NixOS-Configs/hosts/server/default.nix

{
  inputs,
  outputs,
  lib,
  config,
  pkgs,
  ...
}: let
  my-python-packages = python-packages:
    with python-packages; [
      # pipx
      distutils
      docx2txt
      numpy
      pip
      python-dateutil
      requests
      setuptools
    ];
  python-with-my-packages = pkgs.python313.withPackages my-python-packages;
in {
  nix = {
    settings = {
      experimental-features = ["nix-command" "flakes"];
      warn-dirty = false;
      auto-optimise-store = true;
      trusted-users = ["root" "don"];
    };
    gc = {
      automatic = true;
      dates = "daily";
      options = lib.mkDefault "--delete-older-than 4d";
    };
  };
  imports = [
    ../vars.nix
    ../../home
    ./systemd.nix
    ../systemd-primary.nix
    ../common
    ../../modules/beszel-agent.nix
  ];

  # Set your time zone.
  time = {
    timeZone = "America/Chicago";
    hardwareClockInLocalTime = false;
  };

  # Select internationalisation properties.
  i18n = {
    defaultLocale = "en_US.UTF-8";
    inputMethod = {
      enable = true;
      type = "fcitx5";
      fcitx5.addons = with pkgs; [fcitx5-mozc fcitx5-gtk];
    };
  };

  # Bootloader.
  boot = {
    kernelPackages = pkgs.linuxPackages_latest;
    kernelParams = ["consoleblank=60" "quiet" "splash"];
  };

  security = {
    polkit = {enable = true;};
    sudo.enable = false;
    doas = {
      enable = true;
      extraRules = [
        {
          users = ["don"];
          keepEnv = true;
          noPass = true;
        }
      ];
    };
  };

  services = {
    netbird = {
      enable = true;
    };
    pcscd = {enable = true;};
    beszel-agent = {enable = true;};
    avahi = {
      enable = true;
      nssmdns4 = true;
    };
    printing = {enable = true;};
    udisks2 = {enable = true;};
    nscd = {enableNsncd = true;};
    tailscale = {enable = true;};
    locate = {
      enable = true;
      package = pkgs.mlocate;
    };
    openssh = {
      enable = true;
      settings = {
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
        PermitRootLogin = "yes";
      };
    };
  };

  security.rtkit.enable = true;

  users.users = {
    root = {
      initialPassword = "changeme";
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
      ];
    };
    don = {
      isNormalUser = true;
      initialPassword = "changeme";
      description = "Don Harper";
      extraGroups = [
        "disk"
        "docker"
        "lp"
        "cdrom"
        "mlocate"
        "networkmanager"
        "podman"
        "scanner"
        "video"
        "wheel"
      ];
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
      ];
    };
  };

  # nixpkgs.config.allowUnfree = true;

  environment.systemPackages = with pkgs; [
    python-with-my-packages
    age
    aspell
    aspellDicts.en
    base16-schemes
    bash-completion
    btop
    colmena
    dmidecode
    docker-compose
    git-crypt
    gitFull
    has
    home-manager
    hunspell
    hunspellDicts.en_US
    id3v2
    isync
    just
    lazydocker
    lsb-release
    lsof
    lsscsi
    nix-bash-completions
    nixfmt
    pkg-config
    podman
    poppler-utils
    ruby
    sshfs
    sops
    udiskie
  ];

  sops = {
    age.keyFile = "/home/don/.config/sops/age/keys.txt";

    defaultSopsFile = ../../secrets.yaml;
    # defaultSymlinkPath = "/run/user/1000/secrets";
    # defaultSecretsMountPoint = "/run/user/1000/secrets.d";

    secrets = {
      "users/root_password" = {
        owner = "root";
        mode = "0400";
      };
      "users/root_sshauth" = {
        owner = "root";
        mode = "0400";
        path = "/etc/ssh/authorized_keys.d/root";
      };
      "users/don_password" = {
        owner = "don";
        mode = "0400";
      };
      "users/don_sshauth" = {
        owner = "don";
        mode = "0400";
        path = "/etc/ssh/authorized_keys.d/don";
      };
      "users/vicky_password" = {
        owner = "don";
        mode = "0400";
      };
      "users/vicky_sshauth" = {
        owner = "don";
        mode = "0400";
        path = "/etc/ssh/authorized_keys.d/vicky";
      };
      "smtp/smtp_password" = {
        owner = "root";
        mode = "0444";
      };
      "tailscale/ts_api" = {
        owner = "root";
        mode = "0400";
      };
    };
  };

  programs = {
    dconf = {enable = true;};
    mtr = {enable = true;};
    gnupg = {
      agent = {
        enable = true;
        pinentryPackage = pkgs.pinentry-curses;
        enableSSHSupport = true;
      };
    };
  };

  nixpkgs.overlays = [
    (final: super: {
      khal = super.khal.overridePythonAttrs (_: {doCheck = false;});
    })
  ];

  # Open ports in the firewall.
  # networking.firewall = {
  #   enable = true;
  #   trustedInterfaces = ["tailscale0"];
  #   checkReversePath = "loose";
  #   allowedUDPPorts = [config.services.tailscale.port];
  #   allowedTCPPortRanges = [
  #     {
  #       from = 1714;
  #       to = 1764;
  #     }
  #   ];
  #   allowedUDPPortRanges = [
  #     {
  #       from = 1714;
  #       to = 1764;
  #     }
  #   ];
  #   allowedTCPPorts = [22 80 443];
  # };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.11"; # Did you read the comment?
  programs.msmtp = {
    enable = true;
    accounts = {
      default = {
        auth = true;
        tls = false;
        port = 587;
        from = "don@donharper.org";
        host = "smtp.smtp2go.com";
        user = "duckunix";
        passwordeval = "cat ${config.sops.secrets."smtp/smtp_password".path}";
      };
    };
  };
}