2025-02-12 13:08:02 +10:00
|
|
|
{
|
|
|
|
|
pkgs,
|
|
|
|
|
inputs,
|
|
|
|
|
lib,
|
|
|
|
|
...
|
|
|
|
|
}: let
|
|
|
|
|
home-manager = builtins.fetchTarball {
|
2025-02-19 12:14:25 +10:00
|
|
|
url = "https://github.com/nix-community/home-manager/archive/release-24.11.tar.gz";
|
|
|
|
|
sha256 = "0c07xj74vsj37d3a8f98i9rhhhr99ckwlp45n40f0qkmigm3pk8s";
|
2025-02-12 13:08:02 +10:00
|
|
|
};
|
|
|
|
|
in {
|
2025-02-12 14:33:38 +10:00
|
|
|
# TODO:
|
2025-02-12 13:08:02 +10:00
|
|
|
# - add github:charmbracelet/soft-serve
|
|
|
|
|
# - add forgejo
|
|
|
|
|
|
|
|
|
|
imports = [
|
2025-02-12 14:33:38 +10:00
|
|
|
./hardware-configuration.nix
|
2025-02-19 12:14:25 +10:00
|
|
|
(import "${home-manager}/nixos")
|
|
|
|
|
#../../flakes/wishlist/wishlist.nix
|
2025-02-12 13:08:02 +10:00
|
|
|
#../modules/server/nginx.nix
|
|
|
|
|
#../modules/server/ssh.nix
|
|
|
|
|
#../modules/server/fail2ban.nix
|
|
|
|
|
];
|
|
|
|
|
|
2025-02-19 12:14:25 +10:00
|
|
|
# override wishlist with the new cool one!
|
|
|
|
|
#pkgs.config.packageOverrides = {
|
|
|
|
|
# wishlist = inputs.wishlist.packages.x86_64-linux.wishlist;
|
|
|
|
|
#};
|
|
|
|
|
|
2025-02-13 14:47:33 +10:00
|
|
|
nix.settings = {
|
|
|
|
|
# make wheel group trusted users allows my "ae" user
|
|
|
|
|
# to import packages not signed by a trusted key
|
|
|
|
|
# (aka super duper easier to remote deploy)
|
|
|
|
|
trusted-users = ["root" "@wheel"];
|
|
|
|
|
experimental-features = [
|
|
|
|
|
"nix-command"
|
|
|
|
|
"flakes"
|
|
|
|
|
];
|
|
|
|
|
};
|
2025-02-12 13:08:02 +10:00
|
|
|
|
|
|
|
|
time.timeZone = "Australia/Brisbane";
|
|
|
|
|
|
|
|
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
|
console = {
|
|
|
|
|
font = "Lat2-Terminus16";
|
|
|
|
|
keyMap = "us";
|
|
|
|
|
};
|
|
|
|
|
|
2025-02-12 14:33:38 +10:00
|
|
|
# colmena deployment configuration
|
|
|
|
|
deployment = {
|
|
|
|
|
targetHost = "imbored.dev";
|
|
|
|
|
targetUser = "ae";
|
2025-02-12 20:03:33 +10:00
|
|
|
targetPort = 22;
|
2025-02-19 12:14:25 +10:00
|
|
|
# the following line is unnecessary if using an ssh agent
|
|
|
|
|
#sshOptions = ["-i /home/me/.ssh/id_hyrule"];
|
2025-02-12 20:03:33 +10:00
|
|
|
#keys = {
|
|
|
|
|
# "imbored.dev" = {
|
|
|
|
|
# # text, keyCommand, or keyFile must be set
|
|
|
|
|
# # text = "";
|
|
|
|
|
# #keyCommand = [ "" ];
|
|
|
|
|
# keyFile = "/home/me/.ssh/id_hyrule";
|
|
|
|
|
# };
|
|
|
|
|
#};
|
2025-02-12 14:33:38 +10:00
|
|
|
buildOnTarget = false; # build locally then deploy
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# super duper minimum grub2 config
|
|
|
|
|
boot.loader.grub = {
|
|
|
|
|
enable = true;
|
|
|
|
|
device = "/dev/vda";
|
2025-02-12 13:08:02 +10:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
networking = {
|
2025-02-12 14:33:38 +10:00
|
|
|
hostName = "hyrule";
|
2025-02-12 13:08:02 +10:00
|
|
|
networkmanager.enable = true;
|
2025-02-12 14:33:38 +10:00
|
|
|
|
|
|
|
|
firewall = {
|
|
|
|
|
enable = true;
|
|
|
|
|
allowedTCPPorts = [
|
|
|
|
|
22 # sshd
|
|
|
|
|
80 # nginx
|
|
|
|
|
443 # nginx
|
2025-02-19 12:14:25 +10:00
|
|
|
2222 # wishlist
|
|
|
|
|
2035 # debug (for my job)
|
|
|
|
|
5000 # debug (for my job)
|
2025-02-12 14:33:38 +10:00
|
|
|
];
|
|
|
|
|
};
|
2025-02-12 13:08:02 +10:00
|
|
|
};
|
|
|
|
|
|
2025-02-13 14:47:33 +10:00
|
|
|
# grant passwordless sudo to wheel group
|
|
|
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
|
|
2025-02-12 13:08:02 +10:00
|
|
|
users = {
|
|
|
|
|
defaultUserShell = pkgs.bash;
|
|
|
|
|
|
|
|
|
|
users = {
|
|
|
|
|
# primary user
|
2025-02-12 14:33:38 +10:00
|
|
|
ae = {
|
2025-02-12 13:08:02 +10:00
|
|
|
isNormalUser = true;
|
2025-02-19 12:14:25 +10:00
|
|
|
extraGroups = ["wheel" "networkmanager" "docker"];
|
2025-02-12 13:08:02 +10:00
|
|
|
shell = pkgs.bash;
|
2025-02-12 14:33:38 +10:00
|
|
|
home = "/home/ae"; # TEMP: remove and replace with home-manager
|
2025-02-12 13:08:02 +10:00
|
|
|
packages = with pkgs; [
|
|
|
|
|
];
|
|
|
|
|
};
|
|
|
|
|
|
2025-02-19 12:14:25 +10:00
|
|
|
subspace = let
|
|
|
|
|
# override
|
|
|
|
|
wishlistBash =
|
|
|
|
|
pkgs.bash.override {
|
|
|
|
|
};
|
|
|
|
|
in {
|
|
|
|
|
isNormalUser = true;
|
|
|
|
|
shell = pkgs.bash;
|
|
|
|
|
home = "/home/subspace";
|
|
|
|
|
packages = with pkgs; [
|
|
|
|
|
wishlist
|
|
|
|
|
];
|
|
|
|
|
};
|
|
|
|
|
|
2025-02-12 13:08:02 +10:00
|
|
|
# user for friends to ssh into
|
|
|
|
|
friends = {
|
|
|
|
|
isNormalUser = true;
|
|
|
|
|
shell = pkgs.bash;
|
2025-02-12 14:33:38 +10:00
|
|
|
home = "/home/friends"; # TEMP: remove and replace with home-manager
|
2025-02-12 13:08:02 +10:00
|
|
|
packages = with pkgs; [
|
|
|
|
|
];
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2025-02-19 12:14:25 +10:00
|
|
|
virtualisation.docker.enable = true;
|
|
|
|
|
|
|
|
|
|
home-manager = {
|
|
|
|
|
users = {
|
|
|
|
|
ae = import ../../homes/ae;
|
|
|
|
|
subspace = import ../../homes/subspace;
|
|
|
|
|
};
|
|
|
|
|
sharedModules = [];
|
|
|
|
|
};
|
|
|
|
|
|
2025-02-12 14:33:38 +10:00
|
|
|
services = {
|
|
|
|
|
# simple nginx instance to host static construction page
|
|
|
|
|
nginx = {
|
|
|
|
|
enable = true;
|
|
|
|
|
|
|
|
|
|
# package = pkgs.nginxStable.override { openssl = pkgs.libressl; };
|
|
|
|
|
|
|
|
|
|
#virtualHosts."imbored.dev".locations."/" = {
|
|
|
|
|
virtualHosts."imbored.dev" = {
|
|
|
|
|
addSSL = true;
|
|
|
|
|
enableACME = true;
|
|
|
|
|
root = "/var/www/imbored";
|
|
|
|
|
#index = "index.html";
|
|
|
|
|
#root = pkgs.writeTextDir "index.html" ''
|
|
|
|
|
# <html>
|
|
|
|
|
# <body>
|
|
|
|
|
# Give me your mittens!
|
|
|
|
|
# </body>
|
|
|
|
|
# </html>
|
|
|
|
|
#'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
openssh = {
|
|
|
|
|
enable = true;
|
|
|
|
|
ports = [22];
|
|
|
|
|
settings = {
|
|
|
|
|
PasswordAuthentication = true;
|
|
|
|
|
PermitRootLogin = "no";
|
2025-02-19 12:14:25 +10:00
|
|
|
AllowUsers = ["ae" "subspace"]; # allow all users by default
|
2025-02-12 14:33:38 +10:00
|
|
|
UseDns = true;
|
|
|
|
|
X11Forwarding = false;
|
|
|
|
|
};
|
|
|
|
|
};
|
2025-02-19 12:14:25 +10:00
|
|
|
|
|
|
|
|
#wishlist = {
|
|
|
|
|
# enable = true;
|
|
|
|
|
#};
|
2025-02-12 14:33:38 +10:00
|
|
|
};
|
|
|
|
|
# accept Lets Encrypt's security policy (for nginx)
|
|
|
|
|
security.acme = {
|
|
|
|
|
acceptTerms = true;
|
|
|
|
|
defaults.email = "eclarkboman@gmail.com";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
|
|
|
vim
|
|
|
|
|
helix
|
2025-02-19 12:14:25 +10:00
|
|
|
|
|
|
|
|
#wishlist
|
2025-02-12 13:08:02 +10:00
|
|
|
];
|
|
|
|
|
|
|
|
|
|
programs = {
|
2025-02-13 14:47:33 +10:00
|
|
|
fish.enable = true;
|
|
|
|
|
|
|
|
|
|
bash = {
|
|
|
|
|
interactiveShellInit = ''
|
|
|
|
|
if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
|
|
|
|
|
then
|
|
|
|
|
shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
|
|
|
|
|
exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
|
|
|
|
|
fi
|
|
|
|
|
'';
|
|
|
|
|
};
|
2025-02-12 13:08:02 +10:00
|
|
|
};
|
2025-02-12 14:33:38 +10:00
|
|
|
|
2025-02-19 12:14:25 +10:00
|
|
|
#systemd.services.wishlist = {
|
|
|
|
|
# description = "Single entrypoint for multiple SSH endpoints";
|
|
|
|
|
# wantedBy = ["multi-user.target"];
|
|
|
|
|
#
|
|
|
|
|
# serviceConfig = {
|
|
|
|
|
# DynamicUser = "yes";
|
|
|
|
|
# ExecStart = "${pkgs.wishlist}/bin/wishlist serve --config /home/$USER/.ssh/config";
|
|
|
|
|
# Restart = "always";
|
|
|
|
|
# RestartSec = "2s";
|
|
|
|
|
# };
|
|
|
|
|
#};
|
|
|
|
|
|
2025-02-12 14:33:38 +10:00
|
|
|
system.stateVersion = "24.11"; # DO NOT MODIFY
|
2025-02-12 13:08:02 +10:00
|
|
|
}
|
