feat: flake NixOS config for jupiter + VirtualBox test image

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-11 16:09:32 +02:00
commit bb4823efe9
7 changed files with 277 additions and 0 deletions
@@ -0,0 +1,116 @@
+{ config, pkgs, lib, ... }:
+
+# Portable system + service config. Contains NO bootloader or filesystem
+# settings, so it can be reused by both the real host (configuration.nix)
+# and the VirtualBox test image (see flake.nix).
+
+{
+  # ---- Networking ----
+  networking.hostName = "jupiter";
+  networking.networkmanager.enable = true;
+
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      22    # ssh
+      445 139  # samba
+      80 443   # reverse proxy (caddy)
+    ];
+  };
+
+  # ---- Locale / time ----
+  time.timeZone = "Europe/Berlin";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # ---- Users ----
+  users.users.erik = {
+    isNormalUser = true;
+    description = "erik";
+    extraGroups = [ "wheel" "networkmanager" "docker" ];
+    # Replace with your real public key. Password login for ssh is disabled below.
+    openssh.authorizedKeys.keys = [
+      # "ssh-ed25519 AAAA... erik@laptop"
+    ];
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  # ---- SSH ----
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  # ---- Storage / NAS ----
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "workgroup" = "WORKGROUP";
+        "server string" = "jupiter";
+        "security" = "user";
+      };
+      data = {
+        "path" = "/mnt/data";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "valid users" = "erik";
+      };
+    };
+  };
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      userServices = true;
+    };
+  };
+
+  # ---- Containers ----
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      whoami = {
+        image = "traefik/whoami:latest";
+        ports = [ "8080:80" ];
+        autoStart = true;
+      };
+    };
+  };
+
+  # ---- Reverse proxy ----
+  services.caddy = {
+    enable = true;
+  };
+
+  # ---- System packages ----
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+    htop
+    tmux
+    curl
+  ];
+
+  # ---- Nix settings ----
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+  system.stateVersion = "26.05";
+}