blob: 1ec2aa7cdd0800c4b9b071700d23f2e5ee630cbb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
{
config,
modulesPath,
machine,
...
}: rec {
# mailserver config
mailserver = {
enable = true;
stateVersion = 3;
fqdn = "mail.${networking.domain}";
domains = ["${networking.domain}"];
x509.useACMEHost = config.mailserver.fqdn;
loginAccounts = {
"test@${networking.domain}" = {
hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
};
};
};
# cert config
security.acme = {
acceptTerms = true;
defaults.email = "mtgmonket@gmail.com";
};
services.nginx = {
enable = true;
virtualHosts."mail.${networking.domain}" = {
forceSSL = true;
enableACME = true;
};
};
# system config
system.stateVersion = "25.11";
nix.settings.experimental-features = ["flakes" "nix-command"];
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
fileSystems."/" = {
device = "/dev/sda1";
fsType = "ext4";
};
boot.loader.grub.device = "/dev/sda";
boot.loader.timeout = 30;
boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront"];
boot.initrd.kernelModules = ["nvme"];
boot.tmp.cleanOnBoot = true;
zramSwap.enable = true;
networking = {
useNetworkd = true;
usePredictableInterfaceNames = true;
hostName = machine.hostname;
domain = "galaxious.de";
firewall = {
enable = true;
allowedTCPPorts = [80 443];
allowedUDPPorts = [80 443];
};
};
systemd.network = {
enable = true;
networks."40-wan" = {
matchConfig.Name = "enx0050565f4fff";
address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
routes = [
{
Gateway = "109.199.96.1";
GatewayOnLink = true;
}
{Gateway = "fe80::1";}
];
dns = ["2620:fe::fe" "9.9.9.9"];
};
};
services.openssh.enable = true;
users.mutableUsers = false;
users.users.root.openssh.authorizedKeys.keys = [config.pub-keys.ssh.andromeda];
programs.noshell.enable = true;
}
|
