nixos-servers/configuration.nix

139 lines
3.3 KiB
Nix
Raw Normal View History

{ pkgs, config, machine, ... }: {
imports = [ ./hardware-configuration.nix ./disk-config.nix ./agenix.nix ];
2023-11-05 17:43:32 +00:00
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
time.timeZone = "Europe/Amsterdam";
i18n = {
defaultLocale = "en_US.UTF-8";
extraLocaleSettings = {
LC_ADDRESS = "nl_NL.UTF-8";
LC_IDENTIFICATION = "nl_NL.UTF-8";
LC_MEASUREMENT = "nl_NL.UTF-8";
LC_MONETARY = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8";
LC_NUMERIC = "nl_NL.UTF-8";
LC_PAPER = "nl_NL.UTF-8";
LC_TELEPHONE = "nl_NL.UTF-8";
LC_TIME = "nl_NL.UTF-8";
};
};
services = {
openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
};
extraConfig = ''
2023-11-15 12:10:27 +00:00
HostCertificate ${
builtins.toFile "host_ed25519-cert.pub" machine.host-cert
}
HostKey ${config.age.secrets.host_ed25519.path}
2023-11-05 17:43:32 +00:00
'';
};
xserver = {
layout = "us";
xkbVariant = "";
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOodpLr+FDRyKyHjucHizNLVFHZ5AQmE9GmxMnOsSoaw pimkunis@thinkpadpim"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINUZp4BCxf7uLa1QWonx/Crf8tYZ5MKIZ+EuaBa82LrV user@user-laptop"
];
programs.ssh = {
knownHosts = {
dmz = {
2023-11-11 23:04:37 +00:00
hostNames = [ "*.dmz" ];
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x";
2023-11-05 17:43:32 +00:00
certAuthority = true;
};
hypervisors = {
2023-11-11 23:04:37 +00:00
hostNames = [ "*.hyp" ];
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzRkH3d/KVJQouswY/DMpenWbDFVOnI3Vut0xR0e1tb";
2023-11-05 17:43:32 +00:00
certAuthority = true;
};
};
extraConfig = ''
2023-11-15 12:10:27 +00:00
CertificateFile ${
builtins.toFile "user_ed25519-cert.pub" machine.user-cert
}
HostKey ${config.age.secrets.user_ed25519.path}
2023-11-05 17:43:32 +00:00
'';
};
nixpkgs.config.allowUnfree = true;
2023-11-11 23:04:37 +00:00
environment.systemPackages = with pkgs; [ vim neofetch cowsay python3 ];
2023-11-05 17:43:32 +00:00
2023-11-08 20:16:51 +00:00
networking.firewall.enable = false;
networking.nftables = {
enable = true;
checkRuleset = true;
ruleset = builtins.readFile ./nftables.conf;
};
2023-11-05 17:43:32 +00:00
system.stateVersion = "23.05";
systemd.network = {
enable = true;
netdevs = {
"20-vlandmz" = {
netdevConfig = {
Kind = "vlan";
Name = "vlandmz";
};
vlanConfig.Id = 30;
};
"20-bridgedmz" = {
netdevConfig = {
Kind = "bridge";
Name = "bridgedmz";
};
};
};
networks = {
"30-main-nic" = {
matchConfig.Name = "en*";
2023-11-11 23:04:37 +00:00
networkConfig = { DHCP = "yes"; };
vlan = [ "vlandmz" ];
2023-11-05 17:43:32 +00:00
};
"40-vlandmz" = {
matchConfig.Name = "vlandmz";
networkConfig = {
IPv6AcceptRA = false;
LinkLocalAddressing = "no";
Bridge = "bridgedmz";
};
linkConfig.RequiredForOnline = "enslaved";
};
"40-bridgedmz" = {
matchConfig.Name = "bridgedmz";
networkConfig = {
IPv6AcceptRA = false;
LinkLocalAddressing = "no";
};
linkConfig.RequiredForOnline = "carrier";
};
};
};
virtualisation.libvirtd.enable = true;
}