109 lines
3.5 KiB
Nix
109 lines
3.5 KiB
Nix
{ inputs, lib, pkgs, ... }:
|
|
{
|
|
nix.settings.experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
|
|
environment.systemPackages = [
|
|
pkgs.vim
|
|
pkgs.git
|
|
pkgs.agenix
|
|
pkgs.podman
|
|
pkgs.python3
|
|
pkgs.podman-compose
|
|
pkgs.zip
|
|
pkgs.unzip
|
|
pkgs.jq
|
|
];
|
|
|
|
virtualisation.podman = {
|
|
enable = true;
|
|
dockerCompat = true;
|
|
defaultNetwork.settings.dns_enabled = true;
|
|
};
|
|
|
|
users.users.reudy = {
|
|
isNormalUser = true;
|
|
homeMode = "0755";
|
|
extraGroups = [ "wheel" "podman" ]; #sudo
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3"
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD0mitcnuzNWof+RbTIoxDaXonU6yk+i6kpA4lIdI5fE6fzLCOGia5q4t1qen7Lhj1RMuJRqg5R8GeYmAW3tx2Uo3mqnQLJY227xs2FJU5ygn8JW1Uivp6sCJO5yzCHv8JYy9ala+eHlmppmjBo+NnU2mNlPfM5pNKef/srz5jmkeD+73rUim/1KSCZ3yOzSzc1jf7vNkxXAgDREzbmX/sqIrhG2DxjGAaX6SJjh0lh9OF6m1lAkEGq39h3WS7UKAsP3Z2OOSfEKwAefYvijIoWpL5+XGas3p7mhBG9ZDATJVcUHD/tg7XC4QOU8rYTjuP2/ECFS37q4+OCCJlyBRY46AS4ohKDs9iF8z9IjI3G2P6nTOeIySL84kKGI3ufcvBtUpITKWF4rwLE2R4WVG3SOMSCizFJZtpijVOJJulJUYwIyx0khSGpg3cL2LePyJn23FMlaG6w03H0ngdckGxLuvd+H0D12YVa0990hYaquzXPfMsSUy5T9ZievsVu6jU= reudy@Reudy"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKwpcTESCEAiQ+/c8bM9Y2b53nCCl3qFI5KRuEkR+Ya jacob@DESKTOP-40EVMS3"
|
|
];
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"f /var/lib/systemd/linger/reudy"
|
|
];
|
|
|
|
security.sudo.wheelNeedsPassword = true;
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "reudy" ];
|
|
commands = [
|
|
{
|
|
command = "/run/current-system/sw/bin/systemctl reload caddy";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
|
|
# Allow root login with password, needed for passwords set through vpsAdmin
|
|
settings = {
|
|
PermitRootLogin = "no";
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
X11Forwarding = false;
|
|
AllowUsers = [ "reudy" ];
|
|
};
|
|
|
|
ports = [ 14902 ];
|
|
|
|
# Needed for public keys deployed through vpsAdmin, can be disabled if you
|
|
# authorize your keys in configuration
|
|
authorizedKeysInHomedir = true;
|
|
};
|
|
|
|
# fail2ban
|
|
services.fail2ban = {
|
|
enable = true;
|
|
maxretry = 5;
|
|
bantime = "24h";
|
|
bantime-increment = {
|
|
enable = true;
|
|
multipliers = "1 2 4 8 16 32 64";
|
|
maxtime = "168h";
|
|
overalljails = true;
|
|
};
|
|
jails.sshd.settings = {
|
|
enabled = true;
|
|
port = "14902";
|
|
maxretry = 3;
|
|
findtime = "10m";
|
|
bantime = "1h";
|
|
};
|
|
};
|
|
|
|
# Networking
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 80 443 14902 ]; # http https ssh
|
|
};
|
|
|
|
systemd.settings.Manager = {
|
|
DefaultTimeoutStartSec = "900s";
|
|
};
|
|
|
|
time.timeZone = "Europe/Amsterdam";
|
|
|
|
system.stateVersion = "25.11";
|
|
}
|