nixos/machines/_base.nix

93 lines
2.3 KiB
Nix
Raw Normal View History

{ pkgs, modulesPath, config, options, inputs, ... }:
2023-01-25 11:48:44 +00:00
{
imports = [
(modulesPath + "/virtualisation/proxmox-lxc.nix")
# for the secrets
2023-08-06 20:58:23 +00:00
inputs.agenix.nixosModules.default
2023-06-15 21:02:30 +00:00
# every sever may need the firewall config stuff
../applications/firewall.nix
# every sever needs to have a dns record
../applications/dns.nix
# every server needs teh ldap client for admins
../applications/ldap_client.nix
# every server will need the config to backup to
../applications/restic.nix
2023-01-25 11:48:44 +00:00
];
# flakes are essensial
nix.settings.experimental-features = [ "nix-command" "flakes" ];
system.stateVersion = "22.11";
services.openssh = {
enable = true;
2023-06-17 20:35:57 +00:00
settings.PermitRootLogin = "prohibit-password";
2023-01-25 11:48:44 +00:00
};
users.users.root = {
initialHashedPassword = "";
openssh.authorizedKeys.keys = [
# no obligation to have name attached to keys
# Root account
2023-01-25 11:48:44 +00:00
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6DjXTAxesXpQ65l659iAjzEb6VpRaWKSg4AXxifPw9 Skynet Admin"
2023-07-25 22:54:56 +00:00
# CI/CD key
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBDvexq/JjsMqL0G5P38klzoOkHs3IRyXYO1luEJuB5R colmena_key"
# Brendan Golden
2023-01-25 11:48:44 +00:00
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEHNLroAjCVR9Tx382cqdxPZ5KY32r/yoQH1mgsYNqpm Silver_Laptop_WSL_Deb"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjaKI97NY7bki07kxAvo95196NXCaMvI1Dx7dMW05Q1 thenobrainer"
2023-01-25 11:48:44 +00:00
];
};
2023-06-15 20:38:42 +00:00
# skynet-admin-linux will always be added, individual servers can override the groups option
2023-06-14 20:06:44 +00:00
services.skynet_ldap_client.enable = true;
networking = {
2023-04-20 23:53:25 +00:00
# every sever needs to be accessable over ssh for admin use at least
firewall.allowedTCPPorts = [22];
# explisitly stating this is good
defaultGateway = "193.1.99.65";
# cannot use our own it seems?
nameservers = [
# ns1
2023-04-23 03:22:01 +00:00
"193.1.99.120"
2023-04-24 19:19:32 +00:00
# ns2
"193.1.99.109"
];
};
# time on vendetta is strangely out of sync
networking.timeServers = options.networking.timeServers.default ++ [ "ie.pool.ntp.org" ];
services.ntp.enable = true;
2023-06-15 20:38:42 +00:00
# use teh above nameservers as the fallback dns
services.resolved.fallbackDns = config.networking.nameservers;
2023-01-25 11:48:44 +00:00
environment.systemPackages = [
# for flakes
pkgs.git
# useful tools
pkgs.ncdu_2
pkgs.htop
pkgs.nano
pkgs.nmap
2023-04-19 19:42:00 +00:00
pkgs.bind
2023-06-11 21:11:39 +00:00
pkgs.zip
pkgs.traceroute
pkgs.openldap
pkgs.screen
2023-01-25 11:48:44 +00:00
];
}