infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

helios.nix (4276B)

      1 {
      2   pkgs,
      3   config,
      4   lib,
      5   simple-web-app,
      6   daily-tracker,
      7   mkv,
      8   website,
      9   ...
     10 }:
     11 {
     12   imports = [
     13     ../modules/wireguard-client.nix
     14     ../modules/nginx.nix
     15     ../modules/mediawiki.nix
     16     ../modules/forgejo.nix
     17     ../modules/mkv.nix
     18     ../modules/simple-web-app.nix
     19     ../modules/daily-tracker.nix
     20     ../modules/mailserver.nix
     21   ];
     22 
     23   # Generic
     24   system.stateVersion = "25.05";
     25   environment.systemPackages = with pkgs; [
     26     vim
     27     wget
     28     curl
     29     rsync
     30     rclone
     31     zip
     32     unzip
     33   ];
     34   nix.settings.experimental-features = [
     35     "nix-command"
     36     "flakes"
     37   ];
     38   services.openssh.enable = true;
     39   networking.firewall.allowedTCPPorts = [ 80 443 ];
     40 
     41   boot.loader.grub.enable = false;
     42   fileSystems."/" = {
     43     device = "/dev/sda1";
     44     fsType = "ext4";
     45   };
     46   fileSystems."/mnt/volume-hel1-1" = {
     47     device = "/dev/sdb";
     48     fsType = "ext4";
     49   };
     50   swapDevices = [{
     51     device = "/var/lib/swapfile";
     52     size = 2048;
     53   }];
     54 
     55   nix.gc = {
     56     automatic = true;
     57     dates = "weekly";
     58     options = "--delete-older-than 30d";
     59   };
     60   nix.settings.auto-optimise-store = true;
     61 
     62   # Specific
     63   networking.hostName = "helios";
     64   time.timeZone = "Europe/Helsinki";
     65 
     66   sops.defaultSopsFile = ../secrets.yaml;
     67   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     68 
     69   # VPN
     70   services.local.wireguard-client = {
     71     enable = true;
     72     address = "10.100.0.7/24";
     73     privateKeySecretName = "hetzner_wireguard_key";
     74   };
     75 
     76   # Nginx
     77   services.local.nginx-hardened = {
     78     enable = true;
     79     acmeEmail = "silasbrack@gmail.com";
     80   };
     81 
     82   # MediaWiki
     83   services.local.mediawiki = {
     84     enable = true;
     85     name = "Silas' Wiki";
     86     domain = "wiki.fnarglebeast.com";
     87     passwordSecretName = "mediawiki_admin_password";
     88   };
     89 
     90   # Forgejo
     91   services.local.forgejo = {
     92     enable = true;
     93     domain = "git.fnarglebeast.com";
     94   };
     95 
     96   # Personal website
     97   services.nginx.virtualHosts."silasbrack.com" = let
     98     staticSite = pkgs.runCommand "website" {} ''
     99       mkdir -p $out
    100       cp ${website}/index.html $out/
    101       cp -r ${website}/posts $out/
    102       cp -r ${website}/assets $out/
    103     '';
    104   in {
    105     enableACME = true;
    106     forceSSL = true;
    107     root = staticSite;
    108     locations."/" = {};
    109   };
    110 
    111   # MKV distributed key-value store
    112   services.local.mkv = {
    113     enable = true;
    114     package = mkv.packages.${pkgs.stdenv.hostPlatform.system}.default;
    115     volumes = [
    116       "http://10.100.0.7:8081"
    117       "http://10.100.0.4:8081"
    118     ];
    119     volume = {
    120       enable = true;
    121       listenAddress = "10.100.0.7";
    122       path = "/mnt/volume-hel1-1/mkv";
    123     };
    124   };
    125 
    126   # Simple Web App
    127   services.simple-web-app = {
    128     enable = true;
    129     package = simple-web-app.packages.${pkgs.stdenv.hostPlatform.system}.default;
    130   };
    131 
    132   # Daily Tracker
    133   services.local.daily-tracker = {
    134     enable = false;
    135     package = daily-tracker.packages.${pkgs.stdenv.hostPlatform.system}.default;
    136     domain = "daily-tracker.fnarglebeast.com";
    137     secretKeyBaseSecretName = "daily_tracker_secret_key_base";
    138     mailPasswordSecretName = "daily_tracker_mail_password";
    139   };
    140   sops.secrets.daily_tracker_secret_key_base = { };
    141   sops.secrets.daily_tracker_mail_password = { };
    142 
    143   # Mail server
    144   services.local.mailserver = {
    145     enable = true;
    146     fqdn = "mail.silasbrack.com";
    147     domains = [ "silasbrack.com" ];
    148     accounts = {
    149       "silas@silasbrack.com" = {
    150         hashedPasswordFile = config.sops.secrets.mail_silas_password_hash.path;
    151         aliases = [ "postmaster@silasbrack.com" ];
    152       };
    153     };
    154   };
    155   sops.secrets.mail_silas_password_hash = { };
    156 
    157   # Users
    158   users.users = {
    159     root.openssh.authorizedKeys.keys = [
    160       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com"
    161       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPGZOv4PvL/NvBiDFnCh8V6xm03k/C3b8O82z1+tmboI gitea-runner"
    162     ];
    163     silas = {
    164       isNormalUser = true;
    165       description = "Silas Brack";
    166       home = "/home/silas";
    167       extraGroups = [ "networkmanager" "wheel" ];
    168       openssh.authorizedKeys.keys = [
    169         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com"
    170         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ0gNM0od3EE/LL27kYQ/s5MOU7LBNc0pWRWROeINij silas@Lorenzas-MacBook-Pro.local"
    171       ];
    172     };
    173   };
    174 }