From 0d0788cd4ee378fba19e47a2c5d5527c196b65e0 Mon Sep 17 00:00:00 2001
From: Karan Jayachandra <karan.jayachandra@nxp.com>
Date: Fri, 17 Jul 2026 14:34:18 +0200
Subject: Initial commit

---
 modules/common.nix | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 modules/common.nix

(limited to 'modules/common.nix')

diff --git a/modules/common.nix b/modules/common.nix
new file mode 100644
index 0000000..e5c38d4
--- /dev/null
+++ b/modules/common.nix
@@ -0,0 +1,56 @@
+{ pkgs, ... }:
+
+{
+  # European timezone
+  time.timeZone = "Europe/Amsterdam";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  # SSH: key-only, no passwords, no root login
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+      KbdInteractiveAuthentication = false;
+    };
+  };
+
+  # Firewall: only allow SSH, HTTP, HTTPS, and DNS (for AdGuard)
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 80 443 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+
+  # Nix settings: flakes, auto-gc, auto-optimise
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+      trusted-users = [ "root" "admin" ];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 14d";
+    };
+  };
+
+  # Base system packages
+  environment.systemPackages = with pkgs; [
+    git
+    htop
+    curl
+    vim
+    age
+    ssh-to-age
+    sops
+  ];
+
+  # Automatic security updates for the OS
+  system.autoUpgrade = {
+    enable = false; # set to true once you are comfortable with unattended reboots
+    flake = "github:YOUR_USERNAME/nix#eurovm"; # update to your actual flake URL
+    flags = [ "--update-input" "nixpkgs" ];
+  };
+}
-- 
cgit v1.3.1