50 lines
962 B
Nix
50 lines
962 B
Nix
|
{pkgs, config, lib, ...} : {
|
||
|
|
|
||
|
|
imports = [ ./admins.nix ];
|
||
|
|
nix = {
|
||
|
|
extraOptions = ''
|
||
|
|
experimental-features = nix-command flakes
|
||
|
|
builders-use-substitutes = true
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
networking = {
|
||
|
|
firewall = { # these shoud be default, but better make sure!
|
||
|
|
enable = true;
|
||
|
|
allowPing = true;
|
||
|
|
};
|
||
|
|
nftables.enable = true;
|
||
|
|
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
|
||
|
|
# hosts = # TODO write something to autogenerate ip adresses!
|
||
|
|
};
|
||
|
|
|
||
|
|
users = {
|
||
|
|
mutableUsers = false;
|
||
|
|
};
|
||
|
|
|
||
|
|
environment = {
|
||
|
|
systemPackages = builtins.attrValues {
|
||
|
|
inherit (pkgs)
|
||
|
|
htop lsof tmux btop;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
services = {
|
||
|
|
journald.extraConfig = "SystemMaxUse=5G";
|
||
|
|
|
||
|
|
nginx = {
|
||
|
|
recommendedOptimisation = true;
|
||
|
|
recommendedGzipSettings = true;
|
||
|
|
recommendedTlsSettings = true;
|
||
|
|
};
|
||
|
|
|
||
|
|
openssh = {
|
||
|
|
enable = true;
|
||
|
|
settings = {
|
||
|
|
PermitRootLogin = "no";
|
||
|
|
PasswordAuthentication = false;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|