From f4b8c0df041b063c0b47d2ec6c818a9c202fd833 Mon Sep 17 00:00:00 2001
From: Ben Sima <ben@bsima.me>
Date: Wed, 15 Apr 2020 09:54:10 -0700
Subject: Re-namespacing

Moving away from the DNS-driven namespacing toward more condensed names,
mostly because I don't like typing so much.
---
 Biz/buildOS.nix | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 Biz/buildOS.nix

(limited to 'Biz/buildOS.nix')

diff --git a/Biz/buildOS.nix b/Biz/buildOS.nix
new file mode 100644
index 0000000..9e6c2f2
--- /dev/null
+++ b/Biz/buildOS.nix
@@ -0,0 +1,56 @@
+nixos:
+{ ipAddress ? null
+, enableVpn ? false
+, vpnConnectTo ? ""
+, vpnRsaPrivateKeyFile ? null
+, vpnEd25519PrivateKeyFile ? null
+, deps ? {} # an attrset overlayed to pkgs
+, configuration # see: configuration.nix(5)
+}:
+# assert enableVpn -> builtins.isString ipAddress;
+# assert enableVpn -> builtins.isString vpnRsaPrivateKeyFile;
+# assert enableVpn -> builtins.isString vpnEd25519PrivateKeyFile;
+let
+  vpnExtraConfig = if enableVpn then ''
+    ConnectTo = ${vpnConnectTo}
+    Ed25519PrivateKeyFile = "${vpnEd25519PrivateKeyFile}"
+    PrivateKeyFile = "${vpnRsaPrivateKeyFile}"
+  '' else "";
+  overlay = self: super: deps;
+  defaults = {
+    boot.cleanTmpDir = true;
+    #networking.interfaces.simatime-vpn = [{ ipv4.address = ipAddress; }];
+    networking.firewall.allowPing = true;
+    nix.binaryCaches = [ "https://cache.nixos.org" ];
+    nix.gc.automatic = true;
+    nix.gc.dates = "Sunday 02:15";
+    nix.maxJobs = 1; # "auto";
+    nix.optimise.automatic = true;
+    nix.optimise.dates = [ "Sunday 02:30" ];
+    nixpkgs.overlays = [ overlay ];
+    programs.mosh.enable = true;
+    programs.mosh.withUtempter = true;
+    security.acme.email = "ben@bsima.me";
+    security.acme.acceptTerms = true;
+    security.sudo.wheelNeedsPassword = false;
+    services.clamav.daemon.enable = true; # security
+    services.clamav.updater.enable = true; # security
+    services.fail2ban.enable = true; # security
+    services.openssh.enable = true;
+    services.openssh.openFirewall = true;
+    services.openssh.forwardX11 = true;
+    services.openssh.passwordAuthentication = false;
+    #services.tinc.networks.simatime-vpn.extraConfig = vpnExtraConfig;
+    #services.tinc.networks.simatime-vpn.debugLevel = 3;
+    #services.tinc.networks.simatime-vpn.interfaceType = "tap";
+    #services.tinc.networks.simatime-vpn.hosts = import ./vpnHosts.nix;
+    system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin
+  };
+  os = nixos {
+    system = "x86_64-linux";
+    configuration = (defaults // configuration);
+  };
+in {
+   system = os.system;
+   vm = os.vm;
+}
-- 
cgit v1.2.3