Fachschaft/nixConfig
6
2
Fork 2
Code Issues 10 Pull requests 2 Projects Wiki Activity

linting and formatting existing code

Browse source
This commit is contained in:
Dennis Frieberg 2023-11-08 00:47:14 +01:00
parent 0dd73e6adb
commit 238faa3e89
Signed by: nerf
GPG key ID: 42DED0E2D8F04FB6
12 changed files with 202 additions and 183 deletions
Download patch file Download diff file Expand all files Collapse all files

122
nixos/roles/default.nix
View file

@ -1,62 +1,72 @@
{pkgs, config, lib, modulesPath, ...} : {
imports = [
./admins.nix
./nix_keys.nix
./prometheusNodeExporter.nix
(modulesPath + "/virtualisation/xen-domU.nix")
../modules/impermanence.nix
{
pkgs,
lib,
modulesPath,
...
}: {
imports = [
./admins.nix
./nix_keys.nix
./prometheusNodeExporter.nix
(modulesPath + "/virtualisation/xen-domU.nix")
../modules/impermanence.nix
];
nix = {
extraOptions = ''
experimental-features = nix-command flakes
builders-use-substitutes = true
'';
};
networking = {
firewall = { # these shoud be default, but better make sure!
enable = true;
allowPing = true;
};
nftables.enable = true;
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
# hosts = # TODO write something to autogenerate ip adresses!
};
users = {
mutableUsers = false;
users.root.hashedPassword = "!";
};
impermanence.enable = true;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
environment = {
systemPackages = builtins.attrValues {
inherit (pkgs)
htop lsof tmux btop;
};
};
services = {
journald.extraConfig = "SystemMaxUse=5G";
nginx = {
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedTlsSettings = true;
nix = {
extraOptions = ''
experimental-features = nix-command flakes
builders-use-substitutes = true
'';
};
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
networking = {
firewall = {
# these shoud be default, but better make sure!
enable = true;
allowPing = true;
};
nftables.enable = true;
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
# hosts = # TODO write something to autogenerate ip adresses!
};
users = {
mutableUsers = false;
users.root.hashedPassword = "!";
};
impermanence.enable = true;
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
environment = {
systemPackages = builtins.attrValues {
inherit
(pkgs)
htop
lsof
tmux
btop
;
};
};
#Prevent clock drift due to interaction problem with xen hardware clock
timesyncd.enable = lib.mkForce true;
};
services = {
journald.extraConfig = "SystemMaxUse=5G";
nginx = {
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedTlsSettings = true;
};
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
};
#Prevent clock drift due to interaction problem with xen hardware clock
timesyncd.enable = lib.mkForce true;
};
}