tlaternet-server/configuration/default.nix

{ config, pkgs, ... }:

{
  imports = [
    # ./services/gitea.nix
    ./services/hydra.nix
    # ./services/minecraft.nix
    # ./services/nextcloud.nix
    # ./services/webserver.nix
    ./ids.nix
  ];

  nix = {
    # Enable flakes
    package = pkgs.nixFlakes;
    extraOptions = ''
      experimental-features = nix-command flakes
    '';

    # Enable remote builds from tlater
    trustedUsers = [ "@wheel" ];
  };

  networking = {
    hostName = "tlaternet";

    usePredictableInterfaceNames = false;
    useDHCP = false;
    interfaces.eth0.useDHCP = true;

    firewall.allowedTCPPorts = [ 80 443 2222 2221 25565 ];
  };

  time.timeZone = "Europe/London";

  users.users.tlater = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keyFiles = [ ../keys/tlater.pub ];
  };

  services.openssh = {
    enable = true;
    allowSFTP = false;
    passwordAuthentication = false;
    permitRootLogin = "no";
    ports = [ 2222 ];
    startWhenNeeded = true;
  };

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    clientMaxBodySize = "10G";

    virtualHosts = let
      host = port: extra:
        {
          forceSSL = true;
          enableACME = true;
          locations."/" = { proxyPass = "http://localhost:${toString port}"; };
        } // extra;
    in {
      # "tlater.net" = host 3002 { serverAliases = [ "www.tlater.net" ]; };
      # "gitea.tlater.net" = host 3000 { };
      # "nextcloud.tlater.net" = host 3001 { };
      "hydra.tlater.net" = host 3003 { };
    };
  };

  security.acme = {
    email = "tm@tlater.net";
    acceptTerms = true;
  };

  virtualisation.oci-containers.backend = "podman";

  system.stateVersion = "20.09";
}