85 lines
1.9 KiB
Nix
85 lines
1.9 KiB
Nix
{ config, lib, pkgs, inputs, ... }:
|
|
|
|
{
|
|
# Sops setup for this machine
|
|
sops.secrets = {
|
|
"borg-ssh-key" = {
|
|
sopsFile = ../../secrets/fusion/borg.yaml;
|
|
format = "yaml";
|
|
};
|
|
"borg-password" = {
|
|
sopsFile = ../../secrets/fusion/borg.yaml;
|
|
format = "yaml";
|
|
};
|
|
};
|
|
# Setup system configuration
|
|
nathan = {
|
|
services = {
|
|
nginx = {
|
|
enable = true;
|
|
acme = true;
|
|
};
|
|
borg = {
|
|
enable = true;
|
|
extraExcludes = [ "/var/log" ];
|
|
passwordFile = config.sops.secrets."borg-password".path;
|
|
sshKey = config.sops.secrets."borg-ssh-key".path;
|
|
};
|
|
};
|
|
config = {
|
|
setupGrub = false;
|
|
nix = {
|
|
autoUpdate = true;
|
|
autoGC = true;
|
|
};
|
|
harden = false;
|
|
};
|
|
};
|
|
# Configure bootloader
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
boot.kernelParams = [ "net.ifnames=0" ];
|
|
# Configure networking
|
|
networking = {
|
|
domain = "mccarty.io";
|
|
useDHCP = true;
|
|
nameservers = [ "1.1.1.1" ];
|
|
# Open ports in firewall
|
|
firewall = {
|
|
allowedTCPPorts = [ ];
|
|
allowedUDPPorts = [ ];
|
|
};
|
|
};
|
|
|
|
# Setup home manager
|
|
home-manager.users.nathan = import ./home.nix;
|
|
|
|
# Setup gitea
|
|
services.gitea = {
|
|
enable = true;
|
|
appName = "Stranger Systems Git Mirror";
|
|
lfs.enable = true;
|
|
settings = {
|
|
service = { DISABLE_REGISTRATION = true; };
|
|
repository = {
|
|
DEFAULT_BRANCH = "trunk";
|
|
DISABLE_STARS = true;
|
|
ENABLE_PUSH_CREATE_ORG = true;
|
|
};
|
|
server = {
|
|
DOMAIN = "git.stranger.systems";
|
|
ROOT_URL = "https://git.stranger.systems";
|
|
};
|
|
};
|
|
};
|
|
services.nginx.virtualHosts."git.stranger.systems" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/" = { proxyPass = "http://localhost:3000"; };
|
|
};
|
|
|
|
# Update later than everyone else, since this one hosts our updates
|
|
system.autoUpgrade.dates = "6:00";
|
|
|
|
}
|