119 lines
2.8 KiB
Nix
119 lines
2.8 KiB
Nix
{
|
|
pkgs,
|
|
userName,
|
|
nur,
|
|
...
|
|
}: let
|
|
hildibrand = nur.packages.${pkgs.stdenv.hostPlatform.system}.hildibrand;
|
|
caitsith = nur.packages.${pkgs.stdenv.hostPlatform.system}.caitsith;
|
|
in {
|
|
imports = [
|
|
../../pwrMgmt
|
|
../../networking/core.nix
|
|
];
|
|
|
|
# Enable flakes for NixOS
|
|
nix.settings.experimental-features = ["nix-command" "flakes"];
|
|
|
|
# Custom kernel/boot stuff
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# Set your timezone
|
|
time.timeZone = "America/Detroit";
|
|
|
|
# Enable OpenSSH
|
|
services.openssh.enable = true;
|
|
|
|
# Enable keyring
|
|
services.gnome.gnome-keyring.enable = true;
|
|
|
|
# Enable GnuPG
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
};
|
|
|
|
# Enable SUID wrappers (some programs need them)
|
|
programs.mtr.enable = true;
|
|
|
|
# Enable Polkit
|
|
security.polkit.enable = true;
|
|
|
|
# Power management (see ../../pwrMgmt/default.nix)
|
|
pwrMgmt = {
|
|
enable = true;
|
|
cpuFreqGovernor = "performance";
|
|
powertop.enable = false;
|
|
};
|
|
|
|
network = {
|
|
firewall = {
|
|
enable = true;
|
|
};
|
|
networkManager.enable = true;
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
hildibrand
|
|
caitsith
|
|
];
|
|
|
|
systemd.services.hildibrand = {
|
|
description = "Hildibrand - trivia buzzer bot";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = userName;
|
|
WorkingDirectory = "/home/${userName}";
|
|
ExecStart = "${hildibrand}/bin/hildebrand";
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
EnvironmentFile = "/etc/secrets/hildibrand.env";
|
|
};
|
|
};
|
|
|
|
systemd.services.caitsith = {
|
|
description = "Caitsith - a randomizer bot";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
User = userName;
|
|
WorkingDirectory = "/home/${userName}";
|
|
ExecStart = "${caitsith}/bin/hildebrand";
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
EnvironmentFile = "/etc/secrets/caitsith.env";
|
|
};
|
|
};
|
|
|
|
# Add username to groups "wheel" and "video" - more may be added here later
|
|
users = {
|
|
users = {
|
|
${userName} = {
|
|
extraGroups = [ "wheel" "network" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.fail2ban = {
|
|
enable = true;
|
|
package = pkgs.fail2ban;
|
|
maxretry = 5;
|
|
bantime = "3h";
|
|
bantime-increment = {
|
|
enable = true;
|
|
rndtime = "10m";
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "24.11";
|
|
}
|