108 lines
2.8 KiB
Nix
108 lines
2.8 KiB
Nix
{
|
|
pkgs,
|
|
userName,
|
|
vintage-story,
|
|
...
|
|
}: {
|
|
imports = [
|
|
../../pwrMgmt
|
|
../../networking/core.nix
|
|
../../virtualization/podman.nix
|
|
];
|
|
|
|
# Enable flakes for NixOS
|
|
nix.settings.experimental-features = ["nix-command" "flakes"];
|
|
|
|
# Custom kernel/boot stuff
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# Set your timezone
|
|
time.timeZone = "America/Detroit";
|
|
|
|
# Enable OpenSSH
|
|
services.openssh.enable = true;
|
|
|
|
# Enable keyring
|
|
services.gnome.gnome-keyring.enable = true;
|
|
|
|
# Enable GnuPG
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
};
|
|
|
|
# Enable SUID wrappers (some programs need them)
|
|
programs.mtr.enable = true;
|
|
|
|
# Enable Polkit
|
|
security.polkit.enable = true;
|
|
|
|
# Power management (see ../../pwrMgmt/default.nix)
|
|
pwrMgmt = {
|
|
enable = true;
|
|
cpuFreqGovernor = "performance";
|
|
powertop.enable = false;
|
|
};
|
|
|
|
network = {
|
|
firewall = {
|
|
enable = true;
|
|
tcpPorts = {
|
|
allowedPorts = [ 42420 ];
|
|
};
|
|
udpPorts = {
|
|
allowedPorts = [ 42420 ];
|
|
};
|
|
};
|
|
networkManager.enable = true;
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
vintage-story.packages.${pkgs.system}.default
|
|
];
|
|
|
|
# Add username to groups "wheel" and "video" - more may be added here later
|
|
users = {
|
|
groups.hazel = {};
|
|
users = {
|
|
${userName} = {
|
|
extraGroups = [ "wheel" "network" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
|
|
];
|
|
};
|
|
"hazel" = {
|
|
home = "/home/hazel";
|
|
group = "hazel";
|
|
extraGroups = [ "wheel" ];
|
|
description = "hazel";
|
|
isNormalUser = true;
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZnyiQx+k1ygX8E1lsUCB6aTdMc+OKzlZ4admlzknc5ulj0YrtUyqhbNhkNd6pP0QDBFMnXO/rzUvHp4TAyZXKFfpcBCa4zhK97ufymAfvzAjM4vRBqRNcr2n+2iRzxtolbklfjs3ocBQVxXW+pRT5wWxTgK2fcmP2xviDVldr7qte37x5YkQb5SAhYNH8tqJRnuGPe+Q0A3oN4HyHZFnrMq/HlbL5yg/0VKPTtF/IgHf+2dDz5OQQpBx3/N9u/QLwuIm9lkyOG03s0TGmE7up/i0jX2vIqp2BbGSnwdQEL/eSVZx73qQB/J62VFafg13P5yQWDJ33WSoiwhac6bg26HPmPOnCJp5R3c+7jM8N1F1ZbtsKicHSVsRg1RQSree4lchPy7FOPkCuUrB7LNE71mbpOzZNR767S6UAPaXxRw6QNYGBaDqQBwhlU8ZDF5F7EW6ahSUMOI6ECyoibzIMb56xs9osuNeUhB/BcL5sHSFpJjIbdcDLNkEKggrBl6s="
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.fail2ban = {
|
|
enable = true;
|
|
package = pkgs.fail2ban;
|
|
maxretry = 5;
|
|
bantime = "3h";
|
|
bantime-increment = {
|
|
enable = true;
|
|
rndtime = "10m";
|
|
};
|
|
};
|
|
|
|
services.tailscale = {
|
|
enable = true;
|
|
package = pkgs.tailscale;
|
|
};
|
|
|
|
system.stateVersion = "24.11";
|
|
}
|