diff options
Diffstat (limited to 'systems/v-proton-jp43/default.nix')
| -rw-r--r-- | systems/v-proton-jp43/default.nix | 106 |
1 files changed, 106 insertions, 0 deletions
diff --git a/systems/v-proton-jp43/default.nix b/systems/v-proton-jp43/default.nix new file mode 100644 index 0000000..5b9c10e --- /dev/null +++ b/systems/v-proton-jp43/default.nix @@ -0,0 +1,106 @@ +{ config, pkgs, lib, ... }: + +with lib; +let + ipv4 = { + address = "172.233.74.234"; + gateway = "172.233.74.1"; + netmask = "255.255.255.0"; + prefixLength = 24; # https://www.pawprint.net/designresources/netmask-converter.php + }; + ipv6 = { + address = "2400:8905::7ab1:59eb:d315:b252"; + gateway = "fe80::1"; + prefixLength = 64; + }; + networkInterface = "eth0"; + hostName = "v-proton-jp43"; + hostId = "3185b70b"; + hostAddr = "172-233-74-234.ip.linodeusercontent.com"; + + sefidelKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILN14b5Fu+StHeMXq4ClyLG4G+/vCAfS7adxceEFria/ openpgp:0x1D5BCD11" ]; + maintainerKeys = [ ] ++ sefidelKeys; +in +{ + deployment = { + targetHost = hostAddr; + targetPort = 22; + targetUser = "root"; + }; + + imports = [ ./hardware-configuration.nix ]; + + networking.hostId = hostId; + + boot.loader.grub.enable = true; + boot.loader.grub.device = "nodev"; + + # Linode tweaks + boot.loader.timeout = 10; # Compensate for LISH + # LISH + boot.loader.grub.extraConfig = '' + serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1; + terminal_input serial; + terminal_output serial + ''; + networking.usePredictableInterfaceNames = false; + + boot.kernelParams = [ + # LISH + "console=ttyS0,19200n8" + # See <https:#www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt> for documentation. + # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip> + # The server ip refers to the NFS server -- not needed in this case. + "ip=${ipv4.address}::${ipv4.gateway}:${ipv4.netmask}:${hostName}-initrd:${networkInterface}:off:8.8.8.8" + ]; + + boot.tmp.cleanOnBoot = true; + zramSwap.enable = true; + + networking.hostName = hostName; + + networking.useDHCP = false; + networking.interfaces.${networkInterface} = { + ipv4 = { addresses = [{ address = ipv4.address; prefixLength = ipv4.prefixLength; }]; }; + ipv6 = { addresses = [{ address = ipv6.address; prefixLength = ipv6.prefixLength; }]; }; + }; + networking.defaultGateway = ipv4.gateway; + networking.defaultGateway6 = { address = ipv6.gateway; interface = networkInterface; }; + networking.nameservers = [ "8.8.8.8" ]; + + networking.firewall.enable = true; + + time.timeZone = "UTC"; + + sops.secrets.root-password.neededForUsers = true; + sops.secrets.pvpn-private-key = { }; + + users.users.root.hashedPasswordFile = config.sops.secrets.root-password.path; + users.users.root.openssh.authorizedKeys.keys = maintainerKeys; + + services.openssh.enable = true; + services.openssh.settings.PermitRootLogin = "prohibit-password"; + + nix.flakes.enable = true; + + modules = { + security.enable = true; + persistence.enable = false; + cachix.enable = true; + + sops.enable = true; + + services.tailscale.enable = true; + }; + + networking.networkmanager.enable = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.05"; # Did you read the comment? +} + |