toph/dot.nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Moved ssh into its own module

Browse source
This commit is contained in:
Chris Toph 2024-09-07 17:39:33 -04:00
parent 4b263f7ba0
commit 22ded466b3
2 changed files with 38 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
nixos/default.nix
View file

@ -1,11 +1,17 @@
{ modulesPath, config, pkgs, ... }: { modulesPath, config, pkgs, ... }:
let let
hostname = "cloud"; hostname = "cloud";
admin = "toph"; admin = "toph";
password = "[REDACTED]"; password = "[REDACTED]";
timeZone = "America/New_York"; timeZone = "America/New_York";
defaultLocale = "en_US.UTF-8"; defaultLocale = "en_US.UTF-8";
in { in {
## MODULES & IMPORTS ##
imports = imports =
[ [
# Include the default lxc/lxd configuration. # Include the default lxc/lxd configuration.
@ -14,6 +20,7 @@ in {
./hardware-configuration.nix ./hardware-configuration.nix
# Module imports # Module imports
# ACME # ACME
./modules/acme ./modules/acme
# Nextcloud # Nextcloud
@ -22,12 +29,11 @@ in {
./modules/nginx ./modules/nginx
# Snapraid-runner # Snapraid-runner
./modules/snapraid ./modules/snapraid
# SSH
./modules/ssh
]; ];
# OVERLAYS for custom packages. ## NETWORKING ##
nixpkgs.overlays = [ (import ./overlays) ];
# NETWORKING
networking = { networking = {
firewall = { firewall = {
allowedTCPPorts = [ 80 443 ]; allowedTCPPorts = [ 80 443 ];
@ -51,14 +57,14 @@ in {
}; };
}; };
# LOCALE ## TIMEZONE & LOCALE ##
time.timeZone = timeZone; time.timeZone = timeZone;
i18n.defaultLocale = defaultLocale; i18n.defaultLocale = defaultLocale;
# USERS ## USERS ##
users = { users = {
mutableUsers = false; mutableUsers = false;
users ={ users = {
"${admin}" = { "${admin}" = {
isNormalUser = true; isNormalUser = true;
createHome = true; createHome = true;
@ -77,7 +83,7 @@ in {
}; };
}; };
# Enable passwordless sudo. # INFO: Enable passwordless sudo.
security.sudo.extraRules= [ security.sudo.extraRules= [
{ users = [ admin ]; { users = [ admin ];
commands = [ commands = [
@ -88,7 +94,9 @@ in {
} }
]; ];
# SYSTEM PACKAGES ## PACKAGES ##
nixpkgs.overlays = [ (import ./overlays) ];
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
git git
mergerfs mergerfs
@ -101,34 +109,13 @@ in {
wget wget
]; ];
# PROGRAMS & SERVICES ## PROGRAMS & SERVICES ##
programs.ssh.startAgent = true;
# Shells # Shells
environment.shells = with pkgs; [ bash fish ]; environment.shells = with pkgs; [ bash fish ];
programs.fish.enable = true; programs.fish.enable = true;
# OpenSSH service configuration. ## NIXOS ##
services.openssh = {
enable = true;
settings = {
AllowUsers = null; # everyone
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
};
# Enable sound.
# hardware.pulseaudio.enable = true;
# OR
# services.pipewire = {
# enable = true;
# pulse.enable = true;
# };
# Enable touchpad support (enabled default in most desktopManager).
# services.libinput.enable = true;
# LXC specific configuration # LXC specific configuration
# Supress systemd units that don't work because of LXC. # Supress systemd units that don't work because of LXC.
@ -139,14 +126,8 @@ in {
"sys-fs-fuse-connections.mount" "sys-fs-fuse-connections.mount"
]; ];
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This value determines the NixOS release with which your system is to be # This value determines the NixOS release with which your system is to be
system.stateVersion = "24.11"; system.stateVersion = "24.11";
# Enable Flakes # Enable Flakes
nix.settings.experimental-features = [ "nix-command" "flakes" ]; nix.settings.experimental-features = [ "nix-command" "flakes" ];
} }

17
nixos/modules/ssh/default.nix Normal file
View file

@ -0,0 +1,17 @@
{
programs.ssh.startAgent = true;
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClZstYoT64zHnGfE7LMYNiQPN5/gmCt382lC+Ji8lrH PVE"
];
services.openssh = {
enable = true;
settings = {
AllowUsers = null; # everyone
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PermitRootLogin = "no";
};
};
}