selfprivacy-nixos-config/configuration.nix

112 lines
2.8 KiB
Nix
Raw Permalink Normal View History

{ userdata, config, pkgs, lib, ... }:
2021-11-15 10:02:05 +00:00
{
imports = [
./variables-module.nix
./variables.nix
./files.nix
./volumes.nix
2021-11-15 10:02:05 +00:00
./users.nix
./mailserver/system/mailserver.nix
./vpn/ocserv.nix
./api/api.nix
./api/api-module.nix
./social/pleroma.nix
./letsencrypt/acme.nix
./letsencrypt/resolve.nix
./passmgr/bitwarden.nix
./webserver/nginx.nix
./webserver/memcached.nix
./nextcloud/nextcloud.nix
./resources/limits.nix
./videomeet/jitsi.nix
./git/gitea.nix
];
2023-07-15 12:52:46 +00:00
# this should be specified in hardware-configuration.nix?
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
2021-11-17 13:35:00 +00:00
services.redis.servers.sp-api = {
enable = true;
save = [
[
30
1
]
[
10
10
]
];
port = 0;
settings = {
notify-keyspace-events = "KEA";
};
};
2022-11-07 23:41:18 +00:00
services.do-agent.enable = if config.services.userdata.server.provider == "DIGITALOCEAN" then true else false;
2021-11-15 10:02:05 +00:00
boot.cleanTmpDir = true;
networking = {
hostName = config.services.userdata.hostname;
usePredictableInterfaceNames = false;
2021-11-15 10:02:05 +00:00
firewall = {
2022-02-15 12:09:45 +00:00
allowedTCPPorts = lib.mkForce [ 22 25 80 143 443 465 587 993 4443 8443 ];
allowedUDPPorts = lib.mkForce [ 8443 10000 ];
extraCommands = ''
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface vpn00 -j ACCEPT
'';
2021-11-15 10:02:05 +00:00
};
nameservers = [ "1.1.1.1" "1.0.0.1" ];
};
2021-11-15 10:29:20 +00:00
time.timeZone = config.services.userdata.timezone;
2021-11-15 10:02:05 +00:00
i18n.defaultLocale = "en_GB.UTF-8";
2021-11-15 13:35:04 +00:00
users.users.root.openssh.authorizedKeys.keys = config.services.userdata.ssh.rootKeys;
2021-11-15 10:02:05 +00:00
services.openssh = {
2021-11-15 13:35:04 +00:00
enable = config.services.userdata.ssh.enable;
passwordAuthentication = config.services.userdata.ssh.passwordAuthentication;
2021-11-15 10:02:05 +00:00
permitRootLogin = "yes";
openFirewall = false;
};
programs.ssh = {
pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" "ecdsa-sha2-nistp256" ];
hostKeyAlgorithms = [ "ssh-ed25519" "ssh-rsa" ];
2021-11-15 10:02:05 +00:00
};
environment.systemPackages = with pkgs; [
git
jq
2021-11-15 10:02:05 +00:00
];
environment.variables = {
DOMAIN = config.services.userdata.domain;
};
system.autoUpgrade = {
enable = config.services.userdata.autoUpgrade.enable;
allowReboot = config.services.userdata.autoUpgrade.allowReboot;
channel = "https://channel.selfprivacy.org/nixos-selfpricacy";
};
2023-03-17 11:50:54 +00:00
system.stateVersion = config.services.userdata.stateVersion;
2021-11-15 10:02:05 +00:00
nix = {
optimise.automatic = true;
gc = {
automatic = true;
options = "--delete-older-than 7d";
};
};
services.journald.extraConfig = "SystemMaxUse=500M";
2021-11-15 10:02:05 +00:00
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
};
swapDevices = [
{
device = "/swapfile";
priority = 0;
size = 2048;
}
];
security = {
sudo = {
enable = true;
};
};
}