{ config, pkgs, lib, ... }: { imports = [ ../../modules ]; networking.domain = "net.clerie.de"; networking.firewall.logRefusedConnections = lib.mkDefault false; time.timeZone = "Europe/Berlin"; i18n.defaultLocale = "en_US.UTF-8"; console = { keyMap = "de-latin1"; }; security.sudo.wheelNeedsPassword = false; nix.settings = { trusted-users = [ "@wheel" ]; auto-optimise-store = true; }; environment.systemPackages = with pkgs; [ gptfdisk htop parted tmux colmena vim agenix ]; programs.mtr.enable = true; programs.git.enable = true; programs.git.config = { user = { name = "clerie"; email = "git@clerie.de"; }; }; services.openssh.enable = true; services.openssh.settings = { PasswordAuthentication = false; KbdInteractiveAuthentication = false; PermitRootLogin = lib.mkDefault "no"; }; nix.gc = lib.mkDefault { automatic = true; dates = "weekly"; options = "--delete-older-than 30d"; }; services.nginx = { enableReload = true; recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; commonHttpConfig = '' server_names_hash_bucket_size 64; map $remote_addr $remote_addr_anon { ~(?P\d+\.\d+\.\d+)\. $ip.0; ~(?P[^:]*:[^:]*(:[^:]*)?): $ip::; default ::; } log_format combined_anon '$remote_addr_anon - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"'; log_format vcombined_anon '$host: $remote_addr_anon - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"'; access_log /var/log/nginx/access.log vcombined_anon; ''; virtualHosts = { "default" = { default = true; rejectSSL = true; locations."/" = { return = ''200 "Some piece of infrastructure\n"''; extraConfig = '' types { } default_type "text/plain; charset=utf-8"; ''; }; }; }; }; services.logrotate.settings.nginx = { frequency = "daily"; maxage = 14; }; security.acme = { defaults.email = "letsencrypt@clerie.de"; acceptTerms = true; }; nix.settings = { experimental-features = [ "nix-command" "flakes" ]; substituters = [ "https://nix-cache.clerie.de" ]; trusted-public-keys = [ "nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g=" ]; }; # Pin current nixpkgs channel and flake registry to the nixpkgs version # the host got build with nix.nixPath = lib.mkForce [ "nixpkgs=${lib.cleanSource pkgs.path}" ]; nix.registry = { "nixpkgs" = { from = { type = "indirect"; id = "nixpkgs"; }; to = { type = "path"; path = lib.cleanSource pkgs.path; }; exact = true; }; }; services.fstrim.enable = true; clerie.nixfiles.enable = true; clerie.backup = { targets = { cyan.serverName = "cyan.backup.clerie.de"; magenta.serverName = "magenta.backup.clerie.de"; }; }; nixpkgs.overlays = [ (import ../../pkgs/overlay.nix) ]; }