117 lines
2.4 KiB
Nix
117 lines
2.4 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
# Portable system + service config. Contains NO bootloader or filesystem
|
|
# settings, so it can be reused by both the real host (configuration.nix)
|
|
# and the VirtualBox test image (see flake.nix).
|
|
|
|
{
|
|
# ---- Networking ----
|
|
networking.hostName = "jupiter";
|
|
networking.networkmanager.enable = true;
|
|
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
22 # ssh
|
|
445 139 # samba
|
|
80 443 # reverse proxy (caddy)
|
|
];
|
|
};
|
|
|
|
# ---- Locale / time ----
|
|
time.timeZone = "Europe/Berlin";
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
|
|
|
# ---- Users ----
|
|
users.users.erik = {
|
|
isNormalUser = true;
|
|
description = "erik";
|
|
extraGroups = [ "wheel" "networkmanager" "docker" ];
|
|
# Replace with your real public key. Password login for ssh is disabled below.
|
|
openssh.authorizedKeys.keys = [
|
|
# "ssh-ed25519 AAAA... erik@laptop"
|
|
];
|
|
};
|
|
|
|
security.sudo.wheelNeedsPassword = false;
|
|
|
|
# ---- SSH ----
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
PermitRootLogin = "no";
|
|
};
|
|
};
|
|
|
|
# ---- Storage / NAS ----
|
|
services.samba = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
settings = {
|
|
global = {
|
|
"workgroup" = "WORKGROUP";
|
|
"server string" = "jupiter";
|
|
"security" = "user";
|
|
};
|
|
data = {
|
|
"path" = "/mnt/data";
|
|
"browseable" = "yes";
|
|
"read only" = "no";
|
|
"guest ok" = "no";
|
|
"valid users" = "erik";
|
|
};
|
|
};
|
|
};
|
|
services.avahi = {
|
|
enable = true;
|
|
nssmdns4 = true;
|
|
publish = {
|
|
enable = true;
|
|
userServices = true;
|
|
};
|
|
};
|
|
|
|
# ---- Containers ----
|
|
virtualisation.podman = {
|
|
enable = true;
|
|
dockerCompat = true;
|
|
defaultNetwork.settings.dns_enabled = true;
|
|
};
|
|
|
|
virtualisation.oci-containers = {
|
|
backend = "podman";
|
|
containers = {
|
|
whoami = {
|
|
image = "traefik/whoami:latest";
|
|
ports = [ "8080:80" ];
|
|
autoStart = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
# ---- Reverse proxy ----
|
|
services.caddy = {
|
|
enable = true;
|
|
};
|
|
|
|
# ---- System packages ----
|
|
environment.systemPackages = with pkgs; [
|
|
vim
|
|
git
|
|
htop
|
|
tmux
|
|
curl
|
|
];
|
|
|
|
# ---- Nix settings ----
|
|
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
|
nix.gc = {
|
|
automatic = true;
|
|
dates = "weekly";
|
|
options = "--delete-older-than 30d";
|
|
};
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|