added actual hardware identifiers & atual network config

nixos/machines/nyarlathotep/boot.nix

@@ -0,0 +1,8 @@
+{
+  imports = [ ];
+  boot.loader.grub = {
+    device = "nodev";
+    enable = true;
+  };
+}
+

nixos/machines/nyarlathotep/configuration.nix

@@ -0,0 +1,15 @@
+flake-inputs:
+{config, pkgs, lib, ... }: {
+
+imports = [
+  ./hardware-configuration.nix
+  (import ./mail.nix flake-inputs)
+  ../../roles
+  ./boot.nix
+  ./network.nix
+];
+
+# System configuration here
+
+  system.stateVersion = "23.11";
+}

nixos/machines/nyarlathotep/hardware-configuration.nix

@@ -0,0 +1,24 @@
+{config, lib, pkgs, modulesPath, ...}: {
+  imports = [ ];
+
+  boot.initrd.availableKernelModules =
+    [ "ata_piix" "sr_mod" "xen_bklfront" ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/a72da670-f631-49b1-bcb3-6d378cc1f2d0";
+    fsType = "ext4";
+  };
+  fileSystems."/var/mail" = {
+    device = "/dev/disk/by-uuid/23c44c93-5035-4e29-9e46-75c1c08f4cea";
+    fsType = "ext4";
+  };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/8bc30d17-3c08-4648-ab18-8c723523be1a"; }];
+
+  nix.settings.max-jobs = lib.mkDefault 4;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

nixos/machines/nyarlathotep/mail.nix

@@ -0,0 +1,46 @@
+flake-inputs:
+{pkgs, config, lib, ...}: {
+  imports = [flake-inputs.nixos-mailserver.nixosModule];
+
+  mailserver = {
+    enable = true;
+    debug = true; # TODO disable
+    fqdn = "mathebau.de";
+    sendingFqdn = "fb04184.mathematik.tu-darmstadt.de";
+    domains = [
+      "mathebau.de"
+      "lists.mathebau.de"
+    ];
+    # forwards = #TODO
+    # loginAccounts = #TODO
+    # extraVirtualAliases = # TODO # only for local things (maybe don't use?)
+    certificateDomains = ["imap.mathebau.de"];
+    # certificateScheme = "manual"; # Do we need CERTS? We don't want to run a webmailer YES IMAP!!
+    #	certificateFile = #TODO
+    # keyFile = #TODO
+
+    enableSubmission = false; # no starttls smtp
+
+    # Fun dovecot stuff :
+
+    mailDirectory = "/var/mail/vmail/"; # directory to store mail
+     
+    hierarchySeparator = "/"; # seperator for imap mailboxes from client view
+
+    # Caching of search indices
+    indexDir = "/var/mail/lib/dovecot/indices";
+    fullTextSearch = {
+      enforced = "body"; # only brute force headers if no search index is available
+    };
+    lmtpSaveToDetailMailbox = "no";
+    # no starttls
+    enableImap = false;
+
+
+    # TODO checkout redis `config.services.redis.servers.rspamd.`
+
+    # TODO
+    # borgbackup = {
+    # };
+  };
+}

nixos/machines/nyarlathotep/network.nix

@@ -0,0 +1,15 @@
+# We sohuld put that config somewhere in roles and give it a parameter or something,
+# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
+# depend on the same thing 
+{
+  imports = [ ];
+  networking = {
+    interfaces.enX0.ipv4.addresses = [ {
+      addresses = "192.168.0.28";
+      prefixLength = 16;
+    } ];
+    defaultGateway = "192.168.0.155";
+    nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
+  };
+}
+

nixos/roles/admins.nix

@@ -0,0 +1,30 @@
+{lib, ...} :
+with lib;
+
+let
+  admins = {
+    nerf = {
+      hashedPassword =
+        "$6$rounds=424242$FaEtIXMUScxgAYyF$Fl8GbPFgiEv.1iwrhtVpTixG1BTJys3aIfLyTzocQYZV4JymrYEXtnyCTURmVDe8stxbxgDutmtlyElfn1DQc/";
+        keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDGDe2GHC3ZUxwxWawLlKa3DRSHG1Cer5JL3ctc3GcRn nerf@nerflap2"
+        ];
+    };
+  };
+
+  mkAdmin = name :
+  {hashedPassword, keys}: {
+    "${name}" = {
+      isNormalUser = true;
+      createHome = true;
+      extraGroups = [ "wheel" ];
+      group = "users";
+      home = "/home/${name}";
+      openssh.authorizedKeys = { inherit keys; };
+      inherit hashedPassword;
+    };
+  };
+
+in {
+  users.users = mkMerge (mapAttrsToList mkAdmin admins);
+}

nixos/roles/default.nix

@@ -0,0 +1,49 @@
+{pkgs, config, lib, ...} : {
+
+imports = [ ./admins.nix ];
+nix = {
+  extraOptions = ''
+    experimental-features = nix-command flakes
+    builders-use-substitutes = true
+  '';
+};
+
+networking = {
+  firewall = { # these shoud be default, but better make sure!
+    enable = true;
+    allowPing = true;
+  };
+  nftables.enable = true;
+  useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
+  # hosts = # TODO write something to autogenerate ip adresses!
+};
+
+users = {
+  mutableUsers = false;
+};
+
+environment = {
+  systemPackages = builtins.attrValues {
+    inherit (pkgs)
+      htop lsof tmux btop;
+  };
+};
+
+services = {
+  journald.extraConfig = "SystemMaxUse=5G";
+
+  nginx = {
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+    };
+  };
+};
+}