Restructure

- Restructure
- Add sops+age

hosts/common/optional/README.md

@@ -0,0 +1 @@
+Optional config that may or not exist on specific host.

hosts/common/optional/audio.nix

@@ -0,0 +1,7 @@
+{ config, ... }:
+{
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+}

hosts/common/optional/bbr.nix

@@ -0,0 +1,8 @@
+{ config, ... }:
+{
+  boot.kernelModules = [ "tcp_bbr" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.tcp_congestion_control" = "bbr";
+    "net.core.deafult_qdisc" = "fq";
+  };
+}

hosts/common/optional/docker.nix

@@ -0,0 +1,18 @@
+{ config, pkgs, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+  };
+  security.wrappers = {
+    docker-rootlesskit = {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_net_bind_service+ep";
+      source = "${pkgs.rootlesskit}/bin/rootlesskit";
+    };
+  };
+}

hosts/common/optional/endlessh.nix

@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+  services.endlessh = {
+    enable = true;
+    port = 22;
+    openFirewall = true;
+  };
+
+  systemd.services.endlessh = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+  };
+}

hosts/common/optional/fail2ban.nix

@@ -0,0 +1,8 @@
+{ config, ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 3;
+    bantime = "48h";
+  };
+}

hosts/common/optional/openssh.nix

@@ -0,0 +1,14 @@
+{ config, ... }:
+{
+  services.openssh = {
+    enable = true;
+    ports = [ 6969 ];
+    settings = {
+      PasswordAuthentication = false;
+      PermitEmptyPasswords = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      PubkeyAuthentication = true;
+    };
+  };
+}