blob: 7f46af826659d884483ea4a9ddac9c45614f8cb3 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
{ pkgs, ... }:
{
# European timezone
time.timeZone = "Europe/Amsterdam";
i18n.defaultLocale = "en_US.UTF-8";
# SSH: key-only, no passwords, no root login
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
KbdInteractiveAuthentication = false;
};
};
# Firewall: SSH, HTTP/HTTPS (Caddy), and AdGuard's own DNS-over-TLS (853) +
# DNS-over-HTTPS (8443) listeners.
# Plain DNS (port 53) is deliberately NOT opened: CERT-Bund/BSI flagged this
# host as an open DNS resolver abusable for UDP reflection/amplification
# DDoS (spoofed source IP, no handshake). AdGuard's plain listener is
# disabled entirely in modules/adguard.nix (dns.port = 0) - all clients use
# DoT/DoH instead, which require a real TLS handshake with the real client
# IP and so aren't spoofable the same way.
# Port 3000 (AdGuard's plain-HTTP web UI) is deliberately NOT opened here -
# see modules/adguard.nix for why it still binds 0.0.0.0 anyway.
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 80 443 853 8443 ];
};
# Nix settings: flakes, auto-gc, auto-optimise
nix = {
settings = {
experimental-features = [ "nix-command" "flakes" ];
auto-optimise-store = true;
trusted-users = [ "root" "admin" ];
};
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 14d";
};
};
# Base system packages
environment.systemPackages = with pkgs; [
git
htop
curl
vim
age
ssh-to-age
sops
];
# Automatic security updates for the OS.
# This repo is self-hosted via cgit (modules/cgit.nix), so the flake URL
# below points at this same server rather than GitHub - update the repo
# name if you push this config somewhere else.
system.autoUpgrade = {
enable = false; # set to true once you are comfortable with unattended reboots
flake = "git+https://git.karanj.com/feynman.git#eurovm";
flags = [ "--update-input" "nixpkgs" ];
};
}
|
