62 lines
1.7 KiB
Nix
62 lines
1.7 KiB
Nix
{ modulesPath, lib, pkgs, ... }: {
|
|
imports = [
|
|
(modulesPath + "/installer/scan/not-detected.nix")
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
./disk-config.nix
|
|
./nginx.nix
|
|
];
|
|
|
|
boot.loader.grub = {
|
|
efiSupport = true;
|
|
efiInstallAsRemovable = true;
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; map lib.lowPrio [
|
|
curl
|
|
gitMinimal
|
|
neovim
|
|
];
|
|
|
|
services.openssh.enable = true;
|
|
services.openssh.settings.PasswordAuthentication = false;
|
|
|
|
users.users.root.hashedPassword = "$y$j9T$ZT9dUDb5fMGtQTQumYE49.$KI98XnTuykSgTAeP/gttTzEaj0Ys834WxAtKzT1CAb6";
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7P9K9D5RkBk+JCRRS6AtHuTAc6cRpXfRfRMg/Kyren"
|
|
];
|
|
|
|
users.users.website = {
|
|
createHome = false;
|
|
isNormalUser = true;
|
|
group = "users";
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7P9K9D5RkBk+JCRRS6AtHuTAc6cRpXfRfRMg/Kyren"
|
|
];
|
|
};
|
|
systemd.tmpfiles.rules = [
|
|
"d /srv/website 0700 website users"
|
|
];
|
|
|
|
sops = {
|
|
defaultSopsFile = ./secrets.yaml;
|
|
age.sshKeyPaths = [ "/root/id_ed25519" ];
|
|
secrets.github-access-token = { };
|
|
secrets.cloudflare-dns-api-token = { mode = "0440"; group = "acme"; };
|
|
};
|
|
nix.extraOptions = "!include /run/secrets/github-access-token";
|
|
|
|
system.autoUpgrade = {
|
|
enable = true;
|
|
flake = "github:kyren223/server#default";
|
|
dates = "minutely"; # Poll interval
|
|
flags = [
|
|
"--no-write-lock-file" # Prevent flake.lock from upgrading
|
|
"--option" "tarball-ttl" "0" # Required for polling below 1h
|
|
];
|
|
};
|
|
|
|
nix.settings.extra-experimental-features = [ "nix-command" "flakes" ];
|
|
|
|
system.stateVersion = "24.05";
|
|
}
|