infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

poseidon.nix (3188B)

      1 {
      2   pkgs,
      3   modulesPath,
      4   ...
      5 }:
      6 {
      7   imports = [
      8     (modulesPath + "/virtualisation/digital-ocean-image.nix")
      9     ../modules/wireguard-server.nix
     10     ../modules/freshrss.nix
     11   ];
     12 
     13   # Generic
     14   system.stateVersion = "24.05";
     15   environment.systemPackages = with pkgs; [ vim ];
     16   nix.settings.experimental-features = [
     17     "nix-command"
     18     "flakes"
     19   ];
     20   services.openssh.enable = true;
     21 
     22   boot.loader.grub.enable = false;
     23   fileSystems."/" = {
     24     device = "/dev/vda1";
     25     fsType = "ext4";
     26   };
     27   nix.gc = {
     28     automatic = true;
     29     dates = "weekly";
     30     options = "--delete-older-than 30d";
     31   };
     32   nix.settings.auto-optimise-store = true;
     33 
     34   # Specific
     35   networking.hostName = "poseidon";
     36   time.timeZone = "Europe/Amsterdam";
     37 
     38   sops.defaultSopsFile = ../secrets.yaml;
     39   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     40 
     41   # Firewall
     42   networking.firewall.allowedTCPPorts = [ 80 443 ];
     43 
     44   # VPN Server
     45   services.local.wireguard-server = {
     46     enable = true;
     47     privateKeySecretName = "server_wireguard_key";
     48     peers = [
     49       { name = "Thinkpad";           publicKey = "3owbBawNk7IEI8sHmJjr+Wna7QH5WxYuRGjU+OP4i2M="; allowedIPs = [ "10.100.0.2/32" ]; }
     50       { name = "Pixel";              publicKey = "pTuUtRphmXYKhwInaCIQY7nXRgftNzgKJxleACutrFc="; allowedIPs = [ "10.100.0.3/32" ]; }
     51       { name = "Desktop";            publicKey = "F/UODKJ2SQaRUOb7my2LtvRaN4p/khfW8bstO+09/zo="; allowedIPs = [ "10.100.0.4/32" ]; }
     52       { name = "iPad";               publicKey = "KwQo8pMz0JYHaEV3sbezmpD8jwgbXjaumIKeqWYaeiE="; allowedIPs = [ "10.100.0.5/32" ]; }
     53       { name = "Lolo's Macbook Pro"; publicKey = "qmch+NjlcVOxBcOsfwk2SJIcpN58i54131OS9J2yvmM="; allowedIPs = [ "10.100.0.6/32" ]; }
     54       { name = "Hetzner server";     publicKey = "QE4UoW2vSQMX8o1liA4MSwe4fE5sUB0+Ari5a/CqkSc="; allowedIPs = [ "10.100.0.7/32" ]; }
     55       { name = "XPS 13";             publicKey = "ZkRCc3EpJYl0EmRBEAjf9WXCW0JQvlzeq5h7fUn5aEs="; allowedIPs = [ "10.100.0.8/32" ]; }
     56       { name = "Work Macbook Pro";   publicKey = "j+5aLHMTUGQyyjmU55ibA+JXC0pmEvQgQIOOfdMEQUA="; allowedIPs = [ "10.100.0.9/32" ]; }
     57     ];
     58   };
     59 
     60   # ACME
     61   security.acme = {
     62     acceptTerms = true;
     63     defaults.email = "silasbrack@gmail.com";
     64   };
     65 
     66   # Nginx
     67   services.nginx.enable = true;
     68 
     69   # FreshRSS
     70   services.local.freshrss = {
     71     enable = true;
     72     domain = "freshrss.fnarglebeast.com";
     73     defaultUser = "silas";
     74     passwordSecretName = "freshrss_password";
     75   };
     76 
     77   # Users
     78   users.users = {
     79     root.openssh.authorizedKeys.keys = [
     80       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com"
     81       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPGZOv4PvL/NvBiDFnCh8V6xm03k/C3b8O82z1+tmboI gitea-runner"
     82     ];
     83     silas = {
     84       isNormalUser = true;
     85       description = "Silas Brack";
     86       home = "/home/silas";
     87       extraGroups = [ "networkmanager" "wheel" ];
     88       openssh.authorizedKeys.keys = [
     89         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com"
     90         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ0gNM0od3EE/LL27kYQ/s5MOU7LBNc0pWRWROeINij silas@Lorenzas-MacBook-Pro.local"
     91       ];
     92     };
     93   };
     94 }