haccfiles/common/default.nix

{ config, lib, pkgs, modules, ... }:

let
  sources = import ../nix/sources.nix;
in {
  imports = [
    ../modules
    ./users.nix
    (sources.home-manager + "/nixos")
    modules.network.nftables
  ];

  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages;
  boot.kernelParams = [ "quiet" ];

  networking.domain = lib.mkDefault "hacc.space";

  services.journald.extraConfig = ''
    SystemMaxUse=512M
    MaxRetentionSec=48h
  '';
  nix.gc.automatic = lib.mkDefault true;
  nix.gc.options = lib.mkDefault "--delete-older-than 1w";
  nix.trustedUsers = [ "root" "@wheel" ];
  environment.variables.EDITOR = "vim";

  services.openssh = {
    enable = true;
    ports = lib.mkDefault [ 62954 ];
    passwordAuthentication = false;
    challengeResponseAuthentication = false;
    permitRootLogin = lib.mkDefault "prohibit-password";
    extraConfig = "StreamLocalBindUnlink yes";
    forwardX11 = true;
  };
  security.sudo.wheelNeedsPassword = lib.mkDefault false;

  i18n.defaultLocale = "en_IE.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "de";
  };
  programs.mtr.enable = true;

  environment.systemPackages = with pkgs; [
    smartmontools lm_sensors htop tcpdump nload iftop
    bottom 
    ripgrep vgrep
    git wget
    kitty.terminfo
    rsync pv progress
    parallel bc
    usbutils pciutils
    cryptsetup gptfdisk
    zstd p7zip
    file
    whois
    iperf
    fd
    exa
    socat
    tmux
    gnupg
    vim neovim
    patchelf
    binutils
    dnsutils
    flashrom ifdtool cbfstool nvramtool
    nmap
    s-tui stress
    ffmpeg-full
    bat 
  ];

  security.acme.email = "info+acme@hacc.space";
  security.acme.acceptTerms = true;

  services.nginx.appendHttpConfig = ''
    access_log off;
    add_header Permissions-Policy "interest-cohort=()";
  '';

  networking.nftables.enable = true;
}