Snapshot configuration

1 files changed, 102 insertions, 0 deletions

diff --git a/configuration.nix b/configuration.nix
new file mode 100644
index 0000000..09039d3
--- /dev/null
+++ b/configuration.nix
@@ -0,0 +1,102 @@
+{ config, pkgs, ... }:
+{
+  environment = {
+    enableAllTerminfo = true;
+    systemPackages = with pkgs; [ git vim ];
+  };
+
+  imports = [ ./vpsadminos.nix ];
+
+  networking = {
+    domain = "loang.net";
+
+    firewall = {
+      allowedTCPPorts = [
+        80 # HTTP
+        443 # TLS
+        2211 # SSH
+        4001 # IPFS
+      ];
+      allowedUDPPorts = [
+        4001 # IPFS
+      ];
+    };
+
+    hostName = "brno";
+  };
+
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults.email = "mcsinyx@disroot.org";
+    };
+
+    sudo = {
+      enable = true;
+      execWheelOnly = true;
+      wheelNeedsPassword = false;
+    };
+  };
+
+  services = {
+    nginx = {
+      enable = true;
+      virtualHosts."loang.net" = {
+        enableACME = true;
+        forceSSL = true;
+        root = "/var/www/loang.net";
+      };
+    };
+
+    ipfs = {
+      enable = true;
+      enableGC = true;
+    };
+
+    openssh = {
+      enable = true;
+      passwordAuthentication = false;
+      ports = [ 2211 ];
+    };
+  };
+
+  system.stateVersion = "22.05";
+
+  systemd.extraConfig = ''
+    DefaultTimeoutStartSec=900s
+  '';
+
+  time.timeZone = "UTC";
+
+  users = {
+    groups.git = {};
+
+    users = {
+      ckie = {
+        isNormalUser = true;
+        openssh.authorizedKeys.keyFiles = [ "/etc/ssh/ckie.pub" ];
+      };
+
+      cnx = {
+        extraGroups = [ "wheel" ];
+        isNormalUser = true;
+        openssh.authorizedKeys.keyFiles = [ "/etc/ssh/cnx.pub" ];
+        packages = with pkgs; [ stow ];
+      };
+
+      git = {
+        createHome = true;
+        home = "/var/lib/git";
+        group = "git";
+        isSystemUser = true;
+        openssh.authorizedKeys.keyFiles = [ "/etc/ssh/cnx.pub" ];
+        shell = "${pkgs.git}/bin/git-shell";
+      };
+
+      xarvos = {
+        isNormalUser = true;
+        openssh.authorizedKeys.keyFiles = [ "/etc/ssh/xarvos.pub" ];
+      };
+    };
+  };
+}