689fee1398
The upstream module is kind of inscrutable so it may be nice to port it to a simple reaction setup. Since that's probably going to require writing rules manually, though, I'm putting this off for now. Change-Id: Ic3d8c5f2d1b08701f0dc5b8b4eb57dc45bcd58ee Reviewed-on: https://cl.tvl.fyi/c/depot/+/13008 Reviewed-by: sterni <sternenseemann@systemli.org> Autosubmit: sterni <sternenseemann@systemli.org> Tested-by: BuildkiteCI
81 lines
1.7 KiB
Nix
81 lines
1.7 KiB
Nix
# This module is common in the weakest sense, i.e. contains common settings to
|
|
# all my machines contained in depot—as opposed to common to all my potential
|
|
# machines. Consequently, this module is currently very server-centric.
|
|
{ pkgs, lib, depot, config, ... }:
|
|
|
|
let
|
|
me = "lukas";
|
|
in
|
|
|
|
{
|
|
config = {
|
|
|
|
# More common
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
nix = {
|
|
package = pkgs.nix_2_3;
|
|
settings = {
|
|
trusted-public-keys = lib.mkAfter [
|
|
"headcounter.org:/7YANMvnQnyvcVB6rgFTdb8p5LG1OTXaO+21CaOSBzg="
|
|
];
|
|
substituters = lib.mkAfter [
|
|
"https://hydra.build"
|
|
];
|
|
trusted-users = [ me ];
|
|
};
|
|
};
|
|
tvl.cache.enable = true;
|
|
|
|
programs.fish.enable = true;
|
|
|
|
users = {
|
|
users = {
|
|
root.openssh.authorizedKeys.keys = depot.users.sterni.keys.all;
|
|
${me} = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "http" "git" ];
|
|
openssh.authorizedKeys.keys = depot.users.sterni.keys.all;
|
|
shell = pkgs.fish;
|
|
};
|
|
};
|
|
};
|
|
|
|
# Less common
|
|
|
|
services = {
|
|
journald.extraConfig = ''
|
|
SystemMaxUse=10G
|
|
'';
|
|
|
|
openssh.enable = true;
|
|
# TODO(sterni): consider porting to reaction
|
|
fail2ban.enable = true;
|
|
};
|
|
|
|
programs = {
|
|
mosh.enable = true;
|
|
tmux.enable = true;
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
pkgs.wget
|
|
pkgs.git
|
|
pkgs.stow
|
|
pkgs.htop
|
|
pkgs.foot.terminfo
|
|
pkgs.vim
|
|
pkgs.smartmontools
|
|
];
|
|
|
|
security.acme = {
|
|
defaults.email = builtins.getAttr "email" (
|
|
builtins.head (
|
|
builtins.filter (attrs: attrs.username == "sterni") depot.ops.users
|
|
)
|
|
);
|
|
acceptTerms = true;
|
|
};
|
|
};
|
|
}
|