erik
946c44f1d3
- new nixosConfigurations.vps: UEFI systemd-boot, disko on /dev/vda - static IPv4 159.195.64.117/22 gw .1 (+ IPv6), eth0 pinned, public DNS - tailscale via headscale + sops authkey (secrets/vps.yaml, own host key) - caddy public reverse proxy: audiobookshelf.mgaction.town -> jupiter tailnet:8000 - shared common.nix (user/ssh/nix) ; .sops.yaml per-host rules
42 lines
1.1 KiB
Nix
42 lines
1.1 KiB
Nix
{ pkgs, ... }:
|
|
|
|
# Shared base for all hosts: user, SSH hardening, nix settings, packages.
|
|
# (jupiter still carries its own copy in services.nix; vps uses this.)
|
|
{
|
|
# ---- User ----
|
|
users.users.darman = {
|
|
isNormalUser = true;
|
|
description = "darman";
|
|
extraGroups = [ "wheel" "networkmanager" ];
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
|
|
];
|
|
};
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
# ---- SSH (key-only) ----
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
};
|
|
};
|
|
|
|
# ---- Nix ----
|
|
nix.settings = {
|
|
experimental-features = [ "nix-command" "flakes" ];
|
|
# trust wheel so `nixos-rebuild --target-host darman@…` can push closures.
|
|
trusted-users = [ "root" "@wheel" ];
|
|
};
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [ vim git htop tmux curl ];
|
|
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
}
|