diff options
Diffstat (limited to 'Omni/Os')
| -rw-r--r-- | Omni/Os/Base.nix | 35 | ||||
| -rw-r--r-- | Omni/Os/Boot.nix | 14 |
2 files changed, 49 insertions, 0 deletions
diff --git a/Omni/Os/Base.nix b/Omni/Os/Base.nix new file mode 100644 index 0000000..8e301e1 --- /dev/null +++ b/Omni/Os/Base.nix @@ -0,0 +1,35 @@ +{ config, ... }: + +# This module defines common default settings that all OS builds should include. + +let ports = import ../Cloud/Ports.nix; +in { + boot.tmp.cleanOnBoot = true; + networking.firewall.allowPing = true; + nix.settings.substituters = + [ "https://cache.nixos.org" ]; # "ssh://dev.simatime.com" ]; + nix.gc.automatic = true; + nix.gc.dates = "Sunday 02:15"; + nix.optimise.automatic = true; + nix.optimise.dates = [ "Sunday 02:30" ]; + nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ]; + nix.settings.trusted-users = [ "ben" ]; + programs.ccache.enable = true; + programs.mosh.enable = true; + programs.mosh.withUtempter = true; + security.acme.defaults.email = "ben@bsima.me"; + security.acme.acceptTerms = true; + security.sudo.wheelNeedsPassword = false; + services.clamav.daemon.enable = true; # security + services.clamav.updater.enable = true; # security + services.fail2ban.enable = true; # security + services.fail2ban.ignoreIP = [ ports.bensIp ]; # my home IP + services.fail2ban.maxretry = 10; + services.openssh.enable = true; + services.openssh.openFirewall = true; + services.openssh.settings.X11Forwarding = true; + services.openssh.settings.PasswordAuthentication = false; + services.openssh.settings.PermitRootLogin = "prohibit-password"; + system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin + zramSwap.enable = true; +} diff --git a/Omni/Os/Boot.nix b/Omni/Os/Boot.nix new file mode 100644 index 0000000..c789d89 --- /dev/null +++ b/Omni/Os/Boot.nix @@ -0,0 +1,14 @@ +{ bild }: +/* This target creates a qcow2 image of a barebones NixOS VM which should be used + to bootstrap a deployment target. + + The workflow is like this: + + - bild this, you get a qcow2 image + - go to https://cloud.digitalocean.com/images/custom_images + - upload the image + - start a new droplet with this image + - once fully provisioned and accessible via ssh, the new droplet can be a deploy + target for any other namespace +*/ +bild.droplet { imports = [ ./Base.nix ../Users.nix ]; } |