nixos-config

default.nix (9489B)

---

 {
   config,
   lib,
   pkgs,
   inputs,
   ...
 }:
 
 {
   imports = [
     ./hardware.nix
   ];
 
   # decrypt agenix secrets
   age.secrets = {
     email_vinbiz.file = ../../secrets/email_vinbiz.age;
     email_vineetk.file = ../../secrets/email_vineetk.age;
     email_13f0.file = ../../secrets/email_13f0.age;
 
     hetzner_dns = {
       file = ../../secrets/hetzner_dns.age;
       owner = "root";
       group = "root";
     };
 
     radicale_users = {
       file = ../../secrets/radicale_users.age;
       owner = "radicale";
     };
 
     tailscale_saklas = {
       file = ../../secrets/tailscale_saklas.age;
       owner = "root";
       group = "root";
     };
   };
 
   # disable wifi and open some ports
   networking = {
     hostName = "saklas";
     hostId = "b0bababe";
     useDHCP = false;
 
     wireless.enable = false;
 
     firewall = {
       allowedTCPPorts = [
         22
         80
         443
         5222
         5269
       ];
       allowedUDPPorts = [
         3478
         51820
       ];
     };
   };
 
   systemd.network = {
     enable = true;
     networks."10-wan" = {
       matchConfig.Name = "enp1s0";
       networkConfig.DHCP = "no";
       address = [
         "95.217.18.52/32"
         "2a01:4f9:c010:a653::1/64"
       ];
       dns = [
         "185.12.64.1"
         "185.12.64.2"
       ];
       routes = [
         { Destination = "172.31.1.1"; }
         {
           Gateway = "172.31.1.1";
           GatewayOnLink = true;
         }
       ];
     };
   };
 
   # Set your time zone.
   time.timeZone = "America/Toronto";
 
   # Select internationalisation properties.
   i18n.defaultLocale = "en_US.UTF-8";
   console = {
     font = "Lat2-Terminus16";
   };
 
   # enable flakes and nix cli
   nix.settings.experimental-features = [
     "nix-command"
     "flakes"
   ];
 
   # user accounts
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
   ];
 
   users.users.vin = {
     isNormalUser = true;
 
     extraGroups = [
       "nginx"
       "wheel"
     ];
 
     shell = pkgs.zsh;
 
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
     ];
   };
 
   # default packages for both me and root
   environment = {
     systemPackages = with pkgs; [
       doas-sudo-shim
       gitMinimal
       htop
       ncdu
       wget
     ];
 
     pathsToLink = [ "/share/zsh" ];
   };
 
   programs = {
     # disable nano. I don't like nano.
     nano.enable = false;
 
     # configuration in home-manager
     zsh.enable = true;
     zsh.promptInit = "PS1='$ '";
   };
 
   security = {
     # TLS
     acme = {
       acceptTerms = true;
 
       defaults = {
         credentialFiles."HETZNER_API_KEY_FILE" = config.age.secrets.hetzner_dns.path;
         dnsProvider = "hetzner";
         email = "acme@vineetk.net";
         server = "https://acme-v02.api.letsencrypt.org/directory";
       };
 
       certs = {
         "vinbiz.ca".extraDomainNames = [ "*.vinbiz.ca" ];
         "vineetk.net".extraDomainNames = [ "*.vineetk.net" ];
         "13f0.net".extraDomainNames = [ "*.13f0.net" ];
 
         "xmpp.vineetk.net" = {
           group = config.services.prosody.group;
           extraDomainNames = [
             "vineetk.net"
             "muc.vineetk.net"
             "u.vineetk.net"
           ];
           reloadServices = [ "prosody" ];
         };
       };
     };
 
     # I prefer doas over sudo for simplicity
     doas = {
       enable = true;
       extraRules = [
         {
           users = [ "vin" ];
           keepEnv = true;
           persist = true;
         }
       ];
     };
 
     sudo.enable = false;
   };
 
   services = {
     # git
     cgit."git.vineetk.net" = {
       enable = true;
       scanPath = "/var/lib/git";
     };
 
     # VPN
     headscale = {
       enable = true;
       address = "127.0.0.1";
       port = 8080;
       settings = {
         server_url = "https://headscale.13f0.net";
         dns = {
           base_domain = "epistemia";
           extra_records = [
             {
               name = "invidious.demiurge.epistemia";
               type = "A";
               value = "100.64.0.2";
             }
             {
               name = "llm.demiurge.epistemia";
               type = "A";
               value = "100.64.0.2";
             }
             {
               name = "navidrome.demiurge.epistemia";
               type = "A";
               value = "100.64.0.2";
             }
             {
               name = "redlib.demiurge.epistemia";
               type = "A";
               value = "100.64.0.2";
             }
             {
               name = "sdui.demiurge.epistemia";
               type = "A";
               value = "100.64.0.2";
             }
             {
               name = "searx.demiurge.epistemia";
               type = "A";
               value = "100.64.0.2";
             }
           ];
         };
         logtail.enabled = false;
       };
     };
 
     tailscale = {
       enable = true;
       authKeyFile = config.age.secrets.tailscale_saklas.path;
       extraDaemonFlags = [ "--no-logs-no-support" ];
       extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
       openFirewall = true;
     };
 
     # XMPP
     prosody = {
       enable = true;
 
       admins = [ "vin@vineetk.net" ];
       httpFileShare.domain = "u.vineetk.net";
 
       ssl.cert = config.security.acme.certs."xmpp.vineetk.net".directory + "/full.pem";
       ssl.key = config.security.acme.certs."xmpp.vineetk.net".directory + "/key.pem";
 
       muc = [ { domain = "muc.vineetk.net"; } ];
       virtualHosts.vineetk = {
         domain = "vineetk.net";
         enabled = true;
       };
     };
 
     # web server and reverse proxy
     nginx = {
       enable = true;
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
       recommendedZstdSettings = true;
 
       virtualHosts = {
         "vineetk.net" = {
           enableACME = true;
           forceSSL = true;
           default = true;
           locations."/" = {
             index = "index.html";
             root = "/var/www/vineetk_html";
           };
         };
 
         "radicale.vineetk.net" = {
           useACMEHost = "vineetk.net";
           forceSSL = true;
           locations."/" = {
             proxyPass = "http://127.0.0.1:5232/";
             extraConfig = ''
               proxy_pass_header Authorization;
             '';
           };
         };
 
         "git.vineetk.net" = {
           useACMEHost = "vineetk.net";
           forceSSL = true;
           locations."/".proxyPass = "http://127.0.0.1:3000/";
         };
 
         "13f0.net" = {
           enableACME = true;
           forceSSL = true;
           locations."/" = {
             index = "index.html";
             root = "/var/www/13f0_html";
           };
         };
 
         "headscale.13f0.net" = {
           useACMEHost = "13f0.net";
           forceSSL = true;
           locations."/" = {
             proxyPass = "http://127.0.0.1:8080";
             proxyWebsockets = true;
           };
         };
 
         "vinbiz.ca" = {
           enableACME = true;
           forceSSL = true;
           locations."/" = {
             index = "index.html";
             root = "/var/www/vinbiz_html";
           };
         };
       };
     };
 
     # CalDAV and CardDAV
     radicale = {
       enable = true;
       settings = {
         server.hosts = [ "127.0.0.1:5232" ];
         auth = {
           type = "htpasswd";
           htpasswd_filename = config.age.secrets.radicale_users.path;
           htpasswd_encryption = "bcrypt";
         };
       };
     };
 
     # SSH
     # first use tarpit
     endlessh = {
       enable = true;
       port = 22;
       openFirewall = true;
     };
 
     # fail2ban if skiddie uses different port
     fail2ban = {
       enable = true;
       ignoreIP = [
         "35.142.66.239/20"
         "45.134.142.0/24"
       ];
     };
 
     # normal openssh
     openssh = {
       enable = true;
       ports = [ 2222 ];
 
       settings = {
         KbdInteractiveAuthentication = false;
         PasswordAuthentication = false;
         PermitRootLogin = "prohibit-password";
         X11Forwarding = true;
       };
     };
   };
 
   # email via simple-nixos-mailserver
   mailserver = {
     enable = true;
     fqdn = "mail.vineetk.net";
     domains = [
       "vineetk.net"
       "vinbiz.ca"
       "13f0.net"
     ];
 
     # A list of all login accounts. To create the password hashes, use
     # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
     loginAccounts = {
       "vineet@vineetk.net" = {
         hashedPasswordFile = config.age.secrets.email_vineetk.path;
         aliases = [ "@vineetk.net" ];
       };
 
       "kar@13f0.net" = {
         hashedPasswordFile = config.age.secrets.email_13f0.path;
         aliases = [ "@13f0.net" ];
       };
 
       "vineet@vinbiz.ca" = {
         hashedPasswordFile = config.age.secrets.email_vinbiz.path;
         aliases = [ "postmaster@vinbiz.ca" ];
       };
       "suresh@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
       "revathy@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
       "suren@vinbiz.ca".hashedPasswordFile = config.age.secrets.email_vinbiz.path;
     };
 
     acmeCertificateName = "vineetk.net";
     certificateScheme = "acme";
   };
 
   # create caches and use mandoc
   documentation.man = {
     enable = true;
     generateCaches = true;
     man-db.enable = false;
     mandoc.enable = true;
   };
 
   system.stateVersion = "24.11";
 }