blob: e5c38d4e314077c15708f5cef2738ed847b2b3df (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
{ pkgs, ... }:
{
# European timezone
time.timeZone = "Europe/Amsterdam";
i18n.defaultLocale = "en_US.UTF-8";
# SSH: key-only, no passwords, no root login
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
PermitRootLogin = "no";
KbdInteractiveAuthentication = false;
};
};
# Firewall: only allow SSH, HTTP, HTTPS, and DNS (for AdGuard)
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 80 443 53 ];
allowedUDPPorts = [ 53 ];
};
# Nix settings: flakes, auto-gc, auto-optimise
nix = {
settings = {
experimental-features = [ "nix-command" "flakes" ];
auto-optimise-store = true;
trusted-users = [ "root" "admin" ];
};
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 14d";
};
};
# Base system packages
environment.systemPackages = with pkgs; [
git
htop
curl
vim
age
ssh-to-age
sops
];
# Automatic security updates for the OS
system.autoUpgrade = {
enable = false; # set to true once you are comfortable with unattended reboots
flake = "github:YOUR_USERNAME/nix#eurovm"; # update to your actual flake URL
flags = [ "--update-input" "nixpkgs" ];
};
}
|
