nixConfig/nixos/roles/default.nix

65 lines
1.3 KiB
Nix
Raw Normal View History

2023-11-07 23:47:14 +00:00
{
pkgs,
lib,
...
}: {
imports = [
./admins.nix
2024-10-13 11:45:11 +00:00
./nix.nix
2023-11-07 23:47:14 +00:00
./prometheusNodeExporter.nix
../modules/impermanence.nix
];
2023-11-07 23:47:14 +00:00
networking = {
firewall = {
# these shoud be default, but better make sure!
enable = true;
allowPing = true;
};
nftables.enable = true;
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
# hosts = # TODO write something to autogenerate ip adresses!
};
users = {
mutableUsers = false;
users.root.hashedPassword = "!";
};
2023-09-25 19:03:23 +00:00
2023-11-07 23:47:14 +00:00
impermanence.enable = true;
2023-09-28 15:12:34 +00:00
2023-11-07 23:47:14 +00:00
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
2023-09-30 15:19:33 +00:00
2023-11-07 23:47:14 +00:00
environment = {
systemPackages = builtins.attrValues {
inherit
(pkgs)
htop
lsof
tmux
btop
;
};
2023-09-30 15:19:33 +00:00
};
2023-11-07 23:47:14 +00:00
services = {
journald.extraConfig = "SystemMaxUse=5G";
2023-09-30 15:19:33 +00:00
2023-11-07 23:47:14 +00:00
nginx = {
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedTlsSettings = true;
};
2023-09-30 15:19:33 +00:00
2023-11-07 23:47:14 +00:00
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
2023-09-30 15:19:33 +00:00
};
2023-11-07 23:47:14 +00:00
#Prevent clock drift due to interaction problem with xen hardware clock
timesyncd.enable = lib.mkForce true;
2023-09-30 15:19:33 +00:00
};
2023-09-25 19:03:23 +00:00
}