stuebinm
c09337c973
this replaces niv with nix flakes, attempting to preserve the old structure as much as possible. Notable caveats: - I'm not sure if flake inputs expose version information anywhere, so the version in pkgs/mattermost/default.nix is now hardcoded. Confusingly, this appears to trigger a rebuild. Maybe I've missed something. - a lot of the old-style host.nix & deploy.nix machinery in nix-hexchen does not work with flakes, and their newer replacements are not exposed by upstream; I've put basic imitations of the relevant parts in this repo - (in particular, directories in hosts/ won't become deployable configs automatically) - parts of the code are now probably more complicated than they'd have to be - old variables names were preserved; confusingly, this means the flake inputs are still called "sources"
84 lines
1.8 KiB
Nix
84 lines
1.8 KiB
Nix
{ config, lib, pkgs, modules, sources, ... }:
|
|
|
|
{
|
|
imports = [
|
|
../modules
|
|
./users.nix
|
|
modules.network.nftables
|
|
];
|
|
|
|
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages;
|
|
boot.kernelParams = [ "quiet" ];
|
|
|
|
networking.domain = lib.mkDefault "hacc.space";
|
|
|
|
services.journald.extraConfig = ''
|
|
SystemMaxUse=512M
|
|
MaxRetentionSec=48h
|
|
'';
|
|
nix.gc.automatic = lib.mkDefault true;
|
|
nix.gc.options = lib.mkDefault "--delete-older-than 1w";
|
|
nix.trustedUsers = [ "root" "@wheel" ];
|
|
environment.variables.EDITOR = "vim";
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
ports = lib.mkDefault [ 62954 ];
|
|
passwordAuthentication = false;
|
|
kbdInteractiveAuthentication = false;
|
|
permitRootLogin = lib.mkDefault "prohibit-password";
|
|
extraConfig = "StreamLocalBindUnlink yes";
|
|
forwardX11 = true;
|
|
};
|
|
programs.mosh.enable = true;
|
|
security.sudo.wheelNeedsPassword = lib.mkDefault false;
|
|
|
|
i18n.defaultLocale = "en_IE.UTF-8";
|
|
console = {
|
|
font = "Lat2-Terminus16";
|
|
keyMap = "de";
|
|
};
|
|
programs.mtr.enable = true;
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
smartmontools lm_sensors htop tcpdump nload iftop
|
|
bottom
|
|
ripgrep vgrep
|
|
git wget
|
|
kitty.terminfo
|
|
rsync pv progress
|
|
parallel bc
|
|
usbutils pciutils
|
|
cryptsetup gptfdisk
|
|
zstd p7zip
|
|
file
|
|
whois
|
|
iperf
|
|
fd
|
|
exa
|
|
socat
|
|
tmux
|
|
gnupg
|
|
vim neovim
|
|
patchelf
|
|
binutils
|
|
dnsutils
|
|
flashrom ifdtool cbfstool nvramtool
|
|
nmap
|
|
s-tui stress
|
|
ffmpeg-full
|
|
bat
|
|
niv
|
|
];
|
|
|
|
security.acme.defaults.email = "info+acme@hacc.space";
|
|
security.acme.acceptTerms = true;
|
|
|
|
services.nginx.appendHttpConfig = ''
|
|
access_log off;
|
|
add_header Permissions-Policy "interest-cohort=()";
|
|
'';
|
|
|
|
networking.nftables.enable = true;
|
|
}
|