73 lines
1.4 KiB
Nix
73 lines
1.4 KiB
Nix
{
|
|
config,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./secrets
|
|
./dyndns
|
|
./vaultwarden.nix
|
|
];
|
|
|
|
kekleo.graphical = false;
|
|
|
|
users.users.leonhard = {
|
|
initialPassword = "leonhard";
|
|
isNormalUser = true;
|
|
extraGroups = [ "wheel" ];
|
|
openssh.authorizedKeys.keys = config.kekleo.publicKeys;
|
|
};
|
|
|
|
networking = {
|
|
hostName = "server";
|
|
firewall.enable = false;
|
|
interfaces.eno1 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = "192.168.178.210";
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
};
|
|
defaultGateway = {
|
|
address = "192.168.178.1";
|
|
interface = "eno1";
|
|
};
|
|
nameservers = [
|
|
"1.1.1.1"
|
|
"8.8.8.8"
|
|
];
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
ports = [ 5432 ];
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
AllowUsers = [ "leonhard" ];
|
|
};
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "admin@${config.kekleo.domain}";
|
|
defaults.webroot = "/var/lib/acme/acme-challenge/";
|
|
certs.${config.kekleo.domain} = {
|
|
group = config.services.nginx.group;
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
|
|
virtualHosts.${config.kekleo.domain} = {
|
|
forceSSL = true;
|
|
useACMEHost = config.kekleo.domain;
|
|
locations."/.well-known/".root = config.security.acme.defaults.webroot;
|
|
};
|
|
};
|
|
}
|