152 lines
3.7 KiB
Nix
152 lines
3.7 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
hostInfo,
|
|
customPkgs,
|
|
flakeRev,
|
|
...
|
|
}:
|
|
let
|
|
inherit (hostInfo) paths;
|
|
in
|
|
{
|
|
imports = [ ./modules/autodeploy.nix ];
|
|
|
|
services.server-autodeploy.enable = true;
|
|
|
|
assertions =
|
|
let
|
|
isMounted =
|
|
path:
|
|
lib.any (
|
|
# rootfs may be subject to erasure so it's not persistent
|
|
fs: fs.mountPoint != "/" && (fs.mountPoint == path || lib.hasPrefix "${fs.mountPoint}/" path)
|
|
) (lib.attrValues config.fileSystems);
|
|
|
|
isMountedEarly = path: (config.fileSystems.${path} or { neededForBoot = false; }).neededForBoot;
|
|
|
|
mountAssertion = path: {
|
|
assertion = isMounted path;
|
|
message = "configuration.nix needs '${path}' to be a mounted path, but no fileSystems entry covers it.";
|
|
};
|
|
|
|
earlyMountAssertion = path: {
|
|
assertion = isMountedEarly path;
|
|
message = "configuration.nix needs '${path}' to be mounted early (neededForBoot = true), but its fileSystems entry doesn't set that.";
|
|
};
|
|
|
|
strictPaths = lib.optionals (!hostInfo.isVm) [
|
|
"/nix"
|
|
"/var/log"
|
|
];
|
|
in
|
|
map mountAssertion (
|
|
[
|
|
paths.server
|
|
paths.secrets
|
|
]
|
|
++ strictPaths
|
|
)
|
|
++ lib.optionals (!hostInfo.isVm) [ (earlyMountAssertion "/var/log") ];
|
|
|
|
time.timeZone = "UTC";
|
|
system.stateVersion = "26.05";
|
|
system.nixos.label =
|
|
let
|
|
labelFile = ./.nixos-label;
|
|
in
|
|
if builtins.pathExists labelFile then lib.removeSuffix "\n" (builtins.readFile labelFile) else flakeRev;
|
|
|
|
nix = {
|
|
settings = {
|
|
experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
};
|
|
nrBuildUsers = 80;
|
|
};
|
|
|
|
powerManagement.cpuFreqGovernor = "performance";
|
|
|
|
boot.kernelParams = [ "transparent_hugepage=madvise" ];
|
|
|
|
services = {
|
|
fstrim = {
|
|
enable = true;
|
|
interval = "weekly";
|
|
};
|
|
|
|
openssh = {
|
|
enable = true;
|
|
ports = [ 5952 ];
|
|
hostKeys =
|
|
lib.map
|
|
(type: {
|
|
inherit type;
|
|
path = "${paths.secrets}/ssh_host_${type}_key";
|
|
})
|
|
[
|
|
"ed25519"
|
|
"ecdsa"
|
|
"rsa"
|
|
];
|
|
settings.PasswordAuthentication = false;
|
|
};
|
|
};
|
|
|
|
users.mutableUsers = false;
|
|
users.users.server = {
|
|
uid = 1000;
|
|
isNormalUser = true;
|
|
extraGroups = [
|
|
"wheel"
|
|
"systemd-journal"
|
|
];
|
|
hashedPassword = "!";
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi flowey@arch"
|
|
];
|
|
};
|
|
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
security.polkit.extraConfig = ''
|
|
polkit.addRule(function(action, subject) {
|
|
if (action.id.startsWith("org.freedesktop.machine1.") &&
|
|
subject.user === "server") {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
'';
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"L /home/server/config - - - - /persist/@configuration"
|
|
"L /home/server/containers - - - - /persist/@containers"
|
|
"L /home/server/secrets - - - - /persist/@secrets"
|
|
];
|
|
|
|
environment.etc."machine-id".text = "${
|
|
builtins.substring 0 32 (builtins.hashString "sha256" "machine-id-for-${hostInfo.hostname}")
|
|
}\n";
|
|
environment.systemPackages = [
|
|
customPkgs.ct
|
|
customPkgs.server-rebuild
|
|
customPkgs.server-status
|
|
customPkgs.server-kexec
|
|
customPkgs.kitty-terminfo
|
|
pkgs.git
|
|
pkgs.wezterm.terminfo
|
|
];
|
|
|
|
networking.firewall.allowedTCPPorts = [ 5952 ];
|
|
|
|
system.activationScripts.server-keypair = ''
|
|
if [[ ! -f "${paths.server}/keypair/id_ed25519" ]]; then
|
|
mkdir -p "${paths.server}/keypair"
|
|
${lib.getExe' pkgs.openssh "ssh-keygen"} -t ed25519 -f "${paths.server}/keypair/id_ed25519" -N ""
|
|
fi
|
|
'';
|
|
}
|