
|
};
|
2023-03-15 22:50:46 +01:00
|
|
|
services.logrotate.settings.nginx = {
|
|
|
|
frequency = "daily";
|
|
|
|
maxage = 14;
|
|
|
|
};
|
2021-02-21 21:40:05 +01:00
|
|
|
|
2021-01-02 18:19:11 +01:00
|
|
|
security.acme = {
|
2022-02-25 10:58:42 +01:00
|
|
|
defaults.email = "letsencrypt@clerie.de";
|
2021-01-02 18:19:11 +01:00
|
|
|
acceptTerms = true;
|
|
|
|
};
|
|
|
|
|
2022-11-19 00:06:33 +01:00
|
|
|
nix.settings = {
|
|
|
|
experimental-features = [ "nix-command" "flakes" ];
|
|
|
|
substituters = [
|
|
|
|
"https://nix-cache.clerie.de"
|
|
|
|
];
|
|
|
|
trusted-public-keys = [
|
|
|
|
"nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g="
|
|
|
|
];
|
|
|
|
};
|
2022-09-29 17:49:25 +02:00
|
|
|
|
2023-02-25 03:06:08 +01:00
|
|
|
services.fstrim.enable = true;
|
|
|
|
|
2023-02-26 18:45:26 +01:00
|
|
|
clerie.nixfiles.enable = true;
|
|
|
|
|
2023-05-16 12:21:11 +02:00
|
|
|
clerie.backup = {
|
|
|
|
targets = {
|
|
|
|
cyan.serverName = "cyan.backup.clerie.de";
|
|
|
|
magenta.serverName = "magenta.backup.clerie.de";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2020-12-09 22:42:39 +01:00
|
|
|
nixpkgs.overlays = [
|
|
|
|
(import ../../pkgs/overlay.nix)
|
|
|
|
];
|
2020-12-06 16:40:47 +01:00
|
|
|
}
|