Move defaults/base-minimal to nixos-modules/system

2025-03-21 19:54:39 +02:00 · 2025-03-21 19:54:39 +02:00 · 94510a8cd9
commit 94510a8cd9
parent 0abeadc533
9 changed files with 0 additions and 2 deletions
--- a/nixos-modules/system/default.nix
+++ b/nixos-modules/system/default.nix
@ -0,0 +1,126 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  imports = [
+    ./unfree.nix
+    ./applications.nix
+    ./overlays.nix
+    ./security.nix
+  ];
+
+  boot.loader.timeout = 2;
+  boot.tmp.useTmpfs = true;
+  boot.loader.grub.splashImage = null;
+
+  console.keyMap = "de_CH-latin1";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  boot.kernel.sysctl = {
+    "kernel.panic" = 20; # Reboot kernel on panic after this much seconds
+  };
+
+  boot.initrd.network.udhcpc.extraArgs = [
+    "-A"
+    "900" # Wait for a DHCP lease on boot for 15mins
+  ];
+
+  systemd.watchdog = {
+    runtimeTime = "5m";
+    rebootTime = "10m";
+  };
+
+  users.mutableUsers = false;
+  users.users = {
+    root.openssh.authorizedKeys.keys =
+      with lib;
+      concatLists (
+        mapAttrsToList (
+          name: user:
+          if elem "wheel" user.extraGroups && name != "root" then user.openssh.authorizedKeys.keys else [ ]
+        ) config.users.users
+      );
+  };
+
+  # Disable dependency on xorg
+  # TODO: Set environment.noXlibs on hosts that don't need any x libraries.
+  security.pam.services.su.forwardXAuth = lib.mkForce false;
+
+  # Package management
+  nix = {
+    settings =
+      let
+        substituters = [
+          "https://${inputs.self.nixosConfigurations.lindberg-build.config.qois.nixpkgs-cache.hostname}?priority=39"
+          "https://cache.nixos.org?priority=40"
+          "https://attic.qo.is/qois-infrastructure"
+        ];
+      in
+      {
+        trusted-users = [
+          "root"
+          "@wheel"
+        ];
+        trusted-public-keys = [
+          "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "qois-infrastructure:lh35ymN7Aoxm5Hz0S6JusxE+cYzMU+x9OMKjDVIpfuE="
+        ];
+        trusted-substituters = substituters; # For hosts that limit the subst list
+        inherit substituters;
+      };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 90d";
+    };
+    package = pkgs.nixVersions.stable;
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  # Network services
+  networking.firewall = {
+    allowPing = true;
+    allowedTCPPorts = [ 22 ];
+  };
+
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "sysadmin@qo.is";
+  };
+
+  # Default Settings
+  environment.etc = {
+    gitconfig.source = ./etc/gitconfig;
+    vimrc.source = ./etc/vimrc;
+  };
+
+  programs.autojump.enable = true;
+  programs.vim = {
+    enable = true;
+    defaultEditor = true;
+  };
+
+  sops.defaultSopsFile =
+    let
+      defaultSopsPath = "${inputs.private}/nixos-configurations/${config.networking.hostName}/secrets.sops.yaml";
+    in
+    lib.mkIf (builtins.pathExists defaultSopsPath) defaultSopsPath;
+
+  services.fstrim.enable = true;
+
+  qois.outgoing-server-mail.enable = true;
+  qois.backup-client.enable = true;
+
+  systemd.extraConfig = "DefaultLimitNOFILE=4096";
+}