mirror of
https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-config.git
synced 2024-11-29 14:11:26 +00:00
107 lines
2.7 KiB
Nix
107 lines
2.7 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
{
|
|
imports = [
|
|
./variables-module.nix
|
|
./files.nix
|
|
./volumes.nix
|
|
./users.nix
|
|
./vpn/ocserv.nix
|
|
./api/api.nix
|
|
./social/pleroma.nix
|
|
./letsencrypt/acme.nix
|
|
./letsencrypt/resolve.nix
|
|
./backup/restic.nix
|
|
./passmgr/bitwarden.nix
|
|
./webserver/nginx.nix
|
|
./webserver/memcached.nix
|
|
./nextcloud/nextcloud.nix
|
|
./resources/limits.nix
|
|
./videomeet/jitsi.nix
|
|
./git/gitea.nix
|
|
];
|
|
|
|
services.redis.servers.sp-api = {
|
|
enable = true;
|
|
save = [
|
|
[
|
|
30
|
|
1
|
|
]
|
|
[
|
|
10
|
|
10
|
|
]
|
|
];
|
|
port = 0;
|
|
settings = {
|
|
notify-keyspace-events = "KEA";
|
|
};
|
|
};
|
|
|
|
services.do-agent.enable = if config.selfprivacy.userdata.server.provider == "DIGITALOCEAN" then true else false;
|
|
|
|
boot.cleanTmpDir = true;
|
|
networking = {
|
|
hostName = config.selfprivacy.userdata.hostname;
|
|
usePredictableInterfaceNames = false;
|
|
firewall = {
|
|
allowedTCPPorts = lib.mkForce [ 22 25 80 143 443 465 587 993 4443 8443 ];
|
|
allowedUDPPorts = lib.mkForce [ 8443 10000 ];
|
|
extraCommands = ''
|
|
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
|
|
iptables --append FORWARD --in-interface vpn00 -j ACCEPT
|
|
'';
|
|
};
|
|
nameservers = [ "1.1.1.1" "1.0.0.1" ];
|
|
};
|
|
time.timeZone = config.selfprivacy.userdata.timezone;
|
|
i18n.defaultLocale = "en_GB.UTF-8";
|
|
users.users.root.openssh.authorizedKeys.keys = config.selfprivacy.userdata.ssh.rootKeys;
|
|
services.openssh = {
|
|
enable = config.selfprivacy.userdata.ssh.enable;
|
|
passwordAuthentication = config.selfprivacy.userdata.ssh.passwordAuthentication;
|
|
permitRootLogin = "yes";
|
|
openFirewall = false;
|
|
};
|
|
programs.ssh = {
|
|
pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" ];
|
|
hostKeyAlgorithms = [ "ssh-ed25519" "ssh-rsa" ];
|
|
};
|
|
environment.systemPackages = with pkgs; [
|
|
git
|
|
jq
|
|
];
|
|
environment.variables = {
|
|
DOMAIN = config.selfprivacy.userdata.domain;
|
|
};
|
|
system.autoUpgrade = {
|
|
enable = config.selfprivacy.userdata.autoUpgrade.enable;
|
|
allowReboot = config.selfprivacy.userdata.autoUpgrade.allowReboot;
|
|
channel = "https://channel.selfprivacy.org/nixos-selfpricacy";
|
|
};
|
|
system.stateVersion = config.selfprivacy.userdata.stateVersion;
|
|
nix = {
|
|
optimise.automatic = true;
|
|
gc = {
|
|
automatic = true;
|
|
options = "--delete-older-than 7d";
|
|
};
|
|
};
|
|
services.journald.extraConfig = "SystemMaxUse=500M";
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
};
|
|
swapDevices = [
|
|
{
|
|
device = "/swapfile";
|
|
priority = 0;
|
|
size = 2048;
|
|
}
|
|
];
|
|
security = {
|
|
sudo = {
|
|
enable = true;
|
|
};
|
|
};
|
|
}
|