Add system modules

modules/system/default.nix

@@ -0,0 +1,8 @@
+{ config, ... }: {
+  imports = [
+		./docker.nix
+		./gc.nix
+		./network.nix
+		./openssh.nix
+	];
+}

modules/system/docker.nix

@@ -0,0 +1,6 @@
+{ config, ... }: {
+	virtualisation.docker.rootless = {
+		enable = true;
+		setSocketVariable = true;
+	};
+}	

modules/system/gc.nix

@@ -0,0 +1,8 @@
+{ config, ... }: {
+  nix.gc = {
+    automatic = true;
+    dates = "daily";
+    options = "--delete-older-than +5";
+  };
+  nix.settings.auto-optimise-store = true;
+}

modules/system/network.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }: {
+  networking.hostName = "benq-serv";
+  networking.networkmanager.enable = true;
+
+  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  networking.firewall.allowedUDPPorts = [];
+
+  boot.kernelModules = [ "tcp_bbr" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.tcp_congestion_control" = "bbr";
+    "net.core.default_qdisc" = "fq";
+  };
+}

modules/system/openssh.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, ... }: {
+  services.openssh = {
+    enable = true;
+		ports = [ 6969 ];
+		settings = {
+			PasswordAuthentication = false;
+			PermitEmptyPasswords = false;
+			KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      PubkeyAuthentication = true;
+		};
+	};
+
+  services.fail2ban = { 
+		enable = true;
+		maxretry = 3;
+		bantime = "48h";
+	};
+
+	services.endlessh = {
+		enable = true;
+		port = 22;
+    openFirewall = true;
+  };
+
+	systemd.services.endlessh = {
+		wantedBy = [ "multi-user.target" ];
+		after = [ "network.target" ];
+	};
+}