120 lines
2.2 KiB
Nix
120 lines
2.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
|
|
programs = {
|
|
gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
|
|
};
|
|
};
|
|
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
|
|
networking = {
|
|
hostName = "TobServer";
|
|
|
|
useDHCP = false;
|
|
useNetworkd = true;
|
|
|
|
interfaces.eno1.ipv4.addresses = [
|
|
{
|
|
address = "162.55.103.218";
|
|
prefixLength = 26;
|
|
}
|
|
];
|
|
|
|
defaultGateway = {
|
|
address = "162.55.103.193";
|
|
interface = "eno1";
|
|
};
|
|
|
|
nameservers = [
|
|
"185.12.64.1"
|
|
"185.12.64.2"
|
|
];
|
|
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 22 80 443 50001 ];
|
|
};
|
|
};
|
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG3PPXoEV1gt1tR4MyfR3nn1ttzZ4kGTiNfj8703MJdm hetzner-nixos"
|
|
];
|
|
|
|
services = {
|
|
openssh.enable = true;
|
|
openssh.settings.PermitRootLogin = "no";
|
|
|
|
btrfs.autoScrub.enable = true;
|
|
|
|
protonmail-bridge = {
|
|
enable = true;
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
};
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "tobias.ostner@proton.me";
|
|
};
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
boot.loader.grub.enable = true;
|
|
boot.loader.grub.device = "/dev/nvme0n1";
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
age
|
|
btop
|
|
ffmpeg
|
|
gnupg
|
|
jq
|
|
pass
|
|
ripgrep
|
|
sops
|
|
vim
|
|
];
|
|
|
|
programs.git = {
|
|
enable = true;
|
|
|
|
config = {
|
|
user.name = "Tobias Ostner";
|
|
user.email = "tobias.ostner@gmail.com";
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "25.11";
|
|
|
|
users.users.tobi = {
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" "networkmanager" "podman" "bitcoind-mainnet" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG3PPXoEV1gt1tR4MyfR3nn1ttzZ4kGTiNfj8703MJdm hetzner-nixos"
|
|
];
|
|
};
|
|
|
|
security.sudo.enable = true;
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
virtualisation.docker.enable = false;
|
|
|
|
virtualisation.podman = {
|
|
enable = true;
|
|
dockerCompat = true;
|
|
defaultNetwork.settings.dns_enabled = true;
|
|
};
|
|
|
|
sops = {
|
|
defaultSopsFile = ./secrets/tobserver.yaml;
|
|
defaultSopsFormat = "yaml";
|
|
age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
};
|
|
}
|