diff options
| author | Ben Sima <ben@bsima.me> | 2024-11-15 14:55:37 -0500 |
|---|---|---|
| committer | Ben Sima <ben@bsima.me> | 2024-12-21 10:06:49 -0500 |
| commit | 6513755670892983db88a6633b8c1ea6019c03d1 (patch) | |
| tree | 44e9eccdb7a3a74ab7e96a8fee7572dd6a78dc73 /Omni/OsBase.nix | |
| parent | ae7b7e0186b5f2e0dcd4d5fac0a71fa264caedc2 (diff) | |
Re-namespace some stuff to Omni
I was getting confused about what is a product and what is internal
infrastructure; I think it is good to keep those things separate. So I moved a
bunch of stuff to an Omni namespace, actually most stuff went there. Only things
that are explicitly external products are still in the Biz namespace.
Diffstat (limited to 'Omni/OsBase.nix')
| -rw-r--r-- | Omni/OsBase.nix | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/Omni/OsBase.nix b/Omni/OsBase.nix new file mode 100644 index 0000000..3e69d8e --- /dev/null +++ b/Omni/OsBase.nix @@ -0,0 +1,42 @@ +{ pkgs, config, ... }: +let ports = import ./Cloud/Ports.nix; +in { + boot.tmp.cleanOnBoot = true; + fonts.fonts = with pkgs; [ + google-fonts + mononoki + source-code-pro + fantasque-sans-mono + hack-font + fira + fira-code + fira-code-symbols + ]; + networking.firewall.allowPing = true; + nix.settings.substituters = + [ "https://cache.nixos.org" ]; # "ssh://dev.simatime.com" ]; + nix.gc.automatic = true; + nix.gc.dates = "Sunday 02:15"; + nix.optimise.automatic = true; + nix.optimise.dates = [ "Sunday 02:30" ]; + nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ]; + nix.settings.trusted-users = [ "ben" ]; + programs.ccache.enable = true; + programs.mosh.enable = true; + programs.mosh.withUtempter = true; + security.acme.defaults.email = "ben@bsima.me"; + security.acme.acceptTerms = true; + security.sudo.wheelNeedsPassword = false; + services.clamav.daemon.enable = true; # security + services.clamav.updater.enable = true; # security + services.fail2ban.enable = true; # security + services.fail2ban.ignoreIP = [ ports.bensIp ]; # my home IP + services.fail2ban.maxretry = 10; + services.openssh.enable = true; + services.openssh.openFirewall = true; + services.openssh.settings.X11Forwarding = true; + services.openssh.settings.PasswordAuthentication = false; + services.openssh.settings.PermitRootLogin = "prohibit-password"; + system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin + zramSwap.enable = true; +} |