tlaternet-server/configuration/default.nix

93 lines
2.1 KiB
Nix
Raw Normal View History

{ config, pkgs, lib, ... }:
{
imports = [
./services/gitea.nix
2021-04-22 22:32:54 +01:00
./services/minecraft.nix
./services/nextcloud.nix
./services/webserver.nix
./ids.nix
];
nix = {
# Enable flakes
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
# Enable remote builds from tlater
trustedUsers = [ "@wheel" ];
};
2022-04-23 04:06:50 +01:00
sops = {
defaultSopsFile = ../keys/external.yaml;
secrets.steam = { };
};
boot.kernelParams = [ "highres=off" "nohz=off" ];
networking = {
hostName = "tlaternet";
usePredictableInterfaceNames = false;
useDHCP = false;
interfaces.eth0.useDHCP = true;
firewall.allowedTCPPorts = [ 80 443 2222 2221 25565 ];
};
time.timeZone = "Europe/London";
users.users.tlater = {
isNormalUser = true;
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keyFiles = [ ../keys/tlater.pub ];
};
services.openssh = {
enable = true;
allowSFTP = false;
passwordAuthentication = false;
permitRootLogin = "no";
ports = [ 2222 ];
startWhenNeeded = true;
};
services.nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
clientMaxBodySize = "10G";
domain = "tlater.net";
2021-04-12 01:41:31 +01:00
virtualHosts = let
host = port: extra:
lib.recursiveUpdate {
2021-04-12 01:41:31 +01:00
forceSSL = true;
enableACME = true;
2021-10-12 13:53:08 +01:00
locations."/".proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
'';
} extra;
domain = config.services.nginx.domain;
2021-04-12 01:42:46 +01:00
in {
"${domain}" = host 3002 { serverAliases = [ "www.${domain}" ]; };
"gitea.${domain}" = host 3000 { };
"nextcloud.${domain}" = host 3001 { };
2021-04-12 01:42:46 +01:00
};
};
security.acme = {
email = "tm@tlater.net";
acceptTerms = true;
};
virtualisation.oci-containers.backend = "podman";
system.stateVersion = "20.09";
}