updated README

.gitignore

@@ -2,4 +2,4 @@
 # Ignore build outputs from performing a nix-build or `nix build` command
 result
 result-*
-
+.pre-commit-config.yaml

README.md

@@ -170,6 +170,10 @@ In your hardware
 configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff
 is already taken care of by `../../roles`.
 
+The `flake-inputs` argument is optional, but you can use it if you need to get a hold of the flake inputs,
+else this is a complete normal nixos system configuration module (with a lot of settings already imorted
+from `../../roles`).
+
 As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
 this is constant across all systems and will undergo refactor soon.
 

flake-module.nix

@@ -1,28 +1,48 @@
-{inputs, ...}:
-{
+{inputs, ...}: {
   # debug = true;
   # We only define machines config in this flake yet, so we only include
   # the module that builds these. This file might get fuller, if we need to
   # build our own packages, that are not flakes.
-  imports = [ ./nixos/flake-module.nix
-        # To import a flake module
-        # 1. Add foo to inputs
-        # 2. Add foo as a parameter to the outputs function
-        # 3. Add here: foo.flakeModule
-
+  imports = [
+    ./nixos/flake-module.nix
+    inputs.pre-commit-hooks.flakeModule
+    # To import a flake module
+    # 1. Add foo to inputs
+    # 2. Add foo as a parameter to the outputs function
+    # 3. Add here: foo.flakeModule
   ];
-  systems = [ "x86_64-linux"];
-#  perSystem = { config, self', inputs', pkgs, system, ... }: {
-  # Per-system attributes can be defined here. The self' and inputs'
-  # module parameters provide easy access to attributes of the same
-  # system.
+  systems = ["x86_64-linux"];
+  perSystem = {
+    config,
+    inputs',
+    pkgs,
+    ...
+  }: {
+    devShells.default = pkgs.mkShell {
+      shellHook = config.pre-commit.installationScript;
+    };
+
+    pre-commit = {
+      check.enable = true;
+      pkgs = inputs'.nixpkgs.legacyPackages;
+      settings.hooks = {
+        nil.enable = true;
+        statix.enable = true;
+        deadnix.enable = true;
+        alejandra.enable = true;
+      };
+    };
+
+    # Per-system attributes can be defined here. The self' and inputs'
+    # module parameters provide easy access to attributes of the same
+    # system.
+  };
 
   # Equivalent to  inputs'.nixpkgs.legacyPackages.hello;
-#  };
-#      flake = {
-        # The usual flake attributes can be defined here, including system-
-        # agnostic ones like nixosModule and system-enumerating ones, although
-        # those are more easily expressed in perSystem.
+  #      flake = {
+  # The usual flake attributes can be defined here, including system-
+  # agnostic ones like nixosModule and system-enumerating ones, although
+  # those are more easily expressed in perSystem.
 
-#      };
+  #      };
 }

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1685662779,
-        "narHash": "sha256-cKDDciXGpMEjP1n6HlzKinN0H+oLmNpgeCTzYnsA2po=",
+        "lastModified": 1698882062,
+        "narHash": "sha256-HkhafUayIqxXyHH1X8d9RDl1M2CkFgZLjKD3MzabiEo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "71fb97f0d875fd4de4994dfb849f2c75e17eb6c3",
+        "rev": "8c9fa2545007b49a5db5f650ae91f227672c3877",
         "type": "github"
       },
       "original": {
@@ -33,13 +33,31 @@
         "type": "indirect"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1685518550,
+        "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "impermanence": {
       "locked": {
-        "lastModified": 1694622745,
-        "narHash": "sha256-z397+eDhKx9c2qNafL1xv75lC0Q4nOaFlhaU1TINqb8=",
+        "lastModified": 1697303681,
+        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "e9643d08d0d193a2e074a19d4d90c67a874d932e",
+        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
         "type": "github"
       },
       "original": {
@@ -54,14 +72,15 @@
         "flake-compat": [],
         "nixpkgs": [],
         "nixpkgs-22_11": "nixpkgs-22_11",
+        "nixpkgs-23_05": "nixpkgs-23_05",
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1686468558,
-        "narHash": "sha256-K69Ojlx3N8I6tRTZsrKFMIqK4yrnJ6/PjfKZi3wchYg=",
-        "ref": "refs/heads/master",
-        "rev": "290d00f6db4e80467013728819ad73dd4a394d9a",
-        "revCount": 554,
+        "lastModified": 1695910380,
+        "narHash": "sha256-CyzeiXQGm8ceEOSK1dffBCfO7JNp8XhQeNkUiJ5HxgY=",
+        "ref": "master",
+        "rev": "84783b661ecf33927c534b6476beb74ea3308968",
+        "revCount": 572,
         "type": "git",
         "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git"
       },
@@ -72,11 +91,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1686412476,
-        "narHash": "sha256-inl9SVk6o5h75XKC79qrDCAobTD1Jxh6kVYTZKHzewA=",
+        "lastModified": 1699099776,
+        "narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "21951114383770f96ae528d0ae68824557768e81",
+        "rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
         "type": "github"
       },
       "original": {
@@ -101,14 +120,29 @@
         "type": "indirect"
       }
     },
+    "nixpkgs-23_05": {
+      "locked": {
+        "lastModified": 1684782344,
+        "narHash": "sha256-SHN8hPYYSX0thDrMLMWPWYulK3YFgASOrCsIL3AJ78g=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8966c43feba2c701ed624302b6a935f97bcbdf88",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-23.05",
+        "type": "indirect"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "dir": "lib",
-        "lastModified": 1685564631,
-        "narHash": "sha256-8ywr3AkblY4++3lIVxmrWZFzac7+f32ZEhH/A8pNscI=",
+        "lastModified": 1698611440,
+        "narHash": "sha256-jPjHjrerhYDy3q9+s5EAsuhyhuknNfowY6yt6pjn9pc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4f53efe34b3a8877ac923b9350c874e3dcd5dc0a",
+        "rev": "0cbe9f69c234a7700596e943bfae7ef27a31b735",
         "type": "github"
       },
       "original": {
@@ -121,11 +155,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1694908564,
-        "narHash": "sha256-ducA98AuWWJu5oUElIzN24Q22WlO8bOfixGzBgzYdVc=",
+        "lastModified": 1699110214,
+        "narHash": "sha256-L2TU4RgtiqF69W8Gacg2jEkEYJrW+Kp0Mp4plwQh5b8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "596611941a74be176b98aeba9328aa9d01b8b322",
+        "rev": "78f3a4ae19f0e99d5323dd2e3853916b8ee4afee",
         "type": "github"
       },
       "original": {
@@ -135,12 +169,35 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": [],
+        "flake-utils": "flake-utils",
+        "gitignore": [],
+        "nixpkgs": [],
+        "nixpkgs-stable": []
+      },
+      "locked": {
+        "lastModified": 1699271226,
+        "narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "flake-parts": "flake-parts",
         "impermanence": "impermanence",
         "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": "nixpkgs",
+        "pre-commit-hooks": "pre-commit-hooks",
         "sops-nix": "sops-nix"
       }
     },
@@ -152,11 +209,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1695284550,
-        "narHash": "sha256-z9fz/wz9qo9XePEvdduf+sBNeoI9QG8NJKl5ssA8Xl4=",
+        "lastModified": 1699252567,
+        "narHash": "sha256-WCzEBCu17uXilT9OZ3XSy/c4Gk/j3L7AUxBRHzNlQ4Y=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2f375ed8702b0d8ee2430885059d5e7975e38f78",
+        "rev": "0a9d5e41f6013a1b8b66573822f9beb827902968",
         "type": "github"
       },
       "original": {
@@ -165,6 +222,21 @@
         "type": "github"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "utils": {
       "locked": {
         "lastModified": 1605370193,

flake.nix

@@ -17,8 +17,17 @@
     impermanence = {
       url = "github:nix-community/impermanence";
     };
+    pre-commit-hooks = {
+      url = "github:cachix/pre-commit-hooks.nix";
+      inputs = {
+        flake-compat.follows = "";
+        gitignore.follows = "";
+        nixpkgs-stable.follows = "";
+        nixpkgs.follows = "";
+      };
+    };
   };
 
-  outputs = inputs@{ flake-parts, ... }:
-    flake-parts.lib.mkFlake { inherit inputs; } (import ./flake-module.nix);
+  outputs = inputs @ {flake-parts, ...}:
+    flake-parts.lib.mkFlake {inherit inputs;} (import ./flake-module.nix);
 }

nixos/flake-module.nix

@@ -1,20 +1,30 @@
 # copied and adopted from maralorns config
-
 # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
 # and exposes them as outputs.nixosConfigurations.${name}
-{ withSystem, lib, inputs, ... }: {
+{
+  withSystem,
+  lib,
+  inputs,
+  ...
+}: {
   flake = {
-    nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
-    let
+    nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
       machines = builtins.attrNames (builtins.readDir ./machines);
-      makeSystem = name:
+      makeSystem = name: let
+        importedModule = import (./. + "/machines/${name}/configuration.nix");
+        configModule =
+          if lib.isFunction importedModule
+          then importedModule inputs
+          else importedModule;
+      in
         pkgs.nixos {
           imports = [
-            (import (./. + "/machines/${name}/configuration.nix") inputs)
+            configModule
             inputs.sops-nix.nixosModules.sops
             inputs.impermanence.nixosModules.impermanence
           ];
         };
-    in lib.genAttrs machines makeSystem);
+    in
+      lib.genAttrs machines makeSystem);
   };
 }

nixos/machines/ghatanothoa/configuration.nix

@@ -1,19 +1,17 @@
-flake-inputs:
-{config, pkgs, lib, ... }: {
-
-imports = [
-  ./hardware-configuration.nix
-  ../../modules/jitsi.nix
-  ../../roles
-  ./network.nix
-];
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/jitsi.nix
+    ../../roles
+    ./network.nix
+  ];
 
   services.mathebau-jitsi = {
     enable = true;
     hostName = "meet.mathebau.de";
   };
 
-# System configuration here
+  # System configuration here
   networking.hostName = "ghatanothoa";
   system.stateVersion = "23.11";
 }

nixos/machines/ghatanothoa/hardware-configuration.nix

@@ -1,15 +1,15 @@
-{config, lib, pkgs, modulesPath, ...}: {
-  imports = [ ];
+{lib, ...}: {
+  imports = [];
 
   fileSystems."/" = {
     device = "gha-root";
     fsType = "tmpfs";
-    options = [ "size=1G" "mode=755" ];
+    options = ["size=1G" "mode=755"];
   };
   fileSystems."/persist" = {
     device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
     fsType = "btrfs";
-    options = [ "subvol=persist" ];
+    options = ["subvol=persist"];
     neededForBoot = true;
   };
   fileSystems."/boot" = {
@@ -19,11 +19,10 @@
   fileSystems."/nix" = {
     device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
     fsType = "btrfs";
-    options = [ "subvol=nix" ];
+    options = ["subvol=nix"];
   };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
+  swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
 
   nix.settings.max-jobs = lib.mkDefault 4;
 

nixos/machines/ghatanothoa/network.nix

@@ -1,15 +1,16 @@
 # We sohuld put that config somewhere in roles and give it a parameter or something,
 # everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
-# depend on the same thing 
+# depend on the same thing
 {
-  imports = [ ];
+  imports = [];
   networking = {
-    interfaces.enX0.ipv4.addresses = [ {
-      address = "192.168.0.25";
-      prefixLength = 16;
-    } ];
+    interfaces.enX0.ipv4.addresses = [
+      {
+        address = "192.168.0.25";
+        prefixLength = 16;
+      }
+    ];
     defaultGateway = "192.168.0.152";
     nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
   };
 }
-

nixos/modules/impermanence.nix

@@ -1,47 +1,47 @@
-{lib, config, ...} :
-
-let 
-  inherit (lib)
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit
+    (lib)
     mkEnableOption
     mkIf
     mkOption
     types
     ;
   cfg = config.impermanence;
-in
+in {
+  imports = [];
 
-{
-imports = [ ];
-
-options.impermanence = {
-  enable = mkEnableOption "impermanence";
-  storagePath = mkOption {
-    type = types.path;
-    default = "/persist";
-    description = "The path where persistent data is stored";
+  options.impermanence = {
+    enable = mkEnableOption "impermanence";
+    storagePath = mkOption {
+      type = types.path;
+      default = "/persist";
+      description = "The path where persistent data is stored";
+    };
+    name = mkOption {
+      type = types.str;
+      default = "persist";
+      description = "the name of the persistent data store";
+    };
   };
-  name = mkOption {
-    type = types.str;
-    default = "persist";
-    description = "the name of the persistent data store";
-  };
-};
 
-config = mkIf cfg.enable {
-  environment.persistence.${cfg.name} = {
-    persistentStoragePath = cfg.storagePath;
-    directories = [
-      "/var/log"
-      "/var/lib/nixos"
-    ];
-    files = [
-      "/etc/ssh/ssh_host_ed25519_key"
-      "/etc/ssh/ssh_host_ed25519_key.pub"
-      "/etc/ssh/ssh_host_rsa_key"
-      "/etc/ssh/ssh_host_rsa_key.pub"
-    ];
+  config = mkIf cfg.enable {
+    environment.persistence.${cfg.name} = {
+      persistentStoragePath = cfg.storagePath;
+      directories = [
+        "/var/log"
+        "/var/lib/nixos"
+      ];
+      files = [
+        "/etc/ssh/ssh_host_ed25519_key"
+        "/etc/ssh/ssh_host_ed25519_key.pub"
+        "/etc/ssh/ssh_host_rsa_key"
+        "/etc/ssh/ssh_host_rsa_key.pub"
+      ];
+    };
+    environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
   };
-  environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
-};
-
 }

nixos/modules/jitsi.nix

@@ -1,16 +1,21 @@
-{pkgs, config, lib, modulesPath, ...}:
-let 
-  inherit (lib)
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}: let
+  inherit
+    (lib)
     mkIf
     mkEnableOption
     mkOption
-    head;
+    head
+    ;
   inherit (lib.types) str;
   cfg = config.services.mathebau-jitsi;
-in
-{
+in {
   imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
-  
+
   options.services.mathebau-jitsi = {
     enable = mkEnableOption "mathebau jitsi service";
     hostName = mkOption {
@@ -25,16 +30,16 @@ in
   config = mkIf cfg.enable {
     services.jitsi-meet = {
       enable = true;
-      hostName = cfg.hostName;
       config = {
         defaultLang = "de";
       };
+      inherit (cfg) hostName;
     };
     services.jitsi-videobridge = {
       openFirewall = true;
       nat = {
         publicAddress = "130.83.2.184";
-        localAddress = cfg.localAddress;
+        inherit (cfg) localAddress;
       };
     };
     environment.persistence.${config.impermanence.name} = {
@@ -43,13 +48,13 @@ in
         "/var/lib/prosody"
       ];
     };
-  #We are behind a reverse proxy that handles TLS
+    #We are behind a reverse proxy that handles TLS
     services.nginx.virtualHosts."${cfg.hostName}" = {
       enableACME = false;
       forceSSL = false;
     };
 
-  #The network ports for HTTP(S) are not opened automatically
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    #The network ports for HTTP(S) are not opened automatically
+    networking.firewall.allowedTCPPorts = [80 443];
   };
 }

nixos/roles/admins.nix

@@ -1,37 +1,34 @@
-{lib, ...} :
-with lib;
-
-let
+{lib, ...}:
+with lib; let
   admins = {
     nerf = {
-      hashedPassword =
-        "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
-        keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
-        ];
+      hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
+      keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
+      ];
     };
     gonne = {
-      hashedPassword =
-        "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
-        keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
-        ];
+      hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
+      keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
+      ];
     };
   };
 
-  mkAdmin = name :
-  {hashedPassword, keys}: {
+  mkAdmin = name: {
+    hashedPassword,
+    keys,
+  }: {
     "${name}" = {
       isNormalUser = true;
       createHome = true;
-      extraGroups = [ "wheel" ];
+      extraGroups = ["wheel"];
       group = "users";
       home = "/home/${name}";
-      openssh.authorizedKeys = { inherit keys; };
+      openssh.authorizedKeys = {inherit keys;};
       inherit hashedPassword;
     };
   };
-
 in {
   users.users = mkMerge (mapAttrsToList mkAdmin admins);
 }

nixos/roles/default.nix

@@ -1,62 +1,72 @@
-{pkgs, config, lib, modulesPath, ...} : {
-
-imports = [
-  ./admins.nix
-  ./nix_keys.nix
-  ./prometheusNodeExporter.nix
-  (modulesPath + "/virtualisation/xen-domU.nix")
-  ../modules/impermanence.nix
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    ./admins.nix
+    ./nix_keys.nix
+    ./prometheusNodeExporter.nix
+    (modulesPath + "/virtualisation/xen-domU.nix")
+    ../modules/impermanence.nix
   ];
-nix = {
-  extraOptions = ''
-    experimental-features = nix-command flakes
-    builders-use-substitutes = true
-  '';
-};
-
-networking = {
-  firewall = { # these shoud be default, but better make sure!
-    enable = true;
-    allowPing = true;
-  };
-  nftables.enable = true;
-  useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
-  # hosts = # TODO write something to autogenerate ip adresses!
-};
-
-users = {
-  mutableUsers = false;
-  users.root.hashedPassword = "!";
-};
-
-impermanence.enable = true;
-
-sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-
-environment = {
-  systemPackages = builtins.attrValues {
-    inherit (pkgs)
-      htop lsof tmux btop;
-  };
-};
-
-services = {
-  journald.extraConfig = "SystemMaxUse=5G";
-
-  nginx = {
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
+  nix = {
+    extraOptions = ''
+      experimental-features = nix-command flakes
+      builders-use-substitutes = true
+    '';
   };
 
-  openssh = {
-    enable = true;
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
+  networking = {
+    firewall = {
+      # these shoud be default, but better make sure!
+      enable = true;
+      allowPing = true;
+    };
+    nftables.enable = true;
+    useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
+    # hosts = # TODO write something to autogenerate ip adresses!
+  };
+
+  users = {
+    mutableUsers = false;
+    users.root.hashedPassword = "!";
+  };
+
+  impermanence.enable = true;
+
+  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+
+  environment = {
+    systemPackages = builtins.attrValues {
+      inherit
+        (pkgs)
+        htop
+        lsof
+        tmux
+        btop
+        ;
     };
   };
-#Prevent clock drift due to interaction problem with xen hardware clock 
-  timesyncd.enable = lib.mkForce true;
-};
+
+  services = {
+    journald.extraConfig = "SystemMaxUse=5G";
+
+    nginx = {
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedTlsSettings = true;
+    };
+
+    openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+      };
+    };
+    #Prevent clock drift due to interaction problem with xen hardware clock
+    timesyncd.enable = lib.mkForce true;
+  };
 }

nixos/roles/nix_keys.nix

@@ -1,5 +1,5 @@
 {
-  imports = [ ];
+  imports = [];
   nix.settings.trusted-public-keys = [
     "nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
     "gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="

nixos/roles/prometheusNodeExporter.nix

@@ -1,15 +1,14 @@
-{config, ...}:
-{
-  imports = [ ];
+{config, ...}: {
+  imports = [];
   services.prometheus.exporters.node = {
     enable = true;
     port = 9100;
-  # Aligned with https://git.rwth-aachen.de/fsdmath/server/prometheus/-/blob/main/node_exporter/etc/default/prometheus-node-exporter
-  # It was compiled along the following steps:
-  # 1. Does the current Debian release supports the collector?
-  # 2. Is the collector depracated in the latest release?
-  # 3. Could you probably use the collected metrics for monitoring or are they useless because they make no sense in our context
-  #    (e.g. power adapter inside a VM, use fibre port connection)?
+    # Aligned with https://git.rwth-aachen.de/fsdmath/server/prometheus/-/blob/main/node_exporter/etc/default/prometheus-node-exporter
+    # It was compiled along the following steps:
+    # 1. Does the current Debian release supports the collector?
+    # 2. Is the collector depracated in the latest release?
+    # 3. Could you probably use the collected metrics for monitoring or are they useless because they make no sense in our context
+    #    (e.g. power adapter inside a VM, use fibre port connection)?
     disabledCollectors = [
       "arp"
       "bcache"
@@ -35,6 +34,6 @@
       "processes"
     ];
   };
-  networking.firewall.allowedTCPPorts = [ 9100 ];
-  environment.persistence.${config.impermanence.name}.directories = [ "/var/lib/${config.services.prometheus.stateDir}" ];
+  networking.firewall.allowedTCPPorts = [9100];
+  environment.persistence.${config.impermanence.name}.directories = ["/var/lib/${config.services.prometheus.stateDir}"];
 }