vm1 | switch to server profile, and general cleanup

2022-11-26 22:47:22 -06:00 · 2022-11-26 22:47:22 -06:00 · 3fda21e356
commit 3fda21e356
parent 212b3b7cb1
5 changed files with 152 additions and 345 deletions
--- a/server/configuration.nix
+++ b/server/configuration.nix
@ -0,0 +1,148 @@
+{ config, pkgs, ... }:
+
+{
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.efi.efiSysMountPoint = "/boot";
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # Enable networking
+  networking.networkmanager.enable = true;
+  networking.networkmanager.wifi.powersave = true;
+  networking.useDHCP = false;
+  networking.extraHosts =
+    ''
+      100.75.7.116	 harper.tail rss.duckland.org vault.duckland.org git.duckland.org photos.duckland.org recipes.duckland.org vault.duckland.org dashy.duckland.org music.duckland.org bandwidth.duckland.org bandwidth2.duckland.org speed.duckland.org cloud.duckland.org plex.duckland.org smoke.duckland.org smart.duckland.org drone.home.duckland.org webhook.home.duckland.org cal.duckland.org gluetun.config.duckland.org jelly.duckland.org harper
+    '';
+
+  # Set your time zone.
+  time.timeZone = "America/Chicago";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.utf8";
+
+  # Splash screen
+  boot.plymouth.enable = false;
+  boot.plymouth.theme = "breeze";
+
+  # Enable doas instead of sudo
+  security.sudo.enable = false;
+  security.doas.enable = true;
+  security.doas.extraRules = [{
+    users = [ "don" ];
+    keepEnv = true;
+    noPass = true;
+  }];
+
+  sound.enable = false;
+  security.rtkit.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.don = {
+    isNormalUser = true;
+    description = "Don Harper";
+    extraGroups = [ "networkmanager" "wheel" "scanner" "lp" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
+    ];
+  };
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = false;
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    git-crypt
+    gitFull
+    gnupg
+    home-manager
+    keyutils
+    mosh
+    python310
+    python310Packages.tldextract
+    python310Packages.pipx
+    python310Packages.setuptools
+    syncthing
+    tailscale
+    tmux
+    tmuxp
+    topgrade
+    #vim
+    wget
+  ];
+
+  programs.mtr.enable = true;
+  services.tailscale.enable = true;
+  # create a oneshot job to authenticate to Tailscale
+  systemd.services.tailscale-autoconnect = {
+    description = "Automatic connection to Tailscale";
+
+    # make sure tailscale is running before trying to connect to tailscale
+    after = [ "network-pre.target" "tailscale.service" ];
+    wants = [ "network-pre.target" "tailscale.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    # set this service as a oneshot job
+    serviceConfig.Type = "oneshot";
+
+    # have the job run this shell script
+    script = with pkgs; ''
+      # wait for tailscaled to settle
+      sleep 2
+
+      # check if we are already authenticated to tailscale
+      status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
+      if [ $status = "Running" ]; then # if so, then do nothing
+        exit 0
+      fi
+
+      # otherwise authenticate with tailscale
+      ${tailscale}/bin/tailscale up -authkey tskey-kX35vC1CNTRL-ZLmNBp4CQV3bu3SsLGjW56
+    '';
+  };
+
+
+  # Enable the OpenSSH daemon.
+  services.openssh = {
+    enable = true;
+    passwordAuthentication = false;
+    kbdInteractiveAuthentication = false;
+    #permitRootLogin = "yes";
+  };
+
+  # Open ports in the firewall.
+  networking.firewall = {
+    enable = true;
+    # always allow traffic from your Tailscale network
+    trustedInterfaces = [ "tailscale0" ];
+    checkReversePath = "loose";
+
+    # allow the Tailscale UDP port through the firewall
+    allowedUDPPorts = [ config.services.tailscale.port ];
+
+    # allow you to SSH in over the public internet
+    allowedTCPPorts = [ 22 ];
+  };
+
+
+  system.stateVersion = "22.05"; # Did you read the comment?
+  programs.msmtp = {
+    enable = true;
+    accounts = {
+      default = {
+        auth = true;
+        tls = true;
+        from = "duck@duckland.org";
+        host = "smtp.gmail.com";
+        user = "duckunix@gmail.com";
+        passwordeval = "cat /home/don/.smtp_password.txt";
+      };
+    };
+  };
+  nix.gc = {
+    automatic = true;
+    options = "-d";
+  };
+}