System/machines/fusion/configuration.nix

85 lines
1.9 KiB
Nix
Raw Normal View History

2022-11-23 20:36:59 -05:00
{ config, lib, pkgs, inputs, ... }:
{
# Sops setup for this machine
2022-11-29 00:22:23 -05:00
sops.secrets = {
"borg-ssh-key" = {
2022-11-29 00:31:24 -05:00
sopsFile = ../../secrets/fusion/borg.yaml;
2022-11-29 00:22:23 -05:00
format = "yaml";
};
"borg-password" = {
2022-11-29 00:31:24 -05:00
sopsFile = ../../secrets/fusion/borg.yaml;
2022-11-29 00:22:23 -05:00
format = "yaml";
};
};
2022-11-23 20:36:59 -05:00
# Setup system configuration
nathan = {
services = {
nginx = {
enable = true;
acme = true;
};
2022-11-29 00:22:23 -05:00
borg = {
enable = true;
extraExcludes = [ "/var/log" ];
passwordFile = config.sops.secrets."borg-password".path;
sshKey = config.sops.secrets."borg-ssh-key".path;
};
2022-11-23 20:36:59 -05:00
};
config = {
setupGrub = false;
nix = {
autoUpdate = true;
autoGC = true;
};
harden = false;
};
};
# Configure bootloader
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
boot.kernelParams = [ "net.ifnames=0" ];
# Configure networking
networking = {
domain = "mccarty.io";
useDHCP = true;
nameservers = [ "1.1.1.1" ];
# Open ports in firewall
firewall = {
allowedTCPPorts = [ ];
allowedUDPPorts = [ ];
};
};
# Setup home manager
home-manager.users.nathan = import ./home.nix;
2022-11-29 00:45:27 -05:00
# Setup gitea
services.gitea = {
enable = true;
appName = "Stranger Systems Git Mirror";
2023-04-30 22:20:20 -04:00
lfs.enable = true;
2022-11-29 01:04:39 -05:00
settings = {
service = { DISABLE_REGISTRATION = true; };
repository = {
DEFAULT_BRANCH = "trunk";
DISABLE_STARS = true;
ENABLE_PUSH_CREATE_ORG = true;
};
2023-05-30 09:18:20 -04:00
server = {
DOMAIN = "git.stranger.systems";
ROOT_URL = "https://git.stranger.systems";
};
2022-11-29 01:04:39 -05:00
};
2022-11-29 00:45:27 -05:00
};
2022-11-29 01:06:46 -05:00
services.nginx.virtualHosts."git.stranger.systems" = {
2022-11-29 00:45:27 -05:00
enableACME = true;
forceSSL = true;
locations."/" = { proxyPass = "http://localhost:3000"; };
};
2023-03-14 11:33:47 -04:00
# Update later than everyone else, since this one hosts our updates
system.autoUpgrade.dates = "6:00";
2022-11-23 20:36:59 -05:00
}