machines/109-199-104-83/configuration.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

{
  modulesPath,
  machine,
  ...
}: {
  system.stateVersion = "25.11";
  nix.settings.experimental-features = ["flakes" "nix-command"];

  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
  fileSystems = {
    "/" = {
      device = "none";
      fsType = "tmpfs";
      options = ["defaults" "size=30%" "mode=755"];
    };
    "/mnt" = {
      device = "/dev/sda1";
      fsType = "ext4";
    };
    "/boot" = {
      device = "/mnt/boot";
      fsType = "none";
      options = ["bind"];
    };
    "/nix" = {
      device = "/mnt/nix";
      fsType = "none";
      options = ["bind"];
    };
  };
  boot.loader.grub.device = "/dev/sda";
  boot.loader.timeout = 30;
  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
  boot.initrd.kernelModules = ["nvme"];
  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;

  networking = {
    useNetworkd = true;
    usePredictableInterfaceNames = true;
    hostName = machine.hostname;
    domain = "galaxious.de";
  };
  systemd.network = {
    enable = true;
    networks."40-wan" = {
      matchConfig.Name = "enx0050565f4fff";
      address = ["2a02:c207:2299:8419::1/64" "109.199.104.83/20"];
      routes = [
        {
          Gateway = "109.199.96.1";
          GatewayOnLink = true;
        }
        {Gateway = "fe80::1";}
      ];
      dns = ["2620:fe::fe" "9.9.9.9"];
    };
  };

  services.openssh = {
    enable = true;
    allowSFTP = false;
    ports = [5522];
    settings = {
      PermitRootLogin = "no";
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = true;
    };
    extraConfig = ''
      AllowTcpForwarding no
      AllowAgentForwarding no
      MaxAuthTries 3
      MaxSessions 4
      TCPKeepAlive no
    '';
  };
  users.users.root.openssh.authorizedKeys.keys = [];
  age.secrets.secret2.file = ../../secrets/secret2.age;
  environment.persistence."/nix/persist" = {
    enable = true;
    hideMounts = true;
    directories = [
      "/var/log"
      "/var/lib/nixos"
      "/var/lib/systemd/coredump"
      "/etc/NetworkManager/system-connections"
    ];
    files = [
      "/etc/machine-id"
    ];
  };
  programs.noshell.enable = true;
}