add saklas host, mail/webserver vps

3 files changed, 164 insertions, 0 deletions

diff --git a/flake.nix b/flake.nix
index 1f8f37b..6fd51ff 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,6 +54,14 @@
                                         }
                                 ];
                         };
+
+                        saklas = nixpkgs.lib.nixosSystem {
+                                system = "x86_64-linux";
+                                specialArgs = inputs;
+                                modules = [
+                                        ./hosts/saklas
+                                ];
+                        };
                 };
         };
 }
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
new file mode 100644
index 0000000..0c50167
--- /dev/null
+++ b/hosts/saklas/default.nix
@@ -0,0 +1,144 @@
+{ config, lib, pkgs, inputs, ... }:
+
+{
+  imports = [
+    ./hardware.nix
+  ];
+
+  # disable wifi and open some ports
+  networking = {
+    hostName = "saklas";
+    hostId = "b0bababe";
+
+    wireless.enable = false;
+
+    firewall = {
+      allowedTCPPorts = [ 22 80 443 ];
+      allowedUDPPorts = [ 51413 ];
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+  };
+
+  # enable flakes and nix cli
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+
+  # Define a user account.
+  users.users.vin = {
+    isNormalUser = true;
+
+    extraGroups = [
+      "wheel"
+    ];
+
+    shell = pkgs.zsh;
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
+    ];
+  };
+
+  # default packages for both me and root
+  environment = {
+    systemPackages = with pkgs; [
+      doas-sudo-shim
+      emacs
+      git
+      wget
+    ];
+
+    pathsToLink = [ "/share/zsh" ];
+  };
+
+  programs = {
+    # disable nano. I don't like nano.
+    nano.enable = false;
+
+    # configuration in home-manager
+    zsh.enable = true;
+    zsh.promptInit = "PS1='$ '";
+  };
+
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults.email = "me@vineetk.net";
+      defaults.server = "https://acme-v02.api.letsencrypt.org/directory";
+    };
+
+    # I prefer doas over sudo for simplicity
+    doas = {
+      enable = true;
+      extraRules = [{
+        users = [ "vin" ];
+        keepEnv = true;
+        persist = true;
+      }];
+    };
+
+    sudo.enable = false;
+  };
+
+  services = {
+    # reverse proxy
+    nginx = {
+      enable = true;
+
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+
+/*
+      virtualHosts = {
+        "vineetk.net" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/".proxyPass = "http://127.0.0.1:8081";
+        };
+
+        "vinbiz.ca" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/".proxyPass = "http://127.0.0.1:8082";
+        };
+
+        "13f0.net" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/".proxyPass = "http://127.0.0.1:4533";
+        };
+      };
+*/
+    };
+
+    # ssh
+    openssh = {
+      enable = true;
+
+      settings = {
+        KbdInteractiveAuthentication = false;
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        X11Forwarding = true;
+      };
+    };
+  };
+
+  # create caches and use mandoc
+  documentation.man = {
+    enable = true;
+    generateCaches = true;
+    man-db.enable = false;
+    mandoc.enable = true;
+  };
+
+  system.stateVersion = "24.11";
+}
diff --git a/hosts/saklas/hardware.nix b/hosts/saklas/hardware.nix
new file mode 100644
index 0000000..e8b9e8e
--- /dev/null
+++ b/hosts/saklas/hardware.nix
@@ -0,0 +1,12 @@
+{ modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.loader.grub.device = "/dev/sda";
+
+  fileSystems."/" = {
+    device = "/dev/sda1";
+    fsType = "ext4";
+  };
+}