{ pkgs, modulesPath, config, options, inputs, lib, ... }: with lib; let cfg = config.skynet; in { imports = [ # custom lxc mocule until the patch gets merged in ../applications/proxmox-lxc.nix # (modulesPath + "/virtualisation/proxmox-lxc.nix") # for the secrets inputs.agenix.nixosModules.default # every sever may need the firewall config stuff ../applications/firewall.nix # every sever needs to have a dns record ../applications/dns.nix # every server needs teh ldap client for admins ../applications/ldap/client.nix # every server will need the config to backup to ../applications/restic.nix # every server will be monitored for grafana ../applications/prometheus.nix #TODO: make sure no additional config needed for exporters ? ]; options.skynet = { lxc = mkOption { type = types.bool; # most of our servers are lxc so its true by default default = true; description = mdDoc "Is this a Linux Container?"; }; }; config = { # if its a lxc enable proxmoxLXC.enable = cfg.lxc; nix = { settings = { # flakes are essensial experimental-features = ["nix-command" "flakes"]; trusted-users = [ "root" "@skynet-admins-linux" ]; }; # https://nixos.wiki/wiki/Storage_optimization # gc = { # automatic = true; # dates = "weekly"; # options = "--delete-older-than 30d"; # }; # to free up to 10GiB whenever there is less than 1GiB left extraOptions = '' min-free = ${toString (1024 * 1024 * 1024)} max-free = ${toString (1024 * 1024 * 1024 * 10)} ''; }; system.stateVersion = "22.11"; services.openssh = { enable = true; settings.PermitRootLogin = "prohibit-password"; }; users.users.root = { initialHashedPassword = ""; openssh.authorizedKeys.keys = [ # no obligation to have name attached to keys # Root account "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK6DjXTAxesXpQ65l659iAjzEb6VpRaWKSg4AXxifPw9 Skynet Admin" # CI/CD key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBDvexq/JjsMqL0G5P38klzoOkHs3IRyXYO1luEJuB5R colmena_key" # Brendan Golden "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEHNLroAjCVR9Tx382cqdxPZ5KY32r/yoQH1mgsYNqpm Silver_Laptop_WSL_Deb" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKjaKI97NY7bki07kxAvo95196NXCaMvI1Dx7dMW05Q1 thenobrainer" ]; }; # skynet-admin-linux will always be added, individual servers can override the groups option services.skynet_ldap_client.enable = true; networking = { # every sever needs to be accessable over ssh for admin use at least firewall.allowedTCPPorts = [22]; # explisitly stating this is good defaultGateway = { address = "193.1.99.65"; interface = "eth0"; }; # cannot use our own it seems? nameservers = [ # ns1 "193.1.99.120" # ns2 "193.1.99.109" ]; }; # time on vendetta is strangely out of sync networking.timeServers = options.networking.timeServers.default ++ ["ie.pool.ntp.org"]; services.ntp.enable = true; # use teh above nameservers as the fallback dns services.resolved.fallbackDns = config.networking.nameservers; # https://discourse.nixos.org/t/systemd-networkd-wait-online-934764-timeout-occurred-while-waiting-for-network-connectivity/33656/9 systemd.network.wait-online.enable = false; environment.systemPackages = [ # for flakes pkgs.git # useful tools pkgs.ncdu_2 pkgs.htop pkgs.nano pkgs.nmap pkgs.bind pkgs.zip pkgs.traceroute pkgs.openldap pkgs.screen ]; }; }