initial commit

2026-08-31 08:41:45 -05:00
commit 76fa38e34c
54 changed files with 6747 additions and 0 deletions
@@ -0,0 +1,141 @@
+{
+  config,
+  pkgs,
+  lib,
+  hostInfo,
+  customPkgs,
+  ...
+}:
+let
+  inherit (hostInfo) paths;
+in
+{
+  assertions =
+    let
+      isMounted =
+        path:
+        lib.any (
+          # rootfs may be subject to erasure so it's not persistent
+          fs: fs.mountPoint != "/" && (fs.mountPoint == path || lib.hasPrefix "${fs.mountPoint}/" path)
+        ) (lib.attrValues config.fileSystems);
+
+      isMountedEarly = path: (config.fileSystems.${path} or { neededForBoot = false; }).neededForBoot;
+
+      mountAssertion = path: {
+        assertion = isMounted path;
+        message = "configuration.nix needs '${path}' to be a mounted path, but no fileSystems entry covers it.";
+      };
+
+      earlyMountAssertion = path: {
+        assertion = isMountedEarly path;
+        message = "configuration.nix needs '${path}' to be mounted early (neededForBoot = true), but its fileSystems entry doesn't set that.";
+      };
+
+      strictPaths = lib.optionals (!hostInfo.isVm) [
+        "/nix"
+        "/var/log"
+      ];
+    in
+    map mountAssertion (
+      [
+        paths.server
+        paths.secrets
+      ]
+      ++ strictPaths
+    )
+    ++ lib.optionals (!hostInfo.isVm) [ (earlyMountAssertion "/var/log") ];
+
+  time.timeZone = "UTC";
+  system.stateVersion = "26.05";
+
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+    };
+    nrBuildUsers = 80;
+  };
+
+  powerManagement.cpuFreqGovernor = "performance";
+
+  boot.kernelParams = [ "transparent_hugepage=madvise" ];
+
+  services = {
+    fstrim = {
+      enable = true;
+      interval = "weekly";
+    };
+
+    openssh = {
+      enable = true;
+      ports = [ 5952 ];
+      hostKeys =
+        lib.map
+          (type: {
+            inherit type;
+            path = "${paths.secrets}/ssh_host_${type}_key";
+          })
+          [
+            "ed25519"
+            "ecdsa"
+            "rsa"
+          ];
+      settings.PasswordAuthentication = false;
+    };
+  };
+
+  users.mutableUsers = false;
+  users.users.server = {
+    uid = 1000;
+    isNormalUser = true;
+    extraGroups = [
+      "wheel"
+      "systemd-journal"
+    ];
+    hashedPassword = "!";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi flowey@arch"
+    ];
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id.startsWith("org.freedesktop.machine1.") &&
+          subject.user === "server") {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
+  systemd.tmpfiles.rules = [
+    "L /home/server/config     - - - - /persist/@configuration"
+    "L /home/server/containers - - - - /persist/@containers"
+    "L /home/server/secrets    - - - - /persist/@secrets"
+  ];
+
+  environment.etc."machine-id".text = "${
+    builtins.substring 0 32 (builtins.hashString "sha256" "machine-id-for-${hostInfo.hostname}")
+  }\n";
+  environment.systemPackages = [
+    customPkgs.ct
+    customPkgs.server-rebuild
+    customPkgs.server-status
+    customPkgs.server-kexec
+    customPkgs.kitty-terminfo
+    pkgs.git
+    pkgs.wezterm.terminfo
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 5952 ];
+
+  system.activationScripts.server-keypair = ''
+    if [[ ! -f "${paths.server}/keypair/id_ed25519" ]]; then
+      mkdir -p "${paths.server}/keypair"
+      ${lib.getExe' pkgs.openssh "ssh-keygen"} -t ed25519 -f "${paths.server}/keypair/id_ed25519" -N ""
+    fi
+  '';
+}