Add system modules

configuration.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./home-manager.nix
+		./modules/system
     ./hardware-configuration.nix
   ];
 
@@ -14,9 +15,6 @@
     efi.canTouchEfiVariables = true;
   };
 
-  networking.hostName = "benq-serv";
-  networking.networkmanager.enable = true;
-
   time.timeZone = "Europe/Moscow";
 
   i18n = { 
@@ -39,13 +37,9 @@
   environment.systemPackages = with pkgs; [
     git
     vim
+		tmux
   ];
 
-  services.openssh.enable = true;
-
-  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
-  networking.firewall.allowedUDPPorts = [];
-
   system.stateVersion = "25.05";
 }
 

flake.lock

@@ -1,5 +1,25 @@
 {
   "nodes": {
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772807318,
+        "narHash": "sha256-Qjw6ILt8cb2HQQpCmWNLMZZ63wEo1KjTQt+1BcQBr7k=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "daa2c221320809f5514edde74d0ad0193ad54ed8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1772542754,
@@ -18,6 +38,7 @@
     },
     "root": {
       "inputs": {
+        "home-manager": "home-manager",
         "nixpkgs": "nixpkgs"
       }
     }

flake.nix

@@ -3,13 +3,23 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs }@inputs: {
+  outputs = { self, nixpkgs, ... }@inputs: 
+  let
+    system = "x86_64-linux";
+  in
+  {
     nixosConfigurations.nixos = nixpkgs.lib.nixosSystem {
+      inherit system;
       specialArgs = { inherit inputs; };
       modules = [
         ./configuration.nix
+        inputs.home-manager.nixosModules.home-manager
       ];
     }; 
   };

home-manager.nix

@@ -1,23 +1,15 @@
-{ config, pkgs, lib, ... }:
-let
-  home-manager = builtins.fetchTarball { 
-    url = "https://github.com/nix-community/home-manager/archive/release-25.05.tar.gz";
-    sha256 = "07pk5m6mxi666dclaxdwf7xrinifv01vvgxn49bjr8rsbh31syaq";
+{ config, pkgs, ... }: {
+	users.users.benq = { 
+		isNormalUser = true;
+		extraGroups = [ "wheel" ];
 	};
-in
-{
-  imports = [
-    (import "${home-manager}/nixos")
-  ];
-
-  users.users.benq.isNormalUser = true;
 
 	home-manager = {
 		useGlobalPkgs = true;
+		useUserPackages = true;
 		users.benq = { pkgs, ... }: {
 			home.packages = with pkgs; [
 				lazygit       
-	tmux
 			];
 			home.stateVersion = "25.05";
 		};

modules/system/default.nix

@@ -0,0 +1,8 @@
+{ config, ... }: {
+  imports = [
+		./docker.nix
+		./gc.nix
+		./network.nix
+		./openssh.nix
+	];
+}

modules/system/docker.nix

@@ -0,0 +1,6 @@
+{ config, ... }: {
+	virtualisation.docker.rootless = {
+		enable = true;
+		setSocketVariable = true;
+	};
+}	

modules/system/gc.nix

@@ -0,0 +1,8 @@
+{ config, ... }: {
+  nix.gc = {
+    automatic = true;
+    dates = "daily";
+    options = "--delete-older-than +5";
+  };
+  nix.settings.auto-optimise-store = true;
+}

modules/system/network.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }: {
+  networking.hostName = "benq-serv";
+  networking.networkmanager.enable = true;
+
+  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  networking.firewall.allowedUDPPorts = [];
+
+  boot.kernelModules = [ "tcp_bbr" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.tcp_congestion_control" = "bbr";
+    "net.core.default_qdisc" = "fq";
+  };
+}

modules/system/openssh.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, ... }: {
+  services.openssh = {
+    enable = true;
+		ports = [ 6969 ];
+		settings = {
+			PasswordAuthentication = false;
+			PermitEmptyPasswords = false;
+			KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      PubkeyAuthentication = true;
+		};
+	};
+
+  services.fail2ban = { 
+		enable = true;
+		maxretry = 3;
+		bantime = "48h";
+	};
+
+	services.endlessh = {
+		enable = true;
+		port = 22;
+    openFirewall = true;
+  };
+
+	systemd.services.endlessh = {
+		wantedBy = [ "multi-user.target" ];
+		after = [ "network.target" ];
+	};
+}