tlaternet-server/configuration/default.nix

{
  config,
  pkgs,
  lib,
  modulesPath,
  flake-inputs,
  ...
}: {
  imports = [
    flake-inputs.sops-nix.nixosModules.sops
    flake-inputs.tlaternet-webserver.nixosModules.default

    "${modulesPath}/profiles/headless.nix"
    "${modulesPath}/profiles/minimal.nix"
    (import ../modules)

    ./services/conduit.nix
    ./services/gitea.nix
    ./services/nextcloud.nix
    ./services/webserver.nix
    ./services/starbound.nix
    ./services/postgres.nix
    ./sops.nix
  ];

  nixpkgs.overlays = [
    (final: prev: {
      local = import ../pkgs {
        pkgs = prev;
        lib = prev.lib;
      };
    })
  ];

  nix = {
    package = pkgs.nixFlakes;
    extraOptions = ''
      experimental-features = nix-command flakes
    '';

    # Enable remote builds from tlater
    settings.trusted-users = ["@wheel"];
  };

  nixpkgs.config.allowUnfreePredicate = pkg:
    builtins.elem (lib.getName pkg) ["steam-original" "steam-runtime" "steam-run" "steamcmd"];

  # Optimization for minecraft servers, see:
  # https://bugs.mojang.com/browse/MC-183518
  boot.kernelParams = ["highres=off" "nohz=off"];

  networking = {
    hostName = "tlaternet";
    usePredictableInterfaceNames = false;

    firewall = {
      allowedTCPPorts = [
        # http
        80
        443
        # ssh
        2222
        # matrix
        8448
        # starbound
        21025
        # Minecraft
        25565

        config.services.coturn.listening-port
        config.services.coturn.tls-listening-port
        config.services.coturn.alt-listening-port
        config.services.coturn.alt-tls-listening-port
      ];

      allowedUDPPorts = [
        # More minecraft
        25565

        config.services.coturn.listening-port
        config.services.coturn.tls-listening-port
        config.services.coturn.alt-listening-port
        config.services.coturn.alt-tls-listening-port
      ];

      allowedUDPPortRanges = [
        {
          from = config.services.coturn.min-port;
          to = config.services.coturn.max-port;
        }
      ];
    };
  };

  systemd.network = {
    enable = true;

    networks = {
      "10-eth0.network" = {
        matchConfig.Name = "eth0";

        networkConfig = {
          DHCP = "no";

          Address = "178.79.137.55";
          Gateway = "178.79.137.1/24";

          Domains = "ip.linodeusercontent.com";
          DNS = [
            "178.79.182.5"
            "176.58.107.5"
            "176.58.116.5"
            "176.58.121.5"
            "151.236.220.5"
            "212.71.252.5"
            "212.71.253.5"
            "109.74.192.20"
            "109.74.193.20"
            "109.74.194.20"
            "2a01:7e00::9"
            "2a01:7e00::3"
            "2a01:7e00::c"
            "2a01:7e00::5"
            "2a01:7e00::6"
            "2a01:7e00::8"
            "2a01:7e00::b"
            "2a01:7e00::4"
            "2a01:7e00::7"
            "2a01:7e00::2"
          ];

          IPv6PrivacyExtensions = "no";
          IPv6AcceptRA = "yes";
        };
      };
    };
  };

  time.timeZone = "Europe/London";

  users.users.tlater = {
    isNormalUser = true;
    extraGroups = ["wheel"];
    openssh.authorizedKeys.keyFiles = [../keys/tlater.pub];
  };

  services.openssh = {
    enable = true;
    allowSFTP = false;
    passwordAuthentication = false;
    permitRootLogin = "no";
    ports = [2222];
    startWhenNeeded = true;
    gatewayPorts = "yes";
  };

  security = {
    sudo.execWheelOnly = true;

    pam = {
      enableSSHAgentAuth = true;
      services.sudo.sshAgentAuth = true;
    };
  };

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    clientMaxBodySize = "10G";
    domain = "tlater.net";
  };

  security.acme = {
    defaults.email = "tm@tlater.net";
    acceptTerms = true;
  };

  services.fail2ban = {
    enable = true;
    extraPackages = [pkgs.ipset];
    banaction = "iptables-ipset-proto6-allports";
    bantime-increment.enable = true;

    jails = {
      nginx-botsearch = ''
        enabled = true
        logpath = /var/log/nginx/access.log
      '';
    };

    ignoreIP = [
      "127.0.0.0/8"
      "10.0.0.0/8"
      "172.16.0.0/12"
      "192.168.0.0/16"
    ];
  };

  # Remove some unneeded packages
  environment.defaultPackages = [];

  system.stateVersion = "20.09";
}