116 lines
2.3 KiB
Nix
116 lines
2.3 KiB
Nix
|
|
{
|
|
pkgs,
|
|
userName,
|
|
...
|
|
}: {
|
|
imports = [
|
|
../../pwrMgmt
|
|
../../networking/core.nix
|
|
../../networking/dns.nix
|
|
../../virtualization/podman.nix
|
|
];
|
|
|
|
# Enable flakes for NixOS
|
|
nix.settings.experimental-features = ["nix-command" "flakes"];
|
|
|
|
# Custom kernel/boot stuff
|
|
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
boot.loader.systemd-boot.enable = true; # TODO: check on this
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
# Set your timezone
|
|
time.timeZone = "America/Detroit";
|
|
|
|
# Enable OpenSSH
|
|
services.openssh.enable = true;
|
|
|
|
# Enable keyring
|
|
services.gnome.gnome-keyring.enable = true;
|
|
|
|
# Enable GnuPG
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
};
|
|
|
|
# Enable SUID wrappers (some programs need them)
|
|
programs.mtr.enable = true;
|
|
|
|
# Enable Polkit
|
|
security.polkit.enable = true;
|
|
|
|
# Power management (see ../../pwrMgmt/default.nix)
|
|
pwrMgmt = {
|
|
enable = true;
|
|
cpuFreqGovernor = "performance";
|
|
powertop.enable = false;
|
|
};
|
|
|
|
# Podman module (see ../../virtualization/podman.nix)
|
|
# podman = {
|
|
# enable = true;
|
|
# extraPackages = with pkgs; [
|
|
# docker-credential-helpers
|
|
# toolbox
|
|
# cosign
|
|
# crane
|
|
# podman-tui
|
|
# podman-desktop
|
|
# ];
|
|
# };
|
|
|
|
# Core networking module (see ../../networking/core.nix)
|
|
network = {
|
|
firewall.enable = true;
|
|
networkManager.enable = true;
|
|
};
|
|
|
|
# Add username to groups "wheel" and "video" - more may be added here later
|
|
users.users.${userName}.extraGroups = ["wheel" "video" "network"];
|
|
|
|
# fail2ban
|
|
services.fail2ban = {
|
|
enable = true;
|
|
package = pkgs.fail2ban;
|
|
maxretry = 5;
|
|
bantime = "3h";
|
|
bantime-increment = {
|
|
enable = true;
|
|
rndtime = "10m";
|
|
};
|
|
};
|
|
|
|
# Matrix server
|
|
services.matrix-tuwunel = {
|
|
enable = true;
|
|
package = pkgs.matrix-tuwunel;
|
|
settings = {
|
|
global = {
|
|
server_name = "wyattjmiller.com";
|
|
allow_encryption = true;
|
|
allow_federation = true;
|
|
allow_registration = true;
|
|
};
|
|
# TODO: figure out what goes here
|
|
};
|
|
};
|
|
|
|
# LiveKit (MatrixRTC)
|
|
services.livekit = {
|
|
enable = true;
|
|
package = pkgs.livekit;
|
|
openFirewall = true;
|
|
settings = {
|
|
# TODO: figure out what goes here
|
|
};
|
|
};
|
|
|
|
# TURN/STUN server
|
|
# services.coturn = {
|
|
#
|
|
# };
|
|
|
|
system.stateVersion = "25.11";
|
|
}
|