Restructure

- Restructure
- Add sops+age

hosts/common/core/README.md

@@ -0,0 +1 @@
+System config that is required for any host.

hosts/common/core/default.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+{
+  imports = [
+    ./disko.nix
+    ./locale.nix
+    ./nix.nix
+    ./packages.nix
+    ./sops.nix
+  ];
+}

hosts/common/core/disko.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  disko,
+  lib,
+  inputs,
+  ...
+}:
+with lib;
+let
+  cfg = config.disko.cfg;
+in
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+  ];
+
+  options.disko.cfg = {
+    mainDevice = mkOption {
+      type = types.str;
+      description = "Main disk name";
+    };
+  };
+
+  config = {
+    disko.devices.disk.ssd = {
+      device = cfg.mainDevice;
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          ESP = {
+            name = "ESP";
+            size = "1G";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "btrfs";
+              extraArgs = [
+                "-f"
+                "-L"
+                "root"
+              ];
+              mountpoint = "/";
+              mountOptions = [
+                "compress=zstd"
+                "noatime"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/common/core/locale.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+{
+  time.timeZone = "Europe/Moscow";
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_TIME = "en_GB.UTF-8";
+    };
+  };
+
+  services.xserver.xkb = {
+    layout = "us,ru";
+    options = "eurosign:e,caps:escape";
+  };
+}

hosts/common/core/nix.nix

@@ -0,0 +1,14 @@
+{ config, ... }:
+{
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  nix.gc = {
+    automatic = true;
+    dates = "daily";
+    options = "--delete-older-than +5";
+  };
+  nix.settings.auto-optimise-store = true;
+}

hosts/common/core/packages.nix

@@ -0,0 +1,8 @@
+{ congif, pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    git
+    neovim
+    tmux
+  ];
+}

hosts/common/core/sops.nix

@@ -0,0 +1,17 @@
+{ config, inputs, ... }:
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  sops = {
+    defaultSopsFile = "/etc/sops/secrets.yaml";
+    age.keyFile = "/etc/age/key.txt";
+    validateSopsFiles = false;
+    secrets = {
+      benq-password = {
+          neededForUsers = true;
+      };
+    };
+  };
+}

hosts/common/optional/README.md

@@ -0,0 +1 @@
+Optional config that may or not exist on specific host.

hosts/common/optional/audio.nix

@@ -0,0 +1,7 @@
+{ config, ... }:
+{
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+}

hosts/common/optional/bbr.nix

@@ -0,0 +1,8 @@
+{ config, ... }:
+{
+  boot.kernelModules = [ "tcp_bbr" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.tcp_congestion_control" = "bbr";
+    "net.core.deafult_qdisc" = "fq";
+  };
+}

hosts/common/optional/docker.nix

@@ -0,0 +1,18 @@
+{ config, pkgs, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+  };
+  security.wrappers = {
+    docker-rootlesskit = {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_net_bind_service+ep";
+      source = "${pkgs.rootlesskit}/bin/rootlesskit";
+    };
+  };
+}

hosts/common/optional/endlessh.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  services.endlessh = {
+    enable = true;
+    port = 22;
+    openFirewall = true;
+  };
+
+  systemd.services.endlessh = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+  };
+}

hosts/common/optional/fail2ban.nix

@@ -0,0 +1,8 @@
+{ config, ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 3;
+    bantime = "48h";
+  };
+}

hosts/common/optional/openssh.nix

@@ -0,0 +1,14 @@
+{ config, ... }:
+{
+  services.openssh = {
+    enable = true;
+    ports = [ 6969 ];
+    settings = {
+      PasswordAuthentication = false;
+      PermitEmptyPasswords = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      PubkeyAuthentication = true;
+    };
+  };
+}

hosts/common/users/benq.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+with lib;
+{
+  users = {
+    mutableUsers = false;
+    users.benq = {
+      isNormalUser = true;
+      hashedPasswordFile = config.sops.secrets.benq-password.path;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAeIuJzR68xA4ugJjtWbwvaWEU852Hg9FAAhXNw8ou43 benq"
+      ];
+      extraGroups =
+        let
+        ifTheyExist = groups: filter (group: hasAttr group config.users.groups) groups;
+      in
+        flatten [
+        "wheel"
+          (ifTheyExist [
+           "docker"
+           "git"
+           "networkmanager"
+           "video"
+          ])
+        ];
+    };
+  };
+}