111 lines
2.3 KiB
Nix
111 lines
2.3 KiB
Nix
{ hostName, config, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
|
|
../../common/boot.nix
|
|
../../common/locales.nix
|
|
../../common/nix.nix
|
|
../../common/users.nix
|
|
|
|
../../modules/nixos/bash.nix
|
|
../../modules/nixos/tailscale.nix
|
|
];
|
|
|
|
fileSystems = {
|
|
"/".options = [ "compress=zstd" ];
|
|
"/home".options = [ "compress=zstd" ];
|
|
"/nix".options = [ "compress=zstd" "noatime" ];
|
|
"/swap".options = [ "noatime" ];
|
|
};
|
|
|
|
swapDevices = [{
|
|
device = "/swap/swapfile";
|
|
size = 8192;
|
|
}];
|
|
|
|
networking.hostName = "${hostName}";
|
|
|
|
environment.defaultPackages = lib.mkForce [];
|
|
|
|
programs.git = {
|
|
enable = true;
|
|
config = {
|
|
user = {
|
|
name = "wo2wz";
|
|
email = "189177184+wo2wz@users.noreply.github.com";
|
|
};
|
|
safe.directory = "/etc/nixos";
|
|
};
|
|
};
|
|
|
|
services = {
|
|
scx.scheduler = lib.mkForce "scx_rusty";
|
|
|
|
cloudflared = {
|
|
enable = true;
|
|
tunnels = {
|
|
|
|
};
|
|
};
|
|
|
|
caddy = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"drone.taild5f7e6.ts.net".extraConfig = ''
|
|
encode
|
|
|
|
# most of this doesnt matter but why not
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000;"
|
|
X-Frame-Options "SAMEORIGIN"
|
|
X-Content-Type-Options "nosniff"
|
|
-Server
|
|
-X-Powered-By
|
|
}
|
|
|
|
# block connections to admin login
|
|
respond /admin/* 403
|
|
|
|
reverse_proxy localhost:8000
|
|
'';
|
|
# "example.com".extraConfig = ''
|
|
# encode
|
|
|
|
# header {
|
|
# Strict-Transport-Security "max-age=31536000;"
|
|
# X-Frame-Options "DENY"
|
|
# X-Content-Type-Options "nosniff"
|
|
# # nobody is gonna find this site through a search engine anyway
|
|
# X-Robots-Tag "noindex, nofollow"
|
|
# -Server
|
|
# -X-Powered-By
|
|
# }
|
|
|
|
# reverse_proxy localhost:3000
|
|
# '';
|
|
};
|
|
};
|
|
|
|
tailscale.permitCertUid = "caddy"; # allow caddy to manage tailscale ssl certs
|
|
|
|
vaultwarden = {
|
|
enable = true;
|
|
backupDir = "/var/backups/vaultwarden";
|
|
config = {
|
|
DOMAIN = "https://drone.taild5f7e6.ts.net";
|
|
|
|
SIGNUPS_ALLOWED = false;
|
|
};
|
|
environmentFile = "/var/secrets/vaultwarden/secrets.env";
|
|
};
|
|
|
|
zipline = {
|
|
enable = true;
|
|
environmentFiles = [ "/var/secrets/zipline/secrets.env" ];
|
|
};
|
|
};
|
|
|
|
system.stateVersion = "25.05";
|
|
}
|