1
1
Fork 0
nixos-configs/machine/empyrean/default.nix

188 lines
5.2 KiB
Nix
Raw Normal View History

2021-01-23 17:16:48 +00:00
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
#./amanuensis.nix
#./redstring.nix
2021-01-23 17:16:48 +00:00
./catacomb.nix
./gitea.nix
2022-11-27 01:38:18 +00:00
./inquisitor.nix
2021-01-23 17:16:48 +00:00
];
# Use the GRUB 2 boot loader.
boot.loader.grub = {
enable = true;
device = "/dev/xvda";
extraConfig = "serial --unit=0 --speed=115200 ; terminal_input serial console ; terminal_output serial console";
};
boot.kernelParams = ["console=ttyS0"];
2022-11-27 01:40:04 +00:00
nix = {
package = pkgs.nixFlakes;
2022-12-11 00:00:55 +00:00
settings.max-jobs = 2;
2022-11-27 01:40:04 +00:00
extraOptions = ''
experimental-features = nix-command flakes
'';
};
swapDevices = [ { device = "/swap"; size = 1024; } ];
2022-01-08 00:06:07 +00:00
2021-01-23 17:16:48 +00:00
networking.hostName = "empyrean";
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
# Per-interface useDHCP will be mandatory in the future, so this generated config
# replicates the default behaviour.
networking.useDHCP = false;
networking.interfaces.eth0.useDHCP = true;
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = "us";
};
# Set your time zone.
time.timeZone = "UTC";
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
vim htop git tinc_pre python3
gitea
];
2022-01-08 00:14:50 +00:00
environment.variables.EDITOR = "vim";
2021-01-23 17:16:48 +00:00
services.nginx = let
static-site = srv-dir: {
enableACME = true;
forceSSL = true;
root = "/srv/${srv-dir}/";
extraConfig = ''
access_log /var/log/nginx/access_${srv-dir}.log;
index index.html;
'';
};
in {
2021-01-23 17:16:48 +00:00
enable = true;
recommendedProxySettings = true;
virtualHosts = {
# Static pages
"wedding.ktvb.site" = static-site "wedding.ktvb.site";
"www.ktvb.site" = static-site "www.ktvb.site";
"mirror.alogoulogoi.com" = static-site "mirror.alogoulogoi.com";
"www.alogoulogoi.com" = static-site "www";
2023-01-16 05:56:31 +00:00
newtab = {
listen = [ { addr = "10.22.20.1"; port = 80; } ];
root = "/srv/newtab/";
extraConfig = ''
access_log /var/log/nginx/access_newtab.log;
index index.html;
'';
};
2021-01-23 17:16:48 +00:00
# Deny all other subdomains
"alogoulogoi.com" = {
default = true;
locations."/".return = "444";
};
};
};
security.acme = {
2022-12-11 00:00:55 +00:00
defaults.email = "tim.vanbaak+alogoulogoi@gmail.com";
2021-01-23 17:16:48 +00:00
acceptTerms = true;
};
services.ntp = {
enable = true;
servers = ["time.nist.gov"];
};
services.openssh = {
enable = true;
2023-06-09 20:59:09 +00:00
settings.PasswordAuthentication = false;
settings.PermitRootLogin = "prohibit-password";
2021-01-23 17:16:48 +00:00
};
services.tinc.networks.beatific = {
listenAddress = "0.0.0.0";
chroot = false;
};
2022-02-10 15:06:16 +00:00
services.nebula.networks.beatific = {
enable = true;
# Network certificate and host credentials
2022-11-26 02:49:40 +00:00
ca = "/etc/nebula/beatific/beatific.crt";
2022-02-10 15:06:16 +00:00
cert = "/etc/nebula/beatific/empyrean.crt";
key = "/etc/nebula/beatific/empyrean.key";
2022-11-26 02:49:40 +00:00
# This host has a well-known IP at its VPS host, so it can function as a lighthouse/entry node
2022-02-10 15:06:16 +00:00
isLighthouse = true;
# Listen to connection requests from the public Internet
listen.port = 4242;
listen.host = "vpn.alogoulogoi.com";
2022-11-26 02:49:40 +00:00
# Don't filter anything at the VPN level
2022-02-10 15:06:16 +00:00
firewall.outbound = [ { port = "any"; proto = "any"; host = "any"; } ];
firewall.inbound = [ { port = "any"; proto = "any"; host = "any"; } ];
settings = {
# Enable UDP holepunching both ways, which allows nodes to establish more direct connections with each other
punchy = { punch = true; response = true; };
};
};
2023-06-20 04:35:45 +00:00
services.intake = {
listen = { addr = "10.22.20.1"; port = 5234; };
users.tvb.enable = true;
2023-06-21 04:01:41 +00:00
users.tvb.extraPackages = [ pkgs.intakeSources ];
2023-06-20 04:35:45 +00:00
};
2021-01-23 17:16:48 +00:00
networking.firewall = {
enable = true;
allowPing = true;
allowedTCPPorts = [
22 # ssh
80 # http
443 # https
655 # tinc
2023-06-20 04:35:45 +00:00
5234# intake
2021-01-23 17:16:48 +00:00
];
allowedUDPPorts = [
655 # tinc
];
};
users.users.tvb = {
isNormalUser = true;
2022-01-08 00:06:07 +00:00
group = "tvb";
2021-01-23 17:16:48 +00:00
extraGroups = [ "wheel" ]; # Enable sudo for the user.
2022-11-27 02:51:05 +00:00
openssh.authorizedKeys.keyFiles = [
../../keys/tvb.palamas.pub
../../keys/tvb.stagirite.pub
];
2021-01-23 17:16:48 +00:00
};
2022-01-08 00:06:07 +00:00
users.groups.tvb = {};
2021-01-23 17:16:48 +00:00
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
2023-06-09 20:59:09 +00:00
system.stateVersion = "23.05"; # Did you read the comment?
2021-01-23 17:16:48 +00:00
}